@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.9 → 3.9.3-ultramodern.1

package/src/release-envelope/framework-output.ts

@@ -1,25 +1,37 @@
 import { createHash } from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import {
+  assertRendererProfileCompatibility,
   BACKEND_FEDERATION_MANIFEST_FILE,
   BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
   isUltramodernBuildArtifact,
+  type RendererProfile,
   ULTRAMODERN_BUILD_ARTIFACT_FILE,
+  ULTRAMODERN_BUILD_ARTIFACT_PATH,
   type UltramodernBuildArtifact,
 } from '@modern-js/backend-federation-contracts';
+import { readBuildIdentity } from '../backend-federation-build/config';
+import {
+  resolveTopologyDeliveryUnit,
+  resolveTopologyReleaseRole,
+  resolveWorkerDeliveryUnitStamp,
+} from '../cloudflare/delivery-unit';
 import {
   canonicalSerializeMicroVerticalReleaseEnvelope,
   createMicroVerticalReleaseEnvelope,
   verifyMicroVerticalReleaseEnvelope,
 } from './index';
-import type {
-  MicroVerticalReleaseArtifact,
-  MicroVerticalReleaseArtifactInput,
-  MicroVerticalReleaseEnvelope,
-  MicroVerticalReleaseIdentity,
-  MicroVerticalReleaseSurfaces,
-  MicroVerticalReleaseTarget,
+import {
+  type MicroVerticalReleaseArtifact,
+  type MicroVerticalReleaseArtifactInput,
+  type MicroVerticalReleaseIdentity,
+  type MicroVerticalReleaseSurfaces,
+  type MicroVerticalReleaseTarget,
+  type MicroVerticalReleaseUi,
+  type ReleaseEnvelope,
+  SHELL_RELEASE_ENVELOPE_KIND,
 } from './types';
 
 export const MICROVERTICAL_RELEASE_ENVELOPE_PATH =
@@ -33,6 +45,42 @@ const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_SCHEMA_VERSION = 1;
 
 const COMPILED_MODULE_PATTERN = /\.(?:c|m)?js$/u;
 const EFFECT_BFF_WORKER_PATTERN = /^worker\/__modern_bff_effect\.(?:c|m)?js$/u;
+const EFFECT_BFF_WORKER_SUPPORT_PATTERN =
+  /^worker\/__modern_worker_(?:runtime|shared)_*\.(?:c|m)?js$/u;
+const isEffectBffWorkerArtifact = (logicalPath: string) =>
+  EFFECT_BFF_WORKER_PATTERN.test(logicalPath) ||
+  EFFECT_BFF_WORKER_SUPPORT_PATTERN.test(logicalPath);
+const effectBffWorkerArtifacts = (files: string[]) =>
+  files.some(logicalPath => EFFECT_BFF_WORKER_PATTERN.test(logicalPath))
+    ? files.filter(isEffectBffWorkerArtifact)
+    : [];
+const CRAWLER_POLICY_PATH = 'public/robots.txt';
+const isPublicMetadataPath = (logicalPath: string) =>
+  logicalPath === 'public/_headers' ||
+  /^public\/\.well-known\/[^/]+\.json$/u.test(logicalPath);
+const PUBLIC_BUILD_ARTIFACT_PATH = `public/${ULTRAMODERN_BUILD_ARTIFACT_FILE}`;
+// Files an app declared through `deploy.<target>.publicAssets`. The deploy
+// output stages them from app-root sources; they are served data, not a
+// UI/client surface, so API-only units may carry them.
+const DECLARED_PUBLIC_ASSET_RUNTIME = 'public-asset';
+
+const resolveDeclaredPublicAssets = (
+  files: readonly string[],
+  declaredPublicAssets: readonly string[],
+  target: 'Node' | 'Cloudflare',
+) => {
+  const staged = new Set(files);
+  const declared = new Set<string>();
+  for (const logicalPath of declaredPublicAssets) {
+    if (!logicalPath.startsWith('public/') || !staged.has(logicalPath)) {
+      throw new Error(
+        `[ultramodern-release-envelope] final ${target} staging has no declared public asset file ${JSON.stringify(logicalPath)}.`,
+      );
+    }
+    declared.add(logicalPath);
+  }
+  return declared;
+};
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -57,8 +105,8 @@ const collectNestedStrings = (value: unknown, key: string): string[] => {
   ]);
 };
 
-// Empty native MF producers emit no remote entry or exposed execution assets.
-// Only their routeAssets declarations may supply the missing browser evidence.
+// Native MF consumers can import remotes without emitting their own remote entry.
+// Only local routeAssets declarations may supply their browser evidence.
 const emptyProducerRouteModules = async (
   distDirectory: string,
   files: string[],
@@ -70,7 +118,14 @@ const emptyProducerRouteModules = async (
     !Array.isArray(manifest.exposes) ||
     manifest.exposes.length !== 0 ||
     !Array.isArray(manifest.remotes) ||
-    manifest.remotes.length !== 0 ||
+    manifest.remotes.some(
+      remote =>
+        !isRecord(remote) ||
+        ['federationContainerName', 'moduleName', 'alias', 'entry'].some(
+          key =>
+            typeof remote[key] !== 'string' || remote[key].trim().length === 0,
+        ),
+    ) ||
     !isRecord(manifest.metaData) ||
     !isRecord(manifest.metaData.remoteEntry) ||
     manifest.metaData.remoteEntry.name !== '' ||
@@ -303,7 +358,7 @@ const resolveSafeReleaseEnvelopePath = async ({
 
 const writeReleaseEnvelope = async (
   artifactRoot: string,
-  envelope: MicroVerticalReleaseEnvelope,
+  envelope: ReleaseEnvelope,
 ) => {
   const envelopePath = await resolveSafeReleaseEnvelopePath({
     artifactRoot,
@@ -322,7 +377,8 @@ const writeReleaseEnvelope = async (
 
 const readBuildArtifact = async (
   distDirectory: string,
-): Promise<UltramodernBuildArtifact> => {
+  requirePromotable = true,
+): Promise<UltramodernBuildArtifact | undefined> => {
   const artifactPath = path.join(
     distDirectory,
     ULTRAMODERN_BUILD_ARTIFACT_FILE,
@@ -334,8 +390,17 @@ const readBuildArtifact = async (
     );
   }
   if (artifact.deliveryUnit.sourceRevision === 'workspace') {
+    // `resolveUltramodernSourceRevision` deliberately labels a dirty or
+    // non-Git checkout `workspace` so development stays usable; only a
+    // promotion may not carry that identity. A plain `modern build` is the
+    // development path, so it skips the envelope instead of failing the
+    // build. The deploy path still asks for a promotable artifact, which is
+    // where the release gate belongs.
+    if (!requirePromotable) {
+      return undefined;
+    }
     throw new Error(
-      '[ultramodern-release-envelope] sourceRevision "workspace" cannot produce a promotable full-stack envelope.',
+      '[ultramodern-release-envelope] sourceRevision "workspace" cannot produce a promotable envelope.',
     );
   }
   return artifact;
@@ -491,9 +556,8 @@ type ReleaseIdentityCarrierSurface =
   | 'ssr'
   | 'uiClient';
 
-type ReleaseIdentityCarrierPaths = Record<
-  ReleaseIdentityCarrierSurface,
-  string[]
+type ReleaseIdentityCarrierPaths = Partial<
+  Record<ReleaseIdentityCarrierSurface, string[]>
 >;
 
 const writeReleaseIdentityCarrierMetadata = async (
@@ -506,7 +570,11 @@ const writeReleaseIdentityCarrierMetadata = async (
     ReleaseIdentityCarrierSurface,
     string[],
   ][]) {
-    if (logicalPaths.length === 0) {
+    if (
+      logicalPaths.length === 0 &&
+      surface !== 'ssr' &&
+      surface !== 'uiClient'
+    ) {
       throw new Error(
         `[ultramodern-release-envelope] ${surface} has no declared release-identity carrier artifact.`,
       );
@@ -581,12 +649,18 @@ const createReleaseArtifactInputs = async (
   distDirectory: string,
   identity: MicroVerticalReleaseIdentity,
   target: MicroVerticalReleaseTarget,
+  apiOnly: boolean,
+  uiOnly: boolean,
+  shellConsumer: boolean,
 ) => {
+  // A Shell consumes remotes and a UI-only unit has no backend; neither
+  // publishes a backend federation pair.
+  const backendProducer = !uiOnly && !shellConsumer;
   const files = await collectFiles(distDirectory);
-  if (
-    target === 'node' &&
-    files.some(logicalPath => EFFECT_BFF_WORKER_PATTERN.test(logicalPath))
-  ) {
+  // Rspack emits these runtime/shared chunks for UI SSR too. Only an actual
+  // Effect BFF entry makes the shared worker support part of that API surface.
+  const effectWorkerPaths = effectBffWorkerArtifacts(files);
+  if (target === 'node' && files.some(isEffectBffWorkerArtifact)) {
     throw new Error(
       '[ultramodern-release-envelope] Node target conflicts with a Cloudflare Effect API/BFF worker artifact; resolve the canonical deploy target instead of emitting a Node envelope for Cloudflare output.',
     );
@@ -596,7 +670,10 @@ const createReleaseArtifactInputs = async (
     return (
       topLevel === 'static' ||
       topLevel === 'html' ||
-      topLevel === 'public' ||
+      (topLevel === 'public' &&
+        logicalPath !== CRAWLER_POLICY_PATH &&
+        logicalPath !== PUBLIC_BUILD_ARTIFACT_PATH &&
+        !isPublicMetadataPath(logicalPath)) ||
       [
         'index.html',
         'mf-manifest.json',
@@ -618,7 +695,7 @@ const createReleaseArtifactInputs = async (
           logicalPath =>
             logicalPath.startsWith('worker/') &&
             COMPILED_MODULE_PATTERN.test(logicalPath) &&
-            !EFFECT_BFF_WORKER_PATTERN.test(logicalPath),
+            !effectWorkerPaths.includes(logicalPath),
         );
   const nodeApiEntryPaths = files.filter(
     logicalPath =>
@@ -633,44 +710,59 @@ const createReleaseArtifactInputs = async (
               logicalPath.startsWith('shared/')) &&
             COMPILED_MODULE_PATTERN.test(logicalPath),
         )
-      : files.filter(logicalPath =>
-          EFFECT_BFF_WORKER_PATTERN.test(logicalPath),
-        );
+      : effectWorkerPaths;
+
+  if (
+    backendProducer &&
+    target === 'cloudflare' &&
+    effectWorkerPaths.length === 0
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] cloudflare MicroVertical has no actual Effect API/BFF worker artifact.',
+    );
+  }
 
-  if (uiClientPaths.length === 0) {
+  if (apiOnly && (uiClientPaths.length > 0 || ssrPaths.length > 0)) {
+    throw new Error(
+      '[ultramodern-release-envelope] API-only MicroVertical emitted an undeclared UI/client or SSR surface.',
+    );
+  }
+  if (!apiOnly && uiClientPaths.length === 0) {
     throw new Error(
       `[ultramodern-release-envelope] ${target} full-stack MicroVertical has no UI/client artifacts.`,
     );
   }
-  if (ssrPaths.length === 0) {
+  if (!apiOnly && ssrPaths.length === 0) {
     throw new Error(
       `[ultramodern-release-envelope] ${target} full-stack MicroVertical has no ${target === 'node' ? 'Node' : 'workerd'} SSR artifacts.`,
     );
   }
+  if (uiOnly && (apiBackendPaths.length > 0 || nodeApiEntryPaths.length > 0))
+    throw new Error(
+      '[ultramodern-release-envelope] UI-only application emitted an undeclared API/backend artifact.',
+    );
   if (
-    (target === 'node' && nodeApiEntryPaths.length === 0) ||
-    apiBackendPaths.length === 0
+    backendProducer &&
+    ((target === 'node' && nodeApiEntryPaths.length === 0) ||
+      apiBackendPaths.length === 0)
   ) {
     throw new Error(
-      `[ultramodern-release-envelope] ${target} full-stack MicroVertical has no actual ${target === 'node' ? 'compiled Node Effect API artifact' : 'Effect API/BFF worker artifact'}.`,
+      `[ultramodern-release-envelope] ${target} MicroVertical has no actual ${target === 'node' ? 'compiled Node Effect API artifact' : 'Effect API/BFF worker artifact'}.`,
     );
   }
 
-  const clientExecutionPaths = await manifestReferencedClientModules(
-    distDirectory,
-    files,
-  );
-  if (clientExecutionPaths.length === 0) {
+  const clientExecutionPaths = apiOnly
+    ? []
+    : await manifestReferencedClientModules(distDirectory, files);
+  if (!apiOnly && clientExecutionPaths.length === 0) {
     throw new Error(
       '[ultramodern-release-envelope] UI/client manifest references no compiled execution module.',
     );
   }
-  const ssrExecutionPaths = await routeReferencedSsrModules(
-    distDirectory,
-    files,
-    target,
-  );
-  if (ssrExecutionPaths.length === 0) {
+  const ssrExecutionPaths = apiOnly
+    ? []
+    : await routeReferencedSsrModules(distDirectory, files, target);
+  if (!apiOnly && ssrExecutionPaths.length === 0) {
     throw new Error(
       `[ultramodern-release-envelope] route manifest references no emitted ${target === 'node' ? 'Node' : 'Cloudflare'} SSR execution module.`,
     );
@@ -689,13 +781,34 @@ const createReleaseArtifactInputs = async (
     }
   };
   add(uiClientPaths, 'browser');
+  add(
+    files.filter(logicalPath => logicalPath === CRAWLER_POLICY_PATH),
+    'crawler-policy',
+  );
+  add(files.filter(isPublicMetadataPath), 'public-metadata');
   add(ssrPaths, target === 'node' ? 'nodejs' : 'workerd');
   add(apiBackendPaths, target === 'node' ? 'nodejs' : 'workerd-effect');
-  add([BACKEND_FEDERATION_MANIFEST_FILE], 'module-federation-manifest');
+  add([ULTRAMODERN_BUILD_ARTIFACT_FILE], 'release-identity-metadata');
   add(
-    [BACKEND_FEDERATION_REMOTE_ENTRY_FILE],
-    target === 'node' ? 'nodejs' : 'commonjs-module',
+    files.filter(logicalPath => logicalPath === PUBLIC_BUILD_ARTIFACT_PATH),
+    'release-identity-metadata',
   );
+  if (backendProducer) {
+    add([BACKEND_FEDERATION_MANIFEST_FILE], 'module-federation-manifest');
+    add(
+      [BACKEND_FEDERATION_REMOTE_ENTRY_FILE],
+      target === 'node' ? 'nodejs' : 'commonjs-module',
+    );
+  }
+  if (shellConsumer) {
+    // The Shell is the deployed entry point: every remaining build file is
+    // part of its deployment and must be bound.
+    for (const logicalPath of files) {
+      if (!runtimeByPath.has(logicalPath)) {
+        runtimeByPath.set(logicalPath, `${target}-deployment`);
+      }
+    }
+  }
 
   const surfaces: MicroVerticalReleaseSurfaces = {
     uiClient: [...uiClientPaths].sort((left, right) =>
@@ -705,10 +818,14 @@ const createReleaseArtifactInputs = async (
     apiBackend: [...apiBackendPaths].sort((left, right) =>
       left.localeCompare(right),
     ),
-    backendFederation: {
-      manifest: BACKEND_FEDERATION_MANIFEST_FILE,
-      container: BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
-    },
+    ...(backendProducer
+      ? {
+          backendFederation: {
+            manifest: BACKEND_FEDERATION_MANIFEST_FILE,
+            container: BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+          },
+        }
+      : {}),
   };
   const artifacts = [...runtimeByPath]
     .map(([logicalPath, runtime]) => releaseArtifact(logicalPath, runtime))
@@ -717,11 +834,15 @@ const createReleaseArtifactInputs = async (
     distDirectory,
     identity,
     {
-      apiBackend: apiBackendPaths,
-      backendFederation: [
-        BACKEND_FEDERATION_MANIFEST_FILE,
-        BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
-      ],
+      ...(apiBackendPaths.length > 0 ? { apiBackend: apiBackendPaths } : {}),
+      ...(backendProducer
+        ? {
+            backendFederation: [
+              BACKEND_FEDERATION_MANIFEST_FILE,
+              BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+            ],
+          }
+        : {}),
       ssr: [...new Set([...ssrExecutionPaths, ...ssrPaths])],
       uiClient: uiClientPaths.filter(logicalPath =>
         COMPILED_MODULE_PATTERN.test(logicalPath),
@@ -736,6 +857,43 @@ const createReleaseArtifactInputs = async (
   };
 };
 
+const releaseEnvelopeSurfaces = (
+  surfaces: MicroVerticalReleaseSurfaces,
+  shellConsumer: boolean,
+) => {
+  if (!shellConsumer) {
+    return { surfaces };
+  }
+  const { uiClient, ssr, apiBackend } = surfaces;
+  return {
+    kind: SHELL_RELEASE_ENVELOPE_KIND,
+    surfaces: { uiClient, ssr, apiBackend },
+  };
+};
+
+/**
+ * A Shell publishes no backend federation pair, so no producer restamps its
+ * identity. Its finalized build artifact (stamped by the renderer build from the
+ * declared delivery unit) must belong to this app; the build-artifact contract
+ * requires every identity record to carry that one stamped identity.
+ */
+const assertShellBuildIdentity = async (
+  appDirectory: string,
+  distDirectory: string,
+) => {
+  const source = await readBuildIdentity(appDirectory);
+  const finalized = (await pathExists(
+    path.join(distDirectory, ULTRAMODERN_BUILD_ARTIFACT_FILE),
+  ))
+    ? await resolveWorkerDeliveryUnitStamp(appDirectory, distDirectory)
+    : undefined;
+  if (!source.artifact || !finalized || finalized.unitId !== source.unitId) {
+    throw new Error(
+      '[ultramodern-release-envelope] Shell is missing its native compiled delivery-unit identity.',
+    );
+  }
+};
+
 const pathExists = async (filePath: string) => {
   try {
     await fs.access(filePath);
@@ -747,16 +905,34 @@ const pathExists = async (filePath: string) => {
 
 export const emitFrameworkMicroVerticalReleaseEnvelope = async ({
   apiOnly,
+  appDirectory,
   distDirectory,
+  requirePromotable = true,
+  expectedRendererProfile,
+  role,
   target,
 }: {
   apiOnly: boolean;
+  appDirectory?: string;
   distDirectory: string;
+  requirePromotable?: boolean;
+  expectedRendererProfile?: RendererProfile;
+  role?: 'microvertical' | 'shell';
   target: MicroVerticalReleaseTarget;
-}): Promise<MicroVerticalReleaseEnvelope | undefined> => {
-  if (apiOnly) {
-    return undefined;
+}): Promise<ReleaseEnvelope | undefined> => {
+  const declaredRole = appDirectory
+    ? await resolveTopologyReleaseRole(appDirectory)
+    : undefined;
+  if (
+    role !== undefined &&
+    declaredRole !== undefined &&
+    role !== declaredRole
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] Configured release role disagrees with the declared topology app.',
+    );
   }
+  const shellConsumer = (declaredRole ?? role ?? 'microvertical') === 'shell';
   const backendManifestPath = path.join(
     distDirectory,
     BACKEND_FEDERATION_MANIFEST_FILE,
@@ -769,35 +945,115 @@ export const emitFrameworkMicroVerticalReleaseEnvelope = async ({
     pathExists(backendManifestPath),
     pathExists(backendContainerPath),
   ]);
-  if (!hasBackendManifest && !hasBackendContainer) {
-    return undefined;
+  if (shellConsumer) {
+    if (apiOnly || hasBackendManifest || hasBackendContainer || !appDirectory) {
+      throw new Error(
+        '[ultramodern-release-envelope] Shell requires a full-stack application source and cannot declare a backend federation producer.',
+      );
+    }
+    await assertShellBuildIdentity(appDirectory, distDirectory);
+  } else if (!apiOnly && !hasBackendManifest && !hasBackendContainer) {
+    const source = appDirectory
+      ? path.join(appDirectory, ULTRAMODERN_BUILD_ARTIFACT_PATH)
+      : undefined;
+    const participationPaths = [
+      path.join(distDirectory, ULTRAMODERN_BUILD_ARTIFACT_FILE),
+      backendManifestPath,
+      backendContainerPath,
+      ...(source ? [source, source.replace(/\.json$/u, '.ts')] : []),
+    ];
+    const hasParticipationEntry = (
+      await Promise.all(
+        participationPaths.map(async filePath => {
+          try {
+            await fs.lstat(filePath);
+            return true;
+          } catch (error) {
+            if (isMissingPathError(error)) return false;
+            throw error;
+          }
+        }),
+      )
+    ).some(Boolean);
+    if (
+      !hasParticipationEntry &&
+      (!appDirectory || !(await resolveTopologyDeliveryUnit(appDirectory)))
+    )
+      return undefined;
   }
-  if (!hasBackendManifest || !hasBackendContainer) {
+  const buildArtifact = await readBuildArtifact(
+    distDirectory,
+    requirePromotable,
+  );
+  const declared =
+    appDirectory && buildArtifact
+      ? await resolveWorkerDeliveryUnitStamp(appDirectory, distDirectory)
+      : undefined;
+  const uiOnly = Boolean(declared?.surfaces.ui && !declared.surfaces.api);
+  if (uiOnly && (apiOnly || hasBackendManifest || hasBackendContainer))
     throw new Error(
-      '[ultramodern-release-envelope] full-stack MicroVertical backend federation manifest and container must be emitted together.',
+      '[ultramodern-release-envelope] UI-only application cannot declare API-only configuration or backend federation output.',
+    );
+  if (!hasBackendManifest && !hasBackendContainer && !apiOnly && !buildArtifact)
+    return undefined;
+  if (
+    !shellConsumer &&
+    !uiOnly &&
+    (!hasBackendManifest || !hasBackendContainer)
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] MicroVertical backend federation manifest and container must be emitted together.',
     );
   }
 
-  const buildArtifact = await readBuildArtifact(distDirectory);
+  if (!buildArtifact) {
+    return undefined;
+  }
+  const builtUi = buildArtifact.surfaces.ui;
+  if (Boolean(builtUi) === apiOnly) {
+    throw new Error(
+      '[ultramodern-release-envelope] build artifact UI surface must match the configured application surface.',
+    );
+  }
+  if (expectedRendererProfile !== undefined) {
+    assertRendererProfileCompatibility(
+      expectedRendererProfile,
+      builtUi?.rendererProfile,
+    );
+  }
+  const ui: MicroVerticalReleaseUi | undefined = builtUi
+    ? {
+        rendererIdentity: builtUi.rendererIdentity,
+        rendererProfile: builtUi.rendererProfile,
+        routerBindings: builtUi.routerBindings,
+      }
+    : undefined;
   const identity = {
     unitId: buildArtifact.deliveryUnit.unitId,
     buildMarker: buildArtifact.deliveryUnit.buildMarker,
     sourceRevision: buildArtifact.deliveryUnit.sourceRevision,
     releaseVersion: buildArtifact.deliveryUnit.version,
   };
-  await readBackendManifest(distDirectory, identity);
+  if (!shellConsumer && !uiOnly) {
+    await readBackendManifest(distDirectory, identity);
+  }
   const { artifacts, surfaces } = await createReleaseArtifactInputs(
     distDirectory,
     identity,
     target,
+    apiOnly,
+    uiOnly,
+    shellConsumer,
   );
   const envelope = await createMicroVerticalReleaseEnvelope({
     artifactRoot: distDirectory,
     target,
     identity,
+    ...(ui ? { ui } : {}),
     artifacts,
-    surfaces,
+    ...releaseEnvelopeSurfaces(surfaces, shellConsumer),
   });
+  await verifyBuildArtifactCarriers(distDirectory, envelope);
   await writeReleaseEnvelope(distDirectory, envelope);
   return envelope;
 };
@@ -806,13 +1062,15 @@ export const readFrameworkMicroVerticalReleaseEnvelope = async ({
   artifactRoot,
   expectedTarget,
   logicalPathForArtifact,
+  expectedRendererProfile,
   required = false,
 }: {
   artifactRoot: string;
   expectedTarget?: MicroVerticalReleaseTarget;
   logicalPathForArtifact?: (artifact: MicroVerticalReleaseArtifact) => string;
+  expectedRendererProfile?: RendererProfile;
   required?: boolean;
-}): Promise<MicroVerticalReleaseEnvelope | undefined> => {
+}): Promise<ReleaseEnvelope | undefined> => {
   const envelopePath = await resolveSafeReleaseEnvelopePath({
     artifactRoot,
     createDirectory: false,
@@ -825,32 +1083,113 @@ export const readFrameworkMicroVerticalReleaseEnvelope = async ({
     }
     return undefined;
   }
-  return verifyMicroVerticalReleaseEnvelope(await readJson(envelopePath), {
+  const envelope = await verifyMicroVerticalReleaseEnvelope(
+    await readJson(envelopePath),
+    {
+      artifactRoot,
+      ...(expectedTarget ? { expectedTarget } : {}),
+      ...(logicalPathForArtifact ? { logicalPathForArtifact } : {}),
+      ...(expectedRendererProfile ? { expectedRendererProfile } : {}),
+    },
+  );
+  await verifyBuildArtifactCarriers(
     artifactRoot,
-    ...(expectedTarget ? { expectedTarget } : {}),
-    ...(logicalPathForArtifact ? { logicalPathForArtifact } : {}),
-  });
+    envelope,
+    logicalPathForArtifact,
+  );
+  return envelope;
+};
+
+const verifyBuildArtifactCarriers = async (
+  artifactRoot: string,
+  envelope: ReleaseEnvelope,
+  logicalPathForArtifact?: (artifact: MicroVerticalReleaseArtifact) => string,
+) => {
+  const carriers = envelope.artifacts.filter(
+    artifact =>
+      artifact.logicalPath === ULTRAMODERN_BUILD_ARTIFACT_FILE ||
+      artifact.logicalPath === PUBLIC_BUILD_ARTIFACT_PATH,
+  );
+  if (carriers.length === 0) {
+    throw new Error(
+      '[ultramodern-release-envelope] immutable build artifact must be bound to the release envelope.',
+    );
+  }
+  for (const artifact of carriers) {
+    if (
+      artifact.kind !== 'file' ||
+      artifact.runtime !== 'release-identity-metadata'
+    ) {
+      throw new Error(
+        '[ultramodern-release-envelope] immutable build artifact must be a real file with runtime "release-identity-metadata".',
+      );
+    }
+    const logicalPath =
+      logicalPathForArtifact?.(artifact) ?? artifact.logicalPath;
+    const built = await readJson(path.join(artifactRoot, logicalPath));
+    if (!isUltramodernBuildArtifact(built)) {
+      throw new Error(
+        '[ultramodern-release-envelope] bound build artifact is invalid.',
+      );
+    }
+    assertIdentityBlock(
+      built.deliveryUnit,
+      envelope.identity,
+      'buildArtifact.deliveryUnit',
+      true,
+    );
+    if (Boolean(built.surfaces.ui) !== Boolean(envelope.ui)) {
+      throw new Error(
+        '[ultramodern-release-envelope] bound build artifact UI surface differs from the release envelope.',
+      );
+    }
+    if (envelope.ui && built.surfaces.ui) {
+      if (
+        !isDeepStrictEqual(
+          envelope.ui.routerBindings,
+          built.surfaces.ui.routerBindings,
+        )
+      ) {
+        throw new Error(
+          '[ultramodern-release-envelope] buildArtifact.ui.routerBindings differ from the release envelope.',
+        );
+      }
+      assertRendererProfileCompatibility(
+        envelope.ui.rendererProfile,
+        built.surfaces.ui.rendererProfile,
+      );
+      for (const field of [
+        'renderer',
+        'protocolVersion',
+        'appId',
+        'entryName',
+        'buildId',
+      ] as const) {
+        if (
+          envelope.ui.rendererIdentity[field] !==
+          built.surfaces.ui.rendererIdentity[field]
+        ) {
+          throw new Error(
+            `[ultramodern-release-envelope] buildArtifact.ui.rendererIdentity.${field} differs from the release envelope.`,
+          );
+        }
+      }
+    }
+  }
 };
 
 export const verifyBuildOutputReleaseEnvelope = async (
   distDirectory: string,
   expectedTarget?: MicroVerticalReleaseTarget,
 ) => {
-  const [hasEnvelope, hasBuildArtifact, hasBackendManifest, hasBackendEntry] =
-    await Promise.all([
-      pathExists(path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH)),
-      pathExists(path.join(distDirectory, ULTRAMODERN_BUILD_ARTIFACT_FILE)),
-      pathExists(path.join(distDirectory, BACKEND_FEDERATION_MANIFEST_FILE)),
-      pathExists(
-        path.join(distDirectory, BACKEND_FEDERATION_REMOTE_ENTRY_FILE),
-      ),
-    ]);
-  const isFullStackMicroVertical =
-    hasBuildArtifact && (hasBackendManifest || hasBackendEntry);
+  const [hasEnvelope, hasBuildArtifact] = await Promise.all([
+    pathExists(path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH)),
+    pathExists(path.join(distDirectory, ULTRAMODERN_BUILD_ARTIFACT_FILE)),
+  ]);
   return readFrameworkMicroVerticalReleaseEnvelope({
     artifactRoot: distDirectory,
     ...(expectedTarget ? { expectedTarget } : {}),
-    required: hasEnvelope || isFullStackMicroVertical,
+    required: hasEnvelope || hasBuildArtifact,
   });
 };
 
@@ -869,13 +1208,24 @@ export const verifyNodeReleaseEnvelopeStaging = async ({
 const createNodeStagedReleaseArtifactInputs = async (
   outputDirectory: string,
   identity: MicroVerticalReleaseIdentity,
+  apiOnly: boolean,
+  uiOnly: boolean,
+  declaredPublicAssets: readonly string[],
+  shellConsumer: boolean,
 ) => {
+  const backendProducer = !uiOnly && !shellConsumer;
   const files = await collectFiles(outputDirectory);
+  const declaredPublicAssetPaths = resolveDeclaredPublicAssets(
+    files,
+    declaredPublicAssets,
+    'Node',
+  );
   for (const requiredPath of [
     'index.js',
     'package.json',
-    BACKEND_FEDERATION_MANIFEST_FILE,
-    BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+    ...(backendProducer
+      ? [BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE]
+      : []),
   ]) {
     if (!files.includes(requiredPath)) {
       throw new Error(
@@ -888,12 +1238,24 @@ const createNodeStagedReleaseArtifactInputs = async (
     BACKEND_FEDERATION_MANIFEST_FILE,
     BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
   ]);
+  if (
+    shellConsumer &&
+    files.some(logicalPath => backendFederationPaths.has(logicalPath))
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] final Shell Node staging cannot contain a backend federation producer artifact.',
+    );
+  }
   const uiClientPaths = files.filter(logicalPath => {
     const topLevel = logicalPath.split('/')[0];
     return (
       topLevel === 'static' ||
       topLevel === 'html' ||
-      topLevel === 'public' ||
+      (topLevel === 'public' &&
+        logicalPath !== CRAWLER_POLICY_PATH &&
+        logicalPath !== PUBLIC_BUILD_ARTIFACT_PATH &&
+        !isPublicMetadataPath(logicalPath) &&
+        !declaredPublicAssetPaths.has(logicalPath)) ||
       [
         'index.html',
         'mf-manifest.json',
@@ -915,27 +1277,46 @@ const createNodeStagedReleaseArtifactInputs = async (
       (logicalPath.startsWith('api/') || logicalPath.startsWith('shared/')) &&
       COMPILED_MODULE_PATTERN.test(logicalPath),
   );
+  if (
+    uiOnly &&
+    (apiBackendPaths.length > 0 ||
+      files.some(logicalPath => backendFederationPaths.has(logicalPath)))
+  )
+    throw new Error(
+      '[ultramodern-release-envelope] final UI-only Node staging contains an undeclared API/backend or backend federation artifact.',
+    );
+  if (
+    apiOnly &&
+    (uiClientPaths.length > 0 || ssrPaths.some(path => path !== 'index.js'))
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] final API-only Node staging contains an undeclared UI/client or SSR surface.',
+    );
+  }
   for (const [surface, paths] of [
     ['UI/client', uiClientPaths],
-    ['Node SSR', ssrPaths],
+    ['Node SSR', apiOnly ? [] : ssrPaths],
     ['Node API/backend', apiBackendPaths],
   ] as const) {
-    if (paths.length === 0) {
+    if (
+      paths.length === 0 &&
+      (surface === 'Node API/backend' ? backendProducer : !apiOnly)
+    ) {
       throw new Error(
         `[ultramodern-release-envelope] final Node staging has no ${surface} artifacts.`,
       );
     }
   }
-  const clientExecutionPaths = await manifestReferencedClientModules(
-    outputDirectory,
-    files,
-  );
-  const ssrExecutionPaths = await routeReferencedSsrModules(
-    outputDirectory,
-    files,
-    'node',
-  );
-  if (clientExecutionPaths.length === 0 || ssrExecutionPaths.length === 0) {
+  const clientExecutionPaths = apiOnly
+    ? []
+    : await manifestReferencedClientModules(outputDirectory, files);
+  const ssrExecutionPaths = apiOnly
+    ? []
+    : await routeReferencedSsrModules(outputDirectory, files, 'node');
+  if (
+    !apiOnly &&
+    (clientExecutionPaths.length === 0 || ssrExecutionPaths.length === 0)
+  ) {
     throw new Error(
       '[ultramodern-release-envelope] final Node manifests must reference emitted UI/client and SSR execution modules.',
     );
@@ -949,33 +1330,57 @@ const createNodeStagedReleaseArtifactInputs = async (
   for (const logicalPath of uiClientPaths) {
     runtimeByPath.set(logicalPath, 'browser');
   }
-  for (const logicalPath of ssrPaths) {
+  for (const logicalPath of declaredPublicAssetPaths) {
+    runtimeByPath.set(logicalPath, DECLARED_PUBLIC_ASSET_RUNTIME);
+  }
+  if (files.includes(CRAWLER_POLICY_PATH)) {
+    runtimeByPath.set(CRAWLER_POLICY_PATH, 'crawler-policy');
+  }
+  for (const logicalPath of files.filter(isPublicMetadataPath)) {
+    runtimeByPath.set(logicalPath, 'public-metadata');
+  }
+  for (const logicalPath of apiOnly ? [] : ssrPaths) {
     runtimeByPath.set(logicalPath, 'nodejs');
   }
   for (const logicalPath of apiBackendPaths) {
     runtimeByPath.set(logicalPath, 'nodejs');
   }
-  runtimeByPath.set(
-    BACKEND_FEDERATION_MANIFEST_FILE,
-    'module-federation-manifest',
-  );
-  runtimeByPath.set(BACKEND_FEDERATION_REMOTE_ENTRY_FILE, 'nodejs');
+  if (backendProducer) {
+    runtimeByPath.set(
+      BACKEND_FEDERATION_MANIFEST_FILE,
+      'module-federation-manifest',
+    );
+    runtimeByPath.set(BACKEND_FEDERATION_REMOTE_ENTRY_FILE, 'nodejs');
+  }
+  for (const logicalPath of [
+    ULTRAMODERN_BUILD_ARTIFACT_FILE,
+    PUBLIC_BUILD_ARTIFACT_PATH,
+  ]) {
+    if (files.includes(logicalPath))
+      runtimeByPath.set(logicalPath, 'release-identity-metadata');
+  }
 
   const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(
     outputDirectory,
     identity,
     {
-      apiBackend: apiBackendPaths,
-      backendFederation: [
-        BACKEND_FEDERATION_MANIFEST_FILE,
-        BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
-      ],
-      ssr: [
-        ...new Set([
-          ...ssrExecutionPaths,
-          ...ssrPaths.filter(logicalPath => logicalPath !== 'index.js'),
-        ]),
-      ],
+      ...(apiBackendPaths.length > 0 ? { apiBackend: apiBackendPaths } : {}),
+      ...(backendProducer
+        ? {
+            backendFederation: [
+              BACKEND_FEDERATION_MANIFEST_FILE,
+              BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+            ],
+          }
+        : {}),
+      ssr: apiOnly
+        ? []
+        : [
+            ...new Set([
+              ...ssrExecutionPaths,
+              ...ssrPaths.filter(logicalPath => logicalPath !== 'index.js'),
+            ]),
+          ],
       uiClient: uiClientPaths.filter(logicalPath =>
         COMPILED_MODULE_PATTERN.test(logicalPath),
       ),
@@ -992,22 +1397,31 @@ const createNodeStagedReleaseArtifactInputs = async (
       uiClient: [...uiClientPaths].sort((left, right) =>
         left.localeCompare(right),
       ),
-      ssr: [...ssrPaths].sort((left, right) => left.localeCompare(right)),
+      ssr: apiOnly
+        ? []
+        : [...ssrPaths].sort((left, right) => left.localeCompare(right)),
       apiBackend: [...apiBackendPaths].sort((left, right) =>
         left.localeCompare(right),
       ),
-      backendFederation: {
-        manifest: BACKEND_FEDERATION_MANIFEST_FILE,
-        container: BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
-      },
+      ...(backendProducer
+        ? {
+            backendFederation: {
+              manifest: BACKEND_FEDERATION_MANIFEST_FILE,
+              container: BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+            },
+          }
+        : {}),
     },
   };
 };
 
 export const emitNodeStagedReleaseEnvelope = async ({
+  declaredPublicAssets = [],
   distDirectory,
   outputDirectory,
 }: {
+  /** Staged `deploy.node.publicAssets` files, relative to `outputDirectory`. */
+  declaredPublicAssets?: readonly string[];
   distDirectory: string;
   outputDirectory: string;
 }) => {
@@ -1015,17 +1429,24 @@ export const emitNodeStagedReleaseEnvelope = async ({
   if (!source) {
     return undefined;
   }
+  const shellConsumer = source.kind === SHELL_RELEASE_ENVELOPE_KIND;
   const { artifacts, surfaces } = await createNodeStagedReleaseArtifactInputs(
     outputDirectory,
     source.identity,
+    source.surfaces.uiClient.length === 0,
+    source.surfaces.apiBackend.length === 0,
+    declaredPublicAssets,
+    shellConsumer,
   );
   const staged = await createMicroVerticalReleaseEnvelope({
     artifactRoot: outputDirectory,
     target: 'node',
     identity: source.identity,
+    ...(source.ui ? { ui: source.ui } : {}),
     artifacts,
-    surfaces,
+    ...releaseEnvelopeSurfaces(surfaces, shellConsumer),
   });
+  await verifyBuildArtifactCarriers(outputDirectory, staged);
   await writeReleaseEnvelope(outputDirectory, staged);
   return staged;
 };
@@ -1059,14 +1480,24 @@ export const stageCloudflareReleaseEnvelope = async ({
 const createCloudflareStagedReleaseArtifactInputs = async (
   outputDirectory: string,
   identity: MicroVerticalReleaseIdentity,
+  apiOnly: boolean,
+  uiOnly: boolean,
+  declaredPublicAssets: readonly string[],
+  shellConsumer: boolean,
 ) => {
+  const backendProducer = !uiOnly && !shellConsumer;
   const files = await collectFiles(outputDirectory);
+  const declaredPublicAssetPaths = resolveDeclaredPublicAssets(
+    files,
+    declaredPublicAssets,
+    'Cloudflare',
+  );
   for (const requiredPath of [
     'server/index.mjs',
     'server/modern-worker-manifest.json',
     'wrangler.json',
     'package.json',
-    'worker/package.json',
+    ...(apiOnly ? [] : ['worker/package.json']),
   ]) {
     if (!files.includes(requiredPath)) {
       throw new Error(
@@ -1087,34 +1518,84 @@ const createCloudflareStagedReleaseArtifactInputs = async (
   }
   const backendManifestPath = `public/${BACKEND_FEDERATION_MANIFEST_FILE}`;
   const backendContainerPath = `public/${BACKEND_FEDERATION_REMOTE_ENTRY_FILE}`;
-  const apiBackendPaths = files.filter(logicalPath =>
-    EFFECT_BFF_WORKER_PATTERN.test(logicalPath),
-  );
+  const apiBackendPaths = effectBffWorkerArtifacts(files);
+  if (
+    backendProducer &&
+    !files.some(logicalPath => EFFECT_BFF_WORKER_PATTERN.test(logicalPath))
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] final Cloudflare staging has no actual Effect API/BFF worker artifact.',
+    );
+  }
   const ssrPaths = files.filter(
     logicalPath =>
       (logicalPath.startsWith('server/') ||
         logicalPath.startsWith('worker/')) &&
       COMPILED_MODULE_PATTERN.test(logicalPath) &&
-      !EFFECT_BFF_WORKER_PATTERN.test(logicalPath),
+      !apiBackendPaths.includes(logicalPath),
   );
   const uiClientPaths = files.filter(
     logicalPath =>
       logicalPath.startsWith('public/') &&
+      logicalPath !== CRAWLER_POLICY_PATH &&
+      !isPublicMetadataPath(logicalPath) &&
+      !declaredPublicAssetPaths.has(logicalPath) &&
+      logicalPath !== PUBLIC_BUILD_ARTIFACT_PATH &&
       logicalPath !== backendManifestPath &&
       logicalPath !== backendContainerPath,
   );
+  if (
+    shellConsumer &&
+    files.some(
+      logicalPath =>
+        logicalPath === backendManifestPath ||
+        logicalPath === backendContainerPath,
+    )
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] final Shell Cloudflare staging cannot contain a backend federation producer artifact.',
+    );
+  }
+  if (
+    uiOnly &&
+    (apiBackendPaths.length > 0 ||
+      files.some(
+        logicalPath =>
+          logicalPath === backendManifestPath ||
+          logicalPath === backendContainerPath ||
+          (logicalPath.startsWith('api/') &&
+            COMPILED_MODULE_PATTERN.test(logicalPath)),
+      ))
+  )
+    throw new Error(
+      '[ultramodern-release-envelope] final UI-only Cloudflare staging contains an undeclared API/backend or backend federation artifact.',
+    );
+  if (
+    apiOnly &&
+    (uiClientPaths.length > 0 ||
+      ssrPaths.some(path => path !== 'server/index.mjs'))
+  ) {
+    throw new Error(
+      '[ultramodern-release-envelope] final API-only Cloudflare staging contains an undeclared UI/client or SSR surface.',
+    );
+  }
   for (const [surface, paths] of [
     ['UI/client', uiClientPaths],
-    ['Cloudflare SSR', ssrPaths],
+    ['Cloudflare SSR', apiOnly ? [] : ssrPaths],
     ['Cloudflare API/backend', apiBackendPaths],
   ] as const) {
-    if (paths.length === 0) {
+    if (
+      paths.length === 0 &&
+      (surface === 'Cloudflare API/backend' ? backendProducer : !apiOnly)
+    ) {
       throw new Error(
         `[ultramodern-release-envelope] final Cloudflare staging has no ${surface} artifacts.`,
       );
     }
   }
-  for (const logicalPath of [backendManifestPath, backendContainerPath]) {
+  for (const logicalPath of backendProducer
+    ? [backendManifestPath, backendContainerPath]
+    : []) {
     if (!files.includes(logicalPath)) {
       throw new Error(
         `[ultramodern-release-envelope] final Cloudflare staging is missing ${logicalPath}.`,
@@ -1122,18 +1603,25 @@ const createCloudflareStagedReleaseArtifactInputs = async (
     }
   }
 
-  const clientExecutionPaths = await manifestReferencedClientModules(
-    outputDirectory,
-    files,
-    'public/mf-manifest.json',
-  );
-  const ssrExecutionPaths = await routeReferencedSsrModules(
-    outputDirectory,
-    files,
-    'cloudflare',
-    'server/route.json',
-  );
-  if (clientExecutionPaths.length === 0 || ssrExecutionPaths.length === 0) {
+  const clientExecutionPaths = apiOnly
+    ? []
+    : await manifestReferencedClientModules(
+        outputDirectory,
+        files,
+        'public/mf-manifest.json',
+      );
+  const ssrExecutionPaths = apiOnly
+    ? []
+    : await routeReferencedSsrModules(
+        outputDirectory,
+        files,
+        'cloudflare',
+        'server/route.json',
+      );
+  if (
+    !apiOnly &&
+    (clientExecutionPaths.length === 0 || ssrExecutionPaths.length === 0)
+  ) {
     throw new Error(
       '[ultramodern-release-envelope] final Cloudflare manifests must reference emitted UI/client and SSR execution modules.',
     );
@@ -1149,23 +1637,44 @@ const createCloudflareStagedReleaseArtifactInputs = async (
     }
   };
   add(uiClientPaths, 'browser');
-  add(ssrPaths, 'workerd');
+  add([...declaredPublicAssetPaths], DECLARED_PUBLIC_ASSET_RUNTIME);
+  if (files.includes(CRAWLER_POLICY_PATH)) {
+    runtimeByPath.set(CRAWLER_POLICY_PATH, 'crawler-policy');
+  }
+  add(files.filter(isPublicMetadataPath), 'public-metadata');
+  add(apiOnly ? [] : ssrPaths, 'workerd');
   add(apiBackendPaths, 'workerd-effect');
-  add([backendManifestPath], 'module-federation-manifest');
-  add([backendContainerPath], 'commonjs-module');
+  if (backendProducer) {
+    add([backendManifestPath], 'module-federation-manifest');
+    add([backendContainerPath], 'commonjs-module');
+  }
+  add(
+    files.filter(
+      logicalPath =>
+        logicalPath === ULTRAMODERN_BUILD_ARTIFACT_FILE ||
+        logicalPath === PUBLIC_BUILD_ARTIFACT_PATH,
+    ),
+    'release-identity-metadata',
+  );
 
   const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(
     outputDirectory,
     identity,
     {
-      apiBackend: apiBackendPaths,
-      backendFederation: [backendManifestPath, backendContainerPath],
-      ssr: [
-        ...new Set([
-          ...ssrExecutionPaths,
-          ...ssrPaths.filter(logicalPath => logicalPath.startsWith('worker/')),
-        ]),
-      ],
+      ...(apiBackendPaths.length > 0 ? { apiBackend: apiBackendPaths } : {}),
+      ...(backendProducer
+        ? { backendFederation: [backendManifestPath, backendContainerPath] }
+        : {}),
+      ssr: apiOnly
+        ? []
+        : [
+            ...new Set([
+              ...ssrExecutionPaths,
+              ...ssrPaths.filter(logicalPath =>
+                logicalPath.startsWith('worker/'),
+              ),
+            ]),
+          ],
       uiClient: uiClientPaths.filter(logicalPath =>
         COMPILED_MODULE_PATTERN.test(logicalPath),
       ),
@@ -1182,22 +1691,31 @@ const createCloudflareStagedReleaseArtifactInputs = async (
       uiClient: [...uiClientPaths].sort((left, right) =>
         left.localeCompare(right),
       ),
-      ssr: [...ssrPaths].sort((left, right) => left.localeCompare(right)),
+      ssr: apiOnly
+        ? []
+        : [...ssrPaths].sort((left, right) => left.localeCompare(right)),
       apiBackend: [...apiBackendPaths].sort((left, right) =>
         left.localeCompare(right),
       ),
-      backendFederation: {
-        manifest: backendManifestPath,
-        container: backendContainerPath,
-      },
+      ...(backendProducer
+        ? {
+            backendFederation: {
+              manifest: backendManifestPath,
+              container: backendContainerPath,
+            },
+          }
+        : {}),
     },
   };
 };
 
 export const emitCloudflareStagedReleaseEnvelope = async ({
+  declaredPublicAssets = [],
   distDirectory,
   outputDirectory,
 }: {
+  /** Staged `deploy.worker.publicAssets` files, relative to `outputDirectory`. */
+  declaredPublicAssets?: readonly string[];
   distDirectory: string;
   outputDirectory: string;
 }) => {
@@ -1208,18 +1726,25 @@ export const emitCloudflareStagedReleaseEnvelope = async ({
   if (!source) {
     return undefined;
   }
+  const shellConsumer = source.kind === SHELL_RELEASE_ENVELOPE_KIND;
   const { artifacts, surfaces } =
     await createCloudflareStagedReleaseArtifactInputs(
       outputDirectory,
       source.identity,
+      source.surfaces.uiClient.length === 0,
+      source.surfaces.apiBackend.length === 0,
+      declaredPublicAssets,
+      shellConsumer,
     );
   const staged = await createMicroVerticalReleaseEnvelope({
     artifactRoot: outputDirectory,
     target: 'cloudflare',
     identity: source.identity,
+    ...(source.ui ? { ui: source.ui } : {}),
     artifacts,
-    surfaces,
+    ...releaseEnvelopeSurfaces(surfaces, shellConsumer),
   });
+  await verifyBuildArtifactCarriers(outputDirectory, staged);
   await writeReleaseEnvelope(outputDirectory, staged);
   return staged;
 };