@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.9 → 3.9.3-ultramodern.2

package/src/cloudflare-output-contract.ts

@@ -10,29 +10,60 @@ export const CLOUDFLARE_RUNTIME_TYPE = 'cloudflare-module-worker';
 export const CLOUDFLARE_OUTPUT_PACKAGE_TYPE = 'module';
 export const CLOUDFLARE_WORKER_PACKAGE_TYPE = 'commonjs';
 export const CLOUDFLARE_WORKER_BUNDLE_FORMAT = 'commonjs';
-// Import availability for the default 2026-06-02 nodejs_compat target.
-// Some modules are runtime-provided stubs whose unsupported operations throw.
+// Each SSR entry with route data loaders gets a worker bundle that answers
+// `?__loader=` route data requests through this export.
+export const CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT = 'handleRouteDataRequest';
+export const getCloudflareWorkerRouteDataEntryName = (entryName: string) =>
+  `${entryName}-server-loaders`;
+// Every Node.js built-in that workerd resolves for the default 2026-06-02
+// nodejs_compat target (tests/cloudflare-worker-node-builtins.test.ts probes
+// workerd against Node's own `builtinModules`). Names are listed without the
+// `node:` scheme; bare-name imports are only valid where Node itself accepts
+// them (`isBuiltin`), so prefix-only modules such as `sqlite` and `test` are
+// externalized solely as `node:sqlite` and `node:test`. Some modules are
+// runtime-provided stubs whose unsupported operations throw. Earlier
+// compatibility dates are rejected when the Wrangler config is generated.
 export const CLOUDFLARE_WORKER_NODE_BUILTINS = [
+  '_http_agent',
+  '_http_client',
+  '_http_common',
+  '_http_incoming',
+  '_http_outgoing',
+  '_http_server',
+  '_tls_common',
+  '_tls_wrap',
   'assert',
   'assert/strict',
   'async_hooks',
   'buffer',
   'child_process',
+  'cluster',
+  'console',
+  'constants',
   'crypto',
   'dgram',
+  'diagnostics_channel',
   'dns',
+  'dns/promises',
   'domain',
   'events',
   'fs',
   'fs/promises',
   'http',
   'http2',
+  'https',
   'inspector',
+  'inspector/promises',
   'module',
   'net',
   'os',
   'path',
+  'path/posix',
+  'path/win32',
+  'perf_hooks',
   'process',
+  'punycode',
+  'querystring',
   'readline',
   'readline/promises',
   'repl',
@@ -42,6 +73,8 @@ export const CLOUDFLARE_WORKER_NODE_BUILTINS = [
   'stream/promises',
   'stream/web',
   'string_decoder',
+  'sys',
+  'test',
   'timers',
   'timers/promises',
   'tls',
@@ -58,10 +91,20 @@ export const CLOUDFLARE_WORKER_NODE_BUILTINS = [
 ] as const;
 // Platform imports available with the default 2026-06-02 nodejs_compat target.
 // Import availability does not imply support for every Node API operation.
+// `cloudflare:workers` exposes the Worker `env` at module scope, which is how
+// clients built once per isolate reach Hyperdrive, VPC and service bindings.
 export const CLOUDFLARE_WORKER_PLATFORM_MODULES = [
   'cloudflare:sockets',
+  'cloudflare:workers',
 ] as const;
 export const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
   'nodejs_compat',
   'global_fetch_strictly_public',
+  // Without this flag, a deployed Worker's `request.signal` never fires on
+  // client disconnect, so SSR keeps rendering and streaming after the client
+  // has gone away. The native request/session layer (see
+  // renderer-core/src/session/request.ts) already forwards `request.signal`
+  // into its render-abort `AbortController`; this flag is what makes the
+  // platform actually raise that signal in production.
+  'enable_request_signal',
 ] as const;

package/src/cloudflare-output-verifier/identity.ts

@@ -2,14 +2,20 @@ import {
   DELIVERY_UNIT_IDENTITY_FIELDS,
   type DeliveryUnitIdentity,
   deliveryUnitIdentityFieldValue,
+  validateRendererIdentity,
+  validateRendererProfile,
+  validateRendererProfileCompatibility,
 } from '@modern-js/backend-federation-contracts';
+import type { TopologyUiSurface } from '../cloudflare/delivery-unit';
+import { isRecord } from '../cloudflare/utils';
 import type { CloudflareOutputVerifierIssue, JsonObject } from './issues';
 import { addIssue, assertEqual } from './issues';
 
 export type CloudflareDeliveryUnitIdentity = DeliveryUnitIdentity & {
-  surfaces?: Partial<
-    Record<'api' | 'ui', DeliveryUnitIdentity & { surface: 'api' | 'ui' }>
-  >;
+  surfaces?: {
+    ui?: TopologyUiSurface;
+    api?: DeliveryUnitIdentity & { surface: 'api' };
+  };
 };
 
 export const verifyDeliveryUnitIdentity = (
@@ -19,9 +25,8 @@ export const verifyDeliveryUnitIdentity = (
   declared: CloudflareDeliveryUnitIdentity | undefined,
 ) => {
   const stamped = manifest?.deliveryUnit;
-  const hasStamp = Boolean(stamped) && typeof stamped === 'object';
+  const hasStamp = isRecord(stamped);
 
-  // Legacy outputs (no topology declaration and no stamp) are unchanged.
   if (declared) {
     if (!hasStamp) {
       addIssue(issues, {
@@ -46,11 +51,46 @@ export const verifyDeliveryUnitIdentity = (
 
   // Every profile-declared surface must derive from the one stamped record;
   // profiles must not claim a UI/API surface they do not emit.
-  if (hasStamp && stamped.surfaces && typeof stamped.surfaces === 'object') {
+  if (hasStamp) {
+    if (!isRecord(stamped.surfaces)) {
+      addIssue(issues, {
+        code: 'missing-delivery-unit',
+        message:
+          'Cloudflare worker manifest is missing delivery-unit surface markers.',
+        path: manifestPath,
+      });
+      return;
+    }
+    for (const surface of Object.keys(stamped.surfaces)) {
+      if (surface !== 'ui' && surface !== 'api') {
+        addIssue(issues, {
+          code: 'delivery-unit-drift',
+          message: `Cloudflare worker manifest declares an unsupported ${surface} delivery-unit surface.`,
+          path: manifestPath,
+        });
+      }
+    }
+    if (
+      !declared?.surfaces &&
+      !Object.hasOwn(stamped.surfaces, 'ui') &&
+      !Object.hasOwn(stamped.surfaces, 'api')
+    ) {
+      addIssue(issues, {
+        code: 'missing-delivery-unit',
+        message:
+          'Cloudflare worker manifest is missing delivery-unit surface markers.',
+        path: manifestPath,
+      });
+      return;
+    }
     for (const surface of ['ui', 'api'] as const) {
       const marker = stamped.surfaces[surface];
       const expected = declared?.surfaces?.[surface];
 
+      if (!expected && !marker) {
+        continue;
+      }
+
       if (declared?.surfaces && !expected) {
         if (marker) {
           addIssue(issues, {
@@ -62,7 +102,7 @@ export const verifyDeliveryUnitIdentity = (
         continue;
       }
 
-      if (!marker || typeof marker !== 'object') {
+      if (!isRecord(marker)) {
         addIssue(issues, {
           code: 'missing-delivery-unit',
           message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
@@ -71,6 +111,11 @@ export const verifyDeliveryUnitIdentity = (
         continue;
       }
 
+      assertEqual(issues, marker.surface, surface, {
+        code: 'delivery-unit-drift',
+        message: `Cloudflare worker manifest ${surface} surface must declare surface "${surface}".`,
+        path: manifestPath,
+      });
       for (const field of DELIVERY_UNIT_IDENTITY_FIELDS) {
         const markerValue = deliveryUnitIdentityFieldValue(marker, field);
         const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
@@ -82,6 +127,92 @@ export const verifyDeliveryUnitIdentity = (
           path: manifestPath,
         });
       }
+
+      if (surface === 'api') {
+        for (const field of ['rendererIdentity', 'rendererProfile']) {
+          if (Object.hasOwn(marker, field)) {
+            addIssue(issues, {
+              code: 'delivery-unit-drift',
+              message: `Cloudflare worker manifest API surface must not declare ${field}.`,
+              path: manifestPath,
+            });
+          }
+        }
+        continue;
+      }
+      const identity = marker.rendererIdentity;
+      const profile = marker.rendererProfile;
+      const errors = [
+        ...validateRendererIdentity(identity).errors,
+        ...validateRendererProfile(profile).errors,
+      ];
+      for (const error of errors) {
+        addIssue(issues, {
+          code: 'delivery-unit-drift',
+          message: `Cloudflare worker manifest UI ${error.path} ${error.message}`,
+          path: manifestPath,
+        });
+      }
+      if (errors.length || !isRecord(identity) || !isRecord(profile)) {
+        continue;
+      }
+      assertEqual(issues, identity.buildId, marker.buildMarker, {
+        code: 'delivery-unit-drift',
+        message:
+          'Cloudflare worker manifest UI rendererIdentity.buildId must match its surface buildMarker.',
+        path: manifestPath,
+      });
+      assertEqual(issues, identity.appId, marker.appId, {
+        code: 'delivery-unit-drift',
+        message:
+          'Cloudflare worker manifest UI rendererIdentity.appId must match its surface appId.',
+        path: manifestPath,
+      });
+      assertEqual(issues, marker.appId, stamped.appId, {
+        code: 'delivery-unit-drift',
+        message:
+          'Cloudflare worker manifest UI surface appId must match its delivery-unit appId.',
+        path: manifestPath,
+      });
+      for (const field of ['renderer', 'protocolVersion']) {
+        assertEqual(issues, identity[field], profile[field], {
+          code: 'delivery-unit-drift',
+          message: `Cloudflare worker manifest UI rendererProfile.${field} must match its renderer identity.`,
+          path: manifestPath,
+        });
+      }
+      const expectedUi = declared?.surfaces?.ui;
+      // A topology without a renderer projection declares no identity to match.
+      if (expectedUi?.rendererIdentity) {
+        for (const field of [
+          'renderer',
+          'appId',
+          'entryName',
+          'protocolVersion',
+          'buildId',
+        ] as const) {
+          assertEqual(
+            issues,
+            identity[field],
+            expectedUi.rendererIdentity[field],
+            {
+              code: 'delivery-unit-drift',
+              message: `Cloudflare worker manifest UI rendererIdentity.${field} must match the topology renderer identity.`,
+              path: manifestPath,
+            },
+          );
+        }
+        for (const error of validateRendererProfileCompatibility(
+          expectedUi.rendererProfile,
+          profile,
+        ).errors) {
+          addIssue(issues, {
+            code: 'delivery-unit-drift',
+            message: `Cloudflare worker manifest UI ${error.path} ${error.message}`,
+            path: manifestPath,
+          });
+        }
+      }
     }
   }
 };

package/src/cloudflare-output-verifier/index.ts

@@ -174,6 +174,26 @@ export const verifyCloudflareOutput = async (
   }
 
   if (wrangler) {
+    if (
+      typeof wrangler.name !== 'string' ||
+      wrangler.name.trim().length === 0
+    ) {
+      addIssue(issues, {
+        code: 'invalid-wrangler',
+        message: 'wrangler.json name must be a non-empty worker name.',
+        path: wranglerPath,
+      });
+    }
+    if (
+      typeof wrangler.compatibility_date !== 'string' ||
+      !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-wrangler',
+        message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+        path: wranglerPath,
+      });
+    }
     assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
       code: 'invalid-wrangler',
       message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/src/cloudflare-output-verifier/manifest.ts

@@ -61,6 +61,83 @@ export const verifyManifestShape = (
       path: manifestPath,
     });
   }
+  const security = manifest.security;
+  if (
+    !security ||
+    typeof security !== 'object' ||
+    typeof security.enabled !== 'boolean'
+  ) {
+    addIssue(issues, {
+      code: 'invalid-manifest',
+      message: 'Cloudflare output manifest security.enabled must be a boolean.',
+      path: manifestPath,
+    });
+  } else {
+    const cors = security.cors;
+    if (
+      !cors ||
+      typeof cors !== 'object' ||
+      typeof cors.assets !== 'boolean' ||
+      !Array.isArray(cors.allowedOrigins) ||
+      !Array.isArray(cors.allowedMethods) ||
+      !Array.isArray(cors.allowedHeaders)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.cors is incomplete.',
+        path: manifestPath,
+      });
+    }
+    if (security.enabled) {
+      const headers = security.headers;
+      const csp = security.contentSecurityPolicy;
+      const noindex = security.noindex;
+      if (
+        !headers ||
+        typeof headers !== 'object' ||
+        !['string', 'boolean'].includes(typeof headers.referrerPolicy) ||
+        !['string', 'boolean'].includes(typeof headers.contentTypeOptions) ||
+        !['string', 'boolean'].includes(typeof headers.permissionsPolicy)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.headers is incomplete.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !csp ||
+        !['off', 'report-only', 'enforce'].includes(csp.mode) ||
+        !csp.directives ||
+        typeof csp.directives !== 'object' ||
+        Array.isArray(csp.directives) ||
+        Object.values(csp.directives).some(
+          value =>
+            !Array.isArray(value) ||
+            value.some(entry => typeof entry !== 'string'),
+        )
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message:
+            'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !noindex ||
+        typeof noindex.workersDev !== 'boolean' ||
+        typeof noindex.localhost !== 'boolean' ||
+        !Array.isArray(noindex.previewHostnames)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.noindex is incomplete.',
+          path: manifestPath,
+        });
+      }
+    }
+  }
   if (manifest.bff?.runtimeFramework === 'effect') {
     assertEqual(
       issues,

package/src/cloudflare-output-verifier/mutation-policy.ts

@@ -140,7 +140,17 @@ export const verifyCloudflareOutputMutationPolicy = async (
     if (excludedFiles.has(file)) {
       continue;
     }
-    const source = await fs.readFile(file, 'utf-8');
+    let source: string;
+    try {
+      source = await fs.readFile(file, 'utf-8');
+    } catch (error) {
+      // Concurrent sibling builds delete transient files (for example tsgo
+      // resolved configs) between the walk and the read.
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        continue;
+      }
+      throw error;
+    }
     for (const forbidden of FORBIDDEN_MUTATION_PATTERNS) {
       if (forbidden.pattern.test(source)) {
         addIssue(issues, {

package/src/cloudflare-output-verifier/worker-bundles.ts

@@ -5,6 +5,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { parse } from '@babel/parser';
 import traverse, { type NodePath } from '@babel/traverse';
 import {
+  CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
   CLOUDFLARE_WORKER_BUNDLE_DIRECTORY,
   CLOUDFLARE_WORKER_NODE_BUILTINS,
   CLOUDFLARE_WORKER_PLATFORM_MODULES,
@@ -14,7 +15,7 @@ import { addIssue } from './issues';
 
 interface WorkerBundleReference {
   dispatcherExport?: string;
-  kind: 'effect-bff' | 'route';
+  kind: 'effect-bff' | 'route' | 'route-data';
   reference: string;
 }
 
@@ -22,12 +23,15 @@ interface ResolvedWorkerBundleReference extends WorkerBundleReference {
   path: string;
 }
 
-const getReferencedRouteWorkers = (manifest: JsonObject) =>
+const getReferencedRouteWorkers = (
+  manifest: JsonObject,
+  field: 'routeDataWorker' | 'worker',
+) =>
   Array.isArray(manifest?.routeSpec?.routes)
     ? manifest.routeSpec.routes
         .map((route: any) =>
-          typeof route?.worker === 'string' && route.worker.length > 0
-            ? route.worker
+          typeof route?.[field] === 'string' && route[field].length > 0
+            ? route[field]
             : undefined,
         )
         .filter(
@@ -58,10 +62,19 @@ export const getWorkerBundleReferences = (
           },
         ]
       : []),
-    ...getReferencedRouteWorkers(manifest).map((reference: string) => ({
-      kind: 'route' as const,
-      reference,
-    })),
+    ...getReferencedRouteWorkers(manifest, 'worker').map(
+      (reference: string) => ({
+        kind: 'route' as const,
+        reference,
+      }),
+    ),
+    ...getReferencedRouteWorkers(manifest, 'routeDataWorker').map(
+      (reference: string) => ({
+        dispatcherExport: CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
+        kind: 'route-data' as const,
+        reference,
+      }),
+    ),
   ];
 };
 
@@ -101,7 +114,9 @@ export const resolveWorkerBundleReference = (
 export const missingWorkerBundleMessage = (reference: WorkerBundleReference) =>
   reference.kind === 'effect-bff'
     ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
-    : 'Cloudflare route worker manifest points to a missing worker bundle.';
+    : reference.kind === 'route-data'
+      ? 'Cloudflare route data worker manifest points to a missing worker bundle.'
+      : 'Cloudflare route worker manifest points to a missing worker bundle.';
 
 interface AstNode {
   type: string;
@@ -611,14 +626,15 @@ export const verifyWorkerBundleReferences = async (
     contract,
   );
   if (
-    worker.kind === 'effect-bff' &&
     typeof worker.dispatcherExport === 'string' &&
     !entryAnalysis?.exports.has(worker.dispatcherExport)
   ) {
     addIssue(issues, {
       code: 'invalid-worker-bundle',
       message:
-        'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        worker.kind === 'route-data'
+          ? `Cloudflare route data worker bundle must expose ${worker.dispatcherExport}.`
+          : 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
       path: worker.path,
     });
   }

package/src/config.ts

@@ -2,15 +2,10 @@ export type { ResolveEffectTsgoCompilerOptions } from './build-config/public';
 export {
   getBuildConfigEnvironment,
   resolveEffectTsgoCompiler,
-  withBuildConfigEnvironment,
 } from './build-config/public';
-
-export type DeployTarget =
-  | 'node'
-  | 'vercel'
-  | 'netlify'
-  | 'ghPages'
-  | 'cloudflare';
+export { createRemoteManifestUrl } from './build-config/remote-address';
+export type { DeployTarget } from './deploy-output/target';
+export { resolveDeployTarget } from './deploy-output/target';
 
 export type CloudflareWorkerSecurityCspMode = 'enforce' | 'report-only' | 'off';
 
@@ -46,6 +41,18 @@ export interface CloudflareWorkerPublicAssetConfig {
   to: string;
 }
 
+export interface NodePublicAssetConfig {
+  /**
+   * Source file or directory, relative to the app root, to copy into the
+   * Node deploy output's public directory.
+   */
+  from: string;
+  /**
+   * Destination path relative to `.output/public`.
+   */
+  to: string;
+}
+
 export interface CloudflareWorkerD1DatabaseConfig {
   /**
    * Worker binding name, for example `DB`.
@@ -92,6 +99,19 @@ export interface CloudflareWorkerServiceBindingConfig {
   fragments?: CloudflareWorkerServiceBindingFragmentConfig[];
 }
 
+export interface CloudflareWorkerVpcServiceConfig {
+  /** Worker binding name exposed on the module worker `env` object. */
+  binding: string;
+  /** Workers VPC service id (`wrangler vpc service create`). */
+  serviceId: string;
+  /**
+   * Optional application path prefix that Modern.js should dispatch to this
+   * private origin with `env[binding].fetch(request)`, exactly like a
+   * prefixed Worker service binding.
+   */
+  prefix?: string;
+}
+
 export interface CloudflareWorkerServiceBindingFragmentConfig {
   /** Stable remote id used by the shell's composition contract. */
   remote: string;
@@ -187,17 +207,79 @@ export interface CloudflareWorkerSecurityConfig {
   reason?: string;
 }
 
+export interface CloudflareWorkerDeployConfig {
+  name?: string;
+  /**
+   * Cloudflare Workers compatibility date for generated wrangler config.
+   * Use YYYY-MM-DD. Defaults to the date validated against the bundled
+   * Wrangler version used by UltraModern generated workspaces.
+   */
+  compatibilityDate?: string;
+  ssr?: boolean;
+  security?: CloudflareWorkerSecurityConfig;
+  /**
+   * Raw Wrangler-compatible config merged into `.output/wrangler.json`.
+   * Framework-owned worker invariants still win for `main`, the assets
+   * binding/directory/run mode, and required compatibility flags.
+   */
+  wrangler?: Record<string, JsonValue>;
+  /**
+   * Additional app-root files or directories to stage under `.output`.
+   * Use this for provider resources such as migrations or generated config.
+   */
+  artifacts?: CloudflareWorkerArtifactConfig[];
+  /**
+   * Additional app-root files or directories to serve as Cloudflare Worker
+   * Static Assets under `.output/public`. Use `to: '.'` to copy a
+   * source directory's contents into the public asset root.
+   */
+  publicAssets?: CloudflareWorkerPublicAssetConfig[];
+  /**
+   * First-class Cloudflare D1 bindings. Modern.js writes these to
+   * `wrangler.json` as `d1_databases` and stages configured migration
+   * directories into `.output`.
+   */
+  d1Databases?: CloudflareWorkerD1DatabaseConfig[];
+  /**
+   * First-class Cloudflare service bindings. Modern.js writes these to
+   * `wrangler.json` as `services`; when a binding also has `prefix`,
+   * the generated Worker dispatches matching requests through
+   * `env[binding].fetch(request)`.
+   */
+  services?: CloudflareWorkerServiceBindingConfig[];
+  /**
+   * First-class Workers VPC service bindings to private origins reached
+   * through a Cloudflare Tunnel. Modern.js writes these to `wrangler.json`
+   * as `vpc_services`; a binding with `prefix` joins the prefix dispatch of
+   * `services`.
+   */
+  vpcServices?: CloudflareWorkerVpcServiceConfig[];
+  /**
+   * Dist output paths that must not be copied into Cloudflare public assets.
+   * Entries are slash-normalized path prefixes relative to the app dist root.
+   * Top-level `api` and `shared` dist directories are excluded when matching
+   * source directories exist in the app root because they conventionally
+   * contain server-only implementation code.
+   */
+  publicAssetExcludes?: string[];
+}
+
 export interface CloudflareDeployConfig {
-  worker?: {
-    name?: string;
-    compatibilityDate?: string;
-    ssr?: boolean;
-    security?: CloudflareWorkerSecurityConfig;
-    wrangler?: Record<string, JsonValue>;
-    artifacts?: CloudflareWorkerArtifactConfig[];
-    publicAssets?: CloudflareWorkerPublicAssetConfig[];
-    d1Databases?: CloudflareWorkerD1DatabaseConfig[];
-    services?: CloudflareWorkerServiceBindingConfig[];
-    publicAssetExcludes?: string[];
+  /** Release surface owned by this application, independent of federation production. */
+  releaseEnvelopeRole?: 'microvertical' | 'shell';
+  worker?: CloudflareWorkerDeployConfig;
+}
+
+export interface NodeDeployConfig {
+  node?: {
+    /**
+     * Additional app-root files or directories to stage under
+     * `.output/public` when `modern deploy` targets Node, the counterpart of
+     * `deploy.worker.publicAssets`. The Node server does not route these
+     * files; serve them from the app, for example from an API handler.
+     * Release envelopes record them as declared public assets, so API-only
+     * units may ship them.
+     */
+    publicAssets?: NodePublicAssetConfig[];
   };
 }