---
title: "DF0065: Invalid Remote Assets Package Or Version"
description: "Invalid remote-assets {field} \"{value}\"."
canonical_url: "https://devfra.me/errors/df0065"
---
# DF0065: Invalid Remote Assets Package Or Version

> Invalid remote-assets \{field} "\{value}".

## Message

> Invalid remote-assets `{field}` "`{value}`".

## Cause

A remote-assets source's `package` and `version` are interpolated into CDN URLs (`https://cdn.jsdelivr.net/npm/<package>@<version>/…`) and the on-disk cache path (`.remote-assets/<package>@<version>/`). So `package` must be a valid npm package name and `version` an exact semver version; a value carrying path separators, `@`, whitespace, or traversal segments (`..`) is rejected.

## Example

```ts
defineDevframe({
  clientAssets: {
    package: '@devframes/plugin-git-client',
    version: '../etc', // ✗ not a semver version
  },
})
```

## Fix

Use a valid npm package name and an exact version:

```ts
defineDevframe({
  clientAssets: {
    package: '@devframes/plugin-git-client',
    version: '1.2.3',
  },
})
```

## Source

- [`packages/devframe/src/utils/remote-assets.ts`](https://github.com/devframes/devframe/blob/main/packages/devframe/src/utils/remote-assets.ts): `resolveStaticAssetsSource()` validates a remote source before resolving it.


## Sitemap

See the full [sitemap](https://devfra.me/sitemap.md) for all pages.