@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.21 → 3.9.0-ultramodern.23

package/dist/esm/cloudflare/wrangler-config.mjs

@@ -127,6 +127,129 @@ const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>
     if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
     return services.map(normalizeServiceBinding);
 };
+const normalizeVpcService = (vpcService, index)=>{
+    const binding = assertNonEmptyString(vpcService.binding, `deploy.worker.vpcServices[${index}].binding`);
+    const serviceId = assertNonEmptyString(vpcService.serviceId, `deploy.worker.vpcServices[${index}].serviceId`);
+    const prefix = void 0 === vpcService.prefix ? void 0 : assertNonEmptyString(vpcService.prefix, `deploy.worker.vpcServices[${index}].prefix`);
+    return {
+        binding,
+        serviceId,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const decodeRoutePrefix = (prefix)=>{
+    let decoded = prefix;
+    for(let round = 0; round < 4; round += 1){
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch  {
+            break;
+        }
+        if (next === decoded) break;
+        decoded = next;
+    }
+    return decoded;
+};
+const normalizeRoutePrefix = (prefix)=>{
+    const decoded = decodeRoutePrefix(prefix);
+    return '/' === decoded ? decoded : decoded.replace(/\/+$/u, '');
+};
+const isCanonicalRoutePrefix = (prefix)=>prefix.startsWith('/') && !prefix.includes('\\') && decodeRoutePrefix(prefix) === prefix && new URL(prefix, 'https://route.invalid').pathname === prefix;
+const collectWorkerBindingNames = (config)=>{
+    const names = new Set();
+    const visit = (value, inArray)=>{
+        if (Array.isArray(value)) {
+            for (const item of value)visit(item, true);
+            return;
+        }
+        if (!isJsonRecord(value)) return;
+        for (const field of inArray ? [
+            'binding',
+            'name'
+        ] : [
+            'binding'
+        ]){
+            const name = value[field];
+            if ('string' == typeof name) names.add(name.trim());
+        }
+        for (const child of Object.values(value))visit(child, false);
+    };
+    for (const [key, value] of Object.entries(config))if ('env' !== key && 'services' !== key && 'vpc_services' !== key) {
+        if ('vars' === key && isJsonRecord(value)) {
+            for (const name of Object.keys(value))names.add(name);
+            continue;
+        }
+        visit(value, false);
+    }
+    return names;
+};
+const prefixesOverlap = (left, right)=>{
+    const [first, second] = [
+        normalizeRoutePrefix(left),
+        normalizeRoutePrefix(right)
+    ];
+    return '/' === first || '/' === second || first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+};
+const getWorkerEffectBffPrefix = (modernConfig)=>{
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    return isEffectApi && primaryBffPrefix ? primaryBffPrefix : void 0;
+};
+const effectiveServiceBindings = (serviceBindings)=>{
+    const bindings = Array.isArray(serviceBindings) ? serviceBindings : [];
+    return bindings.flatMap((service)=>isJsonRecord(service) && 'string' == typeof service.binding ? [
+            {
+                binding: service.binding.trim(),
+                prefix: 'string' == typeof service.prefix ? service.prefix : void 0
+            }
+        ] : []);
+};
+const createWorkerVpcServiceBindings = (modernConfig, configuredWranglerVpcServices, serviceBindings, workerBindingNames)=>{
+    const vpcServices = modernConfig.deploy?.worker?.vpcServices;
+    if (void 0 === vpcServices) return;
+    if (void 0 !== configuredWranglerVpcServices) throw new Error('Use deploy.worker.vpcServices or deploy.worker.wrangler.vpc_services, not both.');
+    if (!Array.isArray(vpcServices)) throw new Error('deploy.worker.vpcServices must be an array.');
+    const services = effectiveServiceBindings(serviceBindings);
+    const serviceBindingNames = new Set(services.map(({ binding })=>binding));
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
+    const routes = [
+        ...void 0 === effectBffPrefix ? [] : [
+            {
+                owner: 'the Effect BFF',
+                prefix: effectBffPrefix
+            }
+        ],
+        ...services.flatMap(({ binding, prefix })=>void 0 === prefix ? [] : [
+                {
+                    owner: `binding "${binding}"`,
+                    prefix
+                }
+            ])
+    ];
+    const vpcBindingNames = new Set();
+    return vpcServices.map((vpcService, index)=>{
+        const normalized = normalizeVpcService(vpcService, index);
+        if (serviceBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already declared by deploy.worker.services.`);
+        if (workerBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already a binding of this Worker.`);
+        if (vpcBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is declared more than once.`);
+        vpcBindingNames.add(normalized.binding);
+        if (void 0 !== normalized.prefix) {
+            const { prefix } = normalized;
+            if (!isCanonicalRoutePrefix(prefix)) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" must be a decoded URL path that starts with "/" (no query, fragment, "." or ".." segments).`);
+            const shadow = routes.find((route)=>prefixesOverlap(route.prefix, prefix));
+            if (void 0 !== shadow) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" overlaps the prefix "${shadow.prefix}" of ${shadow.owner}; the worker dispatcher would route one of them ambiguously.`);
+            routes.push({
+                owner: `binding "${normalized.binding}"`,
+                prefix
+            });
+        }
+        return normalized;
+    });
+};
 const createWranglerServices = (serviceBindings)=>{
     if (!Array.isArray(serviceBindings)) return serviceBindings;
     if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
@@ -135,8 +258,16 @@ const createWranglerServices = (serviceBindings)=>{
         return wranglerService;
     });
 };
-const createWorkerManifestServiceBindings = (serviceBindings)=>{
-    if (!Array.isArray(serviceBindings)) return;
+const createWorkerManifestServiceBindings = (serviceBindings, vpcServiceBindings)=>{
+    const vpcManifestBindings = (vpcServiceBindings ?? []).flatMap(({ binding, prefix, serviceId })=>void 0 === prefix ? [] : [
+            {
+                binding,
+                interface: 'fetch',
+                prefix,
+                vpcServiceId: serviceId
+            }
+        ]);
+    if (!Array.isArray(serviceBindings)) return vpcManifestBindings.length > 0 ? vpcManifestBindings : void 0;
     const bindings = serviceBindings;
     const manifestBindings = bindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && ('string' == typeof service.prefix || Array.isArray(service.fragments) && service.fragments.length > 0)).map((service)=>({
             binding: service.binding,
@@ -149,7 +280,11 @@ const createWorkerManifestServiceBindings = (serviceBindings)=>{
                 fragments: service.fragments
             }
         }));
-    return manifestBindings.length > 0 ? manifestBindings : void 0;
+    const allBindings = [
+        ...manifestBindings,
+        ...vpcManifestBindings
+    ];
+    return allBindings.length > 0 ? allBindings : void 0;
 };
 const createWranglerConfig = (appDirectory, modernConfig)=>{
     const wrangler = getConfiguredWrangler(modernConfig);
@@ -157,7 +292,7 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
     const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
     const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
     const wranglerServices = createWranglerServices(serviceBindings);
-    return {
+    const workerConfig = {
         $schema: 'node_modules/wrangler/config-schema.json',
         name: getConfiguredWorkerName(appDirectory, modernConfig),
         ...wrangler,
@@ -175,5 +310,33 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
             services: wranglerServices
         }
     };
+    const vpcServiceBindings = createWorkerVpcServiceBindings(modernConfig, wrangler.vpc_services, serviceBindings, collectWorkerBindingNames(workerConfig));
+    if (void 0 === vpcServiceBindings) return workerConfig;
+    const vpcServicesConfig = vpcServiceBindings.map(({ binding, serviceId })=>({
+            binding,
+            service_id: serviceId
+        }));
+    return {
+        ...workerConfig,
+        ...void 0 === environments ? {} : {
+            env: Object.fromEntries(Object.entries(environments).map(([name, environment])=>{
+                if (void 0 !== environment.vpc_services) throw new Error(`Use deploy.worker.vpcServices or deploy.worker.wrangler.env.${name}.vpc_services, not both.`);
+                const environmentBindingNames = new Set([
+                    ...collectWorkerBindingNames(environment),
+                    ...effectiveServiceBindings(environment.services).map(({ binding })=>binding)
+                ]);
+                const collision = vpcServiceBindings.find(({ binding })=>environmentBindingNames.has(binding));
+                if (void 0 !== collision) throw new Error(`deploy.worker.vpcServices binding "${collision.binding}" is already a binding of deploy.worker.wrangler.env.${name}.`);
+                return [
+                    name,
+                    {
+                        ...environment,
+                        vpc_services: vpcServicesConfig
+                    }
+                ];
+            }))
+        },
+        vpc_services: vpcServicesConfig
+    };
 };
-export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, createWranglerConfig, getWorkerEffectBffPrefix };

package/dist/esm/cloudflare-output-contract.mjs

@@ -79,7 +79,8 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'zlib'
 ];
 const CLOUDFLARE_WORKER_PLATFORM_MODULES = [
-    'cloudflare:sockets'
+    'cloudflare:sockets',
+    'cloudflare:workers'
 ];
 const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
     'nodejs_compat',

package/dist/esm-node/build-config/build-environment.mjs

@@ -1,21 +1,48 @@
 import "node:module";
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { accessSync, chmodSync, constants, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, join } from "node:path";
 const EFFECT_TSGO_PACKAGE = '@effect/tsgo';
-const EFFECT_TSGO_BIN = 'effect-tsgo';
+const NATIVE_TYPESCRIPT_PACKAGES = [
+    "typescript",
+    "@typescript/native"
+];
 const EFFECT_TSGO_RESOLUTION_ERROR = 'Unable to resolve the Effect TS-Go compiler. Install "@effect/tsgo" and a native TypeScript backend for this build config, or set EFFECT_TSGO_BIN.';
 const executableEffectTsgoCompilers = new Map();
-function resolveEffectTsgoCli(from) {
+function readJson(fileName) {
+    return JSON.parse(readFileSync(fileName, 'utf-8'));
+}
+function resolvePackageVersion(packageRequire, packageName) {
+    let packageJsonPath;
+    try {
+        packageJsonPath = packageRequire.resolve(`${packageName}/package.json`);
+    } catch  {
+        return;
+    }
+    const { version } = readJson(packageJsonPath);
+    return 'string' == typeof version ? {
+        packageJsonPath,
+        version
+    } : void 0;
+}
+function resolveEffectTsgoTypeScriptArtifact(from) {
     const projectRequire = createRequire(from);
-    const packageJsonPath = projectRequire.resolve(`${EFFECT_TSGO_PACKAGE}/package.json`);
-    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
-    const bin = 'string' == typeof packageJson.bin ? packageJson.bin : packageJson.bin?.[EFFECT_TSGO_BIN];
-    if (!bin) throw new Error(EFFECT_TSGO_RESOLUTION_ERROR);
-    return resolve(dirname(packageJsonPath), bin);
+    const effectTsgoPackageJsonPath = projectRequire.resolve(`${EFFECT_TSGO_PACKAGE}/package.json`);
+    const platformTarget = `${process.platform}-${process.arch}`;
+    const effectTsgoPlatformPackageJsonPath = createRequire(effectTsgoPackageJsonPath).resolve(`${EFFECT_TSGO_PACKAGE}-${platformTarget}/package.json`);
+    const upstream = readJson(join(dirname(effectTsgoPlatformPackageJsonPath), 'lib', 'upstream.json'));
+    const packagedTypeScriptVersions = upstream.components?.typescript ?? {};
+    for (const packageName of NATIVE_TYPESCRIPT_PACKAGES){
+        const typescript = resolvePackageVersion(projectRequire, packageName);
+        const major = typescript && /^\s*(\d+)/u.exec(typescript.version);
+        if (!typescript || !major || Number(major[1]) < 7) continue;
+        const typescriptPlatform = resolvePackageVersion(createRequire(typescript.packageJsonPath), `@typescript/typescript-${platformTarget}`);
+        if (!typescriptPlatform || !Object.hasOwn(packagedTypeScriptVersions, typescriptPlatform.version)) break;
+        return join(dirname(effectTsgoPlatformPackageJsonPath), 'artifacts', "typescript", typescriptPlatform.version, 'win32' === process.platform ? 'tsc.exe' : 'tsc');
+    }
+    throw new Error(EFFECT_TSGO_RESOLUTION_ERROR);
 }
 function resolveExecutableEffectTsgoCompiler(compilerPath) {
     if ('win32' === process.platform) return compilerPath;
@@ -76,13 +103,7 @@ function resolveEffectTsgoCompiler(options) {
         throw new Error(EFFECT_TSGO_RESOLUTION_ERROR);
     }
     try {
-        const compiler = execFileSync(process.execPath, [
-            resolveEffectTsgoCli(options.from),
-            'get-exe-path'
-        ], {
-            encoding: 'utf-8'
-        }).trim();
-        if (compiler) return resolveExecutableEffectTsgoCompiler(compiler);
+        return resolveExecutableEffectTsgoCompiler(resolveEffectTsgoTypeScriptArtifact(options.from));
     } catch  {}
     throw new Error(EFFECT_TSGO_RESOLUTION_ERROR);
 }

package/dist/esm-node/cloudflare/worker-manifest.mjs

@@ -7,7 +7,7 @@ import { ASSETS_BINDING, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, BFF_EFFECT_WORKER_
 import { createI18nWorkerManifest } from "./i18n-worker.mjs";
 import { createCloudflareWorkerSecurityPolicy } from "./security-policies.mjs";
 import { isRecord, normalizeRelativePath } from "./utils.mjs";
-import { createWorkerManifestServiceBindings, createWorkerServiceBindings } from "./wrangler-config.mjs";
+import { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, getWorkerEffectBffPrefix } from "./wrangler-config.mjs";
 const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
 const createEffectBffWorkerManifest = (modernConfig)=>{
     const bff = modernConfig.bff;
@@ -81,13 +81,15 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             } : {}
         };
     }));
-    const bffPrefix = modernConfig.bff?.prefix;
-    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
     const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
     const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
-    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
+    const typedServiceBindings = createWorkerServiceBindings(modernConfig, void 0);
+    const serviceBindings = createWorkerManifestServiceBindings(typedServiceBindings, createWorkerVpcServiceBindings(modernConfig, void 0, typedServiceBindings, new Set([
+        ASSETS_BINDING
+    ])));
     const moduleFederation = await createModuleFederationWorkerManifest(outputDirectory);
-    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
+    if (void 0 !== effectBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
     const effectBffManifest = isEffectApi ? createEffectBffWorkerManifest(modernConfig) : void 0;
     return {
         version: 1,
@@ -124,10 +126,10 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             deliveryUnit: deliveryUnitStamp
         } : {},
         i18n: createI18nWorkerManifest(routeSpec, appContext),
-        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+        bff: void 0 !== effectBffPrefix && effectApiWorkerExists ? {
             dispatcherExport: BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
             runtimeFramework: 'effect',
-            prefix: primaryBffPrefix,
+            prefix: effectBffPrefix,
             worker: BFF_EFFECT_WORKER_ENTRY,
             effect: effectBffManifest
         } : void 0,

package/dist/esm-node/cloudflare/wrangler-config.mjs

@@ -128,6 +128,129 @@ const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>
     if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
     return services.map(normalizeServiceBinding);
 };
+const normalizeVpcService = (vpcService, index)=>{
+    const binding = assertNonEmptyString(vpcService.binding, `deploy.worker.vpcServices[${index}].binding`);
+    const serviceId = assertNonEmptyString(vpcService.serviceId, `deploy.worker.vpcServices[${index}].serviceId`);
+    const prefix = void 0 === vpcService.prefix ? void 0 : assertNonEmptyString(vpcService.prefix, `deploy.worker.vpcServices[${index}].prefix`);
+    return {
+        binding,
+        serviceId,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const decodeRoutePrefix = (prefix)=>{
+    let decoded = prefix;
+    for(let round = 0; round < 4; round += 1){
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch  {
+            break;
+        }
+        if (next === decoded) break;
+        decoded = next;
+    }
+    return decoded;
+};
+const normalizeRoutePrefix = (prefix)=>{
+    const decoded = decodeRoutePrefix(prefix);
+    return '/' === decoded ? decoded : decoded.replace(/\/+$/u, '');
+};
+const isCanonicalRoutePrefix = (prefix)=>prefix.startsWith('/') && !prefix.includes('\\') && decodeRoutePrefix(prefix) === prefix && new URL(prefix, 'https://route.invalid').pathname === prefix;
+const collectWorkerBindingNames = (config)=>{
+    const names = new Set();
+    const visit = (value, inArray)=>{
+        if (Array.isArray(value)) {
+            for (const item of value)visit(item, true);
+            return;
+        }
+        if (!isJsonRecord(value)) return;
+        for (const field of inArray ? [
+            'binding',
+            'name'
+        ] : [
+            'binding'
+        ]){
+            const name = value[field];
+            if ('string' == typeof name) names.add(name.trim());
+        }
+        for (const child of Object.values(value))visit(child, false);
+    };
+    for (const [key, value] of Object.entries(config))if ('env' !== key && 'services' !== key && 'vpc_services' !== key) {
+        if ('vars' === key && isJsonRecord(value)) {
+            for (const name of Object.keys(value))names.add(name);
+            continue;
+        }
+        visit(value, false);
+    }
+    return names;
+};
+const prefixesOverlap = (left, right)=>{
+    const [first, second] = [
+        normalizeRoutePrefix(left),
+        normalizeRoutePrefix(right)
+    ];
+    return '/' === first || '/' === second || first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+};
+const getWorkerEffectBffPrefix = (modernConfig)=>{
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    return isEffectApi && primaryBffPrefix ? primaryBffPrefix : void 0;
+};
+const effectiveServiceBindings = (serviceBindings)=>{
+    const bindings = Array.isArray(serviceBindings) ? serviceBindings : [];
+    return bindings.flatMap((service)=>isJsonRecord(service) && 'string' == typeof service.binding ? [
+            {
+                binding: service.binding.trim(),
+                prefix: 'string' == typeof service.prefix ? service.prefix : void 0
+            }
+        ] : []);
+};
+const createWorkerVpcServiceBindings = (modernConfig, configuredWranglerVpcServices, serviceBindings, workerBindingNames)=>{
+    const vpcServices = modernConfig.deploy?.worker?.vpcServices;
+    if (void 0 === vpcServices) return;
+    if (void 0 !== configuredWranglerVpcServices) throw new Error('Use deploy.worker.vpcServices or deploy.worker.wrangler.vpc_services, not both.');
+    if (!Array.isArray(vpcServices)) throw new Error('deploy.worker.vpcServices must be an array.');
+    const services = effectiveServiceBindings(serviceBindings);
+    const serviceBindingNames = new Set(services.map(({ binding })=>binding));
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
+    const routes = [
+        ...void 0 === effectBffPrefix ? [] : [
+            {
+                owner: 'the Effect BFF',
+                prefix: effectBffPrefix
+            }
+        ],
+        ...services.flatMap(({ binding, prefix })=>void 0 === prefix ? [] : [
+                {
+                    owner: `binding "${binding}"`,
+                    prefix
+                }
+            ])
+    ];
+    const vpcBindingNames = new Set();
+    return vpcServices.map((vpcService, index)=>{
+        const normalized = normalizeVpcService(vpcService, index);
+        if (serviceBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already declared by deploy.worker.services.`);
+        if (workerBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already a binding of this Worker.`);
+        if (vpcBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is declared more than once.`);
+        vpcBindingNames.add(normalized.binding);
+        if (void 0 !== normalized.prefix) {
+            const { prefix } = normalized;
+            if (!isCanonicalRoutePrefix(prefix)) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" must be a decoded URL path that starts with "/" (no query, fragment, "." or ".." segments).`);
+            const shadow = routes.find((route)=>prefixesOverlap(route.prefix, prefix));
+            if (void 0 !== shadow) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" overlaps the prefix "${shadow.prefix}" of ${shadow.owner}; the worker dispatcher would route one of them ambiguously.`);
+            routes.push({
+                owner: `binding "${normalized.binding}"`,
+                prefix
+            });
+        }
+        return normalized;
+    });
+};
 const createWranglerServices = (serviceBindings)=>{
     if (!Array.isArray(serviceBindings)) return serviceBindings;
     if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
@@ -136,8 +259,16 @@ const createWranglerServices = (serviceBindings)=>{
         return wranglerService;
     });
 };
-const createWorkerManifestServiceBindings = (serviceBindings)=>{
-    if (!Array.isArray(serviceBindings)) return;
+const createWorkerManifestServiceBindings = (serviceBindings, vpcServiceBindings)=>{
+    const vpcManifestBindings = (vpcServiceBindings ?? []).flatMap(({ binding, prefix, serviceId })=>void 0 === prefix ? [] : [
+            {
+                binding,
+                interface: 'fetch',
+                prefix,
+                vpcServiceId: serviceId
+            }
+        ]);
+    if (!Array.isArray(serviceBindings)) return vpcManifestBindings.length > 0 ? vpcManifestBindings : void 0;
     const bindings = serviceBindings;
     const manifestBindings = bindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && ('string' == typeof service.prefix || Array.isArray(service.fragments) && service.fragments.length > 0)).map((service)=>({
             binding: service.binding,
@@ -150,7 +281,11 @@ const createWorkerManifestServiceBindings = (serviceBindings)=>{
                 fragments: service.fragments
             }
         }));
-    return manifestBindings.length > 0 ? manifestBindings : void 0;
+    const allBindings = [
+        ...manifestBindings,
+        ...vpcManifestBindings
+    ];
+    return allBindings.length > 0 ? allBindings : void 0;
 };
 const createWranglerConfig = (appDirectory, modernConfig)=>{
     const wrangler = getConfiguredWrangler(modernConfig);
@@ -158,7 +293,7 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
     const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
     const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
     const wranglerServices = createWranglerServices(serviceBindings);
-    return {
+    const workerConfig = {
         $schema: 'node_modules/wrangler/config-schema.json',
         name: getConfiguredWorkerName(appDirectory, modernConfig),
         ...wrangler,
@@ -176,5 +311,33 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
             services: wranglerServices
         }
     };
+    const vpcServiceBindings = createWorkerVpcServiceBindings(modernConfig, wrangler.vpc_services, serviceBindings, collectWorkerBindingNames(workerConfig));
+    if (void 0 === vpcServiceBindings) return workerConfig;
+    const vpcServicesConfig = vpcServiceBindings.map(({ binding, serviceId })=>({
+            binding,
+            service_id: serviceId
+        }));
+    return {
+        ...workerConfig,
+        ...void 0 === environments ? {} : {
+            env: Object.fromEntries(Object.entries(environments).map(([name, environment])=>{
+                if (void 0 !== environment.vpc_services) throw new Error(`Use deploy.worker.vpcServices or deploy.worker.wrangler.env.${name}.vpc_services, not both.`);
+                const environmentBindingNames = new Set([
+                    ...collectWorkerBindingNames(environment),
+                    ...effectiveServiceBindings(environment.services).map(({ binding })=>binding)
+                ]);
+                const collision = vpcServiceBindings.find(({ binding })=>environmentBindingNames.has(binding));
+                if (void 0 !== collision) throw new Error(`deploy.worker.vpcServices binding "${collision.binding}" is already a binding of deploy.worker.wrangler.env.${name}.`);
+                return [
+                    name,
+                    {
+                        ...environment,
+                        vpc_services: vpcServicesConfig
+                    }
+                ];
+            }))
+        },
+        vpc_services: vpcServicesConfig
+    };
 };
-export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, createWranglerConfig, getWorkerEffectBffPrefix };

package/dist/esm-node/cloudflare-output-contract.mjs

@@ -80,7 +80,8 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'zlib'
 ];
 const CLOUDFLARE_WORKER_PLATFORM_MODULES = [
-    'cloudflare:sockets'
+    'cloudflare:sockets',
+    'cloudflare:workers'
 ];
 const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
     'nodejs_compat',

package/dist/types/cloudflare/worker-manifest.d.ts

@@ -130,7 +130,12 @@ export declare const createWorkerManifest: (outputDirectory: string, modernConfi
             };
         } | undefined;
     } | undefined;
-    serviceBindings?: {
+    serviceBindings?: ({
+        binding: string;
+        interface: string;
+        prefix: string;
+        vpcServiceId: string;
+    } | {
         binding: string;
         service: string;
         interface: string;
@@ -141,7 +146,7 @@ export declare const createWorkerManifest: (outputDirectory: string, modernConfi
             boundaryId: string;
             path: string;
         }[] | undefined;
-    }[] | undefined;
+    })[] | undefined;
 }>;
 export declare const createWorkerModuleLoaders: (manifest: any) => string;
 export declare const getPublicAssetExcludes: (appDirectory: string, modernConfig: CloudflareModernConfig) => string[];

package/dist/types/cloudflare/wrangler-config.d.ts

@@ -11,7 +11,22 @@ export declare const createWorkerServiceBindings: (modernConfig: CloudflareModer
         path: string;
     }[] | undefined;
 }[] | JsonValue | undefined;
-export declare const createWorkerManifestServiceBindings: (serviceBindings: ReturnType<typeof createWorkerServiceBindings>) => {
+/**
+ * The prefix the worker's Effect BFF dispatcher owns. It runs before any
+ * service binding, so it takes part in route-overlap checks.
+ */
+export declare const getWorkerEffectBffPrefix: (modernConfig: CloudflareModernConfig) => string | undefined;
+export declare const createWorkerVpcServiceBindings: (modernConfig: CloudflareModernConfig, configuredWranglerVpcServices: JsonValue | undefined, serviceBindings: ReturnType<typeof createWorkerServiceBindings>, workerBindingNames: ReadonlySet<string>) => {
+    binding: string;
+    serviceId: string;
+    prefix?: string | undefined;
+}[] | undefined;
+export declare const createWorkerManifestServiceBindings: (serviceBindings: ReturnType<typeof createWorkerServiceBindings>, vpcServiceBindings: ReturnType<typeof createWorkerVpcServiceBindings>) => ({
+    binding: string;
+    interface: string;
+    prefix: string;
+    vpcServiceId: string;
+} | {
     binding: string;
     service: string;
     interface: string;
@@ -22,7 +37,7 @@ export declare const createWorkerManifestServiceBindings: (serviceBindings: Retu
         boundaryId: string;
         path: string;
     }[] | undefined;
-}[] | undefined;
+})[] | undefined;
 export declare const createWranglerConfig: (appDirectory: string, modernConfig: CloudflareModernConfig) => {
     $schema: string;
     name: string;
@@ -34,10 +49,38 @@ export declare const createWranglerConfig: (appDirectory: string, modernConfig:
         binding: string;
         run_worker_first: boolean;
     };
-    env?: {
+    env?: Record<string, Record<string, JsonValue>> | undefined;
+    d1_databases?: {
+        binding: string;
+        database_name: string;
+        database_id: string;
+        migrations_dir?: string | undefined;
+        preview_database_id?: string | undefined;
+        remote?: boolean | undefined;
+    }[] | JsonValue | undefined;
+    services?: string | number | boolean | JsonValue[] | {
+        binding: string;
+        service: string;
+    }[] | {
+        [key: string]: JsonValue;
+    } | null | undefined;
+} | {
+    $schema: string;
+    name: string;
+    compatibility_date: string;
+    main: string;
+    compatibility_flags: JsonValue[];
+    assets: {
+        directory: string;
+        binding: string;
+        run_worker_first: boolean;
+    };
+    env?: Record<string, Record<string, JsonValue>> | {
         [k: string]: {
-            compatibility_date?: string | undefined;
-            compatibility_flags?: JsonValue[] | undefined;
+            vpc_services: {
+                binding: string;
+                service_id: string;
+            }[];
         };
     } | undefined;
     d1_databases?: {
@@ -54,4 +97,8 @@ export declare const createWranglerConfig: (appDirectory: string, modernConfig:
     }[] | {
         [key: string]: JsonValue;
     } | null | undefined;
+    vpc_services: {
+        binding: string;
+        service_id: string;
+    }[];
 };

package/dist/types/cloudflare-output-contract.d.ts

@@ -13,5 +13,5 @@ export declare const CLOUDFLARE_WORKER_BUNDLE_FORMAT = "commonjs";
 export declare const CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT = "handleRouteDataRequest";
 export declare const getCloudflareWorkerRouteDataEntryName: (entryName: string) => string;
 export declare const CLOUDFLARE_WORKER_NODE_BUILTINS: readonly ['_http_agent', '_http_client', '_http_common', '_http_incoming', '_http_outgoing', '_http_server', '_tls_common', '_tls_wrap', 'assert', 'assert/strict', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants', 'crypto', 'dgram', 'diagnostics_channel', 'dns', 'dns/promises', 'domain', 'events', 'fs', 'fs/promises', 'http', 'http2', 'https', 'inspector', 'inspector/promises', 'module', 'net', 'os', 'path', 'path/posix', 'path/win32', 'perf_hooks', 'process', 'punycode', 'querystring', 'readline', 'readline/promises', 'repl', 'sqlite', 'stream', 'stream/consumers', 'stream/promises', 'stream/web', 'string_decoder', 'sys', 'test', 'timers', 'timers/promises', 'tls', 'trace_events', 'tty', 'url', 'util', 'util/types', 'v8', 'vm', 'wasi', 'worker_threads', 'zlib'];
-export declare const CLOUDFLARE_WORKER_PLATFORM_MODULES: readonly ['cloudflare:sockets'];
+export declare const CLOUDFLARE_WORKER_PLATFORM_MODULES: readonly ['cloudflare:sockets', 'cloudflare:workers'];
 export declare const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS: readonly ['nodejs_compat', 'global_fetch_strictly_public'];