@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.22 → 3.9.0-ultramodern.23

package/README.md

@@ -3,3 +3,26 @@
 Fork-owned UltraModern.js app tooling for Cloudflare Worker delivery, output verification, and release-envelope identity enforcement.
 
 The package is composed into upstream app-tools through existing deploy/plugin extension seams. It must not depend on `@modern-js/app-tools`.
+
+## Private origins and module-scope bindings
+
+Private origins behind a Cloudflare Tunnel are first-class on
+`deploy.worker.vpcServices` (`{ binding, serviceId, prefix? }`). Modern.js
+writes them to `wrangler.json` as `vpc_services` (top level and every
+`wrangler.env.<name>`, because Wrangler bindings are not inherited), and a
+binding with `prefix`
+is dispatched with `env[binding].fetch(request)` like a prefixed
+`deploy.worker.services` entry. A VPC binding name may not reuse any other
+Worker binding: any `binding` field or array-entry `name` in the Wrangler
+config (`ASSETS`, services, D1, KV, Hyperdrive, queue producers, Durable
+Objects, `send_email`, rate limits, …), including each `wrangler.env.<name>`'s
+own bindings, or a `vars` key. A VPC prefix must be a decoded path starting with `/` that URL parsing keeps unchanged (no query, fragment,
+`.` or `..` segments), and may not overlap, even as a percent-encoded alias, the
+Effect BFF prefix or any other routed prefix (the worker decodes the request
+path, dispatches the BFF first, matches path segments and takes the first
+match),
+and the typed option excludes a raw `wrangler.vpc_services`.
+
+Code that needs a binding outside the request handler, such as a Hyperdrive
+connection string or a VPC fetcher, imports `env` from `cloudflare:workers`,
+which worker bundles externalize like `cloudflare:sockets`.

package/dist/cjs/cloudflare/worker-manifest.js

@@ -126,13 +126,15 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             } : {}
         };
     }));
-    const bffPrefix = modernConfig.bff?.prefix;
-    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
     const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectBffPrefix = (0, external_wrangler_config_js_namespaceObject.getWorkerEffectBffPrefix)(modernConfig);
     const effectApiWorkerExists = await utils_namespaceObject.fs.pathExists(external_node_path_default().join(outputDirectory, external_constants_js_namespaceObject.BFF_EFFECT_WORKER_ENTRY));
-    const serviceBindings = (0, external_wrangler_config_js_namespaceObject.createWorkerManifestServiceBindings)((0, external_wrangler_config_js_namespaceObject.createWorkerServiceBindings)(modernConfig, void 0));
+    const typedServiceBindings = (0, external_wrangler_config_js_namespaceObject.createWorkerServiceBindings)(modernConfig, void 0);
+    const serviceBindings = (0, external_wrangler_config_js_namespaceObject.createWorkerManifestServiceBindings)(typedServiceBindings, (0, external_wrangler_config_js_namespaceObject.createWorkerVpcServiceBindings)(modernConfig, void 0, typedServiceBindings, new Set([
+        external_constants_js_namespaceObject.ASSETS_BINDING
+    ])));
     const moduleFederation = await createModuleFederationWorkerManifest(outputDirectory);
-    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, external_constants_js_namespaceObject.BFF_EFFECT_WORKER_ENTRY);
+    if (void 0 !== effectBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, external_constants_js_namespaceObject.BFF_EFFECT_WORKER_ENTRY);
     const effectBffManifest = isEffectApi ? createEffectBffWorkerManifest(modernConfig) : void 0;
     return {
         version: 1,
@@ -169,10 +171,10 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             deliveryUnit: deliveryUnitStamp
         } : {},
         i18n: (0, external_i18n_worker_js_namespaceObject.createI18nWorkerManifest)(routeSpec, appContext),
-        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+        bff: void 0 !== effectBffPrefix && effectApiWorkerExists ? {
             dispatcherExport: external_constants_js_namespaceObject.BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
             runtimeFramework: 'effect',
-            prefix: primaryBffPrefix,
+            prefix: effectBffPrefix,
             worker: external_constants_js_namespaceObject.BFF_EFFECT_WORKER_ENTRY,
             effect: effectBffManifest
         } : void 0,

package/dist/cjs/cloudflare/wrangler-config.js

@@ -39,7 +39,9 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
     createWorkerManifestServiceBindings: ()=>createWorkerManifestServiceBindings,
     createWorkerServiceBindings: ()=>createWorkerServiceBindings,
-    createWranglerConfig: ()=>createWranglerConfig
+    createWorkerVpcServiceBindings: ()=>createWorkerVpcServiceBindings,
+    createWranglerConfig: ()=>createWranglerConfig,
+    getWorkerEffectBffPrefix: ()=>getWorkerEffectBffPrefix
 });
 const external_node_path_namespaceObject = require("node:path");
 var external_node_path_default = /*#__PURE__*/ __webpack_require__.n(external_node_path_namespaceObject);
@@ -171,6 +173,129 @@ const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>
     if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
     return services.map(normalizeServiceBinding);
 };
+const normalizeVpcService = (vpcService, index)=>{
+    const binding = assertNonEmptyString(vpcService.binding, `deploy.worker.vpcServices[${index}].binding`);
+    const serviceId = assertNonEmptyString(vpcService.serviceId, `deploy.worker.vpcServices[${index}].serviceId`);
+    const prefix = void 0 === vpcService.prefix ? void 0 : assertNonEmptyString(vpcService.prefix, `deploy.worker.vpcServices[${index}].prefix`);
+    return {
+        binding,
+        serviceId,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const decodeRoutePrefix = (prefix)=>{
+    let decoded = prefix;
+    for(let round = 0; round < 4; round += 1){
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch  {
+            break;
+        }
+        if (next === decoded) break;
+        decoded = next;
+    }
+    return decoded;
+};
+const normalizeRoutePrefix = (prefix)=>{
+    const decoded = decodeRoutePrefix(prefix);
+    return '/' === decoded ? decoded : decoded.replace(/\/+$/u, '');
+};
+const isCanonicalRoutePrefix = (prefix)=>prefix.startsWith('/') && !prefix.includes('\\') && decodeRoutePrefix(prefix) === prefix && new URL(prefix, 'https://route.invalid').pathname === prefix;
+const collectWorkerBindingNames = (config)=>{
+    const names = new Set();
+    const visit = (value, inArray)=>{
+        if (Array.isArray(value)) {
+            for (const item of value)visit(item, true);
+            return;
+        }
+        if (!(0, external_utils_js_namespaceObject.isJsonRecord)(value)) return;
+        for (const field of inArray ? [
+            'binding',
+            'name'
+        ] : [
+            'binding'
+        ]){
+            const name = value[field];
+            if ('string' == typeof name) names.add(name.trim());
+        }
+        for (const child of Object.values(value))visit(child, false);
+    };
+    for (const [key, value] of Object.entries(config))if ('env' !== key && 'services' !== key && 'vpc_services' !== key) {
+        if ('vars' === key && (0, external_utils_js_namespaceObject.isJsonRecord)(value)) {
+            for (const name of Object.keys(value))names.add(name);
+            continue;
+        }
+        visit(value, false);
+    }
+    return names;
+};
+const prefixesOverlap = (left, right)=>{
+    const [first, second] = [
+        normalizeRoutePrefix(left),
+        normalizeRoutePrefix(right)
+    ];
+    return '/' === first || '/' === second || first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+};
+const getWorkerEffectBffPrefix = (modernConfig)=>{
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    return isEffectApi && primaryBffPrefix ? primaryBffPrefix : void 0;
+};
+const effectiveServiceBindings = (serviceBindings)=>{
+    const bindings = Array.isArray(serviceBindings) ? serviceBindings : [];
+    return bindings.flatMap((service)=>(0, external_utils_js_namespaceObject.isJsonRecord)(service) && 'string' == typeof service.binding ? [
+            {
+                binding: service.binding.trim(),
+                prefix: 'string' == typeof service.prefix ? service.prefix : void 0
+            }
+        ] : []);
+};
+const createWorkerVpcServiceBindings = (modernConfig, configuredWranglerVpcServices, serviceBindings, workerBindingNames)=>{
+    const vpcServices = modernConfig.deploy?.worker?.vpcServices;
+    if (void 0 === vpcServices) return;
+    if (void 0 !== configuredWranglerVpcServices) throw new Error('Use deploy.worker.vpcServices or deploy.worker.wrangler.vpc_services, not both.');
+    if (!Array.isArray(vpcServices)) throw new Error('deploy.worker.vpcServices must be an array.');
+    const services = effectiveServiceBindings(serviceBindings);
+    const serviceBindingNames = new Set(services.map(({ binding })=>binding));
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
+    const routes = [
+        ...void 0 === effectBffPrefix ? [] : [
+            {
+                owner: 'the Effect BFF',
+                prefix: effectBffPrefix
+            }
+        ],
+        ...services.flatMap(({ binding, prefix })=>void 0 === prefix ? [] : [
+                {
+                    owner: `binding "${binding}"`,
+                    prefix
+                }
+            ])
+    ];
+    const vpcBindingNames = new Set();
+    return vpcServices.map((vpcService, index)=>{
+        const normalized = normalizeVpcService(vpcService, index);
+        if (serviceBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already declared by deploy.worker.services.`);
+        if (workerBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already a binding of this Worker.`);
+        if (vpcBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is declared more than once.`);
+        vpcBindingNames.add(normalized.binding);
+        if (void 0 !== normalized.prefix) {
+            const { prefix } = normalized;
+            if (!isCanonicalRoutePrefix(prefix)) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" must be a decoded URL path that starts with "/" (no query, fragment, "." or ".." segments).`);
+            const shadow = routes.find((route)=>prefixesOverlap(route.prefix, prefix));
+            if (void 0 !== shadow) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" overlaps the prefix "${shadow.prefix}" of ${shadow.owner}; the worker dispatcher would route one of them ambiguously.`);
+            routes.push({
+                owner: `binding "${normalized.binding}"`,
+                prefix
+            });
+        }
+        return normalized;
+    });
+};
 const createWranglerServices = (serviceBindings)=>{
     if (!Array.isArray(serviceBindings)) return serviceBindings;
     if (!serviceBindings.every(external_utils_js_namespaceObject.isJsonRecord)) return serviceBindings;
@@ -179,8 +304,16 @@ const createWranglerServices = (serviceBindings)=>{
         return wranglerService;
     });
 };
-const createWorkerManifestServiceBindings = (serviceBindings)=>{
-    if (!Array.isArray(serviceBindings)) return;
+const createWorkerManifestServiceBindings = (serviceBindings, vpcServiceBindings)=>{
+    const vpcManifestBindings = (vpcServiceBindings ?? []).flatMap(({ binding, prefix, serviceId })=>void 0 === prefix ? [] : [
+            {
+                binding,
+                interface: 'fetch',
+                prefix,
+                vpcServiceId: serviceId
+            }
+        ]);
+    if (!Array.isArray(serviceBindings)) return vpcManifestBindings.length > 0 ? vpcManifestBindings : void 0;
     const bindings = serviceBindings;
     const manifestBindings = bindings.filter((service)=>(0, external_utils_js_namespaceObject.isJsonRecord)(service) && 'string' == typeof service.binding && 'string' == typeof service.service && ('string' == typeof service.prefix || Array.isArray(service.fragments) && service.fragments.length > 0)).map((service)=>({
             binding: service.binding,
@@ -193,7 +326,11 @@ const createWorkerManifestServiceBindings = (serviceBindings)=>{
                 fragments: service.fragments
             }
         }));
-    return manifestBindings.length > 0 ? manifestBindings : void 0;
+    const allBindings = [
+        ...manifestBindings,
+        ...vpcManifestBindings
+    ];
+    return allBindings.length > 0 ? allBindings : void 0;
 };
 const createWranglerConfig = (appDirectory, modernConfig)=>{
     const wrangler = getConfiguredWrangler(modernConfig);
@@ -201,7 +338,7 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
     const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
     const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
     const wranglerServices = createWranglerServices(serviceBindings);
-    return {
+    const workerConfig = {
         $schema: 'node_modules/wrangler/config-schema.json',
         name: getConfiguredWorkerName(appDirectory, modernConfig),
         ...wrangler,
@@ -219,14 +356,46 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
             services: wranglerServices
         }
     };
+    const vpcServiceBindings = createWorkerVpcServiceBindings(modernConfig, wrangler.vpc_services, serviceBindings, collectWorkerBindingNames(workerConfig));
+    if (void 0 === vpcServiceBindings) return workerConfig;
+    const vpcServicesConfig = vpcServiceBindings.map(({ binding, serviceId })=>({
+            binding,
+            service_id: serviceId
+        }));
+    return {
+        ...workerConfig,
+        ...void 0 === environments ? {} : {
+            env: Object.fromEntries(Object.entries(environments).map(([name, environment])=>{
+                if (void 0 !== environment.vpc_services) throw new Error(`Use deploy.worker.vpcServices or deploy.worker.wrangler.env.${name}.vpc_services, not both.`);
+                const environmentBindingNames = new Set([
+                    ...collectWorkerBindingNames(environment),
+                    ...effectiveServiceBindings(environment.services).map(({ binding })=>binding)
+                ]);
+                const collision = vpcServiceBindings.find(({ binding })=>environmentBindingNames.has(binding));
+                if (void 0 !== collision) throw new Error(`deploy.worker.vpcServices binding "${collision.binding}" is already a binding of deploy.worker.wrangler.env.${name}.`);
+                return [
+                    name,
+                    {
+                        ...environment,
+                        vpc_services: vpcServicesConfig
+                    }
+                ];
+            }))
+        },
+        vpc_services: vpcServicesConfig
+    };
 };
 exports.createWorkerManifestServiceBindings = __webpack_exports__.createWorkerManifestServiceBindings;
 exports.createWorkerServiceBindings = __webpack_exports__.createWorkerServiceBindings;
+exports.createWorkerVpcServiceBindings = __webpack_exports__.createWorkerVpcServiceBindings;
 exports.createWranglerConfig = __webpack_exports__.createWranglerConfig;
+exports.getWorkerEffectBffPrefix = __webpack_exports__.getWorkerEffectBffPrefix;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "createWorkerManifestServiceBindings",
     "createWorkerServiceBindings",
-    "createWranglerConfig"
+    "createWorkerVpcServiceBindings",
+    "createWranglerConfig",
+    "getWorkerEffectBffPrefix"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {
     value: true

package/dist/cjs/cloudflare-output-contract.js

@@ -108,7 +108,8 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'zlib'
 ];
 const CLOUDFLARE_WORKER_PLATFORM_MODULES = [
-    'cloudflare:sockets'
+    'cloudflare:sockets',
+    'cloudflare:workers'
 ];
 const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
     'nodejs_compat',

package/dist/esm/cloudflare/worker-manifest.mjs

@@ -6,7 +6,7 @@ import { ASSETS_BINDING, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, BFF_EFFECT_WORKER_
 import { createI18nWorkerManifest } from "./i18n-worker.mjs";
 import { createCloudflareWorkerSecurityPolicy } from "./security-policies.mjs";
 import { isRecord, normalizeRelativePath } from "./utils.mjs";
-import { createWorkerManifestServiceBindings, createWorkerServiceBindings } from "./wrangler-config.mjs";
+import { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, getWorkerEffectBffPrefix } from "./wrangler-config.mjs";
 const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
 const createEffectBffWorkerManifest = (modernConfig)=>{
     const bff = modernConfig.bff;
@@ -80,13 +80,15 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             } : {}
         };
     }));
-    const bffPrefix = modernConfig.bff?.prefix;
-    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
     const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
     const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
-    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
+    const typedServiceBindings = createWorkerServiceBindings(modernConfig, void 0);
+    const serviceBindings = createWorkerManifestServiceBindings(typedServiceBindings, createWorkerVpcServiceBindings(modernConfig, void 0, typedServiceBindings, new Set([
+        ASSETS_BINDING
+    ])));
     const moduleFederation = await createModuleFederationWorkerManifest(outputDirectory);
-    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
+    if (void 0 !== effectBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
     const effectBffManifest = isEffectApi ? createEffectBffWorkerManifest(modernConfig) : void 0;
     return {
         version: 1,
@@ -123,10 +125,10 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             deliveryUnit: deliveryUnitStamp
         } : {},
         i18n: createI18nWorkerManifest(routeSpec, appContext),
-        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+        bff: void 0 !== effectBffPrefix && effectApiWorkerExists ? {
             dispatcherExport: BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
             runtimeFramework: 'effect',
-            prefix: primaryBffPrefix,
+            prefix: effectBffPrefix,
             worker: BFF_EFFECT_WORKER_ENTRY,
             effect: effectBffManifest
         } : void 0,

package/dist/esm/cloudflare/wrangler-config.mjs

@@ -127,6 +127,129 @@ const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>
     if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
     return services.map(normalizeServiceBinding);
 };
+const normalizeVpcService = (vpcService, index)=>{
+    const binding = assertNonEmptyString(vpcService.binding, `deploy.worker.vpcServices[${index}].binding`);
+    const serviceId = assertNonEmptyString(vpcService.serviceId, `deploy.worker.vpcServices[${index}].serviceId`);
+    const prefix = void 0 === vpcService.prefix ? void 0 : assertNonEmptyString(vpcService.prefix, `deploy.worker.vpcServices[${index}].prefix`);
+    return {
+        binding,
+        serviceId,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const decodeRoutePrefix = (prefix)=>{
+    let decoded = prefix;
+    for(let round = 0; round < 4; round += 1){
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch  {
+            break;
+        }
+        if (next === decoded) break;
+        decoded = next;
+    }
+    return decoded;
+};
+const normalizeRoutePrefix = (prefix)=>{
+    const decoded = decodeRoutePrefix(prefix);
+    return '/' === decoded ? decoded : decoded.replace(/\/+$/u, '');
+};
+const isCanonicalRoutePrefix = (prefix)=>prefix.startsWith('/') && !prefix.includes('\\') && decodeRoutePrefix(prefix) === prefix && new URL(prefix, 'https://route.invalid').pathname === prefix;
+const collectWorkerBindingNames = (config)=>{
+    const names = new Set();
+    const visit = (value, inArray)=>{
+        if (Array.isArray(value)) {
+            for (const item of value)visit(item, true);
+            return;
+        }
+        if (!isJsonRecord(value)) return;
+        for (const field of inArray ? [
+            'binding',
+            'name'
+        ] : [
+            'binding'
+        ]){
+            const name = value[field];
+            if ('string' == typeof name) names.add(name.trim());
+        }
+        for (const child of Object.values(value))visit(child, false);
+    };
+    for (const [key, value] of Object.entries(config))if ('env' !== key && 'services' !== key && 'vpc_services' !== key) {
+        if ('vars' === key && isJsonRecord(value)) {
+            for (const name of Object.keys(value))names.add(name);
+            continue;
+        }
+        visit(value, false);
+    }
+    return names;
+};
+const prefixesOverlap = (left, right)=>{
+    const [first, second] = [
+        normalizeRoutePrefix(left),
+        normalizeRoutePrefix(right)
+    ];
+    return '/' === first || '/' === second || first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+};
+const getWorkerEffectBffPrefix = (modernConfig)=>{
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    return isEffectApi && primaryBffPrefix ? primaryBffPrefix : void 0;
+};
+const effectiveServiceBindings = (serviceBindings)=>{
+    const bindings = Array.isArray(serviceBindings) ? serviceBindings : [];
+    return bindings.flatMap((service)=>isJsonRecord(service) && 'string' == typeof service.binding ? [
+            {
+                binding: service.binding.trim(),
+                prefix: 'string' == typeof service.prefix ? service.prefix : void 0
+            }
+        ] : []);
+};
+const createWorkerVpcServiceBindings = (modernConfig, configuredWranglerVpcServices, serviceBindings, workerBindingNames)=>{
+    const vpcServices = modernConfig.deploy?.worker?.vpcServices;
+    if (void 0 === vpcServices) return;
+    if (void 0 !== configuredWranglerVpcServices) throw new Error('Use deploy.worker.vpcServices or deploy.worker.wrangler.vpc_services, not both.');
+    if (!Array.isArray(vpcServices)) throw new Error('deploy.worker.vpcServices must be an array.');
+    const services = effectiveServiceBindings(serviceBindings);
+    const serviceBindingNames = new Set(services.map(({ binding })=>binding));
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
+    const routes = [
+        ...void 0 === effectBffPrefix ? [] : [
+            {
+                owner: 'the Effect BFF',
+                prefix: effectBffPrefix
+            }
+        ],
+        ...services.flatMap(({ binding, prefix })=>void 0 === prefix ? [] : [
+                {
+                    owner: `binding "${binding}"`,
+                    prefix
+                }
+            ])
+    ];
+    const vpcBindingNames = new Set();
+    return vpcServices.map((vpcService, index)=>{
+        const normalized = normalizeVpcService(vpcService, index);
+        if (serviceBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already declared by deploy.worker.services.`);
+        if (workerBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already a binding of this Worker.`);
+        if (vpcBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is declared more than once.`);
+        vpcBindingNames.add(normalized.binding);
+        if (void 0 !== normalized.prefix) {
+            const { prefix } = normalized;
+            if (!isCanonicalRoutePrefix(prefix)) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" must be a decoded URL path that starts with "/" (no query, fragment, "." or ".." segments).`);
+            const shadow = routes.find((route)=>prefixesOverlap(route.prefix, prefix));
+            if (void 0 !== shadow) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" overlaps the prefix "${shadow.prefix}" of ${shadow.owner}; the worker dispatcher would route one of them ambiguously.`);
+            routes.push({
+                owner: `binding "${normalized.binding}"`,
+                prefix
+            });
+        }
+        return normalized;
+    });
+};
 const createWranglerServices = (serviceBindings)=>{
     if (!Array.isArray(serviceBindings)) return serviceBindings;
     if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
@@ -135,8 +258,16 @@ const createWranglerServices = (serviceBindings)=>{
         return wranglerService;
     });
 };
-const createWorkerManifestServiceBindings = (serviceBindings)=>{
-    if (!Array.isArray(serviceBindings)) return;
+const createWorkerManifestServiceBindings = (serviceBindings, vpcServiceBindings)=>{
+    const vpcManifestBindings = (vpcServiceBindings ?? []).flatMap(({ binding, prefix, serviceId })=>void 0 === prefix ? [] : [
+            {
+                binding,
+                interface: 'fetch',
+                prefix,
+                vpcServiceId: serviceId
+            }
+        ]);
+    if (!Array.isArray(serviceBindings)) return vpcManifestBindings.length > 0 ? vpcManifestBindings : void 0;
     const bindings = serviceBindings;
     const manifestBindings = bindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && ('string' == typeof service.prefix || Array.isArray(service.fragments) && service.fragments.length > 0)).map((service)=>({
             binding: service.binding,
@@ -149,7 +280,11 @@ const createWorkerManifestServiceBindings = (serviceBindings)=>{
                 fragments: service.fragments
             }
         }));
-    return manifestBindings.length > 0 ? manifestBindings : void 0;
+    const allBindings = [
+        ...manifestBindings,
+        ...vpcManifestBindings
+    ];
+    return allBindings.length > 0 ? allBindings : void 0;
 };
 const createWranglerConfig = (appDirectory, modernConfig)=>{
     const wrangler = getConfiguredWrangler(modernConfig);
@@ -157,7 +292,7 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
     const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
     const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
     const wranglerServices = createWranglerServices(serviceBindings);
-    return {
+    const workerConfig = {
         $schema: 'node_modules/wrangler/config-schema.json',
         name: getConfiguredWorkerName(appDirectory, modernConfig),
         ...wrangler,
@@ -175,5 +310,33 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
             services: wranglerServices
         }
     };
+    const vpcServiceBindings = createWorkerVpcServiceBindings(modernConfig, wrangler.vpc_services, serviceBindings, collectWorkerBindingNames(workerConfig));
+    if (void 0 === vpcServiceBindings) return workerConfig;
+    const vpcServicesConfig = vpcServiceBindings.map(({ binding, serviceId })=>({
+            binding,
+            service_id: serviceId
+        }));
+    return {
+        ...workerConfig,
+        ...void 0 === environments ? {} : {
+            env: Object.fromEntries(Object.entries(environments).map(([name, environment])=>{
+                if (void 0 !== environment.vpc_services) throw new Error(`Use deploy.worker.vpcServices or deploy.worker.wrangler.env.${name}.vpc_services, not both.`);
+                const environmentBindingNames = new Set([
+                    ...collectWorkerBindingNames(environment),
+                    ...effectiveServiceBindings(environment.services).map(({ binding })=>binding)
+                ]);
+                const collision = vpcServiceBindings.find(({ binding })=>environmentBindingNames.has(binding));
+                if (void 0 !== collision) throw new Error(`deploy.worker.vpcServices binding "${collision.binding}" is already a binding of deploy.worker.wrangler.env.${name}.`);
+                return [
+                    name,
+                    {
+                        ...environment,
+                        vpc_services: vpcServicesConfig
+                    }
+                ];
+            }))
+        },
+        vpc_services: vpcServicesConfig
+    };
 };
-export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, createWranglerConfig, getWorkerEffectBffPrefix };

package/dist/esm/cloudflare-output-contract.mjs

@@ -79,7 +79,8 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'zlib'
 ];
 const CLOUDFLARE_WORKER_PLATFORM_MODULES = [
-    'cloudflare:sockets'
+    'cloudflare:sockets',
+    'cloudflare:workers'
 ];
 const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
     'nodejs_compat',

package/dist/esm-node/cloudflare/worker-manifest.mjs

@@ -7,7 +7,7 @@ import { ASSETS_BINDING, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, BFF_EFFECT_WORKER_
 import { createI18nWorkerManifest } from "./i18n-worker.mjs";
 import { createCloudflareWorkerSecurityPolicy } from "./security-policies.mjs";
 import { isRecord, normalizeRelativePath } from "./utils.mjs";
-import { createWorkerManifestServiceBindings, createWorkerServiceBindings } from "./wrangler-config.mjs";
+import { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, getWorkerEffectBffPrefix } from "./wrangler-config.mjs";
 const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
 const createEffectBffWorkerManifest = (modernConfig)=>{
     const bff = modernConfig.bff;
@@ -81,13 +81,15 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             } : {}
         };
     }));
-    const bffPrefix = modernConfig.bff?.prefix;
-    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
     const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
     const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
-    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
+    const typedServiceBindings = createWorkerServiceBindings(modernConfig, void 0);
+    const serviceBindings = createWorkerManifestServiceBindings(typedServiceBindings, createWorkerVpcServiceBindings(modernConfig, void 0, typedServiceBindings, new Set([
+        ASSETS_BINDING
+    ])));
     const moduleFederation = await createModuleFederationWorkerManifest(outputDirectory);
-    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
+    if (void 0 !== effectBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
     const effectBffManifest = isEffectApi ? createEffectBffWorkerManifest(modernConfig) : void 0;
     return {
         version: 1,
@@ -124,10 +126,10 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
             deliveryUnit: deliveryUnitStamp
         } : {},
         i18n: createI18nWorkerManifest(routeSpec, appContext),
-        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+        bff: void 0 !== effectBffPrefix && effectApiWorkerExists ? {
             dispatcherExport: BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
             runtimeFramework: 'effect',
-            prefix: primaryBffPrefix,
+            prefix: effectBffPrefix,
             worker: BFF_EFFECT_WORKER_ENTRY,
             effect: effectBffManifest
         } : void 0,