@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.8 → 3.9.3-ultramodern.1

package/dist/esm/cloudflare/index.mjs

@@ -1,4 +1,5 @@
 import node_path from "node:path";
+import { BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE, ULTRAMODERN_BUILD_ARTIFACT_FILE } from "@modern-js/backend-federation-contracts";
 import { fs } from "@modern-js/utils";
 import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
 import { assertCloudflareOutput } from "../cloudflare-output-verifier/index.mjs";
@@ -6,7 +7,7 @@ import { readTemplate } from "../read-template.mjs";
 import { MICROVERTICAL_RELEASE_ENVELOPE_PATH, emitCloudflareStagedReleaseEnvelope, emitFrameworkMicroVerticalReleaseEnvelope, stageCloudflareReleaseEnvelope, verifyBuildOutputReleaseEnvelope, verifyCloudflareReleaseEnvelopeStaging } from "../release-envelope/framework-output.mjs";
 import { copyCloudflareArtifacts, copyCloudflareD1Migrations, copyCloudflarePublicAssets, getCloudflareArtifacts, getCloudflarePublicAssets } from "./artifacts.mjs";
 import { ROUTE_SPEC_FILE, ROUTE_SPEC_OUTPUT, WORKER_BUNDLE_DIRECTORY } from "./constants.mjs";
-import { resolveTopologyDeliveryUnit, resolveWorkerDeliveryUnitStamp } from "./delivery-unit.mjs";
+import { resolveWorkerDeliveryUnitStamp } from "./delivery-unit.mjs";
 import { createWorkerManifest, createWorkerModuleLoaders, getPublicAssetExcludes, shouldCopyToPublicAssets, shouldCopyToWorkerBundle } from "./worker-manifest.mjs";
 import { createWranglerConfig } from "./wrangler-config.mjs";
 const CLOUDFLARE_ENTRY_TEMPLATE_FRAGMENTS = [
@@ -31,20 +32,28 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
     const publicAssetExcludes = getPublicAssetExcludes(appDirectory, modernConfig);
     const releaseEnvelopeEnabled = api.isPluginExists('@modern-js/ultramodern-release-envelope');
     let hasReleaseEnvelope = false;
+    let declaredPublicAssets = [];
     return {
         async prepare () {
             await fs.remove(outputDirectory);
         },
         async writeOutput () {
-            if (releaseEnvelopeEnabled && await fs.pathExists(node_path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH))) await emitFrameworkMicroVerticalReleaseEnvelope({
+            if (releaseEnvelopeEnabled) await emitFrameworkMicroVerticalReleaseEnvelope({
                 apiOnly,
+                appDirectory,
                 distDirectory,
+                role: modernConfig.deploy?.releaseEnvelopeRole,
                 target: 'cloudflare'
             });
             if (releaseEnvelopeEnabled) await verifyBuildOutputReleaseEnvelope(distDirectory, 'cloudflare');
             await fs.copy(distDirectory, publicDirectory, {
                 filter: (src)=>{
                     const relativePath = node_path.relative(distDirectory, src).replace(/\\/gu, '/');
+                    if (apiOnly && '' !== relativePath && ![
+                        BACKEND_FEDERATION_MANIFEST_FILE,
+                        BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+                        ULTRAMODERN_BUILD_ARTIFACT_FILE
+                    ].includes(relativePath)) return false;
                     return 'release' !== relativePath && !relativePath.startsWith('release/') && 'public' !== relativePath && !relativePath.startsWith('public/') && shouldCopyToPublicAssets(src, distDirectory, publicAssetExcludes);
                 }
             });
@@ -68,12 +77,12 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
                 await fs.writeJSON(outputPlan.paths.workerPackage, outputPlan.packages.worker);
             }
             await copyCloudflareArtifacts(appDirectory, outputDirectory, cloudflareArtifacts);
-            await copyCloudflarePublicAssets(appDirectory, publicDirectory, getCloudflarePublicAssets(modernConfig));
+            declaredPublicAssets = await copyCloudflarePublicAssets(appDirectory, outputDirectory, getCloudflarePublicAssets(modernConfig));
             await copyCloudflareD1Migrations(appDirectory, outputDirectory, modernConfig);
             await fs.writeJSON(wranglerConfigPath, createWranglerConfig(appDirectory, modernConfig), {
                 spaces: 2
             });
-            const deliveryUnitStamp = await resolveWorkerDeliveryUnitStamp(appDirectory);
+            const deliveryUnitStamp = await resolveWorkerDeliveryUnitStamp(appDirectory, distDirectory);
             await fs.writeJSON(workerManifestPath, await createWorkerManifest(outputDirectory, modernConfig, appContext, deliveryUnitStamp), {
                 spaces: 2
             });
@@ -87,7 +96,7 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             const template = await readCloudflareEntryTemplate();
             const manifest = await fs.readJSON(workerManifestPath);
             await fs.writeFile(workerEntryPath, template.replace('p_workerManifest', JSON.stringify(manifest, null, 2)).replace('p_workerModuleLoaders', createWorkerModuleLoaders(manifest)));
-            const topologyDeliveryUnit = await resolveTopologyDeliveryUnit(appDirectory);
+            const topologyDeliveryUnit = await resolveWorkerDeliveryUnitStamp(appDirectory, distDirectory);
             await assertCloudflareOutput({
                 outputDirectory,
                 importWorker: false,
@@ -97,6 +106,7 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             });
             if (hasReleaseEnvelope) {
                 await emitCloudflareStagedReleaseEnvelope({
+                    declaredPublicAssets,
                     distDirectory,
                     outputDirectory
                 });

package/dist/esm/cloudflare/native-renderer.mjs

@@ -0,0 +1,48 @@
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { WORKER_BUNDLE_DIRECTORY } from "./constants.mjs";
+import { isRecord } from "./utils.mjs";
+const NATIVE_RENDERER_WORKER_RESOURCES_FILE = `${WORKER_BUNDLE_DIRECTORY}/native-renderer.json`;
+const invalid = (detail)=>new Error(`Invalid native renderer worker resources (${NATIVE_RENDERER_WORKER_RESOURCES_FILE}): ${detail}. Rebuild the application with deploy.worker.ssr before deploying.`);
+function validateEntry(entryName, value) {
+    if (!isRecord(value)) throw invalid(`entry ${entryName} is not an object`);
+    const { assets, hydrationBuildId, serverConfig, csrFallbackHeader, nonce } = value;
+    if (!Array.isArray(assets) || !assets.length) throw invalid(`entry ${entryName} has no document assets`);
+    if (void 0 !== hydrationBuildId && ('string' != typeof hydrationBuildId || !hydrationBuildId.trim())) throw invalid(`entry ${entryName} has an empty hydration build ID`);
+    if (!isRecord(serverConfig) || ![
+        true,
+        false,
+        'stream'
+    ].includes(serverConfig.ssr) || void 0 !== serverConfig.ssrByRouteIds && (!Array.isArray(serverConfig.ssrByRouteIds) || serverConfig.ssrByRouteIds.some((id)=>'string' != typeof id))) throw invalid(`entry ${entryName} has an invalid server config`);
+    for (const [field, text] of [
+        [
+            'csrFallbackHeader',
+            csrFallbackHeader
+        ],
+        [
+            'nonce',
+            nonce
+        ]
+    ])if (void 0 !== text && ('string' != typeof text || !text)) throw invalid(`entry ${entryName} has an invalid ${field}`);
+}
+async function readNativeRendererWorkerResources(distDirectory, build) {
+    let bytes;
+    try {
+        bytes = await promises.readFile(node_path.join(distDirectory, NATIVE_RENDERER_WORKER_RESOURCES_FILE), 'utf8');
+    } catch (error) {
+        if (error instanceof Error && 'code' in error && 'ENOENT' === error.code) return;
+        throw error;
+    }
+    const value = JSON.parse(bytes);
+    if (!isRecord(value) || 'ultramodern-native-worker-resources' !== value.schema || 1 !== value.version || 'string' != typeof value.renderer || !value.renderer || !isRecord(value.entries)) throw invalid('unknown schema');
+    if (value.renderer !== build?.renderer.name || !build.renderer.nativeDocuments) throw invalid(`renderer ${value.renderer} is not the built native-document renderer`);
+    const entries = value.entries;
+    const nativeEntries = Object.entries(build.identities).filter(([, identity])=>identity.renderer === value.renderer);
+    for (const [entryName] of nativeEntries)if (!Object.hasOwn(entries, entryName)) throw invalid(`entry ${entryName} is missing`);
+    for (const [entryName, entry] of Object.entries(entries)){
+        if (!nativeEntries.some(([name])=>name === entryName)) throw invalid(`entry ${entryName} has no built ${value.renderer} renderer identity`);
+        validateEntry(entryName, entry);
+    }
+    return value;
+}
+export { NATIVE_RENDERER_WORKER_RESOURCES_FILE, readNativeRendererWorkerResources };

package/dist/esm/cloudflare/renderer-identity.mjs

@@ -0,0 +1,57 @@
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { formatBackendFederationValidationErrors, validateRendererIdentity, validateRendererProfile } from "@modern-js/backend-federation-contracts";
+import { isRecord } from "./utils.mjs";
+async function readWorkerRendererBuild(distDirectory, routes, deliveryUnit) {
+    let bytes;
+    try {
+        bytes = await promises.readFile(node_path.join(distDirectory, 'renderer-build.json'), 'utf8');
+    } catch (error) {
+        if (error instanceof Error && 'code' in error && 'ENOENT' === error.code) return;
+        throw error;
+    }
+    const build = JSON.parse(bytes);
+    if (!isRecord(build) || 'ultramodern-renderer-build' !== build.schema || 2 !== build.version || 'string' != typeof build.buildId || !/^[a-f0-9]{64}$/u.test(build.buildId) || !isRecord(build.profile) || build.renderer !== build.profile.renderer || !isRecord(build.worker) || 'boolean' != typeof build.worker.nativeDocuments || 'boolean' != typeof build.worker.rsc || !isRecord(build.entries) || !Object.keys(build.entries).length) throw new Error('Invalid or outdated renderer-build.json for the Cloudflare worker; rebuild the application.');
+    const { renderer, protocolVersion, compiler, hydration, router } = build.profile;
+    const validation = validateRendererProfile({
+        renderer,
+        protocolVersion,
+        compiler,
+        hydration,
+        router
+    });
+    if (!validation.ok) throw new Error(formatBackendFederationValidationErrors(validation.errors));
+    const identities = {};
+    let appId;
+    for (const [entryName, value] of Object.entries(build.entries)){
+        const validation = validateRendererIdentity(value);
+        if (!validation.ok) throw new Error(formatBackendFederationValidationErrors(validation.errors));
+        const identity = value;
+        if ('__proto__' === entryName || identity.entryName !== entryName || identity.renderer !== renderer || identity.protocolVersion !== protocolVersion || identity.buildId !== build.buildId || void 0 !== appId && identity.appId !== appId) throw new Error('Cloudflare renderer entry identity conflicts with its built manifest');
+        appId = identity.appId;
+        identities[entryName] = Object.freeze({
+            ...identity
+        });
+    }
+    for (const route of routes){
+        if (false === route.isSSR && void 0 === route.entryName && void 0 === route.worker && void 0 === route.bundle && (void 0 === route.isRSC || false === route.isRSC) && (void 0 === route.isStream || false === route.isStream) && 'string' == typeof route.entryPath && route.entryPath.startsWith('public/') && !route.entryPath.includes('\\') && node_path.posix.normalize(route.entryPath) === route.entryPath) {
+            const asset = await promises.stat(node_path.join(distDirectory, route.entryPath));
+            if (asset.isFile()) continue;
+        }
+        if (true !== route.isApi || false !== route.isSSR || void 0 !== route.entryName || '' !== route.entryPath || void 0 !== route.worker || void 0 !== route.bundle || void 0 !== route.isRSC && false !== route.isRSC || void 0 !== route.isStream && false !== route.isStream) {
+            if ('string' != typeof route.entryName || !Object.hasOwn(identities, route.entryName)) throw new Error(`Cloudflare generated route has no built renderer identity for ${String(route.entryName)}`);
+        }
+    }
+    const ui = deliveryUnit?.surfaces.ui;
+    if (ui && !isDeepStrictEqual(identities[ui.rendererIdentity.entryName], ui.rendererIdentity)) throw new Error('Cloudflare built renderer identity conflicts with its finalized delivery unit');
+    return Object.freeze({
+        renderer: Object.freeze({
+            name: renderer,
+            nativeDocuments: build.worker.nativeDocuments,
+            rsc: build.worker.rsc
+        }),
+        identities: Object.freeze(identities)
+    });
+}
+export { readWorkerRendererBuild };

package/dist/esm/cloudflare/worker-manifest.mjs

@@ -1,11 +1,14 @@
 import node_path from "node:path";
 import { fs } from "@modern-js/utils";
+import { getCloudflareWorkerRouteDataEntryName } from "../cloudflare-output-contract.mjs";
 import { readRouteSpec } from "./artifacts.mjs";
 import { ASSETS_BINDING, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, BFF_EFFECT_WORKER_ENTRY, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_FORMAT, DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES, EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE, LOADABLE_STATS_FILE, PUBLIC_ASSETS_DIRECTORY, ROUTE_MANIFEST_FILE, ROUTE_SPEC_FILE, ROUTE_SPEC_OUTPUT, SERVER_BUNDLE_DIRECTORY, WORKER_BUNDLE_DIRECTORY, WORKER_ENTRY } from "./constants.mjs";
 import { createI18nWorkerManifest } from "./i18n-worker.mjs";
+import { readNativeRendererWorkerResources } from "./native-renderer.mjs";
+import { readWorkerRendererBuild } from "./renderer-identity.mjs";
 import { createCloudflareWorkerSecurityPolicy } from "./security-policies.mjs";
 import { isRecord, normalizeRelativePath } from "./utils.mjs";
-import { createWorkerManifestServiceBindings, createWorkerServiceBindings } from "./wrangler-config.mjs";
+import { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, getWorkerEffectBffPrefix } from "./wrangler-config.mjs";
 const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
 const createEffectBffWorkerManifest = (modernConfig)=>{
     const bff = modernConfig.bff;
@@ -56,31 +59,59 @@ const createModuleFederationWorkerManifest = async (outputDirectory)=>{
             }
         ];
     });
-    return name && exposes.length > 0 ? {
+    if (!name || 0 === exposes.length) return;
+    const routeManifestPath = node_path.join(outputDirectory, PUBLIC_ASSETS_DIRECTORY, ROUTE_MANIFEST_FILE);
+    const routeManifest = await fs.pathExists(routeManifestPath) ? await fs.readJson(routeManifestPath) : void 0;
+    const routeAssets = isRecord(routeManifest) && isRecord(routeManifest.routeAssets) ? Object.values(routeManifest.routeAssets).filter(isRecord) : [];
+    const routeCss = [
+        ...new Set(routeAssets.flatMap((routeAsset)=>[
+                routeAsset.referenceCssAssets,
+                routeAsset.assets
+            ].flatMap((value)=>Array.isArray(value) ? value : []).filter((asset)=>'string' == typeof asset && asset.endsWith('.css'))))
+    ];
+    return {
         name,
-        exposes
-    } : void 0;
+        exposes,
+        routeCss
+    };
 };
 const createWorkerManifest = async (outputDirectory, modernConfig, appContext, deliveryUnitStamp)=>{
     const routeSpec = await readRouteSpec(outputDirectory);
     const routes = await Promise.all(routeSpec.routes.map(async (route)=>{
         const worker = 'string' == typeof route.worker ? route.worker : void 0;
+        const routeDataWorker = route.isSSR && 'string' == typeof route.entryName ? `${WORKER_BUNDLE_DIRECTORY}/${getCloudflareWorkerRouteDataEntryName(route.entryName)}.js` : void 0;
+        const hasRouteDataWorker = routeDataWorker ? await fs.pathExists(node_path.join(outputDirectory, routeDataWorker)) : false;
         return {
             urlPath: route.urlPath,
             entryName: route.entryName,
             entryPath: route.entryPath,
             isSSR: Boolean(route.isSSR),
             worker,
-            workerExists: worker ? await fs.pathExists(node_path.join(outputDirectory, worker)) : false
+            workerExists: worker ? await fs.pathExists(node_path.join(outputDirectory, worker)) : false,
+            ...hasRouteDataWorker ? {
+                routeDataWorker
+            } : {},
+            ...route.responseHeaders && 'object' == typeof route.responseHeaders ? {
+                responseHeaders: route.responseHeaders
+            } : {}
         };
     }));
-    const bffPrefix = modernConfig.bff?.prefix;
-    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const rendererBuild = await readWorkerRendererBuild(appContext.distDirectory, routeSpec.routes, deliveryUnitStamp);
+    const rendererIdentities = rendererBuild?.identities;
+    const nativeRenderer = await readNativeRendererWorkerResources(appContext.distDirectory, rendererBuild);
+    for (const route of routes){
+        const renderer = 'string' == typeof route.entryName && rendererIdentities && Object.hasOwn(rendererIdentities, route.entryName) ? rendererIdentities[route.entryName].renderer : void 0;
+        if (void 0 !== renderer && rendererBuild?.renderer.nativeDocuments && (nativeRenderer?.renderer !== renderer || !route.workerExists)) throw new Error(`Cloudflare worker deploy of the ${renderer} renderer requires its native worker build for entry ${route.entryName}. Set deploy.worker.ssr: true and rebuild with the Cloudflare deploy target.`);
+    }
     const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
     const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
-    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
+    const typedServiceBindings = createWorkerServiceBindings(modernConfig, void 0);
+    const serviceBindings = createWorkerManifestServiceBindings(typedServiceBindings, createWorkerVpcServiceBindings(modernConfig, void 0, typedServiceBindings, new Set([
+        ASSETS_BINDING
+    ])));
     const moduleFederation = await createModuleFederationWorkerManifest(outputDirectory);
-    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
+    if (void 0 !== effectBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
     const effectBffManifest = isEffectApi ? createEffectBffWorkerManifest(modernConfig) : void 0;
     return {
         version: 1,
@@ -116,11 +147,18 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
         ...deliveryUnitStamp ? {
             deliveryUnit: deliveryUnitStamp
         } : {},
+        ...rendererBuild ? {
+            renderer: rendererBuild.renderer,
+            rendererIdentities
+        } : {},
+        ...nativeRenderer ? {
+            nativeRenderer
+        } : {},
         i18n: createI18nWorkerManifest(routeSpec, appContext),
-        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+        bff: void 0 !== effectBffPrefix && effectApiWorkerExists ? {
             dispatcherExport: BFF_EFFECT_WORKER_DISPATCHER_EXPORT,
             runtimeFramework: 'effect',
-            prefix: primaryBffPrefix,
+            prefix: effectBffPrefix,
             worker: BFF_EFFECT_WORKER_ENTRY,
             effect: effectBffManifest
         } : void 0,
@@ -131,9 +169,12 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext, d
 };
 const createWorkerModuleLoaders = (manifest)=>{
     const imports = new Map();
-    for (const route of manifest.routeSpec.routes)if (route.worker && route.workerExists) {
-        const importPath = `../${String(route.worker).replace(/^\/+/u, '')}`;
-        imports.set(route.worker, `() => import(${JSON.stringify(importPath)})`);
+    for (const route of manifest.routeSpec.routes)for (const worker of [
+        route.workerExists ? route.worker : void 0,
+        route.routeDataWorker
+    ])if (worker) {
+        const importPath = `../${String(worker).replace(/^\/+/u, '')}`;
+        imports.set(worker, `() => import(${JSON.stringify(importPath)})`);
     }
     if (manifest.bff?.worker) {
         const importPath = `../${String(manifest.bff.worker).replace(/^\/+/u, '')}`;

package/dist/esm/cloudflare/worker-options.mjs

@@ -0,0 +1,10 @@
+function isCloudflareWorkerRequestHandlerOptions(options) {
+    if (!('platform' in options) || !('executionContext' in options)) return false;
+    const platform = options.platform;
+    if (null === platform || 'object' != typeof platform || !('kind' in platform) || 'worker' !== platform.kind || !('bindings' in platform)) return false;
+    const bindings = platform.bindings;
+    if (void 0 !== bindings && (null === bindings || 'object' != typeof bindings || Array.isArray(bindings))) return false;
+    const context = options.executionContext;
+    return void 0 === context || null !== context && 'object' == typeof context && 'waitUntil' in context && 'function' == typeof context.waitUntil && 'passThroughOnException' in context && 'function' == typeof context.passThroughOnException;
+}
+export { isCloudflareWorkerRequestHandlerOptions };

package/dist/esm/cloudflare/wrangler-config.mjs

@@ -1,12 +1,16 @@
 import node_path from "node:path";
 import { ASSETS_BINDING, COMPATIBILITY_DATE_PATTERN, DEFAULT_COMPATIBILITY_DATE, PUBLIC_ASSETS_DIRECTORY, REQUIRED_COMPATIBILITY_FLAGS, WORKER_ENTRY } from "./constants.mjs";
 import { isJsonRecord, normalizeRelativePath } from "./utils.mjs";
-const getCompatibilityDate = (modernConfig)=>{
-    const configuredDate = modernConfig.deploy?.worker?.compatibilityDate?.trim();
-    const compatibilityDate = configuredDate || DEFAULT_COMPATIBILITY_DATE;
-    if (!COMPATIBILITY_DATE_PATTERN.test(compatibilityDate)) throw new Error(`deploy.worker.compatibilityDate must use YYYY-MM-DD, received ${JSON.stringify(compatibilityDate)}.`);
+const assertSupportedCompatibilityDate = (compatibilityDate, label)=>{
+    if ('string' != typeof compatibilityDate) throw new Error(`${label} must be a YYYY-MM-DD string.`);
+    if (!COMPATIBILITY_DATE_PATTERN.test(compatibilityDate)) throw new Error(`${label} must use YYYY-MM-DD, received ${JSON.stringify(compatibilityDate)}.`);
+    if (compatibilityDate < DEFAULT_COMPATIBILITY_DATE) throw new Error(`${label} must be ${DEFAULT_COMPATIBILITY_DATE} or later, the date the Cloudflare worker Node.js built-in contract is verified against; received ${JSON.stringify(compatibilityDate)}.`);
     return compatibilityDate;
 };
+const getCompatibilityDate = (modernConfig, wranglerCompatibilityDate)=>{
+    if (void 0 !== wranglerCompatibilityDate) return assertSupportedCompatibilityDate(wranglerCompatibilityDate, 'deploy.worker.wrangler.compatibility_date');
+    return assertSupportedCompatibilityDate(modernConfig.deploy?.worker?.compatibilityDate?.trim() || DEFAULT_COMPATIBILITY_DATE, 'deploy.worker.compatibilityDate');
+};
 const getWorkerName = (appDirectory)=>{
     const basename = node_path.basename(appDirectory);
     return basename.replace(/[^a-zA-Z0-9-_]/g, '-') || 'modern-cloudflare-worker';
@@ -21,11 +25,11 @@ const getConfiguredWrangler = (modernConfig)=>{
     if (!isJsonRecord(wrangler)) throw new Error('deploy.worker.wrangler must be a JSON object.');
     return wrangler;
 };
-const createWranglerCompatibilityFlags = (configuredFlags)=>{
+const createWranglerCompatibilityFlags = (configuredFlags, label = 'deploy.worker.wrangler.compatibility_flags')=>{
     if (void 0 === configuredFlags) return [
         ...REQUIRED_COMPATIBILITY_FLAGS
     ];
-    if (!Array.isArray(configuredFlags) || configuredFlags.some((flag)=>'string' != typeof flag)) throw new Error('deploy.worker.wrangler.compatibility_flags must be an array of strings.');
+    if (!Array.isArray(configuredFlags) || configuredFlags.some((flag)=>'string' != typeof flag)) throw new Error(`${label} must be an array of strings.`);
     return [
         ...new Set([
             ...configuredFlags,
@@ -33,6 +37,26 @@ const createWranglerCompatibilityFlags = (configuredFlags)=>{
         ])
     ];
 };
+const createWranglerEnvironments = (wranglerEnv)=>{
+    if (void 0 === wranglerEnv) return;
+    if (!isJsonRecord(wranglerEnv)) throw new Error('deploy.worker.wrangler.env must be an object.');
+    return Object.fromEntries(Object.entries(wranglerEnv).map(([name, environment])=>{
+        const label = `deploy.worker.wrangler.env.${name}`;
+        if (!isJsonRecord(environment)) throw new Error(`${label} must be an object.`);
+        return [
+            name,
+            {
+                ...environment,
+                ...void 0 === environment.compatibility_date ? {} : {
+                    compatibility_date: assertSupportedCompatibilityDate(environment.compatibility_date, `${label}.compatibility_date`)
+                },
+                ...void 0 === environment.compatibility_flags ? {} : {
+                    compatibility_flags: createWranglerCompatibilityFlags(environment.compatibility_flags, `${label}.compatibility_flags`)
+                }
+            }
+        ];
+    }));
+};
 const createWranglerAssetsConfig = (configuredAssets)=>{
     if (void 0 !== configuredAssets && !isJsonRecord(configuredAssets)) throw new Error('deploy.worker.wrangler.assets must be an object.');
     return {
@@ -103,6 +127,129 @@ const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>
     if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
     return services.map(normalizeServiceBinding);
 };
+const normalizeVpcService = (vpcService, index)=>{
+    const binding = assertNonEmptyString(vpcService.binding, `deploy.worker.vpcServices[${index}].binding`);
+    const serviceId = assertNonEmptyString(vpcService.serviceId, `deploy.worker.vpcServices[${index}].serviceId`);
+    const prefix = void 0 === vpcService.prefix ? void 0 : assertNonEmptyString(vpcService.prefix, `deploy.worker.vpcServices[${index}].prefix`);
+    return {
+        binding,
+        serviceId,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const decodeRoutePrefix = (prefix)=>{
+    let decoded = prefix;
+    for(let round = 0; round < 4; round += 1){
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch  {
+            break;
+        }
+        if (next === decoded) break;
+        decoded = next;
+    }
+    return decoded;
+};
+const normalizeRoutePrefix = (prefix)=>{
+    const decoded = decodeRoutePrefix(prefix);
+    return '/' === decoded ? decoded : decoded.replace(/\/+$/u, '');
+};
+const isCanonicalRoutePrefix = (prefix)=>prefix.startsWith('/') && !prefix.includes('\\') && decodeRoutePrefix(prefix) === prefix && new URL(prefix, 'https://route.invalid').pathname === prefix;
+const collectWorkerBindingNames = (config)=>{
+    const names = new Set();
+    const visit = (value, inArray)=>{
+        if (Array.isArray(value)) {
+            for (const item of value)visit(item, true);
+            return;
+        }
+        if (!isJsonRecord(value)) return;
+        for (const field of inArray ? [
+            'binding',
+            'name'
+        ] : [
+            'binding'
+        ]){
+            const name = value[field];
+            if ('string' == typeof name) names.add(name.trim());
+        }
+        for (const child of Object.values(value))visit(child, false);
+    };
+    for (const [key, value] of Object.entries(config))if ('env' !== key && 'services' !== key && 'vpc_services' !== key) {
+        if ('vars' === key && isJsonRecord(value)) {
+            for (const name of Object.keys(value))names.add(name);
+            continue;
+        }
+        visit(value, false);
+    }
+    return names;
+};
+const prefixesOverlap = (left, right)=>{
+    const [first, second] = [
+        normalizeRoutePrefix(left),
+        normalizeRoutePrefix(right)
+    ];
+    return '/' === first || '/' === second || first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
+};
+const getWorkerEffectBffPrefix = (modernConfig)=>{
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    return isEffectApi && primaryBffPrefix ? primaryBffPrefix : void 0;
+};
+const effectiveServiceBindings = (serviceBindings)=>{
+    const bindings = Array.isArray(serviceBindings) ? serviceBindings : [];
+    return bindings.flatMap((service)=>isJsonRecord(service) && 'string' == typeof service.binding ? [
+            {
+                binding: service.binding.trim(),
+                prefix: 'string' == typeof service.prefix ? service.prefix : void 0
+            }
+        ] : []);
+};
+const createWorkerVpcServiceBindings = (modernConfig, configuredWranglerVpcServices, serviceBindings, workerBindingNames)=>{
+    const vpcServices = modernConfig.deploy?.worker?.vpcServices;
+    if (void 0 === vpcServices) return;
+    if (void 0 !== configuredWranglerVpcServices) throw new Error('Use deploy.worker.vpcServices or deploy.worker.wrangler.vpc_services, not both.');
+    if (!Array.isArray(vpcServices)) throw new Error('deploy.worker.vpcServices must be an array.');
+    const services = effectiveServiceBindings(serviceBindings);
+    const serviceBindingNames = new Set(services.map(({ binding })=>binding));
+    const effectBffPrefix = getWorkerEffectBffPrefix(modernConfig);
+    const routes = [
+        ...void 0 === effectBffPrefix ? [] : [
+            {
+                owner: 'the Effect BFF',
+                prefix: effectBffPrefix
+            }
+        ],
+        ...services.flatMap(({ binding, prefix })=>void 0 === prefix ? [] : [
+                {
+                    owner: `binding "${binding}"`,
+                    prefix
+                }
+            ])
+    ];
+    const vpcBindingNames = new Set();
+    return vpcServices.map((vpcService, index)=>{
+        const normalized = normalizeVpcService(vpcService, index);
+        if (serviceBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already declared by deploy.worker.services.`);
+        if (workerBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is already a binding of this Worker.`);
+        if (vpcBindingNames.has(normalized.binding)) throw new Error(`deploy.worker.vpcServices[${index}].binding "${normalized.binding}" is declared more than once.`);
+        vpcBindingNames.add(normalized.binding);
+        if (void 0 !== normalized.prefix) {
+            const { prefix } = normalized;
+            if (!isCanonicalRoutePrefix(prefix)) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" must be a decoded URL path that starts with "/" (no query, fragment, "." or ".." segments).`);
+            const shadow = routes.find((route)=>prefixesOverlap(route.prefix, prefix));
+            if (void 0 !== shadow) throw new Error(`deploy.worker.vpcServices[${index}].prefix "${prefix}" overlaps the prefix "${shadow.prefix}" of ${shadow.owner}; the worker dispatcher would route one of them ambiguously.`);
+            routes.push({
+                owner: `binding "${normalized.binding}"`,
+                prefix
+            });
+        }
+        return normalized;
+    });
+};
 const createWranglerServices = (serviceBindings)=>{
     if (!Array.isArray(serviceBindings)) return serviceBindings;
     if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
@@ -111,8 +258,16 @@ const createWranglerServices = (serviceBindings)=>{
         return wranglerService;
     });
 };
-const createWorkerManifestServiceBindings = (serviceBindings)=>{
-    if (!Array.isArray(serviceBindings)) return;
+const createWorkerManifestServiceBindings = (serviceBindings, vpcServiceBindings)=>{
+    const vpcManifestBindings = (vpcServiceBindings ?? []).flatMap(({ binding, prefix, serviceId })=>void 0 === prefix ? [] : [
+            {
+                binding,
+                interface: 'fetch',
+                prefix,
+                vpcServiceId: serviceId
+            }
+        ]);
+    if (!Array.isArray(serviceBindings)) return vpcManifestBindings.length > 0 ? vpcManifestBindings : void 0;
     const bindings = serviceBindings;
     const manifestBindings = bindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && ('string' == typeof service.prefix || Array.isArray(service.fragments) && service.fragments.length > 0)).map((service)=>({
             binding: service.binding,
@@ -125,21 +280,29 @@ const createWorkerManifestServiceBindings = (serviceBindings)=>{
                 fragments: service.fragments
             }
         }));
-    return manifestBindings.length > 0 ? manifestBindings : void 0;
+    const allBindings = [
+        ...manifestBindings,
+        ...vpcManifestBindings
+    ];
+    return allBindings.length > 0 ? allBindings : void 0;
 };
 const createWranglerConfig = (appDirectory, modernConfig)=>{
     const wrangler = getConfiguredWrangler(modernConfig);
+    const environments = createWranglerEnvironments(wrangler.env);
     const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
     const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
     const wranglerServices = createWranglerServices(serviceBindings);
-    return {
+    const workerConfig = {
         $schema: 'node_modules/wrangler/config-schema.json',
         name: getConfiguredWorkerName(appDirectory, modernConfig),
-        compatibility_date: getCompatibilityDate(modernConfig),
         ...wrangler,
+        compatibility_date: getCompatibilityDate(modernConfig, wrangler.compatibility_date),
         main: WORKER_ENTRY,
         compatibility_flags: createWranglerCompatibilityFlags(wrangler.compatibility_flags),
         assets: createWranglerAssetsConfig(wrangler.assets),
+        ...void 0 === environments ? {} : {
+            env: environments
+        },
         ...void 0 === d1Databases ? {} : {
             d1_databases: d1Databases
         },
@@ -147,5 +310,33 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
             services: wranglerServices
         }
     };
+    const vpcServiceBindings = createWorkerVpcServiceBindings(modernConfig, wrangler.vpc_services, serviceBindings, collectWorkerBindingNames(workerConfig));
+    if (void 0 === vpcServiceBindings) return workerConfig;
+    const vpcServicesConfig = vpcServiceBindings.map(({ binding, serviceId })=>({
+            binding,
+            service_id: serviceId
+        }));
+    return {
+        ...workerConfig,
+        ...void 0 === environments ? {} : {
+            env: Object.fromEntries(Object.entries(environments).map(([name, environment])=>{
+                if (void 0 !== environment.vpc_services) throw new Error(`Use deploy.worker.vpcServices or deploy.worker.wrangler.env.${name}.vpc_services, not both.`);
+                const environmentBindingNames = new Set([
+                    ...collectWorkerBindingNames(environment),
+                    ...effectiveServiceBindings(environment.services).map(({ binding })=>binding)
+                ]);
+                const collision = vpcServiceBindings.find(({ binding })=>environmentBindingNames.has(binding));
+                if (void 0 !== collision) throw new Error(`deploy.worker.vpcServices binding "${collision.binding}" is already a binding of deploy.worker.wrangler.env.${name}.`);
+                return [
+                    name,
+                    {
+                        ...environment,
+                        vpc_services: vpcServicesConfig
+                    }
+                ];
+            }))
+        },
+        vpc_services: vpcServicesConfig
+    };
 };
-export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWorkerVpcServiceBindings, createWranglerConfig, getWorkerEffectBffPrefix };