fix(ssr): preserve pinned module transport after #3290

src/modules/server/module-server.test.ts

@@ -2486,12 +2486,11 @@ describe({ name: "serveModule", sanitizeResources: false, sanitizeOps: false },
           ssrParentUrl.searchParams.set("ssr", "true");
           const ssrParentResponse = await serve(new Request(ssrParentUrl), projectDir);
           assertEquals(ssrParentResponse.status, 200);
-          for (const childName of ["Absolute.js", "Protocol.js"]) {
-            const childFetch = nestedFetches.find((href) =>
-              new URL(href).pathname.endsWith(`/shared/${childName}`)
-            );
-            assertEquals(childFetch !== undefined, true);
-            const childUrl = new URL(childFetch!);
+          const ssrParentCode = await ssrParentResponse.text();
+          assertStringIncludes(ssrParentCode, absolutePath);
+          assertStringIncludes(ssrParentCode, protocolPath);
+          for (const childFetch of nestedFetches) {
+            const childUrl = new URL(childFetch);
             assertEquals(childUrl.searchParams.get("ssr"), "true");
             assertEquals(childUrl.searchParams.get("pins"), snapshot.cacheKey);
           }

src/server/project-env/fetcher.test.ts

@@ -2,7 +2,11 @@ import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertInstanceOf, assertRejects } from "#veryfront/testing/assert";
 import { describe, it } from "#veryfront/testing/bdd";
 import { createMockServer } from "../../../tests/_helpers/utils.ts";
-import { fetchProjectEnvVars, PROJECT_ENV_RESPONSE_MAX_BYTES } from "./fetcher.ts";
+import {
+  fetchProjectEnvVars,
+  PROJECT_ENV_RESPONSE_MAX_BYTES,
+  projectEnvFetcherInternals,
+} from "./fetcher.ts";
 
 const INTERNAL_USER_ENV = "VERYFRONT_API_INTERNAL_USER";
 const INTERNAL_PASS_ENV = "VERYFRONT_API_INTERNAL_PASS";
@@ -317,6 +321,35 @@ describe("project-env/fetcher", () => {
     }
   });
 
+  it("keeps required env fetch headers authoritative over optional Headers input", async () => {
+    const originalFetch = globalThis.fetch;
+    let capturedHeaders: Headers | undefined;
+    globalThis.fetch = ((_input: string | URL | Request, init?: RequestInit) => {
+      capturedHeaders = new Headers(init?.headers);
+      return Promise.resolve(Response.json({ data: [] }));
+    }) as typeof fetch;
+
+    try {
+      await projectEnvFetcherInternals.fetchEnvironmentVariables(
+        "https://api.veryfront.test/internal/project-environment-variables",
+        "Basic runtime-secret",
+        "my-project",
+        "env-123",
+        undefined,
+        new Headers({
+          accept: "text/plain",
+          authorization: "Bearer attacker",
+          "x-project-slug": "my-project",
+        }),
+      );
+      assertEquals(capturedHeaders?.get("authorization"), "Basic runtime-secret");
+      assertEquals(capturedHeaders?.get("accept"), "application/json");
+      assertEquals(capturedHeaders?.get("x-project-slug"), "my-project");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
   it("fails closed when the configured internal endpoint is absent", async () => {
     const paths: string[] = [];
     const { server, port } = createMockServer((req: Request) => {

src/server/project-env/fetcher.ts

@@ -134,12 +134,11 @@ async function fetchEnvironmentVariables(
   headers: HeadersInit = {},
 ): Promise<Response> {
   try {
+    const requestHeaders = new Headers(headers);
+    requestHeaders.set("Authorization", authorization);
+    requestHeaders.set("Accept", "application/json");
     return await fetch(url, {
-      headers: {
-        Authorization: authorization,
-        Accept: "application/json",
-        ...headers,
-      },
+      headers: requestHeaders,
       redirect: "error",
       signal,
     });
@@ -270,3 +269,7 @@ export async function fetchProjectEnvVars(
     throw error;
   }
 }
+
+export const projectEnvFetcherInternals = {
+  fetchEnvironmentVariables,
+} as const;

src/transforms/esm/specifier-resolver.ts

@@ -29,6 +29,11 @@ import {
 /** Function signature for caching an HTTP module and returning its local path. */
 export type CacheHttpModuleFn = (url: string, options: CacheOptions) => Promise<string | null>;
 
+function toCacheableHttpSpecifier(specifier: string, moduleServerOrigin?: string): string {
+  if (!specifier.startsWith("/") || !moduleServerOrigin) return specifier;
+  return new URL(specifier, moduleServerOrigin).toString();
+}
+
 function isLocalMappedSpecifier(specifier: string): boolean {
   return specifier.startsWith("/_vf_modules/") ||
     specifier.startsWith("_vf_modules/") ||
@@ -95,7 +100,10 @@ async function resolveSpecifier(
       options.dependencyPinningCacheKey,
       options.moduleServerOrigin,
     );
-    const cached = await cacheHttpModule(effectiveSpecifier, options);
+    const cached = await cacheHttpModule(
+      toCacheableHttpSpecifier(effectiveSpecifier, options.moduleServerOrigin),
+      options,
+    );
     if (!cached) {
       throw new Error(`Failed to cache absolute HTTP module ${effectiveSpecifier}`);
     }

src/transforms/import-rewriter/__tests__/hydration-parity.test.ts

@@ -253,10 +253,10 @@ describe("Hydration Parity", () => {
         /\n(function (__veryfrontPinDynamicImport_*)[\s\S]+)\n$/,
       );
       expect(result).toContain(
-        `from "https://app.example/_vf_modules/shared/StaticAbsolute.js?ssr=true&pins=on%3Asnapshot-a"`,
+        `from "/_vf_modules/_pins/on%3Asnapshot-a/shared/StaticAbsolute.js?ssr=true"`,
       );
       expect(result).toContain(
-        `from "https://app.example/_vf_modules/shared/StaticProtocol.js?ssr=true&pins=on%3Asnapshot-a"`,
+        `from "/_vf_modules/_pins/on%3Asnapshot-a/shared/StaticProtocol.js?ssr=true"`,
       );
       expect(result).toContain(
         `from "https://cdn.example/_vf_modules/shared/StaticForeign.js"`,

src/transforms/import-rewriter/core.ts

@@ -7,7 +7,7 @@ import { relativeToProjectDir } from "./project-paths.ts";
 import {
   appendDependencyPinningPathKey,
   appendSameOriginDependencyPinningPathKey,
-  appendSameOriginSSRDependencyPinningKey,
+  appendSameOriginSSRDependencyPinningPathKey,
   normalizeExtension,
 } from "./url-builder.ts";
 import type {
@@ -39,7 +39,7 @@ function pinSameOriginModuleUrl(
       ctx.dependencyPinningCacheKey,
       ctx.moduleServerOrigin,
     )
-    : appendSameOriginSSRDependencyPinningKey(
+    : appendSameOriginSSRDependencyPinningPathKey(
       specifier,
       ctx.dependencyPinningCacheKey,
       ctx.moduleServerOrigin,

src/transforms/import-rewriter/url-builder.test.ts

@@ -6,6 +6,8 @@ import {
   appendDependencyPinningKey,
   appendDependencyPinningPathKey,
   appendSameOriginDependencyPinningPathKey,
+  appendSameOriginSSRDependencyPinningKey,
+  appendSameOriginSSRDependencyPinningPathKey,
   buildCrossProjectUrl,
   buildEsmShUrl,
   buildModuleServerUrl,
@@ -117,6 +119,44 @@ describe("transforms/import-rewriter/url-builder", () => {
       );
     });
 
+    it("adds query pinning to same-origin SSR module URLs for fetchable imports", () => {
+      assertEquals(
+        appendSameOriginSSRDependencyPinningKey(
+          "https://app.example/_vf_modules/components/Button.js?pins=on%3Astale#default",
+          "on:snapshot-a",
+          "https://app.example",
+        ),
+        "https://app.example/_vf_modules/components/Button.js?pins=on%3Asnapshot-a&ssr=true#default",
+      );
+      assertEquals(
+        appendSameOriginSSRDependencyPinningKey(
+          "//app.example/_vf_modules/components/Protocol.js?debug=1",
+          "on:snapshot-a",
+          "https://app.example",
+        ),
+        "https://app.example/_vf_modules/components/Protocol.js?debug=1&pins=on%3Asnapshot-a&ssr=true",
+      );
+      assertEquals(
+        appendSameOriginSSRDependencyPinningKey(
+          "https://cdn.example/_vf_modules/components/Button.js",
+          "on:snapshot-a",
+          "https://app.example",
+        ),
+        "https://cdn.example/_vf_modules/components/Button.js",
+      );
+    });
+
+    it("canonicalizes same-origin SSR module-server URLs to snapshot paths", () => {
+      assertEquals(
+        appendSameOriginSSRDependencyPinningPathKey(
+          "https://app.example/_vf_modules/components/Button.js?pins=on%3Astale#default",
+          "on:snapshot-a",
+          "https://app.example",
+        ),
+        "/_vf_modules/_pins/on%3Asnapshot-a/components/Button.js?ssr=true#default",
+      );
+    });
+
     it("preserves flag-off and non-module targets", () => {
       assertEquals(
         appendDependencyPinningPathKey("/_vf_modules/components/", "off"),

src/transforms/import-rewriter/url-builder.ts

@@ -262,8 +262,58 @@ export function appendSameOriginSSRDependencyPinningKey(
       return url;
     }
 
-    target.searchParams.set("ssr", "true");
-    return appendDependencyPinningKey(target.href, dependencyPinningCacheKey);
+    const params = target.searchParams;
+    params.set("pins", dependencyPinningCacheKey);
+    params.set("ssr", "true");
+    return target.toString();
+  } catch {
+    return url;
+  }
+}
+
+/**
+ * Bind a same-origin absolute module URL to an SSR dependency snapshot using
+ * the module-server path transport. Use this only when the consumer resolves
+ * `/_vf_modules/` paths through the module server instead of generic fetch.
+ */
+export function appendSameOriginSSRDependencyPinningPathKey(
+  url: string,
+  dependencyPinningCacheKey?: string,
+  moduleServerOrigin?: string,
+): string {
+  if (
+    !dependencyPinningCacheKey?.startsWith("on:") ||
+    !moduleServerOrigin ||
+    (!/^https?:\/\//i.test(url) && !url.startsWith("//"))
+  ) {
+    return url;
+  }
+
+  try {
+    const requestOrigin = new URL(moduleServerOrigin);
+    const target = new URL(url, requestOrigin);
+    if (
+      target.origin !== requestOrigin.origin ||
+      !target.pathname.startsWith("/_vf_modules/")
+    ) {
+      return url;
+    }
+
+    const moduleUrl = appendDependencyPinningPathKey(
+      `${target.pathname}${target.search}${target.hash}`,
+      dependencyPinningCacheKey,
+    );
+    const hashIndex = moduleUrl.indexOf("#");
+    const hash = hashIndex === -1 ? "" : moduleUrl.slice(hashIndex);
+    const urlWithoutHash = hashIndex === -1 ? moduleUrl : moduleUrl.slice(0, hashIndex);
+    const queryIndex = urlWithoutHash.indexOf("?");
+    const path = queryIndex === -1 ? urlWithoutHash : urlWithoutHash.slice(0, queryIndex);
+    const params = new URLSearchParams(
+      queryIndex === -1 ? "" : urlWithoutHash.slice(queryIndex + 1),
+    );
+
+    params.set("ssr", "true");
+    return `${path}?${params.toString()}${hash}`;
   } catch {
     return url;
   }

src/transforms/mdx/esm-module-loader/import-transformer.ts

@@ -24,7 +24,7 @@ import { buildMdxJsxCacheFileName } from "./cache-format.ts";
 import { rewriteDntImports } from "./module-fetcher/index.ts";
 import { ensureCachedJsxModulePatched } from "./jsx-cache.ts";
 import type { ESMLoaderContext } from "./types.ts";
-import { appendSameOriginSSRDependencyPinningKey } from "#veryfront/transforms/import-rewriter/url-builder.ts";
+import { appendSameOriginSSRDependencyPinningPathKey } from "#veryfront/transforms/import-rewriter/url-builder.ts";
 import {
   bareStrategy,
   UnifiedImportRewriter,
@@ -165,7 +165,7 @@ export async function pinSameOriginSSRModuleImports(
   if (!dependencyPinningCacheKey?.startsWith("on:") || !moduleServerOrigin) return code;
 
   return await replaceSpecifiers(code, (specifier) => {
-    const pinned = appendSameOriginSSRDependencyPinningKey(
+    const pinned = appendSameOriginSSRDependencyPinningPathKey(
       specifier,
       dependencyPinningCacheKey,
       moduleServerOrigin,

src/transforms/mdx/esm-module-loader/loader-helpers.ts

@@ -161,6 +161,7 @@ export async function processVfModuleImports(
     context.projectId,
     {
       contentSourceId: context.contentSourceId,
+      isLocalProject: context.isLocalProject,
       reactVersion: context.reactVersion,
       moduleServerOrigin: context.moduleServerOrigin,
       dependencyPinningCacheKey: context.dependencyPinningCacheKey,

src/transforms/mdx/esm-module-loader/module-writer.test.ts

@@ -6,6 +6,7 @@ import { mdxRenderer } from "../index.ts";
 import { denoAdapter } from "#veryfront/platform/adapters/deno.ts";
 import { hashString } from "#veryfront/cache/hash.ts";
 import { withMockFetch } from "#veryfront/testing/mock-fetch.ts";
+import { extractDependencyPinningPathKey } from "#veryfront/transforms/import-rewriter/url-builder.ts";
 
 function cacheKeyForDependencies(
   dependencies: Readonly<Record<string, string>>,
@@ -103,9 +104,12 @@ describe("MDX root module cache identity", () => {
         async (input, init) => {
           const request = new Request(input, init);
           const url = new URL(request.url);
-          if (url.pathname !== modulePath) return new Response("not found", { status: 404 });
+          const pinnedPath = extractDependencyPinningPathKey(url.pathname);
+          if (pinnedPath.pathname !== modulePath) {
+            return new Response("not found", { status: 404 });
+          }
           if (
-            url.searchParams.get("pins") !== snapshotPinKey ||
+            pinnedPath.cacheKey !== snapshotPinKey ||
             url.searchParams.get("ssr") !== "true"
           ) {
             rawRequests++;
@@ -130,6 +134,7 @@ describe("MDX root module cache identity", () => {
             dependencies,
             projectDir,
             origin,
+            true,
           ),
       );
 

src/transforms/mdx/esm-module-loader/types.ts

@@ -12,6 +12,7 @@ export interface ESMLoaderContext {
   projectDir?: string;
   projectSlug?: string;
   contentSourceId?: string;
+  isLocalProject?: boolean;
   /** React version for transforms (from project config) */
   reactVersion?: string;
   /** Absolute request origin used to identify same-origin module URLs. */

src/transforms/mdx/index.ts

@@ -45,6 +45,7 @@ export class MDXRenderer {
     dependencyPinningDependencies?: Readonly<Record<string, string>>,
     dependencyPinningSource?: DependencyPinningSourceInput,
     moduleServerOrigin?: string,
+    isLocalProject?: boolean,
   ): Promise<MDXModule> {
     const resolvedDependencyPinningSource = dependencyPinningSource ?? projectDir;
     const dependencySnapshot = await resolveDependencyPinningSnapshot(
@@ -67,6 +68,7 @@ export class MDXRenderer {
       moduleServerOrigin: dependencySnapshot.cacheKey.startsWith("on:")
         ? moduleServerOrigin
         : undefined,
+      isLocalProject,
     };
 
     return await loadModuleESM(compiledProgramCode, context);