@moostjs/vite 0.6.29 → 0.6.31

package/dist/index.cjs

@@ -40,6 +40,32 @@ const DEFAULT_SSR_OUTLET = "<!--ssr-outlet-->";
 const DEFAULT_SSR_STATE = "<!--ssr-state-->";
 const DEFAULT_SSR_HEAD = "<!--ssr-head-->";
 /**
+* Invokes the SSR `render()` for a page request. Shared by all three render call
+* sites so the render contract stays identical across them:
+* - always passes the page request context ({@link TSSRRenderContext}) as the
+*   second `render()` argument;
+* - when a Moost HTTP adapter is provided (and supports it), runs the render
+*   inside an HTTP event context seeded from the real `(req, res)` pair, so
+*   SSR-time `fetch('/api/...')` self-calls inherit the viewer's identity
+*   headers (`forwardHeaders`) instead of arriving anonymous, and `Set-Cookie`
+*   headers from those self-calls are drained onto the page response;
+* - degrades to a plain `render(url, ctx)` call when the adapter is absent or
+*   predates `withHttpContext`.
+*/ async function renderSSRPage(opts) {
+	const { render, url, req, res, http } = opts;
+	const ctx = {
+		headers: req.headers,
+		method: req.method || "GET",
+		req
+	};
+	if (http && typeof http.withHttpContext === "function") {
+		const { result, response } = await http.withHttpContext(req, res, () => render(url, ctx));
+		for (const cookie of response.getSetCookieStrings()) res.appendHeader("set-cookie", cookie);
+		return result;
+	}
+	return render(url, ctx);
+}
+/**
 * Applies an SSR render result to the HTTP response: sets the status code and
 * headers, then substitutes the outlet, state and head markers into the HTML
 * template. Shared by all three render call sites (the dev middleware, the dev
@@ -389,11 +415,33 @@ function moostVite(options) {
 	const prefixes = normalizePrefixes(options.prefix);
 	let moostMiddleware = null;
 	let localFetchTeardown = null;
+	/**
+	* Live ref to the booted MoostHttp instance (from Vite's SSR module graph).
+	* Used to run SSR renders inside an HTTP event context (`withHttpContext`)
+	* so SSR self-fetches inherit the page request's identity. Exposed on the
+	* resolved config for the `createSSRServer()` dev branch; re-pointed on every
+	* boot, cleared on eject.
+	*/ const moostHttpRef = { current: null };
+	const ssrForwarding = options.ssrFetchForwarding !== false;
+	/**
+	* Boot-identity stamps (dev-only "mongrel state" diagnostic — a stale pipeline
+	* presents as security middleware silently switched off). `bootGeneration` is
+	* bumped on every eject; `bootingGeneration` records which generation the
+	* in-flight/most recent boot belongs to (set by runReload). When listen()
+	* captures a middleware for a boot that is no longer current — e.g. a delayed
+	* listen() from a torn boot racing a newer eject — it logs loudly.
+	*/ let bootGeneration = 0;
+	let bootingGeneration = 0;
+	/** Whether the HTTP listen() patch has ever captured a middleware (i.e. this is an HTTP app). */ let httpCaptured = false;
+	/** Module IDs awaiting DI cleanup — consumed in runReload; see ejectApp. */ let pendingCleanup = null;
 	/** In middleware mode: maps req → next() for the onNoMatch callback */ const pendingNextMap = /* @__PURE__ */ new WeakMap();
 	const adapters = isTest ? [] : [
 		createAdapterDetector("http", (MoostHttp, moduleExports) => {
 			MoostHttp.prototype.listen = function(...args) {
 				logger.log(`🔌 Overtaking HTTP.listen`);
+				if (bootingGeneration !== bootGeneration) logger.error(`⚠️  A stale Moost boot captured the HTTP middleware (boot generation ${bootingGeneration}, latest ${bootGeneration}) — an HMR reload race; a follow-up reload will replace it.`);
+				httpCaptured = true;
+				moostHttpRef.current = this;
 				if (options.middleware) moostMiddleware = this.getServerCb((req) => {
 					pendingNextMap.get(req)?.();
 				});
@@ -433,15 +481,24 @@ function moostVite(options) {
 	*/ const getEntryModule = (moduleGraph) => moduleGraph.getModuleByUrl(options.entry);
 	/**
 	* Drops the captured Moost app so the next request triggers a full reload:
-	* releases the middleware + local fetch and ejects DI instances affected by
-	* the changed modules.
+	* releases the middleware + local fetch and queues the changed module IDs for
+	* DI cleanup. The cleanup itself (infact ejects, wooks reset) is deferred to
+	* runReload, under the reload lock: running it here, per hot-update wave,
+	* raced in-flight requests and mid-boot imports mutating the same global
+	* containers — ejected-but-still-referenced instances were lazily re-created
+	* into the OLD pipeline, producing a mongrel half-old/half-new app. Waves
+	* arriving before the lazy reload (editor bulk-save storms) coalesce into one
+	* pending set and one cleanup.
 	*/ const ejectApp = (cleanupInstances) => {
+		bootGeneration++;
 		moostMiddleware = null;
+		moostHttpRef.current = null;
 		if (localFetchTeardown) {
 			localFetchTeardown();
 			localFetchTeardown = null;
 		}
-		moostRestartCleanup(adapters, options.onEject, cleanupInstances);
+		if (pendingCleanup) for (const id of cleanupInstances) pendingCleanup.add(id);
+		else pendingCleanup = cleanupInstances;
 		reloadRequired = true;
 	};
 	patchMoostHandlerLogging();
@@ -455,7 +512,8 @@ function moostVite(options) {
 				const serverDefines = {
 					"process.env.MOOST_DEFERRED_ENV": "\"production\"",
 					__MOOST_ENTRY__: JSON.stringify(`./${entryKey}.js`),
-					__MOOST_PREFIX__: JSON.stringify(prefixes ?? null)
+					__MOOST_PREFIX__: JSON.stringify(prefixes ?? null),
+					__MOOST_SSR_FORWARDING__: JSON.stringify(ssrForwarding)
 				};
 				const ssrInput = {
 					server: options.serverEntry || generatedServerEntry(cfg.root),
@@ -557,8 +615,10 @@ function moostVite(options) {
 				port: options.port,
 				ssrOutlet: options.ssrOutlet,
 				ssrState: options.ssrState,
-				ssrHead: options.ssrHead
+				ssrHead: options.ssrHead,
+				ssrFetchForwarding: options.ssrFetchForwarding
 			};
+			config.__moostViteHttpRef = moostHttpRef;
 		},
 		async transform(code, id) {
 			if (!id.endsWith(".ts")) return null;
@@ -595,6 +655,8 @@ function moostVite(options) {
 			bootError = null;
 			reloadRequired = false;
 			reloadPromise = null;
+			pendingCleanup = null;
+			bootingGeneration = bootGeneration;
 			const runReload = () => {
 				reloadRequired = false;
 				console.log();
@@ -602,11 +664,16 @@ function moostVite(options) {
 				console.log();
 				return (async () => {
 					try {
+						bootingGeneration = bootGeneration;
+						const cleanupInstances = pendingCleanup ?? void 0;
+						pendingCleanup = null;
+						moostRestartCleanup(adapters, options.onEject, cleanupInstances);
 						for (const adapter of adapters) if (adapter.detected) await adapter.init();
 						const entryModule = await getEntryModule(server.environments.ssr.moduleGraph);
 						if (entryModule?.transformResult) server.environments.ssr.moduleGraph.invalidateModule(entryModule);
 						await ssrImport(options.entry);
 						bootError = null;
+						if (httpCaptured && !moostMiddleware) logger.error(`⚠️  Moost app reloaded but no HTTP middleware was captured — the entry did not re-run listen().`);
 					} catch (error) {
 						bootError = error;
 						logger.error(`✖️  Failed to reload Moost App: ${error.message}`);
@@ -684,7 +751,13 @@ function moostVite(options) {
 						let template = await fs.readFile((0, node_path.resolve)(server.config.root, "index.html"), "utf8");
 						template = await server.transformIndexHtml(url, template);
 						const { render } = await server.ssrLoadModule(options.ssrEntry);
-						const result = await render(url);
+						const result = await renderSSRPage({
+							render,
+							url,
+							req,
+							res,
+							http: ssrForwarding ? moostHttpRef.current : null
+						});
 						sendSSRResponse(res, template, {
 							ssrOutlet,
 							ssrState,

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { PluginOption } from 'vite';
+import { IncomingMessage } from 'node:http';
 
 interface TMoostViteDevOptions {
     /**
@@ -76,6 +77,20 @@ interface TMoostViteDevOptions {
      * Default: `true`.
      */
     ssrFetch?: boolean;
+    /**
+     * Run each SSR render inside an HTTP event context seeded from the incoming
+     * page request. SSR-time `fetch('/api/...')` self-calls then inherit the
+     * viewer's identity headers (authorization, cookie, accept-language,
+     * x-forwarded-for, x-request-id — see the HTTP adapter's `forwardHeaders`
+     * option) instead of arriving anonymous, and `Set-Cookie` headers they
+     * produce are drained onto the page response. Applies in dev and is baked
+     * into the generated production server.
+     *
+     * Set to `false` to keep SSR self-calls anonymous.
+     *
+     * Default: `true`.
+     */
+    ssrFetchForwarding?: boolean;
     /**
      * Run Moost as Connect middleware instead of taking over the server.
      * When enabled, Moost runs first and unmatched requests fall through to
@@ -161,4 +176,44 @@ interface TMoostViteDevOptions {
 }
 declare function moostVite(options: TMoostViteDevOptions): PluginOption;
 
+/**
+ * The value an SSR `render(url)` function may return. Only `html` is required;
+ * every other field is optional, so a render returning `{ html }` (or
+ * `{ html, state }`) keeps working unchanged.
+ */
+interface TSSRRenderResult {
+    /** Server-rendered app markup, substituted into the `ssrOutlet` marker. */
+    html: string;
+    /**
+     * Serialized app state. Wrapped in `<script>window.__SSR_STATE__=…</script>`
+     * and substituted into the `ssrState` marker (nothing is emitted when absent).
+     */
+    state?: string;
+    /**
+     * Ready-to-insert `<head>` tags (`<title>`, `<meta>`, canonical, Open Graph,
+     * JSON-LD, …), substituted verbatim into the `ssrHead` marker. This is exactly
+     * the shape head managers emit (e.g. unhead's `renderSSRHead(head).headTags`).
+     */
+    head?: string;
+    /** HTTP status code for the response (default `200`) — e.g. `404` for a soft-404, `301` for a redirect. */
+    status?: number;
+    /** Extra response headers — e.g. `cache-control`, or `location` alongside `status: 301`. */
+    headers?: Record<string, string>;
+}
+/**
+ * Context of the incoming page request, passed as the second argument to the
+ * SSR `render()` entry. Additive: entries typed `render(url)` keep working.
+ */
+interface TSSRRenderContext {
+    /** Raw request headers of the page request (node `IncomingMessage.headers`). */
+    headers: IncomingMessage['headers'];
+    /** HTTP method of the page request (the SSR fallbacks only render `GET` today). */
+    method: string;
+    /** Escape hatch for everything else (socket address, etc.). */
+    req: IncomingMessage;
+}
+/** The SSR entry contract: `render(url, ctx?)`. `ctx` is new and optional. */
+type TSSRRender = (url: string, ctx?: TSSRRenderContext) => Promise<TSSRRenderResult> | TSSRRenderResult;
+
 export { moostVite };
+export type { TMoostViteDevOptions, TSSRRender, TSSRRenderContext, TSSRRenderResult };

package/dist/index.mjs

@@ -11,6 +11,32 @@ const DEFAULT_SSR_OUTLET = "<!--ssr-outlet-->";
 const DEFAULT_SSR_STATE = "<!--ssr-state-->";
 const DEFAULT_SSR_HEAD = "<!--ssr-head-->";
 /**
+* Invokes the SSR `render()` for a page request. Shared by all three render call
+* sites so the render contract stays identical across them:
+* - always passes the page request context ({@link TSSRRenderContext}) as the
+*   second `render()` argument;
+* - when a Moost HTTP adapter is provided (and supports it), runs the render
+*   inside an HTTP event context seeded from the real `(req, res)` pair, so
+*   SSR-time `fetch('/api/...')` self-calls inherit the viewer's identity
+*   headers (`forwardHeaders`) instead of arriving anonymous, and `Set-Cookie`
+*   headers from those self-calls are drained onto the page response;
+* - degrades to a plain `render(url, ctx)` call when the adapter is absent or
+*   predates `withHttpContext`.
+*/ async function renderSSRPage(opts) {
+	const { render, url, req, res, http } = opts;
+	const ctx = {
+		headers: req.headers,
+		method: req.method || "GET",
+		req
+	};
+	if (http && typeof http.withHttpContext === "function") {
+		const { result, response } = await http.withHttpContext(req, res, () => render(url, ctx));
+		for (const cookie of response.getSetCookieStrings()) res.appendHeader("set-cookie", cookie);
+		return result;
+	}
+	return render(url, ctx);
+}
+/**
 * Applies an SSR render result to the HTTP response: sets the status code and
 * headers, then substitutes the outlet, state and head markers into the HTML
 * template. Shared by all three render call sites (the dev middleware, the dev
@@ -358,11 +384,33 @@ function moostVite(options) {
 	const prefixes = normalizePrefixes(options.prefix);
 	let moostMiddleware = null;
 	let localFetchTeardown = null;
+	/**
+	* Live ref to the booted MoostHttp instance (from Vite's SSR module graph).
+	* Used to run SSR renders inside an HTTP event context (`withHttpContext`)
+	* so SSR self-fetches inherit the page request's identity. Exposed on the
+	* resolved config for the `createSSRServer()` dev branch; re-pointed on every
+	* boot, cleared on eject.
+	*/ const moostHttpRef = { current: null };
+	const ssrForwarding = options.ssrFetchForwarding !== false;
+	/**
+	* Boot-identity stamps (dev-only "mongrel state" diagnostic — a stale pipeline
+	* presents as security middleware silently switched off). `bootGeneration` is
+	* bumped on every eject; `bootingGeneration` records which generation the
+	* in-flight/most recent boot belongs to (set by runReload). When listen()
+	* captures a middleware for a boot that is no longer current — e.g. a delayed
+	* listen() from a torn boot racing a newer eject — it logs loudly.
+	*/ let bootGeneration = 0;
+	let bootingGeneration = 0;
+	/** Whether the HTTP listen() patch has ever captured a middleware (i.e. this is an HTTP app). */ let httpCaptured = false;
+	/** Module IDs awaiting DI cleanup — consumed in runReload; see ejectApp. */ let pendingCleanup = null;
 	/** In middleware mode: maps req → next() for the onNoMatch callback */ const pendingNextMap = /* @__PURE__ */ new WeakMap();
 	const adapters = [
 		createAdapterDetector("http", (MoostHttp, moduleExports) => {
 			MoostHttp.prototype.listen = function(...args) {
 				logger.log(`🔌 Overtaking HTTP.listen`);
+				if (bootingGeneration !== bootGeneration) logger.error(`⚠️  A stale Moost boot captured the HTTP middleware (boot generation ${bootingGeneration}, latest ${bootGeneration}) — an HMR reload race; a follow-up reload will replace it.`);
+				httpCaptured = true;
+				moostHttpRef.current = this;
 				if (options.middleware) moostMiddleware = this.getServerCb((req) => {
 					pendingNextMap.get(req)?.();
 				});
@@ -402,15 +450,24 @@ function moostVite(options) {
 	*/ const getEntryModule = (moduleGraph) => moduleGraph.getModuleByUrl(options.entry);
 	/**
 	* Drops the captured Moost app so the next request triggers a full reload:
-	* releases the middleware + local fetch and ejects DI instances affected by
-	* the changed modules.
+	* releases the middleware + local fetch and queues the changed module IDs for
+	* DI cleanup. The cleanup itself (infact ejects, wooks reset) is deferred to
+	* runReload, under the reload lock: running it here, per hot-update wave,
+	* raced in-flight requests and mid-boot imports mutating the same global
+	* containers — ejected-but-still-referenced instances were lazily re-created
+	* into the OLD pipeline, producing a mongrel half-old/half-new app. Waves
+	* arriving before the lazy reload (editor bulk-save storms) coalesce into one
+	* pending set and one cleanup.
 	*/ const ejectApp = (cleanupInstances) => {
+		bootGeneration++;
 		moostMiddleware = null;
+		moostHttpRef.current = null;
 		if (localFetchTeardown) {
 			localFetchTeardown();
 			localFetchTeardown = null;
 		}
-		moostRestartCleanup(adapters, options.onEject, cleanupInstances);
+		if (pendingCleanup) for (const id of cleanupInstances) pendingCleanup.add(id);
+		else pendingCleanup = cleanupInstances;
 		reloadRequired = true;
 	};
 	patchMoostHandlerLogging();
@@ -424,7 +481,8 @@ function moostVite(options) {
 				const serverDefines = {
 					"process.env.MOOST_DEFERRED_ENV": "\"production\"",
 					__MOOST_ENTRY__: JSON.stringify(`./${entryKey}.js`),
-					__MOOST_PREFIX__: JSON.stringify(prefixes ?? null)
+					__MOOST_PREFIX__: JSON.stringify(prefixes ?? null),
+					__MOOST_SSR_FORWARDING__: JSON.stringify(ssrForwarding)
 				};
 				const ssrInput = {
 					server: options.serverEntry || generatedServerEntry(cfg.root),
@@ -526,8 +584,10 @@ function moostVite(options) {
 				port: options.port,
 				ssrOutlet: options.ssrOutlet,
 				ssrState: options.ssrState,
-				ssrHead: options.ssrHead
+				ssrHead: options.ssrHead,
+				ssrFetchForwarding: options.ssrFetchForwarding
 			};
+			config.__moostViteHttpRef = moostHttpRef;
 		},
 		async transform(code, id) {
 			if (!id.endsWith(".ts")) return null;
@@ -564,6 +624,8 @@ function moostVite(options) {
 			bootError = null;
 			reloadRequired = false;
 			reloadPromise = null;
+			pendingCleanup = null;
+			bootingGeneration = bootGeneration;
 			const runReload = () => {
 				reloadRequired = false;
 				console.log();
@@ -571,11 +633,16 @@ function moostVite(options) {
 				console.log();
 				return (async () => {
 					try {
+						bootingGeneration = bootGeneration;
+						const cleanupInstances = pendingCleanup ?? void 0;
+						pendingCleanup = null;
+						moostRestartCleanup(adapters, options.onEject, cleanupInstances);
 						for (const adapter of adapters) if (adapter.detected) await adapter.init();
 						const entryModule = await getEntryModule(server.environments.ssr.moduleGraph);
 						if (entryModule?.transformResult) server.environments.ssr.moduleGraph.invalidateModule(entryModule);
 						await ssrImport(options.entry);
 						bootError = null;
+						if (httpCaptured && !moostMiddleware) logger.error(`⚠️  Moost app reloaded but no HTTP middleware was captured — the entry did not re-run listen().`);
 					} catch (error) {
 						bootError = error;
 						logger.error(`✖️  Failed to reload Moost App: ${error.message}`);
@@ -645,7 +712,13 @@ function moostVite(options) {
 						let template = await fs.readFile(resolve(server.config.root, "index.html"), "utf8");
 						template = await server.transformIndexHtml(url, template);
 						const { render } = await server.ssrLoadModule(options.ssrEntry);
-						const result = await render(url);
+						const result = await renderSSRPage({
+							render,
+							url,
+							req,
+							res,
+							http: ssrForwarding ? moostHttpRef.current : null
+						});
 						sendSSRResponse(res, template, {
 							ssrOutlet,
 							ssrState,

package/dist/prod-server.cjs

@@ -7,6 +7,32 @@ const DEFAULT_SSR_OUTLET = "<!--ssr-outlet-->";
 const DEFAULT_SSR_STATE = "<!--ssr-state-->";
 const DEFAULT_SSR_HEAD = "<!--ssr-head-->";
 /**
+* Invokes the SSR `render()` for a page request. Shared by all three render call
+* sites so the render contract stays identical across them:
+* - always passes the page request context ({@link TSSRRenderContext}) as the
+*   second `render()` argument;
+* - when a Moost HTTP adapter is provided (and supports it), runs the render
+*   inside an HTTP event context seeded from the real `(req, res)` pair, so
+*   SSR-time `fetch('/api/...')` self-calls inherit the viewer's identity
+*   headers (`forwardHeaders`) instead of arriving anonymous, and `Set-Cookie`
+*   headers from those self-calls are drained onto the page response;
+* - degrades to a plain `render(url, ctx)` call when the adapter is absent or
+*   predates `withHttpContext`.
+*/ async function renderSSRPage(opts) {
+	const { render, url, req, res, http } = opts;
+	const ctx = {
+		headers: req.headers,
+		method: req.method || "GET",
+		req
+	};
+	if (http && typeof http.withHttpContext === "function") {
+		const { result, response } = await http.withHttpContext(req, res, () => render(url, ctx));
+		for (const cookie of response.getSetCookieStrings()) res.appendHeader("set-cookie", cookie);
+		return result;
+	}
+	return render(url, ctx);
+}
+/**
 * Applies an SSR render result to the HTTP response: sets the status code and
 * headers, then substitutes the outlet, state and head markers into the HTML
 * template. Shared by all three render call sites (the dev middleware, the dev
@@ -72,6 +98,8 @@ async function createSSRServer(options) {
 		const ssrOutlet = config.ssrOutlet || DEFAULT_SSR_OUTLET;
 		const ssrState = config.ssrState || DEFAULT_SSR_STATE;
 		const ssrHead = config.ssrHead || DEFAULT_SSR_HEAD;
+		const ssrForwarding = config.ssrFetchForwarding !== false;
+		const httpRef = vite.config.__moostViteHttpRef;
 		let ssrFallback = null;
 		if (ssrEntry) {
 			const fs = await import("node:fs/promises");
@@ -83,7 +111,13 @@ async function createSSRServer(options) {
 					let template = await fs.readFile(path.resolve(vite.config.root, "index.html"), "utf8");
 					template = await vite.transformIndexHtml(url, template);
 					const { render } = await vite.ssrLoadModule(ssrEntry);
-					const result = await render(url);
+					const result = await renderSSRPage({
+						render,
+						url,
+						req,
+						res,
+						http: ssrForwarding ? httpRef?.current : null
+					});
 					sendSSRResponse(res, template, {
 						ssrOutlet,
 						ssrState,
@@ -117,6 +151,7 @@ async function createSSRServer(options) {
 	const ssrState = opts.ssrState || (__MOOST_SSR_STATE__ !== void 0 ? __MOOST_SSR_STATE__ : DEFAULT_SSR_STATE);
 	const ssrHead = opts.ssrHead || (__MOOST_SSR_HEAD__ !== void 0 ? __MOOST_SSR_HEAD__ : DEFAULT_SSR_HEAD);
 	const prefixes = normalizePrefixes(opts.prefix ?? __MOOST_PREFIX__);
+	const ssrForwarding = opts.ssrFetchForwarding ?? __MOOST_SSR_FORWARDING__ ?? true;
 	const defaultPort = opts.port || Number(process.env.PORT) || 3e3;
 	const template = await fs.readFile(path.resolve(clientDir, "index.html"), "utf8");
 	let render = null;
@@ -165,7 +200,13 @@ async function createSSRServer(options) {
 			}
 			try {
 				if (render) {
-					const result = await render(url);
+					const result = await renderSSRPage({
+						render,
+						url,
+						req,
+						res,
+						http: ssrForwarding ? moostHttpRef.instance : null
+					});
 					sendSSRResponse(res, template, {
 						ssrOutlet,
 						ssrState,

package/dist/prod-server.d.ts

@@ -24,6 +24,20 @@ interface TSSRRenderResult {
     /** Extra response headers — e.g. `cache-control`, or `location` alongside `status: 301`. */
     headers?: Record<string, string>;
 }
+/**
+ * Context of the incoming page request, passed as the second argument to the
+ * SSR `render()` entry. Additive: entries typed `render(url)` keep working.
+ */
+interface TSSRRenderContext {
+    /** Raw request headers of the page request (node `IncomingMessage.headers`). */
+    headers: IncomingMessage['headers'];
+    /** HTTP method of the page request (the SSR fallbacks only render `GET` today). */
+    method: string;
+    /** Escape hatch for everything else (socket address, etc.). */
+    req: IncomingMessage;
+}
+/** The SSR entry contract: `render(url, ctx?)`. `ctx` is new and optional. */
+type TSSRRender = (url: string, ctx?: TSSRRenderContext) => Promise<TSSRRenderResult> | TSSRRenderResult;
 
 type TMiddleware = (req: IncomingMessage, res: ServerResponse, next: () => void) => void;
 interface TSSRServerOptions {
@@ -48,6 +62,15 @@ interface TSSRServerOptions {
     ssrState?: string;
     /** Override: HTML placeholder for SSR-rendered `<head>` tags */
     ssrHead?: string;
+    /**
+     * Override: run each SSR render inside an HTTP event context seeded from the
+     * incoming page request, so SSR-time `fetch('/api/...')` self-calls inherit
+     * the viewer's identity headers (authorization, cookie, accept-language,
+     * x-forwarded-for, x-request-id — see the adapter's `forwardHeaders` option)
+     * and their `Set-Cookie` headers land on the page response.
+     * Set to `false` to keep SSR self-calls anonymous. Default: `true`.
+     */
+    ssrFetchForwarding?: boolean;
 }
 interface TSSRServer {
     /** Add Connect-compatible middleware (runs in both dev and prod) */
@@ -58,4 +81,4 @@ interface TSSRServer {
 declare function createSSRServer(options?: TSSRServerOptions): Promise<TSSRServer>;
 
 export { createSSRServer };
-export type { TSSRRenderResult, TSSRServer, TSSRServerOptions };
+export type { TSSRRender, TSSRRenderContext, TSSRRenderResult, TSSRServer, TSSRServerOptions };

package/dist/prod-server.mjs

@@ -8,6 +8,32 @@ const DEFAULT_SSR_OUTLET = "<!--ssr-outlet-->";
 const DEFAULT_SSR_STATE = "<!--ssr-state-->";
 const DEFAULT_SSR_HEAD = "<!--ssr-head-->";
 /**
+* Invokes the SSR `render()` for a page request. Shared by all three render call
+* sites so the render contract stays identical across them:
+* - always passes the page request context ({@link TSSRRenderContext}) as the
+*   second `render()` argument;
+* - when a Moost HTTP adapter is provided (and supports it), runs the render
+*   inside an HTTP event context seeded from the real `(req, res)` pair, so
+*   SSR-time `fetch('/api/...')` self-calls inherit the viewer's identity
+*   headers (`forwardHeaders`) instead of arriving anonymous, and `Set-Cookie`
+*   headers from those self-calls are drained onto the page response;
+* - degrades to a plain `render(url, ctx)` call when the adapter is absent or
+*   predates `withHttpContext`.
+*/ async function renderSSRPage(opts) {
+	const { render, url, req, res, http } = opts;
+	const ctx = {
+		headers: req.headers,
+		method: req.method || "GET",
+		req
+	};
+	if (http && typeof http.withHttpContext === "function") {
+		const { result, response } = await http.withHttpContext(req, res, () => render(url, ctx));
+		for (const cookie of response.getSetCookieStrings()) res.appendHeader("set-cookie", cookie);
+		return result;
+	}
+	return render(url, ctx);
+}
+/**
 * Applies an SSR render result to the HTTP response: sets the status code and
 * headers, then substitutes the outlet, state and head markers into the HTML
 * template. Shared by all three render call sites (the dev middleware, the dev
@@ -73,6 +99,8 @@ async function createSSRServer(options) {
 		const ssrOutlet = config.ssrOutlet || DEFAULT_SSR_OUTLET;
 		const ssrState = config.ssrState || DEFAULT_SSR_STATE;
 		const ssrHead = config.ssrHead || DEFAULT_SSR_HEAD;
+		const ssrForwarding = config.ssrFetchForwarding !== false;
+		const httpRef = vite.config.__moostViteHttpRef;
 		let ssrFallback = null;
 		if (ssrEntry) {
 			const fs = await import("node:fs/promises");
@@ -84,7 +112,13 @@ async function createSSRServer(options) {
 					let template = await fs.readFile(path.resolve(vite.config.root, "index.html"), "utf8");
 					template = await vite.transformIndexHtml(url, template);
 					const { render } = await vite.ssrLoadModule(ssrEntry);
-					const result = await render(url);
+					const result = await renderSSRPage({
+						render,
+						url,
+						req,
+						res,
+						http: ssrForwarding ? httpRef?.current : null
+					});
 					sendSSRResponse(res, template, {
 						ssrOutlet,
 						ssrState,
@@ -118,6 +152,7 @@ async function createSSRServer(options) {
 	const ssrState = opts.ssrState || (__MOOST_SSR_STATE__ !== void 0 ? __MOOST_SSR_STATE__ : DEFAULT_SSR_STATE);
 	const ssrHead = opts.ssrHead || (__MOOST_SSR_HEAD__ !== void 0 ? __MOOST_SSR_HEAD__ : DEFAULT_SSR_HEAD);
 	const prefixes = normalizePrefixes(opts.prefix ?? __MOOST_PREFIX__);
+	const ssrForwarding = opts.ssrFetchForwarding ?? __MOOST_SSR_FORWARDING__ ?? true;
 	const defaultPort = opts.port || Number(process.env.PORT) || 3e3;
 	const template = await fs.readFile(path.resolve(clientDir, "index.html"), "utf8");
 	let render = null;
@@ -166,7 +201,13 @@ async function createSSRServer(options) {
 			}
 			try {
 				if (render) {
-					const result = await render(url);
+					const result = await renderSSRPage({
+						render,
+						url,
+						req,
+						res,
+						http: ssrForwarding ? moostHttpRef.instance : null
+					});
 					sendSSRResponse(res, template, {
 						ssrOutlet,
 						ssrState,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moostjs/vite",
-  "version": "0.6.29",
+  "version": "0.6.31",
   "description": "Vite Dev plugin for moostjs",
   "keywords": [
     "composables",
@@ -58,8 +58,8 @@
   "peerDependencies": {
     "sirv": "^3.0.0",
     "vite": "^8.0.0",
-    "@moostjs/event-http": "^0.6.29",
-    "moost": "^0.6.29"
+    "@moostjs/event-http": "^0.6.31",
+    "moost": "^0.6.31"
   },
   "peerDependenciesMeta": {
     "sirv": {