veryfront 0.1.739 → 0.1.742

package/esm/src/security/sandbox/worker-permissions.js

@@ -6,11 +6,10 @@
  *
  * @module security/sandbox/worker-permissions
  */
-/**
- * Deno Worker permission object.
- * See: https://docs.deno.com/runtime/fundamentals/permissions/
- */
 import * as dntShim from "../../../_dnt.shims.js";
+import { getFrameworkRootFromMeta } from "../../platform/compat/vfs-paths.js";
+import { getHostEnv } from "../../platform/compat/process.js";
+import { getCacheBaseDir, getHttpBundleCacheDir, getMdxEsmCacheDir, } from "../../utils/cache-dir.js";
 // Cache compiled binary check — Deno.execPath() is a syscall that never changes at runtime
 const _isCompiledBinary = (() => {
     try {
@@ -24,6 +23,27 @@ const _isCompiledBinary = (() => {
         return false;
     }
 })();
+function normalizeReadPaths(paths) {
+    const unique = new Set();
+    for (const path of paths) {
+        if (!path)
+            continue;
+        const trimmed = path.trim();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return [...unique];
+}
+function getDefaultCompiledReadPaths() {
+    return normalizeReadPaths([
+        getFrameworkRootFromMeta(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url),
+        getCacheBaseDir(),
+        getMdxEsmCacheDir(),
+        getHttpBundleCacheDir(),
+        getHostEnv("DENO_DIR"),
+    ]);
+}
 /**
  * Build scoped permissions for a project worker.
  *
@@ -35,20 +55,14 @@ const _isCompiledBinary = (() => {
  * - ffi: denied (no native code from user code)
  * - sys: denied (no system info access from user code)
  */
-export function buildWorkerPermissions(readPaths) {
-    // In compiled binaries, user modules import from the VFS temp dir which
-    // is outside the project directory. Rather than trying to enumerate all
-    // read paths, grant full read access — the security boundary is enforced
-    // by denying write/run/ffi/sys, not by restricting reads.
-    //
-    // SECURITY (residual, tracked in #2245): with read:true a user route
-    // handler can call Deno.readTextFile directly to read any host file,
-    // bypassing the project-scoped ctx.fs adapter. Narrowing this to a
-    // binary-validated allow-list (or removing direct Deno fs from user module
-    // scope) is blocking work for the next security batch.
-    if (_isCompiledBinary) {
+export function buildWorkerPermissions(readPaths, options = {}) {
+    const isCompiledBinary = options.isCompiledBinary ?? _isCompiledBinary;
+    const normalizedReadPaths = normalizeReadPaths(readPaths);
+    if (isCompiledBinary) {
+        const compiledReadPaths = options.compiledReadPaths ?? getDefaultCompiledReadPaths();
+        const scopedReadPaths = normalizeReadPaths([...normalizedReadPaths, ...compiledReadPaths]);
         return {
-            read: true,
+            read: scopedReadPaths.length > 0 ? scopedReadPaths : false,
             write: false,
             net: true,
             env: true,
@@ -58,7 +72,7 @@ export function buildWorkerPermissions(readPaths) {
         };
     }
     return {
-        read: readPaths.length > 0 ? readPaths : false,
+        read: normalizedReadPaths.length > 0 ? normalizedReadPaths : false,
         write: false,
         net: true,
         env: true,

package/esm/src/server/services/rendering/ssr.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/rendering/ssr.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,kCAAkC,CAAC;AAsB1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,IAAI,YAAY,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CAC3D;AAUD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAqBD,qBAAa,UAAW,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;IAKD,mBAAmB,IAAI,YAAY;IAW7B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAI1D,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA2G1F,OAAO,CAAC,iBAAiB;IAyHzB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;CAS1D"}
+{"version":3,"file":"ssr.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/rendering/ssr.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,kCAAkC,CAAC;AAuB1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,IAAI,YAAY,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CAC3D;AAUD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAqBD,qBAAa,UAAW,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;IAKD,mBAAmB,IAAI,YAAY;IAW7B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAI1D,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+G1F,OAAO,CAAC,iBAAiB;IAyHzB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;CAS1D"}

package/esm/src/server/services/rendering/ssr.service.js

@@ -4,7 +4,7 @@ import { serverLogger, timeAsync } from "../../../utils/index.js";
 import { computeSSRETag } from "../../handlers/request/ssr/etag-handler.js";
 import { VeryfrontError } from "../../../errors/index.js";
 import { getColorSchemeFromRequest } from "../../../security/http/client-hints.js";
-import { endRenderSession, hasRenderSession, startRenderSession, } from "../../../transforms/mdx/esm-module-loader/module-fetcher/index.js";
+import { endRenderSession, hasRenderSession, runInRenderSession, startRenderSession, } from "../../../transforms/mdx/esm-module-loader/module-fetcher/index.js";
 import { getErrorCollector } from "../../../observability/error-collector.js";
 import { profilePhase } from "../../../observability/request-profiler.js";
 import { ErrorOverlay, parseErrorLocation } from "../../dev-server/error-overlay/index.js";
@@ -68,7 +68,10 @@ export class SSRService {
                 slug,
             });
             const renderStartTime = performance.now();
-            const result = await profilePhase("ssr.render_page", () => timeAsync("render-page", () => renderer.renderPage(slug, {
+            // Bind the render session to this async context so modules fetched
+            // during the render are attributed to THIS render, not whichever
+            // concurrent session started first.
+            const result = await runInRenderSession(renderSessionId, () => profilePhase("ssr.render_page", () => timeAsync("render-page", () => renderer.renderPage(slug, {
                 delivery: "stream",
                 request,
                 url,
@@ -84,7 +87,7 @@ export class SSRService {
                 noHmr,
                 forceProductionScripts: options.forceProductionScripts,
                 renderSessionId,
-            })));
+            }))));
             logger.debug("renderPage DONE", {
                 projectSlug: ctx.projectSlug,
                 slug,

package/esm/src/transforms/mdx/esm-module-loader/loader-helpers.d.ts

@@ -25,6 +25,8 @@ export declare function initializeCacheDir(context: ESMLoaderContext): Promise<s
 export declare function findVfModuleImports(code: string): Array<{
     original: string;
     path: string;
+    start: number;
+    end: number;
 }>;
 /**
  * Process /_vf_modules/ imports and replace them with file:// paths.
@@ -32,5 +34,7 @@ export declare function findVfModuleImports(code: string): Array<{
 export declare function processVfModuleImports(code: string, imports: Array<{
     original: string;
     path: string;
+    start: number;
+    end: number;
 }>, context: ESMLoaderContext, projectDir: string, strictMissingModules: boolean): Promise<string>;
 //# sourceMappingURL=loader-helpers.d.ts.map

package/esm/src/transforms/mdx/esm-module-loader/loader-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/mdx/esm-module-loader/loader-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAapF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAWnE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCnF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3F;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,oBAAoB,EAAE,OAAO,GAC5B,OAAO,CAAC,MAAM,CAAC,CAwGjB"}
+{"version":3,"file":"loader-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/mdx/esm-module-loader/loader-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAapF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAWnE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCnF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,oBAAoB,EAAE,OAAO,GAC5B,OAAO,CAAC,MAAM,CAAC,CAoHjB"}

package/esm/src/transforms/mdx/esm-module-loader/loader-helpers.js

@@ -17,6 +17,7 @@ import { exists as fsExists } from "../../../platform/compat/fs.js";
 import { LOG_PREFIX_MDX_LOADER } from "./constants.js";
 import { getLocalFs } from "./cache/index.js";
 import { createStubModule } from "./utils/stub-module.js";
+import { findStaticImportFromSpans, replaceSourceSpans, } from "./utils/source-spans.js";
 import { createModuleFetcherContext, fetchAndCacheModule } from "./module-fetcher/index.js";
 import { buildMissingModuleError } from "./missing-module.js";
 /**
@@ -89,15 +90,7 @@ export async function initializeCacheDir(context) {
  * Find /_vf_modules/ imports in code.
  */
 export function findVfModuleImports(code) {
-    const imports = [];
-    const pattern = /from\s*["'](\/?)(_vf_modules\/[^"']+)["']/g;
-    let match;
-    while ((match = pattern.exec(code)) !== null) {
-        const [original, , path] = match;
-        if (path)
-            imports.push({ original, path });
-    }
-    return imports;
+    return findStaticImportFromSpans(code, (specifier) => specifier.match(/^\/?(_vf_modules\/[^?]+)(?:\?.*)?$/)?.[1]);
 }
 /**
  * Process /_vf_modules/ imports and replace them with file:// paths.
@@ -136,7 +129,7 @@ export async function processVfModuleImports(code, imports, context, projectDir,
         strictMissingModules,
     });
     const fetchStart = performance.now();
-    const results = await Promise.all(imports.map(async ({ original, path }, index) => {
+    const results = await Promise.all(imports.map(async ({ original, path, start, end }, index) => {
         return await withSpan(SpanNames.MDX_FETCH_MODULE, async () => {
             const moduleStart = performance.now();
             logger.debug(`${LOG_PREFIX_MDX_LOADER} Fetching module START`, {
@@ -151,7 +144,7 @@ export async function processVfModuleImports(code, imports, context, projectDir,
                 path,
                 durationMs: (performance.now() - moduleStart).toFixed(1),
             });
-            return { original, filePath, path };
+            return { original, start, end, filePath, path };
         }, {
             "mdx.module_path": path,
             "mdx.module_index": index,
@@ -163,10 +156,15 @@ export async function processVfModuleImports(code, imports, context, projectDir,
         moduleCount: imports.length,
         durationMs: (performance.now() - fetchStart).toFixed(1),
     });
-    let result = code;
-    for (const { original, filePath, path } of results) {
+    const replacements = [];
+    for (const { original, start, end, filePath, path } of results) {
         if (filePath) {
-            result = result.replace(original, `from "file://${filePath}"`);
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${filePath}"`,
+            });
             continue;
         }
         if (strictMissingModules) {
@@ -178,9 +176,15 @@ export async function processVfModuleImports(code, imports, context, projectDir,
                 projectSlug,
             });
         }
-        const stubPath = await createStubModule(path, result, original, context.esmCacheDir);
-        if (stubPath)
-            result = result.replace(original, `from "file://${stubPath}"`);
+        const stubPath = await createStubModule(path, code, original, context.esmCacheDir);
+        if (stubPath) {
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${stubPath}"`,
+            });
+        }
     }
-    return result;
+    return replaceSourceSpans(code, replacements);
 }

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-fetcher.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAK5E;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,cAAc,EACvB,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAChF,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqDxB"}
+{"version":3,"file":"http-fetcher.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAM5E;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,cAAc,EACvB,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAChF,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuExB"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/http-fetcher.js

@@ -11,6 +11,7 @@ import { SpanNames } from "../../../../observability/tracing/span-names.js";
 import { LOG_PREFIX_MDX_LOADER } from "../constants.js";
 import { rewriteVeryfrontImports } from "./import-rewriter.js";
 import { findNestedImports } from "./nested-imports.js";
+import { replaceSourceSpans } from "../utils/source-spans.js";
 /**
  * Fetch module via HTTP as a fallback (local development only).
  *
@@ -38,20 +39,38 @@ export async function fetchModuleViaHTTP(normalizedPath, adapter, fetchAndCacheM
         log.warn(`${LOG_PREFIX_MDX_LOADER} HTTP fetch also failed: ${moduleUrl} (${response.status})`);
         return null;
     }
-    let moduleCode = rewriteVeryfrontImports(await response.text());
+    const moduleCode = rewriteVeryfrontImports(await response.text());
     const { vfModules, relative } = findNestedImports(moduleCode);
     const allImports = [
-        ...vfModules.map(({ original, path }) => ({ original, path, key: "nestedPath" })),
-        ...relative.map(({ original, path }) => ({ original, path, key: "relativePath" })),
+        ...vfModules.map(({ original, path, start, end }) => ({
+            original,
+            path,
+            start,
+            end,
+            key: "nestedPath",
+        })),
+        ...relative.map(({ original, path, start, end }) => ({
+            original,
+            path,
+            start,
+            end,
+            key: "relativePath",
+        })),
     ];
-    const results = await Promise.all(allImports.map(async ({ original, path, key }) => {
+    const results = await Promise.all(allImports.map(async ({ original, path, start, end, key }) => {
         const nestedFilePath = await fetchAndCacheModuleFn(path, normalizedPath);
-        return { original, nestedFilePath, [key]: path };
+        return { original, start, end, nestedFilePath, [key]: path };
     }));
-    for (const { original, nestedFilePath } of results) {
+    const replacements = [];
+    for (const { original, start, end, nestedFilePath } of results) {
         if (nestedFilePath) {
-            moduleCode = moduleCode.replace(original, `from "file://${nestedFilePath}"`);
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${nestedFilePath}"`,
+            });
         }
     }
-    return moduleCode;
+    return replaceSourceSpans(moduleCode, replacements);
 }

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D;AAwCD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8C7F"}
+{"version":3,"file":"import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgB5D;AAwCD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0D7F"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.js

@@ -7,17 +7,24 @@ import { dirname, join, resolve } from "../../../../platform/compat/path/index.j
 import { FRAMEWORK_ROOT } from "../constants.js";
 import { resolveVeryfrontModuleUrl } from "../../../veryfront-module-urls.js";
 import { getLocalFs } from "../cache/index.js";
+import { findStaticImportFromSpans, findStaticSideEffectImportSpans, replaceSourceSpans, } from "../utils/source-spans.js";
 /**
  * Rewrite veryfront/* imports to /_vf_modules/_veryfront/ paths for MDX module loading.
  * Uses deno.json exports/imports as the source of truth and appends ?ssr=true.
  */
 export function rewriteVeryfrontImports(code) {
-    return code.replace(/from\s*["'](veryfront\/[^"']+)["']/g, (_match, specifier) => {
-        const mapped = resolveVeryfrontModuleUrl(specifier);
+    const replacements = findStaticImportFromSpans(code, (specifier) => specifier.startsWith("veryfront/") ? specifier : null).flatMap(({ original, path, start, end }) => {
+        const mapped = resolveVeryfrontModuleUrl(path);
         if (!mapped)
-            return `from "${specifier}"`;
-        return `from "${mapped}?ssr=true"`;
+            return [];
+        return [{
+                start,
+                end,
+                expected: original,
+                replacement: `from "${mapped}?ssr=true"`,
+            }];
     });
+    return replaceSourceSpans(code, replacements);
 }
 /**
  * Rewrite relative imports in framework files to absolute file:// paths.
@@ -72,27 +79,30 @@ export async function rewriteDntImports(code, sourceFilePath) {
     let rewritten = code;
     const patterns = [
         {
-            regex: /from\s*["'](\.\.?\/[^"']+)["']/g,
+            findMatches: (source) => findStaticImportFromSpans(source, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1]),
             buildReplacement: (path) => `from "file://${path}"`,
         },
         {
-            regex: /import\s*["'](\.\.?\/[^"']+)["']/g,
+            findMatches: (source) => findStaticSideEffectImportSpans(source, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1]),
             buildReplacement: (path) => `import "file://${path}"`,
         },
     ];
-    for (const { regex, buildReplacement } of patterns) {
-        const matches = [...rewritten.matchAll(regex)];
-        for (const match of matches) {
-            const original = match[0];
-            const relativePath = match[1];
-            if (!relativePath)
-                continue;
+    for (const { findMatches, buildReplacement } of patterns) {
+        const matches = findMatches(rewritten);
+        const replacements = [];
+        for (const { original, path: relativePath, start, end } of matches) {
             const absolutePath = resolve(sourceDir, relativePath);
             const resolvedPath = needsFrameworkSourceFallback
                 ? await findExistingFrameworkRelativeTarget(absolutePath) ?? absolutePath
                 : absolutePath;
-            rewritten = rewritten.replace(original, buildReplacement(resolvedPath));
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: buildReplacement(resolvedPath),
+            });
         }
+        rewritten = replaceSourceSpans(rewritten, replacements);
     }
     return rewritten;
 }

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/index.d.ts

@@ -15,7 +15,7 @@ import type { Logger } from "../../../../utils/logger/logger.js";
 import type { RuntimeAdapter } from "../../../../platform/adapters/base.js";
 import type { ModuleFetcherContext } from "../types.js";
 export { rewriteDntImports } from "./import-rewriter.js";
-export { endRenderSession, hasRenderSession, startRenderSession } from "./render-sessions.js";
+export { endRenderSession, hasRenderSession, runInRenderSession, startRenderSession, } from "./render-sessions.js";
 /**
  * Error thrown when transform tree exceeds the timeout.
  */

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAG5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAcxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS9F;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOtD;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,SAAS,EAAE,MAAM;CAI9B;AAcD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,GAAE,GAAG,CAAC,MAAM,CAAa,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwFxB;AA6KD;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GACA,oBAAoB,CAUtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAG5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAcxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAS9B;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOtD;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,SAAS,EAAE,MAAM;CAI9B;AAcD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,GAAE,GAAG,CAAC,MAAM,CAAa,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwFxB;AA6KD;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GACA,oBAAoB,CAUtB"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/index.js

@@ -27,7 +27,7 @@ import { readValidCachedModulePath } from "./path-cache-lookup.js";
 import { transformResolvedModuleSource } from "./source-transform.js";
 // Re-export extracted modules for backward compatibility
 export { rewriteDntImports } from "./import-rewriter.js";
-export { endRenderSession, hasRenderSession, startRenderSession } from "./render-sessions.js";
+export { endRenderSession, hasRenderSession, runInRenderSession, startRenderSession, } from "./render-sessions.js";
 /**
  * Maximum time allowed for the entire transform tree (recursive module resolution).
  * If the cumulative time exceeds this, we fail fast instead of hanging indefinitely.

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/nested-imports.d.ts

@@ -13,10 +13,14 @@ export declare function findNestedImports(moduleCode: string): {
     vfModules: Array<{
         original: string;
         path: string;
+        start: number;
+        end: number;
     }>;
     relative: Array<{
         original: string;
         path: string;
+        start: number;
+        end: number;
     }>;
 };
 /**

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/nested-imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nested-imports.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/nested-imports.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,GACjB;IACD,SAAS,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD,CAqBA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAO3F;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,MAAM,EACnB,oBAAoB,EAAE,OAAO,EAC7B,gBAAgB,CAAC,EAAE,MAAM,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,MAAM,CAAC,CAwEjB"}
+{"version":3,"file":"nested-imports.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/nested-imports.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,GACjB;IACD,SAAS,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF,CAkCA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAO3F;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,WAAW,EAAE,MAAM,EACnB,oBAAoB,EAAE,OAAO,EAC7B,gBAAgB,CAAC,EAAE,MAAM,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,MAAM,CAAC,CAuDjB"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/nested-imports.js

@@ -3,8 +3,9 @@
  *
  * @module transforms/mdx/esm-module-loader/module-fetcher/nested-imports
  */
-import { LOG_PREFIX_MDX_LOADER, RELATIVE_IMPORT_PATTERN, UNRESOLVED_VF_MODULES_PATTERN, VF_MODULE_IMPORT_PATTERN, } from "../constants.js";
+import { LOG_PREFIX_MDX_LOADER, UNRESOLVED_VF_MODULES_PATTERN } from "../constants.js";
 import { createStubModule } from "../utils/stub-module.js";
+import { findStaticImportFromSpans, replaceSourceSpans, } from "../utils/source-spans.js";
 import { buildMissingModuleError } from "../missing-module.js";
 /**
  * Find nested module imports in code.
@@ -13,20 +14,22 @@ import { buildMissingModuleError } from "../missing-module.js";
 export function findNestedImports(moduleCode) {
     const vfModules = [];
     const relative = [];
-    const vfPattern = new RegExp(VF_MODULE_IMPORT_PATTERN.source, "g");
-    let match;
-    while ((match = vfPattern.exec(moduleCode)) !== null) {
-        const rawPath = match[1];
+    for (const { original, path: rawPath, start, end } of findStaticImportFromSpans(moduleCode, (specifier) => specifier.match(/^((?:file:\/\/)?\/?\/?_vf_modules\/[^?]+)(?:\?.*)?$/)?.[1])) {
         // Strip file:// prefix and leading slashes to get clean _vf_modules/... path
-        if (rawPath) {
-            vfModules.push({ original: match[0], path: rawPath.replace(/^(?:file:\/\/)?\/+/, "") });
-        }
+        vfModules.push({
+            original,
+            path: rawPath.replace(/^(?:file:\/\/)?\/+/, ""),
+            start,
+            end,
+        });
     }
-    const relativePattern = new RegExp(RELATIVE_IMPORT_PATTERN.source, "g");
-    while ((match = relativePattern.exec(moduleCode)) !== null) {
-        const path = match[1];
-        if (path)
-            relative.push({ original: match[0], path });
+    for (const { original, path, start, end } of findStaticImportFromSpans(moduleCode, (specifier) => specifier.match(/^(\.\.?\/[^?]+)(?:\?.*)?$/)?.[1])) {
+        relative.push({
+            original,
+            path,
+            start,
+            end,
+        });
     }
     return { vfModules, relative };
 }
@@ -45,10 +48,15 @@ export function hasUnresolvedImports(moduleCode) {
  * Process nested imports by replacing them with file:// paths or stub modules.
  */
 export async function processNestedImports(moduleCode, results, esmCacheDir, strictMissingModules, parentModulePath, projectSlug) {
-    let result = moduleCode;
-    for (const { original, nestedFilePath, nestedPath, relativePath } of results) {
+    const replacements = [];
+    for (const { original, start, end, nestedFilePath, nestedPath, relativePath } of results) {
         if (nestedFilePath) {
-            result = result.replace(original, `from "file://${nestedFilePath}"`);
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${nestedFilePath}"`,
+            });
             continue;
         }
         const modulePath = nestedPath || relativePath || "";
@@ -61,17 +69,23 @@ export async function processNestedImports(moduleCode, results, esmCacheDir, str
                 projectSlug,
             });
         }
-        const stubPath = await createStubModule(modulePath, result, original, esmCacheDir);
-        if (stubPath)
-            result = result.replace(original, `from "file://${stubPath}"`);
+        const stubPath = await createStubModule(modulePath, moduleCode, original, esmCacheDir);
+        if (stubPath) {
+            replacements.push({
+                start,
+                end,
+                expected: original,
+                replacement: `from "file://${stubPath}"`,
+            });
+        }
     }
-    return result;
+    return replaceSourceSpans(moduleCode, replacements);
 }
 /**
  * Resolve nested /_vf_modules and relative imports into local file:// cache paths.
  */
 export async function resolveNestedModuleImports(input) {
-    let moduleCode = input.moduleCode;
+    const moduleCode = input.moduleCode;
     const { vfModules, relative } = findNestedImports(moduleCode);
     input.log?.debug(`${LOG_PREFIX_MDX_LOADER} [fetchAndCacheModule] found nested imports`, {
         projectSlug: input.projectSlug,
@@ -87,32 +101,26 @@ export async function resolveNestedModuleImports(input) {
         count: vfModules.length,
     });
     const vfStart = performance.now();
-    const nestedResults = await Promise.all(vfModules.map(async ({ original, path }) => ({
+    const allImports = [
+        ...vfModules.map((module) => ({ ...module, key: "nestedPath" })),
+        ...relative.map((module) => ({ ...module, key: "relativePath" })),
+    ];
+    const nestedResults = await Promise.all(allImports.map(async ({ original, path, start, end, key }) => ({
         original,
+        start,
+        end,
         nestedFilePath: await input.fetchAndCacheModule(path, input.normalizedPath),
-        nestedPath: path,
+        [key]: path,
     })));
     input.log?.debug(`${LOG_PREFIX_MDX_LOADER} [fetchAndCacheModule] processing vfModules DONE`, {
         projectSlug: input.projectSlug,
         normalizedPath: input.normalizedPath,
         vfMs: (performance.now() - vfStart).toFixed(1),
     });
-    moduleCode = await processNestedImports(moduleCode, nestedResults, input.esmCacheDir, input.strictMissingModules, input.normalizedPath, input.projectSlug);
-    input.log?.debug(`${LOG_PREFIX_MDX_LOADER} [fetchAndCacheModule] processing relative imports START`, {
+    input.log?.debug(`${LOG_PREFIX_MDX_LOADER} [fetchAndCacheModule] processing relative imports`, {
         projectSlug: input.projectSlug,
         normalizedPath: input.normalizedPath,
         count: relative.length,
     });
-    const relStart = performance.now();
-    const relativeResults = await Promise.all(relative.map(async ({ original, path }) => ({
-        original,
-        nestedFilePath: await input.fetchAndCacheModule(path, input.normalizedPath),
-        relativePath: path,
-    })));
-    input.log?.debug(`${LOG_PREFIX_MDX_LOADER} [fetchAndCacheModule] processing relative imports DONE`, {
-        projectSlug: input.projectSlug,
-        normalizedPath: input.normalizedPath,
-        relMs: (performance.now() - relStart).toFixed(1),
-    });
-    return await processNestedImports(moduleCode, relativeResults, input.esmCacheDir, input.strictMissingModules, input.normalizedPath, input.projectSlug);
+    return await processNestedImports(moduleCode, nestedResults, input.esmCacheDir, input.strictMissingModules, input.normalizedPath, input.projectSlug);
 }

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/render-sessions.d.ts

@@ -5,6 +5,11 @@
  *
  * @module transforms/mdx/esm-module-loader/module-fetcher/render-sessions
  */
+/**
+ * Run `fn` with `sessionId` bound as the active render session for all async
+ * work it spawns. Modules fetched inside are attributed to this session.
+ */
+export declare function runInRenderSession<T>(sessionId: string, fn: () => T): T;
 /**
  * Start a render session to track module loading.
  * Call this before rendering a page.

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/render-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-sessions.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/render-sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqBH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAOhG;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAiCxD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAWD,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAQlE"}
+{"version":3,"file":"render-sessions.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/render-sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAOhG;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAiCxD;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAuBD,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAQlE"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/render-sessions.js

@@ -5,6 +5,7 @@
  *
  * @module transforms/mdx/esm-module-loader/module-fetcher/render-sessions
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import { rendererLogger as globalLogger } from "../../../../utils/index.js";
 import { LOG_PREFIX_MDX_LOADER } from "../constants.js";
 import { recordSSRModules } from "../../../../modules/manifest/route-module-manifest.js";
@@ -13,6 +14,19 @@ import { recordSSRModules } from "../../../../modules/manifest/route-module-mani
  * Key: renderSessionId, Value: RenderSession
  */
 const renderSessions = new Map();
+/**
+ * The render session id active on the current async execution context.
+ * Set via {@link runInRenderSession} so concurrent SSR renders each resolve
+ * their own session instead of sharing whichever one started first.
+ */
+const currentSessionIdStorage = new AsyncLocalStorage();
+/**
+ * Run `fn` with `sessionId` bound as the active render session for all async
+ * work it spawns. Modules fetched inside are attributed to this session.
+ */
+export function runInRenderSession(sessionId, fn) {
+    return currentSessionIdStorage.run(sessionId, fn);
+}
 /**
  * Start a render session to track module loading.
  * Call this before rendering a page.
@@ -66,8 +80,19 @@ export function hasRenderSession(sessionId) {
  * Used to record modules during fetch and for per-session in-flight deduplication.
  */
 function getCurrentSession() {
-    const firstSession = renderSessions.values().next();
-    return firstSession.done ? null : firstSession.value;
+    const activeId = currentSessionIdStorage.getStore();
+    if (activeId !== undefined) {
+        return renderSessions.get(activeId) ?? null;
+    }
+    // No session bound on the async context (caller not wrapped in
+    // runInRenderSession). Fall back to the single-session heuristic only when
+    // it is unambiguous; with multiple concurrent sessions, decline rather than
+    // mis-attribute modules to the wrong render.
+    if (renderSessions.size === 1) {
+        const firstSession = renderSessions.values().next();
+        return firstSession.done ? null : firstSession.value;
+    }
+    return null;
 }
 export function recordModuleToSession(normalizedPath) {
     const session = getCurrentSession();