fix(vite): keep ?import module requests on vite in dev

An imported `.json` has no extension in `ASSET_EXT_RE`, so with `Sec-Fetch-Dest`
absent the dev middleware handed `/x.json?import` to the SSR catch-all, which
answered it with HTML. Vite only ever tags module graph fetches with `?import`,
so treat that query as an authoritative asset signal in the fallback branch.

Author: n0liu

src/build/vite/dev.ts

@@ -24,6 +24,11 @@ import { getEnvRunner } from "./env.ts";
 const ASSET_EXT_RE =
   /^(?:[jt]sx?|mjs|cjs|css|s[ac]ss|less|styl|vue|svelte|astro|mdx?|map|wasm|png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|otf|eot|mp[34]|webm|wav|ogg|m4a)$/i;
 
+// Vite tags module graph fetches for files it has to serve as modules (e.g. an imported `.json`)
+// with an `?import` query. Only the module graph emits it — a page navigation never does — so it
+// stays authoritative for extensions deliberately left out of `ASSET_EXT_RE` (#4433).
+const VITE_IMPORT_QUERY_RE = /[?&]import(?:[&=]|$)/;
+
 // workerd built-in module namespaces (`cloudflare:workers`, `cloudflare:sockets`, `workerd:...`).
 // These are provided natively by the runtime and have no host-side representation, so they must be
 // externalized for the in-worker module runner to `import()` them directly instead of being fetched
@@ -313,7 +318,7 @@ export async function configureViteDevServer(ctx: NitroPluginContext, server: Vi
     const isAsset =
       typeof fetchDest === "string" && fetchDest !== "empty"
         ? !/^(?:document|iframe|frame)$/.test(fetchDest)
-        : isAssetByExt;
+        : VITE_IMPORT_QUERY_RE.test(req.url!) || isAssetByExt;
 
     // Non-asset requests go to Nitro: the catch-all (`matchedHandlers` are all catch-all here,
     // since explicit routes already returned) renders them, and bare (extensionless) unmatched

test/vite/app.test.ts

@@ -82,6 +82,18 @@ describe("vite:app", () => {
     expect(res.status).not.toBe(200);
   });
 
+  // #4433: Vite marks module-graph fetches for files it has to serve as modules with an `?import`
+  // query. The marker only ever comes from the module graph, never from a page navigation, so such
+  // a request must reach Vite even when the extension is not a known asset type (`.json`) and
+  // `Sec-Fetch-Dest` is absent.
+  test("does not let the SSR catch-all swallow ?import module requests", async () => {
+    const res = await fetch(`${serverURL}/missing-module.json?import`, {
+      headers: { accept: "*/*" },
+      redirect: "manual",
+    });
+    expect(res.status).not.toBe(200);
+  });
+
   // HTTPError thrown from the SSR entry must propagate to the nitro app so the h3
   // error handler preserves its status and headers (consistent with production).
   test("propagates HTTPError status and headers from the SSR entry", async () => {