## Summary
- Keep inspected Resource loads on the same URL + RequestInit fetch path
as ordinary loads. The Request object is retained only for exchange
inspection.
- Fix the Resource editor Refresh action for external APIs without
changing Builder's existing public-IP guarded Node transport.
- Add a refresh-button test, a deterministic inspected POST test, and
opt-in live GET checks for the Holy Redeemer API.
## Tests
- `pnpm --filter @webstudio-is/sdk exec vitest run
src/resource-loader.test.ts --reporter=dot` (60 passed)
- `pnpm --filter @webstudio-is/builder exec vitest run
app/builder/features/settings-panel/variable-editors/http-resource-refresh.test.tsx
--project core-browser-builder-settings --reporter=verbose` (1 passed)
- `WEBSTUDIO_LIVE_RESOURCE_GET=1 pnpm --filter @webstudio-is/builder
exec vitest run app/services/safe-resource-fetch.live.server.test.ts
--project core-server --reporter=verbose --silent=false` (3 passed;
normal and inspected GET returned 200)
- SDK and Builder typechecks; `oxlint` and `oxfmt --check` on changed
files
## Runtime note
The current Vercel Builder still uses its Node public-IP guarded
transport. A future Cloudflare Worker transport requires a separate
migration with `global_fetch_strictly_public` enabled; this PR does not
switch to unrestricted fetch.
Oleg Isonen
cb0cc5c125