fix(app): authenticate static file signals

[james-elicx]

Summary

• replace the mutable response-header static-file control channel with an out-of-band response capability
• keep application and middleware x-vinext-static-file values as ordinary response metadata
• apply the same provenance check in Node production, App response finalization, and Cloudflare Worker asset resolution
• add regressions for reflected headers, middleware header collisions, and cross-bundle Worker behavior

Why

Static asset routing was inferred from a response header that application route handlers could also return. A reflected or proxied value could therefore be mistaken for framework control flow and cause the host adapter to serve a different public asset.

The asset pathname now travels on a framework-created response capability instead of in HTTP headers. This matches Next.js filesystem-routing behavior while preserving custom application headers.

Validation

• vp test run tests/request-pipeline.test.ts tests/app-rsc-handler.test.ts tests/app-rsc-response-finalizer.test.ts tests/deploy.test.ts
• focused App Router Node production regression
• focused Cloudflare Worker Playwright regression
• Next.js 16.2.7 production oracle for reflected and middleware-set custom headers
• changed-file vp check
• vp run vinext#build
• independent cumulative review with no remaining findings

[james-elicx]

/bigbonk review for issues

You have a 7 minute limit for this review. Please prioritize concrete correctness, security, Next.js parity, and cross-runtime findings.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@3077

npm i https://pkg.pr.new/create-vinext-app@3077

npm i https://pkg.pr.new/@vinext/types@3077

npm i https://pkg.pr.new/vinext@3077

commit: edc1ac9

[github-actions]

Example	Preview	Production	Original
app-router-cloudflare	preview	production
pages-router-cloudflare	preview	production
app-router-playground	preview	production	original
realworld-api-rest	preview	production
nextra-docs-template	preview	production
benchmarks	preview	production
hackernews	preview	production	original
workers-cache	preview	production
web	preview	production

[github-actions]

Performance benchmarks

Compared edc1ac9 against base 4146d69 using alternating same-runner rounds. Next.js was unchanged and skipped.

0 improved · 0 regressed · 6 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	142.3 KB	142.2 KB	⚫ -0.0%
Client entry size (gzip)	vinext	129.6 KB	129.5 KB	⚫ -0.0%
Dev server cold start	vinext	3.17 s	3.16 s	⚫ -0.4%
Production build time	vinext	3.69 s	3.72 s	⚫ +0.8%
RSC entry closure size (gzip)	vinext	116.2 KB	116.2 KB	⚫ +0.0%
Server bundle size (gzip)	vinext	197.7 KB	197.7 KB	⚫ +0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}

[ask-bonk]

LGTM!

github run

[james-elicx]

/bigbonk review for issues

Updated head removes the retired internal header constant entirely. You have a 7 minute limit for this review. Please prioritize concrete correctness, security, Next.js parity, and cross-runtime findings.

[ask-bonk]

LGTM!

github run