fix: serve public files in prod

packages/vinext/src/entries/app-rsc-entry.ts

@@ -94,6 +94,8 @@ export type AppRouterConfig = {
    * `virtual:vinext-server-entry` when this flag is set.
    */
   hasPagesDir?: boolean;
+  /** Exact public/ file routes, using normalized leading-slash pathnames. */
+  publicFiles?: string[];
 };
 
 /**
@@ -123,6 +125,7 @@ export function generateRscEntry(
   const bodySizeLimit = config?.bodySizeLimit ?? 1 * 1024 * 1024;
   const i18nConfig = config?.i18n ?? null;
   const hasPagesDir = config?.hasPagesDir ?? false;
+  const publicFiles = config?.publicFiles ?? [];
   // Build import map for all page and layout files
   const imports: string[] = [];
   const importMap: Map<string, string> = new Map();
@@ -845,6 +848,21 @@ function matchRoute(url) {
   return _trieMatch(_routeTrie, urlParts);
 }
 
+function __createStaticFileSignal(pathname, _mwCtx) {
+  const headers = new Headers({
+    "x-vinext-static-file": encodeURIComponent(pathname),
+  });
+  if (_mwCtx.headers) {
+    for (const [key, value] of _mwCtx.headers) {
+      headers.append(key, value);
+    }
+  }
+  return new Response(null, {
+    status: _mwCtx.status ?? 200,
+    headers,
+  });
+}
+
 // matchPattern is kept for findIntercept (linear scan over small interceptLookup array).
 function matchPattern(urlParts, patternParts) {
   const params = Object.create(null);
@@ -1214,6 +1232,7 @@ const __i18nConfig = ${JSON.stringify(i18nConfig)};
 const __configRedirects = ${JSON.stringify(redirects)};
 const __configRewrites = ${JSON.stringify(rewrites)};
 const __configHeaders = ${JSON.stringify(headers)};
+const __publicFiles = new Set(${JSON.stringify(publicFiles)});
 const __allowedOrigins = ${JSON.stringify(allowedOrigins)};
 
 ${generateDevOriginCheckCode(config?.allowedDevOrigins)}
@@ -1424,6 +1443,9 @@ async function _handleRequest(request, __reqCtx, _mwCtx) {
   ${
     bp
       ? `
+  if (!hasBasePath(pathname, __basePath) && !pathname.startsWith("/__vinext/")) {
+    return new Response("Not Found", { status: 404 });
+  }
   // Strip basePath prefix
   pathname = stripBasePath(pathname, __basePath);
   `
@@ -1781,6 +1803,18 @@ async function _handleRequest(request, __reqCtx, _mwCtx) {
     }
   }
 
+  // Serve public/ files as filesystem routes after middleware and before
+  // afterFiles/fallback rewrites, matching Next.js routing semantics.
+  if (
+    (request.method === "GET" || request.method === "HEAD") &&
+    !pathname.endsWith(".rsc") &&
+    __publicFiles.has(cleanPathname)
+  ) {
+    setHeadersContext(null);
+    setNavigationContext(null);
+    return __createStaticFileSignal(cleanPathname, _mwCtx);
+  }
+
   // Set navigation context for Server Components.
   // Note: Headers context is already set by runWithRequestContext in the handler wrapper.
   setNavigationContext({

packages/vinext/src/index.ts

@@ -1986,6 +1986,7 @@ export default function vinext(options: VinextOptions = {}): PluginOption[] {
               bodySizeLimit: nextConfig?.serverActionsBodySizeLimit,
               i18n: nextConfig?.i18n,
               hasPagesDir,
+              publicFiles: scanPublicFileRoutes(root),
             },
             instrumentationPath,
           );
@@ -4070,7 +4071,6 @@ function findFileWithExts(
 
 /** Module-level cache for hasMdxFiles — avoids re-scanning per Vite environment. */
 const _mdxScanCache = new Map<string, boolean>();
-
 /**
  * Check if the project has .mdx files in app/ or pages/ directories.
  */
@@ -4106,6 +4106,60 @@ function scanDirForMdx(dir: string): boolean {
   return false;
 }
 
+function scanPublicFileRoutes(root: string): string[] {
+  const publicDir = path.join(root, "public");
+  const routes: string[] = [];
+  const visitedDirs = new Set<string>();
+
+  function walk(dir: string): void {
+    let realDir: string;
+    try {
+      realDir = fs.realpathSync(dir);
+    } catch {
+      return;
+    }
+    if (visitedDirs.has(realDir)) return;
+    visitedDirs.add(realDir);
+
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(fullPath);
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        let stat: fs.Stats;
+        try {
+          stat = fs.statSync(fullPath);
+        } catch {
+          continue;
+        }
+        if (stat.isDirectory()) {
+          walk(fullPath);
+          continue;
+        }
+        if (!stat.isFile()) continue;
+      } else if (!entry.isFile()) {
+        continue;
+      }
+      const relativePath = path.relative(publicDir, fullPath).split(path.sep).join("/");
+      routes.push("/" + relativePath);
+    }
+  }
+
+  if (fs.existsSync(publicDir)) {
+    try {
+      walk(publicDir);
+    } catch {
+      // ignore unreadable dirs
+    }
+  }
+
+  routes.sort();
+  return routes;
+}
+
 // Public exports for static export
 export { staticExportPages, staticExportApp } from "./build/static-export.js";
 export type {
@@ -4132,6 +4186,7 @@ export { resolvePostcssStringPlugins as _resolvePostcssStringPlugins };
 export { _postcssCache };
 export { hasMdxFiles as _hasMdxFiles };
 export { _mdxScanCache };
+export { scanPublicFileRoutes as _scanPublicFileRoutes };
 export { parseStaticObjectLiteral as _parseStaticObjectLiteral };
 export { _findBalancedObject, _findCallEnd };
 export { stripServerExports as _stripServerExports };

packages/vinext/src/server/app-router-entry.ts

@@ -15,9 +15,20 @@
 // @ts-expect-error — virtual module resolved by vinext
 import rscHandler from "virtual:vinext-rsc-entry";
 import { runWithExecutionContext, type ExecutionContextLike } from "../shims/request-context.js";
+import { resolveStaticAssetSignal } from "./worker-utils.js";
+
+type WorkerAssetEnv = {
+  ASSETS?: {
+    fetch(request: Request): Promise<Response> | Response;
+  };
+};
 
 export default {
-  async fetch(request: Request, _env?: unknown, ctx?: ExecutionContextLike): Promise<Response> {
+  async fetch(
+    request: Request,
+    env?: WorkerAssetEnv,
+    ctx?: ExecutionContextLike,
+  ): Promise<Response> {
     const url = new URL(request.url);
 
     // Normalize backslashes (browsers treat /\ as //) before any other checks.
@@ -52,6 +63,13 @@ export default {
     const result = await (ctx ? runWithExecutionContext(ctx, handleFn) : handleFn());
 
     if (result instanceof Response) {
+      if (env?.ASSETS) {
+        const assetResponse = await resolveStaticAssetSignal(result, {
+          fetchAsset: (path) =>
+            Promise.resolve(env.ASSETS!.fetch(new Request(new URL(path, request.url)))),
+        });
+        if (assetResponse) return assetResponse;
+      }
       return result;
     }
 

packages/vinext/src/server/prod-server.ts

@@ -391,8 +391,11 @@ async function tryServeStatic(
   compress: boolean,
   cache?: StaticFileCache,
   extraHeaders?: Record<string, string | string[]>,
+  statusCode?: number,
 ): Promise<boolean> {
   if (pathname === "/") return false;
+  const responseStatus = statusCode ?? 200;
+  const omitBody = isNoBodyResponseStatus(responseStatus);
 
   // ── Fast path: pre-computed headers, minimal per-request work ──
   // When a cache is provided, all path validation happened at startup.
@@ -419,7 +422,11 @@ async function tryServeStatic(
 
     // 304 Not Modified: string compare against pre-computed ETag
     const ifNoneMatch = req.headers["if-none-match"];
-    if (typeof ifNoneMatch === "string" && matchesIfNoneMatchHeader(ifNoneMatch, entry.etag)) {
+    if (
+      responseStatus === 200 &&
+      typeof ifNoneMatch === "string" &&
+      matchesIfNoneMatchHeader(ifNoneMatch, entry.etag)
+    ) {
       if (extraHeaders) {
         res.writeHead(304, { ...entry.notModifiedHeaders, ...extraHeaders });
       } else {
@@ -449,12 +456,12 @@ async function tryServeStatic(
       : entry.original;
 
     if (extraHeaders) {
-      res.writeHead(200, { ...variant.headers, ...extraHeaders });
+      res.writeHead(responseStatus, { ...variant.headers, ...extraHeaders });
     } else {
-      res.writeHead(200, variant.headers);
+      res.writeHead(responseStatus, variant.headers);
     }
 
-    if (req.method === "HEAD") {
+    if (omitBody || req.method === "HEAD") {
       res.end();
       return true;
     }
@@ -515,7 +522,11 @@ async function tryServeStatic(
   // compress=false also skips all compressed variants.
   // Spreading undefined is a no-op in object literals (ES2018+).
   const ifNoneMatch = req.headers["if-none-match"];
-  if (typeof ifNoneMatch === "string" && matchesIfNoneMatchHeader(ifNoneMatch, etag)) {
+  if (
+    responseStatus === 200 &&
+    typeof ifNoneMatch === "string" &&
+    matchesIfNoneMatchHeader(ifNoneMatch, etag)
+  ) {
     const notModifiedHeaders: Record<string, string | string[]> = {
       ETag: etag,
       "Cache-Control": cacheControl,
@@ -539,12 +550,12 @@ async function tryServeStatic(
     if (encoding) {
       // Content-Length omitted intentionally: compressed size isn't known
       // ahead of time, so Node.js uses chunked transfer encoding.
-      res.writeHead(200, {
+      res.writeHead(responseStatus, {
         ...baseHeaders,
         "Content-Encoding": encoding,
         Vary: "Accept-Encoding",
       });
-      if (req.method === "HEAD") {
+      if (omitBody || req.method === "HEAD") {
         res.end();
         return true;
       }
@@ -561,11 +572,11 @@ async function tryServeStatic(
     }
   }
 
-  res.writeHead(200, {
+  res.writeHead(responseStatus, {
     ...baseHeaders,
     "Content-Length": String(resolved.size),
   });
-  if (req.method === "HEAD") {
+  if (omitBody || req.method === "HEAD") {
     res.end();
     return true;
   }
@@ -1044,6 +1055,46 @@ async function startAppRouterServer(options: AppRouterServerOptions) {
       const request = nodeToWebRequest(req, normalizedUrl);
       const response = await rscHandler(request);
 
+      const staticFileSignal = response.headers.get("x-vinext-static-file");
+      if (staticFileSignal) {
+        let staticFilePath = "/";
+        try {
+          staticFilePath = decodeURIComponent(staticFileSignal);
+        } catch {
+          staticFilePath = staticFileSignal;
+        }
+
+        const staticResponseHeaders = omitHeadersCaseInsensitive(
+          mergeResponseHeaders({}, response),
+          ["x-vinext-static-file", "content-encoding", "content-length", "content-type"],
+        );
+
+        const served = await tryServeStatic(
+          req,
+          res,
+          clientDir,
+          staticFilePath,
+          compress,
+          staticCache,
+          staticResponseHeaders,
+          response.status,
+        );
+        cancelResponseBody(response);
+        if (served) {
+          return;
+        }
+        await sendWebResponse(
+          new Response("Not Found", {
+            status: 404,
+            headers: toWebHeaders(staticResponseHeaders),
+          }),
+          req,
+          res,
+          compress,
+        );
+        return;
+      }
+
       // Stream the Web Response back to the Node.js response
       await sendWebResponse(response, req, res, compress);
     } catch (e) {

packages/vinext/src/server/worker-utils.ts

@@ -35,6 +35,21 @@ function cancelResponseBody(response: Response): void {
   });
 }
 
+function buildHeaderRecord(
+  response: Response,
+  omitNames: readonly string[] = [],
+): Record<string, string | string[]> {
+  const omitted = new Set(omitNames.map((name) => name.toLowerCase()));
+  const headers: Record<string, string | string[]> = {};
+  response.headers.forEach((value, key) => {
+    if (omitted.has(key.toLowerCase()) || key === "set-cookie") return;
+    headers[key] = value;
+  });
+  const cookies = response.headers.getSetCookie?.() ?? [];
+  if (cookies.length > 0) headers["set-cookie"] = cookies;
+  return headers;
+}
+
 export function mergeHeaders(
   response: Response,
   extraHeaders: Record<string, string | string[]>,
@@ -93,3 +108,36 @@ export function mergeHeaders(
     headers: merged,
   });
 }
+
+export async function resolveStaticAssetSignal(
+  signalResponse: Response,
+  options: {
+    fetchAsset(path: string): Promise<Response>;
+  },
+): Promise<Response | null> {
+  const signal = signalResponse.headers.get("x-vinext-static-file");
+  if (!signal) return null;
+
+  let assetPath = "/";
+  try {
+    assetPath = decodeURIComponent(signal);
+  } catch {
+    assetPath = signal;
+  }
+
+  const extraHeaders = buildHeaderRecord(signalResponse, [
+    "x-vinext-static-file",
+    "content-encoding",
+    "content-length",
+    "content-type",
+  ]);
+
+  cancelResponseBody(signalResponse);
+  const assetResponse = await options.fetchAsset(assetPath);
+  // Only preserve the middleware/status-layer override when we actually got a
+  // real asset response back. If the asset lookup misses (404/other non-ok),
+  // keep that filesystem result instead of masking it with the signal status.
+  const statusOverride =
+    assetResponse.ok && signalResponse.status !== 200 ? signalResponse.status : undefined;
+  return mergeHeaders(assetResponse, extraHeaders, statusOverride);
+}