Honor assetConfig.headers/redirects when no on-disk _headers/_redirects file is present

[allsey87]

Describe your change

When a Miniflare consumer provides headers/redirects via the programmatic API:

new Miniflare({
  assets: {
    directory: '...',
    assetConfig: {
      headers: { version: 2, rules: { '/*': { set: { 'Cross-Origin-Opener-Policy': 'same-origin' } } } },
    },
  },
  // ...
});

…the values are silently discarded today. AssetsOptionsSchema advertises assetConfig.headers and assetConfig.redirects as part of the API surface (see packages/miniflare/src/plugins/assets/schema.ts), but packages/miniflare/src/plugins/assets/index.ts overwrites them unconditionally with parsedHeaders / parsedRedirects, which are populated only from the on-disk _headers / _redirects files. When no file is present, the user-supplied config is replaced with undefined:

const assetConfig: AssetConfig = {
  // ...
  ...options.assets.assetConfig,
  redirects: parsedRedirects,   // overwrites the spread, even when undefined
  headers: parsedHeaders,       // overwrites the spread, even when undefined
  // ...
};

This change keeps file-based config as the source of truth when a _headers / _redirects file exists, and falls back to options.assets.assetConfig.headers / .redirects otherwise. The schema already requires the programmatic value to be in the parsed shape (HeadersSchema / RedirectsSchema), so no extra parsing is needed.

Concrete impact: COOP/COEP headers configured programmatically now actually reach the browser, so crossOriginIsolated is true and SharedArrayBuffer transfers across workers succeed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: be1677c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• packages/miniflare/src/plugins/assets/index.ts: [@cloudflare/wrangler]

[allsey87]

To me, it feels like the programmatic API should take priority over the _headers file, but I'll leave that decision to the codeowners

[petebacondarwin]

Hi @allsey87 - thanks for putting up this PR. Please can you read https://github.com/cloudflare/workers-sdk/blob/main/CONTRIBUTING.md and add the necessary tests, changeset and PR description in order for us to consider this PR.

I also agree that programmatic should take precedence.