App Router: next/dynamic asset preloads omit crossOrigin with external assetPrefix

Summary

Vinext 1.0.0-beta.9's DynamicPreloadChunks emits CSS links and ReactDOM.preload(..., { as: 'script' }) without crossOrigin. When assetPrefix is a different origin, the script preload may cache a non-CORS response. The later dynamic module import requires CORS and can fail from that cached response.

Reproduction

https://gist.github.com/jaden-chen/64f2ea68397a9d5844c28da4abb71a74

The tiny real Vinext production application uses next/dynamic inside a client component and a second-origin asset server. No service worker, authentication or custom recovery hooks. The origin returns ACAO and Vary only when Origin is supplied, matching observed R2 behavior. Versions: Vinext 1.0.0-beta.9, plugin-rsc 0.5.34, Vite 8.3.0, React 19.3.0, Node 26.

Observed: the next/dynamic script is fetched without Origin during preloading, then its dynamic import fails CORS with missing ACAO. The app falls into its error boundary. Separate RSC-generated stylesheet links exhibit the same cached-response mismatch, reported to the RSC plugin.

Proposed correction

In src/shims/dynamic-preload-chunks.tsx (installed dist/shims/dynamic-preload-chunks.js), set anonymous crossOrigin on both stylesheet link props and script preload options. A local version-checked patch, together with the two RSC stylesheet corrections, passes initial rendering, client navigation, and warm-cache reload with no service worker and no resource failures.

Please advise whether a supported App Router configuration should already govern these paths. The documented crossOrigin option/Pages Router fixes did not establish coverage for these App Router generated resources in our inspection.