`@sveltejs/adapter-cloudflare` doesn't handle `_headers` collisions

[m-dressler]

Describe the bug

When using the @sveltejs/adapter-cloudflare adapter, it generates/appends the following _headers file:

# === START AUTOGENERATED SVELTE IMMUTABLE HEADERS ===
/_app/*
  X-Robots-Tag: noindex
	Cache-Control: no-cache
/_app/immutable/*
  ! Cache-Control
	Cache-Control: public, immutable, max-age=31536000
# === END AUTOGENERATED SVELTE IMMUTABLE HEADERS ===

However, if a user tried to define custom headers for /_app/immutable/*, too, the current approach simply appends the section which Cloudflare's logic then treats to overwrite the earlier definition.

So this _headers file:

/_app/immutable/*
  Cross-Origin-Embedder-Policy: require-corp

Becomes

/_app/immutable/*
  Cross-Origin-Embedder-Policy: require-corp
# === START AUTOGENERATED SVELTE IMMUTABLE HEADERS ===
/_app/*
  X-Robots-Tag: noindex
	Cache-Control: no-cache
/_app/immutable/*
  ! Cache-Control
	Cache-Control: public, immutable, max-age=31536000
# === END AUTOGENERATED SVELTE IMMUTABLE HEADERS ===

Which Cloudflare Pages then treats as

# /_app/immutable/*                                                    <- ignored as overwritten below
#   Cross-Origin-Embedder-Policy: require-corp
# === START AUTOGENERATED SVELTE IMMUTABLE HEADERS ===
/_app/*
  X-Robots-Tag: noindex
	Cache-Control: no-cache
/_app/immutable/*
  ! Cache-Control
	Cache-Control: public, immutable, max-age=31536000
# === END AUTOGENERATED SVELTE IMMUTABLE HEADERS ===

Reproduction

pnpm dlx sv create --template minimal --no-types --install pnpm --add="sveltekit-adapter=adapter:cloudflare+cfTarget:pages" cf-headers-test
cd cf-headers-test
echo "/_app/immutable/*\n  Cross-Origin-Embedder-Policy: require-corp" >> _headers
pnpm gen
pnpm build
cat .svelte-kit/cloudflare/_headers

This will generate the _headers file with two conflicting paths — if you now deploy this project, you'll find that the Cross-Origin-Embedder-Policy header isn't applied.

Logs

System Info

System:
    OS: macOS 26.3
    CPU: (12) arm64 Apple M4 Pro
    Memory: 10.59 GB / 48.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 24.14.1 - /Users/mauritz/.nvm/versions/node/v24.14.1/bin/node
    npm: 11.11.0 - /Users/mauritz/.nvm/versions/node/v24.14.1/bin/npm
    pnpm: 10.33.2 - /Users/mauritz/Library/pnpm/pnpm
    Deno: 2.7.14 - /Users/mauritz/.deno/bin/deno
  Browsers:
    Brave Browser: 147.1.89.143
    Chrome: 139.0.7258.128
    Safari: 26.3
  npmPackages:
    @sveltejs/adapter-cloudflare: ^7.2.8 => 7.2.8 
    @sveltejs/kit: ^2.50.1 => 2.50.1 
    @sveltejs/vite-plugin-svelte: ^6.2.4 => 6.2.4 
    svelte: ^5.48.2 => 5.49.0 
    vite: ^7.3.1 => 7.3.1

Severity

serious, but I can work around it

Additional Information

No response

[teemingc]

Closed by #16183