Error when serving a public static file in SAP Fiori App on SAP BTP CF

Question

I'm struggling with what seems to be a simple one... but still can't get it working: In SAP BTP CF I have generated a Fiori project (from template), without FLP, with a managed application router + xsuaa. The project works perfectly fine when I build it and deploy it to CF. I can get the app up and running in the browser.

Now, I need to serve a static file xyz.json which should be public (without xsuaaa). It contains just a JSON object with a couple of attributes and values. Unfortunately, here is where the problem starts: I thought it should be as simple as placing xyz.json in the webapp folder, and adding the corresponding route in xs-app.json. However, after building and deploying, when I try to access the resource /xyz.json, I get an "Internal Server Error".

This is how the xs-app.json looks like:

{
  "welcomeFile": "/index.html",
  "authenticationMethod": "route",
  "routes": [
    {
      "source": "^undefined/(.*)$",
      "target": "undefined/$1",
      "destination": "DIRECT_SERVICE_BINDING",
      "authenticationType": "xsuaa",
      "csrfProtection": false
    },
    {
      "source": "^/resources/(.*)$",
      "target": "/resources/$1",
      "authenticationType": "none",
      "destination": "ui5"
    },
    {
      "source": "^/test-resources/(.*)$",
      "target": "/test-resources/$1",
      "authenticationType": "none",
      "destination": "ui5"
    },
    {
      "source": "^(xyz.json)$",
      "target": "$1",
      "authenticationType": "none"
    },
    {
      "source": "^(.*)$",
      "target": "$1",
      "service": "html5-apps-repo-rt",
      "authenticationType": "xsuaa"
    }
  ]
}

I have tried other approaches, like using "source": "^/xyz.txt$" and target "target": "/xyz.json", removing the target from the route, but all lead to the same result.

I guess I'm missing something more, but can't figure things out. Has somebody faced the same issue or knows how to get this working?

P.D.: the app should use xsuaa, only the file xyz.json should be public

I appreciate any hints. Thanks