@qwik.dev/router 2.0.0-beta.2 → 2.0.0-beta.21

package/lib/middleware/request-handler/index.mjs

@@ -1,69 +1,140 @@
-// packages/qwik-router/src/middleware/request-handler/error-handler.ts
-var ServerError = class extends Error {
-  constructor(status, data) {
-    super(typeof data === "string" ? data : void 0);
-    this.status = status;
-    this.data = data;
+import { isServer } from '@qwik.dev/core/build';
+import { i as isPromise, k as QDATA_KEY, Q as Q_ROUTE, h as QFN_KEY, m as QLOADER_KEY, j as QACTION_KEY, d as loadRoute } from '../../chunks/routing.qwik.mjs';
+import { inlinedQrl } from '@qwik.dev/core';
+import { _serialize, _UNINITIALIZED, _deserialize, _verifySerializable } from '@qwik.dev/core/internal';
+import { L as LoadedRouteProp } from '../../chunks/types.qwik.mjs';
+import { _asyncRequestStore as _asyncRequestStore$1, ServerError as ServerError$1, RedirectMessage as RedirectMessage$1, RewriteMessage as RewriteMessage$1, AbortMessage as AbortMessage$1 } from '@qwik.dev/router/middleware/request-handler';
+import { g as getErrorHtml, m as minimalHtmlResponse } from '../../chunks/error-handler.mjs';
+import '@qwik.dev/core/preloader';
+
+var HttpStatus = /* @__PURE__ */ ((HttpStatus2) => {
+  HttpStatus2[HttpStatus2["Continue"] = 100] = "Continue";
+  HttpStatus2[HttpStatus2["SwitchingProtocols"] = 101] = "SwitchingProtocols";
+  HttpStatus2[HttpStatus2["Processing"] = 102] = "Processing";
+  HttpStatus2[HttpStatus2["Ok"] = 200] = "Ok";
+  HttpStatus2[HttpStatus2["Created"] = 201] = "Created";
+  HttpStatus2[HttpStatus2["Accepted"] = 202] = "Accepted";
+  HttpStatus2[HttpStatus2["NonAuthoritativeInformation"] = 203] = "NonAuthoritativeInformation";
+  HttpStatus2[HttpStatus2["NoContent"] = 204] = "NoContent";
+  HttpStatus2[HttpStatus2["ResetContent"] = 205] = "ResetContent";
+  HttpStatus2[HttpStatus2["PartialContent"] = 206] = "PartialContent";
+  HttpStatus2[HttpStatus2["MultiStatus"] = 207] = "MultiStatus";
+  HttpStatus2[HttpStatus2["AlreadyReported"] = 208] = "AlreadyReported";
+  HttpStatus2[HttpStatus2["ImUsed"] = 226] = "ImUsed";
+  HttpStatus2[HttpStatus2["MultipleChoices"] = 300] = "MultipleChoices";
+  HttpStatus2[HttpStatus2["MovedPermanently"] = 301] = "MovedPermanently";
+  HttpStatus2[HttpStatus2["Found"] = 302] = "Found";
+  HttpStatus2[HttpStatus2["SeeOther"] = 303] = "SeeOther";
+  HttpStatus2[HttpStatus2["NotModified"] = 304] = "NotModified";
+  HttpStatus2[HttpStatus2["UseProxy"] = 305] = "UseProxy";
+  HttpStatus2[HttpStatus2["SwitchProxy"] = 306] = "SwitchProxy";
+  HttpStatus2[HttpStatus2["TemporaryRedirect"] = 307] = "TemporaryRedirect";
+  HttpStatus2[HttpStatus2["PermanentRedirect"] = 308] = "PermanentRedirect";
+  HttpStatus2[HttpStatus2["BadRequest"] = 400] = "BadRequest";
+  HttpStatus2[HttpStatus2["Unauthorized"] = 401] = "Unauthorized";
+  HttpStatus2[HttpStatus2["PaymentRequired"] = 402] = "PaymentRequired";
+  HttpStatus2[HttpStatus2["Forbidden"] = 403] = "Forbidden";
+  HttpStatus2[HttpStatus2["NotFound"] = 404] = "NotFound";
+  HttpStatus2[HttpStatus2["MethodNotAllowed"] = 405] = "MethodNotAllowed";
+  HttpStatus2[HttpStatus2["NotAcceptable"] = 406] = "NotAcceptable";
+  HttpStatus2[HttpStatus2["ProxyAuthenticationRequired"] = 407] = "ProxyAuthenticationRequired";
+  HttpStatus2[HttpStatus2["RequestTimeout"] = 408] = "RequestTimeout";
+  HttpStatus2[HttpStatus2["Conflict"] = 409] = "Conflict";
+  HttpStatus2[HttpStatus2["Gone"] = 410] = "Gone";
+  HttpStatus2[HttpStatus2["LengthRequired"] = 411] = "LengthRequired";
+  HttpStatus2[HttpStatus2["PreconditionFailed"] = 412] = "PreconditionFailed";
+  HttpStatus2[HttpStatus2["PayloadTooLarge"] = 413] = "PayloadTooLarge";
+  HttpStatus2[HttpStatus2["UriTooLong"] = 414] = "UriTooLong";
+  HttpStatus2[HttpStatus2["UnsupportedMediaType"] = 415] = "UnsupportedMediaType";
+  HttpStatus2[HttpStatus2["RangeNotSatisfiable"] = 416] = "RangeNotSatisfiable";
+  HttpStatus2[HttpStatus2["ExpectationFailed"] = 417] = "ExpectationFailed";
+  HttpStatus2[HttpStatus2["IAmATeapot"] = 418] = "IAmATeapot";
+  HttpStatus2[HttpStatus2["MisdirectedRequest"] = 421] = "MisdirectedRequest";
+  HttpStatus2[HttpStatus2["UnprocessableEntity"] = 422] = "UnprocessableEntity";
+  HttpStatus2[HttpStatus2["Locked"] = 423] = "Locked";
+  HttpStatus2[HttpStatus2["FailedDependency"] = 424] = "FailedDependency";
+  HttpStatus2[HttpStatus2["UpgradeRequired"] = 426] = "UpgradeRequired";
+  HttpStatus2[HttpStatus2["PreconditionRequired"] = 428] = "PreconditionRequired";
+  HttpStatus2[HttpStatus2["TooManyRequests"] = 429] = "TooManyRequests";
+  HttpStatus2[HttpStatus2["RequestHeaderFieldsTooLarge"] = 431] = "RequestHeaderFieldsTooLarge";
+  HttpStatus2[HttpStatus2["UnavailableForLegalReasons"] = 451] = "UnavailableForLegalReasons";
+  HttpStatus2[HttpStatus2["InternalServerError"] = 500] = "InternalServerError";
+  HttpStatus2[HttpStatus2["NotImplemented"] = 501] = "NotImplemented";
+  HttpStatus2[HttpStatus2["BadGateway"] = 502] = "BadGateway";
+  HttpStatus2[HttpStatus2["ServiceUnavailable"] = 503] = "ServiceUnavailable";
+  HttpStatus2[HttpStatus2["GatewayTimeout"] = 504] = "GatewayTimeout";
+  HttpStatus2[HttpStatus2["HttpVersionNotSupported"] = 505] = "HttpVersionNotSupported";
+  HttpStatus2[HttpStatus2["VariantAlsoNegotiates"] = 506] = "VariantAlsoNegotiates";
+  HttpStatus2[HttpStatus2["InsufficientStorage"] = 507] = "InsufficientStorage";
+  HttpStatus2[HttpStatus2["LoopDetected"] = 508] = "LoopDetected";
+  HttpStatus2[HttpStatus2["NotExtended"] = 510] = "NotExtended";
+  HttpStatus2[HttpStatus2["NetworkAuthenticationRequired"] = 511] = "NetworkAuthenticationRequired";
+  return HttpStatus2;
+})(HttpStatus || {});
+
+function createCacheControl(cacheControl) {
+  const controls = [];
+  if (cacheControl === "day") {
+    cacheControl = 60 * 60 * 24;
+  } else if (cacheControl === "week") {
+    cacheControl = 60 * 60 * 24 * 7;
+  } else if (cacheControl === "month") {
+    cacheControl = 60 * 60 * 24 * 30;
+  } else if (cacheControl === "year") {
+    cacheControl = 60 * 60 * 24 * 365;
+  } else if (cacheControl === "private") {
+    cacheControl = {
+      private: true,
+      noCache: true
+    };
+  } else if (cacheControl === "immutable") {
+    cacheControl = {
+      public: true,
+      immutable: true,
+      maxAge: 60 * 60 * 24 * 365
+    };
+  } else if (cacheControl === "no-cache") {
+    cacheControl = {
+      noCache: true
+    };
   }
-};
-function getErrorHtml(status, e) {
-  let message = "Server Error";
-  if (e != null) {
-    if (typeof e.message === "string") {
-      message = e.message;
-    } else {
-      message = String(e);
-    }
+  if (typeof cacheControl === "number") {
+    cacheControl = {
+      maxAge: cacheControl,
+      sMaxAge: cacheControl
+    };
   }
-  return `<html>` + minimalHtmlResponse(status, message) + `</html>`;
-}
-function minimalHtmlResponse(status, message) {
-  if (typeof status !== "number") {
-    status = 500;
+  if (cacheControl.immutable) {
+    controls.push("immutable");
   }
-  if (typeof message === "string") {
-    message = escapeHtml(message);
-  } else {
-    message = "";
-  }
-  const width = typeof message === "string" ? "600px" : "300px";
-  const color = status >= 500 ? COLOR_500 : COLOR_400;
-  return `
-<head>
-  <meta charset="utf-8">
-  <meta http-equiv="Status" content="${status}">
-  <title>${status} ${message}</title>
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-  <style>
-    body { color: ${color}; background-color: #fafafa; padding: 30px; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, Roboto, sans-serif; }
-    p { max-width: ${width}; margin: 60px auto 30px auto; background: white; border-radius: 4px; box-shadow: 0px 0px 50px -20px ${color}; overflow: hidden; }
-    strong { display: inline-block; padding: 15px; background: ${color}; color: white; }
-    span { display: inline-block; padding: 15px; }
-  </style>
-</head>
-<body><p><strong>${status}</strong> <span>${message}</span></p></body>
-`;
+  if (cacheControl.maxAge) {
+    controls.push(`max-age=${cacheControl.maxAge}`);
+  }
+  if (cacheControl.sMaxAge) {
+    controls.push(`s-maxage=${cacheControl.sMaxAge}`);
+  }
+  if (cacheControl.noStore) {
+    controls.push("no-store");
+  }
+  if (cacheControl.noCache) {
+    controls.push("no-cache");
+  }
+  if (cacheControl.private) {
+    controls.push("private");
+  }
+  if (cacheControl.public) {
+    controls.push("public");
+  }
+  if (cacheControl.staleWhileRevalidate) {
+    controls.push(`stale-while-revalidate=${cacheControl.staleWhileRevalidate}`);
+  }
+  if (cacheControl.staleIfError) {
+    controls.push(`stale-if-error=${cacheControl.staleIfError}`);
+  }
+  return controls.join(", ");
 }
-var ESCAPE_HTML = /[&<>]/g;
-var escapeHtml = (s) => {
-  return s.replace(ESCAPE_HTML, (c) => {
-    switch (c) {
-      case "&":
-        return "&amp;";
-      case "<":
-        return "&lt;";
-      case ">":
-        return "&gt;";
-      default:
-        return "";
-    }
-  });
-};
-var COLOR_400 = "#006ce9";
-var COLOR_500 = "#713fc2";
 
-// packages/qwik-router/src/middleware/request-handler/cookie.ts
-var SAMESITE = {
+const SAMESITE = {
   lax: "Lax",
   Lax: "Lax",
   None: "None",
@@ -71,14 +142,14 @@ var SAMESITE = {
   strict: "Strict",
   Strict: "Strict"
 };
-var UNIT = {
+const UNIT = {
   seconds: 1,
   minutes: 1 * 60,
   hours: 1 * 60 * 60,
   days: 1 * 60 * 60 * 24,
   weeks: 1 * 60 * 60 * 24 * 7
 };
-var createSetCookieValue = (cookieName, cookieValue, options) => {
+const createSetCookieValue = (cookieName, cookieValue, options) => {
   const c = [`${cookieName}=${cookieValue}`];
   if (typeof options.domain === "string") {
     c.push(`Domain=${options.domain}`);
@@ -114,7 +185,7 @@ function tryDecodeUriComponent(str) {
     return str;
   }
 }
-var parseCookieString = (cookieString) => {
+const parseCookieString = (cookieString) => {
   const cookie = {};
   if (typeof cookieString === "string" && cookieString !== "") {
     const cookieSegments = cookieString.split(";");
@@ -139,10 +210,10 @@ function resolveSameSite(sameSite) {
   }
   return void 0;
 }
-var REQ_COOKIE = Symbol("request-cookies");
-var RES_COOKIE = Symbol("response-cookies");
-var LIVE_COOKIE = Symbol("live-cookies");
-var Cookie = class {
+const REQ_COOKIE = /* @__PURE__ */ Symbol("request-cookies");
+const RES_COOKIE = /* @__PURE__ */ Symbol("response-cookies");
+const LIVE_COOKIE = /* @__PURE__ */ Symbol("live-cookies");
+class Cookie {
   [REQ_COOKIE];
   [RES_COOKIE] = {};
   [LIVE_COOKIE] = {};
@@ -199,8 +270,8 @@ var Cookie = class {
   headers() {
     return Object.values(this[RES_COOKIE]);
   }
-};
-var mergeHeadersCookies = (headers, cookies) => {
+}
+const mergeHeadersCookies = (headers, cookies) => {
   const cookieHeaders = cookies.headers();
   if (cookieHeaders.length > 0) {
     const newHeaders = new Headers(headers);
@@ -212,340 +283,46 @@ var mergeHeadersCookies = (headers, cookies) => {
   return headers;
 };
 
-// packages/qwik-router/src/middleware/request-handler/redirect-handler.ts
-var AbortMessage = class {
-};
-var RedirectMessage = class extends AbortMessage {
-};
-
-// packages/qwik-router/src/middleware/request-handler/rewrite-handler.ts
-var RewriteMessage = class extends AbortMessage {
-  constructor(pathname) {
-    super();
-    this.pathname = pathname;
-  }
-};
-
-// packages/qwik-router/src/runtime/src/constants.ts
-var MODULE_CACHE = /* @__PURE__ */ new WeakMap();
-var QACTION_KEY = "qaction";
-var QFN_KEY = "qfunc";
-var QDATA_KEY = "qdata";
-
-// packages/qwik-router/src/runtime/src/route-matcher.ts
-function matchRoute(route, path) {
-  const routeIdx = startIdxSkipSlash(route);
-  const routeLength = lengthNoTrailingSlash(route);
-  const pathIdx = startIdxSkipSlash(path);
-  const pathLength = lengthNoTrailingSlash(path);
-  return matchRoutePart(route, routeIdx, routeLength, path, pathIdx, pathLength);
-}
-function matchRoutePart(route, routeIdx, routeLength, path, pathIdx, pathLength) {
-  let params = null;
-  while (routeIdx < routeLength) {
-    const routeCh = route.charCodeAt(routeIdx++);
-    const pathCh = path.charCodeAt(pathIdx++);
-    if (routeCh === 91 /* OPEN_BRACKET */) {
-      const isMany = isThreeDots(route, routeIdx);
-      const paramNameStart = routeIdx + (isMany ? 3 : 0);
-      const paramNameEnd = scan(route, paramNameStart, routeLength, 93 /* CLOSE_BRACKET */);
-      const paramName = route.substring(paramNameStart, paramNameEnd);
-      const paramSuffixEnd = scan(route, paramNameEnd + 1, routeLength, 47 /* SLASH */);
-      const suffix = route.substring(paramNameEnd + 1, paramSuffixEnd);
-      routeIdx = paramNameEnd + 1;
-      const paramValueStart = pathIdx - 1;
-      if (isMany) {
-        const match = recursiveScan(
-          paramName,
-          suffix,
-          path,
-          paramValueStart,
-          pathLength,
-          route,
-          routeIdx + suffix.length + 1,
-          routeLength
-        );
-        if (match) {
-          return Object.assign(params || (params = {}), match);
-        }
-      }
-      const paramValueEnd = scan(path, paramValueStart, pathLength, 47 /* SLASH */, suffix);
-      if (paramValueEnd == -1) {
-        return null;
-      }
-      const paramValue = path.substring(paramValueStart, paramValueEnd);
-      if (!isMany && !suffix && !paramValue) {
-        return null;
-      }
-      pathIdx = paramValueEnd;
-      (params || (params = {}))[paramName] = decodeURIComponent(paramValue);
-    } else if (routeCh !== pathCh) {
-      if (!(isNaN(pathCh) && isRestParameter(route, routeIdx))) {
-        return null;
-      }
-    }
-  }
-  if (allConsumed(route, routeIdx) && allConsumed(path, pathIdx)) {
-    return params || {};
-  } else {
-    return null;
-  }
-}
-function isRestParameter(text, idx) {
-  return text.charCodeAt(idx) === 91 /* OPEN_BRACKET */ && isThreeDots(text, idx + 1);
-}
-function lengthNoTrailingSlash(text) {
-  const length = text.length;
-  return length > 1 && text.charCodeAt(length - 1) === 47 /* SLASH */ ? length - 1 : length;
-}
-function allConsumed(text, idx) {
-  const length = text.length;
-  return idx >= length || idx == length - 1 && text.charCodeAt(idx) === 47 /* SLASH */;
-}
-function startIdxSkipSlash(text) {
-  return text.charCodeAt(0) === 47 /* SLASH */ ? 1 : 0;
-}
-function isThreeDots(text, idx) {
-  return text.charCodeAt(idx) === 46 /* DOT */ && text.charCodeAt(idx + 1) === 46 /* DOT */ && text.charCodeAt(idx + 2) === 46 /* DOT */;
-}
-function scan(text, idx, end, ch, suffix = "") {
-  while (idx < end && text.charCodeAt(idx) !== ch) {
-    idx++;
-  }
-  const suffixLength = suffix.length;
-  for (let i = 0; i < suffixLength; i++) {
-    if (text.charCodeAt(idx - suffixLength + i) !== suffix.charCodeAt(i)) {
-      return -1;
-    }
-  }
-  return idx - suffixLength;
-}
-function recursiveScan(paramName, suffix, path, pathStart, pathLength, route, routeStart, routeLength) {
-  if (path.charCodeAt(pathStart) === 47 /* SLASH */) {
-    pathStart++;
-  }
-  let pathIdx = pathLength;
-  const sep = suffix + "/";
-  while (pathIdx >= pathStart) {
-    const match = matchRoutePart(route, routeStart, routeLength, path, pathIdx, pathLength);
-    if (match) {
-      let value = path.substring(pathStart, Math.min(pathIdx, pathLength));
-      if (value.endsWith(sep)) {
-        value = value.substring(0, value.length - sep.length);
-      }
-      match[paramName] = decodeURIComponent(value);
-      return match;
-    }
-    const newPathIdx = lastIndexOf(path, pathStart, sep, pathIdx, pathStart - 1) + sep.length;
-    if (pathIdx === newPathIdx) {
-      break;
-    }
-    pathIdx = newPathIdx;
-  }
-  return null;
-}
-function lastIndexOf(text, start, match, searchIdx, notFoundIdx) {
-  let idx = text.lastIndexOf(match, searchIdx);
-  if (idx == searchIdx - match.length) {
-    idx = text.lastIndexOf(match, searchIdx - match.length - 1);
-  }
-  return idx > start ? idx : notFoundIdx;
-}
-
-// packages/qwik-router/src/runtime/src/utils.ts
-var isPromise = (value) => {
-  return value && typeof value.then === "function";
-};
-var deepFreeze = (obj) => {
-  if (obj == null) {
-    return obj;
-  }
-  Object.getOwnPropertyNames(obj).forEach((prop) => {
-    const value = obj[prop];
-    if (value && typeof value === "object" && !Object.isFrozen(value)) {
-      deepFreeze(value);
-    }
-  });
-  return Object.freeze(obj);
-};
-
-// packages/qwik-router/src/runtime/src/routing.ts
-var loadRoute = async (routes, menus, cacheModules, pathname) => {
-  if (!Array.isArray(routes)) {
-    return null;
-  }
-  for (const routeData of routes) {
-    const routeName = routeData[0];
-    const params = matchRoute(routeName, pathname);
-    if (!params) {
-      continue;
-    }
-    const loaders = routeData[1];
-    const routeBundleNames = routeData[3];
-    const modules = new Array(loaders.length);
-    const pendingLoads = [];
-    loaders.forEach((moduleLoader, i) => {
-      loadModule(
-        moduleLoader,
-        pendingLoads,
-        (routeModule) => modules[i] = routeModule,
-        cacheModules
-      );
-    });
-    const menuLoader = getMenuLoader(menus, pathname);
-    let menu = void 0;
-    loadModule(
-      menuLoader,
-      pendingLoads,
-      (menuModule) => menu = menuModule == null ? void 0 : menuModule.default,
-      cacheModules
-    );
-    if (pendingLoads.length > 0) {
-      await Promise.all(pendingLoads);
-    }
-    return [routeName, params, modules, deepFreeze(menu), routeBundleNames];
-  }
-  return null;
-};
-var loadModule = (moduleLoader, pendingLoads, moduleSetter, cacheModules) => {
-  if (typeof moduleLoader === "function") {
-    const loadedModule = MODULE_CACHE.get(moduleLoader);
-    if (loadedModule) {
-      moduleSetter(loadedModule);
-    } else {
-      const moduleOrPromise = moduleLoader();
-      if (typeof moduleOrPromise.then === "function") {
-        pendingLoads.push(
-          moduleOrPromise.then((loadedModule2) => {
-            if (cacheModules !== false) {
-              MODULE_CACHE.set(moduleLoader, loadedModule2);
-            }
-            moduleSetter(loadedModule2);
-          })
-        );
-      } else if (moduleOrPromise) {
-        moduleSetter(moduleOrPromise);
-      }
-    }
-  }
-};
-var getMenuLoader = (menus, pathname) => {
-  if (menus) {
-    pathname = pathname.endsWith("/") ? pathname : pathname + "/";
-    const menu = menus.find(
-      (m) => m[0] === pathname || pathname.startsWith(m[0] + (pathname.endsWith("/") ? "" : "/"))
-    );
-    if (menu) {
-      return menu[1];
-    }
-  }
-};
-
-// packages/qwik-router/src/middleware/request-handler/cache-control.ts
-function createCacheControl(cacheControl) {
-  const controls = [];
-  if (cacheControl === "day") {
-    cacheControl = 60 * 60 * 24;
-  } else if (cacheControl === "week") {
-    cacheControl = 60 * 60 * 24 * 7;
-  } else if (cacheControl === "month") {
-    cacheControl = 60 * 60 * 24 * 30;
-  } else if (cacheControl === "year") {
-    cacheControl = 60 * 60 * 24 * 365;
-  } else if (cacheControl === "private") {
-    cacheControl = {
-      private: true,
-      noCache: true
-    };
-  } else if (cacheControl === "immutable") {
-    cacheControl = {
-      public: true,
-      immutable: true,
-      maxAge: 60 * 60 * 24 * 365
-    };
-  } else if (cacheControl === "no-cache") {
-    cacheControl = {
-      noCache: true
-    };
-  }
-  if (typeof cacheControl === "number") {
-    cacheControl = {
-      maxAge: cacheControl,
-      sMaxAge: cacheControl
-    };
-  }
-  if (cacheControl.immutable) {
-    controls.push("immutable");
-  }
-  if (cacheControl.maxAge) {
-    controls.push(`max-age=${cacheControl.maxAge}`);
-  }
-  if (cacheControl.sMaxAge) {
-    controls.push(`s-maxage=${cacheControl.sMaxAge}`);
-  }
-  if (cacheControl.noStore) {
-    controls.push("no-store");
-  }
-  if (cacheControl.noCache) {
-    controls.push("no-cache");
-  }
-  if (cacheControl.private) {
-    controls.push("private");
-  }
-  if (cacheControl.public) {
-    controls.push("public");
-  }
-  if (cacheControl.staleWhileRevalidate) {
-    controls.push(`stale-while-revalidate=${cacheControl.staleWhileRevalidate}`);
-  }
-  if (cacheControl.staleIfError) {
-    controls.push(`stale-if-error=${cacheControl.staleIfError}`);
-  }
-  return controls.join(", ");
-}
-
-// packages/qwik-router/src/middleware/request-handler/user-response.ts
-var asyncStore;
-import("node:async_hooks").then((module) => {
-  const AsyncLocalStorage = module.AsyncLocalStorage;
-  asyncStore = new AsyncLocalStorage();
-  globalThis.qcAsyncRequestStore = asyncStore;
-}).catch((err) => {
-  console.warn(
-    "AsyncLocalStorage not available, continuing without it. This might impact concurrent server calls.",
-    err
-  );
-});
-function runQwikRouter(serverRequestEv, loadedRoute, requestHandlers, rebuildRouteInfo, trailingSlash = true, basePathname = "/", qwikSerializer) {
+function runQwikRouter(serverRequestEv, loadedRoute, requestHandlers, rebuildRouteInfo, basePathname = "/") {
   let resolve;
   const responsePromise = new Promise((r) => resolve = r);
   const requestEv = createRequestEvent(
     serverRequestEv,
     loadedRoute,
     requestHandlers,
-    trailingSlash,
     basePathname,
-    qwikSerializer,
     resolve
   );
   return {
     response: responsePromise,
     requestEv,
-    completion: asyncStore ? asyncStore.run(requestEv, runNext, requestEv, rebuildRouteInfo, resolve) : runNext(requestEv, rebuildRouteInfo, resolve)
+    completion: _asyncRequestStore$1 ? _asyncRequestStore$1.run(requestEv, runNext, requestEv, rebuildRouteInfo, resolve) : runNext(requestEv, rebuildRouteInfo, resolve)
   };
 }
 async function runNext(requestEv, rebuildRouteInfo, resolve) {
+  try {
+    const isValidURL = (url) => new URL(url.pathname + url.search, url);
+    isValidURL(requestEv.originalUrl);
+  } catch {
+    const status = 404;
+    const message = "Resource Not Found";
+    requestEv.status(status);
+    const html = getErrorHtml(status, message);
+    requestEv.html(status, html);
+    return new ServerError$1(status, message);
+  }
   let rewriteAttempt = 1;
   async function _runNext() {
     try {
       await requestEv.next();
     } catch (e) {
-      if (e instanceof RedirectMessage) {
+      if (e instanceof RedirectMessage$1) {
         const stream = requestEv.getWritableStream();
         await stream.close();
-      } else if (e instanceof RewriteMessage) {
+        return e;
+      } else if (e instanceof RewriteMessage$1) {
         if (rewriteAttempt > 50) {
-          throw new Error(`Infinite rewrite loop`);
+          return new Error(`Infinite rewrite loop`);
         }
         rewriteAttempt += 1;
         const url = new URL(requestEv.url);
@@ -553,41 +330,38 @@ async function runNext(requestEv, rebuildRouteInfo, resolve) {
         const { loadedRoute, requestHandlers } = await rebuildRouteInfo(url);
         requestEv.resetRoute(loadedRoute, requestHandlers, url);
         return await _runNext();
-      } else if (e instanceof ServerError) {
-        if (!requestEv.headersSent) {
-          const status = e.status;
-          const accept = requestEv.request.headers.get("Accept");
-          if (accept && !accept.includes("text/html")) {
-            const qwikSerializer = requestEv[RequestEvQwikSerializer];
-            requestEv.headers.set("Content-Type", "application/qwik-json");
-            requestEv.send(status, await qwikSerializer._serialize([e.data]));
-          } else {
-            const html = getErrorHtml(e.status, e.data);
-            requestEv.html(status, html);
-          }
+      } else if (e instanceof AbortMessage$1) {
+        return;
+      } else if (e instanceof ServerError$1 && !requestEv.headersSent) {
+        const status = e.status;
+        const accept = requestEv.request.headers.get("Accept");
+        if (accept && !accept.includes("text/html")) {
+          requestEv.headers.set("Content-Type", "application/qwik-json");
+          requestEv.send(status, await _serialize([e.data]));
+        } else {
+          requestEv.html(status, getErrorHtml(status, e.data));
         }
-      } else if (!(e instanceof AbortMessage)) {
-        if (getRequestMode(requestEv) !== "dev") {
-          try {
-            if (!requestEv.headersSent) {
-              requestEv.headers.set("content-type", "text/html; charset=utf-8");
-              requestEv.cacheControl({ noCache: true });
-              requestEv.status(500);
-            }
-            const stream = requestEv.getWritableStream();
-            if (!stream.locked) {
-              const writer = stream.getWriter();
-              await writer.write(encoder.encode(minimalHtmlResponse(500, "Internal Server Error")));
-              await writer.close();
-            }
-          } catch {
-            console.error("Unable to render error page");
+        return e;
+      }
+      if (getRequestMode(requestEv) !== "dev") {
+        try {
+          if (!requestEv.headersSent) {
+            requestEv.headers.set("content-type", "text/html; charset=utf-8");
+            requestEv.cacheControl({ noCache: true });
+            requestEv.status(500);
+          }
+          const stream = requestEv.getWritableStream();
+          if (!stream.locked) {
+            const writer = stream.getWriter();
+            await writer.write(encoder.encode(getErrorHtml(500, "Internal Server Error")));
+            await writer.close();
           }
+        } catch {
+          console.error("Unable to render error page");
         }
-        return e;
       }
+      return e;
     }
-    return void 0;
   }
   try {
     return await _runNext();
@@ -597,42 +371,42 @@ async function runNext(requestEv, rebuildRouteInfo, resolve) {
     }
   }
 }
-function getRouteMatchPathname(pathname, trailingSlash) {
-  if (pathname.endsWith(QDATA_JSON)) {
-    const trimEnd = pathname.length - QDATA_JSON_LEN + (trailingSlash ? 1 : 0);
+function getRouteMatchPathname(pathname) {
+  const isInternal = pathname.endsWith(QDATA_JSON);
+  if (isInternal) {
+    const trimEnd = pathname.length - QDATA_JSON.length + (globalThis.__NO_TRAILING_SLASH__ ? 0 : 1);
     pathname = pathname.slice(0, trimEnd);
     if (pathname === "") {
       pathname = "/";
     }
   }
-  return pathname;
+  return { pathname, isInternal };
 }
-var IsQData = "@isQData";
-var QDATA_JSON = "/q-data.json";
-var QDATA_JSON_LEN = QDATA_JSON.length;
+const IsQData = "@isQData";
+const QDATA_JSON = "/q-data.json";
 
-// packages/qwik-router/src/middleware/request-handler/request-event.ts
-var RequestEvLoaders = Symbol("RequestEvLoaders");
-var RequestEvMode = Symbol("RequestEvMode");
-var RequestEvRoute = Symbol("RequestEvRoute");
-var RequestEvQwikSerializer = Symbol("RequestEvQwikSerializer");
-var RequestEvTrailingSlash = Symbol("RequestEvTrailingSlash");
-var RequestRouteName = "@routeName";
-var RequestEvSharedActionId = "@actionId";
-var RequestEvSharedActionFormData = "@actionFormData";
-var RequestEvSharedNonce = "@nonce";
-var RequestEvIsRewrite = "@rewrite";
-function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trailingSlash, basePathname, qwikSerializer, resolved) {
+const RequestEvLoaders = /* @__PURE__ */ Symbol("RequestEvLoaders");
+const RequestEvMode = /* @__PURE__ */ Symbol("RequestEvMode");
+const RequestEvRoute = /* @__PURE__ */ Symbol("RequestEvRoute");
+const RequestEvLoaderSerializationStrategyMap = /* @__PURE__ */ Symbol(
+  "RequestEvLoaderSerializationStrategyMap"
+);
+const RequestRouteName = "@routeName";
+const RequestEvSharedActionId = "@actionId";
+const RequestEvSharedActionFormData = "@actionFormData";
+const RequestEvSharedNonce = "@nonce";
+const RequestEvIsRewrite = "@rewrite";
+const RequestEvShareServerTiming = "@serverTiming";
+const RequestEvShareQData = "qData";
+function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, basePathname, resolved) {
   const { request, platform, env } = serverRequestEv;
   const sharedMap = /* @__PURE__ */ new Map();
   const cookie = new Cookie(request.headers.get("cookie"));
   const headers = new Headers();
   const url = new URL(request.url);
-  if (url.pathname.endsWith(QDATA_JSON)) {
-    url.pathname = url.pathname.slice(0, -QDATA_JSON_LEN);
-    if (trailingSlash && !url.pathname.endsWith("/")) {
-      url.pathname += "/";
-    }
+  const { pathname, isInternal } = getRouteMatchPathname(url.pathname);
+  if (isInternal) {
+    url.pathname = pathname;
     sharedMap.set(IsQData, true);
   }
   let routeModuleIndex = -1;
@@ -644,8 +418,7 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
     routeModuleIndex++;
     while (routeModuleIndex < requestHandlers.length) {
       const moduleRequestHandler = requestHandlers[routeModuleIndex];
-      const asyncStore2 = globalThis.qcAsyncRequestStore;
-      const result = (asyncStore2 == null ? void 0 : asyncStore2.run) ? asyncStore2.run(requestEv, moduleRequestHandler, requestEv) : moduleRequestHandler(requestEv);
+      const result = moduleRequestHandler(requestEv);
       if (isPromise(result)) {
         await result;
       }
@@ -698,19 +471,18 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
     }
     return exit();
   };
-  const exit = () => {
+  const exit = (message = new AbortMessage$1()) => {
     routeModuleIndex = ABORT_INDEX;
-    return new AbortMessage();
+    return message;
   };
   const loaders = {};
   const requestEv = {
     [RequestEvLoaders]: loaders,
+    [RequestEvLoaderSerializationStrategyMap]: /* @__PURE__ */ new Map(),
     [RequestEvMode]: serverRequestEv.mode,
-    [RequestEvTrailingSlash]: trailingSlash,
     get [RequestEvRoute]() {
       return loadedRoute;
     },
-    [RequestEvQwikSerializer]: qwikSerializer,
     cookie,
     headers,
     env,
@@ -718,7 +490,7 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
     signal: request.signal,
     originalUrl: new URL(url),
     get params() {
-      return (loadedRoute == null ? void 0 : loadedRoute[1]) ?? {};
+      return loadedRoute?.[LoadedRouteProp.Params] ?? {};
     },
     get pathname() {
       return url.pathname;
@@ -747,7 +519,7 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
       check();
       headers.set(target, createCacheControl(cacheControl));
     },
-    resolveValue: async (loaderOrAction) => {
+    resolveValue: (async (loaderOrAction) => {
       const id = loaderOrAction.__id;
       if (loaderOrAction.__brand === "server_loader") {
         if (!(id in loaders)) {
@@ -755,9 +527,13 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
             "You can not get the returned data of a loader that has not been executed for this request."
           );
         }
+        if (loaders[id] === _UNINITIALIZED) {
+          const isDev = getRequestMode(requestEv) === "dev";
+          await getRouteLoaderPromise(loaderOrAction, loaders, requestEv, isDev);
+        }
       }
       return loaders[id];
-    },
+    }),
     status: (statusCode) => {
       if (typeof statusCode === "number") {
         check();
@@ -774,31 +550,37 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
     },
     error: (statusCode, message) => {
       status = statusCode;
-      return new ServerError(statusCode, message);
+      headers.delete("Cache-Control");
+      return new ServerError$1(statusCode, message);
     },
     redirect: (statusCode, url2) => {
       check();
       status = statusCode;
       if (url2) {
-        const fixedURL = url2.replace(/([^:])\/{2,}/g, "$1/");
-        if (url2 !== fixedURL) {
+        if (
+          // //test.com
+          /^\/\//.test(url2) || // /test//path
+          /([^:])\/\/+/.test(url2)
+        ) {
+          const fixedURL = url2.replace(/^\/\/+/, "/").replace(/([^:])\/\/+/g, "$1/");
           console.warn(`Redirect URL ${url2} is invalid, fixing to ${fixedURL}`);
+          url2 = fixedURL;
         }
-        headers.set("Location", fixedURL);
+        headers.set("Location", url2);
       }
-      if (statusCode > 301 && !headers.get("Cache-Control")) {
+      headers.delete("Cache-Control");
+      if (statusCode > 301) {
         headers.set("Cache-Control", "no-store");
       }
-      exit();
-      return new RedirectMessage();
+      return exit(new RedirectMessage$1());
     },
-    rewrite: (pathname) => {
+    rewrite: (pathname2) => {
       check();
-      if (pathname.startsWith("http")) {
+      if (pathname2.startsWith("http")) {
         throw new Error("Rewrite does not support absolute urls");
       }
       sharedMap.set(RequestEvIsRewrite, true);
-      return new RewriteMessage(pathname.replace(/\/+/g, "/"));
+      return exit(new RewriteMessage$1(pathname2.replace(/\/+/g, "/")));
     },
     defer: (returnData) => {
       return typeof returnData === "function" ? returnData : () => returnData;
@@ -806,6 +588,7 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
     fail: (statusCode, data) => {
       check();
       status = statusCode;
+      headers.delete("Cache-Control");
       return {
         failed: true,
         ...data
@@ -823,7 +606,7 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
       if (requestData !== void 0) {
         return requestData;
       }
-      return requestData = parseRequest(requestEv, sharedMap, qwikSerializer);
+      return requestData = parseRequest(requestEv, sharedMap);
     },
     json: (statusCode, data) => {
       headers.set("Content-Type", "application/json; charset=utf-8");
@@ -836,9 +619,12 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
     getWritableStream: () => {
       if (writableStream === null) {
         if (serverRequestEv.mode === "dev") {
-          const serverTiming = sharedMap.get("@serverTiming");
+          const serverTiming = sharedMap.get(RequestEvShareServerTiming);
           if (serverTiming) {
-            headers.set("Server-Timing", serverTiming.map((a) => `${a[0]};dur=${a[1]}`).join(","));
+            headers.set(
+              "Server-Timing",
+              serverTiming.map(([name, duration]) => `${name};dur=${duration}`).join(",")
+            );
           }
         }
         writableStream = serverRequestEv.getWritableStream(
@@ -852,13 +638,13 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, trail
       return writableStream;
     }
   };
-  return Object.freeze(requestEv);
+  return requestEv;
 }
 function getRequestLoaders(requestEv) {
   return requestEv[RequestEvLoaders];
 }
-function getRequestTrailingSlash(requestEv) {
-  return requestEv[RequestEvTrailingSlash];
+function getRequestLoaderSerializationStrategyMap(requestEv) {
+  return requestEv[RequestEvLoaderSerializationStrategyMap];
 }
 function getRequestRoute(requestEv) {
   return requestEv[RequestEvRoute];
@@ -866,10 +652,9 @@ function getRequestRoute(requestEv) {
 function getRequestMode(requestEv) {
   return requestEv[RequestEvMode];
 }
-var ABORT_INDEX = Number.MAX_SAFE_INTEGER;
-var parseRequest = async ({ request, method, query }, sharedMap, qwikSerializer) => {
-  var _a;
-  const type = ((_a = request.headers.get("content-type")) == null ? void 0 : _a.split(/[;,]/, 1)[0].trim()) ?? "";
+const ABORT_INDEX = Number.MAX_SAFE_INTEGER;
+const parseRequest = async ({ request, method, query }, sharedMap) => {
+  const type = getContentType(request.headers);
   if (type === "application/x-www-form-urlencoded" || type === "multipart/form-data") {
     const formData = await request.formData();
     sharedMap.set(RequestEvSharedActionFormData, formData);
@@ -882,34 +667,52 @@ var parseRequest = async ({ request, method, query }, sharedMap, qwikSerializer)
       const data = query.get(QDATA_KEY);
       if (data) {
         try {
-          return qwikSerializer._deserialize(decodeURIComponent(data));
+          return _deserialize(decodeURIComponent(data));
         } catch {
         }
       }
     }
-    return qwikSerializer._deserialize(await request.text());
+    return _deserialize(await request.text());
   }
   return void 0;
 };
-var formToObj = (formData) => {
-  const values = [...formData.entries()].reduce((values2, [name, value]) => {
-    name.split(".").reduce((object, key, index, keys) => {
+const isDangerousKey = (k) => k === "__proto__" || k === "constructor" || k === "prototype";
+const formToObj = (formData) => {
+  const values = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of formData) {
+    const keys = name.split(".");
+    let hasDangerousKey = false;
+    for (let i = 0; i < keys.length; i++) {
+      if (isDangerousKey(keys[i])) {
+        hasDangerousKey = true;
+        break;
+      }
+    }
+    if (hasDangerousKey) {
+      continue;
+    }
+    let object = values;
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
       if (key.endsWith("[]")) {
         const arrayKey = key.slice(0, -2);
+        if (isDangerousKey(arrayKey)) {
+          break;
+        }
         object[arrayKey] = object[arrayKey] || [];
-        return object[arrayKey] = [...object[arrayKey], value];
+        object[arrayKey].push(value);
+        break;
       }
-      if (index < keys.length - 1) {
-        return object[key] = object[key] || (Number.isNaN(+keys[index + 1]) ? {} : []);
+      if (i < keys.length - 1) {
+        object = object[key] = object[key] || (Number.isNaN(+keys[i + 1]) ? /* @__PURE__ */ Object.create(null) : []);
+      } else {
+        object[key] = value;
       }
-      return object[key] = value;
-    }, values2);
-    return values2;
-  }, {});
+    }
+  }
   return values;
 };
 
-// packages/qwik-router/src/middleware/request-handler/response-page.ts
 function getQwikRouterServerData(requestEv) {
   const { params, request, status, locale, originalUrl } = requestEv;
   const requestHeaders = {};
@@ -929,13 +732,15 @@ function getQwikRouterServerData(requestEv) {
   if (protocol) {
     reconstructedUrl.protocol = protocol;
   }
+  const loaders = getRequestLoaders(requestEv);
+  const loadersSerializationStrategy = getRequestLoaderSerializationStrategyMap(requestEv);
   return {
     url: reconstructedUrl.href,
     requestHeaders,
     locale: locale(),
     nonce,
     containerAttributes: {
-      "q:route": routeName
+      [Q_ROUTE]: routeName
     },
     qwikrouter: {
       routeName,
@@ -944,7 +749,8 @@ function getQwikRouterServerData(requestEv) {
       loadedRoute: getRequestRoute(requestEv),
       response: {
         status: status(),
-        loaders: getRequestLoaders(requestEv),
+        loaders,
+        loadersSerializationStrategy,
         action,
         formData
       }
@@ -952,12 +758,14 @@ function getQwikRouterServerData(requestEv) {
   };
 }
 
-// packages/qwik-router/src/middleware/request-handler/resolve-request-handlers.ts
-var resolveRequestHandlers = (serverPlugins, route, method, checkOrigin, renderHandler) => {
+const resolveRequestHandlers = (serverPlugins, route, method, checkOrigin, renderHandler, isInternal) => {
   const routeLoaders = [];
   const routeActions = [];
   const requestHandlers = [];
-  const isPageRoute = !!(route && isLastModulePageRoute(route[2]));
+  const isPageRoute = !!(route && isLastModulePageRoute(route[LoadedRouteProp.Mods]));
+  if (isInternal) {
+    requestHandlers.push(handleQDataRedirect);
+  }
   if (serverPlugins) {
     _resolveRequestHandlers(
       routeLoaders,
@@ -969,19 +777,7 @@ var resolveRequestHandlers = (serverPlugins, route, method, checkOrigin, renderH
     );
   }
   if (route) {
-    const routeName = route[0];
-    if (checkOrigin && (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE")) {
-      requestHandlers.unshift(csrfCheckMiddleware);
-    }
-    if (isPageRoute) {
-      if (method === "POST" || method === "GET") {
-        requestHandlers.push(pureServerFunction);
-      }
-      requestHandlers.push(fixTrailingSlash);
-      requestHandlers.push(renderQData);
-    }
-    const routeModules = route[2];
-    requestHandlers.push(handleRedirect);
+    const routeModules = route[LoadedRouteProp.Mods];
     _resolveRequestHandlers(
       routeLoaders,
       routeActions,
@@ -990,17 +786,35 @@ var resolveRequestHandlers = (serverPlugins, route, method, checkOrigin, renderH
       isPageRoute,
       method
     );
+    const routeName = route[LoadedRouteProp.RouteName];
+    if (checkOrigin && (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE")) {
+      if (checkOrigin === "lax-proto") {
+        requestHandlers.unshift(csrfLaxProtoCheckMiddleware);
+      } else {
+        requestHandlers.unshift(csrfCheckMiddleware);
+      }
+    }
+    if (isPageRoute) {
+      if (method === "POST" || method === "GET") {
+        requestHandlers.push(runServerFunction);
+      }
+      requestHandlers.push(fixTrailingSlash);
+      if (isInternal) {
+        requestHandlers.push(renderQData);
+      }
+    }
     if (isPageRoute) {
       requestHandlers.push((ev) => {
         ev.sharedMap.set(RequestRouteName, routeName);
       });
-      requestHandlers.push(actionsMiddleware(routeActions, routeLoaders));
+      requestHandlers.push(actionsMiddleware(routeActions));
+      requestHandlers.push(loadersMiddleware(routeLoaders));
       requestHandlers.push(renderHandler);
     }
   }
   return requestHandlers;
 };
-var _resolveRequestHandlers = (routeLoaders, routeActions, requestHandlers, routeModules, collectActions, method) => {
+const _resolveRequestHandlers = (routeLoaders, routeActions, requestHandlers, routeModules, collectActions, method) => {
   for (const routeModule of routeModules) {
     if (typeof routeModule.onRequest === "function") {
       requestHandlers.push(routeModule.onRequest);
@@ -1056,8 +870,9 @@ var _resolveRequestHandlers = (routeLoaders, routeActions, requestHandlers, rout
     }
   }
 };
-function actionsMiddleware(routeActions, routeLoaders) {
-  return async (requestEv) => {
+function actionsMiddleware(routeActions) {
+  return async (requestEvent) => {
+    const requestEv = requestEvent;
     if (requestEv.headersSent) {
       requestEv.exit();
       return;
@@ -1065,7 +880,6 @@ function actionsMiddleware(routeActions, routeLoaders) {
     const { method } = requestEv;
     const loaders = getRequestLoaders(requestEv);
     const isDev = getRequestMode(requestEv) === "dev";
-    const qwikSerializer = requestEv[RequestEvQwikSerializer];
     if (isDev && method === "GET") {
       if (requestEv.query.has(QACTION_KEY)) {
         console.warn(
@@ -1077,7 +891,7 @@ function actionsMiddleware(routeActions, routeLoaders) {
       const selectedActionId = requestEv.query.get(QACTION_KEY);
       if (selectedActionId) {
         const serverActionsMap = globalThis._qwikActionsMap;
-        const action = routeActions.find((action2) => action2.__id === selectedActionId) ?? (serverActionsMap == null ? void 0 : serverActionsMap.get(selectedActionId));
+        const action = routeActions.find((action2) => action2.__id === selectedActionId) ?? serverActionsMap?.get(selectedActionId);
         if (action) {
           requestEv.sharedMap.set(RequestEvSharedActionId, selectedActionId);
           const data = await requestEv.parseBody();
@@ -1092,57 +906,73 @@ function actionsMiddleware(routeActions, routeLoaders) {
           } else {
             const actionResolved = isDev ? await measure(
               requestEv,
-              action.__qrl.getSymbol().split("_", 1)[0],
+              action.__qrl.getHash(),
               () => action.__qrl.call(requestEv, result.data, requestEv)
             ) : await action.__qrl.call(requestEv, result.data, requestEv);
             if (isDev) {
-              verifySerializable(qwikSerializer, actionResolved, action.__qrl);
+              verifySerializable(actionResolved, action.__qrl);
             }
             loaders[selectedActionId] = actionResolved;
           }
         }
       }
     }
+  };
+}
+function loadersMiddleware(routeLoaders) {
+  return async (requestEvent) => {
+    const requestEv = requestEvent;
+    if (requestEv.headersSent) {
+      requestEv.exit();
+      return;
+    }
+    const loaders = getRequestLoaders(requestEv);
+    const isDev = getRequestMode(requestEv) === "dev";
     if (routeLoaders.length > 0) {
-      const resolvedLoadersPromises = routeLoaders.map((loader) => {
-        const loaderId = loader.__id;
-        loaders[loaderId] = runValidators(
-          requestEv,
-          loader.__validators,
-          void 0,
-          // data
-          isDev
-        ).then((res) => {
-          if (res.success) {
-            if (isDev) {
-              return measure(
-                requestEv,
-                loader.__qrl.getSymbol().split("_", 1)[0],
-                () => loader.__qrl.call(requestEv, requestEv)
-              );
-            } else {
-              return loader.__qrl.call(requestEv, requestEv);
-            }
-          } else {
-            return requestEv.fail(res.status ?? 500, res.error);
-          }
-        }).then((resolvedLoader) => {
-          if (typeof resolvedLoader === "function") {
-            loaders[loaderId] = resolvedLoader();
-          } else {
-            if (isDev) {
-              verifySerializable(qwikSerializer, resolvedLoader, loader.__qrl);
-            }
-            loaders[loaderId] = resolvedLoader;
-          }
-          return resolvedLoader;
-        });
-        return loaders[loaderId];
-      });
+      const resolvedLoadersPromises = routeLoaders.map(
+        (loader) => getRouteLoaderPromise(loader, loaders, requestEv, isDev)
+      );
       await Promise.all(resolvedLoadersPromises);
     }
   };
 }
+async function getRouteLoaderPromise(loader, loaders, requestEv, isDev) {
+  const loaderId = loader.__id;
+  loaders[loaderId] = runValidators(
+    requestEv,
+    loader.__validators,
+    void 0,
+    // data
+    isDev
+  ).then((res) => {
+    if (res.success) {
+      if (isDev) {
+        return measure(
+          requestEv,
+          loader.__qrl.getHash(),
+          () => loader.__qrl.call(requestEv, requestEv)
+        );
+      } else {
+        return loader.__qrl.call(requestEv, requestEv);
+      }
+    } else {
+      return requestEv.fail(res.status ?? 500, res.error);
+    }
+  }).then((resolvedLoader) => {
+    if (typeof resolvedLoader === "function") {
+      loaders[loaderId] = resolvedLoader();
+    } else {
+      if (isDev) {
+        verifySerializable(resolvedLoader, loader.__qrl);
+      }
+      loaders[loaderId] = resolvedLoader;
+    }
+    return resolvedLoader;
+  });
+  const loadersSerializationStrategy = getRequestLoaderSerializationStrategyMap(requestEv);
+  loadersSerializationStrategy.set(loaderId, loader.__serializationStrategy);
+  return loaders[loaderId];
+}
 async function runValidators(requestEv, validators, data, isDev) {
   let lastResult = {
     success: true,
@@ -1171,84 +1001,88 @@ async function runValidators(requestEv, validators, data, isDev) {
 function isAsyncIterator(obj) {
   return obj ? typeof obj === "object" && Symbol.asyncIterator in obj : false;
 }
-async function pureServerFunction(ev) {
-  const fn = ev.query.get(QFN_KEY);
-  if (fn && ev.request.headers.get("X-QRL") === fn && ev.request.headers.get("Content-Type") === "application/qwik-json") {
+async function runServerFunction(ev) {
+  const serverFnHash = ev.query.get(QFN_KEY);
+  if (serverFnHash && ev.request.headers.get("X-QRL") === serverFnHash && ev.request.headers.get("Content-Type") === "application/qwik-json") {
     ev.exit();
     const isDev = getRequestMode(ev) === "dev";
-    const qwikSerializer = ev[RequestEvQwikSerializer];
     const data = await ev.parseBody();
     if (Array.isArray(data)) {
-      const [qrl, ...args] = data;
-      if (isQrl(qrl) && qrl.getHash() === fn) {
-        let result;
-        try {
+      const qrl = inlinedQrl(null, serverFnHash, data[1]);
+      let result;
+      try {
+        if (isDev) {
+          result = await measure(
+            ev,
+            `server_${serverFnHash}`,
+            () => qrl.apply(ev, data[0])
+          );
+        } else {
+          result = await qrl.apply(ev, data[0]);
+        }
+      } catch (err) {
+        if (err instanceof ServerError$1) {
+          throw ev.error(err.status, err.data);
+        }
+        console.error(`Server function ${serverFnHash} failed:`, err);
+        throw ev.error(500, "Invalid request");
+      }
+      if (isAsyncIterator(result)) {
+        ev.headers.set("Content-Type", "text/qwik-json-stream");
+        const writable = ev.getWritableStream();
+        const stream = writable.getWriter();
+        for await (const item of result) {
           if (isDev) {
-            result = await measure(
-              ev,
-              `server_${qrl.getSymbol()}`,
-              () => qrl.apply(ev, args)
-            );
-          } else {
-            result = await qrl.apply(ev, args);
+            verifySerializable(item, qrl);
           }
-        } catch (err) {
-          if (err instanceof ServerError) {
-            throw ev.error(err.status, err.data);
+          const message = await _serialize([item]);
+          if (ev.signal.aborted) {
+            break;
           }
-          throw ev.error(500, "Invalid request");
-        }
-        if (isAsyncIterator(result)) {
-          ev.headers.set("Content-Type", "text/qwik-json-stream");
-          const writable = ev.getWritableStream();
-          const stream = writable.getWriter();
-          for await (const item of result) {
-            if (isDev) {
-              verifySerializable(qwikSerializer, item, qrl);
-            }
-            const message = await qwikSerializer._serialize([item]);
-            if (ev.signal.aborted) {
-              break;
-            }
-            await stream.write(encoder.encode(`${message}
+          await stream.write(encoder.encode(`${message}
 `));
-          }
-          stream.close();
-        } else {
-          verifySerializable(qwikSerializer, result, qrl);
-          ev.headers.set("Content-Type", "application/qwik-json");
-          const message = await qwikSerializer._serialize([result]);
-          ev.send(200, message);
         }
-        return;
+        stream.close();
+      } else {
+        verifySerializable(result, qrl);
+        ev.headers.set("Content-Type", "application/qwik-json");
+        const message = await _serialize([result]);
+        ev.send(200, message);
       }
+      return;
     }
     throw ev.error(500, "Invalid request");
   }
 }
 function fixTrailingSlash(ev) {
-  const trailingSlash = getRequestTrailingSlash(ev);
   const { basePathname, originalUrl, sharedMap } = ev;
   const { pathname, search } = originalUrl;
   const isQData = sharedMap.has(IsQData);
+  if (
+    // all valid pathnames must start with a single slash
+    !pathname.startsWith("/") || // protocol-relative URLs are not allowed like: //test.com, ///bad.com
+    pathname.startsWith("//")
+  ) {
+    return;
+  }
   if (!isQData && pathname !== basePathname && !pathname.endsWith(".html")) {
-    if (trailingSlash) {
+    if (!globalThis.__NO_TRAILING_SLASH__) {
       if (!pathname.endsWith("/")) {
-        throw ev.redirect(301 /* MovedPermanently */, pathname + "/" + search);
+        throw ev.redirect(HttpStatus.MovedPermanently, pathname + "/" + search);
       }
     } else {
       if (pathname.endsWith("/")) {
         throw ev.redirect(
-          301 /* MovedPermanently */,
+          HttpStatus.MovedPermanently,
           pathname.slice(0, pathname.length - 1) + search
         );
       }
     }
   }
 }
-function verifySerializable(qwikSerializer, data, qrl) {
+function verifySerializable(data, qrl) {
   try {
-    qwikSerializer._verifySerializable(data, void 0);
+    _verifySerializable(data, void 0);
   } catch (e) {
     if (e instanceof Error && qrl.dev) {
       e.loc = qrl.dev;
@@ -1256,19 +1090,16 @@ function verifySerializable(qwikSerializer, data, qrl) {
     throw e;
   }
 }
-var isQrl = (value) => {
-  return typeof value === "function" && typeof value.getSymbol === "function";
-};
 function isLastModulePageRoute(routeModules) {
   const lastRouteModule = routeModules[routeModules.length - 1];
   return lastRouteModule && typeof lastRouteModule.default === "function";
 }
-function getPathname(url, trailingSlash) {
+function getPathname(url) {
   url = new URL(url);
   if (url.pathname.endsWith(QDATA_JSON)) {
     url.pathname = url.pathname.slice(0, -QDATA_JSON.length);
   }
-  if (trailingSlash) {
+  if (!globalThis.__NO_TRAILING_SLASH__) {
     if (!url.pathname.endsWith("/")) {
       url.pathname += "/";
     }
@@ -1277,21 +1108,31 @@ function getPathname(url, trailingSlash) {
       url.pathname = url.pathname.slice(0, -1);
     }
   }
-  const search = url.search.slice(1).replaceAll(/&?q(action|data|func)=[^&]+/g, "");
+  const search = url.search.slice(1).replaceAll(/&?q(action|data|func|loaders)=[^&]+/g, "");
   return `${url.pathname}${search ? `?${search}` : ""}${url.hash}`;
 }
-var encoder = /* @__PURE__ */ new TextEncoder();
+const encoder = /* @__PURE__ */ new TextEncoder();
+function csrfLaxProtoCheckMiddleware(requestEv) {
+  checkCSRF(requestEv, "lax-proto");
+}
 function csrfCheckMiddleware(requestEv) {
-  const isForm = isContentType(
+  checkCSRF(requestEv);
+}
+function checkCSRF(requestEv, laxProto) {
+  const contentType = requestEv.request.headers.get("content-type");
+  const isSimpleRequest = !contentType || isContentType(
     requestEv.request.headers,
     "application/x-www-form-urlencoded",
     "multipart/form-data",
     "text/plain"
   );
-  if (isForm) {
+  if (isSimpleRequest) {
     const inputOrigin = requestEv.request.headers.get("origin");
     const origin = requestEv.url.origin;
-    const forbidden = inputOrigin !== origin;
+    let forbidden = inputOrigin !== origin;
+    if (forbidden && laxProto && inputOrigin?.replace(/^http(s)?/g, "") === origin.replace(/^http(s)?/g, "")) {
+      forbidden = false;
+    }
     if (forbidden) {
       throw requestEv.error(
         403,
@@ -1310,13 +1151,11 @@ function renderQwikMiddleware(render) {
     if (isPageDataReq) {
       return;
     }
-    const requestHeaders = {};
-    requestEv.request.headers.forEach((value, key) => requestHeaders[key] = value);
+    requestEv.request.headers.forEach((value, key) => value);
     const responseHeaders = requestEv.headers;
     if (!responseHeaders.has("Content-Type")) {
       responseHeaders.set("Content-Type", "text/html; charset=utf-8");
     }
-    const trailingSlash = getRequestTrailingSlash(requestEv);
     const { readable, writable } = new TextEncoderStream();
     const writableStream = requestEv.getWritableStream();
     const pipe = readable.pipeTo(writableStream, { preventClose: true });
@@ -1338,12 +1177,12 @@ function renderQwikMiddleware(render) {
         loaders: getRequestLoaders(requestEv),
         action: requestEv.sharedMap.get(RequestEvSharedActionId),
         status: status !== 200 ? status : 200,
-        href: getPathname(requestEv.url, trailingSlash)
+        href: getPathname(requestEv.url)
       };
       if (typeof result.html === "string") {
         await stream.write(result.html);
       }
-      requestEv.sharedMap.set("qData", qData);
+      requestEv.sharedMap.set(RequestEvShareQData, qData);
     } finally {
       await stream.ready;
       await stream.close();
@@ -1352,15 +1191,11 @@ function renderQwikMiddleware(render) {
     await writableStream.close();
   };
 }
-async function handleRedirect(requestEv) {
-  const isPageDataReq = requestEv.sharedMap.has(IsQData);
-  if (!isPageDataReq) {
-    return;
-  }
+async function handleQDataRedirect(requestEv) {
   try {
     await requestEv.next();
   } catch (err) {
-    if (!(err instanceof RedirectMessage)) {
+    if (!(err instanceof RedirectMessage$1)) {
       throw err;
     }
   }
@@ -1383,41 +1218,52 @@ async function handleRedirect(requestEv) {
   }
 }
 async function renderQData(requestEv) {
-  const isPageDataReq = requestEv.sharedMap.has(IsQData);
-  if (!isPageDataReq) {
-    return;
-  }
   await requestEv.next();
   if (requestEv.headersSent || requestEv.exited) {
     return;
   }
   const status = requestEv.status();
   const redirectLocation = requestEv.headers.get("Location");
-  const trailingSlash = getRequestTrailingSlash(requestEv);
-  const requestHeaders = {};
-  requestEv.request.headers.forEach((value, key) => requestHeaders[key] = value);
+  requestEv.request.headers.forEach((value, key) => value);
   requestEv.headers.set("Content-Type", "application/json; charset=utf-8");
-  const qData = {
-    loaders: getRequestLoaders(requestEv),
+  let loaders = getRequestLoaders(requestEv);
+  const selectedLoaderIds = requestEv.query.getAll(QLOADER_KEY);
+  const hasCustomLoaders = selectedLoaderIds.length > 0;
+  if (hasCustomLoaders) {
+    const selectedLoaders = {};
+    for (const loaderId of selectedLoaderIds) {
+      const loader = loaders[loaderId];
+      selectedLoaders[loaderId] = loader;
+    }
+    loaders = selectedLoaders;
+  }
+  const qData = hasCustomLoaders ? {
+    // send minimal data to the client
+    loaders,
+    status: status !== 200 ? status : 200,
+    href: getPathname(requestEv.url)
+  } : {
+    loaders,
     action: requestEv.sharedMap.get(RequestEvSharedActionId),
     status: status !== 200 ? status : 200,
-    href: getPathname(requestEv.url, trailingSlash),
+    href: getPathname(requestEv.url),
     redirect: redirectLocation ?? void 0,
     isRewrite: requestEv.sharedMap.get(RequestEvIsRewrite)
   };
   const writer = requestEv.getWritableStream().getWriter();
-  const qwikSerializer = requestEv[RequestEvQwikSerializer];
-  const data = await qwikSerializer._serialize([qData]);
+  const data = await _serialize([qData]);
   writer.write(encoder.encode(data));
-  requestEv.sharedMap.set("qData", qData);
+  requestEv.sharedMap.set(RequestEvShareQData, qData);
   writer.close();
 }
 function makeQDataPath(href) {
   if (href.startsWith("/")) {
-    const append = QDATA_JSON;
-    const url = new URL(href, "http://localhost");
-    const pathname = url.pathname.endsWith("/") ? url.pathname.slice(0, -1) : url.pathname;
-    return pathname + (append.startsWith("/") ? "" : "/") + append + url.search;
+    if (!href.includes(QDATA_JSON)) {
+      const url = new URL(href, "http://localhost");
+      const pathname = url.pathname.endsWith("/") ? url.pathname.slice(0, -1) : url.pathname;
+      return pathname + QDATA_JSON + url.search;
+    }
+    return href;
   } else {
     return void 0;
   }
@@ -1431,44 +1277,73 @@ async function measure(requestEv, name, fn) {
     return await fn();
   } finally {
     const duration = now() - start;
-    let measurements = requestEv.sharedMap.get("@serverTiming");
+    let measurements = requestEv.sharedMap.get(RequestEvShareServerTiming);
     if (!measurements) {
-      requestEv.sharedMap.set("@serverTiming", measurements = []);
+      requestEv.sharedMap.set(RequestEvShareServerTiming, measurements = []);
     }
     measurements.push([name, duration]);
   }
 }
+function getContentType(headers) {
+  return (headers.get("content-type")?.split(/[;,]/, 1)[0].trim() ?? "").toLowerCase();
+}
 function isContentType(headers, ...types) {
-  var _a;
-  const type = ((_a = headers.get("content-type")) == null ? void 0 : _a.split(/;/, 1)[0].trim()) ?? "";
-  return types.includes(type);
+  const type = getContentType(headers);
+  for (let i = 0; i < types.length; i++) {
+    if (types[i].toLowerCase() === type) {
+      return true;
+    }
+  }
+  return false;
 }
 
-// packages/qwik-router/src/middleware/request-handler/request-handler.ts
-async function requestHandler(serverRequestEv, opts, qwikSerializer) {
-  const { render, qwikRouterConfig, checkOrigin } = opts;
+let _asyncRequestStore;
+if (isServer) {
+  import('node:async_hooks').then((module) => {
+    _asyncRequestStore = new module.AsyncLocalStorage();
+  }).catch((err) => {
+    console.warn(
+      "\n=====================\n  Qwik Router Warning:\n    AsyncLocalStorage is not available, continuing without it.\n    This impacts concurrent async server calls, where they lose access to the ServerRequestEv object.\n=====================\n\n",
+      err
+    );
+  });
+}
+let qwikRouterConfigActual;
+async function requestHandler(serverRequestEv, opts) {
+  const { render, checkOrigin } = opts;
+  let { qwikRouterConfig } = opts;
+  if (!qwikRouterConfig) {
+    if (!qwikRouterConfigActual) {
+      qwikRouterConfigActual = await import('@qwik-router-config');
+    }
+    qwikRouterConfig = qwikRouterConfigActual;
+  }
   if (!qwikRouterConfig) {
     throw new Error("qwikRouterConfig is required.");
   }
-  const pathname = serverRequestEv.url.pathname;
-  const matchPathname = getRouteMatchPathname(pathname, qwikRouterConfig.trailingSlash);
+  const { pathname, isInternal } = getRouteMatchPathname(serverRequestEv.url.pathname);
+  if (pathname === "/.well-known" || pathname.startsWith("/.well-known/")) {
+    return null;
+  }
   const routeAndHandlers = await loadRequestHandlers(
     qwikRouterConfig,
-    matchPathname,
+    pathname,
     serverRequestEv.request.method,
     checkOrigin ?? true,
-    render
+    render,
+    isInternal
   );
   if (routeAndHandlers) {
     const [route, requestHandlers] = routeAndHandlers;
     const rebuildRouteInfo = async (url) => {
-      const matchPathname2 = getRouteMatchPathname(url.pathname, qwikRouterConfig.trailingSlash);
+      const { pathname: pathname2 } = getRouteMatchPathname(url.pathname);
       const routeAndHandlers2 = await loadRequestHandlers(
         qwikRouterConfig,
-        matchPathname2,
+        pathname2,
         serverRequestEv.request.method,
         checkOrigin ?? true,
-        render
+        render,
+        isInternal
       );
       if (routeAndHandlers2) {
         const [loadedRoute, requestHandlers2] = routeAndHandlers2;
@@ -1482,22 +1357,21 @@ async function requestHandler(serverRequestEv, opts, qwikSerializer) {
       route,
       requestHandlers,
       rebuildRouteInfo,
-      qwikRouterConfig.trailingSlash,
-      qwikRouterConfig.basePathname,
-      qwikSerializer
+      qwikRouterConfig.basePathname
     );
   }
   return null;
 }
-async function loadRequestHandlers(qwikRouterConfig, pathname, method, checkOrigin, renderFn) {
+async function loadRequestHandlers(qwikRouterConfig, pathname, method, checkOrigin, renderFn, isInternal) {
   const { routes, serverPlugins, menus, cacheModules } = qwikRouterConfig;
-  const route = await loadRoute(routes, menus, cacheModules, pathname);
+  const route = await loadRoute(routes, menus, cacheModules, pathname, isInternal);
   const requestHandlers = resolveRequestHandlers(
     serverPlugins,
     route,
     method,
     checkOrigin,
-    renderQwikMiddleware(renderFn)
+    renderQwikMiddleware(renderFn),
+    isInternal
   );
   if (requestHandlers.length > 0) {
     return [route, requestHandlers];
@@ -1505,8 +1379,67 @@ async function loadRequestHandlers(qwikRouterConfig, pathname, method, checkOrig
   return null;
 }
 
-// packages/qwik-router/src/middleware/request-handler/polyfill.ts
-var _TextEncoderStream_polyfill = class {
+const notFounds = [
+  // Will be replaced in post-build with the 404s generated by SSG
+  "__QWIK_ROUTER_NOT_FOUND_ARRAY__"
+];
+function getNotFound(prefix) {
+  for (const [path, html] of notFounds) {
+    if (prefix.startsWith(path)) {
+      return html;
+    }
+  }
+  return minimalHtmlResponse(404, "Resource Not Found");
+}
+
+const staticPaths = /* @__PURE__ */ new Set(["__QWIK_ROUTER_STATIC_PATHS_ARRAY__"]);
+function isStaticPath(method, url) {
+  if (method.toUpperCase() !== "GET") {
+    return false;
+  }
+  const p = url.pathname;
+  if (p.startsWith("/" + (globalThis.__QWIK_BUILD_DIR__ || "build") + "/")) {
+    return true;
+  }
+  if (p.startsWith("/" + (globalThis.__QWIK_ASSETS_DIR__ || "assets") + "/")) {
+    return true;
+  }
+  if (staticPaths.has(p)) {
+    return true;
+  }
+  if (p.endsWith("/q-data.json")) {
+    const pWithoutQdata = p.replace(/\/q-data.json$/, "");
+    if (staticPaths.has(pWithoutQdata + "/")) {
+      return true;
+    }
+    if (staticPaths.has(pWithoutQdata)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+class ServerError extends Error {
+  constructor(status, data) {
+    super(typeof data === "string" ? data : void 0);
+    this.status = status;
+    this.data = data;
+  }
+}
+
+class AbortMessage {
+}
+class RedirectMessage extends AbortMessage {
+}
+
+class RewriteMessage extends AbortMessage {
+  constructor(pathname) {
+    super();
+    this.pathname = pathname;
+  }
+}
+
+class _TextEncoderStream_polyfill {
   #pendingHighSurrogate = null;
   #handle = new TextEncoder();
   #transform = new TransformStream({
@@ -1523,14 +1456,14 @@ var _TextEncoderStream_polyfill = class {
             finalChunk += highSurrogate + item;
             continue;
           }
-          finalChunk += "\uFFFD";
+          finalChunk += "�";
         }
         if (55296 <= codeUnit && codeUnit <= 56319) {
           this.#pendingHighSurrogate = item;
           continue;
         }
         if (56320 <= codeUnit && codeUnit <= 57343) {
-          finalChunk += "\uFFFD";
+          finalChunk += "�";
           continue;
         }
         finalChunk += item;
@@ -1557,14 +1490,6 @@ var _TextEncoderStream_polyfill = class {
   get [Symbol.toStringTag]() {
     return "TextEncoderStream";
   }
-};
-export {
-  AbortMessage,
-  RedirectMessage,
-  RewriteMessage,
-  ServerError,
-  _TextEncoderStream_polyfill,
-  getErrorHtml,
-  mergeHeadersCookies,
-  requestHandler
-};
+}
+
+export { AbortMessage, RedirectMessage, RequestEvShareQData, RewriteMessage, ServerError, _TextEncoderStream_polyfill, _asyncRequestStore, getErrorHtml, getNotFound, isStaticPath, mergeHeadersCookies, requestHandler };