@qwik.dev/router 2.0.0-beta.43 → 2.0.0-beta.47

package/lib/chunks/user-response.mjs

@@ -1,13 +1,14 @@
 import { t as ensureSlash } from "./pathname.mjs";
-import { C as getRouteLoaderValues, D as loadRouteLoader, G as QACTION_KEY, J as Q_ROUTE, K as QDATA_KEY, N as setRouteLoaders, O as matchesRouteLoaderId, S as getRouteLoaderResponse, Y as _asyncRequestStore, a as isPromise, f as FULLPATH_HEADER, h as clearRouteLoaderData, k as resolveRouteLoaderByHash, q as QFN_KEY, r as resolveRouteConfig, v as getLoaderRequestEvent, x as getRouteLoaderCtx } from "./head.qwik.mjs";
+import { A as loadRouteLoader, D as getRouteLoaderValues, E as getRouteLoaderResponse, N as resolveRouteLoaderByHash, R as setRouteLoaders, T as getRouteLoaderParams, a as isPromise, at as RequestEvRouterConfig, f as FULLPATH_HEADER, g as clearRouteLoaderData, it as Q_ROUTE, j as matchesRouteLoaderId, nt as QDATA_KEY, ot as _asyncRequestStore, r as resolveRouteConfig, rt as QFN_KEY, tt as QACTION_KEY, w as getRouteLoaderCtx, x as getLoaderRequestEvent } from "./head.qwik.mjs";
 import { a as QLoaderId, c as resolveValidInternalFullPathname, i as QActionId, s as recognizeRequest, t as IsQAction, u as trimRecognizedInternalPathname } from "./request-path.mjs";
-import { i as RedirectMessage, n as throwIfControlFlowSignal, r as AbortMessage, t as ServerError } from "./server-error.mjs";
+import { a as shareClassIdentity, i as RedirectMessage, n as throwIfControlFlowSignal, r as AbortMessage, t as ServerError } from "./server-error.mjs";
 import { inlinedQrl, isDev } from "@qwik.dev/core";
 import { _deserialize, _serialize, _verifySerializable, isDev as isDev$1 } from "@qwik.dev/core/internal";
 /**
 * FNV-1a 32-bit hash for generating eTags from response data. Cheap to compute, sufficient
 * collision resistance for cache validation (not cryptographic).
-*/ function hash(str) {
+*/
+function hash(str) {
 	let hash = 2166136261;
 	for (let i = 0; i < str.length; i++) {
 		hash ^= str.charCodeAt(i);
@@ -21,7 +22,8 @@ import { _deserialize, _serialize, _verifySerializable, isDev as isDev$1 } from
 * character outside RFC 7232's `etagc` grammar (printable ASCII except DQUOTE — no escape mechanism
 * exists, and non-ASCII bytes are mangled by many HTTP stacks even though `obs-text` technically
 * permits them). Idempotent.
-*/ function normalizeETag(raw) {
+*/
+function normalizeETag(raw) {
 	let tag = raw.trim();
 	if (tag.endsWith("\"") && tag.startsWith("W/\"")) tag = tag.slice(3);
 	tag = tag.replace(/[^!#-~]/g, "");
@@ -35,7 +37,8 @@ function setETagHeader(requestEv, normalizedETag) {
 * Set the strong ETag header on the response and check the request's `If-None-Match` against it.
 * The eTag argument must already be normalized. Returns true if a 304 was sent (caller should stop
 * processing).
-*/ function performETagMatch(requestEv, normalizedETag) {
+*/
+function performETagMatch(requestEv, normalizedETag, beforeNotModified) {
 	setETagHeader(requestEv, normalizedETag);
 	const ifNoneMatch = requestEv.request.headers.get("If-None-Match");
 	if (ifNoneMatch) {
@@ -47,6 +50,7 @@ function setETagHeader(requestEv, normalizedETag) {
 			}
 		}
 		if (found) {
+			beforeNotModified?.();
 			requestEv.status(304);
 			requestEv.send(304, "");
 			return true;
@@ -100,6 +104,20 @@ var UNIT = {
 	days: 86400,
 	weeks: 604800
 };
+var createSetCookieValue = (cookieName, cookieValue, options) => {
+	const c = [`${cookieName}=${cookieValue}`];
+	if (typeof options.domain === "string") c.push(`Domain=${options.domain}`);
+	if (typeof options.maxAge === "number") c.push(`Max-Age=${options.maxAge}`);
+	else if (Array.isArray(options.maxAge)) c.push(`Max-Age=${options.maxAge[0] * UNIT[options.maxAge[1]]}`);
+	else if (typeof options.expires === "number" || typeof options.expires == "string") c.push(`Expires=${options.expires}`);
+	else if (options.expires instanceof Date) c.push(`Expires=${options.expires.toUTCString()}`);
+	if (options.httpOnly) c.push("HttpOnly");
+	if (typeof options.path === "string") c.push(`Path=${options.path}`);
+	const sameSite = resolveSameSite(options.sameSite);
+	if (sameSite) c.push(`SameSite=${sameSite}`);
+	if (options.secure) c.push("Secure");
+	return c.join("; ");
+};
 function tryDecodeUriComponent(str) {
 	try {
 		return decodeURIComponent(str);
@@ -123,20 +141,6 @@ function resolveSameSite(sameSite) {
 	if (sameSite === false) return "None";
 	if (sameSite) return SAMESITE[sameSite];
 }
-var createSetCookieValue = (cookieName, cookieValue, options) => {
-	const c = [`${cookieName}=${cookieValue}`];
-	if (typeof options.domain === "string") c.push(`Domain=${options.domain}`);
-	if (typeof options.maxAge === "number") c.push(`Max-Age=${options.maxAge}`);
-	else if (Array.isArray(options.maxAge)) c.push(`Max-Age=${options.maxAge[0] * UNIT[options.maxAge[1]]}`);
-	else if (typeof options.expires === "number" || typeof options.expires == "string") c.push(`Expires=${options.expires}`);
-	else if (options.expires instanceof Date) c.push(`Expires=${options.expires.toUTCString()}`);
-	if (options.httpOnly) c.push("HttpOnly");
-	if (typeof options.path === "string") c.push(`Path=${options.path}`);
-	const sameSite = resolveSameSite(options.sameSite);
-	if (sameSite) c.push(`SameSite=${sameSite}`);
-	if (options.secure) c.push("Secure");
-	return c.join("; ");
-};
 var REQ_COOKIE = Symbol("request-cookies");
 var RES_COOKIE = Symbol("response-cookies");
 var LIVE_COOKIE = Symbol("live-cookies");
@@ -192,7 +196,8 @@ var Cookie = class {
 		return Object.values(this[RES_COOKIE]);
 	}
 };
-/** @public */ var mergeHeadersCookies = (headers, cookies) => {
+/** @public */
+var mergeHeadersCookies = (headers, cookies) => {
 	const cookieHeaders = cookies.headers();
 	if (cookieHeaders.length > 0) {
 		const newHeaders = new Headers(headers);
@@ -201,12 +206,15 @@ var Cookie = class {
 	}
 	return headers;
 };
-/** @public */ var RewriteMessage = class extends AbortMessage {
+/** @public */
+var RewriteMessage = class extends AbortMessage {
 	pathname;
 	constructor(pathname) {
-		super(), this.pathname = pathname;
+		super();
+		this.pathname = pathname;
 	}
 };
+shareClassIdentity(RewriteMessage, "RewriteMessage");
 var encoder = /*#__PURE__*/ new TextEncoder();
 function getContentType(headers) {
 	return (headers.get("content-type")?.split(/[;,]/, 1)[0].trim() ?? "").toLowerCase();
@@ -225,108 +233,9 @@ var RequestEvSharedNonce = "@nonce";
 var RequestEvIsRewrite = "@rewrite";
 var RequestEvShareServerTiming = "@serverTiming";
 var RequestEvETagCacheKey = "@eTagCacheKey";
-var RequestEvErrorBoundaryCaught = "@errorBoundaryCaught";
+var RequestEvCaughtError = "@caughtError";
 var RequestEvHttpStatusMessage = "@httpStatusMessage";
-function getRequestRoute(requestEv) {
-	return requestEv[RequestEvRoute];
-}
-function getRequestMode(requestEv) {
-	return requestEv[RequestEvMode];
-}
-var ABORT_INDEX = Number.MAX_SAFE_INTEGER;
-var isDangerousKey = (k) => k === "__proto__" || k === "constructor" || k === "prototype";
-var isArrayIndexKey = (k) => /^(0|[1-9]\d*)$/.test(k);
-var createFormPathNode = () => ({
-	children: /* @__PURE__ */ new Map(),
-	isArray: true
-});
-var getFormPathTree = (formData) => {
-	const root = createFormPathNode();
-	for (const [name] of formData) {
-		const keys = name.split(".");
-		let hasDangerousKey = false;
-		for (const key of keys) if (isDangerousKey(key)) {
-			hasDangerousKey = true;
-			break;
-		}
-		if (hasDangerousKey) continue;
-		let pathNode = root;
-		for (let i = 0; i < keys.length - 1; i++) {
-			const key = keys[i];
-			if (key.endsWith("[]")) break;
-			let childNode = pathNode.children.get(key);
-			if (!childNode) {
-				childNode = createFormPathNode();
-				pathNode.children.set(key, childNode);
-			}
-			if (!isArrayIndexKey(keys[i + 1])) childNode.isArray = false;
-			pathNode = childNode;
-		}
-	}
-	return root;
-};
-var formToObj = (formData) => {
-	/**
-	* Convert FormData to object Handle nested form input using dot notation Handle array input using
-	* indexed dot notation (name.0, name.0) or bracket notation (name[]), the later is needed for
-	* multiselects Create values object by form data entries
-	*/ const values = Object.create(null);
-	const pathTree = getFormPathTree(formData);
-	for (const [name, value] of formData) {
-		const keys = name.split(".");
-		let hasDangerousKey = false;
-		for (let i = 0; i < keys.length; i++) if (isDangerousKey(keys[i])) {
-			hasDangerousKey = true;
-			break;
-		}
-		if (hasDangerousKey) continue;
-		let object = values;
-		let pathNode = pathTree;
-		for (let i = 0; i < keys.length; i++) {
-			const key = keys[i];
-			if (key.endsWith("[]")) {
-				const arrayKey = key.slice(0, -2);
-				if (isDangerousKey(arrayKey)) break;
-				const existingValue = object[arrayKey];
-				if (existingValue !== void 0 && !Array.isArray(existingValue)) break;
-				object[arrayKey] = existingValue || [];
-				object[arrayKey].push(value);
-				break;
-			}
-			if (Array.isArray(object) && !isArrayIndexKey(key)) break;
-			if (i < keys.length - 1) {
-				const childNode = pathNode.children.get(key);
-				const nextValue = object[key];
-				if (nextValue !== void 0) {
-					object = nextValue;
-					pathNode = childNode;
-					continue;
-				}
-				object = object[key] = childNode.isArray ? [] : Object.create(null);
-				pathNode = childNode;
-			} else object[key] = value;
-		}
-	}
-	return values;
-};
-var parseRequest = async ({ request, method, query }, sharedMap) => {
-	const type = getContentType(request.headers);
-	if (type === "application/x-www-form-urlencoded" || type === "multipart/form-data") {
-		const formData = await request.formData();
-		sharedMap.set(RequestEvSharedActionFormData, formData);
-		return formToObj(formData);
-	} else if (type === "application/json") return await request.json();
-	else if (type === "application/qwik-json") {
-		if (method === "GET" && query.has("qdata")) {
-			const data = query.get(QDATA_KEY);
-			if (data) try {
-				return await _deserialize(decodeURIComponent(data));
-			} catch {}
-		}
-		return await _deserialize(await request.text());
-	}
-};
-function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, basePathname, resolved) {
+function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, basePathname, resolved, routerConfig) {
 	const { request, platform, env } = serverRequestEv;
 	const sharedMap = /* @__PURE__ */ new Map();
 	const cookie = new Cookie(request.headers.get("cookie"));
@@ -404,6 +313,7 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, baseP
 	};
 	const requestEv = {
 		[RequestEvMode]: serverRequestEv.mode,
+		[RequestEvRouterConfig]: routerConfig,
 		get [RequestEvRoute]() {
 			return loadedRoute;
 		},
@@ -444,13 +354,13 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, baseP
 			check();
 			headers.set(target, createCacheControl(cacheControl));
 		},
-		resolveValue: async (loaderOrAction) => {
+		resolveValue: (async (loaderOrAction) => {
 			if (loaderOrAction.__brand === "server_loader") {
 				const loaderValues = getRouteLoaderValues(requestEv);
 				if (loaderOrAction.__id in loaderValues) return loaderValues[loaderOrAction.__id];
 				return loadRouteLoader(loaderOrAction, requestEv);
 			}
-		},
+		}),
 		status: (statusCode) => {
 			if (typeof statusCode === "number") {
 				check();
@@ -472,8 +382,8 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, baseP
 			check();
 			status = statusCode;
 			if (url) {
-				if (/^\/\//.test(url) || /([^:])\/\/+/.test(url)) {
-					const fixedURL = url.replace(/^\/\/+/, "/").replace(/([^:])\/\/+/g, "$1/");
+				if (/^[/\\]{2,}/.test(url) || /([^:])[/\\]{2,}/.test(url)) {
+					const fixedURL = url.replace(/^[/\\]{2,}/, "/").replace(/([^:])[/\\]{2,}/g, "$1/");
 					console.warn(`Redirect URL ${url} is invalid, fixing to ${fixedURL}`);
 					url = fixedURL;
 				}
@@ -535,6 +445,107 @@ function createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, baseP
 	};
 	return requestEv;
 }
+function getRequestRoute(requestEv) {
+	return requestEv[RequestEvRoute];
+}
+function getRequestMode(requestEv) {
+	return requestEv[RequestEvMode];
+}
+var ABORT_INDEX = Number.MAX_SAFE_INTEGER;
+var parseRequest = async ({ request, method, query }, sharedMap) => {
+	const type = getContentType(request.headers);
+	if (type === "application/x-www-form-urlencoded" || type === "multipart/form-data") {
+		const formData = await request.formData();
+		sharedMap.set(RequestEvSharedActionFormData, formData);
+		return formToObj(formData);
+	} else if (type === "application/json") return await request.json();
+	else if (type === "application/qwik-json") {
+		if (method === "GET" && query.has("qdata")) {
+			const data = query.get(QDATA_KEY);
+			if (data) try {
+				return await _deserialize(decodeURIComponent(data));
+			} catch {}
+		}
+		return await _deserialize(await request.text());
+	}
+};
+var isDangerousKey = (k) => k === "__proto__" || k === "constructor" || k === "prototype";
+var MAX_FORM_ARRAY_LENGTH = 1e4;
+var isArrayIndexKey = (k) => /^(0|[1-9]\d*)$/.test(k) && Number(k) < MAX_FORM_ARRAY_LENGTH;
+var createFormPathNode = () => ({
+	children: /* @__PURE__ */ new Map(),
+	isArray: true
+});
+var getFormPathTree = (formData) => {
+	const root = createFormPathNode();
+	for (const [name] of formData) {
+		const keys = name.split(".");
+		let hasDangerousKey = false;
+		for (const key of keys) if (isDangerousKey(key)) {
+			hasDangerousKey = true;
+			break;
+		}
+		if (hasDangerousKey) continue;
+		let pathNode = root;
+		for (let i = 0; i < keys.length - 1; i++) {
+			const key = keys[i];
+			if (key.endsWith("[]")) break;
+			let childNode = pathNode.children.get(key);
+			if (!childNode) {
+				childNode = createFormPathNode();
+				pathNode.children.set(key, childNode);
+			}
+			if (!isArrayIndexKey(keys[i + 1])) childNode.isArray = false;
+			pathNode = childNode;
+		}
+	}
+	return root;
+};
+var formToObj = (formData) => {
+	/**
+	* Convert FormData to object Handle nested form input using dot notation Handle array input using
+	* indexed dot notation (name.0, name.0) or bracket notation (name[]), the later is needed for
+	* multiselects Create values object by form data entries
+	*/
+	const values = Object.create(null);
+	const pathTree = getFormPathTree(formData);
+	for (const [name, value] of formData) {
+		const keys = name.split(".");
+		let hasDangerousKey = false;
+		for (let i = 0; i < keys.length; i++) if (isDangerousKey(keys[i])) {
+			hasDangerousKey = true;
+			break;
+		}
+		if (hasDangerousKey) continue;
+		let object = values;
+		let pathNode = pathTree;
+		for (let i = 0; i < keys.length; i++) {
+			const key = keys[i];
+			if (key.endsWith("[]")) {
+				const arrayKey = key.slice(0, -2);
+				if (isDangerousKey(arrayKey)) break;
+				const existingValue = object[arrayKey];
+				if (existingValue !== void 0 && !Array.isArray(existingValue)) break;
+				object[arrayKey] = existingValue || [];
+				object[arrayKey].push(value);
+				break;
+			}
+			if (Array.isArray(object) && !isArrayIndexKey(key)) break;
+			if (i < keys.length - 1) {
+				const childNode = pathNode.children.get(key);
+				const nextValue = object[key];
+				if (nextValue !== void 0) {
+					object = nextValue;
+					pathNode = childNode;
+					continue;
+				}
+				object = object[key] = childNode.isArray ? [] : Object.create(null);
+				pathNode = childNode;
+			} else object[key] = value;
+		}
+	}
+	return values;
+};
 var MAX_CACHE_SIZE = typeof globalThis.__SSR_CACHE_SIZE__ === "number" ? globalThis.__SSR_CACHE_SIZE__ : 50;
 function createLruCache() {
 	const cache = /* @__PURE__ */ new Map();
@@ -566,7 +577,8 @@ var loaderCache = createLruCache();
 /**
 * Resolve an eTag value from a ContentModuleETag (string, function, or undefined). Returns the eTag
 * string or null.
-*/ function resolveETag(eTagExport, headProps) {
+*/
+function resolveETag(eTagExport, headProps) {
 	if (eTagExport === void 0) return null;
 	if (typeof eTagExport === "function") return eTagExport(headProps);
 	return eTagExport;
@@ -574,31 +586,38 @@ var loaderCache = createLruCache();
 /**
 * Resolve a cache key from a CacheKeyFn. The default key callback is only called when `cacheKey ===
 * true`.
-*/ function resolveCacheKey(cacheKeyExport, defaultKey, requestEv, eTag) {
+*/
+function resolveCacheKey(cacheKeyExport, defaultKey, requestEv, eTag) {
 	if (cacheKeyExport === true) return defaultKey(requestEv, eTag);
 	if (typeof cacheKeyExport !== "function") return "";
 	return cacheKeyExport(requestEv, eTag) || "";
 }
-/** Build the default SSR cache key. eTag slot is dropped when no eTag was resolved. */ function defaultSsrCacheKey(requestEv, eTag) {
+/** Build the default SSR cache key. eTag slot is dropped when no eTag was resolved. */
+function defaultSsrCacheKey(requestEv, eTag) {
 	const status = requestEv.status();
-	const pathname = requestEv.url.pathname;
+	const pathname = requestEv.originalUrl.pathname;
 	return eTag ? `${status}|${eTag}|${pathname}` : `${status}|${pathname}`;
 }
-/** Build the default loader cache key. eTag slot is dropped when no eTag was resolved. */ function defaultLoaderCacheKey(requestEv, eTag) {
+/** Build the default loader cache key. eTag slot is dropped when no eTag was resolved. */
+function defaultLoaderCacheKey(requestEv, eTag) {
 	const loaderId = requestEv.sharedMap.get(QLoaderId);
 	const base = `${requestEv.url.pathname}|${requestEv.url.search}|${loaderId}`;
 	return eTag ? `${base}|${eTag}` : base;
 }
-/** Get a cached SSR entry by key (LRU touch). */ function getCachedSsr(key) {
+/** Get a cached SSR entry by key (LRU touch). */
+function getCachedSsr(key) {
 	return ssrCache.get(key);
 }
-/** Cache an SSR entry by key, evicting the least recently used entry if at capacity. */ function setCachedSsr(key, entry) {
+/** Cache an SSR entry by key, evicting the least recently used entry if at capacity. */
+function setCachedSsr(key, entry) {
 	ssrCache.set(key, entry);
 }
-/** Get a cached loader entry by key (LRU touch). */ function getCachedLoader(key) {
+/** Get a cached loader entry by key (LRU touch). */
+function getCachedLoader(key) {
 	return loaderCache.get(key);
 }
-/** Cache a loader entry by key, evicting the least recently used entry if at capacity. */ function setCachedLoader(key, entry) {
+/** Cache a loader entry by key, evicting the least recently used entry if at capacity. */
+function setCachedLoader(key, entry) {
 	loaderCache.set(key, entry);
 }
 /**
@@ -608,7 +627,8 @@ var loaderCache = createLruCache();
 * cleared.
 *
 * @public
-*/ function clearSsrCache(cacheKey) {
+*/
+function clearSsrCache(cacheKey) {
 	ssrCache.clear(cacheKey);
 }
 /**
@@ -618,59 +638,25 @@ var loaderCache = createLruCache();
 * cleared.
 *
 * @public
-*/ function clearLoaderCache(cacheKey) {
+*/
+function clearLoaderCache(cacheKey) {
 	loaderCache.clear(cacheKey);
 }
 /**
 * Create per-loader request event views. Loader-specific URL/search data is scoped to the view,
 * while request-wide state (headers, cookies, loader value maps, etc.) still delegates to the
 * original request event.
-*/ function createLoaderRequestEventFactory(requestEv) {
+*/
+function createLoaderRequestEventFactory(requestEv) {
 	return (loader) => getLoaderRequestEvent(loader, requestEv);
 }
 /**
-* Resolve the loader's cacheControl option. Loaders default to `no-cache` so the browser always
-* revalidates; pair with `eTag` for cheap 304s. A function form may return `null` to skip the
-* header entirely.
-*/ function resolveLoaderCacheControl(option, requestEv) {
-	const value = typeof option === "function" ? option(requestEv) : option;
-	return value === void 0 ? "no-cache" : value;
-}
-async function runBlockingLoadersBeforeTarget(routeLoaders, targetLoader, requestEv) {
-	for (const loader of routeLoaders) {
-		if (loader === targetLoader) return;
-		if (loader.__blockSSR) await loadRouteLoader(loader, requestEv);
-	}
-}
-function setLoaderData(requestEv, routeLoaders, loaderPaths) {
-	if (loaderPaths) Object.assign(getRouteLoaderCtx(requestEv).loaderPaths, loaderPaths);
-	setRouteLoaders(requestEv, routeLoaders);
-}
-/** Resolve eTag from a static string or function (before running the loader). */ function resolvePreETag(eTagOption, requestEv) {
-	if (typeof eTagOption === "string") return normalizeETag(eTagOption);
-	const result = eTagOption(requestEv);
-	return result ? normalizeETag(result) : "";
-}
-function addVaryHeader(requestEv, value) {
-	const vary = requestEv.headers.get("Vary");
-	if (!vary) {
-		requestEv.headers.set("Vary", value);
-		return;
-	}
-	if (!vary.split(",").map((item) => item.trim().toLowerCase()).includes(value.toLowerCase())) requestEv.headers.set("Vary", `${vary}, ${value}`);
-}
-async function sendLoaderResponse(requestEv, data, cacheControl) {
-	requestEv.headers.set("Content-Type", "application/json; charset=utf-8");
-	addVaryHeader(requestEv, FULLPATH_HEADER);
-	if (cacheControl !== null && !requestEv.headers.has("Cache-Control")) requestEv.cacheControl(cacheControl);
-	requestEv.send(200, data);
-}
-/**
 * Handler that executes the requested loader and returns the result as JSON. Runs AFTER
 * plugin/route middleware, so middleware redirects/errors are handled by `jsonRequestWrapper`. The
 * loader function's own redirects/errors are caught by getRouteLoaderResponse and serialized in the
 * LoaderResponse envelope ({ d, r, e }).
-*/ function loaderHandler(routeLoaders, loaderPaths) {
+*/
+function loaderHandler(routeLoaders, loaderPaths) {
 	return async (requestEvent) => {
 		const requestEv = requestEvent;
 		if (!requestEv.sharedMap.has("@isQLoader")) return;
@@ -685,15 +671,18 @@ async function sendLoaderResponse(requestEv, data, cacheControl) {
 		await runBlockingLoadersBeforeTarget(routeLoaders, loader, requestEv);
 		const loaderRequestEv = createLoaderRequestEventFactory(requestEv)(loader);
 		const cacheControl = resolveLoaderCacheControl(loader.__cacheControl, loaderRequestEv);
+		const applyCacheControl = () => {
+			if (cacheControl !== null && !requestEv.headers.has("Cache-Control")) requestEv.cacheControl(cacheControl);
+		};
 		const normalizedETag = loader.__eTag !== void 0 ? resolvePreETag(loader.__eTag, loaderRequestEv) : "";
-		if (normalizedETag && performETagMatch(loaderRequestEv, normalizedETag)) return;
+		if (normalizedETag && performETagMatch(loaderRequestEv, normalizedETag, applyCacheControl)) return;
 		let cacheKey = "";
 		if (loader.__cacheKey) cacheKey = resolveCacheKey(loader.__cacheKey, defaultLoaderCacheKey, loaderRequestEv, normalizedETag);
 		if (cacheKey) {
 			const cached = getCachedLoader(cacheKey);
 			if (cached) {
 				if (!normalizedETag) {
-					if (performETagMatch(loaderRequestEv, cached.eTag)) return;
+					if (performETagMatch(loaderRequestEv, cached.eTag, applyCacheControl)) return;
 				} else setETagHeader(loaderRequestEv, cached.eTag);
 				await sendLoaderResponse(requestEv, cached.body, cacheControl);
 				return;
@@ -708,13 +697,53 @@ async function sendLoaderResponse(requestEv, data, cacheControl) {
 			eTag: finalETag,
 			body: data
 		});
-		if (!normalizedETag && finalETag && performETagMatch(loaderRequestEv, finalETag)) return;
+		if (!normalizedETag && finalETag && performETagMatch(loaderRequestEv, finalETag, applyCacheControl)) return;
 		await sendLoaderResponse(requestEv, data, cacheControl);
 	};
 }
-/** Serialize and send a JSON response (used by error/redirect paths in jsonRequestWrapper). */ async function sendJsonResponse(requestEv, responseData, status = 200) {
+/**
+* Resolve the loader's cacheControl option. Loaders default to private revalidation; pair with
+* `eTag` for cheap 304s. A function form may return `null` to skip the header entirely.
+*/
+function resolveLoaderCacheControl(option, requestEv) {
+	const value = typeof option === "function" ? option(requestEv) : option;
+	return value === void 0 ? "private" : value;
+}
+async function runBlockingLoadersBeforeTarget(routeLoaders, targetLoader, requestEv) {
+	for (const loader of routeLoaders) {
+		if (loader === targetLoader) return;
+		if (loader.__blockSSR) await loadRouteLoader(loader, requestEv);
+	}
+}
+function setLoaderData(requestEv, routeLoaders, loaderPaths) {
+	if (loaderPaths) Object.assign(getRouteLoaderCtx(requestEv).loaderPaths, loaderPaths);
+	setRouteLoaders(requestEv, routeLoaders);
+}
+/** Resolve eTag from a static string or function (before running the loader). */
+function resolvePreETag(eTagOption, requestEv) {
+	if (typeof eTagOption === "string") return normalizeETag(eTagOption);
+	const result = eTagOption(requestEv);
+	return result ? normalizeETag(result) : "";
+}
+async function sendLoaderResponse(requestEv, data, cacheControl) {
+	requestEv.headers.set("Content-Type", "application/json; charset=utf-8");
+	addVaryHeader(requestEv, FULLPATH_HEADER);
+	if (cacheControl !== null && !requestEv.headers.has("Cache-Control")) requestEv.cacheControl(cacheControl);
+	requestEv.send(200, data);
+}
+function addVaryHeader(requestEv, value) {
+	const vary = requestEv.headers.get("Vary");
+	if (!vary) {
+		requestEv.headers.set("Vary", value);
+		return;
+	}
+	if (!vary.split(",").map((item) => item.trim().toLowerCase()).includes(value.toLowerCase())) requestEv.headers.set("Vary", `${vary}, ${value}`);
+}
+/** Serialize and send a JSON response (used by error/redirect paths in jsonRequestWrapper). */
+async function sendJsonResponse(requestEv, responseData, status = 200) {
 	const data = await _serialize(responseData);
 	requestEv.headers.set("Content-Type", "application/json; charset=utf-8");
+	if (!requestEv.headers.has("Cache-Control")) requestEv.cacheControl("private");
 	requestEv.send(status, data);
 }
 async function sendActionResponse(requestEv, responseData) {
@@ -731,7 +760,8 @@ async function sendActionResponse(requestEv, responseData) {
 * By calling `await next()` inside a try/catch, middleware redirects and errors are captured and
 * returned as JSON envelopes instead of HTTP redirects/error pages. This keeps SPA navigation
 * intact on the client.
-*/ function jsonRequestWrapper() {
+*/
+function jsonRequestWrapper() {
 	return async (requestEvent) => {
 		const requestEv = requestEvent;
 		const isLoader = requestEv.internalRequest === "loader";
@@ -771,38 +801,6 @@ async function sendActionResponse(requestEv, responseData) {
 		}
 	};
 }
-function verifySerializable$1(data, qrl) {
-	try {
-		_verifySerializable(data, void 0);
-	} catch (e) {
-		if (e instanceof Error && qrl.dev) e.loc = qrl.dev;
-		throw e;
-	}
-}
-async function measure$1(requestEv, name, fn) {
-	const start = performance.now();
-	try {
-		return await fn();
-	} finally {
-		const duration = performance.now() - start;
-		let measurements = requestEv.sharedMap.get("@serverTiming");
-		if (!measurements) requestEv.sharedMap.set("@serverTiming", measurements = []);
-		measurements.push([name, duration]);
-	}
-}
-async function runValidators(requestEv, validators, data, devMode) {
-	let lastResult = {
-		success: true,
-		data
-	};
-	if (validators) for (const validator of validators) {
-		if (devMode) lastResult = await measure$1(requestEv, `validator$`, () => validator.validate(requestEv, data));
-		else lastResult = await validator.validate(requestEv, data);
-		if (!lastResult.success) return lastResult;
-		else data = lastResult.data;
-	}
-	return lastResult;
-}
 /**
 * Handler for action requests (`?qaction={actionId}`).
 *
@@ -812,7 +810,8 @@ async function runValidators(requestEv, validators, data, devMode) {
 * If the action has no `invalidate` list, the client invalidates all current route loaders unless
 * strict loaders mode treats it as `invalidate: []`. If `invalidate` is specified, only those
 * loader hashes are sent for the client to re-fetch.
-*/ function actionHandler(routeActions) {
+*/
+function actionHandler(routeActions) {
 	return async (requestEvent) => {
 		const requestEv = requestEvent;
 		if (!requestEv.sharedMap.has("@isQAction")) return;
@@ -852,10 +851,43 @@ async function runValidators(requestEv, validators, data, devMode) {
 		requestEv.send(requestEv.status(), serialized);
 	};
 }
+async function runValidators(requestEv, validators, data, devMode) {
+	let lastResult = {
+		success: true,
+		data
+	};
+	if (validators) for (const validator of validators) {
+		if (devMode) lastResult = await measure$1(requestEv, `validator$`, () => validator.validate(requestEv, data));
+		else lastResult = await validator.validate(requestEv, data);
+		if (!lastResult.success) return lastResult;
+		else data = lastResult.data;
+	}
+	return lastResult;
+}
+function verifySerializable$1(data, qrl) {
+	try {
+		_verifySerializable(data, void 0);
+	} catch (e) {
+		if (e instanceof Error && qrl.dev) e.loc = qrl.dev;
+		throw e;
+	}
+}
+async function measure$1(requestEv, name, fn) {
+	const start = performance.now();
+	try {
+		return await fn();
+	} finally {
+		const duration = performance.now() - start;
+		let measurements = requestEv.sharedMap.get("@serverTiming");
+		if (!measurements) requestEv.sharedMap.set("@serverTiming", measurements = []);
+		measurements.push([name, duration]);
+	}
+}
 /**
 * A set of static paths generated by the SSG, including loader json. Routes always have a trailing
 * slash, short for `.../index.html`
-*/ var staticPaths = /* @__PURE__ */ new Set(["__QWIK_ROUTER_STATIC_PATHS_ARRAY__"]);
+*/
+var staticPaths = /* @__PURE__ */ new Set(["__QWIK_ROUTER_STATIC_PATHS_ARRAY__"]);
 /**
 * Check if the current pathname needs a redirect due to trailing slash mismatch. If we're not sure,
 * we fall through.
@@ -864,7 +896,8 @@ async function runValidators(requestEv, validators, data, devMode) {
 *
 * @returns The canonical path with the correct trailing slash if a redirect is needed, otherwise
 *   `undefined`.
-*/ function getStaticPathRedirect(method, url) {
+*/
+function getStaticPathRedirect(method, url) {
 	const { pathname, search } = url;
 	if (method.toUpperCase() !== "GET" || pathname === "/" || !pathname.startsWith("/") || pathname.startsWith("//")) return;
 	const hasTrailingSlash = pathname.endsWith("/");
@@ -877,12 +910,14 @@ async function runValidators(requestEv, validators, data, devMode) {
 * Decide whether a given request path is a static path, for optimizing file access.
 *
 * @internal
-*/ function isStaticPath(method, url) {
+*/
+function isStaticPath(method, url) {
 	method = method.toUpperCase();
 	if (method !== "GET" && method !== "HEAD") return false;
 	const p = url.pathname;
-	if (p.startsWith("/" + (globalThis.__QWIK_BUILD_DIR__ || "build") + "/")) return true;
-	if (p.startsWith("/" + (globalThis.__QWIK_ASSETS_DIR__ || "assets") + "/")) return true;
+	const basePathname = globalThis.__QWIK_ROUTER_BASE_PATHNAME__ || "/";
+	if (p.startsWith(basePathname + (globalThis.__QWIK_BUILD_DIR__ || "build") + "/")) return true;
+	if (p.startsWith(basePathname + (globalThis.__QWIK_ASSETS_DIR__ || "assets") + "/")) return true;
 	if (globalThis.__NO_TRAILING_SLASH__ && p !== "/") return !p.endsWith("/") && (staticPaths.has(p) || staticPaths.has(p + "/"));
 	return staticPaths.has(p);
 }
@@ -890,7 +925,8 @@ async function runValidators(requestEv, validators, data, devMode) {
 * Hypertext Transfer Protocol (HTTP) response status codes.
 *
 * @see {@link https://en.wikipedia.org/wiki/List_of_HTTP_status_codes}
-*/ var HttpStatus = /*#__PURE__*/ function(HttpStatus) {
+*/
+var HttpStatus = /* @__PURE__ */ function(HttpStatus) {
 	/**
 	* The server has received the request headers and the client should proceed to send the request
 	* body (in the case of a request for which a body needs to be sent; for example, a POST request).
@@ -899,59 +935,74 @@ async function runValidators(requestEv, validators, data, devMode) {
 	* Expect: 100-continue as a header in its initial request and receive a 100 Continue status code
 	* in response before sending the body. The response 417 Expectation Failed indicates the request
 	* should not be continued.
-	*/ HttpStatus[HttpStatus["Continue"] = 100] = "Continue";
-	/** The requester has asked the server to switch protocols and the server has agreed to do so. */ HttpStatus[HttpStatus["SwitchingProtocols"] = 101] = "SwitchingProtocols";
+	*/
+	HttpStatus[HttpStatus["Continue"] = 100] = "Continue";
+	/** The requester has asked the server to switch protocols and the server has agreed to do so. */
+	HttpStatus[HttpStatus["SwitchingProtocols"] = 101] = "SwitchingProtocols";
 	/**
 	* A WebDAV request may contain many sub-requests involving file operations, requiring a long time
 	* to complete the request. This code indicates that the server has received and is processing the
 	* request, but no response is available yet. This prevents the client from timing out and
 	* assuming the request was lost.
-	*/ HttpStatus[HttpStatus["Processing"] = 102] = "Processing";
+	*/
+	HttpStatus[HttpStatus["Processing"] = 102] = "Processing";
 	/**
 	* Standard response for successful HTTP requests. The actual response will depend on the request
 	* method used. In a GET request, the response will contain an entity corresponding to the
 	* requested resource. In a POST request, the response will contain an entity describing or
 	* containing the result of the action.
-	*/ HttpStatus[HttpStatus["Ok"] = 200] = "Ok";
-	/** The request has been fulfilled, resulting in the creation of a new resource. */ HttpStatus[HttpStatus["Created"] = 201] = "Created";
+	*/
+	HttpStatus[HttpStatus["Ok"] = 200] = "Ok";
+	/** The request has been fulfilled, resulting in the creation of a new resource. */
+	HttpStatus[HttpStatus["Created"] = 201] = "Created";
 	/**
 	* The request has been accepted for processing, but the processing has not been completed. The
 	* request might or might not be eventually acted upon, and may be disallowed when processing
 	* occurs.
-	*/ HttpStatus[HttpStatus["Accepted"] = 202] = "Accepted";
+	*/
+	HttpStatus[HttpStatus["Accepted"] = 202] = "Accepted";
 	/**
 	* SINCE HTTP/1.1 The server is a transforming proxy that received a 200 OK from its origin, but
 	* is returning a modified version of the origin's response.
-	*/ HttpStatus[HttpStatus["NonAuthoritativeInformation"] = 203] = "NonAuthoritativeInformation";
-	/** The server successfully processed the request and is not returning any content. */ HttpStatus[HttpStatus["NoContent"] = 204] = "NoContent";
+	*/
+	HttpStatus[HttpStatus["NonAuthoritativeInformation"] = 203] = "NonAuthoritativeInformation";
+	/** The server successfully processed the request and is not returning any content. */
+	HttpStatus[HttpStatus["NoContent"] = 204] = "NoContent";
 	/**
 	* The server successfully processed the request, but is not returning any content. Unlike a 204
 	* response, this response requires that the requester reset the document view.
-	*/ HttpStatus[HttpStatus["ResetContent"] = 205] = "ResetContent";
+	*/
+	HttpStatus[HttpStatus["ResetContent"] = 205] = "ResetContent";
 	/**
 	* The server is delivering only part of the resource (byte serving) due to a range header sent by
 	* the client. The range header is used by HTTP clients to enable resuming of interrupted
 	* downloads, or split a download into multiple simultaneous streams.
-	*/ HttpStatus[HttpStatus["PartialContent"] = 206] = "PartialContent";
+	*/
+	HttpStatus[HttpStatus["PartialContent"] = 206] = "PartialContent";
 	/**
 	* The message body that follows is an XML message and can contain a number of separate response
 	* codes, depending on how many sub-requests were made.
-	*/ HttpStatus[HttpStatus["MultiStatus"] = 207] = "MultiStatus";
+	*/
+	HttpStatus[HttpStatus["MultiStatus"] = 207] = "MultiStatus";
 	/**
 	* The members of a DAV binding have already been enumerated in a preceding part of the
 	* (multistatus) response, and are not being included again.
-	*/ HttpStatus[HttpStatus["AlreadyReported"] = 208] = "AlreadyReported";
+	*/
+	HttpStatus[HttpStatus["AlreadyReported"] = 208] = "AlreadyReported";
 	/**
 	* The server has fulfilled a request for the resource, and the response is a representation of
 	* the result of one or more instance-manipulations applied to the current instance.
-	*/ HttpStatus[HttpStatus["ImUsed"] = 226] = "ImUsed";
+	*/
+	HttpStatus[HttpStatus["ImUsed"] = 226] = "ImUsed";
 	/**
 	* Indicates multiple options for the resource from which the client may choose (via agent-driven
 	* content negotiation). For example, this code could be used to present multiple video format
 	* options, to list files with different filename extensions, or to suggest word-sense
 	* disambiguation.
-	*/ HttpStatus[HttpStatus["MultipleChoices"] = 300] = "MultipleChoices";
-	/** This and all future requests should be directed to the given URI. */ HttpStatus[HttpStatus["MovedPermanently"] = 301] = "MovedPermanently";
+	*/
+	HttpStatus[HttpStatus["MultipleChoices"] = 300] = "MultipleChoices";
+	/** This and all future requests should be directed to the given URI. */
+	HttpStatus[HttpStatus["MovedPermanently"] = 301] = "MovedPermanently";
 	/**
 	* This is an example of industry practice contradicting the standard. The HTTP/1.0 specification
 	* (RFC 1945) required the client to perform a temporary redirect (the original describing phrase
@@ -959,78 +1010,95 @@ async function runValidators(requestEv, validators, data, devMode) {
 	* See Other. Therefore, HTTP/1.1 added status codes 303 and 307 to distinguish between the two
 	* behaviors. However, some Web applications and frameworks use the 302 status code as if it were
 	* the 303.
-	*/ HttpStatus[HttpStatus["Found"] = 302] = "Found";
+	*/
+	HttpStatus[HttpStatus["Found"] = 302] = "Found";
 	/**
 	* SINCE HTTP/1.1 The response to the request can be found under another URI using a GET method.
 	* When received in response to a POST (or PUT/DELETE), the client should presume that the server
 	* has received the data and should issue a redirect with a separate GET message.
-	*/ HttpStatus[HttpStatus["SeeOther"] = 303] = "SeeOther";
+	*/
+	HttpStatus[HttpStatus["SeeOther"] = 303] = "SeeOther";
 	/**
 	* Indicates that the resource has not been modified since the version specified by the request
 	* headers If-Modified-Since or If-None-Match. In such case, there is no need to retransmit the
 	* resource since the client still has a previously-downloaded copy.
-	*/ HttpStatus[HttpStatus["NotModified"] = 304] = "NotModified";
+	*/
+	HttpStatus[HttpStatus["NotModified"] = 304] = "NotModified";
 	/**
 	* SINCE HTTP/1.1 The requested resource is available only through a proxy, the address for which
 	* is provided in the response. Many HTTP clients (such as Mozilla and Internet Explorer) do not
 	* correctly handle responses with this status code, primarily for security reasons.
-	*/ HttpStatus[HttpStatus["UseProxy"] = 305] = "UseProxy";
-	/** No longer used. Originally meant "Subsequent requests should use the specified proxy." */ HttpStatus[HttpStatus["SwitchProxy"] = 306] = "SwitchProxy";
+	*/
+	HttpStatus[HttpStatus["UseProxy"] = 305] = "UseProxy";
+	/** No longer used. Originally meant "Subsequent requests should use the specified proxy." */
+	HttpStatus[HttpStatus["SwitchProxy"] = 306] = "SwitchProxy";
 	/**
 	* SINCE HTTP/1.1 In this case, the request should be repeated with another URI; however, future
 	* requests should still use the original URI. In contrast to how 302 was historically
 	* implemented, the request method is not allowed to be changed when reissuing the original
 	* request. For example, a POST request should be repeated using another POST request.
-	*/ HttpStatus[HttpStatus["TemporaryRedirect"] = 307] = "TemporaryRedirect";
+	*/
+	HttpStatus[HttpStatus["TemporaryRedirect"] = 307] = "TemporaryRedirect";
 	/**
 	* The request and all future requests should be repeated using another URI. 307 and 308 parallel
 	* the behaviors of 302 and 301, but do not allow the HTTP method to change. So, for example,
 	* submitting a form to a permanently redirected resource may continue smoothly.
-	*/ HttpStatus[HttpStatus["PermanentRedirect"] = 308] = "PermanentRedirect";
+	*/
+	HttpStatus[HttpStatus["PermanentRedirect"] = 308] = "PermanentRedirect";
 	/**
 	* The server cannot or will not process the request due to an apparent client error (e.g.,
 	* malformed request syntax, too large size, invalid request message framing, or deceptive request
 	* routing).
-	*/ HttpStatus[HttpStatus["BadRequest"] = 400] = "BadRequest";
+	*/
+	HttpStatus[HttpStatus["BadRequest"] = 400] = "BadRequest";
 	/**
 	* Similar to 403 Forbidden, but specifically for use when authentication is required and has
 	* failed or has not yet been provided. The response must include a WWW-Authenticate header field
 	* containing a challenge applicable to the requested resource. See Basic access authentication
 	* and Digest access authentication. 401 semantically means "unauthenticated",i.e. the user does
 	* not have the necessary credentials.
-	*/ HttpStatus[HttpStatus["Unauthorized"] = 401] = "Unauthorized";
+	*/
+	HttpStatus[HttpStatus["Unauthorized"] = 401] = "Unauthorized";
 	/**
 	* Reserved for future use. The original intention was that this code might be used as part of
 	* some form of digital cash or micro payment scheme, but that has not happened, and this code is
 	* not usually used. Google Developers API uses this status if a particular developer has exceeded
 	* the daily limit on requests.
-	*/ HttpStatus[HttpStatus["PaymentRequired"] = 402] = "PaymentRequired";
+	*/
+	HttpStatus[HttpStatus["PaymentRequired"] = 402] = "PaymentRequired";
 	/**
 	* The request was valid, but the server is refusing action. The user might not have the necessary
 	* permissions for a resource.
-	*/ HttpStatus[HttpStatus["Forbidden"] = 403] = "Forbidden";
+	*/
+	HttpStatus[HttpStatus["Forbidden"] = 403] = "Forbidden";
 	/**
 	* The requested resource could not be found but may be available in the future. Subsequent
 	* requests by the client are permissible.
-	*/ HttpStatus[HttpStatus["NotFound"] = 404] = "NotFound";
+	*/
+	HttpStatus[HttpStatus["NotFound"] = 404] = "NotFound";
 	/**
 	* A request method is not supported for the requested resource; for example, a GET request on a
 	* form that requires data to be presented via POST, or a PUT request on a read-only resource.
-	*/ HttpStatus[HttpStatus["MethodNotAllowed"] = 405] = "MethodNotAllowed";
+	*/
+	HttpStatus[HttpStatus["MethodNotAllowed"] = 405] = "MethodNotAllowed";
 	/**
 	* The requested resource is capable of generating only content not acceptable according to the
 	* Accept headers sent in the request.
-	*/ HttpStatus[HttpStatus["NotAcceptable"] = 406] = "NotAcceptable";
-	/** The client must first authenticate itself with the proxy. */ HttpStatus[HttpStatus["ProxyAuthenticationRequired"] = 407] = "ProxyAuthenticationRequired";
+	*/
+	HttpStatus[HttpStatus["NotAcceptable"] = 406] = "NotAcceptable";
+	/** The client must first authenticate itself with the proxy. */
+	HttpStatus[HttpStatus["ProxyAuthenticationRequired"] = 407] = "ProxyAuthenticationRequired";
 	/**
 	* The server timed out waiting for the request. According to HTTP specifications: "The client did
 	* not produce a request within the time that the server was prepared to wait. The client MAY
 	* repeat the request without modifications at any later time."
-	*/ HttpStatus[HttpStatus["RequestTimeout"] = 408] = "RequestTimeout";
+	*/
+	HttpStatus[HttpStatus["RequestTimeout"] = 408] = "RequestTimeout";
 	/**
 	* Indicates that the request could not be processed because of conflict in the request, such as
 	* an edit conflict between multiple simultaneous updates.
-	*/ HttpStatus[HttpStatus["Conflict"] = 409] = "Conflict";
+	*/
+	HttpStatus[HttpStatus["Conflict"] = 409] = "Conflict";
 	/**
 	* Indicates that the resource requested is no longer available and will not be available again.
 	* This should be used when a resource has been intentionally removed and the resource should be
@@ -1038,101 +1106,143 @@ async function runValidators(requestEv, validators, data, devMode) {
 	* future. Clients such as search engines should remove the resource from their indices. Most use
 	* cases do not require clients and search engines to purge the resource, and a "404 Not Found"
 	* may be used instead.
-	*/ HttpStatus[HttpStatus["Gone"] = 410] = "Gone";
+	*/
+	HttpStatus[HttpStatus["Gone"] = 410] = "Gone";
 	/**
 	* The request did not specify the length of its content, which is required by the requested
 	* resource.
-	*/ HttpStatus[HttpStatus["LengthRequired"] = 411] = "LengthRequired";
-	/** The server does not meet one of the preconditions that the requester put on the request. */ HttpStatus[HttpStatus["PreconditionFailed"] = 412] = "PreconditionFailed";
+	*/
+	HttpStatus[HttpStatus["LengthRequired"] = 411] = "LengthRequired";
+	/** The server does not meet one of the preconditions that the requester put on the request. */
+	HttpStatus[HttpStatus["PreconditionFailed"] = 412] = "PreconditionFailed";
 	/**
 	* The request is larger than the server is willing or able to process. Previously called "Request
 	* Entity Too Large".
-	*/ HttpStatus[HttpStatus["PayloadTooLarge"] = 413] = "PayloadTooLarge";
+	*/
+	HttpStatus[HttpStatus["PayloadTooLarge"] = 413] = "PayloadTooLarge";
 	/**
 	* The URI provided was too long for the server to process. Often the result of too much data
 	* being encoded as a query-string of a GET request, in which case it should be converted to a
 	* POST request. Called "Request-URI Too Long" previously.
-	*/ HttpStatus[HttpStatus["UriTooLong"] = 414] = "UriTooLong";
+	*/
+	HttpStatus[HttpStatus["UriTooLong"] = 414] = "UriTooLong";
 	/**
 	* The request entity has a media type which the server or resource does not support. For example,
 	* the client uploads an image as image/svg+xml, but the server requires that images use a
 	* different format.
-	*/ HttpStatus[HttpStatus["UnsupportedMediaType"] = 415] = "UnsupportedMediaType";
+	*/
+	HttpStatus[HttpStatus["UnsupportedMediaType"] = 415] = "UnsupportedMediaType";
 	/**
 	* The client has asked for a portion of the file (byte serving), but the server cannot supply
 	* that portion. For example, if the client asked for a part of the file that lies beyond the end
 	* of the file. Called "Requested Range Not Satisfiable" previously.
-	*/ HttpStatus[HttpStatus["RangeNotSatisfiable"] = 416] = "RangeNotSatisfiable";
-	/** The server cannot meet the requirements of the Expect request-header field. */ HttpStatus[HttpStatus["ExpectationFailed"] = 417] = "ExpectationFailed";
+	*/
+	HttpStatus[HttpStatus["RangeNotSatisfiable"] = 416] = "RangeNotSatisfiable";
+	/** The server cannot meet the requirements of the Expect request-header field. */
+	HttpStatus[HttpStatus["ExpectationFailed"] = 417] = "ExpectationFailed";
 	/**
 	* This code was defined in 1998 as one of the traditional IETF April Fools' jokes, in RFC 2324,
 	* Hyper Text Coffee Pot Control Protocol, and is not expected to be implemented by actual HTTP
 	* servers. The RFC specifies this code should be returned by teapots requested to brew coffee.
 	* This HTTP status is used as an Easter egg in some websites, including Google.com.
-	*/ HttpStatus[HttpStatus["IAmATeapot"] = 418] = "IAmATeapot";
+	*/
+	HttpStatus[HttpStatus["IAmATeapot"] = 418] = "IAmATeapot";
 	/**
 	* The request was directed at a server that is not able to produce a response (for example
 	* because a connection reuse).
-	*/ HttpStatus[HttpStatus["MisdirectedRequest"] = 421] = "MisdirectedRequest";
-	/** The request was well-formed but was unable to be followed due to semantic errors. */ HttpStatus[HttpStatus["UnprocessableEntity"] = 422] = "UnprocessableEntity";
-	/** The resource that is being accessed is locked. */ HttpStatus[HttpStatus["Locked"] = 423] = "Locked";
-	/** The request failed due to failure of a previous request (e.g., a PROPPATCH). */ HttpStatus[HttpStatus["FailedDependency"] = 424] = "FailedDependency";
+	*/
+	HttpStatus[HttpStatus["MisdirectedRequest"] = 421] = "MisdirectedRequest";
+	/** The request was well-formed but was unable to be followed due to semantic errors. */
+	HttpStatus[HttpStatus["UnprocessableEntity"] = 422] = "UnprocessableEntity";
+	/** The resource that is being accessed is locked. */
+	HttpStatus[HttpStatus["Locked"] = 423] = "Locked";
+	/** The request failed due to failure of a previous request (e.g., a PROPPATCH). */
+	HttpStatus[HttpStatus["FailedDependency"] = 424] = "FailedDependency";
 	/**
 	* The client should switch to a different protocol such as TLS/1.0, given in the Upgrade header
 	* field.
-	*/ HttpStatus[HttpStatus["UpgradeRequired"] = 426] = "UpgradeRequired";
+	*/
+	HttpStatus[HttpStatus["UpgradeRequired"] = 426] = "UpgradeRequired";
 	/**
 	* The origin server requires the request to be conditional. Intended to prevent "the 'lost
 	* update' problem, where a client GETs a resource's state, modifies it, and PUTs it back to the
 	* server, when meanwhile a third party has modified the state on the server, leading to a
 	* conflict."
-	*/ HttpStatus[HttpStatus["PreconditionRequired"] = 428] = "PreconditionRequired";
+	*/
+	HttpStatus[HttpStatus["PreconditionRequired"] = 428] = "PreconditionRequired";
 	/**
 	* The user has sent too many requests in a given amount of time. Intended for use with
 	* rate-limiting schemes.
-	*/ HttpStatus[HttpStatus["TooManyRequests"] = 429] = "TooManyRequests";
+	*/
+	HttpStatus[HttpStatus["TooManyRequests"] = 429] = "TooManyRequests";
 	/**
 	* The server is unwilling to process the request because either an individual header field, or
 	* all the header fields collectively, are too large.
-	*/ HttpStatus[HttpStatus["RequestHeaderFieldsTooLarge"] = 431] = "RequestHeaderFieldsTooLarge";
+	*/
+	HttpStatus[HttpStatus["RequestHeaderFieldsTooLarge"] = 431] = "RequestHeaderFieldsTooLarge";
 	/**
 	* A server operator has received a legal demand to deny access to a resource or to a set of
 	* resources that includes the requested resource. The code 451 was chosen as a reference to the
 	* novel Fahrenheit 451.
-	*/ HttpStatus[HttpStatus["UnavailableForLegalReasons"] = 451] = "UnavailableForLegalReasons";
+	*/
+	HttpStatus[HttpStatus["UnavailableForLegalReasons"] = 451] = "UnavailableForLegalReasons";
 	/**
 	* A generic error message, given when an unexpected condition was encountered and no more
 	* specific message is suitable.
-	*/ HttpStatus[HttpStatus["InternalServerError"] = 500] = "InternalServerError";
+	*/
+	HttpStatus[HttpStatus["InternalServerError"] = 500] = "InternalServerError";
 	/**
 	* The server either does not recognize the request method, or it lacks the ability to fulfill the
 	* request. Usually this implies future availability (e.g., a new feature of a web-service API).
-	*/ HttpStatus[HttpStatus["NotImplemented"] = 501] = "NotImplemented";
+	*/
+	HttpStatus[HttpStatus["NotImplemented"] = 501] = "NotImplemented";
 	/**
 	* The server was acting as a gateway or proxy and received an invalid response from the upstream
 	* server.
-	*/ HttpStatus[HttpStatus["BadGateway"] = 502] = "BadGateway";
+	*/
+	HttpStatus[HttpStatus["BadGateway"] = 502] = "BadGateway";
 	/**
 	* The server is currently unavailable (because it is overloaded or down for maintenance).
 	* Generally, this is a temporary state.
-	*/ HttpStatus[HttpStatus["ServiceUnavailable"] = 503] = "ServiceUnavailable";
+	*/
+	HttpStatus[HttpStatus["ServiceUnavailable"] = 503] = "ServiceUnavailable";
 	/**
 	* The server was acting as a gateway or proxy and did not receive a timely response from the
 	* upstream server.
-	*/ HttpStatus[HttpStatus["GatewayTimeout"] = 504] = "GatewayTimeout";
-	/** The server does not support the HTTP protocol version used in the request */ HttpStatus[HttpStatus["HttpVersionNotSupported"] = 505] = "HttpVersionNotSupported";
-	/** Transparent content negotiation for the request results in a circular reference. */ HttpStatus[HttpStatus["VariantAlsoNegotiates"] = 506] = "VariantAlsoNegotiates";
-	/** The server is unable to store the representation needed to complete the request. */ HttpStatus[HttpStatus["InsufficientStorage"] = 507] = "InsufficientStorage";
-	/** The server detected an infinite loop while processing the request. */ HttpStatus[HttpStatus["LoopDetected"] = 508] = "LoopDetected";
-	/** Further extensions to the request are required for the server to fulfill it. */ HttpStatus[HttpStatus["NotExtended"] = 510] = "NotExtended";
+	*/
+	HttpStatus[HttpStatus["GatewayTimeout"] = 504] = "GatewayTimeout";
+	/** The server does not support the HTTP protocol version used in the request */
+	HttpStatus[HttpStatus["HttpVersionNotSupported"] = 505] = "HttpVersionNotSupported";
+	/** Transparent content negotiation for the request results in a circular reference. */
+	HttpStatus[HttpStatus["VariantAlsoNegotiates"] = 506] = "VariantAlsoNegotiates";
+	/** The server is unable to store the representation needed to complete the request. */
+	HttpStatus[HttpStatus["InsufficientStorage"] = 507] = "InsufficientStorage";
+	/** The server detected an infinite loop while processing the request. */
+	HttpStatus[HttpStatus["LoopDetected"] = 508] = "LoopDetected";
+	/** Further extensions to the request are required for the server to fulfill it. */
+	HttpStatus[HttpStatus["NotExtended"] = 510] = "NotExtended";
 	/**
 	* The client needs to authenticate to gain network access. Intended for use by intercepting
 	* proxies used to control access to the network (e.g., "captive portals" used to require
 	* agreement to Terms of Service before granting full Internet access via a Wi-Fi hotspot).
-	*/ HttpStatus[HttpStatus["NetworkAuthenticationRequired"] = 511] = "NetworkAuthenticationRequired";
+	*/
+	HttpStatus[HttpStatus["NetworkAuthenticationRequired"] = 511] = "NetworkAuthenticationRequired";
 	return HttpStatus;
 }({});
-function getQwikRouterServerData(requestEv) {
+/** Client-controlled forwarded headers only override the URL when the proxy is trusted. */
+function getServerDataUrl(originalUrl, headers, trustForwardedHeaders) {
+	const url = new URL(originalUrl.pathname + originalUrl.search, originalUrl);
+	if (!trustForwardedHeaders) return url.href;
+	const host = headers.get("X-Forwarded-Host");
+	const protocol = headers.get("X-Forwarded-Proto");
+	if (host) {
+		url.port = "";
+		url.host = host;
+	}
+	if (protocol) url.protocol = protocol;
+	return url.href;
+}
+function getQwikRouterServerData(requestEv, trustForwardedHeaders) {
 	const { params, request, status, locale, originalUrl } = requestEv;
 	const requestHeaders = {};
 	request.headers.forEach((value, key) => requestHeaders[key] = value);
@@ -1141,19 +1251,10 @@ function getQwikRouterServerData(requestEv) {
 	const formData = requestEv.sharedMap.get(RequestEvSharedActionFormData);
 	const routeName = requestEv.sharedMap.get(RequestRouteName);
 	const nonce = requestEv.sharedMap.get(RequestEvSharedNonce);
-	const headers = requestEv.request.headers;
-	const reconstructedUrl = new URL(originalUrl.pathname + originalUrl.search, originalUrl);
-	const host = headers.get("X-Forwarded-Host");
-	const protocol = headers.get("X-Forwarded-Proto");
-	if (host) {
-		reconstructedUrl.port = "";
-		reconstructedUrl.host = host;
-	}
-	if (protocol) reconstructedUrl.protocol = protocol;
 	const routeLoaderCtx = getRouteLoaderCtx(requestEv);
 	const loaderValues = getRouteLoaderValues(requestEv);
 	return {
-		url: reconstructedUrl.href,
+		url: getServerDataUrl(originalUrl, request.headers, trustForwardedHeaders),
 		requestHeaders,
 		renderMode: getRequestMode(requestEv),
 		locale: locale(),
@@ -1187,7 +1288,8 @@ function createResolveRequestHandlers() {
 			/**
 			* JSON request wrapper must be before all middleware so it can rewrite the URL and catch
 			* redirects/errors from plugin/route middleware via try/catch on next()
-			*/ requestHandlers.push(jsonRequestWrapper());
+			*/
+			requestHandlers.push(jsonRequestWrapper());
 			requestHandlers.push(serverErrorMiddleware(route, renderHandler));
 		}
 		if (serverPlugins) _resolveRequestHandlers(routeLoaders, routeActions, requestHandlers, serverPlugins, isPageRoute, method);
@@ -1314,16 +1416,17 @@ function createResolveRequestHandlers() {
 	}
 	function loadersMiddleware(routeLoaders, route) {
 		return (requestEvent) => {
-			if (requestEvent.headersSent) {
-				requestEvent.exit();
+			const requestEv = requestEvent;
+			if (requestEv.headersSent) {
+				requestEv.exit();
 				return;
 			}
 			if (routeLoaders.length === 0) return;
-			setLoaderData(requestEvent, routeLoaders, route);
+			setLoaderData(requestEv, routeLoaders, route);
 			let allBlockSSRLoaders;
 			for (let i = 0; i < routeLoaders.length; i++) {
 				const loader = routeLoaders[i];
-				const promise = loadRouteLoader(loader, requestEvent);
+				const promise = loadRouteLoader(loader, requestEv);
 				promise.catch(() => {});
 				if (loader.__blockSSR) allBlockSSRLoaders = allBlockSSRLoaders ? allBlockSSRLoaders.then(() => promise) : promise;
 			}
@@ -1334,6 +1437,7 @@ function createResolveRequestHandlers() {
 		if (routeLoaders.length === 0) return;
 		const routeLoaderCtx = getRouteLoaderCtx(requestEv);
 		if (route.$loaderPaths$) Object.assign(routeLoaderCtx.loaderPaths, route.$loaderPaths$);
+		if (route.$loaderParams$) Object.assign(getRouteLoaderParams(requestEv), route.$loaderParams$);
 		setRouteLoaders(requestEv, routeLoaders);
 	}
 	function eTagMiddleware(route) {
@@ -1344,17 +1448,18 @@ function createResolveRequestHandlers() {
 			if (!mods.some((m) => {
 				if (!m) return false;
 				if (m.routeConfig) return typeof m.routeConfig === "function" || m.routeConfig.eTag !== void 0 || m.routeConfig.cacheKey !== void 0;
-				return m.eTag !== void 0 || m.cacheKey !== void 0;
+				const page = m;
+				return page.eTag !== void 0 || page.cacheKey !== void 0;
 			})) return;
 			const loaderValues = getRouteLoaderValues(requestEv);
-			const getData = (loaderOrAction) => {
+			const getData = ((loaderOrAction) => {
 				const id = loaderOrAction.__id;
 				if (loaderOrAction.__brand === "server_loader") {
 					if (!(id in loaderValues)) throw new Error("Loader not executed for this request.");
 					return loaderValues[id];
 				}
 				return requestEv.sharedMap.get("@actionId") === id ? requestEv.sharedMap.get("@actionResult") : void 0;
-			};
+			});
 			const routeLocation = {
 				params: requestEv.params,
 				url: requestEv.url,
@@ -1490,7 +1595,8 @@ function createResolveRequestHandlers() {
 	* Prerendered pages are pruned from the production server route plan, so a request missing the
 	* canonical trailing slash lands here as not found. Redirect it when the canonical path was
 	* prerendered, and leave a genuine 404 alone.
-	*/ function fixStaticTrailingSlash(ev) {
+	*/
+	function fixStaticTrailingSlash(ev) {
 		const canonicalUrl = new URL(ev.originalUrl);
 		canonicalUrl.pathname = globalThis.__NO_TRAILING_SLASH__ ? canonicalUrl.pathname.replace(/\/$/, "") : ensureSlash(canonicalUrl.pathname);
 		if (isStaticPath(ev.request.method, canonicalUrl)) fixTrailingSlash(ev);
@@ -1534,7 +1640,7 @@ function createResolveRequestHandlers() {
 The request origin "${inputOrigin}" does not match the server origin "${origin}".`);
 		}
 	}
-	function renderQwikMiddleware(render) {
+	function renderQwikMiddleware(render, trustForwardedHeaders = false) {
 		return async (requestEv) => {
 			if (requestEv.headersSent) return;
 			const responseHeaders = requestEv.headers;
@@ -1566,7 +1672,7 @@ The request origin "${inputOrigin}" does not match the server origin "${origin}"
 			const stream = writable.getWriter();
 			try {
 				const isStatic = getRequestMode(requestEv) === "static";
-				const serverData = getQwikRouterServerData(requestEv);
+				const serverData = getQwikRouterServerData(requestEv, trustForwardedHeaders);
 				const result = await render({
 					base: requestEv.basePathname + "build/",
 					stream,
@@ -1577,7 +1683,7 @@ The request origin "${inputOrigin}" does not match the server origin "${origin}"
 						...serverData.containerAttributes
 					},
 					onBeforeFirstFlush: (info) => {
-						if (info.errorBoundaryCaught) {
+						if (info.hasCaughtError) {
 							boundaryErrored = true;
 							noStoreSent = true;
 							overrodeCacheControl = responseHeaders.has("Cache-Control");
@@ -1586,8 +1692,8 @@ The request origin "${inputOrigin}" does not match the server origin "${origin}"
 					}
 				});
 				if (typeof result.html === "string") await stream.write(result.html);
-				boundaryErrored ||= result.errorBoundaryCaught === true;
-				if (boundaryErrored) requestEv.sharedMap.set(RequestEvErrorBoundaryCaught, true);
+				boundaryErrored ||= result.hasCaughtError === true;
+				if (boundaryErrored) requestEv.sharedMap.set(RequestEvCaughtError, true);
 			} finally {
 				try {
 					await stream.ready;
@@ -1598,7 +1704,7 @@ The request origin "${inputOrigin}" does not match the server origin "${origin}"
 				}
 			}
 			if (pipeError) throw pipeError;
-			if (boundaryErrored && (noStoreSent ? cachePlan || overrodeCacheControl : !!cachePlan)) console.warn(`An <ErrorBoundary> caught during SSR of ${requestEv.url.pathname} — configured caching disabled: ` + (noStoreSent ? "the response was sent with Cache-Control: no-store." : "the SSR cache was skipped (response headers were already sent)."));
+			if (boundaryErrored && (noStoreSent ? cachePlan || overrodeCacheControl : !!cachePlan)) console.warn(`A <Catch> caught during SSR of ${requestEv.url.pathname} — configured caching disabled: ` + (noStoreSent ? "the response was sent with Cache-Control: no-store." : "the SSR cache was skipped (response headers were already sent)."));
 			if (cachePlan && cacheChunks && cacheChunks.length > 0 && !boundaryErrored) {
 				const totalLength = cacheChunks.reduce((sum, chunk) => sum + chunk.length, 0);
 				const combined = new Uint8Array(totalLength);
@@ -1649,19 +1755,15 @@ The request origin "${inputOrigin}" does not match the server origin "${origin}"
 	};
 }
 var { actionsMiddleware, checkBrand, checkCSRF, fixStaticTrailingSlash, fixTrailingSlash, getPathname, isLastModulePageRoute, isQrl, loadersMiddleware, measure, renderQwikMiddleware, resolveRequestHandlers, streamServerFunctionResult, verifySerializable } = createResolveRequestHandlers();
-/** @public */ var ESCAPE_HTML = /[&<>]/g;
-var escapeHtml = (s) => {
-	return s.replace(ESCAPE_HTML, (c) => {
-		switch (c) {
-			case "&": return "&amp;";
-			case "<": return "&lt;";
-			case ">": return "&gt;";
-			default: return "";
-		}
-	});
-};
-var COLOR_400 = "#006ce9";
-var COLOR_500 = "#713fc2";
+/** @public */
+function getErrorHtml(status, e) {
+	let message = "Server Error";
+	if (e != null) {
+		if (typeof e.message === "string") message = e.message;
+		else message = String(e);
+	}
+	return `<html>` + minimalHtmlResponse(status, message) + `</html>`;
+}
 function minimalHtmlResponse(status, message) {
 	if (typeof status !== "number") status = 500;
 	if (typeof message === "string") message = escapeHtml(message);
@@ -1684,15 +1786,39 @@ function minimalHtmlResponse(status, message) {
 <body><p><strong>${status}</strong> <span>${message}</span></p></body>
 `;
 }
-function getErrorHtml(status, e) {
-	let message = "Server Error";
-	if (e != null) {
-		if (typeof e.message === "string") message = e.message;
-		else message = String(e);
+var ESCAPE_HTML = /[&<>]/g;
+var escapeHtml = (s) => {
+	return s.replace(ESCAPE_HTML, (c) => {
+		switch (c) {
+			case "&": return "&amp;";
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			default: return "";
+		}
+	});
+};
+var COLOR_400 = "#006ce9";
+var COLOR_500 = "#713fc2";
+var ensureError = (e) => e instanceof Error || typeof e === "object" && e !== null ? e : new Error(String(e));
+function runQwikRouter(serverRequestEv, loadedRoute, requestHandlers, rebuildRouteInfo, basePathname = "/", routerConfig) {
+	let resolve;
+	const responsePromise = new Promise((r) => resolve = r);
+	try {
+		const requestEv = createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, basePathname, resolve, routerConfig);
+		return {
+			response: responsePromise,
+			requestEv,
+			completion: _asyncRequestStore ? _asyncRequestStore.run(requestEv, runNext, requestEv, rebuildRouteInfo, resolve) : runNext(requestEv, rebuildRouteInfo, resolve)
+		};
+	} catch (e) {
+		resolve(null);
+		return {
+			response: responsePromise,
+			requestEv: { headersSent: false },
+			completion: Promise.resolve(ensureError(e))
+		};
 	}
-	return `<html>` + minimalHtmlResponse(status, message) + `</html>`;
 }
-var ensureError = (e) => e instanceof Error || typeof e === "object" && e !== null ? e : new Error(String(e));
 async function runNext(requestEv, rebuildRouteInfo, resolve) {
 	try {
 		const isValidURL = (url) => new URL(url.pathname + url.search, url);
@@ -1754,23 +1880,4 @@ async function runNext(requestEv, rebuildRouteInfo, resolve) {
 		if (!requestEv.isDirty()) resolve(null);
 	}
 }
-function runQwikRouter(serverRequestEv, loadedRoute, requestHandlers, rebuildRouteInfo, basePathname = "/") {
-	let resolve;
-	const responsePromise = new Promise((r) => resolve = r);
-	try {
-		const requestEv = createRequestEvent(serverRequestEv, loadedRoute, requestHandlers, basePathname, resolve);
-		return {
-			response: responsePromise,
-			requestEv,
-			completion: _asyncRequestStore ? _asyncRequestStore.run(requestEv, runNext, requestEv, rebuildRouteInfo, resolve) : runNext(requestEv, rebuildRouteInfo, resolve)
-		};
-	} catch (e) {
-		resolve(null);
-		return {
-			response: responsePromise,
-			requestEv: { headersSent: false },
-			completion: Promise.resolve(ensureError(e))
-		};
-	}
-}
-export { getStaticPathRedirect as a, clearSsrCache as c, mergeHeadersCookies as d, resolveRequestHandlers as i, RequestEvErrorBoundaryCaught as l, getErrorHtml as n, isStaticPath as o, renderQwikMiddleware as r, clearLoaderCache as s, runQwikRouter as t, RewriteMessage as u };
+export { getStaticPathRedirect as a, clearSsrCache as c, mergeHeadersCookies as d, resolveRequestHandlers as i, RequestEvCaughtError as l, getErrorHtml as n, isStaticPath as o, renderQwikMiddleware as r, clearLoaderCache as s, runQwikRouter as t, RewriteMessage as u };