# QwikDev/qwik — codebase unpack

> Canonical page: https://codevetter.com/unpack/qwik

This is a deterministic Repo Unpack scan of QwikDev/qwik — a structural map, not a review, security audit, or maintainer-endorsed description.

- Scanned commit: 8eb4589be115eb8f2dabfd12c107dcc23647caec (2026-10-02)
- Last upstream commit: Merge pull request #9119 from QwikDev/fix-forward-back-router
- Generated by codevetter 1.15.0 on 2026-10-02
- 4000 files scanned · 14.0 MB

Source inspection; upstream code and tests were not executed.

## Languages

- TypeScript: 2619 files
- Markdown: 966 files
- JSON: 247 files
- JavaScript: 94 files
- CSS: 86 files
- Rust: 25 files
- SQL: 20 files
- YAML: 12 files

## Repository structure

- packages/ — 2302 files
- e2e/ — 701 files
- .changeset/ — 602 files
- starters/ — 269 files
- scripts/ — 54 files
- .github/ — 12 files
- .ruler/ — 10 files
- patches/ — 5 files

Probable source entrypoint: `packages/` (inferred from the tree, not upstream docs)

## Package

- Cargo.toml: null — 0 declared dependencies

## Structural health signals

Average score 9/10 across 96 files; 3 hotspots. These are deterministic review leads, not proof of a bug.

## Recent history

- 8eb4589be115 (2026-10-02) Merge pull request #9119 from QwikDev/fix-forward-back-router
- c1d2309a8b35 (2026-10-02) fix(router): handle back/forward pressed before the SPA router has initialized
- 9ca474c1cce3 (2026-10-02) Merge pull request #9118 from QwikDev/claude/funny-gates-iako7t
- 3e8a0ae66cf6 (2026-10-02) ci: build docs previews with their own Cloudflare Pages origin
- bdbd082902ad (2026-10-02) docs(blog): use the article hero as the default social image

## Overview

Qwik v2 is a web framework for developers building server-rendered applications that resume execution from serialized state and load event code on demand. This monorepo contains the reactive runtime, SSR engine, TypeScript and Rust optimizers, routing and deployment adapters, project scaffolding, React integration, developer inspection tools, and an Insights analytics application. Its distinctive architecture connects extracted QRL functions, build manifests, HTML metadata, and lazily restored client state. This brief reflects bounded, read-only inspection at commit 8eb4589be115eb8f2dabfd12c107dcc23647caec; no repository code, tests, builds, or workflows were executed.

## System map

The repository distributes a framework through several packages rather than running as one application. Core exposes separate client, server, optimizer, and CLI surfaces, while Router connects generated route configuration to platform middleware. Supporting applications include documentation and Insights, and development tooling includes MCP inspection. Build and deployment commands below are source-defined capabilities, not commands executed during this investigation.
- The pinned branch describes Qwik v2 as resumable, with VNode runtime work, rewritten reactive primitives, and a new serialization mechanism. — [AGENTS.md#L30-38](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L30-L38) [README.md#L14-21](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/README.md#L14-L21)
- @qwik.dev/core publishes conditional development/production runtime exports, an internal surface, JSX runtime exports, and a qwik CLI executable. — [packages/qwik/package.json#L2-8](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/package.json#L2-L8) [packages/qwik/package.json#L39-78](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/package.json#L39-L78)
- renderToString delegates to renderToStream; streaming creates an SSRContainer, installs the server platform, renders JSX, and flushes buffered output. — [packages/qwik/src/server/ssr-render.ts#L22-35](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-render.ts#L22-L35) [packages/qwik/src/server/ssr-render.ts#L72-107](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-render.ts#L72-L107)
- Browser startup is owned by qwikloader.ts, which turns window._qwikEv into a registration object and installs scoped event listeners. — [packages/qwik/src/qwikloader.ts#L543-580](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L543-L580) [packages/qwik/src/qwikloader.ts#L623-641](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L623-L641)
- Router has buildtime-generated virtual modules and shared runtime route matching; requestHandler is the request entry used by adapters. — [packages/qwik-router/src/buildtime/vite/plugin.ts#L54-80](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/buildtime/vite/plugin.ts#L54-L80) [packages/qwik-router/src/runtime/src/routing.ts#L17-25](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/routing.ts#L17-L25) [packages/qwik-router/src/middleware/request-handler/request-handler.ts#L20-31](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-handler.ts#L20-L31)
- createQwikPlugin selects @qwik.dev/ts-optimizer or @qwik.dev/optimizer; QWIK_OPTIMIZER=ts|rust overrides the option and invalid values throw. — [packages/qwik-vite/src/plugins/plugin.ts#L106-115](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-vite/src/plugins/plugin.ts#L106-L115) [packages/qwik-vite/src/plugins/plugin.ts#L168-180](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-vite/src/plugins/plugin.ts#L168-L180)
- The Rust workspace includes optimizer core and NAPI members, lists then excludes the WASM member, and configures a size-oriented release profile. — [Cargo.toml#L1-16](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/Cargo.toml#L1-L16)
- Insights owns persistent application, symbol, error, and manifest tables through Drizzle's libSQL database type and an initialized module-level database handle. — [packages/insights/src/db/schema.ts#L19-85](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/schema.ts#L19-L85) [packages/insights/src/db/index.ts#L1-22](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/index.ts#L1-L22)
- The workspace spans packages/* and e2e/*, requires strict engine compatibility, and pins pnpm 11.22.0 with Node >=22.18.0 at the root. — [pnpm-workspace.yaml#L1-7](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/pnpm-workspace.yaml#L1-L7) [package.json#L188-195](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/package.json#L188-L195)
- Root build.core.dev, build.full, test.unit, and browser-specific test scripts define the contributor build/test surface; docs deployment consumes CI artifacts and publishes to Cloudflare Pages. — [package.json#L205-210](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/package.json#L205-L210) [package.json#L267-295](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/package.json#L267-L295) [.github/workflows/deploy-docs.yml#L48-71](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/deploy-docs.yml#L48-L71)

## Feature catalog

The primary user is an application developer using components, reactive state, routing, server functions, and deployment adapters. The inspected public surfaces also provide scaffolding, React interoperability, lint rules, and local inspection tools. Insights adds telemetry ingestion and an authenticated dashboard foundation. This catalog covers evidenced feature families; the capped inventory and selective source reads do not establish an exhaustive list of every example, documentation screen, or integration.
- Core exports component$, QRL boundaries $, sync$, event$, JSX helpers, Slot, and client rendering APIs. — [packages/qwik/src/core/index.ts#L9-35](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L9-L35) [packages/qwik/src/core/index.ts#L50-72](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L50-L72) [packages/qwik/src/core/index.ts#L102-106](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L102-L106)
- Developer state APIs include useStore, useSignal, computed signals, async signals, contexts, scoped styles, tasks, visible tasks, resources, and serializers. — [packages/qwik/src/core/index.ts#L111-166](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L111-L166)
- Each, Show, Pending, and Catch are exposed control-flow/error primitives; optimizer experimental flags include each, show, pendingBoundary, catchBoundary, and blockSSR. — [packages/qwik/src/core/index.ts#L148-150](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L148-L150) [packages/qwik/src/core/index.ts#L172-185](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L172-L185) [packages/qwik-vite/src/plugins/plugin.ts#L82-98](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-vite/src/plugins/plugin.ts#L82-L98)
- Event handling supports element, document, and window scopes, passive variants, preventdefault attributes, stoppropagation attributes, and late registrations. — [packages/qwik/src/qwikloader.ts#L7-18](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L7-L18) [packages/qwik/src/qwikloader.ts#L265-272](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L265-L272) [packages/qwik/src/qwikloader.ts#L543-590](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L543-L590)
- routeLoader$ supplies ComputedSignal data, per-loader endpoints, search-parameter allowlists, ETags, cache-control options, and strict-loader defaults. — [packages/qwik-router/src/runtime/src/route-loaders.ts#L1097-1155](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/route-loaders.ts#L1097-L1155)
- Route actions provide browser submission state and form completion events; JSON action handling runs validators and can return explicit loader invalidation hashes. — [packages/qwik-router/src/runtime/src/server-functions.ts#L93-167](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/server-functions.ts#L93-L167) [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L81-121](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L81-L121)
- server-function requests can return either a serialized value or an async-iterator stream using application/qwik-json and text/qwik-json-stream. — [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L557-595](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L557-L595) [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L601-617](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L601-L617)
- Router exposes adapters for Azure SWA, Cloudflare Pages, Cloud Run, Bun, Deno, Node, Netlify Edge, static generation, and Vercel Edge. — [packages/qwik-router/package.json#L54-97](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/package.json#L54-L97)
- create-qwik supports argument-based or interactive startup; the argument path accepts template, output directory, --force, and --installDeps. — [packages/create-qwik/index.ts#L7-23](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/index.ts#L7-L23) [packages/create-qwik/src/run-create-cli.ts#L23-49](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/run-create-cli.ts#L23-L49)
- React interoperability exports qwikify$ and reactify$; qwikifyQrl tracks props, resolves the React component lazily, maintains a React root, and schedules root cleanup. — [packages/qwik-react/src/index.qwik.ts#L1-4](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-react/src/index.qwik.ts#L1-L4) [packages/qwik-react/src/react/qwikify.tsx#L27-38](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-react/src/react/qwikify.tsx#L27-L38) [packages/qwik-react/src/react/qwikify.tsx#L59-111](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-react/src/react/qwikify.tsx#L59-L111)
- Developer tooling includes recommended/strict ESLint rule sets and MCP tools for project information, route lists, browser errors, page inspection, and offline documentation. — [packages/eslint-plugin-qwik/index.ts#L22-57](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/eslint-plugin-qwik/index.ts#L22-L57) [packages/mcp/src/server.ts#L76-151](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/mcp/src/server.ts#L76-L151)
- Insights accepts symbol timing telemetry, mounts an Insights component and RouterOutlet, and integrates GitHub sign-in, sign-out, and session APIs. — [packages/insights/src/routes/api/v1/[publicApiKey]/post/index.tsx#L8-43](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/api/v1/%5BpublicApiKey%5D/post/index.tsx#L8-L43) [packages/insights/src/root.tsx#L43-64](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/root.tsx#L43-L64) [packages/insights/src/routes/plugin@auth.ts#L1-14](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/plugin%40auth.ts#L1-L14)

## Data flow

Qwik transforms application code into addressable functions and associates runtime references with build manifests. SSR emits HTML plus container and state metadata, which the client consumes when execution resumes. Router transports action and loader results through Qwik serialization, while Insights converts validated telemetry into statistical database updates. Scaffolding follows a separate filesystem path that stages template merges and optionally invokes a package manager.
- Optimizer extraction records immutable symbol names, hashes, canonical filenames, byte offsets, body text, and QRL callee metadata for subsequent pipeline phases. — [packages/ts-optimizer/src/optimizer/extraction/extract.ts#L57-85](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/ts-optimizer/src/optimizer/extraction/extract.ts#L57-L85)
- resolveManifest merges the built and supplied manifests, then maps symbol hashes to symbol names and bundle filenames. — [packages/qwik/src/server/ssr-render.ts#L115-136](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-render.ts#L115-L136)
- SSR openContainer emits paused state, runtime version, build base, locale, manifest hash, and instance hash as container attributes. — [packages/qwik/src/server/ssr-container.ts#L637-661](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L637-L661)
- emitStateData directs the serialization context into the SSR writer inside a qwik/state script; eager-resume roots add an idle-event QRL. — [packages/qwik/src/server/ssr-container.ts#L1342-1364](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L1342-L1364)
- The documented state representation alternates type identifiers and encoded values, references shared roots, resolves promise forward references, and restores objects through allocation and inflation. — [packages/qwik/src/core/shared/serdes/serialization.md#L3-29](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/shared/serdes/serialization.md#L3-L29)
- DomContainer parses qwik/state, preprocesses roots, chooses eager restoration or wrapDeserializerProxy, processes segment state when enabled, and marks the container resumed. — [packages/qwik/src/core/client/dom-container.ts#L180-211](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/client/dom-container.ts#L180-L211)
- Event attributes encode chunk, symbol, and capture IDs; dispatch resolves the chunk relative to q:base and invokes the handler with capture IDs as its this value. — [packages/qwik/src/qwikloader.ts#L318-354](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L318-L354) [packages/qwik/src/qwikloader.ts#L212-235](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L212-L235)
- SignalImpl.value reads register effect subscriptions and back references; changed writes update the stored value and call scheduleEffects. — [packages/qwik/src/core/reactive-primitives/impl/signal-impl.ts#L61-107](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/reactive-primitives/impl/signal-impl.ts#L61-L107) [packages/qwik/src/core/reactive-primitives/impl/signal-impl.ts#L115-128](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/reactive-primitives/impl/signal-impl.ts#L115-L128)
- submitAction sends FormData or JSON to ?qaction=ID and decodes the response with _deserialize; actionHandler serializes result and optional loaderHashes. — [packages/qwik-router/src/runtime/src/use-endpoint.ts#L25-73](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/use-endpoint.ts#L25-L73) [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L107-122](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L107-L122)
- fetchRouteLoaderData constructs a manifest-versioned loader URL, optionally forwards the page path, caches requests by URL and full-path header, and handles redirects and aborts. — [packages/qwik-router/src/runtime/src/route-loaders.ts#L264-318](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/route-loaders.ts#L264-L318)
- Insights parses incoming JSON with InsightsPayload, normalizes symbol names, buckets delay/latency/timeline measurements, and passes application/manifest identifiers into updateEdge and updateRoutes. — [packages/insights/src/routes/api/v1/[publicApiKey]/post/index.tsx#L8-58](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/api/v1/%5BpublicApiKey%5D/post/index.tsx#L8-L58) [packages/insights/src/root.tsx#L25-41](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/root.tsx#L25-L41)
- createFromStarter writes initial package metadata and README, stages base and optional starter integrations through updateApp, and applies their filesystem writes through commit callbacks. — [packages/create-qwik/src/create-app.ts#L62-94](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/create-app.ts#L62-L94) [packages/qwik/src/cli/add/update-app.ts#L32-76](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/add/update-app.ts#L32-L76)

## Behavior traces

Four concrete flows were followed across their owning files: a server-rendered page and resumed event, a route action, project scaffolding, and Insights ingestion. These traces describe source control flow rather than observed runtime executions. They expose explicit synchronization points: SSR flushes, streamed-container readiness, action submission serialization, and database writes after response creation.
- Page request, step 1: createQwikRouter.router computes the origin, combines body limits, calls fromNodeHttp, and passes the resulting event to requestHandler. — [packages/qwik-router/src/middleware/node/index.ts#L48-83](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/node/index.ts#L48-L83)
- Page request, step 2: requestHandler obtains getRouterConfig, loads routes through loadRequestHandlers/loadRoute, resolves middleware, and calls runQwikRouter. — [packages/qwik-router/src/middleware/request-handler/request-handler.ts#L25-33](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-handler.ts#L25-L33) [packages/qwik-router/src/middleware/request-handler/request-handler.ts#L69-89](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-handler.ts#L69-L89) [packages/qwik-router/src/middleware/request-handler/request-handler.ts#L113-136](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-handler.ts#L113-L136)
- Page request, step 3: runQwikRouter creates RequestEvent and drives runNext; page middleware runs actions/loaders before renderQwikMiddleware supplies serverData and a stream to the application's render function. — [packages/qwik-router/src/middleware/request-handler/user-response.ts#L29-54](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/user-response.ts#L29-L54) [packages/qwik-router/src/middleware/request-handler/user-response.ts#L85-103](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/user-response.ts#L85-L103) [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L131-138](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L131-L138) [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L795-809](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L795-L809)
- SSR step: renderToStream resolves manifest/base, creates StreamHandler and SSRContainer, calls setServerPlatform and container.render, awaits the render promise, then flushes. — [packages/qwik/src/server/ssr-render.ts#L63-96](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-render.ts#L63-L96) [packages/qwik/src/server/ssr-container.ts#L177-198](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L177-L198)
- Resumed click step: qwikloader dispatch reads q-e:click, locates the container, waits for its ready marker when streaming, resolves/imports the handler, and invokes it with captured IDs. — [packages/qwik/src/qwikloader.ts#L130-144](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L130-L144) [packages/qwik/src/qwikloader.ts#L318-360](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L318-L360) [packages/qwik/src/qwikloader.ts#L218-235](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L218-L235)
- QRL invocation step: _run obtains DomContainer, waits for container data, creates invocation context, deserializes capture deltas, and calls runEventHandlerQRL; that function inflates the host element and invokes through retryOnPromise. — [packages/qwik/src/core/client/run-qrl.ts#L84-98](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/client/run-qrl.ts#L84-L98) [packages/qwik/src/core/client/run-qrl.ts#L45-76](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/client/run-qrl.ts#L45-L76) [packages/qwik/src/core/client/dom-container.ts#L180-211](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/client/dom-container.ts#L180-L211)
- Action flow: routeActionQrl.submit queues behind pendingDispatch and updates currentAction; the router task calls submitAction, actionHandler parses/validates/calls the QRL, and the client receives result plus invalidation hashes. — [packages/qwik-router/src/runtime/src/server-functions.ts#L93-147](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/server-functions.ts#L93-L147) [packages/qwik-router/src/runtime/src/qwik-router-component.tsx#L608-647](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/qwik-router-component.tsx#L608-L647) [packages/qwik-router/src/runtime/src/use-endpoint.ts#L55-73](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/use-endpoint.ts#L55-L73) [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L81-121](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L81-L121)
- Scaffold flow: create-qwik.mjs calls runCli; arguments choose runCreateCli, which builds a template manager, validates the target-directory policy, and invokes createApp. — [packages/create-qwik/create-qwik.mjs#L1-3](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/create-qwik.mjs#L1-L3) [packages/create-qwik/index.ts#L7-23](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/index.ts#L7-L23) [packages/create-qwik/src/run-create-cli.ts#L56-89](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/run-create-cli.ts#L56-L89)
- Scaffold write/install flow: createApp calls createFromStarter, updateApp merges integration files, commit creates directories and writes files, and installDeps delegates to runCommand using execa. — [packages/create-qwik/src/create-app.ts#L36-49](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/create-app.ts#L36-L49) [packages/create-qwik/src/create-app.ts#L71-94](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/create-app.ts#L71-L94) [packages/qwik/src/cli/add/update-app.ts#L44-76](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/add/update-app.ts#L44-L76) [packages/qwik/src/cli/utils/utils.ts#L8-34](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/utils/utils.ts#L8-L34)
- Insights persistence flow: plugin@db initializes the libSQL client; onPost parses and validates telemetry, sends an OK response, then resolves manifest/application records and awaits updateEdge/updateRoutes counter updates or inserts. — [packages/insights/src/routes/plugin@db.ts#L7-20](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/plugin%40db.ts#L7-L20) [packages/insights/src/routes/api/v1/[publicApiKey]/post/index.tsx#L8-43](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/api/v1/%5BpublicApiKey%5D/post/index.tsx#L8-L43) [packages/insights/src/db/query.ts#L270-293](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.ts#L270-L293) [packages/insights/src/db/query.ts#L309-329](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.ts#L309-L329)

## Testing signals

Tests and CI configuration were inspected, not executed; test existence is not a passing result. Vitest exercises package-level specifications, Playwright exercises browser and adapter behavior, and Rust optimizer tests use Insta snapshots. Inspected tests provide concrete coverage signals for serialization, streamed events, action responses, request limits, and database aggregation. Coverage remains bounded: this investigation did not establish complete test coverage or production behavior.
- The inspected root Vitest configuration includes package *.spec.* and *.unit.* files, excludes generated/dependency trees, loads vitest-setup.ts, and enables the TypeScript optimizer. — [vitest.config.ts#L15-35](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/vitest.config.ts#L15-L35)
- Serialization tests snapshot encoded Plain and RootRef values and separately test decoding; additional assertions restore signal effect back references and compute QRLs. — [packages/qwik/src/core/shared/serdes/serdes.unit.ts#L65-97](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/shared/serdes/serdes.unit.ts#L65-L97) [packages/qwik/src/core/shared/serdes/serdes.unit.ts#L1110-1132](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/shared/serdes/serdes.unit.ts#L1110-L1132)
- qwikloader.behavior.unit.ts reads dist/qwikloader.debug.js and executes it inside mocked browser globals, so its intended checks depend on current build output. — [packages/qwik/src/qwikloader.behavior.unit.ts#L7-8](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.behavior.unit.ts#L7-L8) [packages/qwik/src/qwikloader.behavior.unit.ts#L52-95](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.behavior.unit.ts#L52-L95)
- A loader regression test asserts that a click does not run before streamed-container data is ready and runs after QwikEvContainerReady is pushed. — [packages/qwik/src/qwikloader.behavior.unit.ts#L443-468](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.behavior.unit.ts#L443-L468)
- Playwright events.e2e.ts checks independent counter updates, prevented navigation, propagation behavior, and mouseleave/mouseover execution ordering. — [e2e/qwik-e2e/tests/events.e2e.ts#L15-47](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/e2e/qwik-e2e/tests/events.e2e.ts#L15-L47) [e2e/qwik-e2e/tests/events.e2e.ts#L50-93](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/e2e/qwik-e2e/tests/events.e2e.ts#L50-L93)
- Action-handler unit tests deserialize response bodies and assert default, explicit, and strict-mode invalidation semantics plus validator failure status. — [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.unit.ts#L72-136](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.unit.ts#L72-L136)
- Request-body-limit tests cover exact-limit acceptance, oversized single/multiple chunks, and invalid limit configuration. — [packages/qwik-router/src/middleware/request-handler/request-body-limit.unit.ts#L22-41](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-body-limit.unit.ts#L22-L41)
- Insights query tests use an in-memory libSQL client with explicit fixtures to check cross-manifest aggregation and isolation from another application's rows. — [packages/insights/src/db/query.unit.ts#L6-46](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.unit.ts#L6-L46) [packages/insights/src/db/query.unit.ts#L52-86](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.unit.ts#L52-L86)
- Rust test_input_fn invokes transform_modules and snapshot_res records emitted modules, maps, segment metadata, and diagnostics using insta::assert_snapshot!. — [packages/optimizer/core/src/test.rs#L7-35](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/optimizer/core/src/test.rs#L7-L35) [packages/optimizer/core/src/test.rs#L52-87](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/optimizer/core/src/test.rs#L52-L87)
- Core Playwright configuration uses *.e2e.ts, parallel execution, a localhost dev-server command, CI-only traces/screenshots, and forbidOnly; docs use a separate Chromium configuration. — [e2e/qwik-e2e/playwright.config.ts#L19-42](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/e2e/qwik-e2e/playwright.config.ts#L19-L42) [e2e/docs-e2e/playwright.config.ts#L5-32](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/e2e/docs-e2e/playwright.config.ts#L5-L32)
- Inspected CI defines unit and MCP checks plus sharded browser runs with QWIK_OPTIMIZER set from TS/Rust matrix entries; no CI run result was retrieved. — [.github/workflows/ci.yml#L934-943](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/ci.yml#L934-L943) [.github/workflows/ci.yml#L1063-1085](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/ci.yml#L1063-L1085) [.github/workflows/ci.yml#L1118-1136](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/ci.yml#L1118-L1136) [.github/workflows/ci.yml#L1198-1201](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/ci.yml#L1198-L1201)
- The inspected action unit harness mocks parseBody and QRL execution, and the Insights query fixtures test reads rather than the full authenticated ingestion path; those tests alone do not prove those integrations. — [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.unit.ts#L14-23](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.unit.ts#L14-L23) [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.unit.ts#L26-69](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.unit.ts#L26-L69) [packages/insights/src/db/query.unit.ts#L6-46](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.unit.ts#L6-L46)

## Risk map

The main sensitive boundaries are HTML/script generation, browser chunk loading, request routing and execution, scaffold filesystem writes, local inspection IPC, and privileged CI deployment. Concrete guards exist at several boundaries, including escaping, origin validation, byte limits, and loopback/token checks. Source inconsistencies and operational hypotheses below are not confirmed vulnerabilities. No runtime exploit, production configuration, credential value, or whole-repository absence was established.
- SSR escapes ordinary text and attribute values, while htmlNode writes raw HTML and dangerouslySetInnerHTML preserves supplied HTML; callers choosing raw output own a sensitive trust boundary. — [packages/qwik/src/server/ssr-container.ts#L933-942](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L933-L942) [packages/qwik/src/server/ssr-container.ts#L1797-1807](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L1797-L1807) [packages/qwik/src/server/ssr-container.ts#L1823-1835](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L1823-L1835) [packages/qwik/src/core/shared/utils/character-escaping.ts#L3-32](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/shared/utils/character-escaping.ts#L3-L32)
- Backpatch scripts replace '<' with a Unicode escape and apply a supplied nonce; sync-function scripts also propagate serverData.nonce. — [packages/qwik/src/server/ssr-container.ts#L1367-1375](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L1367-L1375) [packages/qwik/src/server/ssr-container.ts#L1422-1427](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L1422-L1427)
- Browser resolveHandler imports a URL derived from chunk metadata and q:base, then selects a named export; integrity of server-emitted QRL metadata is therefore a code-loading boundary. — [packages/qwik/src/qwikloader.ts#L218-235](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L218-L235) [packages/qwik/src/qwikloader.ts#L318-331](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.ts#L318-L331)
- Router enables checkOrigin by default and prepends CSRF checks for mutation methods; the check compares origins for simple content types, with an explicit lax-proto mode. — [packages/qwik-router/src/middleware/request-handler/request-handler.ts#L129-134](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-handler.ts#L129-L134) [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L112-120](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L112-L120) [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L713-745](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L713-L745)
- Server-function dispatch requires matching query hash/X-QRL and application/qwik-json, validates argument-array shape, and masks ordinary execution failures with an Invalid request response. — [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L557-586](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L557-L586)
- Internal full-path headers must be relative absolute-path forms under the loader prefix; scheme-relative paths, foreign origins, and malformed URLs are rejected. — [packages/qwik-router/src/middleware/request-handler/request-path.ts#L67-87](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-path.ts#L67-L87) [packages/qwik-router/src/middleware/request-handler/request-handler.ts#L101-110](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-handler.ts#L101-L110)
- limitRequestBody validates a positive safe integer and enforces a 10 MiB default by counting streamed bytes; Node middleware combines configured and caller-supplied limits using the smaller value. — [packages/qwik-router/src/middleware/request-handler/request-body-limit.ts#L3-42](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/request-body-limit.ts#L3-L42) [packages/qwik-router/src/middleware/node/index.ts#L55-70](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/node/index.ts#L55-L70)
- Loader result caching excludes redirect, error, and failed-result envelopes; developer-provided cache keys still define which successful serialized responses share cache entries. — [packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.ts#L66-92](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.ts#L66-L92) [packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.ts#L97-115](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.ts#L97-L115)
- Scaffolding can clear an existing target directory under --force, write outside the repository into an absolute outDir, and invoke package-manager install through execa. — [packages/create-qwik/src/run-create-cli.ts#L73-98](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/run-create-cli.ts#L73-L98) [packages/create-qwik/src/create-app.ts#L26-44](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/create-app.ts#L26-L44) [packages/qwik/src/cli/add/update-app.ts#L54-76](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/add/update-app.ts#L54-L76) [packages/qwik/src/cli/utils/utils.ts#L8-12](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/utils/utils.ts#L8-L12)
- MCP inspection guards its HTTP endpoint with loopback address, bearer token, absent Origin, exact Host, POST-only handling, and an 8192-byte request limit; discovery files use restrictive creation modes. — [packages/mcp/src/index.ts#L158-173](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/mcp/src/index.ts#L158-L173) [packages/mcp/src/index.ts#L243-268](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/mcp/src/index.ts#L243-L268) [packages/mcp/src/access.ts#L1-3](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/mcp/src/access.ts#L1-L3)
- Insights dashboard middleware requires a session email, but the inspected telemetry handler accepts a validated publicApiKey payload and permits auto-creation; schema validation is not itself proof of application ownership authorization. — [packages/insights/src/routes/app/layout.tsx#L6-13](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/app/layout.tsx#L6-L13) [packages/insights/src/routes/api/v1/[publicApiKey]/post/index.tsx#L8-24](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/api/v1/%5BpublicApiKey%5D/post/index.tsx#L8-L24) [packages/insights/src/root.tsx#L34-41](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/root.tsx#L34-L41)
- Insights sends its OK response before database operations finish, and counter-update comments explicitly accept missed-update risk from avoiding transactions. — [packages/insights/src/routes/api/v1/[publicApiKey]/post/index.tsx#L17-43](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/routes/api/v1/%5BpublicApiKey%5D/post/index.tsx#L17-L43) [packages/insights/src/db/query.ts#L267-269](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.ts#L267-L269) [packages/insights/src/db/query.ts#L306-308](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.ts#L306-L308)
- Hypothesis: first-insert delay histograms may use the wrong bucket because updateEdge increments delayBucketField(edge.latencyBucket), while existing-row updates use edge.delayBucket. This source inconsistency was not reproduced. (inferred) — [packages/insights/src/db/query.ts#L270-291](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/insights/src/db/query.ts#L270-L291)
- The root Dockerfile uses Node 16.12.0 and a network-fetched Rust installer, whereas the root manifest requires Node >=22.18.0; the CLI's checkNodeVersion also retains older Node thresholds. — [Dockerfile#L1-8](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/Dockerfile#L1-L8) [package.json#L188-194](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/package.json#L188-L194) [packages/create-qwik/index.ts#L26-49](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/index.ts#L26-L49) [packages/create-qwik/package.json#L17-23](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/package.json#L17-L23)
- Docs deployment is a privileged workflow_run artifact boundary: the job checks repository identity and artifact presence, but the inspected gating does not require workflow_run.conclusion == success despite the header comment. — [.github/workflows/deploy-docs.yml#L1-23](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/deploy-docs.yml#L1-L23) [.github/workflows/deploy-docs.yml#L25-41](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/deploy-docs.yml#L25-L41) [.github/workflows/deploy-docs.yml#L48-71](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/deploy-docs.yml#L48-L71)

## Extension points

Extension mechanisms generally use explicit factories, branded functions, package exports, or declarative metadata. Runtime APIs and serializers connect to an optimizer-aware public boundary, while Router discovers middleware and data functions from route modules. Scaffolding discovers packaged integrations and composes them through a staged update interface. Tooling provides additional named registries for experiments, lint rules, and MCP tools.
- core/index.ts is the public export boundary for components, QRLs, hooks, state primitives, and control-flow helpers; new public APIs must fit this export surface. — [packages/qwik/src/core/index.ts#L9-35](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L9-L35) [packages/qwik/src/core/index.ts#L111-166](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L111-L166) [packages/qwik/src/core/index.ts#L172-185](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L172-L185)
- setPlatform and CorePlatform provide a named platform abstraction, while createQwikPlugin accepts an injected _optimizer before selecting built-in optimizer providers. — [packages/qwik/src/core/index.ts#L41-45](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L41-L45) [packages/qwik-vite/src/plugins/plugin.ts#L168-180](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-vite/src/plugins/plugin.ts#L168-L180)
- ExperimentalFeatures is an explicit registry for compiler-replaced runtime flags, including control-flow primitives, validation, SPA behavior, Insights, and nonblocking loaders. — [packages/qwik-vite/src/plugins/plugin.ts#L74-98](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-vite/src/plugins/plugin.ts#L74-L98)
- routeLoaderQrl produces frozen server_loader functions carrying QRL, validators, ID, serialization strategy, cache-control, ETag, cache-key, search, and blockSSR metadata. — [packages/qwik-router/src/runtime/src/route-loaders.ts#L1097-1123](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/route-loaders.ts#L1097-L1123)
- routeActionQrl produces frozen server_action functions; resolveRequestHandlers discovers loaders/actions by examining branded exported functions in route modules. — [packages/qwik-router/src/runtime/src/server-functions.ts#L173-180](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/server-functions.ts#L173-L180) [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L164-174](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L164-L174)
- Route modules extend request execution through onRequest and method-specific onGet/onPost/onPut/onPatch/onDelete/onOptions/onHead handlers, each accepting a function or function array. — [packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L178-227](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/resolve-request-handlers-core.ts#L178-L227)
- qwikRouter builds a plugin array around router, server-function, and image plugins; ssgAdapter composes the shared viteAdapter with origin and SSG options. — [packages/qwik-router/src/buildtime/vite/plugin.ts#L74-80](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/buildtime/vite/plugin.ts#L74-L80) [packages/qwik-router/src/adapters/ssg/vite/index.ts#L5-20](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/adapters/ssg/vite/index.ts#L5-L20)
- loadIntegrations discovers app, feature, and adapter directories and reads package __qwik__ metadata for display name, documentation, priority, and alwaysInRoot rules. — [packages/qwik/src/cli/utils/integrations.ts#L32-64](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/utils/integrations.ts#L32-L64)
- makeTemplateManager separates standalone templates from base and treats library as a standalone bootstrap; updateApp returns staged updates plus a commit callback. — [packages/create-qwik/src/helpers/templateManager.ts#L25-69](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/create-qwik/src/helpers/templateManager.ts#L25-L69) [packages/qwik/src/cli/add/update-app.ts#L95-102](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/add/update-app.ts#L95-L102)
- Custom serialization APIs include useSerializer$ and createSerializer$; an inspected test supplies serialize/deserialize functions for a custom class. — [packages/qwik/src/core/index.ts#L127-127](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L127-L127) [packages/qwik/src/core/index.ts#L158-165](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/index.ts#L158-L165) [packages/qwik/src/core/shared/serdes/serdes.unit.ts#L1104-1113](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/shared/serdes/serdes.unit.ts#L1104-L1113)
- The ESLint plugin uses a rules table with recommended/strict severity maps, while createMcpServer defines tools through a named table of schemas and accepts an external call dispatcher. — [packages/eslint-plugin-qwik/index.ts#L22-77](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/eslint-plugin-qwik/index.ts#L22-L77) [packages/mcp/src/server.ts#L62-88](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/mcp/src/server.ts#L62-L88)

## Contributor handoff

Tests and CI were inspected, not executed, and this report is a bounded source inventory rather than exhaustive coverage or a verification certificate. Future work should begin at the package and protocol boundary implicated by the task. Serialization and routing changes require coordinated reader/writer inspection, while optimizer behavior must account for both implementations. Repository setup and verification guidance is recorded below for later authorized work; none of those commands ran here.
- Read root AGENTS.md and the owning package sources first; the monorepo map identifies core, Router, React, utilities, DOM, Vite integration, optimizers, scaffolding, docs, and Insights. — [AGENTS.md#L16-18](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L16-L18) [AGENTS.md#L40-61](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L40-L61)
- Shared guidance originates in .ruler; generated AGENTS.md/CLAUDE.md should not be edited directly, and the inspected ruler-check workflow regenerates and checks their drift. — [AGENTS.md#L20-28](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L20-L28) [.github/workflows/ruler-check.yml#L33-42](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/.github/workflows/ruler-check.yml#L33-L42)
- The documented focused loop is build.core.dev followed by the closest Vitest test or Chromium Playwright file; this audit inspected that guidance without executing its setup or verification commands. — [AGENTS.md#L93-109](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L93-L109) [vitest.config.ts#L25-35](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/vitest.config.ts#L25-L35) [e2e/qwik-e2e/playwright.config.ts#L30-41](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/e2e/qwik-e2e/playwright.config.ts#L30-L41)
- Optimizer selection differs between local test configuration and default provider selection; account for tsOptimizer:true, QWIK_OPTIMIZER overrides, and Rust binding prerequisites when planning authorized checks. — [vitest.config.ts#L15-22](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/vitest.config.ts#L15-L22) [packages/qwik-vite/src/plugins/plugin.ts#L106-115](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-vite/src/plugins/plugin.ts#L106-L115) [AGENTS.md#L85-90](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L85-L90)
- For state changes, read serialization.md, SSR emitStateData, and DomContainer's reader together; preserve type/value pairing, shared references, and the distinction between qwik/state and sync-function metadata. — [packages/qwik/src/core/shared/serdes/serialization.md#L3-37](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/shared/serdes/serialization.md#L3-L37) [packages/qwik/src/server/ssr-container.ts#L1342-1385](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/server/ssr-container.ts#L1342-L1385) [packages/qwik/src/core/client/dom-container.ts#L180-202](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/core/client/dom-container.ts#L180-L202)
- For action/loader protocol changes, inspect both server handlers and client transport; JSON-looking endpoints use Qwik serialization and have explicit invalidation, redirect, and caching semantics. — [packages/qwik-router/src/runtime/src/use-endpoint.ts#L55-73](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/use-endpoint.ts#L55-L73) [packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L107-122](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/action-handler.ts#L107-L122) [packages/qwik-router/src/runtime/src/route-loaders.ts#L1126-1149](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/runtime/src/route-loaders.ts#L1126-L1149) [packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.ts#L97-127](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.ts#L97-L127)
- Loader behavior tests consume built qwikloader.debug.js, so source-only edits without regenerated output can leave the intended verification testing stale artifacts. (inferred) — [packages/qwik/src/qwikloader.behavior.unit.ts#L7-8](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/qwikloader.behavior.unit.ts#L7-L8) [AGENTS.md#L95-98](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/AGENTS.md#L95-L98)
- Root tsc.check is not a substitute for every package's type checks: tsconfig.json explicitly excludes packages/qwik/src, scripts, and generated library trees. — [package.json#L295-297](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/package.json#L295-L297) [tsconfig.json#L45-56](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/tsconfig.json#L45-L56)
- Preserve compatibility boundaries: qwikCity delegates to qwikRouter, staticAdapter aliases ssgAdapter, and Node notFound is a deprecated pass-through slated for V3 removal. — [packages/qwik-router/src/buildtime/vite/plugin.ts#L65-70](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/buildtime/vite/plugin.ts#L65-L70) [packages/qwik-router/src/adapters/ssg/vite/index.ts#L16-17](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/adapters/ssg/vite/index.ts#L16-L17) [packages/qwik-router/src/middleware/node/index.ts#L100-105](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik-router/src/middleware/node/index.ts#L100-L105)
- Do not assume repository scripts are read-only: build/update scripts generate artifacts, scaffold commit writes files, and installDeps starts an external package manager. — [package.json#L198-209](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/package.json#L198-L209) [packages/qwik/src/cli/add/update-app.ts#L54-76](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/add/update-app.ts#L54-L76) [packages/qwik/src/cli/utils/install-deps.ts#L8-14](https://github.com/QwikDev/qwik/blob/8eb4589be115eb8f2dabfd12c107dcc23647caec/packages/qwik/src/cli/utils/install-deps.ts#L8-L14)

Source repository: https://github.com/QwikDev/qwik
Full evidence corpus: https://github.com/Codevetter/codevetter/tree/main/benchmarks/repo-unpacks/qwik.json

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)