Qwik City lazy-loaded route chunks exposed without authorization guards

Qwik City utilizes file-based routing where route components are lazy-loaded via dynamic imports. This process generates separate entry chunks that the browser fetches via the client-side loader when a user navigates to a specific path.

Currently, the framework lacks a built-in declarative mechanism to restrict access to these generated chunks based on user roles or authentication. While layout-level guards can handle redirects for the UI, the underlying JavaScript chunk files themselves remain accessible via direct URL if the path is known or intercepted.

There is no documented standard API for route-level protection that prevents the server from serving the chunk if the developer does not implement custom server-side validation within the loader or layout logic.

• Is there a recommended pattern to prevent the browser from requesting lazy-loaded chunks for unauthenticated users?
• How should server-side authorization be integrated with Qwik's chunk-splitting to ensure security?