@timber-js/app 0.2.0-alpha.147 → 0.2.0-alpha.148

package/src/routing/manifest-codegen.ts

@@ -0,0 +1,290 @@
+/**
+ * Route manifest codegen — generates virtual module source for the route
+ * manifest, search-params registry, and global schema.
+ *
+ * Extracted from plugins/routing.ts to keep it under the 500-line budget.
+ * See design/18-build-system.md §"Virtual Modules".
+ *
+ * Task: TIM-1071 item 8
+ */
+
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { collectInterceptionRewrites } from './interception.js';
+import type { RouteTree, SegmentNode, RouteFile } from './types.js';
+import { readFileCached } from './file-cache.js';
+
+// ── Single-file conventions ─────────────────────────────────────────────
+// Each entry maps to a node property that holds a single RouteFile.
+// Order matches the original serializeNode output for byte-identical diffs.
+const SINGLE_FILE_KEYS = [
+  'page',
+  'layout',
+  'middleware',
+  'access',
+  'route',
+  'error',
+  'default',
+  'denied',
+  'params',
+] as const;
+
+// ── Record-shaped conventions ───────────────────────────────────────────
+// Each entry maps to a node property that holds Record<string, RouteFile>.
+const RECORD_FILE_KEYS = [
+  'statusFiles',
+  'jsonStatusFiles',
+  'legacyStatusFiles',
+  'metadataRoutes',
+] as const;
+
+const SCHEMA_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx'];
+
+// ── Manifest generation ─────────────────────────────────────────────────
+
+/**
+ * Generate the virtual module source for the route manifest.
+ *
+ * The output is a default-exported object containing the serialized route tree.
+ * All file references use absolute paths (required for virtual modules).
+ */
+export function generateManifestModule(tree: RouteTree, viteRoot: string): string {
+  const imports: string[] = [];
+  let importIndex = 0;
+
+  function addImport(file: RouteFile): string {
+    const varName = `_route${importIndex++}`;
+    imports.push(`const ${varName} = () => import("${file.filePath}");`);
+    return varName;
+  }
+
+  function serializeRouteFile(key: string, file: RouteFile, indent: string): string {
+    const v = addImport(file);
+    return `${indent}${key}: { load: ${v}, filePath: ${JSON.stringify(file.filePath)} },`;
+  }
+
+  function serializeRouteFileRecord(
+    key: string,
+    record: Record<string, RouteFile>,
+    indent: string
+  ): string | null {
+    const entries = Object.entries(record);
+    if (entries.length === 0) return null;
+    const inner = entries.map(([name, file]) => {
+      const v = addImport(file);
+      return `${indent}    ${JSON.stringify(name)}: { load: ${v}, filePath: ${JSON.stringify(file.filePath)} }`;
+    });
+    return `${indent}${key}: {\n${inner.join(',\n')}\n${indent}},`;
+  }
+
+  function serializeNode(node: SegmentNode, indent: string): string {
+    const nextIndent = indent + '  ';
+    const parts: string[] = [];
+
+    parts.push(`${nextIndent}segmentName: ${JSON.stringify(node.segmentName)},`);
+    parts.push(`${nextIndent}segmentType: ${JSON.stringify(node.segmentType)},`);
+    parts.push(`${nextIndent}urlPath: ${JSON.stringify(node.urlPath)},`);
+
+    if (node.paramName) {
+      parts.push(`${nextIndent}paramName: ${JSON.stringify(node.paramName)},`);
+    }
+
+    if (node.interceptionMarker) {
+      parts.push(`${nextIndent}interceptionMarker: ${JSON.stringify(node.interceptionMarker)},`);
+    }
+    if (node.interceptedSegmentName) {
+      parts.push(
+        `${nextIndent}interceptedSegmentName: ${JSON.stringify(node.interceptedSegmentName)},`
+      );
+    }
+
+    // Single-file conventions — table-driven to avoid copy-paste drift
+    for (const key of SINGLE_FILE_KEYS) {
+      const file = node[key];
+      if (file) {
+        parts.push(serializeRouteFile(key, file, nextIndent));
+      }
+    }
+
+    // searchParams is now a named export from page.tsx, not a separate file.
+    // The page module's searchParams export is loaded via the page's lazy import.
+    // Runtime registration happens in the route loader using the page module.
+
+    // Record-shaped conventions — table-driven
+    for (const key of RECORD_FILE_KEYS) {
+      const record = node[key];
+      if (record) {
+        const line = serializeRouteFileRecord(key, record, nextIndent);
+        if (line) parts.push(line);
+      }
+    }
+
+    // Children
+    if (node.children.length > 0) {
+      const childNodes = node.children.map((c) => serializeNode(c, nextIndent));
+      parts.push(`${nextIndent}children: [\n${childNodes.join(',\n')}\n${nextIndent}],`);
+    } else {
+      parts.push(`${nextIndent}children: [],`);
+    }
+
+    // Parallel slots
+    const slotKeys = Object.keys(node.slots);
+    if (slotKeys.length > 0) {
+      const slotEntries: string[] = [];
+      for (const slotName of slotKeys) {
+        const slotNode = node.slots[slotName]!;
+        slotEntries.push(
+          `${nextIndent}    ${JSON.stringify(slotName)}: ${serializeNode(slotNode, nextIndent + '  ')}`
+        );
+      }
+      parts.push(`${nextIndent}slots: {\n${slotEntries.join(',\n')}\n${nextIndent}},`);
+    } else {
+      parts.push(`${nextIndent}slots: {},`);
+    }
+
+    return `${indent}{\n${parts.join('\n')}\n${indent}}`;
+  }
+
+  const rootSerialized = serializeNode(tree.root, '  ');
+
+  let proxyLine = '';
+  if (tree.proxy) {
+    const v = addImport(tree.proxy);
+    proxyLine = `  proxy: { load: ${v}, filePath: ${JSON.stringify(tree.proxy.filePath)} },`;
+  }
+
+  let globalErrorLine = '';
+  if (tree.globalError) {
+    const v = addImport(tree.globalError);
+    globalErrorLine = `  globalError: { load: ${v}, filePath: ${JSON.stringify(tree.globalError.filePath)} },`;
+  }
+
+  const rewrites = collectInterceptionRewrites(tree.root);
+  const rewritesLine =
+    rewrites.length > 0
+      ? `  interceptionRewrites: ${JSON.stringify(rewrites.map((r) => ({ interceptedPattern: r.interceptedPattern, interceptingPrefix: r.interceptingPrefix })))},`
+      : '';
+
+  const code = [
+    '// Auto-generated route manifest — do not edit.',
+    '// Generated by timber-routing plugin.',
+    '',
+    ...imports,
+    '',
+    'const manifest = {',
+    `  viteRoot: ${JSON.stringify(viteRoot)},`,
+    proxyLine,
+    globalErrorLine,
+    rewritesLine,
+    `  root: ${rootSerialized},`,
+    '};',
+    '',
+    'export default manifest;',
+  ]
+    .filter((line) => line !== undefined && line !== '')
+    .join('\n');
+
+  return code;
+}
+
+// ── Search-params registry ──────────────────────────────────────────────
+
+/**
+ * Walk the route tree and collect every page that exports a
+ * `searchParams` definition, then emit a module that statically imports
+ * each export and registers it into the shared search-params registry.
+ */
+export function generateSearchParamsRegistryModule(tree: RouteTree): string {
+  const entries: Array<{ urlPath: string; filePath: string }> = [];
+
+  function walk(node: SegmentNode): void {
+    if (node.page) {
+      if (node.params && fileHasSearchParamsExport(node.params.filePath)) {
+        entries.push({ urlPath: node.urlPath, filePath: node.params.filePath });
+      } else if (fileHasSearchParamsExport(node.page.filePath)) {
+        entries.push({ urlPath: node.urlPath, filePath: node.page.filePath });
+      }
+    }
+    for (const child of node.children) walk(child);
+    for (const slot of Object.values(node.slots)) walk(slot);
+  }
+  walk(tree.root);
+
+  entries.sort((a, b) => a.urlPath.localeCompare(b.urlPath));
+
+  const lines: string[] = [];
+  lines.push('// Auto-generated search-params registry — do not edit.');
+  lines.push('// Generated by timber-routing plugin (TIM-830).');
+  lines.push('');
+  lines.push("import { registerSearchParams } from '@timber-js/app/search-params';");
+  lines.push('');
+
+  entries.forEach((entry, i) => {
+    lines.push(`import { searchParams as r${i} } from ${JSON.stringify(entry.filePath)};`);
+  });
+  lines.push('');
+
+  entries.forEach((entry, i) => {
+    lines.push(`registerSearchParams(${JSON.stringify(entry.urlPath)}, r${i});`);
+  });
+  lines.push('');
+
+  lines.push('export {};');
+  lines.push('');
+
+  return lines.join('\n');
+}
+
+function fileHasSearchParamsExport(filePath: string): boolean {
+  try {
+    if (!existsSync(filePath)) return false;
+    const content = readFileCached(filePath);
+    return (
+      /export\s+(const|let|var)\s+searchParams\b/.test(content) ||
+      /export\s*\{[^}]*\bsearchParams\b[^}]*\}/.test(content)
+    );
+  } catch {
+    return false;
+  }
+}
+
+// ── Schema module ───────────────────────────────────────────────────────
+
+/**
+ * Generate the virtual:timber-schema module.
+ *
+ * When app/schema.{ts,tsx,js,jsx} exists, generates a module that
+ * imports the schema and resolves its segmentParams codecs into a
+ * bare-name codec map for runtime coercion.
+ */
+export function generateSchemaModule(appDir: string): string {
+  let schemaPath: string | null = null;
+  for (const ext of SCHEMA_EXTENSIONS) {
+    const candidate = join(appDir, `schema${ext}`);
+    if (existsSync(candidate)) {
+      schemaPath = candidate;
+      break;
+    }
+  }
+
+  if (!schemaPath) {
+    return [
+      '// Auto-generated schema loader — no app/schema.ts found.',
+      'export default null;',
+    ].join('\n');
+  }
+
+  return [
+    '// Auto-generated schema loader — do not edit.',
+    '// Generated by timber-routing plugin (TIM-931).',
+    '',
+    `import schema from ${JSON.stringify(schemaPath)};`,
+    `import { resolveSchemaCodecs } from '@timber-js/app/params';`,
+    '',
+    'const globalCodecs = schema?.segmentParams',
+    '  ? resolveSchemaCodecs(schema.segmentParams)',
+    '  : null;',
+    '',
+    'export default globalCodecs;',
+  ].join('\n');
+}

package/src/routing/scanner.ts

@@ -22,19 +22,7 @@ import { classifySegment } from './segment-classify.js';
 import { DEFAULT_PAGE_EXTENSIONS } from './types.js';
 import { classifyMetadataRoute, isDynamicMetadataExtension } from '../server/metadata-routes.js';
 import { swallow } from '../server/logger.js';
-
-/**
- * Pattern matching encoded path delimiters that must be rejected during route discovery.
- * %2F / %2f (forward slash) and %5C / %5c (backslash) can cause route collisions
- * when decoded. See design/13-security.md §"Encoded separators rejected".
- */
-const ENCODED_SEPARATOR_PATTERN = /%(?:2[fF]|5[cC])/;
-
-/**
- * Pattern matching encoded null bytes (%00) that must be rejected.
- * See design/13-security.md §"Null bytes rejected".
- */
-const ENCODED_NULL_PATTERN = /%00/;
+import { ENCODED_SEPARATOR_RE, NULL_BYTE_RE } from '../server/canonicalize.js';
 
 /**
  * File convention names that use pageExtensions (can be .tsx, .ts, .jsx, .js, .mdx, etc.)
@@ -319,17 +307,17 @@ function scanChildren(dirPath: string, parentNode: SegmentNode, extSet: Set<stri
     // Reject directories with encoded path delimiters or null bytes.
     // These can cause route collisions when decoded at the URL boundary.
     // See design/13-security.md §"Encoded separators rejected" and §"Null bytes rejected".
-    if (ENCODED_SEPARATOR_PATTERN.test(entry)) {
+    if (ENCODED_SEPARATOR_RE.test(entry)) {
       throw new Error(
-        `Build error: directory name contains an encoded path delimiter (%%2F or %%5C).\n` +
+        `Build error: directory name contains an encoded path delimiter (%2F or %5C).\n` +
           `  Directory: ${fullPath}\n` +
           `Encoded separators in directory names cause route collisions when decoded. ` +
           `Rename the directory to remove the encoded delimiter.`
       );
     }
-    if (ENCODED_NULL_PATTERN.test(entry)) {
+    if (NULL_BYTE_RE.test(entry)) {
       throw new Error(
-        `Build error: directory name contains an encoded null byte (%%00).\n` +
+        `Build error: directory name contains an encoded null byte (%00).\n` +
           `  Directory: ${fullPath}\n` +
           `Encoded null bytes in directory names are not allowed. ` +
           `Rename the directory to remove the null byte encoding.`

package/src/routing/schema-validation.ts

@@ -7,7 +7,7 @@
  * Design doc: design/41-global-params.md
  */
 
-import { readFileSync } from 'node:fs';
+import { readFileCached } from './file-cache.js';
 import type { RouteTree, SegmentNode } from './types.js';
 import { findSchemaFile, parseExistingSchemaKeys } from '../cli-schema-sync.js';
 import { classifyUrlSegment } from './segment-classify.js';
@@ -66,7 +66,7 @@ export function validateSchemaAgainstRoutes(tree: RouteTree, appDir: string): Sc
   const schemaPath = findSchemaFile(appDir);
   if (!schemaPath) return [];
 
-  const content = readFileSync(schemaPath, 'utf-8');
+  const content = readFileCached(schemaPath);
   const schemaKeys = parseExistingSchemaKeys(content);
 
   if (schemaKeys.length === 0) return [];

package/src/schema-bridge.ts

@@ -85,6 +85,63 @@ export function isCodec(value: unknown): value is Codec<unknown> {
   );
 }
 
+// ---------------------------------------------------------------------------
+// fromParamSchema — bridge from Standard Schema to Codec<T> for route params
+// ---------------------------------------------------------------------------
+
+/**
+ * Bridge a Standard Schema to a Codec for route params.
+ * Parse throws on failure (invalid param → 404). Serialize returns string.
+ */
+export function fromParamSchema<T>(fieldName: string, schema: StandardSchemaV1<T>): Codec<T> {
+  return {
+    parse(value: string | string[] | undefined): T {
+      const result = validateSync(schema, value);
+      if (!result.issues) {
+        return result.value;
+      }
+      const messages = result.issues.map((i) => i.message).join(', ');
+      throw new Error(`[timber] Param '${fieldName}' coercion failed: ${messages}`);
+    },
+    serialize(value: T): string | null {
+      if (value === null || value === undefined) return null;
+      if (Array.isArray(value)) return value.join('/');
+      return String(value);
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// resolveCodecOrSchema — generic resolver for any codec-or-schema field
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve a field value to a Codec. Accepts Codec<T>, StandardSchemaV1<T>,
+ * or (for route params) auto-wraps via fromParamSchema.
+ *
+ * @param fieldName - used in error messages
+ * @param value - the codec or schema to resolve
+ * @param mode - 'param' uses fromParamSchema (throws on parse failure),
+ *               'search' uses fromSchema (falls back to default on failure)
+ */
+export function resolveCodecOrSchema(
+  fieldName: string,
+  value: unknown,
+  mode: 'param' | 'search' = 'search'
+): Codec<unknown> {
+  if (isCodec(value)) return value;
+  if (isStandardSchema(value)) {
+    return mode === 'param'
+      ? fromParamSchema(fieldName, value)
+      : (fromSchema(value) as Codec<unknown>);
+  }
+  throw new Error(
+    `[timber] Field '${fieldName}' is not a valid codec or Standard Schema. ` +
+      `Expected an object with { parse, serialize } methods, or a Standard Schema object ` +
+      `(Zod, Valibot, ArkType).`
+  );
+}
+
 // ---------------------------------------------------------------------------
 // fromSchema — bridge from Standard Schema to Codec<T>
 // ---------------------------------------------------------------------------
@@ -119,13 +176,17 @@ export function fromSchema<T>(schema: StandardSchemaV1<T>): Codec<T> {
         return result.value;
       }
 
-      // On failure, try parsing undefined to get the default
+      // On failure, try parsing undefined to get the default.
+      // Re-validate each time so factory defaults (e.g. .default(() => []))
+      // produce fresh values.
       const defaultResult = validateSync(schema, undefined);
       if (!defaultResult.issues) {
         return defaultResult.value;
       }
 
-      // No default available — return undefined (codec design choice)
+      // No default available — return undefined (codec design choice).
+      // Callers like defineSearchParams validate this at definition time
+      // via validateSchemaDefaults() to catch it early.
       return undefined as T;
     },
 

package/src/search-params/define.ts

@@ -11,7 +11,7 @@
  */
 
 import { useQueryStates as clientUseQueryStates } from '../client/use-query-states.js';
-import { fromSchema, isStandardSchema, isCodec } from '../schema-bridge.js';
+import { fromSchema, isStandardSchema, isCodec, validateSync } from '../schema-bridge.js';
 import type { StandardSchemaV1 } from '../schema-bridge.js';
 import type { Codec } from '../codec.js';
 
@@ -184,7 +184,7 @@ function normalizeRaw(
   raw: URLSearchParams | Record<string, string | string[] | undefined>
 ): Record<string, string | string[] | undefined> {
   if (raw instanceof URLSearchParams) {
-    const result: Record<string, string | string[] | undefined> = {};
+    const result: Record<string, string | string[] | undefined> = Object.create(null);
     for (const key of new Set(raw.keys())) {
       const values = raw.getAll(key);
       result[key] = values.length === 1 ? values[0] : values;
@@ -220,6 +220,20 @@ function resolveField(
 
   // Auto-detect Standard Schema
   if (isStandardSchema(value)) {
+    // Validate that the schema handles absent params (undefined input).
+    // Search params are optional — the URL might not contain the param.
+    // If the schema rejects undefined and has no default, the codec would
+    // return `undefined as T`, making the type lie. Catch this at definition
+    // time instead. design/23-search-params.md §"Default Validation"
+    const absentCheck = validateSync(value, undefined);
+    if (absentCheck.issues) {
+      throw new Error(
+        `[timber] defineSearchParams: field '${fieldName}' has no default value and rejects undefined input.\n` +
+          `  Search params are optional — the URL might not contain ?${fieldName}=anything.\n` +
+          `  Add .default() to your schema: z.coerce.number().int().min(1).default(1)\n` +
+          `  Or use .optional() if the field is truly optional.`
+      );
+    }
     return { codec: fromSchema(value) };
   }
 
@@ -470,6 +484,11 @@ function buildDefinition<T extends Record<string, unknown>>(
     // Merge URL keys: base keys + new codec urlKeys from withUrlKey
     const combinedUrlKeys: Record<string, string> = { ...urlKeys, ...newUrlKeys };
 
+    // Same definition-time guard as defineSearchParams — a throw-on-absent
+    // codec added via extend() gets the friendly guidance error, not a
+    // crash on first parse (TIM-1066).
+    validateDefaults(combinedCodecs as Record<string, SearchParamCodec<unknown>>);
+
     return buildDefinition<Combined>(combinedCodecs, combinedUrlKeys);
   }
 
@@ -479,12 +498,25 @@ function buildDefinition<T extends Record<string, unknown>>(
     const pickedUrlKeys: Record<string, string> = {};
 
     for (const key of keys) {
+      // Explicit guard — TypeScript prevents this, but JS callers and
+      // casts reach here, and "Cannot read properties of undefined
+      // (reading 'serialize')" is no help (TIM-1066).
+      if (!(key in codecMap)) {
+        throw new Error(
+          `[timber] pick('${key}'): unknown key. ` +
+            `Available keys: ${Object.keys(codecMap)
+              .map((k) => `'${k}'`)
+              .join(', ')}.`
+        );
+      }
       pickedCodecs[key] = codecMap[key] as SearchParamCodec<unknown>;
       if (key in urlKeys) {
         pickedUrlKeys[key] = urlKeys[key];
       }
     }
 
+    validateDefaults(pickedCodecs);
+
     return buildDefinition<Pick<T, K>>(
       pickedCodecs as unknown as CodecMap<Pick<T, K>>,
       pickedUrlKeys

package/src/search-params/wrappers.ts

@@ -9,7 +9,23 @@
  */
 
 import type { SearchParamCodec, SearchParamCodecWithUrlKey, SearchParamField } from './define.js';
-import { isCodec, isStandardSchema, fromSchema } from '../schema-bridge.js';
+import { isCodec, isStandardSchema, fromSchema, validateSync } from '../schema-bridge.js';
+import type { StandardSchemaV1 } from '../schema-bridge.js';
+
+function validateSchemaAbsentParam<T>(
+  schema: StandardSchemaV1<T>,
+  fieldHint: string
+): SearchParamCodec<T> {
+  const absentCheck = validateSync(schema, undefined);
+  if (absentCheck.issues) {
+    throw new Error(
+      `[timber] withUrlKey: schema for '${fieldHint}' has no default value and rejects undefined input.\n` +
+        `  Search params are optional — the URL might not contain ?${fieldHint}=anything.\n` +
+        `  Add .default() to your schema or use .optional().`
+    );
+  }
+  return fromSchema(schema);
+}
 
 // ---------------------------------------------------------------------------
 // withDefault
@@ -78,11 +94,13 @@ export function withUrlKey<T>(
   codecOrSchema: SearchParamField<T>,
   urlKey: string
 ): SearchParamCodecWithUrlKey<T> {
-  // Auto-detect Standard Schema (Zod, Valibot, ArkType) and wrap
+  // Auto-detect Standard Schema (Zod, Valibot, ArkType) and wrap.
+  // Validate absent-param handling here since withUrlKey converts to a codec
+  // before resolveField sees it. design/23-search-params.md §"Default Validation"
   const codec: SearchParamCodec<T> = isCodec(codecOrSchema)
     ? codecOrSchema
     : isStandardSchema(codecOrSchema)
-      ? fromSchema(codecOrSchema)
+      ? validateSchemaAbsentParam(codecOrSchema, urlKey)
       : (codecOrSchema as SearchParamCodec<T>);
   return {
     parse: codec.parse.bind(codec),

package/src/segment-params/define.ts

@@ -14,12 +14,7 @@
  */
 
 import type { Codec } from '../codec.js';
-import {
-  type StandardSchemaV1,
-  validateSync,
-  isStandardSchema,
-  isCodec,
-} from '../schema-bridge.js';
+import { type StandardSchemaV1, resolveCodecOrSchema } from '../schema-bridge.js';
 import { useSegmentParams as clientUseSegmentParams } from '../client/use-segment-params.js';
 
 // ---------------------------------------------------------------------------
@@ -114,61 +109,6 @@ export interface ParamsDefinition<T extends Record<string, unknown>> {
 // Internal helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Wrap a Standard Schema into a Codec for route params.
- *
- * Unlike fromSchema for search params:
- * - Parse throws on failure (no fallback to default)
- * - Serialize returns string (not null)
- */
-function fromParamSchema<T>(fieldName: string, schema: StandardSchemaV1<T>): Codec<T> {
-  return {
-    parse(value: string | string[] | undefined): T {
-      // Route params are always strings (single segment) or string[] (catch-all)
-      const input = Array.isArray(value) ? value : value;
-
-      const result = validateSync(schema, input);
-      if (!result.issues) {
-        return result.value;
-      }
-
-      // For route params, parse failure means the param is invalid → throw
-      const messages = result.issues.map((i) => i.message).join(', ');
-      throw new Error(`[timber] Param '${fieldName}' coercion failed: ${messages}`);
-    },
-
-    serialize(value: T): string | null {
-      if (value === null || value === undefined) {
-        return null;
-      }
-      // Catch-all segments produce arrays — join with '/' for path reconstruction
-      if (Array.isArray(value)) {
-        return value.join('/');
-      }
-      return String(value);
-    },
-  };
-}
-
-/**
- * Resolve a field value to a Codec. Auto-detects Standard Schema objects.
- */
-function resolveField(fieldName: string, value: ParamField): Codec<unknown> {
-  if (isCodec(value)) {
-    return value;
-  }
-
-  if (isStandardSchema(value)) {
-    return fromParamSchema(fieldName, value);
-  }
-
-  throw new Error(
-    `[timber] defineSegmentParams: field '${fieldName}' is not a valid codec or Standard Schema. ` +
-      `Expected an object with { parse, serialize } methods, or a Standard Schema object ` +
-      `(Zod, Valibot, ArkType).`
-  );
-}
-
 /**
  * Validate that no codec's serialize returns null.
  * Route params are structural — they must produce a valid path segment.
@@ -224,7 +164,7 @@ export function defineSegmentParams<C extends Record<string, ParamField>>(
   const resolvedCodecs: Record<string, Codec<unknown>> = {};
 
   for (const [key, value] of Object.entries(codecs)) {
-    resolvedCodecs[key] = resolveField(key, value as ParamField);
+    resolvedCodecs[key] = resolveCodecOrSchema(key, value, 'param');
   }
 
   // Validate that serialize doesn't return null

package/src/server/access-gate.tsx

@@ -45,6 +45,14 @@ export function AccessGate(props: AccessGateProps): ReactNode | Promise<ReactNod
     if (verdict === 'pass') {
       return children;
     }
+    // Render deny page in-tree when possible (same as the fallback path).
+    if (verdict instanceof DenySignal && denyPages) {
+      const denyElement = renderMatchingDenyPage(denyPages, verdict.status, verdict.data);
+      if (denyElement) {
+        setDenyStatus(verdict.status);
+        return denyElement;
+      }
+    }
     throw verdict;
   }