@timber-js/app 0.2.0-alpha.185 → 0.2.0-alpha.187

package/src/server/slot-resolver.ts

@@ -26,11 +26,14 @@ import type { InterceptionContext, RouteMatch } from './pipeline.js';
 import { DenySignal, RedirectSignal } from './primitives.js';
 import { logRenderError } from './logger.js';
 import type { ManifestSegmentNode } from './route-matcher.js';
-import { setSlotParams } from './request-context.js';
+import { setSlotParams, runWithSlotSegmentParams } from './request-context.js';
 import { coerceSlotParams } from './param-coercion.js';
 import { matchUrlParts } from './tree-match.js';
+import { extractUrlParts, consumedPartsThroughSegment } from './chain-url-parts.js';
+import { findInterceptingMatch } from './slot-interception.js';
 import { SegmentOutlet } from '../client/segment-outlet.js';
-import { computeSlotKey, shouldSkipSlot, type ClientStateTree } from './state-tree-diff.js';
+import { shouldSkipSlot, type ClientStateTree } from './state-tree-diff.js';
+import { computeSlotKey } from '../routing/segment-keys.js';
 import { isStaticRequestDependent } from './request-dep.js';
 
 type CreateElementFn = (...args: unknown[]) => React.ReactElement;
@@ -96,21 +99,27 @@ export async function resolveSlotElement(
     : findSlotMatch(slotNode, match);
 
   if (slotMatch) {
-    // Store per-slot params in ALS so getSegmentParams(segmentPath) returns
-    // the slot's own param types (e.g. catch-all → string[] vs dynamic → string).
-    if (parentTreePath && Object.keys(slotMatch.slotParams).length > 0) {
-      // Build the full tree path: parent prefix + slot chain segment names.
-      const slotSuffix = slotMatch.chain
-        .map((s) => s.segmentName)
-        .filter(Boolean)
-        .join('/');
-      const prefix = parentTreePath === '/' ? '' : parentTreePath;
-      const fullSlotPath = `${prefix}/${slotSuffix}`;
-
-      // Coerce slot params through global schema codecs (same as main route).
-      const coerced = coerceSlotParams(slotMatch.chain, slotMatch.slotParams);
+    // Coerce the slot's own chain params through the global schema codecs
+    // (same as the main route) and expose them two ways:
+    //
+    //  - keyed, in the ALS slot map, so `getSegmentParams(slotPath)` resolves
+    //    from anywhere in the request;
+    //  - scoped, around every component this resolver invokes from the slot's
+    //    matched chain, so a no-arg `getSegmentParams()` inside the slot
+    //    returns the slot's params instead of the main route's. An
+    //    intercepting page has no other way to see its own params: the
+    //    pipeline re-matched the SOURCE pathname, so the main params describe
+    //    the page rendering *behind* the modal (TIM-1283).
+    //
+    // Both derive from the same coerced record, so the keyed overload and the
+    // no-arg call inside the slot can never disagree.
+    const coerced = coerceSlotParams(slotMatch.chain, slotMatch.slotParams);
+    const fullSlotPath = computeSlotSegmentPath(slotMatch.chain, parentTreePath);
+
+    if (fullSlotPath && Object.keys(coerced).length > 0) {
       setSlotParams(fullSlotPath, coerced);
     }
+    const scope = <T>(fn: () => T): T => runWithSlotSegmentParams(fullSlotPath, coerced, fn);
 
     const SlotPage = await loadComponent(slotMatch.page);
     if (SlotPage) {
@@ -137,7 +146,9 @@ export async function resolveSlotElement(
       } else {
         const SafeSlotPage = async (props: Record<string, unknown>) => {
           try {
-            return await (SlotPage as (props: Record<string, unknown>) => unknown)(props);
+            return await scope(() =>
+              (SlotPage as (props: Record<string, unknown>) => unknown)(props)
+            );
           } catch (error) {
             // RedirectSignal must propagate — the pipeline handles redirects
             // at the top level. Swallowing it here would silently return
@@ -165,11 +176,17 @@ export async function resolveSlotElement(
       // intermediate slot segments (everything between slot root and leaf).
       // Process innermost-first, same order as route-element-builder.ts
       // handles main segments. The slot root (index 0) is handled below.
-      element = await wrapWithIntermediateSegments(slotMatch.chain, element, h, accessVerdicts);
+      element = await wrapWithIntermediateSegments(
+        slotMatch.chain,
+        element,
+        h,
+        accessVerdicts,
+        scope
+      );
 
       // Wrap with slot root's layout — INSIDE the access gate, so the layout
       // server component never executes when access.ts denies. See TIM-1074.
-      element = await wrapWithLayout(slotNode, element, h);
+      element = await wrapWithLayout(slotNode, element, h, scope);
 
       // Wrap in SlotAccessGate if slot root has access.ts. The gate is
       // OUTSIDE the layout, matching the segment model in
@@ -178,10 +195,14 @@ export async function resolveSlotElement(
       // On denial: denied.tsx → default.tsx → null (graceful degradation),
       // rendered WITHOUT the denied slot's own layout.
       // See design/04-authorization.md §"Slot-Level Auth".
-      element = await wrapWithAccessGate(slotNode, element, h, accessVerdicts);
+      element = await wrapWithAccessGate(slotNode, element, h, accessVerdicts, scope);
 
       // Wrap with slot root's error boundaries (outermost)
-      element = await wrapSegmentWithErrorBoundaries(slotNode, element, h);
+      element = await wrapSegmentWithErrorBoundaries(slotNode, element, {
+        loadModule,
+        createElement: h,
+        errorBoundaryComponent: TimberErrorBoundary,
+      });
 
       // Catch-all error boundary: ensures slot errors NEVER propagate to the
       // parent layout. Without this, a slot without error.tsx that throws
@@ -207,6 +228,33 @@ export async function resolveSlotElement(
   return renderDefaultFallback(slotNode, h);
 }
 
+/**
+ * The full tree path of a slot's matched chain — the key both the ALS slot
+ * params map and the generated `getSegmentParams` overloads use.
+ *
+ * Built from the parent's tree path plus each chain node's directory name,
+ * so an intercepting node contributes its marker
+ * (`/gallery/@modal/(.)photo/[id]`) and a route group contributes its
+ * parentheses. Returns undefined when the caller has no parent tree path,
+ * which is how the resolver's test callers and any path-less entry point opt
+ * out of keyed lookups.
+ *
+ * One definition for both the render path and the eager access path: they
+ * key the same map, and a divergence would silently strand one of them.
+ */
+function computeSlotSegmentPath(
+  chain: ManifestSegmentNode[],
+  parentTreePath: string | undefined
+): string | undefined {
+  if (!parentTreePath) return undefined;
+  const slotSuffix = chain
+    .map((s) => s.segmentName)
+    .filter(Boolean)
+    .join('/');
+  const prefix = parentTreePath === '/' ? '' : parentTreePath;
+  return `${prefix}/${slotSuffix}`;
+}
+
 // ─── Element Wrapping Helpers ───────────────────────────────────────────────
 
 /**
@@ -229,29 +277,80 @@ async function wrapWithIntermediateSegments(
   chain: ManifestSegmentNode[],
   element: React.ReactElement,
   h: CreateElementFn,
-  accessVerdicts?: SlotAccessVerdict[]
+  accessVerdicts?: SlotAccessVerdict[],
+  scope?: SlotParamScope
 ): Promise<React.ReactElement> {
   for (let i = chain.length - 1; i > 0; i--) {
     const seg = chain[i];
-    element = await wrapSegmentWithErrorBoundaries(seg, element, h);
-    element = await wrapWithLayout(seg, element, h);
-    element = await wrapWithAccessGate(seg, element, h, accessVerdicts);
+    element = await wrapSegmentWithErrorBoundaries(seg, element, {
+      loadModule,
+      createElement: h,
+      errorBoundaryComponent: TimberErrorBoundary,
+    });
+    element = await wrapWithLayout(seg, element, h, scope);
+    element = await wrapWithAccessGate(seg, element, h, accessVerdicts, scope);
   }
   return element;
 }
 
+/**
+ * Runs a function with the slot's own segment params in scope.
+ *
+ * Applied to every component this module invokes from a slot's matched chain
+ * — page, layouts, access functions — so all of them agree on what a no-arg
+ * `getSegmentParams()` means inside a slot. A partial application would be
+ * worse than none: a layout and the page under it would disagree about the
+ * params of the same render.
+ */
+type SlotParamScope = <T>(fn: () => T) => T;
+
+/**
+ * Invokes a slot layout inside that slot's param scope.
+ *
+ * Declared at module scope, and given the layout and the scope as props,
+ * so its component identity is the same on every render. A closure created
+ * per render would be a new component type each time, and React would
+ * unmount and remount the whole layout subtree — including client
+ * components' state — on every navigation that re-renders the slot.
+ *
+ * Server component: the function-valued props are called here on the server
+ * and never reach the Flight stream, the same way `SlotAccessGate` takes
+ * `accessFn`.
+ */
+function ScopedSlotLayout(props: {
+  layout: (props: Record<string, unknown>) => unknown;
+  scope: SlotParamScope;
+  children: React.ReactElement;
+}): unknown {
+  return props.scope(() => props.layout({ children: props.children }));
+}
+
 /**
  * Wrap an element with a segment's layout component, if present.
+ *
+ * A server-component layout is invoked through the slot param scope, so it
+ * sees the slot's params rather than the main route's — a layout and the
+ * page beneath it must not disagree about the params of one render. A
+ * client-reference layout is passed through untouched: it never executes on
+ * the server, and its params arrive over the client channel
+ * (`useSegmentParams`).
  */
 async function wrapWithLayout(
   node: ManifestSegmentNode,
   element: React.ReactElement,
-  h: CreateElementFn
+  h: CreateElementFn,
+  scope?: SlotParamScope
 ): Promise<React.ReactElement> {
   if (!node.layout) return element;
   const Layout = await loadComponent(node.layout);
   if (!Layout) return element;
-  return h(Layout, { children: element });
+  if (!scope || isClientReference(Layout)) return h(Layout, { children: element });
+
+  return h(ScopedSlotLayout, {
+    layout: Layout as (props: Record<string, unknown>) => unknown,
+    scope,
+    children: element,
+  });
 }
 
 /**
@@ -262,12 +361,17 @@ async function wrapWithAccessGate(
   slotNode: ManifestSegmentNode,
   element: React.ReactElement,
   h: CreateElementFn,
-  accessVerdicts?: SlotAccessVerdict[]
+  accessVerdicts?: SlotAccessVerdict[],
+  scope?: SlotParamScope
 ): Promise<React.ReactElement> {
   if (!slotNode.access) return element;
 
-  const accessFn = await loadComponent(slotNode.access);
-  if (!accessFn) return element;
+  const loaded = await loadComponent(slotNode.access);
+  if (!loaded) return element;
+
+  // The gate calls this during render, so the scope has to travel with the
+  // function rather than wrap the call site.
+  const accessFn = scope ? () => scope(() => loaded()) : loaded;
 
   let DeniedComponent: ((...args: unknown[]) => unknown) | null = null;
   if (slotNode.denied) {
@@ -302,7 +406,7 @@ async function wrapWithAccessGate(
 // ─── Slot Matching ──────────────────────────────────────────────────────────
 
 /** Result of matching a slot's sub-tree against the current route. */
-interface SlotMatchResult {
+export interface SlotMatchResult {
   /** The page file at the matched leaf. */
   page: NonNullable<ManifestSegmentNode['page']>;
   /** The full chain of slot nodes traversed (slot root → … → leaf with page). */
@@ -326,25 +430,50 @@ interface SlotMatchResult {
  * We compare the matched route's segment chain against the slot's children
  * to find the deepest matching page.
  */
-function findSlotMatch(slotNode: ManifestSegmentNode, match: RouteMatch): SlotMatchResult | null {
-  const segments = match.segments;
-
-  // Find the parent segment that owns this slot by comparing urlPaths.
-  // The slot's urlPath matches its parent's urlPath (slots don't add URL depth).
-  // Search BACKWARDS to find the deepest (last) matching segment. Multiple
-  // segments can share the same urlPath when route groups are involved (e.g.,
-  // Root urlPath='/' and (browse) urlPath='/'). The slot's parent is always
-  // the deepest one — searching forward would incorrectly pick the root,
-  // making remainingSegments too long and breaking slot matching.
-  const slotUrlPath = slotNode.urlPath;
-  let parentIndex = -1;
+/**
+ * The index in the matched chain of the segment that owns this slot.
+ *
+ * **By identity**, because `urlPath` cannot answer it. Slots add no URL depth,
+ * so the owner shares the slot's `urlPath` — but so does every route group
+ * above it (`/` for both the root and `(browse)`), and since TIM-1280 so does
+ * an intercepting node on the children path, which sits *below* the owner.
+ * Picking the deepest urlPath match — the rule before this — therefore chose
+ * the intercepting node for a tree like `(browse)/@sidebar/` +
+ * `(browse)/(.)item/[id]/`, slicing one segment too many off the chain and
+ * handing `@sidebar` a shorter URL than it matches against. It would render
+ * its `default.tsx` where a page exists.
+ *
+ * The index must also agree with `slotUrlParts`, which slices the destination
+ * pathname at the same point and already used `indexOf(owner)`. Two derivations
+ * of one index is how they came apart; this is the shared one.
+ *
+ * The `urlPath` search survives only as a fallback for a `slotNode` that is not
+ * attached to any segment in the chain. Production never does that —
+ * `resolveSlotProps` iterates `segment.slots` — but unit tests construct a slot
+ * node standalone, and for those the old behaviour is still the right answer.
+ */
+export function findSlotOwnerIndex(
+  slotNode: ManifestSegmentNode,
+  segments: ManifestSegmentNode[]
+): number {
   for (let i = segments.length - 1; i >= 0; i--) {
-    if (segments[i].urlPath === slotUrlPath) {
-      parentIndex = i;
-      break;
+    for (const candidate of Object.values(segments[i].slots ?? {})) {
+      if (candidate === slotNode) return i;
     }
   }
 
+  for (let i = segments.length - 1; i >= 0; i--) {
+    if (segments[i].urlPath === slotNode.urlPath) return i;
+  }
+
+  return -1;
+}
+
+function findSlotMatch(slotNode: ManifestSegmentNode, match: RouteMatch): SlotMatchResult | null {
+  const segments = match.segments;
+
+  const parentIndex = findSlotOwnerIndex(slotNode, segments);
+
   // The remaining segments after the parent are what we need to match
   // against the slot's children.
   const remainingSegments = parentIndex >= 0 ? segments.slice(parentIndex + 1) : [];
@@ -367,96 +496,6 @@ function findSlotMatch(slotNode: ManifestSegmentNode, match: RouteMatch): SlotMa
   return { page: leaf.page, chain: result.chain, slotParams: result.params };
 }
 
-/**
- * Extract raw URL path parts from a main-route segment chain.
- *
- * Each dynamic segment consumed one URL part (its param value).
- * Static segments consumed their own name. Groups are transparent.
- * Catch-all segments consumed multiple parts (their param value is string[]).
- *
- * Uses rawSegmentParams (pre-coercion) to get actual URL strings.
- * Values are coerced to String() defensively in case a codec leaked
- * a non-string value into the params map.
- */
-export function extractUrlParts(
-  segments: ManifestSegmentNode[],
-  mainParams: Record<string, string | string[]>
-): string[] {
-  const parts: string[] = [];
-  for (const seg of segments) {
-    if (seg.segmentType === 'group') continue;
-    if (seg.segmentType === 'static') {
-      parts.push(seg.segmentName);
-    } else if (seg.paramName) {
-      const value = mainParams[seg.paramName];
-      if (Array.isArray(value)) {
-        parts.push(...value.map(String));
-      } else if (value !== undefined) {
-        // Reconstruct the original URL part for affixed segments.
-        // The param value is the stripped middle (e.g. "123" for [id].png
-        // matching "123.png"), so we re-attach prefix/suffix so that slot
-        // matching through matchUrlParts sees the original part.
-        const prefix = seg.paramPrefix ?? '';
-        const suffix = seg.paramSuffix ?? '';
-        parts.push(prefix + String(value) + suffix);
-      }
-    }
-  }
-  return parts;
-}
-
-/**
- * Find a matching intercepting route in a slot's children for the target pathname.
- *
- * When interception is active, the pipeline has already re-matched the source URL.
- * Here we check the slot's intercepting children (e.g. `(.)photo/[id]`) against
- * the target pathname to find which intercepting page to render.
- *
- * The interceptedSegmentName tells us the first URL segment to look for in the
- * target pathname. We then walk the intercepting child's sub-tree to match
- * remaining segments.
- */
-function findInterceptingMatch(
-  slotNode: ManifestSegmentNode,
-  targetPathname: string
-): SlotMatchResult | null {
-  const targetParts = targetPathname === '/' ? [] : targetPathname.slice(1).split('/');
-
-  for (const child of slotNode.children) {
-    if (child.segmentType !== 'intercepting' || !child.interceptedSegmentName) continue;
-
-    const segName = child.interceptedSegmentName;
-
-    // Find where the intercepted segment name appears in the target parts.
-    // Search from the end since intercepted routes match the URL tail.
-    let matchIdx = -1;
-    for (let i = targetParts.length - 1; i >= 0; i--) {
-      if (targetParts[i] === segName) {
-        matchIdx = i;
-        break;
-      }
-    }
-    if (matchIdx < 0) continue;
-
-    // Match remaining target parts against the intercepting child's sub-tree.
-    const remaining = targetParts.slice(matchIdx + 1);
-    const result = matchUrlParts(child, remaining);
-    if (result) {
-      const leaf = result.chain[result.chain.length - 1];
-      if (leaf.page) {
-        return {
-          page: leaf.page,
-          // Prepend slotNode — matchUrlParts starts from child, not slot root
-          chain: [slotNode, ...result.chain],
-          slotParams: result.params,
-        };
-      }
-    }
-  }
-
-  return null;
-}
-
 // ─── Slot Access Evaluation ─────────────────────────────────────────────────
 
 /** Result of eagerly evaluating one segment's access.ts. */
@@ -483,7 +522,8 @@ export interface SlotAccessVerdict {
  */
 async function evaluateSlotAccessChain(
   slotRoot: ManifestSegmentNode,
-  chain: ManifestSegmentNode[]
+  chain: ManifestSegmentNode[],
+  scope?: SlotParamScope
 ): Promise<SlotAccessVerdict[]> {
   // Collect all nodes with access.ts: slot root + intermediate chain segments
   const nodesWithAccess: ManifestSegmentNode[] = [];
@@ -502,7 +542,7 @@ async function evaluateSlotAccessChain(
       continue;
     }
     try {
-      await accessFn();
+      await (scope ? scope(() => accessFn()) : accessFn());
       results.push({ node, verdict: 'pass' });
     } catch (e) {
       if (e instanceof DenySignal) {
@@ -541,6 +581,68 @@ export interface SlotSkipEntry {
   skipped?: boolean;
 }
 
+/**
+ * The destination URL parts a segment's slots match against.
+ *
+ * A slot walks its own sub-tree starting where its owning segment stopped
+ * consuming the URL, so the parts are sliced at the length its ancestors
+ * consumed. Shared by `resolveSlotProps` and `publishSlotSegmentParams` — both
+ * have to slice identically or the two would disagree about which page a slot
+ * matched, and only one of them would be right.
+ *
+ * @internal
+ */
+export function slotUrlParts(
+  segment: ManifestSegmentNode,
+  match: RouteMatch,
+  url: string
+): string[] {
+  const pathname = new URL(url, 'http://localhost').pathname;
+  // Slice through the owning segment inclusive, to match findSlotMatch, which
+  // walks the chain from parentIndex + 1. `consumedUrlParts` drops the root
+  // (it consumes no URL part) and honors the interception anchor, so a slot on
+  // a retained owner above a climbing marker is not handed parts the target
+  // does not contain.
+  const sliceAt = consumedPartsThroughSegment(segment, match).length;
+  const all = pathname === '/' ? [] : pathname.slice(1).split('/');
+  return all.slice(sliceAt);
+}
+
+/**
+ * Seed per-slot segment params for a segment whose layout is being SKIPPED.
+ *
+ * `resolveSlotProps` seeds these as part of resolving slot props, but a skipped
+ * layout never gets there — `route-element-builder` continues past it. Its
+ * slots are still mounted on the client, though, so leaving them out of the
+ * published map made `useSegmentParams(slotPath)` fall back to the main route's
+ * record after any navigation that skipped their parent (TIM-1285).
+ *
+ * Only the params are seeded. Nothing renders, no access chain runs — a skipped
+ * layout's slots are unchanged by definition, which is what made it skippable.
+ *
+ * @internal
+ */
+export function publishSlotSegmentParams(
+  segment: ManifestSegmentNode,
+  match: RouteMatch,
+  destinationUrl: string,
+  parentTreePath: string | undefined
+): void {
+  const slotEntries = Object.entries(segment.slots ?? {});
+  if (slotEntries.length === 0) return;
+  const destinationParts = slotUrlParts(segment, match, destinationUrl);
+
+  for (const [, slotNode] of slotEntries) {
+    const destMatch = matchUrlParts(slotNode as ManifestSegmentNode, destinationParts);
+    if (!destMatch) continue;
+    const coerced = coerceSlotParams(destMatch.chain, destMatch.params);
+    const fullSlotPath = computeSlotSegmentPath(destMatch.chain, parentTreePath);
+    if (fullSlotPath && Object.keys(coerced).length > 0) {
+      setSlotParams(fullSlotPath, coerced);
+    }
+  }
+}
+
 interface ResolveSlotPropsArgs {
   segment: ManifestSegmentNode;
   segmentId: string;
@@ -591,16 +693,7 @@ export async function resolveSlotProps({
   const destinationPathname = destParsed.pathname;
   const departingPathname = depParsed?.pathname ?? null;
 
-  // Compute URL parts for slot skip comparison.
-  // Include the owning segment (segIdx + 1) to match findSlotMatch,
-  // which slices at parentIndex + 1. Filter out the root segment
-  // (segmentName === '') — it maps to '/' and doesn't consume a URL part.
-  const segIdx = match.segments.indexOf(segment);
-  const parentSegments =
-    segIdx >= 0 ? match.segments.slice(0, segIdx + 1).filter((s) => s.segmentName !== '') : [];
-  const rawParams = match.rawSegmentParams ?? match.segmentParams ?? {};
-  const parentConsumedParts = extractUrlParts(parentSegments, rawParams);
-  const sliceAt = parentConsumedParts.length;
+  const sliceAt = consumedPartsThroughSegment(segment, match).length;
 
   function splitPathname(pathname: string): string[] {
     return pathname === '/' ? [] : pathname.slice(1).split('/');
@@ -608,7 +701,7 @@ export async function resolveSlotProps({
 
   const destinationAll = splitPathname(destinationPathname);
   const departingAll = departingPathname ? splitPathname(departingPathname) : null;
-  const destinationParts = destinationAll.slice(sliceAt);
+  const destinationParts = slotUrlParts(segment, match, destinationUrl);
   const departingParts = departingAll ? departingAll.slice(sliceAt) : null;
   const clientSlots = clientStateTree?.slots ?? null;
 
@@ -633,15 +726,18 @@ export async function resolveSlotProps({
     // files calling getSegmentParams() see the slot's own coerced params,
     // not the main route's. This is the same seeding that resolveSlotElement
     // does, but we need it here for the eager path.
-    if (destMatch && parentTreePath && Object.keys(destMatch.params).length > 0) {
-      const slotSuffix = destMatch.chain
-        .map((s) => s.segmentName)
-        .filter(Boolean)
-        .join('/');
-      const prefix = parentTreePath === '/' ? '' : parentTreePath;
-      const fullSlotPath = `${prefix}/${slotSuffix}`;
+    let eagerScope: SlotParamScope | undefined;
+    if (destMatch) {
       const coerced = coerceSlotParams(destMatch.chain, destMatch.params);
-      setSlotParams(fullSlotPath, coerced);
+      const fullSlotPath = computeSlotSegmentPath(destMatch.chain, parentTreePath);
+      if (fullSlotPath && Object.keys(coerced).length > 0) {
+        setSlotParams(fullSlotPath, coerced);
+      }
+      // The eager path calls access.ts outside the React tree, so the render
+      // scope in resolveSlotElement cannot cover it. Without this, the same
+      // access.ts would read the main route's params when the slot is a skip
+      // candidate and the slot's own params when it is not.
+      eagerScope = (fn) => runWithSlotSegmentParams(fullSlotPath, coerced, fn);
     }
 
     // Check non-access skip conditions first. If any of these fail,
@@ -674,7 +770,7 @@ export async function resolveSlotProps({
     // "No access check for default.tsx" (destMatch null = unmatched slot).
     const chainVerdicts =
       isSkipCandidate && destMatch
-        ? await evaluateSlotAccessChain(slotManifest, destMatch.chain)
+        ? await evaluateSlotAccessChain(slotManifest, destMatch.chain, eagerScope)
         : [];
     const accessBlocked = chainVerdicts.some((v) => v.verdict !== 'pass');
     const canSkip = isSkipCandidate && !accessBlocked;
@@ -713,7 +809,16 @@ export async function resolveSlotProps({
       let slotRequestDep = false;
       const destLeaf = destMatch?.chain[destMatch.chain.length - 1];
       const hasRenderedPage = destMatch && destLeaf?.page;
-      if (hasRenderedPage) {
+      if (interception) {
+        // `destMatch` walks the slot's ordinary children against the
+        // destination URL; the interception resolver renders an intercepting
+        // child instead, which that walk never sees. So the files analyzed
+        // below are not the files that rendered — and `false` here tells the
+        // client the slot is reusable. Stay conservative: a needlessly
+        // request-dependent slot is a wasted refetch, a wrongly static one is
+        // a stale modal.
+        slotRequestDep = true;
+      } else if (hasRenderedPage) {
         // Check slot root layout (rendered by wrapWithLayout)
         if (
           slotManifest.layout?.filePath &&

package/src/server/ssr-bridge-types.ts

@@ -42,6 +42,12 @@ export interface NavContext {
   segmentParams: Record<string, string | string[]>;
   /** Search params from the URL */
   searchParams: Record<string, string>;
+  /**
+   * Per-slot segment params, keyed by slot tree path. Absent when the request
+   * rendered no slot with params of its own. Feeds `useSegmentParams(path)`
+   * during SSR and, via `__timber_slot_params`, after hydration (TIM-1285).
+   */
+  slotParams?: Record<string, Record<string, string | string[]>>;
   /** The committed HTTP status code */
   statusCode: number;
   /** Response headers from middleware/proxy */
@@ -64,6 +70,18 @@ export interface NavContext {
   /** Request cookies as name→value pairs. Used by useCookie() during SSR
    *  to return correct cookie values before hydration. */
   cookies?: Map<string, string>;
+  /**
+   * Lazy thunk that produces the `<script>self.__timber_segments=…</script>`
+   * tag. Invoked by the SSR entry AFTER `renderSsrNodeStream` /
+   * `renderSsrStream` returns (shell ready ⇒ AccessGates settled), so the
+   * `getFirstDeniedSegmentIndex()` ALS value is authoritative. The result
+   * is appended to headHtml before the head injector runs.
+   *
+   * Undefined when client JS is disabled (no client to consume it).
+   * See TIM-1365, TIM-1359.
+   */
+  getHeadSegmentScript?: () => string;
+
   /**
    * Mutable flag: set by TimberErrorBoundary during SSR when it catches
    * a DenySignal (via digest). This tells the RSC entry that the denial