@timber-js/app 0.2.0-alpha.2 → 0.2.0-alpha.200

package/src/client/unload-guard.ts

@@ -8,24 +8,56 @@
  * unloaded so error boundaries and error handlers can suppress abort-related
  * errors during the unload window.
  *
+ * This is the single owner of "is this document going away". Anything that
+ * needs the answer imports `isPageUnloading()` — an unload flag maintained a
+ * second time somewhere else is a flag that will drift out of agreement with
+ * this one (TIM-1260).
+ *
  * Mutable state is delegated to client/state.ts for singleton guarantees.
  * See design/18-build-system.md §"Singleton State Registry"
  *
  * See design/10-error-handling.md §"Known limitation: deny() inside Suspense and hydration"
  */
 
-import { unloading, _setUnloading } from './state.js';
+import { unloading, _setUnloading } from './state.ts';
+
+/**
+ * Departure is *committed*: `pagehide` has fired, or this document has called
+ * reload() on itself. `beforeunload` alone doesn't qualify — it is
+ * speculative, and the user can still cancel out of it.
+ */
+let committed = false;
 
 if (typeof window !== 'undefined') {
   window.addEventListener('beforeunload', () => {
     _setUnloading(true);
+
+    // An app with an unsaved-changes prompt can have this cancelled. Nothing
+    // fires to say so, so the only signal is that the page is still running
+    // afterwards — and timers are blocked while the modal is up, so this task
+    // cannot run until the user has chosen. If they left, `pagehide` has
+    // already committed and this is a no-op.
+    setTimeout(() => {
+      if (!committed) _setUnloading(false);
+    }, 0);
   });
 
-  // Also detect pagehide for bfcache-aware browsers (Safari).
-  // pagehide fires for both navigations and page hide events.
+  // pagehide is the committed-departure event, and fires for both navigations
+  // and bfcache entry. Safari in particular may skip beforeunload entirely.
   window.addEventListener('pagehide', () => {
+    committed = true;
     _setUnloading(true);
   });
+
+  window.addEventListener('pageshow', (event) => {
+    // A bfcache restore un-does the teardown `pagehide` announced: the same
+    // document is alive again, with this module's state intact. Without the
+    // reset, every consumer would go on suppressing errors on a live page.
+    if (event.persisted) {
+      committed = false;
+      _setUnloading(false);
+    }
+  });
 }
 
 /**

package/src/client/use-cookie.ts

@@ -8,8 +8,17 @@
  * See design/29-cookies.md §"useCookie(name) Hook"
  */
 
-import { useSyncExternalStore } from 'react';
-import { getSsrData } from './ssr-data.js';
+// Namespace access, not `import { useSyncExternalStore }`. This module is
+// reachable from `@timber-js/app/cookies` — `defineCookie()` exposes both a
+// server `.get()` and a client `.useCookie()`, so the entry is isomorphic and
+// loads in the RSC environment. React's `react-server` export withholds
+// `useSyncExternalStore` exactly as it withholds `createContext`, and a *named*
+// ESM import of a missing export fails at module instantiation, before any
+// code runs. Same rule as `client/params-context.ts` (TIM-1297, TIM-1298).
+import * as React from 'react';
+import { parseCookie, stringifySetCookie } from 'cookie';
+import { getSsrData } from './ssr-data.ts';
+import { assertValidCookieName } from '../cookies/validation.ts';
 
 // ─── Types ────────────────────────────────────────────────────────────────
 
@@ -38,26 +47,31 @@ type Listener = () => void;
 const listeners = new Map<string, Set<Listener>>();
 
 /** Parse a cookie name from document.cookie. */
-function getCookieValue(name: string): string | undefined {
+export function getCookieValue(name: string): string | undefined {
   if (typeof document === 'undefined') return undefined;
-  const match = document.cookie.match(
-    new RegExp('(?:^|;\\s*)' + name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\s*=\\s*([^;]*)')
-  );
-  return match ? decodeURIComponent(match[1]) : undefined;
+  const cookies = parseCookie(document.cookie);
+  return cookies[name];
 }
 
 /** Serialize options into a cookie string suffix. */
-function serializeOptions(options?: ClientCookieOptions): string {
+export function serializeOptions(options?: ClientCookieOptions): string {
   if (!options) return '; Path=/; SameSite=Lax';
-  const parts: string[] = [];
-  parts.push(`Path=${options.path ?? '/'}`);
-  if (options.domain) parts.push(`Domain=${options.domain}`);
-  if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);
-  if (options.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
   const sameSite = options.sameSite ?? 'lax';
-  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
-  if (options.secure) parts.push('Secure');
-  return '; ' + parts.join('; ');
+  // Build a Set-Cookie string via the cookie package, then strip the
+  // `__placeholder__=` name=value prefix to get just the attributes.
+  const full = stringifySetCookie({
+    name: '__placeholder__',
+    value: '',
+    path: options.path ?? '/',
+    domain: options.domain,
+    maxAge: options.maxAge,
+    expires: options.expires,
+    sameSite,
+    secure: options.secure,
+  });
+  // Strip everything up to and including the first "; "
+  const idx = full.indexOf('; ');
+  return idx >= 0 ? full.slice(idx) : '';
 }
 
 /** Notify all subscribers for a given cookie name. */
@@ -68,6 +82,17 @@ function notify(name: string): void {
   }
 }
 
+/**
+ * Notify useCookie subscribers that a cookie value changed.
+ * Called by defineCookie's imperative client .set()/.delete() methods
+ * so mounted useCookie() consumers re-render.
+ *
+ * @internal — framework use only
+ */
+export function notifyCookieChange(name: string): void {
+  notify(name);
+}
+
 // ─── Hook ─────────────────────────────────────────────────────────────────
 
 /**
@@ -99,12 +124,39 @@ export function useCookie(
   };
 
   const getSnapshot = (): string | undefined => getCookieValue(name);
-  const getServerSnapshot = (): string | undefined => getSsrData()?.cookies.get(name);
+  const getServerSnapshot = (): string | undefined => {
+    // During SSR, read the ALS-backed request cookies.
+    const ssrData = getSsrData();
+    if (ssrData) return ssrData.cookies.get(name);
+    // During client hydration there is no SSR data (it lives in the server's
+    // module graph), but React still calls getServerSnapshot. document.cookie
+    // holds the same cookies the server rendered with, so reading it here
+    // keeps the hydration render consistent with the server HTML.
+    // See design/29-cookies.md §"SSR Hydration".
+    return getCookieValue(name);
+  };
 
-  const value = useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+  const value = React.useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+
+  // Validate the name once per hook instance — names are typically
+  // stable string literals, so this catches the bug at first render
+  // rather than on every write. Throws via `assertValidCookieName` with
+  // a precise error if the name violates RFC 7230 token rules.
+  assertValidCookieName(name);
 
   const setCookie: CookieSetter = (newValue: string, options?: ClientCookieOptions) => {
+    if (typeof newValue !== 'string') {
+      throw new Error(
+        `[timber] useCookie(${JSON.stringify(name)}): value must be a string, got ${typeof newValue}.\n` +
+          `  To store a JSON-serializable value, use defineCookie + jsonCookieCodec from\n` +
+          `  '@timber-js/app/cookies' and call its useCookie() hook instead.`
+      );
+    }
     const merged = { ...defaultOptions, ...options };
+    // Auto-encode mirrors the server's `cookies().set()` contract:
+    // values are URL-encoded on write, URL-decoded on read, so the
+    // logical bytes round-trip losslessly. See design/29-cookies.md
+    // §"Encoding Contract".
     document.cookie = `${name}=${encodeURIComponent(newValue)}${serializeOptions(merged)}`;
     notify(name);
   };

package/src/client/use-link-status.ts

@@ -1,26 +1,26 @@
 'use client';
 
-// useLinkStatus — returns { pending: true } while the nearest parent <Link>'s
+// useLinkStatus — returns { isPending: true } while the nearest parent <Link>'s
 // navigation is in flight. No arguments — scoped via React context.
 // See design/19-client-navigation.md §"useLinkStatus()"
 
 import { useContext, createContext } from 'react';
 
 export interface LinkStatus {
-  pending: boolean;
+  isPending: boolean;
 }
 
 /**
  * React context provided by <Link>. Holds the pending status
  * for that specific link's navigation.
  */
-export const LinkStatusContext = createContext<LinkStatus>({ pending: false });
+export const LinkStatusContext = createContext<LinkStatus>({ isPending: false });
 
 /**
- * Returns `{ pending: true }` while the nearest parent `<Link>` component's
+ * Returns `{ isPending: true }` while the nearest parent `<Link>` component's
  * navigation is in flight. Must be used inside a `<Link>` component's children.
  *
- * Unlike `useNavigationPending()` which is global, this hook is scoped to
+ * Unlike `usePendingNavigation()` which is global, this hook is scoped to
  * the nearest parent `<Link>` — only the link the user clicked shows pending.
  *
  * ```tsx
@@ -28,8 +28,8 @@ export const LinkStatusContext = createContext<LinkStatus>({ pending: false });
  * import { Link, useLinkStatus } from '@timber-js/app/client'
  *
  * function Hint() {
- *   const { pending } = useLinkStatus()
- *   return <span className={pending ? 'opacity-50' : ''} />
+ *   const { isPending } = useLinkStatus()
+ *   return <span className={isPending ? 'opacity-50' : ''} />
  * }
  *
  * export function NavLink({ href, children }) {

package/src/client/use-pathname.ts

@@ -4,47 +4,38 @@
  * Returns the pathname portion of the current URL (e.g. '/dashboard/settings').
  * Updates when client-side navigation changes the URL.
  *
- * On the client, reads from NavigationContext which is updated atomically
- * with the RSC tree render. This replaces the previous useSyncExternalStore
- * approach which only subscribed to popstate events — meaning usePathname()
- * did NOT re-render on forward navigation (pushState). The context approach
- * fixes this: pathname updates in the same render pass as the new tree.
+ * One unconditional read of NavigationContext, on every side (TIM-1425):
  *
- * During SSR, reads the request pathname from the SSR ALS context
- * (populated by ssr-entry.ts) instead of window.location.
+ * - In the browser, the provider wraps the RSC payload in renderRoot(), so
+ *   the pathname updates in the same render pass as the new tree.
+ * - During SSR, the wrapper chain mounts the same provider with the request's
+ *   pathname (TIM-1424), so this is the identical code path — no ALS read,
+ *   no fallback tiers.
+ * - In the RSC environment, this module is never evaluated — the shims plugin
+ *   resolves next/navigation to navigation-rsc.ts, which has a throwing stub
+ *   (TIM-1420).
+ * - Called outside a component entirely, React itself throws its
+ *   invalid-hook-call error — loud, not guessed-at from window.location.
  *
  * Compatible with Next.js's `usePathname()` from `next/navigation`.
  */
 
-import { getSsrData } from './ssr-data.js';
-import { useNavigationContext } from './navigation-context.js';
+import { useNavigationContext } from './navigation-context.ts';
 
 /**
  * Read the current URL pathname.
  *
- * On the client, reads from NavigationContext (provided by
- * NavigationProvider in renderRoot). During SSR, reads from the
- * ALS-backed SSR data context. Falls back to window.location.pathname
- * when called outside a React component (e.g., in tests).
+ * Throws when no NavigationProvider is above the caller (a component rendered
+ * outside the timber app — in tests, render inside the timber providers).
  */
 export function usePathname(): string {
-  // Try reading from NavigationContext (client-side, inside React tree).
-  // During SSR, no NavigationProvider is mounted, so this returns null.
-  try {
-    const navContext = useNavigationContext();
-    if (navContext !== null) {
-      return navContext.pathname;
-    }
-  } catch {
-    // No React dispatcher available (called outside a component).
-    // Fall through to SSR/fallback below.
+  const nav = useNavigationContext();
+  if (nav === null) {
+    throw new Error(
+      '[timber] usePathname() was called outside the timber app tree ' +
+        '(no NavigationProvider found). In tests, render the component ' +
+        'inside the timber providers.'
+    );
   }
-
-  // SSR path: read from ALS-backed SSR data context.
-  const ssrData = getSsrData();
-  if (ssrData) return ssrData.pathname ?? '/';
-
-  // Final fallback: window.location (tests, edge cases).
-  if (typeof window !== 'undefined') return window.location.pathname;
-  return '/';
+  return nav.pathname;
 }

package/src/client/use-pending-navigation.ts

@@ -0,0 +1,40 @@
+import { useSyncExternalStore } from 'react';
+import { getRouterOrNull } from './router-ref.ts';
+
+function subscribe(onStoreChange: () => void): () => void {
+  const router = getRouterOrNull();
+  if (!router) return () => {};
+  return router.onPendingChange(onStoreChange);
+}
+
+function getSnapshot(): boolean {
+  const router = getRouterOrNull();
+  return router ? router.isPending() : false;
+}
+
+const getServerSnapshot = getSnapshot;
+
+/**
+ * Returns true while an RSC navigation is in flight.
+ *
+ * Reads from the router's external pending store via useSyncExternalStore.
+ * Only components that call this hook re-render when pending state
+ * changes — no full-tree re-render.
+ *
+ * ```tsx
+ * 'use client'
+ * import { usePendingNavigation } from '@timber-js/app/client'
+ *
+ * export function NavBar() {
+ *   const isPending = usePendingNavigation()
+ *   return (
+ *     <nav className={isPending ? 'opacity-50' : ''}>
+ *       <Link href="/dashboard">Dashboard</Link>
+ *     </nav>
+ *   )
+ * }
+ * ```
+ */
+export function usePendingNavigation(): boolean {
+  return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
+}

package/src/client/use-query-states.ts

@@ -11,30 +11,156 @@
 'use client';
 
 import { useQueryStates as nuqsUseQueryStates } from 'nuqs';
-import type { SingleParser } from 'nuqs';
+import type { MultiParser } from 'nuqs';
 import type {
   SearchParamCodec,
   SearchParamsDefinition,
   SetParams,
   QueryStatesOptions,
-} from '#/search-params/create.js';
-import { getSearchParams } from '#/search-params/registry.js';
+} from '../search-params/define.ts';
+import { parseTotal } from '../search-params/parse-total.ts';
+import { serializedEqual } from '../search-params/serialize-equal.ts';
 
 // ─── Codec Bridge ─────────────────────────────────────────────────
 
+// nuqs's parser contract conflates values timber codecs distinguish:
+// parse() returning null means "unparseable, substitute defaultValue",
+// and undefined entries are skipped entirely. Timber codecs can
+// legitimately produce both — bare z.string() yields undefined for absent
+// params (implicit optionality), and a codec may map a present value to
+// null. Wrap those two values in sentinels across the nuqs boundary and
+// unwrap them before handing values back to the caller, so the client
+// hook returns exactly what server-side parse() returns.
+// Unique object references compared by identity — a codec can never
+// produce these from URL input, so user-controlled strings cannot collide
+// with them (unlike string sentinels), and unlike Symbols they survive
+// nuqs's internal string coercion without throwing.
+const NULL_SENTINEL: object = { timberSentinel: 'null' };
+const UNDEFINED_SENTINEL: object = { timberSentinel: 'undefined' };
+
+function wrapNuqsValue(value: unknown): unknown {
+  if (value === null) return NULL_SENTINEL;
+  if (value === undefined) return UNDEFINED_SENTINEL;
+  return value;
+}
+
+function unwrapNuqsValue(value: unknown): unknown {
+  if (value === NULL_SENTINEL) return null;
+  if (value === UNDEFINED_SENTINEL) return undefined;
+  return value;
+}
+
 /**
- * Bridge a timber SearchParamCodec to a nuqs-compatible SingleParser.
+ * Bridge a timber SearchParamCodec to a nuqs-compatible MultiParser.
  *
  * nuqs parsers: { parse(string) → T|null, serialize?(T) → string, eq?, defaultValue? }
  * timber codecs: { parse(string|string[]|undefined) → T, serialize(T) → string|null }
+ *
+ * The defaultValue is computed eagerly, through `parseTotal` — the same
+ * entry point server-side `parse()` uses, so the hook and the server agree
+ * on what an absent param means (a bare nuqs parser answers `null`, not
+ * `undefined`; TIM-1350). Codecs are documented to return a default rather
+ * than throw, but a throwing codec must not crash every component that
+ * mounts the hook — treat its default as undefined and let its error
+ * surface from server-side parse() instead.
+ *
+ * A `null` absent-value is NOT registered as the nuqs default. nuqs
+ * already represents an absent key as `null`, so the hook reads the same
+ * value either way — but registering it makes `clearOnDefault` fire on
+ * `setParams({ q: null })` and delete the key before the bridged
+ * `serialize` runs. For a codec that encodes `null` as a real query value
+ * (`serialize(null) === 'none'`), that silently disagrees with
+ * `buildSearchParams({ q: null })`, which writes it. Same reasoning as
+ * `getDefaultSerialized` on the server: a codec with no value for an
+ * absent param has no default to register.
  */
-function bridgeCodec<T>(codec: SearchParamCodec<T>): SingleParser<T> & { defaultValue: T } {
-  return {
-    parse: (v: string) => codec.parse(v),
-    serialize: (v: T) => codec.serialize(v) ?? '',
-    defaultValue: codec.parse(undefined) as T,
-    eq: (a: T, b: T) => codec.serialize(a) === codec.serialize(b),
-  };
+function bridgeCodec<T>(codec: SearchParamCodec<T>): MultiParser<T> & { defaultValue: T } {
+  let absent: unknown;
+  try {
+    absent = parseTotal(codec, undefined);
+  } catch {
+    absent = undefined;
+  }
+
+  const parser = {
+    // `multi`, so nuqs reads the key with `searchParams.getAll()` and hands
+    // us EVERY value. A single parser reads `.get()` — the first value only
+    // — which is not the domain a timber codec is defined over. The server
+    // parses `?tags=a&tags=b` as `['a','b']`; a single parser made the hook
+    // answer `['a']` for the same URL, under a declared `string[]` that
+    // admitted no such disagreement (TIM-1352). Scalar codecs are unaffected:
+    // they receive the array and take `value[0]`, exactly as they do on the
+    // server, so first-value-wins is preserved through the same code path
+    // rather than through nuqs's reader.
+    //
+    // nuqs never calls this with an empty array — `isAbsentFromUrl` treats
+    // `[]` as absent and answers `defaultValue` directly — which is what
+    // keeps the absent case agreeing with the server's `undefined`.
+    //
+    // Reading every value is only half of it: the values must arrive in the
+    // SAME SHAPE the server would have produced, or the divergence just
+    // moves. `normalizeRaw` (search-params/define.ts) collapses a
+    // single-valued key to a bare string and keeps an array only for a
+    // repeated one, so this mirrors that rule exactly. Handing a codec
+    // `['3']` where the server hands it `'3'` breaks every codec whose
+    // `parse` is written for the scalar case — which is most hand-written
+    // ones, contract or no contract.
+    type: 'multi' as const,
+    // Through parseTotal, not codec.parse. nuqs's own `.withDefault(d)`
+    // overrides ONLY `parseServerSide`, so `parseAsInteger.withDefault(1)`
+    // on `?page=abc` returned 1 from the server and null from the hook —
+    // a divergence the declared non-nullable `number` did not admit.
+    parse: (v: readonly string[]) =>
+      wrapNuqsValue(parseTotal(codec, v.length === 1 ? v[0] : [...v])),
+    serialize: (v: unknown) => {
+      const value = unwrapNuqsValue(v);
+      if (value === undefined) return [''];
+      // TIM-1354: catch TypeError from codecs whose serialize is not total
+      // over null (e.g. parseAsIsoDate.serialize(null) → null.toISOString()).
+      // Only TypeError — deliberate signals must not be swallowed.
+      let result: string | string[] | null;
+      try {
+        result = codec.serialize(value as T);
+      } catch (error) {
+        if (error instanceof TypeError) return [''];
+        throw error;
+      }
+      // TIM-1353: pass through string[] from codecs that emit repeated
+      // keys. nuqs multi parsers append one key=value per array element.
+      if (Array.isArray(result)) return result;
+      return [result ?? ''];
+    },
+    eq: (a: unknown, b: unknown) => {
+      if (a === b) return true;
+      try {
+        return serializedEqual(
+          codec.serialize(unwrapNuqsValue(a) as T),
+          codec.serialize(unwrapNuqsValue(b) as T)
+        );
+      } catch {
+        return false;
+      }
+    },
+  } as MultiParser<T> & { defaultValue: T };
+
+  if (absent !== null) parser.defaultValue = wrapNuqsValue(absent) as T;
+  return parser;
+}
+
+/**
+ * Collect `withUrlKey` aliases off a codec map.
+ *
+ * `withUrlKey(codec, 'q')` returns a codec carrying `urlKey: 'q'`, so the map
+ * alone is enough to reconstruct the aliases — `defineSearchParams` builds its
+ * own `urlKeys` from exactly this property.
+ */
+function deriveUrlKeys(codecs: Record<string, SearchParamCodec<unknown>>): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const key of Object.keys(codecs)) {
+    const alias = codecs[key]?.urlKey;
+    if (alias) result[key] = alias;
+  }
+  return result;
 }
 
 /**
@@ -43,12 +169,12 @@ function bridgeCodec<T>(codec: SearchParamCodec<T>): SingleParser<T> & { default
 function bridgeCodecs<T extends Record<string, unknown>>(codecs: {
   [K in keyof T]: SearchParamCodec<T[K]>;
 }) {
-  const result: Record<string, SingleParser<unknown> & { defaultValue: unknown }> = {};
+  const result: Record<string, MultiParser<unknown> & { defaultValue: unknown }> = {};
   for (const key of Object.keys(codecs)) {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     result[key] = bridgeCodec(codecs[key as keyof T]) as any;
   }
-  return result as { [K in keyof T]: SingleParser<T[K]> & { defaultValue: T[K] } };
+  return result as { [K in keyof T]: MultiParser<T[K]> & { defaultValue: T[K] } };
 }
 
 // ─── Hook ─────────────────────────────────────────────────────────
@@ -61,7 +187,7 @@ function bridgeCodecs<T extends Record<string, unknown>>(codecs: {
  *
  * Usage:
  * ```ts
- * // Via a SearchParamsDefinition
+ * // Via a SearchParamsDefinition imported from the route's params.ts
  * const [params, setParams] = definition.useQueryStates()
  *
  * // Standalone with inline codecs
@@ -69,35 +195,37 @@ function bridgeCodecs<T extends Record<string, unknown>>(codecs: {
  *   page: fromSchema(z.coerce.number().int().min(1).default(1)),
  * })
  * ```
+ *
+ * There is deliberately no route-string form (`useQueryStates('/products')`).
+ * Importing the definition from `params.ts` is the documented way to reach
+ * another route's codecs — it needs no runtime registry lookup and so has no
+ * "not registered yet" failure mode. See design/23-search-params.md
+ * §"Client Access".
  */
 export function useQueryStates<T extends Record<string, unknown>>(
-  codecsOrRoute: { [K in keyof T]: SearchParamCodec<T[K]> } | string,
+  codecs: { [K in keyof T]: SearchParamCodec<T[K]> },
   _options?: QueryStatesOptions,
   urlKeys?: Readonly<Record<string, string>>
 ): [T, SetParams<T>] {
-  // Route-string overload: resolve codecs from the registry
-  let codecs: { [K in keyof T]: SearchParamCodec<T[K]> };
-  let resolvedUrlKeys = urlKeys;
-  if (typeof codecsOrRoute === 'string') {
-    const definition = getSearchParams(codecsOrRoute);
-    if (!definition) {
-      throw new Error(
-        `useQueryStates('${codecsOrRoute}'): no search params registered for this route. ` +
-          `Either the route has no search-params.ts file, or it hasn't been loaded yet. ` +
-          `For cross-route usage, import the definition explicitly.`
-      );
-    }
-    codecs = definition.codecs as { [K in keyof T]: SearchParamCodec<T[K]> };
-    resolvedUrlKeys = definition.urlKeys;
-  } else {
-    codecs = codecsOrRoute;
-  }
-
   const bridged = bridgeCodecs(codecs);
 
+  // Forward hook-level options (shallow, scroll, history) to nuqs.
+  // These become the default for all setter calls from this hook instance.
+  // Per-call options in setParams(values, opts) override these defaults.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const nuqsOptions: any = {};
-  if (resolvedUrlKeys && Object.keys(resolvedUrlKeys).length > 0) {
+  if (_options?.shallow !== undefined) nuqsOptions.shallow = _options.shallow;
+  if (_options?.scroll !== undefined) nuqsOptions.scroll = _options.scroll;
+  if (_options?.history !== undefined) nuqsOptions.history = _options.history;
+  // `withUrlKey` attaches the alias to the codec itself — that is the design's
+  // "URL keys travel with codecs" principle — so the aliases are derivable
+  // here and must be, for the inline codec-map form: nobody passes `urlKeys`
+  // on that path, and without this an aliased bundle silently read and wrote
+  // the property name instead of the alias. `bindUseQueryStates` still passes
+  // the definition's precomputed map, which wins on conflict; it is built from
+  // these same codecs, so the two agree by construction rather than by luck.
+  const resolvedUrlKeys = { ...deriveUrlKeys(codecs), ...urlKeys };
+  if (Object.keys(resolvedUrlKeys).length > 0) {
     nuqsOptions.urlKeys = resolvedUrlKeys;
   }
 
@@ -118,6 +246,19 @@ export function useQueryStates<T extends Record<string, unknown>>(
     throw err;
   }
 
+  // Unwrap the null/undefined sentinels the bridge injected (see Codec
+  // Bridge above) so callers see exactly what server-side parse() returns.
+  // Copy-on-write preserves the identity of nuqs's memoized values object
+  // when nothing needs unwrapping.
+  let normalized = values;
+  for (const key of Object.keys(bridged)) {
+    const value = normalized[key];
+    if (value === NULL_SENTINEL || value === UNDEFINED_SENTINEL) {
+      if (normalized === values) normalized = { ...values };
+      normalized[key] = unwrapNuqsValue(value);
+    }
+  }
+
   // Wrap the nuqs setter to match timber's SetParams<T> signature.
   // nuqs's setter accepts Partial<Nullable<Values>> | UpdaterFn | null.
   // timber's setter accepts Partial<T> with optional SetParamsOptions.
@@ -126,11 +267,40 @@ export function useQueryStates<T extends Record<string, unknown>>(
     if (setOptions?.shallow !== undefined) nuqsSetOptions.shallow = setOptions.shallow;
     if (setOptions?.scroll !== undefined) nuqsSetOptions.scroll = setOptions.scroll;
     if (setOptions?.history !== undefined) nuqsSetOptions.history = setOptions.history;
+    // nuqs's update loop skips undefined entries and treats null as a
+    // key deletion before serialize runs. Timber semantics:
+    //   - setParams({ q: undefined }) must clear ?q= (absent = undefined),
+    //     so explicit undefined maps to a null deletion.
+    //   - setParams({ q: null }) clears the key only when the codec encodes
+    //     null as "omit" (serialize(null) === null). If the codec encodes
+    //     null as a real query value, forward the sentinel so the bridged
+    //     serialize writes it — matching definition.serialize({ q: null }).
+    let forwarded: Record<string, unknown> = partial;
+    for (const key of Object.keys(partial)) {
+      const value = partial[key as keyof T];
+      if (value === undefined) {
+        if (forwarded === partial) forwarded = { ...partial };
+        forwarded[key] = null;
+      } else if (value === null) {
+        let encoded: string | string[] | null = null;
+        try {
+          const raw = codecs[key as keyof T]?.serialize(null as T[keyof T]);
+          // string[] is non-null, but an empty array carries no value
+          encoded = raw === null ? null : Array.isArray(raw) ? (raw.length > 0 ? raw : null) : raw;
+        } catch {
+          // Codec can't serialize null — treat as a deletion.
+        }
+        if (encoded !== null) {
+          if (forwarded === partial) forwarded = { ...partial };
+          forwarded[key] = NULL_SENTINEL;
+        }
+      }
+    }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    void setValues(partial as any, nuqsSetOptions);
+    void setValues(forwarded as any, nuqsSetOptions);
   };
 
-  return [values as T, setParams];
+  return [normalized as T, setParams];
 }
 
 // ─── Definition binding ───────────────────────────────────────────