@lotics/app-sdk 0.38.0 → 0.40.0

package/AGENTS.md

@@ -74,6 +74,13 @@ Pick by intent. (→ open the `.d.ts` for the exact signature.)
   client-side advisory — pass `coords` to a workflow to record where an action happened.
 - **Recents** — **`useRecents(key, max)`** → most-recent-first, deduped, capped, `localStorage`-backed
   (web-only, which is why it's here, not in `@lotics/ui`). Feeds a `Combobox`'s `recentOptions`.
+- **Shareable view-state (filters in the URL)** — **`useUrlState(shape)`** → `[values, setValues]`,
+  keeping a declared slice of state (filters, search, sort, the active tab) in the **address bar** so a
+  view survives refresh and is shareable/bookmarkable. `setValues` replaces in place. Build `shape` from
+  **`urlParam`** codecs. See *Save view-state to the URL*.
+- **In-app routing** — **`AppRouter`** (from `@lotics/app-sdk/router`) → wrap a react-router route config so
+  screens become real, addressable URLs in both modes (browser back/forward walk app screens embedded).
+  See *In-app navigation*.
 - **Optimistic mutation glue** — **`useOptimistic()`** → reconcile a workflow mutation against the
   query cache for an interactive (calendar/kanban/grid) app. See the data-bound recipe.
 - **Infra** — **`mount(opts?)`** boots the app + analytics (call once at entry; PostHog is automatic,
@@ -144,8 +151,13 @@ compose these, don't hand-roll search:
 - **`useRecents`** — persist the picked option; pass its list as `recentOptions`.
 
 Fetch detail on select with a SECOND parameterized query (a unique-code `equals`, or a link
-`has_any_of [record_id]`) — never a bare full-table load. Filtering a record by its *own* id isn't a
-compilable AST shape; filter by a unique field value.
+`has_any_of [record_id]`) — never a bare full-table load. To fetch a record by its **own id**, use the
+field-less **`record_id` system condition** (a sibling of `locked`/`current_member`, NOT a `field_key`):
+`useQuery(alias, {}, { filter: { node_type: "condition", type: "record_id", operator: "is_any_of", value:
+[id] } })` (`is_none_of` excludes). Works on any row-level query; a *grouped* query collapses rows so it's
+rejected there. A link `has_any_of [record_id]` matches a *related* record; `record_id` matches the row's
+own id — the only way, since a record has no field holding its own id. **Prefer a link/join when an actual
+relationship exists**; reach for `record_id` only when your starting point is a bare id (e.g. a drill row).
 
 ## Browse + sort + filter (the record picker)
 
@@ -241,6 +253,63 @@ stops constraining instead of erroring (no-op for all-required queries).
 independently. Keep a scope that must always apply `required` (a missing required param 400s). Typos
 can't widen — deploy rejects a `{{params.x}}` with no declared param.
 
+## Save view-state to the URL (`useUrlState`)
+
+The filters above are the query's *server* params; **`useUrlState`** is their *client* home — save them to
+the host's address bar and a filtered view survives refresh and is shareable/bookmarkable as a link. Writes
+always **replace** in place (filter changes shouldn't add history entries); screen-to-screen navigation and
+history are the router's job (next section). The hook drives the host's URL over the bridge; the app can't
+touch the cross-origin host URL itself. Standalone apps drive their own URL — same code.
+
+```tsx
+const [filters, setFilters] = useUrlState({
+  q:      urlParam.string.withDefault(""),
+  status: urlParam.enum(["open", "won", "lost"]),         // optional → omitted when unset
+  tags:   urlParam.arrayOf(urlParam.string).withDefault([]),
+  page:   urlParam.number.withDefault(1),
+});
+// filters → { q: string; status?: "open"|"won"|"lost"; tags: string[]; page: number }
+const { rows } = usePaginatedQuery("search", { keyword: filters.q, status: filters.status }, { pageSize: 50 });
+setFilters({ status: "won" });                  // merge into the address bar → ?status=won
+setFilters({ page: 2 });                        // merge (replace; no history entry)
+```
+
+- **`urlParam`** codecs: `string` / `number` / `boolean` / `isoDate` / `enum([...])` / `arrayOf(inner)`,
+  each `.withDefault(v)` to make it required. **Defaults are omitted from the URL** (`page=1` never
+  appears) — links carry only what changed.
+- **The URL is the only store** — `filters` is decoded fresh each render; don't mirror it into `useState`.
+- **Declared keys only.** The app touches just the keys in `shape`; every other param (a second
+  `useUrlState`, the framework's own) is preserved on write — no namespace rule to remember.
+- **Search box:** keep the live input in local `useState` and commit to `setFilters` on a **debounce** —
+  in an embedded app each `setFilters` is a cross-frame write.
+
+## In-app navigation (`AppRouter`)
+
+For a multi-screen app, write plain react-router and wrap your routes in **`AppRouter`** (from
+`@lotics/app-sdk/router`) — it makes screens real, addressable URLs in both modes, with no per-mode code:
+
+```tsx
+import { AppRouter } from "@lotics/app-sdk/router";
+
+export default function App() {
+  return <AppRouter routes={[
+    { path: "/", element: <List /> },
+    { path: "/item/:id", element: <Detail /> },
+  ]} />;
+}
+```
+
+Inside, use react-router normally — `useNavigate`, `useParams`, `<Link>`.
+
+- **Embedded** (in the Lotics host): the current screen lives in the host address bar (`?_loc=…`) —
+  shareable + refresh-survivable — and the **browser Back/Forward buttons walk app screens** (then leave the
+  app). The host owns the single history stack; the adapter proxies push/replace/go over the bridge.
+- **Standalone** (`<slug>.lotics.app`): a normal browser router — real path URLs, native browser back/forward.
+
+`useUrlState` is the complement for *filters/search* you want as first-class, typed query keys; it composes
+with the router (different keys; the host merge preserves both). `react-router-dom` is an optional peer — only
+apps that import `@lotics/app-sdk/router` pull it in.
+
 ---
 
 ## Recipes (app actions beyond the hooks)

package/dist/src/index.d.ts

@@ -23,7 +23,7 @@ export type { AppComment, AppCommentFile, CommentsState, UseCommentsArgs, Commen
 export { useViewer } from "./viewer.js";
 export { requestGeofencedLocation, isWithinZone } from "./geolocation.js";
 export type { GeofenceZone, GeoCoords, GeofenceOutcome, GeofenceOptions } from "./geolocation.js";
-export { rpc } from "./rpc.js";
+export { rpc, isEmbedded } from "./rpc.js";
 export type { RpcOp } from "./rpc.js";
 export { openExternal } from "./open_external.js";
 export { downloadFile } from "./download.js";
@@ -39,3 +39,7 @@ export { useOptimistic } from "./use_optimistic.js";
 export type { OptimisticApi } from "./use_optimistic.js";
 export { useRecents } from "./use_recents.js";
 export type { RecentsApi, RecentsOptions } from "./use_recents.js";
+export { useUrlState } from "./use_url_state.js";
+export type { UrlStateShape, UrlStateValues } from "./use_url_state.js";
+export { urlParam } from "./url_params.js";
+export type { UrlParamCodec, OptionalUrlParamCodec, UrlParams, UrlParamValue, } from "./url_params.js";

package/dist/src/index.js

@@ -19,7 +19,7 @@ export { useWorkflow, useQuery, useInfiniteQuery, usePaginatedQuery, useFieldOpt
 export { useComments, useCommentCounts } from "./comments.js";
 export { useViewer } from "./viewer.js";
 export { requestGeofencedLocation, isWithinZone } from "./geolocation.js";
-export { rpc } from "./rpc.js";
+export { rpc, isEmbedded } from "./rpc.js";
 export { openExternal } from "./open_external.js";
 export { downloadFile } from "./download.js";
 export { readMembers } from "./members.js";
@@ -27,3 +27,5 @@ export { readSelect } from "./select.js";
 export { row, readLinks, readFiles, readLocked } from "./row.js";
 export { useOptimistic } from "./use_optimistic.js";
 export { useRecents } from "./use_recents.js";
+export { useUrlState } from "./use_url_state.js";
+export { urlParam } from "./url_params.js";

package/dist/src/router.d.ts

@@ -0,0 +1,4 @@
+import { type RouteObject } from "react-router-dom";
+export declare function AppRouter({ routes }: {
+    routes: RouteObject[];
+}): import("react/jsx-runtime").JSX.Element;

package/dist/src/router.js

@@ -0,0 +1,126 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * In-app routing for custom-code apps — `AppRouter` lets an app use react-router
+ * normally (`useNavigate`, `useParams`, `<Link>`) while its screens become real,
+ * addressable URLs in both modes:
+ *
+ *  - **Standalone** (`<slug>.lotics.app`): a normal browser history — real path
+ *    URLs, native browser back/forward, deep-link/refresh via the app host's SPA
+ *    fallback.
+ *  - **Embedded** (inside the Lotics host): the app can't touch the cross-origin
+ *    host URL, so a custom history proxies every push/replace/go to the host over
+ *    the bridge. The host owns the single history stack, so the screen lives in
+ *    its address bar (`?_loc=…`) — shareable + refresh-survivable — and the
+ *    browser Back/Forward buttons walk app screens (then leave the app).
+ *
+ * Shipped as a separate entry (`@lotics/app-sdk/router`) so apps that don't route
+ * never pull react-router into their bundle:
+ *
+ *   import { AppRouter } from "@lotics/app-sdk/router";
+ *   export default function App() {
+ *     return <AppRouter routes={[
+ *       { path: "/", element: <List /> },
+ *       { path: "/item/:id", element: <Detail /> },
+ *     ]} />;
+ *   }
+ */
+import { useState } from "react";
+import { NavigationType, UNSAFE_createBrowserHistory, unstable_HistoryRouter as HistoryRouter, useRoutes, } from "react-router-dom";
+import { getUrlParams, goUrlHistory, isEmbedded, setUrlParams, subscribeUrlParams } from "./rpc.js";
+/** Host query key carrying the app's current screen when embedded, so it's
+ *  shareable and survives refresh. */
+const LOC_KEY = "_loc";
+function hrefOf(to) {
+    if (typeof to === "string")
+        return to || "/";
+    return (to.pathname ?? "/") + (to.search ?? "") + (to.hash ?? "");
+}
+let locKey = 0;
+function toLocation(href) {
+    const u = new URL(href || "/", "http://x");
+    return { pathname: u.pathname, search: u.search, hash: u.hash, state: null, key: String(++locKey) };
+}
+/**
+ * Embedded history: the host owns the single history stack.
+ *  - `push`/`replace` optimistically update the local location and tell the host
+ *    (pushState/replaceState don't fire popstate, so no echo back).
+ *  - `go` (and the browser Back/Forward buttons) move the host history; the
+ *    resulting location arrives via the `url-state` broadcast as an action POP.
+ */
+function createBridgedHistory() {
+    const listeners = new Set();
+    let location = toLocation("/");
+    let action = NavigationType.Pop;
+    // Once the location has been driven — by the app (push/replace) or the host
+    // (a back/forward broadcast) — a late boot-seed must not clobber it; the
+    // bridged read of the host URL resolves a tick after mount.
+    let seeded = false;
+    // `delta` is history metadata (scroll restoration / blockers), not used for
+    // rendering — best-effort per action, since the host doesn't report the exact
+    // index change on a broadcast.
+    function set(href, act, delta) {
+        seeded = true;
+        location = toLocation(href);
+        action = act;
+        for (const l of listeners)
+            l({ action, location, delta });
+    }
+    // Host back/forward (browser Back or our own `go`) → re-render to the broadcast
+    // location. Guarded so an already-current location doesn't re-fire.
+    subscribeUrlParams((params) => {
+        const raw = params[LOC_KEY];
+        const href = typeof raw === "string" ? raw : "/";
+        if (href !== hrefOf(location))
+            set(href, NavigationType.Pop, -1);
+    });
+    // Boot: seed from the host URL (resolves a tick after mount — first paint is
+    // "/"). Skip if the location was already driven, so a navigation that races the
+    // bridge read isn't clobbered.
+    void getUrlParams().then((params) => {
+        if (seeded)
+            return;
+        const raw = params[LOC_KEY];
+        if (typeof raw === "string" && raw !== hrefOf(location))
+            set(raw, NavigationType.Pop, 0);
+    });
+    return {
+        get action() {
+            return action;
+        },
+        get location() {
+            return location;
+        },
+        createHref: (to) => hrefOf(to),
+        createURL: (to) => new URL(hrefOf(to), window.location.origin),
+        encodeLocation: (to) => {
+            const u = new URL(hrefOf(to), "http://x");
+            return { pathname: u.pathname, search: u.search, hash: u.hash };
+        },
+        push: (to) => {
+            const href = hrefOf(to);
+            set(href, NavigationType.Push, 1);
+            void setUrlParams({ [LOC_KEY]: href }, true);
+        },
+        replace: (to) => {
+            const href = hrefOf(to);
+            set(href, NavigationType.Replace, 0);
+            void setUrlParams({ [LOC_KEY]: href }, false);
+        },
+        go: (delta) => {
+            void goUrlHistory(delta);
+        },
+        listen: (listener) => {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+    };
+}
+function RoutedRoutes({ routes }) {
+    return useRoutes(routes);
+}
+export function AppRouter({ routes }) {
+    // Created once (a lazy state initializer survives StrictMode's double render,
+    // so the bridge subscription isn't installed twice).
+    const [history] = useState(() => isEmbedded() ? createBridgedHistory() : UNSAFE_createBrowserHistory());
+    return (_jsx(HistoryRouter, { history: history, children: _jsx(RoutedRoutes, { routes: routes }) }));
+}

package/dist/src/rpc.d.ts

@@ -1,3 +1,4 @@
+import { type UrlParams, type UrlParamsPatch } from "./url_params.js";
 /**
  * RPC bridge for a custom-code app's data operations.
  *
@@ -18,7 +19,7 @@
  *   app  → host: { id, op, payload }
  *   host → app:  { id, type: "result", data } | { id, type: "error", message }
  */
-export type RpcOp = "query" | "field_options" | "workflow" | "agentRuns" | "agentRun.get" | "agentRun.cancel" | "upload" | "members" | "context" | "openExternal" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts";
+export type RpcOp = "query" | "field_options" | "workflow" | "agentRuns" | "agentRun.get" | "agentRun.cancel" | "upload" | "members" | "context" | "openExternal" | "urlState.get" | "urlState.set" | "urlState.go" | "comments.list" | "comments.create" | "comments.update" | "comments.delete" | "comments.counts";
 /** Payload for starting a streaming agent run. */
 export interface AgentRunPayload {
     alias: string;
@@ -57,7 +58,32 @@ export interface AppContext {
      */
     comments_enabled: boolean;
 }
+/**
+ * Whether the app is running embedded in a Lotics host (vs. standalone at its
+ * own `<slug>.lotics.app`). The router adapter (`@lotics/app-sdk/router`) uses
+ * this to pick its history backend; an app rarely needs it directly.
+ */
+export declare function isEmbedded(): boolean;
 export declare function rpc<T = unknown>(op: RpcOp, payload: unknown): Promise<T>;
+/** Read the current app-owned query params — bridged: ask the host; standalone:
+ *  the page's own query string. */
+export declare function getUrlParams(): Promise<UrlParams>;
+/** Merge `patch` into the host's address bar (each key set, or cleared when its
+ *  value is `undefined`), preserving every other param. `push` adds a back-able
+ *  history entry — the router adapter uses it per in-app navigation; the default
+ *  replaces in place (filter changes shouldn't flood history). */
+export declare function setUrlParams(patch: UrlParamsPatch, push?: boolean): Promise<void>;
+/** Move the host's history by `delta` (the router adapter's back/forward). The
+ *  resulting location arrives via the `url-state` broadcast, not the return. */
+export declare function goUrlHistory(delta: number): Promise<void>;
+/** Synchronous best-effort snapshot for first paint. Standalone reads its own
+ *  URL (no flash); bridged can't read the cross-origin host URL synchronously,
+ *  so it returns `{}` and the hook hydrates via `getUrlParams()` on mount. */
+export declare function peekUrlParams(): UrlParams;
+/** Subscribe to external query changes — back/forward (browser or the adapter's
+ *  `go`) and edited URLs. Embedded: the host's `url-state` broadcast; standalone:
+ *  `popstate`. */
+export declare function subscribeUrlParams(cb: (params: UrlParams) => void): () => void;
 /**
  * Start a streaming agent run. Each raw SSE text chunk is handed to `onText`
  * (the caller parses it via `agent_stream`); `done` settles when the stream

package/dist/src/rpc.js

@@ -1,5 +1,6 @@
 import { promptForPassword } from "./password_gate.js";
 import { runUploadPipeline } from "./upload/pipeline.js";
+import { parseSearch, serializeMerge, } from "./url_params.js";
 /**
  * The embedding Lotics host's origin — present iff the app is bridged.
  *
@@ -17,14 +18,75 @@ function getHostOrigin() {
     }
     return hostOriginCache;
 }
+/**
+ * Whether the app is running embedded in a Lotics host (vs. standalone at its
+ * own `<slug>.lotics.app`). The router adapter (`@lotics/app-sdk/router`) uses
+ * this to pick its history backend; an app rarely needs it directly.
+ */
+export function isEmbedded() {
+    // Truthiness, not `!== null`: a present-but-empty `?lotics_host=` yields "",
+    // which is no usable host origin — so it's standalone, matching how `rpc()`
+    // branches transports below.
+    return Boolean(getHostOrigin());
+}
 export function rpc(op, payload) {
     const hostOrigin = getHostOrigin();
     return hostOrigin
         ? rpcBridged(op, payload, hostOrigin)
         : rpcStandalone(op, payload);
 }
+// ── URL state (the address bar as app view-state + route) ───────────────────
+//
+// Two consumers share these ops: `useUrlState` (a declared, typed slice of
+// filters/search) and the router adapter (`@lotics/app-sdk/router`, the app's
+// current screen under `_loc`). An embedded app can't touch the cross-origin
+// host URL directly, so reads/writes/back-forward flow over the bridge: the host
+// drives its own history (`set` with `push`, `go` for back/forward) and pushes
+// the resulting params back via the `url-state` broadcast. A standalone app owns
+// its top-level URL and the same ops resolve against `window.location`.
+/** Read the current app-owned query params — bridged: ask the host; standalone:
+ *  the page's own query string. */
+export function getUrlParams() {
+    return rpc("urlState.get", {});
+}
+/** Merge `patch` into the host's address bar (each key set, or cleared when its
+ *  value is `undefined`), preserving every other param. `push` adds a back-able
+ *  history entry — the router adapter uses it per in-app navigation; the default
+ *  replaces in place (filter changes shouldn't flood history). */
+export function setUrlParams(patch, push = false) {
+    return rpc("urlState.set", { params: patch, push });
+}
+/** Move the host's history by `delta` (the router adapter's back/forward). The
+ *  resulting location arrives via the `url-state` broadcast, not the return. */
+export function goUrlHistory(delta) {
+    return rpc("urlState.go", { delta });
+}
+/** Synchronous best-effort snapshot for first paint. Standalone reads its own
+ *  URL (no flash); bridged can't read the cross-origin host URL synchronously,
+ *  so it returns `{}` and the hook hydrates via `getUrlParams()` on mount. */
+export function peekUrlParams() {
+    return isEmbedded() ? {} : parseSearch(window.location.search);
+}
+/** Subscribe to external query changes — back/forward (browser or the adapter's
+ *  `go`) and edited URLs. Embedded: the host's `url-state` broadcast; standalone:
+ *  `popstate`. */
+export function subscribeUrlParams(cb) {
+    if (isEmbedded()) {
+        ensureListener();
+        urlStateSubscribers.add(cb);
+        return () => {
+            urlStateSubscribers.delete(cb);
+        };
+    }
+    const handler = () => cb(parseSearch(window.location.search));
+    window.addEventListener("popstate", handler);
+    return () => window.removeEventListener("popstate", handler);
+}
 const pending = new Map();
 const streaming = new Map();
+/** `useUrlState` + the router adapter — notified when the host broadcasts new
+ *  params after browser/adapter back/forward. */
+const urlStateSubscribers = new Set();
 let nextRpcId = 0;
 let listenerInstalled = false;
 function ensureListener() {
@@ -36,7 +98,16 @@ function ensureListener() {
         if (event.source !== window.parent || event.origin !== getHostOrigin())
             return;
         const msg = event.data;
-        if (!msg || typeof msg.id !== "number")
+        if (!msg)
+            return;
+        // Broadcast (no id): the host pushes new params after browser/adapter
+        // back/forward so subscribers (`useUrlState`, the router adapter) re-hydrate.
+        if (msg.type === "url-state" && msg.params && typeof msg.params === "object") {
+            for (const cb of urlStateSubscribers)
+                cb(msg.params);
+            return;
+        }
+        if (typeof msg.id !== "number")
             return;
         // Single-response ops.
         const handler = pending.get(msg.id);
@@ -328,6 +399,17 @@ function rpcStandalone(op, payload) {
             return standaloneContext();
         case "openExternal":
             return standaloneOpenExternal(payload);
+        case "urlState.get":
+            // Standalone is a top-level page — its own query string IS the store.
+            return Promise.resolve(parseSearch(window.location.search));
+        case "urlState.set":
+            return standaloneUrlStateSet(payload);
+        case "urlState.go": {
+            // Standalone owns its own history — move it; popstate re-hydrates subscribers.
+            const { delta } = payload;
+            window.history.go(delta);
+            return Promise.resolve();
+        }
         case "comments.list":
         case "comments.create":
         case "comments.update":
@@ -376,6 +458,16 @@ function openValidatedUrl(url) {
 async function standaloneOpenExternal(p) {
     openValidatedUrl(p.url);
 }
+async function standaloneUrlStateSet(p) {
+    const search = serializeMerge(window.location.search, p.params ?? {});
+    const url = window.location.pathname + (search ? `?${search}` : "") + window.location.hash;
+    // pushState/replaceState don't fire popstate, so no echo — the caller updated
+    // optimistically on write.
+    if (p.push)
+        window.history.pushState(null, "", url);
+    else
+        window.history.replaceState(null, "", url);
+}
 async function standaloneContext() {
     const info = await resolveAppInfo();
     return {

package/dist/src/url_params.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Typed codecs that map URL query-string values (always strings, or string
+ * arrays for repeated keys) to and from the typed view-state an app keeps in
+ * the address bar — the engine behind `useUrlState`.
+ *
+ * Two properties make the URLs clean and the round-trip lossless:
+ *
+ *  - **Default-omission.** A codec built with `.withDefault(d)` encodes the
+ *    default value to `undefined` — i.e. the key is dropped from the URL. So a
+ *    filter at its default (`page=1`, `q=""`) never appears, and the shared
+ *    link carries only what the user actually changed.
+ *  - **Declared keys only.** `decodeAll`/`encodePatch` touch exactly the keys the
+ *    app declared. Every other query param (`lotics_host`, `__mock`, a param a
+ *    second `useUrlState` owns, a future host param) is read past and preserved
+ *    on write — the merge is the namespace boundary, so no reserved-prefix rule
+ *    is needed.
+ *
+ * Self-contained on purpose: the SDK publishes to npm as a bundle-free `dist/`,
+ * so it carries no workspace deps (no `@lotics/shared`). These are plain pure
+ * functions — a frontend that later wants the same value⇄query codec can import
+ * them from here rather than growing a second copy.
+ */
+/** A query value as it appears in the URL: a single string, or an array for a
+ *  repeated key (`?tag=a&tag=b`). Absent keys are simply missing from the map. */
+export type UrlParamValue = string | string[];
+/** The current query string decoded to a map (present keys only). */
+export type UrlParams = Record<string, UrlParamValue>;
+/** A write: each key set to its encoded value, or `undefined` to clear it. Only
+ *  the keys present are touched; others in the URL are preserved (a merge). */
+export type UrlParamsPatch = Record<string, UrlParamValue | undefined>;
+/**
+ * A reversible mapping between a typed value `T` and its URL representation.
+ * Methods (not function-typed properties) so a concrete `UrlParamCodec<string>`
+ * stays assignable to `UrlParamCodec<unknown>` for the `useUrlState` codec map.
+ */
+export interface UrlParamCodec<T> {
+    /** Raw query value (or `undefined` when the key is absent) → typed value. */
+    decode(raw: UrlParamValue | undefined): T;
+    /** Typed value → raw query value, or `undefined` to omit the key. */
+    encode(value: T): UrlParamValue | undefined;
+}
+/** A codec whose value is optional (absent key → `undefined`), refinable to a
+ *  required codec with a fallback via `.withDefault`. */
+export interface OptionalUrlParamCodec<T> extends UrlParamCodec<T | undefined> {
+    /** Make the value required: an absent key decodes to `fallback`, and a value
+     *  equal to `fallback` encodes to nothing (kept out of the URL). */
+    withDefault(fallback: T): UrlParamCodec<T>;
+}
+declare function enumCodec<const V extends readonly string[]>(values: V): OptionalUrlParamCodec<V[number]>;
+declare function arrayOf<T>(inner: UrlParamCodec<T | undefined>): OptionalUrlParamCodec<T[]>;
+/**
+ * The codec builders an app composes into a `useUrlState` shape. Each base
+ * builder yields an optional codec (absent key → `undefined`); add
+ * `.withDefault(v)` to make it required and keep the default out of the URL.
+ *
+ *   useUrlState({
+ *     q:      urlParam.string.withDefault(""),
+ *     status: urlParam.enum(["open", "won", "lost"]),       // optional
+ *     tags:   urlParam.arrayOf(urlParam.string).withDefault([]),
+ *     from:   urlParam.isoDate,                              // optional Date
+ *     page:   urlParam.number.withDefault(1),
+ *   })
+ */
+export declare const urlParam: {
+    readonly string: OptionalUrlParamCodec<string>;
+    readonly number: OptionalUrlParamCodec<number>;
+    readonly boolean: OptionalUrlParamCodec<boolean>;
+    readonly isoDate: OptionalUrlParamCodec<Date>;
+    readonly enum: typeof enumCodec;
+    readonly arrayOf: typeof arrayOf;
+};
+/** Decode the declared keys out of a params map into typed values. */
+export declare function decodeAll<D extends Record<string, UrlParamCodec<unknown>>>(defs: D, params: UrlParams): {
+    [K in keyof D]: D[K] extends UrlParamCodec<infer T> ? T : never;
+};
+/** Encode a partial set of declared values into a patch (each key → value or
+ *  `undefined` to clear). Only the keys present in `values` are emitted, so the
+ *  write merges and leaves every other query param untouched. */
+export declare function encodePatch<D extends Record<string, UrlParamCodec<unknown>>>(defs: D, values: Partial<{
+    [K in keyof D]: D[K] extends UrlParamCodec<infer T> ? T : never;
+}>): UrlParamsPatch;
+/** Parse a `location.search` string into a params map (repeated keys → array). */
+export declare function parseSearch(search: string): UrlParams;
+/** Apply a patch to a `location.search` string and return the new query string
+ *  (no leading `?`). Each patch key is replaced; `undefined` clears it; every
+ *  other existing param is preserved. */
+export declare function serializeMerge(search: string, patch: UrlParamsPatch): string;
+/** Apply a patch to an in-memory params map (the optimistic local mirror). */
+export declare function applyPatch(params: UrlParams, patch: UrlParamsPatch): UrlParams;
+/** Shallow value-equality over two params maps — used to drop echoed updates so
+ *  an app's own write doesn't re-render it a second time. */
+export declare function paramsEqual(a: UrlParams, b: UrlParams): boolean;
+export {};

package/dist/src/url_params.js

@@ -0,0 +1,215 @@
+/**
+ * Typed codecs that map URL query-string values (always strings, or string
+ * arrays for repeated keys) to and from the typed view-state an app keeps in
+ * the address bar — the engine behind `useUrlState`.
+ *
+ * Two properties make the URLs clean and the round-trip lossless:
+ *
+ *  - **Default-omission.** A codec built with `.withDefault(d)` encodes the
+ *    default value to `undefined` — i.e. the key is dropped from the URL. So a
+ *    filter at its default (`page=1`, `q=""`) never appears, and the shared
+ *    link carries only what the user actually changed.
+ *  - **Declared keys only.** `decodeAll`/`encodePatch` touch exactly the keys the
+ *    app declared. Every other query param (`lotics_host`, `__mock`, a param a
+ *    second `useUrlState` owns, a future host param) is read past and preserved
+ *    on write — the merge is the namespace boundary, so no reserved-prefix rule
+ *    is needed.
+ *
+ * Self-contained on purpose: the SDK publishes to npm as a bundle-free `dist/`,
+ * so it carries no workspace deps (no `@lotics/shared`). These are plain pure
+ * functions — a frontend that later wants the same value⇄query codec can import
+ * them from here rather than growing a second copy.
+ */
+function first(raw) {
+    return Array.isArray(raw) ? raw[0] : raw;
+}
+function valueEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a instanceof Date && b instanceof Date)
+        return a.getTime() === b.getTime();
+    if (Array.isArray(a) && Array.isArray(b)) {
+        return a.length === b.length && a.every((x, i) => valueEqual(x, b[i]));
+    }
+    return false;
+}
+/** Wrap an optional base codec with `.withDefault`. */
+function optional(base) {
+    return {
+        decode: base.decode,
+        encode: base.encode,
+        withDefault(fallback) {
+            return {
+                decode: (raw) => {
+                    const v = base.decode(raw);
+                    return v === undefined ? fallback : v;
+                },
+                encode: (value) => (valueEqual(value, fallback) ? undefined : base.encode(value)),
+            };
+        },
+    };
+}
+const stringCodec = optional({
+    decode: (raw) => (raw === undefined ? undefined : first(raw)),
+    encode: (v) => v,
+});
+const numberCodec = optional({
+    decode: (raw) => {
+        const s = first(raw);
+        if (s === undefined || s === "")
+            return undefined;
+        const n = Number(s);
+        return Number.isFinite(n) ? n : undefined;
+    },
+    encode: (v) => (v === undefined ? undefined : String(v)),
+});
+const booleanCodec = optional({
+    decode: (raw) => {
+        const s = first(raw);
+        return s === "true" ? true : s === "false" ? false : undefined;
+    },
+    encode: (v) => (v === undefined ? undefined : v ? "true" : "false"),
+});
+const isoDateCodec = optional({
+    decode: (raw) => {
+        const s = first(raw);
+        if (s === undefined || !/^\d{4}-\d{2}-\d{2}$/.test(s))
+            return undefined;
+        const d = new Date(`${s}T00:00:00.000Z`);
+        return Number.isNaN(d.getTime()) ? undefined : d;
+    },
+    encode: (v) => (v === undefined ? undefined : v.toISOString().slice(0, 10)),
+});
+function enumCodec(values) {
+    return optional({
+        decode: (raw) => {
+            const s = first(raw);
+            return s === undefined ? undefined : values.find((v) => v === s);
+        },
+        encode: (v) => v,
+    });
+}
+function arrayOf(inner) {
+    return optional({
+        decode: (raw) => {
+            if (raw === undefined)
+                return undefined;
+            const items = Array.isArray(raw) ? raw : [raw];
+            return items.map((x) => inner.decode(x)).filter((x) => x !== undefined);
+        },
+        encode: (value) => {
+            if (value === undefined || value.length === 0)
+                return undefined;
+            const out = value
+                .map((x) => inner.encode(x))
+                .filter((x) => typeof x === "string");
+            return out.length > 0 ? out : undefined;
+        },
+    });
+}
+/**
+ * The codec builders an app composes into a `useUrlState` shape. Each base
+ * builder yields an optional codec (absent key → `undefined`); add
+ * `.withDefault(v)` to make it required and keep the default out of the URL.
+ *
+ *   useUrlState({
+ *     q:      urlParam.string.withDefault(""),
+ *     status: urlParam.enum(["open", "won", "lost"]),       // optional
+ *     tags:   urlParam.arrayOf(urlParam.string).withDefault([]),
+ *     from:   urlParam.isoDate,                              // optional Date
+ *     page:   urlParam.number.withDefault(1),
+ *   })
+ */
+export const urlParam = {
+    string: stringCodec,
+    number: numberCodec,
+    boolean: booleanCodec,
+    isoDate: isoDateCodec,
+    enum: enumCodec,
+    arrayOf,
+};
+/** Decode the declared keys out of a params map into typed values. */
+export function decodeAll(defs, params) {
+    const out = {};
+    for (const key of Object.keys(defs)) {
+        out[key] = defs[key].decode(params[key]);
+    }
+    // Boundary: a per-key loop can't be expressed as the mapped result type.
+    return out;
+}
+/** Encode a partial set of declared values into a patch (each key → value or
+ *  `undefined` to clear). Only the keys present in `values` are emitted, so the
+ *  write merges and leaves every other query param untouched. */
+export function encodePatch(defs, values) {
+    const out = {};
+    for (const key of Object.keys(values)) {
+        const codec = defs[key];
+        if (codec)
+            out[key] = codec.encode(values[key]);
+    }
+    return out;
+}
+/** Parse a `location.search` string into a params map (repeated keys → array). */
+export function parseSearch(search) {
+    const sp = new URLSearchParams(search);
+    const out = {};
+    for (const key of sp.keys()) {
+        if (key in out)
+            continue;
+        const all = sp.getAll(key);
+        out[key] = all.length > 1 ? all : all[0];
+    }
+    return out;
+}
+/** Apply a patch to a `location.search` string and return the new query string
+ *  (no leading `?`). Each patch key is replaced; `undefined` clears it; every
+ *  other existing param is preserved. */
+export function serializeMerge(search, patch) {
+    const sp = new URLSearchParams(search);
+    for (const [key, value] of Object.entries(patch)) {
+        sp.delete(key);
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                sp.append(key, item);
+        }
+        else {
+            sp.append(key, value);
+        }
+    }
+    return sp.toString();
+}
+/** Apply a patch to an in-memory params map (the optimistic local mirror). */
+export function applyPatch(params, patch) {
+    const next = { ...params };
+    for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined)
+            delete next[key];
+        else
+            next[key] = value;
+    }
+    return next;
+}
+/** Shallow value-equality over two params maps — used to drop echoed updates so
+ *  an app's own write doesn't re-render it a second time. */
+export function paramsEqual(a, b) {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length)
+        return false;
+    for (const key of ak) {
+        const av = a[key];
+        const bv = b[key];
+        if (Array.isArray(av) || Array.isArray(bv)) {
+            if (!Array.isArray(av) || !Array.isArray(bv))
+                return false;
+            if (av.length !== bv.length || !av.every((x, i) => x === bv[i]))
+                return false;
+        }
+        else if (av !== bv) {
+            return false;
+        }
+    }
+    return true;
+}

package/dist/src/use_url_state.d.ts

@@ -0,0 +1,8 @@
+import { type UrlParamCodec } from "./url_params.js";
+/** A `useUrlState` shape: a map of param key → codec. */
+export type UrlStateShape = Record<string, UrlParamCodec<unknown>>;
+/** The decoded, typed values for a shape. */
+export type UrlStateValues<D extends UrlStateShape> = {
+    [K in keyof D]: D[K] extends UrlParamCodec<infer T> ? T : never;
+};
+export declare function useUrlState<D extends UrlStateShape>(defs: D): readonly [UrlStateValues<D>, (patch: Partial<UrlStateValues<D>>) => void];

package/dist/src/use_url_state.js

@@ -0,0 +1,73 @@
+/**
+ * Save a declared slice of an app's view-state — filters, search, sort, the
+ * active tab — into the host's address bar, so a filtered view survives refresh
+ * and is shareable/bookmarkable as a link. Writes always *replace* in place: the
+ * host owns no in-app history, and in-app navigation (and the browser back
+ * button) belong to the app's own router, not to this hook.
+ *
+ *   const [filters, setFilters] = useUrlState({
+ *     q:      urlParam.string.withDefault(""),
+ *     status: urlParam.enum(["open", "won", "lost"]),        // optional
+ *     tags:   urlParam.arrayOf(urlParam.string).withDefault([]),
+ *     page:   urlParam.number.withDefault(1),
+ *   });
+ *   // filters → { q: string; status?: "open"|"won"|"lost"; tags: string[]; page: number }
+ *   setFilters({ q: "acme" });                  // merge into the address bar (replace)
+ *
+ * The app declares only the keys it owns; every other query param (a param a
+ * second `useUrlState` owns, the framework's `lotics_host`/`__mock`, a future
+ * host param) is read past and preserved on write. For a search box, keep the
+ * live input in local state and commit to `setFilters` on a debounce — each
+ * call is a cross-frame write in an embedded app.
+ *
+ * The address bar is the only store: nothing is persisted server-side. Values
+ * are decoded fresh from the current params each render; standalone reads the
+ * URL directly, while an embedded app keeps a local mirror seeded from the host
+ * (`urlState.get` on mount) and updated optimistically on its own writes — so
+ * there's no independently-mutable second copy to drift.
+ */
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { getUrlParams, peekUrlParams, setUrlParams, subscribeUrlParams } from "./rpc.js";
+import { applyPatch, decodeAll, encodePatch, paramsEqual, } from "./url_params.js";
+export function useUrlState(defs) {
+    // `defs` is expected stable (declared inline once); read through a ref so the
+    // decoded values and `setValues` stay referentially stable across renders.
+    const defsRef = useRef(defs);
+    defsRef.current = defs;
+    const [params, setParams] = useState(peekUrlParams);
+    // Once the user edits, a late initial hydration (bridged `getUrlParams`
+    // resolves a tick after mount) must not clobber their write.
+    const editedRef = useRef(false);
+    useEffect(() => {
+        let active = true;
+        const apply = (next) => {
+            if (active)
+                setParams((prev) => (paramsEqual(prev, next) ? prev : next));
+        };
+        void getUrlParams().then((p) => {
+            if (active && !editedRef.current)
+                apply(p);
+        });
+        const unsubscribe = subscribeUrlParams(apply);
+        return () => {
+            active = false;
+            unsubscribe();
+        };
+    }, []);
+    const values = useMemo(() => decodeAll(defsRef.current, params), [params]);
+    const setValues = useCallback((patch) => {
+        editedRef.current = true;
+        const encoded = encodePatch(defsRef.current, patch);
+        // Optimistic local mirror so the UI is responsive even before the write
+        // round-trips (and the only update path in standalone, where the history
+        // write fires no event).
+        setParams((prev) => applyPatch(prev, encoded));
+        // The optimistic mirror already reflects the change, so a failed write
+        // only loses cross-refresh persistence, never the session — keep the
+        // optimistic state, but surface the failure instead of swallowing it.
+        void setUrlParams(encoded).catch((err) => {
+            console.error("useUrlState: failed to write state to the address bar", err);
+        });
+    }, []);
+    return [values, setValues];
+}

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@lotics/app-sdk",
-  "version": "0.38.0",
+  "version": "0.40.0",
   "description": "Runtime SDK for Lotics custom-code apps — typed hooks, postMessage bridge, mount entry point",
   "type": "module",
   "exports": {
-    ".": "./dist/src/index.js"
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./router": {
+      "types": "./dist/src/router.d.ts",
+      "default": "./dist/src/router.js"
+    }
   },
   "types": "./dist/src/index.d.ts",
   "files": [
@@ -23,13 +30,20 @@
   },
   "peerDependencies": {
     "react": "^19.2.0",
-    "react-dom": "^19.2.0"
+    "react-dom": "^19.2.0",
+    "react-router-dom": "^7.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react-router-dom": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "react": "^19.2.0",
-    "react-dom": "^19.2.0"
+    "react-dom": "^19.2.0",
+    "react-router-dom": "^7.0.0"
   },
   "keywords": [
     "lotics",