@miadi/stateloom-web 0.1.0 → 0.1.1

package/server/.next/static/chunks/aea5b1716c68391c.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,76800,e=>{"use strict";var t=e.i(30878);let n="stateloom:doc-change";function o(){return new URLSearchParams(window.location.search).get("doc")}function r(e){return e?`?doc=${encodeURIComponent(e)}`:""}function s(e){let t=new URL(window.location.href);e?t.searchParams.set("doc",e):t.searchParams.delete("doc"),window.history.pushState({},"",t),window.dispatchEvent(new Event(n))}function c(){let[e,r]=(0,t.useState)(null);return(0,t.useEffect)(()=>{let e=()=>r(o());return e(),window.addEventListener("popstate",e),window.addEventListener(n,e),()=>{window.removeEventListener("popstate",e),window.removeEventListener(n,e)}},[]),e}e.s(["docQuery",()=>r,"navigateToDoc",()=>s,"requestedDoc",()=>o,"useRequestedDoc",()=>c])},32058,e=>{e.v(e=>Promise.resolve().then(()=>e(76800)))}]);

package/server/.next/static/chunks/{turbopack-8f57da603e40457d.js → turbopack-34fc7de1568e2a7f.js}

@@ -1,4 +1,4 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/8a03c0d2436d4c0f.js","static/chunks/5e1795a806bd6c51.js","static/chunks/96818f5620f039a1.js"],runtimeModuleIds:[95506]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=(self.TURBOPACK_CHUNK_SUFFIX??document?.currentScript?.getAttribute?.("src")?.replace(/^(.*(?=\?)|^.*$)/,""))||"",n=new WeakMap;function o(e,t){this.m=e,this.e=t}let l=o.prototype,i=Object.prototype.hasOwnProperty,s="u">typeof Symbol&&Symbol.toStringTag;function u(e,t,r){i.call(e,t)||Object.defineProperty(e,t,r)}function a(e,t){let r=e[t];return r||(r=c(t),e[t]=r),r}function c(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function f(e,t){u(e,"__esModule",{value:!0}),s&&u(e,s,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)u(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?u(e,n,{get:o,set:t[r++],enumerable:!0}):u(e,n,{get:o,enumerable:!0})}Object.seal(e)}l.s=function(e,t){let r,n;null!=t?n=(r=a(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,f(n,e)},l.j=function(e,t){var r,o;let l,s,u;null!=t?s=(l=a(this.c,t)).exports:(l=this.m,s=this.e);let c=(r=l,o=s,(u=n.get(r))||(n.set(r,u=[]),r.exports=r.namespaceObject=new Proxy(o,{get(e,t){if(i.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of u){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of u)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),u);"object"==typeof e&&null!==e&&c.push(e)},l.v=function(e,t){(null!=t?a(this.c,t):this.m).exports=e},l.n=function(e,t){let r;(r=null!=t?a(this.c,t):this.m).exports=r.namespaceObject=e};let p=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,h=[null,p({}),p([]),p(p)];function d(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!h.includes(t);t=p(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),f(t,n),t}function m(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=d(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function b(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function y(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}l.i=m,l.A=function(e){return this.r(e)(m.bind(this))},l.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},l.r=function(e){return B(e,this.m).exports},l.f=function(e){function t(t){if(t=b(t),i.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=b(t),i.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let O=Symbol("turbopack queues"),g=Symbol("turbopack exports"),w=Symbol("turbopack error");function C(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}l.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:l,reject:i,promise:s}=y(),u=Object.assign(s,{[g]:r.exports,[O]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),a={get:()=>u,set(e){e!==u&&(u[g]=e)}};Object.defineProperty(r,"exports",a),Object.defineProperty(r,"namespaceObject",a),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(O in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[g]:{},[O]:e=>e(t)};return e.then(e=>{r[g]=e,C(t)},e=>{r[w]=e,C(t)}),r}}return{[g]:e,[O]:()=>{}}}),r=()=>t.map(e=>{if(e[w])throw e[w];return e[g]}),{promise:l,resolve:i}=y(),s=Object.assign(()=>i(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[O](u)),s.queueCount?l:r()},function(e){e?i(u[w]=e):l(u[g]),C(n)}),n&&-1===n.status&&(n.status=0)};let U=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function R(e,t){throw Error(`Invariant: ${t(e)}`)}U.prototype=URL.prototype,l.U=U,l.z=function(e){throw Error("dynamic usage of require is not supported")},l.g=globalThis;let j=o.prototype;var _,k=((_=k||{})[_.Runtime=0]="Runtime",_[_.Parent=1]="Parent",_[_.Update=2]="Update",_);let v=new Map;l.M=v;let $=new Map,P=new Map;async function S(e,t,r){let n;if("string"==typeof r)return E(e,t,K(r));let o=r.included||[],l=o.map(e=>!!v.has(e)||$.get(e));if(l.length>0&&l.every(e=>e))return void await Promise.all(l);let i=r.moduleChunks||[],s=i.map(e=>P.get(e)).filter(e=>e);if(s.length>0){if(s.length===i.length)return void await Promise.all(s);let r=new Set;for(let e of i)P.has(e)||r.add(e);for(let n of r){let r=E(e,t,K(n));P.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=E(e,t,K(r.path)),i))P.has(o)||P.set(o,n)}for(let e of o)$.has(e)||$.set(e,n);await n}j.l=function(e){return S(1,this.m.id,e)};let T=Promise.resolve(void 0),A=new WeakMap;function E(t,r,n){let o=e.loadChunkCached(t,n),l=A.get(o);if(void 0===l){let e=A.set.bind(A,o,T);l=o.then(e).catch(e=>{let o;switch(t){case 0:o=`as a runtime dependency of chunk ${r}`;break;case 1:o=`from module ${r}`;break;case 2:o="from an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}let l=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw l.name="ChunkLoadError",l}),A.set(o,l)}return l}function K(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}j.L=function(e){return E(1,this.m.id,e)},j.R=function(e){let t=this.r(e);return t?.default??t},j.P=function(e){return`/ROOT/${e??""}`},j.b=function(e){let t=new Blob([`self.TURBOPACK_WORKER_LOCATION = ${JSON.stringify(location.origin)};
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/662d1b0ce457c16b.js","static/chunks/5e1795a806bd6c51.js","static/chunks/96818f5620f039a1.js"],runtimeModuleIds:[95506]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=(self.TURBOPACK_CHUNK_SUFFIX??document?.currentScript?.getAttribute?.("src")?.replace(/^(.*(?=\?)|^.*$)/,""))||"",n=new WeakMap;function o(e,t){this.m=e,this.e=t}let l=o.prototype,i=Object.prototype.hasOwnProperty,s="u">typeof Symbol&&Symbol.toStringTag;function u(e,t,r){i.call(e,t)||Object.defineProperty(e,t,r)}function a(e,t){let r=e[t];return r||(r=c(t),e[t]=r),r}function c(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function f(e,t){u(e,"__esModule",{value:!0}),s&&u(e,s,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)u(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?u(e,n,{get:o,set:t[r++],enumerable:!0}):u(e,n,{get:o,enumerable:!0})}Object.seal(e)}l.s=function(e,t){let r,n;null!=t?n=(r=a(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,f(n,e)},l.j=function(e,t){var r,o;let l,s,u;null!=t?s=(l=a(this.c,t)).exports:(l=this.m,s=this.e);let c=(r=l,o=s,(u=n.get(r))||(n.set(r,u=[]),r.exports=r.namespaceObject=new Proxy(o,{get(e,t){if(i.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of u){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of u)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),u);"object"==typeof e&&null!==e&&c.push(e)},l.v=function(e,t){(null!=t?a(this.c,t):this.m).exports=e},l.n=function(e,t){let r;(r=null!=t?a(this.c,t):this.m).exports=r.namespaceObject=e};let p=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,h=[null,p({}),p([]),p(p)];function d(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!h.includes(t);t=p(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),f(t,n),t}function m(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=d(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function b(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function y(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}l.i=m,l.A=function(e){return this.r(e)(m.bind(this))},l.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},l.r=function(e){return B(e,this.m).exports},l.f=function(e){function t(t){if(t=b(t),i.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=b(t),i.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let O=Symbol("turbopack queues"),g=Symbol("turbopack exports"),w=Symbol("turbopack error");function C(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}l.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:l,reject:i,promise:s}=y(),u=Object.assign(s,{[g]:r.exports,[O]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),a={get:()=>u,set(e){e!==u&&(u[g]=e)}};Object.defineProperty(r,"exports",a),Object.defineProperty(r,"namespaceObject",a),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(O in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[g]:{},[O]:e=>e(t)};return e.then(e=>{r[g]=e,C(t)},e=>{r[w]=e,C(t)}),r}}return{[g]:e,[O]:()=>{}}}),r=()=>t.map(e=>{if(e[w])throw e[w];return e[g]}),{promise:l,resolve:i}=y(),s=Object.assign(()=>i(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[O](u)),s.queueCount?l:r()},function(e){e?i(u[w]=e):l(u[g]),C(n)}),n&&-1===n.status&&(n.status=0)};let U=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function R(e,t){throw Error(`Invariant: ${t(e)}`)}U.prototype=URL.prototype,l.U=U,l.z=function(e){throw Error("dynamic usage of require is not supported")},l.g=globalThis;let j=o.prototype;var _,k=((_=k||{})[_.Runtime=0]="Runtime",_[_.Parent=1]="Parent",_[_.Update=2]="Update",_);let v=new Map;l.M=v;let $=new Map,P=new Map;async function S(e,t,r){let n;if("string"==typeof r)return E(e,t,K(r));let o=r.included||[],l=o.map(e=>!!v.has(e)||$.get(e));if(l.length>0&&l.every(e=>e))return void await Promise.all(l);let i=r.moduleChunks||[],s=i.map(e=>P.get(e)).filter(e=>e);if(s.length>0){if(s.length===i.length)return void await Promise.all(s);let r=new Set;for(let e of i)P.has(e)||r.add(e);for(let n of r){let r=E(e,t,K(n));P.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=E(e,t,K(r.path)),i))P.has(o)||P.set(o,n)}for(let e of o)$.has(e)||$.set(e,n);await n}j.l=function(e){return S(1,this.m.id,e)};let T=Promise.resolve(void 0),A=new WeakMap;function E(t,r,n){let o=e.loadChunkCached(t,n),l=A.get(o);if(void 0===l){let e=A.set.bind(A,o,T);l=o.then(e).catch(e=>{let o;switch(t){case 0:o=`as a runtime dependency of chunk ${r}`;break;case 1:o=`from module ${r}`;break;case 2:o="from an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}let l=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw l.name="ChunkLoadError",l}),A.set(o,l)}return l}function K(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}j.L=function(e){return E(1,this.m.id,e)},j.R=function(e){let t=this.r(e);return t?.default??t},j.P=function(e){return`/ROOT/${e??""}`},j.b=function(e){let t=new Blob([`self.TURBOPACK_WORKER_LOCATION = ${JSON.stringify(location.origin)};
 self.TURBOPACK_CHUNK_SUFFIX = ${JSON.stringify(r)};
 self.TURBOPACK_NEXT_CHUNK_URLS = ${JSON.stringify(e.reverse().map(K),null,2)};
 importScripts(...self.TURBOPACK_NEXT_CHUNK_URLS.map(c => self.TURBOPACK_WORKER_LOCATION + c).reverse());`],{type:"text/javascript"});return URL.createObjectURL(t)};let x=/\.js(?:\?[^#]*)?(?:#.*)?$/,N=/\.css(?:\?[^#]*)?(?:#.*)?$/;function M(e){return N.test(e)}l.w=function(t,r,n){return e.loadWebAssembly(1,this.m.id,t,r,n)},l.u=function(t,r){return e.loadWebAssemblyModule(1,this.m.id,t,r)};let L={};l.c=L;let B=(e,t)=>{let r=L[e];if(r){if(r.error)throw r.error;return r}return q(e,k.Parent,t.id)};function q(e,t,r){let n=v.get(e);if("function"!=typeof n)throw Error(function(e,t,r){let n;switch(t){case 0:n=`as a runtime entry of chunk ${r}`;break;case 1:n=`because it was required from module ${r}`;break;case 2:n="because of an HMR update";break;default:R(t,e=>`Unknown source type: ${e}`)}return`Module ${e} was instantiated ${n}, but the module factory is not available.`}(e,t,r));let l=c(e),i=l.exports;L[e]=l;let s=new o(l,i);try{n(s,l,i)}catch(e){throw l.error=e,e}return l.namespaceObject&&l.exports!==l.namespaceObject&&d(l.exports,l.namespaceObject),l}function I(r){let n,o=function(e){if("string"==typeof e)return e;let r=decodeURIComponent(("u">typeof TURBOPACK_NEXT_CHUNK_URLS?TURBOPACK_NEXT_CHUNK_URLS.pop():e.getAttribute("src")).replace(/[?#].*$/,""));return r.startsWith(t)?r.slice(t.length):r}(r[0]);return 2===r.length?n=r[1]:(n=void 0,!function(e,t,r,n){let o=1;for(;o<e.length;){let t=e[o],n=o+1;for(;n<e.length&&"function"!=typeof e[n];)n++;if(n===e.length)throw Error("malformed chunk format, expected a factory function");if(!r.has(t)){let l=e[n];for(Object.defineProperty(l,"name",{value:"module evaluation"});o<n;o++)t=e[o],r.set(t,l)}o=n+1}}(r,0,v)),e.registerChunk(o,n)}let W=new Map;function H(e){let t=W.get(e);if(!t){let r,n;t={resolved:!1,loadingStarted:!1,promise:new Promise((e,t)=>{r=e,n=t}),resolve:()=>{t.resolved=!0,r()},reject:n},W.set(e,t)}return t}e={async registerChunk(e,t){if(H(K(e)).resolve(),null!=t){for(let e of t.otherChunks)H(K("string"==typeof e?e:e.path));if(await Promise.all(t.otherChunks.map(t=>S(0,e,t))),t.runtimeModuleIds.length>0)for(let r of t.runtimeModuleIds)!function(e,t){let r=L[t];if(r){if(r.error)throw r.error;return}q(t,k.Runtime,e)}(e,r)}},loadChunkCached:(e,t)=>(function(e,t){let r=H(t);if(r.loadingStarted)return r.promise;if(e===k.Runtime)return r.loadingStarted=!0,M(t)&&r.resolve(),r.promise;if("function"==typeof importScripts)if(M(t));else if(x.test(t))self.TURBOPACK_NEXT_CHUNK_URLS.push(t),importScripts(TURBOPACK_WORKER_LOCATION+t);else throw Error(`can't infer type of chunk from URL ${t} in worker`);else{let e=decodeURI(t);if(M(t))if(document.querySelectorAll(`link[rel=stylesheet][href="${t}"],link[rel=stylesheet][href^="${t}?"],link[rel=stylesheet][href="${e}"],link[rel=stylesheet][href^="${e}?"]`).length>0)r.resolve();else{let e=document.createElement("link");e.rel="stylesheet",e.href=t,e.onerror=()=>{r.reject()},e.onload=()=>{r.resolve()},document.head.appendChild(e)}else if(x.test(t)){let n=document.querySelectorAll(`script[src="${t}"],script[src^="${t}?"],script[src="${e}"],script[src^="${e}?"]`);if(n.length>0)for(let e of Array.from(n))e.addEventListener("error",()=>{r.reject()});else{let e=document.createElement("script");e.src=t,e.onerror=()=>{r.reject()},document.head.appendChild(e)}}else throw Error(`can't infer type of chunk from URL ${t}`)}return r.loadingStarted=!0,r.promise})(e,t),async loadWebAssembly(e,t,r,n,o){let l=fetch(K(r)),{instance:i}=await WebAssembly.instantiateStreaming(l,o);return i.exports},async loadWebAssemblyModule(e,t,r,n){let o=fetch(K(r));return await WebAssembly.compileStreaming(o)}};let F=globalThis.TURBOPACK;globalThis.TURBOPACK={push:I},F.forEach(I)})();

package/server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "stateloom-web",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "stateloom-web",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "dependencies": {
         "@miadi/stateloom-client": "file:../bridge-client",
         "@miadi/stateloom-protocol": "file:../bridge-protocol",

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stateloom-web",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "scripts": {
     "dev": "next dev -p ${PORT:-4598}",

package/server/src/app/api/file/route.ts

@@ -1,11 +1,21 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
 import { existsSync, readFileSync, writeFileSync, statSync } from "fs";
-import { getProjectFilePath } from "@/lib/projectFile";
+import { resolveDocPath } from "@/lib/projectFile";
 
 export const dynamic = "force-dynamic";
 
-export async function GET() {
-  const path = getProjectFilePath();
+// Optional `?doc=<absolute .json path>` selects the document; omitted, the
+// default project file answers exactly as before. Every doc passes the root
+// allowlist in lib/projectFile.ts — parameter and guard are one surface
+// (chart chart_1785683022927). A refusal names its reason and is a 403,
+// never a write.
+
+export async function GET(req: NextRequest) {
+  const resolution = resolveDocPath(req.nextUrl.searchParams.get("doc"));
+  if (!resolution.ok) {
+    return NextResponse.json({ error: resolution.error }, { status: 403 });
+  }
+  const path = resolution.path;
   if (!existsSync(path)) {
     return NextResponse.json({ path, content: null, mtime: 0, exists: false });
   }
@@ -14,8 +24,12 @@ export async function GET() {
   return NextResponse.json({ path, content, mtime, exists: true });
 }
 
-export async function PUT(req: Request) {
-  const path = getProjectFilePath();
+export async function PUT(req: NextRequest) {
+  const resolution = resolveDocPath(req.nextUrl.searchParams.get("doc"));
+  if (!resolution.ok) {
+    return NextResponse.json({ error: resolution.error }, { status: 403 });
+  }
+  const path = resolution.path;
   const body = await req.json();
   if (typeof body?.content !== "string") {
     return NextResponse.json(

package/server/src/app/api/watch/route.ts

@@ -1,11 +1,19 @@
+import { NextRequest, NextResponse } from "next/server";
 import { existsSync, statSync, watch } from "fs";
-import { getProjectFilePath } from "@/lib/projectFile";
+import { resolveDocPath } from "@/lib/projectFile";
 
 export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
-export async function GET() {
-  const path = getProjectFilePath();
+export async function GET(req: NextRequest) {
+  // Same optional `?doc=` and the same allowlist as /api/file — the watch
+  // stream follows whichever document the page asked for (step 2 of
+  // chart_1785683010290). A refusal is a named 403, not a stream.
+  const resolution = resolveDocPath(req.nextUrl.searchParams.get("doc"));
+  if (!resolution.ok) {
+    return NextResponse.json({ error: resolution.error }, { status: 403 });
+  }
+  const path = resolution.path;
   const encoder = new TextEncoder();
 
   const stream = new ReadableStream({

package/server/src/components/BridgeProvider.tsx

@@ -2,18 +2,23 @@
 
 import { useEffect } from "react";
 import { useDesignerStore } from "@/store/useDesignerStore";
+import { docQuery, useRequestedDoc } from "@/lib/docParam";
 
 export default function BridgeProvider() {
   const applyRemote = useDesignerStore((s) => s.applyRemote);
   const setRemoteStatus = useDesignerStore((s) => s.setRemoteStatus);
   const setRemoteMtime = useDesignerStore((s) => s.setRemoteMtime);
+  // Step 2: the requested `?doc=` rides both the file fetch and the watch
+  // stream; the server resolves and guards, the browser only passes through.
+  const requested = useRequestedDoc();
 
   useEffect(() => {
     let cancelled = false;
+    const qs = docQuery(requested);
 
     async function fetchFile(): Promise<{ content: string | null; mtime: number; path: string; exists: boolean } | null> {
       try {
-        const r = await fetch("/api/file", { cache: "no-store" });
+        const r = await fetch(`/api/file${qs}`, { cache: "no-store" });
         if (!r.ok) return null;
         return await r.json();
       } catch {
@@ -33,7 +38,7 @@ export default function BridgeProvider() {
       }
     })();
 
-    const es = new EventSource("/api/watch");
+    const es = new EventSource(`/api/watch${qs}`);
 
     es.addEventListener("hello", (ev) => {
       try {
@@ -68,7 +73,9 @@ export default function BridgeProvider() {
       cancelled = true;
       es.close();
     };
-  }, [applyRemote, setRemoteStatus, setRemoteMtime]);
+    // `requested` re-keys the whole effect (step 3): a document switch closes
+    // the old watch stream and loads + watches the new document, no reload.
+  }, [applyRemote, setRemoteStatus, setRemoteMtime, requested]);
 
   return null;
 }

package/server/src/components/DocSwitcher.tsx

@@ -0,0 +1,84 @@
+"use client";
+
+import { useState } from "react";
+import { navigateToDoc, useRequestedDoc } from "@/lib/docParam";
+import { rememberedDocs } from "@/lib/layoutMemory";
+
+/**
+ * A human switches diagrams without an agent and without a terminal
+ * (chart_1785683062725). Presentation over state that already exists: recents
+ * are the documents this browser holds layout memory for, plus a free path
+ * field. Choosing navigates via `?doc=` — the providers re-key (step 3), the
+ * server allowlist guards (step 1), no reload, no new transport.
+ */
+export default function DocSwitcher() {
+  const requested = useRequestedDoc();
+  const [open, setOpen] = useState(false);
+  const [typed, setTyped] = useState("");
+
+  const go = (doc: string | null) => {
+    setOpen(false);
+    setTyped("");
+    navigateToDoc(doc);
+  };
+
+  const recents = open
+    ? rememberedDocs().filter((d) => d.startsWith("/") && d !== requested)
+    : [];
+
+  return (
+    <span className="relative inline-flex">
+      <button
+        onClick={() => setOpen((v) => !v)}
+        className="toolbar-btn"
+        title={requested ? `Document: ${requested}` : "Switch document"}
+      >
+        ⇄
+      </button>
+      {open && (
+        <div className="absolute left-0 top-full z-50 mt-1 w-72 rounded border border-gray-700 bg-gray-900 p-2 shadow-lg">
+          <div className="mb-1 text-[10px] uppercase tracking-wide text-gray-500">
+            switch document
+          </div>
+          {requested && (
+            <button
+              onClick={() => go(null)}
+              className="block w-full truncate rounded px-1.5 py-1 text-left text-xs text-gray-300 hover:bg-gray-800"
+              title="Return to the default project file"
+            >
+              ⌂ default document
+            </button>
+          )}
+          {recents.map((d) => (
+            <button
+              key={d}
+              onClick={() => go(d)}
+              className="block w-full truncate rounded px-1.5 py-1 text-left text-xs text-gray-300 hover:bg-gray-800"
+              title={d}
+            >
+              {d.split("/").pop()}
+              <span className="ml-1 text-[10px] text-gray-600">{d}</span>
+            </button>
+          ))}
+          <form
+            onSubmit={(e) => {
+              e.preventDefault();
+              if (typed.trim()) go(typed.trim());
+            }}
+            className="mt-1 flex gap-1"
+          >
+            <input
+              value={typed}
+              onChange={(e) => setTyped(e.target.value)}
+              placeholder="/absolute/path/to/doc.smdf.json"
+              className="min-w-0 flex-1 rounded border border-gray-700 bg-gray-950 px-1.5 py-1 text-xs text-gray-200 placeholder:text-gray-600"
+            />
+            <button type="submit" className="toolbar-btn" title="Open this document">
+              →
+            </button>
+          </form>
+        </div>
+      )}
+    </span>
+  );
+}

package/server/src/components/SocketBridgeProvider.tsx

@@ -11,6 +11,7 @@ import {
   type StateMachineDefinition,
 } from "@miadi/stateloom-protocol";
 import { useDesignerStore } from "@/store/useDesignerStore";
+import { docQuery, useRequestedDoc } from "@/lib/docParam";
 
 const OUTBOUND_DEBOUNCE_MS = 60;
 
@@ -26,6 +27,9 @@ const OUTBOUND_DEBOUNCE_MS = 60;
  */
 export default function SocketBridgeProvider({ url }: { url: string }) {
   const presence = useDesignerStore((s) => s.presence);
+  // The requested `?doc=` (step 2): passed through to the file API, which
+  // resolves and guards it; the join below keys the room by the RESOLVED path.
+  const requested = useRequestedDoc();
 
   useEffect(() => {
     if (!url) return;
@@ -42,7 +46,7 @@ export default function SocketBridgeProvider({ url }: { url: string }) {
       // Learn the docId (the resolved project-file path) from the file API.
       let docId = "";
       try {
-        const r = await fetch("/api/file", { cache: "no-store" });
+        const r = await fetch(`/api/file${docQuery(requested)}`, { cache: "no-store" });
         if (r.ok) docId = (await r.json())?.path ?? "";
       } catch {
         // Connect anyway; the hub keys the doc by whatever id we send.
@@ -115,9 +119,12 @@ export default function SocketBridgeProvider({ url }: { url: string }) {
       if (unsub) unsub();
       if (session) session.disconnect();
     };
-    // Re-run when the URL arrives: DesignBridge resolves it asynchronously from
-    // /api/config, so the first render can legitimately have a different value.
-  }, [url]);
+    // Re-run when the URL arrives (DesignBridge resolves it asynchronously from
+    // /api/config) AND when the requested document changes (step 3): the
+    // cleanup disconnects the old session, the new run joins the new room —
+    // switching needs no reload. applyRemote already rebuilds everything from
+    // an arbitrary definition, so the arriving full-def repaints the canvas.
+  }, [url, requested]);
 
   if (presence.length === 0) return null;
 

package/server/src/components/Toolbar.tsx

@@ -9,6 +9,8 @@ import {
   type ExportFormat,
 } from "@/lib/exportImage";
 import type { StateDef } from "@/types/definition";
+import DocSwitcher from "./DocSwitcher";
+import { docQuery, useRequestedDoc } from "@/lib/docParam";
 
 export default function Toolbar() {
   const definition = useDesignerStore((s) => s.definition);
@@ -36,6 +38,11 @@ export default function Toolbar() {
   const setRemoteMtime = useDesignerStore((s) => s.setRemoteMtime);
   const applyRemote = useDesignerStore((s) => s.applyRemote);
 
+  // Save and reload must follow the SAME document the page is viewing —
+  // without this, 💾 on a switched document would silently write the default
+  // file (the exact mismatch the allowlist exists to prevent).
+  const requested = useRequestedDoc();
+
   const fileInputRef = useRef<HTMLInputElement>(null);
   const [addingState, setAddingState] = useState(false);
   const [newStateName, setNewStateName] = useState("");
@@ -63,7 +70,7 @@ export default function Toolbar() {
     const json = exportJson();
     setSaving(true);
     try {
-      const r = await fetch("/api/file", {
+      const r = await fetch(`/api/file${docQuery(requested)}`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ content: json }),
@@ -115,7 +122,7 @@ export default function Toolbar() {
 
   const handleReloadFromDisk = async () => {
     try {
-      const r = await fetch("/api/file", { cache: "no-store" });
+      const r = await fetch(`/api/file${docQuery(requested)}`, { cache: "no-store" });
       if (!r.ok) {
         setRemoteStatus("error", "Reload failed");
         return;
@@ -198,11 +205,12 @@ export default function Toolbar() {
           className="hidden"
         />
 
-        {/* File name + bridge status */}
+        {/* File name + document switcher + bridge status */}
         <span className="text-xs text-gray-400 mr-1 truncate max-w-[50vw] md:max-w-none">
           {fileName ?? "untitled.smdf.json"}
           {dirty && <span className="text-yellow-500 ml-0.5">●</span>}
         </span>
+        <DocSwitcher />
         {remoteStatus === "synced" && (
           <span className="text-[10px] text-emerald-500" title="In sync with disk">⌁ synced</span>
         )}

package/server/src/lib/docParam.ts

@@ -0,0 +1,51 @@
+"use client";
+
+import { useEffect, useState } from "react";
+
+/**
+ * The one client-side source of the requested document (chart steps 2/3/6 of
+ * chart_1785683010290): the `?doc=` URL parameter. The browser only ever
+ * PASSES the request through — resolution and the root allowlist live on the
+ * server (lib/projectFile.ts), and the browser learns the resolved path from
+ * the API response exactly as before. No parameter → the default document,
+ * byte-identical to the old behavior.
+ */
+
+const DOC_CHANGE_EVENT = "stateloom:doc-change";
+
+export function requestedDoc(): string | null {
+  if (typeof window === "undefined") return null;
+  return new URLSearchParams(window.location.search).get("doc");
+}
+
+/** Query-string tail for API calls: "?doc=…" or "". */
+export function docQuery(doc: string | null): string {
+  return doc ? `?doc=${encodeURIComponent(doc)}` : "";
+}
+
+/** Switch documents without a reload (step 6): rewrite the URL, tell the
+ *  providers. History gets an entry so back/forward walk documents too. */
+export function navigateToDoc(doc: string | null): void {
+  const url = new URL(window.location.href);
+  if (doc) url.searchParams.set("doc", doc);
+  else url.searchParams.delete("doc");
+  window.history.pushState({}, "", url);
+  window.dispatchEvent(new Event(DOC_CHANGE_EVENT));
+}
+
+/** The requested doc as reactive state: updates on picker navigation and on
+ *  back/forward. Server render sees null; the first client effect corrects. */
+export function useRequestedDoc(): string | null {
+  const [doc, setDoc] = useState<string | null>(null);
+  useEffect(() => {
+    const update = () => setDoc(requestedDoc());
+    update();
+    window.addEventListener("popstate", update);
+    window.addEventListener(DOC_CHANGE_EVENT, update);
+    return () => {
+      window.removeEventListener("popstate", update);
+      window.removeEventListener(DOC_CHANGE_EVENT, update);
+    };
+  }, []);
+  return doc;
+}

package/server/src/lib/layoutMemory.ts

@@ -36,6 +36,21 @@ export interface LayoutMemory {
   viewport: Viewport;
 }
 
+/** Documents this browser holds layout memory for — the picker's recents
+ *  (chart_1785683062725: presentation over state that already exists). */
+export function rememberedDocs(): string[] {
+  try {
+    const docs: string[] = [];
+    for (let i = 0; i < window.localStorage.length; i++) {
+      const k = window.localStorage.key(i);
+      if (k?.startsWith(KEY_PREFIX)) docs.push(k.slice(KEY_PREFIX.length));
+    }
+    return docs.sort();
+  } catch {
+    return [];
+  }
+}
+
 export function memoryKey(docId: string): string {
   return `${KEY_PREFIX}${docId}`;
 }
@@ -108,10 +123,13 @@ export function writeMemory(
   }
 }
 
-/** The document this browser is remembering for: the resolved project path. */
+/** The document this browser is remembering for: the resolved project path.
+ *  The requested `?doc=` rides along (step 2) so memory keys follow the
+ *  document the page actually asked for, not always the default. */
 async function resolveDocId(): Promise<string> {
   try {
-    const r = await fetch("/api/file", { cache: "no-store" });
+    const { requestedDoc, docQuery } = await import("./docParam");
+    const r = await fetch(`/api/file${docQuery(requestedDoc())}`, { cache: "no-store" });
     if (r.ok) {
       const path = (await r.json())?.path;
       if (typeof path === "string" && path.length > 0) return path;

package/server/src/lib/projectFile.ts

@@ -1,6 +1,73 @@
-import { resolve } from "path";
+import { existsSync, realpathSync } from "fs";
+import { dirname, isAbsolute, resolve, sep } from "path";
 import { envAlias } from "@miadi/stateloom-protocol";
 
 export function getProjectFilePath(): string {
   return resolve(envAlias("PROJECT_FILE") ?? "./statemachine.smdf.json");
 }
+
+/**
+ * Optional-document resolution for the file API (chart chart_1785683022927).
+ *
+ * The guard is not deferrable and ships in the same change as the parameter:
+ * the canvas binds beyond loopback and PUT /api/file writes to disk, so an
+ * unconstrained path parameter would be arbitrary file write across the
+ * tailnet. A `doc` is admitted only when it is an absolute `.json` path whose
+ * real location sits under an allowed root.
+ *
+ * Roots come from STATELOOM_DOC_ROOTS (SMCRAFT_ twin honored), colon-
+ * separated absolute paths. Unset, the allowlist is exactly the directory of
+ * the default project file — the pre-parameter surface, unchanged.
+ */
+export function allowedDocRoots(): string[] {
+  const raw = envAlias("DOC_ROOTS");
+  const roots = raw
+    ? raw.split(":").map((r) => r.trim()).filter(Boolean)
+    : [dirname(getProjectFilePath())];
+  const real: string[] = [];
+  for (const root of roots) {
+    try {
+      real.push(realpathSync(resolve(root)));
+    } catch {
+      // A configured root that does not exist admits nothing — skipped, not fatal.
+    }
+  }
+  return real;
+}
+
+export type DocResolution =
+  | { ok: true; path: string }
+  | { ok: false; error: string };
+
+/** Resolve an optional `doc` request parameter to an admitted absolute path.
+ *  No doc → the default project file, byte-identical to the old behavior. */
+export function resolveDocPath(doc: string | null | undefined): DocResolution {
+  if (!doc) return { ok: true, path: getProjectFilePath() };
+
+  if (!isAbsolute(doc)) {
+    return { ok: false, error: "doc must be an absolute path" };
+  }
+  if (!doc.endsWith(".json")) {
+    return { ok: false, error: "doc must name a .json document" };
+  }
+
+  const lexical = resolve(doc);
+  // Realpath the file itself when it exists (GET/PUT of a known doc), else its
+  // parent (PUT may create the file) — symlinks cannot smuggle a path outside
+  // the allowlist either way. A doc whose parent does not exist is refused.
+  let anchored: string;
+  try {
+    anchored = existsSync(lexical)
+      ? realpathSync(lexical)
+      : resolve(realpathSync(dirname(lexical)), lexical.slice(lexical.lastIndexOf(sep) + 1));
+  } catch {
+    return { ok: false, error: "doc directory does not exist" };
+  }
+
+  for (const root of allowedDocRoots()) {
+    if (anchored === root || anchored.startsWith(root + sep)) {
+      return { ok: true, path: anchored };
+    }
+  }
+  return { ok: false, error: "doc is outside the allowed roots" };
+}

package/server/stateloom-web.json

@@ -1,5 +1,5 @@
 {
-  "package": "0.1.0",
-  "designer": "0.1.0",
+  "package": "0.1.1",
+  "designer": "0.1.1",
   "next": "16.1.6"
 }