@tridha643/hestia 1.0.1 → 1.1.0

package/dist/cli.js

@@ -7158,6 +7158,19 @@ import {
 } from "fs";
 import { dirname as dirname2 } from "path";
 import { randomUUID } from "crypto";
+function fsyncDir(path) {
+  let fd;
+  try {
+    fd = openSync(dirname2(path), "r");
+  } catch {
+    return;
+  }
+  try {
+    fsyncSync(fd);
+  } catch {} finally {
+    closeSync(fd);
+  }
+}
 function writeAtomicJsonFile(path, value, options = {}) {
   mkdirSync(dirname2(path), { recursive: true });
   const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -7179,6 +7192,7 @@ function writeAtomicJsonFile(path, value, options = {}) {
     rmSync(temporaryPath, { force: true });
     throw error;
   }
+  fsyncDir(path);
 }
 function writeAtomicTextFile(path, source, mode = 384) {
   mkdirSync(dirname2(path), { recursive: true });
@@ -7200,6 +7214,7 @@ function writeAtomicTextFile(path, source, mode = 384) {
     rmSync(temporaryPath, { force: true });
     throw error;
   }
+  fsyncDir(path);
 }
 var init_atomic_json_file = () => {};
 
@@ -9252,6 +9267,39 @@ async function releaseSlot(port, project) {
     });
   } catch {}
 }
+async function sharedVerb(port, verb, body) {
+  const timeoutMs = (body.waitMs ?? 0) + 5000;
+  let response;
+  try {
+    response = await fetch(`http://127.0.0.1:${port}/hestia/shared/${verb}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...daemonAuthHeaders(port) },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    throw new HestiaError("daemon-unreachable", `could not reach hestiad on 127.0.0.1:${port}: ${error.message}`);
+  }
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new HestiaError(payload.code ?? "daemon-unreachable", payload.error ?? `daemon rejected shared ${verb}: HTTP ${response.status}`);
+  }
+  return {
+    granted: payload.granted === true,
+    holder: payload.holder,
+    queued: payload.queued ?? []
+  };
+}
+async function releaseSharedForProject(port, project, service) {
+  try {
+    await fetch(`http://127.0.0.1:${port}/hestia/shared/release-project`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...daemonAuthHeaders(port) },
+      body: JSON.stringify({ project, service }),
+      signal: AbortSignal.timeout(2000)
+    });
+  } catch {}
+}
 var DAEMON_PIDFILE_NAME = "hestiad", MAX_NDJSON_FRAME_BYTES;
 var init_client = __esm(() => {
   init_src();
@@ -9575,6 +9623,7 @@ class Admission {
 }
 var HESTIAD_PROTOCOL_VERSION = 5, MAX_JSON_BODY_BYTES;
 var init_routes = __esm(() => {
+  init_src();
   init_state();
   init_slots();
   MAX_JSON_BODY_BYTES = 16 * 1024;
@@ -10155,25 +10204,182 @@ var init_portless_adapter = __esm(() => {
   HESTIA_ROUTER_RUNTIME_STATE_DIR = join15(HESTIA_ROUTER_INSTALL_DIR, "state");
 });
 
+// packages/engine/src/tunnel/shared.ts
+import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
+import { join as join16 } from "path";
+function sharedRoot() {
+  return join16(hestiaHome(), "shared");
+}
+function sharedPath(name) {
+  return join16(sharedRoot(), `${name}.json`);
+}
+function assertSharedName(name) {
+  if (!NAME_RE.test(name)) {
+    throw new HestiaError("usage", `shared hostname handle ${JSON.stringify(name)} must be a DNS label: ` + `lowercase alphanumerics and hyphens, at most 63 characters`);
+  }
+}
+function assertSharedHostnameFqdn(hostname) {
+  const labels = hostname.split(".");
+  const valid = hostname.length <= 253 && hostname === hostname.toLowerCase() && labels.length >= 2 && labels.every((label) => LABEL_RE.test(label));
+  if (!valid) {
+    throw new HestiaError("usage", `shared hostname ${JSON.stringify(hostname)} must be a fully-qualified ` + `lowercase domain (e.g. slack.acme.com)`);
+  }
+}
+function normalizeSharedPath(input) {
+  if (input === undefined)
+    return;
+  const trimmed = input.trim();
+  const segments = trimmed.split("/").filter((segment) => segment !== "");
+  for (const segment of segments) {
+    if (segment === "." || segment === ".." || !PATH_SEGMENT_RE.test(segment)) {
+      throw new HestiaError("usage", `shared hostname path ${JSON.stringify(input)} must be a URL path prefix ` + `like /webhooks/slack (no query, fragment, or ".." segments)`);
+    }
+  }
+  if (segments.length === 0)
+    return;
+  return `/${segments.join("/")}`;
+}
+function sharedPathMatches(prefix, requestPath) {
+  if (prefix === undefined)
+    return true;
+  return requestPath === prefix || requestPath.startsWith(`${prefix}/`);
+}
+function withSharedLock(fn) {
+  return withLock(sharedRoot(), fn);
+}
+function parseShared(source) {
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    return null;
+  }
+  if (value.schemaVersion !== STATE_SCHEMA_VERSION || typeof value.name !== "string" || !NAME_RE.test(value.name) || typeof value.hostname !== "string" || value.hostname.length === 0 || typeof value.tunnelUuid !== "string" || value.tunnelUuid.length === 0 || typeof value.zone !== "string" || value.zone.length === 0 || typeof value.service !== "string" || value.service.length === 0 || typeof value.createdAt !== "string")
+    return null;
+  if (value.path !== undefined && (typeof value.path !== "string" || !value.path.startsWith("/"))) {
+    return null;
+  }
+  if (value.holder !== undefined) {
+    const holder = value.holder;
+    if (typeof holder.project !== "string" || typeof holder.worktree !== "string" || typeof holder.service !== "string" || typeof holder.at !== "string")
+      return null;
+  }
+  if (value.queue !== undefined) {
+    if (!Array.isArray(value.queue))
+      return null;
+    for (const entry of value.queue) {
+      if (typeof entry !== "object" || entry === null || typeof entry.project !== "string" || typeof entry.worktree !== "string" || typeof entry.at !== "string")
+        return null;
+    }
+  }
+  return value;
+}
+function readSharedHostname(name) {
+  const p = sharedPath(name);
+  if (!existsSync13(p))
+    return null;
+  try {
+    return parseShared(readFileSync13(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function listSharedHostnames() {
+  const root = sharedRoot();
+  if (!existsSync13(root))
+    return [];
+  const records = [];
+  for (const entry of readdirSync4(root).sort()) {
+    if (!entry.endsWith(".json"))
+      continue;
+    const record = readSharedHostname(entry.slice(0, -".json".length));
+    if (record !== null && `${record.name}.json` === entry)
+      records.push(record);
+  }
+  return records;
+}
+async function declareSharedHostname(record) {
+  assertSharedName(record.name);
+  assertSharedHostnameFqdn(record.hostname);
+  const path = normalizeSharedPath(record.path);
+  return withSharedLock(async () => {
+    const collision = listSharedHostnames().find((candidate) => candidate.name !== record.name && candidate.hostname === record.hostname && (candidate.path ?? undefined) === (path ?? undefined));
+    if (collision !== undefined) {
+      throw new HestiaError("shared-conflict", `${record.hostname}${path ?? ""} is already declared as shared hostname ` + `"${collision.name}" \u2014 pick a distinct path or handle`);
+    }
+    const existing = readSharedHostname(record.name);
+    if (existing !== null) {
+      if (existing.hostname !== record.hostname || existing.tunnelUuid !== record.tunnelUuid || (existing.path ?? undefined) !== (path ?? undefined)) {
+        throw new HestiaError("shared-conflict", `shared hostname "${record.name}" already declared as ${existing.hostname}` + `${existing.path ?? ""} on tunnel ${existing.tunnelUuid} \u2014 release and remove it before re-pointing`);
+      }
+      const merged = { ...existing, service: record.service, zone: record.zone };
+      writeAtomicJsonFile(sharedPath(record.name), merged);
+      return merged;
+    }
+    const fresh = {
+      schemaVersion: STATE_SCHEMA_VERSION,
+      ...record,
+      createdAt: new Date().toISOString()
+    };
+    if (path === undefined)
+      delete fresh.path;
+    else
+      fresh.path = path;
+    writeAtomicJsonFile(sharedPath(record.name), fresh);
+    return fresh;
+  });
+}
+async function updateSharedHostname(name, mutate) {
+  return withSharedLock(async () => {
+    const existing = readSharedHostname(name);
+    if (existing === null)
+      return null;
+    const next = mutate(structuredClone(existing));
+    if (next.queue !== undefined && next.queue.length === 0)
+      delete next.queue;
+    if (next.holder === undefined)
+      delete next.holder;
+    writeAtomicJsonFile(sharedPath(name), next);
+    return next;
+  });
+}
+var NAME_RE, LABEL_RE, PATH_SEGMENT_RE;
+var init_shared = __esm(() => {
+  init_src();
+  init_state();
+  init_lock();
+  init_atomic_json_file();
+  NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+  LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+  PATH_SEGMENT_RE = /^[A-Za-z0-9._~!$&'()*+,;=:@%-]+$/;
+});
+
 // packages/engine/src/router/local-http-router.ts
 import { execFile as execFile7 } from "child_process";
 import { Agent, createServer as createServer2, request as httpRequest } from "http";
 import { createConnection as createConnection2, createServer as createNetServer } from "net";
 import { promisify as promisify6 } from "util";
-import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4 } from "fs";
-import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "fs";
+import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync9 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { createHash as createHash5 } from "crypto";
+function pathnameOf(target) {
+  if (target === undefined || target.length === 0)
+    return "/";
+  const cut = target.search(/[?#]/);
+  const path = cut < 0 ? target : target.slice(0, cut);
+  return path.startsWith("/") ? path : "/";
+}
 function readRouterStackRecords() {
-  const stacksDir = join16(hestiaHome(), "stacks");
-  if (!existsSync13(stacksDir))
+  const stacksDir = join17(hestiaHome(), "stacks");
+  if (!existsSync14(stacksDir))
     return [];
   const records = [];
-  for (const project of readdirSync4(stacksDir).sort()) {
-    const path = join16(stacksDir, project, "stack.json");
+  for (const project of readdirSync5(stacksDir).sort()) {
+    const path = join17(stacksDir, project, "stack.json");
     try {
-      const source = readFileSync13(path);
+      const source = readFileSync14(path);
       if (source.byteLength > MAX_MIRROR_BYTES)
         continue;
       const record = parseStackRecord(source.toString("utf8"), path);
@@ -10325,11 +10531,11 @@ function internalEndpointAuthority(project, service) {
 function publicGatewaySocketPath() {
   const uid = process.getuid?.() ?? 501;
   const homeHash = createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12);
-  return join16(tmpdir2(), `hestia-${uid}`, homeHash, "origin.sock");
+  return join17(tmpdir2(), `hestia-${uid}`, homeHash, "origin.sock");
 }
 function prepareGatewaySocket(path) {
   const uid = process.getuid?.();
-  const directories = [join16(tmpdir2(), `hestia-${uid ?? 501}`), join16(tmpdir2(), `hestia-${uid ?? 501}`, createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12))];
+  const directories = [join17(tmpdir2(), `hestia-${uid ?? 501}`), join17(tmpdir2(), `hestia-${uid ?? 501}`, createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12))];
   for (const directory of directories) {
     mkdirSync7(directory, { recursive: true, mode: 448 });
     const stat2 = lstatSync(directory);
@@ -10338,13 +10544,13 @@ function prepareGatewaySocket(path) {
     }
     chmodSync5(directory, 448);
   }
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return;
   const stat = lstatSync(path);
   if (stat.isSymbolicLink() || !stat.isSocket() || uid !== undefined && stat.uid !== uid) {
     throw new Error(`refusing unsafe existing Hestia gateway socket ${path}`);
   }
-  rmSync8(path);
+  rmSync9(path);
 }
 function sendRouterResponse(response, status, message) {
   response.writeHead(status, { "content-type": "text/plain; charset=utf-8", "x-hestia-router": "1" });
@@ -10357,6 +10563,7 @@ class HestiaLocalHttpRouter {
   #frontServer = createNetServer((socket) => this.#acceptFrontSocket(socket));
   #unixServer = createNetServer((socket) => this.#acceptFrontSocket(socket));
   #targets = new Map;
+  #sharedRoutes = new Map;
   #timer;
   async start() {
     await new Promise((resolve2, reject) => {
@@ -10460,12 +10667,52 @@ class HestiaLocalHttpRouter {
         }
       }
     }
+    const sharedRoutes = new Map;
+    for (const shared of listSharedHostnames()) {
+      const hostname = shared.hostname.toLowerCase();
+      targets.delete(hostname);
+      const holder = shared.holder;
+      let target;
+      if (holder !== undefined) {
+        const stack = records.find((record) => record.project === holder.project);
+        const endpoint = stack?.endpoints.find((candidate2) => (candidate2.alias ?? candidate2.name) === holder.service);
+        const service = stack?.services.find((candidate2) => candidate2.name === (endpoint?.workload ?? endpoint?.name));
+        const binding = service?.bindings?.find((candidate2) => `${candidate2.target}/${candidate2.protocol}` === endpoint?.binding);
+        const publishedPort = binding?.publishedPort ?? service?.publishedPort;
+        const candidate = {
+          hostname,
+          project: holder.project,
+          service: service === undefined || service.backend === "tunnel" || publishedPort === undefined ? undefined : { ...service, publishedPort }
+        };
+        const previous = this.#sharedRoutes.get(hostname)?.find((entry) => entry.name === shared.name)?.target;
+        target = previous !== undefined && targetIdentity(previous) === targetIdentity(candidate) ? previous : candidate;
+      }
+      const list = sharedRoutes.get(hostname) ?? [];
+      list.push({ path: shared.path, name: shared.name, claimed: holder !== undefined, target });
+      sharedRoutes.set(hostname, list);
+    }
+    for (const list of sharedRoutes.values()) {
+      list.sort((left, right) => (right.path?.length ?? -1) - (left.path?.length ?? -1));
+    }
     reconcilePortlessAliases([...targets.keys()].filter((hostname) => hostname.endsWith(".localhost")), this.port);
-    for (const [hostname, target] of this.#targets) {
-      if (targets.get(hostname) !== target)
+    const retained = new Set(targets.values());
+    for (const list of sharedRoutes.values()) {
+      for (const entry of list)
+        if (entry.target !== undefined)
+          retained.add(entry.target);
+    }
+    const priorTargets = [...this.#targets.values()];
+    for (const list of this.#sharedRoutes.values()) {
+      for (const entry of list)
+        if (entry.target !== undefined)
+          priorTargets.push(entry.target);
+    }
+    for (const target of priorTargets) {
+      if (!retained.has(target))
         target.agent?.destroy();
     }
     this.#targets = targets;
+    this.#sharedRoutes = sharedRoutes;
   }
   stop() {
     if (this.#timer)
@@ -10479,7 +10726,7 @@ class HestiaLocalHttpRouter {
       target.agent?.destroy();
     this.#frontServer.close();
     this.#unixServer.close();
-    rmSync8(this.socketPath, { force: true });
+    rmSync9(this.socketPath, { force: true });
     this.#server.close();
   }
   #acceptFrontSocket(socket) {
@@ -10524,16 +10771,40 @@ Connection: close\r
 `));
     socket.once("error", () => internal.destroy());
   }
+  #matchTarget(hostname, requestPath) {
+    const routes = this.#sharedRoutes.get(hostname);
+    if (routes !== undefined) {
+      const entry = routes.find((candidate) => sharedPathMatches(candidate.path, requestPath));
+      if (entry === undefined)
+        return { status: 404, message: "Hestia route not found" };
+      if (!entry.claimed) {
+        return {
+          status: 503,
+          message: `Shared hostname unclaimed \u2014 run \`hestia claim ${entry.name}\` in the worktree that should receive this traffic`
+        };
+      }
+      if (entry.target?.service?.publishedPort === undefined) {
+        return { status: 503, message: "Hestia route origin unavailable" };
+      }
+      return { target: entry.target };
+    }
+    const target = this.#targets.get(hostname);
+    if (target === undefined)
+      return { status: 404, message: "Hestia route not found" };
+    if (target.service?.publishedPort === undefined) {
+      return { status: 503, message: "Hestia route origin unavailable" };
+    }
+    return { target };
+  }
   async#proxyHttp(request, response) {
     const hostname = parseRouteAuthority(request.headers.host);
     if (hostname === null)
       return sendRouterResponse(response, 400, "Malformed Host authority");
-    const target = this.#targets.get(hostname);
-    if (target === undefined)
-      return sendRouterResponse(response, 404, "Hestia route not found");
-    const port = target.service?.publishedPort;
-    if (port === undefined)
-      return sendRouterResponse(response, 503, "Hestia route origin unavailable");
+    const match = this.#matchTarget(hostname, pathnameOf(request.url));
+    if ("status" in match)
+      return sendRouterResponse(response, match.status, match.message);
+    const target = match.target;
+    const port = target.service.publishedPort;
     if (await verifyLocalRouterTarget(target) !== port) {
       return sendRouterResponse(response, 503, "Hestia route origin unavailable");
     }
@@ -10574,16 +10845,19 @@ Connection: close\r
 `);
       return;
     }
-    const target = this.#targets.get(host);
-    const port = target?.service?.publishedPort;
-    if (target === undefined || port === undefined) {
-      socket.end(`HTTP/1.1 ${target === undefined ? "404 Not Found" : "503 Service Unavailable"}\r
+    const rawHeaderLines = header.slice(0, -4).split(`\r
+`);
+    const requestPath = pathnameOf(rawHeaderLines[0]?.split(" ")[1]);
+    const match = this.#matchTarget(host, requestPath);
+    if ("status" in match) {
+      const reason = match.status === 404 ? "404 Not Found" : "503 Service Unavailable";
+      socket.end(`HTTP/1.1 ${reason}\r
 \r
 `);
       return;
     }
-    const rawHeaderLines = header.slice(0, -4).split(`\r
-`);
+    const target = match.target;
+    const port = target.service.publishedPort;
     const connectionValues = rawHeaderLines.slice(1).filter((line) => /^connection:/i.test(line)).map((line) => line.slice(line.indexOf(":") + 1));
     const connectionNames = connectionHeaderTokens(connectionValues);
     const retainedHeaders = rawHeaderLines.slice(1).filter((line) => {
@@ -10639,6 +10913,7 @@ var init_local_http_router = __esm(() => {
   init_state();
   init_router_config();
   init_portless_adapter();
+  init_shared();
   pexec6 = promisify6(execFile7);
   MAX_MIRROR_BYTES = 2 * 1024 * 1024;
   MAX_REQUEST_HEADER_BYTES = 64 * 1024;
@@ -10657,15 +10932,15 @@ var init_local_http_router = __esm(() => {
 });
 
 // packages/engine/src/wrangler/adapter.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14, statSync as statSync2 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync15, statSync as statSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join17, relative as relative3 } from "path";
+import { dirname as dirname5, join as join18, relative as relative3 } from "path";
 import { connect } from "net";
 function privateRegistryDir(worktreeRoot) {
-  return join17(worktreeRoot, ".hestia", "wrangler-registry");
+  return join18(worktreeRoot, ".hestia", "wrangler-registry");
 }
 function globalRegistryDir() {
-  return process.env.WRANGLER_REGISTRY_PATH ?? join17(homedir3(), ".wrangler", "config", "registry");
+  return process.env.WRANGLER_REGISTRY_PATH ?? join18(homedir3(), ".wrangler", "config", "registry");
 }
 function tcpConnectable(address, timeoutMs = 500) {
   const [host, portStr] = address.split(":");
@@ -10688,19 +10963,19 @@ function tcpConnectable(address, timeoutMs = 500) {
 }
 async function preflightForeignSessions(workers) {
   const dir = globalRegistryDir();
-  if (!existsSync14(dir))
+  if (!existsSync15(dir))
     return;
   for (const w of workers) {
     if (w.name === null)
       continue;
-    const entryPath = join17(dir, w.name);
-    if (!existsSync14(entryPath))
+    const entryPath = join18(dir, w.name);
+    if (!existsSync15(entryPath))
       continue;
     const freshMs = Date.now() - statSync2(entryPath).mtimeMs;
     let live = freshMs < HEARTBEAT_FRESH_MS;
     if (!live) {
       try {
-        const entry = JSON.parse(readFileSync14(entryPath, "utf8"));
+        const entry = JSON.parse(readFileSync15(entryPath, "utf8"));
         live = entry.debugPortAddress ? await tcpConnectable(entry.debugPortAddress) : false;
       } catch {
         live = false;
@@ -10723,8 +10998,8 @@ async function planWorkers(worktreeRoot, opts) {
   const wranglerBinFor = (configPath) => {
     let dir = dirname5(configPath);
     for (;; ) {
-      const candidate = join17(dir, "node_modules", ".bin", "wrangler");
-      if (existsSync14(candidate))
+      const candidate = join18(dir, "node_modules", ".bin", "wrangler");
+      if (existsSync15(candidate))
         return candidate;
       if (dir === worktreeRoot)
         return null;
@@ -10795,11 +11070,11 @@ var init_adapter = __esm(() => {
 });
 
 // packages/engine/src/wrangler/verify.ts
-import { existsSync as existsSync15, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6 } from "fs";
 function namesIn(dir) {
-  if (!existsSync15(dir))
+  if (!existsSync16(dir))
     return new Set;
-  return new Set(readdirSync5(dir));
+  return new Set(readdirSync6(dir));
 }
 function snapshotGlobalRegistry() {
   return namesIn(globalRegistryDir());
@@ -10828,14 +11103,14 @@ var init_verify = __esm(() => {
 // packages/engine/src/tunnel/cloudflared.ts
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify7 } from "util";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function cloudflaredHome() {
-  return process.env.HESTIA_CLOUDFLARED_HOME ?? join18(homedir4(), ".cloudflared");
+  return process.env.HESTIA_CLOUDFLARED_HOME ?? join19(homedir4(), ".cloudflared");
 }
 function credFilePath(uuid) {
-  return process.env.TUNNEL_CRED_FILE ?? join18(cloudflaredHome(), `${uuid}.json`);
+  return process.env.TUNNEL_CRED_FILE ?? join19(cloudflaredHome(), `${uuid}.json`);
 }
 async function run(args, timeoutMs = 30000) {
   try {
@@ -10869,7 +11144,7 @@ async function adoptTunnel(name) {
     throw new HestiaError("tunnel-not-found", `no tunnel named "${name}" on this account \u2014 create it once with ` + `\`cloudflared tunnel create ${name}\``);
   }
   const credFile = credFilePath(entry.id);
-  if (!existsSync16(credFile)) {
+  if (!existsSync17(credFile)) {
     throw new HestiaError("tunnel-auth-missing", `credentials for tunnel "${name}" not found at ${credFile} \u2014 ` + `run \`cloudflared tunnel create\` on this machine or copy the JSON`);
   }
   return { uuid: entry.id, credFile, connections: entry.connections.length };
@@ -10882,8 +11157,8 @@ var init_cloudflared = __esm(() => {
 
 // packages/engine/src/tunnel/ingress.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 function hostnameFor(tunnelName, branch, service, zone) {
   const label = `${slug(tunnelName)}-${slug(branch)}-${slug(service)}`;
   if (label.length <= LABEL_MAX)
@@ -10901,12 +11176,12 @@ function inferZone(baseRules) {
   return zones.size === 1 ? [...zones][0] : undefined;
 }
 function importBaseRules(uuid, name) {
-  const p = join19(cloudflaredHome(), "config.yml");
-  if (!existsSync17(p))
+  const p = join20(cloudflaredHome(), "config.yml");
+  if (!existsSync18(p))
     return [];
   let parsed;
   try {
-    parsed = $parse(readFileSync15(p, "utf8"));
+    parsed = $parse(readFileSync16(p, "utf8"));
   } catch {
     return [];
   }
@@ -10918,7 +11193,12 @@ function importBaseRules(uuid, name) {
   return parsed.ingress.filter((r) => r.hostname !== undefined || r.path !== undefined);
 }
 function generateMergedConfig(opts) {
-  assertDisjoint(opts.baseRules, opts.dynamicRules);
+  assertDisjoint(opts.baseRules, opts.dynamicRules, opts.sharedRules ?? []);
+  const sharedHostnames = [...new Set((opts.sharedRules ?? []).map((s) => s.hostname))];
+  const shared = sharedHostnames.map((hostname) => ({
+    hostname,
+    service: `unix:${publicGatewaySocketPath()}`
+  }));
   const dynamic = opts.dynamicRules.map((d) => ({
     hostname: d.hostname,
     service: `unix:${publicGatewaySocketPath()}`,
@@ -10929,17 +11209,30 @@ function generateMergedConfig(opts) {
     "credentials-file": opts.credFile,
     ingress: [
       ...opts.baseRules,
+      ...shared,
       ...dynamic,
       { service: "http_status:404" }
     ]
   });
 }
-function assertDisjoint(base, dynamic) {
+function assertDisjoint(base, dynamic, shared) {
   const seen = new Map;
   for (const r of base) {
     if (r.hostname !== undefined)
       seen.set(r.hostname, "the user's static rules");
   }
+  const sharedByHost = new Map;
+  for (const s of shared) {
+    if (!sharedByHost.has(s.hostname))
+      sharedByHost.set(s.hostname, s.name);
+  }
+  for (const [hostname, name] of sharedByHost) {
+    const holder = seen.get(hostname);
+    if (holder !== undefined) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} ("${name}") is already claimed by ${holder}`);
+    }
+    seen.set(hostname, `shared hostname "${name}"`);
+  }
   for (const d of dynamic) {
     const holder = seen.get(d.hostname);
     if (holder !== undefined) {
@@ -11000,31 +11293,31 @@ var POLL_MS4 = 300;
 
 // packages/engine/src/tunnel/registry.ts
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync16,
-  readdirSync as readdirSync6
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync7
 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function tunnelDir(uuid) {
-  return join20(hestiaHome(), "tunnel", uuid);
+  return join21(hestiaHome(), "tunnel", uuid);
 }
 function configPath(uuid) {
-  return join20(tunnelDir(uuid), "config.yml");
+  return join21(tunnelDir(uuid), "config.yml");
 }
 function adoptedMarker(uuid) {
-  return join20(tunnelDir(uuid), "adopted.json");
+  return join21(tunnelDir(uuid), "adopted.json");
 }
 function isAdopted(uuid) {
-  return existsSync18(adoptedMarker(uuid));
+  return existsSync19(adoptedMarker(uuid));
 }
 function readAdopted(uuid) {
   const p = adoptedMarker(uuid);
-  if (!existsSync18(p))
+  if (!existsSync19(p))
     return null;
   let marker;
   try {
-    marker = JSON.parse(readFileSync16(p, "utf8"));
+    marker = JSON.parse(readFileSync17(p, "utf8"));
   } catch {
     marker = {};
   }
@@ -11032,14 +11325,14 @@ function readAdopted(uuid) {
     return { uuid, name: marker.name, credFile: marker.credFile, reconstructed: false };
   }
   let name;
-  const stacksDir = join20(hestiaHome(), "stacks");
-  if (existsSync18(stacksDir)) {
-    for (const project of readdirSync6(stacksDir)) {
-      const sp = join20(stacksDir, project, "stack.json");
-      if (!existsSync18(sp))
+  const stacksDir = join21(hestiaHome(), "stacks");
+  if (existsSync19(stacksDir)) {
+    for (const project of readdirSync7(stacksDir)) {
+      const sp = join21(stacksDir, project, "stack.json");
+      if (!existsSync19(sp))
         continue;
       try {
-        const record = parseStackRecord(readFileSync16(sp, "utf8"), sp);
+        const record = parseStackRecord(readFileSync17(sp, "utf8"), sp);
         if (record.tunnel?.uuid === uuid) {
           name = record.tunnel.name;
           break;
@@ -11055,24 +11348,24 @@ function readAdopted(uuid) {
   };
 }
 function listAdopted() {
-  const root = join20(hestiaHome(), "tunnel");
-  if (!existsSync18(root))
+  const root = join21(hestiaHome(), "tunnel");
+  if (!existsSync19(root))
     return [];
-  return readdirSync6(root).filter((uuid) => isAdopted(uuid));
+  return readdirSync7(root).filter((uuid) => isAdopted(uuid));
 }
 function collectDynamicRules(uuid) {
-  const stacksDir = join20(hestiaHome(), "stacks");
+  const stacksDir = join21(hestiaHome(), "stacks");
   const rules = [];
   const dropped = [];
-  if (!existsSync18(stacksDir))
+  if (!existsSync19(stacksDir))
     return { rules, dropped };
-  for (const project of readdirSync6(stacksDir)) {
-    const p = join20(stacksDir, project, "stack.json");
-    if (!existsSync18(p))
+  for (const project of readdirSync7(stacksDir)) {
+    const p = join21(stacksDir, project, "stack.json");
+    if (!existsSync19(p))
       continue;
     let record;
     try {
-      record = parseStackRecord(readFileSync16(p, "utf8"), p);
+      record = parseStackRecord(readFileSync17(p, "utf8"), p);
     } catch {
       continue;
     }
@@ -11101,20 +11394,22 @@ async function reconcileTunnel(ref, opts) {
     for (const d of dropped) {
       warnings.push(`exposure ${d.hostname} dropped \u2014 service "${d.service}" of ` + `${d.project} is not running (hostname now 404s)`);
     }
+    const sharedRules = listSharedHostnames().filter((record) => record.tunnelUuid === ref.uuid).map((record) => ({ name: record.name, hostname: record.hostname }));
     const cfgPath = configPath(ref.uuid);
     const nextConfig = generateMergedConfig({
       uuid: ref.uuid,
       credFile: ref.credFile,
       baseRules,
-      dynamicRules: rules
+      dynamicRules: rules,
+      sharedRules
     });
     const pf = readPidfile(dir, CONNECTOR);
     const live = pf !== null && isLive(pf);
-    const currentConfig = existsSync18(cfgPath) ? readFileSync16(cfgPath, "utf8") : null;
+    const currentConfig = existsSync19(cfgPath) ? readFileSync17(cfgPath, "utf8") : null;
     if (live && currentConfig === nextConfig) {
       return { restarted: false, metricsPort: pf.port, ready: true, warnings };
     }
-    if (baseRules.length === 0 && rules.length === 0) {
+    if (baseRules.length === 0 && rules.length === 0 && sharedRules.length === 0) {
       if (pf !== null) {
         await stopProcTree(pf);
         removePidfile(dir, CONNECTOR);
@@ -11185,6 +11480,7 @@ var init_registry = __esm(() => {
   init_pidfile();
   init_shutdown();
   init_ingress();
+  init_shared();
   init_atomic_json_file();
 });
 
@@ -11623,10 +11919,230 @@ var init_stream = __esm(() => {
   init_tail();
 });
 
+// packages/engine/src/daemon/shared-arbiter.ts
+class SharedArbiter {
+  onChange;
+  #mutex = Promise.resolve();
+  #polls = new Map;
+  constructor(onChange) {
+    this.onChange = onChange;
+  }
+  #locked(fn) {
+    const next = this.#mutex.then(fn, fn);
+    this.#mutex = next.catch(() => {});
+    return next;
+  }
+  async#notify() {
+    try {
+      await this.onChange?.();
+    } catch {}
+  }
+  #result(record, granted) {
+    return { granted, holder: record.holder, queued: [...record.queue ?? []] };
+  }
+  #wake(name, project, result) {
+    const key = `${name}\x00${project}`;
+    for (const poll of this.#polls.get(key) ?? []) {
+      clearTimeout(poll.timer);
+      poll.resolve(result);
+    }
+    this.#polls.delete(key);
+  }
+  #grantNext(record) {
+    const queue = [...record.queue ?? []];
+    for (;; ) {
+      const head = queue.shift();
+      if (head === undefined) {
+        const next = { ...record, queue: [] };
+        delete next.holder;
+        return next;
+      }
+      if (readMirrorState(head.project) === null)
+        continue;
+      return {
+        ...record,
+        holder: {
+          project: head.project,
+          worktree: head.worktree,
+          service: record.service,
+          at: new Date().toISOString()
+        },
+        queue
+      };
+    }
+  }
+  async request(name, requester, waitMs) {
+    const outcome = await this.#locked(async () => {
+      let granted = false;
+      const updated = await updateSharedHostname(name, (record) => {
+        if (record.holder?.project === requester.project) {
+          granted = true;
+          return {
+            ...record,
+            holder: { ...record.holder, worktree: requester.worktree },
+            queue: (record.queue ?? []).filter((waiter) => waiter.project !== requester.project)
+          };
+        }
+        if (record.holder === undefined) {
+          granted = true;
+          return {
+            ...record,
+            holder: {
+              project: requester.project,
+              worktree: requester.worktree,
+              service: record.service,
+              at: new Date().toISOString()
+            },
+            queue: (record.queue ?? []).filter((waiter) => waiter.project !== requester.project)
+          };
+        }
+        const queue = [...record.queue ?? []];
+        const existing = queue.find((waiter) => waiter.project === requester.project);
+        if (existing !== undefined)
+          existing.worktree = requester.worktree;
+        else
+          queue.push({ project: requester.project, worktree: requester.worktree, at: new Date().toISOString() });
+        return { ...record, queue };
+      });
+      if (updated === null) {
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      }
+      return { granted, record: updated };
+    });
+    if (outcome.granted) {
+      await this.#notify();
+      return this.#result(outcome.record, true);
+    }
+    if (waitMs <= 0)
+      return this.#result(outcome.record, false);
+    return new Promise((resolve2) => {
+      const key = `${name}\x00${requester.project}`;
+      const polls = this.#polls.get(key) ?? [];
+      const poll = {
+        resolve: resolve2,
+        timer: setTimeout(() => {
+          const remaining = (this.#polls.get(key) ?? []).filter((candidate) => candidate !== poll);
+          if (remaining.length === 0)
+            this.#polls.delete(key);
+          else
+            this.#polls.set(key, remaining);
+          const record = readSharedHostname(name);
+          resolve2(record === null ? { granted: false, queued: [] } : this.#result(record, record.holder?.project === requester.project));
+        }, waitMs)
+      };
+      polls.push(poll);
+      this.#polls.set(key, polls);
+    });
+  }
+  async cancel(name, project) {
+    const record = await this.#locked(() => updateSharedHostname(name, (current) => ({
+      ...current,
+      queue: (current.queue ?? []).filter((waiter) => waiter.project !== project)
+    })));
+    if (record === null)
+      throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+    this.#wake(name, project, this.#result(record, false));
+    return this.#result(record, false);
+  }
+  #assertHolder(record, project, verb) {
+    if (record.holder?.project !== project) {
+      throw new HestiaError("shared-not-holder", record.holder === undefined ? `cannot ${verb} "${record.name}" \u2014 it is unclaimed` : `cannot ${verb} "${record.name}" \u2014 it is held by ${record.holder.project}, not ${project}`);
+    }
+  }
+  async allow(name, callerProject) {
+    const record = await this.#transfer(name, callerProject, "allow");
+    return this.#result(record, false);
+  }
+  async deny(name, callerProject) {
+    const record = await this.#locked(async () => {
+      const current = readSharedHostname(name);
+      if (current === null)
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      this.#assertHolder(current, callerProject, "deny");
+      const updated = await updateSharedHostname(name, (candidate) => {
+        const queue = [...candidate.queue ?? []];
+        if (queue.length > 0)
+          queue[0] = { ...queue[0], denied: true };
+        return { ...candidate, queue };
+      });
+      return updated;
+    });
+    return this.#result(record, false);
+  }
+  async release(name, callerProject) {
+    const record = await this.#transfer(name, callerProject, "release");
+    return this.#result(record, false);
+  }
+  async#transfer(name, callerProject, verb) {
+    const record = await this.#locked(async () => {
+      const current = readSharedHostname(name);
+      if (current === null)
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      this.#assertHolder(current, callerProject, verb);
+      return await updateSharedHostname(name, (candidate) => this.#grantNext(candidate));
+    });
+    if (record.holder !== undefined) {
+      this.#wake(record.name, record.holder.project, this.#result(record, true));
+    }
+    await this.#notify();
+    return record;
+  }
+  async releaseProject(project, service) {
+    const held = listSharedHostnames().filter((record) => record.holder?.project === project && (service === undefined || record.service === service));
+    let changed = false;
+    for (const record of held) {
+      const updated = await this.#locked(async () => {
+        const current = readSharedHostname(record.name);
+        if (current?.holder?.project !== project)
+          return null;
+        return await updateSharedHostname(record.name, (candidate) => this.#grantNext(candidate));
+      });
+      if (updated === null || updated === undefined)
+        continue;
+      changed = true;
+      if (updated.holder !== undefined) {
+        this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
+      }
+    }
+    if (changed)
+      await this.#notify();
+  }
+  async sweep(occupied) {
+    let changed = false;
+    for (const record of listSharedHostnames()) {
+      const holderDead = record.holder !== undefined && !occupied.has(record.holder.project) && readMirrorState(record.holder.project) === null;
+      const deadWaiters = (record.queue ?? []).filter((waiter) => readMirrorState(waiter.project) === null);
+      if (!holderDead && deadWaiters.length === 0)
+        continue;
+      const updated = await this.#locked(() => updateSharedHostname(record.name, (candidate) => {
+        const pruned = {
+          ...candidate,
+          queue: (candidate.queue ?? []).filter((waiter) => readMirrorState(waiter.project) !== null)
+        };
+        const currentHolderDead = pruned.holder !== undefined && !occupied.has(pruned.holder.project) && readMirrorState(pruned.holder.project) === null;
+        return currentHolderDead ? this.#grantNext(pruned) : pruned;
+      }));
+      if (updated === null)
+        continue;
+      changed = true;
+      if (updated.holder !== undefined && updated.holder.project !== record.holder?.project) {
+        this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
+      }
+    }
+    if (changed)
+      await this.#notify();
+  }
+}
+var init_shared_arbiter = __esm(() => {
+  init_src();
+  init_state();
+  init_shared();
+});
+
 // packages/engine/src/doctor.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
 import { execFile as execFile9 } from "child_process";
-import { dirname as dirname6, join as join21 } from "path";
+import { dirname as dirname6, join as join22 } from "path";
 function row(check, level, detail) {
   return { check, level, detail };
 }
@@ -11667,8 +12183,8 @@ async function envChecks(ctx) {
   }
   if (ctx !== null) {
     const ignored = await exec("git", ["-C", ctx.worktreeRoot, "check-ignore", "-q", ".hestia/"]);
-    rows.push(ignored.ok ? row("state-ignore", "ok", ".hestia/ is ignored") : row("state-ignore", "error", `add the exact line ".hestia/" to ${join21(ctx.worktreeRoot, ".gitignore")}`));
-    const schema = existsSync19(join21(ctx.worktreeRoot, ".env.schema"));
+    rows.push(ignored.ok ? row("state-ignore", "ok", ".hestia/ is ignored") : row("state-ignore", "error", `add the exact line ".hestia/" to ${join22(ctx.worktreeRoot, ".gitignore")}`));
+    const schema = existsSync20(join22(ctx.worktreeRoot, ".env.schema"));
     if (schema) {
       rows.push(detectVarlock(ctx.worktreeRoot) !== null ? row("varlock", "ok", "local varlock found \u2014 worker env composition active") : row("varlock", "warn", ".env.schema present but no local varlock (bun install?)"));
     }
@@ -11677,7 +12193,7 @@ async function envChecks(ctx) {
       const missing = workers.filter((w) => {
         let dir = dirname6(w.configPath);
         for (;; ) {
-          if (existsSync19(join21(dir, "node_modules", ".bin", "wrangler")))
+          if (existsSync20(join22(dir, "node_modules", ".bin", "wrangler")))
             return false;
           if (dir === ctx.worktreeRoot || dirname6(dir) === dir)
             return true;
@@ -11736,10 +12252,10 @@ async function stateChecks(ctx) {
       rows.push(row(`exposure:${exp.service}`, "error", `ingress rule points at port ${exp.originPort} but the service owns ` + `${publishedPort} \u2014 a recycled port serves ANOTHER worktree; ` + `run any hestia command to resync, this should not persist`));
     }
   }
-  const lockPath2 = join21(hestiaDir(worktreeRoot), "lock");
-  if (existsSync19(lockPath2)) {
+  const lockPath2 = join22(hestiaDir(worktreeRoot), "lock");
+  if (existsSync20(lockPath2)) {
     try {
-      const holder = JSON.parse(readFileSync17(lockPath2, "utf8"));
+      const holder = JSON.parse(readFileSync18(lockPath2, "utf8"));
       if (!isLive(holder)) {
         rows.push(row("lock", "warn", "stale worktree lock (dead holder) \u2014 auto-broken on next command"));
       }
@@ -11747,25 +12263,25 @@ async function stateChecks(ctx) {
       rows.push(row("lock", "warn", "unreadable worktree lock file"));
     }
   }
-  const mirror = join21(hestiaHome(), "stacks", record.project, "stack.json");
-  if (!existsSync19(mirror)) {
+  const mirror = join22(hestiaHome(), "stacks", record.project, "stack.json");
+  if (!existsSync20(mirror)) {
     rows.push(row("mirror", "warn", "no ~/.hestia mirror \u2014 `down --project` would not work after worktree deletion"));
   }
   return rows;
 }
 async function machineChecks() {
   const rows = [];
-  const stacksDir = join21(hestiaHome(), "stacks");
+  const stacksDir = join22(hestiaHome(), "stacks");
   const mirrored = new Set;
-  if (existsSync19(stacksDir)) {
-    for (const project of readdirSync7(stacksDir)) {
-      const p = join21(stacksDir, project, "stack.json");
-      if (!existsSync19(p))
+  if (existsSync20(stacksDir)) {
+    for (const project of readdirSync8(stacksDir)) {
+      const p = join22(stacksDir, project, "stack.json");
+      if (!existsSync20(p))
         continue;
       mirrored.add(project);
       try {
-        const rec = parseStackRecord(readFileSync17(p, "utf8"), p);
-        if (!existsSync19(rec.worktree)) {
+        const rec = parseStackRecord(readFileSync18(p, "utf8"), p);
+        if (!existsSync20(rec.worktree)) {
           rows.push(row(`orphan-mirror:${project}`, "warn", `worktree ${rec.worktree} is gone \u2014 \`hestia down --project ${project}\` to clean up`));
         }
       } catch {
@@ -11823,6 +12339,27 @@ async function tunnelChecks() {
   }
   return rows;
 }
+async function sharedHostnameChecks() {
+  const rows = [];
+  for (const shared of listSharedHostnames()) {
+    const label = `shared:${shared.name}`;
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    const pending = (shared.queue ?? []).length;
+    const queueSuffix = pending > 0 ? ` (${pending} queued)` : "";
+    if (shared.holder === undefined) {
+      rows.push(row(label, "warn", `${url} unclaimed \u2014 requests answer 503 until \`hestia claim ${shared.name}\`${queueSuffix}`));
+      continue;
+    }
+    const mirror = readMirrorState(shared.holder.project);
+    if (mirror === null) {
+      rows.push(row(label, "warn", `held by ${shared.holder.project} but its stack mirror is gone \u2014 the daemon sweep auto-releases it${queueSuffix}`));
+      continue;
+    }
+    const endpoint = mirror.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+    rows.push(endpoint === undefined ? row(label, "warn", `held by ${shared.holder.project} but endpoint "${shared.service}" is not running \u2014 requests answer 503${queueSuffix}`) : row(label, "ok", `${url} \u2192 ${shared.holder.project}${queueSuffix}`));
+  }
+  return rows;
+}
 async function daemonChecks() {
   const rows = [];
   const j = readDaemonJson();
@@ -11837,11 +12374,11 @@ async function daemonChecks() {
       rows.push(row("daemon-config", "warn", w));
   }
   const plist = plistPath();
-  if (existsSync19(plist)) {
-    const content = readFileSync17(plist, "utf8");
+  if (existsSync20(plist)) {
+    const content = readFileSync18(plist, "utf8");
     const args = [...content.matchAll(/<string>([^<]+)<\/string>/g)].map((m) => m[1]);
     const paths = args.filter((a) => a.startsWith("/") && !a.includes(":"));
-    const missing = paths.filter((p) => !existsSync19(p));
+    const missing = paths.filter((p) => !existsSync20(p));
     rows.push(missing.length === 0 ? row("launchd", "ok", `installed (${plist})`) : row("launchd", "error", `plist references missing paths: ${missing.join(", ")} \u2014 re-run \`hestia daemon install\``));
   }
   return rows;
@@ -11880,6 +12417,7 @@ async function doctor(cwd) {
     ctx !== null ? bounded("state", () => stateChecks(ctx)) : Promise.resolve([]),
     bounded("machine", () => machineChecks()),
     bounded("tunnel", () => tunnelChecks()),
+    bounded("shared", () => sharedHostnameChecks()),
     bounded("daemon", () => daemonChecks()),
     bounded("local-router", () => localRouterChecks())
   ]);
@@ -11891,6 +12429,7 @@ var init_doctor = __esm(() => {
   init_git();
   init_config();
   init_state();
+  init_shared();
   init_pidfile();
   init_resolver();
   init_discover();
@@ -11907,8 +12446,8 @@ var init_doctor = __esm(() => {
 // packages/engine/src/daemon/fleet-monitor.ts
 import { execFile as execFile10 } from "child_process";
 import { promisify as promisify8 } from "util";
-import { existsSync as existsSync20, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync19, readdirSync as readdirSync9 } from "fs";
+import { join as join23 } from "path";
 
 class LatestFleetChannel {
   #pending;
@@ -11951,13 +12490,13 @@ class LatestFleetChannel {
 function readManagedMirrors() {
   const records = [];
   const warnings = [];
-  const stacksDirectory = join22(hestiaHome(), "stacks");
-  if (!existsSync20(stacksDirectory))
+  const stacksDirectory = join23(hestiaHome(), "stacks");
+  if (!existsSync21(stacksDirectory))
     return { records, warnings };
-  for (const project of readdirSync8(stacksDirectory).sort()) {
-    const path = join22(stacksDirectory, project, "stack.json");
+  for (const project of readdirSync9(stacksDirectory).sort()) {
+    const path = join23(stacksDirectory, project, "stack.json");
     try {
-      const source = readFileSync18(path);
+      const source = readFileSync19(path);
       if (source.byteLength > MAX_MIRROR_BYTES2) {
         warnings.push(`Fleet mirror too large for ${project}`);
         continue;
@@ -11977,7 +12516,7 @@ function readManagedMirrors() {
 async function attributeLegacyRepoId(record) {
   if (record.repoId !== undefined)
     return record.repoId;
-  if (!existsSync20(record.worktree))
+  if (!existsSync21(record.worktree))
     return null;
   const info = await getRepoInfo(record.worktree);
   if (projectName(info.repoId, info.repo, info.branch, info.worktreeRoot) !== record.project)
@@ -12083,6 +12622,25 @@ function reservationIdentity(reservation, records) {
     worktree: record.worktree
   };
 }
+function collectFleetShared(repoProjects) {
+  return listSharedHostnames().map((record) => ({
+    name: record.name,
+    hostname: record.hostname,
+    ...record.path === undefined ? {} : { path: record.path },
+    url: `https://${record.hostname}${record.path ?? ""}`,
+    holder: record.holder === undefined ? undefined : {
+      project: record.holder.project,
+      worktree: record.holder.worktree,
+      mine: repoProjects.has(record.holder.project)
+    },
+    queue: (record.queue ?? []).map((waiter) => ({
+      project: waiter.project,
+      worktree: waiter.worktree,
+      ...waiter.denied === true ? { denied: true } : {},
+      mine: repoProjects.has(waiter.project)
+    }))
+  })).sort((left, right) => left.name.localeCompare(right.name));
+}
 async function collectFleetSnapshot(repoId, admission) {
   const mirrorResult = readManagedMirrors();
   const machineConfig = readHestiaMachineConfig();
@@ -12178,6 +12736,7 @@ async function collectFleetSnapshot(repoId, admission) {
   const allRecordedProjects = new Set(attributed.map((record) => record.project));
   const unbackedReservations = reservations.filter((reservation) => !allRecordedProjects.has(reservation.project));
   const { maxStacks, warnings: capWarnings } = resolveMaxStacks();
+  const repoProjects = new Set(attributed.filter((record) => record.repoId === repoId).map((record) => record.project));
   return {
     repoId,
     observedAt: new Date().toISOString(),
@@ -12188,6 +12747,7 @@ async function collectFleetSnapshot(repoId, admission) {
       queued: queued.length
     },
     stacks: stackViews,
+    shared: collectFleetShared(repoProjects),
     warnings: [...capWarnings, ...warnings].sort()
   };
 }
@@ -12196,6 +12756,7 @@ function semanticFleetSnapshot(snapshot) {
     repoId: snapshot.repoId,
     capacity: snapshot.capacity,
     stacks: snapshot.stacks,
+    shared: snapshot.shared,
     warnings: snapshot.warnings
   });
 }
@@ -12307,6 +12868,7 @@ var init_fleet_monitor = __esm(() => {
   init_ports();
   init_pidfile();
   init_state();
+  init_shared();
   init_router_config();
   init_local_http_router();
   init_portless_adapter();
@@ -12417,10 +12979,10 @@ var init_init_config = __esm(() => {
 });
 
 // packages/engine/src/index.ts
-import { existsSync as existsSync21, rmSync as rmSync9 } from "fs";
+import { existsSync as existsSync22, rmSync as rmSync10 } from "fs";
 import { execFile as execFile11 } from "child_process";
 import { promisify as promisify9 } from "util";
-import { join as join23, resolve as resolve2 } from "path";
+import { join as join24, resolve as resolve2 } from "path";
 import { createHash as createHash7 } from "crypto";
 import { resolve4, resolve6, resolveCname } from "dns/promises";
 function composeUnsupported(message) {
@@ -12530,7 +13092,7 @@ async function assertHestiaStateIgnored(worktreeRoot) {
   try {
     await pexec9("git", ["-C", worktreeRoot, "check-ignore", "-q", ".hestia/"], { timeout: 5000 });
   } catch {
-    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join23(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join23(worktreeRoot, ".gitignore") });
+    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join24(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join24(worktreeRoot, ".gitignore") });
   }
 }
 async function prepareCompose(worktreeRoot, project, repo, branch, opts, configuredBaseFile) {
@@ -12547,7 +13109,7 @@ async function prepareCompose(worktreeRoot, project, repo, branch, opts, configu
     services
   });
   ensureDir(hestiaDir(worktreeRoot));
-  const overridePath = join23(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+  const overridePath = join24(hestiaDir(worktreeRoot), OVERRIDE_FILE);
   writeAtomicTextFile(overridePath, yaml);
   return {
     ctx: {
@@ -12580,7 +13142,7 @@ function writeDockerfileComposeModel(worktreeRoot, workloads, conventionalCompos
     ...conventionalComposeFile === undefined ? {} : { include: [{ path: conventionalComposeFile }] },
     services
   };
-  const path = join23(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
+  const path = join24(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
   writeAtomicTextFile(path, $stringify(model));
   return path;
 }
@@ -12600,7 +13162,7 @@ function freshRecord(project, repoId, repo, branch, worktree) {
   };
 }
 function assertCurrentStackIdentity(record, current) {
-  const path = join23(hestiaDir(current.worktreeRoot), "stack.json");
+  const path = join24(hestiaDir(current.worktreeRoot), "stack.json");
   assertMutableStackRecord(record, path);
   const matches = record.repoId === current.repoId && record.repo === current.repo && record.branch === current.branch && resolve2(record.worktree) === resolve2(current.worktreeRoot) && record.project === projectName(current.repoId, current.repo, current.branch, current.worktreeRoot);
   if (!matches) {
@@ -12735,6 +13297,27 @@ function applyLocalRouteProjection(record) {
     record.env[directUrlKey(endpoint.name)] = endpoint.url;
     record.env[localUrlKey(endpoint.name)] = endpoint.localUrl;
   }
+  syncSharedProjection(record);
+}
+function syncSharedProjection(record) {
+  for (const shared of listSharedHostnames()) {
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    if (shared.holder?.project === record.project) {
+      const endpoint = record.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+      if (endpoint !== undefined) {
+        endpoint.publicUrl = url;
+        record.env[urlKey(shared.service)] = url;
+      }
+      continue;
+    }
+    for (const endpoint of record.endpoints) {
+      if (endpoint.publicUrl === url)
+        delete endpoint.publicUrl;
+    }
+    if (record.env[urlKey(shared.service)] === url) {
+      delete record.env[urlKey(shared.service)];
+    }
+  }
 }
 function syncExposures(record) {
   const t = record.tunnel;
@@ -12758,7 +13341,7 @@ function matchesExpectedStack(record, expected) {
   return record !== null && (record.repoId === undefined || record.repoId === expected.repoId) && record.worktree === expected.worktree && record.createdAt === expected.createdAt;
 }
 function projectMutationRoot(project) {
-  return join23(hestiaHome(), "project-locks", project);
+  return join24(hestiaHome(), "project-locks", project);
 }
 async function assertNamedTunnelDns(hostname, tunnelUuid) {
   const expected = `${tunnelUuid}.cfargotunnel.com`;
@@ -13164,6 +13747,7 @@ class ComposeEngine {
     const { repo, repoId, branch, worktreeRoot } = currentIdentity;
     let tunnel;
     let tunnelDirty = false;
+    const stoppedAliases = [];
     const project = readState(worktreeRoot)?.project ?? projectName(repoId, repo, branch, worktreeRoot);
     await withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
       const record = readState(worktreeRoot);
@@ -13172,6 +13756,11 @@ class ComposeEngine {
         if (record.services.some((service) => service.name === name && service.backend === "docker")) {
           throw new HestiaError("backend-not-stoppable", `Docker workload ${name} cannot be stopped individually; use hestia down`);
         }
+        for (const endpoint of record.endpoints) {
+          if ((endpoint.workload ?? endpoint.name) === name) {
+            stoppedAliases.push(endpoint.alias ?? endpoint.name);
+          }
+        }
       }
       const pf = readPidfile(worktreeRoot, name);
       if (pf !== null) {
@@ -13217,6 +13806,9 @@ class ComposeEngine {
         }
       }
     }));
+    for (const alias of new Set(stoppedAliases)) {
+      await this.#releaseSharedHoldings(project, alias);
+    }
     if (tunnelDirty)
       await this.#reconcileAdopted(tunnel);
     await this.#refreshLocalRoutes();
@@ -13352,12 +13944,12 @@ class ComposeEngine {
         await stopProcTree(pf);
         removePidfile(worktreeRoot, pf.name);
       }
-      rmSync9(privateRegistryDir(worktreeRoot), { recursive: true, force: true });
+      rmSync10(privateRegistryDir(worktreeRoot), { recursive: true, force: true });
       const composeFile = record?.composeFile ?? tryLoadConfig(worktreeRoot)?.composeFile;
       if (composeFile !== undefined) {
         const project2 = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
-        const overrideFile = record?.overrideFile ?? join23(hestiaDir(worktreeRoot), OVERRIDE_FILE);
-        if (existsSync21(overrideFile)) {
+        const overrideFile = record?.overrideFile ?? join24(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+        if (existsSync22(overrideFile)) {
           await composeDown({ project: project2, baseFile: composeFile, overrideFile, cwd: worktreeRoot }, opts?.destroy ?? false);
         } else if (record?.composeFile !== undefined) {
           const rest = ["compose", "-p", project2, "down", "--remove-orphans"];
@@ -13369,6 +13961,7 @@ class ComposeEngine {
       const project = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
       clearState(worktreeRoot, project);
       await this.#releaseAdmission(project);
+      await this.#releaseSharedHoldings(project);
     }));
     await this.#reconcileAdopted(tunnel);
     await this.#refreshLocalRoutes();
@@ -13378,6 +13971,11 @@ class ComposeEngine {
     if (j !== null)
       await releaseSlot(j.port, project);
   }
+  async#releaseSharedHoldings(project, service) {
+    const j = readDaemonJson();
+    if (j !== null)
+      await releaseSharedForProject(j.port, project, service);
+  }
   async downProject(project, opts) {
     if (!/^[a-z0-9][a-z0-9-]{0,99}$/.test(project)) {
       throw new HestiaError("usage", `invalid project name ${JSON.stringify(project)}`);
@@ -13420,9 +14018,9 @@ class ComposeEngine {
           throw new HestiaError("compose-failed", `docker compose -p ${project} down failed: ${err.message}`);
         }
       }
-      rmSync9(mirrorDir(project), { recursive: true, force: true });
+      rmSync10(mirrorDir(project), { recursive: true, force: true });
     };
-    if (record !== null && existsSync21(record.worktree)) {
+    if (record !== null && existsSync22(record.worktree)) {
       const info = await getRepoInfo(record.worktree);
       const identityMatches = resolve2(info.worktreeRoot) === resolve2(record.worktree) && (record.repoId === undefined ? record.repo === info.repo : record.repoId === info.repoId);
       const localRecord = readState(record.worktree);
@@ -13443,6 +14041,7 @@ class ComposeEngine {
           return;
         }
         await this.#releaseAdmission(project);
+        await this.#releaseSharedHoldings(project);
         await this.#reconcileAdopted(record.tunnel);
         await this.#refreshLocalRoutes();
         return;
@@ -13451,6 +14050,7 @@ class ComposeEngine {
     const projectLockRoot = projectMutationRoot(project);
     await withLock(projectLockRoot, teardownFromMirror);
     await this.#releaseAdmission(project);
+    await this.#releaseSharedHoldings(project);
     await this.#reconcileAdopted(record?.tunnel);
     await this.#refreshLocalRoutes();
   }
@@ -13469,11 +14069,100 @@ class ComposeEngine {
     }
     await ensureDaemon();
     await this.#refreshLocalRoutes(true);
+    if (opts?.shared !== undefined) {
+      if (tunnelName === undefined) {
+        throw new HestiaError("shared-requires-named-tunnel", "shared hostnames need an adopted named tunnel (stable DNS is the point) \u2014 pass --tunnel <name>");
+      }
+      return this.#exposeShared(worktreeRoot, services, tunnelName, opts);
+    }
     if (tunnelName === undefined) {
       return this.#exposeQuick(worktreeRoot, services, opts);
     }
     return this.#exposeNamed(worktreeRoot, services, tunnelName, opts);
   }
+  async#exposeShared(worktreeRoot, services, tunnelName, opts) {
+    if (services.length !== 1) {
+      throw new HestiaError("usage", "--shared declares exactly one service per shared hostname");
+    }
+    const name = opts.shared;
+    assertSharedName(name);
+    const project = readState(worktreeRoot)?.project;
+    if (project === undefined) {
+      throw new HestiaError("service-not-found", "no stack in this worktree \u2014 `hestia up`/`run` something first");
+    }
+    const adopted = await adoptTunnel(tunnelName);
+    if (adopted.connections > 0 && !isAdopted(adopted.uuid) && !opts?.force) {
+      throw new HestiaError("tunnel-busy", `tunnel "${tunnelName}" already has ${adopted.connections} live edge ` + `connection(s) from a foreign connector \u2014 stop the other cloudflared first (hestia's ` + `connector serves your static hostnames too), or pass --force to ` + `accept nondeterministic routing`);
+    }
+    const preflightRecord = readState(worktreeRoot);
+    if (preflightRecord === null) {
+      throw new HestiaError("service-not-found", "stack disappeared while preparing the shared hostname");
+    }
+    const baseRules = importBaseRules(adopted.uuid, tunnelName);
+    const zoneHint = opts?.zone ?? preflightRecord.tunnel?.zone ?? inferZone(baseRules);
+    let hostname;
+    let zone;
+    if (opts?.hostname !== undefined) {
+      hostname = opts.hostname.toLowerCase();
+      assertSharedHostnameFqdn(hostname);
+      zone = zoneOf(hostname) ?? zoneHint ?? hostname;
+    } else {
+      if (zoneHint === undefined) {
+        throw new HestiaError("usage", "cannot infer a zone from the tunnel's existing rules \u2014 pass --zone or an explicit --hostname");
+      }
+      zone = zoneHint;
+      hostname = `${name}.${zone}`;
+    }
+    const path = normalizeSharedPath(opts?.path);
+    const selection = resolveEndpointSelection(preflightRecord, services[0]);
+    if (selection.endpoint.kind !== undefined && selection.endpoint.kind !== "http") {
+      throw new HestiaError("usage", `public tunnels require an HTTP endpoint; ${services[0]} is ${selection.endpoint.kind}`);
+    }
+    const alias = selection.endpoint.alias ?? selection.endpoint.name;
+    if (baseRules.some((rule) => rule.hostname === hostname)) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} is already claimed by the user's static rules`);
+    }
+    const dynamicConflict = collectDynamicRules(adopted.uuid).rules.find((rule) => rule.hostname === hostname);
+    if (dynamicConflict !== undefined) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} is already claimed by project ${dynamicConflict.project}`);
+    }
+    await assertNamedTunnelDns(hostname, adopted.uuid);
+    await declareSharedHostname({
+      name,
+      hostname,
+      path,
+      tunnelUuid: adopted.uuid,
+      zone,
+      service: alias
+    });
+    const handle = await ensureDaemon();
+    const claim = await sharedVerb(handle.port, "claim", {
+      name,
+      project,
+      worktree: worktreeRoot,
+      waitMs: 0
+    });
+    if (!claim.granted) {
+      throw new HestiaError("shared-held", `shared hostname "${name}" is held by ${claim.holder?.project ?? "another stack"} ` + `(${claim.queued.length} queued) \u2014 \`hestia claim ${name} --wait\` to queue for it`);
+    }
+    const outcome = await reconcileTunnel({ name: tunnelName, uuid: adopted.uuid, credFile: adopted.credFile }, { force: opts?.force, readyTimeoutMs: opts?.readyTimeoutMs });
+    for (const w of outcome.warnings)
+      process.stderr.write(`warning: ${w}
+`);
+    const final = await withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
+      const record = readState(worktreeRoot);
+      if (record === null) {
+        throw new HestiaError("service-not-found", "stack disappeared while exposing (concurrent down?)");
+      }
+      applyLocalRouteProjection(record);
+      writeState(worktreeRoot, record);
+      return record;
+    }));
+    if (outcome.error !== undefined)
+      throw outcome.error;
+    await this.#refreshLocalRoutes(true);
+    return final;
+  }
   async#exposeQuick(worktreeRoot, services, opts) {
     const project = readState(worktreeRoot)?.project;
     if (project === undefined) {
@@ -13492,7 +14181,7 @@ class ComposeEngine {
         const alias = selection.endpoint.alias ?? selection.endpoint.name;
         const authority = internalEndpointAuthority(record.project, alias);
         const name = `aux-quick-${createHash7("sha256").update(alias).digest("hex").slice(0, 10)}`;
-        const quickCfg = join23(hestiaDir(worktreeRoot), `quick-${name}.yml`);
+        const quickCfg = join24(hestiaDir(worktreeRoot), `quick-${name}.yml`);
         writeAtomicTextFile(quickCfg, `ingress:
   - service: ${JSON.stringify(`unix:${publicGatewaySocketPath()}`)}
 ` + `    originRequest:
@@ -13684,6 +14373,80 @@ class ComposeEngine {
     await this.#refreshLocalRoutes(true);
     return final;
   }
+  async#sharedContext(cwd, name) {
+    assertSharedName(name);
+    const { worktreeRoot } = await getRepoInfo(cwd);
+    const record = readState(worktreeRoot);
+    if (record === null) {
+      throw new HestiaError("service-not-found", "no stack in this worktree \u2014 `hestia up`/`run` something first");
+    }
+    const shared = readSharedHostname(name);
+    if (shared === null) {
+      throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared \u2014 \`hestia expose <svc> --shared ${name}\` creates one`);
+    }
+    return { worktreeRoot, record, shared };
+  }
+  async#applySharedProjection(worktreeRoot, project) {
+    return withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
+      const record = readState(worktreeRoot);
+      if (record === null) {
+        throw new HestiaError("service-not-found", "stack disappeared during the shared-hostname transition");
+      }
+      applyLocalRouteProjection(record);
+      writeState(worktreeRoot, record);
+      return record;
+    }));
+  }
+  async claimShared(cwd, name, opts) {
+    const { worktreeRoot, record, shared } = await this.#sharedContext(cwd, name);
+    const endpoint = record.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+    if (endpoint === undefined) {
+      throw new HestiaError("service-not-found", `shared hostname "${name}" routes to endpoint alias "${shared.service}", which this ` + `stack does not expose \u2014 \`hestia up\`/\`run\` it first`);
+    }
+    if (endpoint.kind !== undefined && endpoint.kind !== "http") {
+      throw new HestiaError("usage", `shared hostnames require an HTTP endpoint; ${shared.service} is ${endpoint.kind}`);
+    }
+    const handle = await ensureDaemon();
+    const result = await sharedVerb(handle.port, "claim", {
+      name,
+      project: record.project,
+      worktree: worktreeRoot,
+      waitMs: opts?.waitMs ?? 0
+    });
+    if (!result.granted) {
+      const position = result.queued.findIndex((waiter) => waiter.project === record.project) + 1;
+      throw new HestiaError("shared-held", `shared hostname "${name}" is held by ${result.holder?.project ?? "another stack"}` + (position > 0 ? ` \u2014 queued durably at position ${position}/${result.queued.length}; the holder can ` + `\`hestia share allow ${name}\`, or re-run \`hestia claim ${name} --wait\` to keep waiting` : ""), { holder: result.holder, queued: result.queued });
+    }
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return { record: updated, result };
+  }
+  async releaseShared(cwd, name) {
+    const { worktreeRoot, record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "release", { name, project: record.project });
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return updated;
+  }
+  async cancelSharedClaim(cwd, name) {
+    const { record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "cancel", { name, project: record.project });
+  }
+  async allowShared(cwd, name) {
+    const { worktreeRoot, record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "allow", { name, project: record.project });
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return updated;
+  }
+  async denyShared(cwd, name) {
+    const { record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "deny", { name, project: record.project });
+  }
   async status(cwd) {
     const { worktreeRoot } = await getRepoInfo(cwd);
     const record = readState(worktreeRoot);
@@ -13810,11 +14573,14 @@ var init_src2 = __esm(() => {
   init_cloudflared();
   init_ingress();
   init_registry();
+  init_shared();
   init_ensure();
   init_client();
   init_stream();
   init_router_config();
   init_cli();
+  init_shared();
+  init_shared_arbiter();
   init_lock();
   init_supervisor();
   init_tail();
@@ -14003,6 +14769,18 @@ class DaemonFleetSource {
   diagnose(worktree) {
     return doctor(worktree);
   }
+  async claimShared(worktree, name) {
+    await engine.claimShared(worktree, name);
+  }
+  async allowShared(worktree, name) {
+    await engine.allowShared(worktree, name);
+  }
+  async denyShared(worktree, name) {
+    await engine.denyShared(worktree, name);
+  }
+  async releaseShared(worktree, name) {
+    await engine.releaseShared(worktree, name);
+  }
   down(stack) {
     if (stack.createdAt === undefined) {
       return Promise.reject(new Error(`stack ${stack.project} has no stable incarnation timestamp`));
@@ -14036,6 +14814,8 @@ function createFleetUiState() {
     unseenLines: 0,
     helpOpen: false,
     doctorOpen: false,
+    sharedOpen: false,
+    sharedSelection: 0,
     downPending: false
   };
 }
@@ -14195,6 +14975,14 @@ function reduceFleetUiState(state, action) {
       return { ...state, helpOpen: action.open };
     case "doctor":
       return { ...state, doctorOpen: action.open };
+    case "shared":
+      return { ...state, sharedOpen: action.open, sharedSelection: action.open ? 0 : state.sharedSelection };
+    case "move-shared": {
+      if (action.count <= 0)
+        return { ...state, sharedSelection: 0 };
+      const next = Math.max(0, Math.min(action.count - 1, state.sharedSelection + action.delta));
+      return { ...state, sharedSelection: next };
+    }
     case "confirm-down":
       return {
         ...state,
@@ -14734,7 +15522,7 @@ var init_FleetModal = __esm(() => {
 
 // packages/tui/src/FleetApp.tsx
 import { useEffect, useMemo, useReducer, useRef, useState } from "react";
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import { useKeyboard, useRenderer, useTerminalDimensions } from "@opentui/react";
 import { jsxDEV as jsxDEV5, Fragment as Fragment2 } from "@opentui/react/jsx-dev-runtime";
 function middleTruncateWorktreePath(path, width) {
@@ -14752,7 +15540,7 @@ function middleTruncateWorktreePath(path, width) {
   return `${path.slice(0, prefixWidth)}\u2026/${basename3}`;
 }
 function emptySnapshot(repoId) {
-  return { repoId, observedAt: new Date(0).toISOString(), capacity: EMPTY_CAPACITY, stacks: [], warnings: [] };
+  return { repoId, observedAt: new Date(0).toISOString(), capacity: EMPTY_CAPACITY, stacks: [], shared: [], warnings: [] };
 }
 function isEscape(key) {
   const name = key.name.toLowerCase();
@@ -14820,6 +15608,7 @@ function FleetApp({
   const [notice, setNotice] = useState("connecting to hestiad\u2026");
   const [doctorRows, setDoctorRows] = useState([]);
   const [doctorRunning, setDoctorRunning] = useState(false);
+  const [sharedBusy, setSharedBusy] = useState(false);
   const lastFrameAt = useRef(Date.now());
   const stateRef = useRef(state);
   stateRef.current = state;
@@ -14931,6 +15720,55 @@ function FleetApp({
       }
       return;
     }
+    if (current.sharedOpen) {
+      key.preventDefault();
+      key.stopPropagation();
+      if (isEscape(key) || isFleetKey(key, "s"))
+        return dispatch({ type: "shared", open: false });
+      const list = snapshot.shared;
+      if (list.length === 0)
+        return;
+      if (key.name === "down" || isFleetKey(key, "j"))
+        return dispatch({ type: "move-shared", delta: 1, count: list.length });
+      if (key.name === "up" || isFleetKey(key, "k"))
+        return dispatch({ type: "move-shared", delta: -1, count: list.length });
+      const selected = list[Math.min(current.sharedSelection, list.length - 1)];
+      if (selected === undefined || sharedBusy)
+        return;
+      const runShared = (label, action) => {
+        setSharedBusy(true);
+        setNotice(`${label} ${selected.name}\u2026`);
+        action.then(() => setNotice(`${label} ${selected.name}: done`)).catch((error) => setNotice(`${label} ${selected.name} failed: ${error.message}`)).finally(() => setSharedBusy(false));
+      };
+      if (isFleetKey(key, "a") || isFleetKey(key, "x") || isFleetKey(key, "r")) {
+        if (selected.holder?.mine !== true) {
+          setNotice(`this worktree does not hold ${selected.name}`);
+          return;
+        }
+        const worktree = selected.holder.worktree;
+        if (isFleetKey(key, "a"))
+          runShared("allowing", source.allowShared(worktree, selected.name));
+        else if (isFleetKey(key, "x"))
+          runShared("denying", source.denyShared(worktree, selected.name));
+        else
+          runShared("releasing", source.releaseShared(worktree, selected.name));
+        return;
+      }
+      if (isFleetKey(key, "c")) {
+        const acting = selectedStack(snapshot, current.selection.project);
+        if (acting === undefined) {
+          setNotice("select a stack (in the fleet list) to claim as");
+          return;
+        }
+        if (selected.holder?.project === acting.project) {
+          setNotice(`${acting.project} already holds ${selected.name}`);
+          return;
+        }
+        runShared(`claiming as ${acting.project},`, source.claimShared(acting.worktree, selected.name));
+        return;
+      }
+      return;
+    }
     if (current.focus === "filter") {
       if (isEscape(key) || key.name === "return" || key.name === "enter") {
         key.preventDefault();
@@ -14943,6 +15781,8 @@ function FleetApp({
       return onQuit();
     if (isFleetKey(key, "?"))
       return dispatch({ type: "help", open: true });
+    if (isFleetKey(key, "s"))
+      return dispatch({ type: "shared", open: true });
     if (isFleetKey(key, "/"))
       return dispatch({ type: "focus", focus: "filter" });
     if (isFleetKey(key, "0"))
@@ -14970,7 +15810,7 @@ function FleetApp({
       dispatch({ type: "doctor", open: true });
       setDoctorRunning(true);
       setDoctorRows([]);
-      const worktree = stack !== undefined && existsSync22(stack.worktree) ? stack.worktree : process.cwd();
+      const worktree = stack !== undefined && existsSync23(stack.worktree) ? stack.worktree : process.cwd();
       source.diagnose(worktree).then(setDoctorRows).catch((error) => {
         setNotice(`doctor failed: ${error.message}`);
       }).finally(() => setDoctorRunning(false));
@@ -15222,7 +16062,7 @@ function FleetApp({
           }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("text", {
             fg: fleetTheme.text,
-            children: "D doctor"
+            children: "D doctor \xB7 s shared hostnames (claim / allow / deny / release)"
           }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("text", {
             fg: fleetTheme.danger,
@@ -15256,6 +16096,40 @@ function FleetApp({
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this) : null,
+      state.sharedOpen ? /* @__PURE__ */ jsxDEV5(FleetModal, {
+        title: "Shared hostnames",
+        terminalWidth: terminal.width,
+        terminalHeight: terminal.height,
+        children: [
+          snapshot.shared.length === 0 ? /* @__PURE__ */ jsxDEV5("text", {
+            fg: fleetTheme.muted,
+            children: "No shared hostnames declared. `hestia expose <svc> --shared <name>` creates one."
+          }, undefined, false, undefined, this) : snapshot.shared.map((entry, index) => {
+            const active = index === Math.min(state.sharedSelection, snapshot.shared.length - 1);
+            const holder = entry.holder === undefined ? "unclaimed" : `held by ${entry.holder.project}${entry.holder.mine ? " (yours)" : ""}`;
+            return /* @__PURE__ */ jsxDEV5("box", {
+              style: { flexDirection: "column" },
+              children: [
+                /* @__PURE__ */ jsxDEV5("text", {
+                  fg: active ? fleetTheme.accent : fleetTheme.text,
+                  children: `${active ? "\u25B8 " : "  "}${sanitizeFleetTerminalText(entry.name)}  ${sanitizeFleetTerminalText(entry.url)}  ${holder}`
+                }, undefined, false, undefined, this),
+                entry.queue.map((waiter, position) => /* @__PURE__ */ jsxDEV5("text", {
+                  fg: fleetTheme.muted,
+                  children: `      ${position + 1}. ${sanitizeFleetTerminalText(waiter.project)}${waiter.mine ? " (yours)" : ""}${waiter.denied ? " \u2014 denied, still queued" : ""}`
+                }, `${entry.name}:${waiter.project}`, false, undefined, this))
+              ]
+            }, entry.name, true, undefined, this);
+          }),
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1 }
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV5("text", {
+            fg: fleetTheme.muted,
+            children: sharedBusy ? "working\u2026" : "j/k select \xB7 c claim (as selected stack) \xB7 a allow \xB7 x deny \xB7 r release \xB7 Esc/s close"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this) : null,
       state.confirmDown !== undefined ? /* @__PURE__ */ jsxDEV5(FleetModal, {
         title: "Confirm stack down",
         terminalWidth: terminal.width,
@@ -15471,9 +16345,43 @@ var init_src3 = __esm(() => {
 init_src2();
 init_src();
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync23 } from "fs";
-import { dirname as dirname8, join as join24 } from "path";
+import { existsSync as existsSync24 } from "fs";
+import { dirname as dirname8, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+var CLI_VERSION = "1.1.0";
+var PACKAGE_NAME = "@tridha643/hestia";
+function compareVersions(a, b) {
+  const parse = (value) => {
+    const [core, pre] = value.split("-", 2);
+    return {
+      core: (core ?? "").split(".").map((part) => Number.parseInt(part, 10) || 0),
+      pre: pre !== undefined && pre.length > 0
+    };
+  };
+  const left = parse(a);
+  const right = parse(b);
+  const length = Math.max(left.core.length, right.core.length);
+  for (let index = 0;index < length; index += 1) {
+    const diff = (left.core[index] ?? 0) - (right.core[index] ?? 0);
+    if (diff !== 0)
+      return diff;
+  }
+  if (left.pre === right.pre)
+    return 0;
+  return left.pre ? -1 : 1;
+}
+async function fetchLatestVersion() {
+  const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok)
+    throw new Error(`npm registry responded ${response.status}`);
+  const body = await response.json();
+  if (typeof body.version !== "string" || body.version.length === 0) {
+    throw new Error("npm registry response has no version");
+  }
+  return body.version;
+}
 function parseFlags(argv) {
   const f = {
     json: false,
@@ -15485,6 +16393,8 @@ function parseFlags(argv) {
     noPort: false,
     keepHostHeader: false,
     overwriteDns: false,
+    cancel: false,
+    check: false,
     noDaemon: false,
     print: false,
     interactive: false,
@@ -15566,6 +16476,22 @@ function parseFlags(argv) {
       f.keepHostHeader = true;
     else if (a === "--overwrite-dns")
       f.overwriteDns = true;
+    else if (a === "--shared") {
+      f.shared = takeValue();
+      if (!f.shared || f.shared.startsWith("--"))
+        f.errors.push("--shared requires a value");
+    } else if (a === "--hostname") {
+      f.hostname = takeValue();
+      if (!f.hostname || f.hostname.startsWith("--"))
+        f.errors.push("--hostname requires a value");
+    } else if (a === "--path") {
+      f.path = takeValue();
+      if (!f.path || f.path.startsWith("--"))
+        f.errors.push("--path requires a value");
+    } else if (a === "--cancel")
+      f.cancel = true;
+    else if (a === "--check")
+      f.check = true;
     else if (a === "--no-daemon")
       f.noDaemon = true;
     else if (a === "--print")
@@ -15637,12 +16563,16 @@ function parseFlags(argv) {
 function validateCommandOptions(argv, command) {
   const allowedByCommand = {
     version: new Set(["--json"]),
+    upgrade: new Set(["--json", "--check"]),
     skill: new Set(["--json"]),
     discover: new Set(["--json"]),
     init: new Set(["--json", "--print", "--scope", "--write", "--no-port"]),
     up: new Set(["--json", "--services", "--workers", "--allow-remote", "--force", "--no-varlock", "--wait", "--no-daemon"]),
     run: new Set(["--json", "--name", "--env", "--no-port", "--varlock", "--signal", "--ready-timeout", "--cwd", "--wait", "--no-daemon"]),
-    expose: new Set(["--json", "--tunnel", "--zone", "--keep-host-header", "--overwrite-dns", "--force", "--ready-timeout"]),
+    expose: new Set(["--json", "--tunnel", "--zone", "--keep-host-header", "--overwrite-dns", "--force", "--ready-timeout", "--shared", "--hostname", "--path"]),
+    claim: new Set(["--json", "--wait", "--cancel"]),
+    release: new Set(["--json"]),
+    share: new Set(["--json"]),
     route: new Set(["--json"]),
     router: new Set(["--json", "--interactive"]),
     config: new Set(["--json", "--file"]),
@@ -15673,7 +16603,10 @@ function validateCommandOptions(argv, command) {
     "--zone",
     "--file",
     "--scope",
-    "--tail"
+    "--tail",
+    "--shared",
+    "--hostname",
+    "--path"
   ]);
   for (let index = 0;index < argv.length; index += 1) {
     const raw = argv[index];
@@ -15715,6 +16648,15 @@ function printStackHuman(r) {
     const pub = r.endpoints.find((e) => e.name === s.name)?.publicUrl;
     out.push(`  \u25CF ${s.name.padEnd(12)} ${s.backend.padEnd(7)} ${port.padEnd(20)} ${s.state}` + (pub !== undefined ? `  ${pub}` : ""));
   }
+  for (const shared of listSharedHostnames()) {
+    const holds = shared.holder?.project === r.project;
+    const queuedHere = (shared.queue ?? []).some((waiter) => waiter.project === r.project);
+    if (!holds && !queuedHere)
+      continue;
+    const pending = (shared.queue ?? []).length;
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    out.push(holds ? `  \u21C4 shared ${shared.name.padEnd(10)} ${url}  HELD` + (pending > 0 ? `  (${pending} queued \u2014 \`hestia share requests\`)` : "") : `  \u21C4 shared ${shared.name.padEnd(10)} ${url}  queued behind ${shared.holder?.project ?? "?"}`);
+  }
   process.stdout.write(out.join(`
 `) + `
 `);
@@ -15724,6 +16666,9 @@ var HELP = `hestia \u2014 per-worktree isolated dev stacks
 usage:
   hestia version [--json]
         print CLI version, state schema, and daemon protocol
+  hestia upgrade [--check] [--json]
+        upgrade hestia to the latest npm release via \`bun add --global\`;
+        --check only reports whether a newer version is available
   hestia skill path [--json]
         print the packaged Hestia agent skill path
   hestia discover [--json]
@@ -15765,6 +16710,27 @@ usage:
         worktrees). URLs land in endpoints[] + HESTIA_<SVC>_URL. These are
         fail-closed but unauthenticated public URLs. Named v1 performs no DNS
         writes and requires wildcard CNAME *.<zone> \u2192 <uuid>.cfargotunnel.com.
+  hestia expose <endpoint> --shared <name> [--hostname <fqdn>] [--path <prefix>]
+                           [--tunnel <t>] [--zone <zone>] [--json]
+        declare + claim a machine-owned SHARED hostname \u2014 a stable public URL
+        for externally-pinned integrations (Slack request URLs, webhook
+        consumers) that cannot chase per-branch hostnames. Exactly one worktree
+        holds it at a time; handoffs are consent-based and switch inside
+        hestiad with zero connector restarts. The target defaults to
+        <name>.<zone>; --hostname points ANY FQDN you control (any zone) at it,
+        and --path /prefix lets several handles share one hostname routed by
+        longest path prefix (e.g. acme.com/slack vs acme.com/stripe). Prefer
+        plain per-branch expose whenever the external side can be configured
+        per branch (dashboards, multi-redirect OAuth)
+  hestia claim <name> [--wait[=secs]] [--cancel] [--json]
+        claim a shared hostname for this worktree. Held names queue DURABLY
+        (position survives daemon restarts and CLI timeouts); --wait blocks
+        until the holder allows or releases, --cancel leaves the queue
+  hestia release <name> [--json]
+        release a held shared hostname; the queue head is granted immediately
+  hestia share list|requests [--json] | share allow|deny <name> [--json]
+        inspect shared hostnames and arbitrate queued claims as the holder:
+        allow hands over now; deny keeps the requester queued until release
   hestia open <service> [path] [--json]
         resolve a service's public URL (from \`expose\`) and open it in the
         browser; the URL is always printed too, so a headless agent can hand
@@ -15819,7 +16785,7 @@ async function main() {
     switch (cmd) {
       case "version": {
         const version = {
-          cliVersion: "1.0.1",
+          cliVersion: CLI_VERSION,
           stateSchema: STATE_SCHEMA_VERSION,
           daemonProtocol: HESTIAD_PROTOCOL_VERSION,
           runtime: "bun"
@@ -15829,6 +16795,45 @@ async function main() {
 `);
         else
           process.stdout.write(`hestia ${version.cliVersion} (state v${version.stateSchema}, daemon v${version.daemonProtocol}, Bun)
+`);
+        break;
+      }
+      case "upgrade": {
+        let latest;
+        try {
+          latest = await fetchLatestVersion();
+        } catch (error) {
+          fail("upgrade-failed", `could not check the latest ${PACKAGE_NAME} version: ${error.message}`, flags.json);
+        }
+        const available = compareVersions(latest, CLI_VERSION) > 0;
+        if (flags.check || !available) {
+          if (flags.json) {
+            process.stdout.write(JSON.stringify({ current: CLI_VERSION, latest, upgradeAvailable: available }) + `
+`);
+          } else if (available) {
+            process.stdout.write(`hestia ${latest} is available (you have ${CLI_VERSION}) \u2014 run \`hestia upgrade\`
+`);
+          } else {
+            process.stdout.write(`hestia ${CLI_VERSION} is the latest release
+`);
+          }
+          break;
+        }
+        const installArgs = ["add", "--global", `${PACKAGE_NAME}@${latest}`];
+        if (!flags.json) {
+          process.stderr.write(`upgrading hestia ${CLI_VERSION} \u2192 ${latest} via \`bun ${installArgs.join(" ")}\`\u2026
+`);
+        }
+        try {
+          execFileSync4("bun", installArgs, { stdio: flags.json ? "ignore" : "inherit" });
+        } catch (error) {
+          fail("upgrade-failed", `\`bun ${installArgs.join(" ")}\` failed: ${error.message}`, flags.json);
+        }
+        if (flags.json)
+          process.stdout.write(JSON.stringify({ current: CLI_VERSION, latest, upgraded: true }) + `
+`);
+        else
+          process.stdout.write(`hestia upgraded ${CLI_VERSION} \u2192 ${latest}
 `);
         break;
       }
@@ -15837,10 +16842,10 @@ async function main() {
           fail("usage", "usage: hestia skill path", flags.json);
         const packageRoot = dirname8(dirname8(fileURLToPath3(import.meta.url)));
         const candidates = [
-          join24(packageRoot, "skills", "hestia", "SKILL.md"),
-          join24(process.cwd(), "skills", "hestia", "SKILL.md")
+          join25(packageRoot, "skills", "hestia", "SKILL.md"),
+          join25(process.cwd(), "skills", "hestia", "SKILL.md")
         ];
-        const path = candidates.find(existsSync23);
+        const path = candidates.find(existsSync24);
         if (path === undefined)
           fail("config-missing", "packaged Hestia skill was not found", flags.json);
         if (flags.json)
@@ -15992,11 +16997,17 @@ ${result.proposed}`);
         if (flags.overwriteDns) {
           fail("usage", "--overwrite-dns was removed; named v1 requires user-managed wildcard DNS", flags.json);
         }
+        if ((flags.hostname !== undefined || flags.path !== undefined) && flags.shared === undefined) {
+          fail("usage", "--hostname/--path only apply with --shared <name>", flags.json);
+        }
         const r = await engine.expose(cwd, services, {
           tunnel: flags.tunnel,
           zone: flags.zone,
           keepHostHeader: flags.keepHostHeader,
           overwriteDns: flags.overwriteDns,
+          shared: flags.shared,
+          hostname: flags.hostname,
+          path: flags.path,
           force: flags.force,
           readyTimeoutMs: flags.readyTimeout
         });
@@ -16007,6 +17018,103 @@ ${result.proposed}`);
           printStackHuman(r);
         break;
       }
+      case "claim": {
+        const name = flags._[1];
+        if (!name || flags._.length > 2) {
+          fail("usage", "usage: hestia claim <name> [--wait[=secs]] [--cancel]", flags.json);
+        }
+        if (flags.cancel) {
+          await engine.cancelSharedClaim(cwd, name);
+          if (flags.json)
+            process.stdout.write(JSON.stringify({ ok: true, cancelled: name }) + `
+`);
+          else
+            process.stdout.write(`left the queue for "${name}"
+`);
+          break;
+        }
+        const { record, result } = await engine.claimShared(cwd, name, {
+          waitMs: flags.wait !== undefined ? flags.wait * 1000 : 0
+        });
+        const hostname = listSharedHostnames().find((candidate) => candidate.name === name)?.hostname;
+        if (flags.json) {
+          process.stdout.write(JSON.stringify({ granted: true, holder: result.holder, record }, null, 2) + `
+`);
+        } else {
+          process.stdout.write(`claimed "${name}"${hostname !== undefined ? ` \u2014 https://${hostname}` : ""} now routes here
+`);
+        }
+        break;
+      }
+      case "release": {
+        const name = flags._[1];
+        if (!name || flags._.length > 2)
+          fail("usage", "usage: hestia release <name>", flags.json);
+        await engine.releaseShared(cwd, name);
+        if (flags.json)
+          process.stdout.write(JSON.stringify({ ok: true, released: name }) + `
+`);
+        else
+          process.stdout.write(`released "${name}" \u2014 next in queue (if any) now holds it
+`);
+        break;
+      }
+      case "share": {
+        const action = flags._[1];
+        if (action === "list" || action === "requests") {
+          const records = listSharedHostnames();
+          const view = records.map((record) => ({
+            name: record.name,
+            hostname: record.hostname,
+            path: record.path,
+            url: `https://${record.hostname}${record.path ?? ""}`,
+            service: record.service,
+            holder: record.holder,
+            queued: record.queue ?? []
+          })).filter((entry) => action === "list" || entry.queued.length > 0);
+          if (flags.json)
+            process.stdout.write(JSON.stringify(view, null, 2) + `
+`);
+          else if (view.length === 0) {
+            process.stdout.write(action === "list" ? `no shared hostnames declared
+` : `no pending claim requests
+`);
+          } else {
+            for (const entry of view) {
+              const holder = entry.holder === undefined ? "unclaimed" : `held by ${entry.holder.project}`;
+              process.stdout.write(`${entry.name.padEnd(16)} ${entry.url}  ${holder}
+`);
+              entry.queued.forEach((waiter, index) => {
+                process.stdout.write(`  ${String(index + 1).padStart(2)}. ${waiter.project}${waiter.denied ? "  (denied \u2014 still queued)" : ""}
+`);
+              });
+            }
+          }
+          break;
+        }
+        const name = flags._[2];
+        if (action !== "allow" && action !== "deny" || !name) {
+          fail("usage", "usage: hestia share list|requests | share allow|deny <name>", flags.json);
+        }
+        if (action === "allow") {
+          await engine.allowShared(cwd, name);
+          if (flags.json)
+            process.stdout.write(JSON.stringify({ ok: true, allowed: name }) + `
+`);
+          else
+            process.stdout.write(`allowed \u2014 "${name}" handed to the next in queue
+`);
+        } else {
+          await engine.denyShared(cwd, name);
+          if (flags.json)
+            process.stdout.write(JSON.stringify({ ok: true, denied: name }) + `
+`);
+          else
+            process.stdout.write(`denied \u2014 the requester stays queued until you release "${name}"
+`);
+        }
+        break;
+      }
       case "route": {
         const action = flags._[1];
         const services = flags._.slice(2);
@@ -16402,6 +17510,10 @@ ${JSON.stringify(result.config, null, 2)}
     fail("internal", err.message ?? String(err), flags.json);
   }
 }
-main();
+if (import.meta.main)
+  main();
+export {
+  compareVersions
+};
 
-//# debugId=7C129FA1100BA38864756E2164756E21
+//# debugId=D1A8C01922C41BA164756E2164756E21