@tridha643/hestia 1.0.1 → 1.2.0

package/dist/cli.js

@@ -7158,6 +7158,19 @@ import {
 } from "fs";
 import { dirname as dirname2 } from "path";
 import { randomUUID } from "crypto";
+function fsyncDir(path) {
+  let fd;
+  try {
+    fd = openSync(dirname2(path), "r");
+  } catch {
+    return;
+  }
+  try {
+    fsyncSync(fd);
+  } catch {} finally {
+    closeSync(fd);
+  }
+}
 function writeAtomicJsonFile(path, value, options = {}) {
   mkdirSync(dirname2(path), { recursive: true });
   const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
@@ -7179,6 +7192,7 @@ function writeAtomicJsonFile(path, value, options = {}) {
     rmSync(temporaryPath, { force: true });
     throw error;
   }
+  fsyncDir(path);
 }
 function writeAtomicTextFile(path, source, mode = 384) {
   mkdirSync(dirname2(path), { recursive: true });
@@ -7200,6 +7214,7 @@ function writeAtomicTextFile(path, source, mode = 384) {
     rmSync(temporaryPath, { force: true });
     throw error;
   }
+  fsyncDir(path);
 }
 var init_atomic_json_file = () => {};
 
@@ -9252,6 +9267,39 @@ async function releaseSlot(port, project) {
     });
   } catch {}
 }
+async function sharedVerb(port, verb, body) {
+  const timeoutMs = (body.waitMs ?? 0) + 5000;
+  let response;
+  try {
+    response = await fetch(`http://127.0.0.1:${port}/hestia/shared/${verb}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...daemonAuthHeaders(port) },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    throw new HestiaError("daemon-unreachable", `could not reach hestiad on 127.0.0.1:${port}: ${error.message}`);
+  }
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new HestiaError(payload.code ?? "daemon-unreachable", payload.error ?? `daemon rejected shared ${verb}: HTTP ${response.status}`);
+  }
+  return {
+    granted: payload.granted === true,
+    holder: payload.holder,
+    queued: payload.queued ?? []
+  };
+}
+async function releaseSharedForProject(port, project, service) {
+  try {
+    await fetch(`http://127.0.0.1:${port}/hestia/shared/release-project`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...daemonAuthHeaders(port) },
+      body: JSON.stringify({ project, service }),
+      signal: AbortSignal.timeout(2000)
+    });
+  } catch {}
+}
 var DAEMON_PIDFILE_NAME = "hestiad", MAX_NDJSON_FRAME_BYTES;
 var init_client = __esm(() => {
   init_src();
@@ -9575,6 +9623,7 @@ class Admission {
 }
 var HESTIAD_PROTOCOL_VERSION = 5, MAX_JSON_BODY_BYTES;
 var init_routes = __esm(() => {
+  init_src();
   init_state();
   init_slots();
   MAX_JSON_BODY_BYTES = 16 * 1024;
@@ -10155,25 +10204,182 @@ var init_portless_adapter = __esm(() => {
   HESTIA_ROUTER_RUNTIME_STATE_DIR = join15(HESTIA_ROUTER_INSTALL_DIR, "state");
 });
 
+// packages/engine/src/tunnel/shared.ts
+import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
+import { join as join16 } from "path";
+function sharedRoot() {
+  return join16(hestiaHome(), "shared");
+}
+function sharedPath(name) {
+  return join16(sharedRoot(), `${name}.json`);
+}
+function assertSharedName(name) {
+  if (!NAME_RE.test(name)) {
+    throw new HestiaError("usage", `shared hostname handle ${JSON.stringify(name)} must be a DNS label: ` + `lowercase alphanumerics and hyphens, at most 63 characters`);
+  }
+}
+function assertSharedHostnameFqdn(hostname) {
+  const labels = hostname.split(".");
+  const valid = hostname.length <= 253 && hostname === hostname.toLowerCase() && labels.length >= 2 && labels.every((label) => LABEL_RE.test(label));
+  if (!valid) {
+    throw new HestiaError("usage", `shared hostname ${JSON.stringify(hostname)} must be a fully-qualified ` + `lowercase domain (e.g. slack.acme.com)`);
+  }
+}
+function normalizeSharedPath(input) {
+  if (input === undefined)
+    return;
+  const trimmed = input.trim();
+  const segments = trimmed.split("/").filter((segment) => segment !== "");
+  for (const segment of segments) {
+    if (segment === "." || segment === ".." || !PATH_SEGMENT_RE.test(segment)) {
+      throw new HestiaError("usage", `shared hostname path ${JSON.stringify(input)} must be a URL path prefix ` + `like /webhooks/slack (no query, fragment, or ".." segments)`);
+    }
+  }
+  if (segments.length === 0)
+    return;
+  return `/${segments.join("/")}`;
+}
+function sharedPathMatches(prefix, requestPath) {
+  if (prefix === undefined)
+    return true;
+  return requestPath === prefix || requestPath.startsWith(`${prefix}/`);
+}
+function withSharedLock(fn) {
+  return withLock(sharedRoot(), fn);
+}
+function parseShared(source) {
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    return null;
+  }
+  if (value.schemaVersion !== STATE_SCHEMA_VERSION || typeof value.name !== "string" || !NAME_RE.test(value.name) || typeof value.hostname !== "string" || value.hostname.length === 0 || typeof value.tunnelUuid !== "string" || value.tunnelUuid.length === 0 || typeof value.zone !== "string" || value.zone.length === 0 || typeof value.service !== "string" || value.service.length === 0 || typeof value.createdAt !== "string")
+    return null;
+  if (value.path !== undefined && (typeof value.path !== "string" || !value.path.startsWith("/"))) {
+    return null;
+  }
+  if (value.holder !== undefined) {
+    const holder = value.holder;
+    if (typeof holder.project !== "string" || typeof holder.worktree !== "string" || typeof holder.service !== "string" || typeof holder.at !== "string")
+      return null;
+  }
+  if (value.queue !== undefined) {
+    if (!Array.isArray(value.queue))
+      return null;
+    for (const entry of value.queue) {
+      if (typeof entry !== "object" || entry === null || typeof entry.project !== "string" || typeof entry.worktree !== "string" || typeof entry.at !== "string")
+        return null;
+    }
+  }
+  return value;
+}
+function readSharedHostname(name) {
+  const p = sharedPath(name);
+  if (!existsSync13(p))
+    return null;
+  try {
+    return parseShared(readFileSync13(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function listSharedHostnames() {
+  const root = sharedRoot();
+  if (!existsSync13(root))
+    return [];
+  const records = [];
+  for (const entry of readdirSync4(root).sort()) {
+    if (!entry.endsWith(".json"))
+      continue;
+    const record = readSharedHostname(entry.slice(0, -".json".length));
+    if (record !== null && `${record.name}.json` === entry)
+      records.push(record);
+  }
+  return records;
+}
+async function declareSharedHostname(record) {
+  assertSharedName(record.name);
+  assertSharedHostnameFqdn(record.hostname);
+  const path = normalizeSharedPath(record.path);
+  return withSharedLock(async () => {
+    const collision = listSharedHostnames().find((candidate) => candidate.name !== record.name && candidate.hostname === record.hostname && (candidate.path ?? undefined) === (path ?? undefined));
+    if (collision !== undefined) {
+      throw new HestiaError("shared-conflict", `${record.hostname}${path ?? ""} is already declared as shared hostname ` + `"${collision.name}" \u2014 pick a distinct path or handle`);
+    }
+    const existing = readSharedHostname(record.name);
+    if (existing !== null) {
+      if (existing.hostname !== record.hostname || existing.tunnelUuid !== record.tunnelUuid || (existing.path ?? undefined) !== (path ?? undefined)) {
+        throw new HestiaError("shared-conflict", `shared hostname "${record.name}" already declared as ${existing.hostname}` + `${existing.path ?? ""} on tunnel ${existing.tunnelUuid} \u2014 release and remove it before re-pointing`);
+      }
+      const merged = { ...existing, service: record.service, zone: record.zone };
+      writeAtomicJsonFile(sharedPath(record.name), merged);
+      return merged;
+    }
+    const fresh = {
+      schemaVersion: STATE_SCHEMA_VERSION,
+      ...record,
+      createdAt: new Date().toISOString()
+    };
+    if (path === undefined)
+      delete fresh.path;
+    else
+      fresh.path = path;
+    writeAtomicJsonFile(sharedPath(record.name), fresh);
+    return fresh;
+  });
+}
+async function updateSharedHostname(name, mutate) {
+  return withSharedLock(async () => {
+    const existing = readSharedHostname(name);
+    if (existing === null)
+      return null;
+    const next = mutate(structuredClone(existing));
+    if (next.queue !== undefined && next.queue.length === 0)
+      delete next.queue;
+    if (next.holder === undefined)
+      delete next.holder;
+    writeAtomicJsonFile(sharedPath(name), next);
+    return next;
+  });
+}
+var NAME_RE, LABEL_RE, PATH_SEGMENT_RE;
+var init_shared = __esm(() => {
+  init_src();
+  init_state();
+  init_lock();
+  init_atomic_json_file();
+  NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+  LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+  PATH_SEGMENT_RE = /^[A-Za-z0-9._~!$&'()*+,;=:@%-]+$/;
+});
+
 // packages/engine/src/router/local-http-router.ts
 import { execFile as execFile7 } from "child_process";
 import { Agent, createServer as createServer2, request as httpRequest } from "http";
 import { createConnection as createConnection2, createServer as createNetServer } from "net";
 import { promisify as promisify6 } from "util";
-import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4 } from "fs";
-import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "fs";
+import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync9 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { createHash as createHash5 } from "crypto";
+function pathnameOf(target) {
+  if (target === undefined || target.length === 0)
+    return "/";
+  const cut = target.search(/[?#]/);
+  const path = cut < 0 ? target : target.slice(0, cut);
+  return path.startsWith("/") ? path : "/";
+}
 function readRouterStackRecords() {
-  const stacksDir = join16(hestiaHome(), "stacks");
-  if (!existsSync13(stacksDir))
+  const stacksDir = join17(hestiaHome(), "stacks");
+  if (!existsSync14(stacksDir))
     return [];
   const records = [];
-  for (const project of readdirSync4(stacksDir).sort()) {
-    const path = join16(stacksDir, project, "stack.json");
+  for (const project of readdirSync5(stacksDir).sort()) {
+    const path = join17(stacksDir, project, "stack.json");
     try {
-      const source = readFileSync13(path);
+      const source = readFileSync14(path);
       if (source.byteLength > MAX_MIRROR_BYTES)
         continue;
       const record = parseStackRecord(source.toString("utf8"), path);
@@ -10325,11 +10531,11 @@ function internalEndpointAuthority(project, service) {
 function publicGatewaySocketPath() {
   const uid = process.getuid?.() ?? 501;
   const homeHash = createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12);
-  return join16(tmpdir2(), `hestia-${uid}`, homeHash, "origin.sock");
+  return join17(tmpdir2(), `hestia-${uid}`, homeHash, "origin.sock");
 }
 function prepareGatewaySocket(path) {
   const uid = process.getuid?.();
-  const directories = [join16(tmpdir2(), `hestia-${uid ?? 501}`), join16(tmpdir2(), `hestia-${uid ?? 501}`, createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12))];
+  const directories = [join17(tmpdir2(), `hestia-${uid ?? 501}`), join17(tmpdir2(), `hestia-${uid ?? 501}`, createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12))];
   for (const directory of directories) {
     mkdirSync7(directory, { recursive: true, mode: 448 });
     const stat2 = lstatSync(directory);
@@ -10338,13 +10544,13 @@ function prepareGatewaySocket(path) {
     }
     chmodSync5(directory, 448);
   }
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return;
   const stat = lstatSync(path);
   if (stat.isSymbolicLink() || !stat.isSocket() || uid !== undefined && stat.uid !== uid) {
     throw new Error(`refusing unsafe existing Hestia gateway socket ${path}`);
   }
-  rmSync8(path);
+  rmSync9(path);
 }
 function sendRouterResponse(response, status, message) {
   response.writeHead(status, { "content-type": "text/plain; charset=utf-8", "x-hestia-router": "1" });
@@ -10357,6 +10563,7 @@ class HestiaLocalHttpRouter {
   #frontServer = createNetServer((socket) => this.#acceptFrontSocket(socket));
   #unixServer = createNetServer((socket) => this.#acceptFrontSocket(socket));
   #targets = new Map;
+  #sharedRoutes = new Map;
   #timer;
   async start() {
     await new Promise((resolve2, reject) => {
@@ -10460,12 +10667,52 @@ class HestiaLocalHttpRouter {
         }
       }
     }
+    const sharedRoutes = new Map;
+    for (const shared of listSharedHostnames()) {
+      const hostname = shared.hostname.toLowerCase();
+      targets.delete(hostname);
+      const holder = shared.holder;
+      let target;
+      if (holder !== undefined) {
+        const stack = records.find((record) => record.project === holder.project);
+        const endpoint = stack?.endpoints.find((candidate2) => (candidate2.alias ?? candidate2.name) === holder.service);
+        const service = stack?.services.find((candidate2) => candidate2.name === (endpoint?.workload ?? endpoint?.name));
+        const binding = service?.bindings?.find((candidate2) => `${candidate2.target}/${candidate2.protocol}` === endpoint?.binding);
+        const publishedPort = binding?.publishedPort ?? service?.publishedPort;
+        const candidate = {
+          hostname,
+          project: holder.project,
+          service: service === undefined || service.backend === "tunnel" || publishedPort === undefined ? undefined : { ...service, publishedPort }
+        };
+        const previous = this.#sharedRoutes.get(hostname)?.find((entry) => entry.name === shared.name)?.target;
+        target = previous !== undefined && targetIdentity(previous) === targetIdentity(candidate) ? previous : candidate;
+      }
+      const list = sharedRoutes.get(hostname) ?? [];
+      list.push({ path: shared.path, name: shared.name, claimed: holder !== undefined, target });
+      sharedRoutes.set(hostname, list);
+    }
+    for (const list of sharedRoutes.values()) {
+      list.sort((left, right) => (right.path?.length ?? -1) - (left.path?.length ?? -1));
+    }
     reconcilePortlessAliases([...targets.keys()].filter((hostname) => hostname.endsWith(".localhost")), this.port);
-    for (const [hostname, target] of this.#targets) {
-      if (targets.get(hostname) !== target)
+    const retained = new Set(targets.values());
+    for (const list of sharedRoutes.values()) {
+      for (const entry of list)
+        if (entry.target !== undefined)
+          retained.add(entry.target);
+    }
+    const priorTargets = [...this.#targets.values()];
+    for (const list of this.#sharedRoutes.values()) {
+      for (const entry of list)
+        if (entry.target !== undefined)
+          priorTargets.push(entry.target);
+    }
+    for (const target of priorTargets) {
+      if (!retained.has(target))
         target.agent?.destroy();
     }
     this.#targets = targets;
+    this.#sharedRoutes = sharedRoutes;
   }
   stop() {
     if (this.#timer)
@@ -10479,7 +10726,7 @@ class HestiaLocalHttpRouter {
       target.agent?.destroy();
     this.#frontServer.close();
     this.#unixServer.close();
-    rmSync8(this.socketPath, { force: true });
+    rmSync9(this.socketPath, { force: true });
     this.#server.close();
   }
   #acceptFrontSocket(socket) {
@@ -10524,16 +10771,40 @@ Connection: close\r
 `));
     socket.once("error", () => internal.destroy());
   }
+  #matchTarget(hostname, requestPath) {
+    const routes = this.#sharedRoutes.get(hostname);
+    if (routes !== undefined) {
+      const entry = routes.find((candidate) => sharedPathMatches(candidate.path, requestPath));
+      if (entry === undefined)
+        return { status: 404, message: "Hestia route not found" };
+      if (!entry.claimed) {
+        return {
+          status: 503,
+          message: `Shared hostname unclaimed \u2014 run \`hestia claim ${entry.name}\` in the worktree that should receive this traffic`
+        };
+      }
+      if (entry.target?.service?.publishedPort === undefined) {
+        return { status: 503, message: "Hestia route origin unavailable" };
+      }
+      return { target: entry.target };
+    }
+    const target = this.#targets.get(hostname);
+    if (target === undefined)
+      return { status: 404, message: "Hestia route not found" };
+    if (target.service?.publishedPort === undefined) {
+      return { status: 503, message: "Hestia route origin unavailable" };
+    }
+    return { target };
+  }
   async#proxyHttp(request, response) {
     const hostname = parseRouteAuthority(request.headers.host);
     if (hostname === null)
       return sendRouterResponse(response, 400, "Malformed Host authority");
-    const target = this.#targets.get(hostname);
-    if (target === undefined)
-      return sendRouterResponse(response, 404, "Hestia route not found");
-    const port = target.service?.publishedPort;
-    if (port === undefined)
-      return sendRouterResponse(response, 503, "Hestia route origin unavailable");
+    const match = this.#matchTarget(hostname, pathnameOf(request.url));
+    if ("status" in match)
+      return sendRouterResponse(response, match.status, match.message);
+    const target = match.target;
+    const port = target.service.publishedPort;
     if (await verifyLocalRouterTarget(target) !== port) {
       return sendRouterResponse(response, 503, "Hestia route origin unavailable");
     }
@@ -10574,16 +10845,19 @@ Connection: close\r
 `);
       return;
     }
-    const target = this.#targets.get(host);
-    const port = target?.service?.publishedPort;
-    if (target === undefined || port === undefined) {
-      socket.end(`HTTP/1.1 ${target === undefined ? "404 Not Found" : "503 Service Unavailable"}\r
+    const rawHeaderLines = header.slice(0, -4).split(`\r
+`);
+    const requestPath = pathnameOf(rawHeaderLines[0]?.split(" ")[1]);
+    const match = this.#matchTarget(host, requestPath);
+    if ("status" in match) {
+      const reason = match.status === 404 ? "404 Not Found" : "503 Service Unavailable";
+      socket.end(`HTTP/1.1 ${reason}\r
 \r
 `);
       return;
     }
-    const rawHeaderLines = header.slice(0, -4).split(`\r
-`);
+    const target = match.target;
+    const port = target.service.publishedPort;
     const connectionValues = rawHeaderLines.slice(1).filter((line) => /^connection:/i.test(line)).map((line) => line.slice(line.indexOf(":") + 1));
     const connectionNames = connectionHeaderTokens(connectionValues);
     const retainedHeaders = rawHeaderLines.slice(1).filter((line) => {
@@ -10639,6 +10913,7 @@ var init_local_http_router = __esm(() => {
   init_state();
   init_router_config();
   init_portless_adapter();
+  init_shared();
   pexec6 = promisify6(execFile7);
   MAX_MIRROR_BYTES = 2 * 1024 * 1024;
   MAX_REQUEST_HEADER_BYTES = 64 * 1024;
@@ -10657,15 +10932,15 @@ var init_local_http_router = __esm(() => {
 });
 
 // packages/engine/src/wrangler/adapter.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14, statSync as statSync2 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync15, statSync as statSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join17, relative as relative3 } from "path";
+import { dirname as dirname5, join as join18, relative as relative3 } from "path";
 import { connect } from "net";
 function privateRegistryDir(worktreeRoot) {
-  return join17(worktreeRoot, ".hestia", "wrangler-registry");
+  return join18(worktreeRoot, ".hestia", "wrangler-registry");
 }
 function globalRegistryDir() {
-  return process.env.WRANGLER_REGISTRY_PATH ?? join17(homedir3(), ".wrangler", "config", "registry");
+  return process.env.WRANGLER_REGISTRY_PATH ?? join18(homedir3(), ".wrangler", "config", "registry");
 }
 function tcpConnectable(address, timeoutMs = 500) {
   const [host, portStr] = address.split(":");
@@ -10688,19 +10963,19 @@ function tcpConnectable(address, timeoutMs = 500) {
 }
 async function preflightForeignSessions(workers) {
   const dir = globalRegistryDir();
-  if (!existsSync14(dir))
+  if (!existsSync15(dir))
     return;
   for (const w of workers) {
     if (w.name === null)
       continue;
-    const entryPath = join17(dir, w.name);
-    if (!existsSync14(entryPath))
+    const entryPath = join18(dir, w.name);
+    if (!existsSync15(entryPath))
       continue;
     const freshMs = Date.now() - statSync2(entryPath).mtimeMs;
     let live = freshMs < HEARTBEAT_FRESH_MS;
     if (!live) {
       try {
-        const entry = JSON.parse(readFileSync14(entryPath, "utf8"));
+        const entry = JSON.parse(readFileSync15(entryPath, "utf8"));
         live = entry.debugPortAddress ? await tcpConnectable(entry.debugPortAddress) : false;
       } catch {
         live = false;
@@ -10723,8 +10998,8 @@ async function planWorkers(worktreeRoot, opts) {
   const wranglerBinFor = (configPath) => {
     let dir = dirname5(configPath);
     for (;; ) {
-      const candidate = join17(dir, "node_modules", ".bin", "wrangler");
-      if (existsSync14(candidate))
+      const candidate = join18(dir, "node_modules", ".bin", "wrangler");
+      if (existsSync15(candidate))
         return candidate;
       if (dir === worktreeRoot)
         return null;
@@ -10795,11 +11070,11 @@ var init_adapter = __esm(() => {
 });
 
 // packages/engine/src/wrangler/verify.ts
-import { existsSync as existsSync15, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6 } from "fs";
 function namesIn(dir) {
-  if (!existsSync15(dir))
+  if (!existsSync16(dir))
     return new Set;
-  return new Set(readdirSync5(dir));
+  return new Set(readdirSync6(dir));
 }
 function snapshotGlobalRegistry() {
   return namesIn(globalRegistryDir());
@@ -10828,14 +11103,14 @@ var init_verify = __esm(() => {
 // packages/engine/src/tunnel/cloudflared.ts
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify7 } from "util";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function cloudflaredHome() {
-  return process.env.HESTIA_CLOUDFLARED_HOME ?? join18(homedir4(), ".cloudflared");
+  return process.env.HESTIA_CLOUDFLARED_HOME ?? join19(homedir4(), ".cloudflared");
 }
 function credFilePath(uuid) {
-  return process.env.TUNNEL_CRED_FILE ?? join18(cloudflaredHome(), `${uuid}.json`);
+  return process.env.TUNNEL_CRED_FILE ?? join19(cloudflaredHome(), `${uuid}.json`);
 }
 async function run(args, timeoutMs = 30000) {
   try {
@@ -10869,7 +11144,7 @@ async function adoptTunnel(name) {
     throw new HestiaError("tunnel-not-found", `no tunnel named "${name}" on this account \u2014 create it once with ` + `\`cloudflared tunnel create ${name}\``);
   }
   const credFile = credFilePath(entry.id);
-  if (!existsSync16(credFile)) {
+  if (!existsSync17(credFile)) {
     throw new HestiaError("tunnel-auth-missing", `credentials for tunnel "${name}" not found at ${credFile} \u2014 ` + `run \`cloudflared tunnel create\` on this machine or copy the JSON`);
   }
   return { uuid: entry.id, credFile, connections: entry.connections.length };
@@ -10882,8 +11157,8 @@ var init_cloudflared = __esm(() => {
 
 // packages/engine/src/tunnel/ingress.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 function hostnameFor(tunnelName, branch, service, zone) {
   const label = `${slug(tunnelName)}-${slug(branch)}-${slug(service)}`;
   if (label.length <= LABEL_MAX)
@@ -10901,12 +11176,12 @@ function inferZone(baseRules) {
   return zones.size === 1 ? [...zones][0] : undefined;
 }
 function importBaseRules(uuid, name) {
-  const p = join19(cloudflaredHome(), "config.yml");
-  if (!existsSync17(p))
+  const p = join20(cloudflaredHome(), "config.yml");
+  if (!existsSync18(p))
     return [];
   let parsed;
   try {
-    parsed = $parse(readFileSync15(p, "utf8"));
+    parsed = $parse(readFileSync16(p, "utf8"));
   } catch {
     return [];
   }
@@ -10918,7 +11193,12 @@ function importBaseRules(uuid, name) {
   return parsed.ingress.filter((r) => r.hostname !== undefined || r.path !== undefined);
 }
 function generateMergedConfig(opts) {
-  assertDisjoint(opts.baseRules, opts.dynamicRules);
+  assertDisjoint(opts.baseRules, opts.dynamicRules, opts.sharedRules ?? []);
+  const sharedHostnames = [...new Set((opts.sharedRules ?? []).map((s) => s.hostname))];
+  const shared = sharedHostnames.map((hostname) => ({
+    hostname,
+    service: `unix:${publicGatewaySocketPath()}`
+  }));
   const dynamic = opts.dynamicRules.map((d) => ({
     hostname: d.hostname,
     service: `unix:${publicGatewaySocketPath()}`,
@@ -10929,17 +11209,30 @@ function generateMergedConfig(opts) {
     "credentials-file": opts.credFile,
     ingress: [
       ...opts.baseRules,
+      ...shared,
       ...dynamic,
       { service: "http_status:404" }
     ]
   });
 }
-function assertDisjoint(base, dynamic) {
+function assertDisjoint(base, dynamic, shared) {
   const seen = new Map;
   for (const r of base) {
     if (r.hostname !== undefined)
       seen.set(r.hostname, "the user's static rules");
   }
+  const sharedByHost = new Map;
+  for (const s of shared) {
+    if (!sharedByHost.has(s.hostname))
+      sharedByHost.set(s.hostname, s.name);
+  }
+  for (const [hostname, name] of sharedByHost) {
+    const holder = seen.get(hostname);
+    if (holder !== undefined) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} ("${name}") is already claimed by ${holder}`);
+    }
+    seen.set(hostname, `shared hostname "${name}"`);
+  }
   for (const d of dynamic) {
     const holder = seen.get(d.hostname);
     if (holder !== undefined) {
@@ -10956,6 +11249,87 @@ var init_ingress = __esm(() => {
   init_local_http_router();
 });
 
+// packages/engine/src/tunnel/orphans.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { join as join21 } from "path";
+function hestiaTunnelMarker(uuid) {
+  return join21(hestiaHome(), "tunnel", uuid);
+}
+function parseLocalHestiaConnectors(psOutput, marker) {
+  const rows = [];
+  for (const line of psOutput.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "")
+      continue;
+    const m = trimmed.match(/^(\d+)\s+(\d+)\s+(.*)$/);
+    if (m === null)
+      continue;
+    const command = m[3];
+    if (!command.includes(marker))
+      continue;
+    if (!/(^|[\/\s])cloudflared(\s|$)/.test(command))
+      continue;
+    rows.push({ pid: Number(m[1]), pgid: Number(m[2]), command });
+  }
+  return rows;
+}
+function listLocalHestiaConnectors(uuid) {
+  let out;
+  try {
+    out = execFileSync4("ps", ["-Ao", "pid=,pgid=,command="], {
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024,
+      env: { ...process.env, LC_ALL: "C", LANG: "C" }
+    });
+  } catch {
+    return [];
+  }
+  return parseLocalHestiaConnectors(out, hestiaTunnelMarker(uuid));
+}
+async function reapOrphanConnectors(uuid, keep) {
+  const procs = listLocalHestiaConnectors(uuid).filter((p) => {
+    if (keep === undefined)
+      return true;
+    return p.pgid !== keep.pgid && p.pid !== keep.pid;
+  });
+  if (procs.length === 0)
+    return { reapedGroups: 0, pids: [] };
+  const groups = new Set(procs.map((p) => p.pgid));
+  const pids = procs.map((p) => p.pid);
+  for (const pgid of groups) {
+    try {
+      process.kill(-pgid, "SIGTERM");
+    } catch {}
+  }
+  const deadline = Date.now() + REAP_GRACE_MS;
+  while (Date.now() < deadline) {
+    const still = listLocalHestiaConnectors(uuid).filter((p) => {
+      if (keep === undefined)
+        return true;
+      return p.pgid !== keep.pgid && p.pid !== keep.pid;
+    });
+    if (still.length === 0)
+      return { reapedGroups: groups.size, pids };
+    await new Promise((r) => setTimeout(r, REAP_POLL_MS));
+  }
+  for (const p of listLocalHestiaConnectors(uuid)) {
+    if (keep !== undefined && (p.pgid === keep.pgid || p.pid === keep.pid))
+      continue;
+    try {
+      process.kill(-p.pgid, "SIGKILL");
+    } catch {}
+    try {
+      process.kill(p.pid, "SIGKILL");
+    } catch {}
+  }
+  return { reapedGroups: groups.size, pids };
+}
+var REAP_GRACE_MS = 5000, REAP_POLL_MS = 100;
+var init_orphans = __esm(() => {
+  init_state();
+});
+
 // packages/engine/src/tunnel/verify.ts
 async function get2(port, path) {
   try {
@@ -11000,31 +11374,31 @@ var POLL_MS4 = 300;
 
 // packages/engine/src/tunnel/registry.ts
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync16,
-  readdirSync as readdirSync6
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync7
 } from "fs";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 function tunnelDir(uuid) {
-  return join20(hestiaHome(), "tunnel", uuid);
+  return join22(hestiaHome(), "tunnel", uuid);
 }
 function configPath(uuid) {
-  return join20(tunnelDir(uuid), "config.yml");
+  return join22(tunnelDir(uuid), "config.yml");
 }
 function adoptedMarker(uuid) {
-  return join20(tunnelDir(uuid), "adopted.json");
+  return join22(tunnelDir(uuid), "adopted.json");
 }
 function isAdopted(uuid) {
-  return existsSync18(adoptedMarker(uuid));
+  return existsSync19(adoptedMarker(uuid));
 }
 function readAdopted(uuid) {
   const p = adoptedMarker(uuid);
-  if (!existsSync18(p))
+  if (!existsSync19(p))
     return null;
   let marker;
   try {
-    marker = JSON.parse(readFileSync16(p, "utf8"));
+    marker = JSON.parse(readFileSync17(p, "utf8"));
   } catch {
     marker = {};
   }
@@ -11032,14 +11406,14 @@ function readAdopted(uuid) {
     return { uuid, name: marker.name, credFile: marker.credFile, reconstructed: false };
   }
   let name;
-  const stacksDir = join20(hestiaHome(), "stacks");
-  if (existsSync18(stacksDir)) {
-    for (const project of readdirSync6(stacksDir)) {
-      const sp = join20(stacksDir, project, "stack.json");
-      if (!existsSync18(sp))
+  const stacksDir = join22(hestiaHome(), "stacks");
+  if (existsSync19(stacksDir)) {
+    for (const project of readdirSync7(stacksDir)) {
+      const sp = join22(stacksDir, project, "stack.json");
+      if (!existsSync19(sp))
         continue;
       try {
-        const record = parseStackRecord(readFileSync16(sp, "utf8"), sp);
+        const record = parseStackRecord(readFileSync17(sp, "utf8"), sp);
         if (record.tunnel?.uuid === uuid) {
           name = record.tunnel.name;
           break;
@@ -11055,24 +11429,24 @@ function readAdopted(uuid) {
   };
 }
 function listAdopted() {
-  const root = join20(hestiaHome(), "tunnel");
-  if (!existsSync18(root))
+  const root = join22(hestiaHome(), "tunnel");
+  if (!existsSync19(root))
     return [];
-  return readdirSync6(root).filter((uuid) => isAdopted(uuid));
+  return readdirSync7(root).filter((uuid) => isAdopted(uuid));
 }
 function collectDynamicRules(uuid) {
-  const stacksDir = join20(hestiaHome(), "stacks");
+  const stacksDir = join22(hestiaHome(), "stacks");
   const rules = [];
   const dropped = [];
-  if (!existsSync18(stacksDir))
+  if (!existsSync19(stacksDir))
     return { rules, dropped };
-  for (const project of readdirSync6(stacksDir)) {
-    const p = join20(stacksDir, project, "stack.json");
-    if (!existsSync18(p))
+  for (const project of readdirSync7(stacksDir)) {
+    const p = join22(stacksDir, project, "stack.json");
+    if (!existsSync19(p))
       continue;
     let record;
     try {
-      record = parseStackRecord(readFileSync16(p, "utf8"), p);
+      record = parseStackRecord(readFileSync17(p, "utf8"), p);
     } catch {
       continue;
     }
@@ -11101,20 +11475,26 @@ async function reconcileTunnel(ref, opts) {
     for (const d of dropped) {
       warnings.push(`exposure ${d.hostname} dropped \u2014 service "${d.service}" of ` + `${d.project} is not running (hostname now 404s)`);
     }
+    const sharedRules = listSharedHostnames().filter((record) => record.tunnelUuid === ref.uuid).map((record) => ({ name: record.name, hostname: record.hostname }));
     const cfgPath = configPath(ref.uuid);
     const nextConfig = generateMergedConfig({
       uuid: ref.uuid,
       credFile: ref.credFile,
       baseRules,
-      dynamicRules: rules
+      dynamicRules: rules,
+      sharedRules
     });
     const pf = readPidfile(dir, CONNECTOR);
     const live = pf !== null && isLive(pf);
-    const currentConfig = existsSync18(cfgPath) ? readFileSync16(cfgPath, "utf8") : null;
+    const { reapedGroups } = await reapOrphanConnectors(ref.uuid, live ? pf : undefined);
+    if (reapedGroups > 0) {
+      warnings.push(`reaped ${reapedGroups} orphan hestia connector process group(s) for this tunnel`);
+    }
+    const currentConfig = existsSync19(cfgPath) ? readFileSync17(cfgPath, "utf8") : null;
     if (live && currentConfig === nextConfig) {
       return { restarted: false, metricsPort: pf.port, ready: true, warnings };
     }
-    if (baseRules.length === 0 && rules.length === 0) {
+    if (baseRules.length === 0 && rules.length === 0 && sharedRules.length === 0) {
       if (pf !== null) {
         await stopProcTree(pf);
         removePidfile(dir, CONNECTOR);
@@ -11185,6 +11565,8 @@ var init_registry = __esm(() => {
   init_pidfile();
   init_shutdown();
   init_ingress();
+  init_shared();
+  init_orphans();
   init_atomic_json_file();
 });
 
@@ -11623,10 +12005,230 @@ var init_stream = __esm(() => {
   init_tail();
 });
 
+// packages/engine/src/daemon/shared-arbiter.ts
+class SharedArbiter {
+  onChange;
+  #mutex = Promise.resolve();
+  #polls = new Map;
+  constructor(onChange) {
+    this.onChange = onChange;
+  }
+  #locked(fn) {
+    const next = this.#mutex.then(fn, fn);
+    this.#mutex = next.catch(() => {});
+    return next;
+  }
+  async#notify() {
+    try {
+      await this.onChange?.();
+    } catch {}
+  }
+  #result(record, granted) {
+    return { granted, holder: record.holder, queued: [...record.queue ?? []] };
+  }
+  #wake(name, project, result) {
+    const key = `${name}\x00${project}`;
+    for (const poll of this.#polls.get(key) ?? []) {
+      clearTimeout(poll.timer);
+      poll.resolve(result);
+    }
+    this.#polls.delete(key);
+  }
+  #grantNext(record) {
+    const queue = [...record.queue ?? []];
+    for (;; ) {
+      const head = queue.shift();
+      if (head === undefined) {
+        const next = { ...record, queue: [] };
+        delete next.holder;
+        return next;
+      }
+      if (readMirrorState(head.project) === null)
+        continue;
+      return {
+        ...record,
+        holder: {
+          project: head.project,
+          worktree: head.worktree,
+          service: record.service,
+          at: new Date().toISOString()
+        },
+        queue
+      };
+    }
+  }
+  async request(name, requester, waitMs) {
+    const outcome = await this.#locked(async () => {
+      let granted = false;
+      const updated = await updateSharedHostname(name, (record) => {
+        if (record.holder?.project === requester.project) {
+          granted = true;
+          return {
+            ...record,
+            holder: { ...record.holder, worktree: requester.worktree },
+            queue: (record.queue ?? []).filter((waiter) => waiter.project !== requester.project)
+          };
+        }
+        if (record.holder === undefined) {
+          granted = true;
+          return {
+            ...record,
+            holder: {
+              project: requester.project,
+              worktree: requester.worktree,
+              service: record.service,
+              at: new Date().toISOString()
+            },
+            queue: (record.queue ?? []).filter((waiter) => waiter.project !== requester.project)
+          };
+        }
+        const queue = [...record.queue ?? []];
+        const existing = queue.find((waiter) => waiter.project === requester.project);
+        if (existing !== undefined)
+          existing.worktree = requester.worktree;
+        else
+          queue.push({ project: requester.project, worktree: requester.worktree, at: new Date().toISOString() });
+        return { ...record, queue };
+      });
+      if (updated === null) {
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      }
+      return { granted, record: updated };
+    });
+    if (outcome.granted) {
+      await this.#notify();
+      return this.#result(outcome.record, true);
+    }
+    if (waitMs <= 0)
+      return this.#result(outcome.record, false);
+    return new Promise((resolve2) => {
+      const key = `${name}\x00${requester.project}`;
+      const polls = this.#polls.get(key) ?? [];
+      const poll = {
+        resolve: resolve2,
+        timer: setTimeout(() => {
+          const remaining = (this.#polls.get(key) ?? []).filter((candidate) => candidate !== poll);
+          if (remaining.length === 0)
+            this.#polls.delete(key);
+          else
+            this.#polls.set(key, remaining);
+          const record = readSharedHostname(name);
+          resolve2(record === null ? { granted: false, queued: [] } : this.#result(record, record.holder?.project === requester.project));
+        }, waitMs)
+      };
+      polls.push(poll);
+      this.#polls.set(key, polls);
+    });
+  }
+  async cancel(name, project) {
+    const record = await this.#locked(() => updateSharedHostname(name, (current) => ({
+      ...current,
+      queue: (current.queue ?? []).filter((waiter) => waiter.project !== project)
+    })));
+    if (record === null)
+      throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+    this.#wake(name, project, this.#result(record, false));
+    return this.#result(record, false);
+  }
+  #assertHolder(record, project, verb) {
+    if (record.holder?.project !== project) {
+      throw new HestiaError("shared-not-holder", record.holder === undefined ? `cannot ${verb} "${record.name}" \u2014 it is unclaimed` : `cannot ${verb} "${record.name}" \u2014 it is held by ${record.holder.project}, not ${project}`);
+    }
+  }
+  async allow(name, callerProject) {
+    const record = await this.#transfer(name, callerProject, "allow");
+    return this.#result(record, false);
+  }
+  async deny(name, callerProject) {
+    const record = await this.#locked(async () => {
+      const current = readSharedHostname(name);
+      if (current === null)
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      this.#assertHolder(current, callerProject, "deny");
+      const updated = await updateSharedHostname(name, (candidate) => {
+        const queue = [...candidate.queue ?? []];
+        if (queue.length > 0)
+          queue[0] = { ...queue[0], denied: true };
+        return { ...candidate, queue };
+      });
+      return updated;
+    });
+    return this.#result(record, false);
+  }
+  async release(name, callerProject) {
+    const record = await this.#transfer(name, callerProject, "release");
+    return this.#result(record, false);
+  }
+  async#transfer(name, callerProject, verb) {
+    const record = await this.#locked(async () => {
+      const current = readSharedHostname(name);
+      if (current === null)
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      this.#assertHolder(current, callerProject, verb);
+      return await updateSharedHostname(name, (candidate) => this.#grantNext(candidate));
+    });
+    if (record.holder !== undefined) {
+      this.#wake(record.name, record.holder.project, this.#result(record, true));
+    }
+    await this.#notify();
+    return record;
+  }
+  async releaseProject(project, service) {
+    const held = listSharedHostnames().filter((record) => record.holder?.project === project && (service === undefined || record.service === service));
+    let changed = false;
+    for (const record of held) {
+      const updated = await this.#locked(async () => {
+        const current = readSharedHostname(record.name);
+        if (current?.holder?.project !== project)
+          return null;
+        return await updateSharedHostname(record.name, (candidate) => this.#grantNext(candidate));
+      });
+      if (updated === null || updated === undefined)
+        continue;
+      changed = true;
+      if (updated.holder !== undefined) {
+        this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
+      }
+    }
+    if (changed)
+      await this.#notify();
+  }
+  async sweep(occupied) {
+    let changed = false;
+    for (const record of listSharedHostnames()) {
+      const holderDead = record.holder !== undefined && !occupied.has(record.holder.project) && readMirrorState(record.holder.project) === null;
+      const deadWaiters = (record.queue ?? []).filter((waiter) => readMirrorState(waiter.project) === null);
+      if (!holderDead && deadWaiters.length === 0)
+        continue;
+      const updated = await this.#locked(() => updateSharedHostname(record.name, (candidate) => {
+        const pruned = {
+          ...candidate,
+          queue: (candidate.queue ?? []).filter((waiter) => readMirrorState(waiter.project) !== null)
+        };
+        const currentHolderDead = pruned.holder !== undefined && !occupied.has(pruned.holder.project) && readMirrorState(pruned.holder.project) === null;
+        return currentHolderDead ? this.#grantNext(pruned) : pruned;
+      }));
+      if (updated === null)
+        continue;
+      changed = true;
+      if (updated.holder !== undefined && updated.holder.project !== record.holder?.project) {
+        this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
+      }
+    }
+    if (changed)
+      await this.#notify();
+  }
+}
+var init_shared_arbiter = __esm(() => {
+  init_src();
+  init_state();
+  init_shared();
+});
+
 // packages/engine/src/doctor.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
 import { execFile as execFile9 } from "child_process";
-import { dirname as dirname6, join as join21 } from "path";
+import { dirname as dirname6, join as join23 } from "path";
 function row(check, level, detail) {
   return { check, level, detail };
 }
@@ -11667,8 +12269,8 @@ async function envChecks(ctx) {
   }
   if (ctx !== null) {
     const ignored = await exec("git", ["-C", ctx.worktreeRoot, "check-ignore", "-q", ".hestia/"]);
-    rows.push(ignored.ok ? row("state-ignore", "ok", ".hestia/ is ignored") : row("state-ignore", "error", `add the exact line ".hestia/" to ${join21(ctx.worktreeRoot, ".gitignore")}`));
-    const schema = existsSync19(join21(ctx.worktreeRoot, ".env.schema"));
+    rows.push(ignored.ok ? row("state-ignore", "ok", ".hestia/ is ignored") : row("state-ignore", "error", `add the exact line ".hestia/" to ${join23(ctx.worktreeRoot, ".gitignore")}`));
+    const schema = existsSync20(join23(ctx.worktreeRoot, ".env.schema"));
     if (schema) {
       rows.push(detectVarlock(ctx.worktreeRoot) !== null ? row("varlock", "ok", "local varlock found \u2014 worker env composition active") : row("varlock", "warn", ".env.schema present but no local varlock (bun install?)"));
     }
@@ -11677,7 +12279,7 @@ async function envChecks(ctx) {
       const missing = workers.filter((w) => {
         let dir = dirname6(w.configPath);
         for (;; ) {
-          if (existsSync19(join21(dir, "node_modules", ".bin", "wrangler")))
+          if (existsSync20(join23(dir, "node_modules", ".bin", "wrangler")))
             return false;
           if (dir === ctx.worktreeRoot || dirname6(dir) === dir)
             return true;
@@ -11736,10 +12338,10 @@ async function stateChecks(ctx) {
       rows.push(row(`exposure:${exp.service}`, "error", `ingress rule points at port ${exp.originPort} but the service owns ` + `${publishedPort} \u2014 a recycled port serves ANOTHER worktree; ` + `run any hestia command to resync, this should not persist`));
     }
   }
-  const lockPath2 = join21(hestiaDir(worktreeRoot), "lock");
-  if (existsSync19(lockPath2)) {
+  const lockPath2 = join23(hestiaDir(worktreeRoot), "lock");
+  if (existsSync20(lockPath2)) {
     try {
-      const holder = JSON.parse(readFileSync17(lockPath2, "utf8"));
+      const holder = JSON.parse(readFileSync18(lockPath2, "utf8"));
       if (!isLive(holder)) {
         rows.push(row("lock", "warn", "stale worktree lock (dead holder) \u2014 auto-broken on next command"));
       }
@@ -11747,25 +12349,25 @@ async function stateChecks(ctx) {
       rows.push(row("lock", "warn", "unreadable worktree lock file"));
     }
   }
-  const mirror = join21(hestiaHome(), "stacks", record.project, "stack.json");
-  if (!existsSync19(mirror)) {
+  const mirror = join23(hestiaHome(), "stacks", record.project, "stack.json");
+  if (!existsSync20(mirror)) {
     rows.push(row("mirror", "warn", "no ~/.hestia mirror \u2014 `down --project` would not work after worktree deletion"));
   }
   return rows;
 }
 async function machineChecks() {
   const rows = [];
-  const stacksDir = join21(hestiaHome(), "stacks");
+  const stacksDir = join23(hestiaHome(), "stacks");
   const mirrored = new Set;
-  if (existsSync19(stacksDir)) {
-    for (const project of readdirSync7(stacksDir)) {
-      const p = join21(stacksDir, project, "stack.json");
-      if (!existsSync19(p))
+  if (existsSync20(stacksDir)) {
+    for (const project of readdirSync8(stacksDir)) {
+      const p = join23(stacksDir, project, "stack.json");
+      if (!existsSync20(p))
         continue;
       mirrored.add(project);
       try {
-        const rec = parseStackRecord(readFileSync17(p, "utf8"), p);
-        if (!existsSync19(rec.worktree)) {
+        const rec = parseStackRecord(readFileSync18(p, "utf8"), p);
+        if (!existsSync20(rec.worktree)) {
           rows.push(row(`orphan-mirror:${project}`, "warn", `worktree ${rec.worktree} is gone \u2014 \`hestia down --project ${project}\` to clean up`));
         }
       } catch {
@@ -11812,17 +12414,44 @@ async function tunnelChecks() {
     } catch {
       connectors = null;
     }
+    const local = listLocalHestiaConnectors(uuid);
+    const localOrphans = live && pf !== null ? local.filter((p) => p.pgid !== pf.pgid && p.pid !== pf.pid) : local;
+    if (localOrphans.length > 0) {
+      rows.push(row(`${label}:local-orphans`, "error", `${localOrphans.length} untracked hestia connector(s) still running ` + `(pids ${localOrphans.map((p) => p.pid).join(", ")}) \u2014 the daemon sweep ` + `or next hestia command reaps them; do not start another cloudflared`));
+    }
     if (connectors === null) {
       rows.push(row(`${label}:connectors`, "unknown", "cloudflare unreachable \u2014 cannot count connectors"));
     } else {
       const expected = live ? 1 : 0;
       if (connectors > expected) {
-        rows.push(row(`${label}:connectors`, "error", `${connectors} connector(s) registered but hestia runs ${expected} \u2014 a foreign ` + `replica cross-wires worktrees; stop the other cloudflared`));
+        const detail = localOrphans.length > 0 ? `${connectors} connector(s) registered but hestia runs ${expected} \u2014 ` + `${localOrphans.length} are local hestia-owned orphans (auto-reaped on next sweep); ` + `any remainder is a foreign replica` : `${connectors} connector(s) registered but hestia runs ${expected} \u2014 a foreign ` + `replica cross-wires worktrees; stop the other cloudflared (only processes whose ` + `argv lacks ~/.hestia/tunnel/<uuid>/ are truly foreign)`;
+        rows.push(row(`${label}:connectors`, "error", detail));
       }
     }
   }
   return rows;
 }
+async function sharedHostnameChecks() {
+  const rows = [];
+  for (const shared of listSharedHostnames()) {
+    const label = `shared:${shared.name}`;
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    const pending = (shared.queue ?? []).length;
+    const queueSuffix = pending > 0 ? ` (${pending} queued)` : "";
+    if (shared.holder === undefined) {
+      rows.push(row(label, "warn", `${url} unclaimed \u2014 requests answer 503 until \`hestia claim ${shared.name}\`${queueSuffix}`));
+      continue;
+    }
+    const mirror = readMirrorState(shared.holder.project);
+    if (mirror === null) {
+      rows.push(row(label, "warn", `held by ${shared.holder.project} but its stack mirror is gone \u2014 the daemon sweep auto-releases it${queueSuffix}`));
+      continue;
+    }
+    const endpoint = mirror.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+    rows.push(endpoint === undefined ? row(label, "warn", `held by ${shared.holder.project} but endpoint "${shared.service}" is not running \u2014 requests answer 503${queueSuffix}`) : row(label, "ok", `${url} \u2192 ${shared.holder.project}${queueSuffix}`));
+  }
+  return rows;
+}
 async function daemonChecks() {
   const rows = [];
   const j = readDaemonJson();
@@ -11837,11 +12466,11 @@ async function daemonChecks() {
       rows.push(row("daemon-config", "warn", w));
   }
   const plist = plistPath();
-  if (existsSync19(plist)) {
-    const content = readFileSync17(plist, "utf8");
+  if (existsSync20(plist)) {
+    const content = readFileSync18(plist, "utf8");
     const args = [...content.matchAll(/<string>([^<]+)<\/string>/g)].map((m) => m[1]);
     const paths = args.filter((a) => a.startsWith("/") && !a.includes(":"));
-    const missing = paths.filter((p) => !existsSync19(p));
+    const missing = paths.filter((p) => !existsSync20(p));
     rows.push(missing.length === 0 ? row("launchd", "ok", `installed (${plist})`) : row("launchd", "error", `plist references missing paths: ${missing.join(", ")} \u2014 re-run \`hestia daemon install\``));
   }
   return rows;
@@ -11880,6 +12509,7 @@ async function doctor(cwd) {
     ctx !== null ? bounded("state", () => stateChecks(ctx)) : Promise.resolve([]),
     bounded("machine", () => machineChecks()),
     bounded("tunnel", () => tunnelChecks()),
+    bounded("shared", () => sharedHostnameChecks()),
     bounded("daemon", () => daemonChecks()),
     bounded("local-router", () => localRouterChecks())
   ]);
@@ -11891,11 +12521,13 @@ var init_doctor = __esm(() => {
   init_git();
   init_config();
   init_state();
+  init_shared();
   init_pidfile();
   init_resolver();
   init_discover();
   init_registry();
   init_cloudflared();
+  init_orphans();
   init_client();
   init_routes();
   init_launchd();
@@ -11907,8 +12539,8 @@ var init_doctor = __esm(() => {
 // packages/engine/src/daemon/fleet-monitor.ts
 import { execFile as execFile10 } from "child_process";
 import { promisify as promisify8 } from "util";
-import { existsSync as existsSync20, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync19, readdirSync as readdirSync9 } from "fs";
+import { join as join24 } from "path";
 
 class LatestFleetChannel {
   #pending;
@@ -11951,13 +12583,13 @@ class LatestFleetChannel {
 function readManagedMirrors() {
   const records = [];
   const warnings = [];
-  const stacksDirectory = join22(hestiaHome(), "stacks");
-  if (!existsSync20(stacksDirectory))
+  const stacksDirectory = join24(hestiaHome(), "stacks");
+  if (!existsSync21(stacksDirectory))
     return { records, warnings };
-  for (const project of readdirSync8(stacksDirectory).sort()) {
-    const path = join22(stacksDirectory, project, "stack.json");
+  for (const project of readdirSync9(stacksDirectory).sort()) {
+    const path = join24(stacksDirectory, project, "stack.json");
     try {
-      const source = readFileSync18(path);
+      const source = readFileSync19(path);
       if (source.byteLength > MAX_MIRROR_BYTES2) {
         warnings.push(`Fleet mirror too large for ${project}`);
         continue;
@@ -11977,7 +12609,7 @@ function readManagedMirrors() {
 async function attributeLegacyRepoId(record) {
   if (record.repoId !== undefined)
     return record.repoId;
-  if (!existsSync20(record.worktree))
+  if (!existsSync21(record.worktree))
     return null;
   const info = await getRepoInfo(record.worktree);
   if (projectName(info.repoId, info.repo, info.branch, info.worktreeRoot) !== record.project)
@@ -12083,6 +12715,25 @@ function reservationIdentity(reservation, records) {
     worktree: record.worktree
   };
 }
+function collectFleetShared(repoProjects) {
+  return listSharedHostnames().map((record) => ({
+    name: record.name,
+    hostname: record.hostname,
+    ...record.path === undefined ? {} : { path: record.path },
+    url: `https://${record.hostname}${record.path ?? ""}`,
+    holder: record.holder === undefined ? undefined : {
+      project: record.holder.project,
+      worktree: record.holder.worktree,
+      mine: repoProjects.has(record.holder.project)
+    },
+    queue: (record.queue ?? []).map((waiter) => ({
+      project: waiter.project,
+      worktree: waiter.worktree,
+      ...waiter.denied === true ? { denied: true } : {},
+      mine: repoProjects.has(waiter.project)
+    }))
+  })).sort((left, right) => left.name.localeCompare(right.name));
+}
 async function collectFleetSnapshot(repoId, admission) {
   const mirrorResult = readManagedMirrors();
   const machineConfig = readHestiaMachineConfig();
@@ -12178,6 +12829,7 @@ async function collectFleetSnapshot(repoId, admission) {
   const allRecordedProjects = new Set(attributed.map((record) => record.project));
   const unbackedReservations = reservations.filter((reservation) => !allRecordedProjects.has(reservation.project));
   const { maxStacks, warnings: capWarnings } = resolveMaxStacks();
+  const repoProjects = new Set(attributed.filter((record) => record.repoId === repoId).map((record) => record.project));
   return {
     repoId,
     observedAt: new Date().toISOString(),
@@ -12188,6 +12840,7 @@ async function collectFleetSnapshot(repoId, admission) {
       queued: queued.length
     },
     stacks: stackViews,
+    shared: collectFleetShared(repoProjects),
     warnings: [...capWarnings, ...warnings].sort()
   };
 }
@@ -12196,6 +12849,7 @@ function semanticFleetSnapshot(snapshot) {
     repoId: snapshot.repoId,
     capacity: snapshot.capacity,
     stacks: snapshot.stacks,
+    shared: snapshot.shared,
     warnings: snapshot.warnings
   });
 }
@@ -12307,6 +12961,7 @@ var init_fleet_monitor = __esm(() => {
   init_ports();
   init_pidfile();
   init_state();
+  init_shared();
   init_router_config();
   init_local_http_router();
   init_portless_adapter();
@@ -12417,10 +13072,10 @@ var init_init_config = __esm(() => {
 });
 
 // packages/engine/src/index.ts
-import { existsSync as existsSync21, rmSync as rmSync9 } from "fs";
+import { existsSync as existsSync22, rmSync as rmSync10 } from "fs";
 import { execFile as execFile11 } from "child_process";
 import { promisify as promisify9 } from "util";
-import { join as join23, resolve as resolve2 } from "path";
+import { join as join25, resolve as resolve2 } from "path";
 import { createHash as createHash7 } from "crypto";
 import { resolve4, resolve6, resolveCname } from "dns/promises";
 function composeUnsupported(message) {
@@ -12530,7 +13185,7 @@ async function assertHestiaStateIgnored(worktreeRoot) {
   try {
     await pexec9("git", ["-C", worktreeRoot, "check-ignore", "-q", ".hestia/"], { timeout: 5000 });
   } catch {
-    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join23(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join23(worktreeRoot, ".gitignore") });
+    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join25(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join25(worktreeRoot, ".gitignore") });
   }
 }
 async function prepareCompose(worktreeRoot, project, repo, branch, opts, configuredBaseFile) {
@@ -12547,7 +13202,7 @@ async function prepareCompose(worktreeRoot, project, repo, branch, opts, configu
     services
   });
   ensureDir(hestiaDir(worktreeRoot));
-  const overridePath = join23(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+  const overridePath = join25(hestiaDir(worktreeRoot), OVERRIDE_FILE);
   writeAtomicTextFile(overridePath, yaml);
   return {
     ctx: {
@@ -12580,7 +13235,7 @@ function writeDockerfileComposeModel(worktreeRoot, workloads, conventionalCompos
     ...conventionalComposeFile === undefined ? {} : { include: [{ path: conventionalComposeFile }] },
     services
   };
-  const path = join23(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
+  const path = join25(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
   writeAtomicTextFile(path, $stringify(model));
   return path;
 }
@@ -12600,7 +13255,7 @@ function freshRecord(project, repoId, repo, branch, worktree) {
   };
 }
 function assertCurrentStackIdentity(record, current) {
-  const path = join23(hestiaDir(current.worktreeRoot), "stack.json");
+  const path = join25(hestiaDir(current.worktreeRoot), "stack.json");
   assertMutableStackRecord(record, path);
   const matches = record.repoId === current.repoId && record.repo === current.repo && record.branch === current.branch && resolve2(record.worktree) === resolve2(current.worktreeRoot) && record.project === projectName(current.repoId, current.repo, current.branch, current.worktreeRoot);
   if (!matches) {
@@ -12735,6 +13390,27 @@ function applyLocalRouteProjection(record) {
     record.env[directUrlKey(endpoint.name)] = endpoint.url;
     record.env[localUrlKey(endpoint.name)] = endpoint.localUrl;
   }
+  syncSharedProjection(record);
+}
+function syncSharedProjection(record) {
+  for (const shared of listSharedHostnames()) {
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    if (shared.holder?.project === record.project) {
+      const endpoint = record.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+      if (endpoint !== undefined) {
+        endpoint.publicUrl = url;
+        record.env[urlKey(shared.service)] = url;
+      }
+      continue;
+    }
+    for (const endpoint of record.endpoints) {
+      if (endpoint.publicUrl === url)
+        delete endpoint.publicUrl;
+    }
+    if (record.env[urlKey(shared.service)] === url) {
+      delete record.env[urlKey(shared.service)];
+    }
+  }
 }
 function syncExposures(record) {
   const t = record.tunnel;
@@ -12758,7 +13434,7 @@ function matchesExpectedStack(record, expected) {
   return record !== null && (record.repoId === undefined || record.repoId === expected.repoId) && record.worktree === expected.worktree && record.createdAt === expected.createdAt;
 }
 function projectMutationRoot(project) {
-  return join23(hestiaHome(), "project-locks", project);
+  return join25(hestiaHome(), "project-locks", project);
 }
 async function assertNamedTunnelDns(hostname, tunnelUuid) {
   const expected = `${tunnelUuid}.cfargotunnel.com`;
@@ -13164,6 +13840,7 @@ class ComposeEngine {
     const { repo, repoId, branch, worktreeRoot } = currentIdentity;
     let tunnel;
     let tunnelDirty = false;
+    const stoppedAliases = [];
     const project = readState(worktreeRoot)?.project ?? projectName(repoId, repo, branch, worktreeRoot);
     await withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
       const record = readState(worktreeRoot);
@@ -13172,6 +13849,11 @@ class ComposeEngine {
         if (record.services.some((service) => service.name === name && service.backend === "docker")) {
           throw new HestiaError("backend-not-stoppable", `Docker workload ${name} cannot be stopped individually; use hestia down`);
         }
+        for (const endpoint of record.endpoints) {
+          if ((endpoint.workload ?? endpoint.name) === name) {
+            stoppedAliases.push(endpoint.alias ?? endpoint.name);
+          }
+        }
       }
       const pf = readPidfile(worktreeRoot, name);
       if (pf !== null) {
@@ -13217,6 +13899,9 @@ class ComposeEngine {
         }
       }
     }));
+    for (const alias of new Set(stoppedAliases)) {
+      await this.#releaseSharedHoldings(project, alias);
+    }
     if (tunnelDirty)
       await this.#reconcileAdopted(tunnel);
     await this.#refreshLocalRoutes();
@@ -13352,12 +14037,12 @@ class ComposeEngine {
         await stopProcTree(pf);
         removePidfile(worktreeRoot, pf.name);
       }
-      rmSync9(privateRegistryDir(worktreeRoot), { recursive: true, force: true });
+      rmSync10(privateRegistryDir(worktreeRoot), { recursive: true, force: true });
       const composeFile = record?.composeFile ?? tryLoadConfig(worktreeRoot)?.composeFile;
       if (composeFile !== undefined) {
         const project2 = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
-        const overrideFile = record?.overrideFile ?? join23(hestiaDir(worktreeRoot), OVERRIDE_FILE);
-        if (existsSync21(overrideFile)) {
+        const overrideFile = record?.overrideFile ?? join25(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+        if (existsSync22(overrideFile)) {
           await composeDown({ project: project2, baseFile: composeFile, overrideFile, cwd: worktreeRoot }, opts?.destroy ?? false);
         } else if (record?.composeFile !== undefined) {
           const rest = ["compose", "-p", project2, "down", "--remove-orphans"];
@@ -13369,6 +14054,7 @@ class ComposeEngine {
       const project = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
       clearState(worktreeRoot, project);
       await this.#releaseAdmission(project);
+      await this.#releaseSharedHoldings(project);
     }));
     await this.#reconcileAdopted(tunnel);
     await this.#refreshLocalRoutes();
@@ -13378,6 +14064,11 @@ class ComposeEngine {
     if (j !== null)
       await releaseSlot(j.port, project);
   }
+  async#releaseSharedHoldings(project, service) {
+    const j = readDaemonJson();
+    if (j !== null)
+      await releaseSharedForProject(j.port, project, service);
+  }
   async downProject(project, opts) {
     if (!/^[a-z0-9][a-z0-9-]{0,99}$/.test(project)) {
       throw new HestiaError("usage", `invalid project name ${JSON.stringify(project)}`);
@@ -13420,9 +14111,9 @@ class ComposeEngine {
           throw new HestiaError("compose-failed", `docker compose -p ${project} down failed: ${err.message}`);
         }
       }
-      rmSync9(mirrorDir(project), { recursive: true, force: true });
+      rmSync10(mirrorDir(project), { recursive: true, force: true });
     };
-    if (record !== null && existsSync21(record.worktree)) {
+    if (record !== null && existsSync22(record.worktree)) {
       const info = await getRepoInfo(record.worktree);
       const identityMatches = resolve2(info.worktreeRoot) === resolve2(record.worktree) && (record.repoId === undefined ? record.repo === info.repo : record.repoId === info.repoId);
       const localRecord = readState(record.worktree);
@@ -13443,6 +14134,7 @@ class ComposeEngine {
           return;
         }
         await this.#releaseAdmission(project);
+        await this.#releaseSharedHoldings(project);
         await this.#reconcileAdopted(record.tunnel);
         await this.#refreshLocalRoutes();
         return;
@@ -13451,6 +14143,7 @@ class ComposeEngine {
     const projectLockRoot = projectMutationRoot(project);
     await withLock(projectLockRoot, teardownFromMirror);
     await this.#releaseAdmission(project);
+    await this.#releaseSharedHoldings(project);
     await this.#reconcileAdopted(record?.tunnel);
     await this.#refreshLocalRoutes();
   }
@@ -13469,11 +14162,100 @@ class ComposeEngine {
     }
     await ensureDaemon();
     await this.#refreshLocalRoutes(true);
+    if (opts?.shared !== undefined) {
+      if (tunnelName === undefined) {
+        throw new HestiaError("shared-requires-named-tunnel", "shared hostnames need an adopted named tunnel (stable DNS is the point) \u2014 pass --tunnel <name>");
+      }
+      return this.#exposeShared(worktreeRoot, services, tunnelName, opts);
+    }
     if (tunnelName === undefined) {
       return this.#exposeQuick(worktreeRoot, services, opts);
     }
     return this.#exposeNamed(worktreeRoot, services, tunnelName, opts);
   }
+  async#exposeShared(worktreeRoot, services, tunnelName, opts) {
+    if (services.length !== 1) {
+      throw new HestiaError("usage", "--shared declares exactly one service per shared hostname");
+    }
+    const name = opts.shared;
+    assertSharedName(name);
+    const project = readState(worktreeRoot)?.project;
+    if (project === undefined) {
+      throw new HestiaError("service-not-found", "no stack in this worktree \u2014 `hestia up`/`run` something first");
+    }
+    const adopted = await adoptTunnel(tunnelName);
+    if (adopted.connections > 0 && !isAdopted(adopted.uuid) && !opts?.force) {
+      throw new HestiaError("tunnel-busy", `tunnel "${tunnelName}" already has ${adopted.connections} live edge ` + `connection(s) from a foreign connector \u2014 stop the other cloudflared first (hestia's ` + `connector serves your static hostnames too), or pass --force to ` + `accept nondeterministic routing`);
+    }
+    const preflightRecord = readState(worktreeRoot);
+    if (preflightRecord === null) {
+      throw new HestiaError("service-not-found", "stack disappeared while preparing the shared hostname");
+    }
+    const baseRules = importBaseRules(adopted.uuid, tunnelName);
+    const zoneHint = opts?.zone ?? preflightRecord.tunnel?.zone ?? inferZone(baseRules);
+    let hostname;
+    let zone;
+    if (opts?.hostname !== undefined) {
+      hostname = opts.hostname.toLowerCase();
+      assertSharedHostnameFqdn(hostname);
+      zone = zoneOf(hostname) ?? zoneHint ?? hostname;
+    } else {
+      if (zoneHint === undefined) {
+        throw new HestiaError("usage", "cannot infer a zone from the tunnel's existing rules \u2014 pass --zone or an explicit --hostname");
+      }
+      zone = zoneHint;
+      hostname = `${name}.${zone}`;
+    }
+    const path = normalizeSharedPath(opts?.path);
+    const selection = resolveEndpointSelection(preflightRecord, services[0]);
+    if (selection.endpoint.kind !== undefined && selection.endpoint.kind !== "http") {
+      throw new HestiaError("usage", `public tunnels require an HTTP endpoint; ${services[0]} is ${selection.endpoint.kind}`);
+    }
+    const alias = selection.endpoint.alias ?? selection.endpoint.name;
+    if (baseRules.some((rule) => rule.hostname === hostname)) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} is already claimed by the user's static rules`);
+    }
+    const dynamicConflict = collectDynamicRules(adopted.uuid).rules.find((rule) => rule.hostname === hostname);
+    if (dynamicConflict !== undefined) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} is already claimed by project ${dynamicConflict.project}`);
+    }
+    await assertNamedTunnelDns(hostname, adopted.uuid);
+    await declareSharedHostname({
+      name,
+      hostname,
+      path,
+      tunnelUuid: adopted.uuid,
+      zone,
+      service: alias
+    });
+    const handle = await ensureDaemon();
+    const claim = await sharedVerb(handle.port, "claim", {
+      name,
+      project,
+      worktree: worktreeRoot,
+      waitMs: 0
+    });
+    if (!claim.granted) {
+      throw new HestiaError("shared-held", `shared hostname "${name}" is held by ${claim.holder?.project ?? "another stack"} ` + `(${claim.queued.length} queued) \u2014 \`hestia claim ${name} --wait\` to queue for it`);
+    }
+    const outcome = await reconcileTunnel({ name: tunnelName, uuid: adopted.uuid, credFile: adopted.credFile }, { force: opts?.force, readyTimeoutMs: opts?.readyTimeoutMs });
+    for (const w of outcome.warnings)
+      process.stderr.write(`warning: ${w}
+`);
+    const final = await withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
+      const record = readState(worktreeRoot);
+      if (record === null) {
+        throw new HestiaError("service-not-found", "stack disappeared while exposing (concurrent down?)");
+      }
+      applyLocalRouteProjection(record);
+      writeState(worktreeRoot, record);
+      return record;
+    }));
+    if (outcome.error !== undefined)
+      throw outcome.error;
+    await this.#refreshLocalRoutes(true);
+    return final;
+  }
   async#exposeQuick(worktreeRoot, services, opts) {
     const project = readState(worktreeRoot)?.project;
     if (project === undefined) {
@@ -13492,7 +14274,7 @@ class ComposeEngine {
         const alias = selection.endpoint.alias ?? selection.endpoint.name;
         const authority = internalEndpointAuthority(record.project, alias);
         const name = `aux-quick-${createHash7("sha256").update(alias).digest("hex").slice(0, 10)}`;
-        const quickCfg = join23(hestiaDir(worktreeRoot), `quick-${name}.yml`);
+        const quickCfg = join25(hestiaDir(worktreeRoot), `quick-${name}.yml`);
         writeAtomicTextFile(quickCfg, `ingress:
   - service: ${JSON.stringify(`unix:${publicGatewaySocketPath()}`)}
 ` + `    originRequest:
@@ -13684,6 +14466,80 @@ class ComposeEngine {
     await this.#refreshLocalRoutes(true);
     return final;
   }
+  async#sharedContext(cwd, name) {
+    assertSharedName(name);
+    const { worktreeRoot } = await getRepoInfo(cwd);
+    const record = readState(worktreeRoot);
+    if (record === null) {
+      throw new HestiaError("service-not-found", "no stack in this worktree \u2014 `hestia up`/`run` something first");
+    }
+    const shared = readSharedHostname(name);
+    if (shared === null) {
+      throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared \u2014 \`hestia expose <svc> --shared ${name}\` creates one`);
+    }
+    return { worktreeRoot, record, shared };
+  }
+  async#applySharedProjection(worktreeRoot, project) {
+    return withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
+      const record = readState(worktreeRoot);
+      if (record === null) {
+        throw new HestiaError("service-not-found", "stack disappeared during the shared-hostname transition");
+      }
+      applyLocalRouteProjection(record);
+      writeState(worktreeRoot, record);
+      return record;
+    }));
+  }
+  async claimShared(cwd, name, opts) {
+    const { worktreeRoot, record, shared } = await this.#sharedContext(cwd, name);
+    const endpoint = record.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+    if (endpoint === undefined) {
+      throw new HestiaError("service-not-found", `shared hostname "${name}" routes to endpoint alias "${shared.service}", which this ` + `stack does not expose \u2014 \`hestia up\`/\`run\` it first`);
+    }
+    if (endpoint.kind !== undefined && endpoint.kind !== "http") {
+      throw new HestiaError("usage", `shared hostnames require an HTTP endpoint; ${shared.service} is ${endpoint.kind}`);
+    }
+    const handle = await ensureDaemon();
+    const result = await sharedVerb(handle.port, "claim", {
+      name,
+      project: record.project,
+      worktree: worktreeRoot,
+      waitMs: opts?.waitMs ?? 0
+    });
+    if (!result.granted) {
+      const position = result.queued.findIndex((waiter) => waiter.project === record.project) + 1;
+      throw new HestiaError("shared-held", `shared hostname "${name}" is held by ${result.holder?.project ?? "another stack"}` + (position > 0 ? ` \u2014 queued durably at position ${position}/${result.queued.length}; the holder can ` + `\`hestia share allow ${name}\`, or re-run \`hestia claim ${name} --wait\` to keep waiting` : ""), { holder: result.holder, queued: result.queued });
+    }
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return { record: updated, result };
+  }
+  async releaseShared(cwd, name) {
+    const { worktreeRoot, record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "release", { name, project: record.project });
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return updated;
+  }
+  async cancelSharedClaim(cwd, name) {
+    const { record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "cancel", { name, project: record.project });
+  }
+  async allowShared(cwd, name) {
+    const { worktreeRoot, record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "allow", { name, project: record.project });
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return updated;
+  }
+  async denyShared(cwd, name) {
+    const { record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "deny", { name, project: record.project });
+  }
   async status(cwd) {
     const { worktreeRoot } = await getRepoInfo(cwd);
     const record = readState(worktreeRoot);
@@ -13810,11 +14666,14 @@ var init_src2 = __esm(() => {
   init_cloudflared();
   init_ingress();
   init_registry();
+  init_shared();
   init_ensure();
   init_client();
   init_stream();
   init_router_config();
   init_cli();
+  init_shared();
+  init_shared_arbiter();
   init_lock();
   init_supervisor();
   init_tail();
@@ -14003,6 +14862,18 @@ class DaemonFleetSource {
   diagnose(worktree) {
     return doctor(worktree);
   }
+  async claimShared(worktree, name) {
+    await engine.claimShared(worktree, name);
+  }
+  async allowShared(worktree, name) {
+    await engine.allowShared(worktree, name);
+  }
+  async denyShared(worktree, name) {
+    await engine.denyShared(worktree, name);
+  }
+  async releaseShared(worktree, name) {
+    await engine.releaseShared(worktree, name);
+  }
   down(stack) {
     if (stack.createdAt === undefined) {
       return Promise.reject(new Error(`stack ${stack.project} has no stable incarnation timestamp`));
@@ -14024,6 +14895,14 @@ var init_fleet_source = __esm(() => {
   init_src2();
 });
 
+// packages/tui/src/fleet-endpoints.ts
+function serviceEndpoints(service) {
+  return service.endpoints ?? (service.endpoint === undefined ? [] : [service.endpoint]);
+}
+function endpointReach(endpoint) {
+  return endpoint.localUrl ?? endpoint.publicUrl ?? endpoint.url ?? `${endpoint.host}:${endpoint.port}`;
+}
+
 // packages/tui/src/fleet-controller.ts
 function createFleetUiState() {
   return {
@@ -14036,6 +14915,8 @@ function createFleetUiState() {
     unseenLines: 0,
     helpOpen: false,
     doctorOpen: false,
+    sharedOpen: false,
+    sharedSelection: 0,
     downPending: false
   };
 }
@@ -14059,7 +14940,7 @@ function reconcileFleetSelection(previous, snapshot, preferredProject) {
   const previousIndex = snapshot.stacks.findIndex((stack2) => stack2.project === previous.project);
   const stack = snapshot.stacks.find((candidate) => candidate.project === previous.project) ?? snapshot.stacks.find((candidate) => candidate.project === preferredProject) ?? nearestItem(snapshot.stacks, previousIndex < 0 ? 0 : previousIndex) ?? snapshot.stacks[0];
   const service = stack.services.find((candidate) => candidate.name === previous.service) ?? stack.services[0];
-  const endpoints = service?.endpoints ?? (service?.endpoint === undefined ? [] : [service.endpoint]);
+  const endpoints = service === undefined ? [] : serviceEndpoints(service);
   const endpoint = endpoints.find((candidate) => candidate.name === previous.endpoint);
   return { project: stack.project, service: service?.name, endpoint: endpoint?.name };
 }
@@ -14147,7 +15028,7 @@ function reduceFleetUiState(state, action) {
     case "select-endpoint": {
       const stack = action.snapshot.stacks.find((candidate) => candidate.project === state.selection.project);
       const service = stack?.services.find((candidate) => candidate.name === action.service);
-      if (!service?.endpoints?.some((endpoint) => endpoint.name === action.endpoint))
+      if (service === undefined || !serviceEndpoints(service).some((endpoint) => endpoint.name === action.endpoint))
         return state;
       return {
         ...state,
@@ -14179,12 +15060,10 @@ function reduceFleetUiState(state, action) {
         logOffset: action.follow ? 0 : state.logOffset,
         unseenLines: action.follow ? 0 : state.unseenLines
       };
-    case "scroll-logs":
-      return {
-        ...state,
-        follow: action.delta > 0 ? state.follow : false,
-        logOffset: Math.max(0, state.logOffset - action.delta)
-      };
+    case "scroll-logs": {
+      const offset = Math.min(action.maxOffset ?? Number.MAX_SAFE_INTEGER, Math.max(0, state.logOffset - action.delta));
+      return action.delta > 0 && offset === 0 ? { ...state, follow: true, logOffset: 0, unseenLines: 0 } : { ...state, follow: action.delta > 0 ? state.follow : false, logOffset: offset };
+    }
     case "new-lines":
       return state.follow ? state : {
         ...state,
@@ -14195,6 +15074,14 @@ function reduceFleetUiState(state, action) {
       return { ...state, helpOpen: action.open };
     case "doctor":
       return { ...state, doctorOpen: action.open };
+    case "shared":
+      return { ...state, sharedOpen: action.open, sharedSelection: action.open ? 0 : state.sharedSelection };
+    case "move-shared": {
+      if (action.count <= 0)
+        return { ...state, sharedSelection: 0 };
+      const next = Math.max(0, Math.min(action.count - 1, state.sharedSelection + action.delta));
+      return { ...state, sharedSelection: next };
+    }
     case "confirm-down":
       return {
         ...state,
@@ -14204,11 +15091,24 @@ function reduceFleetUiState(state, action) {
       return { ...state, downPending: action.pending };
   }
 }
+var init_fleet_controller = () => {};
 
 // packages/tui/src/terminal-text.ts
+function collapseCarriageReturns(text) {
+  if (!text.includes("\r"))
+    return text;
+  return text.split(`
+`).map((line) => {
+    const parts = line.replace(/\r+$/, "").split("\r");
+    return parts[parts.length - 1] ?? "";
+  }).join(`
+`);
+}
 function sanitizeFleetTerminalText(text, preserveNewlines = false) {
+  const withoutEscapes = text.replace(ESCAPE_CONTROL_SEQUENCE, "").replace(C1_CONTROL_SEQUENCE, "");
+  const collapsed = collapseCarriageReturns(withoutEscapes);
   const controls = preserveNewlines ? /[\x00-\x08\x0b-\x1f\x7f-\x9f]/g : /[\x00-\x1f\x7f-\x9f]/g;
-  return text.replace(ESCAPE_CONTROL_SEQUENCE, "").replace(C1_CONTROL_SEQUENCE, "").replace(controls, "");
+  return collapsed.replace(controls, "");
 }
 var ESCAPE_CONTROL_SEQUENCE, C1_CONTROL_SEQUENCE;
 var init_terminal_text = __esm(() => {
@@ -14216,24 +15116,6 @@ var init_terminal_text = __esm(() => {
   C1_CONTROL_SEQUENCE = /(?:[\x90\x98\x9d\x9e\x9f][\s\S]*?(?:\x07|\x9c)|\x9b[0-?]*[ -/]*[@-~])/g;
 });
 
-// packages/tui/src/fleet-theme.ts
-var fleetTheme;
-var init_fleet_theme = __esm(() => {
-  fleetTheme = {
-    background: "#0d1117",
-    panel: "#161b22",
-    panelAlt: "#21262d",
-    border: "#30363d",
-    text: "#c9d1d9",
-    muted: "#8b949e",
-    accent: "#58a6ff",
-    healthy: "#3fb950",
-    warning: "#d29922",
-    danger: "#f85149",
-    selected: "#1f6feb"
-  };
-});
-
 // node_modules/.bun/ansi-regex@6.2.2/node_modules/ansi-regex/index.js
 function ansiRegex({ onlyFirst = false } = {}) {
   const ST = "(?:\\u0007|\\u001B\\u005C|\\u009C)";
@@ -14416,229 +15298,623 @@ function padFleetText(text, width) {
   const fitted = fitFleetText(text, width);
   return fitted + " ".repeat(Math.max(0, width - stringWidth(fitted)));
 }
+function wrapFleetText(text, width, maxLines = 3) {
+  if (width <= 0)
+    return [];
+  if (text === "")
+    return [""];
+  if (stringWidth(text) <= width)
+    return [text];
+  const characters = Array.from(text);
+  const lines = [];
+  let index = 0;
+  while (index < characters.length && lines.length < maxLines) {
+    const last = lines.length === maxLines - 1;
+    if (last) {
+      lines.push(fitFleetText(characters.slice(index).join(""), width));
+      break;
+    }
+    let line = "";
+    let taken = 0;
+    while (index + taken < characters.length) {
+      const next = characters[index + taken];
+      if (stringWidth(line + next) > width)
+        break;
+      line += next;
+      taken += 1;
+    }
+    if (taken === 0) {
+      lines.push(characters[index]);
+      index += 1;
+      continue;
+    }
+    lines.push(line);
+    index += taken;
+  }
+  return lines;
+}
 var init_fleet_text = __esm(() => {
   init_string_width();
 });
 
-// packages/tui/src/components/StackSidebar.tsx
-import { jsxDEV } from "@opentui/react/jsx-dev-runtime";
-function phaseColor(phase) {
+// packages/tui/src/fleet-theme.ts
+function blendHex(fg, bg, amount) {
+  const parse = (hex2) => [
+    Number.parseInt(hex2.slice(1, 3), 16),
+    Number.parseInt(hex2.slice(3, 5), 16),
+    Number.parseInt(hex2.slice(5, 7), 16)
+  ];
+  const [fr, fg2, fb] = parse(fg);
+  const [br, bg2, bb] = parse(bg);
+  const channel = (f, b) => Math.round(b + (f - b) * amount);
+  const hex = (value) => value.toString(16).padStart(2, "0");
+  return `#${hex(channel(fr, br))}${hex(channel(fg2, bg2))}${hex(channel(fb, bb))}`;
+}
+function backendColor(backend) {
+  if (backend === "docker")
+    return fleetTheme.backendDocker;
+  if (backend === "tunnel")
+    return fleetTheme.backendTunnel;
+  if (backend === "wrangler" || backend === "proc")
+    return fleetTheme.backendProc;
+  return fleetTheme.muted;
+}
+function serviceStateColor(state) {
+  if (state === "healthy")
+    return fleetTheme.healthy;
+  if (state === "unknown" || state === "unhealthy" || state === "starting")
+    return fleetTheme.warning;
+  return fleetTheme.danger;
+}
+function serviceStateGlyph(state) {
+  if (state === "healthy")
+    return "\u25CF";
+  if (state === "unhealthy")
+    return "\u25C6";
+  if (state === "starting")
+    return "\u25CC";
+  return "\u25CB";
+}
+function stackPhaseColor(phase) {
   if (phase === "up")
     return fleetTheme.healthy;
-  if (phase === "degraded" || phase === "unknown")
+  if (phase === "degraded" || phase === "unknown" || phase === "starting")
     return fleetTheme.warning;
+  if (phase === "queued" || phase === "reserved")
+    return fleetTheme.queued;
   if (phase === "stopped")
-    return fleetTheme.danger;
+    return fleetTheme.faint;
   return fleetTheme.accent;
 }
-function StackSidebar({
-  stacks,
-  selectedProject,
-  width,
-  onSelectProject
-}) {
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { width, height: "100%", flexDirection: "column", border: true, borderColor: fleetTheme.border },
-    children: [
-      /* @__PURE__ */ jsxDEV("box", {
-        style: { height: 1, paddingLeft: 1, backgroundColor: fleetTheme.panelAlt },
-        children: /* @__PURE__ */ jsxDEV("text", {
-          fg: fleetTheme.text,
-          children: "Fleet"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
-      stacks.length === 0 ? /* @__PURE__ */ jsxDEV("box", {
-        style: { paddingLeft: 1, paddingTop: 1 },
-        children: /* @__PURE__ */ jsxDEV("text", {
-          fg: fleetTheme.muted,
-          children: "No managed stacks"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this) : stacks.map((stack) => {
-        const selected = stack.project === selectedProject;
-        const branch = sanitizeFleetTerminalText(stack.branch);
-        return /* @__PURE__ */ jsxDEV("box", {
-          onMouseDown: (event) => {
-            if (event.button !== 0)
-              return;
-            event.preventDefault();
-            event.stopPropagation();
-            onSelectProject?.(stack.project);
-          },
-          style: {
-            height: 1,
-            paddingLeft: 1,
-            paddingRight: 1,
-            flexDirection: "row",
-            backgroundColor: selected ? fleetTheme.selected : fleetTheme.background
-          },
-          children: [
-            /* @__PURE__ */ jsxDEV("text", {
-              fg: selected ? "#ffffff" : phaseColor(stack.phase),
-              children: selected ? "\u25B8 " : "  "
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ jsxDEV("text", {
-              fg: selected ? "#ffffff" : fleetTheme.text,
-              children: padFleetText(branch, Math.max(4, width - 13))
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ jsxDEV("text", {
-              fg: selected ? "#ffffff" : phaseColor(stack.phase),
-              children: padFleetText(stack.phase, 9)
-            }, undefined, false, undefined, this)
-          ]
-        }, stack.project, true, undefined, this);
-      })
-    ]
-  }, undefined, true, undefined, this);
+function stackPhaseGlyph(phase, spinnerFrame = 0) {
+  if (phase === "up")
+    return "\u25CF";
+  if (phase === "degraded")
+    return "\u25C6";
+  if (phase === "starting")
+    return SPINNER_FRAMES[spinnerFrame % SPINNER_FRAMES.length];
+  if (phase === "queued" || phase === "reserved")
+    return "\u25CC";
+  if (phase === "stopped")
+    return "\u25CB";
+  return "\u25CB";
 }
-var init_StackSidebar = __esm(() => {
-  init_fleet_text();
-  init_fleet_theme();
-  init_terminal_text();
+var background = "#0d1117", text = "#c9d1d9", accent = "#58a6ff", fleetTheme, SPINNER_FRAMES;
+var init_fleet_theme = __esm(() => {
+  fleetTheme = {
+    background,
+    panel: blendHex(text, background, 0.04),
+    panelAlt: blendHex(text, background, 0.1),
+    border: blendHex(text, background, 0.18),
+    text,
+    bright: "#e6edf3",
+    muted: "#8b949e",
+    faint: "#6e7681",
+    accent,
+    selectedBg: blendHex(accent, background, 0.16),
+    stripe: accent,
+    keycapBg: blendHex(text, background, 0.22),
+    healthy: "#3fb950",
+    warning: "#d29922",
+    danger: "#f85149",
+    queued: "#bc8cff",
+    backendDocker: "#58a6ff",
+    backendProc: "#bc8cff",
+    backendWrangler: "#bc8cff",
+    backendTunnel: "#ffa657",
+    publicBadge: "#ffa657"
+  };
+  SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 });
 
-// packages/tui/src/components/ServicePane.tsx
-import { jsxDEV as jsxDEV2 } from "@opentui/react/jsx-dev-runtime";
-function serviceColor(service) {
-  if (service.state === "healthy")
-    return fleetTheme.healthy;
-  if (service.state === "unknown" || service.state === "unhealthy")
-    return fleetTheme.warning;
-  return fleetTheme.danger;
+// packages/tui/src/fleet-keys.ts
+function isEscapeKey(key) {
+  const name = key.name.toLowerCase();
+  return name === "escape" || name === "esc" || key.sequence === "\x1B";
 }
-function endpointReach(endpoint) {
-  return endpoint.localUrl ?? endpoint.publicUrl ?? endpoint.url ?? `${endpoint.host}:${endpoint.port}`;
+function isEnterKey(key) {
+  return key.name === "return" || key.name === "enter";
 }
-function ServicePane({
-  stack,
-  selectedService,
-  selectedEndpoint,
-  onSelectService,
-  onSelectEndpoint
-}) {
-  return /* @__PURE__ */ jsxDEV2("box", {
-    style: { height: "100%", width: "100%", flexDirection: "column", border: true, borderColor: fleetTheme.border },
-    children: [
-      /* @__PURE__ */ jsxDEV2("box", {
-        style: { height: 1, paddingLeft: 1, backgroundColor: fleetTheme.panelAlt },
-        children: /* @__PURE__ */ jsxDEV2("text", {
-          fg: fleetTheme.text,
-          children: stack === undefined ? "Workloads" : `Workloads \u2014 ${sanitizeFleetTerminalText(stack.branch)}`
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
-      stack?.services.length ? stack.services.flatMap((service) => {
-        const workloadSelected = service.name === selectedService && selectedEndpoint === undefined;
-        const endpoints = service.endpoints ?? (service.endpoint === undefined ? [] : [service.endpoint]);
-        const workloadRow = /* @__PURE__ */ jsxDEV2("box", {
-          onMouseDown: (event) => {
-            if (event.button !== 0)
-              return;
-            event.preventDefault();
-            event.stopPropagation();
-            onSelectService?.(service.name);
-          },
-          style: {
-            height: 1,
-            paddingLeft: 1,
-            paddingRight: 1,
-            flexDirection: "row",
-            backgroundColor: workloadSelected ? fleetTheme.selected : fleetTheme.background
-          },
+function isPlainKey(key, value) {
+  return !key.ctrl && !key.meta && !key.option && !key.super && !key.hyper && (key.name === value || key.sequence === value);
+}
+function isUpKey(key) {
+  return key.name === "up" || isPlainKey(key, "k");
+}
+function isDownKey(key) {
+  return key.name === "down" || isPlainKey(key, "j");
+}
+function isShiftedKey(key, lower) {
+  return key.sequence === lower.toUpperCase() || isPlainKey(key, lower) && key.shift === true;
+}
+function isFollowBottomKey(key) {
+  return isShiftedKey(key, "g");
+}
+function isScrollTopKey(key) {
+  return !isShiftedKey(key, "g") && (key.sequence === "g" || isPlainKey(key, "g"));
+}
+function isDoctorKey(key) {
+  return isShiftedKey(key, "d");
+}
+
+// packages/tui/src/fleet-layout.ts
+function resolveFleetLayout(mode, terminalWidth) {
+  if (mode === "auto")
+    return terminalWidth >= SPLIT_MIN_WIDTH ? "split" : "stack";
+  return mode;
+}
+function fleetPaneWidths(layout, terminalWidth) {
+  if (layout === "stack")
+    return { sidebar: terminalWidth, main: terminalWidth };
+  const sidebar = Math.min(SIDEBAR_MAX_WIDTH, Math.max(SIDEBAR_MIN_WIDTH, Math.floor(terminalWidth * 0.26)));
+  return { sidebar, main: Math.max(20, terminalWidth - sidebar) };
+}
+function servicePaneHeight(rows, maxHeight) {
+  const content = Math.max(2, rows + 1);
+  return Math.min(maxHeight, content + 3);
+}
+function stackSidebarHeight(stackCount) {
+  return Math.min(9, Math.max(4, stackCount + 3));
+}
+var SPLIT_MIN_WIDTH = 110, SIDEBAR_MIN_WIDTH = 28, SIDEBAR_MAX_WIDTH = 44;
+
+// packages/tui/src/fleet-log-rows.ts
+function lineId(line) {
+  let id = lineIds.get(line);
+  if (id === undefined) {
+    id = nextLineId++;
+    lineIds.set(line, id);
+  }
+  return id;
+}
+function wrappedBody(line, bodyWidth) {
+  const cached = wrapCache.get(line);
+  if (cached !== undefined && cached.width === bodyWidth)
+    return cached.wrapped;
+  const wrapped = wrapFleetText(line.text, bodyWidth, 3);
+  wrapCache.set(line, { width: bodyWidth, wrapped });
+  return wrapped;
+}
+function buildFleetLogRows(lines, contentWidth) {
+  const rows = [];
+  for (const line of lines) {
+    const meta = line.meta === true;
+    const bodyWidth = meta ? Math.max(1, contentWidth - META_TAG.length) : contentWidth;
+    const wrapped = wrappedBody(line, bodyWidth);
+    const id = lineId(line);
+    for (let part = 0;part < wrapped.length; part += 1) {
+      rows.push({
+        key: `${id}:${part}`,
+        text: wrapped[part],
+        meta,
+        tag: !meta ? undefined : part === 0 ? META_TAG : " ".repeat(META_TAG.length)
+      });
+    }
+  }
+  return rows;
+}
+var META_TAG = "hestia \u2502 ", nextLineId = 0, lineIds, wrapCache;
+var init_fleet_log_rows = __esm(() => {
+  init_fleet_text();
+  lineIds = new WeakMap;
+  wrapCache = new WeakMap;
+});
+
+// packages/tui/src/fleet-format.ts
+function formatUptime(createdAt, now) {
+  const born = Date.parse(createdAt);
+  if (!Number.isFinite(born))
+    return;
+  const seconds = Math.max(0, Math.floor((now - born) / 1000));
+  if (seconds < 60)
+    return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24)
+    return `${hours}h${minutes % 60 === 0 ? "" : `${minutes % 60}m`}`;
+  const days = Math.floor(hours / 24);
+  return `${days}d${hours % 24 === 0 ? "" : `${hours % 24}h`}`;
+}
+function buildEnvBlock(stack) {
+  const lines = [];
+  for (const service of stack.services) {
+    if (service.backend === "tunnel")
+      continue;
+    if (service.publishedPort !== undefined) {
+      lines.push(`HESTIA_${envKey(service.name)}_PORT=${service.publishedPort}`);
+      if (service.backend === "docker") {
+        lines.push(`HESTIA_${envKey(service.name)}_MAIN_TCP_PORT=${service.publishedPort}`);
+      }
+    }
+    for (const endpoint of serviceEndpoints(service)) {
+      const alias = envKey(endpoint.name);
+      lines.push(`HESTIA_${alias}_PORT=${endpoint.port}`);
+      if (endpoint.publicUrl !== undefined)
+        lines.push(`HESTIA_${alias}_URL=${endpoint.publicUrl}`);
+      if (endpoint.localUrl !== undefined)
+        lines.push(`HESTIA_${alias}_LOCAL_URL=${endpoint.localUrl}`);
+      if (endpoint.url !== undefined)
+        lines.push(`HESTIA_${alias}_DIRECT_URL=${endpoint.url}`);
+    }
+  }
+  return [...new Set(lines)].join(`
+`);
+}
+var init_fleet_format = __esm(() => {
+  init_src2();
+});
+
+// packages/tui/src/fleet-status.ts
+function fleetCapacitySummary(capacity, connected) {
+  if (!connected)
+    return "daemon unreachable";
+  const parts = [`${capacity.live}/${capacity.maxStacks}`];
+  if (capacity.reserved > 0)
+    parts.push(`${capacity.reserved} reserved`);
+  if (capacity.queued > 0)
+    parts.push(`${capacity.queued} queued`);
+  parts.push("daemon ok");
+  return parts.join(" \xB7 ");
+}
+function resolveStatusNotice(connectionNotice, toast) {
+  return toast ?? connectionNotice;
+}
+var FLEET_KEY_HINTS;
+var init_fleet_status = __esm(() => {
+  FLEET_KEY_HINTS = [
+    { keys: ", .", label: "stack" },
+    { keys: "[ ]", label: "svc" },
+    { keys: "o", label: "open" },
+    { keys: "y", label: "yank" },
+    { keys: "?", label: "help" }
+  ];
+});
+
+// packages/tui/src/components/StackSidebar.tsx
+import { memo } from "react";
+import { jsxDEV } from "@opentui/react/jsx-dev-runtime";
+var StackSidebar;
+var init_StackSidebar = __esm(() => {
+  init_string_width();
+  init_fleet_text();
+  init_fleet_theme();
+  init_terminal_text();
+  StackSidebar = memo(function StackSidebar2({
+    stacks,
+    capacity,
+    selectedProject,
+    width,
+    focused = false,
+    spinnerFrame = 0,
+    onSelectProject
+  }) {
+    const branchWidth = Math.max(6, width - 17);
+    const slots = capacity.maxStacks > 0 ? ` \xB7 ${capacity.live}/${capacity.maxStacks} slots` : "";
+    return /* @__PURE__ */ jsxDEV("box", {
+      style: {
+        width,
+        height: "100%",
+        flexDirection: "column",
+        border: true,
+        borderColor: focused ? fleetTheme.accent : fleetTheme.border,
+        backgroundColor: fleetTheme.background
+      },
+      children: [
+        /* @__PURE__ */ jsxDEV("box", {
+          style: { height: 1, paddingLeft: 1, paddingRight: 1, flexDirection: "row", backgroundColor: fleetTheme.panelAlt },
           children: [
-            /* @__PURE__ */ jsxDEV2("text", {
-              fg: workloadSelected ? "#ffffff" : serviceColor(service),
-              children: workloadSelected ? "\u25B8 " : "  "
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ jsxDEV2("text", {
-              fg: workloadSelected ? "#ffffff" : fleetTheme.text,
-              children: padFleetText(sanitizeFleetTerminalText(service.name), 20)
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: focused ? fleetTheme.accent : fleetTheme.text,
+              children: "Stacks"
             }, undefined, false, undefined, this),
-            /* @__PURE__ */ jsxDEV2("text", {
-              fg: workloadSelected ? "#ffffff" : fleetTheme.muted,
-              children: padFleetText(service.backend, 10)
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: fleetTheme.faint,
+              children: slots
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        stacks.length === 0 ? /* @__PURE__ */ jsxDEV("box", {
+          style: { paddingLeft: 1, paddingTop: 1, flexDirection: "column" },
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: fleetTheme.muted,
+              children: "No managed stacks."
             }, undefined, false, undefined, this),
-            /* @__PURE__ */ jsxDEV2("text", {
-              fg: workloadSelected ? "#ffffff" : serviceColor(service),
-              children: service.state
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: fleetTheme.faint,
+              children: "`hestia up` starts one here."
             }, undefined, false, undefined, this)
           ]
-        }, `workload:${service.name}`, true, undefined, this);
-        const endpointRows = endpoints.map((endpoint, index) => {
-          const endpointSelected = service.name === selectedService && endpoint.name === selectedEndpoint;
-          const connector = index === endpoints.length - 1 ? "\u2514\u2500" : "\u251C\u2500";
-          const kind = (endpoint.kind ?? "http").toUpperCase();
-          const selector = `${endpoint.workload ?? service.name}:${endpoint.binding ?? endpoint.port}`;
-          return /* @__PURE__ */ jsxDEV2("box", {
+        }, undefined, true, undefined, this) : stacks.map((stack) => {
+          const selected = stack.project === selectedProject;
+          const branch = sanitizeFleetTerminalText(stack.branch);
+          const phase = sanitizeFleetTerminalText(stack.phase);
+          const glyph = stackPhaseGlyph(stack.phase, spinnerFrame);
+          const meta = stack.services.length > 0 ? ` \xB7${stack.services.length}` : "";
+          const warn = stack.warning === undefined ? "" : " \u26A0";
+          const available = Math.max(4, branchWidth - stringWidth(meta) - stringWidth(warn));
+          const rowBg = selected ? fleetTheme.selectedBg : fleetTheme.background;
+          return /* @__PURE__ */ jsxDEV("box", {
             onMouseDown: (event) => {
               if (event.button !== 0)
                 return;
               event.preventDefault();
               event.stopPropagation();
-              onSelectEndpoint?.(service.name, endpoint.name);
-            },
-            style: {
-              height: 1,
-              paddingLeft: 2,
-              paddingRight: 1,
-              flexDirection: "row",
-              backgroundColor: endpointSelected ? fleetTheme.selected : fleetTheme.background
+              onSelectProject?.(stack.project);
             },
+            style: { height: 1, paddingRight: 1, flexDirection: "row", backgroundColor: rowBg },
             children: [
-              /* @__PURE__ */ jsxDEV2("text", {
-                fg: endpointSelected ? "#ffffff" : fleetTheme.muted,
-                children: endpointSelected ? "\u25B8 " : `${connector} `
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: fleetTheme.stripe,
+                children: selected ? "\u258E" : " "
               }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV2("text", {
-                fg: endpointSelected ? "#ffffff" : fleetTheme.accent,
-                children: padFleetText(sanitizeFleetTerminalText(endpoint.name), 18)
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: stackPhaseColor(stack.phase),
+                children: [
+                  glyph,
+                  " "
+                ]
+              }, undefined, true, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: selected ? fleetTheme.bright : fleetTheme.text,
+                children: padFleetText(fitFleetText(branch, available), available)
               }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV2("text", {
-                fg: endpointSelected ? "#ffffff" : fleetTheme.muted,
-                children: padFleetText(kind, 8)
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: fleetTheme.warning,
+                children: warn
               }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV2("text", {
-                fg: endpointSelected ? "#ffffff" : fleetTheme.muted,
-                children: padFleetText(sanitizeFleetTerminalText(selector), 20)
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: fleetTheme.faint,
+                children: meta
               }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV2("text", {
-                fg: endpointSelected ? "#ffffff" : fleetTheme.text,
-                children: sanitizeFleetTerminalText(endpointReach(endpoint))
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: stackPhaseColor(stack.phase),
+                children: ` ${padFleetText(phase, 8)}`
               }, undefined, false, undefined, this)
             ]
-          }, `endpoint:${service.name}:${endpoint.name}`, true, undefined, this);
-        });
-        return [workloadRow, ...endpointRows];
-      }) : /* @__PURE__ */ jsxDEV2("box", {
-        style: { paddingLeft: 1, paddingTop: 1 },
-        children: /* @__PURE__ */ jsxDEV2("text", {
-          fg: fleetTheme.muted,
-          children: "No workloads recorded"
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
+          }, stack.project, true, undefined, this);
+        })
+      ]
+    }, undefined, true, undefined, this);
+  });
+});
+
+// packages/tui/src/components/ServicePane.tsx
+import { memo as memo2 } from "react";
+import { jsxDEV as jsxDEV2, Fragment } from "@opentui/react/jsx-dev-runtime";
+function portLabel(service) {
+  if (service.publishedPort === undefined)
+    return "\u2014";
+  return `:${service.publishedPort}`;
+}
+var ServicePane;
 var init_ServicePane = __esm(() => {
   init_fleet_text();
   init_fleet_theme();
   init_terminal_text();
-});
-
-// packages/tui/src/components/LogPane.tsx
-import { jsxDEV as jsxDEV3 } from "@opentui/react/jsx-dev-runtime";
+  ServicePane = memo2(function ServicePane2({
+    stack,
+    uptime,
+    selectedService,
+    selectedEndpoint,
+    width = 80,
+    focused = false,
+    onSelectService,
+    onSelectEndpoint
+  }) {
+    const nameWidth = Math.min(24, Math.max(12, Math.floor(width * 0.28)));
+    const backendWidth = 10;
+    const stateWidth = 10;
+    const portWidth = 7;
+    const title = stack === undefined ? "Workloads" : `Workloads \u2014 ${sanitizeFleetTerminalText(stack.branch)}`;
+    const warning = stack?.warning === undefined ? undefined : sanitizeFleetTerminalText(stack.warning);
+    return /* @__PURE__ */ jsxDEV2("box", {
+      style: {
+        height: "100%",
+        width: "100%",
+        flexDirection: "column",
+        border: true,
+        borderColor: focused ? fleetTheme.accent : fleetTheme.border,
+        backgroundColor: fleetTheme.background
+      },
+      children: [
+        /* @__PURE__ */ jsxDEV2("box", {
+          style: { height: 1, paddingLeft: 1, paddingRight: 1, flexDirection: "row", backgroundColor: fleetTheme.panelAlt },
+          children: [
+            /* @__PURE__ */ jsxDEV2("text", {
+              fg: focused ? fleetTheme.accent : fleetTheme.text,
+              children: fitFleetText(title, Math.max(8, width - 14))
+            }, undefined, false, undefined, this),
+            uptime === undefined ? null : /* @__PURE__ */ jsxDEV2("text", {
+              fg: fleetTheme.faint,
+              children: [
+                " \xB7 up ",
+                uptime
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        warning === undefined ? null : /* @__PURE__ */ jsxDEV2("box", {
+          style: { height: 1, paddingLeft: 1, paddingRight: 1 },
+          children: /* @__PURE__ */ jsxDEV2("text", {
+            fg: fleetTheme.warning,
+            children: fitFleetText(`\u26A0 ${warning}`, Math.max(8, width - 4))
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        stack?.services.length ? /* @__PURE__ */ jsxDEV2(Fragment, {
+          children: [
+            /* @__PURE__ */ jsxDEV2("box", {
+              style: { height: 1, paddingLeft: 1, paddingRight: 1, flexDirection: "row" },
+              children: [
+                /* @__PURE__ */ jsxDEV2("text", {
+                  fg: fleetTheme.faint,
+                  children: padFleetText("", 4)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV2("text", {
+                  fg: fleetTheme.faint,
+                  children: padFleetText("NAME", nameWidth)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV2("text", {
+                  fg: fleetTheme.faint,
+                  children: padFleetText("BACKEND", backendWidth)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV2("text", {
+                  fg: fleetTheme.faint,
+                  children: padFleetText("STATE", stateWidth)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV2("text", {
+                  fg: fleetTheme.faint,
+                  children: padFleetText("PORT", portWidth)
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this),
+            stack.services.flatMap((service) => {
+              const workloadSelected = service.name === selectedService && selectedEndpoint === undefined;
+              const endpoints = serviceEndpoints(service);
+              const state = sanitizeFleetTerminalText(service.state);
+              const workloadBg = workloadSelected ? fleetTheme.selectedBg : fleetTheme.background;
+              const workloadRow = /* @__PURE__ */ jsxDEV2("box", {
+                onMouseDown: (event) => {
+                  if (event.button !== 0)
+                    return;
+                  event.preventDefault();
+                  event.stopPropagation();
+                  onSelectService?.(service.name);
+                },
+                style: { height: 1, paddingRight: 1, flexDirection: "row", backgroundColor: workloadBg },
+                children: [
+                  /* @__PURE__ */ jsxDEV2("text", {
+                    fg: fleetTheme.stripe,
+                    children: workloadSelected ? "\u258E" : " "
+                  }, undefined, false, undefined, this),
+                  /* @__PURE__ */ jsxDEV2("text", {
+                    fg: serviceStateColor(service.state),
+                    children: [
+                      " ",
+                      serviceStateGlyph(service.state),
+                      " "
+                    ]
+                  }, undefined, true, undefined, this),
+                  /* @__PURE__ */ jsxDEV2("text", {
+                    fg: workloadSelected ? fleetTheme.bright : fleetTheme.text,
+                    children: padFleetText(sanitizeFleetTerminalText(service.name), nameWidth)
+                  }, undefined, false, undefined, this),
+                  /* @__PURE__ */ jsxDEV2("text", {
+                    fg: backendColor(service.backend),
+                    children: padFleetText(service.backend, backendWidth)
+                  }, undefined, false, undefined, this),
+                  /* @__PURE__ */ jsxDEV2("text", {
+                    fg: serviceStateColor(service.state),
+                    children: padFleetText(state, stateWidth)
+                  }, undefined, false, undefined, this),
+                  /* @__PURE__ */ jsxDEV2("text", {
+                    fg: fleetTheme.muted,
+                    children: padFleetText(portLabel(service), portWidth)
+                  }, undefined, false, undefined, this)
+                ]
+              }, `workload:${service.name}`, true, undefined, this);
+              const endpointRows = endpoints.map((endpoint, index) => {
+                const endpointSelected = service.name === selectedService && endpoint.name === selectedEndpoint;
+                const connector = index === endpoints.length - 1 ? "\u2514\u2500" : "\u251C\u2500";
+                const kind = (endpoint.kind ?? "http").toUpperCase();
+                const reach = sanitizeFleetTerminalText(endpointReach(endpoint));
+                const aliasWidth = Math.min(18, Math.max(10, Math.floor(width * 0.22)));
+                const pub = endpoint.publicUrl === undefined ? "" : " pub";
+                const endpointBg = endpointSelected ? fleetTheme.selectedBg : fleetTheme.background;
+                return /* @__PURE__ */ jsxDEV2("box", {
+                  onMouseDown: (event) => {
+                    if (event.button !== 0)
+                      return;
+                    event.preventDefault();
+                    event.stopPropagation();
+                    onSelectEndpoint?.(service.name, endpoint.name);
+                  },
+                  style: { height: 1, paddingRight: 1, flexDirection: "row", backgroundColor: endpointBg },
+                  children: [
+                    /* @__PURE__ */ jsxDEV2("text", {
+                      fg: fleetTheme.stripe,
+                      children: endpointSelected ? "\u258E" : " "
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ jsxDEV2("text", {
+                      fg: fleetTheme.faint,
+                      children: `  ${connector} `
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ jsxDEV2("text", {
+                      fg: endpointSelected ? fleetTheme.bright : fleetTheme.accent,
+                      children: padFleetText(sanitizeFleetTerminalText(endpoint.name), aliasWidth)
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ jsxDEV2("text", {
+                      fg: fleetTheme.muted,
+                      children: padFleetText(kind, 6)
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ jsxDEV2("text", {
+                      fg: fleetTheme.text,
+                      children: fitFleetText(reach, Math.max(12, width - aliasWidth - 19 - pub.length))
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ jsxDEV2("text", {
+                      fg: fleetTheme.publicBadge,
+                      children: pub
+                    }, undefined, false, undefined, this)
+                  ]
+                }, `endpoint:${service.name}:${endpoint.name}`, true, undefined, this);
+              });
+              return [workloadRow, ...endpointRows];
+            })
+          ]
+        }, undefined, true, undefined, this) : /* @__PURE__ */ jsxDEV2("box", {
+          style: { paddingLeft: 1, paddingTop: 1 },
+          children: /* @__PURE__ */ jsxDEV2("text", {
+            fg: fleetTheme.muted,
+            children: stack?.phase === "queued" || stack?.phase === "reserved" ? "Waiting for a machine slot \u2014 services appear once startup begins." : "No workloads recorded"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  });
+});
+
+// packages/tui/src/components/LogPane.tsx
+import { jsxDEV as jsxDEV3 } from "@opentui/react/jsx-dev-runtime";
 function LogPane({
-  lines,
+  rows,
   height,
   width,
   offset,
   follow,
   unseen,
   label,
+  focused = false,
   onScroll
 }) {
   const viewportRows = Math.max(1, height - 3);
-  const end = Math.max(0, lines.length - offset);
-  const start = Math.max(0, end - viewportRows - 2);
-  const visible = lines.slice(start, end).slice(-viewportRows);
+  const maxOffset = Math.max(0, rows.length - viewportRows);
+  const clamped = Math.min(offset, maxOffset);
+  const end = Math.max(0, rows.length - clamped);
+  const start = Math.max(0, end - viewportRows);
+  const visible = rows.slice(start, end);
+  const title = fitFleetText(`Logs \u2014 ${label}`, Math.max(8, width - 28));
   return /* @__PURE__ */ jsxDEV3("box", {
     onMouseScroll: (event) => {
       if (event.button !== 4 && event.button !== 5)
@@ -14647,14 +15923,21 @@ function LogPane({
       event.stopPropagation();
       onScroll?.(event.button === 4 ? -3 : 3);
     },
-    style: { height: "100%", width: "100%", flexDirection: "column", border: true, borderColor: fleetTheme.border },
+    style: {
+      height: "100%",
+      width: "100%",
+      flexDirection: "column",
+      border: true,
+      borderColor: focused ? fleetTheme.accent : fleetTheme.border,
+      backgroundColor: fleetTheme.background
+    },
     children: [
       /* @__PURE__ */ jsxDEV3("box", {
         style: { height: 1, paddingLeft: 1, paddingRight: 1, flexDirection: "row", backgroundColor: fleetTheme.panelAlt },
         children: [
           /* @__PURE__ */ jsxDEV3("text", {
-            fg: fleetTheme.text,
-            children: padFleetText(`Logs \u2014 ${label}`, Math.max(1, width - 24))
+            fg: focused ? fleetTheme.accent : fleetTheme.text,
+            children: padFleetText(title, Math.max(1, width - 24))
           }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV3("text", {
             fg: follow ? fleetTheme.healthy : fleetTheme.warning,
@@ -14666,15 +15949,21 @@ function LogPane({
         style: { paddingLeft: 1, paddingTop: 1 },
         children: /* @__PURE__ */ jsxDEV3("text", {
           fg: fleetTheme.muted,
-          children: "No log output yet \u2014 service is still being followed."
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this) : visible.map((line, index) => /* @__PURE__ */ jsxDEV3("box", {
-        style: { height: 1, paddingLeft: 1 },
-        children: /* @__PURE__ */ jsxDEV3("text", {
-          fg: line.meta ? fleetTheme.warning : fleetTheme.text,
-          children: fitFleetText(line.meta ? `[hestia] ${line.text}` : line.text, Math.max(1, width - 4))
+          children: "No log output yet \u2014 waiting for this workload."
         }, undefined, false, undefined, this)
-      }, `${start + index}-${line.text}`, false, undefined, this))
+      }, undefined, false, undefined, this) : visible.map((row2) => /* @__PURE__ */ jsxDEV3("box", {
+        style: { height: 1, paddingLeft: 1, flexDirection: "row" },
+        children: [
+          row2.tag === undefined ? null : /* @__PURE__ */ jsxDEV3("text", {
+            fg: fleetTheme.accent,
+            children: row2.tag
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV3("text", {
+            fg: row2.meta ? fleetTheme.warning : fleetTheme.text,
+            children: row2.text
+          }, undefined, false, undefined, this)
+        ]
+      }, row2.key, true, undefined, this))
     ]
   }, undefined, true, undefined, this);
 }
@@ -14684,16 +15973,16 @@ var init_LogPane = __esm(() => {
 });
 
 // packages/tui/src/components/FleetModal.tsx
-import { jsxDEV as jsxDEV4, Fragment } from "@opentui/react/jsx-dev-runtime";
+import { jsxDEV as jsxDEV4, Fragment as Fragment2 } from "@opentui/react/jsx-dev-runtime";
 function FleetModal({
   title,
   terminalWidth,
   terminalHeight,
   children
 }) {
-  const width = Math.min(72, Math.max(30, terminalWidth - 4));
-  const height = Math.min(18, Math.max(7, terminalHeight - 4));
-  return /* @__PURE__ */ jsxDEV4(Fragment, {
+  const width = Math.min(78, Math.max(36, terminalWidth - 4));
+  const height = Math.min(22, Math.max(8, terminalHeight - 4));
+  return /* @__PURE__ */ jsxDEV4(Fragment2, {
     children: [
       /* @__PURE__ */ jsxDEV4("box", {
         style: { position: "absolute", top: 0, left: 0, width: terminalWidth, height: terminalHeight, zIndex: 50 }
@@ -14715,10 +16004,22 @@ function FleetModal({
           paddingTop: 1
         },
         children: [
-          /* @__PURE__ */ jsxDEV4("text", {
-            fg: fleetTheme.accent,
-            children: title
-          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV4("box", {
+            style: { height: 1, flexDirection: "row" },
+            children: [
+              /* @__PURE__ */ jsxDEV4("box", {
+                style: { flexGrow: 1 },
+                children: /* @__PURE__ */ jsxDEV4("text", {
+                  fg: fleetTheme.accent,
+                  children: title
+                }, undefined, false, undefined, this)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV4("text", {
+                fg: fleetTheme.faint,
+                children: "Esc closes"
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this),
           /* @__PURE__ */ jsxDEV4("box", {
             style: { height: 1 }
           }, undefined, false, undefined, this),
@@ -14733,10 +16034,10 @@ var init_FleetModal = __esm(() => {
 });
 
 // packages/tui/src/FleetApp.tsx
-import { useEffect, useMemo, useReducer, useRef, useState } from "react";
-import { existsSync as existsSync22 } from "fs";
+import { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
+import { existsSync as existsSync23 } from "fs";
 import { useKeyboard, useRenderer, useTerminalDimensions } from "@opentui/react";
-import { jsxDEV as jsxDEV5, Fragment as Fragment2 } from "@opentui/react/jsx-dev-runtime";
+import { jsxDEV as jsxDEV5, Fragment as Fragment3 } from "@opentui/react/jsx-dev-runtime";
 function middleTruncateWorktreePath(path, width) {
   if (path.length <= width)
     return path;
@@ -14752,34 +16053,26 @@ function middleTruncateWorktreePath(path, width) {
   return `${path.slice(0, prefixWidth)}\u2026/${basename3}`;
 }
 function emptySnapshot(repoId) {
-  return { repoId, observedAt: new Date(0).toISOString(), capacity: EMPTY_CAPACITY, stacks: [], warnings: [] };
-}
-function isEscape(key) {
-  const name = key.name.toLowerCase();
-  return name === "escape" || name === "esc" || key.sequence === "\x1B";
-}
-function isFleetKey(key, value) {
-  return !key.ctrl && !key.meta && !key.option && !key.super && !key.hyper && (key.name === value || key.sequence === value);
+  return { repoId, observedAt: new Date(0).toISOString(), capacity: EMPTY_CAPACITY, stacks: [], shared: [], warnings: [] };
 }
 function selectedStack(snapshot, project) {
   return snapshot.stacks.find((stack) => stack.project === project);
 }
 function fleetServiceRowCount(stack) {
-  return stack?.services.reduce((count, service) => count + 1 + (service.endpoints?.length ?? (service.endpoint === undefined ? 0 : 1)), 0) ?? 0;
+  return stack?.services.reduce((count, service) => count + 1 + serviceEndpoints(service).length, 0) ?? 0;
 }
 function selectedFleetEndpoint(stack, serviceName, endpointName) {
   const service = stack?.services.find((candidate) => candidate.name === serviceName);
-  const endpoints = service?.endpoints ?? (service?.endpoint === undefined ? [] : [service.endpoint]);
+  const endpoints = service === undefined ? [] : serviceEndpoints(service);
   return endpoints.find((endpoint) => endpoint.name === endpointName) ?? endpoints[0];
 }
 function usableEndpoint(stack, serviceName, endpointName) {
   const endpoint = selectedFleetEndpoint(stack, serviceName, endpointName);
-  if (endpoint === undefined)
-    return;
-  return endpoint.localUrl ?? endpoint.publicUrl ?? endpoint.url ?? `${endpoint.host}:${endpoint.port}`;
+  return endpoint === undefined ? undefined : endpointReach(endpoint);
 }
-function copyableEndpoint(stack, serviceName, endpointName) {
-  return selectedFleetEndpoint(stack, serviceName, endpointName);
+function downTargetChanged(confirmed, snapshot) {
+  const current = snapshot.stacks.find((candidate) => candidate.project === confirmed.project);
+  return current?.repoId !== confirmed.repoId || current.worktree !== confirmed.worktree || current.createdAt !== confirmed.createdAt;
 }
 function fleetLogSelectionKey(stack, serviceName) {
   if (stack === undefined || serviceName === undefined)
@@ -14805,6 +16098,20 @@ function doctorOmissionSummary(rows, visibleRows = 10) {
   const warnings = omitted.filter((row2) => row2.level === "warn").length;
   return `\u2026 ${omitted.length} more (${errors2} errors, ${warnings} warnings)`;
 }
+function budgetDoctorReport(rows, width, lineBudget) {
+  const entries = [];
+  let used = 0;
+  for (const row2 of rows) {
+    const detail = sanitizeFleetTerminalText(row2.detail);
+    const detailLines = detail === "" ? [] : wrapFleetText(detail, Math.max(8, width - 6), 2);
+    const cost = 1 + detailLines.length;
+    if (used + cost > lineBudget)
+      break;
+    entries.push({ row: row2, detailLines });
+    used += cost;
+  }
+  return { entries, shown: entries.length };
+}
 function FleetApp({
   source,
   preferredProject,
@@ -14817,12 +16124,29 @@ function FleetApp({
   const [state, dispatch] = useReducer(reduceFleetUiState, undefined, createFleetUiState);
   const [logs, setLogs] = useState([]);
   const [connected, setConnected] = useState(false);
-  const [notice, setNotice] = useState("connecting to hestiad\u2026");
+  const [connectionNotice, setConnectionNotice] = useState("connecting to hestiad\u2026");
+  const [toast, setToast] = useState(undefined);
   const [doctorRows, setDoctorRows] = useState([]);
   const [doctorRunning, setDoctorRunning] = useState(false);
+  const [sharedBusy, setSharedBusy] = useState(false);
+  const [spinnerFrame, setSpinnerFrame] = useState(0);
+  const [now, setNow] = useState(() => Date.now());
   const lastFrameAt = useRef(Date.now());
+  const toastTimer = useRef(undefined);
   const stateRef = useRef(state);
   stateRef.current = state;
+  const showToast = (text2, ttl = TOAST_TTL_MS) => {
+    if (toastTimer.current !== undefined)
+      clearTimeout(toastTimer.current);
+    setToast(text2);
+    toastTimer.current = setTimeout(() => {
+      setToast((current) => current === text2 ? undefined : current);
+    }, ttl);
+  };
+  useEffect(() => () => {
+    if (toastTimer.current !== undefined)
+      clearTimeout(toastTimer.current);
+  }, []);
   useEffect(() => {
     const controller = new AbortController;
     (async () => {
@@ -14830,23 +16154,24 @@ function FleetApp({
         lastFrameAt.current = Date.now();
         if (frame.type === "snapshot") {
           setConnected(true);
-          setNotice((current) => current === "connecting to hestiad\u2026" || current.startsWith("disconnected:") || current.startsWith("hestiad heartbeat") ? "" : current);
+          setConnectionNotice(undefined);
           setSnapshot(frame.snapshot);
           dispatch({ type: "reconcile", snapshot: frame.snapshot, preferredProject });
         } else if (frame.sequence === -1) {
           setConnected(false);
-          setNotice(frame.at);
+          setConnectionNotice(frame.at);
         } else {
           setConnected(true);
+          setConnectionNotice(undefined);
         }
       }
     })();
     const staleTimer = setInterval(() => {
       if (Date.now() - lastFrameAt.current > 20000) {
         setConnected(false);
-        setNotice("hestiad heartbeat is stale; reconnecting\u2026");
+        setConnectionNotice("hestiad heartbeat is stale; reconnecting\u2026");
       }
-    }, 1000);
+    }, 5000);
     return () => {
       clearInterval(staleTimer);
       controller.abort();
@@ -14854,8 +16179,12 @@ function FleetApp({
   }, [preferredProject, source]);
   const selectedLogStack = selectedStack(snapshot, state.selection.project);
   const selectionKey = fleetLogSelectionKey(selectedLogStack, state.selection.service);
+  const appendedLines = useRef(0);
+  const seenAppendedLines = useRef(0);
   useEffect(() => {
     setLogs([]);
+    appendedLines.current = 0;
+    seenAppendedLines.current = 0;
     if (selectionKey === undefined)
       return;
     const [project, service] = selectionKey.split("\x00");
@@ -14868,57 +16197,90 @@ function FleetApp({
           service: sanitizeFleetTerminalText(line.service),
           text: sanitizeFleetTerminalText(line.text)
         };
+        appendedLines.current += 1;
         setLogs((current) => [...current, sanitized].slice(-LOG_RING_CAPACITY));
-        dispatch({ type: "new-lines", count: 1, maxOffset: LOG_RING_CAPACITY - 1 });
       }
     })();
     return () => controller.abort();
   }, [selectionKey, source]);
   const stacks = useMemo(() => visibleFleetStacks(snapshot, state.filter), [snapshot, state.filter]);
   const stack = selectedStack(snapshot, state.selection.project);
-  const context = {
+  const context = useMemo(() => ({
     repo: sanitizeFleetTerminalText(stack?.repo ?? invokingRepository.repo),
     branch: sanitizeFleetTerminalText(stack?.branch ?? invokingRepository.branch),
     worktree: sanitizeFleetTerminalText(stack?.worktree ?? invokingRepository.worktree),
     project: sanitizeFleetTerminalText(stack?.project ?? "\u2014")
-  };
-  const endpointView = copyableEndpoint(stack, state.selection.service, state.selection.endpoint);
+  }), [stack, invokingRepository]);
+  const endpointView = selectedFleetEndpoint(stack, state.selection.service, state.selection.endpoint);
   const endpoint = usableEndpoint(stack, state.selection.service, state.selection.endpoint);
-  const effectiveLayout = state.layout === "auto" ? terminal.width >= 110 ? "split" : "stack" : state.layout;
-  const focusOrder = ["stacks", "services", "logs"];
+  const effectiveLayout = resolveFleetLayout(state.layout, terminal.width);
+  const paneWidths = fleetPaneWidths(effectiveLayout, terminal.width);
+  const headerRows = 1;
+  const contextRows = 2;
+  const footerRows = 1;
+  const warningRows = stack?.warning === undefined ? 0 : 1;
+  const svcRows = fleetServiceRowCount(stack) + warningRows;
+  const stackedSidebarHeight = stackSidebarHeight(stacks.length);
+  const svcPaneH = servicePaneHeight(svcRows, effectiveLayout === "split" ? 14 : 12);
+  const logHeight = Math.max(5, terminal.height - headerRows - contextRows - footerRows - svcPaneH - (effectiveLayout === "stack" ? stackedSidebarHeight : 0));
+  const logWidth = effectiveLayout === "split" ? paneWidths.main : terminal.width;
+  const logViewportRows = Math.max(1, logHeight - 3);
+  const logRows = useMemo(() => buildFleetLogRows(logs, Math.max(1, logWidth - 4)), [logs, logWidth]);
+  const maxLogOffset = Math.max(0, logRows.length - logViewportRows);
+  useEffect(() => {
+    const appended = appendedLines.current - seenAppendedLines.current;
+    seenAppendedLines.current = appendedLines.current;
+    if (appended > 0 && !stateRef.current.follow) {
+      const fresh = buildFleetLogRows(logs.slice(-Math.min(appended, logs.length)), Math.max(1, logWidth - 4)).length;
+      dispatch({ type: "new-lines", count: fresh, maxOffset: maxLogOffset });
+    }
+  }, [logs, logWidth, maxLogOffset]);
+  const anyStarting = snapshot.stacks.some((candidate) => candidate.phase === "starting");
+  useEffect(() => {
+    if (!anyStarting)
+      return;
+    const timer = setInterval(() => setSpinnerFrame((frame) => (frame + 1) % SPINNER_FRAMES.length), 120);
+    return () => clearInterval(timer);
+  }, [anyStarting]);
+  useEffect(() => {
+    const timer = setInterval(() => setNow(Date.now()), 30000);
+    return () => clearInterval(timer);
+  }, []);
   useEffect(() => {
     const confirmed = state.confirmDown;
-    const currentIncarnation = snapshot.stacks.find((candidate) => candidate.project === confirmed?.project);
-    if (confirmed !== undefined && !state.downPending && (currentIncarnation?.repoId !== confirmed.repoId || currentIncarnation.worktree !== confirmed.worktree || currentIncarnation.createdAt !== confirmed.createdAt)) {
+    if (confirmed !== undefined && !state.downPending && downTargetChanged(confirmed, snapshot)) {
       dispatch({ type: "confirm-down" });
-      setNotice(`${confirmed.project} changed; down cancelled`);
+      showToast(`${confirmed.project} changed; down cancelled`);
     }
   }, [snapshot, state.confirmDown, state.downPending]);
+  const copyToClipboard = (value, label) => {
+    const copied = renderer.copyToClipboardOSC52(value);
+    showToast(copied ? `copied ${label ?? value}` : `copy unavailable: ${label ?? value}`);
+  };
   useKeyboard((key) => {
     const current = stateRef.current;
     if (current.confirmDown !== undefined) {
       key.preventDefault();
       key.stopPropagation();
-      if (isEscape(key) && !current.downPending) {
+      if (isEscapeKey(key) && !current.downPending) {
         dispatch({ type: "confirm-down" });
-      } else if (!current.downPending && (isFleetKey(key, "d") || key.name === "return" || key.name === "enter")) {
+      } else if (!current.downPending && (isPlainKey(key, "d") || isEnterKey(key))) {
         const confirmed = current.confirmDown;
-        const currentIncarnation = snapshot.stacks.find((candidate) => candidate.project === confirmed.project);
-        if (currentIncarnation?.repoId !== confirmed.repoId || currentIncarnation.worktree !== confirmed.worktree || currentIncarnation.createdAt !== confirmed.createdAt) {
+        if (downTargetChanged(confirmed, snapshot)) {
           dispatch({ type: "confirm-down" });
-          setNotice(`${confirmed.project} changed; down cancelled`);
+          showToast(`${confirmed.project} changed; down cancelled`);
           return;
         }
         const project = confirmed.project;
         dispatch({ type: "down-pending", pending: true });
-        setNotice(`tearing down ${project}\u2026`);
+        showToast(`tearing down ${project}\u2026`);
         source.down(confirmed).then(() => {
           dispatch({ type: "down-pending", pending: false });
           dispatch({ type: "confirm-down" });
-          setNotice(`${project} is down; named volumes retained`);
+          showToast(`${project} is down; named volumes retained`);
         }).catch((error) => {
           dispatch({ type: "down-pending", pending: false });
-          setNotice(`down failed: ${error.message}`);
+          showToast(`down failed: ${error.message}`);
         });
       }
       return;
@@ -14926,86 +16288,167 @@ function FleetApp({
     if (current.helpOpen || current.doctorOpen) {
       key.preventDefault();
       key.stopPropagation();
-      if (isEscape(key) || isFleetKey(key, "?")) {
+      if (isEscapeKey(key) || isPlainKey(key, "?")) {
         dispatch({ type: current.helpOpen ? "help" : "doctor", open: false });
       }
       return;
     }
+    if (current.sharedOpen) {
+      key.preventDefault();
+      key.stopPropagation();
+      if (isEscapeKey(key) || isPlainKey(key, "s"))
+        return dispatch({ type: "shared", open: false });
+      const list = snapshot.shared;
+      if (list.length === 0)
+        return;
+      if (isDownKey(key))
+        return dispatch({ type: "move-shared", delta: 1, count: list.length });
+      if (isUpKey(key))
+        return dispatch({ type: "move-shared", delta: -1, count: list.length });
+      const selected = list[Math.min(current.sharedSelection, list.length - 1)];
+      if (selected === undefined || sharedBusy)
+        return;
+      const runShared = (label, action) => {
+        setSharedBusy(true);
+        showToast(`${label} ${selected.name}\u2026`);
+        action.then(() => showToast(`${label} ${selected.name}: done`)).catch((error) => showToast(`${label} ${selected.name} failed: ${error.message}`)).finally(() => setSharedBusy(false));
+      };
+      if (isPlainKey(key, "a") || isPlainKey(key, "x") || isPlainKey(key, "r")) {
+        if (selected.holder?.mine !== true) {
+          showToast(`this worktree does not hold ${selected.name}`);
+          return;
+        }
+        const worktree = selected.holder.worktree;
+        if (isPlainKey(key, "a"))
+          runShared("allowing", source.allowShared(worktree, selected.name));
+        else if (isPlainKey(key, "x"))
+          runShared("denying", source.denyShared(worktree, selected.name));
+        else
+          runShared("releasing", source.releaseShared(worktree, selected.name));
+        return;
+      }
+      if (isPlainKey(key, "c")) {
+        const acting = selectedStack(snapshot, current.selection.project);
+        if (acting === undefined) {
+          showToast("select a stack (in the fleet list) to claim as");
+          return;
+        }
+        if (selected.holder?.project === acting.project) {
+          showToast(`${acting.project} already holds ${selected.name}`);
+          return;
+        }
+        runShared(`claiming as ${acting.project},`, source.claimShared(acting.worktree, selected.name));
+        return;
+      }
+      return;
+    }
     if (current.focus === "filter") {
-      if (isEscape(key) || key.name === "return" || key.name === "enter") {
+      if (isEscapeKey(key)) {
+        key.preventDefault();
+        key.stopPropagation();
+        if (current.filter !== "")
+          dispatch({ type: "filter", filter: "", snapshot });
+        else
+          dispatch({ type: "focus", focus: "stacks" });
+        return;
+      }
+      if (isEnterKey(key)) {
         key.preventDefault();
         key.stopPropagation();
         dispatch({ type: "focus", focus: "stacks" });
       }
       return;
     }
-    if (isFleetKey(key, "q"))
+    if (isPlainKey(key, "q"))
       return onQuit();
-    if (isFleetKey(key, "?"))
+    if (isPlainKey(key, "?"))
       return dispatch({ type: "help", open: true });
-    if (isFleetKey(key, "/"))
+    if (isPlainKey(key, "s"))
+      return dispatch({ type: "shared", open: true });
+    if (isPlainKey(key, "/"))
       return dispatch({ type: "focus", focus: "filter" });
-    if (isFleetKey(key, "0"))
+    if (isPlainKey(key, "0"))
       return dispatch({ type: "layout", layout: "auto" });
-    if (isFleetKey(key, "1"))
+    if (isPlainKey(key, "1"))
       return dispatch({ type: "layout", layout: "split" });
-    if (isFleetKey(key, "2"))
+    if (isPlainKey(key, "2"))
       return dispatch({ type: "layout", layout: "stack" });
     if (key.name === "tab") {
+      const focusOrder = ["stacks", "services", "logs"];
       const index = focusOrder.indexOf(current.focus);
       const delta2 = key.shift ? -1 : 1;
       const next = (index + delta2 + focusOrder.length) % focusOrder.length;
       return dispatch({ type: "focus", focus: focusOrder[next] });
     }
-    if (isFleetKey(key, "["))
+    if (isPlainKey(key, ","))
+      return dispatch({ type: "move-stack", delta: -1, snapshot });
+    if (isPlainKey(key, "."))
+      return dispatch({ type: "move-stack", delta: 1, snapshot });
+    if (isPlainKey(key, "["))
       return dispatch({ type: "move-service", delta: -1, snapshot });
-    if (isFleetKey(key, "]"))
+    if (isPlainKey(key, "]"))
       return dispatch({ type: "move-service", delta: 1, snapshot });
-    if (isFleetKey(key, "g") && key.shift || key.sequence === "G") {
+    if (isPlainKey(key, "f"))
+      return dispatch({ type: "follow", follow: !current.follow });
+    if (isFollowBottomKey(key))
       return dispatch({ type: "follow", follow: true });
+    if (isScrollTopKey(key)) {
+      return dispatch({ type: "scroll-logs", delta: -logRows.length, maxOffset: maxLogOffset });
     }
-    if (key.sequence === "D" || isFleetKey(key, "d") && key.shift) {
+    if (isDoctorKey(key)) {
       if (doctorRunning)
         return;
       dispatch({ type: "doctor", open: true });
       setDoctorRunning(true);
       setDoctorRows([]);
-      const worktree = stack !== undefined && existsSync22(stack.worktree) ? stack.worktree : process.cwd();
+      const worktree = stack !== undefined && existsSync23(stack.worktree) ? stack.worktree : process.cwd();
       source.diagnose(worktree).then(setDoctorRows).catch((error) => {
-        setNotice(`doctor failed: ${error.message}`);
+        showToast(`doctor failed: ${error.message}`);
       }).finally(() => setDoctorRunning(false));
       return;
     }
-    if (isFleetKey(key, "d")) {
+    if (isPlainKey(key, "d")) {
       if (stack?.phase === "queued" || stack?.phase === "reserved") {
-        setNotice(`${stack.project} is ${stack.phase}; down is available after startup begins`);
+        showToast(`${stack.project} is ${stack.phase}; down is available after startup begins`);
       } else if (stack !== undefined) {
         dispatch({ type: "confirm-down", stack });
       }
       return;
     }
-    if (isFleetKey(key, "o") && endpoint !== undefined) {
+    if (isPlainKey(key, "o") && endpoint !== undefined) {
       openFleetUrl(endpoint);
-      setNotice(endpoint);
+      showToast(endpoint);
       return;
     }
-    if (isFleetKey(key, "y") && endpoint !== undefined) {
-      const copied = renderer.copyToClipboardOSC52(endpoint);
-      setNotice(copied ? `copied ${endpoint}` : `copy unavailable: ${endpoint}`);
+    if (isShiftedKey(key, "y")) {
+      if (stack === undefined)
+        return;
+      const env = buildEnvBlock(stack);
+      if (env === "")
+        showToast(`no env surface recorded for ${stack.project}`);
+      else
+        copyToClipboard(env, `env block (${env.split(`
+`).length} keys)`);
       return;
     }
-    const copySurfaceRequested = ["c", "l", "p"].some((name) => isFleetKey(key, name));
-    const surface = isFleetKey(key, "c") ? endpointView?.url : isFleetKey(key, "l") ? endpointView?.localUrl : isFleetKey(key, "p") ? endpointView?.publicUrl : undefined;
-    if (surface !== undefined) {
-      const copied = renderer.copyToClipboardOSC52(surface);
-      setNotice(copied ? `copied ${surface}` : `copy unavailable: ${surface}`);
+    if (isPlainKey(key, "y") && endpoint !== undefined) {
+      copyToClipboard(endpoint);
       return;
     }
-    if (copySurfaceRequested) {
-      setNotice("selected URL surface is unavailable");
+    const copySurfaces = [
+      ["c", endpointView?.url],
+      ["l", endpointView?.localUrl],
+      ["p", endpointView?.publicUrl]
+    ];
+    const copySurface = copySurfaces.find(([name]) => isPlainKey(key, name));
+    if (copySurface !== undefined) {
+      if (copySurface[1] !== undefined)
+        copyToClipboard(copySurface[1]);
+      else
+        showToast("selected URL surface is unavailable");
       return;
     }
-    const delta = key.name === "down" || isFleetKey(key, "j") ? 1 : key.name === "up" || isFleetKey(key, "k") ? -1 : 0;
+    const delta = isDownKey(key) ? 1 : isUpKey(key) ? -1 : 0;
     if (delta === 0)
       return;
     if (current.focus === "stacks")
@@ -15013,11 +16456,46 @@ function FleetApp({
     else if (current.focus === "services")
       dispatch({ type: "move-service", delta, snapshot });
     else
-      dispatch({ type: "scroll-logs", delta });
+      dispatch({ type: "scroll-logs", delta, maxOffset: maxLogOffset });
   });
-  const capacity = snapshot.capacity;
-  const status = connected ? `${capacity.live}/${capacity.maxStacks} live \xB7 ${capacity.reserved} reserved \xB7 ${capacity.queued} queued` : "disconnected";
+  const uptime = stack?.createdAt !== undefined && (stack.phase === "up" || stack.phase === "degraded" || stack.phase === "starting") ? formatUptime(stack.createdAt, now) : undefined;
   const logLabel = state.selection.service ?? "select a service";
+  const statusNotice = resolveStatusNotice(connectionNotice, toast);
+  const doctorWidth = Math.min(72, Math.max(30, terminal.width - 6));
+  const wideFooter = terminal.width >= 100;
+  const onSelectProject = useCallback((project) => dispatch({ type: "select-stack", project, snapshot }), [snapshot]);
+  const onSelectService = useCallback((service) => dispatch({ type: "select-service", service, snapshot }), [snapshot]);
+  const onSelectEndpoint = useCallback((service, endpointName) => dispatch({ type: "select-endpoint", service, endpoint: endpointName, snapshot }), [snapshot]);
+  const servicePane = /* @__PURE__ */ jsxDEV5(ServicePane, {
+    stack,
+    uptime,
+    selectedService: state.selection.service,
+    selectedEndpoint: state.selection.endpoint,
+    width: logWidth,
+    focused: state.focus === "services",
+    onSelectService,
+    onSelectEndpoint
+  }, undefined, false, undefined, this);
+  const sidebar = (width) => /* @__PURE__ */ jsxDEV5(StackSidebar, {
+    stacks,
+    capacity: snapshot.capacity,
+    selectedProject: state.selection.project,
+    width,
+    focused: state.focus === "stacks",
+    spinnerFrame,
+    onSelectProject
+  }, undefined, false, undefined, this);
+  const logPane = /* @__PURE__ */ jsxDEV5(LogPane, {
+    rows: logRows,
+    height: logHeight,
+    width: logWidth,
+    offset: state.logOffset,
+    follow: state.follow,
+    unseen: state.unseenLines,
+    label: logLabel,
+    focused: state.focus === "logs",
+    onScroll: (delta) => dispatch({ type: "scroll-logs", delta, maxOffset: maxLogOffset })
+  }, undefined, false, undefined, this);
   return /* @__PURE__ */ jsxDEV5("box", {
     style: { width: "100%", height: "100%", flexDirection: "column", backgroundColor: fleetTheme.background },
     children: [
@@ -15026,70 +16504,64 @@ function FleetApp({
         children: [
           /* @__PURE__ */ jsxDEV5("text", {
             fg: fleetTheme.accent,
-            children: [
-              "Hestia Fleet \u2014 ",
-              context.repo
-            ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.muted,
-            children: [
-              "  ",
-              status
-            ]
-          }, undefined, true, undefined, this)
-        ]
-      }, undefined, true, undefined, this),
-      terminal.width >= 90 ? /* @__PURE__ */ jsxDEV5("box", {
-        style: { height: 4, paddingLeft: 1, flexDirection: "column", backgroundColor: fleetTheme.background },
-        children: [
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: [
-              "Repository  ",
-              context.repo
-            ]
-          }, undefined, true, undefined, this),
+            children: "Hestia Fleet"
+          }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: [
-              "Branch      ",
-              context.branch
-            ]
-          }, undefined, true, undefined, this),
+            fg: fleetTheme.faint,
+            children: " \xB7 "
+          }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("text", {
             fg: fleetTheme.text,
-            children: [
-              "Worktree    ",
-              middleTruncateWorktreePath(context.worktree, Math.max(16, terminal.width - 13))
-            ]
-          }, undefined, true, undefined, this),
+            children: fitFleetText(context.repo, Math.max(8, terminal.width - 30))
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { flexGrow: 1 }
+          }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.muted,
-            children: [
-              "Project     ",
-              context.project
-            ]
-          }, undefined, true, undefined, this)
+            fg: connected ? fleetTheme.healthy : fleetTheme.warning,
+            children: connected ? "\u25CF connected" : "\u25CB reconnecting"
+          }, undefined, false, undefined, this)
         ]
-      }, undefined, true, undefined, this) : /* @__PURE__ */ jsxDEV5("box", {
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV5("box", {
         style: { height: 2, paddingLeft: 1, flexDirection: "column", backgroundColor: fleetTheme.background },
         children: [
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1, flexDirection: "row" },
             children: [
-              context.repo,
-              " \xB7 ",
-              context.branch,
-              " \xB7 ",
-              context.project
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.muted,
+                children: fitFleetText(context.repo, 24)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: " / "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.text,
+                children: context.branch
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: " \xB7 "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.muted,
+                children: context.project
+              }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.muted,
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1, flexDirection: "row" },
             children: [
-              "worktree ",
-              middleTruncateWorktreePath(context.worktree, Math.max(12, terminal.width - 10))
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: "worktree "
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.muted,
+                children: middleTruncateWorktreePath(context.worktree, Math.max(16, terminal.width - 11))
+              }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this)
         ]
@@ -15097,37 +16569,17 @@ function FleetApp({
       effectiveLayout === "split" ? /* @__PURE__ */ jsxDEV5("box", {
         style: { flexGrow: 1, flexDirection: "row" },
         children: [
-          /* @__PURE__ */ jsxDEV5(StackSidebar, {
-            stacks,
-            selectedProject: state.selection.project,
-            width: Math.max(28, Math.floor(terminal.width * 0.28)),
-            onSelectProject: (project) => dispatch({ type: "select-stack", project, snapshot })
-          }, undefined, false, undefined, this),
+          sidebar(paneWidths.sidebar),
           /* @__PURE__ */ jsxDEV5("box", {
             style: { flexGrow: 1, flexDirection: "column" },
             children: [
               /* @__PURE__ */ jsxDEV5("box", {
-                style: { height: Math.min(12, Math.max(5, fleetServiceRowCount(stack) + 2)) },
-                children: /* @__PURE__ */ jsxDEV5(ServicePane, {
-                  stack,
-                  selectedService: state.selection.service,
-                  selectedEndpoint: state.selection.endpoint,
-                  onSelectService: (service) => dispatch({ type: "select-service", service, snapshot }),
-                  onSelectEndpoint: (service, endpoint2) => dispatch({ type: "select-endpoint", service, endpoint: endpoint2, snapshot })
-                }, undefined, false, undefined, this)
+                style: { height: svcPaneH },
+                children: servicePane
               }, undefined, false, undefined, this),
               /* @__PURE__ */ jsxDEV5("box", {
                 style: { flexGrow: 1 },
-                children: /* @__PURE__ */ jsxDEV5(LogPane, {
-                  lines: logs,
-                  height: Math.max(5, terminal.height - 13),
-                  width: Math.max(20, Math.floor(terminal.width * 0.72)),
-                  offset: state.logOffset,
-                  follow: state.follow,
-                  unseen: state.unseenLines,
-                  label: logLabel,
-                  onScroll: (delta) => dispatch({ type: "scroll-logs", delta })
-                }, undefined, false, undefined, this)
+                children: logPane
               }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this)
@@ -15136,42 +16588,22 @@ function FleetApp({
         style: { flexGrow: 1, flexDirection: "column" },
         children: [
           /* @__PURE__ */ jsxDEV5("box", {
-            style: { height: Math.min(7, Math.max(4, stacks.length + 2)) },
-            children: /* @__PURE__ */ jsxDEV5(StackSidebar, {
-              stacks,
-              selectedProject: state.selection.project,
-              width: terminal.width,
-              onSelectProject: (project) => dispatch({ type: "select-stack", project, snapshot })
-            }, undefined, false, undefined, this)
+            style: { height: stackedSidebarHeight },
+            children: sidebar(terminal.width)
           }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("box", {
-            style: { height: Math.min(10, Math.max(4, fleetServiceRowCount(stack) + 2)) },
-            children: /* @__PURE__ */ jsxDEV5(ServicePane, {
-              stack,
-              selectedService: state.selection.service,
-              selectedEndpoint: state.selection.endpoint,
-              onSelectService: (service) => dispatch({ type: "select-service", service, snapshot }),
-              onSelectEndpoint: (service, endpoint2) => dispatch({ type: "select-endpoint", service, endpoint: endpoint2, snapshot })
-            }, undefined, false, undefined, this)
+            style: { height: svcPaneH },
+            children: servicePane
           }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("box", {
             style: { flexGrow: 1 },
-            children: /* @__PURE__ */ jsxDEV5(LogPane, {
-              lines: logs,
-              height: Math.max(5, terminal.height - 17),
-              width: terminal.width,
-              offset: state.logOffset,
-              follow: state.follow,
-              unseen: state.unseenLines,
-              label: logLabel,
-              onScroll: (delta) => dispatch({ type: "scroll-logs", delta })
-            }, undefined, false, undefined, this)
+            children: logPane
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this),
       /* @__PURE__ */ jsxDEV5("box", {
         style: { height: 1, paddingLeft: 1, paddingRight: 1, flexDirection: "row", backgroundColor: fleetTheme.panelAlt },
-        children: state.focus === "filter" ? /* @__PURE__ */ jsxDEV5(Fragment2, {
+        children: state.focus === "filter" ? /* @__PURE__ */ jsxDEV5(Fragment3, {
           children: [
             /* @__PURE__ */ jsxDEV5("text", {
               fg: fleetTheme.accent,
@@ -15186,73 +16618,137 @@ function FleetApp({
               onSubmit: () => dispatch({ type: "focus", focus: "stacks" })
             }, undefined, false, undefined, this)
           ]
-        }, undefined, true, undefined, this) : /* @__PURE__ */ jsxDEV5("text", {
-          fg: notice ? fleetTheme.warning : fleetTheme.muted,
-          children: notice || "click rows \xB7 wheel logs \xB7 j/k navigate \xB7 [/] service \xB7 / filter \xB7 d down \xB7 ? help \xB7 q quit"
-        }, undefined, false, undefined, this)
+        }, undefined, true, undefined, this) : statusNotice !== undefined ? /* @__PURE__ */ jsxDEV5(Fragment3, {
+          children: [
+            /* @__PURE__ */ jsxDEV5("text", {
+              fg: connectionNotice !== undefined ? fleetTheme.warning : fleetTheme.text,
+              children: fitFleetText(statusNotice, Math.max(8, terminal.width - 20))
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV5("box", {
+              style: { flexGrow: 1 }
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV5("text", {
+              fg: connected ? fleetTheme.muted : fleetTheme.warning,
+              children: fleetCapacitySummary(snapshot.capacity, connected)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this) : /* @__PURE__ */ jsxDEV5(Fragment3, {
+          children: [
+            wideFooter ? /* @__PURE__ */ jsxDEV5("text", {
+              children: FLEET_KEY_HINTS.map((hint) => /* @__PURE__ */ jsxDEV5("span", {
+                children: [
+                  /* @__PURE__ */ jsxDEV5("span", {
+                    fg: fleetTheme.bright,
+                    bg: fleetTheme.keycapBg,
+                    children: ` ${hint.keys} `
+                  }, undefined, false, undefined, this),
+                  /* @__PURE__ */ jsxDEV5("span", {
+                    fg: fleetTheme.muted,
+                    children: ` ${hint.label}  `
+                  }, undefined, false, undefined, this)
+                ]
+              }, hint.keys, true, undefined, this))
+            }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV5("text", {
+              fg: fleetTheme.muted,
+              children: "? help \xB7 q quit"
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV5("box", {
+              style: { flexGrow: 1 }
+            }, undefined, false, undefined, this),
+            state.filter !== "" ? /* @__PURE__ */ jsxDEV5("text", {
+              fg: fleetTheme.accent,
+              children: `filter=${fitFleetText(state.filter, 16)} `
+            }, undefined, false, undefined, this) : null,
+            /* @__PURE__ */ jsxDEV5("text", {
+              fg: connected ? fleetTheme.muted : fleetTheme.warning,
+              children: fleetCapacitySummary(snapshot.capacity, connected)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this)
       }, undefined, false, undefined, this),
       state.helpOpen ? /* @__PURE__ */ jsxDEV5(FleetModal, {
         title: "Fleet help",
         terminalWidth: terminal.width,
         terminalHeight: terminal.height,
-        children: [
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "j/k or arrows  navigate focused pane"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "mouse  click stacks/services \xB7 wheel scroll logs"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "Tab / Shift-Tab  change pane"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "[ / ]  previous / next service"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "/ filter \xB7 G follow logs \xB7 0/1/2 layout"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "o open \xB7 y primary \xB7 c direct \xB7 l local \xB7 p public"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
-            children: "D doctor"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.danger,
-            children: "d confirmed down (named volumes retained)"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.muted,
-            children: "Esc closes this dialog"
-          }, undefined, false, undefined, this)
-        ]
-      }, undefined, true, undefined, this) : null,
+        children: HELP_ROWS.map(([keys, action]) => /* @__PURE__ */ jsxDEV5("box", {
+          style: { height: 1, flexDirection: "row" },
+          children: [
+            /* @__PURE__ */ jsxDEV5("text", {
+              fg: fleetTheme.accent,
+              children: padFleetText(keys, 9)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV5("text", {
+              fg: fleetTheme.muted,
+              children: action
+            }, undefined, false, undefined, this)
+          ]
+        }, keys, true, undefined, this))
+      }, undefined, false, undefined, this) : null,
       state.doctorOpen ? /* @__PURE__ */ jsxDEV5(FleetModal, {
         title: "hestia doctor",
         terminalWidth: terminal.width,
         terminalHeight: terminal.height,
+        children: doctorRunning ? /* @__PURE__ */ jsxDEV5("text", {
+          fg: fleetTheme.muted,
+          children: "Running diagnostics\u2026"
+        }, undefined, false, undefined, this) : (() => {
+          const modalHeight = Math.min(22, Math.max(8, terminal.height - 4));
+          const report = budgetDoctorReport(doctorRows, doctorWidth, Math.max(3, modalHeight - 6));
+          const summary = doctorOmissionSummary(doctorRows, report.shown);
+          return [
+            ...report.entries.flatMap(({ row: row2, detailLines }) => {
+              const mark = row2.level === "ok" ? "\u2713" : row2.level === "error" ? "\u2717" : row2.level === "warn" ? "!" : "?";
+              const color = row2.level === "error" ? fleetTheme.danger : row2.level === "warn" ? fleetTheme.warning : row2.level === "ok" ? fleetTheme.healthy : fleetTheme.muted;
+              const head = `${mark} ${sanitizeFleetTerminalText(row2.check)}`;
+              return [
+                /* @__PURE__ */ jsxDEV5("text", {
+                  fg: color,
+                  children: fitFleetText(head, doctorWidth - 4)
+                }, `${row2.check}:head`, false, undefined, this),
+                ...detailLines.map((part, index) => /* @__PURE__ */ jsxDEV5("text", {
+                  fg: fleetTheme.muted,
+                  children: `  ${part}`
+                }, `${row2.check}:detail:${index}`, false, undefined, this))
+              ];
+            }),
+            summary === undefined ? null : /* @__PURE__ */ jsxDEV5("text", {
+              fg: fleetTheme.warning,
+              children: summary
+            }, "doctor:omitted", false, undefined, this)
+          ];
+        })()
+      }, undefined, false, undefined, this) : null,
+      state.sharedOpen ? /* @__PURE__ */ jsxDEV5(FleetModal, {
+        title: "Shared hostnames",
+        terminalWidth: terminal.width,
+        terminalHeight: terminal.height,
         children: [
-          doctorRunning ? /* @__PURE__ */ jsxDEV5("text", {
+          snapshot.shared.length === 0 ? /* @__PURE__ */ jsxDEV5("text", {
             fg: fleetTheme.muted,
-            children: "Running diagnostics\u2026"
-          }, undefined, false, undefined, this) : doctorRows.slice(0, 10).map((row2) => /* @__PURE__ */ jsxDEV5("text", {
-            fg: row2.level === "error" ? fleetTheme.danger : row2.level === "warn" ? fleetTheme.warning : fleetTheme.text,
-            children: `${row2.level === "ok" ? "\u2713" : row2.level === "error" ? "\u2717" : "!"} ${sanitizeFleetTerminalText(row2.check)} \u2014 ${sanitizeFleetTerminalText(row2.detail)}`
-          }, row2.check, false, undefined, this)),
-          !doctorRunning && doctorOmissionSummary(doctorRows) !== undefined ? /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.warning,
-            children: doctorOmissionSummary(doctorRows)
-          }, undefined, false, undefined, this) : null,
+            children: "No shared hostnames declared. `hestia expose <svc> --shared <name>` creates one."
+          }, undefined, false, undefined, this) : snapshot.shared.map((entry, index) => {
+            const active = index === Math.min(state.sharedSelection, snapshot.shared.length - 1);
+            const holder = entry.holder === undefined ? "unclaimed" : `held by ${entry.holder.project}${entry.holder.mine ? " (yours)" : ""}`;
+            return /* @__PURE__ */ jsxDEV5("box", {
+              style: { flexDirection: "column" },
+              children: [
+                /* @__PURE__ */ jsxDEV5("text", {
+                  fg: active ? fleetTheme.accent : fleetTheme.text,
+                  children: `${active ? "\u258E" : " "} ${sanitizeFleetTerminalText(entry.name)}  ${sanitizeFleetTerminalText(entry.url)}  ${holder}`
+                }, undefined, false, undefined, this),
+                entry.queue.map((waiter, position) => /* @__PURE__ */ jsxDEV5("text", {
+                  fg: fleetTheme.muted,
+                  children: `      ${position + 1}. ${sanitizeFleetTerminalText(waiter.project)}${waiter.mine ? " (yours)" : ""}${waiter.denied ? " \u2014 denied, still queued" : ""}`
+                }, `${entry.name}:${waiter.project}`, false, undefined, this))
+              ]
+            }, entry.name, true, undefined, this);
+          }),
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1 }
+          }, undefined, false, undefined, this),
           /* @__PURE__ */ jsxDEV5("text", {
             fg: fleetTheme.muted,
-            children: "Esc closes this report"
+            children: sharedBusy ? "working\u2026" : "j/k select \xB7 c claim (as selected stack) \xB7 a allow \xB7 x deny \xB7 r release \xB7 Esc/s close"
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this) : null,
@@ -15261,32 +16757,56 @@ function FleetApp({
         terminalWidth: terminal.width,
         terminalHeight: terminal.height,
         children: [
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1, flexDirection: "row" },
             children: [
-              "Branch: ",
-              sanitizeFleetTerminalText(state.confirmDown.branch)
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: padFleetText("Branch", 12)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.bright,
+                children: sanitizeFleetTerminalText(state.confirmDown.branch)
+              }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1, flexDirection: "row" },
             children: [
-              "Repository: ",
-              sanitizeFleetTerminalText(state.confirmDown.repo)
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: padFleetText("Repository", 12)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.text,
+                children: sanitizeFleetTerminalText(state.confirmDown.repo)
+              }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1, flexDirection: "row" },
             children: [
-              "Worktree: ",
-              sanitizeFleetTerminalText(state.confirmDown.worktree)
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: padFleetText("Worktree", 12)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.text,
+                children: sanitizeFleetTerminalText(state.confirmDown.worktree)
+              }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV5("text", {
-            fg: fleetTheme.text,
+          /* @__PURE__ */ jsxDEV5("box", {
+            style: { height: 1, flexDirection: "row" },
             children: [
-              "Project: ",
-              sanitizeFleetTerminalText(state.confirmDown.project)
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.faint,
+                children: padFleetText("Project", 12)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV5("text", {
+                fg: fleetTheme.text,
+                children: sanitizeFleetTerminalText(state.confirmDown.project)
+              }, undefined, false, undefined, this)
             ]
           }, undefined, true, undefined, this),
           /* @__PURE__ */ jsxDEV5("box", {
@@ -15305,15 +16825,33 @@ function FleetApp({
     ]
   }, undefined, true, undefined, this);
 }
-var LOG_RING_CAPACITY = 2000, EMPTY_CAPACITY;
+var LOG_RING_CAPACITY = 2000, TOAST_TTL_MS = 3500, EMPTY_CAPACITY, HELP_ROWS;
 var init_FleetApp = __esm(() => {
+  init_fleet_controller();
   init_terminal_text();
+  init_fleet_text();
   init_fleet_theme();
+  init_fleet_log_rows();
+  init_fleet_format();
+  init_fleet_status();
   init_StackSidebar();
   init_ServicePane();
   init_LogPane();
   init_FleetModal();
   EMPTY_CAPACITY = { maxStacks: 0, live: 0, reserved: 0, queued: 0 };
+  HELP_ROWS = [
+    ["j k \u2191\u2193", "move in focused pane \xB7 Tab cycles panes"],
+    [", . [ ]", "previous / next stack \xB7 service"],
+    ["/", "filter stacks (Esc clears, then exits)"],
+    ["f \xB7 g G", "pause/resume follow \xB7 top / bottom of logs"],
+    ["o", "open selected endpoint in browser"],
+    ["y \xB7 Y", "yank endpoint URL \xB7 stack env block"],
+    ["c l p", "yank direct / local / public URL"],
+    ["s", "shared hostnames (claim, allow, deny, release)"],
+    ["D \xB7 d", "doctor report \xB7 down stack (volumes retained)"],
+    ["1 2 0", "split / stacked / auto layout"],
+    ["q", "quit \xB7 mouse click and wheel work everywhere"]
+  ];
 });
 
 // packages/tui/src/job-control.ts
@@ -15464,16 +17002,51 @@ __export(exports_src, {
 var init_src3 = __esm(() => {
   init_runtime();
   init_fleet_source();
+  init_fleet_controller();
   init_terminal_text();
 });
 
 // packages/cli/src/index.ts
 init_src2();
 init_src();
-import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync23 } from "fs";
-import { dirname as dirname8, join as join24 } from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+import { existsSync as existsSync24 } from "fs";
+import { dirname as dirname8, join as join26 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+var CLI_VERSION = "1.2.0";
+var PACKAGE_NAME = "@tridha643/hestia";
+function compareVersions(a, b) {
+  const parse = (value) => {
+    const [core, pre] = value.split("-", 2);
+    return {
+      core: (core ?? "").split(".").map((part) => Number.parseInt(part, 10) || 0),
+      pre: pre !== undefined && pre.length > 0
+    };
+  };
+  const left = parse(a);
+  const right = parse(b);
+  const length = Math.max(left.core.length, right.core.length);
+  for (let index = 0;index < length; index += 1) {
+    const diff = (left.core[index] ?? 0) - (right.core[index] ?? 0);
+    if (diff !== 0)
+      return diff;
+  }
+  if (left.pre === right.pre)
+    return 0;
+  return left.pre ? -1 : 1;
+}
+async function fetchLatestVersion() {
+  const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok)
+    throw new Error(`npm registry responded ${response.status}`);
+  const body = await response.json();
+  if (typeof body.version !== "string" || body.version.length === 0) {
+    throw new Error("npm registry response has no version");
+  }
+  return body.version;
+}
 function parseFlags(argv) {
   const f = {
     json: false,
@@ -15485,6 +17058,8 @@ function parseFlags(argv) {
     noPort: false,
     keepHostHeader: false,
     overwriteDns: false,
+    cancel: false,
+    check: false,
     noDaemon: false,
     print: false,
     interactive: false,
@@ -15566,6 +17141,22 @@ function parseFlags(argv) {
       f.keepHostHeader = true;
     else if (a === "--overwrite-dns")
       f.overwriteDns = true;
+    else if (a === "--shared") {
+      f.shared = takeValue();
+      if (!f.shared || f.shared.startsWith("--"))
+        f.errors.push("--shared requires a value");
+    } else if (a === "--hostname") {
+      f.hostname = takeValue();
+      if (!f.hostname || f.hostname.startsWith("--"))
+        f.errors.push("--hostname requires a value");
+    } else if (a === "--path") {
+      f.path = takeValue();
+      if (!f.path || f.path.startsWith("--"))
+        f.errors.push("--path requires a value");
+    } else if (a === "--cancel")
+      f.cancel = true;
+    else if (a === "--check")
+      f.check = true;
     else if (a === "--no-daemon")
       f.noDaemon = true;
     else if (a === "--print")
@@ -15637,12 +17228,16 @@ function parseFlags(argv) {
 function validateCommandOptions(argv, command) {
   const allowedByCommand = {
     version: new Set(["--json"]),
+    upgrade: new Set(["--json", "--check"]),
     skill: new Set(["--json"]),
     discover: new Set(["--json"]),
     init: new Set(["--json", "--print", "--scope", "--write", "--no-port"]),
     up: new Set(["--json", "--services", "--workers", "--allow-remote", "--force", "--no-varlock", "--wait", "--no-daemon"]),
     run: new Set(["--json", "--name", "--env", "--no-port", "--varlock", "--signal", "--ready-timeout", "--cwd", "--wait", "--no-daemon"]),
-    expose: new Set(["--json", "--tunnel", "--zone", "--keep-host-header", "--overwrite-dns", "--force", "--ready-timeout"]),
+    expose: new Set(["--json", "--tunnel", "--zone", "--keep-host-header", "--overwrite-dns", "--force", "--ready-timeout", "--shared", "--hostname", "--path"]),
+    claim: new Set(["--json", "--wait", "--cancel"]),
+    release: new Set(["--json"]),
+    share: new Set(["--json"]),
     route: new Set(["--json"]),
     router: new Set(["--json", "--interactive"]),
     config: new Set(["--json", "--file"]),
@@ -15673,7 +17268,10 @@ function validateCommandOptions(argv, command) {
     "--zone",
     "--file",
     "--scope",
-    "--tail"
+    "--tail",
+    "--shared",
+    "--hostname",
+    "--path"
   ]);
   for (let index = 0;index < argv.length; index += 1) {
     const raw = argv[index];
@@ -15715,6 +17313,15 @@ function printStackHuman(r) {
     const pub = r.endpoints.find((e) => e.name === s.name)?.publicUrl;
     out.push(`  \u25CF ${s.name.padEnd(12)} ${s.backend.padEnd(7)} ${port.padEnd(20)} ${s.state}` + (pub !== undefined ? `  ${pub}` : ""));
   }
+  for (const shared of listSharedHostnames()) {
+    const holds = shared.holder?.project === r.project;
+    const queuedHere = (shared.queue ?? []).some((waiter) => waiter.project === r.project);
+    if (!holds && !queuedHere)
+      continue;
+    const pending = (shared.queue ?? []).length;
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    out.push(holds ? `  \u21C4 shared ${shared.name.padEnd(10)} ${url}  HELD` + (pending > 0 ? `  (${pending} queued \u2014 \`hestia share requests\`)` : "") : `  \u21C4 shared ${shared.name.padEnd(10)} ${url}  queued behind ${shared.holder?.project ?? "?"}`);
+  }
   process.stdout.write(out.join(`
 `) + `
 `);
@@ -15724,6 +17331,9 @@ var HELP = `hestia \u2014 per-worktree isolated dev stacks
 usage:
   hestia version [--json]
         print CLI version, state schema, and daemon protocol
+  hestia upgrade [--check] [--json]
+        upgrade hestia to the latest npm release via \`bun add --global\`;
+        --check only reports whether a newer version is available
   hestia skill path [--json]
         print the packaged Hestia agent skill path
   hestia discover [--json]
@@ -15765,6 +17375,27 @@ usage:
         worktrees). URLs land in endpoints[] + HESTIA_<SVC>_URL. These are
         fail-closed but unauthenticated public URLs. Named v1 performs no DNS
         writes and requires wildcard CNAME *.<zone> \u2192 <uuid>.cfargotunnel.com.
+  hestia expose <endpoint> --shared <name> [--hostname <fqdn>] [--path <prefix>]
+                           [--tunnel <t>] [--zone <zone>] [--json]
+        declare + claim a machine-owned SHARED hostname \u2014 a stable public URL
+        for externally-pinned integrations (Slack request URLs, webhook
+        consumers) that cannot chase per-branch hostnames. Exactly one worktree
+        holds it at a time; handoffs are consent-based and switch inside
+        hestiad with zero connector restarts. The target defaults to
+        <name>.<zone>; --hostname points ANY FQDN you control (any zone) at it,
+        and --path /prefix lets several handles share one hostname routed by
+        longest path prefix (e.g. acme.com/slack vs acme.com/stripe). Prefer
+        plain per-branch expose whenever the external side can be configured
+        per branch (dashboards, multi-redirect OAuth)
+  hestia claim <name> [--wait[=secs]] [--cancel] [--json]
+        claim a shared hostname for this worktree. Held names queue DURABLY
+        (position survives daemon restarts and CLI timeouts); --wait blocks
+        until the holder allows or releases, --cancel leaves the queue
+  hestia release <name> [--json]
+        release a held shared hostname; the queue head is granted immediately
+  hestia share list|requests [--json] | share allow|deny <name> [--json]
+        inspect shared hostnames and arbitrate queued claims as the holder:
+        allow hands over now; deny keeps the requester queued until release
   hestia open <service> [path] [--json]
         resolve a service's public URL (from \`expose\`) and open it in the
         browser; the URL is always printed too, so a headless agent can hand
@@ -15819,7 +17450,7 @@ async function main() {
     switch (cmd) {
       case "version": {
         const version = {
-          cliVersion: "1.0.1",
+          cliVersion: CLI_VERSION,
           stateSchema: STATE_SCHEMA_VERSION,
           daemonProtocol: HESTIAD_PROTOCOL_VERSION,
           runtime: "bun"
@@ -15829,6 +17460,45 @@ async function main() {
 `);
         else
           process.stdout.write(`hestia ${version.cliVersion} (state v${version.stateSchema}, daemon v${version.daemonProtocol}, Bun)
+`);
+        break;
+      }
+      case "upgrade": {
+        let latest;
+        try {
+          latest = await fetchLatestVersion();
+        } catch (error) {
+          fail("upgrade-failed", `could not check the latest ${PACKAGE_NAME} version: ${error.message}`, flags.json);
+        }
+        const available = compareVersions(latest, CLI_VERSION) > 0;
+        if (flags.check || !available) {
+          if (flags.json) {
+            process.stdout.write(JSON.stringify({ current: CLI_VERSION, latest, upgradeAvailable: available }) + `
+`);
+          } else if (available) {
+            process.stdout.write(`hestia ${latest} is available (you have ${CLI_VERSION}) \u2014 run \`hestia upgrade\`
+`);
+          } else {
+            process.stdout.write(`hestia ${CLI_VERSION} is the latest release
+`);
+          }
+          break;
+        }
+        const installArgs = ["add", "--global", `${PACKAGE_NAME}@${latest}`];
+        if (!flags.json) {
+          process.stderr.write(`upgrading hestia ${CLI_VERSION} \u2192 ${latest} via \`bun ${installArgs.join(" ")}\`\u2026
+`);
+        }
+        try {
+          execFileSync5("bun", installArgs, { stdio: flags.json ? "ignore" : "inherit" });
+        } catch (error) {
+          fail("upgrade-failed", `\`bun ${installArgs.join(" ")}\` failed: ${error.message}`, flags.json);
+        }
+        if (flags.json)
+          process.stdout.write(JSON.stringify({ current: CLI_VERSION, latest, upgraded: true }) + `
+`);
+        else
+          process.stdout.write(`hestia upgraded ${CLI_VERSION} \u2192 ${latest}
 `);
         break;
       }
@@ -15837,10 +17507,10 @@ async function main() {
           fail("usage", "usage: hestia skill path", flags.json);
         const packageRoot = dirname8(dirname8(fileURLToPath3(import.meta.url)));
         const candidates = [
-          join24(packageRoot, "skills", "hestia", "SKILL.md"),
-          join24(process.cwd(), "skills", "hestia", "SKILL.md")
+          join26(packageRoot, "skills", "hestia", "SKILL.md"),
+          join26(process.cwd(), "skills", "hestia", "SKILL.md")
         ];
-        const path = candidates.find(existsSync23);
+        const path = candidates.find(existsSync24);
         if (path === undefined)
           fail("config-missing", "packaged Hestia skill was not found", flags.json);
         if (flags.json)
@@ -15992,11 +17662,17 @@ ${result.proposed}`);
         if (flags.overwriteDns) {
           fail("usage", "--overwrite-dns was removed; named v1 requires user-managed wildcard DNS", flags.json);
         }
+        if ((flags.hostname !== undefined || flags.path !== undefined) && flags.shared === undefined) {
+          fail("usage", "--hostname/--path only apply with --shared <name>", flags.json);
+        }
         const r = await engine.expose(cwd, services, {
           tunnel: flags.tunnel,
           zone: flags.zone,
           keepHostHeader: flags.keepHostHeader,
           overwriteDns: flags.overwriteDns,
+          shared: flags.shared,
+          hostname: flags.hostname,
+          path: flags.path,
           force: flags.force,
           readyTimeoutMs: flags.readyTimeout
         });
@@ -16007,6 +17683,103 @@ ${result.proposed}`);
           printStackHuman(r);
         break;
       }
+      case "claim": {
+        const name = flags._[1];
+        if (!name || flags._.length > 2) {
+          fail("usage", "usage: hestia claim <name> [--wait[=secs]] [--cancel]", flags.json);
+        }
+        if (flags.cancel) {
+          await engine.cancelSharedClaim(cwd, name);
+          if (flags.json)
+            process.stdout.write(JSON.stringify({ ok: true, cancelled: name }) + `
+`);
+          else
+            process.stdout.write(`left the queue for "${name}"
+`);
+          break;
+        }
+        const { record, result } = await engine.claimShared(cwd, name, {
+          waitMs: flags.wait !== undefined ? flags.wait * 1000 : 0
+        });
+        const hostname = listSharedHostnames().find((candidate) => candidate.name === name)?.hostname;
+        if (flags.json) {
+          process.stdout.write(JSON.stringify({ granted: true, holder: result.holder, record }, null, 2) + `
+`);
+        } else {
+          process.stdout.write(`claimed "${name}"${hostname !== undefined ? ` \u2014 https://${hostname}` : ""} now routes here
+`);
+        }
+        break;
+      }
+      case "release": {
+        const name = flags._[1];
+        if (!name || flags._.length > 2)
+          fail("usage", "usage: hestia release <name>", flags.json);
+        await engine.releaseShared(cwd, name);
+        if (flags.json)
+          process.stdout.write(JSON.stringify({ ok: true, released: name }) + `
+`);
+        else
+          process.stdout.write(`released "${name}" \u2014 next in queue (if any) now holds it
+`);
+        break;
+      }
+      case "share": {
+        const action = flags._[1];
+        if (action === "list" || action === "requests") {
+          const records = listSharedHostnames();
+          const view = records.map((record) => ({
+            name: record.name,
+            hostname: record.hostname,
+            path: record.path,
+            url: `https://${record.hostname}${record.path ?? ""}`,
+            service: record.service,
+            holder: record.holder,
+            queued: record.queue ?? []
+          })).filter((entry) => action === "list" || entry.queued.length > 0);
+          if (flags.json)
+            process.stdout.write(JSON.stringify(view, null, 2) + `
+`);
+          else if (view.length === 0) {
+            process.stdout.write(action === "list" ? `no shared hostnames declared
+` : `no pending claim requests
+`);
+          } else {
+            for (const entry of view) {
+              const holder = entry.holder === undefined ? "unclaimed" : `held by ${entry.holder.project}`;
+              process.stdout.write(`${entry.name.padEnd(16)} ${entry.url}  ${holder}
+`);
+              entry.queued.forEach((waiter, index) => {
+                process.stdout.write(`  ${String(index + 1).padStart(2)}. ${waiter.project}${waiter.denied ? "  (denied \u2014 still queued)" : ""}
+`);
+              });
+            }
+          }
+          break;
+        }
+        const name = flags._[2];
+        if (action !== "allow" && action !== "deny" || !name) {
+          fail("usage", "usage: hestia share list|requests | share allow|deny <name>", flags.json);
+        }
+        if (action === "allow") {
+          await engine.allowShared(cwd, name);
+          if (flags.json)
+            process.stdout.write(JSON.stringify({ ok: true, allowed: name }) + `
+`);
+          else
+            process.stdout.write(`allowed \u2014 "${name}" handed to the next in queue
+`);
+        } else {
+          await engine.denyShared(cwd, name);
+          if (flags.json)
+            process.stdout.write(JSON.stringify({ ok: true, denied: name }) + `
+`);
+          else
+            process.stdout.write(`denied \u2014 the requester stays queued until you release "${name}"
+`);
+        }
+        break;
+      }
       case "route": {
         const action = flags._[1];
         const services = flags._.slice(2);
@@ -16270,8 +18043,8 @@ ${JSON.stringify(result.config, null, 2)}
             process.stdout.write(JSON.stringify(line) + `
 `);
           } else {
-            const text = line.meta ? `[hestia] ${line.text}` : line.text;
-            process.stdout.write(`${line.service.padEnd(nameWidth)} \u2502 ${text}
+            const text2 = line.meta ? `[hestia] ${line.text}` : line.text;
+            process.stdout.write(`${line.service.padEnd(nameWidth)} \u2502 ${text2}
 `);
           }
         }
@@ -16336,7 +18109,7 @@ ${JSON.stringify(result.config, null, 2)}
         } else if (sub === "stop") {
           if (launchdManagesThisHome()) {
             const uid = process.getuid?.() ?? 501;
-            execFileSync4("launchctl", ["bootout", `gui/${uid}/dev.hestia.daemon`]);
+            execFileSync5("launchctl", ["bootout", `gui/${uid}/dev.hestia.daemon`]);
             process.stderr.write("warning: launchd agent booted out \u2014 `hestia daemon install` re-enables reboot revival\n");
           } else {
             await stopDaemonProcess();
@@ -16402,6 +18175,10 @@ ${JSON.stringify(result.config, null, 2)}
     fail("internal", err.message ?? String(err), flags.json);
   }
 }
-main();
+if (import.meta.main)
+  main();
+export {
+  compareVersions
+};
 
-//# debugId=7C129FA1100BA38864756E2164756E21
+//# debugId=E655EED0C9FC8A1364756E2164756E21