@tridha643/hestia 1.0.1 → 1.2.0

package/dist/daemon.js

@@ -6945,9 +6945,9 @@ var require_public_api = __commonJS((exports) => {
 });
 
 // packages/engine/src/daemon/main.ts
-import { chmodSync as chmodSync6, rmSync as rmSync10 } from "fs";
+import { chmodSync as chmodSync6, rmSync as rmSync11 } from "fs";
 import { randomBytes } from "crypto";
-import { join as join23 } from "path";
+import { join as join25 } from "path";
 
 // packages/session-broker-core/src/limits.ts
 var MAX_HTTP_BODY_BYTES = 4 * 1024 * 1024;
@@ -7807,6 +7807,19 @@ import {
 } from "fs";
 import { dirname } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
+function fsyncDir(path) {
+  let fd;
+  try {
+    fd = openSync(dirname(path), "r");
+  } catch {
+    return;
+  }
+  try {
+    fsyncSync(fd);
+  } catch {} finally {
+    closeSync(fd);
+  }
+}
 function writeAtomicJsonFile(path, value, options = {}) {
   mkdirSync(dirname(path), { recursive: true });
   const temporaryPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
@@ -7828,6 +7841,7 @@ function writeAtomicJsonFile(path, value, options = {}) {
     rmSync(temporaryPath, { force: true });
     throw error;
   }
+  fsyncDir(path);
 }
 function writeAtomicTextFile(path, source, mode = 384) {
   mkdirSync(dirname(path), { recursive: true });
@@ -7849,6 +7863,7 @@ function writeAtomicTextFile(path, source, mode = 384) {
     rmSync(temporaryPath, { force: true });
     throw error;
   }
+  fsyncDir(path);
 }
 
 // packages/engine/src/proc/pidfile.ts
@@ -8203,10 +8218,10 @@ function clearState(worktreeRoot, project) {
 }
 
 // packages/engine/src/index.ts
-import { existsSync as existsSync20, rmSync as rmSync9 } from "fs";
+import { existsSync as existsSync21, rmSync as rmSync10 } from "fs";
 import { execFile as execFile10 } from "child_process";
 import { promisify as promisify9 } from "util";
-import { join as join22, resolve as resolve2 } from "path";
+import { join as join24, resolve as resolve2 } from "path";
 import { createHash as createHash7 } from "crypto";
 import { resolve4, resolve6, resolveCname } from "dns/promises";
 
@@ -9402,10 +9417,10 @@ import { execFile as execFile7 } from "child_process";
 import { Agent, createServer as createServer2, request as httpRequest } from "http";
 import { createConnection, createServer as createNetServer } from "net";
 import { promisify as promisify6 } from "util";
-import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4 } from "fs";
-import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "fs";
+import { chmodSync as chmodSync5, lstatSync, mkdirSync as mkdirSync7, rmSync as rmSync9 } from "fs";
 import { tmpdir } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { createHash as createHash5 } from "crypto";
 
 // packages/engine/src/router/router-config.ts
@@ -9876,6 +9891,39 @@ async function releaseSlot(port, project) {
     });
   } catch {}
 }
+async function sharedVerb(port, verb, body) {
+  const timeoutMs = (body.waitMs ?? 0) + 5000;
+  let response;
+  try {
+    response = await fetch(`http://127.0.0.1:${port}/hestia/shared/${verb}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...daemonAuthHeaders(port) },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (error) {
+    throw new HestiaError("daemon-unreachable", `could not reach hestiad on 127.0.0.1:${port}: ${error.message}`);
+  }
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new HestiaError(payload.code ?? "daemon-unreachable", payload.error ?? `daemon rejected shared ${verb}: HTTP ${response.status}`);
+  }
+  return {
+    granted: payload.granted === true,
+    holder: payload.holder,
+    queued: payload.queued ?? []
+  };
+}
+async function releaseSharedForProject(port, project, service) {
+  try {
+    await fetch(`http://127.0.0.1:${port}/hestia/shared/release-project`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...daemonAuthHeaders(port) },
+      body: JSON.stringify({ project, service }),
+      signal: AbortSignal.timeout(2000)
+    });
+  } catch {}
+}
 
 // packages/engine/src/daemon/launchd.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync11, rmSync as rmSync6 } from "fs";
@@ -10258,9 +10306,57 @@ function createRoutes(admission, startedAt, dependencies) {
       await admission.release(body.project);
       return json({ ok: true });
     }
+    if (url.pathname.startsWith("/hestia/shared/") && request.method === "POST") {
+      let body;
+      try {
+        body = await parseJsonBody(request);
+      } catch (error) {
+        return json({ error: `invalid JSON body: ${error.message}` }, 400);
+      }
+      const verb = url.pathname.slice("/hestia/shared/".length);
+      if (!isProject(body.project))
+        return json({ error: "project is invalid" }, 400);
+      const project = body.project;
+      try {
+        if (verb === "release-project") {
+          const service = body.service === undefined ? undefined : isService(body.service) ? body.service : null;
+          if (service === null)
+            return json({ error: "service is invalid" }, 400);
+          await dependencies.shared.releaseProject(project, service);
+          return json({ ok: true });
+        }
+        if (!isSharedName(body.name))
+          return json({ error: "name is invalid" }, 400);
+        const name = body.name;
+        if (verb === "claim") {
+          if (typeof body.worktree !== "string" || !body.worktree.startsWith("/") || body.worktree.length > 4096) {
+            return json({ error: "worktree is invalid" }, 400);
+          }
+          const waitMs = typeof body.waitMs === "number" && Number.isFinite(body.waitMs) && body.waitMs > 0 ? Math.min(body.waitMs, 24 * 60 * 60 * 1000) : 0;
+          return json(await dependencies.shared.request(name, { project, worktree: body.worktree }, waitMs));
+        }
+        if (verb === "allow")
+          return json(await dependencies.shared.allow(name, project));
+        if (verb === "deny")
+          return json(await dependencies.shared.deny(name, project));
+        if (verb === "release")
+          return json(await dependencies.shared.release(name, project));
+        if (verb === "cancel")
+          return json(await dependencies.shared.cancel(name, project));
+      } catch (error) {
+        if (error instanceof HestiaError) {
+          return json({ error: error.message, code: error.code }, error.code === "shared-not-found" ? 404 : 409);
+        }
+        return json({ error: error.message }, 500);
+      }
+      return json({ error: `unknown route ${url.pathname}` }, 404);
+    }
     return json({ error: `unknown route ${url.pathname}` }, 404);
   };
 }
+function isSharedName(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value);
+}
 
 // packages/engine/src/daemon/ensure.ts
 var START_TIMEOUT_MS = 5000;
@@ -10477,6 +10573,149 @@ async function keychainHasFingerprint(keychain, fingerprint) {
   }
 }
 
+// packages/engine/src/tunnel/shared.ts
+import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
+import { join as join16 } from "path";
+var NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
+var LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var PATH_SEGMENT_RE = /^[A-Za-z0-9._~!$&'()*+,;=:@%-]+$/;
+function sharedRoot() {
+  return join16(hestiaHome(), "shared");
+}
+function sharedPath(name) {
+  return join16(sharedRoot(), `${name}.json`);
+}
+function assertSharedName(name) {
+  if (!NAME_RE.test(name)) {
+    throw new HestiaError("usage", `shared hostname handle ${JSON.stringify(name)} must be a DNS label: ` + `lowercase alphanumerics and hyphens, at most 63 characters`);
+  }
+}
+function assertSharedHostnameFqdn(hostname) {
+  const labels = hostname.split(".");
+  const valid = hostname.length <= 253 && hostname === hostname.toLowerCase() && labels.length >= 2 && labels.every((label) => LABEL_RE.test(label));
+  if (!valid) {
+    throw new HestiaError("usage", `shared hostname ${JSON.stringify(hostname)} must be a fully-qualified ` + `lowercase domain (e.g. slack.acme.com)`);
+  }
+}
+function normalizeSharedPath(input) {
+  if (input === undefined)
+    return;
+  const trimmed = input.trim();
+  const segments = trimmed.split("/").filter((segment) => segment !== "");
+  for (const segment of segments) {
+    if (segment === "." || segment === ".." || !PATH_SEGMENT_RE.test(segment)) {
+      throw new HestiaError("usage", `shared hostname path ${JSON.stringify(input)} must be a URL path prefix ` + `like /webhooks/slack (no query, fragment, or ".." segments)`);
+    }
+  }
+  if (segments.length === 0)
+    return;
+  return `/${segments.join("/")}`;
+}
+function sharedPathMatches(prefix, requestPath) {
+  if (prefix === undefined)
+    return true;
+  return requestPath === prefix || requestPath.startsWith(`${prefix}/`);
+}
+function withSharedLock(fn) {
+  return withLock(sharedRoot(), fn);
+}
+function parseShared(source) {
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    return null;
+  }
+  if (value.schemaVersion !== STATE_SCHEMA_VERSION || typeof value.name !== "string" || !NAME_RE.test(value.name) || typeof value.hostname !== "string" || value.hostname.length === 0 || typeof value.tunnelUuid !== "string" || value.tunnelUuid.length === 0 || typeof value.zone !== "string" || value.zone.length === 0 || typeof value.service !== "string" || value.service.length === 0 || typeof value.createdAt !== "string")
+    return null;
+  if (value.path !== undefined && (typeof value.path !== "string" || !value.path.startsWith("/"))) {
+    return null;
+  }
+  if (value.holder !== undefined) {
+    const holder = value.holder;
+    if (typeof holder.project !== "string" || typeof holder.worktree !== "string" || typeof holder.service !== "string" || typeof holder.at !== "string")
+      return null;
+  }
+  if (value.queue !== undefined) {
+    if (!Array.isArray(value.queue))
+      return null;
+    for (const entry of value.queue) {
+      if (typeof entry !== "object" || entry === null || typeof entry.project !== "string" || typeof entry.worktree !== "string" || typeof entry.at !== "string")
+        return null;
+    }
+  }
+  return value;
+}
+function readSharedHostname(name) {
+  const p = sharedPath(name);
+  if (!existsSync13(p))
+    return null;
+  try {
+    return parseShared(readFileSync13(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function listSharedHostnames() {
+  const root = sharedRoot();
+  if (!existsSync13(root))
+    return [];
+  const records = [];
+  for (const entry of readdirSync4(root).sort()) {
+    if (!entry.endsWith(".json"))
+      continue;
+    const record = readSharedHostname(entry.slice(0, -".json".length));
+    if (record !== null && `${record.name}.json` === entry)
+      records.push(record);
+  }
+  return records;
+}
+async function declareSharedHostname(record) {
+  assertSharedName(record.name);
+  assertSharedHostnameFqdn(record.hostname);
+  const path = normalizeSharedPath(record.path);
+  return withSharedLock(async () => {
+    const collision = listSharedHostnames().find((candidate) => candidate.name !== record.name && candidate.hostname === record.hostname && (candidate.path ?? undefined) === (path ?? undefined));
+    if (collision !== undefined) {
+      throw new HestiaError("shared-conflict", `${record.hostname}${path ?? ""} is already declared as shared hostname ` + `"${collision.name}" \u2014 pick a distinct path or handle`);
+    }
+    const existing = readSharedHostname(record.name);
+    if (existing !== null) {
+      if (existing.hostname !== record.hostname || existing.tunnelUuid !== record.tunnelUuid || (existing.path ?? undefined) !== (path ?? undefined)) {
+        throw new HestiaError("shared-conflict", `shared hostname "${record.name}" already declared as ${existing.hostname}` + `${existing.path ?? ""} on tunnel ${existing.tunnelUuid} \u2014 release and remove it before re-pointing`);
+      }
+      const merged = { ...existing, service: record.service, zone: record.zone };
+      writeAtomicJsonFile(sharedPath(record.name), merged);
+      return merged;
+    }
+    const fresh = {
+      schemaVersion: STATE_SCHEMA_VERSION,
+      ...record,
+      createdAt: new Date().toISOString()
+    };
+    if (path === undefined)
+      delete fresh.path;
+    else
+      fresh.path = path;
+    writeAtomicJsonFile(sharedPath(record.name), fresh);
+    return fresh;
+  });
+}
+async function updateSharedHostname(name, mutate) {
+  return withSharedLock(async () => {
+    const existing = readSharedHostname(name);
+    if (existing === null)
+      return null;
+    const next = mutate(structuredClone(existing));
+    if (next.queue !== undefined && next.queue.length === 0)
+      delete next.queue;
+    if (next.holder === undefined)
+      delete next.holder;
+    writeAtomicJsonFile(sharedPath(name), next);
+    return next;
+  });
+}
+
 // packages/engine/src/router/local-http-router.ts
 var pexec6 = promisify6(execFile7);
 var ROUTE_REFRESH_MS = 1000;
@@ -10492,18 +10731,25 @@ var HOP_BY_HOP_HEADERS = new Set([
   "transfer-encoding",
   "upgrade"
 ]);
+function pathnameOf(target) {
+  if (target === undefined || target.length === 0)
+    return "/";
+  const cut = target.search(/[?#]/);
+  const path = cut < 0 ? target : target.slice(0, cut);
+  return path.startsWith("/") ? path : "/";
+}
 
 class OriginOwnershipError extends Error {
 }
 function readRouterStackRecords() {
-  const stacksDir = join16(hestiaHome(), "stacks");
-  if (!existsSync13(stacksDir))
+  const stacksDir = join17(hestiaHome(), "stacks");
+  if (!existsSync14(stacksDir))
     return [];
   const records = [];
-  for (const project of readdirSync4(stacksDir).sort()) {
-    const path = join16(stacksDir, project, "stack.json");
+  for (const project of readdirSync5(stacksDir).sort()) {
+    const path = join17(stacksDir, project, "stack.json");
     try {
-      const source = readFileSync13(path);
+      const source = readFileSync14(path);
       if (source.byteLength > MAX_MIRROR_BYTES)
         continue;
       const record = parseStackRecord(source.toString("utf8"), path);
@@ -10655,11 +10901,11 @@ function internalEndpointAuthority(project, service) {
 function publicGatewaySocketPath() {
   const uid = process.getuid?.() ?? 501;
   const homeHash = createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12);
-  return join16(tmpdir(), `hestia-${uid}`, homeHash, "origin.sock");
+  return join17(tmpdir(), `hestia-${uid}`, homeHash, "origin.sock");
 }
 function prepareGatewaySocket(path) {
   const uid = process.getuid?.();
-  const directories = [join16(tmpdir(), `hestia-${uid ?? 501}`), join16(tmpdir(), `hestia-${uid ?? 501}`, createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12))];
+  const directories = [join17(tmpdir(), `hestia-${uid ?? 501}`), join17(tmpdir(), `hestia-${uid ?? 501}`, createHash5("sha256").update(hestiaHome()).digest("hex").slice(0, 12))];
   for (const directory of directories) {
     mkdirSync7(directory, { recursive: true, mode: 448 });
     const stat2 = lstatSync(directory);
@@ -10668,13 +10914,13 @@ function prepareGatewaySocket(path) {
     }
     chmodSync5(directory, 448);
   }
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return;
   const stat = lstatSync(path);
   if (stat.isSymbolicLink() || !stat.isSocket() || uid !== undefined && stat.uid !== uid) {
     throw new Error(`refusing unsafe existing Hestia gateway socket ${path}`);
   }
-  rmSync8(path);
+  rmSync9(path);
 }
 function sendRouterResponse(response, status, message) {
   response.writeHead(status, { "content-type": "text/plain; charset=utf-8", "x-hestia-router": "1" });
@@ -10687,6 +10933,7 @@ class HestiaLocalHttpRouter {
   #frontServer = createNetServer((socket) => this.#acceptFrontSocket(socket));
   #unixServer = createNetServer((socket) => this.#acceptFrontSocket(socket));
   #targets = new Map;
+  #sharedRoutes = new Map;
   #timer;
   async start() {
     await new Promise((resolve2, reject) => {
@@ -10790,12 +11037,52 @@ class HestiaLocalHttpRouter {
         }
       }
     }
+    const sharedRoutes = new Map;
+    for (const shared of listSharedHostnames()) {
+      const hostname = shared.hostname.toLowerCase();
+      targets.delete(hostname);
+      const holder = shared.holder;
+      let target;
+      if (holder !== undefined) {
+        const stack = records.find((record) => record.project === holder.project);
+        const endpoint = stack?.endpoints.find((candidate2) => (candidate2.alias ?? candidate2.name) === holder.service);
+        const service = stack?.services.find((candidate2) => candidate2.name === (endpoint?.workload ?? endpoint?.name));
+        const binding = service?.bindings?.find((candidate2) => `${candidate2.target}/${candidate2.protocol}` === endpoint?.binding);
+        const publishedPort = binding?.publishedPort ?? service?.publishedPort;
+        const candidate = {
+          hostname,
+          project: holder.project,
+          service: service === undefined || service.backend === "tunnel" || publishedPort === undefined ? undefined : { ...service, publishedPort }
+        };
+        const previous = this.#sharedRoutes.get(hostname)?.find((entry) => entry.name === shared.name)?.target;
+        target = previous !== undefined && targetIdentity(previous) === targetIdentity(candidate) ? previous : candidate;
+      }
+      const list = sharedRoutes.get(hostname) ?? [];
+      list.push({ path: shared.path, name: shared.name, claimed: holder !== undefined, target });
+      sharedRoutes.set(hostname, list);
+    }
+    for (const list of sharedRoutes.values()) {
+      list.sort((left, right) => (right.path?.length ?? -1) - (left.path?.length ?? -1));
+    }
     reconcilePortlessAliases([...targets.keys()].filter((hostname) => hostname.endsWith(".localhost")), this.port);
-    for (const [hostname, target] of this.#targets) {
-      if (targets.get(hostname) !== target)
+    const retained = new Set(targets.values());
+    for (const list of sharedRoutes.values()) {
+      for (const entry of list)
+        if (entry.target !== undefined)
+          retained.add(entry.target);
+    }
+    const priorTargets = [...this.#targets.values()];
+    for (const list of this.#sharedRoutes.values()) {
+      for (const entry of list)
+        if (entry.target !== undefined)
+          priorTargets.push(entry.target);
+    }
+    for (const target of priorTargets) {
+      if (!retained.has(target))
         target.agent?.destroy();
     }
     this.#targets = targets;
+    this.#sharedRoutes = sharedRoutes;
   }
   stop() {
     if (this.#timer)
@@ -10809,7 +11096,7 @@ class HestiaLocalHttpRouter {
       target.agent?.destroy();
     this.#frontServer.close();
     this.#unixServer.close();
-    rmSync8(this.socketPath, { force: true });
+    rmSync9(this.socketPath, { force: true });
     this.#server.close();
   }
   #acceptFrontSocket(socket) {
@@ -10854,16 +11141,40 @@ Connection: close\r
 `));
     socket.once("error", () => internal.destroy());
   }
+  #matchTarget(hostname, requestPath) {
+    const routes = this.#sharedRoutes.get(hostname);
+    if (routes !== undefined) {
+      const entry = routes.find((candidate) => sharedPathMatches(candidate.path, requestPath));
+      if (entry === undefined)
+        return { status: 404, message: "Hestia route not found" };
+      if (!entry.claimed) {
+        return {
+          status: 503,
+          message: `Shared hostname unclaimed \u2014 run \`hestia claim ${entry.name}\` in the worktree that should receive this traffic`
+        };
+      }
+      if (entry.target?.service?.publishedPort === undefined) {
+        return { status: 503, message: "Hestia route origin unavailable" };
+      }
+      return { target: entry.target };
+    }
+    const target = this.#targets.get(hostname);
+    if (target === undefined)
+      return { status: 404, message: "Hestia route not found" };
+    if (target.service?.publishedPort === undefined) {
+      return { status: 503, message: "Hestia route origin unavailable" };
+    }
+    return { target };
+  }
   async#proxyHttp(request, response) {
     const hostname = parseRouteAuthority(request.headers.host);
     if (hostname === null)
       return sendRouterResponse(response, 400, "Malformed Host authority");
-    const target = this.#targets.get(hostname);
-    if (target === undefined)
-      return sendRouterResponse(response, 404, "Hestia route not found");
-    const port = target.service?.publishedPort;
-    if (port === undefined)
-      return sendRouterResponse(response, 503, "Hestia route origin unavailable");
+    const match = this.#matchTarget(hostname, pathnameOf(request.url));
+    if ("status" in match)
+      return sendRouterResponse(response, match.status, match.message);
+    const target = match.target;
+    const port = target.service.publishedPort;
     if (await verifyLocalRouterTarget(target) !== port) {
       return sendRouterResponse(response, 503, "Hestia route origin unavailable");
     }
@@ -10904,16 +11215,19 @@ Connection: close\r
 `);
       return;
     }
-    const target = this.#targets.get(host);
-    const port = target?.service?.publishedPort;
-    if (target === undefined || port === undefined) {
-      socket.end(`HTTP/1.1 ${target === undefined ? "404 Not Found" : "503 Service Unavailable"}\r
+    const rawHeaderLines = header.slice(0, -4).split(`\r
+`);
+    const requestPath = pathnameOf(rawHeaderLines[0]?.split(" ")[1]);
+    const match = this.#matchTarget(host, requestPath);
+    if ("status" in match) {
+      const reason = match.status === 404 ? "404 Not Found" : "503 Service Unavailable";
+      socket.end(`HTTP/1.1 ${reason}\r
 \r
 `);
       return;
     }
-    const rawHeaderLines = header.slice(0, -4).split(`\r
-`);
+    const target = match.target;
+    const port = target.service.publishedPort;
     const connectionValues = rawHeaderLines.slice(1).filter((line) => /^connection:/i.test(line)).map((line) => line.slice(line.indexOf(":") + 1));
     const connectionNames = connectionHeaderTokens(connectionValues);
     const retainedHeaders = rawHeaderLines.slice(1).filter((line) => {
@@ -10963,15 +11277,15 @@ Connection: close\r
 }
 
 // packages/engine/src/wrangler/adapter.ts
-import { existsSync as existsSync14, readFileSync as readFileSync14, statSync as statSync2 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync15, statSync as statSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join17, relative as relative3 } from "path";
+import { dirname as dirname5, join as join18, relative as relative3 } from "path";
 import { connect } from "net";
 function privateRegistryDir(worktreeRoot) {
-  return join17(worktreeRoot, ".hestia", "wrangler-registry");
+  return join18(worktreeRoot, ".hestia", "wrangler-registry");
 }
 function globalRegistryDir() {
-  return process.env.WRANGLER_REGISTRY_PATH ?? join17(homedir3(), ".wrangler", "config", "registry");
+  return process.env.WRANGLER_REGISTRY_PATH ?? join18(homedir3(), ".wrangler", "config", "registry");
 }
 var HEARTBEAT_FRESH_MS = 60000;
 function tcpConnectable(address, timeoutMs = 500) {
@@ -10995,19 +11309,19 @@ function tcpConnectable(address, timeoutMs = 500) {
 }
 async function preflightForeignSessions(workers) {
   const dir = globalRegistryDir();
-  if (!existsSync14(dir))
+  if (!existsSync15(dir))
     return;
   for (const w of workers) {
     if (w.name === null)
       continue;
-    const entryPath = join17(dir, w.name);
-    if (!existsSync14(entryPath))
+    const entryPath = join18(dir, w.name);
+    if (!existsSync15(entryPath))
       continue;
     const freshMs = Date.now() - statSync2(entryPath).mtimeMs;
     let live = freshMs < HEARTBEAT_FRESH_MS;
     if (!live) {
       try {
-        const entry = JSON.parse(readFileSync14(entryPath, "utf8"));
+        const entry = JSON.parse(readFileSync15(entryPath, "utf8"));
         live = entry.debugPortAddress ? await tcpConnectable(entry.debugPortAddress) : false;
       } catch {
         live = false;
@@ -11030,8 +11344,8 @@ async function planWorkers(worktreeRoot, opts) {
   const wranglerBinFor = (configPath) => {
     let dir = dirname5(configPath);
     for (;; ) {
-      const candidate = join17(dir, "node_modules", ".bin", "wrangler");
-      if (existsSync14(candidate))
+      const candidate = join18(dir, "node_modules", ".bin", "wrangler");
+      if (existsSync15(candidate))
         return candidate;
       if (dir === worktreeRoot)
         return null;
@@ -11096,11 +11410,11 @@ async function planWorkers(worktreeRoot, opts) {
 }
 
 // packages/engine/src/wrangler/verify.ts
-import { existsSync as existsSync15, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6 } from "fs";
 function namesIn(dir) {
-  if (!existsSync15(dir))
+  if (!existsSync16(dir))
     return new Set;
-  return new Set(readdirSync5(dir));
+  return new Set(readdirSync6(dir));
 }
 function snapshotGlobalRegistry() {
   return namesIn(globalRegistryDir());
@@ -11125,16 +11439,16 @@ function globalGainWarnings(before, ourNames) {
 // packages/engine/src/tunnel/cloudflared.ts
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify7 } from "util";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var pexec7 = promisify7(execFile8);
 var BIN = "cloudflared";
 function cloudflaredHome() {
-  return process.env.HESTIA_CLOUDFLARED_HOME ?? join18(homedir4(), ".cloudflared");
+  return process.env.HESTIA_CLOUDFLARED_HOME ?? join19(homedir4(), ".cloudflared");
 }
 function credFilePath(uuid) {
-  return process.env.TUNNEL_CRED_FILE ?? join18(cloudflaredHome(), `${uuid}.json`);
+  return process.env.TUNNEL_CRED_FILE ?? join19(cloudflaredHome(), `${uuid}.json`);
 }
 async function run(args, timeoutMs = 30000) {
   try {
@@ -11163,7 +11477,7 @@ async function adoptTunnel(name) {
     throw new HestiaError("tunnel-not-found", `no tunnel named "${name}" on this account \u2014 create it once with ` + `\`cloudflared tunnel create ${name}\``);
   }
   const credFile = credFilePath(entry.id);
-  if (!existsSync16(credFile)) {
+  if (!existsSync17(credFile)) {
     throw new HestiaError("tunnel-auth-missing", `credentials for tunnel "${name}" not found at ${credFile} \u2014 ` + `run \`cloudflared tunnel create\` on this machine or copy the JSON`);
   }
   return { uuid: entry.id, credFile, connections: entry.connections.length };
@@ -11171,8 +11485,8 @@ async function adoptTunnel(name) {
 
 // packages/engine/src/tunnel/ingress.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { join as join20 } from "path";
 var LABEL_MAX = 63;
 var HASH_LEN = 6;
 function hostnameFor(tunnelName, branch, service, zone) {
@@ -11192,12 +11506,12 @@ function inferZone(baseRules) {
   return zones.size === 1 ? [...zones][0] : undefined;
 }
 function importBaseRules(uuid, name) {
-  const p = join19(cloudflaredHome(), "config.yml");
-  if (!existsSync17(p))
+  const p = join20(cloudflaredHome(), "config.yml");
+  if (!existsSync18(p))
     return [];
   let parsed;
   try {
-    parsed = $parse(readFileSync15(p, "utf8"));
+    parsed = $parse(readFileSync16(p, "utf8"));
   } catch {
     return [];
   }
@@ -11209,7 +11523,12 @@ function importBaseRules(uuid, name) {
   return parsed.ingress.filter((r) => r.hostname !== undefined || r.path !== undefined);
 }
 function generateMergedConfig(opts) {
-  assertDisjoint(opts.baseRules, opts.dynamicRules);
+  assertDisjoint(opts.baseRules, opts.dynamicRules, opts.sharedRules ?? []);
+  const sharedHostnames = [...new Set((opts.sharedRules ?? []).map((s) => s.hostname))];
+  const shared = sharedHostnames.map((hostname) => ({
+    hostname,
+    service: `unix:${publicGatewaySocketPath()}`
+  }));
   const dynamic = opts.dynamicRules.map((d) => ({
     hostname: d.hostname,
     service: `unix:${publicGatewaySocketPath()}`,
@@ -11220,17 +11539,30 @@ function generateMergedConfig(opts) {
     "credentials-file": opts.credFile,
     ingress: [
       ...opts.baseRules,
+      ...shared,
       ...dynamic,
       { service: "http_status:404" }
     ]
   });
 }
-function assertDisjoint(base, dynamic) {
+function assertDisjoint(base, dynamic, shared) {
   const seen = new Map;
   for (const r of base) {
     if (r.hostname !== undefined)
       seen.set(r.hostname, "the user's static rules");
   }
+  const sharedByHost = new Map;
+  for (const s of shared) {
+    if (!sharedByHost.has(s.hostname))
+      sharedByHost.set(s.hostname, s.name);
+  }
+  for (const [hostname, name] of sharedByHost) {
+    const holder = seen.get(hostname);
+    if (holder !== undefined) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} ("${name}") is already claimed by ${holder}`);
+    }
+    seen.set(hostname, `shared hostname "${name}"`);
+  }
   for (const d of dynamic) {
     const holder = seen.get(d.hostname);
     if (holder !== undefined) {
@@ -11242,12 +11574,91 @@ function assertDisjoint(base, dynamic) {
 
 // packages/engine/src/tunnel/registry.ts
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync16,
-  readdirSync as readdirSync6
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync7
 } from "fs";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
+
+// packages/engine/src/tunnel/orphans.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { join as join21 } from "path";
+function hestiaTunnelMarker(uuid) {
+  return join21(hestiaHome(), "tunnel", uuid);
+}
+function parseLocalHestiaConnectors(psOutput, marker) {
+  const rows = [];
+  for (const line of psOutput.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "")
+      continue;
+    const m = trimmed.match(/^(\d+)\s+(\d+)\s+(.*)$/);
+    if (m === null)
+      continue;
+    const command = m[3];
+    if (!command.includes(marker))
+      continue;
+    if (!/(^|[\/\s])cloudflared(\s|$)/.test(command))
+      continue;
+    rows.push({ pid: Number(m[1]), pgid: Number(m[2]), command });
+  }
+  return rows;
+}
+function listLocalHestiaConnectors(uuid) {
+  let out;
+  try {
+    out = execFileSync4("ps", ["-Ao", "pid=,pgid=,command="], {
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024,
+      env: { ...process.env, LC_ALL: "C", LANG: "C" }
+    });
+  } catch {
+    return [];
+  }
+  return parseLocalHestiaConnectors(out, hestiaTunnelMarker(uuid));
+}
+var REAP_GRACE_MS = 5000;
+var REAP_POLL_MS = 100;
+async function reapOrphanConnectors(uuid, keep) {
+  const procs = listLocalHestiaConnectors(uuid).filter((p) => {
+    if (keep === undefined)
+      return true;
+    return p.pgid !== keep.pgid && p.pid !== keep.pid;
+  });
+  if (procs.length === 0)
+    return { reapedGroups: 0, pids: [] };
+  const groups = new Set(procs.map((p) => p.pgid));
+  const pids = procs.map((p) => p.pid);
+  for (const pgid of groups) {
+    try {
+      process.kill(-pgid, "SIGTERM");
+    } catch {}
+  }
+  const deadline = Date.now() + REAP_GRACE_MS;
+  while (Date.now() < deadline) {
+    const still = listLocalHestiaConnectors(uuid).filter((p) => {
+      if (keep === undefined)
+        return true;
+      return p.pgid !== keep.pgid && p.pid !== keep.pid;
+    });
+    if (still.length === 0)
+      return { reapedGroups: groups.size, pids };
+    await new Promise((r) => setTimeout(r, REAP_POLL_MS));
+  }
+  for (const p of listLocalHestiaConnectors(uuid)) {
+    if (keep !== undefined && (p.pgid === keep.pgid || p.pid === keep.pid))
+      continue;
+    try {
+      process.kill(-p.pgid, "SIGKILL");
+    } catch {}
+    try {
+      process.kill(p.pid, "SIGKILL");
+    } catch {}
+  }
+  return { reapedGroups: groups.size, pids };
+}
 
 // packages/engine/src/tunnel/verify.ts
 var POLL_MS4 = 300;
@@ -11295,24 +11706,24 @@ async function quickTunnelUrl(metricsPort, timeoutMs) {
 var CONNECTOR = "connector";
 var READY_TIMEOUT_MS2 = 30000;
 function tunnelDir(uuid) {
-  return join20(hestiaHome(), "tunnel", uuid);
+  return join22(hestiaHome(), "tunnel", uuid);
 }
 function configPath(uuid) {
-  return join20(tunnelDir(uuid), "config.yml");
+  return join22(tunnelDir(uuid), "config.yml");
 }
 function adoptedMarker(uuid) {
-  return join20(tunnelDir(uuid), "adopted.json");
+  return join22(tunnelDir(uuid), "adopted.json");
 }
 function isAdopted(uuid) {
-  return existsSync18(adoptedMarker(uuid));
+  return existsSync19(adoptedMarker(uuid));
 }
 function readAdopted(uuid) {
   const p = adoptedMarker(uuid);
-  if (!existsSync18(p))
+  if (!existsSync19(p))
     return null;
   let marker;
   try {
-    marker = JSON.parse(readFileSync16(p, "utf8"));
+    marker = JSON.parse(readFileSync17(p, "utf8"));
   } catch {
     marker = {};
   }
@@ -11320,14 +11731,14 @@ function readAdopted(uuid) {
     return { uuid, name: marker.name, credFile: marker.credFile, reconstructed: false };
   }
   let name;
-  const stacksDir = join20(hestiaHome(), "stacks");
-  if (existsSync18(stacksDir)) {
-    for (const project of readdirSync6(stacksDir)) {
-      const sp = join20(stacksDir, project, "stack.json");
-      if (!existsSync18(sp))
+  const stacksDir = join22(hestiaHome(), "stacks");
+  if (existsSync19(stacksDir)) {
+    for (const project of readdirSync7(stacksDir)) {
+      const sp = join22(stacksDir, project, "stack.json");
+      if (!existsSync19(sp))
         continue;
       try {
-        const record = parseStackRecord(readFileSync16(sp, "utf8"), sp);
+        const record = parseStackRecord(readFileSync17(sp, "utf8"), sp);
         if (record.tunnel?.uuid === uuid) {
           name = record.tunnel.name;
           break;
@@ -11343,24 +11754,24 @@ function readAdopted(uuid) {
   };
 }
 function listAdopted() {
-  const root = join20(hestiaHome(), "tunnel");
-  if (!existsSync18(root))
+  const root = join22(hestiaHome(), "tunnel");
+  if (!existsSync19(root))
     return [];
-  return readdirSync6(root).filter((uuid) => isAdopted(uuid));
+  return readdirSync7(root).filter((uuid) => isAdopted(uuid));
 }
 function collectDynamicRules(uuid) {
-  const stacksDir = join20(hestiaHome(), "stacks");
+  const stacksDir = join22(hestiaHome(), "stacks");
   const rules = [];
   const dropped = [];
-  if (!existsSync18(stacksDir))
+  if (!existsSync19(stacksDir))
     return { rules, dropped };
-  for (const project of readdirSync6(stacksDir)) {
-    const p = join20(stacksDir, project, "stack.json");
-    if (!existsSync18(p))
+  for (const project of readdirSync7(stacksDir)) {
+    const p = join22(stacksDir, project, "stack.json");
+    if (!existsSync19(p))
       continue;
     let record;
     try {
-      record = parseStackRecord(readFileSync16(p, "utf8"), p);
+      record = parseStackRecord(readFileSync17(p, "utf8"), p);
     } catch {
       continue;
     }
@@ -11389,20 +11800,26 @@ async function reconcileTunnel(ref, opts) {
     for (const d of dropped) {
       warnings.push(`exposure ${d.hostname} dropped \u2014 service "${d.service}" of ` + `${d.project} is not running (hostname now 404s)`);
     }
+    const sharedRules = listSharedHostnames().filter((record) => record.tunnelUuid === ref.uuid).map((record) => ({ name: record.name, hostname: record.hostname }));
     const cfgPath = configPath(ref.uuid);
     const nextConfig = generateMergedConfig({
       uuid: ref.uuid,
       credFile: ref.credFile,
       baseRules,
-      dynamicRules: rules
+      dynamicRules: rules,
+      sharedRules
     });
     const pf = readPidfile(dir, CONNECTOR);
     const live = pf !== null && isLive(pf);
-    const currentConfig = existsSync18(cfgPath) ? readFileSync16(cfgPath, "utf8") : null;
+    const { reapedGroups } = await reapOrphanConnectors(ref.uuid, live ? pf : undefined);
+    if (reapedGroups > 0) {
+      warnings.push(`reaped ${reapedGroups} orphan hestia connector process group(s) for this tunnel`);
+    }
+    const currentConfig = existsSync19(cfgPath) ? readFileSync17(cfgPath, "utf8") : null;
     if (live && currentConfig === nextConfig) {
       return { restarted: false, metricsPort: pf.port, ready: true, warnings };
     }
-    if (baseRules.length === 0 && rules.length === 0) {
+    if (baseRules.length === 0 && rules.length === 0 && sharedRules.length === 0) {
       if (pf !== null) {
         await stopProcTree(pf);
         removePidfile(dir, CONNECTOR);
@@ -11887,11 +12304,225 @@ async function* streamStackLogs(record, options = {}) {
     await Promise.allSettled(pumps);
   }
 }
+// packages/engine/src/daemon/shared-arbiter.ts
+class SharedArbiter {
+  onChange;
+  #mutex = Promise.resolve();
+  #polls = new Map;
+  constructor(onChange) {
+    this.onChange = onChange;
+  }
+  #locked(fn) {
+    const next = this.#mutex.then(fn, fn);
+    this.#mutex = next.catch(() => {});
+    return next;
+  }
+  async#notify() {
+    try {
+      await this.onChange?.();
+    } catch {}
+  }
+  #result(record, granted) {
+    return { granted, holder: record.holder, queued: [...record.queue ?? []] };
+  }
+  #wake(name, project, result) {
+    const key = `${name}\x00${project}`;
+    for (const poll of this.#polls.get(key) ?? []) {
+      clearTimeout(poll.timer);
+      poll.resolve(result);
+    }
+    this.#polls.delete(key);
+  }
+  #grantNext(record) {
+    const queue = [...record.queue ?? []];
+    for (;; ) {
+      const head = queue.shift();
+      if (head === undefined) {
+        const next = { ...record, queue: [] };
+        delete next.holder;
+        return next;
+      }
+      if (readMirrorState(head.project) === null)
+        continue;
+      return {
+        ...record,
+        holder: {
+          project: head.project,
+          worktree: head.worktree,
+          service: record.service,
+          at: new Date().toISOString()
+        },
+        queue
+      };
+    }
+  }
+  async request(name, requester, waitMs) {
+    const outcome = await this.#locked(async () => {
+      let granted = false;
+      const updated = await updateSharedHostname(name, (record) => {
+        if (record.holder?.project === requester.project) {
+          granted = true;
+          return {
+            ...record,
+            holder: { ...record.holder, worktree: requester.worktree },
+            queue: (record.queue ?? []).filter((waiter) => waiter.project !== requester.project)
+          };
+        }
+        if (record.holder === undefined) {
+          granted = true;
+          return {
+            ...record,
+            holder: {
+              project: requester.project,
+              worktree: requester.worktree,
+              service: record.service,
+              at: new Date().toISOString()
+            },
+            queue: (record.queue ?? []).filter((waiter) => waiter.project !== requester.project)
+          };
+        }
+        const queue = [...record.queue ?? []];
+        const existing = queue.find((waiter) => waiter.project === requester.project);
+        if (existing !== undefined)
+          existing.worktree = requester.worktree;
+        else
+          queue.push({ project: requester.project, worktree: requester.worktree, at: new Date().toISOString() });
+        return { ...record, queue };
+      });
+      if (updated === null) {
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      }
+      return { granted, record: updated };
+    });
+    if (outcome.granted) {
+      await this.#notify();
+      return this.#result(outcome.record, true);
+    }
+    if (waitMs <= 0)
+      return this.#result(outcome.record, false);
+    return new Promise((resolve2) => {
+      const key = `${name}\x00${requester.project}`;
+      const polls = this.#polls.get(key) ?? [];
+      const poll = {
+        resolve: resolve2,
+        timer: setTimeout(() => {
+          const remaining = (this.#polls.get(key) ?? []).filter((candidate) => candidate !== poll);
+          if (remaining.length === 0)
+            this.#polls.delete(key);
+          else
+            this.#polls.set(key, remaining);
+          const record = readSharedHostname(name);
+          resolve2(record === null ? { granted: false, queued: [] } : this.#result(record, record.holder?.project === requester.project));
+        }, waitMs)
+      };
+      polls.push(poll);
+      this.#polls.set(key, polls);
+    });
+  }
+  async cancel(name, project) {
+    const record = await this.#locked(() => updateSharedHostname(name, (current) => ({
+      ...current,
+      queue: (current.queue ?? []).filter((waiter) => waiter.project !== project)
+    })));
+    if (record === null)
+      throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+    this.#wake(name, project, this.#result(record, false));
+    return this.#result(record, false);
+  }
+  #assertHolder(record, project, verb) {
+    if (record.holder?.project !== project) {
+      throw new HestiaError("shared-not-holder", record.holder === undefined ? `cannot ${verb} "${record.name}" \u2014 it is unclaimed` : `cannot ${verb} "${record.name}" \u2014 it is held by ${record.holder.project}, not ${project}`);
+    }
+  }
+  async allow(name, callerProject) {
+    const record = await this.#transfer(name, callerProject, "allow");
+    return this.#result(record, false);
+  }
+  async deny(name, callerProject) {
+    const record = await this.#locked(async () => {
+      const current = readSharedHostname(name);
+      if (current === null)
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      this.#assertHolder(current, callerProject, "deny");
+      const updated = await updateSharedHostname(name, (candidate) => {
+        const queue = [...candidate.queue ?? []];
+        if (queue.length > 0)
+          queue[0] = { ...queue[0], denied: true };
+        return { ...candidate, queue };
+      });
+      return updated;
+    });
+    return this.#result(record, false);
+  }
+  async release(name, callerProject) {
+    const record = await this.#transfer(name, callerProject, "release");
+    return this.#result(record, false);
+  }
+  async#transfer(name, callerProject, verb) {
+    const record = await this.#locked(async () => {
+      const current = readSharedHostname(name);
+      if (current === null)
+        throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared`);
+      this.#assertHolder(current, callerProject, verb);
+      return await updateSharedHostname(name, (candidate) => this.#grantNext(candidate));
+    });
+    if (record.holder !== undefined) {
+      this.#wake(record.name, record.holder.project, this.#result(record, true));
+    }
+    await this.#notify();
+    return record;
+  }
+  async releaseProject(project, service) {
+    const held = listSharedHostnames().filter((record) => record.holder?.project === project && (service === undefined || record.service === service));
+    let changed = false;
+    for (const record of held) {
+      const updated = await this.#locked(async () => {
+        const current = readSharedHostname(record.name);
+        if (current?.holder?.project !== project)
+          return null;
+        return await updateSharedHostname(record.name, (candidate) => this.#grantNext(candidate));
+      });
+      if (updated === null || updated === undefined)
+        continue;
+      changed = true;
+      if (updated.holder !== undefined) {
+        this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
+      }
+    }
+    if (changed)
+      await this.#notify();
+  }
+  async sweep(occupied) {
+    let changed = false;
+    for (const record of listSharedHostnames()) {
+      const holderDead = record.holder !== undefined && !occupied.has(record.holder.project) && readMirrorState(record.holder.project) === null;
+      const deadWaiters = (record.queue ?? []).filter((waiter) => readMirrorState(waiter.project) === null);
+      if (!holderDead && deadWaiters.length === 0)
+        continue;
+      const updated = await this.#locked(() => updateSharedHostname(record.name, (candidate) => {
+        const pruned = {
+          ...candidate,
+          queue: (candidate.queue ?? []).filter((waiter) => readMirrorState(waiter.project) !== null)
+        };
+        const currentHolderDead = pruned.holder !== undefined && !occupied.has(pruned.holder.project) && readMirrorState(pruned.holder.project) === null;
+        return currentHolderDead ? this.#grantNext(pruned) : pruned;
+      }));
+      if (updated === null)
+        continue;
+      changed = true;
+      if (updated.holder !== undefined && updated.holder.project !== record.holder?.project) {
+        this.#wake(updated.name, updated.holder.project, this.#result(updated, true));
+      }
+    }
+    if (changed)
+      await this.#notify();
+  }
+}
 // packages/engine/src/daemon/fleet-monitor.ts
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify8 } from "util";
-import { existsSync as existsSync19, readFileSync as readFileSync17, readdirSync as readdirSync7 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync18, readdirSync as readdirSync8 } from "fs";
+import { join as join23 } from "path";
 var pexec8 = promisify8(execFile9);
 var DEFAULT_REFRESH_MS = 1000;
 var DEFAULT_HEARTBEAT_MS = 15000;
@@ -11938,13 +12569,13 @@ class LatestFleetChannel {
 function readManagedMirrors() {
   const records = [];
   const warnings = [];
-  const stacksDirectory = join21(hestiaHome(), "stacks");
-  if (!existsSync19(stacksDirectory))
+  const stacksDirectory = join23(hestiaHome(), "stacks");
+  if (!existsSync20(stacksDirectory))
     return { records, warnings };
-  for (const project of readdirSync7(stacksDirectory).sort()) {
-    const path = join21(stacksDirectory, project, "stack.json");
+  for (const project of readdirSync8(stacksDirectory).sort()) {
+    const path = join23(stacksDirectory, project, "stack.json");
     try {
-      const source = readFileSync17(path);
+      const source = readFileSync18(path);
       if (source.byteLength > MAX_MIRROR_BYTES2) {
         warnings.push(`Fleet mirror too large for ${project}`);
         continue;
@@ -11964,7 +12595,7 @@ function readManagedMirrors() {
 async function attributeLegacyRepoId(record) {
   if (record.repoId !== undefined)
     return record.repoId;
-  if (!existsSync19(record.worktree))
+  if (!existsSync20(record.worktree))
     return null;
   const info = await getRepoInfo(record.worktree);
   if (projectName(info.repoId, info.repo, info.branch, info.worktreeRoot) !== record.project)
@@ -12070,6 +12701,25 @@ function reservationIdentity(reservation, records) {
     worktree: record.worktree
   };
 }
+function collectFleetShared(repoProjects) {
+  return listSharedHostnames().map((record) => ({
+    name: record.name,
+    hostname: record.hostname,
+    ...record.path === undefined ? {} : { path: record.path },
+    url: `https://${record.hostname}${record.path ?? ""}`,
+    holder: record.holder === undefined ? undefined : {
+      project: record.holder.project,
+      worktree: record.holder.worktree,
+      mine: repoProjects.has(record.holder.project)
+    },
+    queue: (record.queue ?? []).map((waiter) => ({
+      project: waiter.project,
+      worktree: waiter.worktree,
+      ...waiter.denied === true ? { denied: true } : {},
+      mine: repoProjects.has(waiter.project)
+    }))
+  })).sort((left, right) => left.name.localeCompare(right.name));
+}
 async function collectFleetSnapshot(repoId, admission) {
   const mirrorResult = readManagedMirrors();
   const machineConfig = readHestiaMachineConfig();
@@ -12165,6 +12815,7 @@ async function collectFleetSnapshot(repoId, admission) {
   const allRecordedProjects = new Set(attributed.map((record) => record.project));
   const unbackedReservations = reservations.filter((reservation) => !allRecordedProjects.has(reservation.project));
   const { maxStacks, warnings: capWarnings } = resolveMaxStacks();
+  const repoProjects = new Set(attributed.filter((record) => record.repoId === repoId).map((record) => record.project));
   return {
     repoId,
     observedAt: new Date().toISOString(),
@@ -12175,6 +12826,7 @@ async function collectFleetSnapshot(repoId, admission) {
       queued: queued.length
     },
     stacks: stackViews,
+    shared: collectFleetShared(repoProjects),
     warnings: [...capWarnings, ...warnings].sort()
   };
 }
@@ -12183,6 +12835,7 @@ function semanticFleetSnapshot(snapshot) {
     repoId: snapshot.repoId,
     capacity: snapshot.capacity,
     stacks: snapshot.stacks,
+    shared: snapshot.shared,
     warnings: snapshot.warnings
   });
 }
@@ -12398,7 +13051,7 @@ async function assertHestiaStateIgnored(worktreeRoot) {
   try {
     await pexec9("git", ["-C", worktreeRoot, "check-ignore", "-q", ".hestia/"], { timeout: 5000 });
   } catch {
-    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join22(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join22(worktreeRoot, ".gitignore") });
+    throw new HestiaError("state-not-ignored", `.hestia is not ignored in ${worktreeRoot}; add the line ".hestia/" to ${join24(worktreeRoot, ".gitignore")}`, { remedy: `.hestia/`, path: join24(worktreeRoot, ".gitignore") });
   }
 }
 async function prepareCompose(worktreeRoot, project, repo, branch, opts, configuredBaseFile) {
@@ -12415,7 +13068,7 @@ async function prepareCompose(worktreeRoot, project, repo, branch, opts, configu
     services
   });
   ensureDir(hestiaDir(worktreeRoot));
-  const overridePath = join22(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+  const overridePath = join24(hestiaDir(worktreeRoot), OVERRIDE_FILE);
   writeAtomicTextFile(overridePath, yaml);
   return {
     ctx: {
@@ -12448,7 +13101,7 @@ function writeDockerfileComposeModel(worktreeRoot, workloads, conventionalCompos
     ...conventionalComposeFile === undefined ? {} : { include: [{ path: conventionalComposeFile }] },
     services
   };
-  const path = join22(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
+  const path = join24(hestiaDir(worktreeRoot), DOCKERFILE_COMPOSE_FILE);
   writeAtomicTextFile(path, $stringify(model));
   return path;
 }
@@ -12468,7 +13121,7 @@ function freshRecord(project, repoId, repo, branch, worktree) {
   };
 }
 function assertCurrentStackIdentity(record, current) {
-  const path = join22(hestiaDir(current.worktreeRoot), "stack.json");
+  const path = join24(hestiaDir(current.worktreeRoot), "stack.json");
   assertMutableStackRecord(record, path);
   const matches = record.repoId === current.repoId && record.repo === current.repo && record.branch === current.branch && resolve2(record.worktree) === resolve2(current.worktreeRoot) && record.project === projectName(current.repoId, current.repo, current.branch, current.worktreeRoot);
   if (!matches) {
@@ -12603,6 +13256,27 @@ function applyLocalRouteProjection(record) {
     record.env[directUrlKey(endpoint.name)] = endpoint.url;
     record.env[localUrlKey(endpoint.name)] = endpoint.localUrl;
   }
+  syncSharedProjection(record);
+}
+function syncSharedProjection(record) {
+  for (const shared of listSharedHostnames()) {
+    const url = `https://${shared.hostname}${shared.path ?? ""}`;
+    if (shared.holder?.project === record.project) {
+      const endpoint = record.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+      if (endpoint !== undefined) {
+        endpoint.publicUrl = url;
+        record.env[urlKey(shared.service)] = url;
+      }
+      continue;
+    }
+    for (const endpoint of record.endpoints) {
+      if (endpoint.publicUrl === url)
+        delete endpoint.publicUrl;
+    }
+    if (record.env[urlKey(shared.service)] === url) {
+      delete record.env[urlKey(shared.service)];
+    }
+  }
 }
 function syncExposures(record) {
   const t = record.tunnel;
@@ -12627,7 +13301,7 @@ function matchesExpectedStack(record, expected) {
   return record !== null && (record.repoId === undefined || record.repoId === expected.repoId) && record.worktree === expected.worktree && record.createdAt === expected.createdAt;
 }
 function projectMutationRoot(project) {
-  return join22(hestiaHome(), "project-locks", project);
+  return join24(hestiaHome(), "project-locks", project);
 }
 async function assertNamedTunnelDns(hostname, tunnelUuid) {
   const expected = `${tunnelUuid}.cfargotunnel.com`;
@@ -13033,6 +13707,7 @@ class ComposeEngine {
     const { repo, repoId, branch, worktreeRoot } = currentIdentity;
     let tunnel;
     let tunnelDirty = false;
+    const stoppedAliases = [];
     const project = readState(worktreeRoot)?.project ?? projectName(repoId, repo, branch, worktreeRoot);
     await withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
       const record = readState(worktreeRoot);
@@ -13041,6 +13716,11 @@ class ComposeEngine {
         if (record.services.some((service) => service.name === name && service.backend === "docker")) {
           throw new HestiaError("backend-not-stoppable", `Docker workload ${name} cannot be stopped individually; use hestia down`);
         }
+        for (const endpoint of record.endpoints) {
+          if ((endpoint.workload ?? endpoint.name) === name) {
+            stoppedAliases.push(endpoint.alias ?? endpoint.name);
+          }
+        }
       }
       const pf = readPidfile(worktreeRoot, name);
       if (pf !== null) {
@@ -13086,6 +13766,9 @@ class ComposeEngine {
         }
       }
     }));
+    for (const alias of new Set(stoppedAliases)) {
+      await this.#releaseSharedHoldings(project, alias);
+    }
     if (tunnelDirty)
       await this.#reconcileAdopted(tunnel);
     await this.#refreshLocalRoutes();
@@ -13221,12 +13904,12 @@ class ComposeEngine {
         await stopProcTree(pf);
         removePidfile(worktreeRoot, pf.name);
       }
-      rmSync9(privateRegistryDir(worktreeRoot), { recursive: true, force: true });
+      rmSync10(privateRegistryDir(worktreeRoot), { recursive: true, force: true });
       const composeFile = record?.composeFile ?? tryLoadConfig(worktreeRoot)?.composeFile;
       if (composeFile !== undefined) {
         const project2 = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
-        const overrideFile = record?.overrideFile ?? join22(hestiaDir(worktreeRoot), OVERRIDE_FILE);
-        if (existsSync20(overrideFile)) {
+        const overrideFile = record?.overrideFile ?? join24(hestiaDir(worktreeRoot), OVERRIDE_FILE);
+        if (existsSync21(overrideFile)) {
           await composeDown({ project: project2, baseFile: composeFile, overrideFile, cwd: worktreeRoot }, opts?.destroy ?? false);
         } else if (record?.composeFile !== undefined) {
           const rest = ["compose", "-p", project2, "down", "--remove-orphans"];
@@ -13238,6 +13921,7 @@ class ComposeEngine {
       const project = record?.project ?? projectName(repoId, repo, branch, worktreeRoot);
       clearState(worktreeRoot, project);
       await this.#releaseAdmission(project);
+      await this.#releaseSharedHoldings(project);
     }));
     await this.#reconcileAdopted(tunnel);
     await this.#refreshLocalRoutes();
@@ -13247,6 +13931,11 @@ class ComposeEngine {
     if (j !== null)
       await releaseSlot(j.port, project);
   }
+  async#releaseSharedHoldings(project, service) {
+    const j = readDaemonJson();
+    if (j !== null)
+      await releaseSharedForProject(j.port, project, service);
+  }
   async downProject(project, opts) {
     if (!/^[a-z0-9][a-z0-9-]{0,99}$/.test(project)) {
       throw new HestiaError("usage", `invalid project name ${JSON.stringify(project)}`);
@@ -13289,9 +13978,9 @@ class ComposeEngine {
           throw new HestiaError("compose-failed", `docker compose -p ${project} down failed: ${err.message}`);
         }
       }
-      rmSync9(mirrorDir(project), { recursive: true, force: true });
+      rmSync10(mirrorDir(project), { recursive: true, force: true });
     };
-    if (record !== null && existsSync20(record.worktree)) {
+    if (record !== null && existsSync21(record.worktree)) {
       const info = await getRepoInfo(record.worktree);
       const identityMatches = resolve2(info.worktreeRoot) === resolve2(record.worktree) && (record.repoId === undefined ? record.repo === info.repo : record.repoId === info.repoId);
       const localRecord = readState(record.worktree);
@@ -13312,6 +14001,7 @@ class ComposeEngine {
           return;
         }
         await this.#releaseAdmission(project);
+        await this.#releaseSharedHoldings(project);
         await this.#reconcileAdopted(record.tunnel);
         await this.#refreshLocalRoutes();
         return;
@@ -13320,6 +14010,7 @@ class ComposeEngine {
     const projectLockRoot = projectMutationRoot(project);
     await withLock(projectLockRoot, teardownFromMirror);
     await this.#releaseAdmission(project);
+    await this.#releaseSharedHoldings(project);
     await this.#reconcileAdopted(record?.tunnel);
     await this.#refreshLocalRoutes();
   }
@@ -13338,11 +14029,100 @@ class ComposeEngine {
     }
     await ensureDaemon();
     await this.#refreshLocalRoutes(true);
+    if (opts?.shared !== undefined) {
+      if (tunnelName === undefined) {
+        throw new HestiaError("shared-requires-named-tunnel", "shared hostnames need an adopted named tunnel (stable DNS is the point) \u2014 pass --tunnel <name>");
+      }
+      return this.#exposeShared(worktreeRoot, services, tunnelName, opts);
+    }
     if (tunnelName === undefined) {
       return this.#exposeQuick(worktreeRoot, services, opts);
     }
     return this.#exposeNamed(worktreeRoot, services, tunnelName, opts);
   }
+  async#exposeShared(worktreeRoot, services, tunnelName, opts) {
+    if (services.length !== 1) {
+      throw new HestiaError("usage", "--shared declares exactly one service per shared hostname");
+    }
+    const name = opts.shared;
+    assertSharedName(name);
+    const project = readState(worktreeRoot)?.project;
+    if (project === undefined) {
+      throw new HestiaError("service-not-found", "no stack in this worktree \u2014 `hestia up`/`run` something first");
+    }
+    const adopted = await adoptTunnel(tunnelName);
+    if (adopted.connections > 0 && !isAdopted(adopted.uuid) && !opts?.force) {
+      throw new HestiaError("tunnel-busy", `tunnel "${tunnelName}" already has ${adopted.connections} live edge ` + `connection(s) from a foreign connector \u2014 stop the other cloudflared first (hestia's ` + `connector serves your static hostnames too), or pass --force to ` + `accept nondeterministic routing`);
+    }
+    const preflightRecord = readState(worktreeRoot);
+    if (preflightRecord === null) {
+      throw new HestiaError("service-not-found", "stack disappeared while preparing the shared hostname");
+    }
+    const baseRules = importBaseRules(adopted.uuid, tunnelName);
+    const zoneHint = opts?.zone ?? preflightRecord.tunnel?.zone ?? inferZone(baseRules);
+    let hostname;
+    let zone;
+    if (opts?.hostname !== undefined) {
+      hostname = opts.hostname.toLowerCase();
+      assertSharedHostnameFqdn(hostname);
+      zone = zoneOf(hostname) ?? zoneHint ?? hostname;
+    } else {
+      if (zoneHint === undefined) {
+        throw new HestiaError("usage", "cannot infer a zone from the tunnel's existing rules \u2014 pass --zone or an explicit --hostname");
+      }
+      zone = zoneHint;
+      hostname = `${name}.${zone}`;
+    }
+    const path = normalizeSharedPath(opts?.path);
+    const selection = resolveEndpointSelection(preflightRecord, services[0]);
+    if (selection.endpoint.kind !== undefined && selection.endpoint.kind !== "http") {
+      throw new HestiaError("usage", `public tunnels require an HTTP endpoint; ${services[0]} is ${selection.endpoint.kind}`);
+    }
+    const alias = selection.endpoint.alias ?? selection.endpoint.name;
+    if (baseRules.some((rule) => rule.hostname === hostname)) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} is already claimed by the user's static rules`);
+    }
+    const dynamicConflict = collectDynamicRules(adopted.uuid).rules.find((rule) => rule.hostname === hostname);
+    if (dynamicConflict !== undefined) {
+      throw new HestiaError("hostname-conflict", `shared hostname ${hostname} is already claimed by project ${dynamicConflict.project}`);
+    }
+    await assertNamedTunnelDns(hostname, adopted.uuid);
+    await declareSharedHostname({
+      name,
+      hostname,
+      path,
+      tunnelUuid: adopted.uuid,
+      zone,
+      service: alias
+    });
+    const handle = await ensureDaemon();
+    const claim = await sharedVerb(handle.port, "claim", {
+      name,
+      project,
+      worktree: worktreeRoot,
+      waitMs: 0
+    });
+    if (!claim.granted) {
+      throw new HestiaError("shared-held", `shared hostname "${name}" is held by ${claim.holder?.project ?? "another stack"} ` + `(${claim.queued.length} queued) \u2014 \`hestia claim ${name} --wait\` to queue for it`);
+    }
+    const outcome = await reconcileTunnel({ name: tunnelName, uuid: adopted.uuid, credFile: adopted.credFile }, { force: opts?.force, readyTimeoutMs: opts?.readyTimeoutMs });
+    for (const w of outcome.warnings)
+      process.stderr.write(`warning: ${w}
+`);
+    const final = await withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
+      const record = readState(worktreeRoot);
+      if (record === null) {
+        throw new HestiaError("service-not-found", "stack disappeared while exposing (concurrent down?)");
+      }
+      applyLocalRouteProjection(record);
+      writeState(worktreeRoot, record);
+      return record;
+    }));
+    if (outcome.error !== undefined)
+      throw outcome.error;
+    await this.#refreshLocalRoutes(true);
+    return final;
+  }
   async#exposeQuick(worktreeRoot, services, opts) {
     const project = readState(worktreeRoot)?.project;
     if (project === undefined) {
@@ -13361,7 +14141,7 @@ class ComposeEngine {
         const alias = selection.endpoint.alias ?? selection.endpoint.name;
         const authority = internalEndpointAuthority(record.project, alias);
         const name = `aux-quick-${createHash7("sha256").update(alias).digest("hex").slice(0, 10)}`;
-        const quickCfg = join22(hestiaDir(worktreeRoot), `quick-${name}.yml`);
+        const quickCfg = join24(hestiaDir(worktreeRoot), `quick-${name}.yml`);
         writeAtomicTextFile(quickCfg, `ingress:
   - service: ${JSON.stringify(`unix:${publicGatewaySocketPath()}`)}
 ` + `    originRequest:
@@ -13553,6 +14333,80 @@ class ComposeEngine {
     await this.#refreshLocalRoutes(true);
     return final;
   }
+  async#sharedContext(cwd, name) {
+    assertSharedName(name);
+    const { worktreeRoot } = await getRepoInfo(cwd);
+    const record = readState(worktreeRoot);
+    if (record === null) {
+      throw new HestiaError("service-not-found", "no stack in this worktree \u2014 `hestia up`/`run` something first");
+    }
+    const shared = readSharedHostname(name);
+    if (shared === null) {
+      throw new HestiaError("shared-not-found", `no shared hostname "${name}" is declared \u2014 \`hestia expose <svc> --shared ${name}\` creates one`);
+    }
+    return { worktreeRoot, record, shared };
+  }
+  async#applySharedProjection(worktreeRoot, project) {
+    return withLock(worktreeRoot, () => withLock(projectMutationRoot(project), async () => {
+      const record = readState(worktreeRoot);
+      if (record === null) {
+        throw new HestiaError("service-not-found", "stack disappeared during the shared-hostname transition");
+      }
+      applyLocalRouteProjection(record);
+      writeState(worktreeRoot, record);
+      return record;
+    }));
+  }
+  async claimShared(cwd, name, opts) {
+    const { worktreeRoot, record, shared } = await this.#sharedContext(cwd, name);
+    const endpoint = record.endpoints.find((candidate) => (candidate.alias ?? candidate.name) === shared.service);
+    if (endpoint === undefined) {
+      throw new HestiaError("service-not-found", `shared hostname "${name}" routes to endpoint alias "${shared.service}", which this ` + `stack does not expose \u2014 \`hestia up\`/\`run\` it first`);
+    }
+    if (endpoint.kind !== undefined && endpoint.kind !== "http") {
+      throw new HestiaError("usage", `shared hostnames require an HTTP endpoint; ${shared.service} is ${endpoint.kind}`);
+    }
+    const handle = await ensureDaemon();
+    const result = await sharedVerb(handle.port, "claim", {
+      name,
+      project: record.project,
+      worktree: worktreeRoot,
+      waitMs: opts?.waitMs ?? 0
+    });
+    if (!result.granted) {
+      const position = result.queued.findIndex((waiter) => waiter.project === record.project) + 1;
+      throw new HestiaError("shared-held", `shared hostname "${name}" is held by ${result.holder?.project ?? "another stack"}` + (position > 0 ? ` \u2014 queued durably at position ${position}/${result.queued.length}; the holder can ` + `\`hestia share allow ${name}\`, or re-run \`hestia claim ${name} --wait\` to keep waiting` : ""), { holder: result.holder, queued: result.queued });
+    }
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return { record: updated, result };
+  }
+  async releaseShared(cwd, name) {
+    const { worktreeRoot, record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "release", { name, project: record.project });
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return updated;
+  }
+  async cancelSharedClaim(cwd, name) {
+    const { record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "cancel", { name, project: record.project });
+  }
+  async allowShared(cwd, name) {
+    const { worktreeRoot, record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "allow", { name, project: record.project });
+    const updated = await this.#applySharedProjection(worktreeRoot, record.project);
+    await this.#refreshLocalRoutes();
+    return updated;
+  }
+  async denyShared(cwd, name) {
+    const { record } = await this.#sharedContext(cwd, name);
+    const handle = await ensureDaemon();
+    await sharedVerb(handle.port, "deny", { name, project: record.project });
+  }
   async status(cwd) {
     const { worktreeRoot } = await getRepoInfo(cwd);
     const record = readState(worktreeRoot);
@@ -13672,11 +14526,24 @@ function startDuties(admission, opts) {
       } catch (err) {
         log(`sweep: pump failed: ${err.message}`);
       }
+      if (opts?.shared !== undefined) {
+        try {
+          const state = admission.healthSnapshot();
+          await opts.shared.sweep(new Set([...state.live, ...state.reserved]));
+        } catch (err) {
+          log(`sweep: shared-hostname sweep failed: ${err.message}`);
+        }
+      }
       for (const uuid of listAdopted()) {
         try {
           const pf = connectorPidfile(uuid);
-          if (pf !== null && isLive(pf))
+          if (pf !== null && isLive(pf)) {
+            const { reapedGroups } = await reapOrphanConnectors(uuid, pf);
+            if (reapedGroups > 0) {
+              log(`sweep: reaped ${reapedGroups} orphan connector group(s) for ${uuid}`);
+            }
             continue;
+          }
           const ref = readAdopted(uuid);
           if (ref === null)
             continue;
@@ -13686,6 +14553,11 @@ function startDuties(admission, opts) {
           const outcome = await reconcileTunnel(ref);
           if (outcome.restarted) {
             log(`sweep: connector for ${ref.name} (${uuid}) revived (ready=${outcome.ready})`);
+          } else {
+            for (const w of outcome.warnings) {
+              if (w.includes("reaped"))
+                log(`sweep: ${w}`);
+            }
           }
         } catch (err) {
           log(`sweep: connector revival for ${uuid} failed: ${err.message}`);
@@ -13729,6 +14601,7 @@ async function main() {
     const engine2 = new ComposeEngine;
     const localRouter = new HestiaLocalHttpRouter;
     const routerPort = await localRouter.start();
+    const shared = new SharedArbiter(() => localRouter.refreshRoutes());
     const token = randomBytes(32).toString("hex");
     const server = serveSessionBrokerDaemon({
       daemon,
@@ -13739,6 +14612,7 @@ async function main() {
         fleet,
         routerPort,
         gatewaySocket: localRouter.socketPath,
+        shared,
         refreshLocalRoutes: () => localRouter.refreshRoutes(),
         logsProject: (project, options) => engine2.logsProject(project, options)
       })
@@ -13755,11 +14629,11 @@ async function main() {
         port: "none",
         backend: "proc"
       }),
-      logPath: join23(root, "daemon.log"),
+      logPath: join25(root, "daemon.log"),
       signal: "term",
       backend: "proc"
     });
-    writeAtomicJsonFile(join23(root, "daemon.json"), {
+    writeAtomicJsonFile(join25(root, "daemon.json"), {
       schemaVersion: STATE_SCHEMA_VERSION,
       pid: process.pid,
       port: server.port,
@@ -13769,13 +14643,13 @@ async function main() {
       routerPort,
       gatewaySocket: localRouter.socketPath
     }, { mode: 384 });
-    const stopDuties = startDuties(admission);
+    const stopDuties = startDuties(admission, { shared });
     const shutdown = () => {
       stopDuties();
       fleet.stop();
       localRouter.stop();
       removePidfile(root, PIDFILE_NAME2);
-      rmSync10(join23(root, "daemon.json"), { force: true });
+      rmSync11(join25(root, "daemon.json"), { force: true });
       server.stop(true);
       process.exit(0);
     };
@@ -13790,4 +14664,4 @@ async function main() {
 }
 main();
 
-//# debugId=855573FAB285270F64756E2164756E21
+//# debugId=E5997ABC0405B8AE64756E2164756E21