meshy-node 0.2.4 → 0.2.5

package/main.cjs

@@ -25760,7 +25760,7 @@ var require_application = __commonJS({
   "../../node_modules/.pnpm/express@4.22.1/node_modules/express/lib/application.js"(exports2, module2) {
     "use strict";
     var finalhandler = require_finalhandler();
-    var Router11 = require_router();
+    var Router12 = require_router();
     var methods = require_methods();
     var middleware = require_init();
     var query = require_query();
@@ -25825,7 +25825,7 @@ var require_application = __commonJS({
     };
     app.lazyrouter = function lazyrouter() {
       if (!this._router) {
-        this._router = new Router11({
+        this._router = new Router12({
           caseSensitive: this.enabled("case sensitive routing"),
           strict: this.enabled("strict routing")
         });
@@ -27690,7 +27690,7 @@ var require_express = __commonJS({
     var mixin = require_merge_descriptors();
     var proto = require_application();
     var Route = require_route();
-    var Router11 = require_router();
+    var Router12 = require_router();
     var req = require_request();
     var res = require_response();
     exports2 = module2.exports = createApplication;
@@ -27713,7 +27713,7 @@ var require_express = __commonJS({
     exports2.request = req;
     exports2.response = res;
     exports2.Route = Route;
-    exports2.Router = Router11;
+    exports2.Router = Router12;
     exports2.json = bodyParser.json;
     exports2.query = require_query();
     exports2.raw = bodyParser.raw;
@@ -32335,6 +32335,7 @@ var fs3 = __toESM(require("fs"), 1);
 var path3 = __toESM(require("path"), 1);
 
 // ../../packages/core/src/shared/types.ts
+var DEFAULT_TASK_SHARE_TENANT = "72f988bf-86f1-41af-91ab-2d7cd011db47";
 var TASK_EXECUTION_MODES = ["bypass", "plan", "edit", "dangerous"];
 var MeshyError = class extends Error {
   constructor(code, message, statusCode, details) {
@@ -32387,6 +32388,7 @@ var FILE_NAMES = {
   cluster: "cluster.json",
   nodes: "nodes.json",
   tasks: "tasks.json",
+  shares: "shares.json",
   election: "election.json"
 };
 var FileStore = class {
@@ -32395,6 +32397,7 @@ var FileStore = class {
   cluster = null;
   nodes = /* @__PURE__ */ new Map();
   tasks = /* @__PURE__ */ new Map();
+  shares = /* @__PURE__ */ new Map();
   election = /* @__PURE__ */ new Map();
   dirtySections = /* @__PURE__ */ new Set();
   constructor(options = {}) {
@@ -32410,6 +32413,7 @@ var FileStore = class {
     this.cluster = this.loadCluster();
     this.replaceMap(this.nodes, this.loadNodes());
     this.replaceMap(this.tasks, this.loadTasks());
+    this.replaceMap(this.shares, this.loadTaskShares());
     this.replaceMap(this.election, this.loadElection());
     this.flushDirtySections();
   }
@@ -32422,6 +32426,7 @@ var FileStore = class {
     this.cluster = null;
     this.nodes.clear();
     this.tasks.clear();
+    this.shares.clear();
     this.election.clear();
     this.dirtySections.clear();
   }
@@ -32562,6 +32567,46 @@ var FileStore = class {
     }
     return metrics;
   }
+  createTaskShare(share) {
+    this.ensureOpen();
+    const copy = clone(share);
+    this.shares.set(copy.id, copy);
+    this.persistSection("shares");
+    return clone(copy);
+  }
+  getTaskShare(id) {
+    this.ensureOpen();
+    const share = this.shares.get(id);
+    return share === void 0 ? null : clone(share);
+  }
+  getTaskShareByTaskId(taskId) {
+    this.ensureOpen();
+    for (const share of this.shares.values()) {
+      if (share.taskId === taskId && share.revokedAt === void 0) {
+        return clone(share);
+      }
+    }
+    return null;
+  }
+  getAllTaskShares() {
+    this.ensureOpen();
+    return Array.from(this.shares.values(), (share) => clone(share));
+  }
+  updateTaskShare(id, updates) {
+    this.ensureOpen();
+    const current = this.shares.get(id);
+    if (current === void 0) {
+      return null;
+    }
+    const merged = {
+      ...current,
+      ...clone(updates),
+      id: current.id
+    };
+    this.shares.set(id, merged);
+    this.persistSection("shares");
+    return clone(merged);
+  }
   getElectionValue(key) {
     this.ensureOpen();
     return this.election.get(key) ?? null;
@@ -32633,6 +32678,26 @@ var FileStore = class {
     }
     return tasks;
   }
+  loadTaskShares() {
+    const raw = this.readJsonFile("shares");
+    if (!isPlainObject(raw)) {
+      this.markDirty("shares");
+      return /* @__PURE__ */ new Map();
+    }
+    const shares = /* @__PURE__ */ new Map();
+    for (const [key, value] of Object.entries(raw)) {
+      const share = parseTaskShare(value);
+      if (share === null) {
+        this.markDirty("shares");
+        continue;
+      }
+      if (share.id !== key) {
+        this.markDirty("shares");
+      }
+      shares.set(share.id, share);
+    }
+    return shares;
+  }
   loadElection() {
     const raw = this.readJsonFile("election");
     if (!isPlainObject(raw)) {
@@ -32698,6 +32763,8 @@ var FileStore = class {
         return Object.fromEntries(sortEntries(this.nodes));
       case "tasks":
         return Object.fromEntries(sortEntries(this.tasks));
+      case "shares":
+        return Object.fromEntries(sortEntries(this.shares));
       case "election":
         return Object.fromEntries(sortEntries(this.election));
     }
@@ -32824,6 +32891,29 @@ function parseTask(value) {
     updatedAt: value.updatedAt
   };
 }
+function parseTaskShare(value) {
+  if (!isPlainObject(value)) {
+    return null;
+  }
+  if (typeof value.id !== "string" || typeof value.taskId !== "string" || typeof value.createdAt !== "number" || !Number.isFinite(value.createdAt) || value.revokedAt !== void 0 && (typeof value.revokedAt !== "number" || !Number.isFinite(value.revokedAt))) {
+    return null;
+  }
+  return {
+    id: value.id,
+    taskId: value.taskId,
+    tenant: asTaskShareTenant(value.tenant) ?? DEFAULT_TASK_SHARE_TENANT,
+    scope: asTaskShareScope(value.scope) ?? "chat",
+    createdAt: value.createdAt,
+    revokedAt: typeof value.revokedAt === "number" ? value.revokedAt : void 0
+  };
+}
+function asTaskShareTenant(value) {
+  if (value === "microsoft") return DEFAULT_TASK_SHARE_TENANT;
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function asTaskShareScope(value) {
+  return value === "chat" || value === "filesPreview" ? value : null;
+}
 function asNodeRole(value) {
   return isNodeRole(value) ? value : null;
 }
@@ -33887,6 +33977,19 @@ var TaskEngine = class {
   getMetrics() {
     return this.store.getTaskMetrics();
   }
+  // ── Task Shares ─────────────────────────────────────────────────────
+  createTaskShare(share) {
+    return this.store.createTaskShare(share);
+  }
+  getTaskShare(id) {
+    return this.store.getTaskShare(id);
+  }
+  getTaskShareByTaskId(taskId) {
+    return this.store.getTaskShareByTaskId(taskId);
+  }
+  updateTaskShare(id, updates) {
+    return this.store.updateTaskShare(id, updates);
+  }
   // ── Helpers ──────────────────────────────────────────────────────────
   /** Calculate exponential backoff: min(2^retryCount * 1000, 30000) ms */
   getRetryBackoff(retryCount) {
@@ -41487,6 +41590,10 @@ var SendMessageBody = external_exports.union([
 var TaskLogsQuery = external_exports.object({
   after: external_exports.coerce.number().int().min(0).optional()
 });
+var CreateTaskShareBody = external_exports.object({
+  tenant: external_exports.string().trim().min(1).max(128).default(DEFAULT_TASK_SHARE_TENANT),
+  scope: external_exports.enum(["chat", "filesPreview"]).default("chat")
+}).default({});
 var TaskOutputTreeQuery = external_exports.object({
   path: external_exports.string().default(".")
 });
@@ -41504,7 +41611,7 @@ var BatchTaskIdsBody = external_exports.object({
 // ../../packages/api/src/app/server.ts
 var path17 = __toESM(require("path"), 1);
 var fs15 = __toESM(require("fs"), 1);
-var import_express11 = __toESM(require_express2(), 1);
+var import_express12 = __toESM(require_express2(), 1);
 
 // ../../packages/api/src/middleware/auth.ts
 var SKIP_AUTH_PATHS = ["/api/system/health"];
@@ -44033,6 +44140,7 @@ async function handleTaskMessage(deps, message) {
 
 // ../../packages/api/src/routes/tasks.ts
 var import_express7 = __toESM(require_express2(), 1);
+var import_node_crypto7 = require("crypto");
 
 // ../../packages/api/src/tasks/task-remote-cancellation.ts
 async function cancelRemoteTaskExecution(deps) {
@@ -44595,6 +44703,25 @@ function withAssignedNodeMetadata(task, nodeRegistry) {
     assignedNodeAvailable: node?.status !== "offline" && Boolean(node)
   };
 }
+function withShareMetadata(task, taskEngine, shareOrigin) {
+  const share = taskEngine.getTaskShareByTaskId?.(task.id) ?? null;
+  if (!share) return task;
+  return {
+    ...task,
+    activeShare: {
+      shareId: share.id,
+      tenant: share.tenant,
+      scope: share.scope,
+      ...shareOrigin ? { url: buildShareUrl(shareOrigin, share.id) } : {}
+    }
+  };
+}
+function toTaskResponse(task, nodeRegistry, taskEngine, shareOrigin) {
+  return withShareMetadata(withAssignedNodeMetadata(task, nodeRegistry), taskEngine, shareOrigin);
+}
+function buildShareUrl(origin, shareId) {
+  return `${origin.replace(/\/+$/, "")}/shared/tasks/${encodeURIComponent(shareId)}`;
+}
 function createTaskRoutes() {
   const router = (0, import_express7.Router)();
   router.post("/", asyncHandler6(async (req, res) => {
@@ -44620,7 +44747,7 @@ function createTaskRoutes() {
     res.status(201).json(withAssignedNodeMetadata(task, nodeRegistry));
   }));
   router.get("/", asyncHandler6(async (req, res) => {
-    const { taskEngine, nodeRegistry } = req.app.locals.deps;
+    const { taskEngine, nodeRegistry, shareOrigin } = req.app.locals.deps;
     const query = TaskListQuery.parse(req.query);
     const filter = {};
     if (query.status) filter.status = query.status;
@@ -44630,7 +44757,7 @@ function createTaskRoutes() {
     if (query.offset) filter.offset = query.offset;
     const result = taskEngine.listTasks(filter);
     res.json({
-      tasks: result.tasks.map((task) => withAssignedNodeMetadata(task, nodeRegistry)),
+      tasks: result.tasks.map((task) => toTaskResponse(task, nodeRegistry, taskEngine, shareOrigin)),
       total: result.total
     });
   }));
@@ -44666,12 +44793,59 @@ function createTaskRoutes() {
     res.json({ results });
   }));
   router.get("/:id", asyncHandler6(async (req, res) => {
-    const { taskEngine, nodeRegistry } = req.app.locals.deps;
-    const task = taskEngine.getTask(req.params.id);
+    const { taskEngine, nodeRegistry, shareOrigin } = req.app.locals.deps;
+    const taskId = req.params.id;
+    const task = taskEngine.getTask(taskId);
     if (!task) {
-      throw new MeshyError("TASK_NOT_FOUND", `Task ${req.params.id} not found`, 404);
+      throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
     }
-    res.json(withAssignedNodeMetadata(task, nodeRegistry));
+    res.json(toTaskResponse(task, nodeRegistry, taskEngine, shareOrigin));
+  }));
+  router.post("/:id/share", asyncHandler6(async (req, res) => {
+    const { taskEngine, ensureShareTunnel } = req.app.locals.deps;
+    const body = CreateTaskShareBody.parse(req.body ?? {});
+    const taskId = req.params.id;
+    const task = taskEngine.getTask(taskId);
+    if (!task) {
+      throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
+    }
+    if (!ensureShareTunnel) {
+      throw new MeshyError("VALIDATION_ERROR", "Share tunnel is not available", 503);
+    }
+    const shareOrigin = await ensureShareTunnel();
+    const existing = taskEngine.getTaskShareByTaskId(task.id);
+    if (existing) {
+      const updated = taskEngine.updateTaskShare(existing.id, {
+        tenant: body.tenant,
+        scope: body.scope
+      }) ?? existing;
+      res.json({ shareId: updated.id, tenant: updated.tenant, scope: updated.scope, url: buildShareUrl(shareOrigin, updated.id) });
+      return;
+    }
+    const share = taskEngine.createTaskShare({
+      id: (0, import_node_crypto7.randomUUID)(),
+      taskId: task.id,
+      tenant: body.tenant,
+      scope: body.scope,
+      createdAt: Date.now()
+    });
+    res.status(201).json({ shareId: share.id, tenant: share.tenant, scope: share.scope, url: buildShareUrl(shareOrigin, share.id) });
+  }));
+  router.delete("/:id/share", asyncHandler6(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const taskId = req.params.id;
+    const task = taskEngine.getTask(taskId);
+    if (!task) {
+      throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
+    }
+    const existing = taskEngine.getTaskShareByTaskId(task.id);
+    if (!existing) {
+      res.json({ ok: true, stopped: false });
+      return;
+    }
+    const revokedAt = Date.now();
+    const updated = taskEngine.updateTaskShare(existing.id, { revokedAt }) ?? { ...existing, revokedAt };
+    res.json({ ok: true, stopped: true, shareId: updated.id });
   }));
   router.patch("/:id", asyncHandler6(async (req, res) => {
     const { taskEngine, nodeRegistry, logger: rootLogger } = req.app.locals.deps;
@@ -44914,20 +45088,174 @@ function createTaskRoutes() {
   return router;
 }
 
-// ../../packages/api/src/routes/worker.ts
+// ../../packages/api/src/routes/shared.ts
 var import_express8 = __toESM(require_express2(), 1);
+function asyncHandler7(fn) {
+  return (req, res, next) => fn(req, res, next).catch(next);
+}
+function assertActiveShare(share) {
+  if (!share) {
+    throw new MeshyError("TASK_NOT_FOUND", "Shared conversation not found", 404);
+  }
+  if (share.revokedAt !== void 0) {
+    throw new MeshyError("VALIDATION_ERROR", "Shared conversation has been revoked", 410);
+  }
+  return share;
+}
+function assertFilesPreviewShare(share) {
+  if (share.scope !== "filesPreview") {
+    throw new MeshyError("VALIDATION_ERROR", "Shared conversation does not include files or preview", 403);
+  }
+}
+function getTaskPayloadForShare(task) {
+  return task.payload.initialMessage === void 0 ? {} : { initialMessage: task.payload.initialMessage };
+}
+function toSharedConversation(share, task) {
+  return {
+    id: task.id,
+    shareId: share.id,
+    title: task.title,
+    description: task.description,
+    agent: task.agent,
+    status: task.status,
+    priority: task.priority,
+    assignedNodeName: task.assignedNodeName ?? null,
+    tenant: share.tenant,
+    scope: share.scope,
+    payload: getTaskPayloadForShare(task),
+    createdAt: task.createdAt,
+    updatedAt: task.updatedAt
+  };
+}
+function createSharedRoutes() {
+  const router = (0, import_express8.Router)();
+  router.get("/conversations/:shareId", asyncHandler7(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    const task = taskEngine.getTask(share.taskId);
+    if (!task) {
+      throw new MeshyError("TASK_NOT_FOUND", "Shared conversation task not found", 404);
+    }
+    res.json(toSharedConversation(share, task));
+  }));
+  router.get("/conversations/:shareId/logs", asyncHandler7(async (req, res) => {
+    const { taskEngine, engineRegistry } = req.app.locals.deps;
+    const query = TaskLogsQuery.parse(req.query);
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    const task = taskEngine.getTask(share.taskId);
+    if (!task) {
+      throw new MeshyError("TASK_NOT_FOUND", "Shared conversation task not found", 404);
+    }
+    res.json(readLocalTaskLogs(engineRegistry, task.id, query.after ?? 0, task.agent));
+  }));
+  router.get("/conversations/:shareId/output", asyncHandler7(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    assertFilesPreviewShare(share);
+    const handled = await maybeHandleRemoteTaskOutputRequest(
+      req,
+      res,
+      share.taskId,
+      "",
+      void 0,
+      createNodeMessage("task.output.summary", { taskId: share.taskId }, { expectsResponse: true })
+    );
+    if (handled) return;
+    res.json(getLocalTaskOutputSummary(req.app.locals.deps.taskEngine, share.taskId));
+  }));
+  router.get("/conversations/:shareId/output/tree", asyncHandler7(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const query = TaskOutputTreeQuery.parse(req.query);
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    assertFilesPreviewShare(share);
+    const handled = await maybeHandleRemoteTaskOutputRequest(
+      req,
+      res,
+      share.taskId,
+      "/tree",
+      void 0,
+      createNodeMessage("task.output.tree", { taskId: share.taskId, path: query.path }, { expectsResponse: true })
+    );
+    if (handled) return;
+    res.json(getLocalTaskOutputTree(req.app.locals.deps.taskEngine, share.taskId, query.path));
+  }));
+  router.get("/conversations/:shareId/output/content", asyncHandler7(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const query = TaskOutputContentQuery.parse(req.query);
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    assertFilesPreviewShare(share);
+    const handled = await maybeHandleRemoteTaskOutputRequest(
+      req,
+      res,
+      share.taskId,
+      "/content",
+      void 0,
+      createNodeMessage("task.output.content", { taskId: share.taskId, path: query.path }, { expectsResponse: true })
+    );
+    if (handled) return;
+    const content = getLocalTaskOutputContent(req.app.locals.deps.taskEngine, share.taskId, query.path);
+    res.json({
+      ...content,
+      downloadUrl: `/api/shared/conversations/${encodeURIComponent(share.id)}/output/download?path=${encodeURIComponent(query.path)}`
+    });
+  }));
+  router.get("/conversations/:shareId/output/download", asyncHandler7(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const query = TaskOutputDownloadQuery.parse(req.query);
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    assertFilesPreviewShare(share);
+    const handled = await maybeHandleRemoteTaskOutputRequest(
+      req,
+      res,
+      share.taskId,
+      "/download",
+      void 0,
+      createNodeMessage("task.output.download", { taskId: share.taskId, path: query.path }, { expectsResponse: true })
+    );
+    if (handled) return;
+    const download = getLocalTaskOutputDownload(req.app.locals.deps.taskEngine, share.taskId, query.path);
+    for (const [key, value] of Object.entries(download.headers)) {
+      res.setHeader(key, value);
+    }
+    res.send(download.content);
+  }));
+  router.post("/conversations/:shareId/output/preview-sessions", asyncHandler7(async (req, res) => {
+    const { taskEngine } = req.app.locals.deps;
+    const body = TaskPreviewSessionBody.parse(req.body ?? {});
+    const shareId = req.params.shareId;
+    const share = assertActiveShare(taskEngine.getTaskShare(shareId));
+    assertFilesPreviewShare(share);
+    const handled = await maybeHandleRemoteTaskOutputRequest(req, res, share.taskId, "/preview-sessions", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    }, createNodeMessage("task.preview.create", { taskId: share.taskId, path: body.path }, { expectsResponse: true }));
+    if (handled) return;
+    res.json(await createPreviewSessionPayload(req.app.locals.deps, share.taskId, body.path, resolveRequestOrigin(req)));
+  }));
+  return router;
+}
+
+// ../../packages/api/src/routes/worker.ts
+var import_express9 = __toESM(require_express2(), 1);
 var WorkerMessageBody = external_exports.object({
   taskId: external_exports.string().min(1)
 }).and(SendMessageBody);
 var WorkerTaskBody = external_exports.object({
   taskId: external_exports.string().min(1)
 });
-function asyncHandler7(fn) {
+function asyncHandler8(fn) {
   return (req, res, next) => fn(req, res, next).catch(next);
 }
 function createWorkerRoutes() {
-  const router = (0, import_express8.Router)();
-  router.post("/execute", asyncHandler7(async (req, res) => {
+  const router = (0, import_express9.Router)();
+  router.post("/execute", asyncHandler8(async (req, res) => {
     const { taskEngine, engineRegistry, nodeRegistry, eventBus, logger: rootLogger, workDir } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/execute");
     const task = req.body;
@@ -44944,7 +45272,7 @@ function createWorkerRoutes() {
     });
     res.json({ ok: true });
   }));
-  router.post("/message", asyncHandler7(async (req, res) => {
+  router.post("/message", asyncHandler8(async (req, res) => {
     const { engineRegistry, taskEngine, nodeRegistry, eventBus, logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/message");
     const body = WorkerMessageBody.parse(req.body);
@@ -44994,7 +45322,7 @@ function createWorkerRoutes() {
     }
     res.json({ ok: true });
   }));
-  router.post("/cancel", asyncHandler7(async (req, res) => {
+  router.post("/cancel", asyncHandler8(async (req, res) => {
     const { taskEngine, engineRegistry, logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/cancel");
     const body = WorkerTaskBody.parse(req.body);
@@ -45014,7 +45342,7 @@ function createWorkerRoutes() {
       terminal: result.terminal
     });
   }));
-  router.post("/output", asyncHandler7(async (req, res) => {
+  router.post("/output", asyncHandler8(async (req, res) => {
     const { eventBus, engineRegistry, taskEngine, logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/output");
     const { taskId, event } = req.body;
@@ -45029,7 +45357,7 @@ function createWorkerRoutes() {
     }
     res.json({ ok: true });
   }));
-  router.post("/heartbeat", asyncHandler7(async (req, res) => {
+  router.post("/heartbeat", asyncHandler8(async (req, res) => {
     const { heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/heartbeat");
     const body = req.body;
@@ -45046,7 +45374,7 @@ function createWorkerRoutes() {
     });
     res.json(response);
   }));
-  router.post("/keepalive", asyncHandler7(async (req, res) => {
+  router.post("/keepalive", asyncHandler8(async (req, res) => {
     const { heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/keepalive");
     const body = req.body;
@@ -45064,17 +45392,17 @@ function createWorkerRoutes() {
     });
     res.json(response);
   }));
-  router.post("/vote", asyncHandler7(async (req, res) => {
+  router.post("/vote", asyncHandler8(async (req, res) => {
     const { election } = req.app.locals.deps;
     const response = election.handleVoteRequest(req.body);
     res.json(response);
   }));
-  router.post("/announce", asyncHandler7(async (req, res) => {
+  router.post("/announce", asyncHandler8(async (req, res) => {
     const { election } = req.app.locals.deps;
     election.handleLeaderAnnounce(req.body);
     res.json({ ok: true });
   }));
-  router.post("/preview-session", asyncHandler7(async (req, res) => {
+  router.post("/preview-session", asyncHandler8(async (req, res) => {
     const { logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/preview-session");
     const body = TaskPreviewSessionBody.extend({
@@ -45089,7 +45417,7 @@ function createWorkerRoutes() {
     log2.info("created preview session", { taskId: body.taskId, entryPath: payload.entryPath });
     res.json(payload);
   }));
-  router.get("/preview-asset", asyncHandler7(async (req, res) => {
+  router.get("/preview-asset", asyncHandler8(async (req, res) => {
     const { previewSessionManager } = req.app.locals.deps;
     if (!previewSessionManager) {
       throw new MeshyError("VALIDATION_ERROR", "Preview not available on this node", 400);
@@ -45098,7 +45426,7 @@ function createWorkerRoutes() {
     const requestedPath = typeof req.query.path === "string" && req.query.path.length > 0 ? req.query.path : void 0;
     sendPreviewAssetResponse(previewSessionManager, token, requestedPath, res);
   }));
-  router.post("/control-response", asyncHandler7(async (req, res) => {
+  router.post("/control-response", asyncHandler8(async (req, res) => {
     const { heartbeat, logger: rootLogger } = req.app.locals.deps;
     const log2 = rootLogger.child("worker/control-response");
     const body = normalizeNodeMessageResponse(req.body);
@@ -45125,7 +45453,7 @@ function normalizeNodeMessageResponse(value) {
 }
 
 // ../../packages/api/src/routes/system.ts
-var import_express9 = __toESM(require_express2(), 1);
+var import_express10 = __toESM(require_express2(), 1);
 
 // ../../packages/api/src/app/system-info.ts
 var os5 = __toESM(require("os"), 1);
@@ -45243,12 +45571,12 @@ function buildNodeSettingsSnapshot(options) {
 }
 
 // ../../packages/api/src/routes/system.ts
-function asyncHandler8(fn) {
+function asyncHandler9(fn) {
   return (req, res, next) => fn(req, res, next).catch(next);
 }
 function createSystemRoutes() {
-  const router = (0, import_express9.Router)();
-  router.get("/health", asyncHandler8(async (req, res) => {
+  const router = (0, import_express10.Router)();
+  router.get("/health", asyncHandler9(async (req, res) => {
     const { logger: rootLogger } = req.app.locals.deps;
     rootLogger.child("system/health").info("received system health API call", {
       method: req.method,
@@ -45257,7 +45585,7 @@ function createSystemRoutes() {
     });
     res.json({ status: "ok", timestamp: Date.now() });
   }));
-  router.get("/info", asyncHandler8(async (req, res) => {
+  router.get("/info", asyncHandler9(async (req, res) => {
     const {
       nodeRegistry,
       getTransportType,
@@ -45301,7 +45629,7 @@ function createSystemRoutes() {
       packages: settingsSnapshot.packages
     });
   }));
-  router.post("/transport", asyncHandler8(async (req, res) => {
+  router.post("/transport", asyncHandler9(async (req, res) => {
     const { switchTransport } = req.app.locals.deps;
     if (!switchTransport) {
       res.status(501).json({ error: "Transport switching not available" });
@@ -45315,7 +45643,7 @@ function createSystemRoutes() {
     const newEndpoint = await switchTransport(type);
     res.json({ ok: true, transportType: type, endpoint: newEndpoint });
   }));
-  router.post("/devtunnel", asyncHandler8(async (req, res) => {
+  router.post("/devtunnel", asyncHandler9(async (req, res) => {
     const { enableDevTunnel, disableDevTunnel, nodeRegistry, taskEngine } = req.app.locals.deps;
     if (!enableDevTunnel || !disableDevTunnel) {
       res.status(501).json({ error: "DevTunnel control not available" });
@@ -45344,7 +45672,7 @@ function createSystemRoutes() {
       });
     }
   }));
-  router.get("/metrics", asyncHandler8(async (req, res) => {
+  router.get("/metrics", asyncHandler9(async (req, res) => {
     const { taskEngine } = req.app.locals.deps;
     const metrics = taskEngine.getMetrics();
     res.json(metrics);
@@ -45353,7 +45681,7 @@ function createSystemRoutes() {
 }
 
 // ../../packages/api/src/routes/events.ts
-var import_express10 = __toESM(require_express2(), 1);
+var import_express11 = __toESM(require_express2(), 1);
 var HEARTBEAT_INTERVAL_MS = 15e3;
 var CATEGORY_MAP = {
   tasks: "task.",
@@ -45389,7 +45717,7 @@ function shouldIncludeEvent(eventName, categories) {
   });
 }
 function createEventRoutes() {
-  const router = (0, import_express10.Router)();
+  const router = (0, import_express11.Router)();
   router.get("/", (req, res) => {
     const { eventBus } = req.app.locals.deps;
     const categories = parseFilter(req.query.filter);
@@ -45437,6 +45765,40 @@ data: ${JSON.stringify(data)}
 // ../../packages/api/src/app/server.ts
 var JSON_BODY_LIMIT = "1mb";
 var JSON_BODY_LIMIT_LARGE = "25mb";
+var TRUSTED_LOCAL_HOSTS2 = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function normalizeHost2(value) {
+  const trimmed = value?.trim().toLowerCase();
+  return trimmed ? trimmed.replace(/:\d+$/, "") : void 0;
+}
+function collectForwardedHosts(value) {
+  if (typeof value !== "string") {
+    return [];
+  }
+  return value.split(",").map((item) => normalizeHost2(item)).filter((host) => Boolean(host));
+}
+function getRequestHosts2(req) {
+  const forwardedHosts = collectForwardedHosts(req.headers["x-forwarded-host"]);
+  if (forwardedHosts.length > 0) {
+    return forwardedHosts;
+  }
+  return [normalizeHost2(req.hostname), normalizeHost2(typeof req.headers.host === "string" ? req.headers.host : void 0)].filter((host) => Boolean(host));
+}
+function getOriginHost(origin) {
+  if (!origin) return void 0;
+  try {
+    return normalizeHost2(new URL(origin).host);
+  } catch {
+    return void 0;
+  }
+}
+function isShareHostRequest(req, shareOrigin) {
+  const shareHost = getOriginHost(shareOrigin);
+  if (!shareHost) return false;
+  return getRequestHosts2(req).some((host) => !TRUSTED_LOCAL_HOSTS2.has(host) && host === shareHost);
+}
+function isAllowedSharePath(pathname) {
+  return pathname === "/favicon.ico" || pathname === "/api/shared" || pathname.startsWith("/api/shared/") || pathname === "/preview" || pathname.startsWith("/preview/") || pathname === "/shared" || pathname.startsWith("/shared/") || pathname === "/assets" || pathname.startsWith("/assets/");
+}
 function resolveRuntimeBaseDir() {
   const entryPath = process.argv[1];
   if (typeof entryPath === "string" && entryPath.length > 0) {
@@ -45467,7 +45829,7 @@ function resolveStaticDir(baseDir) {
   return null;
 }
 function createServer2(deps) {
-  const app = (0, import_express11.default)();
+  const app = (0, import_express12.default)();
   app.locals.deps = deps;
   if (typeof deps.heartbeat.setNodeMessageHandler === "function") {
     deps.heartbeat.setNodeMessageHandler((message) => handleNodeMessage(deps, message));
@@ -45483,15 +45845,32 @@ function createServer2(deps) {
         } catch {
         }
       }
+      if (deps.shareOrigin) {
+        try {
+          trustedHosts.push(new URL(deps.shareOrigin).host);
+        } catch {
+        }
+      }
       return trustedHosts;
     }
   };
   const isApiRequest = (req) => req.path === "/api" || req.path.startsWith("/api/");
   const canServeDashboard = (req) => !deps.config.validateBearerToken || isTrustedDashboardRequest(req, authConfig);
+  app.use((req, res, next) => {
+    if (!isShareHostRequest(req, deps.shareOrigin)) {
+      next();
+      return;
+    }
+    if (isAllowedSharePath(req.path)) {
+      next();
+      return;
+    }
+    res.status(404).type("text/plain").send("Not Found");
+  });
   const runtimeBaseDir = resolveRuntimeBaseDir();
   const staticDir = resolveStaticDir(runtimeBaseDir);
   if (staticDir) {
-    const staticMiddleware = import_express11.default.static(staticDir);
+    const staticMiddleware = import_express12.default.static(staticDir);
     app.use((req, res, next) => {
       if (isApiRequest(req)) {
         next();
@@ -45504,7 +45883,7 @@ function createServer2(deps) {
       staticMiddleware(req, res, next);
     });
   }
-  app.use(import_express11.default.json({ limit: JSON_BODY_LIMIT }));
+  app.use(import_express12.default.json({ limit: JSON_BODY_LIMIT }));
   app.use(createAuthMiddleware(authConfig));
   app.use((req, res, next) => {
     void (async () => {
@@ -45526,12 +45905,13 @@ function createServer2(deps) {
     })().catch(next);
   });
   app.use(createRoutingMiddleware(deps.dataRouter));
-  const largeBodyParser = import_express11.default.json({ limit: JSON_BODY_LIMIT_LARGE });
+  const largeBodyParser = import_express12.default.json({ limit: JSON_BODY_LIMIT_LARGE });
   app.use("/api/cluster", createClusterRoutes());
   app.use("/api/cluster-control", createClusterControlRoutes());
   app.use("/api/node", largeBodyParser, createNodeMessageRoutes());
   app.use("/api/nodes", createNodeRoutes());
   app.use("/api/tasks", largeBodyParser, createTaskRoutes());
+  app.use("/api/shared", createSharedRoutes());
   app.use("/api/worker", largeBodyParser, createWorkerRoutes());
   app.use("/api/system", createSystemRoutes());
   app.use("/api/events", createEventRoutes());
@@ -45751,8 +46131,24 @@ ${lines.join("")}`
       return args;
     }
     this.ensureTunnelPort(tunnelId, localPort);
+    this.ensureTunnelAccess(tunnelId);
     return ["host", tunnelId];
   }
+  ensureTunnelAccess(tunnelId) {
+    if (this.config.access !== "tenant") {
+      return;
+    }
+    try {
+      (0, import_node_child_process9.execFileSync)("devtunnel", ["access", "create", tunnelId, "--tenant"], { stdio: "pipe" });
+    } catch (err) {
+      if (isExistingTenantAccessError(err)) {
+        return;
+      }
+      throw new Error(
+        `Failed to configure tenant access for devtunnel "${tunnelId}": ${formatCommandError(err)}`
+      );
+    }
+  }
   ensureTunnelExists() {
     const tunnelId = this.config.id.trim();
     if (!tunnelId) {
@@ -45847,6 +46243,10 @@ function normalizeDevTunnelUrl(value) {
     return null;
   }
 }
+function isExistingTenantAccessError(error) {
+  const message = formatCommandError(error).toLowerCase();
+  return message.includes("already exists") || message.includes("conflict") || message.includes("duplicate");
+}
 function formatCommandError(error) {
   if (!error || typeof error !== "object") {
     return String(error);
@@ -46624,7 +47024,9 @@ async function main() {
   const previewSessionManager = new PreviewSessionManager();
   const previewProxyManager = new PreviewProxyManager();
   let dashboardTransport = null;
+  let shareTransport = null;
   let dashboardOrigin;
+  let shareOrigin;
   let deps;
   async function closeServer(server2) {
     if (!server2) {
@@ -46653,11 +47055,29 @@ async function main() {
       }
     };
   }
+  function createShareTransportConfig() {
+    return {
+      type: "devtunnel",
+      devtunnel: {
+        id: resolveOrCreateDevTunnelId(
+          config.storage.path,
+          meshyNode.getNodeRegistry().getSelf().id,
+          "share"
+        ),
+        allowAnonymous: false,
+        access: "tenant"
+      }
+    };
+  }
   function setAdvertisedDashboardOrigin(origin) {
     dashboardOrigin = origin;
     deps.dashboardOrigin = origin;
     meshyNode.getNodeRegistry().updateDashboardOrigin(meshyNode.getNodeRegistry().getSelf().id, origin);
   }
+  function setShareOrigin(origin) {
+    shareOrigin = origin;
+    deps.shareOrigin = origin;
+  }
   function shouldPublishDashboardTunnel() {
     return authMetadata.enabled && (meshyNode.getTransportType() === "devtunnel" || meshyNode.isDevTunnelEnabled());
   }
@@ -46739,6 +47159,27 @@ async function main() {
     }
     await restartDashboardTransport(reason);
   }
+  async function ensureShareTunnel() {
+    if (shareTransport && shareOrigin && await shareTransport.isHealthy().catch(() => false)) {
+      return shareOrigin;
+    }
+    if (shareTransport) {
+      await shareTransport.stop().catch(() => void 0);
+      shareTransport = null;
+      setShareOrigin(void 0);
+    }
+    const nextTransport = createTransport(createShareTransportConfig());
+    await nextTransport.start(config.node.port);
+    const nextOrigin = await nextTransport.getEndpoint();
+    shareTransport = nextTransport;
+    setShareOrigin(nextOrigin);
+    meshyNode.getLogger().info("started share tunnel", {
+      shareOrigin: nextOrigin,
+      tenantAccess: true,
+      stableUrl: true
+    });
+    return nextOrigin;
+  }
   deps = {
     dataRouter: meshyNode.getDataRouter(),
     taskEngine: meshyNode.getTaskEngine(),
@@ -46791,11 +47232,14 @@ async function main() {
     isDevTunnelEnabled: () => meshyNode.isDevTunnelEnabled(),
     localDashboardOrigin,
     dashboardOrigin,
+    shareOrigin,
+    ensureShareTunnel,
     runtimeMetadata
   };
   deps.previewSessionManager = previewSessionManager;
   deps.previewProxyManager = previewProxyManager;
   deps.dashboardOrigin = dashboardOrigin;
+  deps.shareOrigin = shareOrigin;
   meshyNode.getLogger().info("configured node auth mode", {
     authEnabled: authMetadata.enabled,
     allowSameTenant: authMetadata.allowSameTenant,
@@ -46869,6 +47313,9 @@ async function main() {
       if (dashboardTransport) {
         await dashboardTransport.stop();
       }
+      if (shareTransport) {
+        await shareTransport.stop();
+      }
       await meshyNode.stop();
       await closeServer(server);
       console.log("Goodbye!");