Marketplace app iframes (Penpot, Gitea, IndeedHub, ...) can POST a file to /api/share-to-mesh and postMessage the returned CID to the parent window. The endpoint mirrors /api/blob's body format but adds CORS for the requesting app origin (any port on host_ip) so proxied apps can reach it with credentials:'include'. Session cookie is still the primary auth; the origin check is a sanity guard. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>