@tinycloud/share-sdk 1.2.0-beta.1 → 1.2.0-beta.3

package/dist/share-root.cjs

@@ -21,22 +21,29 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var share_root_entry_exports = {};
 __export(share_root_entry_exports, {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS: () => AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
-  POLICY_OWNER_AUTHORITY_FEATURES: () => POLICY_OWNER_AUTHORITY_FEATURES,
-  POLICY_OWNER_AUTHORITY_PROBE_TTL_MS: () => POLICY_OWNER_AUTHORITY_PROBE_TTL_MS,
+  EDIT_SHARE_READER_MAX_LIFETIME_MS: () => EDIT_SHARE_READER_MAX_LIFETIME_MS,
+  SHARE_CONTROL_HEADER_BUDGET_BYTES: () => SHARE_CONTROL_HEADER_BUDGET_BYTES,
+  SHARE_CONTROL_LIFETIME_MS: () => SHARE_CONTROL_LIFETIME_MS,
+  SHARE_NETWORK_NAME_PREFIX: () => SHARE_NETWORK_NAME_PREFIX,
   SHARE_ROOT_CLOCK_SKEW_MS: () => SHARE_ROOT_CLOCK_SKEW_MS,
   SHARE_ROOT_LINK_MAX_LIFETIME_MS: () => SHARE_ROOT_LINK_MAX_LIFETIME_MS,
   SHARE_ROOT_MAX_LIFETIME_MS: () => SHARE_ROOT_MAX_LIFETIME_MS,
   SHARE_ROOT_PREFIX: () => SHARE_ROOT_PREFIX,
   SHARE_ROOT_REQUEST_MARGIN_MS: () => SHARE_ROOT_REQUEST_MARGIN_MS,
+  ShareGrant: () => ShareGrant,
   ShareRoot: () => ShareRoot,
   ShareRootError: () => ShareRootError,
+  assertNetworkSafeShareId: () => assertNetworkSafeShareId,
   assertNonExtractableShareKey: () => assertNonExtractableShareKey,
-  createPolicyOwnerModeProbe: () => createPolicyOwnerModeProbe,
+  assertShareGrantPath: () => assertShareGrantPath,
   decodeOwnerRootCacao: () => decodeOwnerRootCacao,
-  defaultPolicyOwnerModeProbe: () => defaultPolicyOwnerModeProbe,
   ensureShareRoot: () => ensureShareRoot,
+  openEditShare: () => openEditShare,
   ownerRootCacaoCid: () => ownerRootCacaoCid,
-  readPolicyOwnerAuthorityMode: () => readPolicyOwnerAuthorityMode,
+  perShareNetworkIdFor: () => perShareNetworkIdFor,
+  planShareControlBatches: () => planShareControlBatches,
+  revokeShareGrant: () => revokeShareGrant,
+  runShareControlBatch: () => runShareControlBatch,
   signShareKeyDelegation: () => signShareKeyDelegation
 });
 module.exports = __toCommonJS(share_root_entry_exports);
@@ -5465,6 +5472,37 @@ function serialize(value) {
 function canonicalize(value) {
   return serialize(value);
 }
+async function signCompactUcanAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60) {
+    throw new TypeError("compact invocation lifetime must be between one and 60 seconds");
+  }
+  const principal = input.issuerDid.split("#", 1)[0];
+  const publicKey = ed25519PublicKeyFromDidKey(principal);
+  const header = {
+    alg: "EdDSA",
+    jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: toBase64Url(publicKey) },
+    typ: "JWT",
+    ucv: "0.10.0"
+  };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp: input.expiresAt,
+    fct: input.facts,
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: input.notBefore,
+    nnc: input.nonce,
+    prf: input.proofs
+  };
+  const protectedSegment = toBase64Url(new TextEncoder().encode(canonicalize(header)));
+  const payloadSegment = toBase64Url(new TextEncoder().encode(canonicalize(payload)));
+  const signingInput = new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`);
+  const signature = await input.sign(signingInput);
+  if (signature.length !== 64) throw new TypeError("compact Authorization signature must be Ed25519");
+  return verifyCompactUcanAuthorization(
+    `${protectedSegment}.${payloadSegment}.${toBase64Url(signature)}`
+  );
+}
 function verifyCompactUcanAuthorization(authorization, expectedCid) {
   if (/\s/.test(authorization)) throw new TypeError("compact Authorization contains whitespace");
   const segments = authorization.split(".");
@@ -6583,27 +6621,20 @@ var AGENT_SHARE_ROOT_MAX_LIFETIME_MS = 30 * DAY_MS;
 var SHARE_ROOT_LINK_MAX_LIFETIME_MS = 30 * DAY_MS;
 var SHARE_ROOT_CLOCK_SKEW_MS = 5 * 6e4;
 var SHARE_ROOT_REQUEST_MARGIN_MS = 10 * 6e4;
-var POLICY_OWNER_AUTHORITY_FEATURES = {
-  marker: "policy-owner-authority-v1",
-  record: "policy-owner-authority-record",
-  enforce: "policy-owner-authority-enforce"
-};
-var POLICY_OWNER_AUTHORITY_PROBE_TTL_MS = 5 * 6e4;
-var MAX_INFO_BYTES = 64 * 1024;
+var MAX_NODE_ANSWER_BYTES = 64 * 1024;
 var MAX_POLICY_ROOT_MS = 31 * DAY_MS;
 var PROFILES = {
   share: { spaceName: "applications", maxLifetimeMs: SHARE_ROOT_MAX_LIFETIME_MS },
   agent: { spaceName: "default", maxLifetimeMs: AGENT_SHARE_ROOT_MAX_LIFETIME_MS }
 };
 var KV_ABILITIES = ["tinycloud.kv/get", "tinycloud.kv/metadata"];
-var DECRYPT_ABILITY = "tinycloud.encryption/decrypt";
 var ShareRootError = class extends Error {
   code;
   rootCid;
   signedCid;
   mustRevoke;
   constructor(code3, message, details = {}) {
-    super(details.mustRevoke === true && details.rootCid !== void 0 ? `${message}; the Node imported root ${details.rootCid}, which may grant more than requested: the owner must revoke it` : message);
+    super(details.mustRevoke === true && details.rootCid !== void 0 ? `${message}; the Node imported ${details.rootCid}, which may grant more than requested: the owner must revoke it` : message);
     this.name = "ShareRootError";
     this.code = code3;
     this.mustRevoke = details.mustRevoke === true;
@@ -6613,7 +6644,7 @@ var ShareRootError = class extends Error {
 };
 function parseOwnerDid(ownerDid) {
   const match = /^did:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40})$/.exec(ownerDid);
-  if (match === null) throw new ShareRootError("invalid-request", "share root owner must be did:pkh:eip155");
+  if (match === null) throw new ShareRootError("invalid-request", "share owner must be did:pkh:eip155");
   return { chainId: match[1], address: match[2].toLowerCase() };
 }
 function sameOwner(left, right) {
@@ -6622,16 +6653,9 @@ function sameOwner(left, right) {
 function assertSpace(spaceId, owner, kind) {
   const match = /^tinycloud:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):([A-Za-z0-9_-]+)$/.exec(spaceId);
   if (match === null || !sameOwner({ chainId: match[1], address: match[2].toLowerCase() }, owner) || match[3] !== PROFILES[kind].spaceName) {
-    throw new ShareRootError("invalid-request", `${kind} root must target the owner's ${PROFILES[kind].spaceName} space`);
+    throw new ShareRootError("invalid-request", `${kind} delegations must target the owner's ${PROFILES[kind].spaceName} space`);
   }
 }
-function shareNetworkId(owner) {
-  return `urn:tinycloud:encryption:did:pkh:eip155:${owner.chainId}:${owner.address}:share`;
-}
-function isShareNetworkOf(resource, owner) {
-  const match = /^urn:tinycloud:encryption:did:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):share$/.exec(resource);
-  return match !== null && sameOwner({ chainId: match[1], address: match[2].toLowerCase() }, owner);
-}
 function nodeOriginOf(value) {
   let url;
   try {
@@ -6652,49 +6676,66 @@ function seconds(ms) {
 }
 function parseTime(value, label, rootCid) {
   const time = value === void 0 ? Number.NaN : Date.parse(value);
-  if (!Number.isFinite(time)) throw new ShareRootError("malformed-root", `share root ${label} is missing or invalid`, { rootCid, mustRevoke: true });
+  if (!Number.isFinite(time)) throw new ShareRootError("malformed-root", `delegation ${label} is missing or invalid`, { rootCid, mustRevoke: true });
   return time;
 }
-function validateSignedRoot(decoded, expected) {
+function validateSignedOwnerDelegation(decoded, expected) {
+  const { label } = expected;
   const wider = { rootCid: decoded.cid, mustRevoke: true };
   let issuer;
   try {
     issuer = parseOwnerDid(decoded.issuer);
   } catch {
-    throw new ShareRootError("issuer-mismatch", "share root is not signed by a did:pkh owner", wider);
-  }
-  if (!sameOwner(issuer, expected.owner)) throw new ShareRootError("issuer-mismatch", "share root is signed by another owner", wider);
-  if (decoded.audience !== expected.keyDid) throw new ShareRootError("audience-mismatch", "share root is not delegated to the share key", wider);
-  if (decoded.resources.length !== 1 || !decoded.resources[0].startsWith("urn:recap:")) throw new ShareRootError("resource-mismatch", "share root must carry exactly one ReCap resource", wider);
-  if (decoded.reCapProofs.length !== 0) throw new ShareRootError("resource-mismatch", "share root must not have parent capabilities", wider);
-  const wanted = { [`${expected.spaceId}/kv/${SHARE_ROOT_PREFIX}`]: KV_ABILITIES };
-  if (expected.scope === "kv+share-decrypt") wanted[shareNetworkId(expected.owner)] = [DECRYPT_ABILITY];
-  for (const resource of Object.keys(decoded.attenuation)) if (wanted[resource] === void 0) throw new ShareRootError("resource-mismatch", "share root grants a resource outside its scope", wider);
-  for (const [resource, abilities] of Object.entries(wanted)) {
-    const granted = decoded.attenuation[resource];
-    if (granted === void 0) throw new ShareRootError("resource-mismatch", "share root is missing one of its resources", wider);
-    const names = Object.keys(granted);
-    if (names.length !== abilities.length || abilities.some((ability) => !names.includes(ability))) throw new ShareRootError("ability-mismatch", "share root abilities differ from the request", wider);
-    for (const ability of abilities) {
-      const caveats = granted[ability];
+    throw new ShareRootError("issuer-mismatch", `${label} is not signed by a did:pkh owner`, wider);
+  }
+  if (!sameOwner(issuer, expected.owner)) throw new ShareRootError("issuer-mismatch", `${label} is signed by another owner`, wider);
+  if (decoded.audience !== expected.keyDid) throw new ShareRootError("audience-mismatch", `${label} is not delegated to its key`, wider);
+  if (decoded.resources.length !== 1 || !decoded.resources[0].startsWith("urn:recap:")) throw new ShareRootError("resource-mismatch", `${label} must carry exactly one ReCap resource`, wider);
+  if (decoded.reCapProofs.length !== 0) throw new ShareRootError("resource-mismatch", `${label} must not have parent capabilities`, wider);
+  const { wanted } = expected;
+  for (const [resource, granted] of Object.entries(decoded.attenuation)) {
+    const abilities = wanted[resource];
+    if (abilities === void 0) throw new ShareRootError("resource-mismatch", `${label} grants a resource outside its scope`, wider);
+    for (const [ability, caveats] of Object.entries(granted)) {
+      if (!abilities.includes(ability)) throw new ShareRootError("ability-mismatch", `${label} grants an ability it was not asked for`, wider);
       if (caveats.length !== 1 || typeof caveats[0] !== "object" || caveats[0] === null || Array.isArray(caveats[0]) || Object.keys(caveats[0]).length !== 0) {
-        throw new ShareRootError("ability-mismatch", "share root abilities carry unexpected caveats", wider);
+        throw new ShareRootError("ability-mismatch", `${label} abilities carry unexpected caveats`, wider);
       }
     }
   }
+  const narrower = { rootCid: decoded.cid };
+  for (const [resource, abilities] of Object.entries(wanted)) {
+    const granted = decoded.attenuation[resource];
+    if (granted === void 0) throw new ShareRootError("resource-mismatch", `${label} is narrower than requested: a resource is missing`, narrower);
+    if (abilities.some((ability) => granted[ability] === void 0)) throw new ShareRootError("ability-mismatch", `${label} is narrower than requested: an ability is missing`, narrower);
+  }
   const issuedAt = parseTime(decoded.issuedAt, "issued-at time", decoded.cid);
   const expiresAt = parseTime(decoded.expiresAt, "expiration time", decoded.cid);
-  if (decoded.notBefore !== void 0 && parseTime(decoded.notBefore, "not-before time", decoded.cid) > expected.now) throw new ShareRootError("malformed-root", "share root is not valid yet", { rootCid: decoded.cid });
-  const cap = PROFILES[expected.kind].maxLifetimeMs;
-  if (expiresAt - issuedAt > cap + SHARE_ROOT_CLOCK_SKEW_MS || expiresAt - expected.now > cap) throw new ShareRootError("lifetime-exceeds-cap", `${expected.kind} root lifetime exceeds ${cap / DAY_MS} days`, wider);
-  if (expiresAt <= expected.now) throw new ShareRootError("expired", "share root has expired", { rootCid: decoded.cid });
+  if (decoded.notBefore !== void 0 && parseTime(decoded.notBefore, "not-before time", decoded.cid) > expected.now) throw new ShareRootError("malformed-root", `${label} is not valid yet`, { rootCid: decoded.cid });
+  const cap = expected.maxLifetimeMs;
+  if (expiresAt - issuedAt > cap + SHARE_ROOT_CLOCK_SKEW_MS || expiresAt - expected.now > cap) throw new ShareRootError("lifetime-exceeds-cap", `${label} lifetime exceeds its cap`, wider);
+  if (expiresAt <= expected.now) throw new ShareRootError("expired", `${label} has expired`, { rootCid: decoded.cid });
   if (expected.requestedExpiresAt !== void 0 && seconds(expiresAt) !== seconds(expected.requestedExpiresAt.getTime())) {
-    throw new ShareRootError("expiry-mismatch", "share root was signed with a different expiry than requested", { rootCid: decoded.cid, mustRevoke: expiresAt > expected.requestedExpiresAt.getTime() });
+    throw new ShareRootError("expiry-mismatch", `${label} was signed with a different expiry than requested`, { rootCid: decoded.cid, mustRevoke: expiresAt > expected.requestedExpiresAt.getTime() });
   }
   return { issuedAt: new Date(issuedAt), expiresAt: new Date(expiresAt) };
 }
+function validateSignedRoot(decoded, expected) {
+  return validateSignedOwnerDelegation(decoded, {
+    label: `${expected.kind} root`,
+    owner: expected.owner,
+    keyDid: expected.keyDid,
+    wanted: { [`${expected.spaceId}/kv/${SHARE_ROOT_PREFIX}`]: KV_ABILITIES },
+    maxLifetimeMs: PROFILES[expected.kind].maxLifetimeMs,
+    ...expected.requestedExpiresAt === void 0 ? {} : { requestedExpiresAt: expected.requestedExpiresAt },
+    now: expected.now
+  });
+}
+function isExactKeyUnder(path, prefix) {
+  return typeof path === "string" && path.startsWith(prefix) && path.length > prefix.length && !path.endsWith("/") && !path.includes("//") && !path.split("/").some((segment) => segment === "." || segment === "..") && !/[\u0000-\u001f\u007f\\*?#]/.test(path);
+}
 function assertLinkPath(path) {
-  if (typeof path !== "string" || !path.startsWith(SHARE_ROOT_PREFIX) || path.length === SHARE_ROOT_PREFIX.length || path.endsWith("/") || path.includes("//") || path.split("/").some((segment) => segment === "." || segment === "..") || /[\u0000-\u001f\u007f\\*?#]/.test(path)) throw new ShareRootError("link-out-of-scope", "link path must be one exact key under the share prefix");
+  if (!isExactKeyUnder(path, SHARE_ROOT_PREFIX)) throw new ShareRootError("link-out-of-scope", "link path must be one exact key under the share prefix");
 }
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
@@ -6706,6 +6747,43 @@ async function assertUsableKey(key) {
     throw new ShareRootError("invalid-key", errorMessage(error));
   }
 }
+async function readJsonCapped(response) {
+  if (!/^application\/json\s*(;|$)/i.test(response.headers.get("content-type") ?? "")) throw new Error("node answer is not JSON");
+  const reader = response.body?.getReader();
+  if (reader === void 0) throw new Error("node answer has no body");
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > MAX_NODE_ANSWER_BYTES) {
+      await reader.cancel();
+      throw new Error("node answer is too large");
+    }
+    chunks.push(value);
+  }
+  const bytes2 = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes2.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
+}
+async function isRevokeReceiptFor(response, cid) {
+  if (!response.ok) {
+    await response.body?.cancel();
+    return false;
+  }
+  let receipt;
+  try {
+    receipt = await readJsonCapped(response);
+  } catch {
+    return false;
+  }
+  return typeof receipt === "object" && receipt !== null && "revoked" in receipt && receipt.revoked === true && "cid" in receipt && receipt.cid === cid;
+}
 function policyRootContents(input) {
   const facts = {
     role: input.role,
@@ -6727,69 +6805,45 @@ function policyRootContents(input) {
   }
   return { facts, attenuation };
 }
-function readPolicyOwnerAuthorityMode(features) {
-  if (!Array.isArray(features) || !features.includes(POLICY_OWNER_AUTHORITY_FEATURES.marker)) return void 0;
-  const enforce = features.includes(POLICY_OWNER_AUTHORITY_FEATURES.enforce);
-  const record = features.includes(POLICY_OWNER_AUTHORITY_FEATURES.record);
-  if (enforce === record) return void 0;
-  return enforce ? "enforce" : "record";
-}
-async function readJsonCapped(response) {
-  if (!/^application\/json\s*(;|$)/i.test(response.headers.get("content-type") ?? "")) throw new Error("node info is not JSON");
-  const reader = response.body?.getReader();
-  if (reader === void 0) throw new Error("node info has no body");
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > MAX_INFO_BYTES) {
-      await reader.cancel();
-      throw new Error("node info is too large");
-    }
-    chunks.push(value);
-  }
-  const bytes2 = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes2.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
-}
-function createPolicyOwnerModeProbe(options = {}) {
-  const fetchFn = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
-  const ttlMs = Math.min(options.ttlMs ?? POLICY_OWNER_AUTHORITY_PROBE_TTL_MS, POLICY_OWNER_AUTHORITY_PROBE_TTL_MS);
-  const now = options.now ?? Date.now;
-  const cache3 = /* @__PURE__ */ new Map();
+function ownerPolicySigner(input) {
+  const { ownerDid, authorityCid, notAfter, gate } = input;
   return {
-    async isEnforced(nodeOrigin) {
-      const origin = nodeOriginOf(nodeOrigin);
-      if (origin === void 0) return false;
-      const cached = cache3.get(origin);
-      if (cached !== void 0 && now() - cached.checkedAt < ttlMs) return cached.enforced;
-      let enforced = false;
-      try {
-        const response = await fetchFn(new URL("/info", origin), { redirect: "error", signal: AbortSignal.timeout(5e3) });
-        const info = response.ok ? await readJsonCapped(response) : void 0;
-        enforced = typeof info === "object" && info !== null && "features" in info && readPolicyOwnerAuthorityMode(info.features) === "enforce";
-      } catch {
-        enforced = false;
+    ownerDid,
+    rootCid: authorityCid,
+    notAfter,
+    createOwnerRoot: async (root) => {
+      const key = await gate();
+      const now = input.now();
+      const notBefore = root.notBefore instanceof Date ? root.notBefore.getTime() : Number.NaN;
+      const expiry = root.expiresAt instanceof Date ? root.expiresAt.getTime() : Number.NaN;
+      if (root.ownerDid !== ownerDid || root.role !== "policy-authority" && root.role !== "policy-enforcement") throw new ShareRootError("invalid-request", "policy root must be owned by this key");
+      if (!Number.isFinite(notBefore) || !Number.isFinite(expiry) || notBefore >= expiry || expiry <= now) throw new ShareRootError("invalid-request", "policy root validity is invalid");
+      if (expiry > notAfter.getTime() || expiry - notBefore > MAX_POLICY_ROOT_MS) throw new ShareRootError("lifetime-exceeds-cap", "policy root must not outlive its owner delegation or 31 days", { rootCid: authorityCid });
+      for (const capability of root.capabilities) {
+        if (!input.inScope(capability)) throw new ShareRootError("invalid-request", "policy root capability is outside the owner delegation");
       }
-      cache3.set(origin, { enforced, checkedAt: now() });
-      return enforced;
+      const { facts, attenuation } = policyRootContents(root);
+      const signed = await signShareKeyDelegation({
+        key,
+        audienceDid: root.audienceDid,
+        attenuation,
+        facts: [facts],
+        proofs: [],
+        notBefore: seconds(notBefore),
+        expiresAt: seconds(expiry),
+        nonce: toBase64Url(crypto.getRandomValues(new Uint8Array(16)))
+      });
+      return { cid: signed.cid, delegationHeader: { Authorization: signed.authorization } };
     },
-    observe(nodeOrigin, features) {
-      const origin = nodeOriginOf(nodeOrigin);
-      if (origin !== void 0) cache3.set(origin, { enforced: readPolicyOwnerAuthorityMode(features) === "enforce", checkedAt: now() });
+    sign: async (digest) => {
+      const key = await gate();
+      if (!(digest instanceof Uint8Array) || digest.length !== 32) throw new ShareRootError("invalid-request", "policy signer signs 32-byte digests only");
+      return key.sign(digest);
     }
   };
 }
-var defaultPolicyOwnerModeProbe = createPolicyOwnerModeProbe();
 var ShareRoot = class _ShareRoot {
   kind;
-  scope;
   nodeOrigin;
   cid;
   ownerDid;
@@ -6802,7 +6856,6 @@ var ShareRoot = class _ShareRoot {
   #options;
   constructor(input) {
     this.kind = input.kind;
-    this.scope = input.scope;
     this.nodeOrigin = input.nodeOrigin;
     this.cid = input.cid;
     this.ownerDid = input.ownerDid;
@@ -6815,12 +6868,10 @@ var ShareRoot = class _ShareRoot {
     this.#options = input.options;
   }
   /**
-   * Ask the owner for a new root (one approval) for a fresh share key. The
-   * scope is chosen now: `kv+share-decrypt` only for a `share` root with the
-   * flag on and `nodeOrigin` advertising `enforce`, otherwise `kv`. All request
-   * checks run before anything is signed. If the signed result is rejected,
-   * the key is cleared and the error carries the imported `rootCid` (and
-   * `mustRevoke` when the root may be wider than requested).
+   * Ask the owner for a new root (one approval) for a fresh share key. All
+   * request checks run before anything is signed. If the signed result is
+   * rejected, the key is cleared and the error carries the imported `rootCid`
+   * (and `mustRevoke` when the root may be wider than requested).
    *
    * `keyFactory` defaults to a fresh non-extractable WebCrypto key that only
    * this root holds. A custom factory must not persist the key before
@@ -6836,7 +6887,6 @@ var ShareRoot = class _ShareRoot {
     const expiry = input.expiresAt instanceof Date ? input.expiresAt.getTime() : Number.NaN;
     if (!Number.isFinite(expiry) || expiry <= now) throw new ShareRootError("invalid-request", "share root expiry must be in the future");
     if (expiry - now > PROFILES[kind].maxLifetimeMs) throw new ShareRootError("lifetime-exceeds-cap", `${kind} root lifetime exceeds ${PROFILES[kind].maxLifetimeMs / DAY_MS} days`);
-    const scope = kind === "share" && options.shareRootPolicyRoots === true && await (options.policyOwnerModeProbe ?? defaultPolicyOwnerModeProbe).isEnforced(nodeOrigin) ? "kv+share-decrypt" : "kv";
     const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
     try {
       await assertUsableKey(key);
@@ -6845,7 +6895,6 @@ var ShareRoot = class _ShareRoot {
       throw error;
     }
     const permissions = [{ service: "tinycloud.kv", path: SHARE_ROOT_PREFIX, actions: [...KV_ABILITIES] }];
-    if (scope === "kv+share-decrypt") permissions.push({ service: "tinycloud.encryption", path: shareNetworkId(owner), actions: [DECRYPT_ABILITY] });
     let receipt;
     try {
       receipt = await input.owner.createOwnerDelegation({ delegateDid: key.did, spaceId: input.spaceId, expiresAt: input.expiresAt, permissions });
@@ -6863,8 +6912,8 @@ var ShareRoot = class _ShareRoot {
       } catch (error) {
         throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
       }
-      const times = validateSignedRoot(decoded, { kind, scope, owner, spaceId: input.spaceId, keyDid: key.did, requestedExpiresAt: input.expiresAt, now: (options.now ?? Date.now)() });
-      return new _ShareRoot({ kind, scope, nodeOrigin, cid: decoded.cid, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, ...times, authorization, key, options });
+      const times = validateSignedRoot(decoded, { kind, owner, spaceId: input.spaceId, keyDid: key.did, requestedExpiresAt: input.expiresAt, now: (options.now ?? Date.now)() });
+      return new _ShareRoot({ kind, nodeOrigin, cid: decoded.cid, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, ...times, authorization, key, options });
     } catch (error) {
       key.clear();
       if (error instanceof ShareRootError) throw error;
@@ -6875,9 +6924,7 @@ var ShareRoot = class _ShareRoot {
   static async restore(input) {
     const { record } = input;
     const options = { ...input.options, kind: record.kind };
-    if (record.version !== 1 || record.kind !== "share" && record.kind !== "agent" || record.scope !== "kv" && record.scope !== "kv+share-decrypt" || record.kind === "agent" && record.scope !== "kv") {
-      throw new ShareRootError("malformed-root", "share root record is not supported");
-    }
+    if (record.version !== 1 || record.kind !== "share" && record.kind !== "agent") throw new ShareRootError("malformed-root", "share root record is not supported");
     if (record.keyDid !== input.key.did) throw new ShareRootError("audience-mismatch", "share root record belongs to another key");
     const owner = parseOwnerDid(record.ownerDid);
     assertSpace(record.spaceId, owner, record.kind);
@@ -6891,19 +6938,19 @@ var ShareRoot = class _ShareRoot {
     } catch (error) {
       throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: record.cid });
     }
-    const times = validateSignedRoot(decoded, { kind: record.kind, scope: record.scope, owner, spaceId: record.spaceId, keyDid: input.key.did, now: (options.now ?? Date.now)() });
-    return new _ShareRoot({ kind: record.kind, scope: record.scope, nodeOrigin, cid: decoded.cid, ownerDid: record.ownerDid, spaceId: record.spaceId, ...times, authorization, key: input.key, options });
+    const times = validateSignedRoot(decoded, { kind: record.kind, owner, spaceId: record.spaceId, keyDid: input.key.did, now: (options.now ?? Date.now)() });
+    return new _ShareRoot({ kind: record.kind, nodeOrigin, cid: decoded.cid, ownerDid: record.ownerDid, spaceId: record.spaceId, ...times, authorization, key: input.key, options });
   }
-  /** The `Authorization` value the Node knows this root by (base64url CACAO). */
+  /**
+   * This root's CACAO as base64url, UNPADDED (the record form). As a Node
+   * `Authorization` header it must be padded to a multiple of 4 characters:
+   * the Node refuses an unpadded value otherwise.
+   */
   get authorization() {
     return toBase64Url(this.#authorization);
   }
-  /** True when the root holds `:share` decrypt and may act as a policy owner (still gated per call). */
-  get policyCapable() {
-    return this.scope === "kv+share-decrypt";
-  }
   toRecord() {
-    return { version: 1, kind: this.kind, scope: this.scope, nodeOrigin: this.nodeOrigin, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, expiresAt: this.expiresAt.toISOString() };
+    return { version: 1, kind: this.kind, nodeOrigin: this.nodeOrigin, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, expiresAt: this.expiresAt.toISOString() };
   }
   /** True while the root is live, its key is held, and it lasts at least until `expiresAt`. Revocation is not visible here. */
   covers(expiresAt, now = this.#now()) {
@@ -6940,54 +6987,6 @@ var ShareRoot = class _ShareRoot {
     });
     return { rootCid: this.cid, linkDid: input.linkDid, path: input.path, expiresAt: new Date(seconds(expiry) * 1e3), delegation };
   }
-  /**
-   * The only ShareRoot API that signs Policy/v3 (email/domain) owner material.
-   * Needs a `kv+share-decrypt` root, the `shareRootPolicyRoots` flag, a live
-   * root and key, and the root's Node advertising `enforce`; the returned
-   * signer re-checks all of it on every call. Until then addressed shares use
-   * per-share owner grants. Agent roots are bearer-only.
-   */
-  async policyRootSigner() {
-    await this.#assertPolicyGate();
-    const gate = () => this.#assertPolicyGate();
-    const owner = parseOwnerDid(this.ownerDid);
-    const notAfter = new Date(this.expiresAt);
-    return {
-      ownerDid: this.keyDid,
-      rootCid: this.cid,
-      notAfter,
-      createOwnerRoot: async (input) => {
-        const key = await gate();
-        const now = this.#now();
-        const notBefore = input.notBefore instanceof Date ? input.notBefore.getTime() : Number.NaN;
-        const expiry = input.expiresAt instanceof Date ? input.expiresAt.getTime() : Number.NaN;
-        if (input.ownerDid !== this.keyDid || input.role !== "policy-authority" && input.role !== "policy-enforcement") throw new ShareRootError("invalid-request", "policy root must be owned by this share key");
-        if (!Number.isFinite(notBefore) || !Number.isFinite(expiry) || notBefore >= expiry || expiry <= now) throw new ShareRootError("invalid-request", "policy root validity is invalid");
-        if (expiry > notAfter.getTime() || expiry - notBefore > MAX_POLICY_ROOT_MS) throw new ShareRootError("lifetime-exceeds-cap", "policy root must not outlive its share root or 31 days", { rootCid: this.cid });
-        for (const capability of input.capabilities) {
-          const inScope = capability.kind === "encryption" ? isShareNetworkOf(capability.resource, owner) && capability.action === DECRYPT_ABILITY : capability.resource.startsWith(`${this.spaceId}/kv/${SHARE_ROOT_PREFIX}`) && capability.actions.every((action) => KV_ABILITIES.includes(action));
-          if (!inScope) throw new ShareRootError("invalid-request", "policy root capability is outside the share root");
-        }
-        const { facts, attenuation } = policyRootContents(input);
-        const root = await signShareKeyDelegation({
-          key,
-          audienceDid: input.audienceDid,
-          attenuation,
-          facts: [facts],
-          proofs: [],
-          notBefore: seconds(notBefore),
-          expiresAt: seconds(expiry),
-          nonce: toBase64Url(crypto.getRandomValues(new Uint8Array(16)))
-        });
-        return { cid: root.cid, delegationHeader: { Authorization: root.authorization } };
-      },
-      sign: async (digest) => {
-        const key = await gate();
-        if (!(digest instanceof Uint8Array) || digest.length !== 32) throw new ShareRootError("invalid-request", "policy signer signs 32-byte digests only");
-        return key.sign(digest);
-      }
-    };
-  }
   /** Drop this root's key handle. It does not revoke the root: only the owner does that. */
   clear() {
     this.#key?.clear();
@@ -6997,17 +6996,6 @@ var ShareRoot = class _ShareRoot {
     if (this.#key === void 0) throw new ShareRootError("key-cleared", "share root key has been cleared", { rootCid: this.cid });
     return this.#key;
   }
-  async #assertPolicyGate() {
-    const key = this.#activeKey();
-    if (this.#options.shareRootPolicyRoots !== true) throw new ShareRootError("policy-roots-disabled", "share root policy roots are disabled (shareRootPolicyRoots is off)", { rootCid: this.cid });
-    if (this.kind !== "share") throw new ShareRootError("policy-roots-disabled", "agent roots are bearer-only", { rootCid: this.cid });
-    if (!this.policyCapable) throw new ShareRootError("root-not-policy-capable", "this share root holds no :share decrypt; re-root once the Node enforces", { rootCid: this.cid });
-    if (this.#now() >= this.expiresAt.getTime()) throw new ShareRootError("expired", "share root has expired", { rootCid: this.cid });
-    if (!await (this.#options.policyOwnerModeProbe ?? defaultPolicyOwnerModeProbe).isEnforced(this.nodeOrigin)) {
-      throw new ShareRootError("policy-roots-not-enforced-by-node", "the Node does not advertise owner-authority mode enforce", { rootCid: this.cid });
-    }
-    return key;
-  }
   #now() {
     return (this.#options.now ?? Date.now)();
   }
@@ -7015,17 +7003,14 @@ var ShareRoot = class _ShareRoot {
 async function ensureShareRoot(input) {
   const options = input.options ?? {};
   const kind = options.kind ?? "share";
-  const purpose = input.purpose ?? "bearer";
   const now = (options.now ?? Date.now)();
   const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
   const lifetime = PROFILES[kind].maxLifetimeMs - SHARE_ROOT_REQUEST_MARGIN_MS;
   if (input.expiresAt.getTime() - now > Math.min(lifetime, SHARE_ROOT_LINK_MAX_LIFETIME_MS)) throw new ShareRootError("lifetime-exceeds-cap", "no share root can cover this expiry");
-  if (purpose === "policy") {
-    if (options.shareRootPolicyRoots !== true || kind !== "share") throw new ShareRootError("policy-roots-disabled", "share root policy roots are disabled");
-    if (!await (options.policyOwnerModeProbe ?? defaultPolicyOwnerModeProbe).isEnforced(nodeOrigin)) throw new ShareRootError("policy-roots-not-enforced-by-node", "the Node does not advertise owner-authority mode enforce");
-  }
   const { current } = input;
-  if (current !== void 0 && current.kind === kind && current.spaceId === input.spaceId && current.nodeOrigin === nodeOrigin && current.covers(input.expiresAt, now) && (purpose === "bearer" || current.policyCapable)) return { root: current, rerooted: false };
+  if (current !== void 0 && current.kind === kind && current.spaceId === input.spaceId && current.nodeOrigin === nodeOrigin && current.covers(input.expiresAt, now)) {
+    return { root: current, rerooted: false };
+  }
   const factory = input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false }));
   const root = await ShareRoot.create({
     owner: input.owner,
@@ -7039,30 +7024,744 @@ async function ensureShareRoot(input) {
     },
     options
   });
-  if (purpose === "policy" && !root.policyCapable) {
-    throw new ShareRootError("policy-roots-not-enforced-by-node", "the Node stopped advertising enforce while re-rooting; the new root is kv-only", { rootCid: root.cid });
-  }
   return { root, rerooted: true };
 }
+
+// src/artifact.ts
+var import_sha2563 = require("@noble/hashes/sha256");
+function parseArtifactVersionPath(path) {
+  const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
+  if (match === null) return void 0;
+  return { artifactId: match[1], version: Number(match[2]), file: match[3] };
+}
+
+// src/share-network.ts
+var import_sha2564 = require("@noble/hashes/sha256");
+var SHARE_NETWORK_NAME_PREFIX = "share-";
+var NETWORK_SAFE_SHARE_ID = /^[a-z0-9][a-z0-9-]{15,35}$/;
+var NETWORK_URN = /^urn:tinycloud:encryption:did:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):([a-z0-9][a-z0-9-]*)$/;
+var NETWORK_CREATE_ABILITY = "tinycloud.encryption/network.create";
+var NETWORK_REVOKE_ABILITY = "tinycloud.encryption/network.revoke";
+var DECRYPT_ABILITY = "tinycloud.encryption/decrypt";
+var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
+var NETWORK_ALG = "x25519-aes256gcm/v1";
+function assertNetworkSafeShareId(shareId) {
+  if (typeof shareId !== "string" || !NETWORK_SAFE_SHARE_ID.test(shareId)) {
+    throw new ShareRootError("share-id-not-network-safe", "shareId must match ^[a-z0-9][a-z0-9-]{15,35}$ to name its encryption network");
+  }
+}
+function perShareNetworkIdFor(ownerDid, shareId) {
+  const owner = parseOwnerDid(ownerDid);
+  assertNetworkSafeShareId(shareId);
+  return `urn:tinycloud:encryption:did:pkh:eip155:${owner.chainId}:${owner.address}:${SHARE_NETWORK_NAME_PREFIX}${shareId}`;
+}
+function isPerShareNetworkOf(ownerDid, networkId) {
+  const parsed = typeof networkId === "string" ? parseOwnerNetworkUrn(networkId) : void 0;
+  if (parsed === void 0) return false;
+  const shareId = parsed.name.slice(SHARE_NETWORK_NAME_PREFIX.length);
+  if (!NETWORK_SAFE_SHARE_ID.test(shareId)) return false;
+  return networkId === perShareNetworkIdFor(ownerDid, shareId);
+}
+function parseOwnerNetworkUrn(urn) {
+  const match = typeof urn === "string" ? NETWORK_URN.exec(urn) : null;
+  return match === null ? void 0 : { owner: { chainId: match[1], address: match[2].toLowerCase() }, name: match[3] };
+}
+function sameNetworkUrn(left, right) {
+  const a = parseOwnerNetworkUrn(left);
+  const b = parseOwnerNetworkUrn(right);
+  return a !== void 0 && b !== void 0 && sameOwner(a.owner, b.owner) && a.name === b.name;
+}
+async function nodeDidOf(nodeOrigin, fetchFn) {
+  let info;
+  try {
+    info = await readJsonCapped(await fetchFn(new URL("/info", nodeOrigin), { redirect: "error" }));
+  } catch (error) {
+    throw new ShareRootError("node-refused", `node identity is unavailable: ${errorMessage(error)}`);
+  }
+  const nodeDid = typeof info === "object" && info !== null && "nodeId" in info ? info.nodeId : void 0;
+  if (typeof nodeDid !== "string" || !nodeDid.startsWith("did:key:")) throw new ShareRootError("node-refused", "node identity is unavailable");
+  return nodeDid;
+}
+async function lookupShareNetwork(nodeOrigin, networkId, fetchFn) {
+  const response = await fetchFn(new URL(`/encryption/networks/${encodeURIComponent(networkId)}`, nodeOrigin), { redirect: "error" });
+  if (response.status === 404) return { state: "absent" };
+  if (!response.ok) throw new ShareRootError("node-refused", `share network lookup failed: HTTP ${response.status}`);
+  let body;
+  try {
+    body = await readJsonCapped(response);
+  } catch (error) {
+    throw new ShareRootError("node-refused", `share network descriptor is unreadable: ${errorMessage(error)}`);
+  }
+  const descriptor = typeof body === "object" && body !== null && "descriptor" in body ? body.descriptor : body;
+  if (typeof descriptor !== "object" || descriptor === null || Array.isArray(descriptor) || !("state" in descriptor) || typeof descriptor.state !== "string" || !("networkId" in descriptor) || typeof descriptor.networkId !== "string") {
+    throw new ShareRootError("node-refused", "share network descriptor is malformed");
+  }
+  return { state: descriptor.state, networkId: descriptor.networkId, descriptor };
+}
+function assertActiveShareNetwork(lookup, expectedNetworkId) {
+  if (lookup.state !== "active" || !("descriptor" in lookup)) throw new ShareRootError("network-not-active", `share network is ${lookup.state}`);
+  const { descriptor } = lookup;
+  const expected = parseOwnerNetworkUrn(expectedNetworkId);
+  if (expected === void 0) throw new ShareRootError("invalid-request", "network id must be a did:pkh-owned network URN");
+  const threshold = descriptor.threshold;
+  const ownerDid = descriptor.ownerDid;
+  let ownerMatches = false;
+  try {
+    ownerMatches = typeof ownerDid === "string" && sameOwner(parseOwnerDid(ownerDid), expected.owner);
+  } catch {
+    ownerMatches = false;
+  }
+  if (!sameNetworkUrn(lookup.networkId, expectedNetworkId) || !ownerMatches || descriptor.name !== expected.name || descriptor.alg !== NETWORK_ALG || descriptor.keyVersion !== 1 || typeof threshold !== "object" || threshold === null || !("n" in threshold) || !("t" in threshold) || threshold.n !== 1 || threshold.t !== 1) throw new ShareRootError("network-not-active", "share network descriptor does not match the share");
+}
+async function sendNetworkAdmin(input) {
+  const parsed = parseOwnerNetworkUrn(input.networkId);
+  if (parsed === void 0) throw new ShareRootError("invalid-request", "network id must be a did:pkh-owned network URN");
+  const body = input.action === NETWORK_CREATE_ABILITY ? canonicalize({ name: parsed.name, ownerDid: `did:pkh:eip155:${parsed.owner.chainId}:${parsed.owner.address}`, threshold: { n: 1, t: 1 } }) : canonicalize({});
+  const now = seconds((input.now ?? Date.now)());
+  const bodyHash = [...(0, import_sha2564.sha256)(new TextEncoder().encode(body))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const invocation = await signCompactUcanAuthorization({
+    issuerDid: input.signer.did,
+    audienceDid: input.nodeDid,
+    attenuation: { [input.networkId]: { [input.action]: [{}] } },
+    facts: [{ type: NETWORK_ADMIN_TYPE, targetNode: input.nodeDid, networkId: input.networkId, bodyHash, action: input.action }],
+    proofs: [input.proof],
+    notBefore: now,
+    expiresAt: now + 60,
+    nonce: toBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    sign: input.signer.sign
+  });
+  const path = input.action === NETWORK_CREATE_ABILITY ? "/encryption/networks" : `/encryption/networks/${encodeURIComponent(input.networkId)}/revoke`;
+  const response = await input.fetch(new URL(path, input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { Authorization: invocation.authorization, ...input.action === NETWORK_CREATE_ABILITY ? { "content-type": "application/json" } : {} },
+    ...input.action === NETWORK_CREATE_ABILITY ? { body } : {}
+  });
+  await response.body?.cancel();
+  return response.status;
+}
+async function retireShareNetwork(input) {
+  const status = await sendNetworkAdmin({ ...input, action: NETWORK_REVOKE_ABILITY });
+  const lookup = await lookupShareNetwork(input.nodeOrigin, input.networkId, input.fetch);
+  if (lookup.state === "absent" && (status === 404 || status === 204)) return "absent";
+  if (lookup.state === "revoked") return "retired";
+  throw new ShareRootError("node-refused", `share network retire failed: HTTP ${status}, state ${lookup.state}`);
+}
+
+// src/share-grant.ts
+var KV_ACTIONS = {
+  view: ["tinycloud.kv/get", "tinycloud.kv/metadata"],
+  edit: ["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/put"]
+};
+var NETWORK_ACTIONS = [NETWORK_CREATE_ABILITY, NETWORK_REVOKE_ABILITY, DECRYPT_ABILITY];
+var SHARE_KV_ROOT = "xyz.tinycloud.share/";
+var EDIT_SHARE_READER_MAX_LIFETIME_MS = 60 * 6e4;
+var defaultFetch = (url, init) => globalThis.fetch(url, init);
+function assertShareGrantPath(path, shareId, access) {
+  const inShare = isExactKeyUnder(path, `${SHARE_KV_ROOT}shares/${shareId}/`) && !path.slice(`${SHARE_KV_ROOT}shares/${shareId}/`.length).includes("/");
+  const inArtifact = isExactKeyUnder(path, `${SHARE_KV_ROOT}artifacts/`) && parseArtifactVersionPath(path.slice(SHARE_KV_ROOT.length)) !== void 0;
+  if (!inShare && !inArtifact) throw new ShareRootError("invalid-request", "share grant path must be xyz.tinycloud.share/shares/<shareId>/<file> or an artifact version file");
+  if (inArtifact && access !== "view") throw new ShareRootError("invalid-request", "artifact versions are immutable: only view grants may name a version file");
+}
+function wantedFor(spec) {
+  return { [`${spec.spaceId}/kv/${spec.path}`]: KV_ACTIONS[spec.access], [spec.networkId]: NETWORK_ACTIONS };
+}
+function rowOf(spec, keyDid, state, grantCid) {
+  return { shareId: spec.shareId, nw: spec.networkId.slice(spec.networkId.lastIndexOf(":") + 1), networkId: spec.networkId, keyDid, access: spec.access, path: spec.path, state, ...grantCid === void 0 ? {} : { grantCid } };
+}
+var ShareGrant = class _ShareGrant {
+  cid;
+  ownerDid;
+  spaceId;
+  keyDid;
+  nodeOrigin;
+  shareId;
+  networkId;
+  path;
+  access;
+  issuedAt;
+  expiresAt;
+  #spec;
+  #authorization;
+  #key;
+  #now;
+  #fetch;
+  constructor(input) {
+    this.#spec = input.spec;
+    this.cid = input.cid;
+    this.ownerDid = input.spec.ownerDid;
+    this.spaceId = input.spec.spaceId;
+    this.keyDid = input.key.did;
+    this.nodeOrigin = input.spec.nodeOrigin;
+    this.shareId = input.spec.shareId;
+    this.networkId = input.spec.networkId;
+    this.path = input.spec.path;
+    this.access = input.spec.access;
+    this.issuedAt = input.issuedAt;
+    this.expiresAt = input.expiresAt;
+    this.#authorization = input.authorization;
+    this.#key = input.key;
+    this.#now = input.now;
+    this.#fetch = input.fetch;
+  }
+  /**
+   * Step 0: check everything that does not need the owner, and make the key.
+   * Also looks the share's network up (no approval): a shareId whose network
+   * is retired (burned), or already exists from an earlier grant, is refused
+   * with `share-id-in-use` before the prompt (see `resumeExistingNetwork`).
+   * Throws `share-id-not-network-safe`, `invalid-request`, `lifetime-exceeds-cap`,
+   * `share-id-in-use`, `node-refused` or `invalid-key` with no approval spent.
+   */
+  static async prepare(input) {
+    const clock = input.now ?? Date.now;
+    const now = clock();
+    const owner = parseOwnerDid(input.owner.ownerDid);
+    const networkId = perShareNetworkIdFor(input.owner.ownerDid, input.shareId);
+    assertSpace(input.spaceId, owner, "share");
+    const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
+    if (input.access !== "view" && input.access !== "edit") throw new ShareRootError("invalid-request", "share grant access must be view or edit");
+    assertShareGrantPath(input.path, input.shareId, input.access);
+    const expiry = input.expiresAt instanceof Date ? input.expiresAt.getTime() : Number.NaN;
+    if (!Number.isFinite(expiry) || expiry <= now) throw new ShareRootError("invalid-request", "share grant expiry must be in the future");
+    if (expiry - now > SHARE_ROOT_LINK_MAX_LIFETIME_MS) throw new ShareRootError("lifetime-exceeds-cap", "share grant lifetime exceeds 30 days");
+    const existing = await lookupShareNetwork(nodeOrigin, networkId, input.fetch ?? defaultFetch);
+    if (existing.state !== "absent") {
+      if (existing.state !== "active") throw new ShareRootError("share-id-in-use", `this shareId's network is ${existing.state}; a retired shareId is never reused`);
+      if (input.resumeExistingNetwork !== true) throw new ShareRootError("share-id-in-use", "this shareId already has an active network from an earlier grant");
+      assertActiveShareNetwork(existing, networkId);
+    }
+    const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
+    try {
+      await assertUsableKey(key);
+    } catch (error) {
+      key.clear();
+      throw error;
+    }
+    const spec = { owner, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, nodeOrigin, shareId: input.shareId, networkId, path: input.path, access: input.access };
+    let settled = false;
+    return {
+      shareId: spec.shareId,
+      networkId,
+      keyDid: key.did,
+      row: rowOf(spec, key.did, "pending"),
+      approve: async () => {
+        if (settled) throw new ShareRootError("invalid-request", "this pending grant was already approved or discarded");
+        settled = true;
+        return _ShareGrant.#approve(spec, key, input.owner, input.expiresAt, clock, input.fetch ?? defaultFetch);
+      },
+      discard: () => {
+        settled = true;
+        key.clear();
+      }
+    };
+  }
+  /** `prepare` then `approve`, for callers that keep no `pending` row (tests, one-shot tools). */
+  static async create(input) {
+    return (await _ShareGrant.prepare(input)).approve();
+  }
+  static async #approve(spec, key, owner, expiresAt, clock, fetchFn) {
+    const permissions = [
+      { service: "tinycloud.kv", path: spec.path, actions: [...KV_ACTIONS[spec.access]] },
+      { service: "tinycloud.encryption", path: spec.networkId, actions: [...NETWORK_ACTIONS] }
+    ];
+    let receipt;
+    try {
+      receipt = await owner.createOwnerDelegation({ delegateDid: key.did, spaceId: spec.spaceId, expiresAt, permissions });
+    } catch (error) {
+      key.clear();
+      throw error;
+    }
+    try {
+      const authorization = new Uint8Array(receipt.signedDagCbor);
+      const signedCid = ownerRootCacaoCid(authorization);
+      if (signedCid !== receipt.delegationCid) throw new ShareRootError("malformed-root", "signed grant bytes do not match the imported delegation CID", { rootCid: receipt.delegationCid, signedCid, mustRevoke: true });
+      let decoded;
+      try {
+        decoded = decodeOwnerRootCacao(authorization);
+      } catch (error) {
+        throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
+      }
+      const times = validateSignedOwnerDelegation(decoded, { label: "per-share grant", owner: spec.owner, keyDid: key.did, wanted: wantedFor(spec), maxLifetimeMs: SHARE_ROOT_LINK_MAX_LIFETIME_MS, requestedExpiresAt: expiresAt, now: clock() });
+      return new _ShareGrant({ spec, cid: decoded.cid, ...times, authorization, key, now: clock, fetch: fetchFn });
+    } catch (error) {
+      key.clear();
+      if (error instanceof ShareRootError) throw error;
+      throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
+    }
+  }
+  /** Rebuild a stored grant with its key (e.g. a CLI 0600 key file); the signed bytes are checked again. Only record v2. */
+  static async restore(input) {
+    const { record } = input;
+    const clock = input.now ?? Date.now;
+    if (record.version !== 2) throw new ShareRootError("malformed-root", "share grant record is not supported (only per-share network grants, record v2)");
+    if (record.access !== "view" && record.access !== "edit") throw new ShareRootError("malformed-root", "share grant record access is invalid");
+    if (record.keyDid !== input.key.did) throw new ShareRootError("audience-mismatch", "share grant record belongs to another key");
+    const owner = parseOwnerDid(record.ownerDid);
+    const networkId = perShareNetworkIdFor(record.ownerDid, record.shareId);
+    if (!sameNetworkUrn(networkId, record.networkId)) throw new ShareRootError("malformed-root", "share grant record network does not match its shareId");
+    assertSpace(record.spaceId, owner, "share");
+    const nodeOrigin = requireNodeOrigin(record.nodeOrigin);
+    assertShareGrantPath(record.path, record.shareId, record.access);
+    await assertUsableKey(input.key);
+    const spec = { owner, ownerDid: record.ownerDid, spaceId: record.spaceId, nodeOrigin, shareId: record.shareId, networkId, path: record.path, access: record.access };
+    let authorization;
+    let decoded;
+    try {
+      authorization = fromBase64Url(record.authorization);
+      decoded = decodeOwnerRootCacao(authorization, record.cid);
+    } catch (error) {
+      throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: record.cid });
+    }
+    const times = validateSignedOwnerDelegation(decoded, { label: "per-share grant", owner, keyDid: input.key.did, wanted: wantedFor(spec), maxLifetimeMs: SHARE_ROOT_LINK_MAX_LIFETIME_MS, now: clock() });
+    return new _ShareGrant({ spec, cid: decoded.cid, ...times, authorization, key: input.key, now: clock, fetch: input.fetch ?? defaultFetch });
+  }
+  /**
+   * This grant's CACAO as base64url, UNPADDED (the record form). As a Node
+   * `Authorization` header it must be padded to a multiple of 4 characters:
+   * the Node refuses an unpadded value otherwise.
+   */
+  get authorization() {
+    return toBase64Url(this.#authorization);
+  }
+  /** The exact KV resource this grant covers. */
+  get resource() {
+    return `${this.spaceId}/kv/${this.path}`;
+  }
+  toRecord() {
+    return { version: 2, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, nodeOrigin: this.nodeOrigin, shareId: this.shareId, networkId: this.networkId, path: this.path, access: this.access, expiresAt: this.expiresAt.toISOString() };
+  }
+  /** The history/index row for `state`. */
+  row(state) {
+    return rowOf(this.#spec, this.keyDid, state, this.cid);
+  }
+  /**
+   * Step 3: make sure the share's network exists and is usable. Creates it
+   * when absent (key-signed, no approval), then decides on a fresh lookup
+   * after any answer. Returns `networkId` (the grant's lowercase spelling;
+   * the Node echoes the owner in EIP-55 case). A retired network is never
+   * re-created (the Node answers 409): `network-not-active`.
+   */
+  async ensureNetwork() {
+    const signer = this.#signer();
+    const first = await lookupShareNetwork(this.nodeOrigin, this.networkId, this.#fetch);
+    if (first.state === "absent") {
+      const nodeDid = await nodeDidOf(this.nodeOrigin, this.#fetch);
+      await sendNetworkAdmin({ nodeOrigin: this.nodeOrigin, nodeDid, networkId: this.networkId, action: NETWORK_CREATE_ABILITY, signer, proof: this.cid, fetch: this.#fetch, now: this.#now });
+      return this.assertNetworkActive();
+    }
+    assertActiveShareNetwork(first, this.networkId);
+    return this.networkId;
+  }
+  /** Throw `network-not-active` unless the share's network is `active` now (fresh lookup). */
+  async assertNetworkActive() {
+    assertActiveShareNetwork(await lookupShareNetwork(this.nodeOrigin, this.networkId, this.#fetch), this.networkId);
+    return this.networkId;
+  }
+  /**
+   * Retire the share's network with the per-share key (no approval):
+   * PERMANENT, and every holder of decrypt on it (recipients included) is
+   * refused at their next request. Idempotent: a repeat or a never-created
+   * network counts as done.
+   */
+  async retireNetwork() {
+    const signer = this.#signer();
+    const nodeDid = await nodeDidOf(this.nodeOrigin, this.#fetch);
+    return retireShareNetwork({ nodeOrigin: this.nodeOrigin, nodeDid, networkId: this.networkId, signer, proof: this.cid, fetch: this.#fetch, now: this.#now });
+  }
+  /** Step 4 check (I1): the stored object belongs to this share, on its exact key and network. */
+  assertContentSource(contentSource) {
+    if (contentSource.shareId !== this.shareId || contentSource.kvResource !== this.resource || contentSource.selector !== "exact" || !sameNetworkUrn(contentSource.encryptionNetwork, this.networkId)) throw new ShareRootError("invalid-request", "content source does not belong to this share's grant (shareId, exact key and network)");
+  }
+  /**
+   * Policy/v3 owner signing for this one share. Every call checks the key is
+   * held and the grant is live. Policy roots must be owned by the per-share
+   * key, expire no later than the grant, and name only this grant's exact
+   * KV resource (no action the grant lacks) and decrypt on this share's
+   * network (parsed equality).
+   */
+  policySigner() {
+    const actions = KV_ACTIONS[this.access];
+    return ownerPolicySigner({
+      ownerDid: this.keyDid,
+      authorityCid: this.cid,
+      notAfter: new Date(this.expiresAt),
+      gate: async () => this.#activeKey(),
+      now: this.#now,
+      inScope: (capability) => capability.kind === "encryption" ? sameNetworkUrn(capability.resource, this.networkId) && capability.action === DECRYPT_ABILITY : capability.resource === this.resource && capability.selector === "exact" && capability.actions.every((action) => actions.includes(action))
+    });
+  }
+  /**
+   * Step 5: `publishAddressedShare`'s `authority` for this share. Its
+   * `registerPolicy` first re-reads the network and refuses unless it is
+   * `active` (released Nodes accept registrations on missing or retired
+   * networks).
+   */
+  publishAuthority(registerPolicy) {
+    return {
+      ...this.policySigner(),
+      registerPolicy: async (request) => {
+        await this.assertNetworkActive();
+        return registerPolicy(request);
+      }
+    };
+  }
+  /** Drop the per-share key. It does not retire the network or revoke the grant. */
+  clear() {
+    this.#key?.clear();
+    this.#key = void 0;
+  }
+  #activeKey() {
+    if (this.#key === void 0) throw new ShareRootError("key-cleared", "share grant key has been cleared", { rootCid: this.cid });
+    if (this.#now() >= this.expiresAt.getTime()) throw new ShareRootError("expired", "share grant has expired", { rootCid: this.cid });
+    return this.#key;
+  }
+  #signer() {
+    const key = this.#activeKey();
+    return { did: key.did, sign: (bytes2) => key.sign(bytes2) };
+  }
+};
+async function revokeShareGrant(input) {
+  const fetchFn = input.fetch ?? defaultFetch;
+  const network = await input.grant.retireNetwork();
+  try {
+    const response = await fetchFn(new URL("/revoke", input.grant.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: await input.owner.signOwnerRevocation(input.grant.cid) } });
+    const status = response.status;
+    if (!await isRevokeReceiptFor(response, input.grant.cid)) throw new Error(`HTTP ${status}: no receipt confirming this grant`);
+  } catch (error) {
+    throw new ShareRootError("grant-revoke-incomplete", `the share's network is retired (decrypt cut for everyone), but the grant revoke failed: ${errorMessage(error)}`, { rootCid: input.grant.cid });
+  }
+  return { network, grant: "revoked" };
+}
+async function openEditShare(input) {
+  const clock = input.now ?? Date.now;
+  const lifetime = input.lifetimeMs ?? EDIT_SHARE_READER_MAX_LIFETIME_MS;
+  if (!Number.isFinite(lifetime) || lifetime <= 0 || lifetime > EDIT_SHARE_READER_MAX_LIFETIME_MS) throw new ShareRootError("lifetime-exceeds-cap", "an edit-share reader lives at most one hour");
+  const owner = parseOwnerDid(input.owner.ownerDid);
+  if (!sameOwner(owner, parseOwnerDid(input.record.ownerDid))) throw new ShareRootError("invalid-request", "the share belongs to another owner");
+  const networkId = perShareNetworkIdFor(input.record.ownerDid, input.record.shareId);
+  if (!sameNetworkUrn(networkId, input.record.networkId)) throw new ShareRootError("invalid-request", "share network does not match its shareId");
+  assertSpace(input.record.spaceId, owner, "share");
+  assertShareGrantPath(input.record.path, input.record.shareId, "edit");
+  const key = await createDelegatedShareKey({ extractable: false });
+  const expiresAt = new Date(clock() + lifetime);
+  let receipt;
+  try {
+    receipt = await input.owner.createOwnerDelegation({
+      delegateDid: key.did,
+      spaceId: input.record.spaceId,
+      expiresAt,
+      permissions: [
+        { service: "tinycloud.kv", path: input.record.path, actions: ["tinycloud.kv/get"] },
+        { service: "tinycloud.encryption", path: networkId, actions: [DECRYPT_ABILITY] }
+      ]
+    });
+  } catch (error) {
+    key.clear();
+    throw error;
+  }
+  try {
+    const authorization = new Uint8Array(receipt.signedDagCbor);
+    const signedCid = ownerRootCacaoCid(authorization);
+    if (signedCid !== receipt.delegationCid) throw new ShareRootError("malformed-root", "signed reader grant bytes do not match the imported delegation CID", { rootCid: receipt.delegationCid, signedCid, mustRevoke: true });
+    validateSignedOwnerDelegation(decodeOwnerRootCacao(authorization), {
+      label: "edit-share reader",
+      owner,
+      keyDid: key.did,
+      wanted: { [`${input.record.spaceId}/kv/${input.record.path}`]: ["tinycloud.kv/get"], [networkId]: [DECRYPT_ABILITY] },
+      maxLifetimeMs: EDIT_SHARE_READER_MAX_LIFETIME_MS,
+      requestedExpiresAt: expiresAt,
+      now: clock()
+    });
+  } catch (error) {
+    key.clear();
+    if (error instanceof ShareRootError) throw error;
+    throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
+  }
+  let live = key;
+  const clear = () => {
+    live?.clear();
+    live = void 0;
+  };
+  return {
+    cid: receipt.delegationCid,
+    keyDid: key.did,
+    networkId,
+    path: input.record.path,
+    expiresAt,
+    signer: {
+      did: key.did,
+      sign: async (bytes2) => {
+        if (live === void 0 || clock() >= expiresAt.getTime()) throw new ShareRootError("expired", "edit-share reader has expired or was cleared");
+        return live.sign(bytes2);
+      }
+    },
+    clear
+  };
+}
+
+// src/share-control.ts
+var import_sha3 = require("@noble/hashes/sha3");
+var SHARE_CONTROL_HEADER_BUDGET_BYTES = 3e4;
+var SHARE_CONTROL_LIFETIME_MS = 10 * 6e4;
+var DELEGATION_REVOKE_ABILITY = "tinycloud.delegation/revoke";
+var RECAP_STATEMENT = "I further authorize the stated URI to perform the following actions on my behalf:";
+var PLACEHOLDER_KEY_DID = `did:key:z6Mk${"1".repeat(44)}`;
+function checksumAddress(address) {
+  const lower = address.toLowerCase().slice(2);
+  const hash = (0, import_sha3.keccak_256)(new TextEncoder().encode(lower));
+  let out = "0x";
+  for (let index = 0; index < lower.length; index++) {
+    const nibble = hash[index >> 1] >> (index % 2 === 0 ? 4 : 0) & 15;
+    out += nibble >= 8 ? lower[index].toUpperCase() : lower[index];
+  }
+  return out;
+}
+function reCapStatement(attenuation) {
+  let index = 0;
+  let lines = "";
+  for (const resource of Object.keys(attenuation).sort()) {
+    const namespaces = {};
+    for (const ability of Object.keys(attenuation[resource]).sort()) {
+      const slash = ability.indexOf("/");
+      (namespaces[ability.slice(0, slash)] ??= []).push(ability.slice(slash + 1));
+    }
+    for (const namespace of Object.keys(namespaces).sort()) {
+      lines += ` (${++index}) '${namespace}': ${namespaces[namespace].map((name) => `'${name}'`).join(", ")} for '${resource}'.`;
+    }
+  }
+  return `${RECAP_STATEMENT}${lines}`;
+}
+function encodeDagCbor(value) {
+  const output = [];
+  const head = (major, argument) => {
+    if (argument < 24) output.push(major << 5 | argument);
+    else if (argument < 256) output.push(major << 5 | 24, argument);
+    else if (argument < 65536) output.push(major << 5 | 25, argument >> 8, argument & 255);
+    else output.push(major << 5 | 26, argument >>> 24 & 255, argument >>> 16 & 255, argument >>> 8 & 255, argument & 255);
+  };
+  const write = (item) => {
+    if (typeof item === "number" && Number.isSafeInteger(item) && item >= 0 && item < 4294967296) head(0, item);
+    else if (typeof item === "string") {
+      const encoded = new TextEncoder().encode(item);
+      head(3, encoded.length);
+      output.push(...encoded);
+    } else if (item instanceof Uint8Array) {
+      head(2, item.length);
+      output.push(...item);
+    } else if (Array.isArray(item)) {
+      head(4, item.length);
+      item.forEach(write);
+    } else if (typeof item === "object" && item !== null) {
+      const entries = Object.entries(item).map(([key, entry]) => [new TextEncoder().encode(key), entry]);
+      entries.sort(([left], [right]) => left.length - right.length || compareBytes(left, right));
+      head(5, entries.length);
+      for (const [key, entry] of entries) {
+        head(3, key.length);
+        output.push(...key);
+        write(entry);
+      }
+    } else throw new Error("value is not encodable as a CACAO field");
+  };
+  write(value);
+  return Uint8Array.from(output);
+}
+function compareBytes(left, right) {
+  for (let index = 0; index < left.length; index++) if (left[index] !== right[index]) return left[index] - right[index];
+  return 0;
+}
+function unsignedControl(input) {
+  const address = checksumAddress(input.owner.address);
+  const statement = reCapStatement(input.attenuation);
+  const recap = `urn:recap:${toBase64Url(new TextEncoder().encode(JSON.stringify({ att: input.attenuation, prf: [] })))}`;
+  const message = [
+    `${input.domain} wants you to sign in with your Ethereum account:`,
+    address,
+    "",
+    statement,
+    "",
+    `URI: ${input.keyDid}`,
+    "Version: 1",
+    `Chain ID: ${input.owner.chainId}`,
+    `Nonce: ${input.nonce}`,
+    `Issued At: ${input.issuedAt}`,
+    `Expiration Time: ${input.expiresAt}`,
+    "Resources:",
+    `- ${recap}`
+  ].join("\n");
+  const payload = { aud: input.keyDid, domain: input.domain, exp: input.expiresAt, iat: input.issuedAt, iss: `did:pkh:eip155:${input.owner.chainId}:${address}`, nonce: input.nonce, resources: [recap], statement, version: 1 };
+  return { message, payload };
+}
+function signedControlBytes(payload, signature) {
+  return encodeDagCbor({ h: { t: "eip4361" }, p: payload, s: { t: "eip191", s: signature } });
+}
+function attenuationFor(targets, spaceDelegationResources) {
+  const attenuation = {};
+  for (const resource of spaceDelegationResources) attenuation[resource] = { [DELEGATION_REVOKE_ABILITY]: [{}] };
+  for (const target of targets) attenuation[target.networkId] = { [DELEGATION_REVOKE_ABILITY]: [{}], [NETWORK_REVOKE_ABILITY]: [{}] };
+  return attenuation;
+}
+var ISO_PLACEHOLDER = (/* @__PURE__ */ new Date(0)).toISOString();
+var NONCE_PLACEHOLDER = "0".repeat(32);
+function headerValue(bytes2) {
+  const text2 = toBase64Url(bytes2);
+  return text2 + "=".repeat((4 - text2.length % 4) % 4);
+}
+function headerLength(byteLength) {
+  return 4 * Math.ceil(byteLength / 3);
+}
+function headerBytesOf(owner, domain, targets, spaceDelegationResources) {
+  const { payload } = unsignedControl({ owner, domain, keyDid: PLACEHOLDER_KEY_DID, attenuation: attenuationFor(targets, spaceDelegationResources), issuedAt: ISO_PLACEHOLDER, expiresAt: ISO_PLACEHOLDER, nonce: NONCE_PLACEHOLDER });
+  return headerLength(signedControlBytes(payload, new Uint8Array(65)).length);
+}
+var CONTROL_DOMAIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*(?::\d{1,5})?$/;
+var CONTROL_SPACE_ROW = /^tinycloud:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):([A-Za-z0-9_-]+)\/delegation$/;
+var GRANT_CID = /^b[a-z2-7]{20,}$/;
+function assertControlInputs(ownerDid, owner, domain, targets, spaceDelegationResources) {
+  if (typeof domain !== "string" || !CONTROL_DOMAIN.test(domain)) throw new ShareRootError("invalid-request", "control domain must be a host name, optionally with a port");
+  const seenRows = /* @__PURE__ */ new Set();
+  for (const row of spaceDelegationResources) {
+    const match = typeof row === "string" ? CONTROL_SPACE_ROW.exec(row) : null;
+    if (match === null || !sameOwner({ chainId: match[1], address: match[2].toLowerCase() }, owner)) throw new ShareRootError("control-target-invalid", "control space rows must be <owner space>/delegation");
+    if (seenRows.has(row)) throw new ShareRootError("control-target-invalid", "control space rows must not repeat");
+    seenRows.add(row);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    if (!isPerShareNetworkOf(ownerDid, target.networkId)) throw new ShareRootError("control-target-invalid", "control targets must be this owner's per-share networks (share-<shareId>)");
+    if (target.grantCid !== void 0 && (typeof target.grantCid !== "string" || !GRANT_CID.test(target.grantCid))) throw new ShareRootError("control-target-invalid", "control target grant CID is invalid");
+    if (seen.has(target.networkId)) throw new ShareRootError("control-target-invalid", "control targets must not repeat a network");
+    seen.add(target.networkId);
+  }
+}
+function planShareControlBatches(input) {
+  const owner = parseOwnerDid(input.owner.ownerDid);
+  const budget = input.budgetBytes ?? SHARE_CONTROL_HEADER_BUDGET_BYTES;
+  if (!Number.isSafeInteger(budget) || budget <= 0 || budget > SHARE_CONTROL_HEADER_BUDGET_BYTES) throw new ShareRootError("invalid-request", `control budget must be 1..${SHARE_CONTROL_HEADER_BUDGET_BYTES} bytes`);
+  const rows = (input.spaceIds ?? []).map((spaceId) => `${spaceId}/delegation`);
+  assertControlInputs(input.owner.ownerDid, owner, input.owner.domain, input.targets, rows);
+  const batches = [];
+  let current = [];
+  let size = 0;
+  for (const target of input.targets) {
+    const next = headerBytesOf(owner, input.owner.domain, [...current, target], rows);
+    if (next <= budget) {
+      current.push(target);
+      size = next;
+      continue;
+    }
+    if (current.length === 0) throw new ShareRootError("invalid-request", "one target and the space rows exceed the control budget");
+    batches.push({ targets: current, spaceDelegationResources: rows, headerBytes: size });
+    current = [target];
+    size = headerBytesOf(owner, input.owner.domain, current, rows);
+    if (size > budget) throw new ShareRootError("invalid-request", "one target and the space rows exceed the control budget");
+  }
+  if (current.length > 0) {
+    batches.push({ targets: current, spaceDelegationResources: rows, headerBytes: size });
+  } else if (rows.length > 0) {
+    size = headerBytesOf(owner, input.owner.domain, [], rows);
+    if (size > budget) throw new ShareRootError("invalid-request", "the space rows alone exceed the control budget");
+    batches.push({ targets: [], spaceDelegationResources: rows, headerBytes: size });
+  }
+  return batches;
+}
+function signatureBytes(hex) {
+  if (typeof hex !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(hex)) throw new ShareRootError("invalid-request", "owner signature must be 65 bytes of 0x hex");
+  const bytes2 = new Uint8Array(65);
+  for (let index = 0; index < 65; index++) bytes2[index] = Number.parseInt(hex.slice(2 + index * 2, 4 + index * 2), 16);
+  return bytes2;
+}
+async function runShareControlBatch(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const clock = input.now ?? Date.now;
+  const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
+  const owner = parseOwnerDid(input.owner.ownerDid);
+  const { batch } = input;
+  assertControlInputs(input.owner.ownerDid, owner, input.owner.domain, batch.targets, batch.spaceDelegationResources);
+  if (batch.targets.length === 0 && batch.spaceDelegationResources.length === 0) throw new ShareRootError("invalid-request", "control batch is empty");
+  const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
+  try {
+    const now = clock();
+    const issuedAt = new Date(now).toISOString();
+    const expiresAt = new Date(now + SHARE_CONTROL_LIFETIME_MS).toISOString();
+    const nonce = [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+    const control = unsignedControl({ owner, domain: input.owner.domain, keyDid: key.did, attenuation: attenuationFor(batch.targets, batch.spaceDelegationResources), issuedAt, expiresAt, nonce });
+    const sized = headerLength(signedControlBytes(control.payload, new Uint8Array(65)).length);
+    if (sized > SHARE_CONTROL_HEADER_BUDGET_BYTES) throw new ShareRootError("invalid-request", `control is ${sized} bytes, above the ${SHARE_CONTROL_HEADER_BUDGET_BYTES}-byte budget`);
+    const bytes2 = signedControlBytes(control.payload, signatureBytes(await input.owner.signMessage(control.message)));
+    const controlCid = ownerRootCacaoCid(bytes2);
+    const imported = await fetchFn(new URL("/delegate", nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: headerValue(bytes2) } });
+    if (!imported.ok) throw new ShareRootError("node-refused", `owner control import failed: HTTP ${imported.status} ${(await imported.text()).slice(0, 120)}`);
+    await imported.body?.cancel();
+    const nodeDid = await nodeDidOf(nodeOrigin, fetchFn);
+    const signer = { did: key.did, sign: (data) => key.sign(data) };
+    const networks = [];
+    for (const target of batch.targets) {
+      try {
+        networks.push({ networkId: target.networkId, result: await retireShareNetwork({ nodeOrigin, nodeDid, networkId: target.networkId, signer, proof: controlCid, fetch: fetchFn, now: clock }) });
+      } catch (error) {
+        networks.push({ networkId: target.networkId, result: "failed", error: errorMessage(error) });
+      }
+    }
+    const grants = [];
+    for (const target of batch.targets) {
+      if (target.grantCid === void 0) continue;
+      const at = seconds(clock());
+      const invocation = await signCompactUcanAuthorization({
+        issuerDid: key.did,
+        audienceDid: key.did,
+        attenuation: { [`urn:cid:${target.grantCid}`]: { [DELEGATION_REVOKE_ABILITY]: [{}] } },
+        facts: [{}],
+        proofs: [controlCid],
+        notBefore: at,
+        expiresAt: at + 60,
+        nonce: `urn:uuid:${crypto.randomUUID()}`,
+        sign: signer.sign
+      });
+      const response = await fetchFn(new URL("/revoke", nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: invocation.authorization } });
+      const status = response.status;
+      if (await isRevokeReceiptFor(response, target.grantCid)) {
+        grants.push({ grantCid: target.grantCid, result: "revoked", status });
+        continue;
+      }
+      if (input.revokeFallback === void 0) {
+        grants.push({ grantCid: target.grantCid, result: "refused", status });
+        continue;
+      }
+      const fallback = await fetchFn(new URL("/revoke", nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: await input.revokeFallback.signOwnerRevocation(target.grantCid) } });
+      const fallbackStatus = fallback.status;
+      grants.push({ grantCid: target.grantCid, result: await isRevokeReceiptFor(fallback, target.grantCid) ? "revoked-by-owner" : "refused", status: fallbackStatus });
+    }
+    return { controlCid, networks, grants };
+  } finally {
+    key.clear();
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
-  POLICY_OWNER_AUTHORITY_FEATURES,
-  POLICY_OWNER_AUTHORITY_PROBE_TTL_MS,
+  EDIT_SHARE_READER_MAX_LIFETIME_MS,
+  SHARE_CONTROL_HEADER_BUDGET_BYTES,
+  SHARE_CONTROL_LIFETIME_MS,
+  SHARE_NETWORK_NAME_PREFIX,
   SHARE_ROOT_CLOCK_SKEW_MS,
   SHARE_ROOT_LINK_MAX_LIFETIME_MS,
   SHARE_ROOT_MAX_LIFETIME_MS,
   SHARE_ROOT_PREFIX,
   SHARE_ROOT_REQUEST_MARGIN_MS,
+  ShareGrant,
   ShareRoot,
   ShareRootError,
+  assertNetworkSafeShareId,
   assertNonExtractableShareKey,
-  createPolicyOwnerModeProbe,
+  assertShareGrantPath,
   decodeOwnerRootCacao,
-  defaultPolicyOwnerModeProbe,
   ensureShareRoot,
+  openEditShare,
   ownerRootCacaoCid,
-  readPolicyOwnerAuthorityMode,
+  perShareNetworkIdFor,
+  planShareControlBatches,
+  revokeShareGrant,
+  runShareControlBatch,
   signShareKeyDelegation
 });
 //# sourceMappingURL=share-root.cjs.map