@tinycloud/share-sdk 1.2.0-beta.2 → 1.2.0-beta.4

package/dist/share-root.cjs

@@ -21,8 +21,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var share_root_entry_exports = {};
 __export(share_root_entry_exports, {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS: () => AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
-  POLICY_OWNER_AUTHORITY_FEATURES: () => POLICY_OWNER_AUTHORITY_FEATURES,
-  POLICY_OWNER_AUTHORITY_PROBE_TTL_MS: () => POLICY_OWNER_AUTHORITY_PROBE_TTL_MS,
+  EDIT_SHARE_READER_MAX_LIFETIME_MS: () => EDIT_SHARE_READER_MAX_LIFETIME_MS,
+  SHARE_CONTROL_HEADER_BUDGET_BYTES: () => SHARE_CONTROL_HEADER_BUDGET_BYTES,
+  SHARE_CONTROL_LIFETIME_MS: () => SHARE_CONTROL_LIFETIME_MS,
+  SHARE_NETWORK_NAME_PREFIX: () => SHARE_NETWORK_NAME_PREFIX,
   SHARE_ROOT_CLOCK_SKEW_MS: () => SHARE_ROOT_CLOCK_SKEW_MS,
   SHARE_ROOT_LINK_MAX_LIFETIME_MS: () => SHARE_ROOT_LINK_MAX_LIFETIME_MS,
   SHARE_ROOT_MAX_LIFETIME_MS: () => SHARE_ROOT_MAX_LIFETIME_MS,
@@ -31,15 +33,17 @@ __export(share_root_entry_exports, {
   ShareGrant: () => ShareGrant,
   ShareRoot: () => ShareRoot,
   ShareRootError: () => ShareRootError,
+  assertNetworkSafeShareId: () => assertNetworkSafeShareId,
   assertNonExtractableShareKey: () => assertNonExtractableShareKey,
-  createPolicyOwnerModeProbe: () => createPolicyOwnerModeProbe,
+  assertShareGrantPath: () => assertShareGrantPath,
   decodeOwnerRootCacao: () => decodeOwnerRootCacao,
-  defaultPolicyOwnerModeProbe: () => defaultPolicyOwnerModeProbe,
-  ensureShareNetwork: () => ensureShareNetwork,
   ensureShareRoot: () => ensureShareRoot,
+  openEditShare: () => openEditShare,
   ownerRootCacaoCid: () => ownerRootCacaoCid,
-  readPolicyOwnerAuthorityMode: () => readPolicyOwnerAuthorityMode,
-  shareNetworkIdFor: () => shareNetworkIdFor,
+  perShareNetworkIdFor: () => perShareNetworkIdFor,
+  planShareControlBatches: () => planShareControlBatches,
+  revokeShareGrant: () => revokeShareGrant,
+  runShareControlBatch: () => runShareControlBatch,
   signShareKeyDelegation: () => signShareKeyDelegation
 });
 module.exports = __toCommonJS(share_root_entry_exports);
@@ -6617,27 +6621,20 @@ var AGENT_SHARE_ROOT_MAX_LIFETIME_MS = 30 * DAY_MS;
 var SHARE_ROOT_LINK_MAX_LIFETIME_MS = 30 * DAY_MS;
 var SHARE_ROOT_CLOCK_SKEW_MS = 5 * 6e4;
 var SHARE_ROOT_REQUEST_MARGIN_MS = 10 * 6e4;
-var POLICY_OWNER_AUTHORITY_FEATURES = {
-  marker: "policy-owner-authority-v1",
-  record: "policy-owner-authority-record",
-  enforce: "policy-owner-authority-enforce"
-};
-var POLICY_OWNER_AUTHORITY_PROBE_TTL_MS = 5 * 6e4;
-var MAX_INFO_BYTES = 64 * 1024;
+var MAX_NODE_ANSWER_BYTES = 64 * 1024;
 var MAX_POLICY_ROOT_MS = 31 * DAY_MS;
 var PROFILES = {
   share: { spaceName: "applications", maxLifetimeMs: SHARE_ROOT_MAX_LIFETIME_MS },
   agent: { spaceName: "default", maxLifetimeMs: AGENT_SHARE_ROOT_MAX_LIFETIME_MS }
 };
 var KV_ABILITIES = ["tinycloud.kv/get", "tinycloud.kv/metadata"];
-var DECRYPT_ABILITY = "tinycloud.encryption/decrypt";
 var ShareRootError = class extends Error {
   code;
   rootCid;
   signedCid;
   mustRevoke;
   constructor(code3, message, details = {}) {
-    super(details.mustRevoke === true && details.rootCid !== void 0 ? `${message}; the Node imported root ${details.rootCid}, which may grant more than requested: the owner must revoke it` : message);
+    super(details.mustRevoke === true && details.rootCid !== void 0 ? `${message}; the Node imported ${details.rootCid}, which may grant more than requested: the owner must revoke it` : message);
     this.name = "ShareRootError";
     this.code = code3;
     this.mustRevoke = details.mustRevoke === true;
@@ -6647,7 +6644,7 @@ var ShareRootError = class extends Error {
 };
 function parseOwnerDid(ownerDid) {
   const match = /^did:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40})$/.exec(ownerDid);
-  if (match === null) throw new ShareRootError("invalid-request", "share root owner must be did:pkh:eip155");
+  if (match === null) throw new ShareRootError("invalid-request", "share owner must be did:pkh:eip155");
   return { chainId: match[1], address: match[2].toLowerCase() };
 }
 function sameOwner(left, right) {
@@ -6656,16 +6653,9 @@ function sameOwner(left, right) {
 function assertSpace(spaceId, owner, kind) {
   const match = /^tinycloud:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):([A-Za-z0-9_-]+)$/.exec(spaceId);
   if (match === null || !sameOwner({ chainId: match[1], address: match[2].toLowerCase() }, owner) || match[3] !== PROFILES[kind].spaceName) {
-    throw new ShareRootError("invalid-request", `${kind} root must target the owner's ${PROFILES[kind].spaceName} space`);
+    throw new ShareRootError("invalid-request", `${kind} delegations must target the owner's ${PROFILES[kind].spaceName} space`);
   }
 }
-function shareNetworkId(owner) {
-  return `urn:tinycloud:encryption:did:pkh:eip155:${owner.chainId}:${owner.address}:share`;
-}
-function isShareNetworkOf(resource, owner) {
-  const match = /^urn:tinycloud:encryption:did:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):share$/.exec(resource);
-  return match !== null && sameOwner({ chainId: match[1], address: match[2].toLowerCase() }, owner);
-}
 function nodeOriginOf(value) {
   let url;
   try {
@@ -6686,7 +6676,7 @@ function seconds(ms) {
 }
 function parseTime(value, label, rootCid) {
   const time = value === void 0 ? Number.NaN : Date.parse(value);
-  if (!Number.isFinite(time)) throw new ShareRootError("malformed-root", `share root ${label} is missing or invalid`, { rootCid, mustRevoke: true });
+  if (!Number.isFinite(time)) throw new ShareRootError("malformed-root", `delegation ${label} is missing or invalid`, { rootCid, mustRevoke: true });
   return time;
 }
 function validateSignedOwnerDelegation(decoded, expected) {
@@ -6703,19 +6693,22 @@ function validateSignedOwnerDelegation(decoded, expected) {
   if (decoded.resources.length !== 1 || !decoded.resources[0].startsWith("urn:recap:")) throw new ShareRootError("resource-mismatch", `${label} must carry exactly one ReCap resource`, wider);
   if (decoded.reCapProofs.length !== 0) throw new ShareRootError("resource-mismatch", `${label} must not have parent capabilities`, wider);
   const { wanted } = expected;
-  for (const resource of Object.keys(decoded.attenuation)) if (wanted[resource] === void 0) throw new ShareRootError("resource-mismatch", `${label} grants a resource outside its scope`, wider);
-  for (const [resource, abilities] of Object.entries(wanted)) {
-    const granted = decoded.attenuation[resource];
-    if (granted === void 0) throw new ShareRootError("resource-mismatch", `${label} is missing one of its resources`, wider);
-    const names = Object.keys(granted);
-    if (names.length !== abilities.length || abilities.some((ability) => !names.includes(ability))) throw new ShareRootError("ability-mismatch", `${label} abilities differ from the request`, wider);
-    for (const ability of abilities) {
-      const caveats = granted[ability];
+  for (const [resource, granted] of Object.entries(decoded.attenuation)) {
+    const abilities = wanted[resource];
+    if (abilities === void 0) throw new ShareRootError("resource-mismatch", `${label} grants a resource outside its scope`, wider);
+    for (const [ability, caveats] of Object.entries(granted)) {
+      if (!abilities.includes(ability)) throw new ShareRootError("ability-mismatch", `${label} grants an ability it was not asked for`, wider);
       if (caveats.length !== 1 || typeof caveats[0] !== "object" || caveats[0] === null || Array.isArray(caveats[0]) || Object.keys(caveats[0]).length !== 0) {
         throw new ShareRootError("ability-mismatch", `${label} abilities carry unexpected caveats`, wider);
       }
     }
   }
+  const narrower = { rootCid: decoded.cid };
+  for (const [resource, abilities] of Object.entries(wanted)) {
+    const granted = decoded.attenuation[resource];
+    if (granted === void 0) throw new ShareRootError("resource-mismatch", `${label} is narrower than requested: a resource is missing`, narrower);
+    if (abilities.some((ability) => granted[ability] === void 0)) throw new ShareRootError("ability-mismatch", `${label} is narrower than requested: an ability is missing`, narrower);
+  }
   const issuedAt = parseTime(decoded.issuedAt, "issued-at time", decoded.cid);
   const expiresAt = parseTime(decoded.expiresAt, "expiration time", decoded.cid);
   if (decoded.notBefore !== void 0 && parseTime(decoded.notBefore, "not-before time", decoded.cid) > expected.now) throw new ShareRootError("malformed-root", `${label} is not valid yet`, { rootCid: decoded.cid });
@@ -6728,20 +6721,21 @@ function validateSignedOwnerDelegation(decoded, expected) {
   return { issuedAt: new Date(issuedAt), expiresAt: new Date(expiresAt) };
 }
 function validateSignedRoot(decoded, expected) {
-  const wanted = { [`${expected.spaceId}/kv/${SHARE_ROOT_PREFIX}`]: KV_ABILITIES };
-  if (expected.scope === "kv+share-decrypt") wanted[shareNetworkId(expected.owner)] = [DECRYPT_ABILITY];
   return validateSignedOwnerDelegation(decoded, {
     label: `${expected.kind} root`,
     owner: expected.owner,
     keyDid: expected.keyDid,
-    wanted,
+    wanted: { [`${expected.spaceId}/kv/${SHARE_ROOT_PREFIX}`]: KV_ABILITIES },
     maxLifetimeMs: PROFILES[expected.kind].maxLifetimeMs,
     ...expected.requestedExpiresAt === void 0 ? {} : { requestedExpiresAt: expected.requestedExpiresAt },
     now: expected.now
   });
 }
+function isExactKeyUnder(path, prefix) {
+  return typeof path === "string" && path.startsWith(prefix) && path.length > prefix.length && !path.endsWith("/") && !path.includes("//") && !path.split("/").some((segment) => segment === "." || segment === "..") && !/[\u0000-\u001f\u007f\\*?#]/.test(path);
+}
 function assertLinkPath(path) {
-  if (typeof path !== "string" || !path.startsWith(SHARE_ROOT_PREFIX) || path.length === SHARE_ROOT_PREFIX.length || path.endsWith("/") || path.includes("//") || path.split("/").some((segment) => segment === "." || segment === "..") || /[\u0000-\u001f\u007f\\*?#]/.test(path)) throw new ShareRootError("link-out-of-scope", "link path must be one exact key under the share prefix");
+  if (!isExactKeyUnder(path, SHARE_ROOT_PREFIX)) throw new ShareRootError("link-out-of-scope", "link path must be one exact key under the share prefix");
 }
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
@@ -6753,6 +6747,43 @@ async function assertUsableKey(key) {
     throw new ShareRootError("invalid-key", errorMessage(error));
   }
 }
+async function readJsonCapped(response) {
+  if (!/^application\/json\s*(;|$)/i.test(response.headers.get("content-type") ?? "")) throw new Error("node answer is not JSON");
+  const reader = response.body?.getReader();
+  if (reader === void 0) throw new Error("node answer has no body");
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > MAX_NODE_ANSWER_BYTES) {
+      await reader.cancel();
+      throw new Error("node answer is too large");
+    }
+    chunks.push(value);
+  }
+  const bytes2 = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes2.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
+}
+async function isRevokeReceiptFor(response, cid) {
+  if (!response.ok) {
+    await response.body?.cancel();
+    return false;
+  }
+  let receipt;
+  try {
+    receipt = await readJsonCapped(response);
+  } catch {
+    return false;
+  }
+  return typeof receipt === "object" && receipt !== null && "revoked" in receipt && receipt.revoked === true && "cid" in receipt && receipt.cid === cid;
+}
 function policyRootContents(input) {
   const facts = {
     role: input.role,
@@ -6811,69 +6842,8 @@ function ownerPolicySigner(input) {
     }
   };
 }
-function readPolicyOwnerAuthorityMode(features) {
-  if (!Array.isArray(features) || !features.includes(POLICY_OWNER_AUTHORITY_FEATURES.marker)) return void 0;
-  const enforce = features.includes(POLICY_OWNER_AUTHORITY_FEATURES.enforce);
-  const record = features.includes(POLICY_OWNER_AUTHORITY_FEATURES.record);
-  if (enforce === record) return void 0;
-  return enforce ? "enforce" : "record";
-}
-async function readJsonCapped(response) {
-  if (!/^application\/json\s*(;|$)/i.test(response.headers.get("content-type") ?? "")) throw new Error("node info is not JSON");
-  const reader = response.body?.getReader();
-  if (reader === void 0) throw new Error("node info has no body");
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > MAX_INFO_BYTES) {
-      await reader.cancel();
-      throw new Error("node info is too large");
-    }
-    chunks.push(value);
-  }
-  const bytes2 = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes2.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
-}
-function createPolicyOwnerModeProbe(options = {}) {
-  const fetchFn = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
-  const ttlMs = Math.min(options.ttlMs ?? POLICY_OWNER_AUTHORITY_PROBE_TTL_MS, POLICY_OWNER_AUTHORITY_PROBE_TTL_MS);
-  const now = options.now ?? Date.now;
-  const cache3 = /* @__PURE__ */ new Map();
-  return {
-    async isEnforced(nodeOrigin) {
-      const origin = nodeOriginOf(nodeOrigin);
-      if (origin === void 0) return false;
-      const cached = cache3.get(origin);
-      if (cached !== void 0 && now() - cached.checkedAt < ttlMs) return cached.enforced;
-      let enforced = false;
-      try {
-        const response = await fetchFn(new URL("/info", origin), { redirect: "error", signal: AbortSignal.timeout(5e3) });
-        const info = response.ok ? await readJsonCapped(response) : void 0;
-        enforced = typeof info === "object" && info !== null && "features" in info && readPolicyOwnerAuthorityMode(info.features) === "enforce";
-      } catch {
-        enforced = false;
-      }
-      cache3.set(origin, { enforced, checkedAt: now() });
-      return enforced;
-    },
-    observe(nodeOrigin, features) {
-      const origin = nodeOriginOf(nodeOrigin);
-      if (origin !== void 0) cache3.set(origin, { enforced: readPolicyOwnerAuthorityMode(features) === "enforce", checkedAt: now() });
-    }
-  };
-}
-var defaultPolicyOwnerModeProbe = createPolicyOwnerModeProbe();
 var ShareRoot = class _ShareRoot {
   kind;
-  scope;
   nodeOrigin;
   cid;
   ownerDid;
@@ -6886,7 +6856,6 @@ var ShareRoot = class _ShareRoot {
   #options;
   constructor(input) {
     this.kind = input.kind;
-    this.scope = input.scope;
     this.nodeOrigin = input.nodeOrigin;
     this.cid = input.cid;
     this.ownerDid = input.ownerDid;
@@ -6899,12 +6868,10 @@ var ShareRoot = class _ShareRoot {
     this.#options = input.options;
   }
   /**
-   * Ask the owner for a new root (one approval) for a fresh share key. The
-   * scope is chosen now: `kv+share-decrypt` only for a `share` root with the
-   * flag on and `nodeOrigin` advertising `enforce`, otherwise `kv`. All request
-   * checks run before anything is signed. If the signed result is rejected,
-   * the key is cleared and the error carries the imported `rootCid` (and
-   * `mustRevoke` when the root may be wider than requested).
+   * Ask the owner for a new root (one approval) for a fresh share key. All
+   * request checks run before anything is signed. If the signed result is
+   * rejected, the key is cleared and the error carries the imported `rootCid`
+   * (and `mustRevoke` when the root may be wider than requested).
    *
    * `keyFactory` defaults to a fresh non-extractable WebCrypto key that only
    * this root holds. A custom factory must not persist the key before
@@ -6920,7 +6887,6 @@ var ShareRoot = class _ShareRoot {
     const expiry = input.expiresAt instanceof Date ? input.expiresAt.getTime() : Number.NaN;
     if (!Number.isFinite(expiry) || expiry <= now) throw new ShareRootError("invalid-request", "share root expiry must be in the future");
     if (expiry - now > PROFILES[kind].maxLifetimeMs) throw new ShareRootError("lifetime-exceeds-cap", `${kind} root lifetime exceeds ${PROFILES[kind].maxLifetimeMs / DAY_MS} days`);
-    const scope = kind === "share" && options.shareRootPolicyRoots === true && await (options.policyOwnerModeProbe ?? defaultPolicyOwnerModeProbe).isEnforced(nodeOrigin) ? "kv+share-decrypt" : "kv";
     const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
     try {
       await assertUsableKey(key);
@@ -6929,7 +6895,6 @@ var ShareRoot = class _ShareRoot {
       throw error;
     }
     const permissions = [{ service: "tinycloud.kv", path: SHARE_ROOT_PREFIX, actions: [...KV_ABILITIES] }];
-    if (scope === "kv+share-decrypt") permissions.push({ service: "tinycloud.encryption", path: shareNetworkId(owner), actions: [DECRYPT_ABILITY] });
     let receipt;
     try {
       receipt = await input.owner.createOwnerDelegation({ delegateDid: key.did, spaceId: input.spaceId, expiresAt: input.expiresAt, permissions });
@@ -6947,8 +6912,8 @@ var ShareRoot = class _ShareRoot {
       } catch (error) {
         throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
       }
-      const times = validateSignedRoot(decoded, { kind, scope, owner, spaceId: input.spaceId, keyDid: key.did, requestedExpiresAt: input.expiresAt, now: (options.now ?? Date.now)() });
-      return new _ShareRoot({ kind, scope, nodeOrigin, cid: decoded.cid, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, ...times, authorization, key, options });
+      const times = validateSignedRoot(decoded, { kind, owner, spaceId: input.spaceId, keyDid: key.did, requestedExpiresAt: input.expiresAt, now: (options.now ?? Date.now)() });
+      return new _ShareRoot({ kind, nodeOrigin, cid: decoded.cid, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, ...times, authorization, key, options });
     } catch (error) {
       key.clear();
       if (error instanceof ShareRootError) throw error;
@@ -6959,9 +6924,7 @@ var ShareRoot = class _ShareRoot {
   static async restore(input) {
     const { record } = input;
     const options = { ...input.options, kind: record.kind };
-    if (record.version !== 1 || record.kind !== "share" && record.kind !== "agent" || record.scope !== "kv" && record.scope !== "kv+share-decrypt" || record.kind === "agent" && record.scope !== "kv") {
-      throw new ShareRootError("malformed-root", "share root record is not supported");
-    }
+    if (record.version !== 1 || record.kind !== "share" && record.kind !== "agent") throw new ShareRootError("malformed-root", "share root record is not supported");
     if (record.keyDid !== input.key.did) throw new ShareRootError("audience-mismatch", "share root record belongs to another key");
     const owner = parseOwnerDid(record.ownerDid);
     assertSpace(record.spaceId, owner, record.kind);
@@ -6975,19 +6938,19 @@ var ShareRoot = class _ShareRoot {
     } catch (error) {
       throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: record.cid });
     }
-    const times = validateSignedRoot(decoded, { kind: record.kind, scope: record.scope, owner, spaceId: record.spaceId, keyDid: input.key.did, now: (options.now ?? Date.now)() });
-    return new _ShareRoot({ kind: record.kind, scope: record.scope, nodeOrigin, cid: decoded.cid, ownerDid: record.ownerDid, spaceId: record.spaceId, ...times, authorization, key: input.key, options });
+    const times = validateSignedRoot(decoded, { kind: record.kind, owner, spaceId: record.spaceId, keyDid: input.key.did, now: (options.now ?? Date.now)() });
+    return new _ShareRoot({ kind: record.kind, nodeOrigin, cid: decoded.cid, ownerDid: record.ownerDid, spaceId: record.spaceId, ...times, authorization, key: input.key, options });
   }
-  /** The `Authorization` value the Node knows this root by (base64url CACAO). */
+  /**
+   * This root's CACAO as base64url, UNPADDED (the record form). As a Node
+   * `Authorization` header it must be padded to a multiple of 4 characters:
+   * the Node refuses an unpadded value otherwise.
+   */
   get authorization() {
     return toBase64Url(this.#authorization);
   }
-  /** True when the root holds `:share` decrypt and may act as a policy owner (still gated per call). */
-  get policyCapable() {
-    return this.scope === "kv+share-decrypt";
-  }
   toRecord() {
-    return { version: 1, kind: this.kind, scope: this.scope, nodeOrigin: this.nodeOrigin, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, expiresAt: this.expiresAt.toISOString() };
+    return { version: 1, kind: this.kind, nodeOrigin: this.nodeOrigin, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, expiresAt: this.expiresAt.toISOString() };
   }
   /** True while the root is live, its key is held, and it lasts at least until `expiresAt`. Revocation is not visible here. */
   covers(expiresAt, now = this.#now()) {
@@ -7024,25 +6987,6 @@ var ShareRoot = class _ShareRoot {
     });
     return { rootCid: this.cid, linkDid: input.linkDid, path: input.path, expiresAt: new Date(seconds(expiry) * 1e3), delegation };
   }
-  /**
-   * The only ShareRoot API that signs Policy/v3 (email/domain) owner material.
-   * Needs a `kv+share-decrypt` root, the `shareRootPolicyRoots` flag, a live
-   * root and key, and the root's Node advertising `enforce`; the returned
-   * signer re-checks all of it on every call. Until then addressed shares use
-   * per-share owner grants. Agent roots are bearer-only.
-   */
-  async policyRootSigner() {
-    await this.#assertPolicyGate();
-    const owner = parseOwnerDid(this.ownerDid);
-    return ownerPolicySigner({
-      ownerDid: this.keyDid,
-      authorityCid: this.cid,
-      notAfter: new Date(this.expiresAt),
-      gate: () => this.#assertPolicyGate(),
-      now: () => this.#now(),
-      inScope: (capability) => capability.kind === "encryption" ? isShareNetworkOf(capability.resource, owner) && capability.action === DECRYPT_ABILITY : capability.resource.startsWith(`${this.spaceId}/kv/${SHARE_ROOT_PREFIX}`) && capability.actions.every((action) => KV_ABILITIES.includes(action))
-    });
-  }
   /** Drop this root's key handle. It does not revoke the root: only the owner does that. */
   clear() {
     this.#key?.clear();
@@ -7052,17 +6996,6 @@ var ShareRoot = class _ShareRoot {
     if (this.#key === void 0) throw new ShareRootError("key-cleared", "share root key has been cleared", { rootCid: this.cid });
     return this.#key;
   }
-  async #assertPolicyGate() {
-    const key = this.#activeKey();
-    if (this.#options.shareRootPolicyRoots !== true) throw new ShareRootError("policy-roots-disabled", "share root policy roots are disabled (shareRootPolicyRoots is off)", { rootCid: this.cid });
-    if (this.kind !== "share") throw new ShareRootError("policy-roots-disabled", "agent roots are bearer-only", { rootCid: this.cid });
-    if (!this.policyCapable) throw new ShareRootError("root-not-policy-capable", "this share root holds no :share decrypt; re-root once the Node enforces", { rootCid: this.cid });
-    if (this.#now() >= this.expiresAt.getTime()) throw new ShareRootError("expired", "share root has expired", { rootCid: this.cid });
-    if (!await (this.#options.policyOwnerModeProbe ?? defaultPolicyOwnerModeProbe).isEnforced(this.nodeOrigin)) {
-      throw new ShareRootError("policy-roots-not-enforced-by-node", "the Node does not advertise owner-authority mode enforce", { rootCid: this.cid });
-    }
-    return key;
-  }
   #now() {
     return (this.#options.now ?? Date.now)();
   }
@@ -7070,17 +7003,14 @@ var ShareRoot = class _ShareRoot {
 async function ensureShareRoot(input) {
   const options = input.options ?? {};
   const kind = options.kind ?? "share";
-  const purpose = input.purpose ?? "bearer";
   const now = (options.now ?? Date.now)();
   const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
   const lifetime = PROFILES[kind].maxLifetimeMs - SHARE_ROOT_REQUEST_MARGIN_MS;
   if (input.expiresAt.getTime() - now > Math.min(lifetime, SHARE_ROOT_LINK_MAX_LIFETIME_MS)) throw new ShareRootError("lifetime-exceeds-cap", "no share root can cover this expiry");
-  if (purpose === "policy") {
-    if (options.shareRootPolicyRoots !== true || kind !== "share") throw new ShareRootError("policy-roots-disabled", "share root policy roots are disabled");
-    if (!await (options.policyOwnerModeProbe ?? defaultPolicyOwnerModeProbe).isEnforced(nodeOrigin)) throw new ShareRootError("policy-roots-not-enforced-by-node", "the Node does not advertise owner-authority mode enforce");
-  }
   const { current } = input;
-  if (current !== void 0 && current.kind === kind && current.spaceId === input.spaceId && current.nodeOrigin === nodeOrigin && current.covers(input.expiresAt, now) && (purpose === "bearer" || current.policyCapable)) return { root: current, rerooted: false };
+  if (current !== void 0 && current.kind === kind && current.spaceId === input.spaceId && current.nodeOrigin === nodeOrigin && current.covers(input.expiresAt, now)) {
+    return { root: current, rerooted: false };
+  }
   const factory = input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false }));
   const root = await ShareRoot.create({
     owner: input.owner,
@@ -7094,19 +7024,150 @@ async function ensureShareRoot(input) {
     },
     options
   });
-  if (purpose === "policy" && !root.policyCapable) {
-    throw new ShareRootError("policy-roots-not-enforced-by-node", "the Node stopped advertising enforce while re-rooting; the new root is kv-only", { rootCid: root.cid });
-  }
   return { root, rerooted: true };
 }
 
+// src/artifact.ts
+var import_sha2563 = require("@noble/hashes/sha256");
+function parseArtifactVersionPath(path) {
+  const match = /^artifacts\/([a-z0-9][a-z0-9_-]{2,62})\/versions\/([1-9][0-9]{0,14})\/([^/]+)$/.exec(path);
+  if (match === null) return void 0;
+  return { artifactId: match[1], version: Number(match[2]), file: match[3] };
+}
+
+// src/share-network.ts
+var import_sha2564 = require("@noble/hashes/sha256");
+var SHARE_NETWORK_NAME_PREFIX = "share-";
+var NETWORK_SAFE_SHARE_ID = /^[a-z0-9][a-z0-9-]{15,35}$/;
+var NETWORK_URN = /^urn:tinycloud:encryption:did:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):([a-z0-9][a-z0-9-]*)$/;
+var NETWORK_CREATE_ABILITY = "tinycloud.encryption/network.create";
+var NETWORK_REVOKE_ABILITY = "tinycloud.encryption/network.revoke";
+var DECRYPT_ABILITY = "tinycloud.encryption/decrypt";
+var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
+var NETWORK_ALG = "x25519-aes256gcm/v1";
+function assertNetworkSafeShareId(shareId) {
+  if (typeof shareId !== "string" || !NETWORK_SAFE_SHARE_ID.test(shareId)) {
+    throw new ShareRootError("share-id-not-network-safe", "shareId must match ^[a-z0-9][a-z0-9-]{15,35}$ to name its encryption network");
+  }
+}
+function perShareNetworkIdFor(ownerDid, shareId) {
+  const owner = parseOwnerDid(ownerDid);
+  assertNetworkSafeShareId(shareId);
+  return `urn:tinycloud:encryption:did:pkh:eip155:${owner.chainId}:${owner.address}:${SHARE_NETWORK_NAME_PREFIX}${shareId}`;
+}
+function isPerShareNetworkOf(ownerDid, networkId) {
+  const parsed = typeof networkId === "string" ? parseOwnerNetworkUrn(networkId) : void 0;
+  if (parsed === void 0) return false;
+  const shareId = parsed.name.slice(SHARE_NETWORK_NAME_PREFIX.length);
+  if (!NETWORK_SAFE_SHARE_ID.test(shareId)) return false;
+  return networkId === perShareNetworkIdFor(ownerDid, shareId);
+}
+function parseOwnerNetworkUrn(urn) {
+  const match = typeof urn === "string" ? NETWORK_URN.exec(urn) : null;
+  return match === null ? void 0 : { owner: { chainId: match[1], address: match[2].toLowerCase() }, name: match[3] };
+}
+function sameNetworkUrn(left, right) {
+  const a = parseOwnerNetworkUrn(left);
+  const b = parseOwnerNetworkUrn(right);
+  return a !== void 0 && b !== void 0 && sameOwner(a.owner, b.owner) && a.name === b.name;
+}
+async function nodeDidOf(nodeOrigin, fetchFn) {
+  let info;
+  try {
+    info = await readJsonCapped(await fetchFn(new URL("/info", nodeOrigin), { redirect: "error" }));
+  } catch (error) {
+    throw new ShareRootError("node-refused", `node identity is unavailable: ${errorMessage(error)}`);
+  }
+  const nodeDid = typeof info === "object" && info !== null && "nodeId" in info ? info.nodeId : void 0;
+  if (typeof nodeDid !== "string" || !nodeDid.startsWith("did:key:")) throw new ShareRootError("node-refused", "node identity is unavailable");
+  return nodeDid;
+}
+async function lookupShareNetwork(nodeOrigin, networkId, fetchFn) {
+  const response = await fetchFn(new URL(`/encryption/networks/${encodeURIComponent(networkId)}`, nodeOrigin), { redirect: "error" });
+  if (response.status === 404) return { state: "absent" };
+  if (!response.ok) throw new ShareRootError("node-refused", `share network lookup failed: HTTP ${response.status}`);
+  let body;
+  try {
+    body = await readJsonCapped(response);
+  } catch (error) {
+    throw new ShareRootError("node-refused", `share network descriptor is unreadable: ${errorMessage(error)}`);
+  }
+  const descriptor = typeof body === "object" && body !== null && "descriptor" in body ? body.descriptor : body;
+  if (typeof descriptor !== "object" || descriptor === null || Array.isArray(descriptor) || !("state" in descriptor) || typeof descriptor.state !== "string" || !("networkId" in descriptor) || typeof descriptor.networkId !== "string") {
+    throw new ShareRootError("node-refused", "share network descriptor is malformed");
+  }
+  return { state: descriptor.state, networkId: descriptor.networkId, descriptor };
+}
+function assertActiveShareNetwork(lookup, expectedNetworkId) {
+  if (lookup.state !== "active" || !("descriptor" in lookup)) throw new ShareRootError("network-not-active", `share network is ${lookup.state}`);
+  const { descriptor } = lookup;
+  const expected = parseOwnerNetworkUrn(expectedNetworkId);
+  if (expected === void 0) throw new ShareRootError("invalid-request", "network id must be a did:pkh-owned network URN");
+  const threshold = descriptor.threshold;
+  const ownerDid = descriptor.ownerDid;
+  let ownerMatches = false;
+  try {
+    ownerMatches = typeof ownerDid === "string" && sameOwner(parseOwnerDid(ownerDid), expected.owner);
+  } catch {
+    ownerMatches = false;
+  }
+  if (!sameNetworkUrn(lookup.networkId, expectedNetworkId) || !ownerMatches || descriptor.name !== expected.name || descriptor.alg !== NETWORK_ALG || descriptor.keyVersion !== 1 || typeof threshold !== "object" || threshold === null || !("n" in threshold) || !("t" in threshold) || threshold.n !== 1 || threshold.t !== 1) throw new ShareRootError("network-not-active", "share network descriptor does not match the share");
+}
+async function sendNetworkAdmin(input) {
+  const parsed = parseOwnerNetworkUrn(input.networkId);
+  if (parsed === void 0) throw new ShareRootError("invalid-request", "network id must be a did:pkh-owned network URN");
+  const body = input.action === NETWORK_CREATE_ABILITY ? canonicalize({ name: parsed.name, ownerDid: `did:pkh:eip155:${parsed.owner.chainId}:${parsed.owner.address}`, threshold: { n: 1, t: 1 } }) : canonicalize({});
+  const now = seconds((input.now ?? Date.now)());
+  const bodyHash = [...(0, import_sha2564.sha256)(new TextEncoder().encode(body))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  const invocation = await signCompactUcanAuthorization({
+    issuerDid: input.signer.did,
+    audienceDid: input.nodeDid,
+    attenuation: { [input.networkId]: { [input.action]: [{}] } },
+    facts: [{ type: NETWORK_ADMIN_TYPE, targetNode: input.nodeDid, networkId: input.networkId, bodyHash, action: input.action }],
+    proofs: [input.proof],
+    notBefore: now,
+    expiresAt: now + 60,
+    nonce: toBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    sign: input.signer.sign
+  });
+  const path = input.action === NETWORK_CREATE_ABILITY ? "/encryption/networks" : `/encryption/networks/${encodeURIComponent(input.networkId)}/revoke`;
+  const response = await input.fetch(new URL(path, input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { Authorization: invocation.authorization, ...input.action === NETWORK_CREATE_ABILITY ? { "content-type": "application/json" } : {} },
+    ...input.action === NETWORK_CREATE_ABILITY ? { body } : {}
+  });
+  await response.body?.cancel();
+  return response.status;
+}
+async function retireShareNetwork(input) {
+  const status = await sendNetworkAdmin({ ...input, action: NETWORK_REVOKE_ABILITY });
+  const lookup = await lookupShareNetwork(input.nodeOrigin, input.networkId, input.fetch);
+  if (lookup.state === "absent" && (status === 404 || status === 204)) return "absent";
+  if (lookup.state === "revoked") return "retired";
+  throw new ShareRootError("node-refused", `share network retire failed: HTTP ${status}, state ${lookup.state}`);
+}
+
 // src/share-grant.ts
-var ACTIONS = {
+var KV_ACTIONS = {
   view: ["tinycloud.kv/get", "tinycloud.kv/metadata"],
   edit: ["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/put"]
 };
-function wantedFor(spaceId, path, access, owner) {
-  return { [`${spaceId}/kv/${path}`]: ACTIONS[access], [shareNetworkId(owner)]: [DECRYPT_ABILITY] };
+var NETWORK_ACTIONS = [NETWORK_CREATE_ABILITY, NETWORK_REVOKE_ABILITY, DECRYPT_ABILITY];
+var SHARE_KV_ROOT = "xyz.tinycloud.share/";
+var EDIT_SHARE_READER_MAX_LIFETIME_MS = 60 * 6e4;
+var defaultFetch = (url, init) => globalThis.fetch(url, init);
+function assertShareGrantPath(path, shareId, access) {
+  const inShare = isExactKeyUnder(path, `${SHARE_KV_ROOT}shares/${shareId}/`) && !path.slice(`${SHARE_KV_ROOT}shares/${shareId}/`.length).includes("/");
+  const inArtifact = isExactKeyUnder(path, `${SHARE_KV_ROOT}artifacts/`) && parseArtifactVersionPath(path.slice(SHARE_KV_ROOT.length)) !== void 0;
+  if (!inShare && !inArtifact) throw new ShareRootError("invalid-request", "share grant path must be xyz.tinycloud.share/shares/<shareId>/<file> or an artifact version file");
+  if (inArtifact && access !== "view") throw new ShareRootError("invalid-request", "artifact versions are immutable: only view grants may name a version file");
+}
+function wantedFor(spec) {
+  return { [`${spec.spaceId}/kv/${spec.path}`]: KV_ACTIONS[spec.access], [spec.networkId]: NETWORK_ACTIONS };
+}
+function rowOf(spec, keyDid, state, grantCid) {
+  return { shareId: spec.shareId, nw: spec.networkId.slice(spec.networkId.lastIndexOf(":") + 1), networkId: spec.networkId, keyDid, access: spec.access, path: spec.path, state, ...grantCid === void 0 ? {} : { grantCid } };
 }
 var ShareGrant = class _ShareGrant {
   cid;
@@ -7114,44 +7175,61 @@ var ShareGrant = class _ShareGrant {
   spaceId;
   keyDid;
   nodeOrigin;
+  shareId;
+  networkId;
   path;
   access;
   issuedAt;
   expiresAt;
+  #spec;
   #authorization;
   #key;
   #now;
+  #fetch;
   constructor(input) {
+    this.#spec = input.spec;
     this.cid = input.cid;
-    this.ownerDid = input.ownerDid;
-    this.spaceId = input.spaceId;
+    this.ownerDid = input.spec.ownerDid;
+    this.spaceId = input.spec.spaceId;
     this.keyDid = input.key.did;
-    this.nodeOrigin = input.nodeOrigin;
-    this.path = input.path;
-    this.access = input.access;
+    this.nodeOrigin = input.spec.nodeOrigin;
+    this.shareId = input.spec.shareId;
+    this.networkId = input.spec.networkId;
+    this.path = input.spec.path;
+    this.access = input.spec.access;
     this.issuedAt = input.issuedAt;
     this.expiresAt = input.expiresAt;
     this.#authorization = input.authorization;
     this.#key = input.key;
     this.#now = input.now;
+    this.#fetch = input.fetch;
   }
   /**
-   * Ask the owner for one per-share grant (one approval). Path, access,
-   * expiry, space and Node origin are checked before the wallet is asked; the
-   * signed CACAO is decoded and must match exactly, or the key is cleared and
-   * the error carries the imported CID (`mustRevoke` when it may be wider).
+   * Step 0: check everything that does not need the owner, and make the key.
+   * Also looks the share's network up (no approval): a shareId whose network
+   * is retired (burned), or already exists from an earlier grant, is refused
+   * with `share-id-in-use` before the prompt (see `resumeExistingNetwork`).
+   * Throws `share-id-not-network-safe`, `invalid-request`, `lifetime-exceeds-cap`,
+   * `share-id-in-use`, `node-refused` or `invalid-key` with no approval spent.
    */
-  static async create(input) {
+  static async prepare(input) {
     const clock = input.now ?? Date.now;
     const now = clock();
     const owner = parseOwnerDid(input.owner.ownerDid);
+    const networkId = perShareNetworkIdFor(input.owner.ownerDid, input.shareId);
     assertSpace(input.spaceId, owner, "share");
     const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
-    assertLinkPath(input.path);
     if (input.access !== "view" && input.access !== "edit") throw new ShareRootError("invalid-request", "share grant access must be view or edit");
+    assertShareGrantPath(input.path, input.shareId, input.access);
     const expiry = input.expiresAt instanceof Date ? input.expiresAt.getTime() : Number.NaN;
     if (!Number.isFinite(expiry) || expiry <= now) throw new ShareRootError("invalid-request", "share grant expiry must be in the future");
     if (expiry - now > SHARE_ROOT_LINK_MAX_LIFETIME_MS) throw new ShareRootError("lifetime-exceeds-cap", "share grant lifetime exceeds 30 days");
+    const existing = await lookupShareNetwork(nodeOrigin, networkId, input.fetch ?? defaultFetch);
+    if (existing.state !== "absent") {
+      if (existing.state !== "active") throw new ShareRootError("share-id-in-use", `this shareId's network is ${existing.state}; a retired shareId is never reused`);
+      if (input.resumeExistingNetwork !== true) throw new ShareRootError("share-id-in-use", "this shareId already has an active network from an earlier grant");
+      assertActiveShareNetwork(existing, networkId);
+    }
     const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
     try {
       await assertUsableKey(key);
@@ -7159,13 +7237,36 @@ var ShareGrant = class _ShareGrant {
       key.clear();
       throw error;
     }
+    const spec = { owner, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, nodeOrigin, shareId: input.shareId, networkId, path: input.path, access: input.access };
+    let settled = false;
+    return {
+      shareId: spec.shareId,
+      networkId,
+      keyDid: key.did,
+      row: rowOf(spec, key.did, "pending"),
+      approve: async () => {
+        if (settled) throw new ShareRootError("invalid-request", "this pending grant was already approved or discarded");
+        settled = true;
+        return _ShareGrant.#approve(spec, key, input.owner, input.expiresAt, clock, input.fetch ?? defaultFetch);
+      },
+      discard: () => {
+        settled = true;
+        key.clear();
+      }
+    };
+  }
+  /** `prepare` then `approve`, for callers that keep no `pending` row (tests, one-shot tools). */
+  static async create(input) {
+    return (await _ShareGrant.prepare(input)).approve();
+  }
+  static async #approve(spec, key, owner, expiresAt, clock, fetchFn) {
     const permissions = [
-      { service: "tinycloud.kv", path: input.path, actions: [...ACTIONS[input.access]] },
-      { service: "tinycloud.encryption", path: shareNetworkId(owner), actions: [DECRYPT_ABILITY] }
+      { service: "tinycloud.kv", path: spec.path, actions: [...KV_ACTIONS[spec.access]] },
+      { service: "tinycloud.encryption", path: spec.networkId, actions: [...NETWORK_ACTIONS] }
     ];
     let receipt;
     try {
-      receipt = await input.owner.createOwnerDelegation({ delegateDid: key.did, spaceId: input.spaceId, expiresAt: input.expiresAt, permissions });
+      receipt = await owner.createOwnerDelegation({ delegateDid: key.did, spaceId: spec.spaceId, expiresAt, permissions });
     } catch (error) {
       key.clear();
       throw error;
@@ -7180,33 +7281,29 @@ var ShareGrant = class _ShareGrant {
       } catch (error) {
         throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
       }
-      const times = validateSignedOwnerDelegation(decoded, {
-        label: "per-share grant",
-        owner,
-        keyDid: key.did,
-        wanted: wantedFor(input.spaceId, input.path, input.access, owner),
-        maxLifetimeMs: SHARE_ROOT_LINK_MAX_LIFETIME_MS,
-        requestedExpiresAt: input.expiresAt,
-        now: clock()
-      });
-      return new _ShareGrant({ cid: decoded.cid, ownerDid: input.owner.ownerDid, spaceId: input.spaceId, nodeOrigin, path: input.path, access: input.access, ...times, authorization, key, now: clock });
+      const times = validateSignedOwnerDelegation(decoded, { label: "per-share grant", owner: spec.owner, keyDid: key.did, wanted: wantedFor(spec), maxLifetimeMs: SHARE_ROOT_LINK_MAX_LIFETIME_MS, requestedExpiresAt: expiresAt, now: clock() });
+      return new _ShareGrant({ spec, cid: decoded.cid, ...times, authorization, key, now: clock, fetch: fetchFn });
     } catch (error) {
       key.clear();
       if (error instanceof ShareRootError) throw error;
       throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
     }
   }
-  /** Rebuild a stored grant with its key (e.g. a CLI 0600 key file); the signed bytes are checked again. */
+  /** Rebuild a stored grant with its key (e.g. a CLI 0600 key file); the signed bytes are checked again. Only record v2. */
   static async restore(input) {
     const { record } = input;
     const clock = input.now ?? Date.now;
-    if (record.version !== 1 || record.access !== "view" && record.access !== "edit") throw new ShareRootError("malformed-root", "share grant record is not supported");
+    if (record.version !== 2) throw new ShareRootError("malformed-root", "share grant record is not supported (only per-share network grants, record v2)");
+    if (record.access !== "view" && record.access !== "edit") throw new ShareRootError("malformed-root", "share grant record access is invalid");
     if (record.keyDid !== input.key.did) throw new ShareRootError("audience-mismatch", "share grant record belongs to another key");
     const owner = parseOwnerDid(record.ownerDid);
+    const networkId = perShareNetworkIdFor(record.ownerDid, record.shareId);
+    if (!sameNetworkUrn(networkId, record.networkId)) throw new ShareRootError("malformed-root", "share grant record network does not match its shareId");
     assertSpace(record.spaceId, owner, "share");
     const nodeOrigin = requireNodeOrigin(record.nodeOrigin);
-    assertLinkPath(record.path);
+    assertShareGrantPath(record.path, record.shareId, record.access);
     await assertUsableKey(input.key);
+    const spec = { owner, ownerDid: record.ownerDid, spaceId: record.spaceId, nodeOrigin, shareId: record.shareId, networkId, path: record.path, access: record.access };
     let authorization;
     let decoded;
     try {
@@ -7215,17 +7312,14 @@ var ShareGrant = class _ShareGrant {
     } catch (error) {
       throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: record.cid });
     }
-    const times = validateSignedOwnerDelegation(decoded, {
-      label: "per-share grant",
-      owner,
-      keyDid: input.key.did,
-      wanted: wantedFor(record.spaceId, record.path, record.access, owner),
-      maxLifetimeMs: SHARE_ROOT_LINK_MAX_LIFETIME_MS,
-      now: clock()
-    });
-    return new _ShareGrant({ cid: decoded.cid, ownerDid: record.ownerDid, spaceId: record.spaceId, nodeOrigin, path: record.path, access: record.access, ...times, authorization, key: input.key, now: clock });
+    const times = validateSignedOwnerDelegation(decoded, { label: "per-share grant", owner, keyDid: input.key.did, wanted: wantedFor(spec), maxLifetimeMs: SHARE_ROOT_LINK_MAX_LIFETIME_MS, now: clock() });
+    return new _ShareGrant({ spec, cid: decoded.cid, ...times, authorization, key: input.key, now: clock, fetch: input.fetch ?? defaultFetch });
   }
-  /** The `Authorization` value the Node knows this grant by (base64url CACAO). */
+  /**
+   * This grant's CACAO as base64url, UNPADDED (the record form). As a Node
+   * `Authorization` header it must be padded to a multiple of 4 characters:
+   * the Node refuses an unpadded value otherwise.
+   */
   get authorization() {
     return toBase64Url(this.#authorization);
   }
@@ -7234,31 +7328,84 @@ var ShareGrant = class _ShareGrant {
     return `${this.spaceId}/kv/${this.path}`;
   }
   toRecord() {
-    return { version: 1, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, nodeOrigin: this.nodeOrigin, path: this.path, access: this.access, expiresAt: this.expiresAt.toISOString() };
+    return { version: 2, cid: this.cid, authorization: this.authorization, spaceId: this.spaceId, ownerDid: this.ownerDid, keyDid: this.keyDid, nodeOrigin: this.nodeOrigin, shareId: this.shareId, networkId: this.networkId, path: this.path, access: this.access, expiresAt: this.expiresAt.toISOString() };
+  }
+  /** The history/index row for `state`. */
+  row(state) {
+    return rowOf(this.#spec, this.keyDid, state, this.cid);
+  }
+  /**
+   * Step 3: make sure the share's network exists and is usable. Creates it
+   * when absent (key-signed, no approval), then decides on a fresh lookup
+   * after any answer. Returns `networkId` (the grant's lowercase spelling;
+   * the Node echoes the owner in EIP-55 case). A retired network is never
+   * re-created (the Node answers 409): `network-not-active`.
+   */
+  async ensureNetwork() {
+    const signer = this.#signer();
+    const first = await lookupShareNetwork(this.nodeOrigin, this.networkId, this.#fetch);
+    if (first.state === "absent") {
+      const nodeDid = await nodeDidOf(this.nodeOrigin, this.#fetch);
+      await sendNetworkAdmin({ nodeOrigin: this.nodeOrigin, nodeDid, networkId: this.networkId, action: NETWORK_CREATE_ABILITY, signer, proof: this.cid, fetch: this.#fetch, now: this.#now });
+      return this.assertNetworkActive();
+    }
+    assertActiveShareNetwork(first, this.networkId);
+    return this.networkId;
+  }
+  /** Throw `network-not-active` unless the share's network is `active` now (fresh lookup). */
+  async assertNetworkActive() {
+    assertActiveShareNetwork(await lookupShareNetwork(this.nodeOrigin, this.networkId, this.#fetch), this.networkId);
+    return this.networkId;
+  }
+  /**
+   * Retire the share's network with the per-share key (no approval):
+   * PERMANENT, and every holder of decrypt on it (recipients included) is
+   * refused at their next request. Idempotent: a repeat or a never-created
+   * network counts as done.
+   */
+  async retireNetwork() {
+    const signer = this.#signer();
+    const nodeDid = await nodeDidOf(this.nodeOrigin, this.#fetch);
+    return retireShareNetwork({ nodeOrigin: this.nodeOrigin, nodeDid, networkId: this.networkId, signer, proof: this.cid, fetch: this.#fetch, now: this.#now });
+  }
+  /** Step 4 check (I1): the stored object belongs to this share, on its exact key and network. */
+  assertContentSource(contentSource) {
+    if (contentSource.shareId !== this.shareId || contentSource.kvResource !== this.resource || contentSource.selector !== "exact" || !sameNetworkUrn(contentSource.encryptionNetwork, this.networkId)) throw new ShareRootError("invalid-request", "content source does not belong to this share's grant (shareId, exact key and network)");
   }
   /**
    * Policy/v3 owner signing for this one share. Every call checks the key is
    * held and the grant is live. Policy roots must be owned by the per-share
    * key, expire no later than the grant, and name only this grant's exact
-   * KV resource (with no action the grant lacks) and decrypt on `:share`.
+   * KV resource (no action the grant lacks) and decrypt on this share's
+   * network (parsed equality).
    */
   policySigner() {
-    const owner = parseOwnerDid(this.ownerDid);
-    const actions = ACTIONS[this.access];
+    const actions = KV_ACTIONS[this.access];
     return ownerPolicySigner({
       ownerDid: this.keyDid,
       authorityCid: this.cid,
       notAfter: new Date(this.expiresAt),
       gate: async () => this.#activeKey(),
       now: this.#now,
-      inScope: (capability) => capability.kind === "encryption" ? isShareNetworkOf(capability.resource, owner) && capability.action === DECRYPT_ABILITY : capability.resource === this.resource && capability.selector === "exact" && capability.actions.every((action) => actions.includes(action))
+      inScope: (capability) => capability.kind === "encryption" ? sameNetworkUrn(capability.resource, this.networkId) && capability.action === DECRYPT_ABILITY : capability.resource === this.resource && capability.selector === "exact" && capability.actions.every((action) => actions.includes(action))
     });
   }
-  /** `publishAddressedShare`'s `authority` for this share: the policy signer plus the caller's `registerPolicy`. */
+  /**
+   * Step 5: `publishAddressedShare`'s `authority` for this share. Its
+   * `registerPolicy` first re-reads the network and refuses unless it is
+   * `active` (released Nodes accept registrations on missing or retired
+   * networks).
+   */
   publishAuthority(registerPolicy) {
-    return { ...this.policySigner(), registerPolicy };
+    return {
+      ...this.policySigner(),
+      registerPolicy: async (request) => {
+        await this.assertNetworkActive();
+        return registerPolicy(request);
+      }
+    };
   }
-  /** Drop the per-share key. It does not revoke the grant: only the owner does that. */
+  /** Drop the per-share key. It does not retire the network or revoke the grant. */
   clear() {
     this.#key?.clear();
     this.#key = void 0;
@@ -7268,101 +7415,323 @@ var ShareGrant = class _ShareGrant {
     if (this.#now() >= this.expiresAt.getTime()) throw new ShareRootError("expired", "share grant has expired", { rootCid: this.cid });
     return this.#key;
   }
-};
-
-// src/share-network.ts
-var import_sha2563 = require("@noble/hashes/sha256");
-var NETWORK_CREATE_ABILITY = "tinycloud.encryption/network.create";
-var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
-var NETWORK_GRANT_LIFETIME_MS = 10 * 6e4;
-function shareNetworkIdFor(ownerDid) {
-  parseOwnerDid(ownerDid);
-  return `urn:tinycloud:encryption:${ownerDid}:share`;
-}
-function hex(bytes2) {
-  return [...bytes2].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-async function existingShareNetwork(nodeOrigin, networkId, ownerDid, fetchFn) {
-  const response = await fetchFn(new URL(`/encryption/networks/${encodeURIComponent(networkId)}`, nodeOrigin), { redirect: "error" });
-  if (response.status === 404) return void 0;
-  if (!response.ok) throw new ShareRootError("invalid-request", `share network lookup failed: HTTP ${response.status}`);
-  const body = await response.json();
-  const descriptor = typeof body === "object" && body !== null && "descriptor" in body ? body.descriptor : body;
-  if (typeof descriptor !== "object" || descriptor === null || !("networkId" in descriptor) || !("ownerDid" in descriptor) || !("state" in descriptor)) {
-    throw new ShareRootError("invalid-request", "share network descriptor is malformed");
+  #signer() {
+    const key = this.#activeKey();
+    return { did: key.did, sign: (bytes2) => key.sign(bytes2) };
   }
-  const { networkId: foundId, ownerDid: foundOwner, state } = descriptor;
-  const owner = parseOwnerDid(ownerDid);
-  if (typeof foundId !== "string" || !isShareNetworkOf(foundId, owner) || typeof foundOwner !== "string" || !sameOwner(parseOwnerDid(foundOwner), owner)) {
-    throw new ShareRootError("invalid-request", "share network is not owned by this owner");
+};
+async function revokeShareGrant(input) {
+  const fetchFn = input.fetch ?? defaultFetch;
+  const network = await input.grant.retireNetwork();
+  try {
+    const response = await fetchFn(new URL("/revoke", input.grant.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: await input.owner.signOwnerRevocation(input.grant.cid) } });
+    const status = response.status;
+    if (!await isRevokeReceiptFor(response, input.grant.cid)) throw new Error(`HTTP ${status}: no receipt confirming this grant`);
+  } catch (error) {
+    throw new ShareRootError("grant-revoke-incomplete", `the share's network is retired (decrypt cut for everyone), but the grant revoke failed: ${errorMessage(error)}`, { rootCid: input.grant.cid });
   }
-  if (state === "revoked" || state === "failed") throw new ShareRootError("invalid-request", `share network is ${String(state)}`);
-  return foundId;
+  return { network, grant: "revoked" };
 }
-async function ensureShareNetwork(input) {
+async function openEditShare(input) {
   const clock = input.now ?? Date.now;
-  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const lifetime = input.lifetimeMs ?? EDIT_SHARE_READER_MAX_LIFETIME_MS;
+  if (!Number.isFinite(lifetime) || lifetime <= 0 || lifetime > EDIT_SHARE_READER_MAX_LIFETIME_MS) throw new ShareRootError("lifetime-exceeds-cap", "an edit-share reader lives at most one hour");
   const owner = parseOwnerDid(input.owner.ownerDid);
-  assertSpace(input.spaceId, owner, "share");
-  const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
-  const networkId = shareNetworkIdFor(input.owner.ownerDid);
-  const existing = await existingShareNetwork(nodeOrigin, networkId, input.owner.ownerDid, fetchFn);
-  if (existing !== void 0) return { networkId: existing, approvals: 0 };
-  const info = await (await fetchFn(new URL("/info", nodeOrigin), { redirect: "error" })).json();
-  const nodeDid = typeof info === "object" && info !== null && "nodeId" in info ? info.nodeId : void 0;
-  if (typeof nodeDid !== "string" || !nodeDid.startsWith("did:key:")) throw new ShareRootError("invalid-request", "node identity is unavailable");
-  const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
+  if (!sameOwner(owner, parseOwnerDid(input.record.ownerDid))) throw new ShareRootError("invalid-request", "the share belongs to another owner");
+  const networkId = perShareNetworkIdFor(input.record.ownerDid, input.record.shareId);
+  if (!sameNetworkUrn(networkId, input.record.networkId)) throw new ShareRootError("invalid-request", "share network does not match its shareId");
+  assertSpace(input.record.spaceId, owner, "share");
+  assertShareGrantPath(input.record.path, input.record.shareId, "edit");
+  const key = await createDelegatedShareKey({ extractable: false });
+  const expiresAt = new Date(clock() + lifetime);
+  let receipt;
   try {
-    await assertUsableKey(key);
-    const expiresAt = new Date(clock() + NETWORK_GRANT_LIFETIME_MS);
-    const receipt = await input.owner.createOwnerDelegation({
+    receipt = await input.owner.createOwnerDelegation({
       delegateDid: key.did,
-      spaceId: input.spaceId,
+      spaceId: input.record.spaceId,
       expiresAt,
-      permissions: [{ service: "tinycloud.encryption", path: networkId, actions: [NETWORK_CREATE_ABILITY] }]
+      permissions: [
+        { service: "tinycloud.kv", path: input.record.path, actions: ["tinycloud.kv/get"] },
+        { service: "tinycloud.encryption", path: networkId, actions: [DECRYPT_ABILITY] }
+      ]
     });
+  } catch (error) {
+    key.clear();
+    throw error;
+  }
+  try {
     const authorization = new Uint8Array(receipt.signedDagCbor);
     const signedCid = ownerRootCacaoCid(authorization);
-    if (signedCid !== receipt.delegationCid) throw new ShareRootError("malformed-root", "signed network grant bytes do not match the imported delegation CID", { rootCid: receipt.delegationCid, signedCid, mustRevoke: true });
-    let decoded;
-    try {
-      decoded = decodeOwnerRootCacao(authorization);
-    } catch (error) {
-      throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
-    }
-    validateSignedOwnerDelegation(decoded, {
-      label: "share network grant",
+    if (signedCid !== receipt.delegationCid) throw new ShareRootError("malformed-root", "signed reader grant bytes do not match the imported delegation CID", { rootCid: receipt.delegationCid, signedCid, mustRevoke: true });
+    validateSignedOwnerDelegation(decodeOwnerRootCacao(authorization), {
+      label: "edit-share reader",
       owner,
       keyDid: key.did,
-      wanted: { [networkId]: [NETWORK_CREATE_ABILITY] },
-      maxLifetimeMs: NETWORK_GRANT_LIFETIME_MS,
+      wanted: { [`${input.record.spaceId}/kv/${input.record.path}`]: ["tinycloud.kv/get"], [networkId]: [DECRYPT_ABILITY] },
+      maxLifetimeMs: EDIT_SHARE_READER_MAX_LIFETIME_MS,
       requestedExpiresAt: expiresAt,
       now: clock()
     });
-    const body = { name: "share", ownerDid: input.owner.ownerDid, threshold: { n: 1, t: 1 } };
-    const canonicalBody = canonicalize(body);
-    const now = seconds(clock());
-    const invocation = await signCompactUcanAuthorization({
-      issuerDid: key.did,
-      audienceDid: nodeDid,
-      attenuation: { [networkId]: { [NETWORK_CREATE_ABILITY]: [{}] } },
-      facts: [{ type: NETWORK_ADMIN_TYPE, targetNode: nodeDid, networkId, bodyHash: hex((0, import_sha2563.sha256)(new TextEncoder().encode(canonicalBody))), action: NETWORK_CREATE_ABILITY }],
-      proofs: [decoded.cid],
-      notBefore: now,
-      expiresAt: now + 60,
-      nonce: toBase64Url(crypto.getRandomValues(new Uint8Array(16))),
-      sign: (bytes2) => key.sign(bytes2)
-    });
-    const response = await fetchFn(new URL("/encryption/networks", nodeOrigin), {
-      method: "POST",
-      redirect: "error",
-      headers: { Authorization: invocation.authorization, "content-type": "application/json" },
-      body: canonicalBody
-    });
-    if (!response.ok && response.status !== 409) throw new ShareRootError("invalid-request", `share network creation failed: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`);
-    const created = await existingShareNetwork(nodeOrigin, networkId, input.owner.ownerDid, fetchFn);
-    if (created === void 0) throw new ShareRootError("invalid-request", "share network was not created");
-    return { networkId: created, approvals: 1 };
+  } catch (error) {
+    key.clear();
+    if (error instanceof ShareRootError) throw error;
+    throw new ShareRootError("malformed-root", errorMessage(error), { rootCid: receipt.delegationCid, mustRevoke: true });
+  }
+  let live = key;
+  const clear = () => {
+    live?.clear();
+    live = void 0;
+  };
+  return {
+    cid: receipt.delegationCid,
+    keyDid: key.did,
+    networkId,
+    path: input.record.path,
+    expiresAt,
+    signer: {
+      did: key.did,
+      sign: async (bytes2) => {
+        if (live === void 0 || clock() >= expiresAt.getTime()) throw new ShareRootError("expired", "edit-share reader has expired or was cleared");
+        return live.sign(bytes2);
+      }
+    },
+    clear
+  };
+}
+
+// src/share-control.ts
+var import_sha3 = require("@noble/hashes/sha3");
+var SHARE_CONTROL_HEADER_BUDGET_BYTES = 3e4;
+var SHARE_CONTROL_LIFETIME_MS = 10 * 6e4;
+var DELEGATION_REVOKE_ABILITY = "tinycloud.delegation/revoke";
+var RECAP_STATEMENT = "I further authorize the stated URI to perform the following actions on my behalf:";
+var PLACEHOLDER_KEY_DID = `did:key:z6Mk${"1".repeat(44)}`;
+function checksumAddress(address) {
+  const lower = address.toLowerCase().slice(2);
+  const hash = (0, import_sha3.keccak_256)(new TextEncoder().encode(lower));
+  let out = "0x";
+  for (let index = 0; index < lower.length; index++) {
+    const nibble = hash[index >> 1] >> (index % 2 === 0 ? 4 : 0) & 15;
+    out += nibble >= 8 ? lower[index].toUpperCase() : lower[index];
+  }
+  return out;
+}
+function reCapStatement(attenuation) {
+  let index = 0;
+  let lines = "";
+  for (const resource of Object.keys(attenuation).sort()) {
+    const namespaces = {};
+    for (const ability of Object.keys(attenuation[resource]).sort()) {
+      const slash = ability.indexOf("/");
+      (namespaces[ability.slice(0, slash)] ??= []).push(ability.slice(slash + 1));
+    }
+    for (const namespace of Object.keys(namespaces).sort()) {
+      lines += ` (${++index}) '${namespace}': ${namespaces[namespace].map((name) => `'${name}'`).join(", ")} for '${resource}'.`;
+    }
+  }
+  return `${RECAP_STATEMENT}${lines}`;
+}
+function encodeDagCbor(value) {
+  const output = [];
+  const head = (major, argument) => {
+    if (argument < 24) output.push(major << 5 | argument);
+    else if (argument < 256) output.push(major << 5 | 24, argument);
+    else if (argument < 65536) output.push(major << 5 | 25, argument >> 8, argument & 255);
+    else output.push(major << 5 | 26, argument >>> 24 & 255, argument >>> 16 & 255, argument >>> 8 & 255, argument & 255);
+  };
+  const write = (item) => {
+    if (typeof item === "number" && Number.isSafeInteger(item) && item >= 0 && item < 4294967296) head(0, item);
+    else if (typeof item === "string") {
+      const encoded = new TextEncoder().encode(item);
+      head(3, encoded.length);
+      output.push(...encoded);
+    } else if (item instanceof Uint8Array) {
+      head(2, item.length);
+      output.push(...item);
+    } else if (Array.isArray(item)) {
+      head(4, item.length);
+      item.forEach(write);
+    } else if (typeof item === "object" && item !== null) {
+      const entries = Object.entries(item).map(([key, entry]) => [new TextEncoder().encode(key), entry]);
+      entries.sort(([left], [right]) => left.length - right.length || compareBytes(left, right));
+      head(5, entries.length);
+      for (const [key, entry] of entries) {
+        head(3, key.length);
+        output.push(...key);
+        write(entry);
+      }
+    } else throw new Error("value is not encodable as a CACAO field");
+  };
+  write(value);
+  return Uint8Array.from(output);
+}
+function compareBytes(left, right) {
+  for (let index = 0; index < left.length; index++) if (left[index] !== right[index]) return left[index] - right[index];
+  return 0;
+}
+function unsignedControl(input) {
+  const address = checksumAddress(input.owner.address);
+  const statement = reCapStatement(input.attenuation);
+  const recap = `urn:recap:${toBase64Url(new TextEncoder().encode(JSON.stringify({ att: input.attenuation, prf: [] })))}`;
+  const message = [
+    `${input.domain} wants you to sign in with your Ethereum account:`,
+    address,
+    "",
+    statement,
+    "",
+    `URI: ${input.keyDid}`,
+    "Version: 1",
+    `Chain ID: ${input.owner.chainId}`,
+    `Nonce: ${input.nonce}`,
+    `Issued At: ${input.issuedAt}`,
+    `Expiration Time: ${input.expiresAt}`,
+    "Resources:",
+    `- ${recap}`
+  ].join("\n");
+  const payload = { aud: input.keyDid, domain: input.domain, exp: input.expiresAt, iat: input.issuedAt, iss: `did:pkh:eip155:${input.owner.chainId}:${address}`, nonce: input.nonce, resources: [recap], statement, version: 1 };
+  return { message, payload };
+}
+function signedControlBytes(payload, signature) {
+  return encodeDagCbor({ h: { t: "eip4361" }, p: payload, s: { t: "eip191", s: signature } });
+}
+function attenuationFor(targets, spaceDelegationResources) {
+  const attenuation = {};
+  for (const resource of spaceDelegationResources) attenuation[resource] = { [DELEGATION_REVOKE_ABILITY]: [{}] };
+  for (const target of targets) attenuation[target.networkId] = { [DELEGATION_REVOKE_ABILITY]: [{}], [NETWORK_REVOKE_ABILITY]: [{}] };
+  return attenuation;
+}
+var ISO_PLACEHOLDER = (/* @__PURE__ */ new Date(0)).toISOString();
+var NONCE_PLACEHOLDER = "0".repeat(32);
+function headerValue(bytes2) {
+  const text2 = toBase64Url(bytes2);
+  return text2 + "=".repeat((4 - text2.length % 4) % 4);
+}
+function headerLength(byteLength) {
+  return 4 * Math.ceil(byteLength / 3);
+}
+function headerBytesOf(owner, domain, targets, spaceDelegationResources) {
+  const { payload } = unsignedControl({ owner, domain, keyDid: PLACEHOLDER_KEY_DID, attenuation: attenuationFor(targets, spaceDelegationResources), issuedAt: ISO_PLACEHOLDER, expiresAt: ISO_PLACEHOLDER, nonce: NONCE_PLACEHOLDER });
+  return headerLength(signedControlBytes(payload, new Uint8Array(65)).length);
+}
+var CONTROL_DOMAIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*(?::\d{1,5})?$/;
+var CONTROL_SPACE_ROW = /^tinycloud:pkh:eip155:([1-9]\d*):(0x[0-9a-fA-F]{40}):([A-Za-z0-9_-]+)\/delegation$/;
+var GRANT_CID = /^b[a-z2-7]{20,}$/;
+function assertControlInputs(ownerDid, owner, domain, targets, spaceDelegationResources) {
+  if (typeof domain !== "string" || !CONTROL_DOMAIN.test(domain)) throw new ShareRootError("invalid-request", "control domain must be a host name, optionally with a port");
+  const seenRows = /* @__PURE__ */ new Set();
+  for (const row of spaceDelegationResources) {
+    const match = typeof row === "string" ? CONTROL_SPACE_ROW.exec(row) : null;
+    if (match === null || !sameOwner({ chainId: match[1], address: match[2].toLowerCase() }, owner)) throw new ShareRootError("control-target-invalid", "control space rows must be <owner space>/delegation");
+    if (seenRows.has(row)) throw new ShareRootError("control-target-invalid", "control space rows must not repeat");
+    seenRows.add(row);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    if (!isPerShareNetworkOf(ownerDid, target.networkId)) throw new ShareRootError("control-target-invalid", "control targets must be this owner's per-share networks (share-<shareId>)");
+    if (target.grantCid !== void 0 && (typeof target.grantCid !== "string" || !GRANT_CID.test(target.grantCid))) throw new ShareRootError("control-target-invalid", "control target grant CID is invalid");
+    if (seen.has(target.networkId)) throw new ShareRootError("control-target-invalid", "control targets must not repeat a network");
+    seen.add(target.networkId);
+  }
+}
+function planShareControlBatches(input) {
+  const owner = parseOwnerDid(input.owner.ownerDid);
+  const budget = input.budgetBytes ?? SHARE_CONTROL_HEADER_BUDGET_BYTES;
+  if (!Number.isSafeInteger(budget) || budget <= 0 || budget > SHARE_CONTROL_HEADER_BUDGET_BYTES) throw new ShareRootError("invalid-request", `control budget must be 1..${SHARE_CONTROL_HEADER_BUDGET_BYTES} bytes`);
+  const rows = (input.spaceIds ?? []).map((spaceId) => `${spaceId}/delegation`);
+  assertControlInputs(input.owner.ownerDid, owner, input.owner.domain, input.targets, rows);
+  const batches = [];
+  let current = [];
+  let size = 0;
+  for (const target of input.targets) {
+    const next = headerBytesOf(owner, input.owner.domain, [...current, target], rows);
+    if (next <= budget) {
+      current.push(target);
+      size = next;
+      continue;
+    }
+    if (current.length === 0) throw new ShareRootError("invalid-request", "one target and the space rows exceed the control budget");
+    batches.push({ targets: current, spaceDelegationResources: rows, headerBytes: size });
+    current = [target];
+    size = headerBytesOf(owner, input.owner.domain, current, rows);
+    if (size > budget) throw new ShareRootError("invalid-request", "one target and the space rows exceed the control budget");
+  }
+  if (current.length > 0) {
+    batches.push({ targets: current, spaceDelegationResources: rows, headerBytes: size });
+  } else if (rows.length > 0) {
+    size = headerBytesOf(owner, input.owner.domain, [], rows);
+    if (size > budget) throw new ShareRootError("invalid-request", "the space rows alone exceed the control budget");
+    batches.push({ targets: [], spaceDelegationResources: rows, headerBytes: size });
+  }
+  return batches;
+}
+function signatureBytes(hex) {
+  if (typeof hex !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(hex)) throw new ShareRootError("invalid-request", "owner signature must be 65 bytes of 0x hex");
+  const bytes2 = new Uint8Array(65);
+  for (let index = 0; index < 65; index++) bytes2[index] = Number.parseInt(hex.slice(2 + index * 2, 4 + index * 2), 16);
+  return bytes2;
+}
+async function runShareControlBatch(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const clock = input.now ?? Date.now;
+  const nodeOrigin = requireNodeOrigin(input.nodeOrigin);
+  const owner = parseOwnerDid(input.owner.ownerDid);
+  const { batch } = input;
+  assertControlInputs(input.owner.ownerDid, owner, input.owner.domain, batch.targets, batch.spaceDelegationResources);
+  if (batch.targets.length === 0 && batch.spaceDelegationResources.length === 0) throw new ShareRootError("invalid-request", "control batch is empty");
+  const key = await (input.keyFactory ?? (() => createDelegatedShareKey({ extractable: false })))();
+  try {
+    const now = clock();
+    const issuedAt = new Date(now).toISOString();
+    const expiresAt = new Date(now + SHARE_CONTROL_LIFETIME_MS).toISOString();
+    const nonce = [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+    const control = unsignedControl({ owner, domain: input.owner.domain, keyDid: key.did, attenuation: attenuationFor(batch.targets, batch.spaceDelegationResources), issuedAt, expiresAt, nonce });
+    const sized = headerLength(signedControlBytes(control.payload, new Uint8Array(65)).length);
+    if (sized > SHARE_CONTROL_HEADER_BUDGET_BYTES) throw new ShareRootError("invalid-request", `control is ${sized} bytes, above the ${SHARE_CONTROL_HEADER_BUDGET_BYTES}-byte budget`);
+    const bytes2 = signedControlBytes(control.payload, signatureBytes(await input.owner.signMessage(control.message)));
+    const controlCid = ownerRootCacaoCid(bytes2);
+    const imported = await fetchFn(new URL("/delegate", nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: headerValue(bytes2) } });
+    if (!imported.ok) throw new ShareRootError("node-refused", `owner control import failed: HTTP ${imported.status} ${(await imported.text()).slice(0, 120)}`);
+    await imported.body?.cancel();
+    const nodeDid = await nodeDidOf(nodeOrigin, fetchFn);
+    const signer = { did: key.did, sign: (data) => key.sign(data) };
+    const networks = [];
+    for (const target of batch.targets) {
+      try {
+        networks.push({ networkId: target.networkId, result: await retireShareNetwork({ nodeOrigin, nodeDid, networkId: target.networkId, signer, proof: controlCid, fetch: fetchFn, now: clock }) });
+      } catch (error) {
+        networks.push({ networkId: target.networkId, result: "failed", error: errorMessage(error) });
+      }
+    }
+    const grants = [];
+    for (const target of batch.targets) {
+      if (target.grantCid === void 0) continue;
+      const at = seconds(clock());
+      const invocation = await signCompactUcanAuthorization({
+        issuerDid: key.did,
+        audienceDid: key.did,
+        attenuation: { [`urn:cid:${target.grantCid}`]: { [DELEGATION_REVOKE_ABILITY]: [{}] } },
+        facts: [{}],
+        proofs: [controlCid],
+        notBefore: at,
+        expiresAt: at + 60,
+        nonce: `urn:uuid:${crypto.randomUUID()}`,
+        sign: signer.sign
+      });
+      const response = await fetchFn(new URL("/revoke", nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: invocation.authorization } });
+      const status = response.status;
+      if (await isRevokeReceiptFor(response, target.grantCid)) {
+        grants.push({ grantCid: target.grantCid, result: "revoked", status });
+        continue;
+      }
+      if (input.revokeFallback === void 0) {
+        grants.push({ grantCid: target.grantCid, result: "refused", status });
+        continue;
+      }
+      const fallback = await fetchFn(new URL("/revoke", nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: await input.revokeFallback.signOwnerRevocation(target.grantCid) } });
+      const fallbackStatus = fallback.status;
+      grants.push({ grantCid: target.grantCid, result: await isRevokeReceiptFor(fallback, target.grantCid) ? "revoked-by-owner" : "refused", status: fallbackStatus });
+    }
+    return { controlCid, networks, grants };
   } finally {
     key.clear();
   }
@@ -7370,8 +7739,10 @@ async function ensureShareNetwork(input) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
-  POLICY_OWNER_AUTHORITY_FEATURES,
-  POLICY_OWNER_AUTHORITY_PROBE_TTL_MS,
+  EDIT_SHARE_READER_MAX_LIFETIME_MS,
+  SHARE_CONTROL_HEADER_BUDGET_BYTES,
+  SHARE_CONTROL_LIFETIME_MS,
+  SHARE_NETWORK_NAME_PREFIX,
   SHARE_ROOT_CLOCK_SKEW_MS,
   SHARE_ROOT_LINK_MAX_LIFETIME_MS,
   SHARE_ROOT_MAX_LIFETIME_MS,
@@ -7380,15 +7751,17 @@ async function ensureShareNetwork(input) {
   ShareGrant,
   ShareRoot,
   ShareRootError,
+  assertNetworkSafeShareId,
   assertNonExtractableShareKey,
-  createPolicyOwnerModeProbe,
+  assertShareGrantPath,
   decodeOwnerRootCacao,
-  defaultPolicyOwnerModeProbe,
-  ensureShareNetwork,
   ensureShareRoot,
+  openEditShare,
   ownerRootCacaoCid,
-  readPolicyOwnerAuthorityMode,
-  shareNetworkIdFor,
+  perShareNetworkIdFor,
+  planShareControlBatches,
+  revokeShareGrant,
+  runShareControlBatch,
   signShareKeyDelegation
 });
 //# sourceMappingURL=share-root.cjs.map