@tinycloud/share-sdk 1.2.0-beta.5 → 1.2.0-beta.6

package/dist/share-root.d.cts

@@ -185,6 +185,16 @@ declare class ShareRoot {
     toRecord(): ShareRootRecord;
     /** True while the root is live, its key is held, and it lasts at least until `expiresAt`. Revocation is not visible here. */
     covers(expiresAt: Date, now?: number): boolean;
+    /**
+     * Sign a 60-second `POST /revoke` invocation, by the share key, for one
+     * delegation this root issued (a bearer link). Zero approvals. The Node
+     * authorizes it because the share key is that delegation's delegator. The
+     * root itself is never revoked this way: only the owner does that.
+     */
+    signLinkRevocation(input: {
+        readonly delegationCid: string;
+        readonly nodeDid: string;
+    }): Promise<string>;
     /**
      * Sign a bearer link: `kv/get` on one exact key under the prefix, to the
      * link's own key, with this root as its only proof. It never outlives the
@@ -266,7 +276,7 @@ declare function signShareKeyDelegation(input: ShareKeyDelegationInput): Promise
 type ShareGrantAccess = "view" | "edit";
 /** P2(a): a read-back key lives at most one hour. */
 declare const EDIT_SHARE_READER_MAX_LIFETIME_MS: number;
-type FetchFn$1 = (input: URL, init?: RequestInit) => Promise<Response>;
+type FetchFn$2 = (input: URL, init?: RequestInit) => Promise<Response>;
 /**
  * The share's one content key (I1): `xyz.tinycloud.share/shares/<shareId>/<file>`,
  * or, for `view` only, a TC-1428 version file
@@ -322,11 +332,14 @@ interface ShareGrantRequest {
      * exists and is `active` (a half-published share whose key was lost), and
      * grant a new key on it. Without it, `prepare` refuses an existing network
      * (`share-id-in-use`) before the prompt. A retired network is always
-     * refused.
+     * refused. After resuming, revoke the lost key's grant with an owner SIWE
+     * on its CID (`POST /revoke`; not a kill-all control, which would also
+     * retire this network): it stays live, with decrypt on this share, until
+     * revoked or expired.
      */
     readonly resumeExistingNetwork?: boolean;
     readonly keyFactory?: () => Promise<DelegatedShareKey>;
-    readonly fetch?: FetchFn$1;
+    readonly fetch?: FetchFn$2;
     readonly now?: () => number;
 }
 /** A per-share grant whose key exists but which the owner has not approved yet. Persist `row` first, then `approve()`. */
@@ -412,7 +425,7 @@ declare class ShareGrant {
         readonly record: ShareGrantRecord;
         readonly key: DelegatedShareKey;
         readonly now?: () => number;
-        readonly fetch?: FetchFn$1;
+        readonly fetch?: FetchFn$2;
     }): Promise<ShareGrant>;
     /**
      * This grant's CACAO as base64url, UNPADDED (the record form). As a Node
@@ -475,7 +488,7 @@ declare function revokeShareGrant(input: {
     readonly owner: {
         signOwnerRevocation(cid: string): Promise<string>;
     };
-    readonly fetch?: FetchFn$1;
+    readonly fetch?: FetchFn$2;
 }): Promise<{
     readonly network: "retired" | "absent";
     readonly grant: "revoked";
@@ -520,15 +533,17 @@ declare function perShareNetworkIdFor(ownerDid: string, shareId: string): string
  * production ingress (nginx 1.27.4, `large_client_header_buffers 4 32k`,
  * HTTP/1.1): 32,751 bytes pass, 32,752 bytes get `400 Request Header Or
  * Cookie Too Large`. A direct Node accepts ~483 KB and Cloudflare 128 KB.
- * 30,000 bytes leave 8.4% for header-name and proxy overhead. Each share
- * (network URN with `delegation/revoke` + `network.revoke`) costs ~845
- * bytes: 34 shares per control with the space rows (29,800 bytes measured
- * with the `applications` row, imported by the Node), 35 without.
+ * 30,000 bytes leave 8.4% for header-name and proxy overhead. A control's
+ * capacity depends on the shareId length; with the `applications` and
+ * `default` rows in every control: 33 shares for UUID shareIds, 34 for
+ * 32-hex ids, 37 for 16-character ids (34 UUID shares + the `applications`
+ * row alone measured 29,800 bytes, imported by the Node). L shares take
+ * ceil(L/n) controls, n from the plan.
  */
 declare const SHARE_CONTROL_HEADER_BUDGET_BYTES = 30000;
 /** A control lives ten minutes: long enough to retire and revoke one batch. */
 declare const SHARE_CONTROL_LIFETIME_MS: number;
-type FetchFn = (input: URL, init?: RequestInit) => Promise<Response>;
+type FetchFn$1 = (input: URL, init?: RequestInit) => Promise<Response>;
 /** The owner wallet, as a SIWE signer: one call = one approval. */
 interface ShareControlOwner {
     /** `did:pkh:eip155:<chain>:<address>`. */
@@ -617,9 +632,56 @@ declare function runShareControlBatch(input: {
     readonly revokeFallback?: {
         signOwnerRevocation(cid: string): Promise<string>;
     };
-    readonly fetch?: FetchFn;
+    readonly fetch?: FetchFn$1;
     readonly now?: () => number;
     readonly keyFactory?: () => Promise<DelegatedShareKey>;
 }): Promise<ShareControlResult>;
 
-export { AGENT_SHARE_ROOT_MAX_LIFETIME_MS, type DecodedOwnerRootCacao, EDIT_SHARE_READER_MAX_LIFETIME_MS, type EditShareReader, type PendingShareGrant, SHARE_CONTROL_HEADER_BUDGET_BYTES, SHARE_CONTROL_LIFETIME_MS, SHARE_NETWORK_NAME_PREFIX, SHARE_ROOT_CLOCK_SKEW_MS, SHARE_ROOT_LINK_MAX_LIFETIME_MS, SHARE_ROOT_MAX_LIFETIME_MS, SHARE_ROOT_PREFIX, SHARE_ROOT_REQUEST_MARGIN_MS, type ShareControlBatch, type ShareControlOwner, type ShareControlResult, type ShareControlTarget, ShareGrant, type ShareGrantAccess, type ShareGrantRecord, type ShareGrantRequest, type ShareGrantRow, type ShareGrantRowState, type ShareKeyDelegationInput, type ShareKeySigner, type SharePolicySigner, ShareRoot, ShareRootError, type ShareRootErrorCode, type ShareRootErrorDetails, type ShareRootKind, type ShareRootLink, type ShareRootOptions, type ShareRootOwnerAuthority, type ShareRootRecord, assertNetworkSafeShareId, assertNonExtractableShareKey, assertShareGrantPath, decodeOwnerRootCacao, ensureShareRoot, openEditShare, ownerRootCacaoCid, perShareNetworkIdFor, planShareControlBatches, revokeShareGrant, runShareControlBatch, signShareKeyDelegation };
+type FetchFn = (input: URL, init?: RequestInit) => Promise<Response>;
+/** A bearer link minted under a share root, in today's `/viewer#tc1=` shape. */
+interface RootBearerLink {
+    /** `https://<viewer>/viewer#tc1=<token>`: the token carries the link key and its delegation, as SharingService links do. */
+    readonly url: string;
+    readonly delegationCid: string;
+    readonly rootCid: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly expiresAt: Date;
+}
+/**
+ * Mint a view-only bearer link under a share root (TC-1423 D3, slice 3).
+ * Zero approvals: the share key signs `kv/get` on one exact key under the
+ * share prefix (`ShareRoot.signBearerLink`: never beyond the root, never
+ * more than 30 days, exactly `expiresAt` to the second), the Node imports it
+ * (`POST /delegate`), and the link is encoded exactly like a SharingService
+ * link: a fresh per-link Ed25519 key and its delegation in a `tc1:` token in
+ * the `/viewer` fragment, so viewers and `openNativeShare` read it unchanged.
+ *
+ * The per-link key travels in the fragment by design (anyone with the link
+ * holds it). Links need no decrypt (share roots never have it). Use
+ * `ensureShareRoot` first; a `delegation-revoked` or expired root fails here
+ * and needs a re-root (one approval).
+ */
+declare function publishRootBearerLink(input: {
+    readonly root: ShareRoot;
+    readonly path: string;
+    readonly expiresAt: Date;
+    readonly viewerOrigin: string;
+    readonly fetch?: FetchFn;
+}): Promise<RootBearerLink>;
+/**
+ * Revoke one bearer link with the share key that issued it (zero
+ * approvals): a share-key-signed `POST /revoke` on the link's delegation CID.
+ * Only a `{ revoked: true, cid }` receipt counts as done. The owner can
+ * always revoke the same CID with an owner SIWE (one approval).
+ */
+declare function revokeRootBearerLink(input: {
+    readonly root: ShareRoot;
+    readonly delegationCid: string;
+    readonly fetch?: FetchFn;
+}): Promise<{
+    readonly revoked: true;
+    readonly cid: string;
+}>;
+
+export { AGENT_SHARE_ROOT_MAX_LIFETIME_MS, type DecodedOwnerRootCacao, EDIT_SHARE_READER_MAX_LIFETIME_MS, type EditShareReader, type PendingShareGrant, type RootBearerLink, SHARE_CONTROL_HEADER_BUDGET_BYTES, SHARE_CONTROL_LIFETIME_MS, SHARE_NETWORK_NAME_PREFIX, SHARE_ROOT_CLOCK_SKEW_MS, SHARE_ROOT_LINK_MAX_LIFETIME_MS, SHARE_ROOT_MAX_LIFETIME_MS, SHARE_ROOT_PREFIX, SHARE_ROOT_REQUEST_MARGIN_MS, type ShareControlBatch, type ShareControlOwner, type ShareControlResult, type ShareControlTarget, ShareGrant, type ShareGrantAccess, type ShareGrantRecord, type ShareGrantRequest, type ShareGrantRow, type ShareGrantRowState, type ShareKeyDelegationInput, type ShareKeySigner, type SharePolicySigner, ShareRoot, ShareRootError, type ShareRootErrorCode, type ShareRootErrorDetails, type ShareRootKind, type ShareRootLink, type ShareRootOptions, type ShareRootOwnerAuthority, type ShareRootRecord, assertNetworkSafeShareId, assertNonExtractableShareKey, assertShareGrantPath, decodeOwnerRootCacao, ensureShareRoot, openEditShare, ownerRootCacaoCid, perShareNetworkIdFor, planShareControlBatches, publishRootBearerLink, revokeRootBearerLink, revokeShareGrant, runShareControlBatch, signShareKeyDelegation };

package/dist/share-root.d.ts

@@ -185,6 +185,16 @@ declare class ShareRoot {
     toRecord(): ShareRootRecord;
     /** True while the root is live, its key is held, and it lasts at least until `expiresAt`. Revocation is not visible here. */
     covers(expiresAt: Date, now?: number): boolean;
+    /**
+     * Sign a 60-second `POST /revoke` invocation, by the share key, for one
+     * delegation this root issued (a bearer link). Zero approvals. The Node
+     * authorizes it because the share key is that delegation's delegator. The
+     * root itself is never revoked this way: only the owner does that.
+     */
+    signLinkRevocation(input: {
+        readonly delegationCid: string;
+        readonly nodeDid: string;
+    }): Promise<string>;
     /**
      * Sign a bearer link: `kv/get` on one exact key under the prefix, to the
      * link's own key, with this root as its only proof. It never outlives the
@@ -266,7 +276,7 @@ declare function signShareKeyDelegation(input: ShareKeyDelegationInput): Promise
 type ShareGrantAccess = "view" | "edit";
 /** P2(a): a read-back key lives at most one hour. */
 declare const EDIT_SHARE_READER_MAX_LIFETIME_MS: number;
-type FetchFn$1 = (input: URL, init?: RequestInit) => Promise<Response>;
+type FetchFn$2 = (input: URL, init?: RequestInit) => Promise<Response>;
 /**
  * The share's one content key (I1): `xyz.tinycloud.share/shares/<shareId>/<file>`,
  * or, for `view` only, a TC-1428 version file
@@ -322,11 +332,14 @@ interface ShareGrantRequest {
      * exists and is `active` (a half-published share whose key was lost), and
      * grant a new key on it. Without it, `prepare` refuses an existing network
      * (`share-id-in-use`) before the prompt. A retired network is always
-     * refused.
+     * refused. After resuming, revoke the lost key's grant with an owner SIWE
+     * on its CID (`POST /revoke`; not a kill-all control, which would also
+     * retire this network): it stays live, with decrypt on this share, until
+     * revoked or expired.
      */
     readonly resumeExistingNetwork?: boolean;
     readonly keyFactory?: () => Promise<DelegatedShareKey>;
-    readonly fetch?: FetchFn$1;
+    readonly fetch?: FetchFn$2;
     readonly now?: () => number;
 }
 /** A per-share grant whose key exists but which the owner has not approved yet. Persist `row` first, then `approve()`. */
@@ -412,7 +425,7 @@ declare class ShareGrant {
         readonly record: ShareGrantRecord;
         readonly key: DelegatedShareKey;
         readonly now?: () => number;
-        readonly fetch?: FetchFn$1;
+        readonly fetch?: FetchFn$2;
     }): Promise<ShareGrant>;
     /**
      * This grant's CACAO as base64url, UNPADDED (the record form). As a Node
@@ -475,7 +488,7 @@ declare function revokeShareGrant(input: {
     readonly owner: {
         signOwnerRevocation(cid: string): Promise<string>;
     };
-    readonly fetch?: FetchFn$1;
+    readonly fetch?: FetchFn$2;
 }): Promise<{
     readonly network: "retired" | "absent";
     readonly grant: "revoked";
@@ -520,15 +533,17 @@ declare function perShareNetworkIdFor(ownerDid: string, shareId: string): string
  * production ingress (nginx 1.27.4, `large_client_header_buffers 4 32k`,
  * HTTP/1.1): 32,751 bytes pass, 32,752 bytes get `400 Request Header Or
  * Cookie Too Large`. A direct Node accepts ~483 KB and Cloudflare 128 KB.
- * 30,000 bytes leave 8.4% for header-name and proxy overhead. Each share
- * (network URN with `delegation/revoke` + `network.revoke`) costs ~845
- * bytes: 34 shares per control with the space rows (29,800 bytes measured
- * with the `applications` row, imported by the Node), 35 without.
+ * 30,000 bytes leave 8.4% for header-name and proxy overhead. A control's
+ * capacity depends on the shareId length; with the `applications` and
+ * `default` rows in every control: 33 shares for UUID shareIds, 34 for
+ * 32-hex ids, 37 for 16-character ids (34 UUID shares + the `applications`
+ * row alone measured 29,800 bytes, imported by the Node). L shares take
+ * ceil(L/n) controls, n from the plan.
  */
 declare const SHARE_CONTROL_HEADER_BUDGET_BYTES = 30000;
 /** A control lives ten minutes: long enough to retire and revoke one batch. */
 declare const SHARE_CONTROL_LIFETIME_MS: number;
-type FetchFn = (input: URL, init?: RequestInit) => Promise<Response>;
+type FetchFn$1 = (input: URL, init?: RequestInit) => Promise<Response>;
 /** The owner wallet, as a SIWE signer: one call = one approval. */
 interface ShareControlOwner {
     /** `did:pkh:eip155:<chain>:<address>`. */
@@ -617,9 +632,56 @@ declare function runShareControlBatch(input: {
     readonly revokeFallback?: {
         signOwnerRevocation(cid: string): Promise<string>;
     };
-    readonly fetch?: FetchFn;
+    readonly fetch?: FetchFn$1;
     readonly now?: () => number;
     readonly keyFactory?: () => Promise<DelegatedShareKey>;
 }): Promise<ShareControlResult>;
 
-export { AGENT_SHARE_ROOT_MAX_LIFETIME_MS, type DecodedOwnerRootCacao, EDIT_SHARE_READER_MAX_LIFETIME_MS, type EditShareReader, type PendingShareGrant, SHARE_CONTROL_HEADER_BUDGET_BYTES, SHARE_CONTROL_LIFETIME_MS, SHARE_NETWORK_NAME_PREFIX, SHARE_ROOT_CLOCK_SKEW_MS, SHARE_ROOT_LINK_MAX_LIFETIME_MS, SHARE_ROOT_MAX_LIFETIME_MS, SHARE_ROOT_PREFIX, SHARE_ROOT_REQUEST_MARGIN_MS, type ShareControlBatch, type ShareControlOwner, type ShareControlResult, type ShareControlTarget, ShareGrant, type ShareGrantAccess, type ShareGrantRecord, type ShareGrantRequest, type ShareGrantRow, type ShareGrantRowState, type ShareKeyDelegationInput, type ShareKeySigner, type SharePolicySigner, ShareRoot, ShareRootError, type ShareRootErrorCode, type ShareRootErrorDetails, type ShareRootKind, type ShareRootLink, type ShareRootOptions, type ShareRootOwnerAuthority, type ShareRootRecord, assertNetworkSafeShareId, assertNonExtractableShareKey, assertShareGrantPath, decodeOwnerRootCacao, ensureShareRoot, openEditShare, ownerRootCacaoCid, perShareNetworkIdFor, planShareControlBatches, revokeShareGrant, runShareControlBatch, signShareKeyDelegation };
+type FetchFn = (input: URL, init?: RequestInit) => Promise<Response>;
+/** A bearer link minted under a share root, in today's `/viewer#tc1=` shape. */
+interface RootBearerLink {
+    /** `https://<viewer>/viewer#tc1=<token>`: the token carries the link key and its delegation, as SharingService links do. */
+    readonly url: string;
+    readonly delegationCid: string;
+    readonly rootCid: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly expiresAt: Date;
+}
+/**
+ * Mint a view-only bearer link under a share root (TC-1423 D3, slice 3).
+ * Zero approvals: the share key signs `kv/get` on one exact key under the
+ * share prefix (`ShareRoot.signBearerLink`: never beyond the root, never
+ * more than 30 days, exactly `expiresAt` to the second), the Node imports it
+ * (`POST /delegate`), and the link is encoded exactly like a SharingService
+ * link: a fresh per-link Ed25519 key and its delegation in a `tc1:` token in
+ * the `/viewer` fragment, so viewers and `openNativeShare` read it unchanged.
+ *
+ * The per-link key travels in the fragment by design (anyone with the link
+ * holds it). Links need no decrypt (share roots never have it). Use
+ * `ensureShareRoot` first; a `delegation-revoked` or expired root fails here
+ * and needs a re-root (one approval).
+ */
+declare function publishRootBearerLink(input: {
+    readonly root: ShareRoot;
+    readonly path: string;
+    readonly expiresAt: Date;
+    readonly viewerOrigin: string;
+    readonly fetch?: FetchFn;
+}): Promise<RootBearerLink>;
+/**
+ * Revoke one bearer link with the share key that issued it (zero
+ * approvals): a share-key-signed `POST /revoke` on the link's delegation CID.
+ * Only a `{ revoked: true, cid }` receipt counts as done. The owner can
+ * always revoke the same CID with an owner SIWE (one approval).
+ */
+declare function revokeRootBearerLink(input: {
+    readonly root: ShareRoot;
+    readonly delegationCid: string;
+    readonly fetch?: FetchFn;
+}): Promise<{
+    readonly revoked: true;
+    readonly cid: string;
+}>;
+
+export { AGENT_SHARE_ROOT_MAX_LIFETIME_MS, type DecodedOwnerRootCacao, EDIT_SHARE_READER_MAX_LIFETIME_MS, type EditShareReader, type PendingShareGrant, type RootBearerLink, SHARE_CONTROL_HEADER_BUDGET_BYTES, SHARE_CONTROL_LIFETIME_MS, SHARE_NETWORK_NAME_PREFIX, SHARE_ROOT_CLOCK_SKEW_MS, SHARE_ROOT_LINK_MAX_LIFETIME_MS, SHARE_ROOT_MAX_LIFETIME_MS, SHARE_ROOT_PREFIX, SHARE_ROOT_REQUEST_MARGIN_MS, type ShareControlBatch, type ShareControlOwner, type ShareControlResult, type ShareControlTarget, ShareGrant, type ShareGrantAccess, type ShareGrantRecord, type ShareGrantRequest, type ShareGrantRow, type ShareGrantRowState, type ShareKeyDelegationInput, type ShareKeySigner, type SharePolicySigner, ShareRoot, ShareRootError, type ShareRootErrorCode, type ShareRootErrorDetails, type ShareRootKind, type ShareRootLink, type ShareRootOptions, type ShareRootOwnerAuthority, type ShareRootRecord, assertNetworkSafeShareId, assertNonExtractableShareKey, assertShareGrantPath, decodeOwnerRootCacao, ensureShareRoot, openEditShare, ownerRootCacaoCid, perShareNetworkIdFor, planShareControlBatches, publishRootBearerLink, revokeRootBearerLink, revokeShareGrant, runShareControlBatch, signShareKeyDelegation };

package/dist/share-root.js

@@ -6932,6 +6932,35 @@ var ShareRoot = class _ShareRoot {
   covers(expiresAt, now = this.#now()) {
     return this.#key !== void 0 && now < this.expiresAt.getTime() && expiresAt.getTime() <= this.expiresAt.getTime();
   }
+  /**
+   * Sign a 60-second `POST /revoke` invocation, by the share key, for one
+   * delegation this root issued (a bearer link). Zero approvals. The Node
+   * authorizes it because the share key is that delegation's delegator. The
+   * root itself is never revoked this way: only the owner does that.
+   */
+  async signLinkRevocation(input) {
+    const key = this.#activeKey();
+    if (typeof input.delegationCid !== "string" || !/^b[a-z2-7]+$/.test(input.delegationCid)) throw new ShareRootError("invalid-request", "delegation CID is invalid");
+    if (input.delegationCid === this.cid) throw new ShareRootError("invalid-request", "the share key does not revoke its own root; the owner does");
+    try {
+      ed25519PublicKeyFromDidKey(input.nodeDid);
+    } catch {
+      throw new ShareRootError("invalid-request", "node DID must be an Ed25519 did:key");
+    }
+    const now = seconds(this.#now());
+    const revocation = await signCompactUcanAuthorization({
+      issuerDid: key.did,
+      audienceDid: input.nodeDid,
+      attenuation: { [`urn:cid:${input.delegationCid}`]: { "tinycloud.delegation/revoke": [{}] } },
+      facts: [{}],
+      proofs: [],
+      notBefore: now,
+      expiresAt: now + 60,
+      nonce: `urn:uuid:${crypto.randomUUID()}`,
+      sign: (bytes2) => key.sign(bytes2)
+    });
+    return revocation.authorization;
+  }
   /**
    * Sign a bearer link: `kv/get` on one exact key under the prefix, to the
    * link's own key, with this root as its only proof. It never outlives the
@@ -7714,6 +7743,69 @@ async function runShareControlBatch(input) {
     key.clear();
   }
 }
+
+// src/share-root-link.ts
+import { ed25519 as ed255196 } from "@noble/curves/ed25519";
+
+// src/native.ts
+var NATIVE_SHARE_FRAGMENT_PARAMETER = "tc1";
+function canonicalViewerUrl(viewerOrigin) {
+  const url = new URL(viewerOrigin);
+  if (url.protocol !== "https:" || url.origin !== viewerOrigin || url.pathname !== "/" || url.search || url.hash) throw new TypeError("viewer origin must be a canonical HTTPS origin");
+  url.pathname = "/viewer";
+  return url;
+}
+
+// src/share-root-link.ts
+async function publishRootBearerLink(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const viewerUrl = canonicalViewerUrl(input.viewerOrigin);
+  const secret = ed255196.utils.randomPrivateKey();
+  try {
+    const publicKey = ed255196.getPublicKey(secret);
+    const linkDid = didKeyFromEd25519PublicKey(publicKey);
+    const link = await input.root.signBearerLink({ linkDid, path: input.path, expiresAt: input.expiresAt });
+    const response = await fetchFn(new URL("/delegate", input.root.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: link.delegation.authorization } });
+    if (!response.ok) throw new ShareRootError("node-refused", `the Node refused the link delegation: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`, { rootCid: input.root.cid });
+    const createdAt = /* @__PURE__ */ new Date();
+    const shareData = {
+      key: { kty: "OKP", crv: "Ed25519", x: toBase64Url(publicKey), d: toBase64Url(secret) },
+      keyDid: `${linkDid}#${linkDid.slice("did:key:".length)}`,
+      delegation: {
+        cid: link.delegation.cid,
+        delegateDID: linkDid,
+        delegatorDID: input.root.keyDid,
+        spaceId: input.root.spaceId,
+        path: input.path,
+        actions: ["tinycloud.kv/get"],
+        expiry: link.expiresAt,
+        isRevoked: false,
+        allowSubDelegation: true,
+        createdAt,
+        parentCid: input.root.cid,
+        authHeader: link.delegation.authorization
+      },
+      path: input.path,
+      host: input.root.nodeOrigin,
+      spaceId: input.root.spaceId,
+      version: 1
+    };
+    const token = `tc1:${toBase64Url(new TextEncoder().encode(JSON.stringify(shareData)))}`;
+    viewerUrl.hash = `${NATIVE_SHARE_FRAGMENT_PARAMETER}=${encodeURIComponent(token)}`;
+    return { url: viewerUrl.toString(), delegationCid: link.delegation.cid, rootCid: input.root.cid, spaceId: input.root.spaceId, path: input.path, expiresAt: link.expiresAt };
+  } finally {
+    secret.fill(0);
+  }
+}
+async function revokeRootBearerLink(input) {
+  const fetchFn = input.fetch ?? ((url, init) => globalThis.fetch(url, init));
+  const nodeDid = await nodeDidOf(input.root.nodeOrigin, fetchFn);
+  const authorization = await input.root.signLinkRevocation({ delegationCid: input.delegationCid, nodeDid });
+  const response = await fetchFn(new URL("/revoke", input.root.nodeOrigin), { method: "POST", redirect: "error", headers: { Authorization: authorization } });
+  if (!response.ok) throw new ShareRootError("node-refused", `the Node refused the link revocation: HTTP ${response.status} ${(await response.text()).slice(0, 120)}`, { rootCid: input.root.cid });
+  if (!await isRevokeReceiptFor(response, input.delegationCid)) throw new ShareRootError("invalid-request", "link revocation receipt does not confirm this delegation");
+  return { revoked: true, cid: input.delegationCid };
+}
 export {
   AGENT_SHARE_ROOT_MAX_LIFETIME_MS,
   EDIT_SHARE_READER_MAX_LIFETIME_MS,
@@ -7737,6 +7829,8 @@ export {
   ownerRootCacaoCid,
   perShareNetworkIdFor,
   planShareControlBatches,
+  publishRootBearerLink,
+  revokeRootBearerLink,
   revokeShareGrant,
   runShareControlBatch,
   signShareKeyDelegation