aimeat 2.7.0 → 3.1.0

package/dist/public/views/profile/memory-tab/backup.js

@@ -0,0 +1,77 @@
+/**
+ * @file views/profile/memory-tab/backup.js
+ * @description Export and import of a memory backup, as one hook. Extracted from memory-tab.js to
+ *   satisfy max-file-lines; behaviour unchanged.
+ * @structure
+ *   - useMemoryBackup({ selectedAgent, showToast, confirm, loadMemories }) — handleExport,
+ *     triggerImport, handleImportFile, and the import-mode + busy state the toolbar renders
+ * @usage
+ *   const backup = useMemoryBackup({ selectedAgent, showToast, confirm, loadMemories });
+ *   // spread into the render ctx
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Extracted from memory-tab.js (max-file-lines). Pure move.
+ */
+import { useState, useRef, useCallback } from 'preact/hooks';
+import { t } from '/js/i18n.js';
+import * as memoryService from '/js/services/memory.js';
+
+export function useMemoryBackup({ selectedAgent, showToast, confirm, loadMemories }) {
+  const [importMode, setImportMode] = useState('skip');
+  const [importing, setImporting] = useState(false);
+  const importFileRef = useRef(null);
+
+  const handleExport = useCallback(async (prefix) => {
+    try {
+      const data = await memoryService.exportMemory(selectedAgent || undefined, prefix || undefined);
+      const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement('a');
+      const stamp = new Date().toISOString().slice(0, 10);
+      a.href = url;
+      a.download = `aimeat-memory-${stamp}.json`;
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      URL.revokeObjectURL(url);
+      showToast((t('profile.memory.exportDone') || 'Exported {n} entries').replace('{n}', String(data.count ?? (data.entries || []).length)));
+    } catch (e) { showToast(e.message || t('profile.error'), true); }
+  }, [selectedAgent, showToast]);
+
+  const triggerImport = useCallback(() => { importFileRef.current?.click(); }, []);
+
+  // Import a JSON backup; the user picks a conflict mode (skip/overwrite/rename) before it runs.
+  const handleImportFile = useCallback(async (e) => {
+    const file = e.target.files?.[0];
+    e.target.value = '';   // allow re-picking the same file
+    if (!file) return;
+    let parsed;
+    try {
+      const text = await file.text();
+      parsed = JSON.parse(text);
+    } catch { showToast(t('profile.memory.importBadJson') || 'Not a valid JSON backup', true); return; }
+    const entries = Array.isArray(parsed) ? parsed : (Array.isArray(parsed?.entries) ? parsed.entries : null);
+    if (!entries || entries.length === 0) { showToast(t('profile.memory.importEmpty') || 'No entries found in file', true); return; }
+
+    const modeLabel = (m) => t('profile.memory.importMode.' + m) || m;
+    confirm(
+      (t('profile.memory.importConfirm') || 'Import {n} entries? Existing keys are handled by mode: {mode}.')
+        .replace('{n}', String(entries.length)).replace('{mode}', modeLabel(importMode)),
+      async () => {
+        setImporting(true);
+        try {
+          const resp = await memoryService.importMemory(entries, importMode, selectedAgent || undefined);
+          if (resp.ok === false) { showToast(resp.error?.message || t('profile.error'), true); return; }
+          const s = resp.data || {};
+          showToast((t('profile.memory.importDone') || 'Imported: {c} new, {u} updated, {s} skipped')
+            .replace('{c}', String(s.created || 0)).replace('{u}', String(s.updated || 0)).replace('{s}', String(s.skipped || 0))
+            + ((s.failed && s.failed.length) ? ` · ${s.failed.length} ${t('profile.error') || 'failed'}` : ''),
+            !!(s.failed && s.failed.length));
+          loadMemories();
+        } catch (err) { showToast(err.message || t('profile.error'), true); }
+        finally { setImporting(false); }
+      },
+    );
+  }, [importMode, selectedAgent, showToast, confirm, loadMemories]);
+
+  return { handleExport, triggerImport, handleImportFile, importMode, setImportMode, importing, importFileRef };
+}

package/dist/public/views/profile/memory-tab/browse-view.js

@@ -6,6 +6,9 @@
  *   take the shared ctx so all state/handlers still live in the MemoryTab component.
  * @version-history
  *   v1.0.0 — 2026-07-13 — Extracted from public/views/profile/memory-tab.js (max-file-lines)
+ *   v1.1.0 — 2026-08-08 — Copy labels now resolve from the shared common.copy / common.copied / common.copyPrompt /
+ *       common.copyLink / common.copyUrl keys; the per-view copy label keys this file used were
+ *       removed from both locales. Same words on screen.
  */
 import { h } from 'preact';
 import htm from 'htm';
@@ -207,7 +210,7 @@ export function renderBrowsePanel(ctx) {
                         <button class="btn-outline btn-sm"
                           disabled=${copyingKeys.has(entry.key)}
                           onClick=${(e) => { e.stopPropagation(); handleCopyEntry(ctx, entry.owner_gaii, entry.key); }}>
-                          ${copyingKeys.has(entry.key) ? '...' : t('profile.memory.discoverCopy')}
+                          ${copyingKeys.has(entry.key) ? '...' : t('common.copy')}
                         </button>
                       </div>
                       ${isExpanded && html`

package/dist/public/views/profile/memory-tab/components.js

@@ -5,6 +5,9 @@
  *   universal file preview modal, the drag-and-drop upload form, and the edit-memory modal.
  *   Extracted from memory-tab.js to satisfy max-file-lines.
  * @version-history
+ *   v1.1.0 — 2026-08-11 — The create form and the edit modal no longer offer "group" as a
+ *     visibility, and their group pickers are gone with it. A group is an audience, not a tier:
+ *     give the record the visibility it has for everyone else, then share the key space.
  *   v1.0.0 — 2026-07-13 — Extracted from public/views/profile/memory-tab.js (max-file-lines)
  */
 import { h } from 'preact';
@@ -154,43 +157,29 @@ export function CartTray({ cart, nodeUrl, orgs, onRemove, onClear, showToast })
     </div>`;
 }
 
-export function MemoryForm({ onSave, onCancel, groups }) {
+export function MemoryForm({ onSave, onCancel }) {
   const [key, setKey] = useState('');
   const [value, setValue] = useState('');
   const [vis, setVis] = useState('private');
   const [tags, setTags] = useState('');
-  const [groupId, setGroupId] = useState('');
   return html`
     <div class="create-form">
       <div class="form-row"><label>${t('profile.memory.keyLabel')}</label><input class="input-field" placeholder=${t('profile.memory.keyPlaceholder')} value=${key} onInput=${e => setKey(e.target.value)} /></div>
       <div class="form-row"><label>${t('profile.memory.valueLabel')}</label><textarea class="input-field" rows="3" placeholder=${t('profile.memory.valuePlaceholder')} value=${value} onInput=${e => setValue(e.target.value)}></textarea></div>
       <div class="form-row"><label>${t('profile.memory.visLabel')}</label>
         <select class="input-field" value=${vis} onChange=${e => setVis(e.target.value)}>
+          ${/* No "group" option: a group is an audience, not a visibility. Create the record with
+                the visibility it should have for everyone else, then share the key space with a
+                group from the row or from Access — one share covers the keys written after it. */''}
           <option value="private">${t('profile.memory.visPrivate')}</option>
           <option value="shared">${t('profile.memory.visShared')}</option>
-          <option value="group">${t('knowledge.visibility.group')}</option>
           <option value="members">${t('knowledge.visibility.members')}</option>
           <option value="public">${t('profile.memory.visPublic')}</option>
         </select>
       </div>
-      ${vis === 'group' && html`
-        <div class="form-row"><label>${t('profile.memory.selectGroup')}</label>
-          ${(groups || []).length === 0
-            ? html`
-              <div class="text-meta-sm mb-xs">${t('profile.memory.noGroups')}</div>
-              <button type="button" class="btn-outline btn-sm" onClick=${() => {
-                window.dispatchEvent(new CustomEvent('aimeat-open-tab', { detail: { tabId: 'access' } }));
-              }}>${t('profile.memory.createGroupBtn')}</button>`
-            : html`
-              <select class="input-field" value=${groupId} onChange=${e => setGroupId(e.target.value)}>
-                <option value="">-- ${t('profile.memory.selectGroup')} --</option>
-                ${(groups || []).map(g => html`<option value=${g.id}>${g.name}</option>`)}
-              </select>`}
-        </div>
-      `}
       <div class="form-row"><label>${t('profile.memory.tagsLabel')}</label><input class="input-field" placeholder=${t('profile.memory.tagsPlaceholder')} value=${tags} onInput=${e => setTags(e.target.value)} /></div>
       <div class="form-actions">
-        <button class="btn-primary" onClick=${() => { if (!key || !value) return; onSave(key, value, vis, tags, vis === 'group' ? groupId : undefined); }}>${t('profile.memory.saveBtn')}</button>
+        <button class="btn-primary" onClick=${() => { if (!key || !value) return; onSave(key, value, vis, tags, undefined); }}>${t('profile.memory.saveBtn')}</button>
         <button class="btn-outline" onClick=${onCancel}>${t('profile.memory.cancelBtn')}</button>
       </div>
     </div>`;
@@ -385,10 +374,9 @@ export function FileUploadForm({ onUpload, onCancel }) {
     </div>`;
 }
 
-export function EditMemoryModal({ memKey, initialValue, initialVisibility, initialVersion, isJson, onSave, onCancel, groups }) {
+export function EditMemoryModal({ memKey, initialValue, initialVisibility, initialVersion, isJson, onSave, onCancel }) {
   const [value, setValue] = useState(initialValue);
   const [vis, setVis] = useState(initialVisibility || 'private');
-  const [groupId, setGroupId] = useState('');
 
   // Broken JSON in a memory key crashes the agent that reads it — validate before save.
   // Validation applies when the stored value was an object, or the draft clearly is one.
@@ -397,42 +385,24 @@ export function EditMemoryModal({ memKey, initialValue, initialVisibility, initi
   if (looksJson) {
     try { JSON.parse(value); } catch (e) { jsonError = e.message; }
   }
-  const groupMissing = vis === 'group' && !groupId && (groups || []).length === 0;
-  const canSave = !jsonError && !(vis === 'group' && !groupId);
+  const canSave = !jsonError;
 
   return html`
     <${Modal} open=${true} onClose=${onCancel} title=${`${t('profile.memory.editTitle')}: ${memKey}`}>
         <div class="form-row flex-row mb-half">
           <label class="pf-label-inline">${t('profile.memory.visLabel')}</label>
-          <select class="input-field mem-vis-select" value=${vis}
-            onChange=${e => { setVis(e.target.value); if (e.target.value !== 'group') setGroupId(''); }}>
-            ${['private', 'owner', 'group', 'members', 'public'].map(v => html`<option key=${v} value=${v}>${t('knowledge.visibility.' + v)}</option>`)}
+          ${/* Same as the create form: a group is an audience, not a visibility. Sharing a key
+                space with one is done from the row's share panel or the Access tab. */''}
+          <select class="input-field mem-vis-select" value=${vis} onChange=${e => setVis(e.target.value)}>
+            ${['private', 'owner', 'members', 'public'].map(v => html`<option key=${v} value=${v}>${t('knowledge.visibility.' + v)}</option>`)}
           </select>
         </div>
-        ${vis === 'group' && html`
-          <div class="form-row mb-half">
-            <label>${t('profile.memory.selectGroup')}</label>
-            ${(groups || []).length === 0
-              ? html`
-                <div class="text-meta-sm mb-xs">${t('profile.memory.noGroups')}</div>
-                <button class="btn-outline btn-sm" onClick=${() => {
-                  onCancel();
-                  try { sessionStorage.setItem('aimeat.access.focus', 'groups'); } catch { /* noop */ }   // eslint-disable-line aimeat/no-silent-catch -- noop
-                  window.dispatchEvent(new CustomEvent('aimeat-open-tab', { detail: { tabId: 'access' } }));
-                }}>${t('profile.memory.createGroupBtn')}</button>`
-              : html`
-                <select class="input-field" value=${groupId} onChange=${e => setGroupId(e.target.value)}>
-                  <option value="">-- ${t('profile.memory.selectGroup')} --</option>
-                  ${(groups || []).map(g => html`<option value=${g.id}>${g.name}</option>`)}
-                </select>`}
-          </div>
-        `}
         <textarea class="input-field mem-edit-textarea ${jsonError ? 'mem-edit-textarea--error' : ''}" rows="14"
           value=${value} onInput=${e => setValue(e.target.value)}></textarea>
         ${jsonError && html`<div class="mem-json-error">${t('profile.memory.invalidJson')} — ${jsonError}</div>`}
         <div class="form-actions mt-1">
-          <button class="btn-primary" disabled=${!canSave || groupMissing}
-            onClick=${() => onSave(value, vis, initialVersion, vis === 'group' ? groupId : undefined)}>${t('profile.save')}</button>
+          <button class="btn-primary" disabled=${!canSave}
+            onClick=${() => onSave(value, vis, initialVersion, undefined)}>${t('profile.save')}</button>
           <button class="btn-outline" onClick=${onCancel}>${t('profile.cancel')}</button>
         </div>
     <//>`;

package/dist/public/views/profile/memory-tab/entries-view.js

@@ -5,6 +5,10 @@
  *   of memory rows with per-row visibility/rules/cart/federation controls. Extracted verbatim from
  *   memory-tab.js as a ctx-consuming plain render function (all state/handlers passed in via ctx).
  * @version-history
+ *   v1.1.0 — 2026-08-11 — Sharing left the visibility menu. A row shows a "shared · N" badge when a
+ *     key-space share covers its key (with the group names in the title), and the expanded row can
+ *     open a share panel pre-filled with the key's own space. Picking a group from a VISIBILITY
+ *     list shared exactly one record, which went stale the moment the next one was written.
  *   v1.0.0 — 2026-07-13 — Extracted from public/views/profile/memory-tab.js (max-file-lines)
  */
 import { h } from 'preact';
@@ -51,6 +55,8 @@ export function renderEntries(ctx) {
     searchResults, clearServerSearch, memArchived, setMemArchived, showMemForm, setShowMemForm,
     handleCreateMemory, bulkVis, setBulkVis, applyBulkVis, bulkDelete, collapsedGroups,
     toggleGroupCollapsed, groupLabel, orgNames, deleteGroup,
+    sharedWith, sharePanelFor, openSharePanel, setSharePanelFor, sharePattern, setSharePattern,
+    shareGroupId, setShareGroupId, submitShare,
   } = ctx;
 
   if (!memories) return html`<${Spinner} text=${t('profile.memory.loading')} />`;
@@ -106,6 +112,16 @@ export function renderEntries(ctx) {
         </span>
         <${VisibilityPill} visibility=${m.visibility || 'private'}
           onClick=${(e) => { e.stopPropagation(); setVisPopoverFor(visPopoverFor === m.key ? null : m.key); }} />
+        ${(() => {
+          // A key covered by a share reads as private in the pill above, because it IS private —
+          // the share is the exception on top. Saying so on the row is the only way the owner can
+          // see, while scanning, which of their records somebody else can also read.
+          const via = sharedWith(m.key);
+          return via.length > 0 && html`
+            <span class="badge badge-info" title=${t('profile.memory.shSharedWith').replace('{names}', via.map(g => g.name).join(', '))}>
+              ${t('profile.memory.shSharedBadge')} · ${via.length}
+            </span>`;
+        })()}
         ${keyHasRules(m.key) && html`<span class="shield-icon" title=${t('permissions.sharingRules')} onClick=${(e) => { e.stopPropagation(); loadKeyPerms(m.key); }}>\u{1F6E1}️</span>`}
         ${fedConsents[m.key] && html`<span class="badge badge-success pf-fed-badge">${t('profile.memory.syncedToFederation')}</span>`}
         <button class="mem-cart-btn ${inCart(memCartItem(m)) ? 'mem-cart-btn--on' : ''}"
@@ -118,15 +134,6 @@ export function renderEntries(ctx) {
             <button key=${v} class="mem-vis-opt ${(m.visibility || 'private') === v ? 'mem-vis-opt--current' : ''}"
               onClick=${() => applyVis(m, v)}>${t('knowledge.visibility.' + v)}</button>
           `)}
-          ${groups.length > 0
-            ? groups.map(grp => html`
-                <button key=${grp.id} class="mem-vis-opt ${m.visibility === 'group' && m.group_id === grp.id ? 'mem-vis-opt--current' : ''}"
-                  onClick=${() => applyVis(m, 'group', grp.id)}>${t('knowledge.visibility.group')}: ${escHtml(grp.name)}</button>
-              `)
-            : html`<button class="mem-vis-opt mem-vis-opt--dim" onClick=${() => {
-                try { sessionStorage.setItem('aimeat.access.focus', 'groups'); } catch { /* noop */ }   // eslint-disable-line aimeat/no-silent-catch -- noop
-                window.dispatchEvent(new CustomEvent('aimeat-open-tab', { detail: { tabId: 'access' } }));
-              }}>${t('profile.memory.createGroupBtn')}</button>`}
         </div>
       `}
       ${expandedMem === m.key && html`
@@ -153,7 +160,38 @@ export function renderEntries(ctx) {
             <button class="btn-outline btn-sm" onClick=${(e) => { e.stopPropagation(); if (keyRulesPopover?.key === m.key) setKeyRulesPopover(null); else loadKeyPerms(m.key); }}>
               \u{1F6E1}️ ${t('permissions.sharingRules')}
             </button>
+            <button class="btn-outline btn-sm" onClick=${(e) => { e.stopPropagation(); if (sharePanelFor === m.key) setSharePanelFor(null); else openSharePanel(m.key); }}>
+              ${t('profile.memory.shShareThis')}
+            </button>
           </div>
+          ${sharePanelFor === m.key && html`
+            <div class="key-rules-box" onClick=${(e) => e.stopPropagation()}>
+              ${groups.length === 0 ? html`
+                <div class="text-meta-sm mb-half">${t('profile.memory.shNoGroups')}</div>
+                <button class="btn-outline btn-sm" onClick=${() => {
+                  try { sessionStorage.setItem('aimeat.access.focus', 'groups'); } catch { /* noop */ }   // eslint-disable-line aimeat/no-silent-catch -- noop
+                  window.dispatchEvent(new CustomEvent('aimeat-open-tab', { detail: { tabId: 'access' } }));
+                }}>${t('profile.memory.createGroupBtn')}</button>
+              ` : html`
+                <div class="form-row">
+                  <label>${t('profile.access.shPattern')}</label>
+                  <input type="text" class="input-field input-sm" value=${sharePattern}
+                    onInput=${e => setSharePattern(e.target.value)} />
+                  <div class="text-meta-sm">${t('profile.access.shPatternHelp')}</div>
+                </div>
+                <div class="form-row">
+                  <label>${t('profile.memory.shPickGroup')}</label>
+                  <select class="input-field input-sm" value=${shareGroupId} onChange=${e => setShareGroupId(e.target.value)}>
+                    ${groups.map(g => html`<option key=${g.id} value=${g.id}>${g.name}</option>`)}
+                  </select>
+                </div>
+                <div class="form-actions">
+                  <button class="btn-primary btn-sm" onClick=${submitShare}>${t('profile.access.shCreate')}</button>
+                  <button class="btn-ghost btn-sm" onClick=${() => setSharePanelFor(null)}>${t('profile.access.shCancel')}</button>
+                </div>
+              `}
+            </div>
+          `}
           ${editingMemTags === m.key && html`
             <div class="mb-half">
               <${TagEditor} tags=${m.tags || []} onSave=${(tags) => handleUpdateMemoryTags(m.key, tags, m.version)} />
@@ -272,9 +310,11 @@ export function renderEntries(ctx) {
     ${selectedKeys.size > 0 && html`
       <div class="mem-bulkbar">
         <span class="mem-bulkbar-count">${(t('profile.memory.bulkSelected') || '{n} selected').replace('{n}', String(selectedKeys.size))}</span>
+        ${/* Sharing is not a visibility any more, so the bulk bar changes visibility only. Sharing
+              many keys at once is one share over a pattern that covers them, which is the Access
+              tab or the row's own share panel — not a per-record loop dressed up as a bulk edit. */''}
         <select class="input-field mem-vis-select" value=${bulkVis} onChange=${e => setBulkVis(e.target.value)}>
           ${VIS_OPTIONS.filter(v => v !== 'group').map(v => html`<option key=${v} value=${v}>${t('knowledge.visibility.' + v)}</option>`)}
-          ${groups.map(grp => html`<option key=${grp.id} value=${'group:' + grp.id}>${t('knowledge.visibility.group')}: ${grp.name}</option>`)}
         </select>
         <button class="btn-outline btn-sm" onClick=${applyBulkVis}>${t('profile.memory.bulkApply') || 'Change visibility'}</button>
         <button class="btn-outline btn-sm" onClick=${() => { addCartItems((memories || []).filter(m => selectedKeys.has(m.key)).map(memCartItem)); }}>🛒 ${t('profile.memory.cartAddSelected') || 'Add to collection'}</button>

package/dist/public/views/profile/memory-tab/file-helpers.js

@@ -9,6 +9,7 @@
  */
 import * as memoryService from '/js/services/memory.js';
 import { swallowed } from '/js/swallowed.js';
+import { authHeaders } from '/js/services/auth.js';
 
 export function fileIcon(type) {
   if (type?.startsWith('image')) return '\u{1F5BC}️';
@@ -56,11 +57,7 @@ export function categoryIcon(cat) {
 // Authenticated blob fetch — browser <img>/<video>/<a> can't attach the JWT, so private files
 // are fetched with the session token and shown from an object URL (the AuthImage pattern).
 export async function fetchFileBlob(url) {
-  const headers = /** @type {Record<string,string>} */ ({});
-  if (window.AIMEAT?.auth?.hasSession) {
-    const s = window.AIMEAT.auth.getSession();
-    if (s?.jwt) headers['Authorization'] = 'Bearer ' + s.jwt;
-  }
+  const headers = /** @type {Record<string,string>} */ ({ ...authHeaders() });
   const resp = await fetch(url, { headers });
   if (!resp.ok) throw new Error(String(resp.status));
   return resp.blob();

package/dist/public/views/profile/memory-tab/files-view.js

@@ -6,6 +6,9 @@
  *   memory-tab.js as a ctx-consuming plain render function (all state/handlers passed in via ctx).
  * @version-history
  *   v1.0.0 — 2026-07-13 — Extracted from public/views/profile/memory-tab.js (max-file-lines)
+ *   v1.1.0 — 2026-08-08 — Copy labels now resolve from the shared common.copy / common.copied / common.copyPrompt /
+ *       common.copyLink / common.copyUrl keys; the per-view copy label keys this file used were
+ *       removed from both locales. Same words on screen.
  */
 import { h } from 'preact';
 import htm from 'htm';
@@ -131,8 +134,8 @@ export function renderFilesList(ctx) {
                   <button class="btn-outline btn-sm" title=${t('profile.files.preview') || 'Preview'} onClick=${() => setPreviewFile(f)}>${'\u{1F441}️'} ${t('profile.files.preview') || 'Preview'}</button>
                   <${CopyButton}
                     text=${fileUrl(f)}
-                    label=${`\u{1F517} ${t('profile.files.copyUrl') || 'Copy URL'}`}
-                    title=${t('profile.files.copyUrl') || 'Copy URL'}
+                    label=${`\u{1F517} ${t('common.copyUrl') || 'Copy URL'}`}
+                    title=${t('common.copyUrl') || 'Copy URL'}
                     className="btn-outline btn-sm"
                     onCopied=${() => showToast(t('profile.files.urlCopied') || 'URL copied to clipboard')} />
                   <button class="btn-outline btn-sm" onClick=${() => handleDownloadFile(f)}>${t('profile.files.download')}</button>

package/dist/public/views/profile/memory-tab/sharing.js

@@ -0,0 +1,74 @@
+/**
+ * @file views/profile/memory-tab/sharing.js
+ * @description Key-space sharing for the Memory tab, as one hook. Extracted from memory-tab.js to
+ *   satisfy max-file-lines; behaviour unchanged.
+ *
+ *   Sharing is not a visibility tier. A record keeps the visibility it has for everyone else
+ *   (normally private) and a SHARE, held separately, lets a sharing group read a key PATTERN. That
+ *   is why the row no longer offers "group" in its visibility menu and offers "share this key
+ *   space" instead: picking a group from a visibility list shared exactly one record, which went
+ *   stale the moment the next one was written.
+ * @structure
+ *   - useKeySpaceSharing({ groups, showToast }) — the share list, the row badge lookup, and the
+ *     per-row share panel's state and submit
+ * @usage
+ *   const sharing = useKeySpaceSharing({ groups, showToast });
+ *   // spread into the render ctx; call sharing.loadShares() when the tab (re)loads
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Extracted from memory-tab.js (max-file-lines).
+ */
+import { useState, useCallback } from 'preact/hooks';
+import { t } from '/js/i18n.js';
+import { listOutgoing, createShare, suggestPattern, patternCoversKey } from '/js/services/shares.js';
+import { swallowed } from '/js/swallowed.js';
+
+export function useKeySpaceSharing({ groups, showToast }) {
+  const [shares, setShares] = useState([]);
+  const [sharePanelFor, setSharePanelFor] = useState(null);
+  const [sharePattern, setSharePattern] = useState('');
+  const [shareGroupId, setShareGroupId] = useState('');
+
+  /**
+   * Every share this owner holds, in ONE request rather than one per row. A listing of a thousand
+   * keys still costs a single call, and a row can then say "shared" without asking anything: the
+   * answer is a pattern match against a list already in hand.
+   */
+  const loadShares = useCallback(async () => {
+    try {
+      const resp = await listOutgoing();
+      setShares(resp?.data?.shares || []);
+    } catch (err) {
+      swallowed('memory-tab: loadShares', err);
+      setShares([]);
+    }
+  }, []);
+
+  /** The groups that can already read this key, via any share whose pattern covers it. */
+  const sharedWith = useCallback((key) => {
+    const ids = new Set(shares.filter(s => patternCoversKey(s.key_pattern, key)).map(s => s.group_id));
+    return groups.filter(g => ids.has(g.id));
+  }, [shares, groups]);
+
+  const openSharePanel = useCallback((key) => {
+    setSharePanelFor(key);
+    setSharePattern(suggestPattern(key));
+    setShareGroupId(groups[0]?.id || '');
+  }, [groups]);
+
+  const submitShare = useCallback(async () => {
+    if (!shareGroupId || !sharePattern.trim()) return;
+    try {
+      await createShare(shareGroupId, { key_pattern: sharePattern.trim() });
+      showToast(t('profile.access.shCreated'));
+      setSharePanelFor(null);
+      loadShares();
+    } catch (e) {
+      showToast(e.message || t('profile.access.shCreateError'), true);
+    }
+  }, [shareGroupId, sharePattern, showToast, loadShares]);
+
+  return {
+    loadShares, sharedWith, submitShare, openSharePanel,
+    sharePanelFor, setSharePanelFor, sharePattern, setSharePattern, shareGroupId, setShareGroupId,
+  };
+}

package/dist/public/views/profile/memory-tab.js

@@ -3,6 +3,8 @@
  * @description Profile tab for memory entries and file management — CRUD, search,
  *   visibility cycling, tag editing, sharing rules, and file upload with drag-and-drop.
  * @version-history
+ *   v2.9.0 — 2026-08-11 — Key-space sharing (./memory-tab/sharing.js): rows show which of them a
+ *     group can read and offer "share this key space"; the visibility menus dropped "group".
  *   v2.8.0 — 2026-07-31 — File upload goes through the PRESIGNED path (mint URL, raw PUT) instead of
  *     base64-in-JSON, which capped uploads at ~3.7 MB with a bare 413 regardless of the node's
  *     configured 50 MB. Upload failures now surface their reason instead of "Upload failed".
@@ -88,6 +90,8 @@ import { listAgents } from '/js/services/agents.js';
 import { getKeyPermissions, listConsents, grantConsent, revokeConsent } from '/js/services/consent.js';
 import { getNodeUrl } from '/js/services/auth.js';
 import { listGroups } from '/js/services/sharing-groups.js';
+import { useKeySpaceSharing } from './memory-tab/sharing.js';
+import { useMemoryBackup } from './memory-tab/backup.js';
 import { listOrganisms, currentGhii } from '/js/services/organisms.js';
 import { useConfirm } from '/components/Modal.js';
 import { shortTok } from './memory-tab/helpers.js';
@@ -154,8 +158,6 @@ export default function MemoryTab({ session, showToast, onStats }) {
   const [searchResults, setSearchResults] = useState(null);  // null = not searching; array = results
   const [searchScopePrefix, setSearchScopePrefix] = useState('');  // optional namespace/group scope
   const [searchLoading, setSearchLoading] = useState(false);
-  const [importMode, setImportMode] = useState('skip');   // skip | overwrite | rename
-  const [importing, setImporting] = useState(false);
   const [discoverEntries, setDiscoverEntries] = useState(null);
   const [discoverLoading, setDiscoverLoading] = useState(false);
   const [discoverError, setDiscoverError] = useState(null);
@@ -310,7 +312,7 @@ export default function MemoryTab({ session, showToast, onStats }) {
   // (dynamic) memory re-fetches on agent/archived change; on failure we fall back to the six loaders.
   async function loadTab() {
     const ov = await apiGet('/v1/memory/tab').then(r => r?.data).catch(err => { swallowed('memory-tab: loadTab', err); return null; });
-    if (!ov) { loadAgents(); loadMemories(); loadFiles(); loadFedConsents(); loadGroups(); loadOrgNames(); return; }
+    if (!ov) { loadAgents(); loadMemories(); loadFiles(); loadFedConsents(); loadGroups(); loadShares(); loadOrgNames(); return; }
     setAgents(Array.isArray(ov.agents) ? ov.agents : []);
     // memory (metadata-only default view — mirrors loadMemories meta path)
     const items = ov.memory?.items || [];
@@ -334,6 +336,9 @@ export default function MemoryTab({ session, showToast, onStats }) {
     setAllConsents(consents.filter(c => !c.status || c.status === 'active'));
     // sharing groups
     setGroups(ov.groups?.groups || []);
+    // Key-space shares are not in the composite (it predates them), so they cost one extra request
+    // rather than a stale "shared" badge on every row.
+    loadShares();
     // organism names (mirrors loadOrgNames)
     const orgs = ov.organisms?.organisms || [];
     const nameMap = {};
@@ -422,58 +427,9 @@ export default function MemoryTab({ session, showToast, onStats }) {
   }
 
   // Export all (or a prefix) of the caller's memory as a downloaded JSON backup.
-  async function handleExport(prefix) {
-    try {
-      const data = await memoryService.exportMemory(selectedAgent || undefined, prefix || undefined);
-      const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
-      const url = URL.createObjectURL(blob);
-      const a = document.createElement('a');
-      const stamp = new Date().toISOString().slice(0, 10);
-      a.href = url;
-      a.download = `aimeat-memory-${stamp}.json`;
-      document.body.appendChild(a);
-      a.click();
-      a.remove();
-      URL.revokeObjectURL(url);
-      showToast((t('profile.memory.exportDone') || 'Exported {n} entries').replace('{n}', String(data.count ?? (data.entries || []).length)));
-    } catch (e) { showToast(e.message || t('profile.error'), true); }
-  }
-
-  // Import a JSON backup; the user picks a conflict mode (skip/overwrite/rename) before it runs.
-  const importFileRef = useRef(null);
-  function triggerImport() { importFileRef.current?.click(); }
-  async function handleImportFile(e) {
-    const file = e.target.files?.[0];
-    e.target.value = '';   // allow re-picking the same file
-    if (!file) return;
-    let parsed;
-    try {
-      const text = await file.text();
-      parsed = JSON.parse(text);
-    } catch { showToast(t('profile.memory.importBadJson') || 'Not a valid JSON backup', true); return; }
-    const entries = Array.isArray(parsed) ? parsed : (Array.isArray(parsed?.entries) ? parsed.entries : null);
-    if (!entries || entries.length === 0) { showToast(t('profile.memory.importEmpty') || 'No entries found in file', true); return; }
-
-    const modeLabel = (m) => t('profile.memory.importMode.' + m) || m;
-    confirm(
-      (t('profile.memory.importConfirm') || 'Import {n} entries? Existing keys are handled by mode: {mode}.')
-        .replace('{n}', String(entries.length)).replace('{mode}', modeLabel(importMode)),
-      async () => {
-        setImporting(true);
-        try {
-          const resp = await memoryService.importMemory(entries, importMode, selectedAgent || undefined);
-          if (resp.ok === false) { showToast(resp.error?.message || t('profile.error'), true); return; }
-          const s = resp.data || {};
-          showToast((t('profile.memory.importDone') || 'Imported: {c} new, {u} updated, {s} skipped')
-            .replace('{c}', String(s.created || 0)).replace('{u}', String(s.updated || 0)).replace('{s}', String(s.skipped || 0))
-            + ((s.failed && s.failed.length) ? ` · ${s.failed.length} ${t('profile.error') || 'failed'}` : ''),
-            !!(s.failed && s.failed.length));
-          loadMemories();
-        } catch (e) { showToast(e.message || t('profile.error'), true); }
-        finally { setImporting(false); }
-      },
-    );
-  }
+  // Backup export/import lives in ./memory-tab/backup.js (max-file-lines). Same behaviour, and
+  // it needs loadMemories, so it is created after that function exists.
+  const backup = useMemoryBackup({ selectedAgent, showToast, confirm, loadMemories });
 
   // Delete a whole namespace/group at once (server-side bulk-delete by prefix).
   function deleteGroup(g, count) {
@@ -612,6 +568,11 @@ export default function MemoryTab({ session, showToast, onStats }) {
     loadMemories();
   }
 
+  // Key-space sharing: the share list, the row badge lookup and the per-row panel, in one hook
+  // (./memory-tab/sharing.js). A group is an audience; a share is what it reaches.
+  const sharing = useKeySpaceSharing({ groups, showToast });
+  const { loadShares } = sharing;
+
   // Bulk edit: checkbox-select rows, then change visibility (or delete) for all at once.
   const [selectedKeys, setSelectedKeys] = useState(new Set());
   const [bulkVis, setBulkVis] = useState('private');
@@ -716,9 +677,10 @@ export default function MemoryTab({ session, showToast, onStats }) {
     expandedMem, setExpandedMem, ensureValue, selectedKeys, toggleSelected, setSelectedKeys, visPopoverFor,
     setVisPopoverFor, keyHasRules, loadKeyPerms, fedConsents, inCart, memCartItem, fileCartItem, toggleCartItem,
     addCartItems, applyVis, groups, handleQuickVis, fullLoaded, loadingValueKeys, editingMemTags, setEditingMemTags,
+    ...sharing,
     keyRulesPopover, setKeyRulesPopover, handleUpdateMemoryTags, setEditModal, togglingFed, handleStopSharing,
-    handleShareToFederation, doPull, doPush, handleDeleteMemory, memQuota, loadFullContents, handleExport, importing,
-    triggerImport, importMode, setImportMode, importFileRef, handleImportFile, searchInput, setSearchInput,
+    handleShareToFederation, doPull, doPush, handleDeleteMemory, memQuota, loadFullContents,
+    ...backup, searchInput, setSearchInput,
     runServerSearch, searchScopePrefix, setSearchScopePrefix, searchLoading, searchResults, clearServerSearch,
     memArchived, setMemArchived, showMemForm, setShowMemForm, handleCreateMemory, bulkVis, setBulkVis, applyBulkVis,
     bulkDelete, collapsedGroups, toggleGroupCollapsed, groupLabel, orgNames, deleteGroup,

package/dist/public/views/profile/nodes-tab.js

@@ -10,6 +10,8 @@
  *   v1.3.0 — 2026-06-02 — Component unification (#11): node status dot uses
  *     canonical <StatusDot> (online/offline/degraded/detached) instead of the
  *     bespoke 10px .pn-status-dot (now 8px, with title tooltip added).
+ *   v1.4.0 — 2026-08-08 — The tunnel-URL copy button is btn-ghost btn-sm btn-copy-inline with the shared default
+ *       labels; .pn-copy-btn and the profile.nodes.copyUrl/copied keys are gone.
  */
 import { h } from 'preact';
 import { useState, useEffect, useRef } from 'preact/hooks';
@@ -132,7 +134,8 @@ function NodesList({ session, showToast, onStats }) {
                     <span class="pn-detail-label">${t('profile.nodes.tunnelUrl')}</span>
                     <span class="pn-detail-value flex-row">
                       <code class="text-meta-sm">${tunnelUrl}</code>
-                      <${CopyButton} text=${tunnelUrl} label=${t('profile.nodes.copyUrl')} className="pn-copy-btn" onCopied=${() => showToast(t('profile.nodes.copied'))} />
+                      <${CopyButton} text=${tunnelUrl} className="btn-ghost btn-sm btn-copy-inline"
+                        onCopied=${() => showToast(t('common.copied'))} />
                     </span>
                   </div>
                   <div class="pn-padding-half">

package/dist/public/views/profile/notifications-tab.js

@@ -14,6 +14,7 @@ import { t } from '/js/i18n.js';
 import { Spinner, ToggleSwitch, GlassCard } from './shared.js';
 import { apiGet, apiPost, apiDelete } from '/js/api.js';
 import { swallowed } from '/js/swallowed.js';
+import { getNodeId } from '/js/services/auth.js';
 
 export default function NotificationsTab({ session, showToast }) {
   const [loading, setLoading] = useState(true);
@@ -53,7 +54,7 @@ export default function NotificationsTab({ session, showToast }) {
     } catch (err) { swallowed('notifications-tab: NotificationsTab', err); }
     // Check email verification status
     try {
-      const ghii = session.ghii || `${session.owner}@${window.AIMEAT?.auth?.nodeId || ''}`;
+      const ghii = session.ghii || `${session.owner}@${getNodeId()}`;
       const ghiiRes = await apiGet(`/v1/ghii/${encodeURIComponent(ghii)}`);
       if (ghiiRes.data?.verification_level >= 1) {
         setEmailVerified(true);

package/dist/public/views/profile/organisms/helpers.js

@@ -13,6 +13,7 @@
  */
 import { t, getLocale } from '/js/i18n.js';
 import { swallowed } from '/js/swallowed.js';
+import { authHeaders } from '/js/services/auth.js';
 
 /** Date-only, formatted in the APP locale (browser locale may differ — fi must show 10.6.2026, not 6/10/2026).
  * @param {string} s ISO date string
@@ -52,8 +53,7 @@ export function orgInitials(name) {
  * @returns {Promise<void>} */
 export async function exportOrganismZip(org, showToast) {
   try {
-    const jwt = window.AIMEAT?.auth?.getSession?.()?.jwt || '';
-    const res = await fetch(`/v1/organisms/${encodeURIComponent(org.id)}/export`, { headers: { Authorization: 'Bearer ' + jwt } });
+    const res = await fetch(`/v1/organisms/${encodeURIComponent(org.id)}/export`, { headers: authHeaders() });
     if (!res.ok) {
       // Surface the server's reason (e.g. an access denial) instead of a bare "Export failed".
       const detail = await res.json().then(j => j?.error?.message).catch(err => { swallowed('helpers: exportOrganismZip', err); return null; });