feat(spa): share artifacts from the library and the owner view page

[philmerrell]

What

Sharing an artifact was reachable only from the card inside the conversation that produced it. The library at /artifacts — the page whose whole premise is that artifacts outlive their chat — had no way to share one, and neither did the owner view page at /artifacts/:id.

Both surfaces now open the same ArtifactShareModalComponent the card opens, so there stays exactly one place in the app that knows what an artifact share is.

Surface	Where
Library — list rows	inside the existing @if (row.owned; as item) block
Library — grid cards	the ml-auto icon group, beside Rename/Delete
Owner view page	header, beside Download

Design notes

Owner-only, by structure rather than by check. In the library the control is gated on row.owned, so it never renders on a "Shared with you" row: a received artifact has no artifact id to share — the share id is the only handle you have on it — and re-sharing someone else's grant is not something this model supports.

The view page deliberately has no ownership check of its own. It resolves its artifact out of listLibrary(), which reads the caller's own DynamoDB partition, so an id that is not yours renders "Artifact not found" before the header exists at all. The boundary is the partition key; a comparison in the template would imply the guarantee lives in the UI. A test pins that the control is absent when nothing resolved.

Version semantics. Both surfaces show HEAD, so they pin HEAD's version — and shares are immutable, never following HEAD. The version therefore rides in each control's accessible name (Share Quarterly plan, version 4) as well as the dialog's caption, because the library prints a version badge only when it is > 1 and the control cannot rely on one being on screen.

The grid-footer regression this surfaced

Found in the browser, not by a test.

@max-[19rem] was tuned for four controls and fit with zero slack: at three columns on a 1280px window the container measures exactly 306px and the labelled row needed exactly 306px. Adding Share pushed the row to 326px while leaving the container 2px above the collapse threshold — so the labels stayed visible and the Delete icon was clipped.

Raised to @max-[21rem] (336px), which collapses them with 10px to spare. Attributed by measurement, not inference: hiding the Share button in the live DOM dropped the overflow from 20px back to 0. The labels still reappear at one column (36px / 90px), so they are hidden where they do not fit rather than removed — the failure mode where "the overlap is gone" because the content is gone.

The spec now pins 21rem with a comment saying it is a measured number and to re-measure before adding a sixth control.

Verification

Full SPA suite green: 268 files, 3363 tests. Six new tests; the version-label one was mutation-checked (removed the version from the template, confirmed it failed with the right message), since DOM-selector tests are the kind that can pass vacuously.

Verified live against real dev data (12 artifacts, one of them genuinely shared with this account):

• Grid and list both show Share on owned rows; the received row (Shared by philmerrell@udevelopment…) offers only Open.
• Zero footer overflow on every card in both views; list rows keep 344–425px between title and actions.
• The dialog opens captioned enrollment-report.js · version 1 and fires GET /artifacts/{id}/shares → 200, so the artifact id reaches the real backend correctly.
• View page header: 7 controls, zero overflow, aria-label="Share this artifact, version 1".
• Dark mode: resolves the same dark:text-gray-400 token as the Download and new-tab controls beside it.

No share link was actually created — a live link is outward-facing and this is a real dev account. The create path is the same dialog already validated live in #920.

Scope

Frontend only. No backend, API, or infra change — ArtifactShareService and every endpoint behind it already existed.

🤖 Generated with Claude Code