@@ -0,0 +1,15 @@
+---
+'@objectstack/plugin-sharing': patch
+'@objectstack/runtime': patch
+---
+
+fix(plugin-sharing, runtime): a share link limited to an email allowlist answers every caller it does not open for with `404 INVALID_OR_EXPIRED`, whatever email and password were sent
+
+Clause-②: no — every request refused before is still refused, and every request served before is still served; only which refusal code a caller reads changes.
+
+A share link can carry a password and the `email` audience together. For such a link, the share-link resolve door answered a caller it did not open for from the password, never the audience: `401 NEEDS_PASSWORD` with no password, and `401 WRONG_PASSWORD` with any password, the correct one included, when the email sent was missing or not on the allowlist. A caller with the right password read "Incorrect password".
+
+- **An `email` link, any caller it does not open for:** `404 INVALID_OR_EXPIRED`, with or without an email, with no password, a wrong one or the correct one, signed in or not. It is the answer a password-less `email` link already gave and an unknown token gives, so it tells the caller neither whether the email is on the allowlist, nor whether the password is right, nor whether the link has a password. The door does not read the email to choose its answer.
+- **Served, unchanged:** an allowlisted email with the correct password (or, on a link without a password, an allowlisted email alone) still opens the record. An API or SDK caller sends both together; the door no longer prompts for the password first.
+- **Unchanged:** links with any other audience, including the `signed_in` order (`401 SIGN_IN_REQUIRED` before sign-in, the password arms after), a `public` link's `NEEDS_PASSWORD` / `WRONG_PASSWORD`, and the expired-or-revoked `410 EXPIRED_OR_REVOKED`.
+- Both mounts of the resolve door answer alike: plugin-sharing's share-link routes and the runtime dispatcher's share-links domain.
@@ -463,6 +463,22 @@ export function registerShareLinkRoutes(
           if (row.audience === 'signed_in' && !signedInUserId) {
             return sendError(res, 401, 'SIGN_IN_REQUIRED', 'Please sign in to view this link');
           }
+          // [#23372] An `email` audience is judged before the password too, and
+          // its refusal is the generic one, for every caller the link did not
+          // resolve for. Its satisfaction is the caller's own `?email=` claim,
+          // not a verified identity, and this probe deliberately never reads
+          // it: an answer that differed for an allowlisted email — a password
+          // prompt for it, the generic refusal for any other — would let
+          // anyone holding the token test addresses against the allowlist.
+          // Nor may the password arm below answer: `resolveToken` refuses the
+          // audience before it verifies any password, so that arm knows only
+          // whether one was SENT, and told the holder of the CORRECT password
+          // `WRONG_PASSWORD`. So the caller reads what a password-less `email`
+          // link and an unknown token answer, whatever email and password it
+          // sent, signed in or not; only the record itself — an allowlisted
+          // email AND the right password — differs. Same arm in the dispatcher
+          // twin, held to this order by the same table.
+          if (row.audience === 'email') return invalidOrExpired();
           // [#21197] `password_hash` is `internal`, so the probe row comes back
           // without it; read off the row, every protected link would answer
           // "invalid" here instead of prompting for its password. Recovered
 
@@ -32,6 +32,23 @@
  * the password arms to an anonymous caller, an unprotected `public` link
  * still serves, and a revoked link still answers the 410 whoever asks.
  *
+ * ## The email audience (#23372)
+ *
+ * For a live link whose audience is `email`, every caller the link does not
+ * resolve for is answered `404 INVALID_OR_EXPIRED` — whatever email and
+ * whatever password it sent, signed in or not. The email is the caller's own
+ * claim (`?email=`), never a verified identity, so the probe may not answer
+ * by it: an allowlisted email with a wrong password that read differently
+ * from an off-list email would let anyone holding the token test addresses
+ * against the allowlist. Nor may it answer from the password: `resolveToken`
+ * refuses the audience before it verifies any password, so the password arm
+ * could only report whether one was SENT — `WRONG_PASSWORD` for the correct
+ * one. The refusal is the one a password-less `email` link already answered
+ * and an unknown token answers, so it tells the holder neither whether the
+ * email is on the list, nor whether the password is right, nor whether the
+ * link has one. Only the record itself — an allowlisted email AND the right
+ * password — differs.
+ *
  * ## What is real here
  *
  * Both mounts' production entries over ONE `ObjectQL` on
@@ -61,11 +78,13 @@ const RECORD = 'doc_1';
 const VIEWER = 'usr_viewer';
 const PASSWORD = 'correct horse 23328';
 const WRONG = 'not the password 23328';
+const RECIPIENT = 'recipient-23372@example.test';
+const STRANGER = 'stranger-23372@example.test';
 
 const TARGET = {
   name: OBJECT,
   label: 'Refusal Doc',
-  publicSharing: { enabled: true, allowedAudiences: ['public', 'signed_in'], allowedPermissions: ['view'] },
+  publicSharing: { enabled: true, allowedAudiences: ['public', 'signed_in', 'email'], allowedPermissions: ['view'] },
   fields: {
     id: { name: 'id', label: 'ID', type: 'text', primaryKey: true },
     title: { name: 'title', label: 'Title', type: 'text' },
@@ -75,7 +94,15 @@ const TARGET = {
 type Mount = 'plugin route' | 'dispatcher twin';
 type Caller = 'anonymous' | 'signed in';
 type Presented = 'no password' | 'a wrong password' | 'the correct password';
-type LinkKey = 'signed_in + password' | 'public + password' | 'public' | 'revoked signed_in + password';
+type Email = 'no email' | 'an off-list email' | 'an allowlisted email';
+type LinkKey =
+  | 'signed_in + password'
+  | 'public + password'
+  | 'public'
+  | 'revoked signed_in + password'
+  | 'email + password'
+  | 'email'
+  | 'unknown token';
 type Answer = { status: number; body: any; headers: Record<string, string> };
 
 const MOUNTS: readonly Mount[] = ['plugin route', 'dispatcher twin'];
@@ -84,6 +111,12 @@ const PRESENTED: Record<Presented, string | undefined> = {
   'a wrong password': WRONG,
   'the correct password': PASSWORD,
 };
+/** The `?email=` query parameter, as an API or SDK caller sends it. */
+const EMAILS: Record<Email, string | undefined> = {
+  'no email': undefined,
+  'an off-list email': STRANGER,
+  'an allowlisted email': RECIPIENT,
+};
 
 /** The dispatcher's REAL thrown-error mapper, as the sibling suites borrow it. */
 const realErrorFromThrown = (() => {
@@ -123,7 +156,7 @@ const CALLERS: Record<Caller, ExecutionContext> = {
 
 let engine: ObjectQL;
 const tokens = {} as Record<LinkKey, string>;
-let open: (mount: Mount, link: LinkKey, caller: Caller, presented: Presented) => Promise<Answer>;
+let open: (mount: Mount, link: LinkKey, caller: Caller, presented: Presented, email?: Email) => Promise<Answer>;
 
 beforeAll(async () => {
   engine = new ObjectQL();
@@ -138,14 +171,27 @@ beforeAll(async () => {
 
   const svc = new ShareLinkService({ engine: engine as any });
   const creator = { isSystem: true, userId: 'usr_creator' } as any;
-  const mint = async (audience: 'public' | 'signed_in', password?: string) =>
-    svc.createLink({ object: OBJECT, recordId: RECORD, audience, ...(password ? { password } : {}) }, creator);
+  const mint = async (audience: 'public' | 'signed_in' | 'email', password?: string) =>
+    svc.createLink(
+      {
+        object: OBJECT,
+        recordId: RECORD,
+        audience,
+        ...(password ? { password } : {}),
+        ...(audience === 'email' ? { emailAllowlist: [RECIPIENT] } : {}),
+      },
+      creator,
+    );
   tokens['signed_in + password'] = (await mint('signed_in', PASSWORD)).token;
   tokens['public + password'] = (await mint('public', PASSWORD)).token;
   tokens.public = (await mint('public')).token;
   const revoked = await mint('signed_in', PASSWORD);
   await svc.revokeLink(revoked.id, creator);
   tokens['revoked signed_in + password'] = revoked.token;
+  tokens['email + password'] = (await mint('email', PASSWORD)).token;
+  tokens.email = (await mint('email')).token;
+  // Long enough to reach the row lookup; no row carries it.
+  tokens['unknown token'] = 'never-minted-token-23372';
 
   // The plugin mount, once per caller: the family door resolves the caller
   // through `contextFromRequest`, exactly as production wires it.
@@ -159,12 +205,14 @@ beforeAll(async () => {
   }
   const deps = makeDeps(engine, svc);
 
-  open = async (mount, link, caller, presented) => {
+  open = async (mount, link, caller, presented, email = 'no email') => {
     const token = tokens[link];
     const password = PRESENTED[presented];
     const headers: Record<string, string> = password === undefined ? {} : { 'x-share-password': password };
+    const address = EMAILS[email];
+    const query: Record<string, string> = address === undefined ? {} : { email: address };
     if (mount === 'dispatcher twin') {
-      const res = await handleShareLinksRequest(deps, `/${token}/resolve`, 'GET', undefined, {}, {
+      const res = await handleShareLinksRequest(deps, `/${token}/resolve`, 'GET', undefined, query, {
         executionContext: CALLERS[caller],
         request: { headers },
       } as unknown as HttpProtocolContext);
@@ -181,7 +229,7 @@ beforeAll(async () => {
     };
     const req: IHttpRequest = {
       params: { token },
-      query: {},
+      query,
       body: undefined,
       headers,
       method: 'GET',
@@ -203,6 +251,8 @@ afterAll(async () => {
 interface Row {
   link: LinkKey;
   caller: Caller;
+  /** The `?email=` sent; `no email` when the row leaves it out. */
+  email?: Email;
   presented: Presented;
   status: number;
   /** The refusal's `error.code`; absent on a row that serves the record. */
@@ -228,11 +278,37 @@ const TABLE: readonly Row[] = [
   // Control: the 410 arm is not reordered — a revoked link answers it whoever asks.
   { link: 'revoked signed_in + password', caller: 'anonymous', presented: 'the correct password', status: 410, code: 'EXPIRED_OR_REVOKED' },
   { link: 'revoked signed_in + password', caller: 'signed in', presented: 'the correct password', status: 410, code: 'EXPIRED_OR_REVOKED' },
+  // [#23372] A password AND audience `email`: until the link resolves, one
+  // refusal, whatever email and whatever password were sent.
+  { link: 'email + password', caller: 'anonymous', email: 'no email', presented: 'no password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'no email', presented: 'a wrong password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'no email', presented: 'the correct password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'an off-list email', presented: 'no password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'an off-list email', presented: 'a wrong password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'an off-list email', presented: 'the correct password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'an allowlisted email', presented: 'no password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'an allowlisted email', presented: 'a wrong password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'anonymous', email: 'an allowlisted email', presented: 'the correct password', status: 200 },
+  // Sign-in neither satisfies an `email` audience nor changes its refusal.
+  { link: 'email + password', caller: 'signed in', email: 'an off-list email', presented: 'the correct password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'signed in', email: 'an allowlisted email', presented: 'a wrong password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email + password', caller: 'signed in', email: 'an allowlisted email', presented: 'the correct password', status: 200 },
+  // Control: a password-less `email` link refuses an off-list email the same
+  // way, and serves an allowlisted one.
+  { link: 'email', caller: 'anonymous', email: 'an off-list email', presented: 'no password', status: 404, code: 'INVALID_OR_EXPIRED' },
+  { link: 'email', caller: 'anonymous', email: 'an allowlisted email', presented: 'no password', status: 200 },
 ];
 
+/** Every row names the email it sent, so each title reads the whole request. */
+const ROWS: readonly (Row & { email: Email })[] = TABLE.map((row) => ({ email: 'no email' as const, ...row }));
+
+const CALLER_KEYS = Object.keys(CALLERS) as Caller[];
+const EMAIL_KEYS = Object.keys(EMAILS) as Email[];
+const PRESENTED_KEYS = Object.keys(PRESENTED) as Presented[];
+
 describe.each(MOUNTS)('[#23328] share-link resolve refusal order — the %s', (mount) => {
-  it.each(TABLE)('$link, $caller, $presented → $status $code', async (row) => {
-    const answer = await open(mount, row.link, row.caller, row.presented);
+  it.each(ROWS)('$link, $caller, $email, $presented → $status $code', async (row) => {
+    const answer = await open(mount, row.link, row.caller, row.presented, row.email);
     const label = `${mount}: ${JSON.stringify(answer.body)}`;
     expect(answer.status, label).toBe(row.status);
     if (row.code) {
@@ -251,4 +327,44 @@ describe.each(MOUNTS)('[#23328] share-link resolve refusal order — the %s', (m
     expect(correct, 'the correct password against a wrong one').toEqual(wrong);
     expect(correct, 'the correct password against none').toEqual(none);
   });
+
+  // [#23372] The email audience. Each pin compares whole answers — status,
+  // envelope and headers — against one reference, so any difference a caller
+  // could read is a difference here.
+  it('[#23372] email audience, no password oracle: no email or an off-list email reads one answer whatever password was sent', async () => {
+    const reference = await open(mount, 'email + password', 'anonymous', 'no password', 'no email');
+    for (const caller of CALLER_KEYS) {
+      for (const email of ['no email', 'an off-list email'] as const) {
+        for (const presented of PRESENTED_KEYS) {
+          const answer = await open(mount, 'email + password', caller, presented, email);
+          expect(answer, `${caller}, ${email}, ${presented}`).toEqual(reference);
+        }
+      }
+    }
+  });
+
+  it('[#23372] email audience, no allowlist-membership oracle: an allowlisted email without the right password reads what an off-list email reads', async () => {
+    for (const caller of CALLER_KEYS) {
+      for (const presented of ['no password', 'a wrong password'] as const) {
+        const offList = await open(mount, 'email + password', caller, presented, 'an off-list email');
+        const allowlisted = await open(mount, 'email + password', caller, presented, 'an allowlisted email');
+        expect(allowlisted, `${caller}, ${presented}`).toEqual(offList);
+      }
+    }
+  });
+
+  it('[#23372] email audience: the refusal is the one an unknown token and a password-less email link answer', async () => {
+    const unknown = await open(mount, 'unknown token', 'anonymous', 'no password');
+    const passwordless = await open(mount, 'email', 'anonymous', 'no password', 'an off-list email');
+    expect(passwordless, 'a password-less email link against an unknown token').toEqual(unknown);
+    for (const caller of CALLER_KEYS) {
+      for (const email of EMAIL_KEYS) {
+        for (const presented of PRESENTED_KEYS) {
+          if (email === 'an allowlisted email' && presented === 'the correct password') continue; // served
+          const answer = await open(mount, 'email + password', caller, presented, email);
+          expect(answer, `${caller}, ${email}, ${presented}`).toEqual(unknown);
+        }
+      }
+    }
+  });
 });
@@ -323,6 +323,21 @@ async function handleShareLinksRequestBody(
                 if (live && row.audience === 'signed_in' && !signedInUserId) {
                     return sendErr(401, 'SIGN_IN_REQUIRED', 'Please sign in to view this link');
                 }
+                // [#23372] An `email` audience is judged before the password
+                // too, and its refusal is the generic one, for every caller the
+                // link did not resolve for. Its satisfaction is the caller's
+                // own `?email=` claim, not a verified identity, and this probe
+                // deliberately never reads it: an answer that differed for an
+                // allowlisted email would let anyone holding the token test
+                // addresses against the allowlist. Nor may the password arm
+                // below answer: `resolveToken` refuses the audience before it
+                // verifies any password, so that arm knows only whether one was
+                // SENT, and told the holder of the CORRECT password
+                // `WRONG_PASSWORD`. So the caller reads what a password-less
+                // `email` link and an unknown token answer, whatever email and
+                // password it sent, signed in or not. Same arm in the
+                // plugin-sharing twin, held to this order by the same table.
+                if (live && row.audience === 'email') return invalidOrExpired();
                 // [#21197] `sys_share_link.password_hash` is `internal: true`, so the
                 // probe row above comes back WITHOUT it; read off the row, every
                 // protected link would answer the unknown-token shape and the