fix(runtime): a throw before the share-link body try still answers a public route with no-store

The public-route header wrapper now maps a throw from outside the body's own
try (service resolution) through errorFromThrown before adding the headers;
authenticated routes keep propagating. Adds an NFKC-differing password case to
the cross-implementation scrypt test, both directions, and lists
@objectstack/hono in the changeset frontmatter its text already names.

Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21839-share-link-password-handling.md

@@ -1,6 +1,7 @@
 ---
 '@objectstack/plugin-sharing': patch
 '@objectstack/plugin-hono-server': patch
+'@objectstack/hono': patch
 '@objectstack/runtime': patch
 ---
 

packages/plugins/plugin-sharing/src/share-link-password-webcontainer.test.ts

@@ -69,6 +69,32 @@ describe('[#21839] share-link password: node:crypto and pure-JS scrypt are inter
     expect(nodeScrypt).not.toHaveBeenCalled();
   });
 
+  it('a password whose NFKC form differs from its input is one password on both paths', async () => {
+    // A decomposed e + combining acute, and a fullwidth A: NFKC rewrites both.
+    const raw = 'cafe\u0301 \uFF21 21839';
+    const normalised = 'caf\u00e9 A 21839';
+    expect(raw).not.toBe(normalised);
+    expect(raw.normalize('NFKC')).toBe(normalised);
+
+    // pure-JS mints, native verifies — either spelling of the same password.
+    onWebContainer(true);
+    const pureJsHash = await hashShareLinkPassword(raw);
+    onWebContainer(false);
+    expect(await verifyShareLinkPassword(raw, pureJsHash)).toBe(true);
+    expect(await verifyShareLinkPassword(normalised, pureJsHash)).toBe(true);
+    expect(await verifyShareLinkPassword('cafe A 21839', pureJsHash)).toBe(false);
+
+    // native mints, pure-JS verifies — either spelling of the same password.
+    onWebContainer(false);
+    const nativeHash = await hashShareLinkPassword(raw);
+    onWebContainer(true);
+    nodeScrypt.mockClear();
+    expect(await verifyShareLinkPassword(raw, nativeHash)).toBe(true);
+    expect(await verifyShareLinkPassword(normalised, nativeHash)).toBe(true);
+    expect(await verifyShareLinkPassword('cafe A 21839', nativeHash)).toBe(false);
+    expect(nodeScrypt).not.toHaveBeenCalled();
+  });
+
   it('the pure-JS key is byte-identical to node:crypto for the same password and salt', async () => {
     onWebContainer(true);
     const hash = await hashShareLinkPassword(PASSWORD);

packages/runtime/src/domains/share-links-public-cache-headers.test.ts

@@ -145,3 +145,29 @@ describe('[#21839] dispatcher public share-link routes are never cached', () =>
     expect(list.headers?.Vary).toBeUndefined();
   });
 });
+
+describe('[#21839] a throw outside the body try still carries the public headers', () => {
+  const throwingDeps = (): DomainHandlerDeps =>
+    ({
+      ...makeDeps(undefined, undefined),
+      resolveService: async () => {
+        throw Object.assign(new Error('service registry unavailable'), { status: 503 });
+      },
+    }) as unknown as DomainHandlerDeps;
+
+  it('resolveService throwing on /resolve and /messages answers the mapped error with the headers', async () => {
+    for (const route of ['/tok_21839/resolve', '/tok_21839/messages']) {
+      const res = await handleShareLinksRequest(throwingDeps(), route, 'GET', undefined, {}, {} as HttpProtocolContext);
+      expect(res.handled, route).toBe(true);
+      const answer = res.response as Answer;
+      expect(answer.status, route).toBe(503);
+      expectNoStore(answer, route);
+    }
+  });
+
+  it('an authenticated route still propagates the throw unchanged', async () => {
+    await expect(
+      handleShareLinksRequest(throwingDeps(), '', 'GET', undefined, {}, {} as HttpProtocolContext),
+    ).rejects.toThrow('service registry unavailable');
+  });
+});

packages/runtime/src/domains/share-links.ts

@@ -99,8 +99,18 @@ export async function handleShareLinksRequest(
     query: any,
     context: HttpProtocolContext,
 ): Promise<HttpDispatcherResult> {
-    const result = await handleShareLinksRequestBody(deps, subPath, method, body, query, context);
-    if (!result.response || !isPublicShareLinkRoute(subPath, method)) return result;
+    const isPublic = isPublicShareLinkRoute(subPath, method);
+    let result: HttpDispatcherResult;
+    try {
+        result = await handleShareLinksRequestBody(deps, subPath, method, body, query, context);
+    } catch (err: unknown) {
+        // A throw from OUTSIDE the body's own try (service resolution, engine
+        // lookup) would otherwise leave a public route without the headers
+        // above. Authenticated routes keep their existing propagation.
+        if (!isPublic) throw err;
+        result = { handled: true, response: deps.errorFromThrown(err, 500) };
+    }
+    if (!result.response || !isPublic) return result;
     return {
         ...result,
         response: { ...result.response, headers: { ...result.response.headers, ...PUBLIC_RESPONSE_HEADERS } },