@@ -0,0 +1,18 @@
+---
+'@objectstack/types': patch
+'@objectstack/runtime': patch
+'@objectstack/plugin-sharing': patch
+---
+
+fix(runtime, plugin-sharing): a share link's resolve answer describes the fields it returns — authored label, type, picklist option labels, currency and lookup display bits — so the shared-record page no longer has only the field keys to show (#26991)
+
+Clause-②: no
+Metadata-protocol: none
+
+`GET /api/v1/share-links/TOKEN/resolve` answered `{ record, link, redactFields }` on both of its mounts (the `plugin-sharing` routes and the runtime dispatcher's `/share-links` domain). Its visitor is usually anonymous, and `GET /api/v1/meta/object/NAME` refuses an anonymous caller, so a page rendering the shared record could only humanize each key. The answer now also carries `fields`, keyed by field name:
+
+- **What an entry holds.** The field's authored `label` and `type`; a picklist's `options` (`value`, `label`, `color`); `multiple` when it is `true`; a currency field's `currencyConfig` (`currencyMode`, `defaultCurrency`); and a lookup's `reference` (the target object) and authored `displayField`. Labels are the authored ones the object schema holds, untranslated. A lookup's value in `record` is unchanged: the stored id.
+- **Which fields.** Exactly the keys `record` carries that the shared object declares. A field the link redacts is absent from both `record` and `fields`; a field the record read never returns (`internal`) is absent from both; no other field of the object is described. The meta door's anonymous refusal is unchanged.
+- **One builder.** Both mounts build the whole answer through `buildShareLinkResolveAnswer` (new in `@objectstack/types`, beside `redactSharedRecord` and `projectSharedRecordFields`), so they answer the same shape. Redaction is unchanged.
+
+The existing keys are unchanged, so a reader of the old answer reads the new one as before.
@@ -21,7 +21,7 @@
  * So the target shape was not a design decision. `runtime/src/domains/share-links.ts`
  * serves these same five paths (for cloud's per-environment kernels it is the
  * designed PRIMARY surface), and has always answered `data: link`, `data: links`,
- * `data: { ok: true }`, `data: { record, link, redactFields }`, `data: rows`. This
+ * `data: { ok: true }`, `data: { record, link, redactFields, fields }`, `data: rows`. This
  * module converged onto that. The `sameShapeAsDispatcher` suite at the bottom is
  * what keeps the two from drifting apart again — the failure mode #3833 hit one
  * domain over, where each surface held its own copy of a mapping.
@@ -500,8 +500,9 @@ describe('share-link envelope (#3983) — same shape as the dispatcher twin', ()
     expect(revoke.body.data).toEqual({ ok: true });                        // dispatcher: data: { ok: true }
 
     const resolve = await drive(mount().http, `GET ${B}/:token/resolve`, { params: { token: 'tok_abcdefgh' } });
-    expect(Object.keys(resolve.body.data).sort())                          // dispatcher: data: { record, link, redactFields }
-      .toEqual(['link', 'record', 'redactFields']);
+    // dispatcher: data: { record, link, redactFields, fields } — one builder, #26991
+    expect(Object.keys(resolve.body.data).sort())
+      .toEqual(['fields', 'link', 'record', 'redactFields']);
   });
 
   it('redaction still happens, and `redactFields` names what was stripped', async () => {
 
@@ -7,7 +7,7 @@
  *   GET    /api/v1/share-links                 → list links         → data: link[]
  *                                                (?object, ?recordId, ?includeRevoked)
  *   DELETE /api/v1/share-links/:idOrToken      → revoke             → data: { ok: true }
- *   GET    /api/v1/share-links/:token/resolve  → resolve token      → data: { record, link, redactFields }
+ *   GET    /api/v1/share-links/:token/resolve  → resolve token      → data: { record, link, redactFields, fields }
  *   GET    /api/v1/share-links/:token/messages → conversation rows  → data: ai_messages[]
  *   *      /api/v1/share-links/*               → every other verb and path: refused
  *                                                (anonymous 401, signed-in 404)
@@ -26,7 +26,9 @@
  *      which gates audience / expiry / password and stamps usage).
  *   2. Fetch the underlying record with a SYSTEM context (so the read
  *      bypasses normal RLS — the token IS the authorisation).
- *   3. Strip `redactFields` from the record before returning.
+ *   3. Strip `redactFields` from the record before returning, and describe
+ *      the fields it still carries (`fields`: label, type, option labels,
+ *      currency and lookup display bits — `buildShareLinkResolveAnswer`).
  *
  * For browser-rendered share pages, the front-end calls this endpoint
  * and renders the response read-only.
@@ -47,6 +49,9 @@ import { sendOk, sendError, sendServerFault } from '@objectstack/types';
 // [#22049] The one reading of the password header pair, shared with the
 // dispatcher twin — see `presentedPassword` below.
 import { readSharePasswordHeader, SHARE_PASSWORD_VARY, type SharePasswordHeaderReading } from '@objectstack/types';
+// [#26991] The resolve answer — redaction and the field display projection
+// included — from the ONE builder the dispatcher twin serves it with.
+import { buildShareLinkResolveAnswer } from '@objectstack/types';
 import type { ShareLinkExecutionContext } from '@objectstack/spec/contracts';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
 import type { ErrorCode } from '@objectstack/spec/api';
@@ -186,7 +191,7 @@ interface ShareLinkFamilyRoute {
  * It has always answered in the declared envelope with `data` as the payload —
  * `data: link`, `data: links`, `data: { ok: true }`, `data: { record, link,
  * redactFields }`, `data: rows`. This module answered `{ link }`, `{ links }`,
- * `{ ok: true }`, `{ record, link, redactFields }`, `{ data: rows }`. Same
+ * `{ ok: true }`, `{ record, link, redactFields, fields }`, `{ data: rows }`. Same
  * routes, two shapes, decided by which surface happened to mount them — the
  * asymmetry #3636 fixed for `/i18n`, one domain over.
  *
@@ -271,18 +276,6 @@ function setPublicResponseHeaders(res: IHttpResponse): void {
   for (const [name, value] of Object.entries(SHARE_LINK_PUBLIC_RESPONSE_HEADERS)) res.header(name, value);
 }
 
-/** Strip `redactFields` from a record (also removes from nested arrays of objects). */
-function applyRedaction(record: any, redactFields: string[]): any {
-  if (!record || typeof record !== 'object' || redactFields.length === 0) return record;
-  if (Array.isArray(record)) return record.map((r) => applyRedaction(r, redactFields));
-  const out: any = {};
-  for (const [k, v] of Object.entries(record)) {
-    if (redactFields.includes(k)) continue;
-    out[k] = v;
-  }
-  return out;
-}
-
 export function registerShareLinkRoutes(
   http: IHttpServer,
   service: ShareLinkService,
@@ -548,21 +541,9 @@ export function registerShareLinkRoutes(
         return sendError(res, 410, 'RECORD_GONE', 'The shared record no longer exists');
       }
 
-      sendOk(res, {
-        record: applyRedaction(record, resolved.redactFields),
-        link: {
-          id: resolved.link.id,
-          token: resolved.link.token,
-          object_name: resolved.link.object_name,
-          record_id: resolved.link.record_id,
-          permission: resolved.link.permission,
-          audience: resolved.link.audience,
-          expires_at: resolved.link.expires_at,
-          label: resolved.link.label,
-          created_at: resolved.link.created_at,
-        },
-        redactFields: resolved.redactFields,
-      });
+      // [#26991] The redacted record, the link, and the display projection of
+      // exactly the fields that record carries (`fields`).
+      sendOk(res, buildShareLinkResolveAnswer(record, resolved, engine.getSchema?.(resolved.link.object_name)));
     },
     failure: 'Failed to resolve link',
   });
 
@@ -490,6 +490,12 @@ describe('HttpDispatcher extracted domains (PR-4: share-links)', () => {
             shareLinks: { resolveToken },
             objectql: {
                 find,
+                // [#26991] The resolve answer projects the served fields from the
+                // shared object's schema, which the route reads off the same engine.
+                getSchema: vi.fn().mockReturnValue({
+                    name: 'account',
+                    fields: { name: { name: 'name', label: 'Account Name', type: 'text' }, secret: { name: 'secret', type: 'text' } },
+                }),
                 getObjects: vi.fn().mockReturnValue({}),
                 registry: { getObject: vi.fn().mockReturnValue(null), getRegisteredTypes: vi.fn().mockReturnValue([]) },
             },
@@ -500,6 +506,8 @@ describe('HttpDispatcher extracted domains (PR-4: share-links)', () => {
         expect(record?.name).toBe('Acme');
         // redactFields stripped before the record leaves the server.
         expect(record?.secret).toBeUndefined();
+        // ...and from the field projection, which describes only what the record carries.
+        expect(result.response?.body?.data?.fields).toEqual({ name: { label: 'Account Name', type: 'text' } });
     });
 
     // ── #4038: one shape, no duplicate keys ──────────────────────────────