@objectstack/rest 4.0.4 → 4.1.0

package/dist/index.js

@@ -209,11 +209,544 @@ var RouteGroupBuilder = class {
 };
 
 // src/rest-server.ts
+var logError = (...args) => globalThis.console?.error(...args);
+function mapDataError(error, object) {
+  if (error?.code === "VALIDATION_FAILED" || error?.name === "ValidationError") {
+    return {
+      status: 400,
+      body: {
+        error: error?.message ?? "Validation failed",
+        code: "VALIDATION_FAILED",
+        fields: Array.isArray(error?.fields) ? error.fields : [],
+        ...object ? { object } : {}
+      }
+    };
+  }
+  if (error?.code === "PERMISSION_DENIED" || error?.name === "PermissionDeniedError" || typeof error?.message === "string" && error.message.startsWith("[Security] Access denied")) {
+    return {
+      status: 403,
+      body: {
+        error: error?.message ?? "Permission denied",
+        code: "PERMISSION_DENIED",
+        ...object ? { object } : {}
+      }
+    };
+  }
+  const raw = String(error?.message ?? error ?? "");
+  const lower = raw.toLowerCase();
+  if (raw.includes("[ProjectKernelFactory]") && (lower.includes("missing database_url") || lower.includes("not found"))) {
+    const isProvisioning = lower.includes("status='provisioning'") || lower.includes("status='pending'");
+    const isFailed = lower.includes("status='failed'");
+    return {
+      status: isProvisioning ? 503 : isFailed ? 502 : 404,
+      body: {
+        error: raw,
+        code: isProvisioning ? "PROJECT_PROVISIONING" : isFailed ? "PROJECT_PROVISIONING_FAILED" : "PROJECT_NOT_FOUND"
+      }
+    };
+  }
+  if (error?.code === "RECORD_NOT_FOUND" || /^Record\s+\S+\s+not found in\s+\S+/i.test(raw)) {
+    return {
+      status: 404,
+      body: {
+        error: raw,
+        code: "RECORD_NOT_FOUND",
+        ...object ? { object } : {}
+      }
+    };
+  }
+  const looksLikeUnknownObject = lower.includes("no such table") || lower.includes("relation") && lower.includes("does not exist") || lower.includes("table not found") || lower.includes("unknown object") || lower.includes("object not found") || lower.includes("no driver available") || object !== void 0 && lower.includes(`'${object.toLowerCase()}'`) && lower.includes("not");
+  if (looksLikeUnknownObject) {
+    return {
+      status: 404,
+      body: {
+        error: object ? `Object '${object}' is not registered` : "Object not found",
+        code: "object_not_found",
+        object
+      }
+    };
+  }
+  const looksLikeSqlLeak = lower.includes("sqlite_") || lower.includes("sqlstate") || lower.startsWith("insert into ") || lower.startsWith("update ") || lower.startsWith("select ") || lower.startsWith("delete from ") || lower.includes("constraint failed") || lower.includes("unique constraint") || lower.includes("foreign key");
+  if (looksLikeSqlLeak) {
+    if (lower.includes("unique constraint") || lower.includes("unique violation")) {
+      return {
+        status: 409,
+        body: {
+          error: "A record with this value already exists",
+          code: "UNIQUE_VIOLATION",
+          ...object ? { object } : {}
+        }
+      };
+    }
+    return {
+      status: 500,
+      body: { error: "Internal data error", code: "DATABASE_ERROR" }
+    };
+  }
+  return { status: 400, body: { error: raw || "Bad request" } };
+}
+function sendError(res, error, object) {
+  if (typeof error?.status === "number" && error.status >= 400 && error.status < 600) {
+    const safeMsg = typeof error.message === "string" && error.message.length < 500 ? error.message : "Request failed";
+    res.status(error.status).json({
+      error: safeMsg,
+      ...error.code ? { code: error.code } : {}
+    });
+    return;
+  }
+  const mapped = mapDataError(error, object);
+  res.status(mapped.status).json(mapped.body);
+}
+function isExpectedDataStatus(status) {
+  return status === 403 || status === 404 || status === 409 || status === 502 || status === 503;
+}
+function parseCsvToRows(csv, mapping = {}) {
+  const text = csv.replace(/^\uFEFF/, "");
+  const cells = [];
+  let cur = "";
+  let row = [];
+  let inQuotes = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (text[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inQuotes = true;
+      continue;
+    }
+    if (ch === ",") {
+      row.push(cur);
+      cur = "";
+      continue;
+    }
+    if (ch === "\r") {
+      continue;
+    }
+    if (ch === "\n") {
+      row.push(cur);
+      cur = "";
+      cells.push(row);
+      row = [];
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur.length > 0 || row.length > 0) {
+    row.push(cur);
+    cells.push(row);
+  }
+  while (cells.length > 0 && cells[cells.length - 1].every((c) => c === "")) cells.pop();
+  if (cells.length < 2) return [];
+  const header = cells[0].map((h) => h.trim());
+  const fields = header.map((h) => mapping[h] ?? h);
+  const out = [];
+  for (let r = 1; r < cells.length; r++) {
+    const row2 = cells[r];
+    const obj = {};
+    for (let c = 0; c < fields.length; c++) {
+      const key = fields[c];
+      if (!key) continue;
+      const raw = row2[c] ?? "";
+      obj[key] = raw;
+    }
+    out.push(obj);
+  }
+  return out;
+}
+function formatCsvCell(value) {
+  if (value === null || value === void 0) return "";
+  let s;
+  if (typeof value === "string") s = value;
+  else if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") s = String(value);
+  else if (value instanceof Date) s = value.toISOString();
+  else {
+    try {
+      s = JSON.stringify(value);
+    } catch {
+      s = String(value);
+    }
+  }
+  if (/[",\r\n]/.test(s)) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  return s;
+}
+function rowsToCsv(fields, rows, includeHeader) {
+  const lines = [];
+  if (includeHeader) lines.push(fields.map(formatCsvCell).join(","));
+  for (const row of rows) {
+    lines.push(fields.map((f) => formatCsvCell(row?.[f])).join(","));
+  }
+  return lines.join("\r\n") + (lines.length > 0 ? "\r\n" : "");
+}
 var RestServer = class {
-  constructor(server, protocol, config = {}) {
+  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultProjectIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider) {
     this.protocol = protocol;
     this.config = this.normalizeConfig(config);
     this.routeManager = new RouteManager(server);
+    this.kernelManager = kernelManager;
+    this.envRegistry = envRegistry;
+    this.defaultProjectIdProvider = defaultProjectIdProvider;
+    this.authServiceProvider = authServiceProvider;
+    this.objectQLProvider = objectQLProvider;
+    this.emailServiceProvider = emailServiceProvider;
+    this.sharingServiceProvider = sharingServiceProvider;
+    this.reportsServiceProvider = reportsServiceProvider;
+    this.approvalsServiceProvider = approvalsServiceProvider;
+    this.sharingRulesServiceProvider = sharingRulesServiceProvider;
+  }
+  /**
+   * Resolve the protocol for a given request. When `projectId` is present
+   * and a KernelManager is wired, fetch the per-project kernel's
+   * `protocol` service so metadata / data / UI reads hit the project's
+   * own registry and datastore.
+   *
+   * When `projectId` is absent on an unscoped route and an `envRegistry`
+   * is wired (runtime mode), the resolution chain is:
+   *   1. Hostname → projectId (`envRegistry.resolveByHostname`)
+   *   2. `X-Project-Id` header → projectId (`envRegistry.resolveById`)
+   *   3. Default-project fallback (`defaultProjectIdProvider`, set by
+   *      `createSingleProjectPlugin`)
+   *   4. Control-plane protocol captured at boot.
+   *
+   * Special case: `projectId === 'platform'` is a reserved virtual id used
+   * by Studio to address the control plane through the regular project
+   * URL shape (`/projects/platform/...`). It is NOT a row in the projects
+   * table, so we must never call `KernelManager.getOrCreate('platform')`.
+   * Instead, return the control-plane protocol directly. This lets Studio
+   * (and any other client) speak a single, uniform URL family without
+   * duplicating route logic for the platform surface.
+   */
+  async resolveProtocol(projectId, req) {
+    if (projectId === "platform") return this.protocol;
+    if (!projectId && req && this.envRegistry && this.kernelManager) {
+      const host = this.extractHostname(req);
+      if (host) {
+        try {
+          const result = await this.envRegistry.resolveByHostname(host);
+          if (result?.projectId) projectId = result.projectId;
+        } catch {
+        }
+      }
+      if (!projectId && typeof this.envRegistry.resolveById === "function") {
+        const headerVal = this.extractProjectIdHeader(req);
+        if (headerVal) {
+          try {
+            const driver = await this.envRegistry.resolveById(headerVal);
+            if (driver) projectId = headerVal;
+          } catch {
+          }
+        }
+      }
+    }
+    if (!projectId && this.defaultProjectIdProvider) {
+      try {
+        const def = this.defaultProjectIdProvider();
+        if (def) projectId = def;
+      } catch {
+      }
+    }
+    if (!projectId || !this.kernelManager) return this.protocol;
+    const kernel = await this.kernelManager.getOrCreate(projectId);
+    return kernel.getServiceAsync("protocol");
+  }
+  /**
+   * Resolve the i18n service for the request's project (or control plane
+   * when no project id is in scope). Returns `undefined` when no service is
+   * registered, so callers can short-circuit and skip translation rather
+   * than failing.
+   *
+   * Mirrors `resolveProtocol`'s lookup chain: explicit `projectId` from the
+   * route → kernel-managed `i18n` service. Control-plane / unscoped
+   * requests intentionally return `undefined` because the platform kernel
+   * does not own per-app translation bundles.
+   */
+  async resolveI18nService(projectId) {
+    if (!projectId || projectId === "platform" || !this.kernelManager) return void 0;
+    try {
+      const kernel = await this.kernelManager.getOrCreate(projectId);
+      return await kernel.getServiceAsync("i18n");
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Reject anonymous requests with HTTP 401 when `api.requireAuth` is set.
+   * Returns `true` if the response was sent and the caller should stop
+   * processing. Returns `false` to continue.
+   *
+   * The check is intentionally narrow: only `context?.userId` counts as
+   * "authenticated". `isSystem` flags are never set on inbound HTTP
+   * requests (they're internal-only), so they cannot bypass this gate.
+   */
+  enforceAuth(req, res, context) {
+    if (!this.config.api.requireAuth) return false;
+    if (context?.userId) return false;
+    if (req?.method === "OPTIONS") return false;
+    res.status(401).json({
+      error: "unauthenticated",
+      message: "Authentication is required to access this endpoint."
+    });
+    return true;
+  }
+  /**
+   * Resolve the request's execution context (RBAC/RLS/FLS) by looking up
+   * the better-auth session via the project's `auth` service. Returns
+   * `undefined` for anonymous requests so callers can pass `context` as-is
+   * to the protocol layer (the SecurityPlugin treats undefined as anon).
+   */
+  async resolveExecCtx(projectId, req) {
+    try {
+      if (!projectId && req && this.envRegistry && this.kernelManager) {
+        const host = this.extractHostname(req);
+        if (host) {
+          try {
+            const result = await this.envRegistry.resolveByHostname(host);
+            if (result?.projectId) projectId = result.projectId;
+          } catch {
+          }
+        }
+        if (!projectId && typeof this.envRegistry.resolveById === "function") {
+          const headerVal = this.extractProjectIdHeader(req);
+          if (headerVal) {
+            try {
+              const driver = await this.envRegistry.resolveById(headerVal);
+              if (driver) projectId = headerVal;
+            } catch {
+            }
+          }
+        }
+      }
+      let authService;
+      let kernel;
+      if (projectId && projectId !== "platform" && this.kernelManager) {
+        kernel = await this.kernelManager.getOrCreate(projectId);
+        authService = await kernel.getServiceAsync("auth").catch(() => void 0);
+      }
+      if (!authService && this.defaultProjectIdProvider && this.kernelManager) {
+        try {
+          const def = this.defaultProjectIdProvider();
+          if (def) {
+            kernel = await this.kernelManager.getOrCreate(def);
+            authService = await kernel.getServiceAsync("auth").catch(() => void 0);
+          }
+        } catch {
+        }
+      }
+      if (!authService && this.authServiceProvider) {
+        authService = await this.authServiceProvider(projectId).catch(() => void 0);
+      }
+      if (!authService) return void 0;
+      let api = authService.api;
+      if (!api && typeof authService.getApi === "function") {
+        api = await authService.getApi();
+      }
+      if (!api?.getSession) return void 0;
+      const rawHeaders = req?.headers;
+      let headers;
+      if (rawHeaders && typeof rawHeaders.get === "function") {
+        headers = rawHeaders;
+      } else if (rawHeaders && typeof rawHeaders === "object") {
+        headers = new globalThis.Headers();
+        for (const [k, v] of Object.entries(rawHeaders)) {
+          if (Array.isArray(v)) v.forEach((x) => headers.append(k, String(x)));
+          else if (v != null) headers.set(k, String(v));
+        }
+      } else {
+        return void 0;
+      }
+      const session = await api.getSession({ headers });
+      if (!session?.user?.id) return void 0;
+      const userId = session.user.id;
+      const tenantId = session.session?.activeOrganizationId ?? void 0;
+      const permissions = [];
+      const roles = [];
+      try {
+        let ql;
+        if (kernel) {
+          ql = await kernel.getServiceAsync("objectql").catch(() => void 0);
+        }
+        if (!ql && this.objectQLProvider) {
+          ql = await this.objectQLProvider(projectId).catch(() => void 0);
+        }
+        if (ql && typeof ql.find === "function") {
+          const sysOpts = { context: { isSystem: true } };
+          const memberRows = await ql.find("sys_member", {
+            where: tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId },
+            limit: 50,
+            ...sysOpts
+          }).catch(() => []);
+          for (const m of memberRows ?? []) {
+            if (typeof m.role === "string") {
+              for (const r of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
+                if (!roles.includes(r)) roles.push(r);
+              }
+            }
+          }
+          const upsRows = await ql.find("sys_user_permission_set", {
+            where: { user_id: userId },
+            limit: 100,
+            ...sysOpts
+          }).catch(() => []);
+          const psIds = /* @__PURE__ */ new Set();
+          for (const r of upsRows ?? []) {
+            const orgScope = r.organization_id ?? null;
+            if (!orgScope || tenantId && orgScope === tenantId) {
+              const pid = r.permission_set_id ?? r.permissionSetId;
+              if (pid) psIds.add(pid);
+            }
+          }
+          if (psIds.size > 0) {
+            const psRows = await ql.find("sys_permission_set", {
+              where: { id: { $in: Array.from(psIds) } },
+              limit: 500,
+              ...sysOpts
+            }).catch(() => []);
+            for (const ps of psRows ?? []) {
+              if (ps.name && !permissions.includes(ps.name)) permissions.push(ps.name);
+            }
+          }
+        }
+      } catch {
+      }
+      return {
+        userId,
+        tenantId,
+        roles,
+        permissions,
+        isSystem: false
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Build a `TranslationBundle` (`Record<locale, TranslationData>`) from an
+   * `II18nService` instance. Returns `undefined` when no locales are
+   * registered so callers can avoid translation work.
+   */
+  buildTranslationBundle(i18n) {
+    if (!i18n || typeof i18n.getLocales !== "function" || typeof i18n.getTranslations !== "function") {
+      return void 0;
+    }
+    const locales = i18n.getLocales();
+    if (!locales.length) return void 0;
+    const bundle = {};
+    for (const locale of locales) {
+      const data = i18n.getTranslations(locale);
+      if (data && typeof data === "object") bundle[locale] = data;
+    }
+    return Object.keys(bundle).length ? bundle : void 0;
+  }
+  /**
+   * Parse the highest-priority locale from an `Accept-Language` header.
+   * Falls back to a `?locale=` query parameter, then to the i18n service's
+   * default locale. Returns `undefined` when no preference is expressed
+   * (callers will then return untranslated metadata).
+   */
+  extractLocale(req, i18n) {
+    const headers = req?.headers;
+    let header;
+    if (headers) {
+      header = typeof headers.get === "function" ? headers.get("accept-language") ?? void 0 : headers["accept-language"] ?? headers["Accept-Language"];
+    }
+    if (typeof header === "string" && header.length > 0) {
+      const top = header.split(",")[0]?.split(";")[0]?.trim();
+      if (top) return top;
+    }
+    const queryLocale = req?.query?.locale;
+    if (typeof queryLocale === "string" && queryLocale.length > 0) return queryLocale;
+    if (i18n && typeof i18n.getDefaultLocale === "function") {
+      const def = i18n.getDefaultLocale();
+      if (typeof def === "string" && def.length > 0) return def;
+    }
+    return void 0;
+  }
+  /**
+   * Translate a single metadata document (view or action) when an i18n
+   * service is registered for the request's project and the requested
+   * locale yields a match. Falls through unchanged for unsupported types
+   * or missing translations.
+   */
+  async translateMetaItem(req, type, projectId, item) {
+    if (!item || typeof item !== "object") return item;
+    if (type !== "view" && type !== "action") return item;
+    const i18n = await this.resolveI18nService(projectId);
+    const bundle = this.buildTranslationBundle(i18n);
+    if (!bundle) return item;
+    const locale = this.extractLocale(req, i18n);
+    if (!locale) return item;
+    const { translateMetadataDocument } = await import("@objectstack/spec/system");
+    return translateMetadataDocument(type, item, bundle, { locale });
+  }
+  /**
+   * Translate a list of metadata documents using `translateMetaItem`.
+   */
+  async translateMetaItems(req, type, projectId, items) {
+    if (!Array.isArray(items)) return items;
+    if (type !== "view" && type !== "action") return items;
+    const i18n = await this.resolveI18nService(projectId);
+    const bundle = this.buildTranslationBundle(i18n);
+    if (!bundle) return items;
+    const locale = this.extractLocale(req, i18n);
+    if (!locale) return items;
+    const { translateMetadataDocument } = await import("@objectstack/spec/system");
+    return items.map((item) => translateMetadataDocument(type, item, bundle, { locale }));
+  }
+  /**
+   * Pull the request hostname (without port) from a Node-style `req` or
+   * a Fetch-style request wrapper. Returns undefined when no Host header
+   * is available.
+   */
+  extractHostname(req) {
+    const headers = req?.headers;
+    let host;
+    if (headers) {
+      if (typeof headers.get === "function") {
+        host = headers.get("host") ?? void 0;
+      } else {
+        host = headers.host ?? headers.Host;
+      }
+    }
+    if (!host && typeof req?.hostname === "string") host = req.hostname;
+    if (!host && typeof req?.url === "string") {
+      try {
+        host = new globalThis.URL(req.url).host;
+      } catch {
+      }
+    }
+    if (!host) return void 0;
+    return String(host).split(":")[0].toLowerCase();
+  }
+  /**
+   * Pull the `X-Project-Id` header from a Node- or Fetch-style request.
+   * Header names are case-insensitive; we probe both casings to cover
+   * adapters that don't normalize headers (e.g. raw Node http).
+   */
+  extractProjectIdHeader(req) {
+    const headers = req?.headers;
+    if (!headers) return void 0;
+    let val;
+    if (typeof headers.get === "function") {
+      val = headers.get("x-project-id") ?? headers.get("X-Project-Id");
+    } else {
+      val = headers["x-project-id"] ?? headers["X-Project-Id"];
+    }
+    if (Array.isArray(val)) val = val[0];
+    if (typeof val !== "string") return void 0;
+    const trimmed = val.trim();
+    return trimmed.length > 0 ? trimmed : void 0;
   }
   /**
    * Normalize configuration with defaults
@@ -234,6 +767,10 @@ var RestServer = class {
         enableUi: api.enableUi ?? true,
         enableBatch: api.enableBatch ?? true,
         enableDiscovery: api.enableDiscovery ?? true,
+        enableSearch: api.enableSearch ?? true,
+        enableProjectScoping: api.enableProjectScoping ?? false,
+        projectResolution: api.projectResolution ?? "auto",
+        requireAuth: api.requireAuth ?? false,
         documentation: api.documentation,
         responseFormat: api.responseFormat
       },
@@ -286,52 +823,98 @@ var RestServer = class {
     const { api } = this.config;
     return api.apiPath ?? `${api.basePath}/${api.version}`;
   }
+  /**
+   * Get the project-scoped base path for a given unscoped base.
+   * Example: `/api/v1` → `/api/v1/projects/:projectId`.
+   */
+  getScopedBasePath(basePath) {
+    return `${basePath}/projects/:projectId`;
+  }
   /**
    * Register all REST API routes
+   *
+   * When `enableProjectScoping` is true, routes are registered under
+   * `/api/v1/projects/:projectId/...`. The `projectResolution` strategy
+   * controls whether unscoped legacy routes remain available:
+   *   - `required` → only scoped routes registered.
+   *   - `optional` / `auto` → both scoped and unscoped routes registered.
    */
   registerRoutes() {
     const basePath = this.getApiBasePath();
-    if (this.config.api.enableDiscovery) {
-      this.registerDiscoveryEndpoints(basePath);
-    }
-    if (this.config.api.enableMetadata) {
-      this.registerMetadataEndpoints(basePath);
-    }
-    if (this.config.api.enableUi) {
-      this.registerUiEndpoints(basePath);
-    }
-    if (this.config.api.enableCrud) {
-      this.registerCrudEndpoints(basePath);
-    }
-    if (this.config.api.enableBatch) {
-      this.registerBatchEndpoints(basePath);
+    const { enableProjectScoping, projectResolution } = this.config.api;
+    const registerForBase = (bp) => {
+      if (this.config.api.enableDiscovery) {
+        this.registerDiscoveryEndpoints(bp);
+      }
+      if (this.config.api.enableMetadata) {
+        this.registerMetadataEndpoints(bp);
+      }
+      if (this.config.api.enableUi) {
+        this.registerUiEndpoints(bp);
+      }
+      if (this.config.api.enableSearch ?? true) {
+        this.registerSearchEndpoints(bp);
+      }
+      this.registerEmailEndpoints(bp);
+      this.registerSharingEndpoints(bp);
+      this.registerSharingRuleEndpoints(bp);
+      this.registerReportsEndpoints(bp);
+      this.registerApprovalsEndpoints(bp);
+      if (this.config.api.enableCrud) {
+        this.registerCrudEndpoints(bp);
+      }
+      this.registerDataActionEndpoints(bp);
+      if (this.config.api.enableBatch) {
+        this.registerBatchEndpoints(bp);
+      }
+    };
+    if (enableProjectScoping) {
+      const scopedBase = this.getScopedBasePath(basePath);
+      if (projectResolution === "required") {
+        registerForBase(scopedBase);
+      } else {
+        registerForBase(basePath);
+        registerForBase(scopedBase);
+      }
+    } else {
+      registerForBase(basePath);
     }
   }
   /**
    * Register discovery endpoints
    */
   registerDiscoveryEndpoints(basePath) {
-    const discoveryHandler = async (_req, res) => {
+    const isScoped = basePath.includes("/projects/:projectId");
+    const discoveryHandler = async (req, res) => {
       try {
         const discovery = await this.protocol.getDiscovery();
         discovery.version = this.config.api.version;
+        const realBase = isScoped ? basePath.replace(":projectId", req.params?.projectId ?? ":projectId") : basePath;
         if (discovery.routes) {
           if (this.config.api.enableCrud) {
-            discovery.routes.data = `${basePath}${this.config.crud.dataPrefix}`;
+            discovery.routes.data = `${realBase}${this.config.crud.dataPrefix}`;
           }
           if (this.config.api.enableMetadata) {
-            discovery.routes.metadata = `${basePath}${this.config.metadata.prefix}`;
+            discovery.routes.metadata = `${realBase}${this.config.metadata.prefix}`;
           }
           if (this.config.api.enableUi) {
-            discovery.routes.ui = `${basePath}/ui`;
+            discovery.routes.ui = `${realBase}/ui`;
           }
           if (discovery.routes.auth) {
-            discovery.routes.auth = `${basePath}/auth`;
+            const unscopedBase = isScoped ? basePath.replace(/\/projects\/:projectId$/, "") : basePath;
+            discovery.routes.auth = `${unscopedBase}/auth`;
           }
         }
+        discovery.scoping = {
+          enabled: this.config.api.enableProjectScoping,
+          resolution: this.config.api.projectResolution,
+          scoped: isScoped,
+          projectId: isScoped ? req.params?.projectId : void 0
+        };
         res.json(discovery);
       } catch (error) {
-        res.status(500).json({ error: error.message });
+        logError("[REST] Unhandled error:", error);
+        sendError(res, error);
       }
     };
     this.routeManager.register({
@@ -359,16 +942,20 @@ var RestServer = class {
   registerMetadataEndpoints(basePath) {
     const { metadata } = this.config;
     const metaPath = `${basePath}${metadata.prefix}`;
+    const isScoped = basePath.includes("/projects/:projectId");
     if (metadata.endpoints.types !== false) {
       this.routeManager.register({
         method: "GET",
         path: metaPath,
-        handler: async (_req, res) => {
+        handler: async (req, res) => {
           try {
-            const types = await this.protocol.getMetaTypes();
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const types = await p.getMetaTypes();
             res.json(types);
           } catch (error) {
-            res.status(500).json({ error: error.message });
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error);
           }
         },
         metadata: {
@@ -384,10 +971,19 @@ var RestServer = class {
         handler: async (req, res) => {
           try {
             const packageId = req.query?.package || void 0;
-            const items = await this.protocol.getMetaItems({ type: req.params.type, packageId });
-            res.json(items);
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const items = await p.getMetaItems({
+              type: req.params.type,
+              packageId,
+              ...projectId ? { projectId } : {}
+            });
+            const translated = await this.translateMetaItems(req, req.params.type, projectId, items);
+            res.header("Vary", "Accept-Language");
+            res.json(translated);
           } catch (error) {
-            res.status(404).json({ error: error.message });
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error);
           }
         },
         metadata: {
@@ -402,15 +998,18 @@ var RestServer = class {
         path: `${metaPath}/:type/:name`,
         handler: async (req, res) => {
           try {
-            if (metadata.enableCache && this.protocol.getMetaItemCached) {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            if (metadata.enableCache && p.getMetaItemCached) {
               const cacheRequest = {
                 ifNoneMatch: req.headers["if-none-match"],
                 ifModifiedSince: req.headers["if-modified-since"]
               };
-              const result = await this.protocol.getMetaItemCached({
+              const result = await p.getMetaItemCached({
                 type: req.params.type,
                 name: req.params.name,
-                cacheRequest
+                cacheRequest,
+                ...projectId ? { projectId } : {}
               });
               if (result.notModified) {
                 res.status(304).send();
@@ -428,14 +1027,21 @@ var RestServer = class {
                 const maxAge = result.cacheControl.maxAge ? `, max-age=${result.cacheControl.maxAge}` : "";
                 res.header("Cache-Control", directives + maxAge);
               }
-              res.json(result.data);
+              res.header("Vary", "Accept-Language");
+              res.json(await this.translateMetaItem(req, req.params.type, projectId, result.data));
             } else {
               const packageId = req.query?.package || void 0;
-              const item = await this.protocol.getMetaItem({ type: req.params.type, name: req.params.name, packageId });
-              res.json(item);
+              const item = await p.getMetaItem({
+                type: req.params.type,
+                name: req.params.name,
+                packageId
+              });
+              res.header("Vary", "Accept-Language");
+              res.json(await this.translateMetaItem(req, req.params.type, projectId, item));
             }
           } catch (error) {
-            res.status(404).json({ error: error.message });
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error);
           }
         },
         metadata: {
@@ -449,18 +1055,24 @@ var RestServer = class {
       path: `${metaPath}/:type/:name`,
       handler: async (req, res) => {
         try {
-          if (!this.protocol.saveMetaItem) {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          if (!p.saveMetaItem) {
             res.status(501).json({ error: "Save operation not supported by protocol implementation" });
             return;
           }
-          const result = await this.protocol.saveMetaItem({
+          const body = req.body ?? {};
+          const item = body && typeof body === "object" && "metadata" in body ? body.metadata : body && typeof body === "object" && "item" in body ? body.item : body;
+          const result = await p.saveMetaItem({
             type: req.params.type,
             name: req.params.name,
-            item: req.body
+            item,
+            ...projectId ? { projectId } : {}
           });
           res.json(result);
         } catch (error) {
-          res.status(400).json({ error: error.message });
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error);
         }
       },
       metadata: {
@@ -468,28 +1080,119 @@ var RestServer = class {
         tags: ["metadata"]
       }
     });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${metaPath}/:type/:name`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          if (!p.deleteMetaItem) {
+            res.status(501).json({
+              error: "Reset operation not supported by protocol implementation"
+            });
+            return;
+          }
+          const result = await p.deleteMetaItem({
+            type: req.params.type,
+            name: req.params.name,
+            ...projectId ? { projectId } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error);
+        }
+      },
+      metadata: {
+        summary: "Reset metadata item to artifact default (deletes customization overlay)",
+        tags: ["metadata"]
+      }
+    });
+    if (metadata.endpoints.item !== false) {
+      this.routeManager.register({
+        method: "GET",
+        path: `${metaPath}/:type/:section/:name`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const compoundName = `${req.params.section}/${req.params.name}`;
+            const packageId = req.query?.package || void 0;
+            const item = await p.getMetaItem({
+              type: req.params.type,
+              name: compoundName,
+              packageId
+            });
+            res.header("Vary", "Accept-Language");
+            res.json(await this.translateMetaItem(req, req.params.type, projectId, item));
+          } catch (error) {
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error);
+          }
+        },
+        metadata: {
+          summary: "Get specific metadata item by compound name",
+          tags: ["metadata"]
+        }
+      });
+    }
+    this.routeManager.register({
+      method: "PUT",
+      path: `${metaPath}/:type/:section/:name`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          if (!p.saveMetaItem) {
+            res.status(501).json({ error: "Save operation not supported by protocol implementation" });
+            return;
+          }
+          const compoundName = `${req.params.section}/${req.params.name}`;
+          const result = await p.saveMetaItem({
+            type: req.params.type,
+            name: compoundName,
+            item: req.body,
+            ...projectId ? { projectId } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error);
+        }
+      },
+      metadata: {
+        summary: "Save specific metadata item by compound name",
+        tags: ["metadata"]
+      }
+    });
   }
   /**
    * Register UI endpoints
    */
   registerUiEndpoints(basePath) {
     const uiPath = `${basePath}/ui`;
+    const isScoped = basePath.includes("/projects/:projectId");
     this.routeManager.register({
       method: "GET",
       path: `${uiPath}/view/:object/:type`,
       handler: async (req, res) => {
         try {
-          if (this.protocol.getUiView) {
-            const view = await this.protocol.getUiView({
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          if (p.getUiView) {
+            const view = await p.getUiView({
               object: req.params.object,
-              type: req.params.type
+              type: req.params.type,
+              ...projectId ? { projectId } : {}
             });
             res.json(view);
           } else {
             res.status(501).json({ error: "UI View resolution not supported by protocol implementation" });
           }
         } catch (error) {
-          res.status(404).json({ error: error.message });
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error, req.params?.object);
         }
       },
       metadata: {
@@ -504,6 +1207,7 @@ var RestServer = class {
   registerCrudEndpoints(basePath) {
     const { crud } = this.config;
     const dataPath = `${basePath}${crud.dataPrefix}`;
+    const isScoped = basePath.includes("/projects/:projectId");
     const operations = crud.operations;
     if (operations.list) {
       this.routeManager.register({
@@ -511,13 +1215,25 @@ var RestServer = class {
         path: `${dataPath}/:object`,
         handler: async (req, res) => {
           try {
-            const result = await this.protocol.findData({
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.findData({
               object: req.params.object,
-              query: req.query
+              query: req.query,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            const mapped = mapDataError(error, req.params?.object);
+            if (mapped.status === 404 || mapped.status === 503 || mapped.status === 502) {
+              res.status(mapped.status).json(mapped.body);
+            } else {
+              logError("[REST] Unhandled error:", error);
+              res.status(mapped.status).json(mapped.body);
+            }
           }
         },
         metadata: {
@@ -532,16 +1248,24 @@ var RestServer = class {
         path: `${dataPath}/:object/:id`,
         handler: async (req, res) => {
           try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
             const { select, expand } = req.query || {};
-            const result = await this.protocol.getData({
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.getData({
               object: req.params.object,
               id: req.params.id,
               ...select != null ? { select } : {},
-              ...expand != null ? { expand } : {}
+              ...expand != null ? { expand } : {},
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            res.status(404).json({ error: error.message });
+            const mapped = mapDataError(error, req.params?.object);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
+            res.status(mapped.status === 400 ? 404 : mapped.status).json(mapped.body);
           }
         },
         metadata: {
@@ -556,13 +1280,21 @@ var RestServer = class {
         path: `${dataPath}/:object`,
         handler: async (req, res) => {
           try {
-            const result = await this.protocol.createData({
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.createData({
               object: req.params.object,
-              data: req.body
+              data: req.body,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.status(201).json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            const mapped = mapDataError(error, req.params?.object);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
+            res.status(mapped.status).json(mapped.body);
           }
         },
         metadata: {
@@ -571,20 +1303,57 @@ var RestServer = class {
         }
       });
     }
+    if (operations.list) {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/:object/query`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.findData({
+              object: req.params.object,
+              query: req.body || {},
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
+            });
+            res.json(result);
+          } catch (error) {
+            const mapped = mapDataError(error, req.params?.object);
+            if (!isExpectedDataStatus(mapped.status)) logError("[REST] Unhandled error:", error);
+            res.status(mapped.status).json(mapped.body);
+          }
+        },
+        metadata: {
+          summary: "Advanced query (QueryAST in body)",
+          tags: ["data", "crud"]
+        }
+      });
+    }
     if (operations.update) {
       this.routeManager.register({
         method: "PATCH",
         path: `${dataPath}/:object/:id`,
         handler: async (req, res) => {
           try {
-            const result = await this.protocol.updateData({
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.updateData({
               object: req.params.object,
               id: req.params.id,
-              data: req.body
+              data: req.body,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            const mapped = mapDataError(error, req.params?.object);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
+            res.status(mapped.status).json(mapped.body);
           }
         },
         metadata: {
@@ -599,13 +1368,21 @@ var RestServer = class {
         path: `${dataPath}/:object/:id`,
         handler: async (req, res) => {
           try {
-            const result = await this.protocol.deleteData({
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.deleteData({
               object: req.params.object,
-              id: req.params.id
+              id: req.params.id,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            const mapped = mapDataError(error, req.params?.object);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
+            res.status(mapped.status).json(mapped.body);
           }
         },
         metadata: {
@@ -616,46 +1393,1227 @@ var RestServer = class {
     }
   }
   /**
-   * Register batch operation endpoints
+   * Register object-specific action endpoints that don't fit the
+   * generic CRUD shape. These are domain operations (Salesforce
+   * convertLead, etc.) where the protocol implementation does its own
+   * multi-record orchestration and we just need a thin HTTP route.
+   *
+   * POST {basePath}/data/lead/:id/convert — M10.6 lead conversion.
    */
-  registerBatchEndpoints(basePath) {
-    const { crud, batch } = this.config;
+  registerDataActionEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    const { crud } = this.config;
     const dataPath = `${basePath}${crud.dataPrefix}`;
-    const operations = batch.operations;
-    if (batch.enableBatchEndpoint && this.protocol.batchData) {
-      this.routeManager.register({
-        method: "POST",
-        path: `${dataPath}/:object/batch`,
-        handler: async (req, res) => {
-          try {
-            const result = await this.protocol.batchData({
-              object: req.params.object,
-              request: req.body
-            });
-            res.json(result);
-          } catch (error) {
-            res.status(400).json({ error: error.message });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/lead/:id/convert`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const convertLead = p.convertLead;
+          if (typeof convertLead !== "function") {
+            res.status(501).json({ code: "NOT_IMPLEMENTED", error: "Lead convert not supported by this protocol" });
+            return;
           }
-        },
-        metadata: {
-          summary: "Batch operations",
-          tags: ["data", "batch"]
+          const body = req.body ?? {};
+          const result = await convertLead.call(p, {
+            leadId: req.params.id,
+            accountId: body.accountId,
+            contactId: body.contactId,
+            createOpportunity: body.createOpportunity,
+            opportunity: body.opportunity,
+            convertedStatus: body.convertedStatus,
+            ...context ? { context } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error, "lead");
         }
-      });
-    }
-    if (operations.createMany && this.protocol.createManyData) {
-      this.routeManager.register({
-        method: "POST",
-        path: `${dataPath}/:object/createMany`,
-        handler: async (req, res) => {
-          try {
-            const result = await this.protocol.createManyData({
+      },
+      metadata: {
+        summary: "Convert a Lead into Account + Contact (+ optional Opportunity)",
+        tags: ["data", "lead"]
+      }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/:object/import`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const objectName = String(req.params.object || "");
+          if (!objectName) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "object is required" });
+            return;
+          }
+          const body = req.body ?? {};
+          const dryRun = body.dryRun === true;
+          const mapping = body.mapping ?? {};
+          let rows = [];
+          if (body.format === "json" && Array.isArray(body.rows)) {
+            rows = body.rows;
+          } else if ((body.format === "csv" || typeof body.csv === "string") && typeof body.csv === "string") {
+            rows = parseCsvToRows(body.csv, mapping);
+          } else if (Array.isArray(body)) {
+            rows = body;
+          } else {
+            res.status(400).json({
+              code: "INVALID_REQUEST",
+              error: 'Provide either format:"csv" with csv text or format:"json" with rows[]'
+            });
+            return;
+          }
+          const max = 5e3;
+          if (rows.length > max) {
+            res.status(413).json({
+              code: "PAYLOAD_TOO_LARGE",
+              error: `Import limit is ${max} rows per request (got ${rows.length})`
+            });
+            return;
+          }
+          const results = [];
+          let okCount = 0;
+          let errCount = 0;
+          for (let i = 0; i < rows.length; i++) {
+            const data = rows[i];
+            try {
+              if (dryRun) {
+                const validate = p.validate;
+                if (typeof validate === "function") {
+                  await validate.call(p, { object: objectName, data, context });
+                }
+                results.push({ row: i + 1, ok: true });
+                okCount++;
+              } else {
+                const created = await p.createData({ object: objectName, data, context });
+                const id = created?.id ?? created?.record?.id;
+                results.push({ row: i + 1, ok: true, id });
+                okCount++;
+              }
+            } catch (err) {
+              errCount++;
+              const code = err?.code ?? "IMPORT_ROW_FAILED";
+              const message = typeof err?.message === "string" ? err.message.slice(0, 300) : "Row failed";
+              results.push({ row: i + 1, ok: false, error: message, code });
+            }
+          }
+          res.json({
+            object: objectName,
+            dryRun,
+            total: rows.length,
+            ok: okCount,
+            errors: errCount,
+            results
+          });
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error, String(req.params?.object || ""));
+        }
+      },
+      metadata: {
+        summary: "Bulk-import rows into an object (CSV or JSON, with optional dry-run)",
+        tags: ["data", "import"]
+      }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/:object/export`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const objectName = String(req.params.object || "");
+          if (!objectName) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "object is required" });
+            return;
+          }
+          const q = req.query ?? {};
+          const format = String(q.format ?? "csv").toLowerCase() === "json" ? "json" : "csv";
+          const HARD_CAP = 5e4;
+          const MAX_CHUNK = 5e3;
+          const requestedLimit = q.limit != null ? Math.max(1, Number(q.limit) || 0) : 1e4;
+          const limit = Math.min(requestedLimit, HARD_CAP);
+          const chunkSize = Math.min(MAX_CHUNK, Math.max(50, q.page != null ? Number(q.page) || 500 : 500));
+          let filter = void 0;
+          if (typeof q.filter === "string" && q.filter.length > 0) {
+            try {
+              filter = JSON.parse(q.filter);
+            } catch {
+              res.status(400).json({ code: "INVALID_REQUEST", error: "filter must be JSON" });
+              return;
+            }
+          } else if (q.filter && typeof q.filter === "object") {
+            filter = q.filter;
+          }
+          let orderby = void 0;
+          if (typeof q.orderby === "string" && q.orderby.length > 0) {
+            if (q.orderby.startsWith("{") || q.orderby.startsWith("[")) {
+              try {
+                orderby = JSON.parse(q.orderby);
+              } catch {
+              }
+            } else {
+              const obj = {};
+              for (const part of q.orderby.split(",")) {
+                const [field, dir] = part.split(":").map((s) => s.trim());
+                if (field) obj[field] = dir?.toLowerCase() === "desc" ? "desc" : "asc";
+              }
+              if (Object.keys(obj).length > 0) orderby = obj;
+            }
+          }
+          let fields;
+          if (typeof q.fields === "string" && q.fields.length > 0) {
+            fields = q.fields.split(",").map((s) => s.trim()).filter(Boolean);
+          } else if (Array.isArray(q.fields)) {
+            fields = q.fields.filter((s) => typeof s === "string" && s.length > 0);
+          }
+          if (!fields || fields.length === 0) {
+            try {
+              const schema = await p.getObjectSchema?.(objectName, projectId);
+              const schemaFields = schema?.fields;
+              if (Array.isArray(schemaFields)) {
+                fields = schemaFields.map((f) => f.name).filter((n) => typeof n === "string");
+              }
+            } catch {
+            }
+          }
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+          const safeObj = objectName.replace(/[^A-Za-z0-9_.-]/g, "_");
+          if (format === "csv") {
+            res.header("Content-Type", "text/csv; charset=utf-8");
+            res.header("Content-Disposition", `attachment; filename="${safeObj}-${stamp}.csv"`);
+          } else {
+            res.header("Content-Type", "application/json; charset=utf-8");
+            res.header("Content-Disposition", `attachment; filename="${safeObj}-${stamp}.json"`);
+          }
+          res.header("X-Export-Format", format);
+          res.header("X-Export-Limit", String(limit));
+          res.header("Cache-Control", "no-store");
+          let exported = 0;
+          let firstChunk = true;
+          let skip = 0;
+          if (format === "json") res.write("[");
+          while (exported < limit) {
+            const take = Math.min(chunkSize, limit - exported);
+            const findArgs = {
+              object: objectName,
+              query: {
+                ...filter ? { $filter: filter } : {},
+                ...orderby ? { $orderby: orderby } : {},
+                $top: take,
+                $skip: skip
+              },
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
+            };
+            const result = await p.findData(findArgs);
+            const rows = Array.isArray(result?.data) ? result.data : Array.isArray(result?.rows) ? result.rows : Array.isArray(result) ? result : [];
+            if (rows.length === 0) break;
+            if (format === "csv") {
+              if ((!fields || fields.length === 0) && firstChunk) {
+                fields = Object.keys(rows[0] ?? {});
+              }
+              const text = rowsToCsv(fields ?? [], rows, firstChunk);
+              res.write(text);
+            } else {
+              for (let i = 0; i < rows.length; i++) {
+                const prefix = firstChunk && i === 0 ? "" : ",";
+                res.write(prefix + JSON.stringify(rows[i]));
+              }
+            }
+            firstChunk = false;
+            exported += rows.length;
+            skip += rows.length;
+            if (rows.length < take) break;
+          }
+          if (format === "json") res.write("]");
+          res.end();
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          try {
+            sendError(res, error, String(req.params?.object || ""));
+          } catch {
+            try {
+              res.end();
+            } catch {
+            }
+          }
+        }
+      },
+      metadata: {
+        summary: "Streaming export of object rows (CSV or JSON)",
+        tags: ["data", "export"]
+      }
+    });
+  }
+  /**
+   * Register global cross-object search endpoint (M10.5).
+   * GET {basePath}/search?q=acme&objects=lead,account&limit=20&perObject=5
+   */
+  registerSearchEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    this.routeManager.register({
+      method: "GET",
+      path: `${basePath}/search`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const searchAll = p.searchAll;
+          if (typeof searchAll !== "function") {
+            res.status(501).json({ code: "NOT_IMPLEMENTED", message: "Search not supported by this protocol" });
+            return;
+          }
+          const q = String(req.query?.q ?? req.query?.query ?? "");
+          const objectsParam = req.query?.objects;
+          const objects = typeof objectsParam === "string" ? objectsParam.split(",").map((s) => s.trim()).filter(Boolean) : Array.isArray(objectsParam) ? objectsParam : void 0;
+          const result = await searchAll.call(p, {
+            q,
+            objects,
+            limit: req.query?.limit ? Number(req.query.limit) : void 0,
+            perObject: req.query?.perObject ? Number(req.query.perObject) : void 0,
+            ...context ? { context } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          const mapped = mapDataError(error);
+          if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") {
+            logError("[REST] Unhandled error:", error);
+          }
+          res.status(mapped.status).json(mapped.body);
+        }
+      },
+      metadata: {
+        summary: "Global cross-object search",
+        tags: ["search"]
+      }
+    });
+  }
+  /**
+   * Register email endpoints (M11.B1 / M10.7).
+   *
+   * POST {basePath}/email/send — send a transactional email via the
+   * `IEmailService` provider registered by EmailServicePlugin. Returns
+   * 501 when no provider is wired so deployments without email
+   * configured fail cleanly.
+   *
+   * Request body:
+   *   {
+   *     to: "a@b.com" | ["a@b.com", { name, address }],
+   *     from?: ..., cc?: ..., bcc?: ..., replyTo?: ...,
+   *     subject: string,
+   *     text?: string, html?: string,  // at least one required
+   *     attachments?: [{ filename, content, contentType?, cid? }],
+   *     headers?: { [name]: value },
+   *     relatedObject?: string, relatedId?: string,
+   *   }
+   */
+  registerEmailEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    this.routeManager.register({
+      method: "POST",
+      path: `${basePath}/email/send`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          if (!this.emailServiceProvider) {
+            res.status(501).json({
+              code: "NOT_IMPLEMENTED",
+              message: "Email service is not configured on this deployment"
+            });
+            return;
+          }
+          const emailService = await this.emailServiceProvider(projectId).catch(() => void 0);
+          if (!emailService || typeof emailService.send !== "function") {
+            res.status(501).json({
+              code: "NOT_IMPLEMENTED",
+              message: "Email service is not configured on this deployment"
+            });
+            return;
+          }
+          const body = req.body ?? {};
+          if (!body || typeof body !== "object") {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "JSON body required" });
+            return;
+          }
+          const input = {
+            ...body,
+            ...body.sentBy === void 0 && context?.userId ? { sentBy: context.userId } : {}
+          };
+          try {
+            const result = await emailService.send(input);
+            if (result?.status === "sent") {
+              res.status(200).json(result);
+            } else {
+              res.status(200).json(result);
+            }
+          } catch (err) {
+            const message = String(err?.message ?? err ?? "send failed");
+            if (message.startsWith("VALIDATION_FAILED")) {
+              res.status(400).json({
+                code: "VALIDATION_FAILED",
+                error: message.replace(/^VALIDATION_FAILED:\s*/, "")
+              });
+              return;
+            }
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Email send unhandled error:", error);
+          res.status(500).json({
+            code: "EMAIL_SEND_FAILED",
+            error: String(error?.message ?? error ?? "send failed").slice(0, 500)
+          });
+        }
+      },
+      metadata: {
+        summary: "Send a transactional email via the configured EmailService",
+        tags: ["email"]
+      }
+    });
+  }
+  /**
+   * Register record-level sharing endpoints (M11.C17).
+   *
+   * Surfaces `ISharingService` over HTTP so the UI can list, create
+   * and revoke per-record grants without going through ObjectQL. The
+   * three routes mirror the share-management drawer in Salesforce /
+   * ServiceNow:
+   *
+   *   GET    {basePath}/data/:object/:id/shares
+   *   POST   {basePath}/data/:object/:id/shares
+   *   DELETE {basePath}/data/:object/:id/shares/:shareId
+   *
+   * All three resolve via `sharingServiceProvider`; routes return 501
+   * when no sharing service is configured so a deployment without the
+   * `@objectstack/plugin-sharing` plugin fails cleanly.
+   */
+  registerSharingEndpoints(basePath) {
+    const { crud } = this.config;
+    const dataPath = `${basePath}${crud.dataPrefix}`;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.sharingServiceProvider) return void 0;
+      try {
+        return await this.sharingServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Sharing service is not configured on this deployment"
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/:object/:id/shares`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listShares(req.params.object, req.params.id, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List shares error:", error);
+          res.status(500).json({ code: "SHARES_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List per-record sharing grants", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/:object/:id/shares`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          const input = {
+            object: req.params.object,
+            recordId: req.params.id,
+            recipientType: body.recipientType ?? body.recipient_type,
+            recipientId: body.recipientId ?? body.recipient_id,
+            accessLevel: body.accessLevel ?? body.access_level,
+            source: body.source,
+            sourceId: body.sourceId ?? body.source_id,
+            reason: body.reason
+          };
+          try {
+            const row = await svc.grant(input, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            const msg = String(err?.message ?? err ?? "");
+            if (msg.startsWith("VALIDATION_FAILED")) {
+              res.status(400).json({
+                code: "VALIDATION_FAILED",
+                error: msg.replace(/^VALIDATION_FAILED:\s*/, "")
+              });
+              return;
+            }
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Grant share error:", error);
+          res.status(500).json({ code: "SHARE_GRANT_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Grant a per-record share to a principal", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/:object/:id/shares/:shareId`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.revoke(req.params.shareId, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Revoke share error:", error);
+          res.status(500).json({ code: "SHARE_REVOKE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Revoke a per-record share by id", tags: ["sharing"] }
+    });
+  }
+  /**
+   * Register sharing-rule endpoints (M10.17). Mirrors the existing
+   * sharing endpoints but operates on `sys_sharing_rule` rows.
+   *
+   *   GET    {basePath}/sharing/rules?object=&activeOnly=
+   *   POST   {basePath}/sharing/rules
+   *   GET    {basePath}/sharing/rules/:idOrName
+   *   DELETE {basePath}/sharing/rules/:idOrName
+   *   POST   {basePath}/sharing/rules/:idOrName/evaluate
+   *
+   * Returns 501 when no sharing-rule service is configured.
+   */
+  registerSharingRuleEndpoints(basePath) {
+    const dataPath = basePath;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.sharingRulesServiceProvider) return void 0;
+      try {
+        return await this.sharingRulesServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Sharing-rule service is not configured on this deployment"
+    });
+    const handleError = (err, res, defaultCode) => {
+      const msg = String(err?.message ?? err ?? "");
+      if (msg.startsWith("VALIDATION_FAILED")) {
+        return res.status(400).json({ code: "VALIDATION_FAILED", error: msg.replace(/^VALIDATION_FAILED:\s*/, "") });
+      }
+      if (msg.startsWith("RULE_NOT_FOUND")) {
+        return res.status(404).json({ code: "RULE_NOT_FOUND", error: msg.replace(/^RULE_NOT_FOUND:?\s*/, "") });
+      }
+      logError(`[REST] sharing-rule ${defaultCode}:`, err);
+      return res.status(500).json({ code: defaultCode, error: msg.slice(0, 500) });
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/sharing/rules`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listRules({
+            object: req.query?.object,
+            activeOnly: req.query?.activeOnly === "true" || req.query?.activeOnly === true
+          }, context ?? {});
+          res.json({ data: rows });
+        } catch (err) {
+          handleError(err, res, "RULE_LIST_FAILED");
+        }
+      },
+      metadata: { summary: "List sharing rules", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/sharing/rules`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          const input = {
+            name: body.name,
+            label: body.label,
+            description: body.description,
+            object: body.object ?? body.object_name,
+            criteria: body.criteria,
+            recipientType: body.recipientType ?? body.recipient_type,
+            recipientId: body.recipientId ?? body.recipient_id,
+            accessLevel: body.accessLevel ?? body.access_level,
+            active: body.active
+          };
+          const row = await svc.defineRule(input, context ?? {});
+          res.status(201).json(row);
+        } catch (err) {
+          handleError(err, res, "RULE_DEFINE_FAILED");
+        }
+      },
+      metadata: { summary: "Create or upsert a sharing rule", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/sharing/rules/:idOrName`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getRule(req.params.idOrName, context ?? {});
+          if (!row) return res.status(404).json({ code: "RULE_NOT_FOUND" });
+          res.json(row);
+        } catch (err) {
+          handleError(err, res, "RULE_GET_FAILED");
+        }
+      },
+      metadata: { summary: "Get a sharing rule by id or name", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/sharing/rules/:idOrName`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.deleteRule(req.params.idOrName, context ?? {});
+          res.status(204).end();
+        } catch (err) {
+          handleError(err, res, "RULE_DELETE_FAILED");
+        }
+      },
+      metadata: { summary: "Delete a sharing rule and its materialised grants", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/sharing/rules/:idOrName/evaluate`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const result = await svc.evaluateRule(req.params.idOrName, context ?? {});
+          res.json(result);
+        } catch (err) {
+          handleError(err, res, "RULE_EVALUATE_FAILED");
+        }
+      },
+      metadata: { summary: "Re-evaluate a sharing rule and reconcile grants", tags: ["sharing"] }
+    });
+  }
+  /**
+   * Register saved-report + scheduled-digest endpoints (M11.C16).
+   *
+   * Surfaces `IReportService` over HTTP so the UI can build,
+   * run, and schedule reports without dropping to ObjectQL. Routes
+   * live at the top of the API surface (alongside `/approvals` and
+   * `/sharing`) — reports are a tenant-wide capability, not a record
+   * on a specific CRUD object:
+   *
+   *   GET    {basePath}/reports?object=&ownerId=
+   *   POST   {basePath}/reports
+   *   GET    {basePath}/reports/:id
+   *   DELETE {basePath}/reports/:id
+   *   POST   {basePath}/reports/:id/run
+   *   POST   {basePath}/reports/:id/schedule
+   *   GET    {basePath}/reports/:id/schedules
+   *   DELETE {basePath}/reports/schedules/:scheduleId
+   *
+   * All routes return 501 when `reportsServiceProvider` is unset so
+   * a deployment without `@objectstack/plugin-reports` fails cleanly.
+   */
+  registerReportsEndpoints(basePath) {
+    const dataPath = basePath;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.reportsServiceProvider) return void 0;
+      try {
+        return await this.reportsServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Reports service is not configured on this deployment"
+    });
+    const handleValidation = (res, err) => {
+      const msg = String(err?.message ?? err ?? "");
+      if (msg.startsWith("VALIDATION_FAILED")) {
+        res.status(400).json({
+          code: "VALIDATION_FAILED",
+          error: msg.replace(/^VALIDATION_FAILED:\s*/, "")
+        });
+        return true;
+      }
+      if (msg.startsWith("REPORT_NOT_FOUND")) {
+        res.status(404).json({ code: "REPORT_NOT_FOUND", error: msg });
+        return true;
+      }
+      return false;
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/reports`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const q = req.query ?? {};
+          const rows = await svc.listReports({ object: q.object, ownerId: q.ownerId }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List reports error:", error);
+          res.status(500).json({ code: "REPORTS_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List saved reports", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/reports`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          try {
+            const row = await svc.saveReport(req.body ?? {}, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleValidation(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Save report error:", error);
+          res.status(500).json({ code: "REPORT_SAVE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Create or update a saved report", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/reports/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getReport(req.params.id, context ?? {});
+          if (!row) {
+            res.status(404).json({ code: "REPORT_NOT_FOUND", error: `Report ${req.params.id} not found` });
+            return;
+          }
+          res.json(row);
+        } catch (error) {
+          logError("[REST] Get report error:", error);
+          res.status(500).json({ code: "REPORT_GET_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Get a saved report by id", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/reports/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.deleteReport(req.params.id, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Delete report error:", error);
+          res.status(500).json({ code: "REPORT_DELETE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Delete a saved report (cascades schedules)", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/reports/:id/run`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          try {
+            const result = await svc.run(req.params.id, context ?? {});
+            res.json(result);
+          } catch (err) {
+            if (handleValidation(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Run report error:", error);
+          res.status(500).json({ code: "REPORT_RUN_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Execute a saved report and return rendered output", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/reports/:id/schedule`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          try {
+            const row = await svc.scheduleReport({
+              reportId: req.params.id,
+              recipients: body.recipients ?? [],
+              name: body.name,
+              intervalMinutes: body.intervalMinutes ?? body.interval_minutes,
+              cronExpression: body.cronExpression ?? body.cron_expression,
+              timezone: body.timezone,
+              format: body.format,
+              subjectTemplate: body.subjectTemplate ?? body.subject_template,
+              ownerId: body.ownerId ?? body.owner_id,
+              active: body.active
+            }, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleValidation(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Schedule report error:", error);
+          res.status(500).json({ code: "REPORT_SCHEDULE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Create a recurring email schedule for a report", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/reports/:id/schedules`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listSchedules({ reportId: req.params.id }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List schedules error:", error);
+          res.status(500).json({ code: "SCHEDULES_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List schedules for a report", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/reports/schedules/:scheduleId`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.unscheduleReport(req.params.scheduleId, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Unschedule report error:", error);
+          res.status(500).json({ code: "SCHEDULE_DELETE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Delete a report schedule by id", tags: ["reports"] }
+    });
+  }
+  /**
+   * Register approval engine endpoints.
+   *
+   * Routes (all under {basePath}/approvals):
+   *   GET    /processes                       — list approval processes
+   *   POST   /processes                       — upsert (defineProcess)
+   *   GET    /processes/:id                   — get by id or name
+   *   DELETE /processes/:id                   — delete process
+   *   POST   /requests                        — submit
+   *   GET    /requests                        — list (filters: status, object, recordId, approverId, submitterId)
+   *   GET    /requests/:id                    — get request
+   *   POST   /requests/:id/approve            — approve current step
+   *   POST   /requests/:id/reject             — reject current step
+   *   POST   /requests/:id/recall             — recall (submitter only)
+   *   GET    /requests/:id/actions            — audit trail
+   *
+   * Returns 501 when `approvalsServiceProvider` is unset so deployments
+   * without `@objectstack/plugin-approvals` fail cleanly.
+   */
+  registerApprovalsEndpoints(basePath) {
+    const dataPath = basePath;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.approvalsServiceProvider) return void 0;
+      try {
+        return await this.approvalsServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Approvals service is not configured on this deployment"
+    });
+    const handleApprovalError = (res, err) => {
+      const msg = String(err?.message ?? err ?? "");
+      const mapping = [
+        [/^VALIDATION_FAILED/, 400, "VALIDATION_FAILED"],
+        [/^DUPLICATE_REQUEST/, 409, "DUPLICATE_REQUEST"],
+        [/^INVALID_STATE/, 409, "INVALID_STATE"],
+        [/^FORBIDDEN/, 403, "FORBIDDEN"],
+        [/^NO_ACTIVE_PROCESS/, 404, "NO_ACTIVE_PROCESS"],
+        [/^PROCESS_NOT_FOUND/, 404, "PROCESS_NOT_FOUND"],
+        [/^REQUEST_NOT_FOUND/, 404, "REQUEST_NOT_FOUND"]
+      ];
+      for (const [re, status, code] of mapping) {
+        if (re.test(msg)) {
+          res.status(status).json({ code, error: msg.replace(/^[A-Z_]+:\s*/, "") });
+          return true;
+        }
+      }
+      return false;
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/processes`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const q = req.query ?? {};
+          const rows = await svc.listProcesses({
+            object: q.object,
+            activeOnly: q.activeOnly === "true" || q.activeOnly === true
+          }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List approval processes error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List approval processes", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/approvals/processes`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          try {
+            const row = await svc.defineProcess(req.body ?? {}, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleApprovalError(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Define approval process error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_DEFINE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Define (upsert) an approval process", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/processes/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getProcess(req.params.id, context ?? {});
+          if (!row) {
+            res.status(404).json({ code: "PROCESS_NOT_FOUND", error: `Approval process '${req.params.id}' not found` });
+            return;
+          }
+          res.json(row);
+        } catch (error) {
+          logError("[REST] Get approval process error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_GET_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Get an approval process by id or name", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/approvals/processes/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.deleteProcess(req.params.id, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Delete approval process error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_DELETE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Delete an approval process", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/approvals/requests`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          try {
+            const row = await svc.submit({
+              object: body.object,
+              recordId: body.recordId ?? body.record_id,
+              processName: body.processName ?? body.process_name,
+              submitterId: body.submitterId ?? body.submitter_id ?? context?.userId,
+              comment: body.comment,
+              payload: body.payload
+            }, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleApprovalError(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Submit approval error:", error);
+          res.status(500).json({ code: "APPROVAL_SUBMIT_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Submit a record for approval", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/requests`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) {
+            res.json({ data: [] });
+            return;
+          }
+          const q = req.query ?? {};
+          const rows = await svc.listRequests({
+            object: q.object,
+            recordId: q.recordId ?? q.record_id,
+            status: q.status,
+            approverId: q.approverId ?? q.approver_id,
+            submitterId: q.submitterId ?? q.submitter_id
+          }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List approval requests error:", error);
+          res.status(500).json({ code: "APPROVAL_REQUEST_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List approval requests", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/requests/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getRequest(req.params.id, context ?? {});
+          if (!row) {
+            res.status(404).json({ code: "REQUEST_NOT_FOUND", error: `Approval request '${req.params.id}' not found` });
+            return;
+          }
+          res.json(row);
+        } catch (error) {
+          logError("[REST] Get approval request error:", error);
+          res.status(500).json({ code: "APPROVAL_REQUEST_GET_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Get an approval request by id", tags: ["approvals"] }
+    });
+    const decisionRoute = (suffix, method) => {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/approvals/requests/:id/${suffix}`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const svc = await resolveService(projectId);
+            if (!svc) return respond501(res);
+            const body = req.body ?? {};
+            try {
+              const out = await svc[method](req.params.id, {
+                actorId: body.actorId ?? body.actor_id ?? context?.userId,
+                comment: body.comment
+              }, context ?? {});
+              res.json(out);
+            } catch (err) {
+              if (handleApprovalError(res, err)) return;
+              throw err;
+            }
+          } catch (error) {
+            logError(`[REST] ${suffix} approval error:`, error);
+            res.status(500).json({ code: `APPROVAL_${suffix.toUpperCase()}_FAILED`, error: String(error?.message ?? error).slice(0, 500) });
+          }
+        },
+        metadata: { summary: `${suffix[0].toUpperCase()}${suffix.slice(1)} an approval request`, tags: ["approvals"] }
+      });
+    };
+    decisionRoute("approve", "approve");
+    decisionRoute("reject", "reject");
+    decisionRoute("recall", "recall");
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/requests/:id/actions`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listActions(req.params.id, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List approval actions error:", error);
+          res.status(500).json({ code: "APPROVAL_ACTIONS_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List actions (audit trail) for an approval request", tags: ["approvals"] }
+    });
+  }
+  /**
+   * Register batch operation endpoints
+   */
+  registerBatchEndpoints(basePath) {
+    const { crud, batch } = this.config;
+    const dataPath = `${basePath}${crud.dataPrefix}`;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const operations = batch.operations;
+    if (batch.enableBatchEndpoint && this.protocol.batchData) {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/:object/batch`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.batchData({
               object: req.params.object,
-              records: req.body || []
+              request: req.body,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
+            });
+            res.json(result);
+          } catch (error) {
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error, req.params?.object);
+          }
+        },
+        metadata: {
+          summary: "Batch operations",
+          tags: ["data", "batch"]
+        }
+      });
+    }
+    if (operations.createMany && this.protocol.createManyData) {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/:object/createMany`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.createManyData({
+              object: req.params.object,
+              records: req.body || [],
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.status(201).json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error, req.params?.object);
           }
         },
         metadata: {
@@ -670,13 +2628,20 @@ var RestServer = class {
         path: `${dataPath}/:object/updateMany`,
         handler: async (req, res) => {
           try {
-            const result = await this.protocol.updateManyData({
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.updateManyData({
               object: req.params.object,
-              ...req.body
+              ...req.body,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error, req.params?.object);
           }
         },
         metadata: {
@@ -691,13 +2656,20 @@ var RestServer = class {
         path: `${dataPath}/:object/deleteMany`,
         handler: async (req, res) => {
           try {
-            const result = await this.protocol.deleteManyData({
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.deleteManyData({
               object: req.params.object,
-              ...req.body
+              ...req.body,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            res.status(400).json({ error: error.message });
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error, req.params?.object);
           }
         },
         metadata: {
@@ -721,6 +2693,123 @@ var RestServer = class {
   }
 };
 
+// src/package-routes.ts
+function registerPackageRoutes(server, packageService, basePath = "/api/v1", options = {}) {
+  const packagesPath = `${basePath}/packages`;
+  server.post(packagesPath, async (req, res) => {
+    try {
+      const { manifest, metadata } = req.body || {};
+      if (!manifest || !metadata) {
+        res.status(400).json({ error: "Missing required fields: manifest, metadata" });
+        return;
+      }
+      if (!manifest.id || !manifest.version) {
+        res.status(400).json({ error: "Invalid manifest: id and version are required" });
+        return;
+      }
+      const result = await packageService.publish({ manifest, metadata });
+      if (result.success) {
+        res.json({
+          success: true,
+          message: `Published ${manifest.id}@${manifest.version}`,
+          package: {
+            id: manifest.id,
+            version: manifest.version
+          }
+        });
+        return;
+      }
+      res.status(400).json({ success: false, error: result.error });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  });
+  server.get(packagesPath, async (_req, res) => {
+    try {
+      const packagesMap = /* @__PURE__ */ new Map();
+      if (options.protocol && typeof options.protocol.getMetaItems === "function") {
+        try {
+          const result = await options.protocol.getMetaItems({ type: "package" });
+          if (result?.items) {
+            for (const item of result.items) {
+              const id = item.manifest?.id || item.id;
+              if (id) {
+                packagesMap.set(id, {
+                  ...item,
+                  source: "registry"
+                });
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      try {
+        const dbPackages = await packageService.list();
+        for (const pkg of dbPackages) {
+          const id = pkg.manifest?.id || pkg.id;
+          if (id) {
+            packagesMap.set(id, {
+              ...packagesMap.get(id),
+              ...pkg,
+              source: packagesMap.has(id) ? "both" : "database"
+            });
+          }
+        }
+      } catch {
+      }
+      const packages = Array.from(packagesMap.values());
+      res.json({ packages, total: packages.length });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  });
+  server.get(`${packagesPath}/:id`, async (req, res) => {
+    try {
+      const packageId = req.params.id;
+      const version = req.query?.version || "latest";
+      const pkg = await packageService.get(packageId, version);
+      if (pkg) {
+        res.json({ package: { ...pkg, source: "database" } });
+        return;
+      }
+      if (options.protocol && typeof options.protocol.getMetaItems === "function") {
+        try {
+          const result = await options.protocol.getMetaItems({ type: "package" });
+          const match = result?.items?.find(
+            (item) => (item.manifest?.id || item.id) === packageId
+          );
+          if (match) {
+            res.json({ package: { ...match, source: "registry" } });
+            return;
+          }
+        } catch {
+        }
+      }
+      res.status(404).json({ error: "Package not found" });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  });
+  server.delete(`${packagesPath}/:id`, async (req, res) => {
+    try {
+      const packageId = req.params.id;
+      const version = req.query?.version;
+      const result = await packageService.delete(packageId, version);
+      if (result.success) {
+        res.json({
+          success: true,
+          message: `Deleted ${packageId}${version ? `@${version}` : ""}`
+        });
+        return;
+      }
+      res.status(400).json({ success: false });
+    } catch (error) {
+      res.status(500).json({ error: error.message });
+    }
+  });
+}
+
 // src/rest-api-plugin.ts
 function createRestApiPlugin(config = {}) {
   return {
@@ -741,6 +2830,74 @@ function createRestApiPlugin(config = {}) {
         protocol = ctx.getService(protocolService);
       } catch (e) {
       }
+      let kernelManager;
+      const kernelManagerService = config.kernelManagerServiceName || "kernel-manager";
+      try {
+        kernelManager = ctx.getService(kernelManagerService);
+      } catch (e) {
+      }
+      let envRegistry;
+      try {
+        envRegistry = ctx.getService("env-registry");
+      } catch (e) {
+      }
+      const defaultProjectIdProvider = () => {
+        try {
+          const dp = ctx.getService("default-project");
+          return dp?.projectId;
+        } catch {
+          return void 0;
+        }
+      };
+      const authServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("auth");
+        } catch {
+          return void 0;
+        }
+      };
+      const objectQLProvider = async (_projectId) => {
+        try {
+          return ctx.getService("objectql");
+        } catch {
+          return void 0;
+        }
+      };
+      const emailServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("email");
+        } catch {
+          return void 0;
+        }
+      };
+      const sharingServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("sharing");
+        } catch {
+          return void 0;
+        }
+      };
+      const reportsServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("reports");
+        } catch {
+          return void 0;
+        }
+      };
+      const approvalsServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("approvals");
+        } catch {
+          return void 0;
+        }
+      };
+      const sharingRulesServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("sharingRules");
+        } catch {
+          return void 0;
+        }
+      };
       if (!server) {
         ctx.logger.warn(`RestApiPlugin: HTTP Server service '${serverService}' not found. REST routes skipped.`);
         return;
@@ -751,13 +2908,38 @@ function createRestApiPlugin(config = {}) {
       }
       ctx.logger.info("Hydrating REST API from Protocol...");
       try {
-        const restServer = new RestServer(server, protocol, config.api);
+        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultProjectIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider);
         restServer.registerRoutes();
         ctx.logger.info("REST API successfully registered");
       } catch (err) {
         ctx.logger.error("Failed to register REST API routes", { error: err.message });
         throw err;
       }
+      try {
+        const packageService = ctx.getService("package");
+        if (packageService) {
+          const basePath = config.api?.api?.basePath || "/api";
+          const version = config.api?.api?.version || "v1";
+          const versionedBase = `${basePath}/${version}`;
+          const enableProjectScoping = config.api?.api?.enableProjectScoping ?? false;
+          const projectResolution = config.api?.api?.projectResolution ?? "auto";
+          if (enableProjectScoping && projectResolution === "required") {
+            registerPackageRoutes(server, packageService, `${versionedBase}/projects/:projectId`, {
+              protocol
+            });
+          } else {
+            registerPackageRoutes(server, packageService, versionedBase, { protocol });
+            if (enableProjectScoping) {
+              registerPackageRoutes(server, packageService, `${versionedBase}/projects/:projectId`, {
+                protocol
+              });
+            }
+          }
+          ctx.logger.info("Package management routes registered");
+        }
+      } catch (e) {
+        ctx.logger.debug("Package service not available, package routes skipped");
+      }
     }
   };
 }