@objectstack/rest 4.0.5 → 4.1.1

package/dist/index.cjs

@@ -250,6 +250,17 @@ var RouteGroupBuilder = class {
 // src/rest-server.ts
 var logError = (...args) => globalThis.console?.error(...args);
 function mapDataError(error, object) {
+  if (error?.code === "VALIDATION_FAILED" || error?.name === "ValidationError") {
+    return {
+      status: 400,
+      body: {
+        error: error?.message ?? "Validation failed",
+        code: "VALIDATION_FAILED",
+        fields: Array.isArray(error?.fields) ? error.fields : [],
+        ...object ? { object } : {}
+      }
+    };
+  }
   if (error?.code === "PERMISSION_DENIED" || error?.name === "PermissionDeniedError" || typeof error?.message === "string" && error.message.startsWith("[Security] Access denied")) {
     return {
       status: 403,
@@ -273,6 +284,16 @@ function mapDataError(error, object) {
       }
     };
   }
+  if (error?.code === "RECORD_NOT_FOUND" || /^Record\s+\S+\s+not found in\s+\S+/i.test(raw)) {
+    return {
+      status: 404,
+      body: {
+        error: raw,
+        code: "RECORD_NOT_FOUND",
+        ...object ? { object } : {}
+      }
+    };
+  }
   const looksLikeUnknownObject = lower.includes("no such table") || lower.includes("relation") && lower.includes("does not exist") || lower.includes("table not found") || lower.includes("unknown object") || lower.includes("object not found") || lower.includes("no driver available") || object !== void 0 && lower.includes(`'${object.toLowerCase()}'`) && lower.includes("not");
   if (looksLikeUnknownObject) {
     return {
@@ -284,13 +305,132 @@ function mapDataError(error, object) {
       }
     };
   }
+  const looksLikeSqlLeak = lower.includes("sqlite_") || lower.includes("sqlstate") || lower.startsWith("insert into ") || lower.startsWith("update ") || lower.startsWith("select ") || lower.startsWith("delete from ") || lower.includes("constraint failed") || lower.includes("unique constraint") || lower.includes("foreign key");
+  if (looksLikeSqlLeak) {
+    if (lower.includes("unique constraint") || lower.includes("unique violation")) {
+      return {
+        status: 409,
+        body: {
+          error: "A record with this value already exists",
+          code: "UNIQUE_VIOLATION",
+          ...object ? { object } : {}
+        }
+      };
+    }
+    return {
+      status: 500,
+      body: { error: "Internal data error", code: "DATABASE_ERROR" }
+    };
+  }
   return { status: 400, body: { error: raw || "Bad request" } };
 }
+function sendError(res, error, object) {
+  if (typeof error?.status === "number" && error.status >= 400 && error.status < 600) {
+    const safeMsg = typeof error.message === "string" && error.message.length < 500 ? error.message : "Request failed";
+    res.status(error.status).json({
+      error: safeMsg,
+      ...error.code ? { code: error.code } : {}
+    });
+    return;
+  }
+  const mapped = mapDataError(error, object);
+  res.status(mapped.status).json(mapped.body);
+}
 function isExpectedDataStatus(status) {
-  return status === 403 || status === 404 || status === 502 || status === 503;
+  return status === 403 || status === 404 || status === 409 || status === 502 || status === 503;
+}
+function parseCsvToRows(csv, mapping = {}) {
+  const text = csv.replace(/^\uFEFF/, "");
+  const cells = [];
+  let cur = "";
+  let row = [];
+  let inQuotes = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (text[i + 1] === '"') {
+          cur += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        cur += ch;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inQuotes = true;
+      continue;
+    }
+    if (ch === ",") {
+      row.push(cur);
+      cur = "";
+      continue;
+    }
+    if (ch === "\r") {
+      continue;
+    }
+    if (ch === "\n") {
+      row.push(cur);
+      cur = "";
+      cells.push(row);
+      row = [];
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur.length > 0 || row.length > 0) {
+    row.push(cur);
+    cells.push(row);
+  }
+  while (cells.length > 0 && cells[cells.length - 1].every((c) => c === "")) cells.pop();
+  if (cells.length < 2) return [];
+  const header = cells[0].map((h) => h.trim());
+  const fields = header.map((h) => mapping[h] ?? h);
+  const out = [];
+  for (let r = 1; r < cells.length; r++) {
+    const row2 = cells[r];
+    const obj = {};
+    for (let c = 0; c < fields.length; c++) {
+      const key = fields[c];
+      if (!key) continue;
+      const raw = row2[c] ?? "";
+      obj[key] = raw;
+    }
+    out.push(obj);
+  }
+  return out;
+}
+function formatCsvCell(value) {
+  if (value === null || value === void 0) return "";
+  let s;
+  if (typeof value === "string") s = value;
+  else if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") s = String(value);
+  else if (value instanceof Date) s = value.toISOString();
+  else {
+    try {
+      s = JSON.stringify(value);
+    } catch {
+      s = String(value);
+    }
+  }
+  if (/[",\r\n]/.test(s)) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  return s;
+}
+function rowsToCsv(fields, rows, includeHeader) {
+  const lines = [];
+  if (includeHeader) lines.push(fields.map(formatCsvCell).join(","));
+  for (const row of rows) {
+    lines.push(fields.map((f) => formatCsvCell(row?.[f])).join(","));
+  }
+  return lines.join("\r\n") + (lines.length > 0 ? "\r\n" : "");
 }
 var RestServer = class {
-  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultProjectIdProvider, authServiceProvider, objectQLProvider) {
+  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultProjectIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider) {
     this.protocol = protocol;
     this.config = this.normalizeConfig(config);
     this.routeManager = new RouteManager(server);
@@ -299,6 +439,12 @@ var RestServer = class {
     this.defaultProjectIdProvider = defaultProjectIdProvider;
     this.authServiceProvider = authServiceProvider;
     this.objectQLProvider = objectQLProvider;
+    this.emailServiceProvider = emailServiceProvider;
+    this.sharingServiceProvider = sharingServiceProvider;
+    this.reportsServiceProvider = reportsServiceProvider;
+    this.approvalsServiceProvider = approvalsServiceProvider;
+    this.sharingRulesServiceProvider = sharingRulesServiceProvider;
+    this.i18nServiceProvider = i18nServiceProvider;
   }
   /**
    * Resolve the protocol for a given request. When `projectId` is present
@@ -366,14 +512,70 @@ var RestServer = class {
    * requests intentionally return `undefined` because the platform kernel
    * does not own per-app translation bundles.
    */
-  async resolveI18nService(projectId) {
-    if (!projectId || projectId === "platform" || !this.kernelManager) return void 0;
-    try {
-      const kernel = await this.kernelManager.getOrCreate(projectId);
-      return await kernel.getServiceAsync("i18n");
-    } catch {
-      return void 0;
+  async resolveI18nService(projectId, req) {
+    if (projectId === "platform") return void 0;
+    if (!projectId && req && this.envRegistry && this.kernelManager) {
+      const host = this.extractHostname(req);
+      if (host) {
+        try {
+          const result = await this.envRegistry.resolveByHostname(host);
+          if (result?.projectId) projectId = result.projectId;
+        } catch {
+        }
+      }
+      if (!projectId && typeof this.envRegistry.resolveById === "function") {
+        const headerVal = this.extractProjectIdHeader(req);
+        if (headerVal) {
+          try {
+            const driver = await this.envRegistry.resolveById(headerVal);
+            if (driver) projectId = headerVal;
+          } catch {
+          }
+        }
+      }
+    }
+    if (!projectId && this.defaultProjectIdProvider) {
+      try {
+        const def = this.defaultProjectIdProvider();
+        if (def) projectId = def;
+      } catch {
+      }
+    }
+    if (projectId && this.kernelManager) {
+      try {
+        const kernel = await this.kernelManager.getOrCreate(projectId);
+        const svc = await kernel.getServiceAsync("i18n");
+        if (svc) return svc;
+      } catch {
+      }
+    }
+    if (this.i18nServiceProvider) {
+      try {
+        return await this.i18nServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
     }
+    return void 0;
+  }
+  /**
+   * Reject anonymous requests with HTTP 401 when `api.requireAuth` is set.
+   * Returns `true` if the response was sent and the caller should stop
+   * processing. Returns `false` to continue.
+   *
+   * The check is intentionally narrow: only `context?.userId` counts as
+   * "authenticated". `isSystem` flags are never set on inbound HTTP
+   * requests (they're internal-only), so they cannot bypass this gate.
+   */
+  enforceAuth(req, res, context) {
+    if (!this.config.api.requireAuth) return false;
+    if (context?.userId) return false;
+    if (req?.method === "OPTIONS") return false;
+    res.status(401).json({
+      error: "unauthenticated",
+      message: "Authentication is required to access this endpoint."
+    });
+    return true;
   }
   /**
    * Resolve the request's execution context (RBAC/RLS/FLS) by looking up
@@ -383,6 +585,26 @@ var RestServer = class {
    */
   async resolveExecCtx(projectId, req) {
     try {
+      if (!projectId && req && this.envRegistry && this.kernelManager) {
+        const host = this.extractHostname(req);
+        if (host) {
+          try {
+            const result = await this.envRegistry.resolveByHostname(host);
+            if (result?.projectId) projectId = result.projectId;
+          } catch {
+          }
+        }
+        if (!projectId && typeof this.envRegistry.resolveById === "function") {
+          const headerVal = this.extractProjectIdHeader(req);
+          if (headerVal) {
+            try {
+              const driver = await this.envRegistry.resolveById(headerVal);
+              if (driver) projectId = headerVal;
+            } catch {
+            }
+          }
+        }
+      }
       let authService;
       let kernel;
       if (projectId && projectId !== "platform" && this.kernelManager) {
@@ -536,8 +758,8 @@ var RestServer = class {
    */
   async translateMetaItem(req, type, projectId, item) {
     if (!item || typeof item !== "object") return item;
-    if (type !== "view" && type !== "action") return item;
-    const i18n = await this.resolveI18nService(projectId);
+    if (type !== "view" && type !== "action" && type !== "object") return item;
+    const i18n = await this.resolveI18nService(projectId, req);
     const bundle = this.buildTranslationBundle(i18n);
     if (!bundle) return item;
     const locale = this.extractLocale(req, i18n);
@@ -550,8 +772,8 @@ var RestServer = class {
    */
   async translateMetaItems(req, type, projectId, items) {
     if (!Array.isArray(items)) return items;
-    if (type !== "view" && type !== "action") return items;
-    const i18n = await this.resolveI18nService(projectId);
+    if (type !== "view" && type !== "action" && type !== "object") return items;
+    const i18n = await this.resolveI18nService(projectId, req);
     const bundle = this.buildTranslationBundle(i18n);
     if (!bundle) return items;
     const locale = this.extractLocale(req, i18n);
@@ -622,8 +844,10 @@ var RestServer = class {
         enableUi: api.enableUi ?? true,
         enableBatch: api.enableBatch ?? true,
         enableDiscovery: api.enableDiscovery ?? true,
+        enableSearch: api.enableSearch ?? true,
         enableProjectScoping: api.enableProjectScoping ?? false,
         projectResolution: api.projectResolution ?? "auto",
+        requireAuth: api.requireAuth ?? false,
         documentation: api.documentation,
         responseFormat: api.responseFormat
       },
@@ -705,9 +929,19 @@ var RestServer = class {
       if (this.config.api.enableUi) {
         this.registerUiEndpoints(bp);
       }
+      if (this.config.api.enableSearch ?? true) {
+        this.registerSearchEndpoints(bp);
+      }
+      this.registerEmailEndpoints(bp);
+      this.registerFormEndpoints(bp);
+      this.registerSharingEndpoints(bp);
+      this.registerSharingRuleEndpoints(bp);
+      this.registerReportsEndpoints(bp);
+      this.registerApprovalsEndpoints(bp);
       if (this.config.api.enableCrud) {
         this.registerCrudEndpoints(bp);
       }
+      this.registerDataActionEndpoints(bp);
       if (this.config.api.enableBatch) {
         this.registerBatchEndpoints(bp);
       }
@@ -758,7 +992,7 @@ var RestServer = class {
         res.json(discovery);
       } catch (error) {
         logError("[REST] Unhandled error:", error);
-        res.status(500).json({ error: error.message });
+        sendError(res, error);
       }
     };
     this.routeManager.register({
@@ -799,7 +1033,7 @@ var RestServer = class {
             res.json(types);
           } catch (error) {
             logError("[REST] Unhandled error:", error);
-            res.status(500).json({ error: error.message });
+            sendError(res, error);
           }
         },
         metadata: {
@@ -827,7 +1061,7 @@ var RestServer = class {
             res.json(translated);
           } catch (error) {
             logError("[REST] Unhandled error:", error);
-            res.status(404).json({ error: error.message });
+            sendError(res, error);
           }
         },
         metadata: {
@@ -885,7 +1119,7 @@ var RestServer = class {
             }
           } catch (error) {
             logError("[REST] Unhandled error:", error);
-            res.status(404).json({ error: error.message });
+            sendError(res, error);
           }
         },
         metadata: {
@@ -905,16 +1139,18 @@ var RestServer = class {
             res.status(501).json({ error: "Save operation not supported by protocol implementation" });
             return;
           }
+          const body = req.body ?? {};
+          const item = body && typeof body === "object" && "metadata" in body ? body.metadata : body && typeof body === "object" && "item" in body ? body.item : body;
           const result = await p.saveMetaItem({
             type: req.params.type,
             name: req.params.name,
-            item: req.body,
+            item,
             ...projectId ? { projectId } : {}
           });
           res.json(result);
         } catch (error) {
           logError("[REST] Unhandled error:", error);
-          res.status(400).json({ error: error.message });
+          sendError(res, error);
         }
       },
       metadata: {
@@ -922,6 +1158,92 @@ var RestServer = class {
         tags: ["metadata"]
       }
     });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${metaPath}/:type/:name`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          if (!p.deleteMetaItem) {
+            res.status(501).json({
+              error: "Reset operation not supported by protocol implementation"
+            });
+            return;
+          }
+          const result = await p.deleteMetaItem({
+            type: req.params.type,
+            name: req.params.name,
+            ...projectId ? { projectId } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error);
+        }
+      },
+      metadata: {
+        summary: "Reset metadata item to artifact default (deletes customization overlay)",
+        tags: ["metadata"]
+      }
+    });
+    if (metadata.endpoints.item !== false) {
+      this.routeManager.register({
+        method: "GET",
+        path: `${metaPath}/:type/:section/:name`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const compoundName = `${req.params.section}/${req.params.name}`;
+            const packageId = req.query?.package || void 0;
+            const item = await p.getMetaItem({
+              type: req.params.type,
+              name: compoundName,
+              packageId
+            });
+            res.header("Vary", "Accept-Language");
+            res.json(await this.translateMetaItem(req, req.params.type, projectId, item));
+          } catch (error) {
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error);
+          }
+        },
+        metadata: {
+          summary: "Get specific metadata item by compound name",
+          tags: ["metadata"]
+        }
+      });
+    }
+    this.routeManager.register({
+      method: "PUT",
+      path: `${metaPath}/:type/:section/:name`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          if (!p.saveMetaItem) {
+            res.status(501).json({ error: "Save operation not supported by protocol implementation" });
+            return;
+          }
+          const compoundName = `${req.params.section}/${req.params.name}`;
+          const result = await p.saveMetaItem({
+            type: req.params.type,
+            name: compoundName,
+            item: req.body,
+            ...projectId ? { projectId } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error);
+        }
+      },
+      metadata: {
+        summary: "Save specific metadata item by compound name",
+        tags: ["metadata"]
+      }
+    });
   }
   /**
    * Register UI endpoints
@@ -948,7 +1270,7 @@ var RestServer = class {
           }
         } catch (error) {
           logError("[REST] Unhandled error:", error);
-          res.status(404).json({ error: error.message });
+          sendError(res, error, req.params?.object);
         }
       },
       metadata: {
@@ -974,6 +1296,7 @@ var RestServer = class {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
             const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
             const result = await p.findData({
               object: req.params.object,
               query: req.query,
@@ -1007,6 +1330,7 @@ var RestServer = class {
             const p = await this.resolveProtocol(projectId, req);
             const { select, expand } = req.query || {};
             const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
             const result = await p.getData({
               object: req.params.object,
               id: req.params.id,
@@ -1018,7 +1342,7 @@ var RestServer = class {
             res.json(result);
           } catch (error) {
             const mapped = mapDataError(error, req.params?.object);
-            if (!isExpectedDataStatus(mapped.status)) logError("[REST] Unhandled error:", error);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
             res.status(mapped.status === 400 ? 404 : mapped.status).json(mapped.body);
           }
         },
@@ -1037,6 +1361,7 @@ var RestServer = class {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
             const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
             const result = await p.createData({
               object: req.params.object,
               data: req.body,
@@ -1046,7 +1371,7 @@ var RestServer = class {
             res.status(201).json(result);
           } catch (error) {
             const mapped = mapDataError(error, req.params?.object);
-            if (!isExpectedDataStatus(mapped.status)) logError("[REST] Unhandled error:", error);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
             res.status(mapped.status).json(mapped.body);
           }
         },
@@ -1056,19 +1381,19 @@ var RestServer = class {
         }
       });
     }
-    if (operations.update) {
+    if (operations.list) {
       this.routeManager.register({
-        method: "PATCH",
-        path: `${dataPath}/:object/:id`,
+        method: "POST",
+        path: `${dataPath}/:object/query`,
         handler: async (req, res) => {
           try {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
             const context = await this.resolveExecCtx(projectId, req);
-            const result = await p.updateData({
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.findData({
               object: req.params.object,
-              id: req.params.id,
-              data: req.body,
+              query: req.body || {},
               ...projectId ? { projectId } : {},
               ...context ? { context } : {}
             });
@@ -1080,95 +1405,1640 @@ var RestServer = class {
           }
         },
         metadata: {
-          summary: "Update record",
+          summary: "Advanced query (QueryAST in body)",
           tags: ["data", "crud"]
         }
       });
     }
-    if (operations.delete) {
+    if (operations.update) {
       this.routeManager.register({
-        method: "DELETE",
+        method: "PATCH",
         path: `${dataPath}/:object/:id`,
         handler: async (req, res) => {
           try {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
             const context = await this.resolveExecCtx(projectId, req);
-            const result = await p.deleteData({
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.updateData({
               object: req.params.object,
               id: req.params.id,
+              data: req.body,
               ...projectId ? { projectId } : {},
               ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
             const mapped = mapDataError(error, req.params?.object);
-            if (!isExpectedDataStatus(mapped.status)) logError("[REST] Unhandled error:", error);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
             res.status(mapped.status).json(mapped.body);
           }
         },
         metadata: {
-          summary: "Delete record",
+          summary: "Update record",
           tags: ["data", "crud"]
         }
       });
     }
-  }
-  /**
-   * Register batch operation endpoints
-   */
-  registerBatchEndpoints(basePath) {
-    const { crud, batch } = this.config;
-    const dataPath = `${basePath}${crud.dataPrefix}`;
-    const isScoped = basePath.includes("/projects/:projectId");
-    const operations = batch.operations;
-    if (batch.enableBatchEndpoint && this.protocol.batchData) {
+    if (operations.delete) {
       this.routeManager.register({
-        method: "POST",
-        path: `${dataPath}/:object/batch`,
+        method: "DELETE",
+        path: `${dataPath}/:object/:id`,
         handler: async (req, res) => {
           try {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
-            const result = await p.batchData({
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.deleteData({
               object: req.params.object,
-              request: req.body,
-              ...projectId ? { projectId } : {}
+              id: req.params.id,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
-            logError("[REST] Unhandled error:", error);
-            res.status(400).json({ error: error.message });
+            const mapped = mapDataError(error, req.params?.object);
+            if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") logError("[REST] Unhandled error:", error);
+            res.status(mapped.status).json(mapped.body);
           }
         },
         metadata: {
-          summary: "Batch operations",
-          tags: ["data", "batch"]
+          summary: "Delete record",
+          tags: ["data", "crud"]
         }
       });
     }
-    if (operations.createMany && this.protocol.createManyData) {
-      this.routeManager.register({
-        method: "POST",
-        path: `${dataPath}/:object/createMany`,
-        handler: async (req, res) => {
-          try {
-            const projectId = isScoped ? req.params?.projectId : void 0;
-            const p = await this.resolveProtocol(projectId, req);
-            const result = await p.createManyData({
-              object: req.params.object,
-              records: req.body || [],
-              ...projectId ? { projectId } : {}
-            });
-            res.status(201).json(result);
-          } catch (error) {
-            logError("[REST] Unhandled error:", error);
-            res.status(400).json({ error: error.message });
+  }
+  /**
+   * Register object-specific action endpoints that don't fit the
+   * generic CRUD shape. These are domain operations (Salesforce
+   * convertLead, etc.) where the protocol implementation does its own
+   * multi-record orchestration and we just need a thin HTTP route.
+   *
+   * POST {basePath}/data/lead/:id/convert — M10.6 lead conversion.
+   */
+  registerDataActionEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    const { crud } = this.config;
+    const dataPath = `${basePath}${crud.dataPrefix}`;
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/lead/:id/convert`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const convertLead = p.convertLead;
+          if (typeof convertLead !== "function") {
+            res.status(501).json({ code: "NOT_IMPLEMENTED", error: "Lead convert not supported by this protocol" });
+            return;
           }
-        },
-        metadata: {
-          summary: "Create multiple records",
-          tags: ["data", "batch"]
+          const body = req.body ?? {};
+          const result = await convertLead.call(p, {
+            leadId: req.params.id,
+            accountId: body.accountId,
+            contactId: body.contactId,
+            createOpportunity: body.createOpportunity,
+            opportunity: body.opportunity,
+            convertedStatus: body.convertedStatus,
+            ...context ? { context } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error, "lead");
+        }
+      },
+      metadata: {
+        summary: "Convert a Lead into Account + Contact (+ optional Opportunity)",
+        tags: ["data", "lead"]
+      }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/:object/import`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const objectName = String(req.params.object || "");
+          if (!objectName) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "object is required" });
+            return;
+          }
+          const body = req.body ?? {};
+          const dryRun = body.dryRun === true;
+          const mapping = body.mapping ?? {};
+          let rows = [];
+          if (body.format === "json" && Array.isArray(body.rows)) {
+            rows = body.rows;
+          } else if ((body.format === "csv" || typeof body.csv === "string") && typeof body.csv === "string") {
+            rows = parseCsvToRows(body.csv, mapping);
+          } else if (Array.isArray(body)) {
+            rows = body;
+          } else {
+            res.status(400).json({
+              code: "INVALID_REQUEST",
+              error: 'Provide either format:"csv" with csv text or format:"json" with rows[]'
+            });
+            return;
+          }
+          const max = 5e3;
+          if (rows.length > max) {
+            res.status(413).json({
+              code: "PAYLOAD_TOO_LARGE",
+              error: `Import limit is ${max} rows per request (got ${rows.length})`
+            });
+            return;
+          }
+          const results = [];
+          let okCount = 0;
+          let errCount = 0;
+          for (let i = 0; i < rows.length; i++) {
+            const data = rows[i];
+            try {
+              if (dryRun) {
+                const validate = p.validate;
+                if (typeof validate === "function") {
+                  await validate.call(p, { object: objectName, data, context });
+                }
+                results.push({ row: i + 1, ok: true });
+                okCount++;
+              } else {
+                const created = await p.createData({ object: objectName, data, context });
+                const id = created?.id ?? created?.record?.id;
+                results.push({ row: i + 1, ok: true, id });
+                okCount++;
+              }
+            } catch (err) {
+              errCount++;
+              const code = err?.code ?? "IMPORT_ROW_FAILED";
+              const message = typeof err?.message === "string" ? err.message.slice(0, 300) : "Row failed";
+              results.push({ row: i + 1, ok: false, error: message, code });
+            }
+          }
+          res.json({
+            object: objectName,
+            dryRun,
+            total: rows.length,
+            ok: okCount,
+            errors: errCount,
+            results
+          });
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          sendError(res, error, String(req.params?.object || ""));
+        }
+      },
+      metadata: {
+        summary: "Bulk-import rows into an object (CSV or JSON, with optional dry-run)",
+        tags: ["data", "import"]
+      }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/:object/export`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const objectName = String(req.params.object || "");
+          if (!objectName) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "object is required" });
+            return;
+          }
+          const q = req.query ?? {};
+          const format = String(q.format ?? "csv").toLowerCase() === "json" ? "json" : "csv";
+          const HARD_CAP = 5e4;
+          const MAX_CHUNK = 5e3;
+          const requestedLimit = q.limit != null ? Math.max(1, Number(q.limit) || 0) : 1e4;
+          const limit = Math.min(requestedLimit, HARD_CAP);
+          const chunkSize = Math.min(MAX_CHUNK, Math.max(50, q.page != null ? Number(q.page) || 500 : 500));
+          let filter = void 0;
+          if (typeof q.filter === "string" && q.filter.length > 0) {
+            try {
+              filter = JSON.parse(q.filter);
+            } catch {
+              res.status(400).json({ code: "INVALID_REQUEST", error: "filter must be JSON" });
+              return;
+            }
+          } else if (q.filter && typeof q.filter === "object") {
+            filter = q.filter;
+          }
+          let orderby = void 0;
+          if (typeof q.orderby === "string" && q.orderby.length > 0) {
+            if (q.orderby.startsWith("{") || q.orderby.startsWith("[")) {
+              try {
+                orderby = JSON.parse(q.orderby);
+              } catch {
+              }
+            } else {
+              const obj = {};
+              for (const part of q.orderby.split(",")) {
+                const [field, dir] = part.split(":").map((s) => s.trim());
+                if (field) obj[field] = dir?.toLowerCase() === "desc" ? "desc" : "asc";
+              }
+              if (Object.keys(obj).length > 0) orderby = obj;
+            }
+          }
+          let fields;
+          if (typeof q.fields === "string" && q.fields.length > 0) {
+            fields = q.fields.split(",").map((s) => s.trim()).filter(Boolean);
+          } else if (Array.isArray(q.fields)) {
+            fields = q.fields.filter((s) => typeof s === "string" && s.length > 0);
+          }
+          if (!fields || fields.length === 0) {
+            try {
+              const schema = await p.getObjectSchema?.(objectName, projectId);
+              const schemaFields = schema?.fields;
+              if (Array.isArray(schemaFields)) {
+                fields = schemaFields.map((f) => f.name).filter((n) => typeof n === "string");
+              }
+            } catch {
+            }
+          }
+          const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+          const safeObj = objectName.replace(/[^A-Za-z0-9_.-]/g, "_");
+          if (format === "csv") {
+            res.header("Content-Type", "text/csv; charset=utf-8");
+            res.header("Content-Disposition", `attachment; filename="${safeObj}-${stamp}.csv"`);
+          } else {
+            res.header("Content-Type", "application/json; charset=utf-8");
+            res.header("Content-Disposition", `attachment; filename="${safeObj}-${stamp}.json"`);
+          }
+          res.header("X-Export-Format", format);
+          res.header("X-Export-Limit", String(limit));
+          res.header("Cache-Control", "no-store");
+          let exported = 0;
+          let firstChunk = true;
+          let skip = 0;
+          if (format === "json") res.write("[");
+          while (exported < limit) {
+            const take = Math.min(chunkSize, limit - exported);
+            const findArgs = {
+              object: objectName,
+              query: {
+                ...filter ? { $filter: filter } : {},
+                ...orderby ? { $orderby: orderby } : {},
+                $top: take,
+                $skip: skip
+              },
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
+            };
+            const result = await p.findData(findArgs);
+            const rows = Array.isArray(result?.data) ? result.data : Array.isArray(result?.rows) ? result.rows : Array.isArray(result) ? result : [];
+            if (rows.length === 0) break;
+            if (format === "csv") {
+              if ((!fields || fields.length === 0) && firstChunk) {
+                fields = Object.keys(rows[0] ?? {});
+              }
+              const text = rowsToCsv(fields ?? [], rows, firstChunk);
+              res.write(text);
+            } else {
+              for (let i = 0; i < rows.length; i++) {
+                const prefix = firstChunk && i === 0 ? "" : ",";
+                res.write(prefix + JSON.stringify(rows[i]));
+              }
+            }
+            firstChunk = false;
+            exported += rows.length;
+            skip += rows.length;
+            if (rows.length < take) break;
+          }
+          if (format === "json") res.write("]");
+          res.end();
+        } catch (error) {
+          logError("[REST] Unhandled error:", error);
+          try {
+            sendError(res, error, String(req.params?.object || ""));
+          } catch {
+            try {
+              res.end();
+            } catch {
+            }
+          }
+        }
+      },
+      metadata: {
+        summary: "Streaming export of object rows (CSV or JSON)",
+        tags: ["data", "export"]
+      }
+    });
+  }
+  /**
+   * Register global cross-object search endpoint (M10.5).
+   * GET {basePath}/search?q=acme&objects=lead,account&limit=20&perObject=5
+   */
+  registerSearchEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    this.routeManager.register({
+      method: "GET",
+      path: `${basePath}/search`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const p = await this.resolveProtocol(projectId, req);
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const searchAll = p.searchAll;
+          if (typeof searchAll !== "function") {
+            res.status(501).json({ code: "NOT_IMPLEMENTED", message: "Search not supported by this protocol" });
+            return;
+          }
+          const q = String(req.query?.q ?? req.query?.query ?? "");
+          const objectsParam = req.query?.objects;
+          const objects = typeof objectsParam === "string" ? objectsParam.split(",").map((s) => s.trim()).filter(Boolean) : Array.isArray(objectsParam) ? objectsParam : void 0;
+          const result = await searchAll.call(p, {
+            q,
+            objects,
+            limit: req.query?.limit ? Number(req.query.limit) : void 0,
+            perObject: req.query?.perObject ? Number(req.query.perObject) : void 0,
+            ...context ? { context } : {}
+          });
+          res.json(result);
+        } catch (error) {
+          const mapped = mapDataError(error);
+          if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") {
+            logError("[REST] Unhandled error:", error);
+          }
+          res.status(mapped.status).json(mapped.body);
+        }
+      },
+      metadata: {
+        summary: "Global cross-object search",
+        tags: ["search"]
+      }
+    });
+  }
+  /**
+   * Register email endpoints (M11.B1 / M10.7).
+   *
+   * POST {basePath}/email/send — send a transactional email via the
+   * `IEmailService` provider registered by EmailServicePlugin. Returns
+   * 501 when no provider is wired so deployments without email
+   * configured fail cleanly.
+   *
+   * Request body:
+   *   {
+   *     to: "a@b.com" | ["a@b.com", { name, address }],
+   *     from?: ..., cc?: ..., bcc?: ..., replyTo?: ...,
+   *     subject: string,
+   *     text?: string, html?: string,  // at least one required
+   *     attachments?: [{ filename, content, contentType?, cid? }],
+   *     headers?: { [name]: value },
+   *     relatedObject?: string, relatedId?: string,
+   *   }
+   */
+  registerEmailEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    this.routeManager.register({
+      method: "POST",
+      path: `${basePath}/email/send`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          if (!this.emailServiceProvider) {
+            res.status(501).json({
+              code: "NOT_IMPLEMENTED",
+              message: "Email service is not configured on this deployment"
+            });
+            return;
+          }
+          const emailService = await this.emailServiceProvider(projectId).catch(() => void 0);
+          if (!emailService || typeof emailService.send !== "function") {
+            res.status(501).json({
+              code: "NOT_IMPLEMENTED",
+              message: "Email service is not configured on this deployment"
+            });
+            return;
+          }
+          const body = req.body ?? {};
+          if (!body || typeof body !== "object") {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "JSON body required" });
+            return;
+          }
+          const input = {
+            ...body,
+            ...body.sentBy === void 0 && context?.userId ? { sentBy: context.userId } : {}
+          };
+          try {
+            const result = await emailService.send(input);
+            if (result?.status === "sent") {
+              res.status(200).json(result);
+            } else {
+              res.status(200).json(result);
+            }
+          } catch (err) {
+            const message = String(err?.message ?? err ?? "send failed");
+            if (message.startsWith("VALIDATION_FAILED")) {
+              res.status(400).json({
+                code: "VALIDATION_FAILED",
+                error: message.replace(/^VALIDATION_FAILED:\s*/, "")
+              });
+              return;
+            }
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Email send unhandled error:", error);
+          res.status(500).json({
+            code: "EMAIL_SEND_FAILED",
+            error: String(error?.message ?? error ?? "send failed").slice(0, 500)
+          });
+        }
+      },
+      metadata: {
+        summary: "Send a transactional email via the configured EmailService",
+        tags: ["email"]
+      }
+    });
+  }
+  /**
+   * Register public (anonymous) form endpoints.
+   *
+   * Public forms are opt-in: a `FormView` becomes accessible to anonymous
+   * visitors only when `sharing.allowAnonymous === true` AND a
+   * `sharing.publicLink` slug is configured. Two routes are registered:
+   *
+   *   GET  {basePath}/forms/:slug          → resolved form spec
+   *   POST {basePath}/forms/:slug/submit   → INSERT record (no auth required)
+   *
+   * Both routes bypass `enforceAuth` even when `requireAuth=true` on the
+   * deployment (e.g. ObjectOS multi-tenant). Security is delegated to the
+   * `guest_portal` permission set carried on the execution context — the
+   * SecurityPlugin enforces INSERT-only access to the target object. If
+   * the deployment hasn't registered a `guest_portal` profile, the
+   * security middleware falls open with `permissions: []` (no userId),
+   * matching the existing anonymous-access semantics; deployers must
+   * keep `requireAuth=true` deployments paired with a `guest_portal`
+   * profile (the CRM example does this) to enforce the INSERT-only
+   * contract.
+   *
+   * The matched FormView's parent ViewSchema is found by scanning
+   * `protocol.getMetaItems({ type: 'view' })`. For each entry we inspect
+   * `form.sharing` and every entry in `formViews`; the first FormView
+   * whose `sharing.publicLink` matches `/forms/:slug` (or just `:slug`)
+   * wins. The response carries the matched form view under `form` and
+   * the inferred target object, matching what the frontend's
+   * `mapViewSpecToEmbeddableConfig` expects.
+   */
+  registerFormEndpoints(basePath) {
+    const isScoped = basePath.includes("/projects/:projectId");
+    const slugMatchesPublicLink = (publicLink, slug) => {
+      if (!publicLink || typeof publicLink !== "string") return false;
+      const normalized = publicLink.replace(/^\/+/, "").replace(/^forms\//, "");
+      return normalized === slug;
+    };
+    const findPublicFormView = (views, slug) => {
+      for (const view of views ?? []) {
+        if (!view || typeof view !== "object") continue;
+        const candidates = [];
+        if (view.form && view.form.sharing) candidates.push({ form: view.form });
+        const formViews = view.formViews;
+        if (formViews && typeof formViews === "object") {
+          for (const [key, fv] of Object.entries(formViews)) {
+            if (fv && typeof fv === "object" && fv.sharing) {
+              candidates.push({ form: fv, key });
+            }
+          }
+        }
+        for (const c of candidates) {
+          const sharing = c.form?.sharing;
+          if (!sharing || sharing.allowAnonymous !== true) continue;
+          if (!slugMatchesPublicLink(sharing.publicLink, slug)) continue;
+          const objectName = c.form?.data?.object ?? view?.list?.data?.object ?? view?.form?.data?.object ?? view?.object;
+          if (!objectName) continue;
+          return { view, form: c.form, object: objectName };
+        }
+      }
+      return null;
+    };
+    const resolveFormBySlug = async (projectId, req, slug) => {
+      const p = await this.resolveProtocol(projectId, req);
+      if (typeof p.getMetaItems !== "function") return null;
+      const result = await p.getMetaItems({
+        type: "view",
+        ...projectId ? { projectId } : {}
+      });
+      const items = Array.isArray(result?.items) ? result.items : Array.isArray(result) ? result : [];
+      return findPublicFormView(items, slug);
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${basePath}/forms/:slug`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const slug = String(req.params?.slug ?? "").trim();
+          if (!slug) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "slug is required" });
+            return;
+          }
+          const match = await resolveFormBySlug(projectId, req, slug);
+          if (!match) {
+            res.status(404).json({
+              code: "FORM_NOT_FOUND",
+              error: `No public form configured at /forms/${slug}`
+            });
+            return;
+          }
+          let objectSchema = null;
+          try {
+            const p = await this.resolveProtocol(projectId, req);
+            if (typeof p.getMetaItems === "function") {
+              const r = await p.getMetaItems({
+                type: "object",
+                ...projectId ? { projectId } : {}
+              });
+              const items = Array.isArray(r?.items) ? r.items : Array.isArray(r) ? r : [];
+              const obj = items.find((o) => o?.name === match.object);
+              if (obj && obj.fields && typeof obj.fields === "object") {
+                const allowed = /* @__PURE__ */ new Set();
+                for (const sec of match.form?.sections ?? []) {
+                  for (const f of sec?.fields ?? []) {
+                    if (typeof f === "string") allowed.add(f);
+                    else if (f?.field) allowed.add(f.field);
+                  }
+                }
+                const fields = {};
+                for (const [name, def] of Object.entries(obj.fields)) {
+                  if (allowed.size === 0 || allowed.has(name)) {
+                    fields[name] = def;
+                  }
+                }
+                objectSchema = { name: obj.name, label: obj.label, fields };
+                try {
+                  const i18n = await this.resolveI18nService(projectId, req);
+                  const bundle = this.buildTranslationBundle(i18n);
+                  const locale = this.extractLocale(req, i18n);
+                  if (bundle && locale) {
+                    const { translateMetadataDocument } = await import("@objectstack/spec/system");
+                    objectSchema = translateMetadataDocument("object", objectSchema, bundle, { locale });
+                  }
+                } catch (e) {
+                  logError("[REST] Public form schema translation failed:", e);
+                }
+              }
+            }
+          } catch (e) {
+            logError("[REST] Public form schema load failed:", e);
+          }
+          const safeForm = (() => {
+            if (!match.form || !Array.isArray(match.form.sections)) return match.form;
+            const allow = (name, cfg) => {
+              const def = objectSchema?.fields?.[name];
+              const t = def?.type;
+              if (t !== "lookup" && t !== "master_detail") return true;
+              return !!cfg?.publicPicker;
+            };
+            const sections = match.form.sections.map((sec) => {
+              const fields = (sec?.fields ?? []).filter((f) => {
+                const name = typeof f === "string" ? f : f?.field;
+                if (!name) return false;
+                const cfg = typeof f === "string" ? {} : f;
+                return allow(name, cfg);
+              });
+              return { ...sec, fields };
+            });
+            return { ...match.form, sections };
+          })();
+          res.header("Vary", "Accept-Language");
+          res.json({
+            slug,
+            object: match.object,
+            label: match.view?.label ?? match.form?.label,
+            form: safeForm,
+            objectSchema
+          });
+        } catch (error) {
+          logError("[REST] Public form resolve error:", error);
+          res.status(500).json({
+            code: "FORM_RESOLVE_FAILED",
+            error: String(error?.message ?? error ?? "resolve failed").slice(0, 500)
+          });
+        }
+      },
+      metadata: {
+        summary: "Resolve a public form spec by slug (anonymous)",
+        tags: ["forms", "public"]
+      }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${basePath}/forms/:slug/submit`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const slug = String(req.params?.slug ?? "").trim();
+          if (!slug) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "slug is required" });
+            return;
+          }
+          const match = await resolveFormBySlug(projectId, req, slug);
+          if (!match) {
+            res.status(404).json({
+              code: "FORM_NOT_FOUND",
+              error: `No public form configured at /forms/${slug}`
+            });
+            return;
+          }
+          const allowedFields = /* @__PURE__ */ new Set();
+          for (const section of match.form?.sections ?? []) {
+            for (const f of section?.fields ?? []) {
+              if (typeof f === "string") allowedFields.add(f);
+              else if (f?.field) allowedFields.add(f.field);
+            }
+          }
+          const rawBody = req.body && typeof req.body === "object" ? req.body : {};
+          const filteredData = {};
+          if (allowedFields.size > 0) {
+            for (const [k, v] of Object.entries(rawBody)) {
+              if (allowedFields.has(k)) filteredData[k] = v;
+            }
+          } else {
+            Object.assign(filteredData, rawBody);
+          }
+          const context = {
+            permissions: ["guest_portal"],
+            anonymous: true
+          };
+          const p = await this.resolveProtocol(projectId, req);
+          const result = await p.createData({
+            object: match.object,
+            data: filteredData,
+            ...projectId ? { projectId } : {},
+            context
+          });
+          res.status(201).json(result);
+        } catch (error) {
+          const mapped = mapDataError(error);
+          if (!isExpectedDataStatus(mapped.status) && mapped.body?.code !== "VALIDATION_FAILED") {
+            logError("[REST] Public form submit error:", error);
+          }
+          res.status(mapped.status).json(mapped.body);
+        }
+      },
+      metadata: {
+        summary: "Submit an anonymous public form",
+        tags: ["forms", "public"]
+      }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${basePath}/forms/:slug/lookup/:field`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const slug = String(req.params?.slug ?? "").trim();
+          const fieldName = String(req.params?.field ?? "").trim();
+          if (!slug || !fieldName) {
+            res.status(400).json({ code: "INVALID_REQUEST", error: "slug and field are required" });
+            return;
+          }
+          const match = await resolveFormBySlug(projectId, req, slug);
+          if (!match) {
+            res.status(404).json({
+              code: "FORM_NOT_FOUND",
+              error: `No public form configured at /forms/${slug}`
+            });
+            return;
+          }
+          let fieldCfg = null;
+          for (const sec of match.form?.sections ?? []) {
+            for (const f of sec?.fields ?? []) {
+              const name = typeof f === "string" ? f : f?.field;
+              if (name === fieldName) {
+                fieldCfg = typeof f === "string" ? {} : f;
+                break;
+              }
+            }
+            if (fieldCfg) break;
+          }
+          const picker = fieldCfg?.publicPicker;
+          if (!picker) {
+            res.status(403).json({
+              code: "LOOKUP_NOT_PUBLIC",
+              error: `Field "${fieldName}" is not enabled for public lookup on this form`
+            });
+            return;
+          }
+          const p = await this.resolveProtocol(projectId, req);
+          let referenceTo = picker.object;
+          if (!referenceTo && typeof p.getMetaItems === "function") {
+            try {
+              const r = await p.getMetaItems({
+                type: "object",
+                ...projectId ? { projectId } : {}
+              });
+              const items = Array.isArray(r?.items) ? r.items : Array.isArray(r) ? r : [];
+              const obj = items.find((o) => o?.name === match.object);
+              const def = obj?.fields?.[fieldName];
+              referenceTo = def?.referenceTo ?? def?.target ?? def?.options?.objectName;
+            } catch {
+            }
+          }
+          if (!referenceTo) {
+            res.status(500).json({
+              code: "LOOKUP_TARGET_MISSING",
+              error: `Could not resolve referenced object for "${fieldName}"`
+            });
+            return;
+          }
+          const displayFields = Array.isArray(picker.displayFields) && picker.displayFields.length > 0 ? picker.displayFields.slice(0, 5) : ["name"];
+          const hardCap = 50;
+          const maxResults = Math.min(Math.max(1, Number(picker.maxResults) || 20), hardCap);
+          const q = String(req.query?.q ?? "").trim().slice(0, 100);
+          const filters = [];
+          if (Array.isArray(picker.filter)) filters.push(...picker.filter);
+          if (q) filters.push({ field: displayFields[0], operator: "contains", value: q });
+          const context = {
+            permissions: ["guest_portal"],
+            anonymous: true
+          };
+          const result = await p.findData({
+            object: referenceTo,
+            query: {
+              limit: maxResults,
+              offset: 0,
+              filters,
+              select: ["id", ...displayFields],
+              sort: picker.sort ?? [{ field: displayFields[0], order: "asc" }]
+            },
+            ...projectId ? { projectId } : {},
+            context
+          });
+          const rows = Array.isArray(result?.data) ? result.data : Array.isArray(result?.items) ? result.items : [];
+          const projected = rows.slice(0, maxResults).map((row) => {
+            const out = { id: row?.id };
+            for (const f of displayFields) {
+              if (row && Object.prototype.hasOwnProperty.call(row, f)) out[f] = row[f];
+            }
+            return out;
+          });
+          res.json({
+            data: projected,
+            total: projected.length,
+            truncated: rows.length >= maxResults,
+            displayFields
+          });
+        } catch (error) {
+          const mapped = mapDataError(error);
+          if (!isExpectedDataStatus(mapped.status)) {
+            logError("[REST] Public form lookup error:", error);
+          }
+          res.status(mapped.status).json(mapped.body);
+        }
+      },
+      metadata: {
+        summary: "Scoped lookup picker for a public form field (anonymous)",
+        tags: ["forms", "public"]
+      }
+    });
+  }
+  /**
+   * Register record-level sharing endpoints (M11.C17).
+   *
+   * Surfaces `ISharingService` over HTTP so the UI can list, create
+   * and revoke per-record grants without going through ObjectQL. The
+   * three routes mirror the share-management drawer in Salesforce /
+   * ServiceNow:
+   *
+   *   GET    {basePath}/data/:object/:id/shares
+   *   POST   {basePath}/data/:object/:id/shares
+   *   DELETE {basePath}/data/:object/:id/shares/:shareId
+   *
+   * All three resolve via `sharingServiceProvider`; routes return 501
+   * when no sharing service is configured so a deployment without the
+   * `@objectstack/plugin-sharing` plugin fails cleanly.
+   */
+  registerSharingEndpoints(basePath) {
+    const { crud } = this.config;
+    const dataPath = `${basePath}${crud.dataPrefix}`;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.sharingServiceProvider) return void 0;
+      try {
+        return await this.sharingServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Sharing service is not configured on this deployment"
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/:object/:id/shares`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listShares(req.params.object, req.params.id, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List shares error:", error);
+          res.status(500).json({ code: "SHARES_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List per-record sharing grants", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/:object/:id/shares`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          const input = {
+            object: req.params.object,
+            recordId: req.params.id,
+            recipientType: body.recipientType ?? body.recipient_type,
+            recipientId: body.recipientId ?? body.recipient_id,
+            accessLevel: body.accessLevel ?? body.access_level,
+            source: body.source,
+            sourceId: body.sourceId ?? body.source_id,
+            reason: body.reason
+          };
+          try {
+            const row = await svc.grant(input, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            const msg = String(err?.message ?? err ?? "");
+            if (msg.startsWith("VALIDATION_FAILED")) {
+              res.status(400).json({
+                code: "VALIDATION_FAILED",
+                error: msg.replace(/^VALIDATION_FAILED:\s*/, "")
+              });
+              return;
+            }
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Grant share error:", error);
+          res.status(500).json({ code: "SHARE_GRANT_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Grant a per-record share to a principal", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/:object/:id/shares/:shareId`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.revoke(req.params.shareId, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Revoke share error:", error);
+          res.status(500).json({ code: "SHARE_REVOKE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Revoke a per-record share by id", tags: ["sharing"] }
+    });
+  }
+  /**
+   * Register sharing-rule endpoints (M10.17). Mirrors the existing
+   * sharing endpoints but operates on `sys_sharing_rule` rows.
+   *
+   *   GET    {basePath}/sharing/rules?object=&activeOnly=
+   *   POST   {basePath}/sharing/rules
+   *   GET    {basePath}/sharing/rules/:idOrName
+   *   DELETE {basePath}/sharing/rules/:idOrName
+   *   POST   {basePath}/sharing/rules/:idOrName/evaluate
+   *
+   * Returns 501 when no sharing-rule service is configured.
+   */
+  registerSharingRuleEndpoints(basePath) {
+    const dataPath = basePath;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.sharingRulesServiceProvider) return void 0;
+      try {
+        return await this.sharingRulesServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Sharing-rule service is not configured on this deployment"
+    });
+    const handleError = (err, res, defaultCode) => {
+      const msg = String(err?.message ?? err ?? "");
+      if (msg.startsWith("VALIDATION_FAILED")) {
+        return res.status(400).json({ code: "VALIDATION_FAILED", error: msg.replace(/^VALIDATION_FAILED:\s*/, "") });
+      }
+      if (msg.startsWith("RULE_NOT_FOUND")) {
+        return res.status(404).json({ code: "RULE_NOT_FOUND", error: msg.replace(/^RULE_NOT_FOUND:?\s*/, "") });
+      }
+      logError(`[REST] sharing-rule ${defaultCode}:`, err);
+      return res.status(500).json({ code: defaultCode, error: msg.slice(0, 500) });
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/sharing/rules`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listRules({
+            object: req.query?.object,
+            activeOnly: req.query?.activeOnly === "true" || req.query?.activeOnly === true
+          }, context ?? {});
+          res.json({ data: rows });
+        } catch (err) {
+          handleError(err, res, "RULE_LIST_FAILED");
+        }
+      },
+      metadata: { summary: "List sharing rules", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/sharing/rules`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          const input = {
+            name: body.name,
+            label: body.label,
+            description: body.description,
+            object: body.object ?? body.object_name,
+            criteria: body.criteria,
+            recipientType: body.recipientType ?? body.recipient_type,
+            recipientId: body.recipientId ?? body.recipient_id,
+            accessLevel: body.accessLevel ?? body.access_level,
+            active: body.active
+          };
+          const row = await svc.defineRule(input, context ?? {});
+          res.status(201).json(row);
+        } catch (err) {
+          handleError(err, res, "RULE_DEFINE_FAILED");
+        }
+      },
+      metadata: { summary: "Create or upsert a sharing rule", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/sharing/rules/:idOrName`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getRule(req.params.idOrName, context ?? {});
+          if (!row) return res.status(404).json({ code: "RULE_NOT_FOUND" });
+          res.json(row);
+        } catch (err) {
+          handleError(err, res, "RULE_GET_FAILED");
+        }
+      },
+      metadata: { summary: "Get a sharing rule by id or name", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/sharing/rules/:idOrName`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.deleteRule(req.params.idOrName, context ?? {});
+          res.status(204).end();
+        } catch (err) {
+          handleError(err, res, "RULE_DELETE_FAILED");
+        }
+      },
+      metadata: { summary: "Delete a sharing rule and its materialised grants", tags: ["sharing"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/sharing/rules/:idOrName/evaluate`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const result = await svc.evaluateRule(req.params.idOrName, context ?? {});
+          res.json(result);
+        } catch (err) {
+          handleError(err, res, "RULE_EVALUATE_FAILED");
+        }
+      },
+      metadata: { summary: "Re-evaluate a sharing rule and reconcile grants", tags: ["sharing"] }
+    });
+  }
+  /**
+   * Register saved-report + scheduled-digest endpoints (M11.C16).
+   *
+   * Surfaces `IReportService` over HTTP so the UI can build,
+   * run, and schedule reports without dropping to ObjectQL. Routes
+   * live at the top of the API surface (alongside `/approvals` and
+   * `/sharing`) — reports are a tenant-wide capability, not a record
+   * on a specific CRUD object:
+   *
+   *   GET    {basePath}/reports?object=&ownerId=
+   *   POST   {basePath}/reports
+   *   GET    {basePath}/reports/:id
+   *   DELETE {basePath}/reports/:id
+   *   POST   {basePath}/reports/:id/run
+   *   POST   {basePath}/reports/:id/schedule
+   *   GET    {basePath}/reports/:id/schedules
+   *   DELETE {basePath}/reports/schedules/:scheduleId
+   *
+   * All routes return 501 when `reportsServiceProvider` is unset so
+   * a deployment without `@objectstack/plugin-reports` fails cleanly.
+   */
+  registerReportsEndpoints(basePath) {
+    const dataPath = basePath;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.reportsServiceProvider) return void 0;
+      try {
+        return await this.reportsServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Reports service is not configured on this deployment"
+    });
+    const handleValidation = (res, err) => {
+      const msg = String(err?.message ?? err ?? "");
+      if (msg.startsWith("VALIDATION_FAILED")) {
+        res.status(400).json({
+          code: "VALIDATION_FAILED",
+          error: msg.replace(/^VALIDATION_FAILED:\s*/, "")
+        });
+        return true;
+      }
+      if (msg.startsWith("REPORT_NOT_FOUND")) {
+        res.status(404).json({ code: "REPORT_NOT_FOUND", error: msg });
+        return true;
+      }
+      return false;
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/reports`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const q = req.query ?? {};
+          const rows = await svc.listReports({ object: q.object, ownerId: q.ownerId }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List reports error:", error);
+          res.status(500).json({ code: "REPORTS_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List saved reports", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/reports`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          try {
+            const row = await svc.saveReport(req.body ?? {}, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleValidation(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Save report error:", error);
+          res.status(500).json({ code: "REPORT_SAVE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Create or update a saved report", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/reports/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getReport(req.params.id, context ?? {});
+          if (!row) {
+            res.status(404).json({ code: "REPORT_NOT_FOUND", error: `Report ${req.params.id} not found` });
+            return;
+          }
+          res.json(row);
+        } catch (error) {
+          logError("[REST] Get report error:", error);
+          res.status(500).json({ code: "REPORT_GET_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Get a saved report by id", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/reports/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.deleteReport(req.params.id, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Delete report error:", error);
+          res.status(500).json({ code: "REPORT_DELETE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Delete a saved report (cascades schedules)", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/reports/:id/run`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          try {
+            const result = await svc.run(req.params.id, context ?? {});
+            res.json(result);
+          } catch (err) {
+            if (handleValidation(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Run report error:", error);
+          res.status(500).json({ code: "REPORT_RUN_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Execute a saved report and return rendered output", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/reports/:id/schedule`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          try {
+            const row = await svc.scheduleReport({
+              reportId: req.params.id,
+              recipients: body.recipients ?? [],
+              name: body.name,
+              intervalMinutes: body.intervalMinutes ?? body.interval_minutes,
+              cronExpression: body.cronExpression ?? body.cron_expression,
+              timezone: body.timezone,
+              format: body.format,
+              subjectTemplate: body.subjectTemplate ?? body.subject_template,
+              ownerId: body.ownerId ?? body.owner_id,
+              active: body.active
+            }, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleValidation(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Schedule report error:", error);
+          res.status(500).json({ code: "REPORT_SCHEDULE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Create a recurring email schedule for a report", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/reports/:id/schedules`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listSchedules({ reportId: req.params.id }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List schedules error:", error);
+          res.status(500).json({ code: "SCHEDULES_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List schedules for a report", tags: ["reports"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/reports/schedules/:scheduleId`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.unscheduleReport(req.params.scheduleId, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Unschedule report error:", error);
+          res.status(500).json({ code: "SCHEDULE_DELETE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Delete a report schedule by id", tags: ["reports"] }
+    });
+  }
+  /**
+   * Register approval engine endpoints.
+   *
+   * Routes (all under {basePath}/approvals):
+   *   GET    /processes                       — list approval processes
+   *   POST   /processes                       — upsert (defineProcess)
+   *   GET    /processes/:id                   — get by id or name
+   *   DELETE /processes/:id                   — delete process
+   *   POST   /requests                        — submit
+   *   GET    /requests                        — list (filters: status, object, recordId, approverId, submitterId)
+   *   GET    /requests/:id                    — get request
+   *   POST   /requests/:id/approve            — approve current step
+   *   POST   /requests/:id/reject             — reject current step
+   *   POST   /requests/:id/recall             — recall (submitter only)
+   *   GET    /requests/:id/actions            — audit trail
+   *
+   * Returns 501 when `approvalsServiceProvider` is unset so deployments
+   * without `@objectstack/plugin-approvals` fail cleanly.
+   */
+  registerApprovalsEndpoints(basePath) {
+    const dataPath = basePath;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const resolveService = async (projectId) => {
+      if (!this.approvalsServiceProvider) return void 0;
+      try {
+        return await this.approvalsServiceProvider(projectId);
+      } catch {
+        return void 0;
+      }
+    };
+    const respond501 = (res) => res.status(501).json({
+      code: "NOT_IMPLEMENTED",
+      message: "Approvals service is not configured on this deployment"
+    });
+    const handleApprovalError = (res, err) => {
+      const msg = String(err?.message ?? err ?? "");
+      const mapping = [
+        [/^VALIDATION_FAILED/, 400, "VALIDATION_FAILED"],
+        [/^DUPLICATE_REQUEST/, 409, "DUPLICATE_REQUEST"],
+        [/^INVALID_STATE/, 409, "INVALID_STATE"],
+        [/^FORBIDDEN/, 403, "FORBIDDEN"],
+        [/^NO_ACTIVE_PROCESS/, 404, "NO_ACTIVE_PROCESS"],
+        [/^PROCESS_NOT_FOUND/, 404, "PROCESS_NOT_FOUND"],
+        [/^REQUEST_NOT_FOUND/, 404, "REQUEST_NOT_FOUND"]
+      ];
+      for (const [re, status, code] of mapping) {
+        if (re.test(msg)) {
+          res.status(status).json({ code, error: msg.replace(/^[A-Z_]+:\s*/, "") });
+          return true;
+        }
+      }
+      return false;
+    };
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/processes`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const q = req.query ?? {};
+          const rows = await svc.listProcesses({
+            object: q.object,
+            activeOnly: q.activeOnly === "true" || q.activeOnly === true
+          }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List approval processes error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List approval processes", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/approvals/processes`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          try {
+            const row = await svc.defineProcess(req.body ?? {}, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleApprovalError(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Define approval process error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_DEFINE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Define (upsert) an approval process", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/processes/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getProcess(req.params.id, context ?? {});
+          if (!row) {
+            res.status(404).json({ code: "PROCESS_NOT_FOUND", error: `Approval process '${req.params.id}' not found` });
+            return;
+          }
+          res.json(row);
+        } catch (error) {
+          logError("[REST] Get approval process error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_GET_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Get an approval process by id or name", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "DELETE",
+      path: `${dataPath}/approvals/processes/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          await svc.deleteProcess(req.params.id, context ?? {});
+          res.status(204).end();
+        } catch (error) {
+          logError("[REST] Delete approval process error:", error);
+          res.status(500).json({ code: "APPROVAL_PROCESS_DELETE_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Delete an approval process", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "POST",
+      path: `${dataPath}/approvals/requests`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const body = req.body ?? {};
+          try {
+            const row = await svc.submit({
+              object: body.object,
+              recordId: body.recordId ?? body.record_id,
+              processName: body.processName ?? body.process_name,
+              submitterId: body.submitterId ?? body.submitter_id ?? context?.userId,
+              comment: body.comment,
+              payload: body.payload
+            }, context ?? {});
+            res.status(201).json(row);
+          } catch (err) {
+            if (handleApprovalError(res, err)) return;
+            throw err;
+          }
+        } catch (error) {
+          logError("[REST] Submit approval error:", error);
+          res.status(500).json({ code: "APPROVAL_SUBMIT_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Submit a record for approval", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/requests`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) {
+            res.json({ data: [] });
+            return;
+          }
+          const q = req.query ?? {};
+          const rows = await svc.listRequests({
+            object: q.object,
+            recordId: q.recordId ?? q.record_id,
+            status: q.status,
+            approverId: q.approverId ?? q.approver_id,
+            submitterId: q.submitterId ?? q.submitter_id
+          }, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List approval requests error:", error);
+          res.status(500).json({ code: "APPROVAL_REQUEST_LIST_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List approval requests", tags: ["approvals"] }
+    });
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/requests/:id`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const row = await svc.getRequest(req.params.id, context ?? {});
+          if (!row) {
+            res.status(404).json({ code: "REQUEST_NOT_FOUND", error: `Approval request '${req.params.id}' not found` });
+            return;
+          }
+          res.json(row);
+        } catch (error) {
+          logError("[REST] Get approval request error:", error);
+          res.status(500).json({ code: "APPROVAL_REQUEST_GET_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "Get an approval request by id", tags: ["approvals"] }
+    });
+    const decisionRoute = (suffix, method) => {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/approvals/requests/:id/${suffix}`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const svc = await resolveService(projectId);
+            if (!svc) return respond501(res);
+            const body = req.body ?? {};
+            try {
+              const out = await svc[method](req.params.id, {
+                actorId: body.actorId ?? body.actor_id ?? context?.userId,
+                comment: body.comment
+              }, context ?? {});
+              res.json(out);
+            } catch (err) {
+              if (handleApprovalError(res, err)) return;
+              throw err;
+            }
+          } catch (error) {
+            logError(`[REST] ${suffix} approval error:`, error);
+            res.status(500).json({ code: `APPROVAL_${suffix.toUpperCase()}_FAILED`, error: String(error?.message ?? error).slice(0, 500) });
+          }
+        },
+        metadata: { summary: `${suffix[0].toUpperCase()}${suffix.slice(1)} an approval request`, tags: ["approvals"] }
+      });
+    };
+    decisionRoute("approve", "approve");
+    decisionRoute("reject", "reject");
+    decisionRoute("recall", "recall");
+    this.routeManager.register({
+      method: "GET",
+      path: `${dataPath}/approvals/requests/:id/actions`,
+      handler: async (req, res) => {
+        try {
+          const projectId = isScoped ? req.params?.projectId : void 0;
+          const context = await this.resolveExecCtx(projectId, req);
+          if (this.enforceAuth(req, res, context)) return;
+          const svc = await resolveService(projectId);
+          if (!svc) return respond501(res);
+          const rows = await svc.listActions(req.params.id, context ?? {});
+          res.json({ data: rows });
+        } catch (error) {
+          logError("[REST] List approval actions error:", error);
+          res.status(500).json({ code: "APPROVAL_ACTIONS_FAILED", error: String(error?.message ?? error).slice(0, 500) });
+        }
+      },
+      metadata: { summary: "List actions (audit trail) for an approval request", tags: ["approvals"] }
+    });
+  }
+  /**
+   * Register batch operation endpoints
+   */
+  registerBatchEndpoints(basePath) {
+    const { crud, batch } = this.config;
+    const dataPath = `${basePath}${crud.dataPrefix}`;
+    const isScoped = basePath.includes("/projects/:projectId");
+    const operations = batch.operations;
+    if (batch.enableBatchEndpoint && this.protocol.batchData) {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/:object/batch`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.batchData({
+              object: req.params.object,
+              request: req.body,
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
+            });
+            res.json(result);
+          } catch (error) {
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error, req.params?.object);
+          }
+        },
+        metadata: {
+          summary: "Batch operations",
+          tags: ["data", "batch"]
+        }
+      });
+    }
+    if (operations.createMany && this.protocol.createManyData) {
+      this.routeManager.register({
+        method: "POST",
+        path: `${dataPath}/:object/createMany`,
+        handler: async (req, res) => {
+          try {
+            const projectId = isScoped ? req.params?.projectId : void 0;
+            const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
+            const result = await p.createManyData({
+              object: req.params.object,
+              records: req.body || [],
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
+            });
+            res.status(201).json(result);
+          } catch (error) {
+            logError("[REST] Unhandled error:", error);
+            sendError(res, error, req.params?.object);
+          }
+        },
+        metadata: {
+          summary: "Create multiple records",
+          tags: ["data", "batch"]
         }
       });
     }
@@ -1180,15 +3050,18 @@ var RestServer = class {
           try {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
             const result = await p.updateManyData({
               object: req.params.object,
               ...req.body,
-              ...projectId ? { projectId } : {}
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
             logError("[REST] Unhandled error:", error);
-            res.status(400).json({ error: error.message });
+            sendError(res, error, req.params?.object);
           }
         },
         metadata: {
@@ -1205,15 +3078,18 @@ var RestServer = class {
           try {
             const projectId = isScoped ? req.params?.projectId : void 0;
             const p = await this.resolveProtocol(projectId, req);
+            const context = await this.resolveExecCtx(projectId, req);
+            if (this.enforceAuth(req, res, context)) return;
             const result = await p.deleteManyData({
               object: req.params.object,
               ...req.body,
-              ...projectId ? { projectId } : {}
+              ...projectId ? { projectId } : {},
+              ...context ? { context } : {}
             });
             res.json(result);
           } catch (error) {
             logError("[REST] Unhandled error:", error);
-            res.status(400).json({ error: error.message });
+            sendError(res, error, req.params?.object);
           }
         },
         metadata: {
@@ -1407,6 +3283,48 @@ function createRestApiPlugin(config = {}) {
           return void 0;
         }
       };
+      const emailServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("email");
+        } catch {
+          return void 0;
+        }
+      };
+      const sharingServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("sharing");
+        } catch {
+          return void 0;
+        }
+      };
+      const reportsServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("reports");
+        } catch {
+          return void 0;
+        }
+      };
+      const approvalsServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("approvals");
+        } catch {
+          return void 0;
+        }
+      };
+      const sharingRulesServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("sharingRules");
+        } catch {
+          return void 0;
+        }
+      };
+      const i18nServiceProvider = async (_projectId) => {
+        try {
+          return ctx.getService("i18n");
+        } catch {
+          return void 0;
+        }
+      };
       if (!server) {
         ctx.logger.warn(`RestApiPlugin: HTTP Server service '${serverService}' not found. REST routes skipped.`);
         return;
@@ -1417,7 +3335,7 @@ function createRestApiPlugin(config = {}) {
       }
       ctx.logger.info("Hydrating REST API from Protocol...");
       try {
-        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultProjectIdProvider, authServiceProvider, objectQLProvider);
+        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultProjectIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider);
         restServer.registerRoutes();
         ctx.logger.info("REST API successfully registered");
       } catch (err) {