refactor(rest): narrow the REST protocol dependency to DataProtocol & MetadataProtocol (ADR-0076 D9/A1.5, #2462)

The REST layer was typed against the full ObjectStackProtocol god-union
while actually calling only the data CRUD + metadata control-plane slices
(server-only extensions are feature-detected via casts). Introduce
RestProtocol = DataProtocol & MetadataProtocol, thread it through
RestServer / rest-api-plugin, and export it from the package barrel, per
the D9 incremental narrowing guidance. Type-level only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A1BtxNeUaGmvUYr8FwtUNu

Author: claude

packages/rest/src/index.ts

@@ -2,6 +2,8 @@
 
 // REST Server
 export { RestServer } from './rest-server.js';
+// The protocol slice the REST layer consumes (ADR-0076 D9 / #2462 A1.5)
+export type { RestProtocol } from './rest-server.js';
 
 // Route Management
 export { RouteManager, RouteGroupBuilder } from './route-manager.js';

packages/rest/src/rest-api-plugin.ts

@@ -1,8 +1,8 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { Plugin, PluginContext, IHttpServer } from '@objectstack/core';
-import { RestServer, RestKernelManager } from './rest-server.js';
-import { ObjectStackProtocol, RestServerConfig } from '@objectstack/spec/api';
+import { RestServer, RestKernelManager, RestProtocol } from './rest-server.js';
+import { RestServerConfig } from '@objectstack/spec/api';
 import { registerPackageRoutes } from './package-routes.js';
 import { registerExternalDatasourceRoutes } from './external-datasource-routes.js';
 import type { PackageService } from '@objectstack/service-package';
@@ -25,7 +25,7 @@ export interface RestApiPluginConfig {
  * 
  * Responsibilities:
  * 1. Consumes 'http.server' (or configured service)
- * 2. Consumes 'protocol' (ObjectStackProtocol)
+ * 2. Consumes 'protocol' (the `RestProtocol` slice — DataProtocol + MetadataProtocol, ADR-0076 D9)
  * 3. Instantiates RestServer to auto-generate routes
  */
 export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
@@ -59,7 +59,7 @@ export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
             const protocolService = config.protocolServiceName || 'protocol';
 
             let server: IHttpServer | undefined;
-            let protocol: ObjectStackProtocol | undefined;
+            let protocol: RestProtocol | undefined;
 
             try {
                 server = ctx.getService<IHttpServer>(serverService);
@@ -68,7 +68,7 @@ export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
             }
 
             try {
-                protocol = ctx.getService<ObjectStackProtocol>(protocolService);
+                protocol = ctx.getService<RestProtocol>(protocolService);
             } catch (e) {
                 // Ignore missing service
             }

packages/rest/src/rest-server.ts

@@ -7,7 +7,16 @@ import {
 import { isMcpServerEnabled } from '@objectstack/types';
 import { RouteManager } from './route-manager.js';
 import { RestServerConfig, RestApiConfig, CrudEndpointsConfig, MetadataEndpointsConfig, BatchEndpointsConfig, RouteGenerationConfig } from '@objectstack/spec/api';
-import { ObjectStackProtocol } from '@objectstack/spec/api';
+import { DataProtocol, MetadataProtocol } from '@objectstack/spec/api';
+
+/**
+ * The protocol slice the REST layer actually consumes (ADR-0076 D9 / #2462
+ * A1.5): wire-normalized data CRUD plus the metadata control plane — not the
+ * full `ObjectStackProtocol` union. Server-only extensions (drafts, history,
+ * diagnostics, clone, …) are feature-detected via runtime casts and so don't
+ * widen this contract.
+ */
+export type RestProtocol = DataProtocol & MetadataProtocol;
 import {
     buildFieldMetaMap,
     referenceFieldNames,
@@ -693,7 +702,7 @@ export interface RestEnvRegistry {
 }
 
 export class RestServer {
-    private protocol: ObjectStackProtocol;
+    private protocol: RestProtocol;
     private config: NormalizedRestServerConfig;
     private routeManager: RouteManager;
     private kernelManager?: RestKernelManager;
@@ -749,7 +758,7 @@ export class RestServer {
 
     constructor(
         server: IHttpServer,
-        protocol: ObjectStackProtocol,
+        protocol: RestProtocol,
         config: RestServerConfig = {},
         kernelManager?: RestKernelManager,
         envRegistry?: RestEnvRegistry,
@@ -876,12 +885,12 @@ export class RestServer {
         return undefined;
     }
 
-    private async resolveProtocol(environmentId?: string, req?: any): Promise<ObjectStackProtocol> {
+    private async resolveProtocol(environmentId?: string, req?: any): Promise<RestProtocol> {
         if (environmentId === 'platform') return this.protocol;
         const envId = await this.resolveRequestEnvironmentId(environmentId, req);
         if (!envId || !this.kernelManager) return this.protocol;
         const kernel = await this.kernelManager.getOrCreate(envId);
-        return kernel.getServiceAsync<ObjectStackProtocol>('protocol');
+        return kernel.getServiceAsync<RestProtocol>('protocol');
     }
 
     /**
@@ -998,7 +1007,7 @@ export class RestServer {
     private async enforceApiAccess(
         req: any,
         res: any,
-        p: ObjectStackProtocol,
+        p: RestProtocol,
         environmentId: string | undefined,
         operation: string,
     ): Promise<boolean> {