@@ -0,0 +1,21 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest)!: the export door refuses an unserved `format`, and the clone door refuses a non-object `overrides`, instead of answering as if they were not sent (#27500, #27489)
+
+Clause-②: no (narrowing) — `GET /data/:object/export` refuses a `format` outside csv, json and xlsx, and `POST /data/:object/:id/clone` refuses an `overrides` (or bare body) that is not a JSON object; both used to answer success with the value ignored. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: two REST doors now refuse request values they used to ignore. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing at two REST data doors (`@objectstack/rest`).
+
+- **Export, before.** Any `format` other than `json` or `xlsx` was answered as csv: `?format=pdf`, `?format=xml` and `?format=` (empty) answered `200` with a csv attachment and `X-Export-Format: csv`.
+- **Export, now.** A present `format` must be `csv`, `json` or `xlsx` (case-insensitive, surrounding blanks trimmed). Anything else, the empty value included, answers `400` with `error.code: 'VALIDATION_ERROR'`, naming the value and the served set, before any row is read. The spec's `ExportFormat` enum lists more values (for example `jsonl`, `parquet`); this route never served them and refuses them too.
+- **Clone, before.** `{"overrides": "x"}` (or a number, `true`, `null`) was dropped and the door answered `201` with a plain copy; an array reached the clone and was merged index-wise. A bare array or string body behaved the same way.
+- **Clone, now.** A nested `overrides`, or a bare body, that is not a JSON object answers `400` with `error.code: 'VALIDATION_ERROR'`, naming `overrides`, before the clone runs. `"overrides": null` is refused, not read as absent.
+- **Unchanged.** An absent `format` is csv. An object `overrides`, a bare field map, `{}`, and no body at all clone exactly as before. The SDK's `data.clone` and `data.export` send only accepted shapes.
+- **Who sees it.** An API caller or script that sends an unserved export format, or a clone body whose `overrides` is not an object. Such a request used to succeed while meaning something other than what was sent.
+
+**The remedy.** Export: send `csv`, `json` or `xlsx`, or omit `format` for csv. Clone: send `overrides` as an object of field values, or omit it (or send no body) for a plain copy.
@@ -0,0 +1,100 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#27489] `POST /data/:object/:id/clone` refuses an `overrides` that is not
+ * an object, instead of dropping it.
+ *
+ * The defect: the door passed `overrides` on only when `typeof` said
+ * `object`, so `{"overrides":"x"}` answered `201` with a plain copy and
+ * nothing said the caller's value was ignored, while an array passed that
+ * test and reached `cloneData`, which merged it index-wise. The same held for
+ * a bare (un-nested) body.
+ *
+ * Both halves are pinned here, through the real `HonoHttpServer` (the adapter
+ * `os serve` mounts), so the JSON body is parsed by the code that parses it in
+ * production:
+ *
+ *  - refusal: a non-object `overrides` or bare body answers `400` with the
+ *    nested ADR-0112 `VALIDATION_ERROR` naming `overrides`, and `cloneData` is
+ *    never called;
+ *  - preservation: the nested map, the bare map, `{}` and no body at all reach
+ *    `cloneData` exactly as before.
+ *
+ * `null` is decided: a caller who wrote `"overrides": null` wrote a value, so
+ * it is refused, not read as absent. A bare `null` body is the transport's
+ * empty body and stays a plain copy.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { HonoHttpServer } from '@objectstack/plugin-hono-server';
+import { RestServer } from './rest-server';
+
+const ACCOUNT = { name: 'account', label: 'Account', fields: { name: { type: 'text', label: 'Name' } } };
+
+function boot() {
+    const cloneData = vi.fn().mockResolvedValue({ object: 'account', id: 'a2', sourceId: 'a1', record: { id: 'a2' } });
+    const protocol: any = {
+        getMetaItems: vi.fn().mockResolvedValue({ items: [ACCOUNT] }),
+        getMetaItem: vi.fn().mockResolvedValue({ type: 'object', name: 'account', item: ACCOUNT }),
+        cloneData,
+    };
+    const server = new HonoHttpServer(0);
+    const rest = new RestServer(server as any, protocol, { api: { requireAuth: false } } as any);
+    (rest as any).resolveExecCtx = async () => ({ userId: 'u_clone_overrides' });
+    rest.registerRoutes();
+    return { app: server.getRawApp(), cloneData };
+}
+
+async function clone(body: string | undefined) {
+    const { app, cloneData } = boot();
+    const res: Response = await app.fetch(new Request('http://local/api/v1/data/account/a1/clone', {
+        method: 'POST',
+        ...(body === undefined ? {} : { headers: { 'content-type': 'application/json' }, body }),
+    }));
+    return { status: res.status, body: (await res.json()) as any, cloneData };
+}
+
+describe('[#27489] clone — a non-object overrides is refused before cloneData', () => {
+    it.each([
+        ['a string', '{"overrides":"x"}'],
+        ['a number', '{"overrides":1}'],
+        ['true', '{"overrides":true}'],
+        ['null', '{"overrides":null}'],
+        ['an array', '{"overrides":[{"name":"Copy"}]}'],
+        ['an empty array', '{"overrides":[]}'],
+        ['a bare array body', '[{"name":"Copy"}]'],
+        ['a bare string body', '"x"'],
+        ['a bare number body', '7'],
+    ])('overrides as %s → 400 VALIDATION_ERROR naming overrides, cloneData never called', async (_label, body) => {
+        const out = await clone(body);
+
+        expect(out.status).toBe(400);
+        expect(out.body?.error?.code).toBe('VALIDATION_ERROR');
+        expect(out.body?.error?.message).toContain('"overrides"');
+        expect(out.cloneData).not.toHaveBeenCalled();
+    });
+});
+
+describe('[#27489] clone — object overrides and absent bodies keep their answers', () => {
+    it.each([
+        ['nested overrides', '{"overrides":{"name":"Copy"}}', { name: 'Copy' }],
+        ['a bare field map', '{"name":"Bare"}', { name: 'Bare' }],
+        ['an empty nested map', '{"overrides":{}}', {}],
+        ['an empty body object', '{}', {}],
+        ['a bare null body', 'null', {}],
+    ])('%s → 201, cloneData receives %s', async (_label, body, expected) => {
+        const out = await clone(body);
+
+        expect(out.status).toBe(201);
+        expect(out.cloneData).toHaveBeenCalledTimes(1);
+        expect(out.cloneData.mock.calls[0][0]).toMatchObject({ object: 'account', id: 'a1', overrides: expected });
+    });
+
+    it('no body at all → 201, a plain copy', async () => {
+        const out = await clone(undefined);
+
+        expect(out.status).toBe(201);
+        expect(out.cloneData).toHaveBeenCalledTimes(1);
+        expect(out.cloneData.mock.calls[0][0]).toMatchObject({ object: 'account', id: 'a1' });
+    });
+});
@@ -165,6 +165,33 @@ import {
  */
 export type ServerScopedDataRequest<R> = R & { environmentId?: string; context?: unknown };
 
+/** [#27489] A JSON object: what the clone door reads as a field map. Arrays and `null` are not. */
+function isFieldMap(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/** [#27489] The kind of a refused clone body or `overrides`, named without echoing the value. */
+function describeNonFieldMap(value: unknown): string {
+    if (value === null) return 'null';
+    if (Array.isArray(value)) return 'an array';
+    return `a ${typeof value}`;
+}
+
+/** [#27500] The formats `GET /data/:object/export` serves, csv first as the default. */
+const EXPORT_FORMATS = ['csv', 'json', 'xlsx'] as const;
+type ExportFormatServed = typeof EXPORT_FORMATS[number];
+
+/**
+ * [#27500] The export's `?format=`: absent is csv, a served format is itself,
+ * anything else (the empty value included) is `undefined`, which the route
+ * refuses.
+ */
+function readExportFormat(raw: unknown): ExportFormatServed | undefined {
+    if (raw === undefined) return 'csv';
+    const value = String(raw).trim().toLowerCase();
+    return (EXPORT_FORMATS as readonly string[]).includes(value) ? value as ExportFormatServed : undefined;
+}
+
 /**
  * [#24183] One export row as a json object carrying exactly `fields`, in that
  * order — the json arm's counterpart of the column list `formatRowCells` writes
@@ -296,6 +323,7 @@ export function registerDataActionEndpoints(this: DataActionRouteHost, basePath:
     // object's `enable.clone` capability, default on). Optional JSON body
     // `{ overrides?: {...} }` (or a bare field map) is applied on top of
     // the copied values, e.g. to set a new name or clear a unique field.
+    // Any other `overrides` (or bare body) is a 400.
     // Distinct path segment (`/clone`) keeps it clear of the greedy
     // `/data/:object/:id` matchers.
     this.routeManager.register({
@@ -316,13 +344,29 @@ export function registerDataActionEndpoints(this: DataActionRouteHost, basePath:
                 const body = req.body ?? {};
                 // Accept both `{ overrides: {...} }` and a bare field map so
                 // callers can POST overrides directly without nesting.
-                const overrides = (body && typeof body === 'object' && 'overrides' in body)
-                    ? body.overrides
-                    : body;
+                const nested = isFieldMap(body) && 'overrides' in body;
+                const overrides = nested ? body.overrides : body;
+                // [#27489] Refused, not dropped: a non-object `overrides`
+                // (`"x"`, `1`, `true`, `null`) used to be skipped and answer
+                // `201` with a plain copy, and an array passed the `typeof`
+                // test and reached `cloneData`, which merged it index-wise.
+                // Refused here, at the door, before `cloneData` is called. An
+                // absent body or member is still a plain copy; `null` is a
+                // value the caller wrote, so it is refused rather than read as
+                // absent.
+                if (overrides !== undefined && !isFieldMap(overrides)) {
+                    const got = describeNonFieldMap(overrides);
+                    sendEnvelopeError(res, 400, 'VALIDATION_ERROR', nested
+                        ? `The clone body's "overrides" must be an object of field values, got ${got}. `
+                            + 'Omit it for a plain copy.'
+                        : `The clone body must be an object, { "overrides": {...} } or a bare field map, got ${got}. `
+                            + 'Send no body for a plain copy.');
+                    return;
+                }
                 const result = await cloneData.call(p, {
                     object: req.params.object,
                     id: req.params.id,
-                    ...(overrides && typeof overrides === 'object' ? { overrides } : {}),
+                    ...(overrides !== undefined ? { overrides } : {}),
                     ...(environmentId ? { environmentId } : {}),
                     ...(context ? { context } : {}),
                 });
@@ -945,7 +989,8 @@ export function registerDataActionEndpoints(this: DataActionRouteHost, basePath:
     // GET /data/:object/export  — streaming export (M10.21 / C.21)
     //
     // Query params:
-    //   format=csv|json|xlsx (default: csv. json emits a JSON array, xlsx a workbook.)
+    //   format=csv|json|xlsx (default: csv. json emits a JSON array, xlsx a workbook.
+    //                        Any other value, empty included, is a 400.)
     //   fields=a,b,c        (every format. csv / xlsx write exactly these columns and
     //                        json rows carry exactly these keys, in list order; a key
     //                        the read did not return is absent from a json row.
@@ -1071,9 +1116,22 @@ export function registerDataActionEndpoints(this: DataActionRouteHost, basePath:
                     await this.answerImportTemplate(req, res, p, environmentId, objectName, context, q);
                     return;
                 }
-                const fmtRaw = String(q.format ?? 'csv').toLowerCase();
-                const format: 'csv' | 'json' | 'xlsx' =
-                    fmtRaw === 'json' ? 'json' : fmtRaw === 'xlsx' ? 'xlsx' : 'csv';
+                // [#27500] Read, not coerced: a value outside the set this door
+                // serves used to fall through to csv, so `format=pdf`,
+                // `format=xml` and `format=` answered `200` with a csv file the
+                // caller never asked for. An ABSENT `format` is still csv; a
+                // present one must name a served format, the empty value
+                // included (as `limit=` above is refused rather than read as
+                // absent). Trimmed and case-insensitive, the reading the
+                // template mode above gives the same parameter. The set is the
+                // one this route serves, not the spec's wider `ExportFormat`.
+                const format = readExportFormat(q.format);
+                if (format === undefined) {
+                    sendEnvelopeError(res, 400, 'VALIDATION_ERROR',
+                        `The "format" query parameter takes ${EXPORT_FORMATS.join(', ')}, got `
+                        + `${JSON.stringify(q.format)}. Omit it for csv.`);
+                    return;
+                }
                 // Header row toggle (csv / xlsx). Default on; `header=false` omits it.
                 const includeHeader = String(q.header ?? 'true').toLowerCase() !== 'false';
                 const HARD_CAP = 50_000;
 
@@ -0,0 +1,101 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#27500] `GET /data/:object/export?format=` is READ, not coerced.
+ *
+ * The defect: any `format` other than `json` or `xlsx` fell through to csv, so
+ * `format=pdf`, `format=xml` and `format=` (empty) answered `200` with a csv
+ * attachment and `X-Export-Format: csv`. A caller that branches on the status,
+ * or saves the file under the extension it asked for, could not tell its
+ * request was not honoured.
+ *
+ * Both halves are pinned here, through the real `HonoHttpServer` (the adapter
+ * `os serve` mounts), so the query string is parsed by the code that parses it
+ * in production:
+ *
+ *  - refusal: an unserved value answers `400` with the nested ADR-0112
+ *    `VALIDATION_ERROR`, and `findData` is never called, so no row is read;
+ *  - preservation: an absent `format` is still csv, and each served value
+ *    (any case, surrounding blanks trimmed) answers its own format.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { HonoHttpServer } from '@objectstack/plugin-hono-server';
+import { RestServer } from './rest-server';
+
+const TASK = {
+    name: 'task',
+    label: 'Task',
+    fields: {
+        id: { type: 'text', label: 'ID' },
+        title: { type: 'text', label: 'Title' },
+    },
+};
+
+function boot() {
+    const findData = vi.fn().mockResolvedValue({ object: 'task', records: [{ id: '1', title: 'write code' }] });
+    const protocol: any = {
+        getMetaItems: vi.fn().mockResolvedValue({ items: [TASK] }),
+        getMetaItem: vi.fn().mockResolvedValue({ type: 'object', name: 'task', item: TASK }),
+        findData,
+    };
+    const server = new HonoHttpServer(0);
+    const rest = new RestServer(server as any, protocol, { api: { requireAuth: false } } as any);
+    (rest as any).resolveExecCtx = async () => ({ userId: 'u_export_format' });
+    rest.registerRoutes();
+    return { app: server.getRawApp(), findData };
+}
+
+async function exportWith(query: string) {
+    const { app, findData } = boot();
+    const res: Response = await app.fetch(new Request(`http://local/api/v1/data/task/export${query}`));
+    const text = await res.text();
+    let body: any;
+    try { body = JSON.parse(text); } catch { body = undefined; }
+    return { status: res.status, format: res.headers.get('x-export-format'), body, text, findData };
+}
+
+describe('[#27500] export ?format= — an unserved value is refused, not answered as csv', () => {
+    it.each([
+        ['pdf', '?format=pdf'],
+        ['xml', '?format=xml'],
+        ['empty', '?format='],
+        ['blank', '?format=%20'],
+        ['jsonl (in the spec enum, never served by this route)', '?format=jsonl'],
+    ])('format %s → 400 VALIDATION_ERROR, and no row is read', async (_label, query) => {
+        const out = await exportWith(query);
+
+        expect(out.status).toBe(400);
+        expect(out.body?.error?.code).toBe('VALIDATION_ERROR');
+        // The refusal names the parameter and the served set.
+        expect(out.body?.error?.message).toContain('"format"');
+        expect(out.body?.error?.message).toContain('csv, json, xlsx');
+        expect(out.format).toBeNull();
+        expect(out.findData).not.toHaveBeenCalled();
+    });
+});
+
+describe('[#27500] export ?format= — absent and served values keep their answers', () => {
+    it('an absent format is csv', async () => {
+        const out = await exportWith('');
+        expect(out.status).toBe(200);
+        expect(out.format).toBe('csv');
+        expect(out.text).toContain('write code');
+        expect(out.findData).toHaveBeenCalled();
+    });
+
+    it.each([
+        ['?format=csv', 'csv'],
+        ['?format=CSV', 'csv'],
+        ['?format=json', 'json'],
+        ['?format=JSON', 'json'],
+        ['?format=%20json%20', 'json'],
+        ['?format=xlsx', 'xlsx'],
+        ['?format=Xlsx', 'xlsx'],
+    ])('%s answers %s', async (query, expected) => {
+        const out = await exportWith(query);
+        expect(out.status).toBe(200);
+        expect(out.format).toBe(expected);
+        expect(out.findData).toHaveBeenCalled();
+    });
+});