@classytic/arc 2.41.0 → 2.43.0

package/dist/{memory-CpDZ9NPw.mjs → memory-9Cp7611C.mjs}

@@ -1,5 +1,6 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
+import { n as evictToSize } from "./boundedMap-BULzfXYU.mjs";
 //#region src/cache/memory.ts
 var memory_exports = /* @__PURE__ */ __exportAll({ MemoryCacheStore: () => MemoryCacheStore });
 /**
@@ -24,13 +25,13 @@ var MemoryCacheStore = class {
 	_misses = 0;
 	_evictions = 0;
 	constructor(options = {}) {
-		this.defaultTtlSeconds = options.defaultTtlSeconds ?? 60;
-		this.maxEntries = clamp(options.maxEntries ?? 1e3, 1, 1e5);
-		this.maxEntryBytes = clamp(options.maxEntryBytes ?? 262144, 1024, 10485760);
-		this.maxMemoryBytes = options.maxMemoryBytes ?? 52428800;
-		this.evictionWatermark = clamp(options.evictionWatermark ?? .9, .5, 1);
+		this.defaultTtlSeconds = finite("defaultTtlSeconds", options.defaultTtlSeconds ?? 60);
+		this.maxEntries = clamp("maxEntries", options.maxEntries ?? 1e3, 1, 1e5);
+		this.maxEntryBytes = clamp("maxEntryBytes", options.maxEntryBytes ?? 262144, 1024, 10485760);
+		this.maxMemoryBytes = clamp("maxMemoryBytes", options.maxMemoryBytes ?? 52428800, 0, Number.MAX_SAFE_INTEGER);
+		this.evictionWatermark = clamp("evictionWatermark", options.evictionWatermark ?? .9, .5, 1);
 		this.logger = options.logger ?? console;
-		const cleanupIntervalMs = clamp(options.cleanupIntervalMs ?? 3e4, 1e3, 6e5);
+		const cleanupIntervalMs = clamp("cleanupIntervalMs", options.cleanupIntervalMs ?? 3e4, 1e3, 6e5);
 		this.cleanupTimer = setInterval(() => this.cleanupExpired(), cleanupIntervalMs);
 		if (this.cleanupTimer.unref) this.cleanupTimer.unref();
 	}
@@ -54,11 +55,12 @@ var MemoryCacheStore = class {
 		const effectiveTtlSeconds = ttlSeconds ?? this.defaultTtlSeconds;
 		if (!Number.isFinite(effectiveTtlSeconds) || effectiveTtlSeconds <= 0) return;
 		const ttlMs = effectiveTtlSeconds * 1e3;
-		const size = this.estimateSize(value);
-		if (size > this.maxEntryBytes) {
-			this.logger.warn(`[MemoryCacheStore] Skipping oversized entry for key '${key}' (${size} bytes > ${this.maxEntryBytes} bytes)`);
+		const valueBytes = this.estimateSize(value);
+		if (valueBytes > this.maxEntryBytes) {
+			this.logger.warn(`[MemoryCacheStore] Skipping oversized entry for key '${key}' (${valueBytes} bytes > ${this.maxEntryBytes} bytes)`);
 			return;
 		}
+		const size = valueBytes + keyBytes(key);
 		const existing = this.cache.get(key);
 		if (existing) {
 			this.currentBytes -= existing.size;
@@ -70,8 +72,7 @@ var MemoryCacheStore = class {
 			expiresAt: Date.now() + ttlMs
 		});
 		this.currentBytes += size;
-		this.evictToLimit();
-		if (this.maxMemoryBytes > 0) this.evictToMemoryLimit();
+		this.enforceLimits();
 	}
 	async delete(key) {
 		const entry = this.cache.get(key);
@@ -96,14 +97,14 @@ var MemoryCacheStore = class {
 		const effectiveTtlSeconds = ttlSeconds ?? this.defaultTtlSeconds;
 		if (entry) this.currentBytes -= entry.size;
 		this.cache.delete(key);
-		const size = 8;
+		const size = 8 + keyBytes(key);
 		this.cache.set(key, {
 			value: next,
 			size,
 			expiresAt: live ? entry.expiresAt : now + Math.max(1, effectiveTtlSeconds) * 1e3
 		});
 		this.currentBytes += size;
-		this.evictToLimit();
+		this.enforceLimits();
 		return next;
 	}
 	async clear(pattern) {
@@ -133,26 +134,19 @@ var MemoryCacheStore = class {
 		this.cache.delete(key);
 		this.currentBytes -= entry.size;
 	}
-	evictToLimit() {
-		while (this.cache.size > this.maxEntries) {
-			const oldestKey = this.cache.keys().next().value;
-			if (!oldestKey) break;
-			const entry = this.cache.get(oldestKey);
-			if (!entry) break;
-			this.removeEntry(oldestKey, entry);
-			this._evictions++;
-		}
-	}
-	evictToMemoryLimit() {
+	/** Every write path ends here, so no path can skip a limit. */
+	enforceLimits() {
+		this._evictions += evictToSize(this.cache, this.maxEntries, (_key, entry) => {
+			this.currentBytes -= entry.size;
+		});
+		if (this.maxMemoryBytes <= 0 || this.currentBytes <= this.maxMemoryBytes) return;
 		const target = this.maxMemoryBytes * this.evictionWatermark;
-		while (this.currentBytes > this.maxMemoryBytes && this.cache.size > 0) {
-			const oldestKey = this.cache.keys().next().value;
-			if (!oldestKey) break;
-			const entry = this.cache.get(oldestKey);
-			if (!entry) break;
+		while (this.currentBytes > target) {
+			const oldest = this.cache.entries().next();
+			if (oldest.done) break;
+			const [oldestKey, entry] = oldest.value;
 			this.removeEntry(oldestKey, entry);
 			this._evictions++;
-			if (this.currentBytes <= target) break;
 		}
 	}
 	cleanupExpired() {
@@ -169,8 +163,16 @@ var MemoryCacheStore = class {
 		}
 	}
 };
-function clamp(value, min, max) {
-	return Math.min(max, Math.max(min, value));
+/** A non-finite option is a configuration bug — `Math.max(min, NaN)` is NaN, which silently disabled the cap. */
+function finite(name, value) {
+	if (!Number.isFinite(value)) throw new Error(`[arc] MemoryCacheStore ${name} must be a finite number, got ${String(value)}.`);
+	return value;
+}
+function clamp(name, value, min, max) {
+	return Math.min(max, Math.max(min, finite(name, value)));
+}
+function keyBytes(key) {
+	return Buffer.byteLength(key, "utf8");
 }
 /**
 * Translate a glob pattern (`prefix:*`, `*:tag:v`) into a regex. Only `*`

package/dist/{metrics-BaKnq8ag.mjs → metrics-CWI11eRu.mjs}

@@ -1,5 +1,6 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as __exportAll } from "./rolldown-runtime-DjDuyglE.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as __exportAll } from "./rolldown-runtime-D1w9Y1VJ.mjs";
+import { a as MetricHistogram, i as DURATION_BUCKETS_SECONDS, o as MetricSeries, s as renderMetricSample } from "./health-DqbsG-_w.mjs";
 import fp from "fastify-plugin";
 //#region src/plugins/metrics.ts
 var metrics_exports = /* @__PURE__ */ __exportAll({
@@ -7,99 +8,64 @@ var metrics_exports = /* @__PURE__ */ __exportAll({
 	metricsPlugin: () => metricsPlugin
 });
 var Counter = class {
-	data = /* @__PURE__ */ new Map();
+	series;
+	constructor(maxSeries) {
+		this.series = new MetricSeries(maxSeries);
+	}
 	inc(labels, value = 1) {
-		const key = labelKey(labels);
-		const existing = this.data.get(key);
-		if (existing) existing.value += value;
-		else this.data.set(key, {
-			labels: { ...labels },
-			value
-		});
+		this.series.get(labels, () => ({ value: 0 })).value += value;
 	}
 	values() {
-		return [...this.data.values()];
-	}
-	reset() {
-		this.data.clear();
-	}
-};
-var Histogram = class {
-	data = /* @__PURE__ */ new Map();
-	observe(labels, value) {
-		const key = labelKey(labels);
-		const existing = this.data.get(key);
-		if (existing) {
-			existing.sum += value;
-			existing.count += 1;
-		} else this.data.set(key, {
+		return this.series.entries().map(({ labels, value }) => ({
 			labels: { ...labels },
-			sum: value,
-			count: 1
-		});
-	}
-	values() {
-		return [...this.data.values()].flatMap(({ labels, sum, count }) => [{
-			labels: {
-				...labels,
-				le: "sum"
-			},
-			value: sum
-		}, {
-			labels: {
-				...labels,
-				le: "count"
-			},
-			value: count
-		}]);
+			value: value.value
+		}));
 	}
 	reset() {
-		this.data.clear();
+		this.series.reset();
 	}
 };
 var Gauge = class {
-	data = /* @__PURE__ */ new Map();
+	series;
+	constructor(maxSeries) {
+		this.series = new MetricSeries(maxSeries);
+	}
 	set(labels, value) {
-		const key = labelKey(labels);
-		this.data.set(key, {
-			labels: { ...labels },
-			value
-		});
+		this.series.get(labels, () => ({ value: 0 })).value = value;
 	}
 	values() {
-		return [...this.data.values()];
+		return this.series.entries().map(({ labels, value }) => ({
+			labels: { ...labels },
+			value: value.value
+		}));
 	}
 	reset() {
-		this.data.clear();
+		this.series.reset();
 	}
 };
-function labelKey(labels) {
-	return Object.entries(labels).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}=${v}`).join(",");
-}
 function toPrometheusText(metrics) {
 	const lines = [];
 	for (const m of metrics) {
 		lines.push(`# HELP ${m.name} ${m.help}`);
 		lines.push(`# TYPE ${m.name} ${m.type}`);
-		for (const v of m.values) {
-			const labelStr = Object.entries(v.labels).map(([k, val]) => `${k}="${val}"`).join(",");
-			lines.push(`${m.name}{${labelStr}} ${v.value}`);
-		}
+		for (const v of m.values) lines.push(renderMetricSample(m.name, v));
 	}
 	return `${lines.join("\n")}\n`;
 }
 const metricsPlugin = async (fastify, opts = {}) => {
 	const path = opts.path ?? "/_metrics";
 	const prefix = opts.prefix ?? "arc";
-	const httpRequestsTotal = new Counter();
-	const crudOpsTotal = new Counter();
-	const cacheHitsTotal = new Counter();
-	const cacheMissesTotal = new Counter();
-	const eventsPublishedTotal = new Counter();
-	const eventsConsumedTotal = new Counter();
-	const httpDuration = new Histogram();
-	const crudDuration = new Histogram();
-	const circuitBreakerState = new Gauge();
+	const maxSeries = opts.maxSeries ?? 1e3;
+	if (!/^[a-zA-Z_:][a-zA-Z0-9_:]*$/.test(prefix)) throw new Error("metrics.prefix must be a valid Prometheus metric prefix");
+	const httpRequestsTotal = new Counter(maxSeries);
+	const crudOpsTotal = new Counter(maxSeries);
+	const cacheHitsTotal = new Counter(maxSeries);
+	const cacheMissesTotal = new Counter(maxSeries);
+	const eventsPublishedTotal = new Counter(maxSeries);
+	const eventsConsumedTotal = new Counter(maxSeries);
+	const httpDuration = new MetricHistogram(DURATION_BUCKETS_SECONDS, maxSeries);
+	const crudDuration = new MetricHistogram(DURATION_BUCKETS_SECONDS, maxSeries);
+	const circuitBreakerState = new Gauge(maxSeries);
 	const collector = {
 		collect() {
 			const metrics = [
@@ -196,17 +162,18 @@ const metricsPlugin = async (fastify, opts = {}) => {
 			eventsConsumedTotal.inc({ event_type: eventType });
 		},
 		recordCircuitBreakerState(service, state) {
-			const stateValue = state === "open" ? 1 : state === "half-open" ? 2 : 0;
+			const normalized = state.toLowerCase().replaceAll("_", "-");
+			const stateValue = normalized === "open" ? 1 : normalized === "half-open" ? 2 : 0;
 			circuitBreakerState.set({ service }, stateValue);
 		}
 	};
 	fastify.decorate("metrics", collector);
 	fastify.addHook("onResponse", async (request, reply) => {
-		if (request.url === path) return;
+		if (request.routeOptions.url === path) return;
 		const duration = reply.elapsedTime / 1e3;
 		const labels = {
 			method: request.method,
-			route: request.routeOptions?.url ?? request.url,
+			route: request.routeOptions.url ?? "__unmatched__",
 			status: String(reply.statusCode)
 		};
 		httpRequestsTotal.inc(labels);
@@ -222,4 +189,4 @@ var metrics_default = fp(metricsPlugin, {
 	fastify: "5.x"
 });
 //#endregion
-export { metrics_default as n, metrics_exports as r, metricsPlugin as t };
+export { metrics_exports as n, metrics_default as t };

package/dist/middleware/index.d.mts

@@ -1,5 +1,5 @@
 
-import { I as MiddlewareHandler, L as RequestWithExtras, Q as MiddlewareConfig } from "../index-DHbyPo5j.mjs";
+import { A as RequestWithExtras, J as MiddlewareConfig, k as MiddlewareHandler } from "../index-mqaqZNpe.mjs";
 import { RouteHandlerMethod } from "fastify";
 //#region src/middleware/middleware.d.ts
 interface NamedMiddleware {
@@ -122,4 +122,4 @@ interface MultipartBodyOptions {
  */
 declare function multipartBody(options?: MultipartBodyOptions): RouteHandlerMethod;
 //#endregion
-export { type MultipartBodyOptions, type NamedMiddleware, type ParsedFile, middleware, multipartBody, sortMiddlewares };
+export { type MiddlewareOptions, type MultipartBodyOptions, type NamedMiddleware, type ParsedFile, middleware, multipartBody, sortMiddlewares };

package/dist/middleware/index.mjs

@@ -1,6 +1,6 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as CRUD_OPERATIONS } from "../constants-BxLgNFF7.mjs";
-import { t as multipartBody } from "../multipartBody-C92aJ8am.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as CRUD_OPERATIONS } from "../constants-Cu7Mx7_U.mjs";
+import { t as multipartBody } from "../multipartBody-CXM2a-Dy.mjs";
 //#region src/middleware/middleware.ts
 /**
 * Named Middleware — Priority-based, conditional middleware execution.

package/dist/migrations/index.mjs

@@ -1,5 +1,5 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
-import { t as startRenewingLease } from "../renewingLease-B3VYh5aU.mjs";
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { t as startRenewingLease } from "../renewingLease-qODa7KJQ.mjs";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/migrations/index.ts
 /**

package/dist/{module-BkQEesNQ.mjs → module-BSvOQC7E.mjs}

@@ -1,18 +1,18 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
 //#region src/factory/module/index.ts
 /**
 * Identity helper for authoring a typed module — mirrors `defineResource`.
 * Gives inference + a single obvious construction site; does no work.
 *
-* `TExports` is inferred from the `bootstrap` return value, so a module
-* author gets a typed public export for free:
+* Everything is inferred: the export from `bootstrap`'s return, the port types from
+* `requires` (declare `requires` BEFORE the phases that read `ports`):
 *
 * ```ts
-* export const accountingModule = (deps: Deps) =>
-*   defineModule({
-*     name: "accounting",
-*     bootstrap: async () => createAccountingEngine(deps), // TExports inferred
-*   });
+* defineModule({
+*   name: "accounting",
+*   requires: { ports: ["outbox"], optionalPorts: ["calendar"] },
+*   bootstrap: (f, { ports }) => createAccountingEngine(ports.outbox, ports.calendar),
+* });
 * ```
 */
 function defineModule(module) {

package/dist/multiTenant-cY0FkDiA.d.mts

@@ -0,0 +1,104 @@
+
+import { G as CrudRouteKey, W as PresetResult } from "./index-mqaqZNpe.mjs";
+//#region src/permissions/tenantPreparation.d.ts
+type TenantFieldSpec = {
+  field: string;
+  type: "org";
+} | {
+  field: string;
+  type: "team";
+} | {
+  field: string;
+  contextKey: string;
+};
+//#endregion
+//#region src/presets/multiTenant.d.ts
+interface MultiTenantOptions {
+  /**
+   * Single-field form: name of the database field to filter by.
+   * Reads `getOrgId(scope)` as the value source.
+   *
+   * Mutually exclusive with `tenantFields` — pass one or the other, not both.
+   *
+   * @default 'organizationId'
+   */
+  tenantField?: string;
+  /**
+   * Multi-field form (2.7.1+): list of tenant dimensions to filter by in
+   * lockstep. Use this when a resource is scoped by more than just
+   * organization — e.g. organization + branch, organization + project,
+   * or organization + team + workspace.
+   *
+   * Each entry is a discriminated `TenantFieldSpec` declaring where the
+   * value comes from. Use `type: 'org'` / `type: 'team'` for built-in scope
+   * fields, or `contextKey: '...'` to read from `scope.context` (set by
+   * your auth function).
+   *
+   * Fail-closed: if any required dimension is missing, the request is
+   * rejected. Elevated scopes apply whatever resolves and skip the rest.
+   *
+   * Mutually exclusive with `tenantField`.
+   *
+   * @example
+   * ```typescript
+   * multiTenantPreset({
+   *   tenantFields: [
+   *     { field: 'organizationId', type: 'org' },
+   *     { field: 'branchId',       contextKey: 'branchId' },
+   *   ],
+   * })
+   * ```
+   */
+  tenantFields?: readonly TenantFieldSpec[];
+  /**
+   * Routes that allow public access (no auth required)
+   * When a route is in this array:
+   * - If no org context: allow through without filtering (public data)
+   * - If org context present: require auth and apply filter
+   *
+   * @default [] (strict mode - all routes require auth)
+   * @example
+   * multiTenantPreset({ allowPublic: ['list', 'get'] })
+   */
+  allowPublic?: CrudRouteKey[];
+  /**
+   * Reads that are NOT scoped to a tenant at all — a marketplace listing.
+   *
+   * `allowPublic` answers "may an anonymous caller reach this route?". That is a different
+   * question from "is this listing scoped to a tenant?", and until this option there was no way
+   * to answer the second one with "no". An `allowPublic` route still filters by the caller's
+   * organization whenever they have one, and a signed-in user of a multi-org product ALWAYS has
+   * one, because choosing an organization writes it onto the session. So a cross-tenant catalog
+   * silently became single-tenant the moment one of its own sellers browsed it: the same URL,
+   * with no header and no query parameter to explain the difference, returned a different world
+   * depending on who was asking.
+   *
+   * The only escape was to drop this preset from the resource entirely, which also drops tenant
+   * INJECTION on create/update — the thing that stops a member moving a document into another
+   * organization. Trading a write guarantee for a read behaviour is not a real choice.
+   *
+   * Listed routes get no tenant middleware: no filter, and nothing stashed for the repo layer.
+   * Everything else keeps its filter, so writes are unaffected.
+   *
+   * READS ONLY, by type. A cross-tenant `create` or `update` is not a listing, it is an escape
+   * from tenancy, and it should never be one option away by accident.
+   *
+   * THIS DOES NOT AUTHORIZE ANYTHING. Removing the tenant filter widens what the query can
+   * return, so the resource owes a row-level `policy` from its permission check saying what a
+   * stranger may see (`{ status: 'active' }`, `{ visibility: 'public' }`). Declaring this without
+   * one publishes every row in every tenant.
+   *
+   * @default []
+   * @example
+   * // A public catalog: anyone may browse every seller's LIVE products,
+   * // while create/update/delete stay pinned to the caller's own shop.
+   * multiTenantPreset({
+   *   allowPublic: ['list', 'get'],
+   *   crossTenant: ['list', 'get'],
+   * })
+   */
+  crossTenant?: readonly Extract<CrudRouteKey, "list" | "get">[];
+}
+declare function multiTenantPreset(options?: MultiTenantOptions): PresetResult;
+//#endregion
+export { multiTenantPreset as n, TenantFieldSpec as r, MultiTenantOptions as t };

package/dist/{multipartBody-C92aJ8am.mjs → multipartBody-CXM2a-Dy.mjs}

@@ -1,6 +1,41 @@
-/*! @classytic/arc v2.41.0 | MIT | https://classytic.com */
+/*! @classytic/arc v2.43.0 | MIT | https://classytic.com */
+import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
+/**
+* Multipart Body Middleware — Opt-in multipart/form-data parsing for CRUD routes.
+*
+* Parses multipart form fields into `req.body` and attaches files to `req.body._files`.
+* Use with a `before:create` or `before:update` hook to process files (upload to S3, etc.)
+* before BaseController persists the record.
+*
+* Requires `@fastify/multipart` to be registered on the Fastify instance
+* (Arc registers it by default via `createApp()` unless `multipart: false`).
+*
+* @example
+* ```typescript
+* import { defineResource } from '@classytic/arc';
+* import { multipartBody } from '@classytic/arc/middleware';
+*
+* const productResource = defineResource({
+*   name: 'product',
+*   adapter,
+*   middlewares: {
+*     create: [multipartBody()],
+*     update: [multipartBody()],
+*   },
+*   hooks: {
+*     'before:create': async (data) => {
+*       if (data._files?.image) {
+*         data.imageUrl = await uploadToS3(data._files.image);
+*         delete data._files;
+*       }
+*       return data;
+*     },
+*   },
+* });
+* ```
+*/
 const DEFAULT_MAX_FILE_SIZE = 10485760;
 const DEFAULT_MAX_FILES = 5;
 const DEFAULT_MAX_TOTAL_BYTES = 26214400;
@@ -78,19 +113,19 @@ function multipartBody(options = {}) {
 			for await (const part of parts) if (part.type === "file") {
 				if (fileCount >= maxFiles) continue;
 				if (mimeMatcher && !mimeMatcher.matches(part.mimetype)) return reply.code(415).send({
-					code: "arc.unsupported_media_type",
+					code: ARC_ERROR_CODES.UNSUPPORTED_MEDIA_TYPE,
 					message: `File type '${part.mimetype}' not allowed. Accepted: ${mimeMatcher.describe()}`,
 					status: 415
 				});
 				const buffer = await part.toBuffer();
 				if (buffer.length > maxFileSize) return reply.code(413).send({
-					code: "arc.payload_too_large",
+					code: ARC_ERROR_CODES.PAYLOAD_TOO_LARGE,
 					message: `File '${part.filename}' exceeds maximum size of ${Math.round(maxFileSize / 1024 / 1024)}MB`,
 					status: 413
 				});
 				totalBytes += buffer.length;
 				if (totalBytes > maxTotalBytes) return reply.code(413).send({
-					code: "arc.payload_too_large",
+					code: ARC_ERROR_CODES.PAYLOAD_TOO_LARGE,
 					message: `Combined upload size exceeds ${Math.round(maxTotalBytes / 1024 / 1024)}MB per request`,
 					status: 413
 				});
@@ -106,7 +141,7 @@ function multipartBody(options = {}) {
 		} catch (err) {
 			request.log.error({ err }, "multipartBody: failed to parse multipart form");
 			return reply.code(400).send({
-				code: "arc.bad_request",
+				code: ARC_ERROR_CODES.BAD_REQUEST,
 				message: "Failed to parse multipart form data",
 				status: 400
 			});
@@ -114,10 +149,14 @@ function multipartBody(options = {}) {
 		if (requiredFields) {
 			const missing = requiredFields.filter((name) => !(name in files));
 			if (missing.length > 0) return reply.code(400).send({
-				code: "MISSING_FILE_FIELDS",
+				code: ARC_ERROR_CODES.VALIDATION_ERROR,
 				message: `Missing required file field${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`,
 				status: 400,
-				details: { missing }
+				details: missing.map((name) => ({
+					path: name,
+					code: "required",
+					message: `File field "${name}" is required`
+				}))
 			});
 		}
 		if (fileCount > 0) body[filesKey] = files;