fix(rest): ingress parse failures speak the documented fields[] envelope

The two new schema parses (#3897 / #3933) reported Zod failures as `issues[]`,
copying the cross-object batch route. But the data surface's documented
`VALIDATION_FAILED` envelope carries `fields[]` (`{field, code, message}` —
wire-format §7), which is also what `mapDataError` emits for a validator-thrown
one (#3918). Two shapes behind one wire code means a client keying on `fields`
silently sees nothing on these routes.

Adds `zodIssuesToFields` and uses it on both, so `code: 'VALIDATION_FAILED'`
means one thing on the data surface regardless of which layer noticed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TzLE9cw4gZKNyPN2ZP4iTt

Author: claude

packages/rest/src/rest-bulk-path-object.test.ts

@@ -132,6 +132,11 @@ describe('updateMany ingress validation (#3933)', () => {
 
     expect(res.statusCode).toBe(400);
     expect(res.body.code).toBe('VALIDATION_FAILED');
+    // The documented data-surface envelope (`fields[]`, wire-format §7), not a
+    // second per-route shape.
+    expect(res.body.fields).toEqual([
+      { field: 'records.0.id', code: 'invalid_type', message: expect.any(String) },
+    ]);
     expect(updateManyData).not.toHaveBeenCalled();
   });
 });

packages/rest/src/rest-delete-many-ingress.test.ts

@@ -109,6 +109,12 @@ describe('POST /data/:object/deleteMany — ingress validation (#3897)', () => {
 
     expect(res.statusCode).toBe(400);
     expect(res.body.code).toBe('VALIDATION_FAILED');
+    // Same `fields[]` envelope a validator-thrown VALIDATION_FAILED uses
+    // (#3918 / wire-format §7) — one shape per code on the wire.
+    expect(res.body.fields).toEqual([
+      { field: 'ids.0', code: 'invalid_type', message: expect.any(String) },
+    ]);
+    expect(res.body.object).toBe('invoice');
     expect(deleteManyData).not.toHaveBeenCalled();
   });
 

packages/rest/src/rest-server.ts

@@ -76,6 +76,25 @@ const TRANSLATABLE_META_TYPES = new Set(['view', 'action', 'object', 'app', 'das
  * not permitted …" — trips the `'<obj>' … not` substring check and
  * returns a misleading 404.
  */
+/**
+ * Zod issues → the data surface's `fields[]` validation envelope
+ * (`{ field, code, message }`, docs/api/wire-format §7).
+ *
+ * A schema `.parse()` at a route ingress must report failures in the SAME shape
+ * a validator-thrown `VALIDATION_FAILED` does through {@link mapDataError}
+ * (#3918) — otherwise a client keying on `fields` has to learn a second shape
+ * per route, and `code: 'VALIDATION_FAILED'` stops meaning one thing on the
+ * wire.
+ */
+export function zodIssuesToFields(issues: unknown): Array<{ field: string; code: string; message: string }> {
+    if (!Array.isArray(issues)) return [];
+    return issues.map((i: any) => ({
+        field: Array.isArray(i?.path) ? i.path.join('.') : String(i?.path ?? ''),
+        code: String(i?.code ?? 'invalid'),
+        message: String(i?.message ?? 'Invalid value'),
+    }));
+}
+
 export function mapDataError(error: any, object?: string): { status: number; body: Record<string, unknown> } {
     // Referential-integrity restrict on delete → 409 with the dependent count.
     // Surfaced FIRST so the structured fields survive the generic catch-alls.
@@ -6836,8 +6855,8 @@ export class RestServer {
                             res.status(400).json({
                                 error: 'Invalid updateMany request',
                                 code: 'VALIDATION_FAILED',
+                                fields: zodIssuesToFields(parsedUpdate.error?.issues),
                                 object: req.params?.object,
-                                issues: parsedUpdate.error?.issues,
                             });
                             return;
                         }
@@ -6897,8 +6916,8 @@ export class RestServer {
                             res.status(400).json({
                                 error: 'Invalid deleteMany request',
                                 code: 'VALIDATION_FAILED',
+                                fields: zodIssuesToFields(parsed.error?.issues),
                                 object: req.params?.object,
-                                issues: parsed.error?.issues,
                             });
                             return;
                         }