test: update pre-existing stale specs for 2.0 multimodal + validation behavior

Fixes a backlog of integration/unit specs that asserted pre-2.0 behavior and
were failing CI (not caused by recent feature work):
- modality-aware empty-input error is 'No file(s) provided', not /no image/i
  (rotate, border, crop, resize, smart-crop, edge-cases, adversarial-extended,
  api, tool-factory-route)
- input validation rejects pre-enqueue with a clean 400 in 'error' (was a worker
  422 in 'details'): create-zip, extract-zip, merge-csvs
- resolveToolPool defaults unknown tools to the system pool (pool-routing)
- /upload and fetch-urls accept non-image content, validated per-tool at process
  time (api, fetch-urls)
- color-adjust legacy aliases were consolidated into adjust-colors: drop the
  removed-alias tests; retarget the format-preservation tests
- xml-to-csv gracefully converts a single non-repeating record to a 1-row CSV
- dropzone is multimodal; image-only filtering is opt-in via fileFilter
- factory-multi-input: register the synthetic test tools in the catalog so they
  route correctly (file modality for concat; image for the validation-prefix test)

Verified locally: unit 4546 passed, integration 8332 passed, typecheck + lint green.

tests/integration/adversarial-extended.test.ts

@@ -620,7 +620,7 @@ describe("Batch edge cases — extended", () => {
 
     expect(res.statusCode).toBe(400);
     const json = JSON.parse(res.body);
-    expect(json.error).toMatch(/no image/i);
+    expect(json.error).toMatch(/no file/i);
   });
 
   it("handles batch with duplicate filenames", async () => {
@@ -729,7 +729,7 @@ describe("Batch edge cases — extended", () => {
     // The zero-byte file is skipped, resulting in 0 valid files
     expect(res.statusCode).toBe(400);
     const json = JSON.parse(res.body);
-    expect(json.error).toMatch(/no image/i);
+    expect(json.error).toMatch(/no file/i);
   });
 });
 
@@ -1282,7 +1282,7 @@ describe("Batch with only zero-byte files", () => {
     // Zero-byte files are skipped during parsing, so 0 valid files
     expect(res.statusCode).toBe(400);
     const json = JSON.parse(res.body);
-    expect(json.error).toMatch(/no image/i);
+    expect(json.error).toMatch(/no file/i);
   });
 });
 

tests/integration/api.test.ts

@@ -576,7 +576,10 @@ describe("File upload/download", () => {
       expect(JSON.parse(res.body).error).toMatch(/no valid files/i);
     });
 
-    it("returns 400 for a non-image file (text file disguised as upload)", async () => {
+    // Upload is modality-agnostic in 2.0: it accepts any file and defers content
+    // validation to per-tool processing (a disguised/invalid file fails when a
+    // tool actually runs on it). Stored files are never executed.
+    it("accepts a non-image file upload (content validated per-tool at process time)", async () => {
       const textContent = Buffer.from("This is not an image. Just plain text content.");
       const { body: payload, contentType } = createMultipartPayload([
         {
@@ -596,10 +599,10 @@ describe("File upload/download", () => {
         },
         payload,
       });
-      expect(res.statusCode).toBe(400);
+      expect(res.statusCode).toBe(200);
     });
 
-    it("rejects a file with image extension but non-image content", async () => {
+    it("accepts a file with image extension but non-image content (validated at process time)", async () => {
       const fakeImage = Buffer.from("#!/bin/bash\necho 'gotcha'");
       const { body: payload, contentType } = createMultipartPayload([
         {
@@ -619,7 +622,7 @@ describe("File upload/download", () => {
         },
         payload,
       });
-      expect(res.statusCode).toBe(400);
+      expect(res.statusCode).toBe(200);
     });
 
     it("sanitizes path traversal in filename", async () => {
@@ -830,7 +833,7 @@ describe("Tool processing", () => {
         payload,
       });
       expect(res.statusCode).toBe(400);
-      expect(JSON.parse(res.body).error).toMatch(/no image/i);
+      expect(JSON.parse(res.body).error).toMatch(/no file/i);
     });
 
     it("returns 400 for malformed settings JSON", async () => {
@@ -3428,7 +3431,7 @@ describe("Crop format preservation", () => {
 // COLOR ADJUSTMENTS FORMAT PRESERVATION
 // ═══════════════════════════════════════════════════════════════════════════
 describe("Color adjustments format preservation", () => {
-  it("preserves JPEG format for JPEG input via brightness-contrast", async () => {
+  it("preserves JPEG format for JPEG input via adjust-colors", async () => {
     const { body: payload, contentType } = createMultipartPayload([
       { name: "file", filename: "photo.jpg", contentType: "image/jpeg", content: JPG_100x100 },
       { name: "settings", content: JSON.stringify({ brightness: 10 }) },
@@ -3436,7 +3439,7 @@ describe("Color adjustments format preservation", () => {
 
     const res = await app.inject({
       method: "POST",
-      url: "/api/v1/tools/brightness-contrast",
+      url: "/api/v1/tools/adjust-colors",
       headers: {
         authorization: `Bearer ${adminToken}`,
         "content-type": contentType,
@@ -3455,7 +3458,7 @@ describe("Color adjustments format preservation", () => {
     expect(meta.format).toBe("jpeg");
   });
 
-  it("preserves PNG format for PNG input via saturation", async () => {
+  it("preserves PNG format for PNG input via adjust-colors", async () => {
     const { body: payload, contentType } = createMultipartPayload([
       { name: "file", filename: "image.png", contentType: "image/png", content: PNG_200x150 },
       { name: "settings", content: JSON.stringify({ saturation: 20 }) },
@@ -3463,7 +3466,7 @@ describe("Color adjustments format preservation", () => {
 
     const res = await app.inject({
       method: "POST",
-      url: "/api/v1/tools/saturation",
+      url: "/api/v1/tools/adjust-colors",
       headers: {
         authorization: `Bearer ${adminToken}`,
         "content-type": contentType,
@@ -3529,7 +3532,9 @@ describe("Edge cases & adversarial inputs", () => {
       },
       payload,
     });
-    expect(res.statusCode).toBe(400);
+    // Upload accepts the bytes (2.0 multimodal); a null-byte "image" is rejected
+    // later when a tool tries to decode it, not at upload time.
+    expect(res.statusCode).toBe(200);
   });
 
   it("handles concurrent requests without corruption", async () => {

tests/integration/border.test.ts

@@ -297,7 +297,7 @@ describe("Border", () => {
 
     expect(res.statusCode).toBe(400);
     const result = JSON.parse(res.body);
-    expect(result.error).toMatch(/no image/i);
+    expect(result.error).toMatch(/no file/i);
   });
 
   it("rejects invalid border color format", async () => {

tests/integration/color-adjustments.test.ts

@@ -3,7 +3,7 @@
  *
  * Covers brightness, contrast, exposure, saturation, hue, temperature, tint,
  * sharpness, channel adjustments, and effects (grayscale, sepia, invert).
- * Also tests legacy alias routes (brightness-contrast, saturation, etc.).
+ * Consolidated adjust-colors tool replaces the old brightness-contrast, saturation, etc.
  */
 
 import { readFileSync } from "node:fs";
@@ -228,37 +228,6 @@ describe("Multiple input formats", () => {
   });
 });
 
-// ── Legacy alias routes ───────────────────────────────────────────
-describe("Legacy alias routes", () => {
-  it("brightness-contrast alias works", async () => {
-    const res = await postTool("brightness-contrast", { brightness: 25, contrast: -10 });
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.body);
-    expect(result.downloadUrl).toBeDefined();
-  });
-
-  it("saturation alias works", async () => {
-    const res = await postTool("saturation", { saturation: 50 });
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.body);
-    expect(result.downloadUrl).toBeDefined();
-  });
-
-  it("color-channels alias works", async () => {
-    const res = await postTool("color-channels", { red: 150, green: 50, blue: 100 });
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.body);
-    expect(result.downloadUrl).toBeDefined();
-  });
-
-  it("color-effects alias works", async () => {
-    const res = await postTool("color-effects", { effect: "sepia" });
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.body);
-    expect(result.downloadUrl).toBeDefined();
-  });
-});
-
 // ── Error handling ────────────────────────────────────────────────
 describe("Error handling", () => {
   it("returns 400 when no file is provided", async () => {

tests/integration/create-zip.test.ts

@@ -47,7 +47,7 @@ describe("create-zip (pure JS, no skipIf)", () => {
     expect(dl.rawPayload.length).toBeGreaterThan(CSV_A.length + CSV_B.length - 50);
   }, 30_000);
 
-  it("rejects a single file with 422 'at least two'", async () => {
+  it("rejects a single file with 400 'at least two'", async () => {
     const { body, contentType } = createMultipartPayload([
       { name: "file", filename: "tiny-a.csv", contentType: "text/csv", content: CSV_A },
       { name: "settings", content: JSON.stringify({}) },
@@ -59,8 +59,8 @@ describe("create-zip (pure JS, no skipIf)", () => {
       body,
     });
 
-    expect(res.statusCode).toBe(422);
+    expect(res.statusCode).toBe(400);
     const parsed = JSON.parse(res.body);
-    expect(parsed.details).toMatch(/at least two/i);
+    expect(parsed.error).toMatch(/at least 2/i);
   }, 30_000);
 });

tests/integration/crop.test.ts

@@ -221,7 +221,7 @@ describe("Crop", () => {
 
     expect(res.statusCode).toBe(400);
     const result = JSON.parse(res.body);
-    expect(result.error).toMatch(/no image/i);
+    expect(result.error).toMatch(/no file/i);
   });
 
   it("rejects invalid settings JSON", async () => {

tests/integration/edge-cases.test.ts

@@ -630,7 +630,7 @@ describe("Missing file part in multipart request", () => {
 
     expect(res.statusCode).toBe(400);
     const json = JSON.parse(res.body);
-    expect(json.error).toMatch(/no image/i);
+    expect(json.error).toMatch(/no file/i);
   });
 
   it("rejects pipeline execute with only pipeline definition and no file", async () => {
@@ -651,7 +651,7 @@ describe("Missing file part in multipart request", () => {
 
     expect(res.statusCode).toBe(400);
     const json = JSON.parse(res.body);
-    expect(json.error).toMatch(/no image/i);
+    expect(json.error).toMatch(/no file/i);
   });
 });
 

tests/integration/extract-zip.test.ts

@@ -101,7 +101,7 @@ describe("extract-zip (pure JS, no skipIf)", () => {
     expect(dl.payload).toBe("hello world from extract-zip test");
   }, 30_000);
 
-  it("rejects a zip with path traversal (../evil.txt) with 422", async () => {
+  it("rejects a zip with path traversal (../evil.txt) with 400", async () => {
     // Most zip libraries sanitize entry names, so we binary-patch
     // a placeholder to inject "../evil.txt" into the raw zip bytes.
     const zip = new AdmZip();
@@ -118,11 +118,11 @@ describe("extract-zip (pure JS, no skipIf)", () => {
     }
 
     const res = await runExtract("traversal.zip", zipBuf);
-    expect(res.statusCode).toBe(422);
+    expect(res.statusCode).toBe(400);
     const parsed = JSON.parse(res.body);
-    // yauzl itself rejects "../" paths with "invalid relative path" (defense in depth);
-    // our guard also catches them if yauzl's validation is bypassed
-    expect(parsed.details).toMatch(/unsafe entry path|invalid relative path/i);
+    // Path traversal is now rejected pre-enqueue with a clean 400 InputValidationError,
+    // whose message is surfaced in `error` (the legacy worker path used `details`/422).
+    expect(parsed.error).toMatch(/unsafe entry path|invalid relative path/i);
   }, 30_000);
 
   it("rejects a high-ratio zip bomb with 422", async () => {

tests/integration/factory-multi-input.test.ts

@@ -7,6 +7,7 @@
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { TOOLS } from "@snapotter/shared";
 import { eq } from "drizzle-orm";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { db, schema } from "../../apps/api/src/db/index.js";
@@ -47,17 +48,66 @@ preReadyHooks.push((app) => {
       contentType: "application/octet-stream",
     }),
   });
+  // Image-modality multi-input tool: used to verify per-file validation errors
+  // are prefixed with the filename. (multi-concat is "file" modality, which
+  // passes content through without validating, so it cannot exercise this path.)
+  createToolRoute(app, {
+    toolId: "multi-validate",
+    maxInputs: 2,
+    settingsSchema: emptySchema,
+    process: async () => {
+      throw new Error("legacy path must not run");
+    },
+    processV2: async (ctx) => ({
+      buffer: ctx.inputs[0].buffer,
+      filename: "out.png",
+      contentType: "image/png",
+    }),
+  });
 });
 
 let testApp: TestApp;
 let adminToken: string;
 
 beforeAll(async () => {
+  // multi-concat isn't a real catalog tool. resolveToolPool() routes unknown
+  // tool IDs to the "system" pool (whose worker only runs system jobs), and the
+  // factory would default it to image modality (which re-encodes inputs). Register
+  // it as a "file" tool so it routes to the docs pool with raw passthrough, like a
+  // real multi-input file tool. Removed again in afterAll.
+  TOOLS.push(
+    {
+      id: "multi-concat",
+      name: "Multi Concat (test)",
+      description: "Test-only tool that concatenates inputs",
+      category: "archives",
+      icon: "FolderArchive",
+      route: "/multi-concat",
+      modality: "file",
+      acceptedInputs: [],
+      executionHint: "fast",
+    } as (typeof TOOLS)[number],
+    {
+      id: "multi-validate",
+      name: "Multi Validate (test)",
+      description: "Test-only image multi-input tool",
+      category: "archives",
+      icon: "Image",
+      route: "/multi-validate",
+      modality: "image",
+      acceptedInputs: [],
+      executionHint: "fast",
+    } as (typeof TOOLS)[number],
+  );
   testApp = await buildTestApp();
   adminToken = await loginAsAdmin(testApp.app);
 }, 30_000);
 
 afterAll(async () => {
+  for (const id of ["multi-concat", "multi-validate"]) {
+    const idx = TOOLS.findIndex((t) => t.id === id);
+    if (idx !== -1) TOOLS.splice(idx, 1);
+  }
   await testApp.cleanup();
 }, 10_000);
 
@@ -161,7 +211,7 @@ describe("Factory multi-input (maxInputs)", () => {
 
     const res = await testApp.app.inject({
       method: "POST",
-      url: "/api/v1/tools/multi-concat",
+      url: "/api/v1/tools/multi-validate",
       headers: {
         authorization: `Bearer ${adminToken}`,
         "content-type": contentType,

tests/integration/fetch-urls.test.ts

@@ -136,7 +136,7 @@ describe("POST /api/v1/fetch-urls", () => {
     expect(body.results[0].error).toContain("404");
   });
 
-  it("returns failure for non-image content", async () => {
+  it("accepts non-image content (multimodal)", async () => {
     const res = await app.inject({
       method: "POST",
       url: "/api/v1/fetch-urls",
@@ -147,8 +147,8 @@ describe("POST /api/v1/fetch-urls", () => {
     expect(res.statusCode).toBe(200);
     const body = JSON.parse(res.body);
     expect(body.results).toHaveLength(1);
-    expect(body.results[0].success).toBe(false);
-    expect(body.results[0].error).toBeTruthy();
+    expect(body.results[0].success).toBe(true);
+    expect(body.results[0].downloadUrl).toBeDefined();
   });
 
   it("handles mixed batch with successes and failures", async () => {
@@ -173,7 +173,7 @@ describe("POST /api/v1/fetch-urls", () => {
     expect(body.results[0].filename).toBe("photo.jpg");
     expect(body.results[1].success).toBe(false);
     expect(body.results[1].error).toContain("404");
-    expect(body.results[2].success).toBe(false);
+    expect(body.results[2].success).toBe(true);
   });
 
   it("returns 400 for an empty URL array", async () => {

tests/integration/merge-csvs.test.ts

@@ -66,7 +66,7 @@ describe("merge-csvs (pure JS, no skipIf)", () => {
     expect(parsed.details).toMatch(/different columns/i);
   }, 30_000);
 
-  it("rejects a single file with 422", async () => {
+  it("rejects a single file with 400", async () => {
     const { body, contentType } = createMultipartPayload([
       { name: "file", filename: "tiny-a.csv", contentType: "text/csv", content: CSV_A },
       { name: "settings", content: JSON.stringify({}) },
@@ -78,8 +78,8 @@ describe("merge-csvs (pure JS, no skipIf)", () => {
       body,
     });
 
-    expect(res.statusCode).toBe(422);
+    expect(res.statusCode).toBe(400);
     const parsed = JSON.parse(res.body);
-    expect(parsed.details).toMatch(/at least two/i);
+    expect(parsed.error).toMatch(/at least 2/i);
   }, 30_000);
 });

tests/integration/pool-routing.test.ts

@@ -8,8 +8,8 @@ describe("pool routing", () => {
   it("ai tools route to the ai pool regardless of modality", () => {
     expect(resolveToolPool("remove-background")).toBe("ai");
   });
-  it("unknown tools default to image", () => {
-    expect(resolveToolPool("not-a-tool")).toBe("image");
+  it("unknown tools default to system", () => {
+    expect(resolveToolPool("not-a-tool")).toBe("system");
   });
   it("long hint skips the sync window", () => {
     expect(shouldSkipSyncWindow("long")).toBe(true);

tests/integration/resize.test.ts

@@ -208,7 +208,7 @@ describe("Resize", () => {
 
     expect(res.statusCode).toBe(400);
     const result = JSON.parse(res.body);
-    expect(result.error).toMatch(/no image/i);
+    expect(result.error).toMatch(/no file/i);
   });
 
   it("rejects invalid settings JSON", async () => {

tests/integration/rotate.test.ts

@@ -208,7 +208,7 @@ describe("Rotate", () => {
 
     expect(res.statusCode).toBe(400);
     const result = JSON.parse(res.body);
-    expect(result.error).toMatch(/no image/i);
+    expect(result.error).toMatch(/no file/i);
   });
 
   it("rejects invalid settings JSON", async () => {

tests/integration/smart-crop.test.ts

@@ -339,7 +339,7 @@ describe("Smart Crop", () => {
 
     expect(res.statusCode).toBe(400);
     const result = JSON.parse(res.body);
-    expect(result.error).toMatch(/no image/i);
+    expect(result.error).toMatch(/no file/i);
   });
 
   it("rejects invalid settings JSON", async () => {

tests/integration/xml-to-csv.test.ts

@@ -48,11 +48,22 @@ describe("xml-to-csv (pure JS, no skipIf)", () => {
     expect(text).toContain("Grace");
   }, 30_000);
 
-  it("rejects XML with no repeating elements", async () => {
+  it("converts single non-repeating record to a 1-row CSV", async () => {
     const xml = Buffer.from('<?xml version="1.0"?><root><single>value</single></root>');
     const res = await runTool("flat.xml", xml);
-    expect(res.statusCode).toBe(422);
-    const parsed = JSON.parse(res.body);
-    expect(parsed.details).toMatch(/no repeating elements/i);
+    expect(res.statusCode).toBe(200);
+    const envelope = JSON.parse(res.body);
+    expect(envelope.downloadUrl).toBeDefined();
+    expect(envelope.rows).toBe(1);
+
+    const dl = await testApp.app.inject({ method: "GET", url: envelope.downloadUrl });
+    expect(dl.statusCode).toBe(200);
+
+    const text = dl.payload;
+    const lines = text.trim().split("\n");
+    // header + 1 data row
+    expect(lines.length).toBe(2);
+    expect(text).toContain("single");
+    expect(text).toContain("value");
   }, 30_000);
 });

tests/unit/api/tool-factory-route.test.ts

@@ -309,7 +309,7 @@ describe("createToolRoute", () => {
 
       expect(reply.status).toHaveBeenCalledWith(400);
       expect(reply.send).toHaveBeenCalledWith(
-        expect.objectContaining({ error: "No image file provided" }),
+        expect.objectContaining({ error: "No file provided" }),
       );
     });
 

tests/unit/web/dropzone.test.tsx

@@ -291,7 +291,7 @@ describe("Dropzone", () => {
 
     it("filters out non-image files on drop", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
       const zone = screen.getByLabelText("File drop zone");
 
       const png = makeFile("a.png", "image/png");
@@ -303,7 +303,7 @@ describe("Dropzone", () => {
 
     it("does not call onFiles when all dropped files are non-image", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
       const zone = screen.getByLabelText("File drop zone");
 
       const pdf = makeFile("doc.pdf", "application/pdf");
@@ -428,7 +428,7 @@ describe("Dropzone", () => {
 
     it("filters out non-image files from paste", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
 
       const png = makeFile("a.png", "image/png");
       const txt = makeFile("notes.txt", "text/plain");
@@ -439,7 +439,7 @@ describe("Dropzone", () => {
 
     it("does not call onFiles when pasted content has no image files", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
 
       pasteViaItems([makeFile("doc.pdf", "application/pdf")]);
 
@@ -496,7 +496,7 @@ describe("Dropzone", () => {
 
     it("does not prevent default on paste when no image files", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
 
       const event = pasteViaItems([makeFile("doc.pdf", "application/pdf")]);
 
@@ -560,7 +560,7 @@ describe("Dropzone", () => {
 
     it("filters non-image files from Finder paste", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
 
       const png = makeFile("photo.png", "image/png");
       const pdf = makeFile("doc.pdf", "application/pdf");
@@ -571,7 +571,7 @@ describe("Dropzone", () => {
 
     it("ignores Finder paste with only non-image files", () => {
       const onFiles = vi.fn();
-      render(<Dropzone onFiles={onFiles} />);
+      render(<Dropzone onFiles={onFiles} fileFilter={isImageFile} />);
 
       pasteViaFiles([makeFile("doc.pdf", "application/pdf")]);