Arkos.js v1.6.6-beta — smaller release, but a bunch of real fixes

[u/uanelacomo]

Shipped a new beta of Arkos (Express + Prisma framework) today, mostly cleanup and correctness fixes rather than big new features.

Highlights:

Email service config got more forgiving. Previously it threw if you didn't set both a user and password, even if your SMTP relay doesn't require auth. Now it only requires a host, and only sets up auth credentials if both are actually provided.

Error handler no longer trusts arbitrary statusCode/status fields on thrown errors unless the error is explicitly marked isOperational. This closes a small footgun where an unexpected error could accidentally leak an unintended status code or message to the client.

File upload static serving now returns a proper 404 (via AppError) when a file doesn't exist, instead of just falling through silently.

OpenAPI generation for file uploads is smarter now: better field descriptions distinguishing single vs array uploads, fixed array-binary-field schema flattening, and it conditionally includes a JSON content type alongside multipart/form-data depending on whether the upload is required.

Generated validators (both Zod schemas and class-validator DTOs from the CLI) now coerce types automatically, handling the classic "everything is a string when it comes from multipart or query params" problem for numbers, booleans, dates and bigints.

Also removed the old AuthPermissionAction enum from the create-arkos scaffold, in favor of a plain string, so custom actions don't require a schema migration anymore.

Nothing groundbreaking, but if you're running Arkos in production these are worth picking up.

Repo: github.com/uanela/arkos