@classytic/arc 2.7.7 → 2.8.0

package/dist/testing/index.d.mts

@@ -1,5 +1,5 @@
-import { Ut as CrudRepository, Vt as ResourceDefinition, u as AnyRecord } from "../interface-B91alUzq.mjs";
-import { d as ResourceLike, r as CreateAppOptions } from "../types-CKB47kiu.mjs";
+import { Yt as CrudRepository, m as AnyRecord, qt as ResourceDefinition } from "../interface-IJqN3pXK.mjs";
+import { d as ResourceLike, r as CreateAppOptions } from "../types-gUxAIZHp.mjs";
 import Fastify, { FastifyInstance, FastifyServerOptions } from "fastify";
 import { Connection } from "mongoose";
 import { Mock } from "vitest";

package/dist/testing/index.mjs

@@ -1796,7 +1796,7 @@ function runEventTests(resourceName, displayName, events) {
 * ```
 */
 async function createTestApp(options = {}) {
-	const { createApp } = await import("../createApp-D7e77m8C.mjs").then((n) => n.r);
+	const { createApp } = await import("../createApp-Cy8eUNKQ.mjs").then((n) => n.r);
 	const { useInMemoryDb = true, mongoUri: providedMongoUri, ...appOptions } = options;
 	const defaultAuth = {
 		type: "jwt",

package/dist/types/index.d.mts

@@ -1,5 +1,5 @@
-import { _ as isAuthenticated, c as getOrgRoles, g as hasOrgAccess, n as PUBLIC_SCOPE, p as getTeamId, r as RequestScope, s as getOrgId, t as AUTHENTICATED_SCOPE, v as isElevated, y as isMember } from "../types--D3vvfdt.mjs";
-import { $ as RateLimitConfig, A as FieldRule, B as JwtContext, C as CrudRouterOptions, Ct as getUserId, D as FastifyRequestExtras, E as EventsDecorator, F as InferDocType, Ft as IController, G as OpenApiSchemas, Gt as PaginatedResult, H as MiddlewareConfig, I as InferResourceDoc, It as IControllerResponse, J as PopulateOption, K as OwnershipCheck, Kt as PaginationParams, L as IntrospectionData, Lt as IRequestContext, M as HealthCheck, Mt as ControllerHandler, N as HealthOptions, Nt as ControllerLike, O as FastifyWithAuth, P as InferAdapterDoc, Pt as FastifyHandler, Q as QueryParserInterface, R as IntrospectionPluginOptions, Rt as RouteHandler, S as CrudRouteKey, St as envelope, T as EventDefinition, Tt as BaseControllerOptions, U as MiddlewareHandler, Ut as CrudRepository, V as LookupOption, W as ObjectId, Wt as InferDoc, X as PresetHook, Y as PresetFunction, Z as PresetResult, _ as Authenticator, _t as TypedResourceConfig, at as ResourceCacheConfig, b as ControllerQueryOptions, bt as ValidateOptions, ct as ResourceHooks, d as ApiResponse, dt as RouteHandlerMethod, et as RegistryEntry, f as ArcDecorator, ft as RouteSchemaOptions, g as AuthPluginOptions, gt as TypedRepository, h as AuthHelpers, ht as TypedController, it as RequestWithExtras, j as GracefulShutdownOptions, k as FastifyWithDecorators, l as AdditionalRoute, lt as ResourceMetadata, m as ArcRequest, mt as TokenPair, nt as RequestContext, ot as ResourceConfig, p as ArcInternalMetadata, pt as ServiceContext, q as ParsedQuery, qt as QueryOptions, rt as RequestIdOptions, st as ResourceHookContext, tt as RegistryStats, u as AnyRecord, ut as ResourcePermissions, v as AuthenticatorContext, vt as UserLike, w as CrudSchemas, x as CrudController, xt as ValidationResult, y as ConfigError, yt as UserOrganization, z as JWTPayload } from "../interface-B91alUzq.mjs";
-import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "../types-B4BNthET.mjs";
-import { n as ElevationOptions, t as ElevationEvent } from "../elevation-D7WK0RXq.mjs";
-export { AUTHENTICATED_SCOPE, AdditionalRoute, AnyRecord, ApiResponse, ArcDecorator, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRepository, CrudRouteKey, CrudRouterOptions, CrudSchemas, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OpenApiSchemas, OwnershipCheck, PUBLIC_SCOPE, PaginatedResult, PaginationParams, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryOptions, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResourceCacheConfig, ResourceConfig, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteHandler, RouteHandlerMethod, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult, envelope, getOrgId, getOrgRoles, getTeamId, getUserId, hasOrgAccess, isAuthenticated, isElevated, isMember };
+import { _ as isAuthenticated, c as getOrgRoles, g as hasOrgAccess, n as PUBLIC_SCOPE, p as getTeamId, r as RequestScope, s as getOrgId, t as AUTHENTICATED_SCOPE, v as isElevated, y as isMember } from "../types-CN6JvmYz.mjs";
+import { $ as PresetFunction, $t as QueryOptions, A as EventsDecorator, B as InferResourceDoc, Bt as FastifyHandler, C as ConfigError, Ct as TypedResourceConfig, D as CrudRouterOptions, Dt as ValidationResult, E as CrudRouteKey, Et as ValidateOptions, F as GracefulShutdownOptions, G as LookupOption, H as IntrospectionPluginOptions, Ht as IControllerResponse, I as HealthCheck, J as ObjectId, K as MiddlewareConfig, L as HealthOptions, M as FastifyWithAuth, N as FastifyWithDecorators, O as CrudSchemas, Ot as envelope, P as FieldRule, Q as PopulateOption, Qt as PaginationParams, R as InferAdapterDoc, Rt as ControllerHandler, S as AuthenticatorContext, St as TypedRepository, T as CrudController, Tt as UserOrganization, U as JWTPayload, Ut as IRequestContext, V as IntrospectionData, Vt as IController, W as JwtContext, Wt as RouteHandler, X as OwnershipCheck, Xt as InferDoc, Y as OpenApiSchemas, Yt as CrudRepository, Z as ParsedQuery, Zt as PaginatedResult, _ as ArcInternalMetadata, _t as RouteMcpConfig, at as RegistryStats, b as AuthPluginOptions, bt as TokenPair, ct as RequestWithExtras, d as ActionHandlerFn, dt as ResourceHookContext, et as PresetHook, f as ActionsMap, ft as ResourceHooks, g as ArcDecorator, gt as RouteHandlerMethod, h as ApiResponse, ht as RouteDefinition, it as RegistryEntry, j as FastifyRequestExtras, jt as BaseControllerOptions, k as EventDefinition, kt as getUserId, l as ActionDefinition, lt as ResourceCacheConfig, m as AnyRecord, mt as ResourcePermissions, nt as QueryParserInterface, ot as RequestContext, p as AdditionalRoute, pt as ResourceMetadata, q as MiddlewareHandler, rt as RateLimitConfig, st as RequestIdOptions, tt as PresetResult, u as ActionEntry, ut as ResourceConfig, v as ArcRequest, vt as RouteSchemaOptions, w as ControllerQueryOptions, wt as UserLike, x as Authenticator, xt as TypedController, y as AuthHelpers, yt as ServiceContext, z as InferDocType, zt as ControllerLike } from "../interface-IJqN3pXK.mjs";
+import { i as UserBase, n as PermissionContext, r as PermissionResult, t as PermissionCheck } from "../types-BoaZHr-2.mjs";
+import { n as ElevationOptions, t as ElevationEvent } from "../elevation-UJO3-NvX.mjs";
+export { AUTHENTICATED_SCOPE, ActionDefinition, ActionEntry, ActionHandlerFn, ActionsMap, AdditionalRoute, AnyRecord, ApiResponse, ArcDecorator, ArcInternalMetadata, ArcRequest, AuthHelpers, AuthPluginOptions, Authenticator, AuthenticatorContext, BaseControllerOptions, ConfigError, ControllerHandler, ControllerLike, ControllerQueryOptions, CrudController, CrudRepository, CrudRouteKey, CrudRouterOptions, CrudSchemas, ElevationEvent, ElevationOptions, EventDefinition, EventsDecorator, FastifyHandler, FastifyRequestExtras, FastifyWithAuth, FastifyWithDecorators, FieldRule, GracefulShutdownOptions, HealthCheck, HealthOptions, IController, IControllerResponse, IRequestContext, InferAdapterDoc, InferDoc, InferDocType, InferResourceDoc, IntrospectionData, IntrospectionPluginOptions, JWTPayload, JwtContext, LookupOption, MiddlewareConfig, MiddlewareHandler, ObjectId, OpenApiSchemas, OwnershipCheck, PUBLIC_SCOPE, PaginatedResult, PaginationParams, ParsedQuery, PermissionCheck, PermissionContext, PermissionResult, PopulateOption, PresetFunction, PresetHook, PresetResult, QueryOptions, QueryParserInterface, RateLimitConfig, RegistryEntry, RegistryStats, RequestContext, RequestIdOptions, RequestScope, RequestWithExtras, ResourceCacheConfig, ResourceConfig, ResourceHookContext, ResourceHooks, ResourceMetadata, ResourcePermissions, RouteDefinition, RouteHandler, RouteHandlerMethod, RouteMcpConfig, RouteSchemaOptions, ServiceContext, TokenPair, TypedController, TypedRepository, TypedResourceConfig, UserBase, UserLike, UserOrganization, ValidateOptions, ValidationResult, envelope, getOrgId, getOrgRoles, getTeamId, getUserId, hasOrgAccess, isAuthenticated, isElevated, isMember };

package/dist/{types-B4BNthET.d.mts → types-BoaZHr-2.d.mts}

@@ -1,4 +1,4 @@
-import { r as RequestScope } from "./types--D3vvfdt.mjs";
+import { r as RequestScope } from "./types-CN6JvmYz.mjs";
 import { FastifyRequest } from "fastify";
 
 //#region src/permissions/types.d.ts

package/dist/{types-C5g2oRC7.d.mts → types-Ct0PUUSp.d.mts}

@@ -1,4 +1,4 @@
-import { Vt as ResourceDefinition } from "./interface-B91alUzq.mjs";
+import { qt as ResourceDefinition } from "./interface-IJqN3pXK.mjs";
 import { z } from "zod";
 
 //#region src/integrations/mcp/types.d.ts

package/dist/{types-CKB47kiu.d.mts → types-gUxAIZHp.d.mts}

@@ -1,12 +1,12 @@
-import { _ as Authenticator } from "./interface-B91alUzq.mjs";
-import { n as ElevationOptions } from "./elevation-D7WK0RXq.mjs";
-import { t as ExternalOpenApiPaths } from "./externalPaths-iba7jD3d.mjs";
-import { i as CacheStore } from "./interface-CG7oRZjX.mjs";
-import { r as QueryCachePluginOptions } from "./queryCachePlugin-Ckl71mkc.mjs";
-import { i as EventTransport } from "./EventTransport-C4VheKeC.mjs";
-import { t as EventPluginOptions } from "./eventPlugin-CdvUoUna.mjs";
-import { c as MetricsOptions, d as SSEOptions, m as CachingOptions, r as VersioningOptions, t as ErrorHandlerOptions } from "./errorHandler-pCpEtNd7.mjs";
-import { r as IdempotencyStore } from "./interface-CSbZdv_3.mjs";
+import { x as Authenticator } from "./interface-IJqN3pXK.mjs";
+import { n as ElevationOptions } from "./elevation-UJO3-NvX.mjs";
+import { t as ExternalOpenApiPaths } from "./externalPaths-BQ8QijNH.mjs";
+import { i as CacheStore } from "./interface-bpoLKKqx.mjs";
+import { r as QueryCachePluginOptions } from "./queryCachePlugin-BCFVXnxK.mjs";
+import { i as EventTransport } from "./EventTransport-n1KBxC_N.mjs";
+import { t as EventPluginOptions } from "./eventPlugin-CAOWMQS8.mjs";
+import { c as MetricsOptions, d as SSEOptions, m as CachingOptions, r as VersioningOptions, t as ErrorHandlerOptions } from "./errorHandler-BeN-ERN7.mjs";
+import { r as IdempotencyStore } from "./interface-CkkWm5uR.mjs";
 import { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest, FastifyServerOptions } from "fastify";
 
 //#region src/factory/loadResources.d.ts

package/dist/utils/index.d.mts

@@ -1,6 +1,6 @@
-import { G as OpenApiSchemas, Q as QueryParserInterface, q as ParsedQuery, u as AnyRecord } from "../interface-B91alUzq.mjs";
-import { a as NotFoundError, c as RateLimitError, d as ValidationError, i as ForbiddenError, l as ServiceUnavailableError, m as isArcError, n as ConflictError, o as OrgAccessDeniedError, p as createError, r as ErrorDetails, s as OrgRequiredError, t as ArcError, u as UnauthorizedError } from "../errors-BS6lZvWy.mjs";
-import { a as CircuitBreakerStats, c as createCircuitBreakerRegistry, i as CircuitBreakerRegistry, n as CircuitBreakerError, o as CircuitState, r as CircuitBreakerOptions, s as createCircuitBreaker, t as CircuitBreaker } from "../circuitBreaker-BBPDt-J_.mjs";
+import { Y as OpenApiSchemas, Z as ParsedQuery, m as AnyRecord, nt as QueryParserInterface } from "../interface-IJqN3pXK.mjs";
+import { a as NotFoundError, c as RateLimitError, d as ValidationError, i as ForbiddenError, l as ServiceUnavailableError, m as isArcError, n as ConflictError, o as OrgAccessDeniedError, p as createError, r as ErrorDetails, s as OrgRequiredError, t as ArcError, u as UnauthorizedError } from "../errors-BI8kEKsO.mjs";
+import { a as CircuitBreakerStats, c as createCircuitBreakerRegistry, i as CircuitBreakerRegistry, n as CircuitBreakerError, o as CircuitState, r as CircuitBreakerOptions, s as createCircuitBreaker, t as CircuitBreaker } from "../circuitBreaker-BGVoB1hD.mjs";
 import { FastifyInstance } from "fastify";
 
 //#region src/utils/compensation.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/arc",
-  "version": "2.7.7",
+  "version": "2.8.0",
   "description": "Resource-oriented backend framework for Fastify — clean, minimal, powerful, tree-shakable",
   "type": "module",
   "exports": {
@@ -245,12 +245,12 @@
     "@opentelemetry/instrumentation-mongodb": ">=0.40.0",
     "@opentelemetry/sdk-node": ">=0.50.0",
     "@sinclair/typebox": ">=0.34.0",
-    "better-auth": ">=1.6.0",
+    "better-auth": ">=1.6.2",
     "bullmq": ">=5.0.0",
     "fastify": ">=5.0.0",
     "fastify-raw-body": ">=5.0.0",
     "ioredis": ">=5.0.0",
-    "mongodb": ">=6.0.0",
+    "mongodb": ">=7.0.0",
     "mongoose": ">=9.4.1",
     "pino-pretty": ">=13.0.0",
     "zod": ">=4.0.0"

package/skills/arc/SKILL.md

@@ -8,11 +8,11 @@ description: |
   Triggers: arc, fastify resource, defineResource, createApp, BaseController, arc preset,
   arc auth, arc events, arc jobs, arc websocket, arc mcp, arc plugin, arc testing, arc cli,
   arc permissions, arc hooks, arc pipeline, arc factory, arc cache, arc QueryCache.
-version: 2.7.3
+version: 2.8.0
 license: MIT
 metadata:
   author: Classytic
-  version: "2.7.1"
+  version: "2.8.0"
 tags:
   - fastify
   - rest-api
@@ -91,6 +91,23 @@ const productResource = defineResource({
   additionalRoutes: [
     { method: 'GET', path: '/featured', handler: 'getFeatured', permissions: allowPublic(), wrapHandler: true },
   ],
+
+  // v2.8: routes (replaces additionalRoutes — additionalRoutes still works but is deprecated)
+  routes: [
+    { method: 'GET', path: '/stats', handler: 'getStats', permissions: auth() },
+    { method: 'POST', path: '/webhook', handler: webhookFn, raw: true, permissions: auth() },
+  ],
+
+  // v2.8: actions (replaces onRegister + createActionRouter)
+  actions: {
+    approve: async (id, data, req) => service.approve(id, req.user._id),
+    cancel: {
+      handler: async (id, data, req) => service.cancel(id, data.reason, req.user._id),
+      permissions: roles('admin'),
+      schema: { reason: { type: 'string' } },
+    },
+  },
+  actionPermissions: auth(),
 });
 
 await fastify.register(productResource.toPlugin());
@@ -867,7 +884,8 @@ permissions: {
 **DX helpers:**
 
 ```typescript
-// Typed request for wrapHandler: false routes — no more (req as any).user
+// Typed request for raw routes — no more (req as any).user
+// v2.8: `raw: true` replaces `wrapHandler: false` (wrapHandler still works but is deprecated)
 import type { ArcRequest } from '@classytic/arc';
 handler: async (req: ArcRequest, reply) => { req.user?.id; req.scope; req.signal; }
 
@@ -884,6 +902,7 @@ import { createDomainError } from '@classytic/arc';
 throw createDomainError('SELF_REFERRAL', 'Cannot refer yourself', 422);
 
 // Resource lifecycle hook — wire singletons during registration
+// v2.8: for action routes, use `actions` config instead of onRegister + createActionRouter
 defineResource({ name: 'notification', onRegister: (f) => setSseManager(f.sseManager) });
 
 // SSE auth — preAuth runs BEFORE auth middleware (EventSource can't set headers)
@@ -893,7 +912,7 @@ additionalRoutes: [{ preAuth: [(req) => { req.headers.authorization = `Bearer ${
 additionalRoutes: [{ streamResponse: true, handler: async (req, reply) => reply.send(stream) }]
 ```
 
-## DX Helpers (v2.7.3)
+## DX Helpers (v2.7.3+)
 
 **Reply helpers** — consistent response envelopes (opt-in via `createApp({ replyHelpers: true })`):
 

package/skills/arc/references/integrations.md

@@ -3,7 +3,7 @@
 Pluggable adapters for BullMQ jobs, WebSocket real-time, Streamline workflows, and MCP tools.
 All are separate subpath imports — only loaded when explicitly used.
 
-> **MCP** has its own dedicated reference: [mcp.md](mcp.md) — auto-generate tools from resources, custom tools, Better Auth OAuth 2.1.
+> **MCP** has its own dedicated reference: [mcp.md](mcp.md) — auto-generate tools from resources (including actions, v2.8), custom tools, Better Auth OAuth 2.1.
 
 ## Job Queue (BullMQ)
 

package/skills/arc/references/mcp.md

@@ -46,6 +46,8 @@ await app.register(mcpPlugin, {
 
 Per resource, generates up to 5 tools: `list_{plural}`, `get_{name}`, `create_{name}`, `update_{name}`, `delete_{name}`.
 
+Resource `actions` (v2.8) also auto-generate MCP tools — each action becomes a tool named `{action}_{name}` with the action's input schema.
+
 Tool handlers call `BaseController` — same pipeline as REST (auth, org-scoping, hooks, field permissions, cache).
 
 ### McpPluginOptions