@happyvertical/smrt-core 0.36.0 → 0.36.1

package/dist/vite-plugin/sveltekit-generator.js

@@ -62,6 +62,53 @@ function resolveStandardRouteSerializers(apiConfig) {
     listItemSerializerName
   };
 }
+function isValidTypeIdentifier(name) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name);
+}
+function resolveObjectTypeReference(projectRoot, className, objectDef, options, routeDir) {
+  const simpleClassName = extractSimpleClassName(className);
+  if (!objectDef || !isValidTypeIdentifier(simpleClassName)) {
+    return { typeName: "import('@happyvertical/smrt-core').SmrtObject" };
+  }
+  const importPath = isLocalObject(projectRoot, objectDef) || !objectDef.packageName ? getRouteTypeImportPath(
+    projectRoot,
+    objectDef,
+    options,
+    simpleClassName,
+    routeDir
+  ) : objectDef.packageName;
+  return {
+    typeName: simpleClassName,
+    importStatement: `import type { ${simpleClassName} } from '${importPath}';`
+  };
+}
+function getRouteTypeImportPath(projectRoot, objectDef, options, simpleClassName, routeDir) {
+  if (objectDef.filePath) {
+    const srcLibDir = join(projectRoot, "src/lib");
+    if (objectDef.filePath.startsWith(`${srcLibDir}/`)) {
+      const libRelative = relative(srcLibDir, objectDef.filePath).replace(/\\/g, "/").replace(/\.(ts|js|tsx|jsx)$/, "");
+      return `$lib/${libRelative}`.replace(/\/+/g, "/");
+    }
+    if (routeDir) {
+      const routeRelative = relative(routeDir, objectDef.filePath).replace(/\\/g, "/").replace(/\.(ts|js|tsx|jsx)$/, "");
+      return routeRelative.startsWith(".") ? routeRelative : `./${routeRelative}`;
+    }
+  }
+  return getSvelteKitImportPath(
+    projectRoot,
+    objectDef.filePath,
+    options.objectsDir,
+    simpleClassName
+  );
+}
+function mergeImportStatements(importStatements) {
+  return Array.from(new Set(importStatements.filter(Boolean))).join("\n");
+}
+function findObjectDefByRegistryKey(manifest, className) {
+  return manifest.objects[className] ?? Object.values(manifest.objects).find(
+    (objectDef) => objectDef.className === extractSimpleClassName(className)
+  );
+}
 function collectReadonlyFieldNames(objectDef) {
   const fields = objectDef.fields || {};
   const names = [];
@@ -155,20 +202,43 @@ function requireRouteAuth(locals: unknown, mutating: boolean): void {
 // object), so recurse and route each through toPublicJSON() rather than letting
 // JSON.stringify call toJSON(). Non-plain instances (Date, etc.) and primitives
 // pass through; a cycle guard prevents infinite loops.
-function toPublicResult(value: any, seen: WeakSet<object> = new WeakSet()): any {
+interface PublicJsonSource {
+  toPublicJSON(): unknown;
+}
+
+function hasPublicJson(value: object): value is PublicJsonSource {
+  return (
+    'toPublicJSON' in value &&
+    typeof (value as { toPublicJSON?: unknown }).toPublicJSON === 'function'
+  );
+}
+
+function readJsonRecord(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  return value as Record<string, unknown>;
+}
+
+function toPublicResult(
+  value: unknown,
+  seen: WeakSet<object> = new WeakSet(),
+): unknown {
   if (value === null || typeof value !== 'object') return value;
-  if (typeof value.toPublicJSON === 'function') return value.toPublicJSON();
+  if (seen.has(value)) return null;
+  if (hasPublicJson(value)) {
+    seen.add(value);
+    return toPublicResult(value.toPublicJSON(), seen);
+  }
   if (Array.isArray(value)) {
-    if (seen.has(value)) return value;
     seen.add(value);
-    return value.map((entry: any) => toPublicResult(entry, seen));
+    return value.map((entry) => toPublicResult(entry, seen));
   }
   const proto = Object.getPrototypeOf(value);
   if (proto !== Object.prototype && proto !== null) return value;
-  if (seen.has(value)) return value;
   seen.add(value);
-  const out: Record<string, any> = {};
-  for (const [key, entry] of Object.entries(value)) {
+  const out: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(
+    value as Record<string, unknown>,
+  )) {
     out[key] = toPublicResult(entry, seen);
   }
   return out;
@@ -185,8 +255,10 @@ import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenanc
 function establishTenantContext(locals: unknown): void {
   if (hasTenantContext()) return;
   if (!locals || typeof locals !== 'object') return;
-  const l = locals as Record<string, any>;
-  const tenantId = l.tenantId ?? l.user?.tenantId ?? l.session?.tenantId;
+  const l = locals as Record<string, unknown>;
+  const user = l.user as Record<string, unknown> | undefined;
+  const session = l.session as Record<string, unknown> | undefined;
+  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;
   if (typeof tenantId === 'string' && tenantId) {
     enterTenantContext({ tenantId });
   }
@@ -275,6 +347,92 @@ function buildActionInvocationArgs(actionDef) {
     (parameter) => buildOptionsPropertyAccess(parameter.name)
   );
 }
+function buildObjectTypeProperty(propertyName) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyName)) {
+    return propertyName;
+  }
+  return JSON.stringify(propertyName);
+}
+function buildActionTargetTypeExpression(targetTypeName, isStatic) {
+  return isStatic ? `(typeof ${targetTypeName})` : targetTypeName;
+}
+function buildActionArgsTypeAlias(actionName, targetTypeName, isStatic) {
+  const targetTypeExpression = buildActionTargetTypeExpression(
+    targetTypeName,
+    isStatic
+  );
+  return `  type ActionArgs = Parameters<${targetTypeExpression}[${JSON.stringify(actionName)}]>;`;
+}
+function buildActionOptionsTypeAlias(actionDef) {
+  const parameters = Array.isArray(actionDef.parameters) ? actionDef.parameters : [];
+  if (parameters.length <= 1 && parameters[0]?.name === "options") {
+    return "";
+  }
+  return [
+    "  type ActionOptions = {",
+    ...parameters.map(
+      (parameter, index) => `    ${buildObjectTypeProperty(parameter.name)}: ActionArgs[${index}];`
+    ),
+    "  };"
+  ].join("\n");
+}
+function buildActionOptionsLoad(actionName, actionDef, routeConfig, targetTypeName, isStatic) {
+  const parameters = Array.isArray(actionDef.parameters) ? actionDef.parameters : [];
+  if (parameters.length === 0) {
+    return "";
+  }
+  const hasPathParams = routeConfig.pathParamNames.length > 0;
+  const pathParamsObjectLiteral = buildPathParamsObjectLiteral(
+    routeConfig.pathParamNames
+  );
+  const isSingleOptionsParameter = parameters.length === 1 && parameters[0]?.name === "options";
+  const lines = [
+    buildActionArgsTypeAlias(actionName, targetTypeName, isStatic)
+  ];
+  const optionsTypeAlias = buildActionOptionsTypeAlias(actionDef);
+  if (optionsTypeAlias) {
+    lines.push(optionsTypeAlias);
+  }
+  if (routeConfig.method === "GET") {
+    if (hasPathParams) {
+      lines.push(
+        `  const pathParams = ${pathParamsObjectLiteral};`,
+        "  const options = {",
+        "    ...Object.fromEntries(new URL(request.url).searchParams.entries()),",
+        "    ...pathParams,",
+        `  } as ${isSingleOptionsParameter ? "ActionArgs[0]" : "ActionOptions"};`,
+        ""
+      );
+    } else {
+      lines.push(
+        "  const options = Object.fromEntries(",
+        "    new URL(request.url).searchParams.entries(),",
+        `  ) as ${isSingleOptionsParameter ? "ActionArgs[0]" : "ActionOptions"};`,
+        ""
+      );
+    }
+    return lines.join("\n");
+  }
+  if (hasPathParams) {
+    lines.push(
+      `  const pathParams = ${pathParamsObjectLiteral};`,
+      "  const body: unknown = await request.json();",
+      "  const options = {",
+      "    ...readJsonRecord(body),",
+      "    ...pathParams,",
+      `  } as ${isSingleOptionsParameter ? "ActionArgs[0]" : "ActionOptions"};`,
+      ""
+    );
+    return lines.join("\n");
+  }
+  lines.push("  const body: unknown = await request.json();");
+  if (isSingleOptionsParameter) {
+    lines.push("  const options = body as ActionArgs[0];", "");
+  } else {
+    lines.push("  const options = readJsonRecord(body) as ActionOptions;", "");
+  }
+  return lines.join("\n");
+}
 function buildOptionsPropertyAccess(propertyName) {
   if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyName)) {
     return `options.${propertyName}`;
@@ -380,7 +538,9 @@ function clearGeneratedRouteFiles(routesRoot) {
   }
 }
 function knowledgeRouteDir(projectRoot, options) {
-  const basePath = options.knowledge?.api?.basePath || "/__smrt/knowledge";
+  const basePath = String(
+    options.knowledge?.api?.basePath || "/__smrt/knowledge"
+  );
   const routeRoot = svelteKitRouteRoot(options.routesDir);
   const segments = basePath.split("/").map((segment) => segment.trim()).filter(Boolean);
   return join(projectRoot, routeRoot, ...segments);
@@ -710,7 +870,9 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
       projectRoot,
       className,
       objectDef,
-      includedActions
+      includedActions,
+      options,
+      routeDir
     );
     writeRoute(routeDir, "+server.ts", collectionRoute);
   }
@@ -719,7 +881,9 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
       projectRoot,
       className,
       objectDef,
-      includedActions
+      includedActions,
+      options,
+      join(routeDir, "[id]")
     );
     writeRoute(join(routeDir, "[id]"), "+server.ts", itemRoute);
   }
@@ -745,6 +909,8 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
       routeDir: join(actionBaseDir, ...routeConfig.pathSegments),
       spec: {
         lookupClassName: className,
+        lookupObjectDef: objectDef,
+        hostClassName: className,
         actionName,
         actionDef,
         routeConfig,
@@ -757,8 +923,10 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
   )) {
     const actionRoute = generateActionRouteTemplate(
       projectRoot,
+      actionRouteDir,
       routeSpecs,
-      objectDef
+      objectDef,
+      options
     );
     writeRoute(actionRouteDir, "+server.ts", actionRoute);
   }
@@ -775,6 +943,7 @@ async function generateCollectionRoutesForObject(projectRoot, className, objectD
     objectDef,
     manifest
   );
+  const lookupObjectDef = findObjectDefByRegistryKey(manifest, lookupClassName);
   const customActions = Object.entries(objectDef.methods).filter(
     ([name, method]) => !STANDARD_API_ACTIONS.includes(name) && method.isPublic && shouldIncludeInApi(name, apiConfig)
   );
@@ -801,6 +970,8 @@ async function generateCollectionRoutesForObject(projectRoot, className, objectD
       routeDir: join(routeDir, ...routeConfig.pathSegments),
       spec: {
         lookupClassName,
+        lookupObjectDef,
+        hostClassName: className,
         actionName,
         actionDef,
         routeConfig,
@@ -813,8 +984,10 @@ async function generateCollectionRoutesForObject(projectRoot, className, objectD
   )) {
     const actionRoute = generateActionRouteTemplate(
       projectRoot,
+      actionRouteDir,
       routeSpecs,
-      objectDef
+      objectDef,
+      options
     );
     writeRoute(actionRouteDir, "+server.ts", actionRoute);
     generatedAnyRoutes = true;
@@ -922,7 +1095,7 @@ function writeRoute(dir, filename, content) {
   }
 }
 function getSvelteKitImportPath(projectRoot, objectFilePath, objectsDir, className) {
-  const filePath = join(projectRoot, objectsDir, `${className || "Object"}.ts`);
+  const filePath = objectFilePath || join(projectRoot, objectsDir, `${className || "Object"}.ts`);
   const absoluteObjectsDir = objectsDir.startsWith("/") ? objectsDir : join(projectRoot, objectsDir);
   const relativePath = relative(absoluteObjectsDir, filePath);
   const normalizedPath = relativePath.replace(/\\/g, "/");
@@ -938,9 +1111,16 @@ function isLocalObject(projectRoot, objectDef) {
   if (!objectDef.filePath) return false;
   return objectDef.filePath.startsWith(projectRoot) && !objectDef.filePath.includes("/node_modules/");
 }
-function generateCollectionRouteTemplate(_projectRoot, className, objectDef, includedActions, _options) {
+function generateCollectionRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir) {
   const hasGet = includedActions.includes("list");
   const hasPost = includedActions.includes("create");
+  const modelType = resolveObjectTypeReference(
+    projectRoot,
+    className,
+    objectDef,
+    options,
+    routeDir
+  );
   const serializers = resolveStandardRouteSerializers(
     objectDef.decoratorConfig?.api
   );
@@ -951,7 +1131,8 @@ function generateCollectionRouteTemplate(_projectRoot, className, objectDef, inc
 import { error, json } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}
 ` : ""}import { getCollection } from '$lib/server/smrt';
-import type { RequestHandler } from './$types';
+${modelType.importStatement ? `${modelType.importStatement}
+` : ""}import type { RequestHandler } from './$types';
 // Note: ${className} is auto-registered by the Vite plugin scanner
 ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}`;
   const getHandler = hasGet ? `
@@ -961,7 +1142,7 @@ ${routeGuardPreamble(objectDef, false)}
   const limit = Number(url.searchParams.get('limit')) || 50;
   const offset = Number(url.searchParams.get('offset')) || 0;
 
-${generateCollectionLoad(className)}
+${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const items = await collection.list({ limit, offset });
   const count = await collection.count();
 ${serializers.listItemSerializerName ? `
@@ -978,9 +1159,10 @@ ${serializers.listItemSerializerName ? `
 // Create new ${className.toLowerCase()}
 export const POST: RequestHandler = async ({ locals, request }) => {
 ${routeGuardPreamble(objectDef, true)}
-  const data = applyWritablePolicy(await request.json());
+  const body: unknown = await request.json();
+  const data = applyWritablePolicy(body);
 
-${generateCollectionLoad(className)}
+${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.create(data);
   await item.save();
 ${serializers.itemSerializerName ? `
@@ -993,7 +1175,7 @@ ${serializers.itemSerializerName ? `
   return imports + getHandler + postHandler;
 }
 function generateCollectionLoad(className, options = {}) {
-  const genericSuffix = options.generic ? "<any>" : "";
+  const genericSuffix = options.typeName ? `<${options.typeName}>` : "";
   return [
     `  const collection = await getCollection${genericSuffix}(`,
     `    '${className}',`,
@@ -1031,11 +1213,18 @@ function generateClassNotRegisteredError(className) {
     "    );"
   ].join("\n");
 }
-function generateItemRouteTemplate(_projectRoot, className, objectDef, includedActions, _options) {
+function generateItemRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir) {
   const hasGet = includedActions.includes("get");
   const hasPut = includedActions.includes("update");
   const hasDelete = includedActions.includes("delete");
   const simpleClassName = extractSimpleClassName(className);
+  const modelType = resolveObjectTypeReference(
+    projectRoot,
+    className,
+    objectDef,
+    options,
+    routeDir
+  );
   const serializers = resolveStandardRouteSerializers(
     objectDef.decoratorConfig?.api
   );
@@ -1046,13 +1235,14 @@ function generateItemRouteTemplate(_projectRoot, className, objectDef, includedA
 import { error, json } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}
 ` : ""}import { getCollection } from '$lib/server/smrt';
-import type { RequestHandler } from './$types';
+${modelType.importStatement ? `${modelType.importStatement}
+` : ""}import type { RequestHandler } from './$types';
 ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}`;
   const getHandler = hasGet ? `
 // Get single ${simpleClassName.toLowerCase()}
 export const GET: RequestHandler = async ({ locals, params }) => {
 ${routeGuardPreamble(objectDef, false)}
-${generateCollectionLoad(className, { generic: true })}
+${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(className)}
 ${serializers.itemSerializerName ? `
@@ -1066,11 +1256,12 @@ ${serializers.itemSerializerName ? `
 // Update ${simpleClassName.toLowerCase()}
 export const PUT: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, true)}
-${generateCollectionLoad(className, { generic: true })}
+${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(className)}
 
-  const data = applyWritablePolicy(await request.json());
+  const body: unknown = await request.json();
+  const data = applyWritablePolicy(body);
   Object.assign(item, data);
   await item.save();
 ${serializers.itemSerializerName ? `
@@ -1084,7 +1275,7 @@ ${serializers.itemSerializerName ? `
 // Delete ${simpleClassName.toLowerCase()}
 export const DELETE: RequestHandler = async ({ locals, params }) => {
 ${routeGuardPreamble(objectDef, true)}
-${generateCollectionLoad(className, { generic: true })}
+${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(className)}
 
@@ -1094,12 +1285,30 @@ ${generateNotFoundError(className)}
 ` : "";
   return imports + getHandler + putHandler + deleteHandler;
 }
-function generateActionRouteTemplate(_projectRoot, routeSpecs, objectDef, _options) {
+function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDef, options) {
   if (routeSpecs.length === 0) {
     throw new Error("Cannot generate a custom action route without handlers");
   }
   const [firstSpec] = routeSpecs;
   const { lookupClassName, routeConfig, hostType } = firstSpec;
+  const lookupModelType = resolveObjectTypeReference(
+    projectRoot,
+    lookupClassName,
+    firstSpec.lookupObjectDef,
+    options,
+    routeDir
+  );
+  const hostModelType = resolveObjectTypeReference(
+    projectRoot,
+    firstSpec.hostClassName,
+    objectDef,
+    options,
+    routeDir
+  );
+  const typeImports = mergeImportStatements([
+    lookupModelType.importStatement,
+    hostModelType.importStatement
+  ]);
   const hasMixedHosts = routeSpecs.some(
     (spec) => spec.hostType !== hostType || spec.lookupClassName !== lookupClassName || spec.routeConfig.scope !== routeConfig.scope
   );
@@ -1108,14 +1317,15 @@ function generateActionRouteTemplate(_projectRoot, routeSpecs, objectDef, _optio
       `Cannot generate mixed custom route handlers for ${lookupClassName}. All handlers sharing a route path must target the same host type and scope.`
     );
   }
-  const importBlock = hostType === "collection" ? `import { error, json } from '@sveltejs/kit';
-import { getCollection } from '$lib/server/smrt';
-import type { RequestHandler } from './$types';` : routeConfig.scope === "collection" ? `import { error, json } from '@sveltejs/kit';
-import { ObjectRegistry } from '@happyvertical/smrt-core';
-import type { RequestHandler } from './$types';` : `import { error, json } from '@sveltejs/kit';
-import { getCollection } from '$lib/server/smrt';
-import type { RequestHandler } from './$types';`;
-  const tenantScoped = isTenantScoped(objectDef);
+  const importBlock = [
+    "import { error, json } from '@sveltejs/kit';",
+    hostType === "collection" || routeConfig.scope !== "collection" ? "import { getCollection } from '$lib/server/smrt';" : "import { ObjectRegistry } from '@happyvertical/smrt-core';",
+    typeImports,
+    "import type { RequestHandler } from './$types';"
+  ].filter(Boolean).join("\n");
+  const tenantScoped = isTenantScoped(objectDef) || routeSpecs.some(
+    (spec) => !!spec.lookupObjectDef && isTenantScoped(spec.lookupObjectDef)
+  );
   const handlers = routeSpecs.map(
     (spec) => generateActionRouteHandler(
       spec.lookupClassName,
@@ -1123,7 +1333,9 @@ import type { RequestHandler } from './$types';`;
       spec.actionDef,
       spec.routeConfig,
       spec.hostType,
-      tenantScoped
+      tenantScoped,
+      lookupModelType.typeName,
+      hostModelType.typeName
     )
   ).join("\n");
   return `${AUTO_GENERATED_ROUTE_HEADER}
@@ -1133,7 +1345,7 @@ ${importBlock}
 ${generateAuthGuardHelper(objectDef)}${tenantScoped ? generateTenantContextHelper() : ""}
 ${handlers}`;
 }
-function generateActionRouteHandler(lookupClassName, actionName, actionDef, routeConfig, hostType, tenantScoped) {
+function generateActionRouteHandler(lookupClassName, actionName, actionDef, routeConfig, hostType, tenantScoped, lookupTypeName, hostTypeName) {
   const handlerName = routeConfig.method;
   const guardLines = [
     `  requireRouteAuth(locals, ${routeConfig.method !== "GET"});`
@@ -1145,45 +1357,32 @@ function generateActionRouteHandler(lookupClassName, actionName, actionDef, rout
   const hasInput = actionDef.parameters.length > 0;
   const needsRequest = hasInput;
   const invocationArgs = buildActionInvocationArgs(actionDef);
-  const hasPathParams = routeConfig.pathParamNames.length > 0;
-  const pathParamsObjectLiteral = buildPathParamsObjectLiteral(
-    routeConfig.pathParamNames
-  );
-  const optionsLoad = hasInput && routeConfig.method === "GET" ? hasPathParams ? [
-    `  const pathParams = ${pathParamsObjectLiteral};`,
-    "  const options = {",
-    "    ...Object.fromEntries(new URL(request.url).searchParams.entries()),",
-    "    ...pathParams,",
-    "  };",
-    ""
-  ].join("\n") : [
-    "  const options = Object.fromEntries(",
-    "    new URL(request.url).searchParams.entries(),",
-    "  );",
-    ""
-  ].join("\n") : hasInput ? hasPathParams ? [
-    `  const pathParams = ${pathParamsObjectLiteral};`,
-    "  const options = {",
-    "    ...(await request.json()),",
-    "    ...pathParams,",
-    "  };",
-    ""
-  ].join("\n") : "  const options = await request.json();\n" : "";
   const collectionHandlerArgs = buildRouteHandlerArgs(
-    hasPathParams,
+    routeConfig.pathParamNames.length > 0,
     needsRequest
   );
   const itemHandlerArgs = buildRouteHandlerArgs(true, needsRequest);
   if (hostType === "collection") {
+    const optionsLoad2 = buildActionOptionsLoad(
+      actionName,
+      actionDef,
+      routeConfig,
+      hostTypeName,
+      actionDef.isStatic
+    );
+    const receiverExpression = actionDef.isStatic ? "CollectionClass" : "typedCollection";
+    const staticTargetLoad = actionDef.isStatic ? `  const CollectionClass = typedCollection.constructor as typeof ${hostTypeName};
+` : "";
     return `// Custom collection method: ${actionName}
 export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
 ${authGuardLine}
-${generateCollectionLoad(lookupClassName, { generic: true })}
-  const typedCollection = collection as any;
+${generateCollectionLoad(lookupClassName, { typeName: lookupTypeName })}
+  const typedCollection = collection as unknown as ${hostTypeName};
 ${generateCollectionNotRegisteredError(lookupClassName)}
+${staticTargetLoad}
 
-${optionsLoad}  const result = ${buildActionInvocationExpression(
-      actionDef.isStatic ? "(typedCollection.constructor as any)" : "typedCollection",
+${optionsLoad2}  const result = ${buildActionInvocationExpression(
+      receiverExpression,
       actionName,
       invocationArgs
     )};
@@ -1193,13 +1392,20 @@ ${optionsLoad}  const result = ${buildActionInvocationExpression(
 `;
   }
   if (routeConfig.scope === "collection") {
+    const optionsLoad2 = buildActionOptionsLoad(
+      actionName,
+      actionDef,
+      routeConfig,
+      hostTypeName,
+      true
+    );
     return `// Custom collection action: ${actionName}
 export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
 ${authGuardLine}
   const registered = ObjectRegistry.getClass('${lookupClassName}');
 ${generateClassNotRegisteredError(lookupClassName)}
 
-${optionsLoad}  const ClassRef = registered.constructor as any;
+${optionsLoad2}  const ClassRef = registered.constructor as typeof ${hostTypeName};
   const result = ${buildActionInvocationExpression(
       "ClassRef",
       actionName,
@@ -1210,10 +1416,17 @@ ${optionsLoad}  const ClassRef = registered.constructor as any;
 };
 `;
   }
+  const optionsLoad = buildActionOptionsLoad(
+    actionName,
+    actionDef,
+    routeConfig,
+    hostTypeName,
+    false
+  );
   return `// Custom action: ${actionName}
 export const ${handlerName}: RequestHandler = async (${itemHandlerArgs}) => {
 ${authGuardLine}
-${generateCollectionLoad(lookupClassName, { generic: true })}
+${generateCollectionLoad(lookupClassName, { typeName: lookupTypeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(lookupClassName)}
 
@@ -1243,7 +1456,7 @@ import type { RequestHandler } from './$types';
 const INCLUDE_DOCS_BY_DEFAULT = ${JSON.stringify(includeDocs)};
 const INCLUDE_PROMPTS_BY_DEFAULT = ${JSON.stringify(includePrompts)};
 const REQUIRE_ADMIN = ${JSON.stringify(requireAdmin)};
-const KNOWLEDGE_ARTIFACT: Record<string, any> | null = ${artifactLiteral};
+const KNOWLEDGE_ARTIFACT: Record<string, unknown> | null = ${artifactLiteral};
 
 if (!dev && !REQUIRE_ADMIN) {
   console.warn('[smrt] PUBLIC knowledge API route enabled; unauthenticated responses are sanitized.');
@@ -1252,7 +1465,7 @@ if (!dev && !REQUIRE_ADMIN) {
 export const GET: RequestHandler = async ({ locals, url, setHeaders }) => {
   setHeaders({ 'cache-control': 'private, no-store' });
 
-  if (!dev && REQUIRE_ADMIN && !isKnowledgeAdmin(locals as Record<string, any>)) {
+  if (!dev && REQUIRE_ADMIN && !isKnowledgeAdmin(locals)) {
     throw error(403, 'SMRT knowledge requires dev mode or admin access');
   }
 
@@ -1271,7 +1484,7 @@ export const GET: RequestHandler = async ({ locals, url, setHeaders }) => {
   }));
 };
 
-function readKnowledgeArtifact(): Record<string, any> {
+function readKnowledgeArtifact(): Record<string, unknown> {
   if (!KNOWLEDGE_ARTIFACT) throw error(404, 'SMRT knowledge artifact not found');
   return KNOWLEDGE_ARTIFACT;
 }
@@ -1283,9 +1496,9 @@ function queryBoolean(url: URL, name: string, defaultValue: boolean): boolean {
 }
 
 function sanitizeKnowledgeArtifact(
-  artifact: Record<string, any>,
+  artifact: Record<string, unknown>,
   options: { includeDocs: boolean; includePrompts: boolean; publicAccess: boolean },
-): Record<string, any> {
+): Record<string, unknown> {
   const sanitized = { ...artifact };
 
   if (!options.includeDocs) {
@@ -1306,21 +1519,32 @@ function sanitizeKnowledgeArtifact(
   return sanitized;
 }
 
-function isKnowledgeAdmin(locals: Record<string, any>): boolean {
-  if (locals.smrtKnowledgeAdmin === true || locals.smrtAdmin === true) {
+function recordValue(value: unknown, key: string): unknown {
+  if (!value || typeof value !== 'object') return undefined;
+  return (value as Record<string, unknown>)[key];
+}
+
+function isKnowledgeAdmin(locals: unknown): boolean {
+  if (!locals || typeof locals !== 'object') return false;
+  const localRecord = locals as Record<string, unknown>;
+  if (
+    localRecord.smrtKnowledgeAdmin === true ||
+    localRecord.smrtAdmin === true
+  ) {
     return true;
   }
 
-  const userRoles = rolesFrom(locals.user);
-  const sessionRoles = rolesFrom(locals.session?.user);
+  const userRoles = rolesFrom(localRecord.user);
+  const sessionRoles = rolesFrom(recordValue(localRecord.session, 'user'));
   return [...userRoles, ...sessionRoles].some((role) =>
     ['admin', 'owner', 'superadmin'].includes(role),
   );
 }
 
-function rolesFrom(value: any): string[] {
+function rolesFrom(value: unknown): string[] {
   if (!value || typeof value !== 'object') return [];
-  const roles = Array.isArray(value.roles) ? value.roles : [value.role];
+  const roleList = recordValue(value, 'roles');
+  const roles = Array.isArray(roleList) ? roleList : [recordValue(value, 'role')];
   return roles
     .filter((role): role is string => typeof role === 'string')
     .map((role) => role.toLowerCase());