@happyvertical/smrt-core 0.38.2 → 0.38.3

package/dist/vite-plugin/sveltekit-generator.js

@@ -1,6 +1,7 @@
 import { generateConditionalGetRouteHelper } from "../generators/conditional-get.js";
 import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
 import { generateChangesRoute } from "./changes-route.js";
+import { generateEventsRoute } from "./events-route.js";
 import { generateSyncApplyRoute } from "./sync-apply-route.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
@@ -175,6 +176,59 @@ function getApiPublicAccess(apiConfig) {
 	if (value === true || value === "read") return value;
 	return false;
 }
+function toFieldColumnAlias(fieldName) {
+	return fieldName.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").replace(/([a-z\d])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
+}
+function manifestObjectKey(objectDef) {
+	return objectDef.qualifiedName ?? objectDef.className;
+}
+function manifestObjectExtends(objectDef, parent) {
+	const extendsQualified = objectDef.extendsQualified;
+	const extendsName = objectDef.extends;
+	return typeof extendsQualified === "string" && extendsQualified === parent.qualifiedName || typeof extendsName === "string" && (extendsName === parent.className || extendsName === parent.qualifiedName);
+}
+function findManifestParent(objectDef, manifest) {
+	return Object.values(manifest.objects).find((candidate) => manifestObjectExtends(objectDef, candidate));
+}
+function collectStiHierarchyObjects(objectDef, manifest) {
+	if (!manifest) return [objectDef];
+	let cursor = objectDef;
+	let stiBase = cursor.decoratorConfig?.tableStrategy === "sti" ? cursor : void 0;
+	while (cursor) {
+		const parent = findManifestParent(cursor, manifest);
+		if (!parent) break;
+		if (parent.decoratorConfig?.tableStrategy === "sti") stiBase = parent;
+		cursor = parent;
+	}
+	if (!stiBase) return [objectDef];
+	const members = /* @__PURE__ */ new Map();
+	const visit = (current) => {
+		const key = manifestObjectKey(current);
+		if (members.has(key)) return;
+		members.set(key, current);
+		for (const candidate of Object.values(manifest.objects)) {
+			if (candidate === current) continue;
+			if (manifestObjectExtends(candidate, current)) visit(candidate);
+		}
+	};
+	visit(stiBase);
+	return [...members.values()];
+}
+function collectReadPermissionFields(objectDef, manifest) {
+	const result = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const member of collectStiHierarchyObjects(objectDef, manifest)) for (const [name, def] of Object.entries(member.fields ?? {})) {
+		const permission = typeof def.readPermission === "string" ? def.readPermission : typeof def._meta?.readPermission === "string" ? def._meta.readPermission : void 0;
+		if (!permission) continue;
+		for (const fieldName of [name, toFieldColumnAlias(name)]) {
+			const key = `${fieldName}\0${permission}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			result.push([fieldName, permission]);
+		}
+	}
+	return result;
+}
 /**
 * Emit the fail-closed authorization guard injected into generated route files
 * (#1540, 2c). Every generated CRUD/action handler calls `requireRouteAuth`,
@@ -182,12 +236,18 @@ function getApiPublicAccess(apiConfig) {
 * authenticated principal. Mirrors the knowledge-route `isKnowledgeAdmin`
 * precedent. Mutating verbs require auth even when reads are public.
 */
-function generateAuthGuardHelper(objectDef) {
+function generateAuthGuardHelper(objectDef, manifest) {
 	const publicAccess = getApiPublicAccess(objectDef.decoratorConfig?.api);
+	const readPermissionFields = collectReadPermissionFields(objectDef, manifest);
 	return `
 // Fail-closed authorization (#1540): generated routes require an authenticated
 // principal on \`locals\` unless explicitly marked \`@smrt({ api: { public } })\`.
 const PUBLIC_ACCESS: boolean | 'read' = ${JSON.stringify(publicAccess)};
+const READ_PERMISSION_FIELDS: Array<[string, string]> = ${JSON.stringify(readPermissionFields)};
+
+interface PublicJsonOptions {
+  permissions?: Iterable<string>;
+}
 
 function hasAuthenticatedPrincipal(locals: unknown): boolean {
   if (!locals || typeof locals !== 'object') return false;
@@ -215,13 +275,74 @@ function requireRouteAuth(locals: unknown, mutating: boolean): void {
   }
 }
 
+function getPublicJsonOptions(locals: unknown): PublicJsonOptions {
+  const l = readJsonRecord(locals);
+  const permissions = l.permissions ?? l.permissionSet ?? l.smrtPermissions;
+  if (Array.isArray(permissions) || permissions instanceof Set) {
+    return { permissions };
+  }
+  return {};
+}
+
+function hasReadPermission(
+  options: PublicJsonOptions,
+  permission: string,
+): boolean {
+  if (!options.permissions) return false;
+  for (const granted of options.permissions) {
+    if (granted === permission) return true;
+  }
+  return false;
+}
+
+function applyReadPermissionRedaction(
+  value: unknown,
+  options: PublicJsonOptions,
+  seen: WeakSet<object> = new WeakSet(),
+): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return null;
+  if (hasPublicJson(value)) {
+    seen.add(value);
+    return applyReadPermissionRedaction(
+      value.toPublicJSON(options),
+      options,
+      seen,
+    );
+  }
+  if (Array.isArray(value)) {
+    seen.add(value);
+    return value.map((entry) =>
+      applyReadPermissionRedaction(entry, options, seen),
+    );
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return value;
+  seen.add(value);
+  const out = { ...(value as Record<string, unknown>) };
+  const metaData =
+    out._meta_data && typeof out._meta_data === 'object'
+      ? { ...(out._meta_data as Record<string, unknown>) }
+      : null;
+  for (const [fieldName, permission] of READ_PERMISSION_FIELDS) {
+    if (hasReadPermission(options, permission)) continue;
+    delete out[fieldName];
+    if (metaData) delete metaData[fieldName];
+  }
+  if (metaData) out._meta_data = metaData;
+  for (const [key, entry] of Object.entries(out)) {
+    out[key] = applyReadPermissionRedaction(entry, options, seen);
+  }
+  return out;
+}
+
 // Sensitive-field-safe serialization for custom-action results (#1540): a
 // custom method may return a SmrtObject (or one nested in an array/plain
 // object), so recurse and route each through toPublicJSON() rather than letting
 // JSON.stringify call toJSON(). Non-plain instances (Date, etc.) and primitives
 // pass through; a cycle guard prevents infinite loops.
 interface PublicJsonSource {
-  toPublicJSON(): unknown;
+  toPublicJSON(options?: PublicJsonOptions): unknown;
 }
 
 function hasPublicJson(value: object): value is PublicJsonSource {
@@ -238,17 +359,18 @@ function readJsonRecord(value: unknown): Record<string, unknown> {
 
 function toPublicResult(
   value: unknown,
+  options: PublicJsonOptions,
   seen: WeakSet<object> = new WeakSet(),
 ): unknown {
   if (value === null || typeof value !== 'object') return value;
   if (seen.has(value)) return null;
   if (hasPublicJson(value)) {
     seen.add(value);
-    return toPublicResult(value.toPublicJSON(), seen);
+    return toPublicResult(value.toPublicJSON(options), options, seen);
   }
   if (Array.isArray(value)) {
     seen.add(value);
-    return value.map((entry) => toPublicResult(entry, seen));
+    return value.map((entry) => toPublicResult(entry, options, seen));
   }
   const proto = Object.getPrototypeOf(value);
   if (proto !== Object.prototype && proto !== null) return value;
@@ -257,7 +379,7 @@ function toPublicResult(
   for (const [key, entry] of Object.entries(
     value as Record<string, unknown>,
   )) {
-    out[key] = toPublicResult(entry, seen);
+    out[key] = toPublicResult(entry, options, seen);
   }
   return out;
 }
@@ -492,12 +614,13 @@ async function generateSvelteKitRoutes(projectRoot, manifest, options) {
 			}
 			continue;
 		}
-		await generateRoutesForObject(projectRoot, className, objectDef, options);
+		await generateRoutesForObject(projectRoot, className, objectDef, manifest, options);
 		generatedCount++;
 	}
 	if (options.knowledge?.api?.enabled) generateKnowledgeRoute(projectRoot, options);
 	generateSyncApplyRoute(projectRoot, manifest, options);
 	generateChangesRoute(projectRoot, manifest, options);
+	generateEventsRoute(projectRoot, manifest, options);
 	updateGitignore(projectRoot, options);
 	const skippedMsg = skippedCollections > 0 ? ` (skipped ${skippedCollections} collection classes)` : "";
 	console.log(`[smrt] Generated routes for ${generatedCount} SMRT objects${skippedMsg}`);
@@ -780,7 +903,7 @@ export async function getCollection<
 /**
 * Generates route files for a single SMRT object
 */
-async function generateRoutesForObject(projectRoot, className, objectDef, options) {
+async function generateRoutesForObject(projectRoot, className, objectDef, manifest, options) {
 	const collectionName = objectDef.collection;
 	const routeDir = join(projectRoot, options.routesDir, collectionName);
 	const apiConfig = objectDef.decoratorConfig?.api;
@@ -789,9 +912,9 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
 		return;
 	}
 	const includedActions = resolveStandardCrudActions(apiConfig);
-	if (includedActions.includes("list") || includedActions.includes("create")) writeRoute(routeDir, "+server.ts", generateCollectionRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir));
+	if (includedActions.includes("list") || includedActions.includes("create")) writeRoute(routeDir, "+server.ts", generateCollectionRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, routeDir));
 	if (includedActions.includes("get") || includedActions.includes("update") || includedActions.includes("delete")) {
-		const itemRoute = generateItemRouteTemplate(projectRoot, className, objectDef, includedActions, options, join(routeDir, "[id]"));
+		const itemRoute = generateItemRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, join(routeDir, "[id]"));
 		writeRoute(join(routeDir, "[id]"), "+server.ts", itemRoute);
 	}
 	const customActions = Object.entries(objectDef.methods).filter(([name, method]) => !STANDARD_API_ACTIONS.includes(name) && method.isPublic && shouldIncludeInApi(name, apiConfig));
@@ -816,7 +939,7 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
 			}
 		});
 	}
-	for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(actionSpecs)) writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, options));
+	for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(actionSpecs)) writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, manifest, options));
 }
 async function generateCollectionRoutesForObject(projectRoot, className, objectDef, manifest, options) {
 	const apiConfig = objectDef.decoratorConfig?.api;
@@ -851,7 +974,7 @@ async function generateCollectionRoutesForObject(projectRoot, className, objectD
 		});
 	}
 	for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(actionSpecs)) {
-		writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, options));
+		writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, manifest, options));
 		generatedAnyRoutes = true;
 	}
 	return generatedAnyRoutes;
@@ -998,13 +1121,15 @@ function isLocalObject(projectRoot, objectDef) {
 /**
 * Generates collection route template (GET list, POST create)
 */
-function generateCollectionRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir) {
+function generateCollectionRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, routeDir) {
 	const hasGet = includedActions.includes("list");
 	const hasPost = includedActions.includes("create");
 	const modelType = resolveObjectTypeReference(projectRoot, className, objectDef, options, routeDir);
 	const serializers = resolveStandardRouteSerializers(objectDef.decoratorConfig?.api);
 	const serializerImports = serializers.importStatements.join("\n");
 	const listUsesSerializer = !!serializers.listItemSerializerName;
+	const listUsesPermissionScopedBody = collectReadPermissionFields(objectDef, manifest).length > 0;
+	const listUsesBodyHash = listUsesSerializer || listUsesPermissionScopedBody;
 	const imports = `${AUTO_GENERATED_ROUTE_HEADER}
 // DO NOT EDIT - changes will be overwritten
 
@@ -1012,10 +1137,11 @@ import { error${hasPost ? ", json" : ""} } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}\n` : ""}import { getCollection } from '$lib/server/smrt';
 ${modelType.importStatement ? `${modelType.importStatement}\n` : ""}import type { RequestHandler } from './$types';
 // Note: ${className} is auto-registered by the Vite plugin scanner
-${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
+${generateAuthGuardHelper(objectDef, manifest)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
 		tenantScoped: isTenantScoped(objectDef),
+		permissionScoped: listUsesPermissionScopedBody,
 		modelName: className,
-		useBodyHash: listUsesSerializer
+		useBodyHash: listUsesBodyHash
 	}) : ""}`;
 	const listAndCount = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
   const items = await collection.list({ limit, offset, where: readScope });
@@ -1025,6 +1151,7 @@ ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenan
 // List all ${className.toLowerCase()}s
 export const GET: RequestHandler = async ({ locals, url, request }) => {
 ${routeGuardPreamble(objectDef, false)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
   const limit = Number(url.searchParams.get('limit')) || 50;
   const offset = Number(url.searchParams.get('offset')) || 0;
 
@@ -1032,13 +1159,21 @@ ${generateCollectionLoad(className, { typeName: modelType.typeName })}
 ${listUsesSerializer ? `${listAndCount}
   // Custom serializer may render related-table data → v1 body-hash ETag (#1765).
   const serializedItems = await Promise.all(
-    items.map((item) => ${serializers.listItemSerializerName}(item)),
+    items.map(async (item) =>
+      applyReadPermissionRedaction(
+        await ${serializers.listItemSerializerName}(item),
+        publicJsonOptions,
+      ),
+    ),
   );
-  return conditionalJson(request, { items: serializedItems, count, limit, offset });` : `  // ETag v2 (#1765): the table-version ETag is checked first; on a concrete
+  return conditionalJson(request, { items: serializedItems, count, limit, offset });` : listUsesPermissionScopedBody ? `${listAndCount}
+  // Field read permissions make the body vary by caller permissions → v1 body-hash ETag (#1565).
+  const items_public = items.map((item) => item.toPublicJSON(publicJsonOptions));
+  return conditionalJson(request, { items: items_public, count, limit, offset });` : `  // ETag v2 (#1765): the table-version ETag is checked first; on a concrete
   // If-None-Match the list query below never runs (zero-query 304).
   return conditionalVersionedRead(request, collection.db, collection.tableName, async () => {
 ${listAndCount}
-    const items_public = items.map((item) => item.toPublicJSON());
+    const items_public = items.map((item) => item.toPublicJSON(publicJsonOptions));
     return { items: items_public, count, limit, offset };
   });`}
 };
@@ -1047,6 +1182,7 @@ ${listAndCount}
 // Create new ${className.toLowerCase()}
 export const POST: RequestHandler = async ({ locals, request }) => {
 ${routeGuardPreamble(objectDef, true)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
   const body: unknown = await request.json();
   const data = applyWritablePolicy(body);
 
@@ -1056,8 +1192,11 @@ ${generateCollectionLoad(className, { typeName: modelType.typeName })}
 ${serializers.itemSerializerName ? `
   const serializedItem = await ${serializers.itemSerializerName}(item);
 
-  return json(serializedItem, { status: 201 });` : `
-  return json(item.toPublicJSON(), { status: 201 });`}
+  return json(
+    applyReadPermissionRedaction(serializedItem, publicJsonOptions),
+    { status: 201 },
+  );` : `
+  return json(item.toPublicJSON(publicJsonOptions), { status: 201 });`}
 };
 ` : "";
 	return imports + getHandler + postHandler;
@@ -1101,7 +1240,7 @@ function generateClassNotRegisteredError(className) {
 /**
 * Generates item route template (GET, PUT, DELETE)
 */
-function generateItemRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir) {
+function generateItemRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, routeDir) {
 	const hasGet = includedActions.includes("get");
 	const hasPut = includedActions.includes("update");
 	const hasDelete = includedActions.includes("delete");
@@ -1110,16 +1249,19 @@ function generateItemRouteTemplate(projectRoot, className, objectDef, includedAc
 	const serializers = resolveStandardRouteSerializers(objectDef.decoratorConfig?.api);
 	const serializerImports = serializers.importStatements.join("\n");
 	const getUsesSerializer = !!serializers.itemSerializerName;
+	const getUsesPermissionScopedBody = collectReadPermissionFields(objectDef, manifest).length > 0;
+	const getUsesBodyHash = getUsesSerializer || getUsesPermissionScopedBody;
 	const imports = `${AUTO_GENERATED_ROUTE_HEADER}
 // DO NOT EDIT - changes will be overwritten
 
 import { error${hasPut || hasDelete ? ", json" : ""} } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}\n` : ""}import { getCollection } from '$lib/server/smrt';
 ${modelType.importStatement ? `${modelType.importStatement}\n` : ""}import type { RequestHandler } from './$types';
-${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
+${generateAuthGuardHelper(objectDef, manifest)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
 		tenantScoped: isTenantScoped(objectDef),
+		permissionScoped: getUsesPermissionScopedBody,
 		modelName: className,
-		useBodyHash: getUsesSerializer
+		useBodyHash: getUsesBodyHash
 	}) : ""}`;
 	const getForRead = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
   const item = await collection.get(
@@ -1129,18 +1271,25 @@ ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenan
 // Get single ${simpleClassName.toLowerCase()}
 export const GET: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, false)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
 ${getUsesSerializer ? `${getForRead}
 ${generateNotFoundError(className)}
   // Custom serializer may render related-table data → v1 body-hash ETag (#1765).
   const serializedItem = await ${serializers.itemSerializerName}(item);
-  return conditionalJson(request, serializedItem);` : `  // ETag v2 (#1765): a concrete If-None-Match answers 304 without the row fetch
+  return conditionalJson(
+    request,
+    applyReadPermissionRedaction(serializedItem, publicJsonOptions),
+  );` : getUsesPermissionScopedBody ? `${getForRead}
+${generateNotFoundError(className)}
+  // Field read permissions make the body vary by caller permissions → v1 body-hash ETag (#1565).
+  return conditionalJson(request, item.toPublicJSON(publicJsonOptions));` : `  // ETag v2 (#1765): a concrete If-None-Match answers 304 without the row fetch
   // (a delete advances the version, so a since-deleted row can't false-match);
   // a wildcard \`*\` is deferred until the fetch confirms the row exists.
   return conditionalVersionedRead(request, collection.db, collection.tableName, async () => {
 ${getForRead}
 ${generateNotFoundError(className)}
-    return item.toPublicJSON();
+    return item.toPublicJSON(publicJsonOptions);
   });`}
 };
 ` : "";
@@ -1148,6 +1297,7 @@ ${generateNotFoundError(className)}
 // Update ${simpleClassName.toLowerCase()}
 export const PUT: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, true)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(className)}
@@ -1159,8 +1309,8 @@ ${generateNotFoundError(className)}
 ${serializers.itemSerializerName ? `
   const serializedItem = await ${serializers.itemSerializerName}(item);
 
-  return json(serializedItem);` : `
-  return json(item.toPublicJSON());`}
+  return json(applyReadPermissionRedaction(serializedItem, publicJsonOptions));` : `
+  return json(item.toPublicJSON(publicJsonOptions));`}
 };
 ` : "";
 	const deleteHandler = hasDelete ? `
@@ -1180,7 +1330,7 @@ ${generateNotFoundError(className)}
 /**
 * Generates custom action route template
 */
-function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDef, options) {
+function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDef, manifest, options) {
 	if (routeSpecs.length === 0) throw new Error("Cannot generate a custom action route without handlers");
 	const [firstSpec] = routeSpecs;
 	const { lookupClassName, routeConfig, hostType } = firstSpec;
@@ -1200,7 +1350,7 @@ function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDe
 // DO NOT EDIT - changes will be overwritten
 
 ${importBlock}
-${generateAuthGuardHelper(objectDef)}${tenantScoped ? generateTenantContextHelper() : ""}
+${generateAuthGuardHelper(objectDef, manifest)}${tenantScoped ? generateTenantContextHelper() : ""}
 ${handlers}`;
 }
 function generateActionRouteHandler(lookupClassName, actionName, actionDef, routeConfig, hostType, tenantScoped, lookupTypeName, hostTypeName) {
@@ -1219,6 +1369,7 @@ function generateActionRouteHandler(lookupClassName, actionName, actionDef, rout
 		return `// Custom collection method: ${actionName}
 export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
 ${authGuardLine}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(lookupClassName, { typeName: lookupTypeName })}
   const typedCollection = collection as unknown as ${hostTypeName};
 ${generateCollectionNotRegisteredError(lookupClassName)}
@@ -1226,7 +1377,10 @@ ${staticTargetLoad}
 
 ${optionsLoad}  const result = ${buildActionInvocationExpression(receiverExpression, actionName, invocationArgs)};
 
-  return json({ action: '${actionName}', result: toPublicResult(result) });
+  return json({
+    action: '${actionName}',
+    result: toPublicResult(result, publicJsonOptions),
+  });
 };
 `;
 	}
@@ -1235,13 +1389,17 @@ ${optionsLoad}  const result = ${buildActionInvocationExpression(receiverExpress
 		return `// Custom collection action: ${actionName}
 export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
 ${authGuardLine}
+  const publicJsonOptions = getPublicJsonOptions(locals);
   const registered = ObjectRegistry.getClass('${lookupClassName}');
 ${generateClassNotRegisteredError(lookupClassName)}
 
 ${optionsLoad}  const ClassRef = registered.constructor as typeof ${hostTypeName};
   const result = ${buildActionInvocationExpression("ClassRef", actionName, invocationArgs)};
 
-  return json({ action: '${actionName}', result: toPublicResult(result) });
+  return json({
+    action: '${actionName}',
+    result: toPublicResult(result, publicJsonOptions),
+  });
 };
 `;
 	}
@@ -1249,13 +1407,17 @@ ${optionsLoad}  const ClassRef = registered.constructor as typeof ${hostTypeName
 	return `// Custom action: ${actionName}
 export const ${handlerName}: RequestHandler = async (${itemHandlerArgs}) => {
 ${authGuardLine}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(lookupClassName, { typeName: lookupTypeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(lookupClassName)}
 
 ${optionsLoad}  const result = ${buildActionInvocationExpression("item", actionName, invocationArgs)};
 
-  return json({ action: '${actionName}', result: toPublicResult(result) });
+  return json({
+    action: '${actionName}',
+    result: toPublicResult(result, publicJsonOptions),
+  });
 };
 `;
 }