@happyvertical/smrt-core 0.40.69 → 0.41.0

package/dist/query-bounds.js

@@ -0,0 +1,177 @@
+import { ValidationError } from "./errors.js";
+//#region src/query-bounds.ts
+/**
+* Query bounds for list surfaces (#2367).
+*
+* Every generated read surface — REST, SvelteKit routes, the MCP server and the
+* MCP runtime bootstrap — takes `limit`/`offset` straight from untrusted input.
+* Before this module each one parsed them by hand, and each got it wrong in a
+* different way: `Number.parseInt('abc')` produced `LIMIT NaN` (a 500 from the
+* driver, not a 400 from the API), `Number(x) || 50` silently turned `0` into
+* `50`, and none of them capped the value, so `?limit=100000000` was a
+* single-request table scan on every generated endpoint.
+*
+* This is the one parser they all share. It is deliberately strict on the input
+* (a bound is a non-negative integer or it is a client error) and deliberately
+* forgiving on magnitude (an oversized page is clamped, not rejected, so a
+* caller paging with a too-large window still makes progress instead of
+* receiving an error it cannot act on).
+*
+* The bounds themselves are also available to `SmrtCollection.list()` through
+* the `defaultListLimit` / `maxListLimit` collection options. Those are opt-in:
+* `list()` is the framework's own bulk-read primitive and dozens of internal
+* callers (relationship loaders, junction hydration, `listByIds`) legitimately
+* expect every matching row, so a framework-wide implicit default would
+* silently truncate results rather than bound an attack surface. The bound
+* belongs where untrusted input arrives, which is why the generated surfaces
+* apply it unconditionally and direct programmatic callers opt in.
+*/
+/**
+* Page size a generated list surface uses when the caller supplies none.
+*
+* Matches the value the REST and SvelteKit generators already hard-coded, so
+* adopting the shared parser is not a behavior change for callers that omit
+* `limit`.
+*/
+var DEFAULT_LIST_LIMIT = 50;
+/**
+* Largest page a generated list surface will serve.
+*
+* Matches the cap `MCPGenerator` already applied in-process, now enforced on
+* every generated surface rather than one of them.
+*/
+var MAX_LIST_LIMIT = 1e3;
+/**
+* A `limit`/`offset` value that cannot be honored.
+*
+* Extends `ValidationError` so the retry classifier never retries it, and
+* carries `status`/`publicMessage` so `normalizeTypedHttpError()` renders it as
+* a structured 400 instead of letting a caller typo become a 500.
+*/
+var QueryBoundsError = class extends ValidationError {
+	status = 400;
+	publicMessage;
+	constructor(message, code = "INVALID_QUERY_BOUNDS", details) {
+		super(message, code, details);
+		this.name = "QueryBoundsError";
+		this.publicMessage = message;
+	}
+};
+/**
+* An `orderBy` term that cannot be honored (#2367).
+*
+* `orderBy` reaches SQL in the identifier position, and until this rail existed
+* it was checked only against `/^[a-zA-Z0-9_]+$/` — so an unknown column
+* produced a driver error and a *sensitive* column produced a working ordering
+* oracle: `?orderBy=api_secret&limit=1` reveals the extreme value of a secret
+* one request at a time, even though the column itself is never serialized.
+* `where` and `select` have rejected sensitive fields since #1540/#1902; this
+* is the same rail for the third identifier-position input.
+*/
+var QueryOrderByError = class extends ValidationError {
+	status = 400;
+	publicMessage;
+	constructor(message, publicMessage, code = "INVALID_ORDER_BY", details) {
+		super(message, code, details);
+		this.name = "QueryOrderByError";
+		this.publicMessage = publicMessage;
+	}
+};
+/**
+* Parse one bound from untrusted input.
+*
+* Accepts a non-negative safe integer, or a string of digits (optionally
+* surrounded by whitespace). Everything else — `'abc'`, `'1.5'`, `'-1'`,
+* `'1e3'`, `NaN`, `Infinity`, booleans, objects — is a client error, because
+* silently substituting a default for a malformed bound hides the caller's bug
+* and returns a page they did not ask for.
+*
+* `0` is preserved rather than folded into the default: `limit=0` means "no
+* rows", which is what the REST surface already did and what the SvelteKit
+* surface's `|| 50` fallback got wrong.
+*/
+function resolveListBound(raw, options) {
+	const { defaultValue = 0, maxValue, parameterName = "bound" } = options;
+	if (raw === null || raw === void 0 || raw === "") return maxValue !== void 0 ? Math.min(defaultValue, maxValue) : defaultValue;
+	let parsed;
+	if (typeof raw === "number") parsed = raw;
+	else if (typeof raw === "string") {
+		const trimmed = raw.trim();
+		if (!/^\d+$/.test(trimmed)) throw new QueryBoundsError(`Invalid ${parameterName}: '${raw}' is not a non-negative integer.`, "INVALID_QUERY_BOUNDS", {
+			parameterName,
+			value: raw
+		});
+		parsed = Number(trimmed);
+	} else throw new QueryBoundsError(`Invalid ${parameterName}: expected a non-negative integer, got ${typeof raw}.`, "INVALID_QUERY_BOUNDS", {
+		parameterName,
+		value: raw
+	});
+	if (!Number.isSafeInteger(parsed) || parsed < 0) throw new QueryBoundsError(`Invalid ${parameterName}: '${String(raw)}' is not a non-negative integer.`, "INVALID_QUERY_BOUNDS", {
+		parameterName,
+		value: raw
+	});
+	return maxValue !== void 0 ? Math.min(parsed, maxValue) : parsed;
+}
+/**
+* Resolve a page size from untrusted input: default when absent, rejected when
+* malformed, clamped when oversized.
+*
+* @throws {QueryBoundsError} when the input is not a non-negative integer
+*/
+function resolveListLimit(raw, options = {}) {
+	return resolveListBound(raw, {
+		defaultValue: options.defaultValue ?? 50,
+		maxValue: options.maxValue ?? 1e3,
+		parameterName: options.parameterName ?? "limit"
+	});
+}
+/**
+* Resolve a page offset from untrusted input.
+*
+* Unbounded above by default: an offset past the end of the table returns an
+* empty page, and capping it would silently serve the wrong page instead.
+*
+* @throws {QueryBoundsError} when the input is not a non-negative integer
+*/
+function resolveListOffset(raw, options = {}) {
+	return resolveListBound(raw, {
+		defaultValue: options.defaultValue ?? 0,
+		maxValue: options.maxValue,
+		parameterName: options.parameterName ?? "offset"
+	});
+}
+/**
+* Deterministic default ordering for a generated list page.
+*
+* `LIMIT`/`OFFSET` without `ORDER BY` is not pagination: PostgreSQL may return
+* rows in any order and is free to choose a different one per query, so page 2
+* can repeat or skip rows from page 1. `created_at DESC` alone is not enough
+* either — rows sharing a timestamp still tie — so the primary key follows as a
+* total-order tiebreak.
+*
+* Schema generation emits the index that makes this ordering cheap —
+* `(tenant_id, created_at)` on a tenant-scoped table, `(created_at)` otherwise
+* (#2363). The primary-key tiebreak is deliberately not in that index: its
+* direction is opposite, so it is resolved by an incremental sort over the
+* rows that share a timestamp.
+*/
+var DEFAULT_LIST_ORDER_BY = ["created_at DESC", "id ASC"];
+/**
+* Deterministic default ordering for a model whose primary key may not be `id`.
+*
+* A class declaring `@field({ primaryKey: true })` on its own column has no
+* synthetic `id` column — schema generation omits `id`/`slug`/`context` for
+* custom-primary-key classes — so `ORDER BY ... id ASC` would name a column
+* that does not exist and fail the whole page. The tiebreak therefore follows
+* the declared key.
+*
+* @param primaryKeyField - the model's primary-key field name in SMRT (not
+*   column) form; `collection.list()` maps it to the column
+*/
+function buildDefaultListOrderBy(primaryKeyField = "id") {
+	return ["created_at DESC", `${primaryKeyField} ASC`];
+}
+//#endregion
+export { DEFAULT_LIST_LIMIT, DEFAULT_LIST_ORDER_BY, MAX_LIST_LIMIT, QueryBoundsError, QueryOrderByError, buildDefaultListOrderBy, resolveListLimit, resolveListOffset };
+
+//# sourceMappingURL=query-bounds.js.map

package/dist/query-bounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-bounds.js","names":[],"sources":["../src/query-bounds.ts"],"sourcesContent":["/**\n * Query bounds for list surfaces (#2367).\n *\n * Every generated read surface — REST, SvelteKit routes, the MCP server and the\n * MCP runtime bootstrap — takes `limit`/`offset` straight from untrusted input.\n * Before this module each one parsed them by hand, and each got it wrong in a\n * different way: `Number.parseInt('abc')` produced `LIMIT NaN` (a 500 from the\n * driver, not a 400 from the API), `Number(x) || 50` silently turned `0` into\n * `50`, and none of them capped the value, so `?limit=100000000` was a\n * single-request table scan on every generated endpoint.\n *\n * This is the one parser they all share. It is deliberately strict on the input\n * (a bound is a non-negative integer or it is a client error) and deliberately\n * forgiving on magnitude (an oversized page is clamped, not rejected, so a\n * caller paging with a too-large window still makes progress instead of\n * receiving an error it cannot act on).\n *\n * The bounds themselves are also available to `SmrtCollection.list()` through\n * the `defaultListLimit` / `maxListLimit` collection options. Those are opt-in:\n * `list()` is the framework's own bulk-read primitive and dozens of internal\n * callers (relationship loaders, junction hydration, `listByIds`) legitimately\n * expect every matching row, so a framework-wide implicit default would\n * silently truncate results rather than bound an attack surface. The bound\n * belongs where untrusted input arrives, which is why the generated surfaces\n * apply it unconditionally and direct programmatic callers opt in.\n */\n\nimport { ValidationError } from './errors';\n\n/**\n * Page size a generated list surface uses when the caller supplies none.\n *\n * Matches the value the REST and SvelteKit generators already hard-coded, so\n * adopting the shared parser is not a behavior change for callers that omit\n * `limit`.\n */\nexport const DEFAULT_LIST_LIMIT = 50;\n\n/**\n * Largest page a generated list surface will serve.\n *\n * Matches the cap `MCPGenerator` already applied in-process, now enforced on\n * every generated surface rather than one of them.\n */\nexport const MAX_LIST_LIMIT = 1000;\n\n/**\n * A `limit`/`offset` value that cannot be honored.\n *\n * Extends `ValidationError` so the retry classifier never retries it, and\n * carries `status`/`publicMessage` so `normalizeTypedHttpError()` renders it as\n * a structured 400 instead of letting a caller typo become a 500.\n */\nexport class QueryBoundsError extends ValidationError {\n  readonly status = 400;\n  readonly publicMessage: string;\n\n  constructor(\n    message: string,\n    code = 'INVALID_QUERY_BOUNDS',\n    details?: Record<string, unknown>,\n  ) {\n    super(message, code, details);\n    this.name = 'QueryBoundsError';\n    this.publicMessage = message;\n  }\n}\n\n/**\n * An `orderBy` term that cannot be honored (#2367).\n *\n * `orderBy` reaches SQL in the identifier position, and until this rail existed\n * it was checked only against `/^[a-zA-Z0-9_]+$/` — so an unknown column\n * produced a driver error and a *sensitive* column produced a working ordering\n * oracle: `?orderBy=api_secret&limit=1` reveals the extreme value of a secret\n * one request at a time, even though the column itself is never serialized.\n * `where` and `select` have rejected sensitive fields since #1540/#1902; this\n * is the same rail for the third identifier-position input.\n */\nexport class QueryOrderByError extends ValidationError {\n  readonly status = 400;\n  readonly publicMessage: string;\n\n  constructor(\n    message: string,\n    publicMessage: string,\n    code = 'INVALID_ORDER_BY',\n    details?: Record<string, unknown>,\n  ) {\n    super(message, code, details);\n    this.name = 'QueryOrderByError';\n    this.publicMessage = publicMessage;\n  }\n}\n\n/**\n * Options for {@link resolveListLimit} / {@link resolveListOffset}.\n */\nexport interface ListBoundOptions {\n  /** Value used when the input is absent (`null`, `undefined`, or `''`). */\n  defaultValue?: number;\n  /** Upper bound; larger values are clamped down to it. Omit for none. */\n  maxValue?: number;\n  /** Parameter name used in the rejection message. */\n  parameterName?: string;\n}\n\n/**\n * Parse one bound from untrusted input.\n *\n * Accepts a non-negative safe integer, or a string of digits (optionally\n * surrounded by whitespace). Everything else — `'abc'`, `'1.5'`, `'-1'`,\n * `'1e3'`, `NaN`, `Infinity`, booleans, objects — is a client error, because\n * silently substituting a default for a malformed bound hides the caller's bug\n * and returns a page they did not ask for.\n *\n * `0` is preserved rather than folded into the default: `limit=0` means \"no\n * rows\", which is what the REST surface already did and what the SvelteKit\n * surface's `|| 50` fallback got wrong.\n */\nfunction resolveListBound(raw: unknown, options: ListBoundOptions): number {\n  const { defaultValue = 0, maxValue, parameterName = 'bound' } = options;\n\n  if (raw === null || raw === undefined || raw === '') {\n    return maxValue !== undefined\n      ? Math.min(defaultValue, maxValue)\n      : defaultValue;\n  }\n\n  let parsed: number;\n  if (typeof raw === 'number') {\n    parsed = raw;\n  } else if (typeof raw === 'string') {\n    const trimmed = raw.trim();\n    // Strict digits only. `Number.parseInt` would accept '12abc' and\n    // `Number()` would accept '1e3' and ' 0x10 '; both would then be\n    // interpolated into a page size the caller never wrote.\n    if (!/^\\d+$/.test(trimmed)) {\n      throw new QueryBoundsError(\n        `Invalid ${parameterName}: '${raw}' is not a non-negative integer.`,\n        'INVALID_QUERY_BOUNDS',\n        { parameterName, value: raw },\n      );\n    }\n    parsed = Number(trimmed);\n  } else {\n    throw new QueryBoundsError(\n      `Invalid ${parameterName}: expected a non-negative integer, got ${typeof raw}.`,\n      'INVALID_QUERY_BOUNDS',\n      { parameterName, value: raw },\n    );\n  }\n\n  if (!Number.isSafeInteger(parsed) || parsed < 0) {\n    throw new QueryBoundsError(\n      `Invalid ${parameterName}: '${String(raw)}' is not a non-negative integer.`,\n      'INVALID_QUERY_BOUNDS',\n      { parameterName, value: raw },\n    );\n  }\n\n  return maxValue !== undefined ? Math.min(parsed, maxValue) : parsed;\n}\n\n/**\n * Resolve a page size from untrusted input: default when absent, rejected when\n * malformed, clamped when oversized.\n *\n * @throws {QueryBoundsError} when the input is not a non-negative integer\n */\nexport function resolveListLimit(\n  raw: unknown,\n  options: ListBoundOptions = {},\n): number {\n  return resolveListBound(raw, {\n    defaultValue: options.defaultValue ?? DEFAULT_LIST_LIMIT,\n    maxValue: options.maxValue ?? MAX_LIST_LIMIT,\n    parameterName: options.parameterName ?? 'limit',\n  });\n}\n\n/**\n * Resolve a page offset from untrusted input.\n *\n * Unbounded above by default: an offset past the end of the table returns an\n * empty page, and capping it would silently serve the wrong page instead.\n *\n * @throws {QueryBoundsError} when the input is not a non-negative integer\n */\nexport function resolveListOffset(\n  raw: unknown,\n  options: ListBoundOptions = {},\n): number {\n  return resolveListBound(raw, {\n    defaultValue: options.defaultValue ?? 0,\n    maxValue: options.maxValue,\n    parameterName: options.parameterName ?? 'offset',\n  });\n}\n\n/**\n * Deterministic default ordering for a generated list page.\n *\n * `LIMIT`/`OFFSET` without `ORDER BY` is not pagination: PostgreSQL may return\n * rows in any order and is free to choose a different one per query, so page 2\n * can repeat or skip rows from page 1. `created_at DESC` alone is not enough\n * either — rows sharing a timestamp still tie — so the primary key follows as a\n * total-order tiebreak.\n *\n * Schema generation emits the index that makes this ordering cheap —\n * `(tenant_id, created_at)` on a tenant-scoped table, `(created_at)` otherwise\n * (#2363). The primary-key tiebreak is deliberately not in that index: its\n * direction is opposite, so it is resolved by an incremental sort over the\n * rows that share a timestamp.\n */\nexport const DEFAULT_LIST_ORDER_BY: readonly string[] = [\n  'created_at DESC',\n  'id ASC',\n];\n\n/**\n * Deterministic default ordering for a model whose primary key may not be `id`.\n *\n * A class declaring `@field({ primaryKey: true })` on its own column has no\n * synthetic `id` column — schema generation omits `id`/`slug`/`context` for\n * custom-primary-key classes — so `ORDER BY ... id ASC` would name a column\n * that does not exist and fail the whole page. The tiebreak therefore follows\n * the declared key.\n *\n * @param primaryKeyField - the model's primary-key field name in SMRT (not\n *   column) form; `collection.list()` maps it to the column\n */\nexport function buildDefaultListOrderBy(primaryKeyField = 'id'): string[] {\n  return ['created_at DESC', `${primaryKeyField} ASC`];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,IAAa,qBAAqB;;;;;;;AAQlC,IAAa,iBAAiB;;;;;;;;AAS9B,IAAa,mBAAb,cAAsC,gBAAgB;CACpD,SAAkB;CAClB;CAEA,YACE,SACA,OAAO,wBACP,SACA;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,KAAK,OAAO;EACZ,KAAK,gBAAgB;CACvB;AACF;;;;;;;;;;;;AAaA,IAAa,oBAAb,cAAuC,gBAAgB;CACrD,SAAkB;CAClB;CAEA,YACE,SACA,eACA,OAAO,oBACP,SACA;EACA,MAAM,SAAS,MAAM,OAAO;EAC5B,KAAK,OAAO;EACZ,KAAK,gBAAgB;CACvB;AACF;;;;;;;;;;;;;;AA2BA,SAAS,iBAAiB,KAAc,SAAmC;CACzE,MAAM,EAAE,eAAe,GAAG,UAAU,gBAAgB,YAAY;CAEhE,IAAI,QAAQ,QAAQ,QAAQ,KAAA,KAAa,QAAQ,IAC/C,OAAO,aAAa,KAAA,IAChB,KAAK,IAAI,cAAc,QAAQ,IAC/B;CAGN,IAAI;CACJ,IAAI,OAAO,QAAQ,UACjB,SAAS;MACJ,IAAI,OAAO,QAAQ,UAAU;EAClC,MAAM,UAAU,IAAI,KAAK;EAIzB,IAAI,CAAC,QAAQ,KAAK,OAAO,GACvB,MAAM,IAAI,iBACR,WAAW,cAAc,KAAK,IAAI,mCAClC,wBACA;GAAE;GAAe,OAAO;EAAI,CAC9B;EAEF,SAAS,OAAO,OAAO;CACzB,OACE,MAAM,IAAI,iBACR,WAAW,cAAc,yCAAyC,OAAO,IAAI,IAC7E,wBACA;EAAE;EAAe,OAAO;CAAI,CAC9B;CAGF,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,GAC5C,MAAM,IAAI,iBACR,WAAW,cAAc,KAAK,OAAO,GAAG,EAAE,mCAC1C,wBACA;EAAE;EAAe,OAAO;CAAI,CAC9B;CAGF,OAAO,aAAa,KAAA,IAAY,KAAK,IAAI,QAAQ,QAAQ,IAAI;AAC/D;;;;;;;AAQA,SAAgB,iBACd,KACA,UAA4B,CAAC,GACrB;CACR,OAAO,iBAAiB,KAAK;EAC3B,cAAc,QAAQ,gBAAA;EACtB,UAAU,QAAQ,YAAA;EAClB,eAAe,QAAQ,iBAAiB;CAC1C,CAAC;AACH;;;;;;;;;AAUA,SAAgB,kBACd,KACA,UAA4B,CAAC,GACrB;CACR,OAAO,iBAAiB,KAAK;EAC3B,cAAc,QAAQ,gBAAgB;EACtC,UAAU,QAAQ;EAClB,eAAe,QAAQ,iBAAiB;CAC1C,CAAC;AACH;;;;;;;;;;;;;;;;AAiBA,IAAa,wBAA2C,CACtD,mBACA,QACF;;;;;;;;;;;;;AAcA,SAAgB,wBAAwB,kBAAkB,MAAgB;CACxE,OAAO,CAAC,mBAAmB,GAAG,gBAAgB,KAAK;AACrD"}

package/dist/registry/class-registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"class-registration.d.ts","sourceRoot":"","sources":["../../src/registry/class-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAKV,qBAAqB,EAGtB,MAAM,qBAAqB,CAAC;AAqC7B,OAAO,KAAK,EACV,eAAe,EAEf,iBAAiB,EAElB,MAAM,YAAY,CAAC;AA0dpB,wBAAgB,QAAQ,CACtB,IAAI,EAAE,OAAO,UAAU,EACvB,MAAM,GAAE,iBAAsB,GAC7B,IAAI,CAmvBN;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAMlB,qBAAqB,EAAE,WAAW,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,GAC3E,IAAI,CAeN;AA6LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,EACzB,gBAAgB,CAAC,EAAE;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACA,IAAI,CA2CN;AA0ID,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,qBAAqB,EAChC,WAAW,CAAC,EAAE,MAAM,GACnB,IAAI,CAmQN"}
+{"version":3,"file":"class-registration.d.ts","sourceRoot":"","sources":["../../src/registry/class-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAKV,qBAAqB,EAGtB,MAAM,qBAAqB,CAAC;AAqC7B,OAAO,KAAK,EACV,eAAe,EAEf,iBAAiB,EAElB,MAAM,YAAY,CAAC;AA0dpB,wBAAgB,QAAQ,CACtB,IAAI,EAAE,OAAO,UAAU,EACvB,MAAM,GAAE,iBAAsB,GAC7B,IAAI,CAmvBN;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAMlB,qBAAqB,EAAE,WAAW,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,GAC3E,IAAI,CAeN;AA6LD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,EACzB,gBAAgB,CAAC,EAAE;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACA,IAAI,CA2CN;AA0ID,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,qBAAqB,EAChC,WAAW,CAAC,EAAE,MAAM,GACnB,IAAI,CA4QN"}

package/dist/registry/class-registration.js

@@ -1,10 +1,10 @@
 import { ConfigurationError } from "../errors.js";
+import { toSnakeCase } from "../utils/naming.js";
 import { createQualifiedName, isQualifiedName } from "../utils/qualified-names.js";
 import { cloneManifestSchemaColumns } from "../manifest/store.js";
 import { getClasses, getCollections, getConstructorIndex, getFieldDecorators, getInheritanceCache, getSourceFileFromStack, getStiSiblingsLoaded, verboseLog } from "./shared-state.js";
 import { findClass, getCanonicalClassName, hasClassCaseInsensitive, qualifyExtendsName } from "./name-resolver.js";
 import { buildInheritanceChain } from "./inheritance-resolver.js";
-import { toSnakeCase } from "../utils/naming.js";
 import { discoverManifestSync, discoverSTISiblingsSync, getPackageName, lookupInManifest } from "../manifest/manifest-loader.js";
 import { tableNameFromClass } from "../utils.js";
 import { SmrtObject } from "../object.js";
@@ -882,6 +882,7 @@ function registerFromManifest(name, objectDef, packageName) {
 	} else verboseLog(`[registry] Using ${validationRules.length} pre-computed validation rules for ${name}`);
 	const qualifiedName = qualifiedNameEarly;
 	const visibility = objectDef.visibility || config.visibility || "public";
+	const tenantScopedConfig = normalizeTenantScopedConfig(config.tenantScoped);
 	getClasses().set(registrationKey, {
 		name: simpleClassName,
 		qualifiedName,
@@ -890,6 +891,7 @@ function registerFromManifest(name, objectDef, packageName) {
 		fields,
 		methods,
 		schema,
+		tenantScopedConfig,
 		validators,
 		validationRules,
 		tools: objectDef.tools,