@opensaas/stack-core 0.20.0 → 0.21.0

package/dist/context/hook-pipeline.d.ts

@@ -0,0 +1,49 @@
+import type { ListConfig } from '../config/types.js';
+import type { AccessContext } from '../access/types.js';
+/**
+ * Hook Pipeline — the single module that runs the transform+validate span of a
+ * write: list `resolveInput` → field `resolveInput` → list `validate` → field
+ * `validate` → built-in field rules (`validateFieldRules`). It owns the order of
+ * these phases and the threading of `resolvedData` through them, in one place.
+ *
+ * It is THE place where input is shaped and validated; it throws
+ * {@link ValidationError} on failure exactly as before (validate hooks via
+ * `addValidationError`, then `validateFieldRules`) — validation is never silent.
+ *
+ * Side-effect hooks (`beforeOperation`/`afterOperation`), operation-level access,
+ * writable-field filtering, nested operations, persistence and Field Visibility
+ * are deliberately OUT of this span — they stay in the Write Pipeline. See the
+ * "Hook Pipeline" and "Write Pipeline" glossary terms in CONTEXT.md.
+ */
+/**
+ * Arguments for one transform+validate span. Only the create/update operations
+ * run this span (delete skips the input-shaping phases entirely).
+ */
+export interface HookPipelineArgs {
+    operation: 'create' | 'update';
+    listName: string;
+    listConfig: ListConfig<any>;
+    /** The original input data for the write. */
+    inputData: Record<string, unknown>;
+    /** The existing row for update; `undefined` for create. */
+    item: Record<string, unknown> | undefined;
+    context: AccessContext;
+}
+/**
+ * Result of a transform+validate span: the fully-resolved write data after the
+ * resolveInput hooks have run and all validation has passed.
+ */
+export interface HookPipelineResult {
+    resolvedData: Record<string, unknown>;
+}
+/**
+ * The transform+validate span, owning order + `resolvedData` threading.
+ */
+export interface HookPipeline {
+    run(args: HookPipelineArgs): Promise<HookPipelineResult>;
+}
+/**
+ * The default Hook Pipeline instance used by the Write Pipeline.
+ */
+export declare const hookPipeline: HookPipeline;
+//# sourceMappingURL=hook-pipeline.d.ts.map

package/dist/context/hook-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-pipeline.d.ts","sourceRoot":"","sources":["../../src/context/hook-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAUvD;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IAC3B,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IACzC,OAAO,EAAE,aAAa,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACzD;AAkGD;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,YAE1B,CAAA"}

package/dist/context/hook-pipeline.js

@@ -0,0 +1,75 @@
+import { executeResolveInput, executeValidate, executeFieldResolveInputHooks, executeFieldValidateHooks, validateFieldRules, ValidationError, } from '../hooks/index.js';
+/**
+ * Run the transform+validate span once.
+ *
+ * Phase order (owned here, in one place):
+ *   list `resolveInput`
+ *     → field `resolveInput`
+ *     → list `validate`
+ *     → field `validate`
+ *     → built-in field rules (`validateFieldRules`)
+ *
+ * Contract preserved exactly:
+ *   - `resolvedData` starts as `inputData` and is threaded through each phase;
+ *   - validate hooks report failures via `addValidationError` → THROW
+ *     `ValidationError` (never silent);
+ *   - built-in field rule failures THROW `ValidationError`;
+ *   - on success returns the transformed `resolvedData`.
+ */
+async function runHookPipeline(args) {
+    const { operation, listName, listConfig, inputData, item, context } = args;
+    // ── Phase 1: list-level resolveInput ──────────────────────────────────────
+    let resolvedData = await executeResolveInput(listConfig.hooks, operation === 'create'
+        ? {
+            listKey: listName,
+            operation: 'create',
+            inputData,
+            resolvedData: inputData,
+            item: undefined,
+            context,
+        }
+        : {
+            listKey: listName,
+            operation: 'update',
+            inputData,
+            resolvedData: inputData,
+            item,
+            context,
+        });
+    // ── Phase 1.5: field-level resolveInput (e.g. hash passwords) ──────────────
+    resolvedData = await executeFieldResolveInputHooks(inputData, resolvedData, listConfig.fields, operation, context, listName, item);
+    // ── Phase 2: list-level validate ──────────────────────────────────────────
+    await executeValidate(listConfig.hooks, operation === 'create'
+        ? {
+            listKey: listName,
+            operation: 'create',
+            inputData,
+            resolvedData,
+            item: undefined,
+            context,
+        }
+        : {
+            listKey: listName,
+            operation: 'update',
+            inputData,
+            resolvedData,
+            item,
+            context,
+        });
+    // ── Phase 2.5: field-level validate ───────────────────────────────────────
+    await executeFieldValidateHooks(inputData, resolvedData, listConfig.fields, operation, context, listName, item);
+    // ── Phase 3: built-in field rules (isRequired, length, etc.) ──────────────
+    // Validation failures THROW (validation is not silent).
+    const validation = validateFieldRules(resolvedData, listConfig.fields, operation);
+    if (validation.errors.length > 0) {
+        throw new ValidationError(validation.errors, validation.fieldErrors);
+    }
+    return { resolvedData };
+}
+/**
+ * The default Hook Pipeline instance used by the Write Pipeline.
+ */
+export const hookPipeline = {
+    run: runHookPipeline,
+};
+//# sourceMappingURL=hook-pipeline.js.map

package/dist/context/hook-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-pipeline.js","sourceRoot":"","sources":["../../src/context/hook-pipeline.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,6BAA6B,EAC7B,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAiD1B;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,eAAe,CAAC,IAAsB;IACnD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IAE1E,6EAA6E;IAC7E,IAAI,YAAY,GAAG,MAAM,mBAAmB,CAC1C,UAAU,CAAC,KAAK,EAChB,SAAS,KAAK,QAAQ;QACpB,CAAC,CAAC;YACE,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,OAAO;SACR;QACH,CAAC,CAAC;YACE,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,YAAY,EAAE,SAAS;YACvB,IAAI;YACJ,OAAO;SACR,CACN,CAAA;IAED,8EAA8E;IAC9E,YAAY,GAAG,MAAM,6BAA6B,CAChD,SAAS,EACT,YAAY,EACZ,UAAU,CAAC,MAAM,EACjB,SAAS,EACT,OAAO,EACP,QAAQ,EACR,IAAI,CACL,CAAA;IAED,6EAA6E;IAC7E,MAAM,eAAe,CACnB,UAAU,CAAC,KAAK,EAChB,SAAS,KAAK,QAAQ;QACpB,CAAC,CAAC;YACE,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,YAAY;YACZ,IAAI,EAAE,SAAS;YACf,OAAO;SACR;QACH,CAAC,CAAC;YACE,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,YAAY;YACZ,IAAI;YACJ,OAAO;SACR,CACN,CAAA;IAED,6EAA6E;IAC7E,MAAM,yBAAyB,CAC7B,SAAS,EACT,YAAY,EACZ,UAAU,CAAC,MAAM,EACjB,SAAS,EACT,OAAO,EACP,QAAQ,EACR,IAAI,CACL,CAAA;IAED,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACjF,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAA;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,GAAG,EAAE,eAAe;CACrB,CAAA"}

package/dist/context/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,oBAAoB,CAAA;AACpE,OAAO,KAAK,EAAE,OAAO,EAAiB,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAmBlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAkP1D,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACpE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAChF;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AA4GrD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,OAAO,SAAS,cAAc,EAC9B,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,EAEnD,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE,YAAY,EACtB,OAAO,GAAE,OAAe,GACvB;IACD,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,YAAY,CAAA;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,MAAM;QACV,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;QACvB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,YAAY,CAAA;QACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAChC,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,EAAE,MAAM,OAAO,CAAA;QACnB,OAAO,EAAE,OAAO,CAAA;KACjB,CAAA;CACF,CAgMA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,oBAAoB,CAAA;AACpE,OAAO,KAAK,EAAE,OAAO,EAAiB,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAS1D,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACpE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAChF;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AA4GrD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,OAAO,SAAS,cAAc,EAC9B,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,EAEnD,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,OAAO,CAAC,EAAE,YAAY,EACtB,OAAO,GAAE,OAAe,GACvB;IACD,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,YAAY,CAAA;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,MAAM;QACV,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;QACvB,MAAM,EAAE,OAAO,CAAA;QACf,OAAO,EAAE,YAAY,CAAA;QACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAChC,YAAY,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,EAAE,MAAM,OAAO,CAAA;QACnB,OAAO,EAAE,OAAO,CAAA;KACjB,CAAA;CACF,CAgMA"}

package/dist/context/index.js

@@ -1,211 +1,8 @@
-import { checkAccess, mergeFilters, filterReadableFields, filterWritableFields, buildIncludeWithAccessControl, } from '../access/index.js';
-import { executeResolveInput, executeValidate, executeBeforeOperation, executeAfterOperation, validateFieldRules, ValidationError, DatabaseError, } from '../hooks/index.js';
-import { processNestedOperations } from './nested-operations.js';
+import { checkAccess, mergeFilters, filterReadableFields, buildIncludeWithAccessControl, } from '../access/index.js';
+import { ValidationError, DatabaseError } from '../hooks/index.js';
 import { getDbKey } from '../lib/case-utils.js';
 import { buildInclude, pickFields, isFragment } from '../query/index.js';
-/**
- * Execute field-level resolveInput hooks
- * Allows fields to transform their input values before database write
- */
-async function executeFieldResolveInputHooks(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-inputData, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-resolvedData, fields, operation, context, listKey, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-item) {
-    let result = { ...resolvedData };
-    console.log('Executing field resolveInput hooks for list:', listKey, 'operation:', operation, 'inputData:', inputData, 'resolvedData before field hooks:', resolvedData);
-    for (const [fieldKey, fieldConfig] of Object.entries(fields)) {
-        // Skip if field not in data
-        if (!(fieldKey in result))
-            continue;
-        // Skip if no hooks defined
-        if (!fieldConfig.hooks?.resolveInput)
-            continue;
-        // Execute field hook
-        // Type assertion is safe here because hooks are typed correctly in field definitions
-        // and we're working with runtime values that match those types
-        const transformedValue = await fieldConfig.hooks.resolveInput({
-            listKey,
-            fieldKey,
-            operation,
-            inputData,
-            item,
-            resolvedData: { ...result }, // Pass a copy to avoid mutation affecting recorded args
-            context,
-        });
-        // Create new object with updated field to avoid mutating the passed reference
-        result = { ...result, [fieldKey]: transformedValue };
-    }
-    return result;
-}
-/**
- * Execute field-level validate hooks
- * Allows fields to perform custom validation after resolveInput but before database write
- */
-async function executeFieldValidateHooks(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-inputData, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-resolvedData, fields, operation, context, listKey, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-item) {
-    const errors = [];
-    const fieldErrors = {};
-    const addValidationError = (fieldKey) => (msg) => {
-        errors.push(msg);
-        fieldErrors[fieldKey] = msg;
-    };
-    for (const [fieldKey, fieldConfig] of Object.entries(fields)) {
-        // Support both 'validate' (new) and 'validateInput' (deprecated) for backwards compatibility
-        const validateHook = fieldConfig.hooks?.validate ?? fieldConfig.hooks?.validateInput;
-        if (!validateHook)
-            continue;
-        // Execute field hook
-        // Type assertion is safe here because hooks are typed correctly in field definitions
-        if (operation === 'delete') {
-            await validateHook({
-                listKey,
-                fieldKey,
-                operation: 'delete',
-                item,
-                context,
-                addValidationError: addValidationError(fieldKey),
-            });
-        }
-        else if (operation === 'create') {
-            await validateHook({
-                listKey,
-                fieldKey,
-                operation: 'create',
-                inputData,
-                item: undefined,
-                resolvedData,
-                context,
-                addValidationError: addValidationError(fieldKey),
-            });
-        }
-        else {
-            // operation === 'update'
-            await validateHook({
-                listKey,
-                fieldKey,
-                operation: 'update',
-                inputData,
-                item,
-                resolvedData,
-                context,
-                addValidationError: addValidationError(fieldKey),
-            });
-        }
-    }
-    if (errors.length > 0) {
-        throw new ValidationError(errors, fieldErrors);
-    }
-}
-/**
- * Execute field-level beforeOperation hooks (side effects only)
- * Allows fields to perform side effects before database write
- */
-async function executeFieldBeforeOperationHooks(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-inputData, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-resolvedData, fields, operation, context, listKey, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-item) {
-    for (const [fieldKey, fieldConfig] of Object.entries(fields)) {
-        // Skip if no hooks defined
-        if (!fieldConfig.hooks?.beforeOperation)
-            continue;
-        // Skip if field not in data (for create/update)
-        if (operation !== 'delete' && !(fieldKey in resolvedData))
-            continue;
-        // Execute field hook (side effects only, no return value used)
-        // Type assertion is safe here because hooks are typed correctly in field definitions
-        if (operation === 'delete') {
-            await fieldConfig.hooks.beforeOperation({
-                listKey,
-                fieldKey,
-                operation: 'delete',
-                item,
-                context,
-            });
-        }
-        else if (operation === 'create') {
-            await fieldConfig.hooks.beforeOperation({
-                listKey,
-                fieldKey,
-                operation: 'create',
-                inputData,
-                resolvedData,
-                context,
-            });
-        }
-        else {
-            // operation === 'update'
-            await fieldConfig.hooks.beforeOperation({
-                listKey,
-                fieldKey,
-                operation: 'update',
-                inputData,
-                item,
-                resolvedData,
-                context,
-            });
-        }
-    }
-}
-/**
- * Execute field-level afterOperation hooks (side effects only)
- * Allows fields to perform side effects after database operations
- */
-async function executeFieldAfterOperationHooks(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-item, inputData, resolvedData, fields, operation, context, listKey, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-originalItem) {
-    for (const [fieldKey, fieldConfig] of Object.entries(fields)) {
-        // Skip if no hooks defined
-        if (!fieldConfig.hooks?.afterOperation)
-            continue;
-        // Execute field hook (side effects only, no return value used)
-        if (operation === 'delete') {
-            await fieldConfig.hooks.afterOperation({
-                listKey,
-                fieldKey,
-                operation: 'delete',
-                originalItem,
-                context,
-            });
-        }
-        else if (operation === 'create') {
-            await fieldConfig.hooks.afterOperation({
-                listKey,
-                fieldKey,
-                operation: 'create',
-                inputData,
-                item,
-                resolvedData,
-                context,
-            });
-        }
-        else {
-            // operation === 'update'
-            await fieldConfig.hooks.afterOperation({
-                listKey,
-                fieldKey,
-                operation: 'update',
-                inputData,
-                originalItem,
-                item,
-                resolvedData,
-                context,
-            });
-        }
-    }
-}
+import { runWritePipeline, createWriteStrategy, updateWriteStrategy, deleteWriteStrategy, } from './write-pipeline.js';
 /**
  * Check if a list is configured as a singleton
  */
@@ -339,7 +136,7 @@ export function getContext(config, prisma, session, storage, _isSudo = false) {
             findMany: findManyOp,
             create: createOp,
             update: updateOp,
-            delete: createDelete(listName, listConfig, prisma, context),
+            delete: createDelete(listName, listConfig, prisma, context, config),
             count: createCount(listName, listConfig, prisma, context),
             createMany: createCreateMany(listName, listConfig, prisma, context, config, createOp),
             updateMany: createUpdateMany(listName, listConfig, prisma, context, config, findManyOp, updateOp),
@@ -591,100 +388,18 @@ listConfig, prisma, context, config) {
 function createCreate(listName, 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 listConfig, prisma, context, config) {
+    // Thin adapter over the Write Pipeline: pick the create strategy, run the
+    // canonical secured write sequence, return its result.
     return async (args) => {
-        // 0. Check singleton constraint (enforce even in sudo mode)
-        if (isSingletonList(listConfig)) {
-            // Access Prisma model dynamically - required because model names are generated at runtime
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const model = prisma[getDbKey(listName)];
-            const existingCount = await model.count();
-            if (existingCount > 0) {
-                throw new ValidationError([`Cannot create: ${listName} is a singleton list with an existing record`], {});
-            }
-        }
-        // 1. Check create access (skip if sudo mode)
-        if (!context._isSudo) {
-            const createAccess = listConfig.access?.operation?.create;
-            const accessResult = await checkAccess(createAccess, {
-                session: context.session,
-                context,
-            });
-            if (accessResult === false) {
-                return null;
-            }
-        }
-        // 2. Execute list-level resolveInput hook
-        let resolvedData = await executeResolveInput(listConfig.hooks, {
-            listKey: listName,
-            operation: 'create',
-            inputData: args.data,
-            resolvedData: args.data,
-            item: undefined,
+        return runWritePipeline({
+            listName,
+            listConfig,
+            prisma,
             context,
-        });
-        // 2.5. Execute field-level resolveInput hooks (e.g., hash passwords)
-        resolvedData = await executeFieldResolveInputHooks(args.data, resolvedData, listConfig.fields, 'create', context, listName);
-        // 3. Execute list-level validate hook
-        await executeValidate(listConfig.hooks, {
-            listKey: listName,
-            operation: 'create',
+            config,
             inputData: args.data,
-            resolvedData,
-            item: undefined,
-            context,
+            strategy: createWriteStrategy(listName, listConfig, context),
         });
-        // 3.5. Execute field-level validate hooks
-        await executeFieldValidateHooks(args.data, resolvedData, listConfig.fields, 'create', context, listName);
-        // 4. Field validation (isRequired, length, etc.)
-        const validation = validateFieldRules(resolvedData, listConfig.fields, 'create');
-        if (validation.errors.length > 0) {
-            throw new ValidationError(validation.errors, validation.fieldErrors);
-        }
-        // 5. Filter writable fields (field-level access control, skip if sudo mode)
-        const filteredData = await filterWritableFields(resolvedData, listConfig.fields, 'create', {
-            session: context.session,
-            context: { ...context, _isSudo: context._isSudo },
-            inputData: args.data,
-        });
-        // 5.5. Process nested relationship operations
-        const data = await processNestedOperations(filteredData, listConfig.fields, config, { ...context, prisma }, 'create');
-        // 6. Execute field-level beforeOperation hooks (side effects only)
-        await executeFieldBeforeOperationHooks(args.data, resolvedData, listConfig.fields, 'create', context, listName);
-        // 7. Execute list-level beforeOperation hook
-        await executeBeforeOperation(listConfig.hooks, {
-            listKey: listName,
-            operation: 'create',
-            inputData: args.data,
-            resolvedData,
-            context,
-        });
-        // 8. Execute database create
-        // Access Prisma model dynamically - required because model names are generated at runtime
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const model = prisma[getDbKey(listName)];
-        // Singleton lists use Int @id with value always 1 (matching Keystone 6 behaviour)
-        const createData = isSingletonList(listConfig) ? { id: 1, ...data } : data;
-        const item = await model.create({
-            data: createData,
-        });
-        // 9. Execute list-level afterOperation hook
-        await executeAfterOperation(listConfig.hooks, {
-            listKey: listName,
-            operation: 'create',
-            inputData: args.data,
-            item,
-            resolvedData,
-            context,
-        });
-        // 10. Execute field-level afterOperation hooks (side effects only)
-        await executeFieldAfterOperationHooks(item, args.data, resolvedData, listConfig.fields, 'create', context, listName, undefined);
-        // 11. Filter readable fields and apply resolveOutput hooks (including nested relationships)
-        // Pass sudo flag through context to skip field-level access checks
-        const filtered = await filterReadableFields(item, listConfig.fields, {
-            session: context.session,
-            context: { ...context, _isSudo: context._isSudo },
-        }, config, 0, listName);
-        return filtered;
     };
 }
 /**
@@ -711,109 +426,18 @@ createFn) {
 function createUpdate(listName, 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
 listConfig, prisma, context, config) {
+    // Thin adapter over the Write Pipeline: pick the update strategy, run the
+    // canonical secured write sequence, return its result.
     return async (args) => {
-        // 1. Fetch the item to pass to access control and hooks
-        // Access Prisma model dynamically - required because model names are generated at runtime
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const model = prisma[getDbKey(listName)];
-        const item = await model.findUnique({
-            where: args.where,
-        });
-        if (!item) {
-            return null;
-        }
-        // 2. Check update access (skip if sudo mode)
-        if (!context._isSudo) {
-            const updateAccess = listConfig.access?.operation?.update;
-            const accessResult = await checkAccess(updateAccess, {
-                session: context.session,
-                item,
-                context,
-            });
-            if (accessResult === false) {
-                return null;
-            }
-            // If access returns a filter, check if item matches
-            if (typeof accessResult === 'object') {
-                const matchesFilter = await model.findFirst({
-                    where: mergeFilters(args.where, accessResult),
-                });
-                if (!matchesFilter) {
-                    return null;
-                }
-            }
-        }
-        // 3. Execute list-level resolveInput hook
-        let resolvedData = await executeResolveInput(listConfig.hooks, {
-            listKey: listName,
-            operation: 'update',
-            inputData: args.data,
-            resolvedData: args.data,
-            item,
+        return runWritePipeline({
+            listName,
+            listConfig,
+            prisma,
             context,
-        });
-        // 3.5. Execute field-level resolveInput hooks (e.g., hash passwords)
-        resolvedData = await executeFieldResolveInputHooks(args.data, resolvedData, listConfig.fields, 'update', context, listName, item);
-        // 4. Execute list-level validate hook
-        await executeValidate(listConfig.hooks, {
-            listKey: listName,
-            operation: 'update',
+            config,
             inputData: args.data,
-            resolvedData,
-            item,
-            context,
+            strategy: updateWriteStrategy(listConfig, context, args.where),
         });
-        // 4.5. Execute field-level validate hooks
-        await executeFieldValidateHooks(args.data, resolvedData, listConfig.fields, 'update', context, listName, item);
-        // 5. Field validation (isRequired, length, etc.)
-        const validation = validateFieldRules(resolvedData, listConfig.fields, 'update');
-        if (validation.errors.length > 0) {
-            throw new ValidationError(validation.errors, validation.fieldErrors);
-        }
-        // 6. Filter writable fields (field-level access control, skip if sudo mode)
-        const filteredData = await filterWritableFields(resolvedData, listConfig.fields, 'update', {
-            session: context.session,
-            item,
-            context: { ...context, _isSudo: context._isSudo },
-            inputData: args.data,
-        });
-        // 6.5. Process nested relationship operations
-        const data = await processNestedOperations(filteredData, listConfig.fields, config, { ...context, prisma }, 'update');
-        // 7. Execute field-level beforeOperation hooks (side effects only)
-        await executeFieldBeforeOperationHooks(args.data, resolvedData, listConfig.fields, 'update', context, listName, item);
-        // 8. Execute list-level beforeOperation hook
-        await executeBeforeOperation(listConfig.hooks, {
-            listKey: listName,
-            operation: 'update',
-            inputData: args.data,
-            item,
-            resolvedData,
-            context,
-        });
-        // 9. Execute database update
-        const updated = await model.update({
-            where: args.where,
-            data,
-        });
-        // 10. Execute list-level afterOperation hook
-        await executeAfterOperation(listConfig.hooks, {
-            listKey: listName,
-            operation: 'update',
-            inputData: args.data,
-            originalItem: item, // item is the original item before the update
-            item: updated,
-            resolvedData,
-            context,
-        });
-        // 11. Execute field-level afterOperation hooks (side effects only)
-        await executeFieldAfterOperationHooks(updated, args.data, resolvedData, listConfig.fields, 'update', context, listName, item);
-        // 12. Filter readable fields and apply resolveOutput hooks (including nested relationships)
-        // Pass sudo flag through context to skip field-level access checks
-        const filtered = await filterReadableFields(updated, listConfig.fields, {
-            session: context.session,
-            context: { ...context, _isSudo: context._isSudo },
-        }, config, 0, listName);
-        return filtered;
     };
 }
 /**
@@ -844,75 +468,19 @@ updateFn) {
  */
 function createDelete(listName, 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
-listConfig, prisma, context) {
+listConfig, prisma, context, config) {
+    // Thin adapter over the Write Pipeline: pick the delete strategy, run the
+    // canonical secured write sequence, return its result.
     return async (args) => {
-        // 0. Check singleton constraint (enforce even in sudo mode)
-        if (isSingletonList(listConfig)) {
-            throw new ValidationError([`Cannot delete: ${listName} is a singleton list`], {});
-        }
-        // 1. Fetch the item to pass to access control and hooks
-        // Access Prisma model dynamically - required because model names are generated at runtime
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const model = prisma[getDbKey(listName)];
-        const item = await model.findUnique({
-            where: args.where,
-        });
-        if (!item) {
-            return null;
-        }
-        // 2. Check delete access (skip if sudo mode)
-        if (!context._isSudo) {
-            const deleteAccess = listConfig.access?.operation?.delete;
-            const accessResult = await checkAccess(deleteAccess, {
-                session: context.session,
-                item,
-                context,
-            });
-            if (accessResult === false) {
-                return null;
-            }
-            // If access returns a filter, check if item matches
-            if (typeof accessResult === 'object') {
-                const matchesFilter = await model.findFirst({
-                    where: mergeFilters(args.where, accessResult),
-                });
-                if (!matchesFilter) {
-                    return null;
-                }
-            }
-        }
-        // 3. Execute list-level validate hook
-        await executeValidate(listConfig.hooks, {
-            listKey: listName,
-            operation: 'delete',
-            item,
-            context,
-        });
-        // 3.5. Execute field-level validate hooks
-        await executeFieldValidateHooks(undefined, undefined, listConfig.fields, 'delete', context, listName, item);
-        // 4. Execute field-level beforeOperation hooks (side effects only)
-        await executeFieldBeforeOperationHooks({}, {}, listConfig.fields, 'delete', context, listName, item);
-        // 5. Execute list-level beforeOperation hook
-        await executeBeforeOperation(listConfig.hooks, {
-            listKey: listName,
-            operation: 'delete',
-            item,
-            context,
-        });
-        // 6. Execute database delete
-        const deleted = await model.delete({
-            where: args.where,
-        });
-        // 7. Execute list-level afterOperation hook
-        await executeAfterOperation(listConfig.hooks, {
-            listKey: listName,
-            operation: 'delete',
-            originalItem: item, // item is the original item before deletion
+        return runWritePipeline({
+            listName,
+            listConfig,
+            prisma,
             context,
+            config,
+            inputData: undefined,
+            strategy: deleteWriteStrategy(listName, listConfig, context, args.where),
         });
-        // 8. Execute field-level afterOperation hooks (side effects only)
-        await executeFieldAfterOperationHooks(deleted, undefined, undefined, listConfig.fields, 'delete', context, listName, item);
-        return deleted;
     };
 }
 /**