@opensaas/stack-core 0.25.0 → 0.27.0

package/dist/utils/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAMzC;;;;;OAKG;IACG,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItD;;;OAGG;IACH,QAAQ,IAAI,MAAM;IAIlB;;;OAGG;IACH,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAO1C;;;OAGG;IACH,MAAM,IAAI,MAAM;IAIhB;;;OAGG;IACH,OAAO,IAAI,MAAM;CAGlB"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,MAAM,EAIxC;IAED;;;;;OAKG;IACG,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErD;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAEjB;IAED;;;OAGG;IACH,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzC;IAED;;;OAGG;IACH,MAAM,IAAI,MAAM,CAEf;IAED;;;OAGG;IACH,OAAO,IAAI,MAAM,CAEhB;CACF"}

package/dist/utils/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAE7B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,aAAqB,mBAAmB;IAExC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,cAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4CAA4C;QAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3C,uEAAuE;IACvE,uCAAuC;IACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAE7B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,UAAU,GAAW,mBAAmB;IAExC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,cAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4CAA4C;QAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3C,uEAAuE;IACvE,uCAAuC;IACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACI,IAAI;IAAjC,YAA6B,IAAY;oBAAZ,IAAI;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}

package/dist/validation/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/validation/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAyC,EACzC,YAAiC,QAAQ;IAEzC,MAAM,KAAK,GAAiC,EAAE,CAAA;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,wDAAwD;QACxD,+DAA+D;QAC/D,IACE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,WAAW,CAAC,IAAI,KAAK,cAAc;YACnC,WAAW,CAAC,OAAO,EACnB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,mCAAmC;QACnC,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACnE,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;QACvC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,YAAyC,EACzC,YAAiC,QAAQ;IAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAErC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAA;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/validation/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAyC,EACzC,SAAS,GAAwB,QAAQ;IAEzC,MAAM,KAAK,GAAiC,EAAE,CAAA;IAE9C,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,wDAAwD;QACxD,+DAA+D;QAC/D,IACE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,WAAW,CAAC,IAAI,KAAK,cAAc;YACnC,WAAW,CAAC,OAAO,EACnB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,mCAAmC;QACnC,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7B,KAAK,CAAC,SAAS,CAAC,GAAG,WAAW,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QACnE,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAA;QACvC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,YAAyC,EACzC,SAAS,GAAwB,QAAQ;IAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAErC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAA;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-core",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Core stack for OpenSaas - schema definition, access control, and runtime utilities",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,10 +57,11 @@
   },
   "devDependencies": {
     "@prisma/client": "^7.8.0",
-    "@types/node": "^25.9.1",
-    "@vitest/coverage-v8": "^4.0.18",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "@types/node": "^26.1.1",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "@vitest/coverage-v8": "^4.1.10",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "^4.1.10"
   },
   "scripts": {
     "build": "tsc",

package/src/access/access-filter.ts

@@ -251,3 +251,57 @@ export function mergeIncludeWithAccessControl(
 
   return merged
 }
+
+/**
+ * Remove keys that correspond to `virtual` fields from a Prisma `include`
+ * object, recursing into nested relationship includes using the related
+ * list's field configs.
+ *
+ * Virtual fields are computed in JavaScript (via `resolveOutput` in
+ * `field-visibility.ts`) and have no database column. Naming one in `include`
+ * type-checks — the generated `Include` type lists every field the config
+ * declares — but Prisma throws `Unknown field '<name>' for include statement`
+ * at runtime. This is applied as the final step on whatever `include` a read
+ * op ends up with (fragment-built, access-controlled merge, or sudo
+ * passthrough) so a virtual key never reaches the Prisma client, regardless
+ * of which path produced it. The virtual value is still computed
+ * unconditionally by `filterReadableFields`, so stripping the include key has
+ * no effect on whether the value appears in the result (#628).
+ */
+export function stripVirtualFieldsFromInclude(
+  include: Record<string, unknown> | undefined,
+  fieldConfigs: Record<string, FieldConfig>,
+  config: OpenSaasConfig,
+): Record<string, unknown> | undefined {
+  if (!include) return include
+
+  const result: Record<string, unknown> = {}
+
+  for (const [key, value] of Object.entries(include)) {
+    const fieldConfig = fieldConfigs[key]
+
+    // Virtual fields have no database column — drop them from the include.
+    if (fieldConfig?.virtual) continue
+
+    const isDeclaredRelationship =
+      fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && !!fieldConfig.ref
+    const entry = asEntryObject(value)
+
+    if (isDeclaredRelationship && entry?.include) {
+      const relatedConfig = getRelatedListConfig(fieldConfig.ref as string, config)
+      if (relatedConfig) {
+        const nestedInclude = stripVirtualFieldsFromInclude(
+          entry.include,
+          relatedConfig.listConfig.fields,
+          config,
+        )
+        result[key] = { ...(value as Record<string, unknown>), include: nestedInclude }
+        continue
+      }
+    }
+
+    result[key] = value
+  }
+
+  return result
+}

package/src/access/index.ts

@@ -22,6 +22,10 @@ export {
 // Canonical field-level access evaluation (shared by read and write paths).
 export { checkFieldAccess, filterWritableFields } from './field-access.js'
 // Phase 1 — Access Filter (pre-query row/relation scoping).
-export { buildIncludeWithAccessControl, mergeIncludeWithAccessControl } from './access-filter.js'
+export {
+  buildIncludeWithAccessControl,
+  mergeIncludeWithAccessControl,
+  stripVirtualFieldsFromInclude,
+} from './access-filter.js'
 // Phase 2 — Field Visibility (post-query field stripping + resolveOutput).
 export { filterReadableFields } from './field-visibility.js'

package/src/config/label.ts

@@ -0,0 +1,58 @@
+import type { ListConfig } from './types.js'
+
+/**
+ * Resolve the field name that represents a list's rows as a single label —
+ * the projection half of the label seam. `getItemLabel` reads exactly the
+ * field this returns, so the field chosen for projection can never drift
+ * from the field used for rendering.
+ *
+ * Fallback order: configured `ui.labelField` → `name` → `title` → `id`
+ * (first field that exists on the list).
+ *
+ * @throws if `ui.labelField` is set but does not reference a declared,
+ * non-relationship field on the list.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+export function getLabelFieldName(listConfig: ListConfig<any>): string {
+  const configured = listConfig.ui?.labelField
+
+  if (configured !== undefined) {
+    const field = listConfig.fields[configured]
+    if (!field) {
+      throw new Error(
+        `ui.labelField "${configured}" does not reference a field declared on this list.`,
+      )
+    }
+    if (field.type === 'relationship') {
+      throw new Error(
+        `ui.labelField "${configured}" must reference a scalar field, not a relationship.`,
+      )
+    }
+    return configured
+  }
+
+  if ('name' in listConfig.fields) return 'name'
+  if ('title' in listConfig.fields) return 'title'
+  return 'id'
+}
+
+/**
+ * Resolve the display label for a single row — the render half of the label
+ * seam. Reads the field `getLabelFieldName` resolves, falling back to `id`
+ * when that field is missing from the row (e.g. stripped by field-level
+ * access).
+ */
+export function getItemLabel(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  item: Record<string, unknown>,
+): string {
+  const fieldName = getLabelFieldName(listConfig)
+  const value = Object.prototype.hasOwnProperty.call(item, fieldName) ? item[fieldName] : undefined
+
+  if (value === undefined || value === null) {
+    return String(item.id)
+  }
+
+  return String(value)
+}

package/src/config/types.ts

@@ -5,14 +5,7 @@ import type { z } from 'zod'
  * Field configuration types
  */
 export type FieldType =
-  | 'text'
-  | 'integer'
-  | 'checkbox'
-  | 'timestamp'
-  | 'password'
-  | 'select'
-  | 'relationship'
-  | string // Allow custom field types from third-party packages
+  'text' | 'integer' | 'checkbox' | 'timestamp' | 'password' | 'select' | 'relationship' | string // Allow custom field types from third-party packages
 
 /**
  * Field-level hook argument types (exported for user annotations)
@@ -1711,11 +1704,11 @@ export type ListConfig<TTypeInfo extends TypeInfo> = {
 /**
  * List-level UI configuration for the admin interface.
  *
- * Mirrors Keystone's `ui` block on a list. Only the list-view defaults
- * (column selection/order and default sort) are supported today; other
- * Keystone concerns (`label`, `labelField`, `description`) are intentionally
- * deferred as they cover different concerns (navigation text and
- * relationship-picker labels rather than list-view defaults).
+ * Mirrors Keystone's `ui` block on a list. List-view defaults (column
+ * selection/order and default sort) and the label field are supported
+ * today; other Keystone concerns (`label`, `description`) are intentionally
+ * deferred as they cover navigation text rather than list-view or
+ * row-labelling defaults.
  */
 export type ListUIConfig = {
   /**
@@ -1723,6 +1716,20 @@ export type ListUIConfig = {
    * Keystone's `ui.listView`.
    */
   listView?: ListViewUIConfig
+  /**
+   * The field used to represent a row as a single label — in relationship
+   * cells, dropdown options, and page headings. Must reference a declared,
+   * non-relationship field on this list.
+   *
+   * When omitted, resolves via `getLabelFieldName`'s fallback order: `name`
+   * → `title` → `id` (first field that exists on the list).
+   *
+   * @example
+   * ```typescript
+   * ui: { labelField: 'email' }
+   * ```
+   */
+  labelField?: string
 }
 
 /**

package/src/context/apply-defaults.ts

@@ -0,0 +1,79 @@
+import type { FieldConfig } from '../config/types.js'
+
+/**
+ * Apply field `defaultValue`s to omitted inputs on CREATE — the runtime half of
+ * the resolve-then-validate ordering (Keystone 6 parity, issue #615).
+ *
+ * A field's `defaultValue` is otherwise only realised as a Prisma `@default(...)`
+ * applied by the database at write time, which is AFTER the write pipeline's
+ * validation phase has already run. That ordering means a required-with-default
+ * field (e.g. `select({ validation: { isRequired: true }, defaultValue: 'X' })`)
+ * fails `isRequired` validation on an omitted input even though a default exists.
+ *
+ * This helper closes that gap: in the resolve phase (after `resolveInput` hooks,
+ * before validation) it fills `resolvedData[field]` with the field's
+ * `defaultValue` ONLY when the field was OMITTED (value is `undefined`). It is a
+ * SINGLE shared mechanism used by both the top-level create path (Hook Pipeline)
+ * and the nested-relation create path.
+ *
+ * Guard rails (each acceptance-criteria-driven):
+ *   - CREATE only. Update never injects defaults for omitted fields (the caller
+ *     only invokes this for `operation === 'create'`).
+ *   - Explicitly-provided values are preserved. A key present in `resolvedData`
+ *     — INCLUDING an explicit `null` — is left untouched; only `undefined`
+ *     (omitted) keys are filled.
+ *   - Virtual, system (`id`/`createdAt`/`updatedAt`) and relationship fields are
+ *     skipped — they have no scalar `defaultValue` to inject and relationships
+ *     carry connect/create payloads rather than literal defaults.
+ *   - The timestamp `{ kind: 'now' }` sentinel is NOT injected: it is not a
+ *     literal value but a request for the DB-level `@default(now())`, which still
+ *     applies at write time. Injecting the sentinel object would corrupt the
+ *     payload. (A concrete `Date` default is a real literal and IS injected.)
+ *
+ * The function mutates and returns `resolvedData` (consistent with the other
+ * resolve-phase helpers that thread `resolvedData` through the pipeline).
+ */
+export function applyCreateDefaults(
+  resolvedData: Record<string, unknown>,
+  fieldConfigs: Record<string, FieldConfig>,
+): Record<string, unknown> {
+  for (const [fieldKey, fieldConfig] of Object.entries(fieldConfigs)) {
+    // Skip virtual fields — not stored in the database.
+    if (fieldConfig.virtual) continue
+
+    // Skip system fields — always managed by the framework/DB.
+    if (fieldKey === 'id' || fieldKey === 'createdAt' || fieldKey === 'updatedAt') continue
+
+    // Skip relationships — they carry connect/create payloads, not literal defaults.
+    if (fieldConfig.type === 'relationship') continue
+
+    // No declared default → nothing to inject.
+    if (!('defaultValue' in fieldConfig) || fieldConfig.defaultValue === undefined) continue
+
+    // Only fill OMITTED keys. An explicitly-provided value (including explicit
+    // `null`) is preserved and must not be overwritten by the default.
+    if (resolvedData[fieldKey] !== undefined) continue
+
+    const defaultValue = fieldConfig.defaultValue
+
+    // The timestamp `{ kind: 'now' }` sentinel is a DB-level `@default(now())`
+    // request, not a literal — leave it for Prisma to apply at write time.
+    if (isNowSentinel(defaultValue)) continue
+
+    resolvedData[fieldKey] = defaultValue
+  }
+
+  return resolvedData
+}
+
+/**
+ * Detect the timestamp `{ kind: 'now' }` default sentinel.
+ */
+function isNowSentinel(value: unknown): boolean {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'kind' in value &&
+    (value as { kind: unknown }).kind === 'now'
+  )
+}

package/src/context/hook-pipeline.ts

@@ -8,6 +8,7 @@ import {
   validateFieldRules,
   ValidationError,
 } from '../hooks/index.js'
+import { applyCreateDefaults } from './apply-defaults.js'
 
 /**
  * Hook Pipeline — the single module that runs the transform+validate span of a
@@ -109,6 +110,16 @@ async function runHookPipeline(args: HookPipelineArgs): Promise<HookPipelineResu
     item,
   )
 
+  // ── Phase 1.75: apply field defaults to omitted inputs (CREATE only) ───────
+  // Resolve-then-validate (Keystone parity, #615): a field declaring a
+  // `defaultValue` is filled into `resolvedData` here — AFTER resolveInput hooks
+  // and BEFORE validation — but only when the field was OMITTED, so a
+  // required-with-default field passes `isRequired` instead of failing it.
+  // Update is untouched (no default injection on update).
+  if (operation === 'create') {
+    resolvedData = applyCreateDefaults(resolvedData, listConfig.fields)
+  }
+
   // ── Phase 2: list-level validate ──────────────────────────────────────────
   await executeValidate(
     listConfig.hooks,

package/src/context/index.ts

@@ -6,11 +6,13 @@ import {
   filterReadableFields,
   buildIncludeWithAccessControl,
   mergeIncludeWithAccessControl,
+  stripVirtualFieldsFromInclude,
 } from '../access/index.js'
 import { ValidationError, DatabaseError } from '../hooks/index.js'
 import { getDbKey } from '../lib/case-utils.js'
 import type { PrismaClientLike } from '../access/types.js'
 import { buildInclude, pickFields, isFragment } from '../query/index.js'
+import { getRelationshipOptions } from '../query/relationship-options.js'
 import {
   runWritePipeline,
   createWriteStrategy,
@@ -22,6 +24,14 @@ export type ServerActionProps =
   | { listKey: string; action: 'create'; data: Record<string, unknown> }
   | { listKey: string; action: 'update'; id: string; data: Record<string, unknown> }
   | { listKey: string; action: 'delete'; id: string }
+  | {
+      listKey: string
+      action: 'relationshipOptions'
+      field: string
+      search?: string
+      take?: number
+      selectedIds?: string[]
+    }
 
 /**
  * Tracks which (listName, operation) pairs have already warned about an ignored
@@ -230,6 +240,87 @@ function parsePrismaError(error: unknown, listConfig: ListConfig<any>): Error {
   return new Error('An unknown error occurred')
 }
 
+/**
+ * Database transaction isolation levels.
+ *
+ * Mirrors Prisma's `TransactionIsolationLevel`. The level passed to
+ * {@link StackContext.transaction} is forwarded to the underlying interactive
+ * transaction; provider support varies (e.g. `Serializable` is supported by
+ * PostgreSQL — required for the concurrency-sensitive capacity-gate pattern).
+ */
+export type TransactionIsolationLevel =
+  'ReadUncommitted' | 'ReadCommitted' | 'RepeatableRead' | 'Serializable' | 'Snapshot'
+
+/**
+ * Options for {@link StackContext.transaction}, forwarded verbatim to the
+ * underlying Prisma interactive transaction.
+ */
+export interface TransactionOptions {
+  /** Max ms to wait to acquire a transaction from the pool. */
+  maxWait?: number
+  /** Max ms the interactive transaction may run before timing out. */
+  timeout?: number
+  /** Isolation level for the transaction (e.g. `'Serializable'`). */
+  isolationLevel?: TransactionIsolationLevel
+}
+
+/**
+ * Minimal shape of a Prisma client that can open an interactive transaction.
+ * A Prisma transaction client (the `tx` handed to the callback) intentionally
+ * does NOT expose `$transaction`, which is how nested writes detect they are
+ * already inside a transaction and join it rather than opening another.
+ */
+interface TransactionCapable<TPrisma> {
+  $transaction?: (
+    fn: (tx: TPrisma) => Promise<unknown>,
+    options?: TransactionOptions,
+  ) => Promise<unknown>
+}
+
+/**
+ * The access-controlled context returned by {@link getContext}.
+ *
+ * Exposes the secured `db` delegate plus the session, raw `prisma`, storage,
+ * plugin services, the generic `serverAction` handler, `sudo()` (bypasses access
+ * control but still runs hooks), and `transaction()` (interactive, hook-firing
+ * transaction). All access-checked operations run their list/field hooks.
+ */
+export interface StackContext<TPrisma extends PrismaClientLike = PrismaClientLike> {
+  db: AccessControlledDB<TPrisma>
+  session: Session | null
+  prisma: TPrisma
+  storage: StorageUtils
+  plugins: Record<string, unknown>
+  serverAction: (props: ServerActionProps) => Promise<unknown>
+  /**
+   * Run `fn` inside ONE interactive transaction. The `txContext` handed to `fn`
+   * is a full {@link StackContext} whose `db.*` operations are access-checked and
+   * hook-firing (identical to this context) but persist against the transaction
+   * client, so every write in the callback is atomic — a throw anywhere rolls the
+   * whole transaction back.
+   *
+   * `options` (notably `isolationLevel`) is forwarded to the underlying Prisma
+   * transaction. Serialization failures (e.g. Prisma `P2034`) propagate to the
+   * caller rather than being swallowed, so the caller can own a retry loop. If
+   * the client cannot open an interactive transaction (e.g. a plain mock, or we
+   * are already inside a transaction), `fn` runs directly against the current
+   * client with identical hook/access semantics.
+   *
+   * Caveat: plugin runtime services (`txContext.plugins`) stay bound to the
+   * top-level (non-transaction) client — they are shared services initialised
+   * once per request. Reads through a plugin service therefore won't see this
+   * transaction's uncommitted writes, and a plugin service that WRITES would
+   * escape the transaction and survive a rollback. Use `txContext.db` (not a
+   * plugin service) for writes that must be atomic with the transaction.
+   */
+  transaction: <T>(
+    fn: (txContext: StackContext<TPrisma>) => Promise<T>,
+    options?: TransactionOptions,
+  ) => Promise<T>
+  sudo: () => StackContext<TPrisma>
+  _isSudo: boolean
+}
+
 /**
  * Create an access-controlled context
  *
@@ -247,25 +338,10 @@ export function getContext<
   session: Session | null,
   storage?: StorageUtils,
   _isSudo: boolean = false,
-): {
-  db: AccessControlledDB<TPrisma>
-  session: Session | null
-  prisma: TPrisma
-  storage: StorageUtils
-  plugins: Record<string, unknown>
-  serverAction: (props: ServerActionProps) => Promise<unknown>
-  _isSudo: boolean
-  sudo: () => {
-    db: AccessControlledDB<TPrisma>
-    session: Session | null
-    prisma: TPrisma
-    storage: StorageUtils
-    plugins: Record<string, unknown>
-    serverAction: (props: ServerActionProps) => Promise<unknown>
-    sudo: () => unknown
-    _isSudo: boolean
-  }
-} {
+  // Internal: when rebuilding the context against a transaction client, reuse the
+  // already-initialised plugin services rather than re-running plugin runtimes.
+  _sharedPlugins?: Record<string, unknown>,
+): StackContext<TPrisma> {
   // Initialize db object - will be populated with access-controlled operations
   // Type is intentionally broad to allow dynamic model access
   const db: Record<string, unknown> = {}
@@ -298,7 +374,9 @@ export function getContext<
         )
       },
     },
-    plugins: {}, // Will be populated with plugin runtime services
+    // Reuse already-initialised plugin services when rebinding to a transaction
+    // client, otherwise start empty and populate via plugin runtimes below.
+    plugins: _sharedPlugins ?? {},
     _isSudo,
     _resolveOutputCounter: { depth: 0 },
   }
@@ -306,16 +384,20 @@ export function getContext<
   // Create access-controlled operations for each list, populating `db` in place.
   populateDbDelegate(db, config, prisma, context)
 
-  // Execute plugin runtime functions and populate context.plugins
+  // Execute plugin runtime functions and populate context.plugins.
+  // Skipped when reusing shared plugins (transaction rebind) so runtimes — and
+  // any side effects they carry — run exactly once per top-level context.
   // Use _plugins (sorted by dependencies) if available, otherwise fall back to plugins array
-  const pluginsToExecute = config._plugins || config.plugins || []
-  for (const plugin of pluginsToExecute) {
-    if (plugin.runtime) {
-      try {
-        context.plugins[plugin.name] = plugin.runtime(context)
-      } catch (error) {
-        console.error(`Error executing runtime for plugin "${plugin.name}":`, error)
-        // Continue with other plugins even if one fails
+  if (!_sharedPlugins) {
+    const pluginsToExecute = config._plugins || config.plugins || []
+    for (const plugin of pluginsToExecute) {
+      if (plugin.runtime) {
+        try {
+          context.plugins[plugin.name] = plugin.runtime(context)
+        } catch (error) {
+          console.error(`Error executing runtime for plugin "${plugin.name}":`, error)
+          // Continue with other plugins even if one fails
+        }
       }
     }
   }
@@ -345,6 +427,26 @@ export function getContext<
     }
 
     try {
+      if (props.action === 'relationshipOptions') {
+        const fieldConfig = listConfig.fields[props.field] as
+          { type?: string; ref?: string } | undefined
+        if (!fieldConfig || fieldConfig.type !== 'relationship' || !fieldConfig.ref) {
+          return {
+            success: false,
+            error: `Field "${props.field}" on list "${props.listKey}" is not a relationship field`,
+          }
+        }
+
+        const relatedListKey = fieldConfig.ref.split('.')[0]
+        const options = await getRelationshipOptions(context, config, relatedListKey, {
+          search: props.search,
+          take: props.take,
+          selectedIds: props.selectedIds,
+        })
+
+        return { success: true, data: options }
+      }
+
       let result: unknown = null
 
       if (props.action === 'create') {
@@ -411,11 +513,35 @@ export function getContext<
 
   // Sudo function - creates a new context that bypasses access control
   // but still executes all hooks and validation
-  function sudo() {
+  function sudo(): StackContext<TPrisma> {
     return getContext(config, prisma, session, context.storage, true)
   }
 
-  return {
+  // Interactive, hook-firing transaction (#614). Rebinds the access-controlled
+  // context to the transaction client so every `txContext.db.*` write runs its
+  // access checks + hooks but persists inside ONE transaction (atomic). The
+  // transaction `options` (e.g. `isolationLevel`) pass through to Prisma, and a
+  // serialization failure thrown inside the callback propagates to the caller
+  // for retry (it is never converted to a silent `null`).
+  function transaction<T>(
+    fn: (txContext: StackContext<TPrisma>) => Promise<T>,
+    options?: TransactionOptions,
+  ): Promise<T> {
+    const client = prisma as unknown as TransactionCapable<TPrisma>
+    if (typeof client.$transaction !== 'function') {
+      // No interactive transaction available — either a plain client/mock or we
+      // are already inside a transaction (a Prisma tx client exposes no
+      // `$transaction`). Run directly: hook/access semantics are identical and
+      // atomicity is provided by any enclosing transaction.
+      return fn(returned)
+    }
+    return client.$transaction(
+      (tx) => fn(getContext(config, tx, session, context.storage, _isSudo, context.plugins)),
+      options,
+    ) as Promise<T>
+  }
+
+  const returned: StackContext<TPrisma> = {
     db: db as AccessControlledDB<TPrisma>,
     session,
     prisma,
@@ -423,8 +549,10 @@ export function getContext<
     plugins: context.plugins,
     serverAction,
     sudo,
+    transaction,
     _isSudo,
   }
+  return returned
 }
 
 /**
@@ -586,6 +714,13 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
         : accessControlledInclude
     }
 
+    // Virtual fields have no database column. Whichever path produced
+    // `include` (fragment, access-controlled merge, or sudo passthrough), a
+    // virtual key must never reach Prisma — it would throw "Unknown field"
+    // (#628). The virtual value is still computed unconditionally below by
+    // `filterReadableFields`, independent of what was requested here.
+    include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
+
     // Execute query with optimized includes
     // Access Prisma model dynamically - required because model names are generated at runtime
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -709,6 +844,13 @@ function createFindMany<TPrisma extends PrismaClientLike>(
         : accessControlledInclude
     }
 
+    // Virtual fields have no database column. Whichever path produced
+    // `include` (fragment, access-controlled merge, or sudo passthrough), a
+    // virtual key must never reach Prisma — it would throw "Unknown field"
+    // (#628). The virtual value is still computed unconditionally below by
+    // `filterReadableFields`, independent of what was requested here.
+    include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
+
     // Execute query with optimized includes
     // Access Prisma model dynamically - required because model names are generated at runtime
     // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/src/context/nested-operations.ts

@@ -15,6 +15,7 @@ import {
   ValidationError,
 } from '../hooks/index.js'
 import { getDbKey } from '../lib/case-utils.js'
+import { applyCreateDefaults } from './apply-defaults.js'
 
 /**
  * Nested writes (#569 / ADR-0010).
@@ -273,6 +274,12 @@ async function processNestedCreate(
         relatedListName,
       )
 
+      // 3.5 Apply field defaults to omitted inputs (resolve-then-validate, #615).
+      // Mirrors the top-level Hook Pipeline so a nested required-with-default
+      // field resolves to its default before validation instead of failing
+      // `isRequired`. Create-only; explicit values (incl. null) are preserved.
+      resolvedData = applyCreateDefaults(resolvedData, relatedListConfig.fields)
+
       // 4. Execute validate hook
       await executeValidate(relatedListConfig.hooks, {
         listKey: relatedListName,

package/src/context/write-pipeline.ts

@@ -53,8 +53,7 @@ export type WriteOperation = 'create' | 'update' | 'delete'
  *   any input phases, before-hooks, or the DB call.
  */
 export type TargetResolution =
-  | { status: 'ok'; originalItem: Record<string, unknown> | undefined }
-  | { status: 'denied' }
+  { status: 'ok'; originalItem: Record<string, unknown> | undefined } | { status: 'denied' }
 
 /**
  * Minimal dynamic Prisma model surface used by the write pipeline. Model names