@opensaas/stack-core 0.39.1 → 0.40.0

package/src/context/nested-operations.ts

@@ -1,6 +1,12 @@
 import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js'
 import type { AccessContext, FieldAccess } from '../access/types.js'
-import { checkAccess, filterWritableFields, getRelatedListConfig } from '../access/index.js'
+import {
+  checkAccess,
+  checkCreateAccess,
+  filterWritableFields,
+  getRelatedListConfig,
+  resolveSyntheticReverseRelation,
+} from '../access/index.js'
 import { checkFieldAccess } from '../access/field-access.js'
 import {
   executeResolveInput,
@@ -205,12 +211,12 @@ async function processNestedCreate(
     itemsArray.map(async (item, index) => {
       if (!context._isSudo) {
         const createAccess = relatedListConfig.access?.operation?.create
-        const accessResult = await checkAccess(createAccess, {
+        const allowed = await checkCreateAccess(relatedListName, createAccess, {
           session: context.session,
           context,
         })
 
-        if (accessResult === false) {
+        if (!allowed) {
           throw new Error('Access denied: Cannot create related item')
         }
       }
@@ -279,6 +285,8 @@ async function processNestedCreate(
           session: context.session,
           context,
           inputData: item,
+          listName: relatedListName,
+          config,
         },
       )
 
@@ -590,6 +598,8 @@ async function processNestedUpdate(
           item: originalItem,
           context,
           inputData: updateData,
+          listName: relatedListName,
+          config,
         },
       )
 
@@ -1194,27 +1204,62 @@ export async function processNestedOperations(
   const processed: Record<string, unknown> = {}
 
   for (const [fieldName, value] of Object.entries(data)) {
-    const fieldConfig = fieldConfigs[fieldName]
-
-    if (!isRelationshipField(fieldConfig) || value === null || value === undefined) {
+    if (value === null || value === undefined) {
       processed[fieldName] = value
       continue
     }
 
-    const relationshipField = fieldConfig as { type: 'relationship'; ref: string }
-    const relatedConfig = getRelatedListConfig(relationshipField.ref, config)
-    if (!relatedConfig) {
+    const fieldConfig = fieldConfigs[fieldName]
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+    let relatedListConfig: ListConfig<any>
+    let resolvedListName: string
+    let owningFieldAccess: FieldAccess | undefined
+
+    if (isRelationshipField(fieldConfig)) {
+      const relationshipField = fieldConfig as { type: 'relationship'; ref: string }
+      const relatedConfig = getRelatedListConfig(relationshipField.ref, config)
+      if (!relatedConfig) {
+        processed[fieldName] = value
+        continue
+      }
+
+      const { listName: relatedListName, listConfig } = relatedConfig
+      resolvedListName = relatedListName || findListName(listConfig, config)
+      relatedListConfig = listConfig
+      // The owning relationship field's field-level access, for the #588 gate
+      // in verifyConnectReachable.
+      owningFieldAccess = fieldConfig.access
+    } else if (!fieldConfig) {
+      // Not a field the parent's config declares — check whether it names the
+      // synthetic back-relation a list-only `ref` generates on this list
+      // (`from_<List>_<field>`, #978). Resolved, it is processed exactly like a
+      // nested write through the declared field that owns it; unresolved, it
+      // is left untouched. This is NOT solely a sudo path: a multi-column
+      // field's raw per-part columns (e.g. `m_url`/`m_size`, #789) are ALSO
+      // undeclared from this list's `fieldConfigs` perspective and reach here
+      // on every write, sudo or not — `filterWritableFields` already
+      // recognises and gates those via its own `splitColumnOwners` map before
+      // its undeclared-key branch, and this function has no such map to tell
+      // them apart from a genuinely-unrecognised key, so it must not throw
+      // here. A genuinely unrecognised key under sudo is refused instead by
+      // `filterWritableFields`'s own resolution attempt, one level up.
+      const synthetic = resolveSyntheticReverseRelation(fieldName, parentListName, config)
+      if (!synthetic) {
+        processed[fieldName] = value
+        continue
+      }
+
+      resolvedListName = synthetic.sourceListName
+      relatedListConfig = synthetic.sourceListConfig
+      // There is no parent-side field here (unlike the declared-relationship
+      // branch above) — the FK-owning field genuinely IS the one the source
+      // list declares, so its access is the owning-field gate.
+      owningFieldAccess = synthetic.sourceFieldConfig.access
+    } else {
       processed[fieldName] = value
       continue
     }
 
-    const { listName: relatedListName, listConfig: relatedListConfig } = relatedConfig
-    const resolvedListName = relatedListName || findListName(relatedListConfig, config)
-
-    // The owning relationship field's field-level access, for the #588 gate
-    // in verifyConnectReachable.
-    const owningFieldAccess = fieldConfig.access
-
     processed[fieldName] = await processFieldNestedOps(
       fieldName,
       value as Record<string, unknown>,

package/src/context/write-pipeline.ts

@@ -2,6 +2,7 @@ import type { OpenSaasConfig, ListConfig } from '../config/types.js'
 import type { AccessContext, PrismaClientLike } from '../access/types.js'
 import {
   checkAccess,
+  checkCreateAccess,
   mergeFilters,
   filterReadableFields,
   filterWritableFields,
@@ -330,6 +331,8 @@ async function runWriteInTransaction<TPrisma extends PrismaClientLike>(
     item: originalItem,
     context: { ...context, _isSudo: context._isSudo },
     inputData: input,
+    listName,
+    config,
   })
 
   // ── Phase 5.5: process nested relationship operations ───────────────────────
@@ -560,8 +563,9 @@ async function runDeletePath(args: {
  * Create strategy for {@link WriteStrategy}.
  *
  * Axis 1: checks `create` access with no existing row; a filter result
- * proceeds with no re-check (unlike update/delete). Enforces the
- * singleton-create constraint even under sudo.
+ * throws `InvalidCreateAccessResultError` rather than proceeding unchecked —
+ * create has no row to re-check a filter against, unlike update/delete
+ * (#1009). Enforces the singleton-create constraint even under sudo.
  * Axis 2: runs all input phases.
  * Axis 3: `model.create({ data })`, prepending `id: 1` for singleton lists.
  */
@@ -588,11 +592,11 @@ export function createWriteStrategy(
       }
 
       if (!context._isSudo) {
-        const accessResult = await checkAccess(listConfig.access?.operation?.create, {
+        const allowed = await checkCreateAccess(listName, listConfig.access?.operation?.create, {
           session: context.session,
           context,
         })
-        if (accessResult === false) {
+        if (!allowed) {
           return { status: 'denied' }
         }
       }

package/src/fields/index.ts

@@ -229,9 +229,16 @@ export function integer<
         modifiers += ` @map("${db.map}")`
       }
 
+      // Unique modifier — non-unique index routes through `index` below,
+      // same as `text()`'s getPrismaType.
+      if (options?.isIndexed === 'unique') {
+        modifiers += ' @unique'
+      }
+
       return {
         type: 'Int',
         modifiers: modifiers.trimStart() || undefined,
+        index: options?.isIndexed === true ? true : undefined,
       }
     },
     getTypeScriptType: () => {
@@ -657,9 +664,16 @@ export function timestamp<
         modifiers += ` @map("${db.map}")`
       }
 
+      // Unique modifier — non-unique index routes through `index` below,
+      // same as `text()`'s getPrismaType.
+      if (options?.isIndexed === 'unique') {
+        modifiers += ' @unique'
+      }
+
       return {
         type: 'DateTime',
         modifiers: modifiers.trimStart() || undefined,
+        index: options?.isIndexed === true ? true : undefined,
       }
     },
     getTypeScriptType: () => {
@@ -930,7 +944,10 @@ function formatCalendarDay(value: unknown): string | null | undefined {
  * ```
  *
  * **Important Notes:**
- * - Password fields are excluded from read operations by default in access control
+ * - Password field values are redacted to `{ isSet: boolean }` on serialization
+ *   (`JSON.stringify`, the admin UI). Field-level `read` access is not denied by
+ *   default — configure `access.field.read` if the raw value should never reach
+ *   `context.db` callers at all.
  * - Always use the `compare()` method to verify passwords - never compare strings directly
  * - The password field value has type `HashedPassword` which extends string with compare()
  * - Empty strings and undefined values are skipped (not hashed) to allow partial updates
@@ -955,6 +972,13 @@ export function password<TTypeInfo extends import('../config/types.js').TypeInfo
     },
     ui: {
       ...options?.ui,
+      // Excluded from default admin table columns (issue #1018) — declared
+      // via the flag rather than matched by field type/name, so an app can
+      // still opt a real password field back in with `ui.listView.defaultColumn: true`.
+      listView: {
+        defaultColumn: false,
+        ...options?.ui?.listView,
+      },
       valueForClientSerialization: ({ value }) => ({ isSet: !!value }),
     },
     hooks: {
@@ -1129,10 +1153,17 @@ export function select<
           modifiers += ` @map("${options.db.map}")`
         }
 
+        // Unique modifier — non-unique index routes through `index` below,
+        // same as `text()`'s getPrismaType.
+        if (options.isIndexed === 'unique') {
+          modifiers += ' @unique'
+        }
+
         return {
           type: enumName,
           modifiers: modifiers || undefined,
           enumValues: options.options.map((opt) => opt.value),
+          index: options.isIndexed === true ? true : undefined,
         }
       }
 
@@ -1146,9 +1177,14 @@ export function select<
         modifiers += ` @map("${options.db.map}")`
       }
 
+      if (options.isIndexed === 'unique') {
+        modifiers += ' @unique'
+      }
+
       return {
         type: 'String',
         modifiers: modifiers || undefined,
+        index: options.isIndexed === true ? true : undefined,
       }
     },
     getTypeScriptType: () => {
@@ -1366,6 +1402,18 @@ function computeManyToManyRelationName(
   return undefined
 }
 
+/**
+ * The name Prisma generation synthesizes for the back-relation a list-only
+ * `ref` (`ref: 'ListName'`, no target field) creates on its target model —
+ * Prisma requires an opposite field, and the config never declares one.
+ * Exported so runtime nested-write resolution (`resolveSyntheticReverseRelation`
+ * in `access/engine.ts`) can recognise the same name rather than re-deriving
+ * the format by string parsing (#978).
+ */
+export function getSyntheticFieldName(listKey: string, fieldName: string): string {
+  return `from_${listKey}_${fieldName}`
+}
+
 function getPrismaRelation(
   field: RelationshipField,
   fieldName: string,
@@ -1378,7 +1426,7 @@ function getPrismaRelation(
   // Synthetic back-relation for list-only refs (Prisma requires an opposite field)
   let backRelation: PrismaRelationResult['backRelation']
   if (!targetField) {
-    const syntheticFieldName = `from_${listKey}_${fieldName}`
+    const syntheticFieldName = getSyntheticFieldName(listKey, fieldName)
     const relationName = field.db?.relationName ?? `${listKey}_${fieldName}`
     backRelation = {
       targetList,
@@ -1494,10 +1542,12 @@ export function relationship<
       )
     }
 
-    if (refParts.length === 1) {
+    if (refParts.length === 1 && typeof options.db.foreignKey === 'boolean') {
       throw new Error(
-        'db.foreignKey can only be used on bidirectional relationships (ref: "ListName.fieldName"). ' +
-          'List-only refs (ref: "ListName") always create foreign keys automatically.',
+        'db.foreignKey cannot be a boolean on list-only refs (ref: "ListName"). ' +
+          'List-only refs always create foreign keys automatically, so the ownership sense of ' +
+          'db.foreignKey is meaningless here. Use db.foreignKey: { map: "columnName" } to rename ' +
+          'the foreign key column instead.',
       )
     }
   }

package/src/fields/relationship-foreign-key.test.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest'
+import { relationship } from './index.js'
+
+describe('relationship field builder: db.foreignKey validation', () => {
+  it('rejects a boolean db.foreignKey on a list-only ref', () => {
+    expect(() => relationship({ ref: 'User', db: { foreignKey: true } })).toThrow(
+      'db.foreignKey cannot be a boolean on list-only refs',
+    )
+    expect(() => relationship({ ref: 'User', db: { foreignKey: false } })).toThrow(
+      'db.foreignKey cannot be a boolean on list-only refs',
+    )
+  })
+
+  it('allows an object db.foreignKey (map) on a list-only ref', () => {
+    expect(() =>
+      relationship({ ref: 'User', db: { foreignKey: { map: 'user_id' } } }),
+    ).not.toThrow()
+  })
+
+  it('still allows a boolean db.foreignKey on a bidirectional ref', () => {
+    expect(() => relationship({ ref: 'User.posts', db: { foreignKey: true } })).not.toThrow()
+  })
+
+  it('still rejects db.foreignKey on a many relationship regardless of ref shape', () => {
+    expect(() =>
+      relationship({ ref: 'User', many: true, db: { foreignKey: { map: 'user_id' } } }),
+    ).toThrow('db.foreignKey can only be used on single relationships')
+  })
+})

package/src/index.ts

@@ -50,7 +50,7 @@ export type {
 } from './context/index.js'
 
 // Naming utilities (documented public helpers; used for URLs and db keys)
-export { getDbKey, getUrlKey, getListKeyFromUrl } from './lib/case-utils.js'
+export { getDbKey, getUrlKey, getListKeyFromUrl, resolveListKeyFromUrl } from './lib/case-utils.js'
 
 // Label seam — resolves the field that represents a row as a single label
 // (projection) and reads it off a row (render). Used by the admin UI for
@@ -64,6 +64,14 @@ export { resolveNavCounts, isListQueryStaticallyDenied } from './config/nav-coun
 // Validation error surfaced by write operations
 export { ValidationError } from './hooks/index.js'
 
+// Resolves which columns (and, where recoverable, which named constraint) a
+// caught P2002 unique-constraint violation hit — normalising Prisma 7 driver
+// adapters' undocumented error shape to the documented `meta.target` one, so
+// a caller of `context.db.*` never needs to reach into adapter internals
+// (see issue #979).
+export { uniqueConstraintOf } from './lib/prisma-errors.js'
+export type { UniqueConstraintInfo } from './lib/prisma-errors.js'
+
 // Thrown by a read when a caller-supplied `include` names a relation nested
 // deeper than the Access Filter can scope (see ADR-0022). Distinct from
 // `ValidationError` — this is the engine refusing to return unscoped data, not
@@ -83,6 +91,14 @@ export { ResolveOutputCycleError } from './access/index.js'
 // validation failure.
 export { InvalidFieldAccessResultError } from './access/index.js'
 
+// Thrown by the write pipeline's create strategy and by the nested-create
+// path when operation-level `create` access returns anything other than a
+// strict boolean (see #1009, ADR-0022, and ADR-0030). A filter — the shape
+// `query`/`update`/`delete` legitimately return — cannot be honoured on
+// create: there is no existing row and no way to test it against input data,
+// so it is refused loudly rather than silently treated as a full allow.
+export { InvalidCreateAccessResultError } from './access/index.js'
+
 // Thrown by a read when a caller-supplied `where` filters on a relation whose
 // related list denies operation-level `query` access outright (see #916 and
 // ADR-0022). Distinct from `ValidationError` for the same reason as

package/src/lib/case-utils.test.ts

@@ -7,6 +7,7 @@ import {
   getDbKey,
   getUrlKey,
   getListKeyFromUrl,
+  resolveListKeyFromUrl,
 } from './case-utils.js'
 
 describe('Case Conversion Utilities', () => {
@@ -97,6 +98,37 @@ describe('Case Conversion Utilities', () => {
     })
   })
 
+  describe('resolveListKeyFromUrl', () => {
+    it('resolves a PascalCase list key from its URL segment', () => {
+      expect(resolveListKeyFromUrl('blog-post', ['User', 'BlogPost'])).toBe('BlogPost')
+    })
+
+    it('resolves a camelCase list key (e.g. a derived plugin list) from its URL segment', () => {
+      // getListKeyFromUrl('oauth-application') would reconstruct 'OauthApplication',
+      // which isn't a key in this list — that's the bug this resolver fixes.
+      expect(resolveListKeyFromUrl('oauth-application', ['oauthApplication'])).toBe(
+        'oauthApplication',
+      )
+    })
+
+    it('returns undefined for a URL segment matching no list key', () => {
+      expect(resolveListKeyFromUrl('does-not-exist', ['User', 'BlogPost'])).toBeUndefined()
+    })
+
+    it('throws when two distinct list keys produce the same URL segment', () => {
+      expect(() =>
+        resolveListKeyFromUrl('oauth-application', ['oauthApplication', 'OauthApplication']),
+      ).toThrow(/Ambiguous list URL/)
+    })
+
+    it('is derived from getUrlKey, so it cannot drift from how URLs are built', () => {
+      const listKeys = ['User', 'AuthUser', 'BlogPost', 'oauthApplication']
+      for (const listKey of listKeys) {
+        expect(resolveListKeyFromUrl(getUrlKey(listKey), listKeys)).toBe(listKey)
+      }
+    })
+  })
+
   describe('Round-trip conversions', () => {
     it('should maintain consistency: PascalCase -> kebab-case -> PascalCase', () => {
       const original = 'BlogPost'

package/src/lib/case-utils.ts

@@ -40,3 +40,29 @@ export function getUrlKey(listKey: string): string {
 export function getListKeyFromUrl(urlSegment: string): string {
   return kebabToPascal(urlSegment)
 }
+
+/**
+ * Resolves a URL segment back to the list key that produced it, by checking
+ * each candidate key against `getUrlKey` — the same helper that builds the
+ * URL — rather than reconstructing a key by string transformation the way
+ * `getListKeyFromUrl` does. That reconstruction is lossy for any list key
+ * that isn't strict PascalCase (e.g. a camelCase key from a derived list),
+ * so this is the config-aware resolver route lookups should use instead.
+ *
+ * Returns `undefined` when no candidate key's URL matches — callers render
+ * their usual "not found" state rather than treating this as an error.
+ * Throws if more than one candidate key produces the same URL segment: that
+ * is a configuration error (two list keys collide once case-folded to a
+ * URL) and must be reported, not resolved by silently picking one.
+ */
+export function resolveListKeyFromUrl(urlSegment: string, listKeys: string[]): string | undefined {
+  const matches = listKeys.filter((listKey) => getUrlKey(listKey) === urlSegment)
+
+  if (matches.length > 1) {
+    throw new Error(
+      `Ambiguous list URL "${urlSegment}": list keys ${matches.map((key) => `"${key}"`).join(', ')} all resolve to this URL. Rename these lists so their URLs are unique.`,
+    )
+  }
+
+  return matches[0]
+}

package/src/lib/prisma-errors.ts

@@ -0,0 +1,86 @@
+type PrismaP2002Meta = {
+  target?: string[]
+  driverAdapterError?: {
+    cause?: {
+      originalMessage?: string
+      constraint?: { fields?: unknown[] }
+    }
+  }
+}
+
+// Postgres quotes an identifier in `constraint.fields` only when it needed
+// quoting (e.g. camelCase columns), so `"tenantId"` and `slug` are both valid
+// entries for the same array.
+function stripIdentifierQuotes(field: string): string {
+  const match = field.match(/^"(.*)"$/)
+  return match ? match[1] : field
+}
+
+export interface UniqueConstraintInfo {
+  /** Column names covered by the violated constraint, quote-stripped. */
+  fields: string[]
+  /**
+   * The violated constraint's name, when recoverable from the error.
+   *
+   * Known limit: this is parsed out of Postgres' English-locale error text
+   * (`cause.originalMessage`) — the adapter exposes no structured field for
+   * it. A server running under a non-English `lc_messages` locale will not
+   * match, leaving this `undefined` while `fields` (structured data) still
+   * resolves correctly.
+   */
+  constraintName?: string
+}
+
+/**
+ * Resolve which columns — and, where recoverable, which named constraint — a
+ * Prisma `P2002` unique-constraint violation hit.
+ *
+ * Prisma documents `error.meta.target` for this. Under Prisma 7 driver
+ * adapters (verified against `@prisma/adapter-pg` and PGlite; see issue #979)
+ * that field is `undefined` instead — the same information sits at
+ * `error.meta.driverAdapterError.cause`, with the constraint name only
+ * recoverable as free text inside `cause.originalMessage`. This normalises
+ * both shapes to one stable result so callers never need to reach into that
+ * adapter-specific structure themselves.
+ *
+ * A derived constraint name is truncated by Postgres at its 63-character
+ * identifier limit, and one row can violate two unique indexes at once (with
+ * Postgres reporting whichever it checked first) — an index an application
+ * means to branch on should be named explicitly, and a caller may still need
+ * to re-read the colliding row to fully disambiguate.
+ *
+ * Returns `undefined` when `error` isn't a `P2002` with any recoverable
+ * column or constraint information — never throws, since the adapter error
+ * shape is untrusted and every level of it may be absent.
+ */
+export function uniqueConstraintOf(error: unknown): UniqueConstraintInfo | undefined {
+  if (
+    !error ||
+    typeof error !== 'object' ||
+    !('code' in error) ||
+    (error as { code?: unknown }).code !== 'P2002'
+  ) {
+    return undefined
+  }
+
+  const meta = (error as { meta?: PrismaP2002Meta }).meta
+
+  if (meta?.target && Array.isArray(meta.target)) {
+    return { fields: meta.target }
+  }
+
+  const cause = meta?.driverAdapterError?.cause
+  const rawFields = cause?.constraint?.fields
+  const fields = Array.isArray(rawFields)
+    ? rawFields.filter((f): f is string => typeof f === 'string').map(stripIdentifierQuotes)
+    : []
+
+  const constraintName =
+    typeof cause?.originalMessage === 'string'
+      ? cause.originalMessage.match(/unique constraint "([^"]+)"/)?.[1]
+      : undefined
+
+  if (fields.length === 0 && !constraintName) return undefined
+
+  return constraintName ? { fields, constraintName } : { fields }
+}

package/src/mcp/constants.ts

@@ -0,0 +1,24 @@
+/**
+ * How many levels deep the `query` tool's `fields` projection schema
+ * enumerates a list's relations: the root list's own fields (level 1), and
+ * for each relation, the related list's own scalar/virtual fields (level 2).
+ * A relation named at level 2 is not itself selectable further — reaching
+ * past it is a second tool call, the same round-trip a bare read already
+ * assumes. Deliberately shallower than `READ_INCLUDE_MAX_DEPTH` (5) so no
+ * schema-conforming request can reach the engine's depth refusal.
+ *
+ * Fixed (not configurable) by design (ADR-0033, ADR-0026's position on the
+ * depth cap) — `generateFieldsProjectionSchema` and `resolveFieldsProjection`
+ * (`projection.ts`) are hand-written for exactly this depth (one loop over
+ * the root list's fields, one nested loop over a relation's), not driven by
+ * this value at runtime. It exists so the depth has one documented, tested
+ * name rather than an unexplained "2" in two places; changing it is a
+ * deliberate rewrite of both functions, not a config knob.
+ */
+export const MCP_FIELDS_SCHEMA_DEPTH = 2
+
+/** Row cap applied to a nested to-many relation in a `fields` projection when the caller omits `take`. */
+export const MCP_NESTED_TAKE_DEFAULT = 5
+
+/** Hard ceiling a nested to-many relation's `take` is clamped to, regardless of what the caller requests. */
+export const MCP_NESTED_TAKE_MAX = 50

package/src/mcp/field-schema.ts

@@ -0,0 +1,84 @@
+import type { FieldConfig } from '../config/types.js'
+
+/** JSON Schema for one field's own value — shared by the create/update `data` schema and the `query` tool's `fields` projection schema. */
+export function fieldToJsonSchema(
+  fieldName: string,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Field configs have varying structures
+  fieldConfig: any,
+): Record<string, unknown> {
+  const baseSchema: Record<string, unknown> = {}
+
+  switch (fieldConfig.type) {
+    case 'text':
+    case 'password':
+      baseSchema.type = 'string'
+      if (fieldConfig.validation?.length) {
+        if (fieldConfig.validation.length.min)
+          baseSchema.minLength = fieldConfig.validation.length.min
+        if (fieldConfig.validation.length.max)
+          baseSchema.maxLength = fieldConfig.validation.length.max
+      }
+      break
+    case 'integer':
+      baseSchema.type = 'number'
+      if (fieldConfig.validation?.min !== undefined) baseSchema.minimum = fieldConfig.validation.min
+      if (fieldConfig.validation?.max !== undefined) baseSchema.maximum = fieldConfig.validation.max
+      break
+    case 'checkbox':
+      baseSchema.type = 'boolean'
+      break
+    case 'timestamp':
+      baseSchema.type = 'string'
+      baseSchema.format = 'date-time'
+      break
+    case 'select':
+      baseSchema.type = 'string'
+      if (fieldConfig.options) {
+        baseSchema.enum = fieldConfig.options.map((opt: { value: string }) => opt.value)
+      }
+      break
+    case 'relationship':
+      baseSchema.type = 'object'
+      baseSchema.properties = {
+        connect: {
+          type: 'object',
+          properties: {
+            id: { type: 'string' },
+          },
+        },
+      }
+      break
+    default:
+      baseSchema.type = 'string'
+  }
+
+  return baseSchema
+}
+
+export function generateFieldSchemas(
+  fields: Record<string, FieldConfig>,
+  operation: 'create' | 'update',
+): {
+  properties: Record<string, unknown>
+  required: string[]
+} {
+  const properties: Record<string, unknown> = {}
+  const required: string[] = []
+
+  for (const [fieldName, fieldConfig] of Object.entries(fields)) {
+    if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) continue
+
+    properties[fieldName] = fieldToJsonSchema(fieldName, fieldConfig)
+
+    if (
+      operation === 'create' &&
+      'validation' in fieldConfig &&
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Validation property varies by field type
+      (fieldConfig.validation as any)?.isRequired
+    ) {
+      required.push(fieldName)
+    }
+  }
+
+  return { properties, required }
+}