# Behavior traces — keystonejs/keystone

> Canonical page: https://codevetter.com/unpack/keystone/behavior-traces

# Behavior traces — keystonejs/keystone

Scanned commit 1a8f2b7fae39ea5dac415745caea4f766109e669 (2026-09-14). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The inspected flows connect CLI startup, browser item creation, password login, and asset persistence to their actual execution functions. Branches such as disabled UI, failed authentication, denied queries, and frozen builds change the sequence materially. These are source-derived walkthroughs, not executed traces.
- Production startup follows cli('start') → start() → importBuiltKeystoneConfiguration() → createSystem() → importBuiltPrismaModule() → getKeystone() → connect() → createExpressServer(); --no-server returns before client/server initialization. — [packages/core/src/scripts/cli.ts#L86-88](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/cli.ts#L86-L88) [packages/core/src/scripts/start.ts#L19-31](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/start.ts#L19-L31)
- After API startup, enabled UI follows createNextServer() → prepare() → createAdminUIMiddlewareWithNextApp(); PORT and HOST override listen options before httpServer.listen(). — [packages/core/src/scripts/start.ts#L33-54](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/start.ts#L33-L54)
- CreateItemPage submits through useCreateItem.create(); invalid fields stop submission, otherwise serialization feeds tryCreateItem(), success clears navigation prevention and emits a toast, then the page navigates to /{list.path}/{id}. — [packages/core/src/admin-ui/pages/CreateItemPage/index.tsx#L34-43](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/admin-ui/pages/CreateItemPage/index.tsx#L34-L43) [packages/core/src/admin-ui/utils/useCreateItem.ts#L80-122](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/admin-ui/utils/useCreateItem.ts#L80-L122)
- The generated create resolver calls createOne() → getOperationAccess() → createSingle__() → list/field access enforcement → resolveInputForCreateOrUpdate() → beforeOperation() → Prisma.create() → afterOperation(); singleton creation forces id=1. — [packages/core/src/lib/core/mutations/index.ts#L75-102](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L75-L102) [packages/core/src/lib/core/mutations/index.ts#L273-286](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L273-L286) [packages/core/src/lib/core/mutations/index.ts#L692-704](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L692-L704)
- SigninPage submits identity/secret to the generated authentication mutation; its resolver performs sudo().db.findOne(), simulated hashing for missing password data, KDF comparison, and sessionStrategy.start(), returning failure if the token is empty. — [packages/auth/src/pages/SigninPage.tsx#L34-70](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/auth/src/pages/SigninPage.tsx#L34-L70) [packages/auth/src/gql/getBaseAuthSchema.ts#L85-118](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/auth/src/gql/getBaseAuthSchema.ts#L85-L118)
- The next authenticated request follows withRequest() → wrapped session get() → stateless getToken()/Iron.unseal() → sudo().query.findOne(sessionData) → withSession(); missing tokens, missing users, or failed hydration leave the request unauthenticated. — [packages/core/src/lib/context/createContext.ts#L105-116](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/context/createContext.ts#L105-L116) [packages/core/src/session.ts#L62-98](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/session.ts#L62-L98) [packages/auth/src/index.ts#L108-132](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/auth/src/index.ts#L108-L132)
- A file create resolves the Upload, opens its stream, transforms the filename, and awaits storage.put() before Prisma persistence; replacement cleanup runs after the update and deletes the old key only when it differs. — [packages/core/src/fields/types/file/index.ts#L65-81](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L65-L81) [packages/core/src/fields/types/file/index.ts#L98-109](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L98-L109) [packages/core/src/lib/core/mutations/index.ts#L164-182](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L164-L182)
- build() bundles configuration, ensures Prisma config, then validates schemas when frozen or generates them otherwise; it generates types/client, bundles Prisma, and optionally generates/builds Next UI. postinstall selects frozen=true and ui=false. — [packages/core/src/scripts/build.ts#L28-59](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/build.ts#L28-L59) [packages/core/src/scripts/cli.ts#L94-98](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/scripts/cli.ts#L94-L98)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)