# Data flow — keystonejs/keystone

> Canonical page: https://codevetter.com/unpack/keystone/data-flow

# Data flow — keystonejs/keystone

Scanned commit 1a8f2b7fae39ea5dac415745caea4f766109e669 (2026-09-14). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Configuration is transformed into executable schemas, generated artifacts, and browser metadata before requests arrive. Each HTTP GraphQL request receives a context containing its decoded session and shared Prisma access. Persistence flows through input resolvers and hooks, while browser preferences, session stores, asset stores, and telemetry use separate state boundaries.
- config() adds IDs and list defaults; initialise-lists invokes each field factory with provider, list metadata, listKey, and fieldKey, then resolves its access, hooks, GraphQL enablement, and UI metadata. — [packages/core/src/schema.ts#L64-104](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/schema.ts#L64-L104) [packages/core/src/lib/core/initialise-lists.ts#L765-805](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/initialise-lists.ts#L765-L805)
- buildArtifacts() prints the public GraphQL schema and formatted Prisma schema; generateArtifacts() writes both, while generateTypes() derives TypeScript from the internal schema and initialized lists. — [packages/core/src/artifacts.ts#L58-98](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/artifacts.ts#L58-L98)
- Express parses GraphQL JSON and multipart uploads, then calls context.withRequest(req,res); withRequest() invokes the session strategy and returns a context bound to the resulting session. — [packages/core/src/lib/express.ts#L88-101](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/express.ts#L88-L101) [packages/core/src/lib/context/createContext.ts#L100-120](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/context/createContext.ts#L100-L120)
- Admin creation serializes field-controller state into mutation variables; server input resolution applies field hooks before list hooks, validates resolved data, transforms it for Prisma, and returns before/after callbacks. — [packages/core/src/admin-ui/utils/useCreateItem.ts#L80-105](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/admin-ui/utils/useCreateItem.ts#L80-L105) [packages/core/src/lib/core/mutations/index.ts#L526-576](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L526-L576) [packages/core/src/lib/core/mutations/index.ts#L579-620](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/mutations/index.ts#L579-L620)
- findMany() enforces maxTake, operation access, list filters, field filtering/cursor permissions, and ordering permissions before a Prisma query; access filters are combined with caller filters using AND. — [packages/core/src/lib/core/queries/resolvers.ts#L66-77](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/queries/resolvers.ts#L66-L77) [packages/core/src/lib/core/queries/resolvers.ts#L127-161](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/queries/resolvers.ts#L127-L161) [packages/core/src/lib/core/queries/resolvers.ts#L194-208](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/core/queries/resolvers.ts#L194-L208)
- File input streams are counted and passed to storage.put(); Prisma receives filename/filesize metadata, output URLs delegate to storage.url(), and changed or deleted assets are removed through afterOperation. — [packages/core/src/fields/types/file/index.ts#L65-81](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L65-L81) [packages/core/src/fields/types/file/index.ts#L95-127](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L95-L127) [packages/core/src/fields/types/file/index.ts#L139-148](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/fields/types/file/index.ts#L139-L148)
- Stateless sessions seal data into HTTP-only cookies and return the sealed token; storedSessions instead persists data under a random ID and seals that ID, then resolves or deletes it through the configured store. — [packages/core/src/session.ts#L116-135](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/session.ts#L116-L135) [packages/core/src/session.ts#L138-167](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/session.ts#L138-L167)
- Development telemetry POSTs package versions, database provider, list/field counts, OS, and Node major version; Conf records per-project/device send dates, with CI, production, opt-out, and environment-variable exclusions. — [packages/core/src/lib/telemetry.ts#L205-225](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/telemetry.ts#L205-L225) [packages/core/src/lib/telemetry.ts#L238-273](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/telemetry.ts#L238-L273) [packages/core/src/lib/telemetry.ts#L276-317](https://github.com/keystonejs/keystone/blob/1a8f2b7fae39ea5dac415745caea4f766109e669/packages/core/src/lib/telemetry.ts#L276-L317)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)