tina4-nodejs 3.13.138 → 3.13.140

package/packages/orm/src/adapters/firebird.ts

@@ -12,7 +12,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * Install: npm install node-firebird
  * URL format: firebird://user:pass@host:port/path/to/database.fdb
  */
-import { firebirdDialect, buildInsert, buildSetClause, buildWhereClause, quoteIdentifierWith } from "./sqlDialect.js";
+import { firebirdDialect, quoteIdentifierWith } from "./sqlDialect.js";
+import { buildDelete, buildInsertRow, buildInsertRows, buildUpdate } from "./sqlCrud.js";
 import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
 import { SQLTranslator } from "../sqlTranslator.js";
 import { connectTimeoutMillis, withConnectTimeout } from "../connectTimeout.js";
@@ -643,19 +644,15 @@ export class FirebirdAdapter implements DatabaseAdapter {
     // the batch reports affectedRows == row count and no lastInsertId (same as the
     // single-row path). See PostgresAdapter for the array-crash rationale.
     if (Array.isArray(data)) {
-      if (data.length === 0) return { success: true, affectedRows: 0 };
-      const keys = Object.keys(data[0]);
-      const sql = buildInsert(FB_DIALECT, table, keys);
-      const paramsList = data.map((row) => keys.map((k) => row[k]));
-      const result = await this.executeManyAsync(sql, paramsList);
+      const batch = buildInsertRows(FB_DIALECT, table, data);
+      if (!batch) return { success: true, affectedRows: 0 };
+      const result = await this.executeManyAsync(batch.sql, batch.paramsList);
       // The generator holds the LAST inserted id after the batch (FB-LASTID-GAP).
       const lastId = (await this.readGeneratorId(table)) ?? result.lastId;
       return { success: true, affectedRows: result.totalAffected, lastId: lastId ?? undefined };
     }
 
-    const keys = Object.keys(data);
-    const sql = buildInsert(FB_DIALECT, table, keys);
-    const values = Object.values(data);
+    const { sql, values } = buildInsertRow(FB_DIALECT, table, data);
 
     // FAIL LOUD, like fetch/execute and the other three frameworks: a bad statement
     // RAISES and never returns a falsy result. Swallowing it into {success:false}
@@ -674,29 +671,12 @@ export class FirebirdAdapter implements DatabaseAdapter {
 
   async updateAsync(table: string, data: Record<string, unknown>, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-    // Identifiers go through fbQuote, exactly like insertAsync. Firebird folds an
-    // UNQUOTED identifier to uppercase, so a conventional `CREATE TABLE probe_t`
-    // stores PROBE_T/ID — and a hand-rolled `"${k}"` emits lowercase-quoted "id",
-    // which is a DIFFERENT, non-existent column. update and delete were therefore
-    // broken on every conventionally-created Firebird table while insert worked.
-    const setClauses = buildSetClause(FB_DIALECT, Object.keys(data));
-
-    // A raw WHERE fragment + params is half the write_path contract's filter
-    // form. Without this branch Object.keys("id = ?") yields the STRING INDICES
-    // ["0","1",...] and the statement addresses columns that do not exist.
-    // Firebird already uses `?`, so the fragment needs no rewriting.
-    if (typeof filter === "string") {
-      const where = filter ? ` WHERE ${filter}` : "";
-      const affected = await this.executeReturningCount(
-        `UPDATE ${fbQuote(table)} SET ${setClauses}${where}`,
-        [...Object.values(data), ...(params ?? [])],
-      );
-      return { success: true, affectedRows: affected };
-    }
-
-    const whereClauses = buildWhereClause(FB_DIALECT, Object.keys(filter));
-    const sql = `UPDATE ${FB_DIALECT.quote(table)} SET ${setClauses} WHERE ${whereClauses}`;
-    const values = [...Object.values(data), ...Object.values(filter)];
+    // FB_DIALECT.quote is fbQuote: Firebird folds an UNQUOTED identifier to
+    // uppercase, so a conventional `CREATE TABLE probe_t` stores PROBE_T/ID and a
+    // lowercase-quoted "id" would be a different, non-existent column. The
+    // composer routes every identifier through it. Firebird uses `?` natively, so
+    // a raw string filter needs no rewrite.
+    const { sql, values } = buildUpdate(FB_DIALECT, table, data, filter, params);
 
     const affected = await this.executeReturningCount(sql, values);
     return { success: true, affectedRows: affected };
@@ -708,19 +688,8 @@ export class FirebirdAdapter implements DatabaseAdapter {
 
   async deleteAsync(table: string, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-
-    // See updateAsync: truncate() calls this with "1 = 1", which walked the
-    // string as an object — db.truncate() was broken outright.
-    if (typeof filter === "string") {
-      const where = filter ? ` WHERE ${filter}` : "";
-      const affected = await this.executeReturningCount(`DELETE FROM ${fbQuote(table)}${where}`, params ?? []);
-      return { success: true, affectedRows: affected };
-    }
-
-    // Same fbQuote policy as insert/update — see updateAsync.
-    const whereClauses = buildWhereClause(FB_DIALECT, Object.keys(filter));
-    const sql = `DELETE FROM ${FB_DIALECT.quote(table)} WHERE ${whereClauses}`;
-    const values = Object.values(filter);
+    // Same fbQuote (FB_DIALECT.quote) policy as insert/update; `?` markers native.
+    const { sql, values } = buildDelete(FB_DIALECT, table, filter, params);
 
     const affected = await this.executeReturningCount(sql, values);
     return { success: true, affectedRows: affected };

package/packages/orm/src/adapters/mssql.ts

@@ -12,7 +12,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * Install: npm install tedious
  * URL format: mssql://user:pass@host:port/database
  */
-import { ANSI_DIALECT, MSSQL_DIALECT, buildInsert, buildSetClause, buildWhereClause } from "./sqlDialect.js";
+import { ANSI_DIALECT, MSSQL_DIALECT } from "./sqlDialect.js";
+import { buildDelete, buildInsertRow, buildInsertRows, buildUpdate } from "./sqlCrud.js";
 import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
 import { SQLTranslator } from "../sqlTranslator.js";
 import { connectTimeoutMillis, driverConnectTimeoutMillis, withConnectTimeout } from "../connectTimeout.js";
@@ -360,15 +361,13 @@ export class MssqlAdapter implements DatabaseAdapter {
     // tracked for a batch — affectedRows == row count is what callers rely on).
     // See PostgresAdapter for the array-crash rationale this branch fixes.
     if (Array.isArray(data)) {
-      if (data.length === 0) return { success: true, affectedRows: 0 };
-      const keys = Object.keys(data[0]);
       // `?` placeholders — executeManyAsync -> executeAsync runs convertPlaceholders,
-      // which rewrites them to @p0, @p1, ... for tedious.
-      // The batch path binds through executeMany, which converts "?" itself.
-      const sql = buildInsert({ quote: MSSQL_DIALECT.quote, marker: ANSI_DIALECT.marker }, table, keys);
-      const paramsList = data.map((row) => keys.map((k) => row[k]));
+      // which rewrites them to @p0, @p1, ... for tedious. So the batch INSERT is
+      // built with MSSQL's bracket quoting but the ANSI `?` marker.
+      const batch = buildInsertRows({ quote: MSSQL_DIALECT.quote, marker: ANSI_DIALECT.marker }, table, data);
+      if (!batch) return { success: true, affectedRows: 0 };
       try {
-        const result = await this.executeManyAsync(sql, paramsList);
+        const result = await this.executeManyAsync(batch.sql, batch.paramsList);
         if (result.lastId !== undefined) this._lastInsertId = result.lastId;
         return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
       } catch (e) {
@@ -376,11 +375,9 @@ export class MssqlAdapter implements DatabaseAdapter {
       }
     }
 
-    const keys = Object.keys(data);
     // startAt 0: MSSQL BINDS by the marker name, so @p must start where the
     // binding loop starts. Shifting to 1 would name parameters that do not exist.
-    const sql = buildInsert(MSSQL_DIALECT, table, keys, "; SELECT SCOPE_IDENTITY() AS id", 0);
-    const values = Object.values(data);
+    const { sql, values } = buildInsertRow(MSSQL_DIALECT, table, data, "; SELECT SCOPE_IDENTITY() AS id", { startAt: 0 });
 
     try {
       const result = await this.execSqlPromise(sql, values);
@@ -406,32 +403,13 @@ export class MssqlAdapter implements DatabaseAdapter {
 
   async updateAsync(table: string, data: Record<string, unknown>, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-    const dataKeys = Object.keys(data);
-    let paramIndex = 0;
-    const setClauses = buildSetClause(MSSQL_DIALECT, dataKeys, paramIndex);
-    paramIndex += dataKeys.length;
-
-    // A raw WHERE fragment + params is half the write_path contract's filter
-    // form. Without this branch Object.keys("id = ?") yields the STRING INDICES
-    // ["0","1",...], producing `WHERE [0] = @p1 AND [1] = @p2` — SQL Server then
-    // reports an invalid column name '0'.
-    if (typeof filter === "string") {
-      const where = filter ? ` WHERE ${this.convertPlaceholders(filter, paramIndex)}` : "";
-      const sql = `UPDATE ${MSSQL_DIALECT.quote(table)} SET ${setClauses}${where}`;
-      const values = [...Object.values(data), ...(params ?? [])];
-      try {
-        const result = await this.execSqlPromise(sql, values);
-        return { success: true, affectedRows: result.rowCount };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const filterKeys = Object.keys(filter);
-    const whereClauses = buildWhereClause(MSSQL_DIALECT, filterKeys, paramIndex);
-    paramIndex += filterKeys.length;
-    const sql = `UPDATE ${MSSQL_DIALECT.quote(table)} SET ${setClauses} WHERE ${whereClauses}`;
-    const values = [...Object.values(data), ...Object.values(filter)];
+    // @pN markers name from 0 (MSSQL binds by name); the WHERE markers continue
+    // past the SET values. A raw string filter's `?` are rewritten to @pN via
+    // convertPlaceholders at the correct start position.
+    const { sql, values } = buildUpdate(MSSQL_DIALECT, table, data, filter, params, {
+      startAt: 0,
+      convertFragment: (fragment, startAt) => this.convertPlaceholders(fragment, startAt),
+    });
 
     try {
       const result = await this.execSqlPromise(sql, values);
@@ -447,27 +425,12 @@ export class MssqlAdapter implements DatabaseAdapter {
 
   async deleteAsync(table: string, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-
-    // See updateAsync: truncate() calls this with "1 = 1", which became
-    // `WHERE [0] = @p0 AND [1] = @p1 ...` — db.truncate() was broken outright.
-    if (typeof filter === "string") {
-      const sql = filter
-        ? `DELETE FROM [${table}] WHERE ${this.bindable(filter, params)}`
-        : `DELETE FROM [${table}]`;
-      try {
-        const result = await this.execSqlPromise(sql, params ?? []);
-        return { success: true, affectedRows: result.rowCount };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const filterKeys = Object.keys(filter);
-    let paramIndex = 0;
-    const whereClauses = buildWhereClause(MSSQL_DIALECT, filterKeys, paramIndex);
-    paramIndex += filterKeys.length;
-    const sql = `DELETE FROM ${MSSQL_DIALECT.quote(table)} WHERE ${whereClauses}`;
-    const values = Object.values(filter);
+    // bindable() rewrites a raw fragment's `?` to @pN only when params are bound
+    // (truncate() passes "1 = 1" with none). A hash filter numbers @pN from 0.
+    const { sql, values } = buildDelete(MSSQL_DIALECT, table, filter, params, {
+      startAt: 0,
+      convertFragment: (fragment) => this.bindable(fragment, params),
+    });
 
     try {
       const result = await this.execSqlPromise(sql, values);

package/packages/orm/src/adapters/mysql.ts

@@ -12,7 +12,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * Install: npm install mysql2
  * URL format: mysql://user:pass@host:port/database
  */
-import { MYSQL_DIALECT, buildInsert, buildSetClause, buildWhereClause, quoteIdentifierWith } from "./sqlDialect.js";
+import { MYSQL_DIALECT, quoteIdentifierWith } from "./sqlDialect.js";
+import { buildDelete, buildInsertRow, buildInsertRows, buildUpdate } from "./sqlCrud.js";
 import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
 import { SQLTranslator } from "../sqlTranslator.js";
 import { connectTarget, connectTimeoutMillis, driverConnectTimeoutMillis, withConnectTimeout } from "../connectTimeout.js";
@@ -263,12 +264,10 @@ export class MysqlAdapter implements DatabaseAdapter {
     // executeManyAsync (ONE connection). See PostgresAdapter for the rationale;
     // without this branch a list crashed/mis-built SQL via Object.keys() on the array.
     if (Array.isArray(data)) {
-      if (data.length === 0) return { success: true, affectedRows: 0 };
-      const keys = Object.keys(data[0]);
-      const sql = buildInsert(MYSQL_DIALECT, table, keys);
-      const paramsList = data.map((row) => keys.map((k) => row[k]));
+      const batch = buildInsertRows(MYSQL_DIALECT, table, data);
+      if (!batch) return { success: true, affectedRows: 0 };
       try {
-        const result = await this.executeManyAsync(sql, paramsList);
+        const result = await this.executeManyAsync(batch.sql, batch.paramsList);
         if (result.lastId !== undefined) this._lastInsertId = result.lastId;
         return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
       } catch (e) {
@@ -276,9 +275,7 @@ export class MysqlAdapter implements DatabaseAdapter {
       }
     }
 
-    const keys = Object.keys(data);
-    const sql = buildInsert(MYSQL_DIALECT, table, keys);
-    const values = Object.values(data);
+    const { sql, values } = buildInsertRow(MYSQL_DIALECT, table, data);
 
     try {
       const result = await this.queryPromise(sql, values);
@@ -299,28 +296,9 @@ export class MysqlAdapter implements DatabaseAdapter {
 
   async updateAsync(table: string, data: Record<string, unknown>, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-    const setClauses = buildSetClause(MYSQL_DIALECT, Object.keys(data));
-
-    // A raw WHERE fragment + params is half the write_path contract's filter
-    // form. Without this branch Object.keys("id = ?") yields the STRING INDICES
-    // ["0","1",...], producing `WHERE \`0\` = ? AND \`1\` = ?` — MySQL then
-    // reports an unknown column '0'. MySQL already uses `?`, so the fragment
-    // needs no placeholder rewriting.
-    if (typeof filter === "string") {
-      const where = filter ? ` WHERE ${filter}` : "";
-      const sql = `UPDATE ${MYSQL_DIALECT.quote(table)} SET ${setClauses}${where}`;
-      const values = [...Object.values(data), ...(params ?? [])];
-      try {
-        const result = await this.queryPromise(sql, values);
-        return { success: true, affectedRows: result.affectedRows ?? 0 };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const whereClauses = buildWhereClause(MYSQL_DIALECT, Object.keys(filter));
-    const sql = `UPDATE ${MYSQL_DIALECT.quote(table)} SET ${setClauses} WHERE ${whereClauses}`;
-    const values = [...Object.values(data), ...Object.values(filter)];
+    // MySQL uses `?` markers natively, so a raw string filter needs no rewrite;
+    // the string vs hash branch and value assembly are the shared composer's.
+    const { sql, values } = buildUpdate(MYSQL_DIALECT, table, data, filter, params);
 
     try {
       const result = await this.queryPromise(sql, values);
@@ -336,24 +314,7 @@ export class MysqlAdapter implements DatabaseAdapter {
 
   async deleteAsync(table: string, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-
-    // See updateAsync: truncate() calls this with "1 = 1", which became
-    // `WHERE \`0\` = ? AND \`1\` = ? ...` — db.truncate() was broken outright.
-    if (typeof filter === "string") {
-      const sql = filter
-        ? `DELETE FROM \`${table}\` WHERE ${filter}`
-        : `DELETE FROM \`${table}\``;
-      try {
-        const result = await this.queryPromise(sql, params ?? []);
-        return { success: true, affectedRows: result.affectedRows ?? 0 };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const whereClauses = buildWhereClause(MYSQL_DIALECT, Object.keys(filter));
-    const sql = `DELETE FROM ${MYSQL_DIALECT.quote(table)} WHERE ${whereClauses}`;
-    const values = Object.values(filter);
+    const { sql, values } = buildDelete(MYSQL_DIALECT, table, filter, params);
 
     try {
       const result = await this.queryPromise(sql, values);

package/packages/orm/src/adapters/odbc.ts

@@ -16,7 +16,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * The connection string after stripping the "odbc:///" prefix is passed
  * directly to odbc.connect(), so any valid ODBC connection string works.
  */
-import { ANSI_DIALECT, buildInsert, buildSetClause, buildWhereClause } from "./sqlDialect.js";
+import { ANSI_DIALECT } from "./sqlDialect.js";
+import { buildDelete, buildInsertRow, buildInsertRows, buildUpdate } from "./sqlCrud.js";
 import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
 import { createRequire } from "node:module";
 import { SQLTranslator } from "../sqlTranslator.js";
@@ -303,17 +304,13 @@ export class OdbcAdapter implements DatabaseAdapter {
     // Python master. The single-object path used to run Object.keys() over the
     // array here -> ["0","1",...], a broken INSERT, so batch insert never worked.
     if (Array.isArray(data)) {
-      if (data.length === 0) return { success: true, affectedRows: 0 };
-      const keys = Object.keys(data[0]);
-      const sql = buildInsert(ANSI_DIALECT, table, keys);
-      const paramsList = data.map((row) => keys.map((k) => (row as Record<string, unknown>)[k]));
-      const { totalAffected } = await this.executeManyAsync(sql, paramsList);
+      const batch = buildInsertRows(ANSI_DIALECT, table, data);
+      if (!batch) return { success: true, affectedRows: 0 };
+      const { totalAffected } = await this.executeManyAsync(batch.sql, batch.paramsList);
       return { success: true, affectedRows: totalAffected };
     }
 
-    const keys = Object.keys(data);
-    const sql = buildInsert(ANSI_DIALECT, table, keys);
-    const values = Object.values(data);
+    const { sql, values } = buildInsertRow(ANSI_DIALECT, table, data);
 
     try {
       const result = await this.connection.query(sql, values);
@@ -331,23 +328,10 @@ export class OdbcAdapter implements DatabaseAdapter {
     params?: unknown[],
   ): Promise<DatabaseResult> {
     this.ensureConnected();
-    const setClauses = buildSetClause(ANSI_DIALECT, Object.keys(data));
-
-    let whereSql: string;
-    let values: unknown[];
-    if (typeof filter === "string") {
-      // The string form ("id = ?" + params). Without this branch Object.keys()
-      // walked the STRING -> ["0","1",...], building a nonsense WHERE clause -
-      // the exact bug the pg/mysql/mssql adapters guard against. params was also
-      // dropped entirely (the method never took it), so a parameterised string
-      // filter could not bind at all.
-      whereSql = filter;
-      values = [...Object.values(data), ...(params ?? [])];
-    } else {
-      whereSql = buildWhereClause(ANSI_DIALECT, Object.keys(filter));
-      values = [...Object.values(data), ...Object.values(filter)];
-    }
-    const sql = `UPDATE ${ANSI_DIALECT.quote(table)} SET ${setClauses} WHERE ${whereSql}`;
+    // ODBC (the lab DSN is PostgreSQL) still passes `?` markers through — the
+    // driver binds them positionally — so no fragment rewrite. The string vs
+    // hash branch and value assembly are the shared composer's.
+    const { sql, values } = buildUpdate(ANSI_DIALECT, table, data, filter, params);
 
     try {
       const result = await this.connection.query(sql, values);
@@ -374,22 +358,7 @@ export class OdbcAdapter implements DatabaseAdapter {
       return { success: true, affectedRows: totalAffected };
     }
 
-    if (typeof filter === "string") {
-      // The string form binds its own params (was dropped: query ran with []).
-      const sql = filter
-        ? `DELETE FROM "${table}" WHERE ${filter}`
-        : `DELETE FROM "${table}"`;
-      try {
-        const result = await this.connection.query(sql, params ?? []);
-        return { success: true, affectedRows: this.affectedCount(result) };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const whereClauses = buildWhereClause(ANSI_DIALECT, Object.keys(filter));
-    const sql = `DELETE FROM ${ANSI_DIALECT.quote(table)} WHERE ${whereClauses}`;
-    const values = Object.values(filter);
+    const { sql, values } = buildDelete(ANSI_DIALECT, table, filter, params);
 
     try {
       const result = await this.connection.query(sql, values);

package/packages/orm/src/adapters/postgres.ts

@@ -12,7 +12,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * Install: npm install pg @types/pg
  * URL format: postgresql://user:pass@host:port/database
  */
-import { ANSI_DIALECT, POSTGRES_DIALECT, buildInsert, buildSetClause, buildWhereClause } from "./sqlDialect.js";
+import { ANSI_DIALECT, POSTGRES_DIALECT } from "./sqlDialect.js";
+import { buildDelete, buildInsertRow, buildInsertRows, buildUpdate } from "./sqlCrud.js";
 import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
 import { SQLTranslator } from "../sqlTranslator.js";
 import { connectTarget, connectTimeoutMillis, driverConnectTimeoutMillis, withConnectTimeout } from "../connectTimeout.js";
@@ -315,13 +316,11 @@ export class PostgresAdapter implements DatabaseAdapter {
     // — producing garbage SQL (mirrors the Python `'list' has no attribute keys`
     // crash this fix addresses).
     if (Array.isArray(data)) {
-      if (data.length === 0) return { success: true, affectedRows: 0 };
-      const keys = Object.keys(data[0]);
       // The batch path binds through executeManyAsync, which converts "?" itself.
-      const sql = buildInsert(ANSI_DIALECT, table, keys);
-      const paramsList = data.map((row) => keys.map((k) => row[k]));
+      const batch = buildInsertRows(ANSI_DIALECT, table, data);
+      if (!batch) return { success: true, affectedRows: 0 };
       try {
-        const result = await this.executeManyAsync(sql, paramsList);
+        const result = await this.executeManyAsync(batch.sql, batch.paramsList);
         if (result.lastId !== undefined) this._lastInsertId = result.lastId;
         return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
       } catch (e) {
@@ -329,9 +328,7 @@ export class PostgresAdapter implements DatabaseAdapter {
       }
     }
 
-    const keys = Object.keys(data);
-    const sql = buildInsert(POSTGRES_DIALECT, table, keys, " RETURNING *");
-    const values = Object.values(data);
+    const { sql, values } = buildInsertRow(POSTGRES_DIALECT, table, data, " RETURNING *");
 
     try {
       const result = await this.client!.query(sql, values);
@@ -354,34 +351,13 @@ export class PostgresAdapter implements DatabaseAdapter {
 
   async updateAsync(table: string, data: Record<string, unknown>, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-    const dataKeys = Object.keys(data);
-    let paramIndex = 1;
-    const setClauses = buildSetClause(POSTGRES_DIALECT, dataKeys, paramIndex);
-    paramIndex += dataKeys.length;
-
-    // A raw WHERE fragment + params is half the write_path contract's filter
-    // form ("a string filter with params works the same as a hash filter").
-    // Without this branch Object.keys("id = ?") yields the STRING INDICES
-    // ["0","1",...], producing `WHERE "0" = $2 AND "1" = $3` — the engine then
-    // reports `column "0" does not exist`. sqlite/mongodb/odbc already carried
-    // this branch; postgres/mysql/mssql/firebird did not.
-    if (typeof filter === "string") {
-      const where = filter ? ` WHERE ${this.convertPlaceholders(filter, paramIndex)}` : "";
-      const sql = `UPDATE ${POSTGRES_DIALECT.quote(table)} SET ${setClauses}${where}`;
-      const values = [...Object.values(data), ...(params ?? [])];
-      try {
-        const result = await this.client!.query(sql, values);
-        return { success: true, affectedRows: result.rowCount ?? 0 };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const filterKeys = Object.keys(filter);
-    const whereClauses = buildWhereClause(POSTGRES_DIALECT, filterKeys, paramIndex);
-    paramIndex += filterKeys.length;
-    const sql = `UPDATE ${POSTGRES_DIALECT.quote(table)} SET ${setClauses} WHERE ${whereClauses}`;
-    const values = [...Object.values(data), ...Object.values(filter)];
+    // The composer numbers the SET markers from $1 and continues the WHERE
+    // markers past them; a raw string filter's `?` are rewritten to $N via
+    // convertPlaceholders (identity would leave `?`, which pg rejects).
+    const { sql, values } = buildUpdate(POSTGRES_DIALECT, table, data, filter, params, {
+      startAt: 1,
+      convertFragment: (fragment, startAt) => this.convertPlaceholders(fragment, startAt),
+    });
 
     try {
       const result = await this.client!.query(sql, values);
@@ -397,29 +373,13 @@ export class PostgresAdapter implements DatabaseAdapter {
 
   async deleteAsync(table: string, filter: Record<string, unknown> | string, params?: unknown[]): Promise<DatabaseResult> {
     this.ensureConnected();
-
-    // See updateAsync: a raw WHERE fragment must not be walked as an object.
-    // truncate() calls this with "1 = 1", which became `WHERE "0" = $1 AND
-    // "1" = $2 ...` and failed with `column "0" does not exist` — db.truncate()
-    // was broken outright on PostgreSQL.
-    if (typeof filter === "string") {
-      const sql = filter
-        ? `DELETE FROM "${table}" WHERE ${this.bindable(filter, params)}`
-        : `DELETE FROM "${table}"`;
-      try {
-        const result = await this.client!.query(sql, params ?? []);
-        return { success: true, affectedRows: result.rowCount ?? 0 };
-      } catch (e) {
-        return { success: false, affectedRows: 0, error: (e as Error).message };
-      }
-    }
-
-    const filterKeys = Object.keys(filter);
-    let paramIndex = 1;
-    const whereClauses = buildWhereClause(POSTGRES_DIALECT, filterKeys, paramIndex);
-    paramIndex += filterKeys.length;
-    const sql = `DELETE FROM ${POSTGRES_DIALECT.quote(table)} WHERE ${whereClauses}`;
-    const values = Object.values(filter);
+    // bindable() rewrites a raw fragment's `?` to $N only when params are bound
+    // (truncate() passes "1 = 1" with none — no rewrite, no error). A hash filter
+    // numbers its `$N` from 1.
+    const { sql, values } = buildDelete(POSTGRES_DIALECT, table, filter, params, {
+      startAt: 1,
+      convertFragment: (fragment) => this.bindable(fragment, params),
+    });
 
     try {
       const result = await this.client!.query(sql, values);