tina4-nodejs 3.13.98 → 3.13.100

package/packages/orm/src/adapters/firebird.ts

@@ -201,10 +201,51 @@ export class FirebirdAdapter implements DatabaseAdapter {
   private db: any = null;
   private transaction: any = null;
   private _lastInsertId: number | bigint | null = null;
+  /** Resolved node-firebird config, kept so a dead connection can re-attach. */
+  private fbConfig: any = null;
+
+  // Substring markers (lowercased) that identify a dead-socket Firebird error
+  // worth reconnecting for (FB-DEC-01). Idle Firebird connections die behind NAT
+  // timeouts, server-side ConnectionIdleTimeout, or Docker network rotation.
+  // MEASURED on the lab: a killed attachment raises "Connection shutdown, Killed
+  // by database administrator." Node had no reconnect path before -- this closes
+  // the parity gap with Python/PHP/Ruby.
+  private static readonly DEAD_CONN_MARKERS = [
+    "error writing data to the connection",
+    "error reading data from the connection",
+    "connection shutdown",
+    "connection lost",
+    "network error",
+    "connection is not active",
+    "broken pipe",
+  ];
+
+  /** Is this a dead-socket error worth a transparent reconnect (not a logical SQL error)? */
+  static isDeadConnection(err: unknown): boolean {
+    const message = String((err as Error)?.message ?? err ?? "").toLowerCase();
+    if (!message) return false;
+    return FirebirdAdapter.DEAD_CONN_MARKERS.some((marker) => message.includes(marker));
+  }
 
   constructor(private config: FirebirdConfig | string) {}
 
   /** Connect to Firebird. Must be called before using the adapter. */
+  /** ADR-0044 required adapter capability. */
+  getDatabaseType(): string {
+    return 'firebird';
+  }
+
+  /** ADR-0044: readable/writable native boolean. */
+  autocommit = true;
+
+  /**
+   * ADR-0044 / DBA-P02: every built-in adapter can guarantee an atomic
+   * multi-row batch by default. A test-only deployment representing one
+   * that cannot sets this false so executeMany rejects BEFORE the first
+   * write rather than risking partial durability.
+   */
+  supportsAtomicBatch = true;
+
   async connect(): Promise<void> {
     const fb = requireFirebird();
 
@@ -253,14 +294,16 @@ export class FirebirdAdapter implements DatabaseAdapter {
       fbConfig.database = normalizeFirebirdDbIdentifier(fbConfig.database);
     }
 
+    // Kept so a dead connection can re-attach with the same config (FB-DEC-01).
+    this.fbConfig = fbConfig;
+
     // node-firebird has NO connect-timeout option of its own, so there is no
     // driver timer to translate and the outer bound is the ONLY thing standing
     // between a silent driver and a permanently hung boot. This is the adapter
-    // the 16-minute probe measured.
+    // the 16-minute probe measured. The SRP-login retry lives inside the bound
+    // (FB-DEC-03), so the whole retry sequence is still capped by the timeout.
     this.db = await withConnectTimeout(
-      () => new Promise<any>((resolve, reject) => {
-        fb.attach(fbConfig, (err: Error | null, db: any) => (err ? reject(err) : resolve(db)));
-      }),
+      () => this.attachWithRetry(fbConfig),
       connectTimeoutMillis(),
       fbConfig.host,
       fbConfig.port,
@@ -269,6 +312,58 @@ export class FirebirdAdapter implements DatabaseAdapter {
     );
   }
 
+  private attachOnce(config: any): Promise<any> {
+    const fb = requireFirebird();
+    return new Promise((resolve, reject) => {
+      fb.attach(config, (err: Error | null, db: any) => (err ? reject(err) : resolve(db)));
+    });
+  }
+
+  /**
+   * Attach with a BOUNDED retry (FB-DEC-03). node-firebird's SRP login over
+   * WireCrypt is intermittently flaky (~12% measured historically), and a flake
+   * surfaces as an auth/handshake error indistinguishable from a real one, so a
+   * bounded retry-all is the robust, honest handling: a transient handshake
+   * failure recovers, while a genuine bad credential still fails after the bound
+   * -- never skipped, never papered over.
+   */
+  private async attachWithRetry(config: any, attempts = 4): Promise<any> {
+    let lastError: unknown;
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      try {
+        return await this.attachOnce(config);
+      } catch (err) {
+        lastError = err;
+        if (attempt < attempts - 1) {
+          await new Promise((resolve) => setTimeout(resolve, 100 * (attempt + 1)));
+        }
+      }
+    }
+    throw lastError;
+  }
+
+  /**
+   * Run a node-firebird op; on a DEAD-connection error (outside an explicit
+   * transaction) re-attach once and retry (FB-DEC-01). Inside a transaction the
+   * error surfaces -- atomicity beats resilience, and the caller rolls back.
+   */
+  private async withReconnect<T>(op: () => Promise<T>): Promise<T> {
+    try {
+      return await op();
+    } catch (err) {
+      if (this.transaction || !FirebirdAdapter.isDeadConnection(err)) throw err;
+      await this.reconnectFirebird();
+      return op();
+    }
+  }
+
+  private async reconnectFirebird(): Promise<void> {
+    try { this.db?.detach?.(() => {}); } catch { /* already gone */ }
+    this.db = null;
+    if (!this.fbConfig) throw new Error("Firebird reconnect called before connect().");
+    this.db = await this.attachWithRetry(this.fbConfig);
+  }
+
   private parseUrl(url: string): { host?: string; port?: number; user?: string; password?: string; database?: string } {
     // firebird://user:pass@host:port/path/to/db.fdb[?charset=...]
     // The path part after the host is normalised by normalizeFirebirdDbIdentifier()
@@ -330,22 +425,75 @@ export class FirebirdAdapter implements DatabaseAdapter {
   }
 
   private queryPromise(sql: string, params?: unknown[]): Promise<any[]> {
-    return new Promise((resolve, reject) => {
-      const translated = this.translateSql(sql);
+    const translated = this.translateSql(sql);
+    // statementHandle() is read INSIDE the op so a reconnect (which replaces
+    // this.db) is picked up on the retry.
+    return this.withReconnect(() => new Promise<any[]>((resolve, reject) => {
       this.statementHandle().query(translated, params ?? [], (err: Error | null, result: any[]) => {
         if (err) reject(err);
         else resolve(result ?? []);
       });
-    });
+    }));
   }
 
   private executePromise(sql: string, params?: unknown[]): Promise<void> {
-    return new Promise((resolve, reject) => {
-      const translated = this.translateSql(sql);
+    const translated = this.translateSql(sql);
+    return this.withReconnect(() => new Promise<void>((resolve, reject) => {
       this.statementHandle().execute(translated, params ?? [], (err: Error | null) => {
         if (err) reject(err);
         else resolve();
       });
+    }));
+  }
+
+  /**
+   * The real affected-row count. node-firebird gives NO DML count of its own
+   * (the callback result is undefined -- MEASURED), but Firebird 5 multi-row
+   * RETURNING surfaces one row per affected row, so `... RETURNING 1` + the row
+   * count IS the real count (FB-AFFECTED-FAB replaces the hardcoded 1). RETURNING
+   * a constant, not `*`, so a large update/delete does not materialise full rows.
+   */
+  private async executeReturningCount(sql: string, params?: unknown[]): Promise<number> {
+    const rows = await this.queryPromise(`${sql} RETURNING 1`, params);
+    return Array.isArray(rows) ? rows.length : 0;
+  }
+
+  /**
+   * Firebird has no generic last_insert_id -- read the GEN_<TABLE>_ID generator
+   * the row's BEFORE INSERT trigger drew from (FB-LASTID-GAP). Column-name-
+   * independent, so correct for a non-`id` PK too. null when the table has no
+   * such generator (GEN_ID then throws -> caught).
+   */
+  private async readGeneratorId(table: string): Promise<number | bigint | null> {
+    const generator = "GEN_" + table.replace(/"/g, "").toUpperCase() + "_ID";
+    try {
+      const rows = await this.queryPromise(`SELECT GEN_ID(${generator}, 0) AS LID FROM RDB$DATABASE`);
+      const value = (rows[0]?.["LID"] ?? rows[0]?.["lid"]) as number | bigint | undefined;
+      this._lastInsertId = value ?? null;
+      return this._lastInsertId;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Read a node-firebird BLOB column into a Buffer. A BLOB arrives as a STREAMING
+   * FUNCTION (fn((err, name, emitter) => emitter.on('data'|'end'))), NOT a Buffer
+   * -- MEASURED -- so the old decodeBlobs no-op leaked the function to the caller
+   * and no bytes round-tripped (FB-BLOB-SRP-UNVERIFIED).
+   */
+  private readBlob(
+    blobFn: (cb: (err: Error | null, name: string, emitter: any) => void) => void,
+  ): Promise<Buffer | null> {
+    return new Promise((resolve, reject) => {
+      blobFn((err, _name, emitter) => {
+        if (err) return reject(err);
+        if (!emitter) return resolve(null);
+        const chunks: Buffer[] = [];
+        emitter.on("data", (chunk: Buffer) => chunks.push(Buffer.from(chunk)));
+        emitter.on("end", () => resolve(Buffer.concat(chunks)));
+        emitter.on("error", (streamErr: Error) => reject(streamErr));
+      });
     });
   }
 
@@ -379,14 +527,29 @@ export class FirebirdAdapter implements DatabaseAdapter {
   async queryAsync<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]> {
     this.ensureConnected();
     const rows = await this.queryPromise(sql, params);
-    return (rows as T[]).map(row => this.decodeBlobs(foldColumnNames(row)));
+    const decoded: T[] = [];
+    for (const row of rows as T[]) {
+      decoded.push(await this.decodeBlobs(foldColumnNames(row)));
+    }
+    return decoded;
   }
 
-  /** Ensure BLOB columns are readable — node-firebird may return callback-based
-   *  blob readers. Convert to Buffer. Regular buffers pass through unchanged. */
-  private decodeBlobs<T>(row: T): T {
-    // node-firebird returns BLOBs as Buffer by default when using
-    // query(sql, params, callback) — already raw bytes.
+  /**
+   * Read out any BLOB columns to Buffers. node-firebird returns a BLOB as a
+   * STREAMING FUNCTION, not a Buffer (MEASURED), so a column whose value is a
+   * function is read via readBlob(); everything else passes through unchanged
+   * (FB-BLOB-SRP-UNVERIFIED -- the old no-op leaked the function to the caller).
+   */
+  private async decodeBlobs<T>(row: T): Promise<T> {
+    if (row === null || typeof row !== "object") return row;
+    const record = row as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (typeof record[key] === "function") {
+        record[key] = await this.readBlob(
+          record[key] as (cb: (err: Error | null, name: string, emitter: any) => void) => void,
+        );
+      }
+    }
     return row;
   }
 
@@ -431,7 +594,9 @@ export class FirebirdAdapter implements DatabaseAdapter {
       const sql = buildInsert(FB_DIALECT, table, keys);
       const paramsList = data.map((row) => keys.map((k) => row[k]));
       const result = await this.executeManyAsync(sql, paramsList);
-      return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
+      // The generator holds the LAST inserted id after the batch (FB-LASTID-GAP).
+      const lastId = (await this.readGeneratorId(table)) ?? result.lastId;
+      return { success: true, affectedRows: result.totalAffected, lastId: lastId ?? undefined };
     }
 
     const keys = Object.keys(data);
@@ -443,8 +608,10 @@ export class FirebirdAdapter implements DatabaseAdapter {
     // is what hid a wholly broken write path — the caller awaited a resolved
     // promise, read back zero rows, and no error surfaced anywhere.
     await this.executePromise(sql, values);
-    // Firebird doesn't have a generic last_insert_id — return success without id
-    return { success: true, affectedRows: 1 };
+    // Derive the last-id from the GEN_<TABLE>_ID generator the trigger drew from
+    // (FB-LASTID-GAP); null when the table has no such generator.
+    const lastId = await this.readGeneratorId(table);
+    return { success: true, affectedRows: 1, lastId: lastId ?? undefined };
   }
 
   update(table: string, data: Record<string, unknown>, filter: Record<string, unknown>, params?: unknown[]): DatabaseResult {
@@ -466,19 +633,19 @@ export class FirebirdAdapter implements DatabaseAdapter {
     // Firebird already uses `?`, so the fragment needs no rewriting.
     if (typeof filter === "string") {
       const where = filter ? ` WHERE ${filter}` : "";
-      await this.executePromise(
+      const affected = await this.executeReturningCount(
         `UPDATE ${fbQuote(table)} SET ${setClauses}${where}`,
         [...Object.values(data), ...(params ?? [])],
       );
-      return { success: true, affectedRows: 1 };
+      return { success: true, affectedRows: affected };
     }
 
     const whereClauses = buildWhereClause(FB_DIALECT, Object.keys(filter));
     const sql = `UPDATE ${FB_DIALECT.quote(table)} SET ${setClauses} WHERE ${whereClauses}`;
     const values = [...Object.values(data), ...Object.values(filter)];
 
-    await this.executePromise(sql, values);
-    return { success: true, affectedRows: 1 };
+    const affected = await this.executeReturningCount(sql, values);
+    return { success: true, affectedRows: affected };
   }
 
   delete(table: string, filter: Record<string, unknown>, params?: unknown[]): DatabaseResult {
@@ -492,8 +659,8 @@ export class FirebirdAdapter implements DatabaseAdapter {
     // string as an object — db.truncate() was broken outright.
     if (typeof filter === "string") {
       const where = filter ? ` WHERE ${filter}` : "";
-      await this.executePromise(`DELETE FROM ${fbQuote(table)}${where}`, params ?? []);
-      return { success: true, affectedRows: 1 };
+      const affected = await this.executeReturningCount(`DELETE FROM ${fbQuote(table)}${where}`, params ?? []);
+      return { success: true, affectedRows: affected };
     }
 
     // Same fbQuote policy as insert/update — see updateAsync.
@@ -501,8 +668,8 @@ export class FirebirdAdapter implements DatabaseAdapter {
     const sql = `DELETE FROM ${FB_DIALECT.quote(table)} WHERE ${whereClauses}`;
     const values = Object.values(filter);
 
-    await this.executePromise(sql, values);
-    return { success: true, affectedRows: 1 };
+    const affected = await this.executeReturningCount(sql, values);
+    return { success: true, affectedRows: affected };
   }
 
   startTransaction(): void {
@@ -741,8 +908,14 @@ function fieldTypeToFirebird(def: FieldDefinition): string {
     case "number":
     case "numeric":
       return "DOUBLE PRECISION";
+    case "decimal":
+      return `DECIMAL(${def.precision ?? 10},${def.scale ?? 2})`;
     case "boolean":
-      return "SMALLINT";
+      // INTEGER, not SMALLINT: parity with the Python master + PHP + Ruby, which
+      // all map a Firebird boolean column to INTEGER (the driver round-trip for a
+      // native BOOLEAN is uneven across Firebird versions). The real-engine DDL
+      // contract (feature 18) pins this four-way.
+      return "INTEGER";
     case "datetime":
       return "TIMESTAMP";
     case "text":

package/packages/orm/src/adapters/mongodb.ts

@@ -32,6 +32,28 @@ interface MongoOperation {
   skip?: number;
   sort?: Record<string, 1 | -1>;
   pipeline?: Record<string, unknown>[];
+  /**
+   * The write's empty filter is an INTENTIONAL match-all (an explicit 1=1
+   * tautology, e.g. truncate()'s WHERE 1 = 1), not a blank/absent WHERE. The
+   * executor uses this to let the whole-collection write through the
+   * requireWriteFilter guard, which otherwise (correctly) refuses an empty
+   * filter as the mass-write footgun.
+   */
+  matchAll?: boolean;
+}
+
+/**
+ * The explicit whole-collection tautology: the WHERE clause truncate() issues,
+ * "1 = 1". It means MATCH-ALL, so it translates to an empty {} filter and the
+ * write reaches deleteMany({}) / updateMany({}) -- emptying or rewriting every
+ * document -- exactly as Python/PHP/Ruby do. It is NOT an unparseable WHERE (the
+ * fail-closed parse still throws for unsupported SQL) and NOT a blank/absent
+ * WHERE (requireWriteFilter still refuses that), so the mass-write guard stays
+ * intact.
+ */
+const MATCH_ALL_WHERE = /^\s*1\s*=\s*1\s*$/;
+function isMatchAllWhere(where: string | null | undefined): boolean {
+  return where != null && MATCH_ALL_WHERE.test(where);
 }
 
 /** Convert SQL WHERE clause tokens into a MongoDB filter object. */
@@ -44,6 +66,12 @@ function parseWhereClause(where: string, params: unknown[], paramOffset = 0): {
   for (const part of parts) {
     const trimmed = part.trim();
 
+    // The explicit 1=1 tautology contributes no constraint (match-all): skip it
+    // rather than mis-parsing "1 = 1" as { "1": 1 } (which matched nothing and
+    // made truncate() a silent no-op). NOT an unparseable WHERE -- the
+    // fail-closed throw below still fires for genuinely unsupported SQL.
+    if (MATCH_ALL_WHERE.test(trimmed)) continue;
+
     // key = ?
     const eqParam = trimmed.match(/^["']?(\w+)["']?\s*=\s*\?$/i);
     if (eqParam) {
@@ -118,11 +146,43 @@ function parseWhereClause(where: string, params: unknown[], paramOffset = 0): {
       filter[nullMatch[1]] = nullMatch[2] ? { $ne: null } : null;
       continue;
     }
+
+    // Fail closed. An unrecognised condition must NEVER be silently dropped:
+    // dropping it leaves an empty (match-all) filter, and on a DELETE/UPDATE
+    // that empty filter reaches deleteMany({})/updateMany({}) and wipes or
+    // rewrites the WHOLE collection. Throw so the caller sees the unsupported
+    // SQL instead of silently losing data.
+    throw new Error(
+      `Unsupported MongoDB WHERE condition: ${JSON.stringify(trimmed)}. The ` +
+        `MongoDB SQL provider fails closed rather than matching every document. ` +
+        `Supported: = != <> > >= < <= LIKE, IN, IS [NOT] NULL, AND.`,
+    );
   }
 
   return { filter, consumed: paramIndex - paramOffset };
 }
 
+/**
+ * Fail closed: a DELETE/UPDATE must carry a real filter.
+ *
+ * An empty MongoDB filter matches EVERY document, so deleteMany({}) /
+ * updateMany({}) would wipe or rewrite the whole collection. Refuse it -- UNLESS
+ * the empty filter is an intentional match-all (an explicit 1=1 tautology, the
+ * spelling truncate() uses; the caller signals that with the operation's
+ * `matchAll` flag or an isMatchAllWhere() check and bypasses this guard). The
+ * raw driver is the escape hatch for anything the SQL subset cannot express.
+ * Shared by both write paths so the guard cannot drift.
+ */
+function requireWriteFilter(filter: Record<string, unknown> | undefined, operation: string, table: string | undefined): void {
+  if (!filter || Object.keys(filter).length === 0) {
+    throw new Error(
+      `Refusing to ${operation} every document in ${table}: the statement has no ` +
+        `WHERE clause, which would affect the whole collection. Add a WHERE, or use ` +
+        `truncate() to clear it explicitly.`,
+    );
+  }
+}
+
 /** Parse a SQL string into a MongoOperation. Returns null if parsing is not supported. */
 function parseSql(sql: string, params: unknown[] = []): MongoOperation | null {
   const s = sql.trim();
@@ -199,8 +259,12 @@ function parseSql(sql: string, params: unknown[] = []): MongoOperation | null {
   }
 
   // ---- UPDATE ----
+  // WHERE is OPTIONAL in the grammar so a filterless UPDATE ("UPDATE t SET x=1")
+  // is RECOGNISED as an updateMany with an empty filter and reaches the
+  // fail-closed guard -- rather than failing the regex, returning null, and
+  // being silently acknowledged as a no-op (a silent wrong result).
   const updateMatch = s.match(
-    /^UPDATE\s+["']?(\w+)["']?\s+SET\s+(.*?)\s+WHERE\s+(.+)$/is,
+    /^UPDATE\s+["']?(\w+)["']?\s+SET\s+(.*?)(?:\s+WHERE\s+(.+))?$/is,
   );
   if (updateMatch) {
     const [, collection, setClause, whereClause] = updateMatch;
@@ -220,10 +284,15 @@ function parseSql(sql: string, params: unknown[] = []): MongoOperation | null {
       }
     }
 
-    // Parse WHERE clause (params start after SET params)
-    const { filter } = parseWhereClause(whereClause.trim(), params, setParamIndex);
+    // Parse WHERE clause (params start after SET params). No WHERE -> empty
+    // filter, which the write guard refuses; an explicit 1=1 tautology -> an
+    // empty filter that IS an intentional match-all (matchAll bypasses the guard).
+    const matchAll = isMatchAllWhere(whereClause?.trim());
+    const filter = whereClause
+      ? parseWhereClause(whereClause.trim(), params, setParamIndex).filter
+      : {};
 
-    return { type: "updateMany", collection, filter, update: { $set: setDoc } };
+    return { type: "updateMany", collection, filter, update: { $set: setDoc }, matchAll };
   }
 
   // ---- DELETE ----
@@ -232,10 +301,13 @@ function parseSql(sql: string, params: unknown[] = []): MongoOperation | null {
   );
   if (deleteMatch) {
     const [, collection, whereClause] = deleteMatch;
+    // An explicit 1=1 tautology (truncate()'s WHERE) is an intentional match-all;
+    // a blank/absent WHERE is the mass-delete footgun the executor guard refuses.
+    const matchAll = isMatchAllWhere(whereClause?.trim());
     const filter = whereClause
       ? parseWhereClause(whereClause.trim(), params).filter
       : {};
-    return { type: "deleteMany", collection, filter };
+    return { type: "deleteMany", collection, filter, matchAll };
   }
 
   // ---- CREATE TABLE (treated as createCollection) ----
@@ -296,6 +368,22 @@ export class MongodbAdapter implements DatabaseAdapter {
   }
 
   /** Connect to MongoDB. Must be called before using the adapter. */
+  /** ADR-0044 required adapter capability. */
+  getDatabaseType(): string {
+    return 'mongodb';
+  }
+
+  /** ADR-0044: readable/writable native boolean. */
+  autocommit = true;
+
+  /**
+   * ADR-0044 / DBA-P02: every built-in adapter can guarantee an atomic
+   * multi-row batch by default. A test-only deployment representing one
+   * that cannot sets this false so executeMany rejects BEFORE the first
+   * write rather than risking partial durability.
+   */
+  supportsAtomicBatch = true;
+
   async connect(): Promise<void> {
     let MongoClient: any;
     try {
@@ -368,11 +456,15 @@ export class MongodbAdapter implements DatabaseAdapter {
         return result;
       }
       case "updateMany": {
-        const result = await col.updateMany(op.filter ?? {}, op.update!, { session: this.session });
+        // matchAll = an explicit 1=1 tautology; its empty filter is an
+        // intentional whole-collection write, not the blank-WHERE footgun.
+        if (!op.matchAll) requireWriteFilter(op.filter, "UPDATE", op.collection);
+        const result = await col.updateMany(op.filter!, op.update!, { session: this.session });
         return result;
       }
       case "deleteMany": {
-        const result = await col.deleteMany(op.filter ?? {}, { session: this.session });
+        if (!op.matchAll) requireWriteFilter(op.filter, "DELETE", op.collection);
+        const result = await col.deleteMany(op.filter!, { session: this.session });
         return result;
       }
       case "find": {
@@ -465,6 +557,53 @@ export class MongodbAdapter implements DatabaseAdapter {
     return rows[0] ?? null;
   }
 
+  /**
+   * Atomic, monotonic, concurrency-safe next id — feature 16. A
+   * findOneAndUpdate($inc) on the tina4_sequences collection, keyed by _id (its
+   * built-in unique index makes concurrent first-use upserts race-safe: two
+   * callers can never create two counters for one table). Seeds from
+   * MAX(pkColumn) the FIRST time only ($setOnInsert). Throws on an impossible
+   * empty result rather than returning a fixed id that could collide with a row.
+   */
+  async getNextId(table: string, pkColumn = "id"): Promise<number> {
+    this.ensureConnected();
+    const sequences = this.db.collection("tina4_sequences");
+    const seqName = `${table}.${pkColumn}`;
+
+    const existing = await sequences.findOne({ _id: seqName }, { session: this.session });
+    if (existing == null) {
+      let seed = 0;
+      try {
+        const maxDoc = await this.db.collection(table)
+          .find({}, { session: this.session })
+          .sort({ [pkColumn]: -1 })
+          .limit(1)
+          .next();
+        if (maxDoc && maxDoc[pkColumn] != null) seed = Number(maxDoc[pkColumn]);
+      } catch { /* collection may not exist yet — seed 0 */ }
+      try {
+        await sequences.updateOne(
+          { _id: seqName },
+          { $setOnInsert: { current_value: seed } },
+          { upsert: true, session: this.session },
+        );
+      } catch { /* race — another caller seeded first; the $inc below still holds */ }
+    }
+
+    const res = await sequences.findOneAndUpdate(
+      { _id: seqName },
+      { $inc: { current_value: 1 } },
+      { upsert: true, returnDocument: "after", session: this.session },
+    );
+    // The mongodb driver returns the doc directly (v5/v6) or wrapped as
+    // { value: doc } (v4). Our counter doc has no `value` field, so this is safe.
+    const doc = res != null && (res as any).value !== undefined ? (res as any).value : res;
+    if (!doc || (doc as any).current_value == null) {
+      throw new Error(`getNextId: MongoDB counter '${seqName}' produced no value`);
+    }
+    return Number((doc as any).current_value);
+  }
+
   insert(table: string, data: Record<string, unknown> | Record<string, unknown>[]): DatabaseResult {
     throw new Error("Use insertAsync() for MongoDB — async adapter requires async methods.");
   }
@@ -491,6 +630,7 @@ export class MongodbAdapter implements DatabaseAdapter {
 
   async updateAsync(table: string, data: Record<string, unknown>, filter: Record<string, unknown>): Promise<DatabaseResult> {
     this.ensureConnected();
+    requireWriteFilter(filter, "UPDATE", table);
     const col = this.db.collection(table);
     try {
       const result = await col.updateMany(filter, { $set: data }, { session: this.session });
@@ -511,25 +651,35 @@ export class MongodbAdapter implements DatabaseAdapter {
       if (Array.isArray(filter)) {
         let total = 0;
         for (const f of filter) {
+          requireWriteFilter(f, "DELETE", table);
           const r = await col.deleteMany(f, { session: this.session });
           total += r.deletedCount;
         }
         return { success: true, affectedRows: total };
       }
 
-      // String WHERE clause — not directly translatable; delete nothing safely
+      // String WHERE clause. A BLANK/absent WHERE is REFUSED -- it would delete
+      // every document. The explicit 1=1 tautology (truncate()'s spelling) is
+      // the ONE intentional whole-collection delete: the WHERE is present and
+      // non-blank, so it is NOT a filterless write -- deleteMany({}) empties the
+      // collection, matching Python/PHP/Ruby (where "1 = 1" translates to an
+      // empty match-all filter). An unparseable WHERE still throws in
+      // parseWhereClause below.
       if (typeof filter === "string") {
         if (!filter.trim()) {
-          // Empty filter = delete all documents
+          requireWriteFilter({}, "DELETE", table); // always throws: no filter
+        }
+        if (isMatchAllWhere(filter.trim())) {
           const r = await col.deleteMany({}, { session: this.session });
           return { success: true, affectedRows: r.deletedCount };
         }
-        // Attempt parse via dummy SELECT wrapping
         const { filter: parsedFilter } = parseWhereClause(filter, []);
+        requireWriteFilter(parsedFilter, "DELETE", table);
         const r = await col.deleteMany(parsedFilter, { session: this.session });
         return { success: true, affectedRows: r.deletedCount };
       }
 
+      requireWriteFilter(filter as Record<string, unknown>, "DELETE", table);
       const result = await col.deleteMany(filter as Record<string, unknown>, { session: this.session });
       return { success: true, affectedRows: result.deletedCount };
     } catch (e) {