fix(drizzle): process bulk deletes sequentially to prevent silent data loss

[razmenaia]

Summary

Fixes #16075

payload.delete({ where }) silently fails to delete 1+ records. Payload reports success and returns the correct IDs, but the records remain in the database.

Root Cause

The bulk delete operation in delete.ts uses .map(async ...) to create per-document promises, then either Promise.all or for...of await to process them. However, .map(async ...) eagerly starts all async callbacks immediately — for...of await only controls the order results are collected, not execution order.

This means all deleteOne calls run concurrently on a shared transaction connection. Each deleteOne performs 3 queries (selectDistinct → findFirst → deleteWhere) that interleave and silently drop deletes.

bulkOperationsSingleTransaction: true does not fix it because of the same .map() antipattern.

Fix

Replace .map(async ...) + for...of await with a proper sequential for...of loop:

const processDoc = async (doc) => { /* existing body */ }

const awaitedDocs = []
for (const doc of docs) {
  awaitedDocs.push(await processDoc(doc))
}

Reproduction

• Reproduces within 1-3 iterations on Payload 3.80.0 with @payloadcms/db-postgres
• Verified not present in 3.41.0 (regression)
• Drizzle direct db.delete().where() works perfectly — confirms the bug is in Payload's abstraction layer, not Drizzle or Postgres

See #16075 for full details, POC scripts, and proof.

Made with Cursor