spec/ParseGraphQLServer.spec.js (3)

12162-12222: Strengthen the partial-failure create assertion to verify rejected items are not persisted.

This test currently proves the successful item exists, but it doesn’t prove the rejected "FAIL" item was not created.

♻️ Suggested assertion hardening

               const q = new Parse.Query('BulkTest');
               q.equalTo('title', 'ok');
               const saved = await q.find({ useMasterKey: true });
               expect(saved.length).toBe(1);
+
+              const blocked = new Parse.Query('BulkTest');
+              blocked.equalTo('title', 'FAIL');
+              expect(await blocked.count({ useMasterKey: true })).toBe(0);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ParseGraphQLServer.spec.js` around lines 12162 - 12222, Add an assertion
that the rejected item with title 'FAIL' was not persisted: after the existing
check that saved 'ok' exists, create a new Parse.Query('BulkTest') (e.g., qFail)
with qFail.equalTo('title', 'FAIL') and await qFail.find({ useMasterKey: true })
and assert its length is 0 (or that no objects are returned). This uses the
existing Parse.Query usage in the test and the createManyBulkTest flow to
confirm the rejected item wasn't saved.

---

11979-12015: Add a negative-control auth test for batch-limit bypass.

You validate master-key bypass, but a security regression test should also assert that non-master auth still enforces batchRequestLimit (for example JS key/session, and maintenance key if policy says master-only bypass).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ParseGraphQLServer.spec.js` around lines 11979 - 12015, Add a
negative-control test alongside the existing "should bypass batchRequestLimit
for master key on createMany" that verifies non-master auth does NOT bypass the
limit: use reconfigureGraphQLWithBatchLimit2AndOpenClient() to set limit=2, then
call the same createMany mutation via apolloClient but send non-master
credentials (e.g. replace 'X-Parse-Master-Key' with a JS key/session header or
omit it, and optionally test maintenance key if policy applies) and assert the
request is rejected or truncated (expect an error or results.length <= 2) to
confirm batchRequestLimit is enforced for non-master auth; reference the
existing mutation name CreateManyBulkTest/createManyBulkTest, clientMutationId
usage, and the request context headers to locate where to add the new test.

---

11793-11835: Consider consolidating duplicated BulkTest bootstrap logic.

Schema reset/recreate is repeated in both beforeEach and reconfigureGraphQLWithBatchLimit2AndOpenClient; centralizing this into one helper would reduce drift and test maintenance cost.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ParseGraphQLServer.spec.js` around lines 11793 - 11835, Duplicate
Bootstrap: Extract the repeated Parse.Schema setup (purge/delete/addString/save
and parseGraphQLServer.parseGraphQLSchema.schemaCache.clear()) into a single
helper (e.g., resetBulkTestSchema or bootstrapBulkTestSchema) and call it from
both beforeEach and reconfigureGraphQLWithBatchLimit2AndOpenClient; if updateCLP
should only run after server reconfigure, keep updateCLP('BulkTest', ...) inside
reconfigureGraphQLWithBatchLimit2AndOpenClient, otherwise add an optional
parameter to the helper so the CLP update can be performed there when requested.

src/GraphQL/loaders/parseClassMutations.js (3)

37-52: Inconsistent error creation pattern.

The empty-input case uses createSanitizedError (line 39) while the batch-limit exceeded case uses new Parse.Error directly (line 47). Both should likely use the same pattern for consistency. If createSanitizedError is needed for security reasons, it should also be applied to the batch limit error.

♻️ Suggested fix for consistency

   if (isBatchRequestLimitExceeded(count, config, auth)) {
     const batchRequestLimit = getBatchRequestLimit(config);
-    throw new Parse.Error(
+    throw createSanitizedError(
       Parse.Error.INVALID_JSON,
-      `bulk input contains ${count} items, which exceeds the limit of ${batchRequestLimit}.`
+      `bulk input contains ${count} items, which exceeds the limit of ${batchRequestLimit}.`,
+      config
     );
   }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/GraphQL/loaders/parseClassMutations.js` around lines 37 - 52, The
function assertBulkInputLength inconsistently constructs errors: it uses
createSanitizedError for the zero-count case but constructs a raw Parse.Error
for the batch-limit case; update the batch-limit branch (inside
assertBulkInputLength, where isBatchRequestLimitExceeded and
getBatchRequestLimit are used) to throw a sanitized error via
createSanitizedError (matching the same error type/message pattern used for the
empty-input case) so both branches use the same secure error-creation helper
instead of new Parse.Error.

---

508-521: Optional: Consider extracting shared result mapping logic.

The result mapping logic (lines 508-521, 667-680, 781-794) is duplicated across all three bulk mutations. A shared helper could reduce duplication:

const mapSettledToResults = (settled, queryName) =>
  settled.map(r =>
    r.status === 'fulfilled'
      ? { success: true, [queryName]: r.value, error: null }
      : { success: false, [queryName]: null, error: bulkErrorFromReason(r.reason) }
  );

Also applies to: 667-680, 781-794

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/GraphQL/loaders/parseClassMutations.js` around lines 508 - 521, The
mapping of settled Promise results is duplicated across three bulk mutation
blocks; extract a single helper (e.g., mapSettledToResults(settled, queryName))
that takes the settled array and the getGraphQLQueryName string and returns the
unified result shape using bulkErrorFromReason for failures, then replace the
duplicated mapping in each bulk mutation with calls to this helper (update
usages where getGraphQLQueryName and settled are passed). Ensure the helper is
exported/available in the same module and that all three mutation handlers (the
blocks using settled and getGraphQLQueryName) call mapSettledToResults to remove
the duplicated logic.

---

435-506: Consider adding concurrency control for database operations.

Promise.allSettled executes all operations concurrently without throttling. Even within the batch limit, large batches could overwhelm the database with simultaneous writes. Consider using a concurrency-limited execution pattern (e.g., p-limit or chunked sequential execution) if batch limits can be set high.

Additionally, the inner cloneArgs at line 438 appears redundant since fieldsList is already cloned at line 428. This creates unnecessary object allocations per item.

♻️ Suggested fix to remove redundant cloning

           fieldsList.map(fieldSet =>
             (async () => {
-              let fields = fieldSet ? cloneArgs({ fields: fieldSet }).fields : {};
-              if (!fields) {
-                fields = {};
-              }
+              const fields = fieldSet || {};
               const parseFields = await transformTypes('create', fields, {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/GraphQL/loaders/parseClassMutations.js` around lines 435 - 506, The batch
create loop uses Promise.allSettled over fieldsList.map which fires all DB
writes concurrently and also calls cloneArgs per item (cloneArgs({ fields:
fieldSet }).fields) redundantly; fix by removing the inner cloneArgs usage and
reuse the already-cloned fieldsList, and replace the raw
Promise.allSettled(fieldsList.map(...)) concurrency with a limited-execution
pattern (e.g., p-limit or manual chunking) around the async worker that runs
transformTypes and objectsMutations.createObject so only N creates run at once
while still collecting results (you can still call Promise.allSettled on the
limited set of promises), keeping the rest of the logic (transformTypes,
objectsMutations.createObject, objectsQueries.getObject, filterDeletedFields)
unchanged.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

spec/Utils.spec.js (1)

292-323: Add coverage for primitive/non-Error rejection reasons

bulkErrorPayloadFromReason accepts unknown, but tests only cover Parse.Error and native Error. Add at least one primitive/nullish case to prevent regressions in Promise rejection normalization.

Proposed test additions

   describe('bulkErrorPayloadFromReason', () => {
+    it('should handle primitive non-Parse reasons', () => {
+      const config = { enableSanitizedErrorResponse: false };
+      const payload = bulkErrorPayloadFromReason('plain failure', config);
+      expect(payload.code).toBe(Parse.Error.INTERNAL_SERVER_ERROR);
+      expect(payload.message).toBe('plain failure');
+    });
+
+    it('should handle undefined reason', () => {
+      const config = { enableSanitizedErrorResponse: true };
+      const payload = bulkErrorPayloadFromReason(undefined, config);
+      expect(payload.code).toBe(Parse.Error.INTERNAL_SERVER_ERROR);
+      expect(payload.message).toBe('Internal server error');
+    });
+
     it('should sanitize Parse.Error messages when enableSanitizedErrorResponse is true', () => {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/Utils.spec.js` around lines 292 - 323, Add a new unit test case to cover
primitive and nullish rejection reasons for bulkErrorPayloadFromReason: create
tests that pass null, undefined and a primitive (e.g., a string or number) as
the reason and assert the returned payload.code is
Parse.Error.INTERNAL_SERVER_ERROR and payload.message is the sanitized message
('Internal server error') when config.enableSanitizedErrorResponse is true, and
the raw primitive/string value (or a stringified representation for non-strings)
when enableSanitizedErrorResponse is false; reference the existing describe
block and function bulkErrorPayloadFromReason to locate where to add these cases
so Promise rejection normalization for unknown reasons is covered.

spec/ParseGraphQLServer.spec.js (2)

11801-11873: Consolidate duplicated GraphQL reconfigure/client bootstrap helpers.

reconfigureGraphQLWithBatchLimit2AndOpenClient and reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient duplicate most setup/teardown logic. Extract one parameterized helper to reduce drift.

♻️ Proposed refactor

-async function reconfigureGraphQLWithBatchLimit2AndOpenClient() {
-  parseServer = await global.reconfigureServer({ requestComplexity: { batchRequestLimit: 2 } });
-  await createGQLFromParseServer(parseServer);
-  const httpLink = await createUploadLink({ uri: 'http://localhost:13377/graphql', fetch, headers });
-  apolloClient = new ApolloClient({ ... });
-  // schema + CLP setup
-}
-
-async function reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient() {
-  parseServer = await global.reconfigureServer({
-    maintenanceKey: 'test2',
-    maxUploadSize: '1kb',
-    enableSanitizedErrorResponse: false,
-  });
-  await createGQLFromParseServer(parseServer);
-  const httpLink = await createUploadLink({ uri: 'http://localhost:13377/graphql', fetch, headers });
-  apolloClient = new ApolloClient({ ... });
-  // schema + CLP setup
-}
+async function reconfigureBulkGraphQLAndOpenClient(serverConfig) {
+  parseServer = await global.reconfigureServer(serverConfig);
+  await createGQLFromParseServer(parseServer);
+  const httpLink = await createUploadLink({ uri: 'http://localhost:13377/graphql', fetch, headers });
+  apolloClient = new ApolloClient({ ... });
+  // schema + CLP setup (shared)
+}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ParseGraphQLServer.spec.js` around lines 11801 - 11873, The two helpers
reconfigureGraphQLWithBatchLimit2AndOpenClient and
reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient share identical
bootstrapping (createGQLFromParseServer, createUploadLink + ApolloClient,
Parse.Schema purge/delete/addString,
parseGraphQLServer.parseGraphQLSchema.schemaCache.clear, and updateCLP); extract
a single parameterized helper (e.g., reconfigureGraphQLAndOpenClient(options))
that accepts the parseServer config object (requestComplexity or
enableSanitizedErrorResponse/etc.) and performs the shared steps, replace both
original functions with calls to this new helper passing the different config
objects, and update all callers to use it so no duplicate setup/teardown logic
remains.

---

12155-12195: Pin deleteMany duplicate-ID behavior with an explicit test.

deleteManyBulkTest tests success and partial failure, but not repeated IDs in the same request. Add one test so behavior is deterministic and protected against probing-style regressions.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ParseGraphQLServer.spec.js` around lines 12155 - 12195, Add a new test
case to pin deleteMany duplicate-ID behavior: create two objects (e.g., via
Parse.Object and Parse.Object.saveAll), then call the deleteManyBulkTest GraphQL
mutation (using apolloClient.mutate and toGlobalId) with an input.ids array that
contains the same object's global ID twice and assert the deterministic behavior
— e.g., that the results array length, per-item success flags, and which
objectIds are returned match the intended spec (either deduplicated or treated
as separate attempts). Place this alongside the existing "should deleteMany"
test so future changes to deleteManyBulkTest's handling of duplicate IDs are
caught.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

spec/Utils.spec.js (1)

292-349: Consider adding an explicit default-config test for sanitization fallback.

You cover explicit true/false; adding config omitted (undefined) would lock in the default secure behavior and prevent regressions.

➕ Optional test addition

   describe('bulkErrorPayloadFromReason', () => {
+    it('should sanitize non-Parse reasons when config is undefined', () => {
+      const payload = bulkErrorPayloadFromReason(new Error('internal stack trace'));
+      expect(payload.code).toBe(Parse.Error.INTERNAL_SERVER_ERROR);
+      expect(payload.message).toBe('Internal server error');
+    });
+
     it('should sanitize Parse.Error messages when enableSanitizedErrorResponse is true', () => {
       const config = { enableSanitizedErrorResponse: true };
       const reason = new Parse.Error(Parse.Error.SCRIPT_FAILED, 'Cloud script detail');

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/Utils.spec.js` around lines 292 - 349, Add a test that verifies
bulkErrorPayloadFromReason defaults to the sanitized behavior when the config
argument is omitted: create a new spec that calls
bulkErrorPayloadFromReason(reason) with no config for both a Parse.Error (e.g.,
new Parse.Error(Parse.Error.SCRIPT_FAILED, 'Cloud script detail')) and a generic
Error (e.g., new Error('internal stack trace')), and assert that the returned
payloads use the sanitized messages ("Permission denied" for the Parse.Error
case and "Internal server error" for the generic error) while keeping the
appropriate codes.

spec/ParseGraphQLServer.spec.js (1)

12323-12428: ⚠️ Potential issue | 🟠 Major

These "plain Error" assertions still miss the generic bulk-error contract.

By asserting SCRIPT_FAILED on Line 12371 and Line 12423, these tests are only locking in the wrapped-hook path. They do not protect the GraphQL response shape for true non-Parse.Error per-item failures, which is the leakage-sensitive branch this PR was missing. Please add a case that actually reaches that branch, or update these expectations if hook-thrown Errors are supposed to surface as INTERNAL_SERVER_ERROR instead.

Based on learnings: For GraphQL bulk mutations in parse-community/parse-server, per-item failures must respect enableSanitizedErrorResponse at the GraphQL layer. When enableSanitizedErrorResponse is true (default), a plain Error thrown from hooks should be returned as { code: INTERNAL_SERVER_ERROR, message: 'Internal server error' }; when false, the original Error.message should be returned.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@spec/ParseGraphQLServer.spec.js` around lines 12323 - 12428, The assertions
for plain Error handling in createMany bulk tests are incorrect: instead of
expecting Parse.Error.SCRIPT_FAILED for hook-thrown plain Errors, update the
tests to assert the GraphQL-layer sanitized contract controlled by
enableSanitizedErrorResponse; when using
reconfigureGraphQLWithBatchLimit2AndOpenClient() (sanitization enabled) assert
the per-item failed.error.code equals Parse.Error.INTERNAL_SERVER_ERROR and
message equals 'Internal server error', and when using
reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient() (sanitization disabled)
assert failed.error.message equals the original 'internal stack detail'; keep
references to createManyBulkTest results and the beforeSave hook in the spec so
the test still triggers the same failure path.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

spec/ParseGraphQLServer.spec.js (1)

12516-12588: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Collapse the two near-identical bootstrap helpers into one parameterized helper.

reconfigureGraphQLWithBatchLimit2AndOpenClient and reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient differ only in the reconfigureServer options; everything after that (Apollo link/client construction, schema recreation, CLP grant) is byte-identical. The same block is inlined a third time at Lines 12701-12734. Three copies of this sequence means any future change to the client setup has to be made in three places.

♻️ Proposed consolidation

-          async function reconfigureGraphQLWithBatchLimit2AndOpenClient() {
-            parseServer = await global.reconfigureServer({
-              requestComplexity: { batchRequestLimit: 2 },
-            });
+          async function reconfigureGraphQLAndOpenClient(serverOptions) {
+            parseServer = await global.reconfigureServer(serverOptions);
             await createGQLFromParseServer(parseServer);
             const httpLink = await createUploadLink({
               uri: 'http://localhost:13377/graphql',
               fetch,
               headers,
             });
             apolloClient = new ApolloClient({
               link: httpLink,
               cache: new InMemoryCache(),
               defaultOptions: {
                 query: {
                   fetchPolicy: 'no-cache',
                 },
               },
             });
             const sc = new Parse.Schema('BulkTest');
             await sc.purge().catch(() => {});
             await sc.delete().catch(() => {});
             await sc.addString('title').save();
             await parseGraphQLServer.parseGraphQLSchema.schemaCache.clear();
             await updateCLP(
               {
                 create: { '*': true },
                 find: { '*': true },
                 get: { '*': true },
                 update: { '*': true },
                 delete: { '*': true },
               },
               'BulkTest'
             );
           }
-
-          async function reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient() {
-            parseServer = await global.reconfigureServer({
-              maintenanceKey: 'test2',
-              maxUploadSize: '1kb',
-              enableSanitizedErrorResponse: false,
-            });
-            await createGQLFromParseServer(parseServer);
-            const httpLink = await createUploadLink({
-              uri: 'http://localhost:13377/graphql',
-              fetch,
-              headers,
-            });
-            apolloClient = new ApolloClient({
-              link: httpLink,
-              cache: new InMemoryCache(),
-              defaultOptions: {
-                query: {
-                  fetchPolicy: 'no-cache',
-                },
-              },
-            });
-            const sc = new Parse.Schema('BulkTest');
-            await sc.purge().catch(() => {});
-            await sc.delete().catch(() => {});
-            await sc.addString('title').save();
-            await parseGraphQLServer.parseGraphQLSchema.schemaCache.clear();
-            await updateCLP(
-              {
-                create: { '*': true },
-                find: { '*': true },
-                get: { '*': true },
-                update: { '*': true },
-                delete: { '*': true },
-              },
-              'BulkTest'
-            );
-          }

Call sites then become reconfigureGraphQLAndOpenClient({ requestComplexity: { batchRequestLimit: 2 } }), reconfigureGraphQLAndOpenClient({ maintenanceKey: 'test2', maxUploadSize: '1kb', enableSanitizedErrorResponse: false }), and for Lines 12701-12734 reconfigureGraphQLAndOpenClient({ requestComplexity: { batchRequestLimit: 2 }, enableSanitizedErrorResponse: false }).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@spec/ParseGraphQLServer.spec.js` around lines 12516 - 12588, Replace the
duplicate reconfigureGraphQLWithBatchLimit2AndOpenClient,
reconfigureGraphQLWithUnsanitizedErrorsAndOpenClient, and the third inline setup
with one parameterized reconfigureGraphQLAndOpenClient helper that accepts
reconfigureServer options and retains the shared Apollo client, schema, cache,
and CLP setup. Update all three call sites to pass only their differing option
objects.

src/GraphQL/loaders/parseClassMutations.js (2)

88-102: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

The allow*Many guard clauses are dead logic, and null is not treated as "unset".

Two things here, and I'll defend both:

1. allowCreateMany = isCreateManyEnabled && (isCreateEnabled || createManyExplicit === true) reduces to isCreateManyEnabled in every branch. If createManyExplicit is undefined, then isCreateManyEnabled === isCreateEnabled and the right-hand clause is also isCreateEnabled; if it is true, the right-hand clause is true; if it is false, the left-hand clause already short-circuits. Same for update/delete. The extra clause only obscures the intent (bulk defaults to the single-op flag, explicit config always wins).

2. ParseGraphQLController._validateClassConfig accepts createMany: null as a valid "not set" value, but here only undefined falls back to isCreateEnabled; a persisted null yields isCreateManyEnabled === null, silently disabling the bulk mutation while create stays enabled. Use a nullish check.

♻️ Proposed simplification

-  const isCreateManyEnabled = createManyExplicit !== undefined ? createManyExplicit : isCreateEnabled;
-  const isUpdateManyEnabled = updateManyExplicit !== undefined ? updateManyExplicit : isUpdateEnabled;
-  const isDeleteManyEnabled = deleteManyExplicit !== undefined ? deleteManyExplicit : isDestroyEnabled;
-  const allowCreateMany =
-    isCreateManyEnabled && (isCreateEnabled || createManyExplicit === true);
-  const allowUpdateMany =
-    isUpdateManyEnabled && (isUpdateEnabled || updateManyExplicit === true);
-  const allowDeleteMany =
-    isDeleteManyEnabled && (isDestroyEnabled || deleteManyExplicit === true);
+  const allowCreateMany = createManyExplicit ?? isCreateEnabled;
+  const allowUpdateMany = updateManyExplicit ?? isUpdateEnabled;
+  const allowDeleteMany = deleteManyExplicit ?? isDestroyEnabled;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/GraphQL/loaders/parseClassMutations.js` around lines 88 - 102, In the
mutation enablement setup, update createManyExplicit, updateManyExplicit, and
deleteManyExplicit to treat both null and undefined as unset when deriving their
is*ManyEnabled values, then simplify allowCreateMany, allowUpdateMany, and
allowDeleteMany to use those derived flags directly. Preserve explicit
true/false overrides and the existing single-operation defaults.

---

449-463: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

All three bulk resolvers recompute query-AST-derived selection data once per item. getFieldNames(mutationInfo), the prefix filter/map, extractKeysAndInclude, and (where used) needToGetAllKeys depend only on mutationInfo and the class schema, never on the item — so an N-item batch performs N identical AST walks inside the Promise.allSettled closures. Hoist them above the .map() in each resolver and keep only the genuinely per-item getOnlyRequiredFields(fields, ...) call inside.

• src/GraphQL/loaders/parseClassMutations.js#L449-L463: hoist selectedFields, keys, include, and needToGetAllKeys above the createMany Promise.allSettled; also drop the redundant cloneArgs({ fields: fieldSet }) on Line 432 since Line 422 already deep-cloned args.
• src/GraphQL/loaders/parseClassMutations.js#L608-L622: hoist the same four values above the updateMany Promise.allSettled.
• src/GraphQL/loaders/parseClassMutations.js#L743-L746: hoist selectedFields, keys, and include above the deleteMany Promise.allSettled.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/GraphQL/loaders/parseClassMutations.js` around lines 449 - 463, In
src/GraphQL/loaders/parseClassMutations.js#L449-L463, hoist selectedFields,
keys, include, and needToGetAllKeys above the createMany Promise.allSettled map,
leaving only getOnlyRequiredFields(fields, ...) per item; also remove the
redundant cloneArgs({ fields: fieldSet }) noted at `#L432`. Apply the same
hoisting in `#L608-L622` for updateMany, and hoist selectedFields, keys, and
include above the deleteMany Promise.allSettled in `#L743-L746`.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes