@semics-tech/mongolite 1.3.0 → 1.4.0

package/dist/cjs/sync/diff.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * Field-level diffing between the last-known server state and the local document.
+ *
+ * Replication used to push whole documents, which meant a local edit to one field
+ * rewrote every other field too — including fields another writer had just changed,
+ * and including fields whose BSON type the local store cannot represent. Diffing
+ * narrows each push to `$set`/`$unset` of what genuinely changed, so everything else
+ * upstream is left exactly as it was.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deepEqual = deepEqual;
+exports.computeDiff = computeDiff;
+exports.isEmptyDiff = isEmptyDiff;
+exports.applyDiff = applyDiff;
+/**
+ * True when `value` is a genuine plain object worth recursing into.
+ *
+ * Class instances are deliberately excluded. A `Date`, `ObjectId` or `Binary` is
+ * `typeof 'object'`, and treating one as a bag of fields would copy it into a plain
+ * object — destroying exactly the BSON types the shadow exists to preserve.
+ */
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Structural equality, insensitive to key order.
+ *
+ * `JSON.stringify` comparison would report `{a:1,b:2}` and `{b:2,a:1}` as different and
+ * push a spurious update on every sync.
+ */
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    // NaN is the one primitive that isn't equal to itself.
+    if (typeof a === 'number' && typeof b === 'number')
+        return Number.isNaN(a) && Number.isNaN(b);
+    // Two equal instants are separate objects; without this every sync would rewrite
+    // any date-valued field.
+    if (a instanceof Date || b instanceof Date) {
+        return a instanceof Date && b instanceof Date && a.getTime() === b.getTime();
+    }
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((item, index) => deepEqual(item, b[index]));
+    }
+    if (isPlainObject(a) && isPlainObject(b)) {
+        const aKeys = Object.keys(a);
+        const bKeys = Object.keys(b);
+        if (aKeys.length !== bKeys.length)
+            return false;
+        return aKeys.every((key) => Object.prototype.hasOwnProperty.call(b, key) && deepEqual(a[key], b[key]));
+    }
+    return false;
+}
+/**
+ * Computes the minimal update that turns `base` into `local`.
+ *
+ * `base` must be the **lossy JSON projection** of the server document — the same shape
+ * the local store would have produced for it (see `projectToLocalShape` in `shadow.ts`).
+ * That is what makes type preservation work: a server `Date` projects to the same ISO
+ * string the local store holds, compares equal, and so never appears in the diff — the
+ * upstream `Date` survives untouched.
+ *
+ * Nested objects recurse into dotted paths, so two writers editing different sub-fields
+ * of the same document do not collide.
+ *
+ * **Arrays are atomic.** Any change to an array replaces the whole array. Positional
+ * diffing of arrays is famously error-prone once elements are inserted or reordered, and
+ * a wrong answer here silently corrupts data — so this deliberately does not attempt it.
+ *
+ * @param base The last-known server state, projected to local shape. `null` if the
+ * document has never been upstream, in which case every field is new.
+ * @param local The current local document.
+ */
+function computeDiff(base, local) {
+    const diff = { set: {}, unset: [] };
+    collect(base ?? {}, local, '', diff);
+    return diff;
+}
+function collect(base, local, prefix, diff) {
+    const keys = new Set([...Object.keys(base), ...Object.keys(local)]);
+    for (const key of keys) {
+        // `_id` is the identity, never part of the update.
+        if (prefix === '' && key === '_id')
+            continue;
+        const path = prefix === '' ? key : `${prefix}.${key}`;
+        const inLocal = Object.prototype.hasOwnProperty.call(local, key);
+        const inBase = Object.prototype.hasOwnProperty.call(base, key);
+        if (!inLocal) {
+            diff.unset.push(path);
+            continue;
+        }
+        const localValue = local[key];
+        const baseValue = base[key];
+        if (!inBase) {
+            diff.set[path] = localValue;
+            continue;
+        }
+        // Recurse only when both sides are objects; otherwise the shapes differ and the
+        // whole subtree is replaced.
+        if (isPlainObject(baseValue) && isPlainObject(localValue)) {
+            collect(baseValue, localValue, path, diff);
+            continue;
+        }
+        if (!deepEqual(baseValue, localValue)) {
+            diff.set[path] = localValue;
+        }
+    }
+}
+/** True when the diff would change nothing upstream. */
+function isEmptyDiff(diff) {
+    return Object.keys(diff.set).length === 0 && diff.unset.length === 0;
+}
+/**
+ * Applies a diff to a copy of `document`, mirroring what the upstream `$set`/`$unset`
+ * does.
+ *
+ * Used to roll the shadow forward after a successful push without a second round trip.
+ * Because it edits the *server* document in place, fields the diff never mentions keep
+ * their original BSON values — which is the whole point of diffing in the first place.
+ */
+function applyDiff(document, diff) {
+    const result = clone(document);
+    for (const [path, value] of Object.entries(diff.set)) {
+        setPath(result, path.split('.'), value);
+    }
+    for (const path of diff.unset) {
+        unsetPath(result, path.split('.'));
+    }
+    return result;
+}
+/**
+ * Structured clone that leaves class instances (BSON `Date`, `ObjectId`, `Binary`, …)
+ * by reference. Copying them field-by-field would destroy exactly the types the shadow
+ * exists to preserve.
+ */
+function clone(value) {
+    if (Array.isArray(value))
+        return value.map(clone);
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, item] of Object.entries(value))
+            out[key] = clone(item);
+        return out;
+    }
+    return value;
+}
+function setPath(target, segments, value) {
+    const [head, ...rest] = segments;
+    if (rest.length === 0) {
+        target[head] = value;
+        return;
+    }
+    const next = target[head];
+    // Mirror MongoDB: a dotted path creates intermediate objects as needed.
+    const container = isPlainObject(next) ? next : {};
+    target[head] = container;
+    setPath(container, rest, value);
+}
+function unsetPath(target, segments) {
+    const [head, ...rest] = segments;
+    if (rest.length === 0) {
+        delete target[head];
+        return;
+    }
+    const next = target[head];
+    if (isPlainObject(next))
+        unsetPath(next, rest);
+}

package/dist/cjs/sync/httpSink.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SyncRequestRejected = exports.HttpUpstreamSink = void 0;
+/**
+ * A {@link SyncSink} that ships changes to a remote HTTP API instead of connecting to
+ * MongoDB directly, for deployments where the local instance cannot reach the database.
+ *
+ * The API receives MongoDB-shaped commands and applies them on the client's behalf —
+ * see `@semics-tech/mongolite/server` for a receiver that does exactly that.
+ *
+ * Version predicates travel with each operation and conflicts come back in the response,
+ * so replication behaves the same over HTTP as it does over a direct connection: the
+ * upstream stays the source of truth, and a concurrent writer is detected rather than
+ * overwritten.
+ */
+const commands_js_1 = require("./commands.js");
+const protocol_js_1 = require("./protocol.js");
+class HttpUpstreamSink {
+    constructor(options) {
+        this.options = options;
+        this.name = 'http';
+        this.cookie = null;
+        if (!options.baseUrl)
+            throw new Error('HttpUpstreamSink requires a `baseUrl`.');
+        if (!options.database)
+            throw new Error('HttpUpstreamSink requires a `database`.');
+        const globalFetch = globalThis.fetch;
+        if (!options.fetch && typeof globalFetch !== 'function') {
+            throw new Error('HttpUpstreamSink needs a `fetch` implementation. Node 18+ provides one globally; ' +
+                'on older runtimes pass `fetch` explicitly.');
+        }
+        this.fetchImpl = options.fetch ?? globalFetch;
+        this.idMapping = options.idMapping ?? 'auto';
+        this.versioning = options.versioning ?? true;
+    }
+    async apply(operations) {
+        const includeCommands = this.options.includeCommands ?? true;
+        const request = {
+            protocol: protocol_js_1.SYNC_PROTOCOL_VERSION,
+            replicator: this.options.replicator,
+            operations: operations.map((op) => (0, protocol_js_1.toWireOperation)(op, includeCommands
+                ? (0, commands_js_1.buildWriteCommand)(op, { idMapping: this.idMapping, versioning: this.versioning })
+                : undefined)),
+        };
+        let response;
+        try {
+            response = await this.send('_sync', request);
+        }
+        catch (err) {
+            // A request the API rejects outright will be rejected again on every retry, so
+            // it is reported as a per-operation failure — dead-lettered, not spun on. The
+            // sink's contract is that throwing means "transient", and this is not that.
+            if (err instanceof SyncRequestRejected) {
+                return {
+                    applied: 0,
+                    failures: operations.map((_op, index) => ({
+                        index,
+                        message: err.message,
+                        code: err.status,
+                    })),
+                };
+            }
+            throw err;
+        }
+        return {
+            applied: response.applied ?? 0,
+            failures: response.failures,
+            conflicts: response.conflicts,
+        };
+    }
+    async fetch(collection, documentIds) {
+        if (documentIds.length === 0)
+            return [];
+        const response = await this.send('_sync/fetch', {
+            protocol: protocol_js_1.SYNC_PROTOCOL_VERSION,
+            collection,
+            documentIds,
+        });
+        return response.documents ?? [];
+    }
+    // ---------------------------------------------------------------- internals
+    endpoint(path) {
+        const base = this.options.baseUrl.replace(/\/+$/, '');
+        const prefix = (this.options.pathPrefix ?? 'sync').replace(/^\/+|\/+$/g, '');
+        return `${base}/${prefix}/${encodeURIComponent(this.options.database)}/${path}`;
+    }
+    async requestHeaders() {
+        const headers = {
+            'content-type': protocol_js_1.SYNC_CONTENT_TYPE,
+            accept: protocol_js_1.SYNC_CONTENT_TYPE,
+            ...this.options.headers,
+            ...(this.options.getAuthHeaders ? await this.options.getAuthHeaders() : {}),
+        };
+        if (this.cookie && (this.options.cookies ?? true))
+            headers.cookie = this.cookie;
+        return headers;
+    }
+    /**
+     * Posts a body and decodes the reply.
+     *
+     * Retries are deliberately *not* handled here — the replicator already owns backoff,
+     * outage buffering and checkpointing. This throws on anything retryable and lets it do
+     * its job; throwing twice over would compound the delays.
+     */
+    async send(path, body) {
+        const timeoutMs = this.options.timeoutMs ?? 30000;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let response;
+        try {
+            response = await this.fetchImpl(this.endpoint(path), {
+                method: 'POST',
+                headers: await this.requestHeaders(),
+                body: (0, protocol_js_1.encodeBody)(body),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            // Network failure, DNS, timeout — all transient as far as we can tell.
+            throw new Error(`Sync request to ${this.endpoint(path)} failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (this.options.cookies ?? true) {
+            const setCookie = response.headers.get('set-cookie');
+            if (setCookie)
+                this.cookie = setCookie;
+        }
+        const text = await response.text();
+        if (!response.ok) {
+            const detail = text.slice(0, 500);
+            // 4xx means the request itself is wrong and will stay wrong; throwing would spin
+            // forever. Surfacing it as a per-operation failure dead-letters the batch instead.
+            // 408 and 429 are the exceptions — they explicitly invite a retry.
+            const retryable = response.status >= 500 || response.status === 408 || response.status === 429;
+            if (retryable) {
+                throw new Error(`Sync request failed with ${response.status}: ${detail}`);
+            }
+            throw new SyncRequestRejected(`Sync request rejected with ${response.status}: ${detail}`, response.status);
+        }
+        return (0, protocol_js_1.decodeBody)(text);
+    }
+}
+exports.HttpUpstreamSink = HttpUpstreamSink;
+/**
+ * The remote API refused the request outright.
+ *
+ * Distinct from a transport failure: retrying will produce the same refusal, so the
+ * batch is dead-lettered rather than retried.
+ */
+class SyncRequestRejected extends Error {
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = 'SyncRequestRejected';
+    }
+}
+exports.SyncRequestRejected = SyncRequestRejected;

package/dist/cjs/sync/index.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deepEqual = exports.isEmptyDiff = exports.applyDiff = exports.computeDiff = exports.projectToLocalShape = exports.SHADOW_TABLE = exports.SyncShadow = exports.fromWireOperation = exports.toWireOperation = exports.decodeBody = exports.encodeBody = exports.SyncProtocolError = exports.SYNC_PROTOCOL_VERSION = exports.fetchDocuments = exports.executeWrites = exports.toUpstreamId = exports.buildWriteCommand = exports.SyncRequestRejected = exports.HttpUpstreamSink = exports.UPDATED_AT_FIELD = exports.VERSION_FIELD = exports.MongoUpstreamSink = exports.SYNC_OBJECT_PREFIX = exports.DEAD_LETTER_TABLE = exports.STATE_TABLE = exports.OUTBOX_TABLE = exports.SyncOutbox = exports.SyncReplicator = void 0;
+var replicator_js_1 = require("./replicator.js");
+Object.defineProperty(exports, "SyncReplicator", { enumerable: true, get: function () { return replicator_js_1.SyncReplicator; } });
+var outbox_js_1 = require("./outbox.js");
+Object.defineProperty(exports, "SyncOutbox", { enumerable: true, get: function () { return outbox_js_1.SyncOutbox; } });
+Object.defineProperty(exports, "OUTBOX_TABLE", { enumerable: true, get: function () { return outbox_js_1.OUTBOX_TABLE; } });
+Object.defineProperty(exports, "STATE_TABLE", { enumerable: true, get: function () { return outbox_js_1.STATE_TABLE; } });
+Object.defineProperty(exports, "DEAD_LETTER_TABLE", { enumerable: true, get: function () { return outbox_js_1.DEAD_LETTER_TABLE; } });
+Object.defineProperty(exports, "SYNC_OBJECT_PREFIX", { enumerable: true, get: function () { return outbox_js_1.SYNC_OBJECT_PREFIX; } });
+var mongoSink_js_1 = require("./mongoSink.js");
+Object.defineProperty(exports, "MongoUpstreamSink", { enumerable: true, get: function () { return mongoSink_js_1.MongoUpstreamSink; } });
+Object.defineProperty(exports, "VERSION_FIELD", { enumerable: true, get: function () { return mongoSink_js_1.VERSION_FIELD; } });
+Object.defineProperty(exports, "UPDATED_AT_FIELD", { enumerable: true, get: function () { return mongoSink_js_1.UPDATED_AT_FIELD; } });
+var httpSink_js_1 = require("./httpSink.js");
+Object.defineProperty(exports, "HttpUpstreamSink", { enumerable: true, get: function () { return httpSink_js_1.HttpUpstreamSink; } });
+Object.defineProperty(exports, "SyncRequestRejected", { enumerable: true, get: function () { return httpSink_js_1.SyncRequestRejected; } });
+var commands_js_1 = require("./commands.js");
+Object.defineProperty(exports, "buildWriteCommand", { enumerable: true, get: function () { return commands_js_1.buildWriteCommand; } });
+Object.defineProperty(exports, "toUpstreamId", { enumerable: true, get: function () { return commands_js_1.toUpstreamId; } });
+var mongoExecutor_js_1 = require("./mongoExecutor.js");
+Object.defineProperty(exports, "executeWrites", { enumerable: true, get: function () { return mongoExecutor_js_1.executeWrites; } });
+Object.defineProperty(exports, "fetchDocuments", { enumerable: true, get: function () { return mongoExecutor_js_1.fetchDocuments; } });
+var protocol_js_1 = require("./protocol.js");
+Object.defineProperty(exports, "SYNC_PROTOCOL_VERSION", { enumerable: true, get: function () { return protocol_js_1.SYNC_PROTOCOL_VERSION; } });
+Object.defineProperty(exports, "SyncProtocolError", { enumerable: true, get: function () { return protocol_js_1.SyncProtocolError; } });
+Object.defineProperty(exports, "encodeBody", { enumerable: true, get: function () { return protocol_js_1.encodeBody; } });
+Object.defineProperty(exports, "decodeBody", { enumerable: true, get: function () { return protocol_js_1.decodeBody; } });
+Object.defineProperty(exports, "toWireOperation", { enumerable: true, get: function () { return protocol_js_1.toWireOperation; } });
+Object.defineProperty(exports, "fromWireOperation", { enumerable: true, get: function () { return protocol_js_1.fromWireOperation; } });
+var shadow_js_1 = require("./shadow.js");
+Object.defineProperty(exports, "SyncShadow", { enumerable: true, get: function () { return shadow_js_1.SyncShadow; } });
+Object.defineProperty(exports, "SHADOW_TABLE", { enumerable: true, get: function () { return shadow_js_1.SHADOW_TABLE; } });
+Object.defineProperty(exports, "projectToLocalShape", { enumerable: true, get: function () { return shadow_js_1.projectToLocalShape; } });
+var diff_js_1 = require("./diff.js");
+Object.defineProperty(exports, "computeDiff", { enumerable: true, get: function () { return diff_js_1.computeDiff; } });
+Object.defineProperty(exports, "applyDiff", { enumerable: true, get: function () { return diff_js_1.applyDiff; } });
+Object.defineProperty(exports, "isEmptyDiff", { enumerable: true, get: function () { return diff_js_1.isEmptyDiff; } });
+Object.defineProperty(exports, "deepEqual", { enumerable: true, get: function () { return diff_js_1.deepEqual; } });

package/dist/cjs/sync/mongoExecutor.js

@@ -0,0 +1,306 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeWrites = executeWrites;
+exports.classifyBulkError = classifyBulkError;
+exports.fetchDocuments = fetchDocuments;
+/**
+ * Applies prepared write commands to MongoDB and classifies the outcome.
+ *
+ * Shared by the direct sink and by the HTTP receiver, so the subtle part has exactly
+ * one implementation: **a lost compare-and-swap raises no error.** It is a silent
+ * zero-match in an aggregate count, which means detecting it takes deliberate work —
+ * comparing what the batch expected to change against what the server says changed, and
+ * then re-reading the candidates to find out which document actually lost.
+ */
+const commands_js_1 = require("./commands.js");
+const diff_js_1 = require("./diff.js");
+/**
+ * MongoDB server error codes that mean "this write will never succeed" — retrying them
+ * would stall the stream behind one bad document forever, so they are dead-lettered.
+ */
+const PERMANENT_ERROR_CODES = new Set([
+    2, // BadValue
+    9, // FailedToParse
+    10334, // BSONObjectTooLarge
+    14, // TypeMismatch
+    52, // DollarPrefixedFieldName
+    56, // EmptyFieldName
+    121, // DocumentValidationFailure
+    17280, // KeyTooLong
+]);
+/** MongoDB's duplicate-key code. On an insert-if-absent it means we lost a create race. */
+const DUPLICATE_KEY = 11000;
+/**
+ * Runs prepared writes against a database, one `bulkWrite` per collection.
+ *
+ * Throws on transient failure (network, election, timeout) so the caller retries the
+ * whole batch without checkpointing. Returns per-operation failures and conflicts for
+ * everything it could classify.
+ */
+async function executeWrites(db, writes, options = {}) {
+    const { writeConcern = { w: 'majority' }, versioning = true, idMapping, ObjectId } = options;
+    const byCollection = new Map();
+    for (const write of writes) {
+        const bucket = byCollection.get(write.op.collection);
+        if (bucket)
+            bucket.push(write);
+        else
+            byCollection.set(write.op.collection, [write]);
+    }
+    const failures = [];
+    const conflicts = [];
+    let applied = 0;
+    for (const [collectionName, entries] of byCollection) {
+        let result = null;
+        let rejected = 0;
+        try {
+            result = await db.collection(collectionName).bulkWrite(entries.map((entry) => entry.command), {
+                // Operations within a batch touch distinct documents, so ordering buys
+                // nothing and unordered lets the server parallelise.
+                ordered: false,
+                writeConcern,
+            });
+        }
+        catch (err) {
+            const bulkFailures = classifyBulkError(err, entries.length);
+            // A transient failure means the whole batch's fate is unknown — throw so the
+            // caller retries it rather than checkpointing work that may not have landed.
+            if (bulkFailures === null)
+                throw err;
+            for (const failure of bulkFailures) {
+                const entry = entries[failure.index];
+                if (!entry)
+                    continue;
+                // A duplicate `_id` on an insert-if-absent means someone created the document
+                // first — a conflict to reconcile, not a poison document. A duplicate on any
+                // *other* unique index is a real constraint violation and must be dead-lettered,
+                // or it would be retried forever as a phantom conflict.
+                if (failure.code === DUPLICATE_KEY && isIdIndexViolation(failure)) {
+                    conflicts.push({ index: entry.index, reason: 'already-exists' });
+                }
+                else {
+                    failures.push({ index: entry.index, message: failure.message, code: failure.code });
+                }
+            }
+            rejected = bulkFailures.length;
+            result = err.result ?? null;
+        }
+        const landed = entries.length - rejected;
+        const suspects = findMisses(entries, result, rejected, versioning);
+        // `suspects` are candidates to investigate, not confirmed misses: the counts are
+        // aggregate, so one short count implicates every conditional write in the batch.
+        // Only the re-read says which of them actually lost, and `applied` must be reduced
+        // by that number rather than by the number investigated.
+        const confirmed = suspects.length
+            ? await describeConflicts(db, collectionName, suspects, conflicts, idMapping, ObjectId)
+            : 0;
+        applied += landed - confirmed;
+    }
+    return {
+        applied,
+        failures: failures.length > 0 ? failures : undefined,
+        conflicts: conflicts.length > 0 ? conflicts : undefined,
+    };
+}
+/**
+ * Identifies operations whose conditional write may not have matched.
+ *
+ * `bulkWrite` reports only aggregate counts, so this compares what the batch expected
+ * to change against what the server says changed. When the numbers agree, nothing was
+ * missed and no per-document work is needed.
+ */
+function findMisses(entries, result, rejected, versioning) {
+    if (!versioning || result === null || rejected === entries.length)
+        return [];
+    const candidates = entries.filter((entry) => (0, commands_js_1.isConditional)(entry.op));
+    if (candidates.length === 0)
+        return [];
+    const writes = candidates.filter((entry) => entry.op.type !== 'delete');
+    const deletes = candidates.filter((entry) => entry.op.type === 'delete');
+    const acknowledgedWrites = (result.matchedCount ?? 0) + (result.upsertedCount ?? 0);
+    const acknowledgedDeletes = result.deletedCount ?? 0;
+    const missed = [];
+    // The counts are aggregate, so which specific documents missed is unknown; the
+    // caller re-reads the candidates and decides per document.
+    if (acknowledgedWrites < writes.length)
+        missed.push(...writes);
+    if (acknowledgedDeletes < deletes.length)
+        missed.push(...deletes);
+    return missed;
+}
+/**
+ * Re-reads the upstream state of operations that may have missed, and records a
+ * conflict for each one whose version really has moved on.
+ *
+ * The re-read turns an aggregate "something didn't match" into a precise, per-document
+ * answer, and supplies the current server document the caller needs to reconcile.
+ *
+ * @returns How many candidates genuinely lost.
+ */
+async function describeConflicts(db, collectionName, candidates, conflicts, idMapping, ObjectId) {
+    const ids = candidates.map((entry) => (0, commands_js_1.toUpstreamId)(entry.op.documentId, idMapping, ObjectId));
+    const current = await db
+        .collection(collectionName)
+        .find({ _id: { $in: ids } })
+        .toArray();
+    const byId = new Map(current.map((doc) => [String(doc._id), doc]));
+    let confirmed = 0;
+    for (const { index, op } of candidates) {
+        const serverDocument = byId.get(op.documentId);
+        const serverVersion = (0, commands_js_1.readVersion)(serverDocument);
+        if (op.type === 'delete') {
+            // Already gone upstream is the outcome we wanted, however it happened.
+            if (!serverDocument)
+                continue;
+            conflicts.push({ index, reason: 'version-mismatch', serverDocument, serverVersion });
+            confirmed += 1;
+            continue;
+        }
+        if (!serverDocument) {
+            conflicts.push({ index, reason: 'missing' });
+            confirmed += 1;
+            continue;
+        }
+        // The write may have landed after all, with a different operation in the batch
+        // being the one that missed.
+        //
+        // A version one ahead is necessary evidence but nowhere near sufficient: another
+        // writer following the same protocol also bumps `_v` by exactly one, so the two
+        // cases look identical from the version alone. Confirming that the document
+        // actually carries our change is what tells them apart — and getting this wrong
+        // silently swallows the very conflicts this machinery exists to catch.
+        if ((0, commands_js_1.isConditional)(op) &&
+            serverVersion === op.baseVersion + 1 &&
+            reflectsWrite(serverDocument, op)) {
+            continue;
+        }
+        conflicts.push({ index, reason: 'version-mismatch', serverDocument, serverVersion });
+        confirmed += 1;
+    }
+    return confirmed;
+}
+/**
+ * Splits a driver error into per-operation permanent failures.
+ *
+ * @returns The failures to dead-letter, or `null` when the error is transient and the
+ * whole batch should be retried.
+ */
+function classifyBulkError(err, operationCount) {
+    const error = err;
+    // The driver retried and still could not reach a writable primary.
+    if (error.hasErrorLabel?.('RetryableWriteError'))
+        return null;
+    const writeErrors = error.writeErrors ?? error.result?.writeErrors;
+    if (Array.isArray(writeErrors) && writeErrors.length > 0) {
+        const failures = [];
+        for (const writeError of writeErrors) {
+            const code = writeError.code;
+            // An unrecognised write error might be transient (a duplicate key during a
+            // failover, say), so the batch is worth retrying whole. A duplicate key is
+            // handled separately by the caller, as a create race rather than a defect.
+            if (code === undefined || (code !== DUPLICATE_KEY && !PERMANENT_ERROR_CODES.has(code))) {
+                return null;
+            }
+            const index = writeError.index ?? 0;
+            if (index >= operationCount)
+                return null;
+            failures.push({
+                index,
+                message: writeError.errmsg ?? writeError.message ?? `write error ${code}`,
+                code,
+                keyPattern: writeError.keyPattern,
+            });
+        }
+        return failures;
+    }
+    // No per-write detail: a connection, timeout or auth error. Retry it.
+    return null;
+}
+/**
+ * True when the upstream document carries the change this operation was making.
+ *
+ * Only the paths the operation itself wrote are checked. That is deliberate: those are
+ * the values we would have written in local JSON form, so comparing them against the
+ * server is meaningful, whereas fields we never touched may hold BSON types the local
+ * store cannot represent and would not compare equal.
+ *
+ * A false positive is possible if another writer happened to set the identical value —
+ * and is harmless, since the upstream then holds what we wanted anyway.
+ */
+function reflectsWrite(serverDocument, op) {
+    if (op.diff) {
+        for (const [path, value] of Object.entries(op.diff.set)) {
+            if ((0, commands_js_1.isReservedPath)(path))
+                continue;
+            if (!valueAtPathEquals(serverDocument, path, value))
+                return false;
+        }
+        for (const path of op.diff.unset) {
+            if ((0, commands_js_1.isReservedPath)(path))
+                continue;
+            if (readPath(serverDocument, path) !== undefined)
+                return false;
+        }
+        return true;
+    }
+    // Whole-document write: every field we sent should be present upstream.
+    for (const [key, value] of Object.entries((0, commands_js_1.stripReservedFields)(op.document ?? {}))) {
+        if (!valueAtPathEquals(serverDocument, key, value))
+            return false;
+    }
+    return true;
+}
+/**
+ * Compares a value at a dotted path against what we wrote.
+ *
+ * The server side is flattened to local JSON shape first, so a `Date` upstream compares
+ * equal to the ISO string a local write would have carried.
+ */
+function valueAtPathEquals(document, path, expected) {
+    const actual = readPath(document, path);
+    if (actual === undefined)
+        return false;
+    try {
+        return (0, diff_js_1.deepEqual)(JSON.parse(JSON.stringify(actual)), expected);
+    }
+    catch {
+        return false;
+    }
+}
+/** Reads a dotted path, returning `undefined` if any segment is missing. */
+function readPath(document, path) {
+    let current = document;
+    for (const segment of path.split('.')) {
+        if (typeof current !== 'object' || current === null)
+            return undefined;
+        current = current[segment];
+        if (current === undefined)
+            return undefined;
+    }
+    return current;
+}
+/**
+ * True when a duplicate-key error is about the `_id` index specifically.
+ *
+ * MongoDB reports the offending index in `keyPattern` (and names it in `errmsg`), which
+ * is the only way to tell "someone else created this document" apart from "this document
+ * violates a unique constraint on some other field".
+ */
+function isIdIndexViolation(failure) {
+    if (failure.keyPattern) {
+        const keys = Object.keys(failure.keyPattern);
+        return keys.length === 1 && keys[0] === '_id';
+    }
+    // Older servers and some drivers only give the message; the index name appears in it.
+    return /index:\s*_id_/.test(failure.message);
+}
+/** Reads documents back by `_id`, for refreshing a shadow after a conflict. */
+async function fetchDocuments(db, collection, documentIds, idMapping, ObjectId) {
+    if (documentIds.length === 0)
+        return [];
+    const ids = documentIds.map((id) => (0, commands_js_1.toUpstreamId)(id, idMapping, ObjectId));
+    return db
+        .collection(collection)
+        .find({ _id: { $in: ids } })
+        .toArray();
+}