mongodb 7.5.0 → 7.6.0

package/src/bulk/ordered.ts

@@ -17,13 +17,28 @@ export class OrderedBulkOperation extends BulkOperationBase {
     batchType: BatchType,
     document: Document | UpdateStatement | DeleteStatement
   ): this {
-    // Get the bsonSize
-    const bsonSize = BSON.calculateObjectSize(document, {
-      checkKeys: false,
-      // Since we don't know what the user selected for BSON options here,
-      // err on the safe side, and check the size with ignoreUndefined: false.
-      ignoreUndefined: false
-    } as any);
+    // Serialize the operation once here and reuse the bytes for both the size
+    // check/splitting and the wire message (via a DocumentSequence). Under
+    // auto-encryption the command is sent as a BSON array rather than a
+    // document sequence, so the buffer would never be reused; there we only
+    // measure the size and leave `buffer` undefined so nothing is retained on
+    // the batch.
+    let buffer: Uint8Array | undefined;
+    let bsonSize: number;
+    if (this.s.usingAutoEncryption) {
+      bsonSize = BSON.calculateObjectSize(document, {
+        checkKeys: false,
+        ignoreUndefined: false
+      } as any);
+    } else {
+      const bson = this.s.bsonOptions;
+      buffer = BSON.serialize(document, {
+        checkKeys: this.s.checkKeys,
+        ignoreUndefined: bson.ignoreUndefined,
+        serializeFunctions: bson.serializeFunctions
+      });
+      bsonSize = buffer.length;
+    }
 
     // Throw error if the doc is bigger than the max BSON size
     if (bsonSize >= this.s.maxBsonObjectSize)
@@ -75,6 +90,7 @@ export class OrderedBulkOperation extends BulkOperationBase {
 
     this.s.currentBatch.originalIndexes.push(this.s.currentIndex);
     this.s.currentBatch.operations.push(document);
+    if (buffer != null) this.s.currentBatch.serializedOperations.push(buffer);
     this.s.currentBatchSize += 1;
     this.s.currentBatchSizeBytes += maxKeySize + bsonSize;
     this.s.currentIndex += 1;

package/src/bulk/unordered.ts

@@ -31,14 +31,28 @@ export class UnorderedBulkOperation extends BulkOperationBase {
     batchType: BatchType,
     document: Document | UpdateStatement | DeleteStatement
   ): this {
-    // Get the bsonSize
-    const bsonSize = BSON.calculateObjectSize(document, {
-      checkKeys: false,
-
-      // Since we don't know what the user selected for BSON options here,
-      // err on the safe side, and check the size with ignoreUndefined: false.
-      ignoreUndefined: false
-    } as any);
+    // Serialize the operation once here and reuse the bytes for both the size
+    // check/splitting and the wire message (via a DocumentSequence). Under
+    // auto-encryption the command is sent as a BSON array rather than a
+    // document sequence, so the buffer would never be reused; there we only
+    // measure the size and leave `buffer` undefined so nothing is retained on
+    // the batch.
+    let buffer: Uint8Array | undefined;
+    let bsonSize: number;
+    if (this.s.usingAutoEncryption) {
+      bsonSize = BSON.calculateObjectSize(document, {
+        checkKeys: false,
+        ignoreUndefined: false
+      } as any);
+    } else {
+      const bson = this.s.bsonOptions;
+      buffer = BSON.serialize(document, {
+        checkKeys: this.s.checkKeys,
+        ignoreUndefined: bson.ignoreUndefined,
+        serializeFunctions: bson.serializeFunctions
+      });
+      bsonSize = buffer.length;
+    }
 
     // Throw error if the doc is bigger than the max BSON size
     if (bsonSize >= this.s.maxBsonObjectSize) {
@@ -90,6 +104,7 @@ export class UnorderedBulkOperation extends BulkOperationBase {
     }
 
     this.s.currentBatch.operations.push(document);
+    if (buffer != null) this.s.currentBatch.serializedOperations.push(buffer);
     this.s.currentBatch.originalIndexes.push(this.s.currentIndex);
     this.s.currentIndex = this.s.currentIndex + 1;
 

package/src/client-side-encryption/auto_encrypter.ts

@@ -11,6 +11,7 @@ import { type Abortable } from '../mongo_types';
 import { MongoDBCollectionNamespace } from '../utils';
 import { autoSelectSocketOptions } from './client_encryption';
 import { defaultErrorWrapper, MongoCryptInvalidArgumentError } from './errors';
+import { type CSFLEKMSTlsOptions, type KMSConnectCallback } from './kms_options';
 import { MongocryptdManager } from './mongocryptd_manager';
 import {
   type CredentialProviders,
@@ -18,7 +19,7 @@ import {
   type KMSProviders,
   refreshKMSCredentials
 } from './providers';
-import { type CSFLEKMSTlsOptions, StateMachine } from './state_machine';
+import { StateMachine } from './state_machine';
 
 /** @public */
 export interface AutoEncryptionOptions {
@@ -110,6 +111,12 @@ export interface AutoEncryptionOptions {
   proxyOptions?: ProxyOptions;
   /** The TLS options to use connecting to the KMS provider */
   tlsOptions?: CSFLEKMSTlsOptions;
+  /**
+   * A callback that establishes the socket used to connect to a KMS host, e.g. to route KMS
+   * requests through an HTTP proxy via the HTTP CONNECT method. Mutually exclusive with `proxyOptions`.
+   * See {@link KMSConnectCallback} for a usage example.
+   */
+  kmsConnectCallback?: KMSConnectCallback;
 }
 
 /**
@@ -156,6 +163,7 @@ export class AutoEncrypter {
   _metaDataClient: MongoClient;
   _proxyOptions: ProxyOptions;
   _tlsOptions: CSFLEKMSTlsOptions;
+  _kmsConnectCallback?: KMSConnectCallback;
   _kmsProviders: KMSProviders;
   _bypassMongocryptdAndCryptShared: boolean;
   _contextCounter: number;
@@ -242,7 +250,13 @@ export class AutoEncrypter {
     this._keyVaultClient = options.keyVaultClient || client;
     this._metaDataClient = options.metadataClient || client;
     this._proxyOptions = options.proxyOptions || {};
+    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {
+      throw new MongoCryptInvalidArgumentError(
+        'Cannot set both proxyOptions and kmsConnectCallback'
+      );
+    }
     this._tlsOptions = options.tlsOptions || {};
+    this._kmsConnectCallback = options.kmsConnectCallback;
     this._kmsProviders = options.kmsProviders || {};
     this._credentialProviders = options.credentialProviders;
 
@@ -417,7 +431,8 @@ export class AutoEncrypter {
       promoteLongs: false,
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     return deserialize(await stateMachine.execute(this, context, options), {
@@ -443,7 +458,8 @@ export class AutoEncrypter {
       ...options,
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     return await stateMachine.execute(this, context, options);

package/src/client-side-encryption/client_encryption.ts

@@ -31,6 +31,11 @@ import {
   MongoCryptCreateEncryptedCollectionError,
   MongoCryptInvalidArgumentError
 } from './errors';
+import {
+  type ClientEncryptionSocketOptions,
+  type CSFLEKMSTlsOptions,
+  type KMSConnectCallback
+} from './kms_options';
 import {
   type ClientEncryptionDataKeyProvider,
   type CredentialProviders,
@@ -38,11 +43,7 @@ import {
   type KMSProviders,
   refreshKMSCredentials
 } from './providers/index';
-import {
-  type ClientEncryptionSocketOptions,
-  type CSFLEKMSTlsOptions,
-  StateMachine
-} from './state_machine';
+import { StateMachine } from './state_machine';
 
 /**
  * @public
@@ -75,6 +76,8 @@ export class ClientEncryption {
   /** @internal */
   _tlsOptions: CSFLEKMSTlsOptions;
   /** @internal */
+  _kmsConnectCallback?: KMSConnectCallback;
+  /** @internal */
   _kmsProviders: KMSProviders;
   /** @internal */
   _timeoutMS?: number;
@@ -125,7 +128,13 @@ export class ClientEncryption {
   constructor(client: MongoClient, options: ClientEncryptionOptions) {
     this._client = client;
     this._proxyOptions = options.proxyOptions ?? {};
+    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {
+      throw new MongoCryptInvalidArgumentError(
+        'Cannot set both proxyOptions and kmsConnectCallback'
+      );
+    }
     this._tlsOptions = options.tlsOptions ?? {};
+    this._kmsConnectCallback = options.kmsConnectCallback;
     this._kmsProviders = options.kmsProviders || {};
     const { timeoutMS } = resolveTimeoutOptions(client, options);
     this._timeoutMS = timeoutMS;
@@ -226,7 +235,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     const timeoutContext =
@@ -295,7 +305,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     const timeoutContext = TimeoutContext.create(
@@ -699,7 +710,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
 
     const timeoutContext =
@@ -797,7 +809,8 @@ export class ClientEncryption {
     const stateMachine = new StateMachine({
       proxyOptions: this._proxyOptions,
       tlsOptions: this._tlsOptions,
-      socketOptions: autoSelectSocketOptions(this._client.s.options)
+      socketOptions: autoSelectSocketOptions(this._client.s.options),
+      kmsConnectCallback: this._kmsConnectCallback
     });
     const context = this._mongoCrypt.makeExplicitEncryptionContext(valueBuffer, contextOptions);
 
@@ -961,6 +974,13 @@ export interface ClientEncryptionOptions {
    */
   tlsOptions?: CSFLEKMSTlsOptions;
 
+  /**
+   * A callback that establishes the socket used to connect to a KMS host, e.g. to route KMS
+   * requests through an HTTP proxy via the HTTP CONNECT method. Mutually exclusive with `proxyOptions`.
+   * See {@link KMSConnectCallback} for a usage example.
+   */
+  kmsConnectCallback?: KMSConnectCallback;
+
   /**
    * Sets the expiration time for the DEK in the cache in milliseconds. Defaults to 60000. 0 means no timeout.
    */

package/src/client-side-encryption/kms_options.ts

@@ -0,0 +1,93 @@
+import { type Duplex } from 'stream';
+
+import { type MongoClientOptions } from '../mongo_client';
+
+/**
+ * @public
+ *
+ * TLS options to use when connecting. The spec specifically calls out which insecure
+ * tls options are not allowed:
+ *
+ *  - tlsAllowInvalidCertificates
+ *  - tlsAllowInvalidHostnames
+ *  - tlsInsecure
+ *
+ * These options are not included in the type, and are ignored if provided.
+ */
+export type ClientEncryptionTlsOptions = Pick<
+  MongoClientOptions,
+  'tlsCAFile' | 'tlsCertificateKeyFile' | 'tlsCertificateKeyFilePassword' | 'secureContext'
+>;
+
+/** @public */
+export type CSFLEKMSTlsOptions = {
+  aws?: ClientEncryptionTlsOptions;
+  gcp?: ClientEncryptionTlsOptions;
+  kmip?: ClientEncryptionTlsOptions;
+  local?: ClientEncryptionTlsOptions;
+  azure?: ClientEncryptionTlsOptions;
+
+  [key: string]: ClientEncryptionTlsOptions | undefined;
+};
+
+/**
+ * @public
+ *
+ * Socket options to use for KMS requests.
+ */
+export type ClientEncryptionSocketOptions = Pick<
+  MongoClientOptions,
+  'autoSelectFamily' | 'autoSelectFamilyAttemptTimeout'
+>;
+
+/**
+ * @public
+ *
+ * A callback that establishes the connection to a KMS host.
+ *
+ * When provided on `AutoEncryptionOptions` or `ClientEncryptionOptions`, the driver invokes this
+ * callback instead of connecting to the KMS host itself, passing the target `host` and `port`. The
+ * callback MUST return a `Duplex` stream connected to the KMS host, either directly or tunneled
+ * through a proxy; a `net.Socket` satisfies this, as does any other `Duplex`. The returned stream is
+ * passed to Node.js' `tls.connect()` as its `socket`, and the driver performs the KMS host's TLS
+ * handshake over it using the KMS provider's configured TLS options. The callback therefore MUST NOT
+ * perform the KMS host's TLS handshake itself, though it MAY use TLS for its own transport, e.g. when
+ * connecting to an HTTPS proxy. This enables routing KMS requests through an HTTP proxy via the HTTP
+ * CONNECT method.
+ *
+ * When the operation has a client-side operation timeout (CSOT) configured, `timeoutMS` is the
+ * remaining time budget in milliseconds; it is `undefined` otherwise. The `signal` aborts when the
+ * connection attempt exceeds that budget; the callback should stop connecting and reject when it fires.
+ *
+ * @example <caption>Route KMS requests through an HTTP proxy using the HTTP CONNECT method</caption>
+ * ```ts
+ * import * as net from 'net';
+ *
+ * const kmsConnectCallback: KMSConnectCallback = ({ host, port, signal }) =>
+ *   new Promise((resolve, reject) => {
+ *     // Open a plain connection to the proxy, not to the KMS host.
+ *     const socket = net.connect({ host: 'proxy.example.com', port: 8080, signal });
+ *     socket.once('error', reject);
+ *     socket.once('connect', () => {
+ *       // Ask the proxy to tunnel to the KMS host, then hand the socket back for the driver's TLS.
+ *       socket.write(`CONNECT ${host}:${port} HTTP/1.1\r\nHost: ${host}:${port}\r\n\r\n`);
+ *       socket.once('data', chunk => {
+ *         if (chunk.toString('utf8').startsWith('HTTP/1.1 200')) resolve(socket);
+ *         else reject(new Error('Proxy refused the CONNECT request'));
+ *       });
+ *     });
+ *   });
+ *
+ * const clientEncryption = new ClientEncryption(keyVaultClient, {
+ *   keyVaultNamespace,
+ *   kmsProviders,
+ *   kmsConnectCallback
+ * });
+ * ```
+ */
+export type KMSConnectCallback = (options: {
+  host: string;
+  port: number;
+  timeoutMS?: number;
+  signal: AbortSignal;
+}) => Promise<Duplex>;

package/src/client-side-encryption/state_machine.ts

@@ -15,7 +15,7 @@ import { type ProxyOptions } from '../cmap/connection';
 import { CursorTimeoutContext } from '../cursor/abstract_cursor';
 import { getSocks, type SocksLib } from '../deps';
 import { MongoOperationTimeoutError } from '../error';
-import { type MongoClient, type MongoClientOptions } from '../mongo_client';
+import { type MongoClient } from '../mongo_client';
 import { type Abortable } from '../mongo_types';
 import { type CollectionInfo } from '../operations/list_collections';
 import { Timeout, type TimeoutContext, TimeoutError } from '../timeout';
@@ -28,6 +28,12 @@ import {
 } from '../utils';
 import { autoSelectSocketOptions, type DataKey } from './client_encryption';
 import { MongoCryptError } from './errors';
+import {
+  type ClientEncryptionSocketOptions,
+  type ClientEncryptionTlsOptions,
+  type CSFLEKMSTlsOptions,
+  type KMSConnectCallback
+} from './kms_options';
 import { type MongocryptdManager } from './mongocryptd_manager';
 import { type KMSProviders } from './providers';
 
@@ -93,44 +99,6 @@ declare module 'mongodb-client-encryption' {
   }
 }
 
-/**
- * @public
- *
- * TLS options to use when connecting. The spec specifically calls out which insecure
- * tls options are not allowed:
- *
- *  - tlsAllowInvalidCertificates
- *  - tlsAllowInvalidHostnames
- *  - tlsInsecure
- *
- * These options are not included in the type, and are ignored if provided.
- */
-export type ClientEncryptionTlsOptions = Pick<
-  MongoClientOptions,
-  'tlsCAFile' | 'tlsCertificateKeyFile' | 'tlsCertificateKeyFilePassword' | 'secureContext'
->;
-
-/** @public */
-export type CSFLEKMSTlsOptions = {
-  aws?: ClientEncryptionTlsOptions;
-  gcp?: ClientEncryptionTlsOptions;
-  kmip?: ClientEncryptionTlsOptions;
-  local?: ClientEncryptionTlsOptions;
-  azure?: ClientEncryptionTlsOptions;
-
-  [key: string]: ClientEncryptionTlsOptions | undefined;
-};
-
-/**
- * @public
- *
- * Socket options to use for KMS requests.
- */
-export type ClientEncryptionSocketOptions = Pick<
-  MongoClientOptions,
-  'autoSelectFamily' | 'autoSelectFamilyAttemptTimeout'
->;
-
 /**
  * This is kind of a hack.  For `rewrapManyDataKey`, we have tests that
  * guarantee that when there are no matching keys, `rewrapManyDataKey` returns
@@ -173,6 +141,9 @@ export type StateMachineOptions = {
 
   /** Socket specific options we support. */
   socketOptions: ClientEncryptionSocketOptions;
+
+  /** Optional callback that establishes the KMS socket, if set. */
+  kmsConnectCallback?: KMSConnectCallback;
 } & Pick<BSONSerializeOptions, 'promoteLongs' | 'promoteValues'>;
 
 /**
@@ -388,9 +359,55 @@ export class StateMachine {
     }
 
     let abortListener;
+    let kmsRequestTimeout: Timeout | undefined;
 
     try {
-      if (this.options.proxyOptions && this.options.proxyOptions.proxyHost) {
+      options?.signal?.throwIfAborted();
+
+      if (this.options.kmsConnectCallback) {
+        const remainingTimeMS = options?.timeoutContext?.csotEnabled()
+          ? options.timeoutContext.getRemainingTimeMSOrThrow(
+              `KMS request timed out after ${options.timeoutContext.timeoutMS}ms`
+            )
+          : undefined;
+        // A non-finite budget (timeoutMS: 0) means no timeout; otherwise back the callback with one.
+        const timeoutMS = Number.isFinite(remainingTimeMS) ? remainingTimeMS : undefined;
+        const controller = new AbortController();
+        // Forward the operation's own abort signal so aborting the operation also aborts the callback.
+        const forwardAbort = addAbortListener(options?.signal, function () {
+          controller.abort(this.reason);
+        });
+        const connectPromise = this.options.kmsConnectCallback({
+          host: socketOptions.host,
+          port: socketOptions.port,
+          timeoutMS,
+          signal: controller.signal
+        });
+        // If the callback resolves a socket after we already aborted, close it so it does not leak.
+        connectPromise.then(
+          resolvedSocket => {
+            if (controller.signal.aborted) resolvedSocket.destroy();
+          },
+          () => null
+        );
+        const timeout = timeoutMS ? Timeout.expires(timeoutMS) : undefined;
+        try {
+          socketOptions.socket = timeout
+            ? await Promise.race([connectPromise, timeout])
+            : await connectPromise;
+        } catch (err) {
+          if (TimeoutError.is(err)) {
+            const timeoutError = new MongoOperationTimeoutError('KMS request timed out');
+            // Abort with the timeout error as the reason so the callback sees it on `signal.reason`.
+            controller.abort(timeoutError);
+            throw timeoutError;
+          }
+          throw onerror(err);
+        } finally {
+          timeout?.clear();
+          forwardAbort?.[kDispose]();
+        }
+      } else if (this.options.proxyOptions && this.options.proxyOptions.proxyHost) {
         netSocket = new net.Socket();
 
         const {
@@ -465,20 +482,24 @@ export class StateMachine {
             resolve();
           }
         });
-      await (options?.timeoutContext?.csotEnabled()
-        ? Promise.all([
-            willResolveKmsRequest,
-            Timeout.expires(options.timeoutContext?.remainingTimeMS)
-          ])
+      const remainingTimeMS = options?.timeoutContext?.csotEnabled()
+        ? options.timeoutContext.getRemainingTimeMSOrThrow(
+            `KMS request timed out after ${options.timeoutContext.timeoutMS}ms`
+          )
+        : undefined;
+      const timeoutMS = Number.isFinite(remainingTimeMS) ? remainingTimeMS : undefined;
+      kmsRequestTimeout = timeoutMS ? Timeout.expires(timeoutMS) : undefined;
+      await (kmsRequestTimeout
+        ? Promise.race([willResolveKmsRequest, kmsRequestTimeout])
         : willResolveKmsRequest);
     } catch (error) {
-      if (error instanceof TimeoutError)
-        throw new MongoOperationTimeoutError('KMS request timed out');
+      if (TimeoutError.is(error)) throw new MongoOperationTimeoutError('KMS request timed out');
       throw error;
     } finally {
       // There's no need for any more activity on this socket at this point.
       destroySockets();
       abortListener?.[kDispose]();
+      kmsRequestTimeout?.clear();
     }
   }
 

package/src/cmap/auth/gssapi.ts

@@ -69,10 +69,7 @@ export class GSSAPI extends AuthProvider {
 }
 
 async function makeKerberosClient({
-  options: {
-    hostAddress,
-    runtime: { os }
-  },
+  options: { hostAddress, runtime },
   credentials
 }: AuthContext): Promise<KerberosClient> {
   if (!hostAddress || typeof hostAddress.host !== 'string' || !credentials) {
@@ -81,6 +78,8 @@ async function makeKerberosClient({
     );
   }
 
+  const { os } = await runtime;
+
   loadKrb();
   if ('kModuleError' in krb) {
     throw krb['kModuleError'];

package/src/cmap/auth/mongo_credentials.ts

@@ -25,7 +25,6 @@ function getDefaultAuthMechanism(hello: Document | null): AuthMechanism {
     }
   }
 
-  // Default auth mechanism for 4.0 and higher.
   return AuthMechanism.MONGODB_SCRAM_SHA256;
 }
 

package/src/cmap/auth/mongodb_aws.ts

@@ -1,11 +1,7 @@
 import { type Binary, type BSONSerializeOptions, ByteUtils } from '../../bson';
 import * as BSON from '../../bson';
-import {
-  MongoCompatibilityError,
-  MongoMissingCredentialsError,
-  MongoRuntimeError
-} from '../../error';
-import { maxWireVersion, ns, randomBytes } from '../../utils';
+import { MongoMissingCredentialsError, MongoRuntimeError } from '../../error';
+import { ns, randomBytes } from '../../utils';
 import { type AuthContext, AuthProvider } from './auth_provider';
 import {
   type AWSCredentialProvider,
@@ -45,12 +41,6 @@ export class MongoDBAWS extends AuthProvider {
       throw new MongoMissingCredentialsError('AuthContext must provide credentials.');
     }
 
-    if (maxWireVersion(connection) < 9) {
-      throw new MongoCompatibilityError(
-        'MONGODB-AWS authentication requires MongoDB version 4.4 or later'
-      );
-    }
-
     authContext.credentials = await makeTempCredentials(
       authContext.credentials,
       this.credentialFetcher

package/src/cmap/command_monitoring_events.ts

@@ -32,7 +32,7 @@ export class CommandStartedEvent {
   /**
    * Server generated connection id
    * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId"
-   * from the server on 4.2+.
+   * from the server.
    */
   serverConnectionId: bigint | null;
   serviceId?: ObjectId;
@@ -88,7 +88,7 @@ export class CommandSucceededEvent {
   connectionId?: string | number;
   /**
    * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server on 4.2+.
+   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server.
    */
   serverConnectionId: bigint | null;
   requestId: number;
@@ -148,7 +148,7 @@ export class CommandFailedEvent {
   connectionId?: string | number;
   /**
    * Server generated connection id
-   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server on 4.2+.
+   * Distinct from the connection id and is returned by the hello or legacy hello response as "connectionId" from the server.
    */
   serverConnectionId: bigint | null;
   requestId: number;
@@ -249,13 +249,12 @@ const LEGACY_FIND_OPTIONS_MAP = {
 function extractCommand(command: WriteProtocolMessageType): Document {
   if (command instanceof OpMsgRequest) {
     const cmd = { ...command.command };
-    // For OP_MSG with payload type 1 we need to pull the documents
-    // array out of the document sequence for monitoring.
-    if (cmd.ops instanceof DocumentSequence) {
-      cmd.ops = cmd.ops.documents;
-    }
-    if (cmd.nsInfo instanceof DocumentSequence) {
-      cmd.nsInfo = cmd.nsInfo.documents;
+    // For OP_MSG payload type 1, replace any document-sequence field with its
+    // documents array for monitoring (ops, nsInfo, documents, updates, deletes).
+    for (const key of Object.keys(cmd)) {
+      if (cmd[key] instanceof DocumentSequence) {
+        cmd[key] = cmd[key].documents;
+      }
     }
     return cmd;
   }

package/src/cmap/commands.ts

@@ -500,6 +500,23 @@ export class DocumentSequence {
   }
 }
 
+/**
+ * Build a DocumentSequence from documents that have already been serialized,
+ * reusing the provided buffers instead of re-serializing.
+ * @internal
+ */
+export function makeDocumentSequence(
+  field: string,
+  documents: Document[],
+  serialized: Uint8Array[]
+): DocumentSequence {
+  const sequence = new DocumentSequence(field);
+  for (let i = 0; i < documents.length; i++) {
+    sequence.push(documents[i], serialized[i]);
+  }
+  return sequence;
+}
+
 /** @internal */
 export class OpMsgRequest {
   requestId: number;

package/src/cmap/connect.ts

@@ -174,7 +174,7 @@ export async function performInitialHandshake(
 
       if (error instanceof MongoError) {
         error.addErrorLabel(MongoErrorLabel.HandshakeError);
-        if (needsRetryableWriteLabel(error, response.maxWireVersion, conn.description.type)) {
+        if (needsRetryableWriteLabel(error)) {
           error.addErrorLabel(MongoErrorLabel.RetryableWriteError);
         }
       }
@@ -224,7 +224,7 @@ export interface HandshakeDocument extends Document {
   compression: string[];
   saslSupportedMechs?: string;
   loadBalanced?: boolean;
-  backpressure: true;
+  backpressure: '2';
 }
 
 /**
@@ -242,7 +242,7 @@ export async function prepareHandshakeDocument(
 
   const handshakeDoc: HandshakeDocument = {
     [serverApi?.version || options.loadBalanced === true ? 'hello' : LEGACY_HELLO_COMMAND]: 1,
-    backpressure: true,
+    backpressure: '2',
     helloOk: true,
     client: clientMetadata,
     compression: compressors