Module object_id 

objectId generation.

The alphabet and length are part of the contract: clients make assumptions about both, and allowCustomObjectId: false makes the server validate incoming ids against /^[a-zA-Z0-9]{1,}$/ (SchemaController.js).

Upstream: src/cryptoUtils.js, randomString and newObjectId. The alphabet is uppercase, then lowercase, then digits, 62 characters, and the default size is 10.

Divergence, Tier 2, deliberate. Upstream indexes the alphabet with byte % 62, which is biased because 256 is not a multiple of 62: the first 8 characters (A through H) come up about 25% more often than the rest. Upstream’s own comment acknowledges this. The bias is not wire-visible (a client cannot tell a biased 10-char alphanumeric id from an unbiased one), and reproducing a weak RNG on purpose is worse than fixing it, so this uses rejection sampling. This is a deliberate, recorded difference from upstream rather than an oversight.

Constants

DEFAULT_OBJECT_ID_SIZE

Upstream’s newObjectId default (cryptoUtils.js).

Functions

is_valid_auto_object_id

Does this string satisfy upstream’s default objectId shape?

new_object_id

A new objectId. Ten characters unless a size is given.

random_string

A random alphanumeric string of size characters, uniformly distributed over the 62-char alphabet.