@rpcbase/server 0.538.0 → 0.540.0

package/dist/rts/index.js

@@ -1,845 +1,1006 @@
-import { a as normalizeRtsQueryOptions, c as runRtsCount, l as runRtsQuery, n as RTS_USER_ID_HEADER, o as resolveRtsQueryDependencyModelNames, t as RTS_TENANT_ID_QUERY_PARAM } from "../queryExecutor-JadZcQSQ.js";
-import { models } from "@rpcbase/db";
-import { buildAbility, buildAbilityFromSession, getTenantRolesFromSessionUser } from "@rpcbase/db/acl";
 import { randomUUID } from "node:crypto";
+import { models } from "@rpcbase/db";
+import { buildAbilityFromSession, getTenantRolesFromSessionUser, buildAbility } from "@rpcbase/db/acl";
 import { WebSocketServer } from "ws";
-//#region src/rts/routes.ts
-var routes = Object.entries({ .../* @__PURE__ */ Object.assign({
-	"./api/changes/handler.ts": () => import("../handler-Cq6MsoD4.js"),
-	"./api/cleanup/handler.ts": () => import("../handler-CZD5p1Jv.js")
-}) }).reduce((acc, [path, mod]) => {
-	acc[path.replace("./api/", "@rpcbase/server/rts/api/")] = mod;
-	return acc;
+import { R as RTS_TENANT_ID_QUERY_PARAM, d as RTS_USER_ID_HEADER, n as normalizeRtsQueryOptions, e as resolveRtsQueryDependencyModelNames, a as runRtsQuery, c as runRtsCount } from "../queryExecutor-Bol_iR8f.js";
+const routes = Object.entries({
+  .../* @__PURE__ */ Object.assign({ "./api/changes/handler.ts": () => import("../handler--FFBJMl6.js") })
+}).reduce((acc, [path, mod]) => {
+  acc[path.replace("./api/", "@rpcbase/server/rts/api/")] = mod;
+  return acc;
 }, {});
-//#endregion
-//#region src/rts/index.ts
-var QUERY_KEY_MAX_LEN = 4096;
-var INTERNAL_MODEL_NAMES = new Set(["RBRtsChange", "RBRtsCounter"]);
-var DEFAULT_MAX_PAYLOAD_BYTES = 1024 * 1024;
-var DEFAULT_MAX_SUBSCRIPTIONS_PER_SOCKET = 256;
-var DEFAULT_DISPATCH_DEBOUNCE_MS = 25;
-var initializedServers = /* @__PURE__ */ new WeakSet();
-var customHandlers = [];
-var sockets = /* @__PURE__ */ new Map();
-var socketMeta = /* @__PURE__ */ new Map();
-var socketWrappers = /* @__PURE__ */ new Map();
-var socketCleanup = /* @__PURE__ */ new Map();
-var socketSubscriptions = /* @__PURE__ */ new Map();
-var socketCountSubscriptions = /* @__PURE__ */ new Map();
-var subscriptions = /* @__PURE__ */ new Map();
-var countSubscriptions = /* @__PURE__ */ new Map();
-var changeStreams = /* @__PURE__ */ new Map();
-var dispatchTimers = /* @__PURE__ */ new Map();
-var upgradeMeta = /* @__PURE__ */ new WeakMap();
-var maxPayloadBytes = DEFAULT_MAX_PAYLOAD_BYTES;
-var maxSubscriptionsPerSocket = DEFAULT_MAX_SUBSCRIPTIONS_PER_SOCKET;
-var dispatchDebounceMs = DEFAULT_DISPATCH_DEBOUNCE_MS;
-var allowInternalModels = false;
-var RtsSocket = class {
-	id;
-	tenantId;
-	userId;
-	ws;
-	handlers = /* @__PURE__ */ new Map();
-	constructor({ id, ws, meta }) {
-		this.id = id;
-		this.ws = ws;
-		this.tenantId = meta.tenantId;
-		this.userId = meta.userId;
-	}
-	on(event, handler) {
-		const set = this.handlers.get(event) ?? /* @__PURE__ */ new Set();
-		set.add(handler);
-		this.handlers.set(event, set);
-		return () => this.off(event, handler);
-	}
-	off(event, handler) {
-		const set = this.handlers.get(event);
-		if (!set) return;
-		set.delete(handler);
-		if (!set.size) this.handlers.delete(event);
-	}
-	emit(event, payload) {
-		sendWs(this.ws, {
-			type: "event",
-			event,
-			payload
-		});
-	}
-	close() {
-		try {
-			this.ws.close();
-		} catch {}
-	}
-	dispatch(event, payload) {
-		const set = this.handlers.get(event);
-		if (!set) return;
-		for (const handler of set) handler(payload);
-	}
-};
-var rawToText = (raw) => {
-	if (typeof raw === "string") return raw;
-	if (raw instanceof ArrayBuffer) return Buffer.from(raw).toString();
-	if (Array.isArray(raw)) return Buffer.concat(raw).toString();
-	return raw.toString();
-};
-var safeJsonParse = (raw) => JSON.parse(rawToText(raw));
-var sendWs = (ws, message) => {
-	if (ws.readyState !== 1) return;
-	ws.send(JSON.stringify(message));
-};
-var ensureSocketErrorHandler = (socket, context) => {
-	if (socket.listenerCount("error") > 0) return;
-	socket.on("error", (err) => {
-		const message = err instanceof Error ? err.message : String(err);
-		const name = err instanceof Error ? err.name : typeof err;
-		const stack = err instanceof Error ? err.stack : void 0;
-		const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
-		if (code === "ECONNRESET" || code == null && message.includes("ECONNRESET")) return;
-		console.warn("[rb/rts] socket error", {
-			name,
-			code,
-			message,
-			stack,
-			remoteAddress: socket.remoteAddress,
-			remotePort: socket.remotePort,
-			localAddress: socket.localAddress,
-			localPort: socket.localPort,
-			...context?.()
-		});
-	});
-};
-var redactErrorMessage = (err) => {
-	const trimmedModelList = (err instanceof Error ? err.message : "Unknown error").replace(/\.\s+Available models:[\s\S]*$/, "");
-	const maxLen = 256;
-	if (trimmedModelList.length <= maxLen) return trimmedModelList;
-	return trimmedModelList.slice(0, maxLen);
-};
-var unauthorized = (socket, message = "Unauthorized") => {
-	ensureSocketErrorHandler(socket);
-	try {
-		socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
-		socket.write(`Error: ${message}\r\n`);
-		socket.end();
-	} catch {
-		socket.destroy();
-	}
-};
-var badRequest = (socket, message = "Bad Request") => {
-	ensureSocketErrorHandler(socket);
-	try {
-		socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
-		socket.write(`Error: ${message}\r\n`);
-		socket.end();
-	} catch {
-		socket.destroy();
-	}
-};
-var runSessionMiddleware = async (sessionMiddleware, req) => {
-	await new Promise((resolve, reject) => {
-		const next = (err) => {
-			if (err) reject(err);
-			else resolve();
-		};
-		sessionMiddleware(req, {}, next);
-	});
-};
-var parseUpgradeMeta = async ({ req, url, sessionMiddleware }) => {
-	const tenantId = url.searchParams.get(RTS_TENANT_ID_QUERY_PARAM);
-	if (!tenantId) throw new Error("Missing rb-tenant-id query parameter");
-	if (sessionMiddleware) {
-		const upgradeReq = req;
-		try {
-			await runSessionMiddleware(sessionMiddleware, upgradeReq);
-		} catch {
-			throw new Error("Failed to load session for RTS");
-		}
-		const sessionUser = upgradeReq.session?.user;
-		const sessionUserId = sessionUser?.id;
-		if (!sessionUserId) throw new Error("Not signed in (missing session.user.id)");
-		const signedInTenants = sessionUser?.signedInTenants;
-		const currentTenantId = sessionUser?.currentTenantId;
-		if (Array.isArray(signedInTenants) && signedInTenants.length > 0) {
-			if (!signedInTenants.includes(tenantId)) throw new Error("Tenant not authorized for this session");
-		} else if (currentTenantId) {
-			if (currentTenantId !== tenantId) throw new Error("Tenant not authorized for this session");
-		} else throw new Error("Tenant not authorized for this session");
-		return {
-			tenantId,
-			userId: sessionUserId,
-			ability: buildAbilityFromSession({
-				tenantId,
-				session: upgradeReq.session
-			})
-		};
-	}
-	const raw = req.headers[RTS_USER_ID_HEADER];
-	const headerUserId = Array.isArray(raw) ? raw[0] : raw;
-	if (!headerUserId) throw new Error("Missing rb-user-id header (reverse-proxy) and no session middleware configured");
-	const user = await (await models.getGlobal("RBUser", { req: { session: null } })).findById(headerUserId, {
-		tenants: 1,
-		tenantRoles: 1
-	}).lean();
-	const tenantsRaw = user?.tenants;
-	if (!(Array.isArray(tenantsRaw) ? tenantsRaw.map((t) => String(t)) : []).includes(tenantId)) throw new Error("Tenant not authorized for this session");
-	const roles = getTenantRolesFromSessionUser(user, tenantId);
-	return {
-		tenantId,
-		userId: headerUserId,
-		ability: buildAbility({
-			tenantId,
-			userId: headerUserId,
-			roles: roles.length ? roles : ["owner"]
-		})
-	};
-};
-var getTenantModel = async (tenantId, modelName) => {
-	const ctx = { req: { session: { user: { currentTenantId: tenantId } } } };
-	return models.getUnsafe(modelName, ctx);
-};
-var makeDispatchKey = (tenantId, modelName) => `${tenantId}:${modelName}`;
-var clearDispatchTimer = (tenantId, modelName) => {
-	const key = makeDispatchKey(tenantId, modelName);
-	const timer = dispatchTimers.get(key);
-	if (!timer) return;
-	clearTimeout(timer);
-	dispatchTimers.delete(key);
-};
-var scheduleDispatchSubscriptionsForModel = (tenantId, modelName) => {
-	const key = makeDispatchKey(tenantId, modelName);
-	if (dispatchTimers.has(key)) return;
-	const delay = Math.max(0, Math.min(1e3, Math.floor(dispatchDebounceMs)));
-	dispatchTimers.set(key, setTimeout(() => {
-		dispatchTimers.delete(key);
-		Promise.all([dispatchSubscriptionsForModel(tenantId, modelName), dispatchCountSubscriptionsForModel(tenantId, modelName)]).catch(() => {});
-	}, delay));
-};
-var runAndSendQuery = async ({ tenantId, targetSocketIds, ability, modelName, queryKey, query, options }) => {
-	const result = await runRtsQuery({
-		tenantId,
-		ability,
-		modelName,
-		query,
-		options,
-		allowInternalModels
-	});
-	const payload = {
-		type: "query-payload",
-		modelName,
-		queryKey,
-		data: result.data,
-		...result.pageInfo ? { pageInfo: result.pageInfo } : {},
-		...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {}
-	};
-	for (const socketId of targetSocketIds) {
-		const ws = sockets.get(socketId);
-		if (!ws) continue;
-		sendWs(ws, payload);
-	}
-};
-var runAndSendCount = async ({ tenantId, targetSocketIds, ability, modelName, queryKey, query }) => {
-	const payload = {
-		type: "count-payload",
-		modelName,
-		queryKey,
-		count: await runRtsCount({
-			tenantId,
-			ability,
-			modelName,
-			query,
-			allowInternalModels
-		})
-	};
-	for (const socketId of targetSocketIds) {
-		const ws = sockets.get(socketId);
-		if (!ws) continue;
-		sendWs(ws, payload);
-	}
-};
-var subscriptionDependsOnModel = (changedModelName, ownerModelName, subscription) => {
-	if (ownerModelName === changedModelName) return true;
-	return subscription.dependencyModelNames.includes(changedModelName);
-};
-var hasAnySubscriptionsDependingOnModel = (tenantId, modelName) => {
-	const tenantSubs = subscriptions.get(tenantId);
-	if (!tenantSubs) return false;
-	for (const userSubs of tenantSubs.values()) for (const [ownerModelName, modelSubs] of userSubs.entries()) for (const subscription of modelSubs.values()) if (subscriptionDependsOnModel(modelName, ownerModelName, subscription)) return true;
-	return false;
-};
-var hasAnyCountSubscriptionsForModel = (tenantId, modelName) => {
-	const tenantSubs = countSubscriptions.get(tenantId);
-	if (!tenantSubs) return false;
-	for (const userSubs of tenantSubs.values()) if (userSubs.get(modelName)?.size) return true;
-	return false;
-};
-var dispatchSubscriptionsForModel = async (tenantId, modelName) => {
-	const tenantSubs = subscriptions.get(tenantId);
-	if (!tenantSubs || !tenantSubs.size) return;
-	for (const userSubs of tenantSubs.values()) for (const [ownerModelName, modelSubs] of userSubs.entries()) for (const [queryKey, sub] of modelSubs.entries()) {
-		if (!subscriptionDependsOnModel(modelName, ownerModelName, sub)) continue;
-		const targetSocketIds = Array.from(sub.socketIds);
-		if (!targetSocketIds.length) continue;
-		const socketId = targetSocketIds[0];
-		const ability = socketMeta.get(socketId)?.ability;
-		if (!ability) continue;
-		try {
-			await runAndSendQuery({
-				tenantId,
-				targetSocketIds,
-				ability,
-				modelName: ownerModelName,
-				queryKey,
-				query: sub.query,
-				options: sub.options
-			});
-		} catch (err) {
-			const payload = {
-				type: "query-payload",
-				modelName: ownerModelName,
-				queryKey,
-				error: redactErrorMessage(err)
-			};
-			for (const socketId of targetSocketIds) {
-				const ws = sockets.get(socketId);
-				if (!ws) continue;
-				sendWs(ws, payload);
-			}
-		}
-	}
-};
-var dispatchCountSubscriptionsForModel = async (tenantId, modelName) => {
-	const tenantSubs = countSubscriptions.get(tenantId);
-	if (!tenantSubs || !tenantSubs.size) return;
-	for (const userSubs of tenantSubs.values()) {
-		const modelSubs = userSubs.get(modelName);
-		if (!modelSubs) continue;
-		for (const [queryKey, sub] of modelSubs.entries()) {
-			const targetSocketIds = Array.from(sub.socketIds);
-			if (!targetSocketIds.length) continue;
-			const socketId = targetSocketIds[0];
-			const ability = socketMeta.get(socketId)?.ability;
-			if (!ability) continue;
-			try {
-				await runAndSendCount({
-					tenantId,
-					targetSocketIds,
-					ability,
-					modelName,
-					queryKey,
-					query: sub.query
-				});
-			} catch (err) {
-				const payload = {
-					type: "count-payload",
-					modelName,
-					queryKey,
-					error: redactErrorMessage(err)
-				};
-				for (const targetSocketId of targetSocketIds) {
-					const ws = sockets.get(targetSocketId);
-					if (!ws) continue;
-					sendWs(ws, payload);
-				}
-			}
-		}
-	}
-};
-var ensureChangeStream = async (tenantId, modelName) => {
-	const tenantStreams = changeStreams.get(tenantId) ?? /* @__PURE__ */ new Map();
-	changeStreams.set(tenantId, tenantStreams);
-	if (tenantStreams.has(modelName)) return;
-	const stream = (await getTenantModel(tenantId, modelName)).watch([], { fullDocument: "updateLookup" });
-	stream.on("change", () => {
-		scheduleDispatchSubscriptionsForModel(tenantId, modelName);
-	});
-	stream.on("close", () => {
-		clearDispatchTimer(tenantId, modelName);
-		const map = changeStreams.get(tenantId);
-		map?.delete(modelName);
-		if (map && map.size === 0) changeStreams.delete(tenantId);
-	});
-	stream.on("error", () => {
-		try {
-			clearDispatchTimer(tenantId, modelName);
-			stream.close();
-		} catch {}
-	});
-	tenantStreams.set(modelName, stream);
-};
-var addSocketSubscription = ({ socketId, tenantId, userId, modelName, queryKey, query, options, dependencyModelNames }) => {
-	const tenantSubs = subscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
-	subscriptions.set(tenantId, tenantSubs);
-	const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
-	tenantSubs.set(userId, userSubs);
-	const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
-	userSubs.set(modelName, modelSubs);
-	const existing = modelSubs.get(queryKey);
-	if (existing) {
-		existing.socketIds.add(socketId);
-		existing.dependencyModelNames = Array.from(new Set([...existing.dependencyModelNames, ...dependencyModelNames]));
-	} else modelSubs.set(queryKey, {
-		query,
-		options,
-		dependencyModelNames: Array.from(new Set(dependencyModelNames)),
-		socketIds: new Set([socketId])
-	});
-	const byModel = socketSubscriptions.get(socketId) ?? /* @__PURE__ */ new Map();
-	socketSubscriptions.set(socketId, byModel);
-	const querySet = byModel.get(modelName) ?? /* @__PURE__ */ new Set();
-	byModel.set(modelName, querySet);
-	querySet.add(queryKey);
-};
-var addSocketCountSubscription = ({ socketId, tenantId, userId, modelName, queryKey, query }) => {
-	const tenantSubs = countSubscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
-	countSubscriptions.set(tenantId, tenantSubs);
-	const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
-	tenantSubs.set(userId, userSubs);
-	const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
-	userSubs.set(modelName, modelSubs);
-	const existing = modelSubs.get(queryKey);
-	if (existing) existing.socketIds.add(socketId);
-	else modelSubs.set(queryKey, {
-		query,
-		socketIds: new Set([socketId])
-	});
-	const byModel = socketCountSubscriptions.get(socketId) ?? /* @__PURE__ */ new Map();
-	socketCountSubscriptions.set(socketId, byModel);
-	const querySet = byModel.get(modelName) ?? /* @__PURE__ */ new Set();
-	byModel.set(modelName, querySet);
-	querySet.add(queryKey);
-};
-var removeSocketSubscription = ({ socketId, tenantId, userId, modelName, queryKey }) => {
-	const tenantSubs = subscriptions.get(tenantId);
-	const userSubs = tenantSubs?.get(userId);
-	const modelSubs = userSubs?.get(modelName);
-	const sub = modelSubs?.get(queryKey);
-	const affectedModelNames = new Set([modelName, ...sub?.dependencyModelNames ?? []]);
-	if (sub) {
-		sub.socketIds.delete(socketId);
-		if (!sub.socketIds.size) modelSubs?.delete(queryKey);
-	}
-	const byModel = socketSubscriptions.get(socketId);
-	const set = byModel?.get(modelName);
-	if (set) {
-		set.delete(queryKey);
-		if (!set.size) byModel?.delete(modelName);
-	}
-	if (modelSubs && modelSubs.size === 0) userSubs?.delete(modelName);
-	if (userSubs && userSubs.size === 0) tenantSubs?.delete(userId);
-	for (const affectedModelName of affectedModelNames) {
-		if (hasAnySubscriptionsDependingOnModel(tenantId, affectedModelName) || hasAnyCountSubscriptionsForModel(tenantId, affectedModelName)) continue;
-		const tenantStreams = changeStreams.get(tenantId);
-		const stream = tenantStreams?.get(affectedModelName);
-		if (stream) {
-			try {
-				stream.close();
-			} catch {}
-			clearDispatchTimer(tenantId, affectedModelName);
-			tenantStreams?.delete(affectedModelName);
-			if (tenantStreams && tenantStreams.size === 0) changeStreams.delete(tenantId);
-		}
-	}
-	if (tenantSubs && tenantSubs.size === 0) subscriptions.delete(tenantId);
-	if (byModel && byModel.size === 0) socketSubscriptions.delete(socketId);
-};
-var removeSocketCountSubscription = ({ socketId, tenantId, userId, modelName, queryKey }) => {
-	const tenantSubs = countSubscriptions.get(tenantId);
-	const userSubs = tenantSubs?.get(userId);
-	const modelSubs = userSubs?.get(modelName);
-	const sub = modelSubs?.get(queryKey);
-	if (sub) {
-		sub.socketIds.delete(socketId);
-		if (!sub.socketIds.size) modelSubs?.delete(queryKey);
-	}
-	const byModel = socketCountSubscriptions.get(socketId);
-	const set = byModel?.get(modelName);
-	if (set) {
-		set.delete(queryKey);
-		if (!set.size) byModel?.delete(modelName);
-	}
-	if (modelSubs && modelSubs.size === 0) userSubs?.delete(modelName);
-	if (userSubs && userSubs.size === 0) tenantSubs?.delete(userId);
-	if (!hasAnySubscriptionsDependingOnModel(tenantId, modelName) && !hasAnyCountSubscriptionsForModel(tenantId, modelName)) {
-		const tenantStreams = changeStreams.get(tenantId);
-		const stream = tenantStreams?.get(modelName);
-		if (stream) {
-			try {
-				stream.close();
-			} catch {}
-			clearDispatchTimer(tenantId, modelName);
-			tenantStreams?.delete(modelName);
-			if (tenantStreams && tenantStreams.size === 0) changeStreams.delete(tenantId);
-		}
-	}
-	if (tenantSubs && tenantSubs.size === 0) countSubscriptions.delete(tenantId);
-	if (byModel && byModel.size === 0) socketCountSubscriptions.delete(socketId);
-};
-var getSocketSubscriptionCount = (socketId) => {
-	let count = 0;
-	const querySubscriptionsByModel = socketSubscriptions.get(socketId);
-	if (querySubscriptionsByModel) for (const set of querySubscriptionsByModel.values()) count += set.size;
-	const countSubscriptionsByModel = socketCountSubscriptions.get(socketId);
-	if (countSubscriptionsByModel) for (const set of countSubscriptionsByModel.values()) count += set.size;
-	return count;
-};
-var cleanupSocket = (socketId) => {
-	const meta = socketMeta.get(socketId);
-	if (meta) {
-		const byModel = socketSubscriptions.get(socketId);
-		if (byModel) for (const [modelName, keys] of byModel.entries()) for (const queryKey of keys.values()) removeSocketSubscription({
-			socketId,
-			tenantId: meta.tenantId,
-			userId: meta.userId,
-			modelName,
-			queryKey
-		});
-		const countByModel = socketCountSubscriptions.get(socketId);
-		if (countByModel) for (const [modelName, keys] of countByModel.entries()) for (const queryKey of keys.values()) removeSocketCountSubscription({
-			socketId,
-			tenantId: meta.tenantId,
-			userId: meta.userId,
-			modelName,
-			queryKey
-		});
-	}
-	socketSubscriptions.delete(socketId);
-	socketCountSubscriptions.delete(socketId);
-	const cleanupFns = socketCleanup.get(socketId) ?? [];
-	socketCleanup.delete(socketId);
-	for (const fn of cleanupFns) try {
-		fn();
-	} catch {}
-	sockets.delete(socketId);
-	socketMeta.delete(socketId);
-	socketWrappers.delete(socketId);
-};
-var clearTenantDispatchTimers = (tenantId) => {
-	const prefix = `${tenantId}:`;
-	for (const key of Array.from(dispatchTimers.keys())) {
-		if (!key.startsWith(prefix)) continue;
-		const timer = dispatchTimers.get(key);
-		if (timer) clearTimeout(timer);
-		dispatchTimers.delete(key);
-	}
-};
-var cleanupRtsTenant = (tenantId) => {
-	const normalizedTenantId = tenantId.trim();
-	if (!normalizedTenantId) return;
-	const tenantSocketIds = Array.from(socketMeta.entries()).filter(([, meta]) => meta.tenantId === normalizedTenantId).map(([socketId]) => socketId);
-	for (const socketId of tenantSocketIds) {
-		const ws = sockets.get(socketId);
-		cleanupSocket(socketId);
-		if (ws) try {
-			ws.close();
-		} catch {}
-	}
-	clearTenantDispatchTimers(normalizedTenantId);
-	const tenantStreams = changeStreams.get(normalizedTenantId);
-	if (tenantStreams) {
-		for (const [modelName, stream] of tenantStreams.entries()) {
-			try {
-				stream.close();
-			} catch {}
-			clearDispatchTimer(normalizedTenantId, modelName);
-		}
-		changeStreams.delete(normalizedTenantId);
-	}
-	subscriptions.delete(normalizedTenantId);
-	countSubscriptions.delete(normalizedTenantId);
-};
-var handleClientMessage = async ({ socketId, meta, message }) => {
-	const ws = sockets.get(socketId);
-	if (!ws) return;
-	if (message.type === "event") {
-		socketWrappers.get(socketId)?.dispatch(message.event, message.payload);
-		return;
-	}
-	const isCountMessage = message.type === "run-count" || message.type === "register-count" || message.type === "remove-count";
-	const sendAccessError = (error) => {
-		if (isCountMessage) {
-			sendWs(ws, {
-				type: "count-payload",
-				modelName: message.modelName ?? "",
-				queryKey: message.queryKey ?? "",
-				error
-			});
-			return;
-		}
-		sendWs(ws, {
-			type: "query-payload",
-			modelName: message.modelName ?? "",
-			queryKey: message.queryKey ?? "",
-			error
-		});
-	};
-	if (!message.modelName || typeof message.modelName !== "string") return;
-	if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(message.modelName)) {
-		sendAccessError("Model not allowed");
-		return;
-	}
-	if (!message.queryKey || typeof message.queryKey !== "string") return;
-	if (message.queryKey.length > QUERY_KEY_MAX_LEN) return;
-	if (message.type === "remove-query") {
-		removeSocketSubscription({
-			socketId,
-			tenantId: meta.tenantId,
-			userId: meta.userId,
-			modelName: message.modelName,
-			queryKey: message.queryKey
-		});
-		return;
-	}
-	if (message.type === "remove-count") {
-		removeSocketCountSubscription({
-			socketId,
-			tenantId: meta.tenantId,
-			userId: meta.userId,
-			modelName: message.modelName,
-			queryKey: message.queryKey
-		});
-		return;
-	}
-	if (!message.query || typeof message.query !== "object") return;
-	const ability = meta.ability;
-	if (!ability.can("read", message.modelName)) {
-		sendAccessError("forbidden");
-		return;
-	}
-	if (message.type === "register-query" || message.type === "run-query") {
-		const options = normalizeRtsQueryOptions(message.options);
-		if (message.type === "register-query") {
-			if (!(socketSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false) && getSocketSubscriptionCount(socketId) >= maxSubscriptionsPerSocket) {
-				sendWs(ws, {
-					type: "query-payload",
-					modelName: message.modelName,
-					queryKey: message.queryKey,
-					error: "Too many subscriptions"
-				});
-				return;
-			}
-			let dependencyModelNames = [];
-			if (options.populate !== void 0) try {
-				dependencyModelNames = await resolveRtsQueryDependencyModelNames({
-					tenantId: meta.tenantId,
-					ability,
-					modelName: message.modelName,
-					options,
-					allowInternalModels
-				});
-			} catch (err) {
-				const error = redactErrorMessage(err);
-				sendWs(ws, {
-					type: "query-payload",
-					modelName: message.modelName,
-					queryKey: message.queryKey,
-					error
-				});
-				return;
-			}
-			addSocketSubscription({
-				socketId,
-				tenantId: meta.tenantId,
-				userId: meta.userId,
-				modelName: message.modelName,
-				queryKey: message.queryKey,
-				query: message.query,
-				options,
-				dependencyModelNames
-			});
-			try {
-				const modelNamesToWatch = new Set([message.modelName, ...dependencyModelNames]);
-				for (const modelName of modelNamesToWatch) await ensureChangeStream(meta.tenantId, modelName);
-			} catch (err) {
-				const error = redactErrorMessage(err);
-				sendWs(ws, {
-					type: "query-payload",
-					modelName: message.modelName,
-					queryKey: message.queryKey,
-					error
-				});
-				return;
-			}
-			if (message.runInitialQuery === false) return;
-		}
-		try {
-			await runAndSendQuery({
-				tenantId: meta.tenantId,
-				targetSocketIds: [socketId],
-				ability,
-				modelName: message.modelName,
-				queryKey: message.queryKey,
-				query: message.query,
-				options
-			});
-		} catch (err) {
-			const error = redactErrorMessage(err);
-			sendWs(ws, {
-				type: "query-payload",
-				modelName: message.modelName,
-				queryKey: message.queryKey,
-				error
-			});
-		}
-		return;
-	}
-	if (message.type === "register-count" || message.type === "run-count") {
-		if (message.type === "register-count") {
-			if (!(socketCountSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false) && getSocketSubscriptionCount(socketId) >= maxSubscriptionsPerSocket) {
-				sendWs(ws, {
-					type: "count-payload",
-					modelName: message.modelName,
-					queryKey: message.queryKey,
-					error: "Too many subscriptions"
-				});
-				return;
-			}
-			addSocketCountSubscription({
-				socketId,
-				tenantId: meta.tenantId,
-				userId: meta.userId,
-				modelName: message.modelName,
-				queryKey: message.queryKey,
-				query: message.query
-			});
-			try {
-				await ensureChangeStream(meta.tenantId, message.modelName);
-			} catch (err) {
-				const error = redactErrorMessage(err);
-				sendWs(ws, {
-					type: "count-payload",
-					modelName: message.modelName,
-					queryKey: message.queryKey,
-					error
-				});
-				return;
-			}
-			if (message.runInitialQuery === false) return;
-		}
-		try {
-			await runAndSendCount({
-				tenantId: meta.tenantId,
-				targetSocketIds: [socketId],
-				ability,
-				modelName: message.modelName,
-				queryKey: message.queryKey,
-				query: message.query
-			});
-		} catch (err) {
-			const error = redactErrorMessage(err);
-			sendWs(ws, {
-				type: "count-payload",
-				modelName: message.modelName,
-				queryKey: message.queryKey,
-				error
-			});
-		}
-	}
-};
-var initRts = ({ server, path = "/rts", sessionMiddleware, maxPayloadBytes: maxPayloadBytesArg, maxSubscriptionsPerSocket: maxSubscriptionsPerSocketArg, dispatchDebounceMs: dispatchDebounceMsArg, allowInternalModels: allowInternalModelsArg }) => {
-	if (initializedServers.has(server)) return;
-	initializedServers.add(server);
-	if (typeof maxPayloadBytesArg === "number" && Number.isFinite(maxPayloadBytesArg) && maxPayloadBytesArg > 0) maxPayloadBytes = Math.floor(maxPayloadBytesArg);
-	if (typeof maxSubscriptionsPerSocketArg === "number" && Number.isFinite(maxSubscriptionsPerSocketArg) && maxSubscriptionsPerSocketArg > 0) maxSubscriptionsPerSocket = Math.floor(maxSubscriptionsPerSocketArg);
-	if (typeof dispatchDebounceMsArg === "number" && Number.isFinite(dispatchDebounceMsArg) && dispatchDebounceMsArg >= 0) dispatchDebounceMs = Math.floor(dispatchDebounceMsArg);
-	allowInternalModels = Boolean(allowInternalModelsArg);
-	const wss = new WebSocketServer({
-		noServer: true,
-		maxPayload: maxPayloadBytes
-	});
-	server.on("upgrade", (req, socket, head) => {
-		ensureSocketErrorHandler(socket, () => ({
-			upgradeHost: req.headers.host ?? "",
-			upgradeUrl: req.url ?? "",
-			userAgent: typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : ""
-		}));
-		upgradeMeta.delete(req);
-		let url;
-		try {
-			url = new URL(req.url ?? "", `http://${req.headers.host ?? "localhost"}`);
-		} catch {
-			badRequest(socket, "Invalid URL");
-			return;
-		}
-		if (url.pathname !== path) return;
-		(async () => {
-			try {
-				const meta = await parseUpgradeMeta({
-					req,
-					url,
-					sessionMiddleware
-				});
-				upgradeMeta.set(req, meta);
-				wss.handleUpgrade(req, socket, head, (ws) => {
-					wss.emit("connection", ws, req);
-				});
-			} catch (err) {
-				const message = err instanceof Error ? err.message : "RTS upgrade failed";
-				if (message.startsWith("Missing rb-tenant-id")) {
-					badRequest(socket, message);
-					return;
-				}
-				unauthorized(socket, message);
-				return;
-			}
-		})().catch(() => {
-			badRequest(socket, "RTS upgrade failed");
-		});
-	});
-	wss.on("connection", (ws, req) => {
-		const meta = upgradeMeta.get(req);
-		upgradeMeta.delete(req);
-		if (!meta) {
-			try {
-				ws.close();
-			} catch {}
-			return;
-		}
-		const socketId = randomUUID();
-		sockets.set(socketId, ws);
-		socketMeta.set(socketId, meta);
-		const wrapper = new RtsSocket({
-			id: socketId,
-			ws,
-			meta
-		});
-		socketWrappers.set(socketId, wrapper);
-		const cleanupFns = [];
-		for (const handler of customHandlers) try {
-			const cleanup = handler(wrapper);
-			if (typeof cleanup === "function") cleanupFns.push(cleanup);
-		} catch {}
-		if (cleanupFns.length) socketCleanup.set(socketId, cleanupFns);
-		ws.on("message", (raw) => {
-			let parsed;
-			try {
-				parsed = safeJsonParse(raw);
-			} catch {
-				return;
-			}
-			if (!parsed || typeof parsed !== "object") return;
-			const message = parsed;
-			if (message.type !== "event" && message.type !== "run-query" && message.type !== "register-query" && message.type !== "remove-query" && message.type !== "run-count" && message.type !== "register-count" && message.type !== "remove-count") return;
-			handleClientMessage({
-				socketId,
-				meta,
-				message
-			});
-		});
-		ws.on("close", () => {
-			cleanupSocket(socketId);
-		});
-		ws.on("error", () => {
-			cleanupSocket(socketId);
-		});
-	});
-};
-var registerRtsHandler = (handler) => {
-	customHandlers.push(handler);
-};
-var notifyRtsModelChanged = (tenantId, modelName) => {
-	scheduleDispatchSubscriptionsForModel(tenantId, modelName);
-};
-//#endregion
-export { cleanupRtsTenant, initRts, notifyRtsModelChanged, registerRtsHandler, routes };
-
-//# sourceMappingURL=index.js.map
+const QUERY_KEY_MAX_LEN = 4096;
+const INTERNAL_MODEL_NAMES = /* @__PURE__ */ new Set(["RBRtsChange", "RBRtsCounter"]);
+const DEFAULT_MAX_PAYLOAD_BYTES = 1024 * 1024;
+const DEFAULT_MAX_SUBSCRIPTIONS_PER_SOCKET = 256;
+const DEFAULT_DISPATCH_DEBOUNCE_MS = 25;
+const initializedServers = /* @__PURE__ */ new WeakSet();
+const customHandlers = [];
+const sockets = /* @__PURE__ */ new Map();
+const socketMeta = /* @__PURE__ */ new Map();
+const socketWrappers = /* @__PURE__ */ new Map();
+const socketCleanup = /* @__PURE__ */ new Map();
+const socketSubscriptions = /* @__PURE__ */ new Map();
+const socketCountSubscriptions = /* @__PURE__ */ new Map();
+const subscriptions = /* @__PURE__ */ new Map();
+const countSubscriptions = /* @__PURE__ */ new Map();
+const changeStreams = /* @__PURE__ */ new Map();
+const dispatchTimers = /* @__PURE__ */ new Map();
+const upgradeMeta = /* @__PURE__ */ new WeakMap();
+let maxPayloadBytes = DEFAULT_MAX_PAYLOAD_BYTES;
+let maxSubscriptionsPerSocket = DEFAULT_MAX_SUBSCRIPTIONS_PER_SOCKET;
+let dispatchDebounceMs = DEFAULT_DISPATCH_DEBOUNCE_MS;
+let allowInternalModels = false;
+class RtsSocket {
+  id;
+  tenantId;
+  userId;
+  ws;
+  handlers = /* @__PURE__ */ new Map();
+  constructor({
+    id,
+    ws,
+    meta
+  }) {
+    this.id = id;
+    this.ws = ws;
+    this.tenantId = meta.tenantId;
+    this.userId = meta.userId;
+  }
+  on(event, handler) {
+    const set = this.handlers.get(event) ?? /* @__PURE__ */ new Set();
+    set.add(handler);
+    this.handlers.set(event, set);
+    return () => this.off(event, handler);
+  }
+  off(event, handler) {
+    const set = this.handlers.get(event);
+    if (!set) return;
+    set.delete(handler);
+    if (!set.size) this.handlers.delete(event);
+  }
+  emit(event, payload) {
+    sendWs(this.ws, {
+      type: "event",
+      event,
+      payload
+    });
+  }
+  close() {
+    try {
+      this.ws.close();
+    } catch {
+    }
+  }
+  dispatch(event, payload) {
+    const set = this.handlers.get(event);
+    if (!set) return;
+    for (const handler of set) {
+      handler(payload);
+    }
+  }
+}
+const rawToText = (raw) => {
+  if (typeof raw === "string") return raw;
+  if (raw instanceof ArrayBuffer) return Buffer.from(raw).toString();
+  if (Array.isArray(raw)) return Buffer.concat(raw).toString();
+  return raw.toString();
+};
+const safeJsonParse = (raw) => JSON.parse(rawToText(raw));
+const sendWs = (ws, message) => {
+  if (ws.readyState !== 1) return;
+  ws.send(JSON.stringify(message));
+};
+const ensureSocketErrorHandler = (socket, context) => {
+  if (socket.listenerCount("error") > 0) return;
+  socket.on("error", (err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    const name = err instanceof Error ? err.name : typeof err;
+    const stack = err instanceof Error ? err.stack : void 0;
+    const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
+    if (code === "ECONNRESET" || code == null && message.includes("ECONNRESET")) return;
+    console.warn("[rb/rts] socket error", {
+      name,
+      code,
+      message,
+      stack,
+      remoteAddress: socket.remoteAddress,
+      remotePort: socket.remotePort,
+      localAddress: socket.localAddress,
+      localPort: socket.localPort,
+      ...context?.()
+    });
+  });
+};
+const redactErrorMessage = (err) => {
+  const raw = err instanceof Error ? err.message : "Unknown error";
+  const trimmedModelList = raw.replace(/\.\s+Available models:[\s\S]*$/, "");
+  const maxLen = 256;
+  if (trimmedModelList.length <= maxLen) return trimmedModelList;
+  return trimmedModelList.slice(0, maxLen);
+};
+const unauthorized = (socket, message = "Unauthorized") => {
+  ensureSocketErrorHandler(socket);
+  try {
+    socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+    socket.write(`Error: ${message}\r
+`);
+    socket.end();
+  } catch {
+    socket.destroy();
+  }
+};
+const badRequest = (socket, message = "Bad Request") => {
+  ensureSocketErrorHandler(socket);
+  try {
+    socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
+    socket.write(`Error: ${message}\r
+`);
+    socket.end();
+  } catch {
+    socket.destroy();
+  }
+};
+const runSessionMiddleware = async (sessionMiddleware, req) => {
+  await new Promise((resolve, reject) => {
+    const next = (err) => {
+      if (err) reject(err);
+      else resolve();
+    };
+    sessionMiddleware(req, {}, next);
+  });
+};
+const parseUpgradeMeta = async ({
+  req,
+  url,
+  sessionMiddleware
+}) => {
+  const tenantId = url.searchParams.get(RTS_TENANT_ID_QUERY_PARAM);
+  if (!tenantId) {
+    throw new Error("Missing rb-tenant-id query parameter");
+  }
+  if (sessionMiddleware) {
+    const upgradeReq = req;
+    try {
+      await runSessionMiddleware(sessionMiddleware, upgradeReq);
+    } catch {
+      throw new Error("Failed to load session for RTS");
+    }
+    const sessionUser = upgradeReq.session?.user;
+    const sessionUserId = sessionUser?.id;
+    if (!sessionUserId) {
+      throw new Error("Not signed in (missing session.user.id)");
+    }
+    const signedInTenants = sessionUser?.signedInTenants;
+    const currentTenantId = sessionUser?.currentTenantId;
+    if (Array.isArray(signedInTenants) && signedInTenants.length > 0) {
+      if (!signedInTenants.includes(tenantId)) {
+        throw new Error("Tenant not authorized for this session");
+      }
+    } else if (currentTenantId) {
+      if (currentTenantId !== tenantId) {
+        throw new Error("Tenant not authorized for this session");
+      }
+    } else {
+      throw new Error("Tenant not authorized for this session");
+    }
+    const ability2 = buildAbilityFromSession({
+      tenantId,
+      session: upgradeReq.session
+    });
+    return {
+      tenantId,
+      userId: sessionUserId,
+      ability: ability2
+    };
+  }
+  const raw = req.headers[RTS_USER_ID_HEADER];
+  const headerUserId = Array.isArray(raw) ? raw[0] : raw;
+  if (!headerUserId) {
+    throw new Error("Missing rb-user-id header (reverse-proxy) and no session middleware configured");
+  }
+  const rbCtx = {
+    req: {
+      session: null
+    }
+  };
+  const User = await models.getGlobal("RBUser", rbCtx);
+  const user = await User.findById(headerUserId, {
+    tenants: 1,
+    tenantRoles: 1
+  }).lean();
+  const tenantsRaw = user?.tenants;
+  const tenants = Array.isArray(tenantsRaw) ? tenantsRaw.map((t) => String(t)) : [];
+  if (!tenants.includes(tenantId)) {
+    throw new Error("Tenant not authorized for this session");
+  }
+  const roles = getTenantRolesFromSessionUser(user, tenantId);
+  const ability = buildAbility({
+    tenantId,
+    userId: headerUserId,
+    roles: roles.length ? roles : ["owner"]
+  });
+  return {
+    tenantId,
+    userId: headerUserId,
+    ability
+  };
+};
+const getTenantModel = async (tenantId, modelName) => {
+  const ctx = {
+    req: {
+      session: {
+        user: {
+          currentTenantId: tenantId
+        }
+      }
+    }
+  };
+  return models.getUnsafe(modelName, ctx);
+};
+const makeDispatchKey = (tenantId, modelName) => `${tenantId}:${modelName}`;
+const clearDispatchTimer = (tenantId, modelName) => {
+  const key = makeDispatchKey(tenantId, modelName);
+  const timer = dispatchTimers.get(key);
+  if (!timer) return;
+  clearTimeout(timer);
+  dispatchTimers.delete(key);
+};
+const scheduleDispatchSubscriptionsForModel = (tenantId, modelName) => {
+  const key = makeDispatchKey(tenantId, modelName);
+  if (dispatchTimers.has(key)) return;
+  const delay = Math.max(0, Math.min(1e3, Math.floor(dispatchDebounceMs)));
+  dispatchTimers.set(key, setTimeout(() => {
+    dispatchTimers.delete(key);
+    void Promise.all([dispatchSubscriptionsForModel(tenantId, modelName), dispatchCountSubscriptionsForModel(tenantId, modelName)]).catch(() => {
+    });
+  }, delay));
+};
+const runAndSendQuery = async ({
+  tenantId,
+  targetSocketIds,
+  ability,
+  modelName,
+  queryKey,
+  query,
+  options
+}) => {
+  const result = await runRtsQuery({
+    tenantId,
+    ability,
+    modelName,
+    query,
+    options,
+    allowInternalModels
+  });
+  const payload = {
+    type: "query-payload",
+    modelName,
+    queryKey,
+    data: result.data,
+    ...result.pageInfo ? {
+      pageInfo: result.pageInfo
+    } : {},
+    ...typeof result.totalCount === "number" ? {
+      totalCount: result.totalCount
+    } : {}
+  };
+  for (const socketId of targetSocketIds) {
+    const ws = sockets.get(socketId);
+    if (!ws) continue;
+    sendWs(ws, payload);
+  }
+};
+const runAndSendCount = async ({
+  tenantId,
+  targetSocketIds,
+  ability,
+  modelName,
+  queryKey,
+  query
+}) => {
+  const count = await runRtsCount({
+    tenantId,
+    ability,
+    modelName,
+    query,
+    allowInternalModels
+  });
+  const payload = {
+    type: "count-payload",
+    modelName,
+    queryKey,
+    count
+  };
+  for (const socketId of targetSocketIds) {
+    const ws = sockets.get(socketId);
+    if (!ws) continue;
+    sendWs(ws, payload);
+  }
+};
+const subscriptionDependsOnModel = (changedModelName, ownerModelName, subscription) => {
+  if (ownerModelName === changedModelName) return true;
+  return subscription.dependencyModelNames.includes(changedModelName);
+};
+const hasAnySubscriptionsDependingOnModel = (tenantId, modelName) => {
+  const tenantSubs = subscriptions.get(tenantId);
+  if (!tenantSubs) return false;
+  for (const userSubs of tenantSubs.values()) {
+    for (const [ownerModelName, modelSubs] of userSubs.entries()) {
+      for (const subscription of modelSubs.values()) {
+        if (subscriptionDependsOnModel(modelName, ownerModelName, subscription)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+};
+const hasAnyCountSubscriptionsForModel = (tenantId, modelName) => {
+  const tenantSubs = countSubscriptions.get(tenantId);
+  if (!tenantSubs) return false;
+  for (const userSubs of tenantSubs.values()) {
+    const modelSubs = userSubs.get(modelName);
+    if (modelSubs?.size) {
+      return true;
+    }
+  }
+  return false;
+};
+const dispatchSubscriptionsForModel = async (tenantId, modelName) => {
+  const tenantSubs = subscriptions.get(tenantId);
+  if (!tenantSubs || !tenantSubs.size) return;
+  for (const userSubs of tenantSubs.values()) {
+    for (const [ownerModelName, modelSubs] of userSubs.entries()) {
+      for (const [queryKey, sub] of modelSubs.entries()) {
+        if (!subscriptionDependsOnModel(modelName, ownerModelName, sub)) continue;
+        const targetSocketIds = Array.from(sub.socketIds);
+        if (!targetSocketIds.length) continue;
+        const socketId = targetSocketIds[0];
+        const meta = socketMeta.get(socketId);
+        const ability = meta?.ability;
+        if (!ability) continue;
+        try {
+          await runAndSendQuery({
+            tenantId,
+            targetSocketIds,
+            ability,
+            modelName: ownerModelName,
+            queryKey,
+            query: sub.query,
+            options: sub.options
+          });
+        } catch (err) {
+          const error = redactErrorMessage(err);
+          const payload = {
+            type: "query-payload",
+            modelName: ownerModelName,
+            queryKey,
+            error
+          };
+          for (const socketId2 of targetSocketIds) {
+            const ws = sockets.get(socketId2);
+            if (!ws) continue;
+            sendWs(ws, payload);
+          }
+        }
+      }
+    }
+  }
+};
+const dispatchCountSubscriptionsForModel = async (tenantId, modelName) => {
+  const tenantSubs = countSubscriptions.get(tenantId);
+  if (!tenantSubs || !tenantSubs.size) return;
+  for (const userSubs of tenantSubs.values()) {
+    const modelSubs = userSubs.get(modelName);
+    if (!modelSubs) continue;
+    for (const [queryKey, sub] of modelSubs.entries()) {
+      const targetSocketIds = Array.from(sub.socketIds);
+      if (!targetSocketIds.length) continue;
+      const socketId = targetSocketIds[0];
+      const meta = socketMeta.get(socketId);
+      const ability = meta?.ability;
+      if (!ability) continue;
+      try {
+        await runAndSendCount({
+          tenantId,
+          targetSocketIds,
+          ability,
+          modelName,
+          queryKey,
+          query: sub.query
+        });
+      } catch (err) {
+        const error = redactErrorMessage(err);
+        const payload = {
+          type: "count-payload",
+          modelName,
+          queryKey,
+          error
+        };
+        for (const targetSocketId of targetSocketIds) {
+          const ws = sockets.get(targetSocketId);
+          if (!ws) continue;
+          sendWs(ws, payload);
+        }
+      }
+    }
+  }
+};
+const ensureChangeStream = async (tenantId, modelName) => {
+  const tenantStreams = changeStreams.get(tenantId) ?? /* @__PURE__ */ new Map();
+  changeStreams.set(tenantId, tenantStreams);
+  if (tenantStreams.has(modelName)) return;
+  const model = await getTenantModel(tenantId, modelName);
+  const stream = model.watch([], {
+    fullDocument: "updateLookup"
+  });
+  stream.on("change", () => {
+    scheduleDispatchSubscriptionsForModel(tenantId, modelName);
+  });
+  stream.on("close", () => {
+    clearDispatchTimer(tenantId, modelName);
+    const map = changeStreams.get(tenantId);
+    map?.delete(modelName);
+    if (map && map.size === 0) changeStreams.delete(tenantId);
+  });
+  stream.on("error", () => {
+    try {
+      clearDispatchTimer(tenantId, modelName);
+      stream.close();
+    } catch {
+    }
+  });
+  tenantStreams.set(modelName, stream);
+};
+const addSocketSubscription = ({
+  socketId,
+  tenantId,
+  userId,
+  modelName,
+  queryKey,
+  query,
+  options,
+  dependencyModelNames
+}) => {
+  const tenantSubs = subscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
+  subscriptions.set(tenantId, tenantSubs);
+  const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
+  tenantSubs.set(userId, userSubs);
+  const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
+  userSubs.set(modelName, modelSubs);
+  const existing = modelSubs.get(queryKey);
+  if (existing) {
+    existing.socketIds.add(socketId);
+    existing.dependencyModelNames = Array.from(/* @__PURE__ */ new Set([...existing.dependencyModelNames, ...dependencyModelNames]));
+  } else {
+    modelSubs.set(queryKey, {
+      query,
+      options,
+      dependencyModelNames: Array.from(new Set(dependencyModelNames)),
+      socketIds: /* @__PURE__ */ new Set([socketId])
+    });
+  }
+  const byModel = socketSubscriptions.get(socketId) ?? /* @__PURE__ */ new Map();
+  socketSubscriptions.set(socketId, byModel);
+  const querySet = byModel.get(modelName) ?? /* @__PURE__ */ new Set();
+  byModel.set(modelName, querySet);
+  querySet.add(queryKey);
+};
+const addSocketCountSubscription = ({
+  socketId,
+  tenantId,
+  userId,
+  modelName,
+  queryKey,
+  query
+}) => {
+  const tenantSubs = countSubscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
+  countSubscriptions.set(tenantId, tenantSubs);
+  const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
+  tenantSubs.set(userId, userSubs);
+  const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
+  userSubs.set(modelName, modelSubs);
+  const existing = modelSubs.get(queryKey);
+  if (existing) {
+    existing.socketIds.add(socketId);
+  } else {
+    modelSubs.set(queryKey, {
+      query,
+      socketIds: /* @__PURE__ */ new Set([socketId])
+    });
+  }
+  const byModel = socketCountSubscriptions.get(socketId) ?? /* @__PURE__ */ new Map();
+  socketCountSubscriptions.set(socketId, byModel);
+  const querySet = byModel.get(modelName) ?? /* @__PURE__ */ new Set();
+  byModel.set(modelName, querySet);
+  querySet.add(queryKey);
+};
+const removeSocketSubscription = ({
+  socketId,
+  tenantId,
+  userId,
+  modelName,
+  queryKey
+}) => {
+  const tenantSubs = subscriptions.get(tenantId);
+  const userSubs = tenantSubs?.get(userId);
+  const modelSubs = userSubs?.get(modelName);
+  const sub = modelSubs?.get(queryKey);
+  const affectedModelNames = /* @__PURE__ */ new Set([modelName, ...sub?.dependencyModelNames ?? []]);
+  if (sub) {
+    sub.socketIds.delete(socketId);
+    if (!sub.socketIds.size) {
+      modelSubs?.delete(queryKey);
+    }
+  }
+  const byModel = socketSubscriptions.get(socketId);
+  const set = byModel?.get(modelName);
+  if (set) {
+    set.delete(queryKey);
+    if (!set.size) {
+      byModel?.delete(modelName);
+    }
+  }
+  if (modelSubs && modelSubs.size === 0) {
+    userSubs?.delete(modelName);
+  }
+  if (userSubs && userSubs.size === 0) {
+    tenantSubs?.delete(userId);
+  }
+  for (const affectedModelName of affectedModelNames) {
+    if (hasAnySubscriptionsDependingOnModel(tenantId, affectedModelName) || hasAnyCountSubscriptionsForModel(tenantId, affectedModelName)) {
+      continue;
+    }
+    const tenantStreams = changeStreams.get(tenantId);
+    const stream = tenantStreams?.get(affectedModelName);
+    if (stream) {
+      try {
+        stream.close();
+      } catch {
+      }
+      clearDispatchTimer(tenantId, affectedModelName);
+      tenantStreams?.delete(affectedModelName);
+      if (tenantStreams && tenantStreams.size === 0) changeStreams.delete(tenantId);
+    }
+  }
+  if (tenantSubs && tenantSubs.size === 0) subscriptions.delete(tenantId);
+  if (byModel && byModel.size === 0) socketSubscriptions.delete(socketId);
+};
+const removeSocketCountSubscription = ({
+  socketId,
+  tenantId,
+  userId,
+  modelName,
+  queryKey
+}) => {
+  const tenantSubs = countSubscriptions.get(tenantId);
+  const userSubs = tenantSubs?.get(userId);
+  const modelSubs = userSubs?.get(modelName);
+  const sub = modelSubs?.get(queryKey);
+  if (sub) {
+    sub.socketIds.delete(socketId);
+    if (!sub.socketIds.size) {
+      modelSubs?.delete(queryKey);
+    }
+  }
+  const byModel = socketCountSubscriptions.get(socketId);
+  const set = byModel?.get(modelName);
+  if (set) {
+    set.delete(queryKey);
+    if (!set.size) {
+      byModel?.delete(modelName);
+    }
+  }
+  if (modelSubs && modelSubs.size === 0) {
+    userSubs?.delete(modelName);
+  }
+  if (userSubs && userSubs.size === 0) {
+    tenantSubs?.delete(userId);
+  }
+  if (!hasAnySubscriptionsDependingOnModel(tenantId, modelName) && !hasAnyCountSubscriptionsForModel(tenantId, modelName)) {
+    const tenantStreams = changeStreams.get(tenantId);
+    const stream = tenantStreams?.get(modelName);
+    if (stream) {
+      try {
+        stream.close();
+      } catch {
+      }
+      clearDispatchTimer(tenantId, modelName);
+      tenantStreams?.delete(modelName);
+      if (tenantStreams && tenantStreams.size === 0) changeStreams.delete(tenantId);
+    }
+  }
+  if (tenantSubs && tenantSubs.size === 0) countSubscriptions.delete(tenantId);
+  if (byModel && byModel.size === 0) socketCountSubscriptions.delete(socketId);
+};
+const getSocketSubscriptionCount = (socketId) => {
+  let count = 0;
+  const querySubscriptionsByModel = socketSubscriptions.get(socketId);
+  if (querySubscriptionsByModel) {
+    for (const set of querySubscriptionsByModel.values()) count += set.size;
+  }
+  const countSubscriptionsByModel = socketCountSubscriptions.get(socketId);
+  if (countSubscriptionsByModel) {
+    for (const set of countSubscriptionsByModel.values()) count += set.size;
+  }
+  return count;
+};
+const cleanupSocket = (socketId) => {
+  const meta = socketMeta.get(socketId);
+  if (meta) {
+    const byModel = socketSubscriptions.get(socketId);
+    if (byModel) {
+      for (const [modelName, keys] of byModel.entries()) {
+        for (const queryKey of keys.values()) {
+          removeSocketSubscription({
+            socketId,
+            tenantId: meta.tenantId,
+            userId: meta.userId,
+            modelName,
+            queryKey
+          });
+        }
+      }
+    }
+    const countByModel = socketCountSubscriptions.get(socketId);
+    if (countByModel) {
+      for (const [modelName, keys] of countByModel.entries()) {
+        for (const queryKey of keys.values()) {
+          removeSocketCountSubscription({
+            socketId,
+            tenantId: meta.tenantId,
+            userId: meta.userId,
+            modelName,
+            queryKey
+          });
+        }
+      }
+    }
+  }
+  socketSubscriptions.delete(socketId);
+  socketCountSubscriptions.delete(socketId);
+  const cleanupFns = socketCleanup.get(socketId) ?? [];
+  socketCleanup.delete(socketId);
+  for (const fn of cleanupFns) {
+    try {
+      fn();
+    } catch {
+    }
+  }
+  sockets.delete(socketId);
+  socketMeta.delete(socketId);
+  socketWrappers.delete(socketId);
+};
+const handleClientMessage = async ({
+  socketId,
+  meta,
+  message
+}) => {
+  const ws = sockets.get(socketId);
+  if (!ws) return;
+  if (message.type === "event") {
+    const wrapper = socketWrappers.get(socketId);
+    wrapper?.dispatch(message.event, message.payload);
+    return;
+  }
+  const isCountMessage = message.type === "run-count" || message.type === "register-count" || message.type === "remove-count";
+  const sendAccessError = (error) => {
+    if (isCountMessage) {
+      sendWs(ws, {
+        type: "count-payload",
+        modelName: message.modelName ?? "",
+        queryKey: message.queryKey ?? "",
+        error
+      });
+      return;
+    }
+    sendWs(ws, {
+      type: "query-payload",
+      modelName: message.modelName ?? "",
+      queryKey: message.queryKey ?? "",
+      error
+    });
+  };
+  if (!message.modelName || typeof message.modelName !== "string") return;
+  if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(message.modelName)) {
+    sendAccessError("Model not allowed");
+    return;
+  }
+  if (!message.queryKey || typeof message.queryKey !== "string") return;
+  if (message.queryKey.length > QUERY_KEY_MAX_LEN) return;
+  if (message.type === "remove-query") {
+    removeSocketSubscription({
+      socketId,
+      tenantId: meta.tenantId,
+      userId: meta.userId,
+      modelName: message.modelName,
+      queryKey: message.queryKey
+    });
+    return;
+  }
+  if (message.type === "remove-count") {
+    removeSocketCountSubscription({
+      socketId,
+      tenantId: meta.tenantId,
+      userId: meta.userId,
+      modelName: message.modelName,
+      queryKey: message.queryKey
+    });
+    return;
+  }
+  if (!message.query || typeof message.query !== "object") return;
+  const ability = meta.ability;
+  if (!ability.can("read", message.modelName)) {
+    sendAccessError("forbidden");
+    return;
+  }
+  if (message.type === "register-query" || message.type === "run-query") {
+    const options = normalizeRtsQueryOptions(message.options);
+    if (message.type === "register-query") {
+      const existing = socketSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false;
+      if (!existing && getSocketSubscriptionCount(socketId) >= maxSubscriptionsPerSocket) {
+        sendWs(ws, {
+          type: "query-payload",
+          modelName: message.modelName,
+          queryKey: message.queryKey,
+          error: "Too many subscriptions"
+        });
+        return;
+      }
+      let dependencyModelNames = [];
+      if (options.populate !== void 0) {
+        try {
+          dependencyModelNames = await resolveRtsQueryDependencyModelNames({
+            tenantId: meta.tenantId,
+            ability,
+            modelName: message.modelName,
+            options,
+            allowInternalModels
+          });
+        } catch (err) {
+          const error = redactErrorMessage(err);
+          sendWs(ws, {
+            type: "query-payload",
+            modelName: message.modelName,
+            queryKey: message.queryKey,
+            error
+          });
+          return;
+        }
+      }
+      addSocketSubscription({
+        socketId,
+        tenantId: meta.tenantId,
+        userId: meta.userId,
+        modelName: message.modelName,
+        queryKey: message.queryKey,
+        query: message.query,
+        options,
+        dependencyModelNames
+      });
+      try {
+        const modelNamesToWatch = /* @__PURE__ */ new Set([message.modelName, ...dependencyModelNames]);
+        for (const modelName of modelNamesToWatch) {
+          await ensureChangeStream(meta.tenantId, modelName);
+        }
+      } catch (err) {
+        const error = redactErrorMessage(err);
+        sendWs(ws, {
+          type: "query-payload",
+          modelName: message.modelName,
+          queryKey: message.queryKey,
+          error
+        });
+        return;
+      }
+      if (message.runInitialQuery === false) {
+        return;
+      }
+    }
+    try {
+      await runAndSendQuery({
+        tenantId: meta.tenantId,
+        targetSocketIds: [socketId],
+        ability,
+        modelName: message.modelName,
+        queryKey: message.queryKey,
+        query: message.query,
+        options
+      });
+    } catch (err) {
+      const error = redactErrorMessage(err);
+      sendWs(ws, {
+        type: "query-payload",
+        modelName: message.modelName,
+        queryKey: message.queryKey,
+        error
+      });
+    }
+    return;
+  }
+  if (message.type === "register-count" || message.type === "run-count") {
+    if (message.type === "register-count") {
+      const existing = socketCountSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false;
+      if (!existing && getSocketSubscriptionCount(socketId) >= maxSubscriptionsPerSocket) {
+        sendWs(ws, {
+          type: "count-payload",
+          modelName: message.modelName,
+          queryKey: message.queryKey,
+          error: "Too many subscriptions"
+        });
+        return;
+      }
+      addSocketCountSubscription({
+        socketId,
+        tenantId: meta.tenantId,
+        userId: meta.userId,
+        modelName: message.modelName,
+        queryKey: message.queryKey,
+        query: message.query
+      });
+      try {
+        await ensureChangeStream(meta.tenantId, message.modelName);
+      } catch (err) {
+        const error = redactErrorMessage(err);
+        sendWs(ws, {
+          type: "count-payload",
+          modelName: message.modelName,
+          queryKey: message.queryKey,
+          error
+        });
+        return;
+      }
+      if (message.runInitialQuery === false) {
+        return;
+      }
+    }
+    try {
+      await runAndSendCount({
+        tenantId: meta.tenantId,
+        targetSocketIds: [socketId],
+        ability,
+        modelName: message.modelName,
+        queryKey: message.queryKey,
+        query: message.query
+      });
+    } catch (err) {
+      const error = redactErrorMessage(err);
+      sendWs(ws, {
+        type: "count-payload",
+        modelName: message.modelName,
+        queryKey: message.queryKey,
+        error
+      });
+    }
+  }
+};
+const initRts = ({
+  server,
+  path = "/rts",
+  sessionMiddleware,
+  maxPayloadBytes: maxPayloadBytesArg,
+  maxSubscriptionsPerSocket: maxSubscriptionsPerSocketArg,
+  dispatchDebounceMs: dispatchDebounceMsArg,
+  allowInternalModels: allowInternalModelsArg
+}) => {
+  if (initializedServers.has(server)) return;
+  initializedServers.add(server);
+  if (typeof maxPayloadBytesArg === "number" && Number.isFinite(maxPayloadBytesArg) && maxPayloadBytesArg > 0) {
+    maxPayloadBytes = Math.floor(maxPayloadBytesArg);
+  }
+  if (typeof maxSubscriptionsPerSocketArg === "number" && Number.isFinite(maxSubscriptionsPerSocketArg) && maxSubscriptionsPerSocketArg > 0) {
+    maxSubscriptionsPerSocket = Math.floor(maxSubscriptionsPerSocketArg);
+  }
+  if (typeof dispatchDebounceMsArg === "number" && Number.isFinite(dispatchDebounceMsArg) && dispatchDebounceMsArg >= 0) {
+    dispatchDebounceMs = Math.floor(dispatchDebounceMsArg);
+  }
+  allowInternalModels = Boolean(allowInternalModelsArg);
+  const wss = new WebSocketServer({
+    noServer: true,
+    maxPayload: maxPayloadBytes
+  });
+  server.on("upgrade", (req, socket, head) => {
+    ensureSocketErrorHandler(socket, () => ({
+      upgradeHost: req.headers.host ?? "",
+      upgradeUrl: req.url ?? "",
+      userAgent: typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : ""
+    }));
+    upgradeMeta.delete(req);
+    let url;
+    try {
+      url = new URL(req.url ?? "", `http://${req.headers.host ?? "localhost"}`);
+    } catch {
+      badRequest(socket, "Invalid URL");
+      return;
+    }
+    if (url.pathname !== path) return;
+    void (async () => {
+      try {
+        const meta = await parseUpgradeMeta({
+          req,
+          url,
+          sessionMiddleware
+        });
+        upgradeMeta.set(req, meta);
+        wss.handleUpgrade(req, socket, head, (ws) => {
+          wss.emit("connection", ws, req);
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "RTS upgrade failed";
+        if (message.startsWith("Missing rb-tenant-id")) {
+          badRequest(socket, message);
+          return;
+        }
+        unauthorized(socket, message);
+        return;
+      }
+    })().catch(() => {
+      badRequest(socket, "RTS upgrade failed");
+    });
+  });
+  wss.on("connection", (ws, req) => {
+    const meta = upgradeMeta.get(req);
+    upgradeMeta.delete(req);
+    if (!meta) {
+      try {
+        ws.close();
+      } catch {
+      }
+      return;
+    }
+    const socketId = randomUUID();
+    sockets.set(socketId, ws);
+    socketMeta.set(socketId, meta);
+    const wrapper = new RtsSocket({
+      id: socketId,
+      ws,
+      meta
+    });
+    socketWrappers.set(socketId, wrapper);
+    const cleanupFns = [];
+    for (const handler of customHandlers) {
+      try {
+        const cleanup = handler(wrapper);
+        if (typeof cleanup === "function") cleanupFns.push(cleanup);
+      } catch {
+      }
+    }
+    if (cleanupFns.length) socketCleanup.set(socketId, cleanupFns);
+    ws.on("message", (raw) => {
+      let parsed;
+      try {
+        parsed = safeJsonParse(raw);
+      } catch {
+        return;
+      }
+      if (!parsed || typeof parsed !== "object") return;
+      const message = parsed;
+      if (message.type !== "event" && message.type !== "run-query" && message.type !== "register-query" && message.type !== "remove-query" && message.type !== "run-count" && message.type !== "register-count" && message.type !== "remove-count") return;
+      void handleClientMessage({
+        socketId,
+        meta,
+        message
+      });
+    });
+    ws.on("close", () => {
+      cleanupSocket(socketId);
+    });
+    ws.on("error", () => {
+      cleanupSocket(socketId);
+    });
+  });
+};
+const registerRtsHandler = (handler) => {
+  customHandlers.push(handler);
+};
+const notifyRtsModelChanged = (tenantId, modelName) => {
+  scheduleDispatchSubscriptionsForModel(tenantId, modelName);
+};
+export {
+  initRts,
+  notifyRtsModelChanged,
+  registerRtsHandler,
+  routes
+};
+//# sourceMappingURL=index.js.map