@terreno/api 0.13.2 → 0.14.0

package/dist/realtime/realtime.test.js

@@ -0,0 +1,2158 @@
+"use strict";
+// biome-ignore-all lint/suspicious/noExplicitAny: test mocks use dynamic shapes for registry entries and documents
+/**
+ * Tests for the realtime module's pure functions and classes:
+ *   - queryMatcher.ts (matchesQuery)
+ *   - queryStore.ts (addQuerySubscription, removeQuerySubscription, etc.)
+ *   - registry.ts (registerRealtime, getRealtimeRegistry, etc.)
+ *   - realtimeApp.ts (RealtimeApp class — register, getIo, close)
+ *   - realtimeApp.ts (installRealtimeSocketHandlers — permission and rate-limit logic)
+ *   - changeStreamWatcher.ts (serializeDoc — responseHandler fallback)
+ */
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var express_1 = __importDefault(require("express"));
+var changeStreamWatcher_1 = require("./changeStreamWatcher");
+var queryMatcher_1 = require("./queryMatcher");
+var queryStore_1 = require("./queryStore");
+var realtimeApp_1 = require("./realtimeApp");
+var registry_1 = require("./registry");
+// ─────────────────────────────────────────────────────────────────────────────
+// queryMatcher tests
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("matchesQuery", function () {
+    (0, bun_test_1.describe)("direct equality", function () {
+        (0, bun_test_1.it)("matches string equality", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ name: "Alice" }, { name: "Alice" })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for non-matching string", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ name: "Alice" }, { name: "Bob" })).toBe(false);
+        });
+        (0, bun_test_1.it)("matches numeric equality", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5 }, { count: 5 })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for non-matching number", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5 }, { count: 6 })).toBe(false);
+        });
+        (0, bun_test_1.it)("matches boolean true", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ active: true }, { active: true })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for non-matching boolean", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ active: true }, { active: false })).toBe(false);
+        });
+        (0, bun_test_1.it)("matches null value", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ deleted: null }, { deleted: null })).toBe(true);
+        });
+        (0, bun_test_1.it)("matches undefined/missing field", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({}, { deleted: undefined })).toBe(true);
+        });
+    });
+    (0, bun_test_1.describe)("nested field access", function () {
+        (0, bun_test_1.it)("accesses nested fields via dot notation", function () {
+            var doc = { user: { age: 30, name: "Alice" } };
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)(doc, { "user.name": "Alice" })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when nested path doesn't match", function () {
+            var doc = { user: { name: "Alice" } };
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)(doc, { "user.name": "Bob" })).toBe(false);
+        });
+        (0, bun_test_1.it)("returns false when nested path is undefined", function () {
+            var doc = { user: {} };
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)(doc, { "user.name": "Alice" })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$eq operator", function () {
+        (0, bun_test_1.it)("matches with $eq", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5 }, { count: { $eq: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false with $eq mismatch", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5 }, { count: { $eq: 6 } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$ne operator", function () {
+        (0, bun_test_1.it)("matches when value is not equal", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { status: { $ne: "inactive" } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when value equals $ne operand", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { status: { $ne: "active" } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$gt, $gte operators", function () {
+        (0, bun_test_1.it)("matches $gt", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 10 }, { score: { $gt: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when not $gt", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 5 }, { score: { $gt: 5 } })).toBe(false);
+        });
+        (0, bun_test_1.it)("matches $gte for equal value", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 5 }, { score: { $gte: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("matches $gte for greater value", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 6 }, { score: { $gte: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when not $gte", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 4 }, { score: { $gte: 5 } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$lt, $lte operators", function () {
+        (0, bun_test_1.it)("matches $lt", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 3 }, { score: { $lt: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when not $lt", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 5 }, { score: { $lt: 5 } })).toBe(false);
+        });
+        (0, bun_test_1.it)("matches $lte for equal value", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 5 }, { score: { $lte: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("matches $lte for lesser value", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 4 }, { score: { $lte: 5 } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when not $lte", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ score: 6 }, { score: { $lte: 5 } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$in operator", function () {
+        (0, bun_test_1.it)("matches when value is in array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { status: { $in: ["active", "pending"] } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when value is not in array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "inactive" }, { status: { $in: ["active", "pending"] } })).toBe(false);
+        });
+        (0, bun_test_1.it)("returns false when operand is not an array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { status: { $in: "active" } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$nin operator", function () {
+        (0, bun_test_1.it)("matches when value is not in array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "inactive" }, { status: { $nin: ["active", "pending"] } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when value is in array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { status: { $nin: ["active", "pending"] } })).toBe(false);
+        });
+        (0, bun_test_1.it)("returns false when operand is not an array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { status: { $nin: "active" } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$exists operator", function () {
+        (0, bun_test_1.it)("matches when field exists and $exists is true", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ name: "Alice" }, { name: { $exists: true } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when field is missing and $exists is true", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({}, { name: { $exists: true } })).toBe(false);
+        });
+        (0, bun_test_1.it)("matches when field is missing and $exists is false", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({}, { name: { $exists: false } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when field exists and $exists is false", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ name: "Alice" }, { name: { $exists: false } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$not operator", function () {
+        (0, bun_test_1.it)("negates a condition with $not", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5 }, { count: { $not: { $gt: 10 } } })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when negated condition matches", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 15 }, { count: { $not: { $gt: 10 } } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$and operator", function () {
+        (0, bun_test_1.it)("matches when all conditions are true", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5, status: "active" }, { $and: [{ status: "active" }, { count: 5 }] })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when one condition fails", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 3, status: "active" }, { $and: [{ status: "active" }, { count: 5 }] })).toBe(false);
+        });
+        (0, bun_test_1.it)("returns false when $and operand is not an array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { $and: "invalid" })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("$or operator", function () {
+        (0, bun_test_1.it)("matches when any condition is true", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "inactive" }, { $or: [{ status: "active" }, { status: "inactive" }] })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false when no conditions match", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "pending" }, { $or: [{ status: "active" }, { status: "inactive" }] })).toBe(false);
+        });
+        (0, bun_test_1.it)("returns false when $or operand is not an array", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ status: "active" }, { $or: "invalid" })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("unknown operator", function () {
+        (0, bun_test_1.it)("returns false for unknown operators (fail closed)", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ name: "Alice" }, { name: { $regex: "Al" } })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("ObjectId-like values", function () {
+        (0, bun_test_1.it)("matches ObjectId-like objects via toString", function () {
+            var fakeObjectId = {
+                constructor: { name: "ObjectId" },
+                toString: function () { return "507f1f77bcf86cd799439011"; },
+            };
+            var doc = { ownerId: fakeObjectId };
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)(doc, { ownerId: "507f1f77bcf86cd799439011" })).toBe(true);
+        });
+    });
+    (0, bun_test_1.describe)("array equality", function () {
+        (0, bun_test_1.it)("matches array conditions by JSON serialization", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ tags: ["a", "b"] }, { tags: ["a", "b"] })).toBe(true);
+        });
+        (0, bun_test_1.it)("returns false for different arrays", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ tags: ["a", "b"] }, { tags: ["a", "c"] })).toBe(false);
+        });
+    });
+    (0, bun_test_1.describe)("empty query", function () {
+        (0, bun_test_1.it)("matches any document with empty query", function () {
+            (0, bun_test_1.expect)((0, queryMatcher_1.matchesQuery)({ count: 5, name: "Alice" }, {})).toBe(true);
+        });
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// queryStore tests
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("queryStore", function () {
+    (0, bun_test_1.beforeEach)(function () {
+        (0, queryStore_1.clearQueryStore)();
+    });
+    (0, bun_test_1.afterEach)(function () {
+        (0, queryStore_1.clearQueryStore)();
+    });
+    (0, bun_test_1.describe)("computeQueryId", function () {
+        (0, bun_test_1.it)("produces a deterministic id from collection and query", function () {
+            var id1 = (0, queryStore_1.computeQueryId)("todos", { completed: false });
+            var id2 = (0, queryStore_1.computeQueryId)("todos", { completed: false });
+            (0, bun_test_1.expect)(id1).toBe(id2);
+        });
+        (0, bun_test_1.it)("normalizes key order before computing id", function () {
+            var id1 = (0, queryStore_1.computeQueryId)("todos", { completed: false, ownerId: "abc" });
+            var id2 = (0, queryStore_1.computeQueryId)("todos", { completed: false, ownerId: "abc" });
+            (0, bun_test_1.expect)(id1).toBe(id2);
+        });
+        (0, bun_test_1.it)("includes the collection name in the id", function () {
+            var id = (0, queryStore_1.computeQueryId)("todos", { completed: false });
+            (0, bun_test_1.expect)(id.startsWith("todos:")).toBe(true);
+        });
+        (0, bun_test_1.it)("produces different ids for different collections", function () {
+            var id1 = (0, queryStore_1.computeQueryId)("todos", { completed: false });
+            var id2 = (0, queryStore_1.computeQueryId)("items", { completed: false });
+            (0, bun_test_1.expect)(id1).not.toBe(id2);
+        });
+        (0, bun_test_1.it)("produces different ids for different queries", function () {
+            var id1 = (0, queryStore_1.computeQueryId)("todos", { completed: false });
+            var id2 = (0, queryStore_1.computeQueryId)("todos", { completed: true });
+            (0, bun_test_1.expect)(id1).not.toBe(id2);
+        });
+    });
+    (0, bun_test_1.describe)("addQuerySubscription", function () {
+        (0, bun_test_1.it)("stores a subscription and makes it retrievable", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(1);
+            (0, bun_test_1.expect)(subs[0].queryId).toBe("todos:q1");
+        });
+        (0, bun_test_1.it)("allows the same socket to subscribe to multiple queries", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: true }, "todos:q2");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(2);
+        });
+        (0, bun_test_1.it)("allows multiple sockets to subscribe to the same query", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket2", "todos", { completed: false }, "todos:q1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            // Same queryId — deduplicated in the store
+            (0, bun_test_1.expect)(subs).toHaveLength(1);
+        });
+    });
+    (0, bun_test_1.describe)("removeQuerySubscription", function () {
+        (0, bun_test_1.it)("removes a specific query for a socket", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.removeQuerySubscription)("socket1", "todos:q1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(0);
+        });
+        (0, bun_test_1.it)("does not remove a query if another socket still uses it", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket2", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.removeQuerySubscription)("socket1", "todos:q1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(1);
+        });
+        (0, bun_test_1.it)("is safe to call for a socket that has no subscriptions", function () {
+            (0, bun_test_1.expect)(function () { return (0, queryStore_1.removeQuerySubscription)("nonexistent", "todos:q1"); }).not.toThrow();
+        });
+    });
+    (0, bun_test_1.describe)("removeAllSocketQueries", function () {
+        (0, bun_test_1.it)("removes all subscriptions for a socket", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: true }, "todos:q2");
+            (0, queryStore_1.removeAllSocketQueries)("socket1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(0);
+        });
+        (0, bun_test_1.it)("preserves subscriptions for other sockets", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket2", "todos", { completed: true }, "todos:q2");
+            (0, queryStore_1.removeAllSocketQueries)("socket1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(1);
+            (0, bun_test_1.expect)(subs[0].queryId).toBe("todos:q2");
+        });
+        (0, bun_test_1.it)("is safe to call for a socket that has no subscriptions", function () {
+            (0, bun_test_1.expect)(function () { return (0, queryStore_1.removeAllSocketQueries)("nonexistent"); }).not.toThrow();
+        });
+        (0, bun_test_1.it)("only removes a shared query if no other sockets use it", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket2", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.removeAllSocketQueries)("socket1");
+            // socket2 still subscribes — query should remain
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs).toHaveLength(1);
+        });
+    });
+    (0, bun_test_1.describe)("getQuerySubscriptionsForCollection", function () {
+        (0, bun_test_1.it)("returns only subscriptions for the given collection", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket2", "items", { status: "active" }, "items:q1");
+            var todoSubs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(todoSubs).toHaveLength(1);
+            (0, bun_test_1.expect)(todoSubs[0].queryId).toBe("todos:q1");
+        });
+        (0, bun_test_1.it)("returns an empty array when no subscriptions exist for collection", function () {
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("nonexistent");
+            (0, bun_test_1.expect)(subs).toHaveLength(0);
+        });
+        (0, bun_test_1.it)("returns query data for each subscription", function () {
+            var query = { completed: false, ownerId: "user1" };
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", query, "todos:q1");
+            var subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("todos");
+            (0, bun_test_1.expect)(subs[0].query).toEqual(query);
+        });
+    });
+    (0, bun_test_1.describe)("clearQueryStore", function () {
+        (0, bun_test_1.it)("removes all subscriptions", function () {
+            (0, queryStore_1.addQuerySubscription)("socket1", "todos", { completed: false }, "todos:q1");
+            (0, queryStore_1.addQuerySubscription)("socket2", "items", { status: "active" }, "items:q1");
+            (0, queryStore_1.clearQueryStore)();
+            (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("todos")).toHaveLength(0);
+            (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("items")).toHaveLength(0);
+        });
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// registry tests
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("realtimeRegistry", function () {
+    var makeEntry = function (overrides) {
+        if (overrides === void 0) { overrides = {}; }
+        return (__assign({ collectionName: "todos", config: {
+                methods: ["create", "update", "delete"],
+                roomStrategy: "owner",
+            }, modelName: "Todo", options: {}, routePath: "/todos" }, overrides));
+    };
+    (0, bun_test_1.beforeEach)(function () {
+        (0, registry_1.clearRealtimeRegistry)();
+    });
+    (0, bun_test_1.afterEach)(function () {
+        (0, registry_1.clearRealtimeRegistry)();
+    });
+    (0, bun_test_1.describe)("registerRealtime", function () {
+        (0, bun_test_1.it)("adds an entry to the registry", function () {
+            (0, registry_1.registerRealtime)(makeEntry());
+            (0, bun_test_1.expect)((0, registry_1.getRealtimeRegistry)()).toHaveLength(1);
+        });
+        (0, bun_test_1.it)("allows multiple entries", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ modelName: "Todo", routePath: "/todos" }));
+            (0, registry_1.registerRealtime)(makeEntry({ collectionName: "items", modelName: "Item", routePath: "/items" }));
+            (0, bun_test_1.expect)((0, registry_1.getRealtimeRegistry)()).toHaveLength(2);
+        });
+    });
+    (0, bun_test_1.describe)("getRealtimeRegistry", function () {
+        (0, bun_test_1.it)("returns all registered entries", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ modelName: "Todo" }));
+            (0, registry_1.registerRealtime)(makeEntry({ collectionName: "items", modelName: "Item", routePath: "/items" }));
+            var registry = (0, registry_1.getRealtimeRegistry)();
+            (0, bun_test_1.expect)(registry).toHaveLength(2);
+            (0, bun_test_1.expect)(registry.map(function (e) { return e.modelName; })).toEqual(["Todo", "Item"]);
+        });
+        (0, bun_test_1.it)("returns empty array when nothing is registered", function () {
+            (0, bun_test_1.expect)((0, registry_1.getRealtimeRegistry)()).toHaveLength(0);
+        });
+    });
+    (0, bun_test_1.describe)("findRegistryEntryByCollection", function () {
+        (0, bun_test_1.it)("finds an entry by collection name", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ collectionName: "todos" }));
+            var entry = (0, registry_1.findRegistryEntryByCollection)("todos");
+            (0, bun_test_1.expect)(entry).toBeDefined();
+            (0, bun_test_1.expect)(entry === null || entry === void 0 ? void 0 : entry.collectionName).toBe("todos");
+        });
+        (0, bun_test_1.it)("returns undefined for unknown collection", function () {
+            var entry = (0, registry_1.findRegistryEntryByCollection)("nonexistent");
+            (0, bun_test_1.expect)(entry).toBeUndefined();
+        });
+        (0, bun_test_1.it)("returns first match when multiple entries exist", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ collectionName: "todos", modelName: "Todo1" }));
+            (0, registry_1.registerRealtime)(makeEntry({ collectionName: "todos", modelName: "Todo2" }));
+            var entry = (0, registry_1.findRegistryEntryByCollection)("todos");
+            (0, bun_test_1.expect)(entry === null || entry === void 0 ? void 0 : entry.modelName).toBe("Todo1");
+        });
+    });
+    (0, bun_test_1.describe)("findRegistryEntryByRoutePath", function () {
+        (0, bun_test_1.it)("finds an entry by exact route path with leading slash", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ routePath: "/todos" }));
+            var entry = (0, registry_1.findRegistryEntryByRoutePath)("todos");
+            (0, bun_test_1.expect)(entry).toBeDefined();
+            (0, bun_test_1.expect)(entry === null || entry === void 0 ? void 0 : entry.routePath).toBe("/todos");
+        });
+        (0, bun_test_1.it)("finds an entry when collection matches routePath exactly", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ routePath: "todos" }));
+            var entry = (0, registry_1.findRegistryEntryByRoutePath)("todos");
+            (0, bun_test_1.expect)(entry).toBeDefined();
+        });
+        (0, bun_test_1.it)("returns undefined for unknown route path", function () {
+            (0, registry_1.registerRealtime)(makeEntry({ routePath: "/todos" }));
+            var entry = (0, registry_1.findRegistryEntryByRoutePath)("items");
+            (0, bun_test_1.expect)(entry).toBeUndefined();
+        });
+    });
+    (0, bun_test_1.describe)("clearRealtimeRegistry", function () {
+        (0, bun_test_1.it)("removes all entries", function () {
+            (0, registry_1.registerRealtime)(makeEntry());
+            (0, registry_1.clearRealtimeRegistry)();
+            (0, bun_test_1.expect)((0, registry_1.getRealtimeRegistry)()).toHaveLength(0);
+        });
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// RealtimeApp tests
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("RealtimeApp", function () {
+    (0, bun_test_1.describe)("constructor", function () {
+        (0, bun_test_1.it)("creates an instance with empty config", function () {
+            var app = new realtimeApp_1.RealtimeApp();
+            (0, bun_test_1.expect)(app).toBeDefined();
+        });
+        (0, bun_test_1.it)("creates an instance with provided config", function () {
+            var app = new realtimeApp_1.RealtimeApp({ adapter: "none", debug: true });
+            (0, bun_test_1.expect)(app).toBeDefined();
+        });
+    });
+    (0, bun_test_1.describe)("getIo", function () {
+        (0, bun_test_1.it)("returns null before the server is created", function () {
+            var app = new realtimeApp_1.RealtimeApp();
+            (0, bun_test_1.expect)(app.getIo()).toBeNull();
+        });
+    });
+    (0, bun_test_1.describe)("register", function () {
+        (0, bun_test_1.it)("health endpoint returns status not_started when io is not initialized", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var expressApp, app, supertest, st, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        expressApp = (0, express_1.default)();
+                        app = new realtimeApp_1.RealtimeApp();
+                        app.register(expressApp);
+                        return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("supertest")); })];
+                    case 1:
+                        supertest = _a.sent();
+                        st = supertest.default(expressApp);
+                        return [4 /*yield*/, st.get("/realtime/health").expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.status).toBe("not_started");
+                        (0, bun_test_1.expect)(res.body.clients).toBe(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("close", function () {
+        (0, bun_test_1.it)("closes gracefully when io is null", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var app;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        app = new realtimeApp_1.RealtimeApp();
+                        // Should not throw
+                        return [4 /*yield*/, (0, bun_test_1.expect)(app.close()).resolves.toBeUndefined()];
+                    case 1:
+                        // Should not throw
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});
+var createMockSocket = function (decodedToken) {
+    var rooms = new Set();
+    var emitted = [];
+    var listeners = new Map();
+    var socket = {
+        decodedToken: decodedToken,
+        emit: function (event, payload) {
+            emitted.push({ event: event, payload: payload });
+        },
+        emitted: emitted,
+        id: "socket-".concat(Math.random().toString(36).slice(2, 9)),
+        join: function (room) { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                rooms.add(room);
+                return [2 /*return*/];
+            });
+        }); },
+        leave: function (room) { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                rooms.delete(room);
+                return [2 /*return*/];
+            });
+        }); },
+        listeners: listeners,
+        on: function (event, handler) {
+            listeners.set(event, handler);
+        },
+        rooms: rooms,
+        trigger: function (event) {
+            var args = [];
+            for (var _i = 1; _i < arguments.length; _i++) {
+                args[_i - 1] = arguments[_i];
+            }
+            return __awaiter(void 0, void 0, void 0, function () {
+                var handler;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            handler = listeners.get(event);
+                            if (!handler) return [3 /*break*/, 2];
+                            return [4 /*yield*/, handler.apply(void 0, __spreadArray([], __read(args), false))];
+                        case 1:
+                            _a.sent();
+                            _a.label = 2;
+                        case 2: return [2 /*return*/];
+                    }
+                });
+            });
+        },
+    };
+    return socket;
+};
+(0, bun_test_1.describe)("installRealtimeSocketHandlers", function () {
+    (0, bun_test_1.beforeEach)(function () {
+        (0, registry_1.clearRealtimeRegistry)();
+        (0, queryStore_1.clearQueryStore)();
+    });
+    (0, bun_test_1.afterEach)(function () {
+        (0, registry_1.clearRealtimeRegistry)();
+        (0, queryStore_1.clearQueryStore)();
+    });
+    var registerOwnerCollection = function () {
+        (0, registry_1.registerRealtime)({
+            collectionName: "todos",
+            config: { methods: ["create", "update", "delete"], roomStrategy: "owner" },
+            modelName: "Todo",
+            options: {
+                permissions: {
+                    create: [function () { return true; }],
+                    delete: [function () { return true; }],
+                    list: [function () { return true; }],
+                    read: [function () { return true; }],
+                    update: [function () { return true; }],
+                },
+            },
+            routePath: "/todos",
+        });
+    };
+    var registerModelCollection = function () {
+        (0, registry_1.registerRealtime)({
+            collectionName: "broadcasts",
+            config: { methods: ["create", "update", "delete"], roomStrategy: "model" },
+            modelName: "Broadcast",
+            options: {
+                permissions: {
+                    create: [function () { return true; }],
+                    delete: [function () { return true; }],
+                    list: [function () { return true; }],
+                    read: [function () { return true; }],
+                    update: [function () { return true; }],
+                },
+            },
+            routePath: "/broadcasts",
+        });
+    };
+    var registerAdminOnlyCollection = function () {
+        (0, registry_1.registerRealtime)({
+            collectionName: "secrets",
+            config: { methods: ["create", "update", "delete"], roomStrategy: "model" },
+            modelName: "Secret",
+            options: {
+                permissions: {
+                    create: [function (_method, user) { return (user === null || user === void 0 ? void 0 : user.admin) === true; }],
+                    delete: [function (_method, user) { return (user === null || user === void 0 ? void 0 : user.admin) === true; }],
+                    list: [function (_method, user) { return (user === null || user === void 0 ? void 0 : user.admin) === true; }],
+                    read: [function (_method, user) { return (user === null || user === void 0 ? void 0 : user.admin) === true; }],
+                    update: [function (_method, user) { return (user === null || user === void 0 ? void 0 : user.admin) === true; }],
+                },
+            },
+            routePath: "/secrets",
+        });
+    };
+    (0, bun_test_1.describe)("connection setup", function () {
+        (0, bun_test_1.it)("joins user-specific and authenticated rooms when token has userId", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        // joinUserRooms is fire-and-forget — give microtasks a chance to flush.
+                        return [4 /*yield*/, Promise.resolve()];
+                    case 1:
+                        // joinUserRooms is fire-and-forget — give microtasks a chance to flush.
+                        _a.sent();
+                        return [4 /*yield*/, Promise.resolve()];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("user:user1")).toBe(true);
+                        (0, bun_test_1.expect)(socket.rooms.has("authenticated")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("joins admin room for admin tokens", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, Promise.resolve()];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, Promise.resolve()];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("admin")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("does not join admin room for non-admin tokens", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, Promise.resolve()];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, Promise.resolve()];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("admin")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("subscribe:model permission", function () {
+        (0, bun_test_1.it)("denies unregistered collections", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "nonexistent")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:nonexistent")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("denies owner-strategy model room for non-admin users", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "todos")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:todos")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("allows owner-strategy model room for admins", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "todos")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:todos")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("allows non-admins to subscribe to model-strategy collections", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "broadcasts")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:broadcasts")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("denies model-strategy collections when modelRouter list permission fails", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerAdminOnlyCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "secrets")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:secrets")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("allows model-strategy collections when modelRouter list permission passes", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerAdminOnlyCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "secrets")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:secrets")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("ignores empty or non-string model names", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, modelRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "")];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:model", 123)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:model", null)];
+                    case 3:
+                        _a.sent();
+                        modelRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("model:"); });
+                        (0, bun_test_1.expect)(modelRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("enforces MAX_MODEL_SUBSCRIPTIONS cap", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var i, socket, i, modelRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        // Register MAX + 5 model-strategy collections.
+                        for (i = 0; i < realtimeApp_1.MAX_MODEL_SUBSCRIPTIONS + 5; i++) {
+                            (0, registry_1.registerRealtime)({
+                                collectionName: "coll".concat(i),
+                                config: { methods: ["create"], roomStrategy: "model" },
+                                modelName: "Coll".concat(i),
+                                options: {
+                                    permissions: {
+                                        create: [function () { return true; }],
+                                        delete: [function () { return true; }],
+                                        list: [function () { return true; }],
+                                        read: [function () { return true; }],
+                                        update: [function () { return true; }],
+                                    },
+                                },
+                                routePath: "/coll".concat(i),
+                            });
+                        }
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        i = 0;
+                        _a.label = 1;
+                    case 1:
+                        if (!(i < realtimeApp_1.MAX_MODEL_SUBSCRIPTIONS + 5)) return [3 /*break*/, 4];
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "coll".concat(i))];
+                    case 2:
+                        _a.sent();
+                        _a.label = 3;
+                    case 3:
+                        i++;
+                        return [3 /*break*/, 1];
+                    case 4:
+                        modelRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("model:"); });
+                        (0, bun_test_1.expect)(modelRooms.length).toBe(realtimeApp_1.MAX_MODEL_SUBSCRIPTIONS);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("subscribe:document permission", function () {
+        (0, bun_test_1.it)("denies unregistered collections", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, docRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "nonexistent", id: "abc" })];
+                    case 1:
+                        _a.sent();
+                        docRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("document:"); });
+                        (0, bun_test_1.expect)(docRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("denies owner-strategy document subscription for non-admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "todos", id: "doc1" })];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("document:todos:doc1")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("allows owner-strategy document subscription for admins", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "todos", id: "doc1" })];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("document:todos:doc1")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("allows model-strategy document subscription for non-admin", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "broadcasts", id: "doc1" })];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("document:broadcasts:doc1")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("denies document subscriptions when modelRouter read permission fails", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerAdminOnlyCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "secrets", id: "doc1" })];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("document:secrets:doc1")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("ignores malformed payloads", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, docRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", null)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:document", {})];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "broadcasts" })];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { id: "doc1" })];
+                    case 4:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: 123, id: "doc1" })];
+                    case 5:
+                        _a.sent();
+                        docRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("document:"); });
+                        (0, bun_test_1.expect)(docRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("subscribe:query permission", function () {
+        (0, bun_test_1.it)("denies unregistered collections", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, queryRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", { collection: "nope", query: { a: 1 } })];
+                    case 1:
+                        _a.sent();
+                        queryRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("query:"); });
+                        (0, bun_test_1.expect)(queryRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("injects ownerId for owner-strategy non-admin subscribers", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, subscribed;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "todos",
+                                query: { completed: false },
+                            })];
+                    case 1:
+                        _a.sent();
+                        subscribed = socket.emitted.find(function (e) { return e.event === "query:subscribed"; });
+                        (0, bun_test_1.expect)(subscribed).toBeDefined();
+                        (0, bun_test_1.expect)((subscribed === null || subscribed === void 0 ? void 0 : subscribed.payload).queryId).toContain("user1");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("does NOT inject ownerId for admins (admins see all)", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, subscribed;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "todos",
+                                query: { completed: false },
+                            })];
+                    case 1:
+                        _a.sent();
+                        subscribed = socket.emitted.find(function (e) { return e.event === "query:subscribed"; });
+                        (0, bun_test_1.expect)(subscribed).toBeDefined();
+                        (0, bun_test_1.expect)((subscribed === null || subscribed === void 0 ? void 0 : subscribed.payload).queryId).not.toContain("admin1");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("ignores subscriptions when user has no id (anonymous) for owner strategy", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, queryRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: false });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "todos",
+                                query: { completed: false },
+                            })];
+                    case 1:
+                        _a.sent();
+                        queryRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("query:"); });
+                        (0, bun_test_1.expect)(queryRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("computes the queryId server-side regardless of client-provided value", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, subscribed, payload;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "todos",
+                                query: { completed: false },
+                                queryId: "EVIL_HIJACK", // client-provided is ignored
+                            })];
+                    case 1:
+                        _a.sent();
+                        subscribed = socket.emitted.find(function (e) { return e.event === "query:subscribed"; });
+                        payload = subscribed === null || subscribed === void 0 ? void 0 : subscribed.payload;
+                        (0, bun_test_1.expect)(payload.queryId).not.toBe("EVIL_HIJACK");
+                        // Must match what the server computes
+                        (0, bun_test_1.expect)(payload.queryId).toBe((0, queryStore_1.computeQueryId)("todos", { completed: false }));
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("denies query subscriptions when modelRouter list permission fails", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, queryRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerAdminOnlyCollection();
+                        socket = createMockSocket({ admin: false, id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "secrets",
+                                query: { classification: "restricted" },
+                            })];
+                    case 1:
+                        _a.sent();
+                        queryRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("query:"); });
+                        (0, bun_test_1.expect)(queryRooms).toHaveLength(0);
+                        (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("secrets")).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("applies modelRouter queryFilter before storing a query subscription", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, subs;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        (0, registry_1.registerRealtime)({
+                            collectionName: "filtered",
+                            config: { methods: ["create"], roomStrategy: "model" },
+                            modelName: "Filtered",
+                            options: {
+                                permissions: {
+                                    create: [function () { return true; }],
+                                    delete: [function () { return true; }],
+                                    list: [function () { return true; }],
+                                    read: [function () { return true; }],
+                                    update: [function () { return true; }],
+                                },
+                                queryFilter: function () { return ({ tenantId: "tenant-1" }); },
+                            },
+                            routePath: "/filtered",
+                        });
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "filtered",
+                                query: { status: "active" },
+                            })];
+                    case 1:
+                        _a.sent();
+                        subs = (0, queryStore_1.getQuerySubscriptionsForCollection)("filtered");
+                        (0, bun_test_1.expect)(subs).toHaveLength(1);
+                        (0, bun_test_1.expect)(subs[0].query).toEqual({ status: "active", tenantId: "tenant-1" });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("denies query subscriptions when modelRouter queryFilter throws", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, queryRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        (0, registry_1.registerRealtime)({
+                            collectionName: "filtered",
+                            config: { methods: ["create"], roomStrategy: "model" },
+                            modelName: "Filtered",
+                            options: {
+                                permissions: {
+                                    create: [function () { return true; }],
+                                    delete: [function () { return true; }],
+                                    list: [function () { return true; }],
+                                    read: [function () { return true; }],
+                                    update: [function () { return true; }],
+                                },
+                                queryFilter: function () {
+                                    throw new Error("tenant lookup failed");
+                                },
+                            },
+                            routePath: "/filtered",
+                        });
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "filtered",
+                                query: { status: "active" },
+                            })];
+                    case 1:
+                        _a.sent();
+                        queryRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("query:"); });
+                        (0, bun_test_1.expect)(queryRooms).toHaveLength(0);
+                        (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("filtered")).toHaveLength(0);
+                        (0, bun_test_1.expect)(socket.emitted.some(function (e) { return e.event === "query:subscribed"; })).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("ignores malformed query payloads", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, queryRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", null)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {})];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:query", { collection: "todos" })];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:query", { collection: "todos", query: [1, 2, 3] })];
+                    case 4:
+                        _a.sent();
+                        queryRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("query:"); });
+                        (0, bun_test_1.expect)(queryRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("enforces MAX_QUERY_SUBSCRIPTIONS cap", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, i, queryRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        i = 0;
+                        _a.label = 1;
+                    case 1:
+                        if (!(i < realtimeApp_1.MAX_QUERY_SUBSCRIPTIONS + 5)) return [3 /*break*/, 4];
+                        return [4 /*yield*/, socket.trigger("subscribe:query", {
+                                collection: "todos",
+                                query: { priority: i },
+                            })];
+                    case 2:
+                        _a.sent();
+                        _a.label = 3;
+                    case 3:
+                        i++;
+                        return [3 /*break*/, 1];
+                    case 4:
+                        queryRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("query:"); });
+                        (0, bun_test_1.expect)(queryRooms.length).toBe(realtimeApp_1.MAX_QUERY_SUBSCRIPTIONS);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("unsubscribe and counters", function () {
+        (0, bun_test_1.it)("unsubscribe:model frees a slot so further subscriptions are allowed", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        (0, registry_1.registerRealtime)({
+                            collectionName: "other",
+                            config: { methods: ["create"], roomStrategy: "model" },
+                            modelName: "Other",
+                            options: {
+                                permissions: {
+                                    create: [function () { return true; }],
+                                    delete: [function () { return true; }],
+                                    list: [function () { return true; }],
+                                    read: [function () { return true; }],
+                                    update: [function () { return true; }],
+                                },
+                            },
+                            routePath: "/other",
+                        });
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "broadcasts")];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:broadcasts")).toBe(true);
+                        return [4 /*yield*/, socket.trigger("unsubscribe:model", "broadcasts")];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:broadcasts")).toBe(false);
+                        // can re-subscribe
+                        return [4 /*yield*/, socket.trigger("subscribe:model", "other")];
+                    case 3:
+                        // can re-subscribe
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("model:other")).toBe(true);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("unsubscribe:document removes the room and decrements the counter", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:document", { collection: "broadcasts", id: "doc1" })];
+                    case 1:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("document:broadcasts:doc1")).toBe(true);
+                        return [4 /*yield*/, socket.trigger("unsubscribe:document", { collection: "broadcasts", id: "doc1" })];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("document:broadcasts:doc1")).toBe(false);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("unsubscribe:document ignores malformed payloads", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, docRooms;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        // None of these should throw or affect rooms
+                        return [4 /*yield*/, socket.trigger("unsubscribe:document", null)];
+                    case 1:
+                        // None of these should throw or affect rooms
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("unsubscribe:document", {})];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("unsubscribe:document", { collection: "broadcasts" })];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("unsubscribe:document", { id: "doc1" })];
+                    case 4:
+                        _a.sent();
+                        docRooms = Array.from(socket.rooms).filter(function (r) { return r.startsWith("document:"); });
+                        (0, bun_test_1.expect)(docRooms).toHaveLength(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("unsubscribe:query removes the query subscription and leaves the room", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket, subscribed, queryId;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerModelCollection();
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", { collection: "broadcasts", query: { priority: 1 } })];
+                    case 1:
+                        _a.sent();
+                        subscribed = socket.emitted.find(function (e) { return e.event === "query:subscribed"; });
+                        (0, bun_test_1.expect)(subscribed).toBeDefined();
+                        queryId = (subscribed === null || subscribed === void 0 ? void 0 : subscribed.payload).queryId;
+                        (0, bun_test_1.expect)(socket.rooms.has("query:".concat(queryId))).toBe(true);
+                        (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("broadcasts").length).toBe(1);
+                        return [4 /*yield*/, socket.trigger("unsubscribe:query", { queryId: queryId })];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)(socket.rooms.has("query:".concat(queryId))).toBe(false);
+                        (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("broadcasts").length).toBe(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("unsubscribe:query ignores malformed payloads", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        socket = createMockSocket({ id: "user1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("unsubscribe:query", null)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("unsubscribe:query", {})];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("disconnect removes all query subscriptions for the socket", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var socket;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        registerOwnerCollection();
+                        socket = createMockSocket({ admin: true, id: "admin1" });
+                        (0, realtimeApp_1.installRealtimeSocketHandlers)(socket);
+                        return [4 /*yield*/, socket.trigger("subscribe:query", { collection: "todos", query: { priority: 1 } })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, socket.trigger("subscribe:query", { collection: "todos", query: { priority: 2 } })];
+                    case 2:
+                        _a.sent();
+                        (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("todos").length).toBeGreaterThan(0);
+                        return [4 /*yield*/, socket.trigger("disconnect")];
+                    case 3:
+                        _a.sent();
+                        // The mock leaves rooms intact but the store should be cleared for this socket.
+                        // Other sockets aren't subscribed, so the store should be empty.
+                        (0, bun_test_1.expect)((0, queryStore_1.getQuerySubscriptionsForCollection)("todos").length).toBe(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// serializeDoc — responseHandler fallback for change stream events
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("serializeDoc (change stream serializer)", function () {
+    var makeEntry = function (overrides) {
+        if (overrides === void 0) { overrides = {}; }
+        return (__assign({ collectionName: "users", config: { methods: ["create", "update", "delete"], roomStrategy: "model" }, modelName: "User", options: {}, routePath: "/users" }, overrides));
+    };
+    (0, bun_test_1.it)("prefers realtimeResponseHandler when provided", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var entry, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    entry = makeEntry({
+                        config: {
+                            methods: ["update"],
+                            realtimeResponseHandler: function (doc) { return ({ customized: doc.name }); },
+                            roomStrategy: "model",
+                        },
+                    });
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.serializeDoc)(entry, { name: "Alice", secret: "x" }, "update")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toEqual({ customized: "Alice" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("falls back to modelRouter responseHandler when no realtime handler is set", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var responseHandler, entry, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    responseHandler = (0, bun_test_1.mock)(function (doc) { return __awaiter(void 0, void 0, void 0, function () {
+                        var hash, salt, rest;
+                        return __generator(this, function (_a) {
+                            hash = doc.hash, salt = doc.salt, rest = __rest(doc, ["hash", "salt"]);
+                            return [2 /*return*/, rest];
+                        });
+                    }); });
+                    entry = makeEntry({ options: { responseHandler: responseHandler } });
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.serializeDoc)(entry, { email: "a@b.com", hash: "h", name: "Alice", salt: "s" }, "update")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toEqual({ email: "a@b.com", name: "Alice" });
+                    (0, bun_test_1.expect)(responseHandler).toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("maps 'delete' method to 'read' when invoking the REST responseHandler", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var observedMethod, responseHandler, entry;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    responseHandler = function (doc, method) { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            observedMethod = method;
+                            return [2 /*return*/, doc];
+                        });
+                    }); };
+                    entry = makeEntry({ options: { responseHandler: responseHandler } });
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.serializeDoc)(entry, { name: "Alice" }, "delete")];
+                case 1:
+                    _a.sent();
+                    (0, bun_test_1.expect)(observedMethod).toBe("read");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("re-throws when modelRouter responseHandler throws (event dropped, no leak)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var responseHandler, entry, doc;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    responseHandler = function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            throw new Error("boom");
+                        });
+                    }); };
+                    entry = makeEntry({ options: { responseHandler: responseHandler } });
+                    doc = { hash: "h", name: "Alice", salt: "s", toJSON: function () { return ({ hash: "h", name: "Alice" }); } };
+                    return [4 /*yield*/, (0, bun_test_1.expect)((0, changeStreamWatcher_1.serializeDoc)(entry, doc, "update")).rejects.toThrow("boom")];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("re-throws when realtimeResponseHandler throws (event dropped, no leak)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var entry, doc;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    entry = makeEntry({
+                        config: {
+                            methods: ["update"],
+                            realtimeResponseHandler: function () {
+                                throw new Error("boom");
+                            },
+                            roomStrategy: "model",
+                        },
+                    });
+                    doc = { name: "Alice", toJSON: function () { return ({ name: "Alice-json" }); } };
+                    return [4 /*yield*/, (0, bun_test_1.expect)((0, changeStreamWatcher_1.serializeDoc)(entry, doc, "update")).rejects.toThrow("boom")];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns toJSON output when no handlers are configured", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var entry, doc, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    entry = makeEntry();
+                    doc = { name: "Alice", toJSON: function () { return ({ id: "1", name: "Alice" }); } };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.serializeDoc)(entry, doc, "create")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toEqual({ id: "1", name: "Alice" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns raw doc when toJSON is missing and no handlers configured", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var entry, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    entry = makeEntry();
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.serializeDoc)(entry, { name: "Alice" }, "create")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toEqual({ name: "Alice" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("adds id from _id when handlers omit it (change stream raw document shape)", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var entry, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    entry = makeEntry();
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.serializeDoc)(entry, { _id: "507f1f77bcf86cd799439011", name: "Alice" }, "create")];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toEqual({
+                        _id: "507f1f77bcf86cd799439011",
+                        id: "507f1f77bcf86cd799439011",
+                        name: "Alice",
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// changeStreamWatcher — internal helpers
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("mapOperationType", function () {
+    (0, bun_test_1.it)("maps insert to create", function () {
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("insert", {})).toBe("create");
+    });
+    (0, bun_test_1.it)("maps update to update by default", function () {
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("update", {
+            updateDescription: { updatedFields: { title: "x" } },
+        })).toBe("update");
+    });
+    (0, bun_test_1.it)("maps replace to update", function () {
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("replace", {})).toBe("update");
+    });
+    (0, bun_test_1.it)("maps update with deleted=true to delete (soft delete) when delete is enabled", function () {
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("update", { updateDescription: { updatedFields: { deleted: true } } }, [
+            "create",
+            "update",
+            "delete",
+        ])).toBe("delete");
+    });
+    (0, bun_test_1.it)("keeps soft delete as update when delete is NOT in the enabled methods", function () {
+        // A model configured with methods: ["create", "update"] must still see
+        // soft-delete events as updates — otherwise they'd be silently dropped.
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("update", { updateDescription: { updatedFields: { deleted: true } } }, [
+            "create",
+            "update",
+        ])).toBe("update");
+    });
+    (0, bun_test_1.it)("maps delete to delete", function () {
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("delete", {})).toBe("delete");
+    });
+    (0, bun_test_1.it)("returns null for unknown operation types", function () {
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("invalidate", {})).toBeNull();
+        (0, bun_test_1.expect)((0, changeStreamWatcher_1.mapOperationType)("drop", {})).toBeNull();
+    });
+});
+(0, bun_test_1.describe)("resolveRooms", function () {
+    var baseEntry = {
+        collectionName: "todos",
+        config: { methods: ["create", "update", "delete"] },
+        modelName: "Todo",
+        options: {},
+        routePath: "/todos",
+    };
+    (0, bun_test_1.it)("returns user-specific room for owner strategy with ownerId", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: "owner" }) });
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, { ownerId: "user-1" }, "create");
+        (0, bun_test_1.expect)(rooms).toEqual(["user:user-1"]);
+    });
+    (0, bun_test_1.it)("converts ObjectId-like ownerId to string", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: "owner" }) });
+        var ownerId = { toString: function () { return "owner-from-obj"; } };
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, { ownerId: ownerId }, "create");
+        (0, bun_test_1.expect)(rooms).toEqual(["user:owner-from-obj"]);
+    });
+    (0, bun_test_1.it)("falls back to model room when owner strategy has no ownerId", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: "owner" }) });
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, {}, "create");
+        (0, bun_test_1.expect)(rooms).toEqual(["model:todos"]);
+    });
+    (0, bun_test_1.it)("returns model room for model strategy", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: "model" }) });
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, {}, "create");
+        (0, bun_test_1.expect)(rooms).toEqual(["model:todos"]);
+    });
+    (0, bun_test_1.it)("returns authenticated room for broadcast strategy", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: "broadcast" }) });
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, {}, "create");
+        (0, bun_test_1.expect)(rooms).toEqual(["authenticated"]);
+    });
+    (0, bun_test_1.it)("defaults to model room for unknown strategy", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: "unknown" }) });
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, {}, "create");
+        (0, bun_test_1.expect)(rooms).toEqual(["model:todos"]);
+    });
+    (0, bun_test_1.it)("invokes custom function room resolver", function () {
+        var entry = __assign(__assign({}, baseEntry), { config: __assign(__assign({}, baseEntry.config), { roomStrategy: function (doc, method) { return ["custom:".concat(method, ":").concat(doc.id)]; } }) });
+        var rooms = (0, changeStreamWatcher_1.resolveRooms)(entry, { id: "42" }, "update");
+        (0, bun_test_1.expect)(rooms).toEqual(["custom:update:42"]);
+    });
+});
+(0, bun_test_1.describe)("emitToDocumentAndQueryRooms", function () {
+    var permissiveOptions = {
+        permissions: {
+            create: [function () { return true; }],
+            delete: [function () { return true; }],
+            list: [function () { return true; }],
+            read: [function () { return true; }],
+            update: [function () { return true; }],
+        },
+    };
+    var makeIo = function () {
+        var emissions = [];
+        var roomSockets = new Map();
+        var sockets = new Map();
+        var nextSocketId = 1;
+        var addSocketToRoom = function (room, decodedToken) {
+            var _a;
+            if (decodedToken === void 0) { decodedToken = { admin: true, id: "admin" }; }
+            var socketId = "socket-".concat(nextSocketId);
+            nextSocketId += 1;
+            if (!roomSockets.has(room)) {
+                roomSockets.set(room, new Set());
+            }
+            (_a = roomSockets.get(room)) === null || _a === void 0 ? void 0 : _a.add(socketId);
+            sockets.set(socketId, {
+                decodedToken: decodedToken,
+                emit: function (event, payload) {
+                    emissions.push({ event: event, payload: payload, room: room });
+                },
+                id: socketId,
+            });
+        };
+        var io = {
+            sockets: {
+                adapter: { rooms: roomSockets },
+                sockets: sockets,
+            },
+            to: function (room) { return ({
+                emit: function (event, payload) {
+                    emissions.push({ event: event, payload: payload, room: room });
+                },
+            }); },
+        };
+        return { addSocketToRoom: addSocketToRoom, emissions: emissions, io: io };
+    };
+    (0, bun_test_1.beforeEach)(function () {
+        (0, queryStore_1.clearQueryStore)();
+    });
+    (0, bun_test_1.afterEach)(function () {
+        (0, queryStore_1.clearQueryStore)();
+    });
+    (0, bun_test_1.it)("emits to the document room", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, emissions, io, event;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = makeIo(), emissions = _a.emissions, io = _a.io;
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "update",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, {}, function () { })];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "document:todos:doc-1"; })).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("forwards hard deletes to every query room for non-owner strategies", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, addSocketToRoom, emissions, io, event, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, queryId);
+                    _a = makeIo(), addSocketToRoom = _a.addSocketToRoom, emissions = _a.emissions, io = _a.io;
+                    addSocketToRoom("query:".concat(queryId));
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "delete",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    entry = {
+                        collectionName: "todos",
+                        config: { methods: ["delete"], roomStrategy: "model" },
+                        modelName: "Todo",
+                        options: permissiveOptions,
+                        routePath: "/todos",
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, undefined, function () { }, entry)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "query:".concat(queryId) && e.event === "sync"; })).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("does NOT forward hard deletes to query rooms for owner-strategy collections", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, addSocketToRoom, emissions, io, event, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { ownerId: "user-1" });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { ownerId: "user-1" }, queryId);
+                    _a = makeIo(), addSocketToRoom = _a.addSocketToRoom, emissions = _a.emissions, io = _a.io;
+                    addSocketToRoom("document:todos:doc-1");
+                    addSocketToRoom("query:".concat(queryId));
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "delete",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    entry = {
+                        collectionName: "todos",
+                        config: { methods: ["delete"], roomStrategy: "owner" },
+                        modelName: "Todo",
+                        options: permissiveOptions,
+                        routePath: "/todos",
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, undefined, function () { }, entry)];
+                case 1:
+                    _b.sent();
+                    // Document room still receives the event, but query rooms must not — otherwise users
+                    // would see deletes for docs they don't own.
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "query:".concat(queryId); })).toBe(false);
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "document:todos:doc-1"; })).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("forwards soft deletes only to query rooms whose filter the document satisfies", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var matchingQueryId, nonMatchingQueryId, _a, addSocketToRoom, emissions, io, event, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    matchingQueryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    nonMatchingQueryId = (0, queryStore_1.computeQueryId)("todos", { priority: 9 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, matchingQueryId);
+                    (0, queryStore_1.addQuerySubscription)("socket-b", "todos", { priority: 9 }, nonMatchingQueryId);
+                    _a = makeIo(), addSocketToRoom = _a.addSocketToRoom, emissions = _a.emissions, io = _a.io;
+                    addSocketToRoom("query:".concat(matchingQueryId));
+                    addSocketToRoom("query:".concat(nonMatchingQueryId));
+                    event = {
+                        collection: "todos",
+                        data: { deleted: true, priority: 1 },
+                        id: "doc-1",
+                        method: "delete",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    entry = {
+                        collectionName: "todos",
+                        config: { methods: ["delete"], roomStrategy: "owner" },
+                        modelName: "Todo",
+                        options: permissiveOptions,
+                        routePath: "/todos",
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, { deleted: true, priority: 1 }, function () { }, entry)];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "query:".concat(matchingQueryId); })).toBe(true);
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "query:".concat(nonMatchingQueryId); })).toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("skips matching when fullDocument is missing on non-delete events", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, emissions, io, event;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, queryId);
+                    _a = makeIo(), emissions = _a.emissions, io = _a.io;
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "create",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, undefined, function () { })];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "query:".concat(queryId); })).toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("emits create events to query rooms when the doc matches", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, emissions, io, event, queryEmissions;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, queryId);
+                    _a = makeIo(), emissions = _a.emissions, io = _a.io;
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "create",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, { priority: 1 }, function () { })];
+                case 1:
+                    _b.sent();
+                    queryEmissions = emissions.filter(function (e) { return e.room === "query:".concat(queryId); });
+                    (0, bun_test_1.expect)(queryEmissions.length).toBe(1);
+                    (0, bun_test_1.expect)(queryEmissions[0].payload).toMatchObject({ method: "create" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("does not emit create events to query rooms when the doc does not match", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, emissions, io, event;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, queryId);
+                    _a = makeIo(), emissions = _a.emissions, io = _a.io;
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "create",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, { priority: 9 }, function () { })];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions.some(function (e) { return e.room === "query:".concat(queryId); })).toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("emits update as-is when the document still matches the query", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, emissions, io, event, queryEmissions;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, queryId);
+                    _a = makeIo(), emissions = _a.emissions, io = _a.io;
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "update",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, { priority: 1 }, function () { })];
+                case 1:
+                    _b.sent();
+                    queryEmissions = emissions.filter(function (e) { return e.room === "query:".concat(queryId); });
+                    (0, bun_test_1.expect)(queryEmissions.length).toBe(1);
+                    (0, bun_test_1.expect)(queryEmissions[0].payload).toMatchObject({ method: "update" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("converts updates that no longer match into delete events for the query", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var queryId, _a, emissions, io, event, queryEmissions;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    queryId = (0, queryStore_1.computeQueryId)("todos", { priority: 1 });
+                    (0, queryStore_1.addQuerySubscription)("socket-a", "todos", { priority: 1 }, queryId);
+                    _a = makeIo(), emissions = _a.emissions, io = _a.io;
+                    event = {
+                        collection: "todos",
+                        id: "doc-1",
+                        method: "update",
+                        model: "Todo",
+                        timestamp: 1,
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToDocumentAndQueryRooms)(io, "todos", event, { priority: 9 }, function () { })];
+                case 1:
+                    _b.sent();
+                    queryEmissions = emissions.filter(function (e) { return e.room === "query:".concat(queryId); });
+                    (0, bun_test_1.expect)(queryEmissions.length).toBe(1);
+                    (0, bun_test_1.expect)(queryEmissions[0].payload).toMatchObject({ method: "delete" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("filters socket emissions by object read permission and responseHandler", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, addSocketToRoom, emissions, io, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = makeIo(), addSocketToRoom = _a.addSocketToRoom, emissions = _a.emissions, io = _a.io;
+                    addSocketToRoom("model:todos", { id: "owner-1" });
+                    addSocketToRoom("model:todos", { id: "other-user" });
+                    entry = {
+                        collectionName: "todos",
+                        config: { methods: ["update"], roomStrategy: "model" },
+                        modelName: "Todo",
+                        options: {
+                            permissions: {
+                                create: [function () { return true; }],
+                                delete: [function () { return true; }],
+                                list: [function () { return true; }],
+                                read: [
+                                    function (_method, user, obj) {
+                                        return (user === null || user === void 0 ? void 0 : user.admin) === true || (user === null || user === void 0 ? void 0 : user.id) === (obj === null || obj === void 0 ? void 0 : obj.ownerId);
+                                    },
+                                ],
+                                update: [function () { return true; }],
+                            },
+                            responseHandler: function (doc, _method, req) {
+                                var _a;
+                                return ({
+                                    id: doc._id,
+                                    title: doc.title,
+                                    visibleTo: (_a = req.user) === null || _a === void 0 ? void 0 : _a.id,
+                                });
+                            },
+                        },
+                        routePath: "/todos",
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToAuthorizedRoom)(io, "model:todos", {
+                            collection: "todos",
+                            id: "todo-1",
+                            method: "update",
+                            model: "Todo",
+                            timestamp: 1,
+                        }, entry, { _id: "todo-1", ownerId: "owner-1", secret: "hidden", title: "Visible" }, function () { })];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions).toHaveLength(1);
+                    (0, bun_test_1.expect)(emissions[0].payload).toMatchObject({
+                        data: { id: "todo-1", title: "Visible", visibleTo: "owner-1" },
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("continues emitting to other sockets when per-socket serialization fails", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, addSocketToRoom, emissions, io, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = makeIo(), addSocketToRoom = _a.addSocketToRoom, emissions = _a.emissions, io = _a.io;
+                    addSocketToRoom("model:todos", { id: "bad-user" });
+                    addSocketToRoom("model:todos", { id: "good-user" });
+                    entry = {
+                        collectionName: "todos",
+                        config: { methods: ["update"], roomStrategy: "model" },
+                        modelName: "Todo",
+                        options: {
+                            permissions: {
+                                create: [function () { return true; }],
+                                delete: [function () { return true; }],
+                                list: [function () { return true; }],
+                                read: [function () { return true; }],
+                                update: [function () { return true; }],
+                            },
+                            responseHandler: function (doc, _method, req) {
+                                var _a, _b;
+                                if (((_a = req.user) === null || _a === void 0 ? void 0 : _a.id) === "bad-user") {
+                                    throw new Error("cannot serialize for bad user");
+                                }
+                                return __assign(__assign({}, doc), { visibleTo: (_b = req.user) === null || _b === void 0 ? void 0 : _b.id });
+                            },
+                        },
+                        routePath: "/todos",
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToAuthorizedRoom)(io, "model:todos", {
+                            collection: "todos",
+                            id: "todo-1",
+                            method: "update",
+                            model: "Todo",
+                            timestamp: 1,
+                        }, entry, { _id: "todo-1", title: "Visible" }, function () { })];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions).toHaveLength(1);
+                    (0, bun_test_1.expect)(emissions[0].payload).toMatchObject({
+                        data: { id: "todo-1", title: "Visible", visibleTo: "good-user" },
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("does not emit hard delete metadata when read permission requires an object owner", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, addSocketToRoom, emissions, io, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = makeIo(), addSocketToRoom = _a.addSocketToRoom, emissions = _a.emissions, io = _a.io;
+                    addSocketToRoom("model:todos", { id: "other-user" });
+                    entry = {
+                        collectionName: "todos",
+                        config: { methods: ["delete"], roomStrategy: "model" },
+                        modelName: "Todo",
+                        options: {
+                            permissions: {
+                                create: [function () { return true; }],
+                                delete: [function () { return true; }],
+                                list: [function () { return true; }],
+                                read: [
+                                    function (_method, user, obj) {
+                                        return (user === null || user === void 0 ? void 0 : user.admin) === true || (user === null || user === void 0 ? void 0 : user.id) === (obj === null || obj === void 0 ? void 0 : obj.ownerId);
+                                    },
+                                ],
+                                update: [function () { return true; }],
+                            },
+                        },
+                        routePath: "/todos",
+                    };
+                    return [4 /*yield*/, (0, changeStreamWatcher_1.emitToAuthorizedRoom)(io, "model:todos", {
+                            collection: "todos",
+                            id: "todo-1",
+                            method: "delete",
+                            model: "Todo",
+                            timestamp: 1,
+                        }, entry, undefined, function () { })];
+                case 1:
+                    _b.sent();
+                    (0, bun_test_1.expect)(emissions).toEqual([]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+// ─────────────────────────────────────────────────────────────────────────────
+// redactCredentials — Redis URL logging
+// ─────────────────────────────────────────────────────────────────────────────
+(0, bun_test_1.describe)("redactCredentials", function () {
+    (0, bun_test_1.it)("redacts user:password@ in a redis URL", function () {
+        (0, bun_test_1.expect)((0, realtimeApp_1.redactCredentials)("redis://user:secret@host:6379/0")).toBe("redis://***@host:6379/0");
+    });
+    (0, bun_test_1.it)("redacts password-only userinfo", function () {
+        (0, bun_test_1.expect)((0, realtimeApp_1.redactCredentials)("redis://:secret@host:6379")).toBe("redis://***@host:6379");
+    });
+    (0, bun_test_1.it)("returns the URL unchanged when there are no credentials", function () {
+        (0, bun_test_1.expect)((0, realtimeApp_1.redactCredentials)("redis://host:6379/0")).toBe("redis://host:6379/0");
+    });
+    (0, bun_test_1.it)("falls back to regex replacement on unparsable URLs", function () {
+        // Some non-URL strings still match the userinfo regex.
+        (0, bun_test_1.expect)((0, realtimeApp_1.redactCredentials)("rediss://u:p@example.com")).toContain("***@");
+        (0, bun_test_1.expect)((0, realtimeApp_1.redactCredentials)("rediss://u:p@example.com")).not.toContain("u:p");
+    });
+});