Realtime that cannot leak.
Subscribe to entity changes over WebSocket or SSE. Vadyl emits FIELD NAMES only — never values. Subscribers re-read through the canonical CRUD pipeline for actual values, applying access enforcement and field masking. Identity is captured at handshake; subscriptions don't accidentally inherit later request scopes. Reserved-name protection blocks external subscribers from internal dispatch channels.
Field names, never values. Defense in depth.
WebSocket + SSE
Two transports, one canonical SubscriptionManager. RealtimeWebSocketHandler and RealtimeSseHandler are thin transport adapters; subscription state and dispatch are shared.
Entity-indexed fan-out
ConcurrentDictionary keyed by entity name. O(1) subscription removal. Posting a change fans out to every matching subscriber's filter evaluation in parallel.
BoolExpr filter evaluation
Subscribers attach filter expressions in the same AST that drives access policies. The platform evaluates per-subscriber, per-event — same predicate semantics as queries.
Field names only
ChangeEvent.NewValues is null. ChangedFields is the field NAME list. Sensitive / encrypted data cannot leak through realtime — anti-pattern explicit.
Identity at handshake
EntitySubscription captures UserId / Roles / Tenant / Project at WebSocket / SSE handshake. Doesn't hold a reference to scoped IRequestScope — anti-pattern that would survive HTTP scope disposal.
ChangeEventBus
Bounded channel. Posted by WriteCoordinator AFTER commit. Fire-and-forget DropOldest under load. Never blocks the write path; never delivers a phantom event.
Reserved-name protection
Names matching _vadyl_* prefix are internal dispatch only. SubscriptionManager.Subscribe returns false on reserved names; the metric tracks attempts. External clients cannot route to internal signals (anti-pattern #75).
BroadcastManager
Named broadcast channels with presence tracking. Scoped to tenant / project. Use for typing indicators, live cursors, room state — peer to entity subscriptions.
Replay buffers
Subscribers can request a small replay window on connection. Buffered in memory, capacity-bounded. Useful for catch-up after transient disconnects.
One canonical manager
Never values
Never request-scope leak
External subscribers blocked
Realtime that respects access control.
Subscribe. Vadyl evaluates your filter, fans out the names. Re-read through CRUD for values — same access enforcement, same field masking, same audit. Defense in depth.