@ismaelsoilet/synapsejs 1.3.0 → 1.8.0

package/README.md

@@ -21,7 +21,9 @@ Features are listed with the command that fails when they break. Nothing is docu
 without one — see the repository's `AGENTS.md` for the full contract.
 
 **Stable:** vertical slices (N = 1) · `Result<T, E>` flows · TypeBox JIT contracts · declarative
-`sliceSchema` migrations with DAG topological ordering · embedded SQLite (WAL, prepared-statement cache, CTE-safe) ·
+`sliceSchema` migrations with DAG topological ordering · bidirectional `-- up:` / `-- down:` rollbacks (`synapse rollback`) · embedded SQLite (WAL, tuned busy_timeout & cache pragmas delivering 4,000+ req/s, CTE-safe) ·
+full-duplex WebSockets (`defineSocket` + `useWebSocket`) · hierarchical sub-slice composition & outlets (`<SubSlice>`, `<SliceOutlet>`) · in-memory SSR micro-cache & ISR (`defineCache`) ·
+vendor bundle code-splitting via Import Maps (`compiler.vendorChunks`) · standardized shared domain modules (`synapse new-shared`) ·
 isomorphic Query Builder with parameterized relational joins and sub-object nesting (`nestJoinedRow`) · centralized Schema Catalog (`.codebase/db-schema.d.ts`) ·
 declarative UI primitives & hooks (`DataTable`, `DataForm`, `useAction`, `useLoaderData`, `useSubscription`, `SynapseProvider`) ·
 realtime SSE gateway (`EventHub` + `ctx.broadcast`) · schema drift detector (`synapse db-drift`) · AST diff & cross-slice impact analysis (`synapse impact`) ·
@@ -31,9 +33,11 @@ with rawBody preservation · B2B multi-tenancy & IDOR prevention (`requireTenant
 and Turbo Morphing router · explicit RBAC via `requireAuth(session, roles)` · zero-wiring routing + SSR + RPC · slice discovery
 that never reports PASS with zero slices · isomorphic splitter with compile and leak gates · typed AST skeleton map ·
 scaffolder with `--fields` grammar and templates (create, list, update, delete, login, oauth-github, crud) · standalone production bundler (`synapse build --standalone`) ·
-MCP stdio server with 10 tools · slice invariants under `bun:test` with per-invariant reporting · PostgreSQL parity · real concurrency & load stress benchmarks.
+MCP stdio server with 18 native tools (11 Synapse + 7 Jev) · slice invariants under `bun:test` with per-invariant reporting · PostgreSQL parity · real concurrency & load stress benchmarks ·
+SSRF & Network Guard (`validateExternalUrl`, `isPrivateOrReservedIp`) · anti-spoofing & bounded LRU rate limiting · bounded LRU SSR micro-cache with parameter normalization · strict payload size guards (RPC 5MB, Webhook 10MB) & malformed JSON protection · SQLite queue zombie job recovery with `locked_at` visibility timeout · HTTP 500 SSR error isolation & bundle suppression · secure HttpOnly cookies (`ctx.setCookie`) · graceful HTTP shutdown (`server.stop` with connection drain) ·
+Prototype Pollution Shield (`setNestedProperty`, `expandNestedObject`) · Parameterized Query Operator Allowlist (`VALID_WHERE_OPERATORS`) · Reentrant SQLite Savepoints (`txDepth` + `SAVEPOINT`) · Atomic Queue Poison-Pill Neutralization (claim increment & DLQ timeout) · Strict Multi-Tenant Context Derivation (spoofing-proof token claims) · Streaming Upload & Chunked DoS Armor (`readBodyWithinLimit`) · Origin-Validated WebSocket Upgrades (`SYNAPSE_ALLOWED_ORIGINS`) · Safe SSR Serialization (`<script type="application/json">`) & Cookie CRLF Guard.
 
-**Roadmap:** down-migrations / DDL rollbacks, multi-region distributed cache adapters (Redis/Dragonfly).
+**Roadmap:** multi-node distributed cache adapters (Redis/Dragonfly cluster sync), multi-host worker clustering.
 
 The repository README carries a measured context-surface benchmark of the same two features
 implemented with and without the slice convention, including what the numbers do not show.
@@ -126,8 +130,9 @@ bun run mcp     # JSON-RPC 2.0 over stdio
 
 Tools: `synapse_get_repo_map`, `synapse_get_db_schema`, `synapse_check`, `synapse_split`,
 `synapse_run_pbt`, `synapse_scaffold_slice`, `synapse_migrate`, `synapse_rollback`, `synapse_contract`,
-`synapse_check_db_drift`, `synapse_diff_impact`. Slice-dependent tools fail with `NO_SLICES_DIR` (listing the paths they examined)
-instead of reporting an empty success.
+`synapse_check_db_drift`, `synapse_diff_impact`, `synapse_test_gate`, `synapse_abort_check`,
+`synapse_verify_step`, `synapse_reasoning_effort`, `synapse_triage_error`, `synapse_route_task`, `synapse_evaluate_nudge`.
+Slice-dependent tools fail with `NO_SLICES_DIR` (listing the paths they examined) instead of reporting an empty success.
 
 Client configuration for an agent host:
 
@@ -182,11 +187,13 @@ import {
 
   // Declarative UI Primitives, Hooks & i18n
   DataTable, DataForm, Button, Card, Badge, Pagination,
-  SynapseProvider, useAction, useLoaderData, useSubscription, useSession, useSynapseContext,
+  SliceOutlet, SliceOutletProvider, SubSlice,
+  SynapseProvider, useAction, useLoaderData, useSubscription, useWebSocket, useSession, useSynapseContext,
   createTranslator,
 
-  // Realtime SSE Gateway
+  // Realtime & Cache Gateways
   EventHub, getEventHub, resetEventHub,
+  defineSocket, defineCache,
 
   // Compiler, Scaffolding, Schemas, Drift & Diagnostics
   runSliceMigrations, rollbackSliceMigrations, runMachineVerifications,
@@ -194,7 +201,7 @@ import {
   checkSchemaDrift, analyzeImpact, nestJoinedRow,
   resolveSlicesDir, findSliceFiles, SLICE_EXTENSION,
   splitSlice, verifySplit, writeSplitArtifacts, artifactDirectory,
-  scaffoldSlice, scaffoldCrud, parseFields, compressRepositoryAST, buildStandalone,
+  scaffoldSlice, scaffoldCrud, scaffoldShared, parseFields, compressRepositoryAST, buildStandalone,
 
   // MCP
   SynapseMcpServer

package/bin/synapse.ts

@@ -28,7 +28,7 @@ import { generateDatabaseSchemaCatalog } from '../src/compiler/db-schema-generat
 import { analyzeImpact } from '../src/compiler/impact-analyzer';
 import { rollbackSliceMigrations, runSliceMigrations } from '../src/compiler/migration-runner';
 import { runSliceOracles } from '../src/compiler/oracle-runner';
-import { scaffoldCrud, scaffoldSlice } from '../src/compiler/scaffolder';
+import { scaffoldCrud, scaffoldShared, scaffoldSlice } from '../src/compiler/scaffolder';
 import { checkSchemaDrift } from '../src/compiler/schema-drift';
 import { findSliceFiles, resolveSlicesDir } from '../src/compiler/slice-discovery';
 import { artifactDirectory, splitSlice, verifySplit, writeSplitArtifacts } from '../src/compiler/slice-splitter';
@@ -442,6 +442,53 @@ async function main() {
       break;
     }
 
+    case 'new-shared': {
+      const name = process.argv[3];
+      if (!name) {
+        process.stderr.write(
+          `${JSON.stringify({
+            status: 'ERROR',
+            message: 'Nome do módulo compartilhado ausente. Uso: synapse new-shared <nome>'
+          })}\n`
+        );
+        process.exit(1);
+      }
+
+      const root = process.env.SYNAPSE_ROOT || process.cwd();
+      const created = scaffoldShared(name, root);
+
+      if (!created.ok) {
+        process.stderr.write(
+          `${JSON.stringify(
+            {
+              status: 'ERROR',
+              operation: 'SCAFFOLD_SHARED',
+              code: created.error.code,
+              message: created.error.message
+            },
+            null,
+            2
+          )}\n`
+        );
+        process.exit(1);
+      }
+
+      process.stdout.write(
+        `${JSON.stringify(
+          {
+            status: 'PASS',
+            operation: 'SCAFFOLD_SHARED',
+            name,
+            createdPath: path.relative(root, created.value)
+          },
+          null,
+          2
+        )}\n`
+      );
+      process.exit(0);
+      break;
+    }
+
     case 'build': {
       const isStandalone = process.argv.includes('--standalone');
 
@@ -707,7 +754,7 @@ async function main() {
         `${JSON.stringify(
           {
             framework: 'SynapseJS',
-            version: '1.1.0',
+            version: '1.6.0',
             runtime: 'Bun + Bun.serve',
             database: 'Embedded SQLite (WAL) and PostgreSQL, both verified',
             protocols: ['REST/HTTP', 'Isomorphic RPC', 'Model Context Protocol (MCP)'],
@@ -877,6 +924,26 @@ async function main() {
                 feature: 'Token revocation, TOTP 2FA, image optimization & plugin hooks',
                 status: 'stable',
                 evidence: 'bun test packages/synapse/test/onda4.test.ts'
+              },
+              {
+                feature: 'SSRF & Private Network Guard',
+                status: 'stable',
+                evidence: 'bun test packages/synapse/test/production-hardening.test.ts'
+              },
+              {
+                feature: 'Bounded LRU SSR Cache & Query Normalization',
+                status: 'stable',
+                evidence: 'bun test packages/synapse/test/production-hardening.test.ts'
+              },
+              {
+                feature: 'SQLite Queue Zombie Job Visibility Recovery',
+                status: 'stable',
+                evidence: 'bun test packages/synapse/test/production-hardening.test.ts'
+              },
+              {
+                feature: 'HttpOnly Cookie Authentication via ActionContext',
+                status: 'stable',
+                evidence: 'bun test packages/synapse/test/production-hardening.test.ts'
               }
             ],
             commands: [
@@ -910,7 +977,7 @@ async function main() {
 
     default: {
       process.stderr.write(
-        `Unknown command: ${command}\nAvailable: new, dev, check, migrate, rollback, mcp, skeleton, db-schema, split, build, test, worker, new-slice, contract, info\n`
+        `Unknown command: ${command}\nAvailable: start, dev, check, migrate, rollback, mcp, skeleton, db-schema, db-drift, impact, split, build, test, worker, new, new-slice, contract, info\n`
       );
       process.exit(1);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ismaelsoilet/synapsejs",
-  "version": "1.3.0",
+  "version": "1.8.0",
   "description": "Bun-only fullstack framework where a feature is a single contiguous file",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/client/components.tsx

@@ -336,32 +336,49 @@ export interface DataFormProps {
   className?: string;
 }
 
-export function setNestedProperty(obj: Record<string, any>, path: string, value: unknown): void {
+const FORBIDDEN_PROPERTIES = new Set(['__proto__', 'constructor', 'prototype']);
+
+export function setNestedProperty(obj: Record<string, unknown>, path: string, value: unknown): void {
   const parts = path.split('.');
+  if (parts.some((p) => FORBIDDEN_PROPERTIES.has(p.trim()))) {
+    return;
+  }
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
+    if (FORBIDDEN_PROPERTIES.has(part)) return;
     if (!cur[part] || typeof cur[part] !== 'object') {
-      cur[part] = {};
+      cur[part] = Object.create(null);
     }
-    cur = cur[part];
+    cur = cur[part] as Record<string, unknown>;
+  }
+  const lastKey = parts[parts.length - 1];
+  if (!FORBIDDEN_PROPERTIES.has(lastKey)) {
+    cur[lastKey] = value;
   }
-  cur[parts[parts.length - 1]] = value;
 }
 
-export function getNestedProperty(obj: Record<string, any>, path: string): unknown {
+export function getNestedProperty(obj: Record<string, unknown>, path: string): unknown {
   const parts = path.split('.');
-  let cur: any = obj;
+  if (parts.some((p) => FORBIDDEN_PROPERTIES.has(p.trim()))) {
+    return undefined;
+  }
+  let cur: unknown = obj;
   for (const part of parts) {
-    if (cur === null || cur === undefined) return undefined;
-    cur = cur[part];
+    if (cur === null || cur === undefined || typeof cur !== 'object' || FORBIDDEN_PROPERTIES.has(part)) {
+      return undefined;
+    }
+    cur = (cur as Record<string, unknown>)[part];
   }
   return cur;
 }
 
 export function expandNestedObject(flat: Record<string, unknown>): Record<string, unknown> {
-  const nested: Record<string, any> = {};
+  const nested: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(flat)) {
+    if (FORBIDDEN_PROPERTIES.has(key.trim())) {
+      continue;
+    }
     if (key.includes('.')) {
       setNestedProperty(nested, key, value);
     } else {

package/src/client/outlet.tsx

@@ -0,0 +1,40 @@
+import type React from 'react';
+import { createContext, type ReactNode, useContext } from 'react';
+
+export interface SliceOutletContextValue {
+  content?: ReactNode;
+  outlets?: Record<string, ReactNode>;
+}
+
+const SliceOutletContext = createContext<SliceOutletContextValue>({});
+
+export interface SliceOutletProviderProps {
+  content?: ReactNode;
+  outlets?: Record<string, ReactNode>;
+  children: ReactNode;
+}
+
+export function SliceOutletProvider({ content, outlets = {}, children }: SliceOutletProviderProps) {
+  return <SliceOutletContext.Provider value={{ content, outlets }}>{children}</SliceOutletContext.Provider>;
+}
+
+export interface SliceOutletProps {
+  name?: string;
+  fallback?: ReactNode;
+  children?: ReactNode;
+}
+
+/**
+ * <SliceOutlet /> renders nested content within Root or Domain Layouts,
+ * enabling parallel sub-panels and composable nested views.
+ */
+export function SliceOutlet({ name, fallback = null, children }: SliceOutletProps): React.ReactElement | null {
+  const ctx = useContext(SliceOutletContext);
+  if (children) {
+    return <>{children}</>;
+  }
+  if (name && ctx.outlets) {
+    return <>{ctx.outlets[name] ?? fallback}</>;
+  }
+  return <>{ctx.content ?? fallback}</>;
+}

package/src/client/sub-slice.tsx

@@ -0,0 +1,45 @@
+import React, { type ComponentType, type ReactElement, useMemo } from 'react';
+import { rpcCall } from '../core/rpc-client';
+import { SynapseProvider } from './context';
+
+export interface SubSliceProps<TProps extends Record<string, unknown> = Record<string, unknown>> {
+  domain: string;
+  name: string;
+  // biome-ignore lint/suspicious/noExplicitAny: dynamic component props boundary
+  component?: ComponentType<any>;
+  props?: TProps;
+  actionPropNames?: string[];
+  children?: (injectedProps: Record<string, unknown>) => ReactElement;
+}
+
+/**
+ * <SubSlice /> dynamically embeds a sub-slice component into any layout or parent view,
+ * automatically wiring its transparent RPC action endpoint without violating Locality of Behavior (N = 1).
+ */
+export function SubSlice<TProps extends Record<string, unknown> = Record<string, unknown>>({
+  domain,
+  name,
+  component: Component,
+  props = {} as TProps,
+  actionPropNames = ['action', 'onSubmitAction'],
+  children
+}: SubSliceProps<TProps>): ReactElement {
+  const rpcPath = `/_synapse/rpc/${domain}/${name}`;
+
+  const boundActions = useMemo(() => {
+    const actions: Record<string, (payload: unknown) => Promise<unknown>> = {};
+    for (const actionName of actionPropNames) {
+      actions[actionName] = (payload: unknown) => rpcCall(rpcPath, payload);
+    }
+    return actions;
+  }, [rpcPath, actionPropNames]);
+
+  const mergedProps = {
+    ...props,
+    ...boundActions
+  };
+
+  const content = children ? children(mergedProps) : Component ? React.createElement(Component, mergedProps) : null;
+
+  return <SynapseProvider props={mergedProps}>{content}</SynapseProvider>;
+}

package/src/client/use-websocket.ts

@@ -0,0 +1,146 @@
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+export interface UseWebSocketOptions<TServerMsg = unknown> {
+  enabled?: boolean;
+  reconnect?: boolean;
+  reconnectIntervalMs?: number;
+  onOpen?: () => void;
+  onMessage?: (message: TServerMsg) => void;
+  onClose?: (event: CloseEvent) => void;
+  onError?: (event: Event) => void;
+}
+
+export interface UseWebSocketResult<TServerMsg = unknown, TClientMsg = unknown> {
+  isConnected: boolean;
+  lastMessage: TServerMsg | null;
+  send: (data: TClientMsg | string) => void;
+  close: () => void;
+  error: Error | null;
+}
+
+/**
+ * Hook for bidirectional WebSocket communication with SynapseJS slices.
+ */
+export function useWebSocket<TServerMsg = unknown, TClientMsg = unknown>(
+  pathOrSlice: string,
+  options: UseWebSocketOptions<TServerMsg> = {}
+): UseWebSocketResult<TServerMsg, TClientMsg> {
+  const { enabled = true, reconnect = true, reconnectIntervalMs = 3000 } = options;
+
+  const [isConnected, setIsConnected] = useState<boolean>(false);
+  const [lastMessage, setLastMessage] = useState<TServerMsg | null>(null);
+  const [error, setError] = useState<Error | null>(null);
+
+  const socketRef = useRef<WebSocket | null>(null);
+  const optionsRef = useRef(options);
+  optionsRef.current = options;
+
+  const resolveUrl = useCallback((path: string): string => {
+    if (typeof window === 'undefined') return '';
+    if (path.startsWith('ws://') || path.startsWith('wss://')) return path;
+
+    const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+    const host = window.location.host;
+
+    if (path.startsWith('/')) {
+      return `${protocol}//${host}${path}`;
+    }
+    // Formato <domain>/<name>
+    return `${protocol}//${host}/_synapse/ws/${path}`;
+  }, []);
+
+  useEffect(() => {
+    if (!enabled || typeof window === 'undefined') return;
+
+    let isMounted = true;
+    let reconnectTimeout: ReturnType<typeof setTimeout> | null = null;
+
+    const connect = () => {
+      try {
+        const url = resolveUrl(pathOrSlice);
+        if (!url) return;
+
+        const ws = new WebSocket(url);
+        socketRef.current = ws;
+
+        ws.onopen = () => {
+          if (!isMounted) return;
+          setIsConnected(true);
+          setError(null);
+          optionsRef.current.onOpen?.();
+        };
+
+        ws.onmessage = (event) => {
+          if (!isMounted) return;
+          try {
+            const data = JSON.parse(event.data) as TServerMsg;
+            setLastMessage(data);
+            optionsRef.current.onMessage?.(data);
+          } catch {
+            const raw = event.data as unknown as TServerMsg;
+            setLastMessage(raw);
+            optionsRef.current.onMessage?.(raw);
+          }
+        };
+
+        ws.onerror = (e) => {
+          if (!isMounted) return;
+          const err = new Error(`Erro na conexão WebSocket para "${pathOrSlice}"`);
+          setError(err);
+          optionsRef.current.onError?.(e);
+        };
+
+        ws.onclose = (e) => {
+          if (!isMounted) return;
+          setIsConnected(false);
+          optionsRef.current.onClose?.(e);
+
+          if (reconnect && isMounted && !e.wasClean) {
+            reconnectTimeout = setTimeout(connect, reconnectIntervalMs);
+          }
+        };
+      } catch (err) {
+        if (!isMounted) return;
+        setError(err instanceof Error ? err : new Error(String(err)));
+      }
+    };
+
+    connect();
+
+    return () => {
+      isMounted = false;
+      if (reconnectTimeout) clearTimeout(reconnectTimeout);
+      if (socketRef.current) {
+        socketRef.current.close();
+        socketRef.current = null;
+      }
+      setIsConnected(false);
+    };
+  }, [pathOrSlice, enabled, reconnect, reconnectIntervalMs, resolveUrl]);
+
+  const send = useCallback(
+    (data: TClientMsg | string) => {
+      if (socketRef.current && socketRef.current.readyState === WebSocket.OPEN) {
+        const payload = typeof data === 'string' ? data : JSON.stringify(data);
+        socketRef.current.send(payload);
+      } else {
+        console.warn(`[useWebSocket] Tentativa de envio em socket desconectado (${pathOrSlice})`);
+      }
+    },
+    [pathOrSlice]
+  );
+
+  const close = useCallback(() => {
+    if (socketRef.current) {
+      socketRef.current.close();
+    }
+  }, []);
+
+  return {
+    isConnected,
+    lastMessage,
+    send,
+    close,
+    error
+  };
+}

package/src/client.ts

@@ -53,6 +53,18 @@ export {
   type TranslateFn,
   type TranslationDictionary
 } from './client/i18n';
+export {
+  SliceOutlet,
+  type SliceOutletProps,
+  SliceOutletProvider,
+  type SliceOutletProviderProps
+} from './client/outlet';
+export { SubSlice, type SubSliceProps } from './client/sub-slice';
+export {
+  type UseWebSocketOptions,
+  type UseWebSocketResult,
+  useWebSocket
+} from './client/use-websocket';
 export type { Result } from './core/machine-types';
 export { type RpcTransportError, rpcCall, rpcTransportFailure } from './core/rpc-client';
 export type { SessionContext } from './core/session-context';

package/src/compiler/client-bundler.ts

@@ -61,11 +61,16 @@ export function clientManifestPath(baseDir: string): string {
   return path.join(baseDir, '.synapse', 'client', 'manifest.json');
 }
 
-export async function buildVendorBundle(baseDir: string): Promise<Result<BuiltBundle, BuildError>> {
+export async function buildVendorBundle(
+  baseDir: string,
+  vendorPackages: string[] = []
+): Promise<Result<BuiltBundle, BuildError>> {
   const vendorEntryDir = path.join(baseDir, '.synapse/client-entry');
   fs.mkdirSync(vendorEntryDir, { recursive: true });
   const vendorEntryPath = path.join(vendorEntryDir, '_vendor.ts');
 
+  const extraExports = (vendorPackages || []).map((pkg) => `export * from '${pkg}';`).join('\n');
+
   const vendorEntryContent = [
     `import React from 'react';`,
     `import * as ReactDOM from 'react-dom';`,
@@ -73,6 +78,7 @@ export async function buildVendorBundle(baseDir: string): Promise<Result<BuiltBu
     `import * as SynapseClient from 'synapsejs/client';`,
     `import * as jsxRuntime from 'react/jsx-runtime';`,
     `import * as jsxDevRuntime from 'react/jsx-dev-runtime';`,
+    ...(extraExports ? [extraExports] : []),
     ``,
     `export default React;`,
     `export * from 'react';`,
@@ -209,7 +215,8 @@ export function componentExportOf(module: Record<string, unknown>): string | und
 
 export async function buildClientBundle(
   target: BundleTarget,
-  baseDir: string
+  baseDir: string,
+  options?: { vendorPackages?: string[] }
 ): Promise<Result<BuiltBundle, BuildError>> {
   // Uma fatia que não carrega não pode derrubar o build inteiro: ela vira FAIL com o motivo.
   let sliceModule: Record<string, unknown>;
@@ -311,7 +318,7 @@ export async function buildClientBundle(
   if (vendorSplit) {
     const vendorFile = path.join(baseDir, '.synapse/client', VENDOR_BUNDLE_NAME);
     if (!fs.existsSync(vendorFile)) {
-      await buildVendorBundle(baseDir);
+      await buildVendorBundle(baseDir, options?.vendorPackages);
     }
   }
 
@@ -334,7 +341,8 @@ export async function buildClientBundle(
             'react-dom',
             'react-dom/client',
             'synapsejs/client',
-            '@ismaelsoilet/synapsejs/client'
+            '@ismaelsoilet/synapsejs/client',
+            ...(options?.vendorPackages || [])
           ]
         : [],
       define: { 'process.env.NODE_ENV': production ? '"production"' : '"development"' }
@@ -421,7 +429,8 @@ export interface BuildReportEntry {
  * component and fails to produce a bundle is a broken build.
  */
 export async function buildAllClientBundles(
-  appRoot: string
+  appRoot: string,
+  options?: { vendorPackages?: string[] }
 ): Promise<Result<{ entries: BuildReportEntry[]; manifestFile: string }, SlicesDirError>> {
   const resolution = resolveSlicesDir(appRoot);
 
@@ -433,7 +442,7 @@ export async function buildAllClientBundles(
   const entries: BuildReportEntry[] = [];
   const built: BuiltBundle[] = [];
 
-  const vendorRes = await buildVendorBundle(appRoot);
+  const vendorRes = await buildVendorBundle(appRoot, options?.vendorPackages);
   if (vendorRes.ok) {
     built.push(vendorRes.value);
     entries.push({ slice: '_vendor', status: 'PASS', url: vendorRes.value.url, bytes: vendorRes.value.bytes });
@@ -446,7 +455,8 @@ export async function buildAllClientBundles(
 
     const bundle = await buildClientBundle(
       { key, name, domain, filePath: file, rpcPath: `/_synapse/rpc/${domain}/${name}` },
-      appRoot
+      appRoot,
+      options
     );
 
     if (bundle.ok) {