@ismaelsoilet/synapsejs 1.3.0 → 1.8.0

package/src/runtime/server.ts

@@ -26,25 +26,33 @@ import { findSliceFiles, resolveSlicesDir } from '../compiler/slice-discovery';
 import {
   type ActionContext,
   AnonymousSession,
+  BoundedLruCache,
   createActionContext,
   createDefaultLogger,
   createSession,
   type DatabaseClient,
   getDatabase,
   loadSynapseConfig,
+  normalizeCacheKey,
   optimizeImage,
   resetDatabaseInstance,
   type SessionContext,
-  type SynapseConfig
+  type SliceCacheConfig,
+  type SliceSocketDefinition,
+  type SynapseConfig,
+  type SynapseWebSocket,
+  serializeCookie
 } from '../core/index';
 import { ROLES_COOKIE, SESSION_COOKIE } from '../core/session-cookie';
 import { verifySessionToken } from '../core/session-token';
+import { SYNAPSE_VERSION } from '../version';
 import { serializeClientProps } from './client-entry';
-import { isAction, isComponent, isJob, isLoader, isMeta, isWebhook } from './discovery-rules';
+import { isAction, isCache, isComponent, isJob, isLoader, isMeta, isSocket, isWebhook } from './discovery-rules';
 import { getEventHub } from './event-hub';
+import { validateExternalUrl } from './network-guard';
 import { QueueEngine } from './queue-engine';
 import { TokenBucketRateLimiter } from './rate-limiter';
-import { saveUpload } from './uploads';
+import { readBodyWithinLimit, saveUpload } from './uploads';
 
 export interface SliceMetadata {
   title?: string;
@@ -71,6 +79,7 @@ export interface DiscoveredSlice {
   routePath: string;
   rpcPath: string;
   webhookPath: string;
+  wsPath: string;
   filePath: string;
   actionFn?: (payload: unknown, dbOrCtx?: any, session?: SessionContext, extraCtx?: ActionContext) => Promise<any>;
   componentFn?: React.ComponentType<any>;
@@ -82,6 +91,10 @@ export interface DiscoveredSlice {
   metaFn?: (props: Record<string, unknown>, context: SliceLoaderContext) => SliceMetadata | Promise<SliceMetadata>;
   /** Optional Webhook handler receiving rawBody and ActionContext */
   webhookFn?: (event: WebhookEvent, ctx: ActionContext) => Promise<any>;
+  /** Optional SSR cache and ISR policy */
+  cacheConfig?: SliceCacheConfig;
+  /** Optional bidirectional WebSocket handler */
+  socketDef?: SliceSocketDefinition;
 }
 
 /**
@@ -137,9 +150,9 @@ export const TURBO_ROUTER_SCRIPT = `(function() {
         curRoot.innerHTML = newRoot.innerHTML;
         document.title = doc.title;
         var newPropsScript = doc.querySelector('script[data-synapse-props]');
-        if (newPropsScript) {
+        if (newPropsScript && newPropsScript.textContent) {
           try {
-            eval(newPropsScript.textContent);
+            window.__SYNAPSE_PROPS__ = JSON.parse(newPropsScript.textContent);
           } catch (_) {}
         }
         if (push) history.pushState({}, '', href);
@@ -250,6 +263,29 @@ export class SynapseServer {
   private layoutComponent: React.ComponentType<any> | null = null;
   private domainLayouts: Map<string, React.ComponentType<any>> = new Map();
   private rateLimiter: TokenBucketRateLimiter;
+  private ssrCache: BoundedLruCache<{
+    html: string;
+    expiresAt: number;
+    staleUntil: number;
+    ttlSeconds: number;
+    swrSeconds: number;
+    tags: string[];
+  }>;
+  private revalidatingKeys = new Set<string>();
+
+  public invalidateCache(tags?: string[]): void {
+    if (!tags || tags.length === 0) {
+      this.ssrCache.clear();
+      return;
+    }
+    const tagSet = new Set(tags);
+    for (const [key, entry] of this.ssrCache.entries()) {
+      if (entry.tags.some((t) => tagSet.has(t))) {
+        this.ssrCache.delete(key);
+      }
+    }
+  }
+
   private metrics = {
     startTime: Date.now(),
     totalRequests: 0,
@@ -261,11 +297,15 @@ export class SynapseServer {
   };
   public port: number;
 
-  constructor(baseDir: string = process.cwd(), port: number = 3000, db?: DatabaseClient) {
+  constructor(baseDir: string = process.cwd(), port: number = 3000, db?: DatabaseClient, config?: SynapseConfig) {
     this.baseDir = baseDir;
     this.port = port;
     this.db = db || getDatabase();
-    this.rateLimiter = new TokenBucketRateLimiter();
+    if (config) {
+      this.config = { ...config };
+    }
+    this.rateLimiter = new TokenBucketRateLimiter({ maxBuckets: 10_000 });
+    this.ssrCache = new BoundedLruCache(this.config.cache?.maxEntries || 1000);
     this.queueEngine = new QueueEngine({
       dbPath: path.join(this.baseDir, '.synapse/queue.sqlite'),
       logger: createDefaultLogger('QueueEngine')
@@ -275,11 +315,14 @@ export class SynapseServer {
   /**
    * Gracefully shuts down the HTTP server and closes database connections.
    */
-  async stop(): Promise<void> {
+  async stop(drainTimeoutMs = 5000): Promise<void> {
     if (this.httpServer) {
-      this.httpServer.stop(true);
+      this.httpServer.stop(false);
       this.httpServer = null;
     }
+    if (drainTimeoutMs > 0) {
+      await new Promise((resolve) => setTimeout(resolve, Math.min(drainTimeoutMs, 200)));
+    }
     this.rateLimiter.close();
     this.queueEngine.close();
     await this.db.close?.();
@@ -321,7 +364,8 @@ export class SynapseServer {
       tenantId: session.tenantId,
       services: (this.config.services as Record<string, unknown>) || {},
       logger: createDefaultLogger(sliceName),
-      enqueue: (jobOrName, payload, options) => this.queueEngine.enqueue(jobOrName, payload, options)
+      enqueue: (jobOrName, payload, options) => this.queueEngine.enqueue(jobOrName, payload, options),
+      invalidateCache: (tags) => this.invalidateCache(tags)
     });
   }
 
@@ -409,6 +453,8 @@ export class SynapseServer {
         let loaderFn: any = null;
         let webhookFn: any = null;
         let metaFn: any = null;
+        let cacheConfig: any = null;
+        let socketDef: any = null;
 
         for (const [exportName, val] of Object.entries(mod)) {
           if (
@@ -420,16 +466,29 @@ export class SynapseServer {
           ) {
             this.queueEngine.registerJob(val as any);
           }
+          if (isCache(exportName) && val && typeof val === 'object') {
+            cacheConfig = val;
+          }
+          if (isSocket(exportName) && val && typeof val === 'object') {
+            socketDef = val;
+          }
           if (typeof val !== 'function') {
             continue;
           }
-          if (isAction(exportName)) {
+          if (exportName === 'default' && typeof val === 'function') {
+            componentFn = val;
+            componentExport = 'default';
+          } else if (isAction(exportName)) {
             actionFn = val;
           } else if (isLoader(exportName)) {
             loaderFn = val;
           } else if (isComponent(exportName)) {
-            componentFn = val;
-            componentExport = exportName;
+            if (componentExport !== 'default') {
+              if (!componentFn || exportName.endsWith('View')) {
+                componentFn = val;
+                componentExport = exportName;
+              }
+            }
           } else if (isWebhook(exportName)) {
             webhookFn = val;
           } else if (isMeta(exportName)) {
@@ -444,13 +503,16 @@ export class SynapseServer {
           routePath,
           rpcPath,
           webhookPath: `/_synapse/webhooks/${domain}/${name}`,
+          wsPath: `/_synapse/ws/${domain}/${name}`,
           filePath: file,
           actionFn,
           componentFn,
           componentExport,
           loaderFn,
           metaFn,
-          webhookFn
+          webhookFn,
+          cacheConfig,
+          socketDef
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -462,6 +524,13 @@ export class SynapseServer {
     return this.slices.size;
   }
 
+  /**
+   * Registers a slice directly on this server instance (useful for programmatic slices and testing).
+   */
+  public registerSlice(slice: DiscoveredSlice): void {
+    this.slices.set(slice.key, slice);
+  }
+
   /**
    * `<domain>/<name>` resolves directly. A bare name resolves only while it is
    * unique across domains; ambiguity is an explicit conflict, never a guess.
@@ -584,13 +653,18 @@ export class SynapseServer {
       return verified.ok
         ? createSession({
             userId: verified.value.userId,
-            tenantId: (verified.value as { tenantId?: string }).tenantId || tenantId,
+            tenantId: verified.value.tenantId || tenantId,
             roles: verified.value.roles,
             token
           })
         : AnonymousSession(tenantId);
     }
 
+    // Em produção sem SYNAPSE_SESSION_SECRET, forjamento de headers é terminantemente proibido (CWE-287)
+    if (process.env.NODE_ENV === 'production') {
+      return AnonymousSession(tenantId);
+    }
+
     // Modo de desenvolvimento (sem segredo configurado):
     // Aceita headers diretos ou cookies para conveniência local.
     const cookieRoles = cookies[ROLES_COOKIE];
@@ -656,7 +730,8 @@ export class SynapseServer {
         filePath: slice.filePath,
         rpcPath: slice.rpcPath
       },
-      this.baseDir
+      this.baseDir,
+      { vendorPackages: this.config.compiler?.vendorPackages }
     );
 
     if (!built.ok) {
@@ -693,6 +768,119 @@ export class SynapseServer {
     return elements.join('\n');
   }
 
+  /**
+   * Renders the slice SSR component tree and packages the complete HTML shell
+   */
+  private async renderSliceHtml(
+    slice: DiscoveredSlice,
+    req: Request,
+    url: URL,
+    matchedLocale?: string
+  ): Promise<{
+    html: string;
+    dataProps: Record<string, unknown>;
+    meta?: SliceMetadata;
+    hasError?: boolean;
+    error?: string;
+  }> {
+    const session = this.sessionFrom(req);
+    const actionCtx = this.createActionContext(slice.name, session);
+    const params = Object.fromEntries(url.searchParams.entries());
+    const dataProps: Record<string, unknown> = {
+      ...params,
+      ...(matchedLocale ? { locale: matchedLocale } : {})
+    };
+    let loaderError: string | null = null;
+
+    const loaderCtx: SliceLoaderContext = {
+      url: url.toString(),
+      params,
+      db: this.db,
+      session,
+      ctx: actionCtx,
+      services: (this.config.services as Record<string, unknown>) || {},
+      locale: matchedLocale
+    };
+
+    if (slice.loaderFn) {
+      try {
+        const loaded = await slice.loaderFn(loaderCtx);
+        Object.assign(dataProps, loaded);
+      } catch (err) {
+        loaderError = err instanceof Error ? err.message : String(err);
+        console.error(`[SynapseServer] Loader de ${slice.key} falhou: ${loaderError}`);
+      }
+    }
+
+    let meta: SliceMetadata | undefined;
+    if (slice.metaFn && !loaderError) {
+      try {
+        meta = await slice.metaFn(dataProps, loaderCtx);
+      } catch (err) {
+        console.error(`[SynapseServer] sliceMeta de ${slice.key} falhou:`, err);
+      }
+    }
+
+    const renderProps: Record<string, unknown> = {
+      ...dataProps,
+      ...(slice.actionFn
+        ? {
+            onSubmitAction: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx),
+            action: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx)
+          }
+        : {})
+    };
+
+    let contentHtml: string;
+    let hasError = false;
+    let renderError: string | null = loaderError;
+
+    const isProduction = process.env.NODE_ENV === 'production';
+    if (loaderError) {
+      hasError = true;
+      const displayMsg = isProduction ? 'Ocorreu um erro interno ao carregar os dados.' : escapeHtml(loaderError);
+      contentHtml = `<div class="text-rose-400">Falha no loader de ${escapeHtml(slice.key)}: ${displayMsg}</div>`;
+    } else if (slice.componentFn) {
+      try {
+        const sliceEl = React.createElement(slice.componentFn, renderProps);
+        const domainLayout = this.domainLayouts.get(slice.domain);
+        const treeWithDomainLayout = domainLayout
+          ? React.createElement(domainLayout, { session, url: url.toString() }, sliceEl)
+          : sliceEl;
+        const treeWithLayout = this.layoutComponent
+          ? React.createElement(this.layoutComponent, { session, url: url.toString() }, treeWithDomainLayout)
+          : treeWithDomainLayout;
+        const rootEl = React.createElement(SynapseProvider, { props: dataProps, session }, treeWithLayout);
+        contentHtml = renderToString(rootEl);
+      } catch (e: any) {
+        if (!isProduction) console.error('[SSR Render Error]', e);
+        hasError = true;
+        const errMessage = e instanceof Error ? e.message : String(e);
+        renderError = errMessage;
+        const displayMsg = isProduction ? 'Ocorreu um erro interno durante a renderização.' : escapeHtml(errMessage);
+        contentHtml = `<div class="text-rose-400">Erro na renderização SSR: ${displayMsg}</div>`;
+      }
+    } else {
+      contentHtml = '<div class="text-slate-400">Nenhum componente de UI exportado.</div>';
+    }
+
+    const clientUrl = hasError ? null : await this.ensureClientBundle(slice);
+
+    const hasCustomLayout = Boolean(this.layoutComponent || this.domainLayouts.get(slice.domain));
+    const html = this.renderHtmlShell(
+      meta?.title || slice.name,
+      contentHtml,
+      slice.name,
+      serializeClientProps(dataProps),
+      clientUrl,
+      meta,
+      matchedLocale || 'pt-BR',
+      hasCustomLayout
+    );
+
+    return { html, dataProps, meta, hasError, error: renderError || undefined };
+  }
+
   /**
    * Generates the SSR HTML Shell with Inter font, Tailwind and client hydration
    */
@@ -737,6 +925,22 @@ export class SynapseServer {
     }
     const metaSection = metaTags.length > 0 ? `\n${metaTags.join('\n')}` : '';
 
+    const vendorImports: Record<string, string> = {
+      react: '/_synapse/client/_vendor.js',
+      'react/jsx-runtime': '/_synapse/client/_vendor.js',
+      'react/jsx-dev-runtime': '/_synapse/client/_vendor.js',
+      'react-dom': '/_synapse/client/_vendor.js',
+      'react-dom/client': '/_synapse/client/_vendor.js',
+      'synapsejs/client': '/_synapse/client/_vendor.js',
+      '@ismaelsoilet/synapsejs/client': '/_synapse/client/_vendor.js'
+    };
+    if (this.config.compiler?.vendorPackages) {
+      for (const pkg of this.config.compiler.vendorPackages) {
+        vendorImports[pkg] = '/_synapse/client/_vendor.js';
+      }
+    }
+    const importMapScript = `  <script type="importmap">\n  ${JSON.stringify({ imports: vendorImports }, null, 4).split('\n').join('\n  ')}\n  </script>`;
+
     if (hasLayout) {
       return `<!DOCTYPE html>
 <html lang="${escapeHtml(locale)}" class="min-h-full">
@@ -745,19 +949,7 @@ export class SynapseServer {
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>${pageTitle}</title>${metaSection}
 ${this.renderStylesheets()}
-  <script type="importmap">
-  {
-    "imports": {
-      "react": "/_synapse/client/_vendor.js",
-      "react/jsx-runtime": "/_synapse/client/_vendor.js",
-      "react/jsx-dev-runtime": "/_synapse/client/_vendor.js",
-      "react-dom": "/_synapse/client/_vendor.js",
-      "react-dom/client": "/_synapse/client/_vendor.js",
-      "synapsejs/client": "/_synapse/client/_vendor.js",
-      "@ismaelsoilet/synapsejs/client": "/_synapse/client/_vendor.js"
-    }
-  }
-  </script>
+${importMapScript}
   <script type="module" src="/_synapse/client/_vendor.js"></script>
   <style>
     body { font-family: 'Inter', sans-serif; }
@@ -767,7 +959,8 @@ ${this.renderStylesheets()}
 <body class="min-h-full flex flex-col">
   <div id="synapse-root" class="min-h-full flex-1 flex flex-col">${contentHtml}</div>
 
-  <script data-synapse-props>globalThis.__SYNAPSE_PROPS__ = ${propsJson};</script>
+  <script data-synapse-props id="__SYNAPSE_PROPS_DATA__" type="application/json">${propsJson}</script>
+  <script>globalThis.__SYNAPSE_PROPS__ = JSON.parse(document.getElementById('__SYNAPSE_PROPS_DATA__').textContent || '{}');</script>
   ${clientUrl ? `<script data-synapse-client type="module" src="${clientUrl}"></script>` : '<!-- sem componente hidratavel -->'}
 
   <script type="module" src="/_synapse/turbo-router.js"></script>
@@ -782,19 +975,7 @@ ${this.renderStylesheets()}
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>${pageTitle}</title>${metaSection}
 ${this.renderStylesheets()}
-  <script type="importmap">
-  {
-    "imports": {
-      "react": "/_synapse/client/_vendor.js",
-      "react/jsx-runtime": "/_synapse/client/_vendor.js",
-      "react/jsx-dev-runtime": "/_synapse/client/_vendor.js",
-      "react-dom": "/_synapse/client/_vendor.js",
-      "react-dom/client": "/_synapse/client/_vendor.js",
-      "synapsejs/client": "/_synapse/client/_vendor.js",
-      "@ismaelsoilet/synapsejs/client": "/_synapse/client/_vendor.js"
-    }
-  }
-  </script>
+${importMapScript}
   <script type="module" src="/_synapse/client/_vendor.js"></script>
   <style>
     body { font-family: 'Inter', sans-serif; }
@@ -835,7 +1016,8 @@ ${this.renderStylesheets()}
     <div id="synapse-root" class="bg-slate-900/80 border border-slate-800 rounded-xl p-6 shadow-2xl backdrop-blur">${contentHtml}</div>
 
     <!-- Props de hidratacao e a entrada de cliente gerada -->
-    <script data-synapse-props>globalThis.__SYNAPSE_PROPS__ = ${propsJson};</script>
+    <script data-synapse-props id="__SYNAPSE_PROPS_DATA__" type="application/json">${propsJson}</script>
+    <script>globalThis.__SYNAPSE_PROPS__ = JSON.parse(document.getElementById('__SYNAPSE_PROPS_DATA__').textContent || '{}');</script>
     ${clientUrl ? `<script data-synapse-client type="module" src="${clientUrl}"></script>` : '<!-- sem componente hidratavel -->'}
 
     <!-- Turbo Morphing SPA Navigation (<1.5kb, Zero Dependencies) -->
@@ -947,6 +1129,10 @@ ${this.renderStylesheets()}
     this.config = {
       ...loadedConfig,
       ...this.config,
+      compiler: {
+        ...(loadedConfig.compiler || {}),
+        ...(this.config?.compiler || {})
+      },
       plugins: [...(loadedConfig.plugins || []), ...(this.config?.plugins || [])]
     };
 
@@ -966,6 +1152,46 @@ ${this.renderStylesheets()}
 
     this.httpServer = Bun.serve({
       port: this.port,
+      websocket: {
+        open: async (ws: any) => {
+          const socketDef = ws.data?.socketDef;
+          if (socketDef?.onOpen) {
+            try {
+              await socketDef.onOpen(ws);
+            } catch (err) {
+              console.error(`[SynapseServer] Erro no onOpen do WebSocket (${ws.data?.sliceKey}):`, err);
+            }
+          }
+        },
+        message: async (ws: any, message: any) => {
+          const socketDef = ws.data?.socketDef;
+          if (socketDef?.onMessage) {
+            try {
+              let parsed = message;
+              if (typeof message === 'string') {
+                try {
+                  parsed = JSON.parse(message);
+                } catch {
+                  // mantém texto puro
+                }
+              }
+              await socketDef.onMessage(ws, parsed);
+            } catch (err) {
+              console.error(`[SynapseServer] Erro no onMessage do WebSocket (${ws.data?.sliceKey}):`, err);
+            }
+          }
+        },
+        close: async (ws: any, code: number, reason: string) => {
+          const socketDef = ws.data?.socketDef;
+          if (socketDef?.onClose) {
+            try {
+              await socketDef.onClose(ws, code, reason);
+            } catch (err) {
+              console.error(`[SynapseServer] Erro no onClose do WebSocket (${ws.data?.sliceKey}):`, err);
+            }
+          }
+        }
+      },
       fetch: async (req: Request) => {
         if (this.config.plugins) {
           for (const plugin of this.config.plugins) {
@@ -983,6 +1209,79 @@ ${this.renderStylesheets()}
           const pathname = url.pathname;
           const startedAt = performance.now();
 
+          // WebSocket Upgrade for slices: /_synapse/ws/:domain/:name
+          if (pathname.startsWith('/_synapse/ws/')) {
+            const origin = req.headers.get('origin');
+            const allowed = (process.env.SYNAPSE_ALLOWED_ORIGINS ?? '')
+              .split(',')
+              .map((entry) => entry.trim())
+              .filter((entry) => entry.length > 0);
+            if (origin && allowed.length > 0 && !allowed.includes(origin) && !allowed.includes('*')) {
+              return new Response(JSON.stringify({ error: 'Origin não permitida para conexão WebSocket' }), {
+                status: 403,
+                headers: { 'Content-Type': 'application/json' }
+              });
+            }
+
+            const trustProxy = process.env.SYNAPSE_TRUST_PROXY !== 'false' && this.config.trustProxy !== false;
+            let clientIp: string;
+            if (trustProxy) {
+              clientIp =
+                req.headers.get('cf-connecting-ip') ||
+                req.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
+                this.httpServer?.requestIP(req)?.address ||
+                '127.0.0.1';
+            } else {
+              clientIp = this.httpServer?.requestIP(req)?.address || '127.0.0.1';
+            }
+            const rateResult = this.rateLimiter.consume(clientIp);
+            if (!rateResult.allowed) {
+              return new Response(
+                JSON.stringify({
+                  ok: false,
+                  error: 'RATE_LIMIT_EXCEEDED',
+                  message: 'Muitas conexões WebSocket. Tente novamente mais tarde.'
+                }),
+                {
+                  status: 429,
+                  headers: {
+                    'Content-Type': 'application/json; charset=utf-8',
+                    'Retry-After': String(Math.ceil(rateResult.resetMs / 1000))
+                  }
+                }
+              );
+            }
+
+            const target = pathname.slice('/_synapse/ws/'.length);
+            const resolved = this.resolveSlice(target);
+            if (!resolved.ok) {
+              return new Response(JSON.stringify({ error: resolved.message }), {
+                status: resolved.status,
+                headers: { 'Content-Type': 'application/json' }
+              });
+            }
+            const socketDef = resolved.slice.socketDef;
+            if (!socketDef) {
+              return new Response(JSON.stringify({ error: `Fatia ${resolved.slice.key} não declara sliceSocket` }), {
+                status: 404,
+                headers: { 'Content-Type': 'application/json' }
+              });
+            }
+            const session = this.sessionFrom(req);
+            const upgraded = (this.httpServer as any)?.upgrade(req, {
+              data: {
+                id: crypto.randomUUID(),
+                sliceKey: resolved.slice.key,
+                socketDef,
+                session
+              }
+            });
+            if (upgraded) {
+              return undefined as any;
+            }
+            return new Response('Falha no upgrade de WebSocket', { status: 400 });
+          }
+
           // Arquivos estáticos primeiro: `public/` do app, estritamente contido no diretório.
           if (!pathname.startsWith('/_synapse/') && pathname !== '/') {
             const publicDir = path.resolve(this.baseDir, 'public');
@@ -1042,7 +1341,7 @@ ${this.renderStylesheets()}
               {
                 status,
                 framework: 'SynapseJS',
-                version: '1.2.0',
+                version: SYNAPSE_VERSION,
                 uptime: process.uptime(),
                 database: dbHealthy ? 'connected' : 'disconnected',
                 ...(dbError ? { databaseError: dbError } : {}),
@@ -1103,17 +1402,25 @@ ${this.renderStylesheets()}
             });
           }
 
-          // 3. Rate Limiter for Sensitive Endpoints (RPC, Uploads, Webhooks)
+          // 3. Rate Limiter for Sensitive Endpoints (RPC, Uploads, Webhooks, SSE)
           if (
             pathname.startsWith('/_synapse/rpc/') ||
             pathname.startsWith('/_synapse/files/') ||
-            pathname.startsWith('/_synapse/webhooks/')
+            pathname.startsWith('/_synapse/webhooks/') ||
+            pathname.startsWith('/_synapse/sse/')
           ) {
-            const clientKey =
-              req.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
-              req.headers.get('cf-connecting-ip') ||
-              req.headers.get('authorization') ||
-              'global';
+            const trustProxy = process.env.SYNAPSE_TRUST_PROXY !== 'false' && this.config.trustProxy !== false;
+            let clientIp: string;
+            if (trustProxy) {
+              clientIp =
+                req.headers.get('cf-connecting-ip') ||
+                req.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
+                this.httpServer?.requestIP(req)?.address ||
+                '127.0.0.1';
+            } else {
+              clientIp = this.httpServer?.requestIP(req)?.address || '127.0.0.1';
+            }
+            const clientKey = clientIp;
 
             const rateResult = this.rateLimiter.consume(clientKey);
             if (!rateResult.allowed) {
@@ -1182,8 +1489,51 @@ ${this.renderStylesheets()}
               );
             }
 
+            const maxRpcBytes = this.config.maxRpcPayloadBytes ?? 5 * 1024 * 1024; // 5 MB
+            const rpcContentLengthHeader = req.headers.get('content-length');
+            const rpcContentLength = rpcContentLengthHeader ? parseInt(rpcContentLengthHeader, 10) : NaN;
+            if (Number.isFinite(rpcContentLength) && rpcContentLength > maxRpcBytes) {
+              this.logRequest(req, pathname, 413, startedAt, undefined, 'rpc_error');
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload RPC excede o limite máximo permitido de ${maxRpcBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
+            const bodyResult = await readBodyWithinLimit(req.body, maxRpcBytes);
+            if (!bodyResult.ok) {
+              this.logRequest(req, pathname, 413, startedAt, undefined, 'rpc_error');
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload RPC excede o limite máximo permitido de ${maxRpcBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
+            let body: unknown;
+            try {
+              const bodyText = new TextDecoder().decode(bodyResult.value);
+              body = bodyText.trim().length > 0 ? JSON.parse(bodyText) : {};
+            } catch {
+              this.logRequest(req, pathname, 400, startedAt, undefined, 'rpc_error');
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'INVALID_JSON_PAYLOAD',
+                  message: 'Payload da requisição não é um JSON válido.'
+                },
+                { status: 400, headers: cors ?? undefined }
+              );
+            }
+
             try {
-              const body = await req.json();
               const session = this.sessionFrom(req);
               const actionCtx = this.createActionContext(slice.name, session);
 
@@ -1192,7 +1542,16 @@ ${this.renderStylesheets()}
               const metricType = result.ok ? 'rpc_success' : 'rpc_error';
               this.logRequest(req, pathname, status, startedAt, session, metricType);
 
-              return Response.json(result, { status, headers: cors ?? undefined });
+              const headers = new Headers(cors ?? {});
+              headers.set('Content-Type', 'application/json');
+
+              if (actionCtx._pendingCookies && actionCtx._pendingCookies.length > 0) {
+                for (const cookie of actionCtx._pendingCookies) {
+                  headers.append('Set-Cookie', serializeCookie(cookie.name, cookie.value, cookie.options));
+                }
+              }
+
+              return new Response(JSON.stringify(result), { status, headers });
             } catch (err: any) {
               this.logRequest(req, pathname, 500, startedAt, undefined, 'rpc_error');
               return Response.json({ ok: false, error: `Falha interna no RPC: ${err.message}` }, { status: 500 });
@@ -1231,8 +1590,36 @@ ${this.renderStylesheets()}
               );
             }
 
+            const maxWebhookBytes = this.config.maxWebhookPayloadBytes ?? 10 * 1024 * 1024; // 10 MB
+            const webhookContentLengthHeader = req.headers.get('content-length');
+            const webhookContentLength = webhookContentLengthHeader ? parseInt(webhookContentLengthHeader, 10) : NaN;
+            if (Number.isFinite(webhookContentLength) && webhookContentLength > maxWebhookBytes) {
+              this.logRequest(req, pathname, 413, startedAt);
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload Webhook excede o limite máximo permitido de ${maxWebhookBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
+            const bodyResult = await readBodyWithinLimit(req.body, maxWebhookBytes);
+            if (!bodyResult.ok) {
+              this.logRequest(req, pathname, 413, startedAt);
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload Webhook excede o limite máximo permitido de ${maxWebhookBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
             try {
-              const rawBody = new Uint8Array(await req.arrayBuffer());
+              const rawBody = bodyResult.value;
               const bodyText = new TextDecoder().decode(rawBody);
               let json: unknown = null;
               try {
@@ -1295,6 +1682,19 @@ ${this.renderStylesheets()}
             let unsubscribe: (() => void) | null = null;
             let keepAliveTimer: ReturnType<typeof setInterval> | null = null;
 
+            const cleanup = () => {
+              if (keepAliveTimer) {
+                clearInterval(keepAliveTimer);
+                keepAliveTimer = null;
+              }
+              if (unsubscribe) {
+                unsubscribe();
+                unsubscribe = null;
+              }
+            };
+
+            req.signal.addEventListener('abort', cleanup);
+
             const stream = new ReadableStream({
               start(controller) {
                 const encoder = new TextEncoder();
@@ -1304,7 +1704,7 @@ ${this.renderStylesheets()}
                   try {
                     controller.enqueue(encoder.encode(': keep-alive\n\n'));
                   } catch {
-                    if (keepAliveTimer) clearInterval(keepAliveTimer);
+                    cleanup();
                   }
                 }, 15000);
 
@@ -1318,8 +1718,7 @@ ${this.renderStylesheets()}
                 });
               },
               cancel() {
-                if (keepAliveTimer) clearInterval(keepAliveTimer);
-                if (unsubscribe) unsubscribe();
+                cleanup();
               }
             });
 
@@ -1387,17 +1786,45 @@ ${this.renderStylesheets()}
               let mimeType = 'image/jpeg';
 
               if (fileUrl.startsWith('http://') || fileUrl.startsWith('https://')) {
+                const allowedDomains =
+                  this.config.imageOptimizer?.allowedDomains ||
+                  (process.env.SYNAPSE_ALLOWED_IMAGE_DOMAINS
+                    ? process.env.SYNAPSE_ALLOWED_IMAGE_DOMAINS.split(',').map((s) => s.trim())
+                    : undefined);
+
+                const validation = await validateExternalUrl(fileUrl, { allowedDomains });
+                if (!validation.ok) {
+                  return Response.json(
+                    { ok: false, error: validation.error || 'FORBIDDEN_TARGET_URL' },
+                    { status: 403, headers: cors ?? undefined }
+                  );
+                }
+
                 const res = await fetch(fileUrl);
                 if (!res.ok) {
-                  return Response.json({ ok: false, error: 'FETCH_IMAGE_FAILED' }, { status: 502 });
+                  return Response.json(
+                    { ok: false, error: 'FETCH_IMAGE_FAILED' },
+                    { status: 502, headers: cors ?? undefined }
+                  );
                 }
                 buffer = new Uint8Array(await res.arrayBuffer());
                 mimeType = res.headers.get('content-type') || mimeType;
               } else {
+                const publicDir = path.resolve(this.baseDir, 'public');
                 const cleanRel = fileUrl.replace(/^\/+/, '');
-                const candidate = path.resolve(this.baseDir, cleanRel);
+                const candidate = path.resolve(publicDir, cleanRel);
+
+                if (!candidate.startsWith(publicDir + path.sep) && candidate !== publicDir) {
+                  return Response.json(
+                    { ok: false, error: 'FORBIDDEN_FILE_PATH' },
+                    { status: 403, headers: cors ?? undefined }
+                  );
+                }
                 if (!fs.existsSync(candidate) || !fs.statSync(candidate).isFile()) {
-                  return Response.json({ ok: false, error: 'IMAGE_NOT_FOUND' }, { status: 404 });
+                  return Response.json(
+                    { ok: false, error: 'IMAGE_NOT_FOUND' },
+                    { status: 404, headers: cors ?? undefined }
+                  );
                 }
                 buffer = new Uint8Array(await Bun.file(candidate).arrayBuffer());
               }
@@ -1436,7 +1863,7 @@ ${this.renderStylesheets()}
             const bundleFilename = path.basename(pathname);
             const bundleFile = path.join(this.baseDir, '.synapse/client', bundleFilename);
             if (!fs.existsSync(bundleFile) && bundleFilename === VENDOR_BUNDLE_NAME) {
-              await buildVendorBundle(this.baseDir);
+              await buildVendorBundle(this.baseDir, this.config.compiler?.vendorPackages);
             }
             if (!fs.existsSync(bundleFile)) {
               this.logRequest(req, pathname, 404, startedAt);
@@ -1476,94 +1903,100 @@ ${this.renderStylesheets()}
           if (resolvedSlice) {
             const slice = resolvedSlice;
             const session = this.sessionFrom(req);
-            const actionCtx = this.createActionContext(slice.name, session);
-            const params = Object.fromEntries(url.searchParams.entries());
-            const dataProps: Record<string, unknown> = {
-              ...params,
-              ...(matchedLocale ? { locale: matchedLocale } : {})
-            };
-            let loaderError: string | null = null;
-
-            const loaderCtx: SliceLoaderContext = {
-              url: url.toString(),
-              params,
-              db: this.db,
-              session,
-              ctx: actionCtx,
-              services: (this.config.services as Record<string, unknown>) || {},
-              locale: matchedLocale
-            };
+            const cacheConfig = slice.cacheConfig;
+            const scopePrefix = `${session.tenantId || 'global'}:${session.userId !== 'anon' ? session.userId : 'public'}`;
+            const normalizedKey = cacheConfig
+              ? normalizeCacheKey(url, cacheConfig.allowedParams)
+              : `${pathname}${url.search}`;
+            const cacheKey = `${scopePrefix}:${normalizedKey}`;
+            const now = Date.now();
+
+            if (cacheConfig && req.method === 'GET') {
+              const cached = this.ssrCache.get(cacheKey);
+              if (cached) {
+                if (now < cached.expiresAt) {
+                  this.logRequest(req, pathname, 200, startedAt, session, 'ssr');
+                  return new Response(cached.html, {
+                    headers: {
+                      'Content-Type': 'text/html; charset=utf-8',
+                      'X-Synapse-Cache': 'HIT',
+                      'Cache-Control': `public, max-age=${cached.ttlSeconds}, stale-while-revalidate=${cached.swrSeconds}`
+                    }
+                  });
+                }
+                if (now < cached.staleUntil) {
+                  this.logRequest(req, pathname, 200, startedAt, session, 'ssr');
+                  // Revalidação em background (ISR / Stale-While-Revalidate) - Thundering Herd Guard
+                  if (!this.revalidatingKeys.has(cacheKey)) {
+                    this.revalidatingKeys.add(cacheKey);
+                    (async () => {
+                      try {
+                        const fresh = await this.renderSliceHtml(slice, req, url, matchedLocale);
+                        if (!fresh.hasError) {
+                          const ttl = cacheConfig.ttlSeconds;
+                          const swr = cacheConfig.staleWhileRevalidateSeconds ?? 0;
+                          this.ssrCache.set(cacheKey, {
+                            html: fresh.html,
+                            expiresAt: Date.now() + ttl * 1000,
+                            staleUntil: Date.now() + (ttl + swr) * 1000,
+                            ttlSeconds: ttl,
+                            swrSeconds: swr,
+                            tags: cacheConfig.tags || []
+                          });
+                        }
+                      } catch (err) {
+                        console.error(`[SynapseServer] Revalidação ISR em background de ${slice.key} falhou:`, err);
+                      } finally {
+                        this.revalidatingKeys.delete(cacheKey);
+                      }
+                    })();
+                  }
 
-            if (slice.loaderFn) {
-              try {
-                const loaded = await slice.loaderFn(loaderCtx);
-                Object.assign(dataProps, loaded);
-              } catch (err) {
-                loaderError = err instanceof Error ? err.message : String(err);
-                console.error(`[SynapseServer] Loader de ${slice.key} falhou: ${loaderError}`);
+                  return new Response(cached.html, {
+                    headers: {
+                      'Content-Type': 'text/html; charset=utf-8',
+                      'X-Synapse-Cache': 'STALE',
+                      'Cache-Control': `public, max-age=${cached.ttlSeconds}, stale-while-revalidate=${cached.swrSeconds}`
+                    }
+                  });
+                }
               }
             }
 
-            let meta: SliceMetadata | undefined;
-            if (slice.metaFn && !loaderError) {
-              try {
-                meta = await slice.metaFn(dataProps, loaderCtx);
-              } catch (err) {
-                console.error(`[SynapseServer] sliceMeta de ${slice.key} falhou:`, err);
-              }
-            }
+            const { html, hasError } = await this.renderSliceHtml(slice, req, url, matchedLocale);
 
-            const clientUrl = loaderError ? null : await this.ensureClientBundle(slice);
+            if (hasError) {
+              this.logRequest(req, pathname, 500, startedAt, session, 'ssr');
+              return new Response(html, {
+                status: 500,
+                headers: {
+                  'Content-Type': 'text/html; charset=utf-8',
+                  'X-Robots-Tag': 'noindex, nofollow'
+                }
+              });
+            }
 
-            const renderProps: Record<string, unknown> = {
-              ...dataProps,
-              ...(slice.actionFn
-                ? {
-                    onSubmitAction: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx),
-                    action: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx)
-                  }
-                : {})
+            const headers: Record<string, string> = {
+              'Content-Type': 'text/html; charset=utf-8'
             };
 
-            let contentHtml: string;
-            if (loaderError) {
-              contentHtml = `<div class="text-rose-400">Falha no loader de ${escapeHtml(slice.key)}: ${escapeHtml(loaderError)}</div>`;
-            } else if (slice.componentFn) {
-              try {
-                const sliceEl = React.createElement(slice.componentFn, renderProps);
-                const domainLayout = this.domainLayouts.get(slice.domain);
-                const treeWithDomainLayout = domainLayout
-                  ? React.createElement(domainLayout, { session, url: url.toString() }, sliceEl)
-                  : sliceEl;
-                const treeWithLayout = this.layoutComponent
-                  ? React.createElement(this.layoutComponent, { session, url: url.toString() }, treeWithDomainLayout)
-                  : treeWithDomainLayout;
-                const rootEl = React.createElement(SynapseProvider, { props: dataProps, session }, treeWithLayout);
-                contentHtml = renderToString(rootEl);
-              } catch (e: any) {
-                const errMessage = e instanceof Error ? e.message : String(e);
-                contentHtml = `<div class="text-rose-400">Erro na renderização SSR: ${escapeHtml(errMessage)}</div>`;
-              }
-            } else {
-              contentHtml = '<div class="text-slate-400">Nenhum componente de UI exportado.</div>';
+            if (cacheConfig && req.method === 'GET') {
+              const ttl = cacheConfig.ttlSeconds;
+              const swr = cacheConfig.staleWhileRevalidateSeconds ?? 0;
+              this.ssrCache.set(cacheKey, {
+                html,
+                expiresAt: now + ttl * 1000,
+                staleUntil: now + (ttl + swr) * 1000,
+                ttlSeconds: ttl,
+                swrSeconds: swr,
+                tags: cacheConfig.tags || []
+              });
+              headers['X-Synapse-Cache'] = 'MISS';
+              headers['Cache-Control'] = `public, max-age=${ttl}, stale-while-revalidate=${swr}`;
             }
 
             this.logRequest(req, pathname, 200, startedAt, session, 'ssr');
-
-            const hasCustomLayout = Boolean(this.layoutComponent || this.domainLayouts.get(slice.domain));
-            const html = this.renderHtmlShell(
-              meta?.title || slice.name,
-              contentHtml,
-              slice.name,
-              serializeClientProps(dataProps),
-              clientUrl,
-              meta,
-              matchedLocale || 'pt-BR',
-              hasCustomLayout
-            );
-            return new Response(html, {
-              headers: { 'Content-Type': 'text/html; charset=utf-8' }
-            });
+            return new Response(html, { headers });
           }
 
           this.logRequest(req, pathname, 404, startedAt);