@ismaelsoilet/synapsejs 1.4.0 → 1.9.0

package/src/runtime/server.ts

@@ -26,25 +26,34 @@ import { findSliceFiles, resolveSlicesDir } from '../compiler/slice-discovery';
 import {
   type ActionContext,
   AnonymousSession,
+  BoundedLruCache,
   createActionContext,
   createDefaultLogger,
   createSession,
   type DatabaseClient,
   getDatabase,
+  hasAnyRole,
   loadSynapseConfig,
+  normalizeCacheKey,
   optimizeImage,
   resetDatabaseInstance,
   type SessionContext,
-  type SynapseConfig
+  type SliceCacheConfig,
+  type SliceSocketDefinition,
+  type SynapseConfig,
+  serializeCookie
 } from '../core/index';
 import { ROLES_COOKIE, SESSION_COOKIE } from '../core/session-cookie';
-import { verifySessionToken } from '../core/session-token';
+import { isSessionTokenRevoked, isSessionTokenRevokedInDb, verifySessionToken } from '../core/session-token';
+import { declaredTopic, type RealtimeRejectionCode, scopedTopic } from '../core/topics';
+import { SYNAPSE_VERSION } from '../version';
 import { serializeClientProps } from './client-entry';
-import { isAction, isComponent, isJob, isLoader, isMeta, isWebhook } from './discovery-rules';
+import { isAction, isCache, isComponent, isJob, isLoader, isMeta, isSocket, isWebhook } from './discovery-rules';
 import { getEventHub } from './event-hub';
+import { validateExternalUrl } from './network-guard';
 import { QueueEngine } from './queue-engine';
 import { TokenBucketRateLimiter } from './rate-limiter';
-import { saveUpload } from './uploads';
+import { readBodyWithinLimit, saveUpload } from './uploads';
 
 export interface SliceMetadata {
   title?: string;
@@ -71,6 +80,7 @@ export interface DiscoveredSlice {
   routePath: string;
   rpcPath: string;
   webhookPath: string;
+  wsPath: string;
   filePath: string;
   actionFn?: (payload: unknown, dbOrCtx?: any, session?: SessionContext, extraCtx?: ActionContext) => Promise<any>;
   componentFn?: React.ComponentType<any>;
@@ -82,6 +92,10 @@ export interface DiscoveredSlice {
   metaFn?: (props: Record<string, unknown>, context: SliceLoaderContext) => SliceMetadata | Promise<SliceMetadata>;
   /** Optional Webhook handler receiving rawBody and ActionContext */
   webhookFn?: (event: WebhookEvent, ctx: ActionContext) => Promise<any>;
+  /** Optional SSR cache and ISR policy */
+  cacheConfig?: SliceCacheConfig;
+  /** Optional bidirectional WebSocket handler */
+  socketDef?: SliceSocketDefinition;
 }
 
 /**
@@ -121,6 +135,15 @@ const ERROR_STATUS: Array<{ pattern: RegExp; status: number }> = [
   { pattern: /_FAILED$/, status: 500 }
 ];
 
+const RATE_LIMITED_PREFIXES = [
+  '/_synapse/rpc/',
+  '/_synapse/files/',
+  '/_synapse/webhooks/',
+  '/_synapse/sse/',
+  '/_synapse/images/',
+  '/_synapse/api/'
+];
+
 export const TURBO_ROUTER_SCRIPT = `(function() {
   if (window.__synapseNavInstalled) return;
   window.__synapseNavInstalled = true;
@@ -137,9 +160,9 @@ export const TURBO_ROUTER_SCRIPT = `(function() {
         curRoot.innerHTML = newRoot.innerHTML;
         document.title = doc.title;
         var newPropsScript = doc.querySelector('script[data-synapse-props]');
-        if (newPropsScript) {
+        if (newPropsScript && newPropsScript.textContent) {
           try {
-            eval(newPropsScript.textContent);
+            window.__SYNAPSE_PROPS__ = JSON.parse(newPropsScript.textContent);
           } catch (_) {}
         }
         if (push) history.pushState({}, '', href);
@@ -236,6 +259,150 @@ export function formatLogLine(entry: {
   return JSON.stringify({ ts: new Date().toISOString(), ...entry });
 }
 
+/** Backstop ceiling for any request body: 12 MiB, above every per-route limit. */
+export const DEFAULT_MAX_REQUEST_BODY_BYTES = 12 * 1024 * 1024;
+
+/** The runtime mode, from SYNAPSE_ENV or NODE_ENV. */
+function runtimeMode(): string {
+  return (process.env.SYNAPSE_ENV ?? process.env.NODE_ENV ?? '').trim().toLowerCase();
+}
+
+/**
+ * True when the process declares a mode other than the development ones — an exact
+ * `production` spelling, but also `prod`, `staging` or any other value an operator
+ * clearly intends as a real deployment. An unset value is not production-like here:
+ * the request layer still requires the explicit development opt-in below.
+ */
+export function isProductionLikeMode(): boolean {
+  const mode = runtimeMode();
+
+  if (!mode) {
+    return false;
+  }
+
+  return !['development', 'dev', 'test'].includes(mode);
+}
+
+/**
+ * Caller-supplied identity (x-user-id, x-user-roles, the roles cookie) is honoured
+ * only under an explicit development opt-in: `SYNAPSE_DEV_HEADERS=true`, or a
+ * development/test runtime mode. Any other state — unset, staging, production —
+ * resolves to an anonymous session, so a mistyped variable cannot grant identity,
+ * and the explicit flag is the acknowledgement an operator gives by name.
+ */
+export function headerTrustEnabled(): boolean {
+  const explicit = (process.env.SYNAPSE_DEV_HEADERS ?? '').trim().toLowerCase();
+
+  if (explicit === 'true') {
+    return true;
+  }
+
+  if (explicit === 'false') {
+    return false;
+  }
+
+  if (isProductionLikeMode()) {
+    return false;
+  }
+
+  const mode = runtimeMode();
+
+  return mode === 'development' || mode === 'dev' || mode === 'test';
+}
+
+/**
+ * The process-level body ceiling: explicit config first, then
+ * SYNAPSE_MAX_REQUEST_BODY_BYTES, then the default.
+ */
+export function maxRequestBodyBytes(config?: SynapseConfig): number {
+  const configured = config?.maxRequestBodyBytes;
+
+  if (typeof configured === 'number' && Number.isFinite(configured) && configured > 0) {
+    return Math.floor(configured);
+  }
+
+  const raw = Number(process.env.SYNAPSE_MAX_REQUEST_BODY_BYTES);
+
+  return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : DEFAULT_MAX_REQUEST_BODY_BYTES;
+}
+
+export interface ExternalFetchResult {
+  ok: boolean;
+  body?: Uint8Array;
+  contentType?: string;
+  status?: number;
+  code?: string;
+}
+
+/**
+ * Fetches a URL whose host has already passed `validateExternalUrl`, connecting to the
+ * address that was validated rather than resolving the hostname a second time: the URL
+ * is rewritten to the pinned address, the original Host header is preserved and TLS
+ * validation still checks the certificate against the real hostname (serverName).
+ *
+ * The response is read through the same streaming ceiling as every other body reader,
+ * the whole fetch is bounded by a timeout, and redirects are refused rather than
+ * followed (a hop would have to be revalidated, and refusing cannot be defeated).
+ */
+export async function fetchPinnedExternal(
+  rawUrl: string,
+  resolvedIp: string | undefined,
+  options: { maxBytes: number; timeoutMs: number }
+): Promise<ExternalFetchResult> {
+  const parsed = new URL(rawUrl);
+  const hostname = parsed.hostname;
+  const pinnedHost = resolvedIp?.includes(':') ? `[${resolvedIp}]` : resolvedIp;
+  const port = parsed.port ? `:${parsed.port}` : '';
+  const target = pinnedHost ? `${parsed.protocol}//${pinnedHost}${port}${parsed.pathname}${parsed.search}` : rawUrl;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs);
+
+  try {
+    const response = await fetch(target, {
+      headers: { host: parsed.host },
+      redirect: 'manual',
+      signal: controller.signal,
+      ...(parsed.protocol === 'https:' ? { tls: { serverName: hostname } } : {})
+    } as RequestInit);
+
+    if (!response.ok) {
+      return { ok: false, status: 502, code: 'UPSTREAM_RESPONSE_FAILED' };
+    }
+
+    const body = await readBodyWithinLimit(response.body, options.maxBytes);
+
+    if (!body.ok) {
+      return { ok: false, status: 413, code: 'UPSTREAM_RESPONSE_TOO_LARGE' };
+    }
+
+    return {
+      ok: true,
+      body: body.value,
+      contentType: response.headers.get('content-type') || 'application/octet-stream'
+    };
+  } catch (err) {
+    const aborted = err instanceof Error && (err.name === 'AbortError' || err.message.includes('aborted'));
+
+    return aborted
+      ? { ok: false, status: 504, code: 'UPSTREAM_TIMEOUT' }
+      : { ok: false, status: 502, code: 'UPSTREAM_FETCH_FAILED' };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export interface ShutdownSummary {
+  /** Requests that were still being handled when the drain began and finished in time. */
+  drained: number;
+  /** Requests still running when the drain timeout expired; each received 503 DRAINING. */
+  aborted: number;
+  /** Jobs returned to the queue by the shutdown, exactly one attempt counted. */
+  jobsRequeued: number;
+  /** Jobs whose attempt budget was already exhausted; marked failed. */
+  jobsFailed: number;
+}
+
 export class SynapseServer {
   private slices: Map<string, DiscoveredSlice> = new Map();
   private baseDir: string;
@@ -250,6 +417,29 @@ export class SynapseServer {
   private layoutComponent: React.ComponentType<any> | null = null;
   private domainLayouts: Map<string, React.ComponentType<any>> = new Map();
   private rateLimiter: TokenBucketRateLimiter;
+  private ssrCache: BoundedLruCache<{
+    html: string;
+    expiresAt: number;
+    staleUntil: number;
+    ttlSeconds: number;
+    swrSeconds: number;
+    tags: string[];
+  }>;
+  private revalidatingKeys = new Set<string>();
+
+  public invalidateCache(tags?: string[]): void {
+    if (!tags || tags.length === 0) {
+      this.ssrCache.clear();
+      return;
+    }
+    const tagSet = new Set(tags);
+    for (const [key, entry] of this.ssrCache.entries()) {
+      if (entry.tags.some((t) => tagSet.has(t))) {
+        this.ssrCache.delete(key);
+      }
+    }
+  }
+
   private metrics = {
     startTime: Date.now(),
     totalRequests: 0,
@@ -261,35 +451,159 @@ export class SynapseServer {
   };
   public port: number;
 
-  constructor(baseDir: string = process.cwd(), port: number = 3000, db?: DatabaseClient) {
+  constructor(baseDir: string = process.cwd(), port: number = 3000, db?: DatabaseClient, config?: SynapseConfig) {
     this.baseDir = baseDir;
     this.port = port;
     this.db = db || getDatabase();
-    this.rateLimiter = new TokenBucketRateLimiter();
+    if (config) {
+      this.config = { ...config };
+    }
+    this.rateLimiter = new TokenBucketRateLimiter({
+      maxBuckets: config?.rateLimit?.maxBuckets ?? 10_000,
+      capacity: config?.rateLimit?.capacity,
+      refillRate: config?.rateLimit?.refillRate
+    });
+    this.ssrCache = new BoundedLruCache(this.config.cache?.maxEntries || 1000);
     this.queueEngine = new QueueEngine({
       dbPath: path.join(this.baseDir, '.synapse/queue.sqlite'),
       logger: createDefaultLogger('QueueEngine')
     });
+
+    // Pending until shutdown reaches its drain deadline; every request races it.
+    this.drainSignal = new Promise<Response>((resolve) => {
+      this.drainSignalResolve = resolve;
+    });
   }
 
+  /**
+   * Resolves when in-flight requests must stop waiting — the drain deadline. It stays
+   * pending while the server is running, so every handler races it from the moment it
+   * begins and a request that is still running when the deadline fires is answered
+   * with 503 DRAINING instead of being cut off with no response.
+   */
+  private drainSignal: Promise<Response>;
+  private drainSignalResolve: ((response: Response) => void) | null = null;
+  private inFlightCount = 0;
+  private abortedCount = 0;
+  private drainedCount = 0;
+  private shutdownPromise: Promise<ShutdownSummary> | null = null;
+  private openStreams = new Set<ReadableStreamDefaultController<Uint8Array>>();
+
+  /** What a `stop()` call reports and logs: the observable result of the drain. */
+  private lastShutdownSummary: ShutdownSummary | null = null;
+
   /**
    * Gracefully shuts down the HTTP server and closes database connections.
+   *
+   * Waits for the promise Bun's own drain returns, raced against the configured
+   * timeout — the value is honoured instead of being replaced by a shorter fixed
+   * wait — and only then closes the rate limiter, the queue engine and the
+   * database, so a request that queries the database late in the drain still can.
+   * A second call is safe: it resolves with the same summary and closes nothing twice.
    */
-  async stop(): Promise<void> {
-    if (this.httpServer) {
-      this.httpServer.stop(true);
-      this.httpServer = null;
+  async stop(drainTimeoutMs = 5000): Promise<ShutdownSummary> {
+    if (this.shutdownPromise) {
+      return this.shutdownPromise;
     }
+
+    this.shutdownPromise = this.performShutdown(drainTimeoutMs);
+
+    return this.shutdownPromise;
+  }
+
+  private async performShutdown(drainTimeoutMs: number): Promise<ShutdownSummary> {
+    // No new background work is claimed from this point on: a job enqueued by an
+    // in-flight request stays pending for the next process.
+    this.queueEngine.stopClaiming();
+
+    const inFlightAtStart = this.inFlightCount;
+    const stopPromise: Promise<unknown> = this.httpServer ? this.httpServer.stop(false) : Promise.resolve();
+    this.httpServer = null;
+
+    let timedOut = false;
+
+    if (drainTimeoutMs > 0) {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const deadline = new Promise<'timeout'>((resolve) => {
+        timer = setTimeout(() => resolve('timeout'), drainTimeoutMs);
+      });
+
+      // Fires only when the deadline expires: everything still outstanding is then
+      // answered with 503 DRAINING, deliberately, before persistence is closed.
+      deadline.then(() => {
+        this.abortedCount = this.inFlightCount;
+        this.closeOpenStreams();
+
+        this.drainSignalResolve?.(
+          Response.json(
+            { ok: false, error: 'DRAINING', message: 'O servidor está encerrando e não concluiu esta requisição.' },
+            { status: 503 }
+          )
+        );
+      });
+
+      // The wait is always bounded: a connection that never finishes producing its
+      // request must not hold the shutdown open past the configured timeout.
+      const outcome = await Promise.race([stopPromise.then(() => 'drained' as const), deadline]);
+
+      if (timer) {
+        clearTimeout(timer);
+      }
+
+      timedOut = outcome === 'timeout';
+    }
+    // A configured timeout of zero skips the wait entirely.
+
+    if (timedOut) {
+      // What outlived the deadline is terminated deliberately and reported; the
+      // race in the request path has already answered each one with 503 DRAINING.
+      this.closeOpenStreams();
+    }
+
+    this.drainedCount = inFlightAtStart - this.abortedCount;
+
+    const jobs = this.queueEngine.interruptRunningJobs();
+
     this.rateLimiter.close();
     this.queueEngine.close();
     await this.db.close?.();
     resetDatabaseInstance();
+
+    this.lastShutdownSummary = {
+      drained: Math.max(0, this.drainedCount),
+      aborted: this.abortedCount,
+      jobsRequeued: jobs.requeued,
+      jobsFailed: jobs.failed
+    };
+
+    return this.lastShutdownSummary;
+  }
+
+  private closeOpenStreams(): void {
+    for (const controller of this.openStreams) {
+      try {
+        controller.close();
+      } catch {
+        // already closed
+      }
+    }
+
+    this.openStreams.clear();
+  }
+
+  get shutdownSummary(): ShutdownSummary | null {
+    return this.lastShutdownSummary;
   }
 
   get database(): DatabaseClient {
     return this.db;
   }
 
+  /** How many slices were discovered and registered — the benchmark's own sanity check. */
+  get loadedSliceCount(): number {
+    return this.slices.size;
+  }
+
   get queue(): QueueEngine {
     return this.queueEngine;
   }
@@ -306,7 +620,13 @@ export class SynapseServer {
       rpcSuccessCount: this.metrics.rpcSuccessCount,
       rpcErrorCount: this.metrics.rpcErrorCount,
       ssrRenderCount: this.metrics.ssrRenderCount,
-      staticFileCount: this.metrics.staticFileCount
+      staticFileCount: this.metrics.staticFileCount,
+      /** Requests that have begun handling and not yet produced a response. */
+      inFlightRequests: this.inFlightCount,
+      /** Open event streams: reported apart from drainable work. */
+      openStreams: this.openStreams.size,
+      shuttingDown: this.shutdownPromise !== null,
+      shutdown: this.lastShutdownSummary
     };
   }
 
@@ -314,14 +634,17 @@ export class SynapseServer {
     return this.config;
   }
 
-  private createActionContext(sliceName: string, session: SessionContext): ActionContext {
+  private createActionContext(sliceKey: string, session: SessionContext): ActionContext {
     return createActionContext({
       db: this.db,
       session,
       tenantId: session.tenantId,
       services: (this.config.services as Record<string, unknown>) || {},
-      logger: createDefaultLogger(sliceName),
-      enqueue: (jobOrName, payload, options) => this.queueEngine.enqueue(jobOrName, payload, options)
+      logger: createDefaultLogger(sliceKey),
+      // Publishing is owner-checked: only the slice that declared a topic may write to it.
+      sliceOwner: sliceKey,
+      enqueue: (jobOrName, payload, options) => this.queueEngine.enqueue(jobOrName, payload, options),
+      invalidateCache: (tags) => this.invalidateCache(tags)
     });
   }
 
@@ -409,6 +732,8 @@ export class SynapseServer {
         let loaderFn: any = null;
         let webhookFn: any = null;
         let metaFn: any = null;
+        let cacheConfig: any = null;
+        let socketDef: any = null;
 
         for (const [exportName, val] of Object.entries(mod)) {
           if (
@@ -420,16 +745,29 @@ export class SynapseServer {
           ) {
             this.queueEngine.registerJob(val as any);
           }
+          if (isCache(exportName) && val && typeof val === 'object') {
+            cacheConfig = val;
+          }
+          if (isSocket(exportName) && val && typeof val === 'object') {
+            socketDef = val;
+          }
           if (typeof val !== 'function') {
             continue;
           }
-          if (isAction(exportName)) {
+          if (exportName === 'default' && typeof val === 'function') {
+            componentFn = val;
+            componentExport = 'default';
+          } else if (isAction(exportName)) {
             actionFn = val;
           } else if (isLoader(exportName)) {
             loaderFn = val;
           } else if (isComponent(exportName)) {
-            componentFn = val;
-            componentExport = exportName;
+            if (componentExport !== 'default') {
+              if (!componentFn || exportName.endsWith('View')) {
+                componentFn = val;
+                componentExport = exportName;
+              }
+            }
           } else if (isWebhook(exportName)) {
             webhookFn = val;
           } else if (isMeta(exportName)) {
@@ -444,13 +782,16 @@ export class SynapseServer {
           routePath,
           rpcPath,
           webhookPath: `/_synapse/webhooks/${domain}/${name}`,
+          wsPath: `/_synapse/ws/${domain}/${name}`,
           filePath: file,
           actionFn,
           componentFn,
           componentExport,
           loaderFn,
           metaFn,
-          webhookFn
+          webhookFn,
+          cacheConfig,
+          socketDef
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -462,6 +803,13 @@ export class SynapseServer {
     return this.slices.size;
   }
 
+  /**
+   * Registers a slice directly on this server instance (useful for programmatic slices and testing).
+   */
+  public registerSlice(slice: DiscoveredSlice): void {
+    this.slices.set(slice.key, slice);
+  }
+
   /**
    * `<domain>/<name>` resolves directly. A bare name resolves only while it is
    * unique across domains; ambiguity is an explicit conflict, never a guess.
@@ -519,6 +867,57 @@ export class SynapseServer {
     };
   }
 
+  /**
+   * Client identity for rate limiting. Forwarding headers are honoured only when the
+   * deployment explicitly declares a trusted proxy (SYNAPSE_TRUST_PROXY=true or
+   * config.trustProxy), so a direct client rotating X-Forwarded-For cannot mint a
+   * fresh allowance out of thin air.
+   */
+  private clientIdentity(req: Request): string {
+    const peer = this.httpServer?.requestIP(req)?.address || '127.0.0.1';
+    const trustProxy = process.env.SYNAPSE_TRUST_PROXY === 'true' || this.config.trustProxy === true;
+
+    if (!trustProxy) {
+      return peer;
+    }
+
+    return req.headers.get('cf-connecting-ip') || req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || peer;
+  }
+
+  /**
+   * Consumes one token for the request's client identity. Returns a 429 response when
+   * the allowance is exhausted, or null when the request may proceed.
+   */
+  private rateLimitRefusal(req: Request, pathname: string, startedAt: number): Response | null {
+    const rateResult = this.rateLimiter.consume(this.clientIdentity(req));
+
+    if (rateResult.allowed) {
+      return null;
+    }
+
+    const cors = this.corsHeaders(req);
+    this.logRequest(req, pathname, 429, startedAt);
+
+    return new Response(
+      JSON.stringify({
+        ok: false,
+        error: 'RATE_LIMIT_EXCEEDED',
+        message: 'Muitas requisições. Tente novamente mais tarde.'
+      }),
+      {
+        status: 429,
+        headers: {
+          'Content-Type': 'application/json; charset=utf-8',
+          'Retry-After': String(Math.ceil(rateResult.resetMs / 1000)),
+          'X-RateLimit-Limit': String(rateResult.limit),
+          'X-RateLimit-Remaining': String(rateResult.remaining),
+          'X-RateLimit-Reset': String(Math.ceil((Date.now() + rateResult.resetMs) / 1000)),
+          ...(cors ?? {})
+        }
+      }
+    );
+  }
+
   /** Records request metrics and writes one JSON line per request when SYNAPSE_LOG=json. */
   private logRequest(
     request: Request,
@@ -578,17 +977,26 @@ export class SynapseServer {
 
     if (secret) {
       if (!token) {
-        return AnonymousSession(tenantId);
+        return AnonymousSession();
       }
       const verified = verifySessionToken(token, secret);
+
+      // The tenant comes exclusively from the verified claims: with a secret
+      // configured, neither the tenant header nor the subdomain can supply one.
       return verified.ok
         ? createSession({
             userId: verified.value.userId,
-            tenantId: (verified.value as { tenantId?: string }).tenantId || tenantId,
+            tenantId: verified.value.tenantId,
             roles: verified.value.roles,
             token
           })
-        : AnonymousSession(tenantId);
+        : AnonymousSession();
+    }
+
+    // Sem segredo, a identidade forjável por header só é aceita sob opt-in explícito
+    // de desenvolvimento; qualquer outro estado resolve para anônimo.
+    if (!headerTrustEnabled()) {
+      return AnonymousSession(tenantId);
     }
 
     // Modo de desenvolvimento (sem segredo configurado):
@@ -614,6 +1022,60 @@ export class SynapseServer {
     return AnonymousSession(tenantId);
   }
 
+  /** Signature -> memoised revocation verdict, bounded by TTL and entry cap. */
+  private revocationMemo = new Map<string, { revoked: boolean; checkedAt: number }>();
+
+  /**
+   * The session for a request, with revocation consulted on every request. A
+   * signature is queried against the persisted store at most once per TTL window,
+   * so the common case costs nothing; the in-process set short-circuits it entirely.
+   */
+  async requestSession(request: Request): Promise<SessionContext> {
+    const session = this.sessionFrom(request);
+
+    if (!session.isAuthenticated || !session.token) {
+      return session;
+    }
+
+    return (await this.isTokenRevoked(session.token)) ? AnonymousSession() : session;
+  }
+
+  private async isTokenRevoked(token: string): Promise<boolean> {
+    if (isSessionTokenRevoked(token)) {
+      return true;
+    }
+
+    const signature = token.split('.')[1];
+
+    if (!signature) {
+      return true;
+    }
+
+    const ttlMs = Number(process.env.SYNAPSE_REVOCATION_MEMO_TTL_MS ?? '');
+    const ttl = Number.isFinite(ttlMs) && ttlMs >= 0 ? ttlMs : 30_000;
+    const cached = this.revocationMemo.get(signature);
+
+    if (cached && Date.now() - cached.checkedAt < ttl) {
+      return cached.revoked;
+    }
+
+    const revoked = await isSessionTokenRevokedInDb(this.db, token);
+
+    while (this.revocationMemo.size >= 5000) {
+      const oldest = this.revocationMemo.keys().next().value;
+
+      if (oldest === undefined) {
+        break;
+      }
+
+      this.revocationMemo.delete(oldest);
+    }
+
+    this.revocationMemo.set(signature, { revoked, checkedAt: Date.now() });
+
+    return revoked;
+  }
+
   /**
    * Builds the browser bundle for a slice from the splitter's client artifact.
    *
@@ -656,7 +1118,8 @@ export class SynapseServer {
         filePath: slice.filePath,
         rpcPath: slice.rpcPath
       },
-      this.baseDir
+      this.baseDir,
+      { vendorPackages: this.config.compiler?.vendorPackages }
     );
 
     if (!built.ok) {
@@ -671,28 +1134,352 @@ export class SynapseServer {
   }
 
   /**
-   * Returns stylesheet links, respecting SYNAPSE_DISABLE_CDN and detecting public/synapse.css
+   * The third-party origins, opt-in only. Enabling them without an integrity hash
+   * emits nothing: an unpinned third-party script (or stylesheet) in an origin that
+   * holds a script-readable session cookie is the risk this switch exists to gate.
+   */
+  private thirdPartyOrigins(): { enabled: boolean; script?: string; fontStyles?: string; fontFiles?: string } {
+    const enabled =
+      this.config.cdn?.enabled === true ||
+      process.env.SYNAPSE_ENABLE_CDN === 'true' ||
+      process.env.SYNAPSE_ENABLE_CDN === '1';
+
+    if (!enabled) {
+      return { enabled: false };
+    }
+
+    return {
+      enabled: true,
+      script: this.config.cdn?.scriptIntegrity || process.env.SYNAPSE_CDN_INTEGRITY || undefined,
+      fontStyles: this.config.cdn?.fontIntegrity || process.env.SYNAPSE_FONTS_INTEGRITY || undefined,
+      fontFiles: 'https://fonts.gstatic.com'
+    };
+  }
+
+  /**
+   * The Content-Security-Policy every HTML response carries. An operator-supplied
+   * policy replaces it (never weakened); otherwise the policy is same-origin, with
+   * third-party origins appearing only when explicitly enabled and pinned.
+   */
+  private contentSecurityPolicy(): string {
+    const operatorPolicy = this.config.contentSecurityPolicy || process.env.SYNAPSE_CSP;
+
+    if (operatorPolicy) {
+      return operatorPolicy;
+    }
+
+    const thirdParty = this.thirdPartyOrigins();
+    const scriptSources = ["'self'", "'unsafe-inline'"];
+    const styleSources = ["'self'", "'unsafe-inline'"];
+    const fontSources = ["'self'", 'data:'];
+
+    if (thirdParty.script) {
+      scriptSources.push('https://cdn.tailwindcss.com');
+    }
+
+    if (thirdParty.fontStyles) {
+      styleSources.push('https://fonts.googleapis.com');
+      fontSources.push('https://fonts.gstatic.com');
+    }
+
+    return [
+      "default-src 'self'",
+      `script-src ${scriptSources.join(' ')}`,
+      `style-src ${styleSources.join(' ')}`,
+      "img-src 'self' data: https:",
+      `font-src ${fontSources.join(' ')}`,
+      "connect-src 'self'",
+      "object-src 'none'",
+      "frame-ancestors 'none'",
+      "base-uri 'self'",
+      "form-action 'self'"
+    ].join('; ');
+  }
+
+  /** The baseline headers every response carries — routed, unrouted, static or error. */
+  private baselineHeaders(req: Request): Record<string, string> {
+    const headers: Record<string, string> = {
+      'X-Content-Type-Options': 'nosniff',
+      'Referrer-Policy': 'strict-origin-when-cross-origin',
+      'X-Frame-Options': 'DENY',
+      'Content-Security-Policy': this.contentSecurityPolicy()
+    };
+
+    const forwardedProto = req.headers.get('x-forwarded-proto');
+    const trustProxy = process.env.SYNAPSE_TRUST_PROXY === 'true' || this.config.trustProxy === true;
+    const isTls =
+      new URL(req.url).protocol === 'https:' || (trustProxy && forwardedProto?.split(',')[0]?.trim() === 'https');
+
+    if (isTls) {
+      headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains';
+    }
+
+    return headers;
+  }
+
+  /** Adds the baseline headers to a response without overriding what it already sets. */
+  private withBaselineHeaders(response: Response, req: Request): Response {
+    for (const [name, value] of Object.entries(this.baselineHeaders(req))) {
+      if (!response.headers.has(name)) {
+        response.headers.set(name, value);
+      }
+    }
+
+    // The response is returned as it came, so a `Bun.file` body keeps its
+    // zero-copy send instead of being re-wrapped as a stream.
+    return response;
+  }
+
+  /**
+   * A realtime refusal: the same machine-readable shape on both transports, with the
+   * code always drawn from the set the machine contract enumerates.
+   */
+  private realtimeRefusal(
+    code: RealtimeRejectionCode,
+    status: number,
+    message: string,
+    cors?: Record<string, string> | null
+  ): Response {
+    return Response.json({ ok: false, error: code, message }, { status, headers: cors ?? undefined });
+  }
+
+  /** Concurrent realtime connections held per client identity. */
+  private realtimeConnections = new Map<string, number>();
+
+  private releaseRealtimeConnection(clientKey: string): void {
+    const open = this.realtimeConnections.get(clientKey) ?? 0;
+
+    if (open <= 1) {
+      this.realtimeConnections.delete(clientKey);
+    } else {
+      this.realtimeConnections.set(clientKey, open - 1);
+    }
+  }
+
+  private realtimeBounds(): { maxTopics: number; maxSubscriptions: number; maxConnectionsPerClient: number } {
+    return {
+      maxTopics: this.config.realtime?.maxTopics ?? 1000,
+      maxSubscriptions: this.config.realtime?.maxSubscriptions ?? 1000,
+      maxConnectionsPerClient: this.config.realtime?.maxConnectionsPerClient ?? 8
+    };
+  }
+
+  /**
+   * The origin check for a WebSocket upgrade, fail-closed: an allow-list must be
+   * configured and must contain the request's origin (or the wildcard). An absent
+   * origin and the opaque `null` origin are refused. The one carve-out is a loopback
+   * origin, so local development works without a production-grade allow-list.
+   */
+  private webSocketOriginAllowed(req: Request): boolean {
+    const origin = req.headers.get('origin');
+
+    if (!origin || origin === 'null') {
+      return false;
+    }
+
+    if (this.isLoopbackOrigin(origin)) {
+      return true;
+    }
+
+    const allowed = (process.env.SYNAPSE_ALLOWED_ORIGINS ?? '')
+      .split(',')
+      .map((entry) => entry.trim())
+      .filter((entry) => entry.length > 0);
+
+    return allowed.includes('*') || allowed.includes(origin);
+  }
+
+  private isLoopbackOrigin(origin: string): boolean {
+    try {
+      const parsed = new URL(origin);
+
+      return (
+        parsed.hostname === 'localhost' ||
+        parsed.hostname === '127.0.0.1' ||
+        parsed.hostname === '::1' ||
+        parsed.hostname === '[::1]'
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * The response for an unexpected internal failure: a stable code plus a
+   * correlation identifier that also appears on the log record. Outside development
+   * the exception text is never part of the body — it goes to the log only.
+   */
+  private internalFailure(err: unknown, pathname: string, cors?: Record<string, string> | null): Response {
+    const correlationId = crypto.randomUUID();
+    const message = err instanceof Error ? err.message : String(err);
+
+    console.error(`[SynapseServer] Falha interna [${correlationId}] em ${pathname}: ${message}`);
+
+    return Response.json(
+      {
+        ok: false,
+        error: 'INTERNAL_ERROR',
+        correlationId,
+        ...(isProductionLikeMode() ? {} : { message })
+      },
+      { status: 500, headers: cors ?? undefined }
+    );
+  }
+
+  /**
+   * Returns stylesheet links. The application's own stylesheet always wins; nothing
+   * third-party is referenced unless explicitly enabled and integrity-pinned.
    */
   private renderStylesheets(): string {
-    const disableCdn = process.env.SYNAPSE_DISABLE_CDN === 'true' || process.env.SYNAPSE_DISABLE_CDN === '1';
     const localCssPath = path.join(this.baseDir, 'public', 'synapse.css');
-    const hasLocalCss = fs.existsSync(localCssPath);
+
+    if (fs.existsSync(localCssPath)) {
+      return '  <link rel="stylesheet" href="/synapse.css">';
+    }
+
+    const thirdParty = this.thirdPartyOrigins();
+
+    if (!thirdParty.enabled) {
+      return '';
+    }
 
     const elements: string[] = [];
-    if (!disableCdn) {
-      elements.push('  <script src="https://cdn.tailwindcss.com"></script>');
+
+    if (thirdParty.script) {
+      elements.push(
+        `  <script src="https://cdn.tailwindcss.com" integrity="${thirdParty.script}" crossorigin="anonymous"></script>`
+      );
+    } else {
+      console.warn(
+        '[SynapseServer] CDN habilitado sem um hash de integridade (SYNAPSE_CDN_INTEGRITY): o script de terceiros não será emitido.'
+      );
+    }
+
+    if (thirdParty.fontStyles) {
       elements.push('  <link rel="preconnect" href="https://fonts.googleapis.com">');
       elements.push('  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>');
       elements.push(
-        '  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">'
+        `  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" integrity="${thirdParty.fontStyles}" crossorigin="anonymous">`
       );
     }
-    if (hasLocalCss) {
-      elements.push('  <link rel="stylesheet" href="/synapse.css">');
-    }
+
     return elements.join('\n');
   }
 
+  /**
+   * Renders the slice SSR component tree and packages the complete HTML shell
+   */
+  private async renderSliceHtml(
+    slice: DiscoveredSlice,
+    req: Request,
+    url: URL,
+    matchedLocale?: string
+  ): Promise<{
+    html: string;
+    dataProps: Record<string, unknown>;
+    meta?: SliceMetadata;
+    hasError?: boolean;
+    error?: string;
+  }> {
+    const session = await this.requestSession(req);
+    const actionCtx = this.createActionContext(slice.key, session);
+    const params = Object.fromEntries(url.searchParams.entries());
+    const dataProps: Record<string, unknown> = {
+      ...params,
+      ...(matchedLocale ? { locale: matchedLocale } : {})
+    };
+    let loaderError: string | null = null;
+
+    const loaderCtx: SliceLoaderContext = {
+      url: url.toString(),
+      params,
+      db: this.db,
+      session,
+      ctx: actionCtx,
+      services: (this.config.services as Record<string, unknown>) || {},
+      locale: matchedLocale
+    };
+
+    if (slice.loaderFn) {
+      try {
+        const loaded = await slice.loaderFn(loaderCtx);
+        Object.assign(dataProps, loaded);
+      } catch (err) {
+        loaderError = err instanceof Error ? err.message : String(err);
+        console.error(`[SynapseServer] Loader de ${slice.key} falhou: ${loaderError}`);
+      }
+    }
+
+    let meta: SliceMetadata | undefined;
+    if (slice.metaFn && !loaderError) {
+      try {
+        meta = await slice.metaFn(dataProps, loaderCtx);
+      } catch (err) {
+        console.error(`[SynapseServer] sliceMeta de ${slice.key} falhou:`, err);
+      }
+    }
+
+    const renderProps: Record<string, unknown> = {
+      ...dataProps,
+      ...(slice.actionFn
+        ? {
+            onSubmitAction: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx),
+            action: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx)
+          }
+        : {})
+    };
+
+    let contentHtml: string;
+    let hasError = false;
+    let renderError: string | null = loaderError;
+
+    const isProduction = isProductionLikeMode();
+    if (loaderError) {
+      hasError = true;
+      console.error(`[SynapseServer] Loader de ${slice.key} falhou: ${loaderError}`);
+      const displayMsg = isProduction ? 'Ocorreu um erro interno ao carregar os dados.' : escapeHtml(loaderError);
+      contentHtml = `<div class="text-rose-400">Falha no loader de ${escapeHtml(slice.key)}: ${displayMsg}</div>`;
+    } else if (slice.componentFn) {
+      try {
+        const sliceEl = React.createElement(slice.componentFn, renderProps);
+        const domainLayout = this.domainLayouts.get(slice.domain);
+        const treeWithDomainLayout = domainLayout
+          ? React.createElement(domainLayout, { session, url: url.toString() }, sliceEl)
+          : sliceEl;
+        const treeWithLayout = this.layoutComponent
+          ? React.createElement(this.layoutComponent, { session, url: url.toString() }, treeWithDomainLayout)
+          : treeWithDomainLayout;
+        const rootEl = React.createElement(SynapseProvider, { props: dataProps, session }, treeWithLayout);
+        contentHtml = renderToString(rootEl);
+      } catch (e: any) {
+        hasError = true;
+        const errMessage = e instanceof Error ? e.message : String(e);
+        console.error(`[SynapseServer] Erro na renderização SSR de ${slice.key}: ${errMessage}`);
+        renderError = errMessage;
+        const displayMsg = isProduction ? 'Ocorreu um erro interno durante a renderização.' : escapeHtml(errMessage);
+        contentHtml = `<div class="text-rose-400">Erro na renderização SSR: ${displayMsg}</div>`;
+      }
+    } else {
+      contentHtml = '<div class="text-slate-400">Nenhum componente de UI exportado.</div>';
+    }
+
+    const clientUrl = hasError ? null : await this.ensureClientBundle(slice);
+
+    const hasCustomLayout = Boolean(this.layoutComponent || this.domainLayouts.get(slice.domain));
+    const html = this.renderHtmlShell(
+      meta?.title || slice.name,
+      contentHtml,
+      slice.name,
+      serializeClientProps(dataProps),
+      clientUrl,
+      meta,
+      matchedLocale || 'pt-BR',
+      hasCustomLayout
+    );
+
+    return { html, dataProps, meta, hasError, error: renderError || undefined };
+  }
+
   /**
    * Generates the SSR HTML Shell with Inter font, Tailwind and client hydration
    */
@@ -737,6 +1524,22 @@ export class SynapseServer {
     }
     const metaSection = metaTags.length > 0 ? `\n${metaTags.join('\n')}` : '';
 
+    const vendorImports: Record<string, string> = {
+      react: '/_synapse/client/_vendor.js',
+      'react/jsx-runtime': '/_synapse/client/_vendor.js',
+      'react/jsx-dev-runtime': '/_synapse/client/_vendor.js',
+      'react-dom': '/_synapse/client/_vendor.js',
+      'react-dom/client': '/_synapse/client/_vendor.js',
+      'synapsejs/client': '/_synapse/client/_vendor.js',
+      '@ismaelsoilet/synapsejs/client': '/_synapse/client/_vendor.js'
+    };
+    if (this.config.compiler?.vendorPackages) {
+      for (const pkg of this.config.compiler.vendorPackages) {
+        vendorImports[pkg] = '/_synapse/client/_vendor.js';
+      }
+    }
+    const importMapScript = `  <script type="importmap">\n  ${JSON.stringify({ imports: vendorImports }, null, 4).split('\n').join('\n  ')}\n  </script>`;
+
     if (hasLayout) {
       return `<!DOCTYPE html>
 <html lang="${escapeHtml(locale)}" class="min-h-full">
@@ -745,19 +1548,7 @@ export class SynapseServer {
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>${pageTitle}</title>${metaSection}
 ${this.renderStylesheets()}
-  <script type="importmap">
-  {
-    "imports": {
-      "react": "/_synapse/client/_vendor.js",
-      "react/jsx-runtime": "/_synapse/client/_vendor.js",
-      "react/jsx-dev-runtime": "/_synapse/client/_vendor.js",
-      "react-dom": "/_synapse/client/_vendor.js",
-      "react-dom/client": "/_synapse/client/_vendor.js",
-      "synapsejs/client": "/_synapse/client/_vendor.js",
-      "@ismaelsoilet/synapsejs/client": "/_synapse/client/_vendor.js"
-    }
-  }
-  </script>
+${importMapScript}
   <script type="module" src="/_synapse/client/_vendor.js"></script>
   <style>
     body { font-family: 'Inter', sans-serif; }
@@ -767,7 +1558,8 @@ ${this.renderStylesheets()}
 <body class="min-h-full flex flex-col">
   <div id="synapse-root" class="min-h-full flex-1 flex flex-col">${contentHtml}</div>
 
-  <script data-synapse-props>globalThis.__SYNAPSE_PROPS__ = ${propsJson};</script>
+  <script data-synapse-props id="__SYNAPSE_PROPS_DATA__" type="application/json">${propsJson}</script>
+  <script>globalThis.__SYNAPSE_PROPS__ = JSON.parse(document.getElementById('__SYNAPSE_PROPS_DATA__').textContent || '{}');</script>
   ${clientUrl ? `<script data-synapse-client type="module" src="${clientUrl}"></script>` : '<!-- sem componente hidratavel -->'}
 
   <script type="module" src="/_synapse/turbo-router.js"></script>
@@ -782,19 +1574,7 @@ ${this.renderStylesheets()}
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>${pageTitle}</title>${metaSection}
 ${this.renderStylesheets()}
-  <script type="importmap">
-  {
-    "imports": {
-      "react": "/_synapse/client/_vendor.js",
-      "react/jsx-runtime": "/_synapse/client/_vendor.js",
-      "react/jsx-dev-runtime": "/_synapse/client/_vendor.js",
-      "react-dom": "/_synapse/client/_vendor.js",
-      "react-dom/client": "/_synapse/client/_vendor.js",
-      "synapsejs/client": "/_synapse/client/_vendor.js",
-      "@ismaelsoilet/synapsejs/client": "/_synapse/client/_vendor.js"
-    }
-  }
-  </script>
+${importMapScript}
   <script type="module" src="/_synapse/client/_vendor.js"></script>
   <style>
     body { font-family: 'Inter', sans-serif; }
@@ -835,7 +1615,8 @@ ${this.renderStylesheets()}
     <div id="synapse-root" class="bg-slate-900/80 border border-slate-800 rounded-xl p-6 shadow-2xl backdrop-blur">${contentHtml}</div>
 
     <!-- Props de hidratacao e a entrada de cliente gerada -->
-    <script data-synapse-props>globalThis.__SYNAPSE_PROPS__ = ${propsJson};</script>
+    <script data-synapse-props id="__SYNAPSE_PROPS_DATA__" type="application/json">${propsJson}</script>
+    <script>globalThis.__SYNAPSE_PROPS__ = JSON.parse(document.getElementById('__SYNAPSE_PROPS_DATA__').textContent || '{}');</script>
     ${clientUrl ? `<script data-synapse-client type="module" src="${clientUrl}"></script>` : '<!-- sem componente hidratavel -->'}
 
     <!-- Turbo Morphing SPA Navigation (<1.5kb, Zero Dependencies) -->
@@ -947,6 +1728,10 @@ ${this.renderStylesheets()}
     this.config = {
       ...loadedConfig,
       ...this.config,
+      compiler: {
+        ...(loadedConfig.compiler || {}),
+        ...(this.config?.compiler || {})
+      },
       plugins: [...(loadedConfig.plugins || []), ...(this.config?.plugins || [])]
     };
 
@@ -964,14 +1749,80 @@ ${this.renderStylesheets()}
       }
     }
 
+    /**
+     * Process-level ceiling on any request body. It is the backstop behind the
+     * per-route limits (RPC 5 MiB, webhook 10 MiB, upload 5 MiB): every body-reading
+     * path is bounded even before its own guard runs, so no single request can
+     * exhaust process memory.
+     */
+    const processBodyCeiling = maxRequestBodyBytes(this.config);
+
     this.httpServer = Bun.serve({
       port: this.port,
+      maxRequestBodySize: processBodyCeiling,
+      websocket: {
+        open: async (ws: any) => {
+          const socketDef = ws.data?.socketDef;
+          if (socketDef?.onOpen) {
+            try {
+              await socketDef.onOpen(ws);
+            } catch (err) {
+              console.error(`[SynapseServer] Erro no onOpen do WebSocket (${ws.data?.sliceKey}):`, err);
+            }
+          }
+        },
+        message: async (ws: any, message: any) => {
+          const socketDef = ws.data?.socketDef;
+          if (socketDef?.onMessage) {
+            try {
+              let parsed = message;
+              if (typeof message === 'string') {
+                try {
+                  parsed = JSON.parse(message);
+                } catch {
+                  // mantém texto puro
+                }
+              }
+              await socketDef.onMessage(ws, parsed);
+            } catch (err) {
+              console.error(`[SynapseServer] Erro no onMessage do WebSocket (${ws.data?.sliceKey}):`, err);
+            }
+          }
+        },
+        close: async (ws: any, code: number, reason: string) => {
+          if (ws.data?.clientKey) {
+            this.releaseRealtimeConnection(ws.data.clientKey);
+          }
+
+          const socketDef = ws.data?.socketDef;
+          if (socketDef?.onClose) {
+            try {
+              await socketDef.onClose(ws, code, reason);
+            } catch (err) {
+              console.error(`[SynapseServer] Erro no onClose do WebSocket (${ws.data?.sliceKey}):`, err);
+            }
+          }
+        }
+      },
       fetch: async (req: Request) => {
+        // Every request that has begun handling and has not produced a response is
+        // outstanding work the drain waits for. An unbounded event stream is not:
+        // it is tracked separately and closed when shutdown begins.
+        this.inFlightCount++;
+        let released = false;
+        const releaseInFlight = () => {
+          if (!released) {
+            released = true;
+            this.inFlightCount--;
+          }
+        };
+
         if (this.config.plugins) {
           for (const plugin of this.config.plugins) {
             if (plugin.onRequest) {
               const intercepted = await plugin.onRequest(req);
               if (intercepted instanceof Response) {
+                releaseInFlight();
                 return intercepted;
               }
             }
@@ -983,6 +1834,76 @@ ${this.renderStylesheets()}
           const pathname = url.pathname;
           const startedAt = performance.now();
 
+          // WebSocket Upgrade for slices: /_synapse/ws/:domain/:name
+          if (pathname.startsWith('/_synapse/ws/')) {
+            // Fail-closed: no allow-list means no upgrade, with a loopback carve-out
+            // for local development. An absent or opaque origin is refused too.
+            if (!this.webSocketOriginAllowed(req)) {
+              this.logRequest(req, pathname, 403, startedAt);
+              return this.realtimeRefusal(
+                'ORIGIN_NOT_ALLOWED',
+                403,
+                'Origem não permitida para conexão WebSocket.',
+                this.corsHeaders(req)
+              );
+            }
+
+            const rateRefusal = this.rateLimitRefusal(req, pathname, startedAt);
+
+            if (rateRefusal) {
+              return rateRefusal;
+            }
+
+            const wsBounds = this.realtimeBounds();
+            const wsClientKey = this.clientIdentity(req);
+            const wsOpen = this.realtimeConnections.get(wsClientKey) ?? 0;
+
+            if (wsOpen >= wsBounds.maxConnectionsPerClient) {
+              this.logRequest(req, pathname, 429, startedAt);
+              return this.realtimeRefusal(
+                'REALTIME_LIMIT_EXCEEDED',
+                429,
+                'Limite de conexões simultâneas por cliente atingido.'
+              );
+            }
+
+            this.realtimeConnections.set(wsClientKey, wsOpen + 1);
+
+            const target = pathname.slice('/_synapse/ws/'.length);
+            const resolved = this.resolveSlice(target);
+            if (!resolved.ok) {
+              this.releaseRealtimeConnection(wsClientKey);
+              return new Response(JSON.stringify({ error: resolved.message }), {
+                status: resolved.status,
+                headers: { 'Content-Type': 'application/json' }
+              });
+            }
+            const socketDef = resolved.slice.socketDef;
+            if (!socketDef) {
+              this.releaseRealtimeConnection(wsClientKey);
+              return new Response(JSON.stringify({ error: `Fatia ${resolved.slice.key} não declara sliceSocket` }), {
+                status: 404,
+                headers: { 'Content-Type': 'application/json' }
+              });
+            }
+            const session = await this.requestSession(req);
+            const upgraded = (this.httpServer as any)?.upgrade(req, {
+              data: {
+                id: crypto.randomUUID(),
+                sliceKey: resolved.slice.key,
+                socketDef,
+                session,
+                clientKey: wsClientKey
+              }
+            });
+            if (upgraded) {
+              return undefined as any;
+            }
+
+            this.releaseRealtimeConnection(wsClientKey);
+            return new Response('Falha no upgrade de WebSocket', { status: 400 });
+          }
+
           // Arquivos estáticos primeiro: `public/` do app, estritamente contido no diretório.
           if (!pathname.startsWith('/_synapse/') && pathname !== '/') {
             const publicDir = path.resolve(this.baseDir, 'public');
@@ -1009,6 +1930,18 @@ ${this.renderStylesheets()}
             });
           }
 
+          // 1.5 Rate Limiter for every accepting surface (machine endpoints, RPC,
+          // uploads, webhooks, SSE, images). Server-rendered page loads are covered
+          // separately, right before the render begins. Static files, the dashboard
+          // and the generated client bundles are not part of this budget.
+          if (RATE_LIMITED_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {
+            const refusal = this.rateLimitRefusal(req, pathname, startedAt);
+
+            if (refusal) {
+              return refusal;
+            }
+          }
+
           // 2. Machine Endpoints for AI
           if (pathname === '/_synapse/api/repo-map') {
             const repoMapPath = path.join(this.baseDir, '.codebase/repo-map.d.ts');
@@ -1036,28 +1969,34 @@ ${this.renderStylesheets()}
             const healthy = dbHealthy && !this.discoveryError;
             const status = healthy ? 'OK' : 'DEGRADED';
             const httpStatus = healthy ? 200 : 503;
+            const session = await this.requestSession(req);
+
+            // This endpoint requires no authentication, so it discloses only the
+            // aggregate verdict: no absolute path, no discovery candidate, no load-error
+            // text and no route inventory. The detailed inventory is authenticated.
+            const payload: Record<string, unknown> = {
+              status,
+              framework: 'SynapseJS',
+              version: SYNAPSE_VERSION,
+              uptime: process.uptime(),
+              database: dbHealthy ? 'connected' : 'disconnected',
+              slicesLoaded: this.slices.size
+            };
 
-            this.logRequest(req, pathname, httpStatus, startedAt);
-            return Response.json(
-              {
-                status,
-                framework: 'SynapseJS',
-                version: '1.2.0',
-                uptime: process.uptime(),
-                database: dbHealthy ? 'connected' : 'disconnected',
-                ...(dbError ? { databaseError: dbError } : {}),
-                slicesLoaded: this.slices.size,
-                slicesResolutionError: this.discoveryError,
-                loadErrors: this.loadErrors,
-                slices: Array.from(this.slices.values()).map((s) => ({
-                  domain: s.domain,
-                  name: s.name,
-                  route: s.routePath,
-                  rpc: s.rpcPath
-                }))
-              },
-              { status: httpStatus }
-            );
+            if (session.isAuthenticated) {
+              payload.databaseError = dbError;
+              payload.slicesResolutionError = this.discoveryError;
+              payload.loadErrors = this.loadErrors;
+              payload.slices = Array.from(this.slices.values()).map((s) => ({
+                domain: s.domain,
+                name: s.name,
+                route: s.routePath,
+                rpc: s.rpcPath
+              }));
+            }
+
+            this.logRequest(req, pathname, httpStatus, startedAt, session);
+            return Response.json(payload, { status: httpStatus });
           }
 
           if (pathname === '/_synapse/api/metrics') {
@@ -1068,26 +2007,27 @@ ${this.renderStylesheets()}
             this.logRequest(req, pathname, 200, startedAt);
 
             if (formatParam === 'prometheus' || acceptHeader.includes('text/plain')) {
-              const promText =
-                [
-                  '# HELP synapse_uptime_seconds SynapseJS server uptime in seconds',
-                  '# TYPE synapse_uptime_seconds gauge',
-                  `synapse_uptime_seconds ${uptimeSeconds}`,
-                  '# HELP synapse_requests_total Total number of HTTP requests received',
-                  '# TYPE synapse_requests_total counter',
-                  `synapse_requests_total ${this.metrics.totalRequests}`,
-                  '# HELP synapse_rpc_success_total Total successful RPC action calls',
-                  '# TYPE synapse_rpc_success_total counter',
-                  `synapse_rpc_success_total ${this.metrics.rpcSuccessCount}`,
-                  '# HELP synapse_rpc_error_total Total failed RPC action calls',
-                  '# TYPE synapse_rpc_error_total counter',
-                  `synapse_rpc_error_total ${this.metrics.rpcErrorCount}`,
-                  '# HELP synapse_ssr_renders_total Total server-side rendered pages',
-                  '# TYPE synapse_ssr_renders_total counter',
-                  `synapse_ssr_renders_total ${this.metrics.ssrRenderCount}`
-                ].join('\n') + '\n';
-
-              return new Response(promText, {
+              const promText = [
+                '# HELP synapse_uptime_seconds SynapseJS server uptime in seconds',
+                '# TYPE synapse_uptime_seconds gauge',
+                `synapse_uptime_seconds ${uptimeSeconds}`,
+                '# HELP synapse_requests_total Total number of HTTP requests received',
+                '# TYPE synapse_requests_total counter',
+                `synapse_requests_total ${this.metrics.totalRequests}`,
+                '# HELP synapse_rpc_success_total Total successful RPC action calls',
+                '# TYPE synapse_rpc_success_total counter',
+                `synapse_rpc_success_total ${this.metrics.rpcSuccessCount}`,
+                '# HELP synapse_rpc_error_total Total failed RPC action calls',
+                '# TYPE synapse_rpc_error_total counter',
+                `synapse_rpc_error_total ${this.metrics.rpcErrorCount}`,
+                '# HELP synapse_ssr_renders_total Total server-side rendered pages',
+                '# TYPE synapse_ssr_renders_total counter',
+                `synapse_ssr_renders_total ${this.metrics.ssrRenderCount}`
+              ].join('\n');
+
+              const promTextWithNewline = `${promText}\n`;
+
+              return new Response(promTextWithNewline, {
                 headers: { 'Content-Type': 'text/plain; version=0.0.4; charset=utf-8' }
               });
             }
@@ -1103,43 +2043,6 @@ ${this.renderStylesheets()}
             });
           }
 
-          // 3. Rate Limiter for Sensitive Endpoints (RPC, Uploads, Webhooks)
-          if (
-            pathname.startsWith('/_synapse/rpc/') ||
-            pathname.startsWith('/_synapse/files/') ||
-            pathname.startsWith('/_synapse/webhooks/')
-          ) {
-            const clientKey =
-              req.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
-              req.headers.get('cf-connecting-ip') ||
-              req.headers.get('authorization') ||
-              'global';
-
-            const rateResult = this.rateLimiter.consume(clientKey);
-            if (!rateResult.allowed) {
-              const cors = this.corsHeaders(req);
-              this.logRequest(req, pathname, 429, startedAt);
-              return new Response(
-                JSON.stringify({
-                  ok: false,
-                  error: 'RATE_LIMIT_EXCEEDED',
-                  message: 'Muitas requisições. Tente novamente mais tarde.'
-                }),
-                {
-                  status: 429,
-                  headers: {
-                    'Content-Type': 'application/json; charset=utf-8',
-                    'Retry-After': String(Math.ceil(rateResult.resetMs / 1000)),
-                    'X-RateLimit-Limit': String(rateResult.limit),
-                    'X-RateLimit-Remaining': String(rateResult.remaining),
-                    'X-RateLimit-Reset': String(Math.ceil((Date.now() + rateResult.resetMs) / 1000)),
-                    ...(cors ?? {})
-                  }
-                }
-              );
-            }
-          }
-
           // 3. RPC Actions Dispatcher (POST /_synapse/rpc/:sliceName)
           if (pathname.startsWith('/_synapse/rpc/')) {
             const cors = this.corsHeaders(req);
@@ -1182,20 +2085,72 @@ ${this.renderStylesheets()}
               );
             }
 
+            const maxRpcBytes = this.config.maxRpcPayloadBytes ?? 5 * 1024 * 1024; // 5 MB
+            const rpcContentLengthHeader = req.headers.get('content-length');
+            const rpcContentLength = rpcContentLengthHeader ? parseInt(rpcContentLengthHeader, 10) : NaN;
+            if (Number.isFinite(rpcContentLength) && rpcContentLength > maxRpcBytes) {
+              this.logRequest(req, pathname, 413, startedAt, undefined, 'rpc_error');
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload RPC excede o limite máximo permitido de ${maxRpcBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
+            const bodyResult = await readBodyWithinLimit(req.body, maxRpcBytes);
+            if (!bodyResult.ok) {
+              this.logRequest(req, pathname, 413, startedAt, undefined, 'rpc_error');
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload RPC excede o limite máximo permitido de ${maxRpcBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
+            let body: unknown;
+            try {
+              const bodyText = new TextDecoder().decode(bodyResult.value);
+              body = bodyText.trim().length > 0 ? JSON.parse(bodyText) : {};
+            } catch {
+              this.logRequest(req, pathname, 400, startedAt, undefined, 'rpc_error');
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'INVALID_JSON_PAYLOAD',
+                  message: 'Payload da requisição não é um JSON válido.'
+                },
+                { status: 400, headers: cors ?? undefined }
+              );
+            }
+
             try {
-              const body = await req.json();
-              const session = this.sessionFrom(req);
-              const actionCtx = this.createActionContext(slice.name, session);
+              const session = await this.requestSession(req);
+              const actionCtx = this.createActionContext(slice.key, session);
 
               const result = await slice.actionFn(body, actionCtx, session, actionCtx);
               const status = result.ok ? 200 : httpStatusForError(result.error);
               const metricType = result.ok ? 'rpc_success' : 'rpc_error';
               this.logRequest(req, pathname, status, startedAt, session, metricType);
 
-              return Response.json(result, { status, headers: cors ?? undefined });
-            } catch (err: any) {
+              const headers = new Headers(cors ?? {});
+              headers.set('Content-Type', 'application/json');
+
+              if (actionCtx._pendingCookies && actionCtx._pendingCookies.length > 0) {
+                for (const cookie of actionCtx._pendingCookies) {
+                  headers.append('Set-Cookie', serializeCookie(cookie.name, cookie.value, cookie.options));
+                }
+              }
+
+              return new Response(JSON.stringify(result), { status, headers });
+            } catch (err: unknown) {
               this.logRequest(req, pathname, 500, startedAt, undefined, 'rpc_error');
-              return Response.json({ ok: false, error: `Falha interna no RPC: ${err.message}` }, { status: 500 });
+              return this.internalFailure(err, pathname, cors);
             }
           }
 
@@ -1231,8 +2186,36 @@ ${this.renderStylesheets()}
               );
             }
 
+            const maxWebhookBytes = this.config.maxWebhookPayloadBytes ?? 10 * 1024 * 1024; // 10 MB
+            const webhookContentLengthHeader = req.headers.get('content-length');
+            const webhookContentLength = webhookContentLengthHeader ? parseInt(webhookContentLengthHeader, 10) : NaN;
+            if (Number.isFinite(webhookContentLength) && webhookContentLength > maxWebhookBytes) {
+              this.logRequest(req, pathname, 413, startedAt);
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload Webhook excede o limite máximo permitido de ${maxWebhookBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
+            const bodyResult = await readBodyWithinLimit(req.body, maxWebhookBytes);
+            if (!bodyResult.ok) {
+              this.logRequest(req, pathname, 413, startedAt);
+              return Response.json(
+                {
+                  ok: false,
+                  error: 'PAYLOAD_TOO_LARGE',
+                  message: `Payload Webhook excede o limite máximo permitido de ${maxWebhookBytes} bytes.`
+                },
+                { status: 413, headers: cors ?? undefined }
+              );
+            }
+
             try {
-              const rawBody = new Uint8Array(await req.arrayBuffer());
+              const rawBody = bodyResult.value;
               const bodyText = new TextDecoder().decode(rawBody);
               let json: unknown = null;
               try {
@@ -1241,8 +2224,8 @@ ${this.renderStylesheets()}
                 json = null;
               }
 
-              const session = this.sessionFrom(req);
-              const actionCtx = this.createActionContext(slice.name, session);
+              const session = await this.requestSession(req);
+              const actionCtx = this.createActionContext(slice.key, session);
 
               const result = await slice.webhookFn(
                 {
@@ -1262,12 +2245,8 @@ ${this.renderStylesheets()}
               }
               return Response.json(result, { status, headers: cors ?? undefined });
             } catch (err: unknown) {
-              const message = err instanceof Error ? err.message : String(err);
               this.logRequest(req, pathname, 500, startedAt);
-              return Response.json(
-                { ok: false, error: `Falha no processamento de webhook: ${message}` },
-                { status: 500 }
-              );
+              return this.internalFailure(err, pathname, cors);
             }
           }
 
@@ -1287,16 +2266,96 @@ ${this.renderStylesheets()}
             const topic = decodeURIComponent(rawTopic);
 
             if (!topic) {
-              return Response.json({ ok: false, error: 'Tópico de subscrição inválido.' }, { status: 400 });
+              return this.realtimeRefusal('TOPIC_NOT_FOUND', 404, 'Tópico de subscrição inválido.', cors);
+            }
+
+            const session = await this.requestSession(req);
+
+            // Access is declared, not inferred: a name is not a permission.
+            const declaration = declaredTopic(topic, session.tenantId);
+
+            if (!session.isAuthenticated && !declaration?.public) {
+              return this.realtimeRefusal('UNAUTHENTICATED', 401, 'Subscrição requer uma sessão autenticada.', cors);
+            }
+
+            if (!declaration) {
+              return this.realtimeRefusal('TOPIC_NOT_FOUND', 404, 'Tópico não declarado.', cors);
             }
 
+            if (declaration.readRoles?.length && !hasAnyRole(session, declaration.readRoles)) {
+              return this.realtimeRefusal('TOPIC_FORBIDDEN', 403, 'Sessão sem papel para este tópico.', cors);
+            }
+
+            const bounds = this.realtimeBounds();
+
+            if (this.openStreams.size >= bounds.maxSubscriptions) {
+              return this.realtimeRefusal(
+                'REALTIME_LIMIT_EXCEEDED',
+                429,
+                'Limite de subscrições simultâneas atingido.',
+                cors
+              );
+            }
+
+            const effectiveTopic = scopedTopic(topic, session.tenantId);
             const eventHub = getEventHub();
-            const session = this.sessionFrom(req);
+            const isNewTopic = eventHub.listenerCount(effectiveTopic) === 0;
+
+            if (isNewTopic && eventHub.activeTopics().length >= bounds.maxTopics) {
+              return this.realtimeRefusal(
+                'REALTIME_LIMIT_EXCEEDED',
+                429,
+                'Limite de tópicos registrados atingido.',
+                cors
+              );
+            }
+
+            const clientKey = this.clientIdentity(req);
+            const openForClient = this.realtimeConnections.get(clientKey) ?? 0;
+
+            if (openForClient >= bounds.maxConnectionsPerClient) {
+              return this.realtimeRefusal(
+                'REALTIME_LIMIT_EXCEEDED',
+                429,
+                'Limite de conexões simultâneas por cliente atingido.',
+                cors
+              );
+            }
+
+            this.realtimeConnections.set(clientKey, openForClient + 1);
+
             let unsubscribe: (() => void) | null = null;
             let keepAliveTimer: ReturnType<typeof setInterval> | null = null;
 
-            const stream = new ReadableStream({
+            const cleanup = () => {
+              if (keepAliveTimer) {
+                clearInterval(keepAliveTimer);
+                keepAliveTimer = null;
+              }
+              if (unsubscribe) {
+                unsubscribe();
+                unsubscribe = null;
+              }
+              const open = this.realtimeConnections.get(clientKey) ?? 0;
+              if (open <= 1) {
+                this.realtimeConnections.delete(clientKey);
+              } else {
+                this.realtimeConnections.set(clientKey, open - 1);
+              }
+            };
+
+            req.signal.addEventListener('abort', cleanup);
+
+            let streamController: ReadableStreamDefaultController<Uint8Array> | null = null;
+            const server = this;
+            const stream = new ReadableStream<Uint8Array>({
               start(controller) {
+                streamController = controller;
+                // An open stream is not drainable work: it never completes on its own.
+                // It is tracked separately and closed deliberately when shutdown begins.
+                server.openStreams.add(controller);
+                releaseInFlight();
+
                 const encoder = new TextEncoder();
                 controller.enqueue(encoder.encode(': connected\n\n'));
 
@@ -1304,22 +2363,24 @@ ${this.renderStylesheets()}
                   try {
                     controller.enqueue(encoder.encode(': keep-alive\n\n'));
                   } catch {
-                    if (keepAliveTimer) clearInterval(keepAliveTimer);
+                    cleanup();
                   }
                 }, 15000);
 
-                unsubscribe = eventHub.subscribe(topic, (data) => {
+                unsubscribe = eventHub.subscribe(effectiveTopic, (data) => {
                   try {
                     const eventData = JSON.stringify(data);
                     controller.enqueue(encoder.encode(`event: message\ndata: ${eventData}\n\n`));
                   } catch (err) {
-                    console.error(`[SSE] Erro ao serializar evento para tópico "${topic}":`, err);
+                    console.error(`[SSE] Erro ao serializar evento para tópico "${effectiveTopic}":`, err);
                   }
                 });
               },
               cancel() {
-                if (keepAliveTimer) clearInterval(keepAliveTimer);
-                if (unsubscribe) unsubscribe();
+                if (streamController) {
+                  server.openStreams.delete(streamController);
+                }
+                cleanup();
               }
             });
 
@@ -1357,7 +2418,7 @@ ${this.renderStylesheets()}
             const outcome = await saveUpload(req, {
               baseDir: this.baseDir,
               domain: resolvedUpload.slice.domain,
-              session: this.sessionFrom(req)
+              session: await this.requestSession(req)
             });
 
             this.logRequest(req, pathname, outcome.status, startedAt);
@@ -1372,6 +2433,11 @@ ${this.renderStylesheets()}
               return new Response(null, { status: cors ? 204 : 404, headers: cors ?? undefined });
             }
 
+            const session = await this.requestSession(req);
+            if (!session.isAuthenticated) {
+              return Response.json({ ok: false, error: 'UNAUTHORIZED' }, { status: 401, headers: cors ?? undefined });
+            }
+
             const fileUrl = url.searchParams.get('url');
             const widthParam = url.searchParams.get('w');
             const heightParam = url.searchParams.get('h');
@@ -1387,17 +2453,50 @@ ${this.renderStylesheets()}
               let mimeType = 'image/jpeg';
 
               if (fileUrl.startsWith('http://') || fileUrl.startsWith('https://')) {
-                const res = await fetch(fileUrl);
-                if (!res.ok) {
-                  return Response.json({ ok: false, error: 'FETCH_IMAGE_FAILED' }, { status: 502 });
+                const allowedDomains =
+                  this.config.imageOptimizer?.allowedDomains ||
+                  (process.env.SYNAPSE_ALLOWED_IMAGE_DOMAINS
+                    ? process.env.SYNAPSE_ALLOWED_IMAGE_DOMAINS.split(',').map((s) => s.trim())
+                    : undefined);
+
+                const validation = await validateExternalUrl(fileUrl, { allowedDomains });
+                if (!validation.ok) {
+                  return Response.json(
+                    { ok: false, error: validation.error || 'FORBIDDEN_TARGET_URL' },
+                    { status: 403, headers: cors ?? undefined }
+                  );
+                }
+
+                const fetched = await fetchPinnedExternal(fileUrl, validation.resolvedIp, {
+                  maxBytes: this.config.imageOptimizer?.maxResponseBytes ?? 10 * 1024 * 1024,
+                  timeoutMs: this.config.imageOptimizer?.timeoutMs ?? 10_000
+                });
+
+                if (!fetched.ok || !fetched.body) {
+                  return Response.json(
+                    { ok: false, error: fetched.code || 'FETCH_IMAGE_FAILED' },
+                    { status: fetched.status ?? 502, headers: cors ?? undefined }
+                  );
                 }
-                buffer = new Uint8Array(await res.arrayBuffer());
-                mimeType = res.headers.get('content-type') || mimeType;
+
+                buffer = fetched.body;
+                mimeType = fetched.contentType || mimeType;
               } else {
+                const publicDir = path.resolve(this.baseDir, 'public');
                 const cleanRel = fileUrl.replace(/^\/+/, '');
-                const candidate = path.resolve(this.baseDir, cleanRel);
+                const candidate = path.resolve(publicDir, cleanRel);
+
+                if (!candidate.startsWith(publicDir + path.sep) && candidate !== publicDir) {
+                  return Response.json(
+                    { ok: false, error: 'FORBIDDEN_FILE_PATH' },
+                    { status: 403, headers: cors ?? undefined }
+                  );
+                }
                 if (!fs.existsSync(candidate) || !fs.statSync(candidate).isFile()) {
-                  return Response.json({ ok: false, error: 'IMAGE_NOT_FOUND' }, { status: 404 });
+                  return Response.json(
+                    { ok: false, error: 'IMAGE_NOT_FOUND' },
+                    { status: 404, headers: cors ?? undefined }
+                  );
                 }
                 buffer = new Uint8Array(await Bun.file(candidate).arrayBuffer());
               }
@@ -1419,8 +2518,7 @@ ${this.renderStylesheets()}
                 }
               });
             } catch (err: unknown) {
-              const msg = err instanceof Error ? err.message : String(err);
-              return Response.json({ ok: false, error: msg }, { status: 500 });
+              return this.internalFailure(err, pathname, cors);
             }
           }
 
@@ -1436,7 +2534,7 @@ ${this.renderStylesheets()}
             const bundleFilename = path.basename(pathname);
             const bundleFile = path.join(this.baseDir, '.synapse/client', bundleFilename);
             if (!fs.existsSync(bundleFile) && bundleFilename === VENDOR_BUNDLE_NAME) {
-              await buildVendorBundle(this.baseDir);
+              await buildVendorBundle(this.baseDir, this.config.compiler?.vendorPackages);
             }
             if (!fs.existsSync(bundleFile)) {
               this.logRequest(req, pathname, 404, startedAt);
@@ -1475,102 +2573,130 @@ ${this.renderStylesheets()}
 
           if (resolvedSlice) {
             const slice = resolvedSlice;
-            const session = this.sessionFrom(req);
-            const actionCtx = this.createActionContext(slice.name, session);
-            const params = Object.fromEntries(url.searchParams.entries());
-            const dataProps: Record<string, unknown> = {
-              ...params,
-              ...(matchedLocale ? { locale: matchedLocale } : {})
-            };
-            let loaderError: string | null = null;
-
-            const loaderCtx: SliceLoaderContext = {
-              url: url.toString(),
-              params,
-              db: this.db,
-              session,
-              ctx: actionCtx,
-              services: (this.config.services as Record<string, unknown>) || {},
-              locale: matchedLocale
-            };
 
-            if (slice.loaderFn) {
-              try {
-                const loaded = await slice.loaderFn(loaderCtx);
-                Object.assign(dataProps, loaded);
-              } catch (err) {
-                loaderError = err instanceof Error ? err.message : String(err);
-                console.error(`[SynapseServer] Loader de ${slice.key} falhou: ${loaderError}`);
-              }
+            // A rendered page load is an accepting surface too, and it is the most
+            // expensive one: refuse before any loader or action runs.
+            const pageRefusal = this.rateLimitRefusal(req, pathname, startedAt);
+
+            if (pageRefusal) {
+              return pageRefusal;
             }
 
-            let meta: SliceMetadata | undefined;
-            if (slice.metaFn && !loaderError) {
-              try {
-                meta = await slice.metaFn(dataProps, loaderCtx);
-              } catch (err) {
-                console.error(`[SynapseServer] sliceMeta de ${slice.key} falhou:`, err);
+            const session = await this.requestSession(req);
+            const cacheConfig = slice.cacheConfig;
+            const scopePrefix = `${session.tenantId || 'global'}:${session.userId !== 'anon' ? session.userId : 'public'}`;
+            const normalizedKey = cacheConfig
+              ? normalizeCacheKey(url, cacheConfig.allowedParams)
+              : `${pathname}${url.search}`;
+            const cacheKey = `${scopePrefix}:${normalizedKey}`;
+            const now = Date.now();
+
+            if (cacheConfig && req.method === 'GET') {
+              const cached = this.ssrCache.get(cacheKey);
+              if (cached) {
+                if (now < cached.expiresAt) {
+                  this.logRequest(req, pathname, 200, startedAt, session, 'ssr');
+                  return new Response(cached.html, {
+                    headers: {
+                      'Content-Type': 'text/html; charset=utf-8',
+                      'X-Synapse-Cache': 'HIT',
+                      'Cache-Control': `public, max-age=${cached.ttlSeconds}, stale-while-revalidate=${cached.swrSeconds}`
+                    }
+                  });
+                }
+                if (now < cached.staleUntil) {
+                  this.logRequest(req, pathname, 200, startedAt, session, 'ssr');
+                  // Revalidação em background (ISR / Stale-While-Revalidate) - Thundering Herd Guard
+                  if (!this.revalidatingKeys.has(cacheKey)) {
+                    this.revalidatingKeys.add(cacheKey);
+                    (async () => {
+                      try {
+                        const fresh = await this.renderSliceHtml(slice, req, url, matchedLocale);
+                        if (!fresh.hasError) {
+                          const ttl = cacheConfig.ttlSeconds;
+                          const swr = cacheConfig.staleWhileRevalidateSeconds ?? 0;
+                          this.ssrCache.set(cacheKey, {
+                            html: fresh.html,
+                            expiresAt: Date.now() + ttl * 1000,
+                            staleUntil: Date.now() + (ttl + swr) * 1000,
+                            ttlSeconds: ttl,
+                            swrSeconds: swr,
+                            tags: cacheConfig.tags || []
+                          });
+                        }
+                      } catch (err) {
+                        console.error(`[SynapseServer] Revalidação ISR em background de ${slice.key} falhou:`, err);
+                      } finally {
+                        this.revalidatingKeys.delete(cacheKey);
+                      }
+                    })();
+                  }
+
+                  return new Response(cached.html, {
+                    headers: {
+                      'Content-Type': 'text/html; charset=utf-8',
+                      'X-Synapse-Cache': 'STALE',
+                      'Cache-Control': `public, max-age=${cached.ttlSeconds}, stale-while-revalidate=${cached.swrSeconds}`
+                    }
+                  });
+                }
               }
             }
 
-            const clientUrl = loaderError ? null : await this.ensureClientBundle(slice);
+            const { html, hasError } = await this.renderSliceHtml(slice, req, url, matchedLocale);
 
-            const renderProps: Record<string, unknown> = {
-              ...dataProps,
-              ...(slice.actionFn
-                ? {
-                    onSubmitAction: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx),
-                    action: (payload: unknown) => slice.actionFn?.(payload, actionCtx, session, actionCtx)
-                  }
-                : {})
+            if (hasError) {
+              this.logRequest(req, pathname, 500, startedAt, session, 'ssr');
+              return new Response(html, {
+                status: 500,
+                headers: {
+                  'Content-Type': 'text/html; charset=utf-8',
+                  'X-Robots-Tag': 'noindex, nofollow'
+                }
+              });
+            }
+
+            const headers: Record<string, string> = {
+              'Content-Type': 'text/html; charset=utf-8'
             };
 
-            let contentHtml: string;
-            if (loaderError) {
-              contentHtml = `<div class="text-rose-400">Falha no loader de ${escapeHtml(slice.key)}: ${escapeHtml(loaderError)}</div>`;
-            } else if (slice.componentFn) {
-              try {
-                const sliceEl = React.createElement(slice.componentFn, renderProps);
-                const domainLayout = this.domainLayouts.get(slice.domain);
-                const treeWithDomainLayout = domainLayout
-                  ? React.createElement(domainLayout, { session, url: url.toString() }, sliceEl)
-                  : sliceEl;
-                const treeWithLayout = this.layoutComponent
-                  ? React.createElement(this.layoutComponent, { session, url: url.toString() }, treeWithDomainLayout)
-                  : treeWithDomainLayout;
-                const rootEl = React.createElement(SynapseProvider, { props: dataProps, session }, treeWithLayout);
-                contentHtml = renderToString(rootEl);
-              } catch (e: any) {
-                const errMessage = e instanceof Error ? e.message : String(e);
-                contentHtml = `<div class="text-rose-400">Erro na renderização SSR: ${escapeHtml(errMessage)}</div>`;
-              }
-            } else {
-              contentHtml = '<div class="text-slate-400">Nenhum componente de UI exportado.</div>';
+            if (cacheConfig && req.method === 'GET') {
+              const ttl = cacheConfig.ttlSeconds;
+              const swr = cacheConfig.staleWhileRevalidateSeconds ?? 0;
+              this.ssrCache.set(cacheKey, {
+                html,
+                expiresAt: now + ttl * 1000,
+                staleUntil: now + (ttl + swr) * 1000,
+                ttlSeconds: ttl,
+                swrSeconds: swr,
+                tags: cacheConfig.tags || []
+              });
+              headers['X-Synapse-Cache'] = 'MISS';
+              headers['Cache-Control'] = `public, max-age=${ttl}, stale-while-revalidate=${swr}`;
             }
 
             this.logRequest(req, pathname, 200, startedAt, session, 'ssr');
-
-            const hasCustomLayout = Boolean(this.layoutComponent || this.domainLayouts.get(slice.domain));
-            const html = this.renderHtmlShell(
-              meta?.title || slice.name,
-              contentHtml,
-              slice.name,
-              serializeClientProps(dataProps),
-              clientUrl,
-              meta,
-              matchedLocale || 'pt-BR',
-              hasCustomLayout
-            );
-            return new Response(html, {
-              headers: { 'Content-Type': 'text/html; charset=utf-8' }
-            });
+            return new Response(html, { headers });
           }
 
           this.logRequest(req, pathname, 404, startedAt);
           return new Response('404 Not Found in SynapseJS Router', { status: 404 });
         };
 
-        let response = await handleRequest();
+        let response: Response | undefined;
+
+        try {
+          response = await Promise.race([handleRequest(), this.drainSignal]);
+        } finally {
+          releaseInFlight();
+        }
+
+        // A successful WebSocket upgrade returned nothing: the connection is no
+        // longer an HTTP response, so neither plugins nor headers apply to it.
+        if (!(response instanceof Response)) {
+          return response as unknown as Response;
+        }
+
         if (this.config.plugins) {
           for (const plugin of this.config.plugins) {
             if (plugin.onResponse) {
@@ -1578,7 +2704,10 @@ ${this.renderStylesheets()}
             }
           }
         }
-        return response;
+
+        // The baseline security headers are applied here, so every response — routed,
+        // unrouted, static or an error page — carries the same set.
+        return this.withBaselineHeaders(response, req);
       }
     });