@ismaelsoilet/synapsejs 1.8.0 → 1.9.0

package/src/compiler/slice-splitter.ts

@@ -42,7 +42,12 @@ export interface SplitResult {
   artifacts: SplitArtifact[];
 }
 
-export type SplitErrorCode = 'SLICE_NOT_FOUND' | 'SLICE_IMPORTS_SLICE' | 'NO_ROOTS' | 'UNPARSED';
+export type SplitErrorCode =
+  | 'SLICE_NOT_FOUND'
+  | 'SLICE_IMPORTS_SLICE'
+  | 'NO_ROOTS'
+  | 'UNPARSED'
+  | 'SERVER_VALUE_IN_CLIENT';
 
 export interface SplitError {
   code: SplitErrorCode;
@@ -67,10 +72,14 @@ export interface SplitVerification {
 const CLIENT_ROOTS = [...COMPONENT_SUFFIXES];
 const TEST_ONLY_NAMES: readonly string[] = [...TEST_ONLY_EXPORTS];
 
-const SERVER_ONLY_PATTERNS: Array<{ label: string; pattern: RegExp }> = [
+/** The expressions that must never survive into a client bundle. Exported so the
+ * linear-time guarantee can be asserted directly against each of them. */
+export const SERVER_ONLY_PATTERNS: Array<{ label: string; pattern: RegExp }> = [
   // `SELECT ... FROM` e não `SELECT` seguido de qualquer palavra: sem o FROM, a
   // tag HTML `<select id="x">` de um formulário casava como vazamento de SQL.
-  { label: 'SELECT statement', pattern: /\bSELECT\s+[\w*"`][\w*"`.,\s]*\bFROM\b/i },
+  // O quantificador é limitado (uma janela fixa, não `*`): um bundle grande com
+  // muitos `SELECT` sem `FROM` fazia o motor retroceder sobre o texto inteiro.
+  { label: 'SELECT statement', pattern: /\bSELECT\s[\w*"`.,\s]{0,4096}?\bFROM\b/i },
   { label: 'INSERT statement', pattern: /\bINSERT\s+INTO\b/i },
   { label: 'UPDATE statement', pattern: /\bUPDATE\s+\w+\s+SET\b/i },
   { label: 'DELETE statement', pattern: /\bDELETE\s+FROM\b/i },
@@ -507,6 +516,20 @@ function unwrapPromiseType(typeText: string): string {
   return match ? match[1].trim() : `Awaited<${typeText}>`;
 }
 
+/**
+ * A wire stub describes a server *function*. A server-owned value that a component
+ * references has no wire form, so the caller must fail with a diagnostic instead of
+ * emitting a stub that would call the endpoint as if it were an action.
+ */
+function isStubCandidate(entry: DeclEntry): boolean {
+  return (
+    ts.isFunctionDeclaration(entry.node) ||
+    ts.isFunctionExpression(entry.node) ||
+    ts.isArrowFunction(entry.node) ||
+    ts.isMethodDeclaration(entry.node)
+  );
+}
+
 function renderRpcStub(entry: DeclEntry, endpoint: string, sourceFile: ts.SourceFile): string {
   const fn = entry.node as ts.FunctionDeclaration;
   const payload = fn.parameters[0];
@@ -712,6 +735,27 @@ export function splitSlice(sliceFilePath: string, baseDir: string = process.cwd(
   const sliceName = path.basename(sliceFilePath, '.slice.tsx');
   const relativePath = path.relative(baseDir, sliceFilePath);
   const endpoint = `/_synapse/rpc/${sliceName}`;
+
+  const serverValueInClient = stubbedKeys.find((key) => {
+    const entry = entries.get(key);
+
+    return entry ? !isStubCandidate(entry) : false;
+  });
+
+  if (serverValueInClient) {
+    const entry = entries.get(serverValueInClient) as DeclEntry;
+
+    return Err({
+      code: 'SERVER_VALUE_IN_CLIENT',
+      message:
+        `O componente de ${path.basename(sliceFilePath)} referencia '${serverValueInClient}', ` +
+        `que é um valor do servidor (${ts.SyntaxKind[entry.node.kind]}) e não uma action: não existe ` +
+        `forma de transportá-lo pelo endpoint RPC. Mova o valor para um módulo em src/shared/, ` +
+        `importe-o de 'synapsejs/client', ou limite-se a declará-lo no servidor.`,
+      candidates: [serverValueInClient]
+    });
+  }
+
   const artifacts: SplitArtifact[] = [];
   const outDir = artifactDirectory(baseDir, sliceName);
   const sourceDir = path.dirname(sliceFilePath);

package/src/core/action-context.ts

@@ -10,6 +10,7 @@ import { getEventHub } from '../runtime/event-hub';
 import type { DatabaseClient, QueryOptions, WhereCondition } from './database-client';
 import type { SessionContext } from './session-context';
 import { getStorage, type StorageClient } from './storage';
+import { declaredTopic, scopedTopic } from './topics';
 
 export interface StructuredLogger {
   info(message: string, context?: Record<string, unknown>): void;
@@ -32,8 +33,20 @@ export type EnqueueFn = <TPayload>(
 export type BroadcastFn = (topic: string, data: unknown) => number;
 
 export interface CookieOptions {
+  /**
+   * Defaults to true. A cookie written without stating otherwise is not readable by
+   * script; pass `false` explicitly to opt out.
+   */
   httpOnly?: boolean;
+  /**
+   * Defaults to true. A cookie written without stating otherwise is not sent over
+   * plaintext; pass `false` explicitly to opt out.
+   */
   secure?: boolean;
+  /**
+   * Defaults to `lax`. An explicit `strict` or `none` applies instead — the framework
+   * never infers a weaker policy from anything but a deliberate statement.
+   */
   sameSite?: 'lax' | 'strict' | 'none';
   maxAge?: number;
   path?: string;
@@ -46,6 +59,12 @@ export interface PendingCookie {
   options?: CookieOptions;
 }
 
+/**
+ * Serializes one response cookie. The safe attributes are the **defaults**: a cookie
+ * written with no options at all is HttpOnly, Secure and SameSite=Lax, and only an
+ * explicit `false` (or a different `sameSite`) changes that. This is a breaking
+ * change from the previous opt-in behaviour.
+ */
 export function serializeCookie(name: string, value: string, options: CookieOptions = {}): string {
   const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
   if (options.maxAge !== undefined) {
@@ -56,15 +75,14 @@ export function serializeCookie(name: string, value: string, options: CookieOpti
   }
   const cleanPath = options.path && !/[\r\n;\s]/.test(options.path) ? options.path.trim() : '/';
   parts.push(`Path=${cleanPath}`);
-  if (options.secure) {
+  if (options.secure ?? true) {
     parts.push('Secure');
   }
-  if (options.httpOnly) {
+  if (options.httpOnly ?? true) {
     parts.push('HttpOnly');
   }
-  if (options.sameSite) {
-    parts.push(`SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1).toLowerCase()}`);
-  }
+  const sameSite = options.sameSite ?? 'lax';
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase() + sameSite.slice(1).toLowerCase()}`);
   return parts.join('; ');
 }
 
@@ -101,9 +119,6 @@ export interface ActionContext<TServices = Record<string, unknown>> extends Data
 
   /** Internal list of pending cookies to be set on the response */
   readonly _pendingCookies?: PendingCookie[];
-
-  /** Lazy adapter for Kysely (if configured or requested) */
-  readonly kysely?: unknown;
 }
 
 export function createDefaultLogger(sliceName?: string): StructuredLogger {
@@ -130,7 +145,11 @@ export interface ActionContextOptions<TServices = Record<string, unknown>> {
   storage?: StorageClient;
   broadcast?: BroadcastFn;
   invalidateCache?: (tags?: string[]) => void;
-  kysely?: unknown;
+  /**
+   * The slice key (`<domain>/<name>`) this context belongs to. Publishing into a
+   * declared topic is only allowed for the declaration's owner.
+   */
+  sliceOwner?: string;
 }
 
 /**
@@ -148,11 +167,30 @@ export function createActionContext<TServices = Record<string, unknown>>(
     logger = createDefaultLogger(),
     enqueue = async () => 'job_noop',
     storage = getStorage(),
-    broadcast = (topic: string, data: unknown) => getEventHub().publish(topic, data),
     invalidateCache = () => {},
-    kysely
+    sliceOwner
   } = options;
 
+  /**
+   * Publishing is declared, not inferred: the topic must exist in the session's
+   * tenant scope and this feature must be its declared owner. Anything else is
+   * rejected and notifies nobody.
+   */
+  const broadcast: BroadcastFn =
+    options.broadcast ??
+    ((topic: string, data: unknown) => {
+      const declaration = declaredTopic(topic, tenantId);
+
+      if (!declaration || (sliceOwner && declaration.owner !== sliceOwner)) {
+        logger.warn(
+          `Broadcast recusado no tópico "${topic}": não declarado${sliceOwner ? ` por ${sliceOwner}` : ''} (defineTopic).`
+        );
+        return 0;
+      }
+
+      return getEventHub().publish(scopedTopic(topic, tenantId), data);
+    });
+
   const pendingCookies: PendingCookie[] = [];
   const setCookie = (name: string, value: string, options?: CookieOptions) => {
     pendingCookies.push({ name, value, options });
@@ -171,7 +209,6 @@ export function createActionContext<TServices = Record<string, unknown>>(
     invalidateCache,
     setCookie,
     _pendingCookies: pendingCookies,
-    kysely,
 
     // DatabaseClient proxy methods
     query: <T = unknown>(sql: string, params?: unknown[]) => db.query<T>(sql, params),
@@ -195,8 +232,8 @@ export function createActionContext<TServices = Record<string, unknown>>(
           logger,
           enqueue,
           storage,
-          broadcast,
-          kysely: txDb
+          broadcast: options.broadcast,
+          sliceOwner
         });
         return operation(txContext);
       });

package/src/core/config.ts

@@ -11,7 +11,7 @@ export interface SynapsePlugin {
   name: string;
   // biome-ignore lint/suspicious/noExplicitAny: generic boundary for framework server
   onBootstrap?: (server: any) => Promise<void> | void;
-  onRequest?: (req: Request) => Promise<Response | null | undefined> | Response | null | void;
+  onRequest?: (req: Request) => Promise<Response | null | undefined> | Response | null | undefined;
   onResponse?: (res: Response, req: Request) => Promise<Response> | Response;
   // biome-ignore lint/suspicious/noExplicitAny: generic boundary for database client
   onMigrate?: (db: any) => Promise<void> | void;
@@ -55,9 +55,31 @@ export interface SynapseConfig<TServices = Record<string, unknown>> {
 
   /**
    * Trust proxy headers (cf-connecting-ip, x-forwarded-for) for rate limiting and IP resolution.
+   * Opt-in: when this is not explicitly `true` (or SYNAPSE_TRUST_PROXY is not `true`), the
+   * immediate peer address is used and a rotating forwarding header cannot mint a new allowance.
    */
   trustProxy?: boolean;
 
+  /**
+   * Process-level maximum request body size, enforced by the HTTP server itself before any
+   * body reader runs (default: 12 MiB, above every per-route ceiling). It is the backstop
+   * behind the RPC (5 MiB), webhook (10 MiB) and upload (5 MiB) limits.
+   */
+  maxRequestBodyBytes?: number;
+
+  /**
+   * Rate limiting. Scope is the serving process only: each instance keeps its own counters,
+   * so N instances behind a load balancer permit N times the per-instance allowance.
+   */
+  rateLimit?: {
+    /** Maximum burst capacity (default: 150). */
+    capacity?: number;
+    /** Refill rate in tokens per second (default: 100). */
+    refillRate?: number;
+    /** Maximum tracked client identities before the registry is saturated (default: 10,000). */
+    maxBuckets?: number;
+  };
+
   /**
    * Max allowed payload bytes for RPC POST requests (default: 5MB).
    */
@@ -75,11 +97,54 @@ export interface SynapseConfig<TServices = Record<string, unknown>> {
     maxEntries?: number;
   };
 
+  /**
+   * Third-party CDN and web-font origins (Tailwind's runtime compiler, Google Fonts).
+   * **Opt-in**: nothing third-party is referenced by default. When enabled, the
+   * content-security policy is rebuilt to permit exactly the configured origins, and
+   * the emitted tags carry a subresource-integrity hash — without one, the tag is not
+   * emitted at all, because an unpinned third-party script in an origin that holds a
+   * script-readable session cookie is the whole risk.
+   */
+  cdn?: {
+    enabled?: boolean;
+    /** SRI hash for the Tailwind runtime script (`sha384-...`). */
+    scriptIntegrity?: string;
+    /** SRI hash for the Google Fonts stylesheet (`sha384-...`). */
+    fontIntegrity?: string;
+  };
+
+  /**
+   * Realtime (event stream and WebSocket) limits. Long-lived connections consume a
+   * token from the rate limiter at most once, so these bounds — not the token bucket —
+   * are what caps concurrent streams.
+   */
+  realtime?: {
+    /** Maximum distinct topics with an open subscription (default: 1000). */
+    maxTopics?: number;
+    /** Maximum concurrently open realtime connections (default: 1000). */
+    maxSubscriptions?: number;
+    /** Maximum concurrently open realtime connections from one client (default: 8). */
+    maxConnectionsPerClient?: number;
+  };
+
+  /**
+   * Operator-supplied Content-Security-Policy. When present it is emitted as given —
+   * the framework never weakens it — and replaces the built-in policy.
+   */
+  contentSecurityPolicy?: string;
+
   /**
    * Image optimizer security settings.
+   * When `allowedDomains` is absent, any publicly routable host is permitted (loopback,
+   * link-local, private and metadata addresses are always refused) and the documentation
+   * says so rather than implying a restriction that is not enforced.
    */
   imageOptimizer?: {
     allowedDomains?: string[];
+    /** Maximum bytes accepted from a remote image host (default: 10 MiB). */
+    maxResponseBytes?: number;
+    /** Maximum time a remote image fetch may take, in ms (default: 10,000). */
+    timeoutMs?: number;
   };
 }
 
@@ -93,20 +158,33 @@ const CONFIG_FILENAMES = ['synapse.config.ts', 'synapse.config.js', 'synapse.con
 
 /**
  * Discovers and loads `synapse.config.(ts|js|mjs)` from the application root.
+ *
+ * A configuration file that exists but cannot be loaded is **fatal**: the config
+ * carries security-relevant defaults (trusted proxy, body ceilings, realtime bounds),
+ * so degrading to an empty configuration silently would start the server with
+ * settings nobody chose. Absence of the file is not an error — it means "defaults".
  */
 export async function loadSynapseConfig(appDir: string): Promise<SynapseConfig> {
   for (const filename of CONFIG_FILENAMES) {
     const candidate = path.join(appDir, filename);
-    if (fs.existsSync(candidate)) {
-      try {
-        const mod = await import(candidate);
-        const config = mod.default || mod;
-        return typeof config === 'function' ? await config() : config;
-      } catch (err: unknown) {
-        const errMessage = err instanceof Error ? err.message : String(err);
-        console.warn(`[SynapseConfig] Aviso ao carregar ${filename}: ${errMessage}`);
-      }
+
+    if (!fs.existsSync(candidate)) {
+      continue;
     }
+
+    let mod: { default?: unknown } & Record<string, unknown>;
+
+    try {
+      mod = (await import(candidate)) as { default?: unknown } & Record<string, unknown>;
+    } catch (err: unknown) {
+      const errMessage = err instanceof Error ? err.message : String(err);
+
+      throw new Error(`[SynapseConfig] falha ao carregar ${filename}: ${errMessage}`);
+    }
+
+    const config = (mod.default || mod) as SynapseConfig | (() => SynapseConfig | Promise<SynapseConfig>);
+
+    return typeof config === 'function' ? await config() : config;
   }
 
   return {};

package/src/core/database-client.ts

@@ -1,8 +1,9 @@
 /**
  * SynapseJS - Database Context & Query Builder Abstraction
  *
- * Provides a clean, type-safe persistence contract without reflection-based ORM bloat.
- * Compatible with raw parameterized SQL, Kysely, and Drizzle query builders.
+ * Provides a clean, type-safe persistence contract without reflection-based ORM bloat:
+ * raw parameterized SQL plus a relational query builder, with no adapter for any other
+ * query builder.
  */
 
 export interface QueryResult<T = unknown> {
@@ -112,6 +113,24 @@ export interface DatabaseClient {
 /**
  * In-memory Mock Database Client for deterministic testing and PBT (Fast-Check).
  */
+/** Equality and `eq`/`in` matching, which is what the in-memory store can honour honestly. */
+function rowMatchesCondition(row: Record<string, unknown>, where: WhereCondition): boolean {
+  return Object.entries(where).every(([column, condition]) => {
+    const value = row[column];
+
+    if (condition !== null && typeof condition === 'object' && 'op' in (condition as Record<string, unknown>)) {
+      const { op, val } = condition as { op: string; val: unknown };
+
+      if (op === 'eq') return value === val;
+      if (op === 'in') return Array.isArray(val) && val.includes(value);
+
+      return false;
+    }
+
+    return value === condition;
+  });
+}
+
 export class MockDatabaseClient implements DatabaseClient {
   private tables: Map<string, Array<Record<string, unknown>>> = new Map();
   private queryHandlers: Array<{
@@ -228,18 +247,61 @@ export class MockDatabaseClient implements DatabaseClient {
   async update<T = unknown>(table: string, data: Record<string, unknown>, where: WhereCondition): Promise<T[]> {
     const { sql, params } = compileUpdate(table, data, where);
     const results = await this.query<T>(sql, params);
-    if (results.length > 0) return results;
-    return [data as T];
+
+    if (results.length > 0) {
+      return results;
+    }
+
+    // No row matched, so no row is returned: reporting the payload back would be a
+    // write that never happened.
+    const rows = this.tables.get(table);
+
+    if (!rows) {
+      return [];
+    }
+
+    const updated = rows.filter((row) => rowMatchesCondition(row, where));
+    for (const row of updated) {
+      Object.assign(row, data);
+    }
+
+    return updated as unknown as T[];
   }
 
   async delete(table: string, where: WhereCondition): Promise<number> {
     const { sql, params } = compileDelete(table, where);
     const results = await this.query(sql, params);
-    return results.length > 0 ? results.length : 1;
+
+    if (results.length > 0) {
+      return results.length;
+    }
+
+    // A delete that matched nothing removed nothing.
+    const rows = this.tables.get(table);
+
+    if (!rows) {
+      return 0;
+    }
+
+    const survivors = rows.filter((row) => !rowMatchesCondition(row, where));
+    const removed = rows.length - survivors.length;
+    this.tables.set(table, survivors);
+
+    return removed;
   }
 
   async transaction<T>(operation: (tx: DatabaseClient) => Promise<T>): Promise<T> {
-    return operation(this);
+    const snapshot = new Map(
+      Array.from(this.tables.entries()).map(([table, rows]) => [table, rows.map((row) => ({ ...row }))])
+    );
+
+    try {
+      return await operation(this);
+    } catch (error) {
+      // A rolled-back transaction discards the writes made inside it.
+      this.tables = snapshot;
+      throw error;
+    }
   }
 
   close(): void {}

package/src/core/index.ts

@@ -7,6 +7,7 @@ export * from './database-factory';
 export * from './image-optimizer';
 export * from './jobs';
 export * from './machine-types';
+export * from './path-guard';
 export * from './postgres-client';
 export * from './postgres-queue';
 export * from './query-builder';
@@ -14,5 +15,7 @@ export * from './session-context';
 export * from './session-token';
 export * from './sqlite-client';
 export * from './storage';
+export * from './topics';
 export * from './validation';
+export * from './webhook-signature';
 export * from './websocket';

package/src/core/path-guard.ts

@@ -0,0 +1,105 @@
+/**
+ * SynapseJS - Path Segment Guard
+ *
+ * The single rule that decides whether caller-supplied input may become one
+ * segment of a filesystem path. Every write surface — slice scaffolding,
+ * shared-module scaffolding, application creation and the upload parser —
+ * passes its input through this validator before joining, so containment
+ * cannot hold on one path and be missing on a sibling.
+ *
+ * It rejects rather than rewrites: a silently sanitized name turns a traversal
+ * into "expected behaviour".
+ */
+
+import * as path from 'path';
+import { Err, Ok, type Result } from './machine-types';
+
+export const MAX_PATH_SEGMENT_LENGTH = 120;
+
+/** An ordinary name: alphanumeric start, then alphanumerics, dot, underscore or dash. */
+const SEGMENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/** The same rule as a pattern source, for schemas that declare the constraint. */
+export const PATH_SEGMENT_PATTERN = SEGMENT_PATTERN.source;
+
+export type PathSegmentErrorCode = 'INVALID_PATH_SEGMENT';
+
+/**
+ * Accepts a caller-supplied string only when it is one safe path segment.
+ *
+ * Rejections: separators, parent traversal, absolute prefixes, empty or
+ * blank segments, over-length input, and anything outside the plain-name
+ * pattern. Every write surface that joins caller input into a filesystem
+ * path applies exactly this rule.
+ */
+export function validatePathSegment(
+  raw: string | null | undefined,
+  maxLength: number = MAX_PATH_SEGMENT_LENGTH
+): Result<string, PathSegmentErrorCode> {
+  if (typeof raw !== 'string') {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  const segment = raw.trim();
+
+  if (!segment || segment.length > maxLength) {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  if (segment.includes('/') || segment.includes('\\') || segment.includes('\0')) {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  if (segment.includes('..')) {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  if (path.isAbsolute(segment) || /^[A-Za-z]:/.test(segment)) {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  if (!SEGMENT_PATTERN.test(segment)) {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  return Ok(segment);
+}
+
+/**
+ * True only when `target` resolves to a location strictly inside `base`.
+ *
+ * This is the post-join assertion: character validation alone is defeated by
+ * a compound path that looks safe segment by segment, so the resolved target
+ * is compared against the resolved base before any write.
+ */
+export function isInsideBase(base: string, target: string): boolean {
+  const resolvedBase = path.resolve(base);
+  const resolvedTarget = path.resolve(target);
+  const relative = path.relative(resolvedBase, resolvedTarget);
+
+  return relative !== '' && !relative.startsWith('..') && !path.isAbsolute(relative);
+}
+
+/**
+ * Validates every segment, joins them onto `base` and asserts the resolved
+ * target stays inside it. The only way to turn caller input into a write path.
+ */
+export function resolveWithinBase(base: string, ...segments: string[]): Result<string, PathSegmentErrorCode> {
+  const resolvedBase = path.resolve(base);
+
+  for (const segment of segments) {
+    const validated = validatePathSegment(segment);
+
+    if (!validated.ok) {
+      return validated;
+    }
+  }
+
+  const target = path.join(resolvedBase, ...segments);
+
+  if (!isInsideBase(resolvedBase, target)) {
+    return Err('INVALID_PATH_SEGMENT');
+  }
+
+  return Ok(target);
+}

package/src/core/postgres-queue.ts

@@ -146,14 +146,32 @@ export class PostgresQueueEngine {
     );
 
     for (const deadJob of deadJobs) {
-      await this.db
-        .query(
-          `INSERT INTO _synapse_jobs_dlq (id, name, payload, attempts, max_attempts, last_error, failed_at)
-           VALUES ($1, $2, $3, $4, $5, $6, $7)
+      // `job_id` is NOT NULL in the table, and the id is derived from the job so a
+      // repeated recovery of the same zombie stays idempotent. A failure here is
+      // logged: swallowing it is how a dead-letter queue silently holds nothing.
+      const dlqId = `dlq_${deadJob.id}`;
+
+      try {
+        await this.db.query(
+          `INSERT INTO _synapse_jobs_dlq (id, job_id, name, payload, attempts, max_attempts, last_error, failed_at)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
            ON CONFLICT (id) DO UPDATE SET attempts = EXCLUDED.attempts, last_error = EXCLUDED.last_error, failed_at = EXCLUDED.failed_at;`,
-          [deadJob.id, deadJob.name, deadJob.payload, deadJob.attempts, deadJob.max_attempts, deadJob.last_error, now]
-        )
-        .catch(() => {});
+          [
+            dlqId,
+            deadJob.id,
+            deadJob.name,
+            deadJob.payload,
+            deadJob.attempts,
+            deadJob.max_attempts,
+            deadJob.last_error,
+            now
+          ]
+        );
+      } catch (error: unknown) {
+        this.logger.warn(
+          `[DLQ] Falha ao registrar o job ${deadJob.id} na dead letter queue: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
     }
 
     const rows = await this.db.query<JobRecord>(