refactor(server): reduz a complexidade das funções de netGuard

- SSRF: /api/queue aceitava qualquer URL, inclusive localhost, rede
  privada e 169.254.169.254. Agora só http/https e, por padrão, nada de
  endereço local/privado (checagem na fila e no conector do undici, que
  cobre DNS rebinding e redirects). ALLOW_PRIVATE_NETWORK=true libera.
- O header x-session-id virava nome de diretório sem validação; com ".."
  a expiração faria rmSync em server/. Agora só UUID é aceito.
- Respostas 3xx eram salvas como se fossem o arquivo; agora segue até 5
  redirects e trata 3xx restante como erro.
- decodeURIComponent inválido no Content-Disposition derrubava o download.
- web: useCallback em refreshTasks (corrige o warning exhaustive-deps).

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 12.8.1
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm lint
+      - run: pnpm test
+      - run: pnpm build

README.md

@@ -2,6 +2,7 @@
 
 **Proxy de download efêmero: a sua VPS baixa o arquivo por uma rota melhor e entrega para o seu navegador, com os arquivos apagados automaticamente depois.**
 
+[![CI](https://github.com/evandrodevbr/Downloader/actions/workflows/ci.yml/badge.svg)](https://github.com/evandrodevbr/Downloader/actions/workflows/ci.yml)
 ![Node](https://img.shields.io/badge/Node-%3E%3D20.19-5FA04E?logo=nodedotjs&logoColor=white)
 ![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)
 ![Fastify](https://img.shields.io/badge/Fastify-5-000000?logo=fastify&logoColor=white)
@@ -49,8 +50,8 @@ navegador
 
 ## Requisitos
 
-- Node.js 20.19 ou superior (exigência do Vite 7 e do undici 7; verificado no Node 24.20.0)
+- Node.js 20.19 ou superior para rodar e fazer o build (exigência do Vite 7 e do undici 7). Para rodar os testes (vitest 5) use Node 22.12 ou superior.
-- pnpm 9 ou superior (verificado no pnpm 12.4.1; o lockfile é o formato 9.0)
+- pnpm 9 ou superior (verificado no pnpm 12.8.1 com Node 26.7.0; o lockfile é o formato 9.0)
 - Portas livres: backend (padrão 3000) e Vite (5173) em desenvolvimento
 
 Observação sobre pnpm: a seção `overrides` do `pnpm-workspace.yaml` (fastify e undici com versão mínima de segurança) só é aplicada pelo pnpm 10 ou superior. Com pnpm 9 ela é ignorada.
@@ -90,7 +91,7 @@ PORT=3100 VITE_API_PROXY=http://localhost:3100 pnpm dev
 | GET | `/api/download/:taskId` | Entrega o arquivo concluído da task. |
 | GET | `/stream` | Descontinuado: responde 410. |
 
-A sessão é identificada pelo header `x-session-id` (a interface guarda o id em `localStorage`). Erros observados: 400 para URL inválida (`{"error":"Invalid URL"}`) ou download não pronto, 403 para task de outra sessão e 404 para task inexistente. Se a origem falhar (por exemplo, 404 no host de origem), a task fica com `status: "error"` e a mensagem em `error`.
+A sessão é identificada pelo header `x-session-id` (a interface guarda o id em `localStorage`). Erros observados: 400 para URL inválida (`{"error":"Invalid URL"}`), com protocolo que não seja http/https, apontando para endereço local ou privado, ou para download não pronto; 403 para task de outra sessão e 404 para task inexistente. Se a origem falhar (por exemplo, 404 no host de origem), a task fica com `status: "error"` e a mensagem em `error`. O servidor segue até 5 redirects; um nome de domínio que resolva para IP privado também faz a task terminar em erro.
 
 ## Produção
 
@@ -101,50 +102,56 @@ PORT=3000 pnpm start  # node server/dist/index.js: API + build do front na mesma
 
 O `nixpacks.toml` descreve esse fluxo: build em `pnpm install --frozen-lockfile && pnpm build` e start em `pnpm start`.
 
-Variáveis de ambiente: `PORT` (padrão 3000) e `STORAGE_ROOT` (padrão `server/storage`) no backend; `VITE_API_URL` (host da API no frontend) e `VITE_API_PROXY` (alvo do proxy em dev).
+## Configuração
+
+| Variável | Onde | Padrão | O que faz |
+|---|---|---|---|
+| `PORT` | backend | `3000` | Porta do Fastify. |
+| `STORAGE_ROOT` | backend | `server/storage` | Diretório onde ficam os arquivos das sessões. |
+| `ALLOW_PRIVATE_NETWORK` | backend | desligado | Com `true`, permite baixar de `localhost` e de endereços de rede privada. Por padrão o servidor recusa esses destinos (proteção contra SSRF). |
+| `VITE_API_URL` | frontend | mesma origem | Host da API, se for diferente do que serve o front. |
+| `VITE_API_PROXY` | frontend (dev) | `http://localhost:3000` | Alvo do proxy de `/api` no Vite. |
 
 ## Estrutura do projeto
 
 ```
 server/                 backend Fastify
 ├── src/index.ts            rotas (/health, /api/*), CORS e static do front
-└── src/lib/
+├── src/lib/
-    ├── DownloadManager.ts  download da origem com undici e gravação na sessão
+│   ├── DownloadManager.ts  download da origem com undici e gravação na sessão
-    └── SessionManager.ts   sessões, expiração (1 h) e limpeza dos arquivos
+│   ├── SessionManager.ts   sessões, expiração (1 h) e limpeza dos arquivos
+│   └── netGuard.ts         validação de URL e bloqueio de destinos privados (SSRF)
+└── test/                   testes (vitest)
 web/                    frontend React + Vite
 ├── src/context/            SessionContext (sessão e polling das tasks)
 ├── src/components/         ui/ (Input, Button, Card, Alert...) e feature/ (form, item, timer)
 └── vite.config.ts          proxy de /api em desenvolvimento
 .agent/                 scaffolding de agentes de IA (não faz parte do runtime)
-docs/PLAN.md            vazio (placeholder nunca preenchido)
+.github/workflows/      CI (typecheck, lint, testes e build)
 nixpacks.toml           comandos de build e start do deploy
 pnpm-workspace.yaml     workspaces, allowBuilds e overrides
 ```
 
-## Verificação
+## Testes e desenvolvimento
 
-Não há testes automatizados neste repositório. O que existe de fato:
+```bash
+pnpm typecheck   # tsc nos dois pacotes
+pnpm lint        # eslint no web
+pnpm test        # vitest no server e no web
+pnpm build
+```
 
-- `pnpm build` roda o `tsc` do server e `tsc -b && vite build` do web, e é o gate atual;
+Os testes do servidor cobrem a validação de URL e o bloqueio de IPs privados, o tratamento de redirects, a expiração de sessões (com remoção das tasks e dos arquivos) e a validação do id de sessão. Os do web cobrem os estados do componente `DownloadItem`. O mesmo conjunto roda no GitHub Actions (`.github/workflows/ci.yml`).
-- `pnpm --filter web lint` roda o eslint (passa com 1 warning de `exhaustive-deps` em `SessionContext.tsx`);
-- verificação manual executada em 14/09/2026 (Linux, Node 24.20.0, pnpm 12.4.1): `pnpm install` e `pnpm build` com exit 0; 13 checagens de API passando (`/health`, `/`, `/api/session`, `/api/queue` com URL inválida e válida, `/api/tasks`, `/api/download/:id`, 400/403/404 e `/stream` respondendo 410); download de 10 MB conferido por sha256 idêntico ao da origem; interface verificada em Chrome headless (sessão inicializada, task concluída e "Save to Disk" baixando o arquivo com o mesmo sha256).
-
-Adicionar testes automatizados é o próximo passo natural do projeto.
 
 ## Estado atual e limitações
 
 - Sessões e tasks ficam em memória: reiniciar o servidor perde a lista de tasks (os arquivos em disco são removidos pelo coletor depois de 1 hora).
-- Sem autenticação: qualquer um que alcance o servidor pode enfileirar downloads. Coloque atrás de VPN, autenticação reversa ou firewall.
+- Sem autenticação: qualquer um que alcance o servidor pode enfileirar downloads (de destinos públicos). Coloque atrás de VPN, autenticação reversa ou firewall.
 - Não há retomada de download nem uso de `Range` no fluxo atual (o parâmetro `offset` do antigo `/stream` não existe mais).
 - Não há limite de tamanho, banda ou cota: um link muito grande ocupa o disco do servidor até a sessão expirar.
-- URLs que não sejam http/https são aceitas na fila e falham depois com `status: "error"`.
+- "Save to Disk" carrega o arquivo inteiro na memória do navegador (`blob()`) antes de salvar, o que pesa em arquivos muito grandes.
-- Sem CI configurada e sem arquivo de licença.
 - O diretório `.agent/` é scaffolding de ferramentas de IA e não é usado pela aplicação.
 
-## Documentação
-
-Não há documentação interna além deste README: `docs/PLAN.md` está vazio e `web/README.md` é o texto padrão do template do Vite.
-
 ## Licença
 
 Sem licença definida no repositório: não existe arquivo `LICENSE` e o `package.json` está marcado como `private`. Defina uma licença antes de reutilizar ou publicar o código.

package.json

@@ -8,12 +8,13 @@
     "dev:server": "pnpm --filter server dev",
     "dev:web": "pnpm --filter web dev",
     "build": "pnpm -r build",
-    "start": "pnpm --filter server start"
+    "start": "pnpm --filter server start",
+    "test": "pnpm -r --if-present test",
+    "lint": "pnpm -r --if-present lint",
+    "typecheck": "pnpm -r --if-present typecheck"
   },
   "workspaces": [
     "server",
     "web"
   ]
 }
-
-

pnpm-lock.yaml

@@ -1,3 +1,161 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.8.1
+        version: 12.8.1
+
+packages:
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-siDxcidfz5eM6L2tJfik+i2bbUEw8UC7MZ3Yl2HYdRmqbdhHGAOQACtOOu6QVW4Jul4/w5wVKm+wM8ACtgh1Pg==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-0F/uqPRc3aN4vLHsa0f+6fTtmsigFQ9/yxEU43fionF//pNHEd5e97b3w/nKIgqYMCUQCJphmBRMA9Q8/wlo9Q==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-/rwavvMQJsl2RIxOHBnDF+4Gk+fhQFAY4M3PQZoKskJOEnaJcygG9p1xby6wcQcbS4d9dIubv09CQhufTgfmpw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-htYt2gN7zqJKLhC99Ft6EUiO7myjZAZXfmGCTJUL1v+o7vE9hZdE1+fAkk4Oj1ZHNRti6b2woOxEkRkAusi8OQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-PB5BULNgytxvExoOXUUeseS/DcpPENs+cg3iA6xHHeaLT4ctEGKSGXEbuj7USeqvo8JBpAx039hivnbzGqDwnA==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-kKeyC/ArjrgdciQRBrOL0j9HtOI4gDRgoyP+eJ1CQKyadpKlf/DhDDyspXe07R3B9KagTVLUF2nlt6Dr5quFIg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-q4s9a9X2O3N9aeUFooW24orNrxvu20+jyVUFR5RanPCqOKKPBrgs2iywMkBBx1aXkkzdWT54/mfz8Be8sJlWEw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-F7XSjKJthwCh/L6abZiMpAfo2Cm61SZIT3e4dfgiIjESndlWaXCnfLKngSgZ/SEMsdmHT6dud3+kWIB3tw0/xQ==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-z1ecpIK/ZY08Unk69KWWE9867oaKUytGUjrHnBoGFAAhsK+q+0cfvBH+f5fWobJ7FX97leMlLO+gkJolddM45Q==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-KU6tnrBfu4uKXTq6N5qJwSm8FSrs9Wc8b5AUEsHK9bRXwNdsZ1/lRxG1++X29SKRW9OSNuDSjxASv5mAvGo1gA==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-eUE8BWJkDr2tJb/yrk0yVnszlmNqFarVxUlqiZ9BAkct28Nq/5g2H0tvMDmPA7fAQW3STNj+omJPPRVT+4s5sQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-8bDZ0lZlCdi2rvnFul7EYgcC7zKeWSe76y8JV2oXobaS8p9i9d6PSf6LgLtTM0fI7R9Oh4eLCbveXyNDMmvZ+g==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-MsT0dlrRxnCRCHCaosNbhWpEiAFnFuMEu3KuDJDU41BXgTwiINxU8goloUSUDejWZUqKaUqNC/qUTihl9nFtqg==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-SWtPe0PsbTTk//gJND10tMdOfCYjrkq5+qV49hzVhY7xz2iJ339Rc+xwASlcvbwTfrvH39YNqpKYibD+CRGLwA==}
+    cpu: [x64]
+    os: [win32]
+
+  [email protected]:
+    resolution: {integrity: sha512-9kupB1B/XOr+BsjTjmBS0BeURFgOwSed3Vv8EctIqoomRLZlmOB+dh2oSHKp/FfV+QK4f6SdAkGY1VhhKqu+RQ==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  [email protected]:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.8.1
+      '@pnpm/exe.android-x64': 12.8.1
+      '@pnpm/exe.darwin-arm64': 12.8.1
+      '@pnpm/exe.darwin-x64': 12.8.1
+      '@pnpm/exe.freebsd-x64': 12.8.1
+      '@pnpm/exe.linux-arm64': 12.8.1
+      '@pnpm/exe.linux-arm64-musl': 12.8.1
+      '@pnpm/exe.linux-ppc64': 12.8.1
+      '@pnpm/exe.linux-riscv64': 12.8.1
+      '@pnpm/exe.linux-s390x': 12.8.1
+      '@pnpm/exe.linux-x64': 12.8.1
+      '@pnpm/exe.linux-x64-musl': 12.8.1
+      '@pnpm/exe.win32-arm64': 12.8.1
+      '@pnpm/exe.win32-x64': 12.8.1
+
+---
 lockfileVersion: '9.0'
 
 settings:
@@ -40,6 +198,9 @@ importers:
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
+      vitest:
+        specifier: ^5.0.3
+        version: 5.0.3(@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
 
   web:
     dependencies:
@@ -58,9 +219,6 @@ importers:
       tailwind-merge:
         specifier: ^3.4.0
         version: 3.4.0
-      uuid:
-        specifier: ^13.0.0
-        version: 13.0.0
       zod:
         specifier: ^3.25.76
         version: 3.25.76
@@ -82,19 +240,19 @@ importers:
         version: 19.2.3(@types/[email protected])
       '@vitejs/plugin-react':
         specifier: ^5.1.1
-        version: 5.1.1([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+        version: 5.1.1([email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
       autoprefixer:
         specifier: ^10.4.24
         version: 10.4.24([email protected])
       eslint:
         specifier: ^9.39.1
-        version: 9.39.1([email protected])
+        version: 9.39.1([email protected])([email protected])
       eslint-plugin-react-hooks:
         specifier: ^7.0.1
-        version: 7.0.1([email protected]([email protected]))
+        version: 7.0.1([email protected]([email protected])([email protected]))([email protected])
       eslint-plugin-react-refresh:
         specifier: ^0.4.24
-        version: 0.4.24([email protected]([email protected]))
+        version: 0.4.24([email protected]([email protected])([email protected]))
       globals:
         specifier: ^16.5.0
         version: 16.5.0
@@ -109,10 +267,13 @@ importers:
         version: 5.9.3
       typescript-eslint:
         specifier: ^8.46.4
-        version: 8.47.0([email protected]([email protected]))([email protected])
+        version: 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
       vite:
         specifier: ^7.2.4
         version: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+      vitest:
+        specifier: ^5.0.3
+        version: 5.0.3(@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
 
 packages:
 
@@ -616,6 +777,9 @@ packages:
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
+  '@jridgewell/[email protected]':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
@@ -851,6 +1015,12 @@ packages:
   '@types/[email protected]':
     resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
 
+  '@types/[email protected]':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/[email protected]':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
   '@types/[email protected]':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
@@ -936,6 +1106,20 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
+  '@vitest/[email protected]':
+    resolution: {integrity: sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/[email protected]':
+    resolution: {integrity: sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==}
+
   [email protected]:
     resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
 
@@ -970,6 +1154,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
+  [email protected]:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
   [email protected]:
     resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
     engines: {node: '>=8.0.0'}
@@ -1033,6 +1221,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-BCfFL1sHijQlBGWBMuJyhZUhzo7wer5sVj9hqekB/7xn0Ypy+pER/edCYQm4exbXj4WiySGp40P8UuTh6w1srg==}
 
+  [email protected]:
+    resolution: {integrity: sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==}
+    engines: {node: '>=18'}
+
   [email protected]:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
@@ -1103,6 +1295,9 @@ packages:
     resolution: {integrity: sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==}
     engines: {node: '>=10.13.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
+
   [email protected]:
     resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
     engines: {node: '>=18'}
@@ -1150,6 +1345,7 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-BhHmn2yNOFA9H9JmmIVKJmd288g9hrVRDkdoIgRCRuSySRUHH7r/DI6aAXW9T1WwUuY3DFgrcaqB+deURBLR5g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
     peerDependencies:
       jiti: '*'
@@ -1173,10 +1369,17 @@ packages:
     resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
     engines: {node: '>=4.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
   [email protected]:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
+    engines: {node: '>=12.0.0'}
+
   [email protected]:
     resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
 
@@ -1478,6 +1681,9 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  [email protected]:
+    resolution: {integrity: sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==}
+
   [email protected]:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
@@ -1520,6 +1726,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
 
+  [email protected]:
+    resolution: {integrity: sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==}
+    engines: {node: '>=12.20.0'}
+
   [email protected]:
     resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
     engines: {node: '>=14.0.0'}
@@ -1563,6 +1773,10 @@ packages:
     resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
     engines: {node: '>=12'}
 
+  [email protected]:
+    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
+    engines: {node: '>=12'}
+
   [email protected]:
     resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
 
@@ -1698,6 +1912,9 @@ packages:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
 
+  [email protected]:
+    resolution: {integrity: sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==}
+
   [email protected]:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
@@ -1720,10 +1937,22 @@ packages:
     resolution: {integrity: sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==}
     engines: {node: '>=20'}
 
+  [email protected]:
+    resolution: {integrity: sha512-IAbQaPJIIdhVxi0mqy9lez1wEwje0UQf9F1vwtbelEG5Nbgn0nPOxCvU+mNeNS9gyJTAhrHp74CbUaSynQpZcQ==}
+    engines: {node: '>=20.0.0'}
+
+  [email protected]:
+    resolution: {integrity: sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==}
+    engines: {node: '>=18'}
+
   [email protected]:
     resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
     engines: {node: '>=12.0.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
   [email protected]:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
@@ -1785,10 +2014,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
-  [email protected]:
-    resolution: {integrity: sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==}
-    hasBin: true
-
   [email protected]:
     resolution: {integrity: sha512-NL8jTlbo0Tn4dUEXEsUg8KeyG/Lkmc4Fnzb8JXN/Ykm9G4HNImjtABMJgkQoVjOBN/j2WAwDTRytdqJbZsah7w==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -1829,11 +2054,57 @@ packages:
       yaml:
         optional: true
 
+  [email protected]:
+    resolution: {integrity: sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==}
+    engines: {node: ^22.12.0 || ^24.0.0 || >=26.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 5.0.3
+      '@vitest/browser-preview': 5.0.3
+      '@vitest/browser-webdriverio': ^5.0.0-beta.5 || >=5.0.0
+      '@vitest/coverage-istanbul': 5.0.3
+      '@vitest/coverage-v8': 5.0.3
+      '@vitest/ui': 5.0.3
+      happy-dom: '*'
+      jsdom: '*'
+      vite: ^6.4.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
   [email protected]:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
     hasBin: true
 
+  [email protected]:
+    resolution: {integrity: sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==}
+    engines: {node: '>=20.11'}
+    hasBin: true
+
   [email protected]:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
@@ -1866,20 +2137,20 @@ snapshots:
 
   '@babel/[email protected]': {}
 
-  '@babel/[email protected]':
+  '@babel/[email protected]([email protected])':
     dependencies:
       '@babel/code-frame': 7.27.1
       '@babel/generator': 7.28.5
       '@babel/helper-compilation-targets': 7.27.2
-      '@babel/helper-module-transforms': 7.28.3(@babel/[email protected])
+      '@babel/helper-module-transforms': 7.28.3(@babel/[email protected]([email protected]))([email protected])
       '@babel/helpers': 7.28.4
       '@babel/parser': 7.28.5
       '@babel/template': 7.27.2
-      '@babel/traverse': 7.28.5
+      '@babel/traverse': 7.28.5([email protected])
       '@babel/types': 7.28.5
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -1904,19 +2175,19 @@ snapshots:
 
   '@babel/[email protected]': {}
 
-  '@babel/[email protected]':
+  '@babel/[email protected]([email protected])':
     dependencies:
-      '@babel/traverse': 7.28.5
+      '@babel/traverse': 7.28.5([email protected])
       '@babel/types': 7.28.5
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/[email protected](@babel/[email protected])':
+  '@babel/[email protected](@babel/[email protected]([email protected]))([email protected])':
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
-      '@babel/helper-module-imports': 7.27.1
+      '@babel/helper-module-imports': 7.27.1([email protected])
       '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.28.5
+      '@babel/traverse': 7.28.5([email protected])
     transitivePeerDependencies:
       - supports-color
 
@@ -1937,14 +2208,14 @@ snapshots:
     dependencies:
       '@babel/types': 7.28.5
 
-  '@babel/[email protected](@babel/[email protected])':
+  '@babel/[email protected](@babel/[email protected]([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
       '@babel/helper-plugin-utils': 7.27.1
 
-  '@babel/[email protected](@babel/[email protected])':
+  '@babel/[email protected](@babel/[email protected]([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
       '@babel/helper-plugin-utils': 7.27.1
 
   '@babel/[email protected]':
@@ -1953,7 +2224,7 @@ snapshots:
       '@babel/parser': 7.28.5
       '@babel/types': 7.28.5
 
-  '@babel/[email protected]':
+  '@babel/[email protected]([email protected])':
     dependencies:
       '@babel/code-frame': 7.27.1
       '@babel/generator': 7.28.5
@@ -1961,7 +2232,7 @@ snapshots:
       '@babel/parser': 7.28.5
       '@babel/template': 7.27.2
       '@babel/types': 7.28.5
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
     transitivePeerDependencies:
       - supports-color
 
@@ -2126,17 +2397,17 @@ snapshots:
   '@esbuild/[email protected]':
     optional: true
 
-  '@eslint-community/[email protected]([email protected]([email protected]))':
+  '@eslint-community/[email protected]([email protected]([email protected])([email protected]))':
     dependencies:
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/[email protected]': {}
 
-  '@eslint/[email protected]':
+  '@eslint/[email protected]([email protected])':
     dependencies:
       '@eslint/object-schema': 2.1.7
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -2149,10 +2420,10 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/[email protected]':
+  '@eslint/[email protected]([email protected])':
     dependencies:
       ajv: 6.12.6
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -2246,10 +2517,12 @@ snapshots:
 
   '@jridgewell/[email protected]': {}
 
+  '@jridgewell/[email protected]': {}
+
   '@jridgewell/[email protected]':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
 
   '@lukeed/[email protected]': {}
 
@@ -2425,6 +2698,13 @@ snapshots:
     dependencies:
       '@babel/types': 7.28.5
 
+  '@types/[email protected]':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/[email protected]': {}
+
   '@types/[email protected]': {}
 
   '@types/[email protected]': {}
@@ -2445,15 +2725,15 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
-  '@typescript-eslint/[email protected](@typescript-eslint/[email protected]([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected](@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]))([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/parser': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
       '@typescript-eslint/scope-manager': 8.47.0
-      '@typescript-eslint/type-utils': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/type-utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
       '@typescript-eslint/visitor-keys': 8.47.0
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       graphemer: 1.4.0
       ignore: 7.0.5
       natural-compare: 1.4.0
@@ -2462,23 +2742,23 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
       '@typescript-eslint/scope-manager': 8.47.0
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
       '@typescript-eslint/visitor-keys': 8.47.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected])':
+  '@typescript-eslint/[email protected]([email protected])([email protected])':
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.47.0([email protected])
       '@typescript-eslint/types': 8.47.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -2492,13 +2772,13 @@ snapshots:
     dependencies:
       typescript: 5.9.3
 
-  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       ts-api-utils: 2.1.0([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -2506,13 +2786,13 @@ snapshots:
 
   '@typescript-eslint/[email protected]': {}
 
-  '@typescript-eslint/[email protected]([email protected])':
+  '@typescript-eslint/[email protected]([email protected])([email protected])':
     dependencies:
-      '@typescript-eslint/project-service': 8.47.0([email protected])
+      '@typescript-eslint/project-service': 8.47.0([email protected])([email protected])
       '@typescript-eslint/tsconfig-utils': 8.47.0([email protected])
       '@typescript-eslint/types': 8.47.0
       '@typescript-eslint/visitor-keys': 8.47.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
@@ -2522,13 +2802,13 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected]))
+      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected])([email protected]))
       '@typescript-eslint/scope-manager': 8.47.0
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -2538,11 +2818,11 @@ snapshots:
       '@typescript-eslint/types': 8.47.0
       eslint-visitor-keys: 4.2.1
 
-  '@vitejs/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+  '@vitejs/[email protected]([email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
-      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/[email protected])
+      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/[email protected]([email protected]))
-      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/[email protected])
+      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/[email protected]([email protected]))
       '@rolldown/pluginutils': 1.0.0-beta.47
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
@@ -2550,6 +2830,26 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@vitest/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      '@vitest/spy': 5.0.3
+      estree-walker: 3.0.3
+      magic-string: 1.4.3
+    optionalDependencies:
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+
+  '@vitest/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      '@vitest/spy': 5.0.3
+      estree-walker: 3.0.3
+      magic-string: 1.4.3
+    optionalDependencies:
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+
+  '@vitest/[email protected]': {}
+
   [email protected]: {}
 
   [email protected]([email protected]):
@@ -2582,6 +2882,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]([email protected]):
@@ -2647,6 +2949,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]:
     dependencies:
       ansi-styles: 4.3.0
@@ -2676,9 +2980,11 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]:
+  [email protected]([email protected]):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 7.2.0
 
   [email protected]: {}
 
@@ -2697,6 +3003,8 @@ snapshots:
       graceful-fs: 4.2.11
       tapable: 2.3.0
 
+  [email protected]: {}
+
   [email protected]:
     optionalDependencies:
       '@esbuild/aix-ppc64': 0.25.12
@@ -2761,20 +3069,20 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]([email protected])):
+  [email protected]([email protected]([email protected])([email protected]))([email protected]):
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
       '@babel/parser': 7.28.5
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       hermes-parser: 0.25.1
       zod: 3.25.76
       zod-validation-error: 4.0.2([email protected])
     transitivePeerDependencies:
       - supports-color
 
-  [email protected]([email protected]([email protected])):
+  [email protected]([email protected]([email protected])([email protected])):
     dependencies:
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
 
   [email protected]:
     dependencies:
@@ -2785,14 +3093,14 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]):
+  [email protected]([email protected])([email protected]):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected]))
+      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected])([email protected]))
       '@eslint-community/regexpp': 4.12.2
-      '@eslint/config-array': 0.21.1
+      '@eslint/config-array': 0.21.1([email protected])
       '@eslint/config-helpers': 0.4.2
       '@eslint/core': 0.17.0
-      '@eslint/eslintrc': 3.3.1
+      '@eslint/eslintrc': 3.3.1([email protected])
       '@eslint/js': 9.39.1
       '@eslint/plugin-kit': 0.4.1
       '@humanfs/node': 0.16.7
@@ -2802,7 +3110,7 @@ snapshots:
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       escape-string-regexp: 4.0.0
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -2842,8 +3150,14 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]:
+    dependencies:
+      '@types/estree': 1.0.8
+
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]: {}
@@ -2903,6 +3217,10 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.3
 
+  [email protected]([email protected]):
+    optionalDependencies:
+      picomatch: 4.0.7
+
   [email protected]:
     dependencies:
       flat-cache: 4.0.1
@@ -3115,6 +3433,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  [email protected]:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+
   [email protected]: {}
 
   [email protected]:
@@ -3146,6 +3468,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]:
@@ -3184,6 +3508,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]:
     dependencies:
       split2: 4.2.0
@@ -3313,6 +3639,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]:
@@ -3329,11 +3657,20 @@ snapshots:
     dependencies:
       real-require: 0.2.0
 
+  [email protected]: {}
+
+  [email protected]: {}
+
   [email protected]:
     dependencies:
       fdir: 6.5.0([email protected])
       picomatch: 4.0.3
 
+  [email protected]:
+    dependencies:
+      fdir: 6.5.0([email protected])
+      picomatch: 4.0.7
+
   [email protected]:
     dependencies:
       is-number: 7.0.0
@@ -3357,13 +3694,13 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
-  [email protected]([email protected]([email protected]))([email protected]):
+  [email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.47.0(@typescript-eslint/[email protected]([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])
+      '@typescript-eslint/eslint-plugin': 8.47.0(@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]))([email protected]([email protected])([email protected]))([email protected])([email protected])
-      '@typescript-eslint/parser': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/parser': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -3390,8 +3727,6 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  [email protected]: {}
-
   [email protected](@types/[email protected])([email protected])([email protected])([email protected]):
     dependencies:
       esbuild: 0.25.12
@@ -3407,10 +3742,69 @@ snapshots:
       lightningcss: 1.30.2
       tsx: 4.21.0
 
+  [email protected](@types/[email protected])([email protected])([email protected])([email protected]):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0([email protected])
+      picomatch: 4.0.3
+      postcss: 8.5.6
+      rollup: 4.53.3
+      tinyglobby: 0.2.15
+    optionalDependencies:
+      '@types/node': 25.2.3
+      fsevents: 2.3.3
+      jiti: 2.6.1
+      lightningcss: 1.30.2
+      tsx: 4.21.0
+
+  [email protected](@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected])):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/mocker': 5.0.3([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+      chai: 6.3.0
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 1.4.3
+      obug: 2.2.1
+      picomatch: 4.0.7
+      std-env: 4.3.0
+      tinybench: 6.2.1
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+      why-is-node-running: 3.2.1
+    optionalDependencies:
+      '@types/node': 24.10.1
+    transitivePeerDependencies:
+      - msw
+
+  [email protected](@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected])):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/mocker': 5.0.3([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+      chai: 6.3.0
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 1.4.3
+      obug: 2.2.1
+      picomatch: 4.0.7
+      std-env: 4.3.0
+      tinybench: 6.2.1
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+      why-is-node-running: 3.2.1
+    optionalDependencies:
+      '@types/node': 25.2.3
+    transitivePeerDependencies:
+      - msw
+
   [email protected]:
     dependencies:
       isexe: 2.0.0
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]: {}

server/package.json

@@ -7,7 +7,9 @@
   "scripts": {
     "dev": "tsx src/index.ts",
     "build": "tsc -p tsconfig.json",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
@@ -19,6 +21,7 @@
   "devDependencies": {
     "@types/node": "^25.2.3",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.3"
   }
 }

server/src/index.ts

@@ -2,18 +2,18 @@ import Fastify, { FastifyRequest, FastifyReply } from "fastify";
 import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import { z } from "zod";
-import { Agent, setGlobalDispatcher } from "undici";
+import { Agent, interceptors, setGlobalDispatcher } from "undici";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { sessionManager } from "./lib/SessionManager.js";
 import { DownloadManager } from "./lib/DownloadManager.js";
+import { UrlNotAllowedError, createGuardedConnector } from "./lib/netGuard.js";
 
 // Otimização: Agente HTTP global com conexões persistentes e timeout relaxado.
 // Isso ajuda a manter a performance em downloads paralelos e evita gargalos de socket.
 const agent = new Agent({
-  connect: {
+  // O conector recusa destinos locais/privados (SSRF), inclusive em redirects.
-    timeout: 30_000,
+  connect: createGuardedConnector({ timeout: 30_000 }),
-  },
   pipelining: 1,
   keepAliveTimeout: 10_000,
   connections: 500, // Aumenta limite de conexões simultâneas
@@ -51,17 +51,11 @@ app.get("/health", async () => {
   return { status: "ok" };
 });
 
-const streamQuerySchema = z.object({
+// Segue até 5 redirects (links de download costumam redirecionar); sem isso o
-  url: z.string().url("URL inválida").startsWith("http", "Apenas HTTP/HTTPS permitidos"),
+// corpo da resposta 3xx era salvo como se fosse o arquivo.
-  // Offset opcional em bytes para retomar download.
+const downloadManager = new DownloadManager(
-  offset: z
+  agent.compose(interceptors.redirect({ maxRedirections: 5 })),
-    .string()
+);
-    .regex(/^\d+$/)
-    .transform((value) => Number.parseInt(value, 10))
-    .optional(),
-});
-
-const downloadManager = new DownloadManager(agent);
 
 // Helper to get session from header
 const getSession = (req: FastifyRequest, reply: FastifyReply) => {
@@ -95,8 +89,12 @@ app.post("/api/queue", async (request, reply) => {
   const parse = queueSchema.safeParse(request.body);
   if (!parse.success) return reply.status(400).send({ error: "Invalid URL" });
 
-  const task = await downloadManager.queueDownload(session.id, parse.data.url);
+  try {
-  return task;
+    return await downloadManager.queueDownload(session.id, parse.data.url);
+  } catch (err) {
+    if (err instanceof UrlNotAllowedError) return reply.status(400).send({ error: err.message });
+    throw err;
+  }
 });
 
 // 3. List Tasks (Polling)

server/src/lib/DownloadManager.ts

@@ -5,6 +5,7 @@ import { Transform } from "node:stream";
 import { request, Dispatcher } from "undici";
 import { randomUUID } from "node:crypto";
 import { sessionManager } from "./SessionManager.js";
+import { assertDownloadableUrl } from "./netGuard.js";
 
 type DownloadStatus = "queued" | "downloading" | "completed" | "error";
 
@@ -23,13 +24,32 @@ export type DownloadTask = {
 };
 
 // Map to store active task metadata in memory (for speed)
-// Ideally this would be persisted to JSON in the session folder for crash recovery
+// Ideally this would be persisted to JSON in the session folder for crash recovery.
+// As tasks de uma sessão são removidas quando ela expira (ver construtor), então o
+// mapa não cresce sem limite num servidor de longa duração.
 const tasks = new Map<string, DownloadTask>();
-const agent = new Dispatcher(); // Should use the global agent from index.ts ideally, or pass it in.
+
+// decodeURIComponent lança em sequências inválidas (ex.: "%E0%A4%A"); nesse caso
+// mantém o texto original em vez de falhar o download inteiro.
+function safeDecode(value: string): string {
+    try {
+        return decodeURIComponent(value);
+    } catch {
+        return value;
+    }
+}
 
 export class DownloadManager {
 
-    constructor(private globalAgent: Dispatcher) { }
+    constructor(private globalAgent: Dispatcher) {
+        sessionManager.onDestroy((sessionId) => this.dropSession(sessionId));
+    }
+
+    private dropSession(sessionId: string) {
+        for (const [id, task] of tasks) {
+            if (task.sessionId === sessionId) tasks.delete(id);
+        }
+    }
 
     public getTasks(sessionId: string): DownloadTask[] {
         return Array.from(tasks.values()).filter(t => t.sessionId === sessionId);
@@ -40,15 +60,13 @@ export class DownloadManager {
     }
 
     public async queueDownload(sessionId: string, url: string): Promise<DownloadTask> {
+        const parsedUrl = assertDownloadableUrl(url);
         const id = randomUUID();
 
         // Try to determine filename
         let filename = "download.bin";
-        try {
+        const lastSegment = parsedUrl.pathname.split("/").pop();
-            const u = new URL(url);
+        if (lastSegment) filename = basename(lastSegment);
-            const p = u.pathname.split("/").pop();
-            if (p) filename = basename(p);
-        } catch { }
 
         const task: DownloadTask = {
             id,
@@ -87,7 +105,7 @@ export class DownloadManager {
                 headers: { "User-Agent": "Ephemeral-Downloader/2.0" }
             });
 
-            if (response.statusCode >= 400) {
+            if (response.statusCode >= 300) {
                 throw new Error(`HTTP Error ${response.statusCode}`);
             }
 
@@ -98,7 +116,7 @@ export class DownloadManager {
                 if (match?.[1]) {
                     // O header vem do host de origem: usar apenas o nome base evita
                     // caminho relativo (../) escrevendo fora do diretório da sessão.
-                    const headerName = basename(decodeURIComponent(match[1].replace(/"/g, "")));
+                    const headerName = basename(safeDecode(match[1].replace(/"/g, "")));
                     if (headerName) {
                         task.filename = headerName;
                     }

server/src/lib/SessionManager.ts

@@ -14,6 +14,10 @@ const STORAGE_ROOT = process.env.STORAGE_ROOT
     : resolve(SERVER_ROOT, "storage");
 const SESSION_TIMEOUT_MS = 60 * 60 * 1000; // 1 Hour
 
+// O id vem do header x-session-id e vira nome de diretório: aceitar só UUID
+// impede path traversal (por exemplo "..", que apagaria server/ na expiração).
+const SESSION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 type SessionData = {
     id: string;
     lastActive: number;
@@ -21,6 +25,7 @@ type SessionData = {
 
 export class SessionManager {
     private sessions: Map<string, SessionData> = new Map();
+    private destroyListeners: Array<(sessionId: string) => void> = [];
 
     constructor() {
         // Ensure storage root exists
@@ -29,7 +34,8 @@ export class SessionManager {
         }
 
         // Start Garbage Collector
-        setInterval(() => this.cleanup(), 60 * 1000); // Check every minute
+        // unref: o coletor não deve impedir o processo de encerrar (nem os testes).
+        setInterval(() => this.cleanup(), 60 * 1000).unref(); // Check every minute
         console.log("[SessionManager] Garbage Collector started.");
     }
 
@@ -39,6 +45,8 @@ export class SessionManager {
     public getSession(id?: string): SessionData {
         const now = Date.now();
 
+        if (id !== undefined && !SESSION_ID_PATTERN.test(id)) id = undefined;
+
         if (id && this.sessions.has(id)) {
             const session = this.sessions.get(id)!;
             session.lastActive = now;
@@ -89,6 +97,14 @@ export class SessionManager {
         }
     }
 
+    /**
+     * Registra um callback chamado quando uma sessão é destruída (expiração),
+     * para quem guarda estado por sessão poder descartá-lo.
+     */
+    public onDestroy(listener: (sessionId: string) => void) {
+        this.destroyListeners.push(listener);
+    }
+
     /**
      * Removes expired sessions and deletes their files.
      */
@@ -128,6 +144,7 @@ export class SessionManager {
 
     private destroySession(id: string) {
         this.sessions.delete(id);
+        for (const listener of this.destroyListeners) listener(id);
         const path = this.getSessionPath(id);
         if (existsSync(path)) {
             try {

server/src/lib/netGuard.ts

@@ -0,0 +1,164 @@
+import { lookup as dnsLookup } from "node:dns";
+import { isIP } from "node:net";
+import { buildConnector } from "undici";
+
+/**
+ * Proteção contra SSRF: o servidor baixa qualquer URL que o cliente enviar,
+ * então por padrão ele recusa endereços de loopback, rede privada, link-local
+ * (inclui o endpoint de metadados de nuvem 169.254.169.254) e similares.
+ *
+ * Para rodar o servidor numa rede privada e baixar de hosts internos de
+ * propósito, defina ALLOW_PRIVATE_NETWORK=true.
+ */
+
+export class UrlNotAllowedError extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = "UrlNotAllowedError";
+    }
+}
+
+const allowPrivateNetwork = () => process.env.ALLOW_PRIVATE_NETWORK === "true";
+
+function parseIPv4(ip: string): number[] | null {
+    const parts = ip.split(".").map(Number);
+    return parts.length === 4 && parts.every((n) => Number.isInteger(n) && n >= 0 && n <= 255)
+        ? parts
+        : null;
+}
+
+// Faixas IPv4 não públicas: [primeiro octeto, 2º octeto mín., 2º octeto máx.],
+// e o terceiro octeto só importa em 192.0.0.0/24.
+const BLOCKED_IPV4_RANGES: Array<[number, number, number]> = [
+    [0, 0, 255], // "esta rede"
+    [10, 0, 255], // privada
+    [127, 0, 255], // loopback
+    [100, 64, 127], // CGNAT
+    [169, 254, 254], // link-local / metadados de nuvem
+    [172, 16, 31], // privada
+    [192, 168, 168], // privada
+    [198, 18, 19], // benchmarking
+];
+
+function isBlockedIPv4([a, b, c]: number[]): boolean {
+    if (a >= 224) return true; // multicast, reservado e broadcast
+    if (a === 192 && b === 0 && c === 0) return true; // IETF protocol assignments
+    return BLOCKED_IPV4_RANGES.some(([first, min, max]) => a === first && b >= min && b <= max);
+}
+
+/** Troca um IPv4 embutido no fim ("::ffff:1.2.3.4") por dois grupos hexa. */
+function expandEmbeddedIPv4(text: string): string | null {
+    const embedded = text.match(/^(.*:)(\d+\.\d+\.\d+\.\d+)$/);
+    if (!embedded) return text;
+    const v4 = parseIPv4(embedded[2]);
+    if (!v4) return null;
+    return `${embedded[1]}${((v4[0] << 8) | v4[1]).toString(16)}:${((v4[2] << 8) | v4[3]).toString(16)}`;
+}
+
+/** Expande um IPv6 para 8 grupos de 16 bits (ou null se for inválido). */
+function parseIPv6(ip: string): number[] | null {
+    const text = expandEmbeddedIPv4(ip.split("%")[0].toLowerCase()); // remove zone id
+    if (text === null) return null;
+
+    const halves = text.split("::");
+    if (halves.length > 2) return null;
+    const head = halves[0] ? halves[0].split(":") : [];
+    const tail = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+    const missing = 8 - head.length - tail.length;
+    const compressed = halves.length === 2;
+    if (compressed ? missing < 1 : missing !== 0) return null;
+
+    const groups = [...head, ...Array(missing).fill("0"), ...tail].map((g) => parseInt(g, 16));
+    return groups.every((g) => g >= 0 && g <= 0xffff) ? groups : null;
+}
+
+function isReservedIPv6Prefix(first: number): boolean {
+    return (
+        (first & 0xfe00) === 0xfc00 || // fc00::/7 (unique local)
+        (first & 0xffc0) === 0xfe80 || // fe80::/10 (link-local)
+        (first & 0xff00) === 0xff00 // multicast
+    );
+}
+
+function isBlockedIPv6(ip: string): boolean {
+    const g = parseIPv6(ip);
+    if (!g) return true; // não conseguiu interpretar: recusa por segurança
+
+    const zeros = (from: number, to: number) => g.slice(from, to).every((x) => x === 0);
+    const embeddedV4 = [g[6] >> 8, g[6] & 0xff, g[7] >> 8, g[7] & 0xff];
+
+    if (zeros(0, 7) && g[7] <= 1) return true; // :: e ::1
+    if (zeros(0, 5) && g[5] === 0xffff) return isBlockedIPv4(embeddedV4); // ::ffff:a.b.c.d
+    if (g[0] === 0x64 && g[1] === 0xff9b && zeros(2, 6)) return isBlockedIPv4(embeddedV4); // NAT64
+    return isReservedIPv6Prefix(g[0]);
+}
+
+/** true se o endereço IP (v4 ou v6) pertence a uma faixa não pública. */
+export function isBlockedAddress(ip: string): boolean {
+    const family = isIP(ip);
+    if (family === 4) return isBlockedIPv4(parseIPv4(ip)!);
+    if (family === 6) return isBlockedIPv6(ip);
+    return true;
+}
+
+function isBlockedHostname(hostname: string): boolean {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (host === "localhost" || host.endsWith(".localhost")) return true;
+    return isIP(host) !== 0 && isBlockedAddress(host);
+}
+
+/**
+ * Valida a URL antes de enfileirar: só http/https e, a menos que
+ * ALLOW_PRIVATE_NETWORK=true, nada de localhost ou IP privado literal.
+ * Nomes de domínio que resolvem para IP privado são barrados na conexão.
+ */
+export function assertDownloadableUrl(rawUrl: string): URL {
+    let url: URL;
+    try {
+        url = new URL(rawUrl);
+    } catch {
+        throw new UrlNotAllowedError("Invalid URL");
+    }
+
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new UrlNotAllowedError("Only http and https URLs are allowed");
+    }
+    if (!allowPrivateNetwork() && isBlockedHostname(url.hostname)) {
+        throw new UrlNotAllowedError("URLs pointing to local or private addresses are not allowed");
+    }
+    return url;
+}
+
+/**
+ * Conector do undici que revalida o destino em cada conexão (inclusive nos
+ * redirects): IP literal é checado antes de conectar e nomes são checados no
+ * IP já resolvido, o que também cobre DNS rebinding.
+ */
+export function createGuardedConnector(options: buildConnector.BuildOptions): buildConnector.connector {
+    const connect = buildConnector({
+        ...options,
+        lookup: (hostname, lookupOptions, callback) => {
+            dnsLookup(hostname, lookupOptions, (err, address, family) => {
+                if (err) return callback(err, address as never, family as never);
+                const list = Array.isArray(address) ? address.map((a) => a.address) : [address];
+                const blocked = !allowPrivateNetwork() && list.some(isBlockedAddress);
+                if (blocked) {
+                    return callback(
+                        new UrlNotAllowedError(`${hostname} resolves to a local or private address`),
+                        address as never,
+                        family as never,
+                    );
+                }
+                callback(null, address as never, family as never);
+            });
+        },
+    } as buildConnector.BuildOptions);
+
+    return (opts, callback) => {
+        if (!allowPrivateNetwork() && isBlockedHostname(opts.hostname)) {
+            callback(new UrlNotAllowedError("Blocked local or private address"), null);
+            return;
+        }
+        connect(opts, callback);
+    };
+}

server/test/helpers.ts

@@ -0,0 +1,18 @@
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { vi } from "vitest";
+
+/**
+ * Carrega os módulos do servidor com um STORAGE_ROOT temporário.
+ * O SessionManager lê a variável e cria o singleton no import, então o módulo
+ * precisa ser reimportado a cada teste.
+ */
+export async function loadModules() {
+    const storageRoot = mkdtempSync(join(tmpdir(), "downloader-test-"));
+    process.env.STORAGE_ROOT = storageRoot;
+    vi.resetModules();
+    const { sessionManager } = await import("../src/lib/SessionManager.js");
+    const { DownloadManager } = await import("../src/lib/DownloadManager.js");
+    return { storageRoot, sessionManager, DownloadManager };
+}

server/test/netGuard.test.ts

@@ -0,0 +1,188 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { rmSync } from "node:fs";
+import { Agent, interceptors } from "undici";
+import {
+    UrlNotAllowedError,
+    assertDownloadableUrl,
+    createGuardedConnector,
+    isBlockedAddress,
+} from "../src/lib/netGuard.js";
+import { loadModules } from "./helpers.js";
+
+// Resolve "internal.test" para um IP privado e o resto para um público,
+// sem depender de DNS real.
+vi.mock("node:dns", () => ({
+    lookup: (
+        host: string,
+        opts: { all?: boolean },
+        cb: (err: Error | null, address: unknown, family?: number) => void,
+    ) => {
+        const address = host === "internal.test" ? "10.0.0.5" : "93.184.216.34";
+        if (opts?.all) cb(null, [{ address, family: 4 }]);
+        else cb(null, address, 4);
+    },
+}));
+
+afterEach(() => {
+    delete process.env.ALLOW_PRIVATE_NETWORK;
+});
+
+describe("isBlockedAddress", () => {
+    it.each([
+        "0.0.0.0", "10.1.2.3", "100.64.0.1", "127.0.0.1", "169.254.169.254",
+        "172.16.0.1", "172.31.255.255", "192.168.1.1", "198.18.0.1", "224.0.0.1",
+        "255.255.255.255", "::", "::1", "fc00::1", "fd12:3456::1", "fe80::1",
+        "ff02::1", "::ffff:127.0.0.1", "::ffff:7f00:1", "::ffff:10.0.0.1",
+        "64:ff9b::7f00:1",
+    ])("bloqueia %s", (ip) => {
+        expect(isBlockedAddress(ip)).toBe(true);
+    });
+
+    it.each([
+        "8.8.8.8", "1.1.1.1", "93.184.216.34", "172.15.0.1", "172.32.0.1",
+        "100.63.0.1", "198.20.0.1", "2606:4700:4700::1111", "::ffff:8.8.8.8",
+    ])("permite %s", (ip) => {
+        expect(isBlockedAddress(ip)).toBe(false);
+    });
+
+    it("bloqueia o que não é IP", () => {
+        expect(isBlockedAddress("example.com")).toBe(true);
+    });
+});
+
+describe("assertDownloadableUrl", () => {
+    it("aceita http e https públicos", () => {
+        expect(assertDownloadableUrl("https://example.com/a.zip").hostname).toBe("example.com");
+        expect(assertDownloadableUrl("http://8.8.8.8/a.zip").hostname).toBe("8.8.8.8");
+    });
+
+    it.each(["ftp://example.com/a", "file:///etc/passwd", "javascript:alert(1)"])(
+        "recusa o protocolo de %s",
+        (url) => {
+            expect(() => assertDownloadableUrl(url)).toThrow(/http and https/);
+        },
+    );
+
+    it("recusa URL inválida", () => {
+        expect(() => assertDownloadableUrl("not a url")).toThrow(UrlNotAllowedError);
+    });
+
+    it.each([
+        "http://localhost:3000/", "http://app.localhost/", "http://127.0.0.1/",
+        "http://[::1]/", "http://169.254.169.254/latest/meta-data/",
+        "http://10.0.0.1/", "http://192.168.0.10:8080/", "http://[::ffff:127.0.0.1]/",
+        "http://2130706433/", // 127.0.0.1 em decimal: o parser do WHATWG normaliza
+    ])("recusa %s", (url) => {
+        expect(() => assertDownloadableUrl(url)).toThrow(/local or private/);
+    });
+
+    it("libera endereços privados com ALLOW_PRIVATE_NETWORK=true", () => {
+        process.env.ALLOW_PRIVATE_NETWORK = "true";
+        expect(assertDownloadableUrl("http://127.0.0.1/").hostname).toBe("127.0.0.1");
+    });
+});
+
+describe("createGuardedConnector", () => {
+    const connect = (hostname: string) =>
+        new Promise<Error | null>((done) => {
+            const connector = createGuardedConnector({ timeout: 2000 });
+            connector({ hostname, host: hostname, protocol: "http:", port: "9" }, (err, socket) => {
+                socket?.destroy();
+                done(err);
+            });
+        });
+
+    it("recusa IP literal privado antes de conectar", async () => {
+        expect(await connect("127.0.0.1")).toBeInstanceOf(UrlNotAllowedError);
+    });
+
+    it("recusa nome que resolve para IP privado", async () => {
+        const err = await connect("internal.test");
+        expect(err).toBeInstanceOf(UrlNotAllowedError);
+        expect(err?.message).toMatch(/internal\.test resolves/);
+    });
+
+    it("deixa passar nome que resolve para IP público (falha só ao conectar)", async () => {
+        const err = await connect("public.test");
+        expect(err).not.toBeInstanceOf(UrlNotAllowedError);
+    });
+});
+
+describe("DownloadManager com a proteção", () => {
+    let origin: Server | undefined;
+
+    afterEach(async () => {
+        if (origin) await new Promise((done) => origin!.close(done));
+        origin = undefined;
+    });
+
+    async function startOrigin(handler: Parameters<typeof createServer>[1]) {
+        origin = createServer(handler);
+        await new Promise<void>((done) => origin!.listen(0, "127.0.0.1", done));
+        return (origin.address() as AddressInfo).port;
+    }
+
+    async function waitWhileDownloading(read: () => string | undefined) {
+        for (let i = 0; i < 500 && read() === "downloading"; i++) {
+            await new Promise((done) => setTimeout(done, 5));
+        }
+    }
+
+    it("recusa enfileirar URL privada", async () => {
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+        const session = sessionManager.getSession();
+        // loadModules() reimporta os módulos, então a classe não é a mesma: compara pelo nome.
+        await expect(manager.queueDownload(session.id, "http://127.0.0.1:1/x")).rejects.toMatchObject({
+            name: "UrlNotAllowedError",
+        });
+        expect(manager.getTasks(session.id)).toEqual([]);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it("segue redirect e salva o arquivo final, não o corpo do 302", async () => {
+        process.env.ALLOW_PRIVATE_NETWORK = "true";
+        const port = await startOrigin((req, res) => {
+            if (req.url === "/start") {
+                res.writeHead(302, { location: "/final.bin" });
+                res.end("redirecting");
+                return;
+            }
+            res.setHeader("content-length", "5");
+            res.end("hello");
+        });
+
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const agent = new Agent({ connect: createGuardedConnector({ timeout: 2000 }) }).compose(
+            interceptors.redirect({ maxRedirections: 5 }),
+        );
+        const manager = new DownloadManager(agent);
+        const session = sessionManager.getSession();
+        const task = await manager.queueDownload(session.id, `http://127.0.0.1:${port}/start`);
+        await waitWhileDownloading(() => manager.getTask(task.id)?.status);
+
+        const finished = manager.getTask(task.id)!;
+        expect(finished.status).toBe("completed");
+        expect(finished.totalBytes).toBe(5);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it("marca erro quando a resposta 3xx não é seguida", async () => {
+        process.env.ALLOW_PRIVATE_NETWORK = "true";
+        const port = await startOrigin((_req, res) => {
+            res.writeHead(302);
+            res.end("nope");
+        });
+
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+        const session = sessionManager.getSession();
+        const task = await manager.queueDownload(session.id, `http://127.0.0.1:${port}/`);
+        await waitWhileDownloading(() => manager.getTask(task.id)?.status);
+
+        expect(manager.getTask(task.id)).toMatchObject({ status: "error", error: "HTTP Error 302" });
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+});

server/test/sessions.test.ts

@@ -0,0 +1,106 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { sep } from "node:path";
+import { Agent } from "undici";
+import { loadModules } from "./helpers.js";
+
+const HOUR = 60 * 60 * 1000;
+
+let origin: Server;
+let originUrl: string;
+
+beforeEach(async () => {
+    process.env.ALLOW_PRIVATE_NETWORK = "true"; // a origem de teste está em 127.0.0.1
+    vi.useFakeTimers({ toFake: ["setInterval", "Date"] });
+    origin = createServer((_req, res) => {
+        res.setHeader("content-length", "5");
+        res.end("hello");
+    });
+    await new Promise<void>((done) => origin.listen(0, "127.0.0.1", done));
+    originUrl = `http://127.0.0.1:${(origin.address() as AddressInfo).port}/file.txt`;
+});
+
+afterEach(async () => {
+    delete process.env.ALLOW_PRIVATE_NETWORK;
+    vi.useRealTimers();
+    await new Promise((done) => origin.close(done));
+});
+
+async function waitForStatus(
+    read: () => string | undefined,
+    wanted: string,
+) {
+    for (let i = 0; i < 500 && read() !== wanted; i++) {
+        await new Promise((done) => setImmediate(done));
+    }
+    expect(read()).toBe(wanted);
+}
+
+describe("tasks e sessões", () => {
+    it("descarta as tasks e os arquivos quando a sessão expira", async () => {
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+
+        const session = sessionManager.getSession();
+        const task = await manager.queueDownload(session.id, originUrl);
+        await waitForStatus(() => manager.getTask(task.id)?.status, "completed");
+        expect(readdirSync(`${storageRoot}/${session.id}`)).toHaveLength(1);
+
+        vi.setSystemTime(Date.now() + HOUR + 1000);
+        vi.advanceTimersByTime(60_000); // dispara o coletor
+
+        expect(manager.getTask(task.id)).toBeUndefined();
+        expect(manager.getTasks(session.id)).toEqual([]);
+        expect(existsSync(`${storageRoot}/${session.id}`)).toBe(false);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it("mantém as tasks de outras sessões ainda ativas", async () => {
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+
+        const expiring = sessionManager.getSession();
+        await manager.queueDownload(expiring.id, originUrl);
+
+        vi.setSystemTime(Date.now() + HOUR - 1000);
+        const alive = sessionManager.getSession(); // criada perto do fim da outra
+        const kept = await manager.queueDownload(alive.id, originUrl);
+        vi.setSystemTime(Date.now() + 2000);
+        vi.advanceTimersByTime(60_000);
+
+        expect(manager.getTasks(expiring.id)).toEqual([]);
+        expect(manager.getTask(kept.id)).toBeDefined();
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+});
+
+describe("id de sessão", () => {
+    it("aceita um UUID já conhecido", async () => {
+        const { sessionManager, storageRoot } = await loadModules();
+        const first = sessionManager.getSession();
+        expect(sessionManager.getSession(first.id).id).toBe(first.id);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it.each(["..", ".", "../../etc", "a/b", "not-a-uuid", ""])(
+        "ignora o id inválido %j e cria outra sessão",
+        async (bad) => {
+            const { sessionManager, storageRoot } = await loadModules();
+            const session = sessionManager.getSession(bad);
+            expect(session.id).toMatch(/^[0-9a-f-]{36}$/);
+            expect(sessionManager.getSessionPath(session.id)).toBe(`${storageRoot}${sep}${session.id}`);
+            rmSync(storageRoot, { recursive: true, force: true });
+        },
+    );
+
+    it("não deixa um id '..' apagar a pasta pai quando expira", async () => {
+        const { sessionManager, storageRoot } = await loadModules();
+        sessionManager.getSession("..");
+        vi.setSystemTime(Date.now() + HOUR + 1000);
+        vi.advanceTimersByTime(60_000);
+        expect(existsSync(storageRoot)).toBe(true);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+});

web/README.md

@@ -1,73 +0,0 @@
-# React + TypeScript + Vite
-
-This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
-
-Currently, two official plugins are available:
-
-- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
-- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
-
-## React Compiler
-
-The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
-
-## Expanding the ESLint configuration
-
-If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
-
-```js
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-
-      // Remove tseslint.configs.recommended and replace with this
-      tseslint.configs.recommendedTypeChecked,
-      // Alternatively, use this for stricter rules
-      tseslint.configs.strictTypeChecked,
-      // Optionally, add this for stylistic rules
-      tseslint.configs.stylisticTypeChecked,
-
-      // Other configs...
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
-```
-
-You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
-
-```js
-// eslint.config.js
-import reactX from 'eslint-plugin-react-x'
-import reactDom from 'eslint-plugin-react-dom'
-
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-      // Enable lint rules for React
-      reactX.configs['recommended-typescript'],
-      // Enable lint rules for React DOM
-      reactDom.configs.recommended,
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
-```

web/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>web</title>
+    <title>Ephemeral Downloader</title>
   </head>
   <body>
     <div id="root"></div>

web/package.json

@@ -7,6 +7,8 @@
     "dev": "vite",
     "build": "tsc -b && vite build",
     "lint": "eslint .",
+    "test": "vitest run",
+    "typecheck": "tsc -b",
     "preview": "vite preview"
   },
   "dependencies": {
@@ -15,7 +17,6 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "tailwind-merge": "^3.4.0",
-    "uuid": "^13.0.0",
     "zod": "^3.25.76"
   },
   "devDependencies": {
@@ -34,6 +35,7 @@
     "tailwindcss": "^4.1.18",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.46.4",
-    "vite": "^7.2.4"
+    "vite": "^7.2.4",
+    "vitest": "^5.0.3"
   }
 }

web/src/App.css

@@ -1,290 +0,0 @@
-.app-root {
-  min-height: 100vh;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  padding: 2.5rem 1.5rem 3rem;
-  gap: 2.5rem;
-  background: radial-gradient(circle at top, #27272a 0, #09090b 45%, #020617 100%);
-}
-
-.app-header {
-  max-width: 640px;
-  text-align: center;
-}
-
-.app-header h1 {
-  font-size: 2rem;
-  margin-bottom: 0.5rem;
-}
-
-.app-header p {
-  font-size: 0.98rem;
-  color: #e4e4e7;
-}
-
-.app-header-meta {
-  margin-top: 0.5rem;
-  display: flex;
-  justify-content: center;
-  gap: 1rem;
-  flex-wrap: wrap;
-  font-size: 0.8rem;
-  color: #a1a1aa;
-}
-
-.app-main {
-  width: 100%;
-  display: flex;
-  justify-content: center;
-  align-items: flex-start;
-  gap: 2rem;
-  max-width: 1200px;
-  margin: 0 auto;
-}
-
-.download-form {
-  width: 100%;
-  max-width: 560px;
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-  padding: 1.5rem 1.75rem;
-  border-radius: 1rem;
-  border: 1px solid rgba(63, 63, 70, 0.9);
-  background: radial-gradient(circle at top left, #18181b 0, #020617 60%);
-  box-shadow:
-    0 18px 40px rgba(0, 0, 0, 0.7),
-    0 0 0 1px rgba(24, 24, 27, 0.9);
-}
-
-.field-label {
-  font-size: 0.9rem;
-  font-weight: 500;
-}
-
-.field-helper {
-  font-size: 0.78rem;
-  color: #a1a1aa;
-  margin-top: -0.1rem;
-}
-
-.url-input {
-  padding: 0.75rem 0.9rem;
-  border-radius: 0.5rem;
-  border: 1px solid #27272a;
-  background-color: #09090b;
-  color: #f4f4f5;
-  font-size: 0.95rem;
-  resize: vertical;
-}
-
-.url-input--multiline {
-  line-height: 1.4;
-}
-
-.url-input:focus {
-  outline: 2px solid #4f46e5;
-  outline-offset: 1px;
-  border-color: transparent;
-}
-
-.primary-button {
-  margin-top: 0.5rem;
-  padding: 0.75rem 1rem;
-  border-radius: 0.5rem;
-  border: none;
-  background: #4f46e5;
-  color: #f9fafb;
-  font-weight: 600;
-  font-size: 0.95rem;
-  cursor: pointer;
-  transition: background 180ms ease-out, transform 160ms ease-out;
-}
-
-.primary-button:hover {
-  background: #4338ca;
-}
-
-.primary-button:active {
-  transform: translateY(1px) scale(0.99);
-}
-
-.primary-button:focus-visible {
-  outline: 2px solid #a5b4fc;
-  outline-offset: 2px;
-}
-
-.error-text {
-  font-size: 0.85rem;
-  color: #f97373;
-}
-
-.downloads-section {
-  width: 100%;
-  max-width: 620px;
-  margin-top: 0;
-  padding: 1.25rem 1.5rem;
-  border-radius: 1rem;
-  border: 1px solid rgba(63, 63, 70, 0.9);
-  background-color: rgba(9, 9, 11, 0.9);
-  backdrop-filter: blur(14px);
-}
-
-.downloads-title {
-  font-size: 1rem;
-  margin-bottom: 0.5rem;
-}
-
-.downloads-empty {
-  margin-top: 0.5rem;
-  font-size: 0.85rem;
-  color: #a1a1aa;
-}
-
-.downloads-list {
-  list-style: none;
-  padding: 0;
-  margin: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-}
-
-.download-item {
-  padding: 0.6rem 0.1rem 0.7rem;
-  border-bottom: 1px solid rgba(39, 39, 42, 0.8);
-}
-
-.download-item:last-of-type {
-  border-bottom: none;
-}
-
-.download-main {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  gap: 0.75rem;
-  margin-bottom: 0.35rem;
-}
-
-.download-url {
-  font-size: 0.8rem;
-  color: #e5e5e5;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.badge {
-  padding: 0.2rem 0.55rem;
-  border-radius: 999px;
-  font-size: 0.7rem;
-  font-weight: 500;
-}
-
-.badge--pending {
-  background-color: rgba(39, 39, 42, 0.9);
-  color: #e5e5e5;
-}
-
-.badge--downloading {
-  background-color: rgba(37, 99, 235, 0.18);
-  color: #bfdbfe;
-}
-
-.badge--completed {
-  background-color: rgba(22, 163, 74, 0.25);
-  color: #bbf7d0;
-}
-
-.badge--error {
-  background-color: rgba(239, 68, 68, 0.18);
-  color: #fecaca;
-}
-
-.progress-wrapper {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.progress-bar {
-  flex: 1;
-  height: 0.4rem;
-  border-radius: 999px;
-  background-color: #18181b;
-  overflow: hidden;
-}
-
-.progress-bar__fill {
-  height: 100%;
-  border-radius: inherit;
-  background: linear-gradient(to right, #4f46e5, #22c55e);
-  transition: width 160ms ease-out;
-}
-
-.progress-label {
-  font-size: 0.75rem;
-  color: #e4e4e7;
-  width: 3ch;
-  text-align: right;
-}
-
-.download-error {
-  margin-top: 0.1rem;
-  font-size: 0.78rem;
-  color: #fecaca;
-}
-
-.download-meta {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.4rem;
-  margin-top: 0.25rem;
-  font-size: 0.8rem;
-  color: #d4d4d8;
-}
-
-.download-footer {
-  margin-top: 0.35rem;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem;
-}
-
-.secondary-button {
-  padding: 0.35rem 0.75rem;
-  border-radius: 999px;
-  border: 1px solid #3f3f46;
-  background-color: transparent;
-  color: #e4e4e7;
-  font-size: 0.78rem;
-  font-weight: 500;
-  cursor: pointer;
-  transition:
-    background-color 160ms ease-out,
-    border-color 160ms ease-out,
-    transform 120ms ease-out;
-}
-
-.secondary-button:hover {
-  background-color: rgba(63, 63, 70, 0.4);
-  border-color: #71717a;
-}
-
-.secondary-button:active {
-  transform: translateY(1px) scale(0.99);
-}
-
-@media (min-width: 768px) {
-  .app-header h1 {
-    font-size: 2.25rem;
-  }
-
-  .download-form {
-    padding: 1.75rem 2rem;
-  }
-}

web/src/App.tsx

@@ -1,4 +1,3 @@
-import "./App.css";
 import { DownloadForm } from "./components/feature/DownloadForm";
 import { DownloadItem } from "./components/feature/DownloadItem";
 import { Layout } from "./components/ui/Layout";
@@ -36,14 +35,6 @@ function DownloadList() {
 function Main() {
   const { queueDownload } = useSession();
 
-  const handleDownload = async (url: string) => {
-    try {
-      await queueDownload(url);
-    } catch (error) {
-      console.error("Failed to queue", error);
-    }
-  };
-
   return (
     <Layout>
       <div className="grid gap-8 lg:grid-cols-12">
@@ -57,7 +48,7 @@ function Main() {
                   Paste a link to start. Files are downloaded to the server first.
                 </p>
               </div>
-              <DownloadForm onDownload={handleDownload} />
+              <DownloadForm onDownload={queueDownload} />
             </section>
 
             <Alert variant="destructive">

web/src/assets/react.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>

web/src/components/feature/DownloadForm.tsx

@@ -9,14 +9,15 @@ const formSchema = z.object({
 });
 
 interface DownloadFormProps {
-    onDownload: (url: string) => void;
+    onDownload: (url: string) => Promise<void>;
 }
 
 export function DownloadForm({ onDownload }: DownloadFormProps) {
     const [url, setUrl] = useState("");
     const [error, setError] = useState<string | null>(null);
+    const [submitting, setSubmitting] = useState(false);
 
-    const handleSubmit = (e: React.FormEvent) => {
+    const handleSubmit = async (e: React.FormEvent) => {
         e.preventDefault();
         setError(null);
 
@@ -27,8 +28,15 @@ export function DownloadForm({ onDownload }: DownloadFormProps) {
             return;
         }
 
-        onDownload(url);
+        setSubmitting(true);
-        setUrl("");
+        try {
+            await onDownload(url);
+            setUrl("");
+        } catch (err) {
+            setError(err instanceof Error ? err.message : "Failed to queue download");
+        } finally {
+            setSubmitting(false);
+        }
     };
 
     return (
@@ -37,14 +45,21 @@ export function DownloadForm({ onDownload }: DownloadFormProps) {
                 <div className="flex-1 space-y-1">
                     <Input
                         type="url"
+                        aria-label="File URL"
+                        aria-invalid={error ? true : undefined}
+                        aria-describedby={error ? "url-error" : undefined}
                         placeholder="https://example.com/file.zip"
                         value={url}
                         onChange={(e) => setUrl(e.target.value)}
                         className={error ? "border-destructive focus-visible:ring-destructive" : ""}
                     />
-                    {error && <p className="text-xs text-destructive">{error}</p>}
+                    {error && (
+                        <p id="url-error" role="alert" className="text-xs text-destructive">
+                            {error}
+                        </p>
+                    )}
                 </div>
-                <Button type="submit">
+                <Button type="submit" disabled={submitting}>
                     <Download className="mr-2 h-4 w-4" />
                     Download
                 </Button>

web/src/components/feature/DownloadItem.test.tsx

@@ -0,0 +1,109 @@
+import { describe, expect, it } from "vitest";
+import { renderToStaticMarkup } from "react-dom/server";
+import { DownloadItem, type DownloadItemData } from "./DownloadItem";
+
+const base: DownloadItemData = {
+    id: "t1",
+    sessionId: "s1",
+    url: "https://example.com/file.zip",
+    filename: "file.zip",
+    status: "downloading",
+    progress: 40,
+    totalBytes: 10 * 1024 * 1024,
+    receivedBytes: 4 * 1024 * 1024,
+    speed: 2 * 1024 * 1024,
+    createdAt: 0,
+};
+
+const render = (patch: Partial<DownloadItemData> = {}) =>
+    renderToStaticMarkup(<DownloadItem item={{ ...base, ...patch }} />);
+
+describe("DownloadItem", () => {
+    describe("em andamento (caminho principal)", () => {
+        const html = render();
+
+        it("mostra status, bytes, velocidade e porcentagem", () => {
+            expect(html).toContain("downloading");
+            expect(html).toContain("4.0 MB");
+            expect(html).toContain("10.0 MB");
+            expect(html).toContain("2.00 MB/s");
+            expect(html).toContain("40%");
+        });
+
+        it("usa o spinner e não mostra botão nem erro", () => {
+            expect(html).toContain("animate-spin");
+            expect(html).not.toContain("Save to Disk");
+            expect(html).not.toContain("Ready for download");
+        });
+    });
+
+    describe("status queued", () => {
+        it("mostra a mensagem de fila e o ícone pulsante", () => {
+            const html = render({ status: "queued" });
+            expect(html).toContain("Queued on server...");
+            expect(html).toContain("animate-pulse");
+            expect(html).not.toContain("animate-spin");
+        });
+    });
+
+    describe("status completed", () => {
+        const html = render({ status: "completed", progress: 100 });
+
+        it("mostra o botão de salvar e o tamanho final", () => {
+            expect(html).toContain("Save to Disk");
+            expect(html).toContain("Ready for download (10.0 MB)");
+        });
+
+        it("esconde a seção de progresso", () => {
+            expect(html).not.toContain("MB/s");
+            expect(html).not.toContain("100%");
+        });
+    });
+
+    describe("status error", () => {
+        it("mostra a mensagem de erro da task", () => {
+            const html = render({ status: "error", error: "HTTP Error 404" });
+            expect(html).toContain("HTTP Error 404");
+            expect(html).not.toContain("Save to Disk");
+            expect(html).not.toContain("MB/s");
+        });
+
+        it("usa a mensagem padrão sem detalhe de erro", () => {
+            expect(render({ status: "error" })).toContain("Unknown error occurred");
+        });
+    });
+
+    describe("título", () => {
+        it("usa o nome do arquivo", () => {
+            expect(render()).toContain('title="file.zip"');
+        });
+
+        it("cai para a URL quando não há nome do arquivo", () => {
+            expect(render({ filename: "" })).toContain(
+                'title="https://example.com/file.zip"'
+            );
+        });
+    });
+
+    describe("valores zerados durante o download", () => {
+        it("tamanho total desconhecido mostra ??", () => {
+            expect(render({ totalBytes: 0 })).toContain("??");
+        });
+
+        it("sem velocidade mostra 0 B/s", () => {
+            expect(render({ speed: 0 })).toContain("0 B/s");
+        });
+
+        it("sem progresso mostra 0%", () => {
+            expect(render({ progress: 0 })).toContain(">0%<");
+        });
+
+        it("sem bytes recebidos mostra hífen", () => {
+            expect(render({ receivedBytes: 0 })).toContain("- / 10.0 MB");
+        });
+
+        it("arredonda a porcentagem", () => {
+            expect(render({ progress: 40.6 })).toContain("41%");
+        });
+    });
+});

web/src/components/feature/DownloadItem.tsx

@@ -1,3 +1,4 @@
+import type { ReactNode } from "react";
 import {
     FileCheck,
     FileWarning,
@@ -34,59 +35,91 @@ interface DownloadItemProps {
     item: DownloadItemData;
 }
 
+const ICON_BOX = "flex h-10 w-10 items-center justify-center rounded-full";
+
+const STATUS_ICON: Record<DownloadStatus, { box: string; icon: ReactNode }> = {
+    completed: { box: "bg-green-500/10 text-green-500", icon: <FileCheck className="h-5 w-5" /> },
+    error: { box: "bg-destructive/10 text-destructive", icon: <FileWarning className="h-5 w-5" /> },
+    queued: {
+        box: "bg-secondary text-secondary-foreground",
+        icon: <Server className="h-5 w-5 animate-pulse" />,
+    },
+    downloading: { box: "bg-primary/10 text-primary", icon: <Loader2 className="h-5 w-5 animate-spin" /> },
+};
+
+function StatusIcon({ status }: { status: DownloadStatus }) {
+    const { box, icon } = STATUS_ICON[status];
+    return <div className={`${ICON_BOX} ${box}`}>{icon}</div>;
+}
+
+function ProgressSection({ item }: { item: DownloadItemData }) {
+    const total = item.totalBytes ? formatBytes(item.totalBytes) : "??";
+
+    return (
+        <div className="space-y-2 pt-2">
+            <div className="flex justify-between text-xs text-muted-foreground">
+                <span>{item.status === "queued" ? "Queued on server..." : item.status}</span>
+                <span>{formatBytes(item.receivedBytes || 0)} / {total}</span>
+            </div>
+            <Progress value={item.progress || 0} className="h-1.5" />
+            <div className="flex justify-between text-xs text-muted-foreground">
+                <span>{item.speed ? formatSpeed(item.speed) : "0 B/s"}</span>
+                <span>{item.progress ? `${Math.round(item.progress)}%` : "0%"}</span>
+            </div>
+        </div>
+    );
+}
+
+function StatusDetails({ item }: { item: DownloadItemData }) {
+    if (item.status === "completed") {
+        return (
+            <div className="pt-2 flex items-center gap-2 text-xs text-green-500">
+                <FileCheck className="w-3 h-3" />
+                <span>Ready for download ({formatBytes(item.totalBytes)})</span>
+            </div>
+        );
+    }
+
+    if (item.status === "error") {
+        return (
+            <div className="text-sm text-destructive pt-1">
+                {item.error || "Unknown error occurred"}
+            </div>
+        );
+    }
+
+    return <ProgressSection item={item} />;
+}
+
+async function saveToDisk(item: DownloadItemData) {
+    try {
+        const sessionId = localStorage.getItem("downloader_session_id") || "";
+        const res = await fetch(`${API_URL}/api/download/${item.id}`, {
+            headers: { "x-session-id": sessionId }
+        });
+        if (!res.ok) throw new Error("Download failed");
+
+        const blob = await res.blob();
+        const url = window.URL.createObjectURL(blob);
+        const a = document.createElement("a");
+        a.href = url;
+        a.download = item.filename;
+        document.body.appendChild(a);
+        a.click();
+        window.URL.revokeObjectURL(url);
+        document.body.removeChild(a);
+    } catch {
+        alert("Failed to download file");
+    }
+}
+
 export function DownloadItem({ item }: DownloadItemProps) {
-    const isCompleted = item.status === "completed";
-    const isError = item.status === "error";
-    const isQueued = item.status === "queued";
-
-    const handleDownloadFile = () => {
-        const download = async () => {
-            try {
-                const sessionId = localStorage.getItem("downloader_session_id") || "";
-                const res = await fetch(`${API_URL}/api/download/${item.id}`, {
-                    headers: { "x-session-id": sessionId }
-                });
-                if (!res.ok) throw new Error("Download failed");
-
-                const blob = await res.blob();
-                const url = window.URL.createObjectURL(blob);
-                const a = document.createElement("a");
-                a.href = url;
-                a.download = item.filename;
-                document.body.appendChild(a);
-                a.click();
-                window.URL.revokeObjectURL(url);
-                document.body.removeChild(a);
-            } catch {
-                alert("Failed to download file");
-            }
-        };
-
-        download();
-    };
-
     return (
         <Card className="overflow-hidden transition-all hover:bg-muted/50">
             <CardContent className="p-4">
                 <div className="flex items-start gap-4">
                     <div className="mt-1">
-                        {isCompleted ? (
+                        <StatusIcon status={item.status} />
-                            <div className="flex h-10 w-10 items-center justify-center rounded-full bg-green-500/10 text-green-500">
-                                <FileCheck className="h-5 w-5" />
-                            </div>
-                        ) : isError ? (
-                            <div className="flex h-10 w-10 items-center justify-center rounded-full bg-destructive/10 text-destructive">
-                                <FileWarning className="h-5 w-5" />
-                            </div>
-                        ) : isQueued ? (
-                            <div className="flex h-10 w-10 items-center justify-center rounded-full bg-secondary text-secondary-foreground">
-                                <Server className="h-5 w-5 animate-pulse" />
-                            </div>
-                        ) : (
-                            <div className="flex h-10 w-10 items-center justify-center rounded-full bg-primary/10 text-primary">
-                                <Loader2 className="h-5 w-5 animate-spin" />
-                            </div>
-                        )}
                     </div>
 
                     <div className="flex-1 space-y-1 min-w-0">
@@ -99,41 +132,15 @@ export function DownloadItem({ item }: DownloadItemProps) {
                                     {item.url}
                                 </p>
                             </div>
-                            {isCompleted && (
+                            {item.status === "completed" && (
-                                <Button size="sm" onClick={handleDownloadFile} className="shrink-0 gap-2">
+                                <Button size="sm" onClick={() => saveToDisk(item)} className="shrink-0 gap-2">
                                     <HardDrive className="w-4 h-4" />
                                     Save to Disk
                                 </Button>
                             )}
                         </div>
 
-                        {/* Progress Section */}
+                        <StatusDetails item={item} />
-                        {!isCompleted && !isError && (
-                            <div className="space-y-2 pt-2">
-                                <div className="flex justify-between text-xs text-muted-foreground">
-                                    <span>{isQueued ? "Queued on server..." : item.status}</span>
-                                    <span>{formatBytes(item.receivedBytes || 0)} / {item.totalBytes ? formatBytes(item.totalBytes) : "??"}</span>
-                                </div>
-                                <Progress value={item.progress || 0} className="h-1.5" />
-                                <div className="flex justify-between text-xs text-muted-foreground">
-                                    <span>{item.speed ? formatSpeed(item.speed) : "0 B/s"}</span>
-                                    <span>{item.progress ? `${Math.round(item.progress)}%` : "0%"}</span>
-                                </div>
-                            </div>
-                        )}
-
-                        {isCompleted && (
-                            <div className="pt-2 flex items-center gap-2 text-xs text-green-500">
-                                <FileCheck className="w-3 h-3" />
-                                <span>Ready for download ({formatBytes(item.totalBytes)})</span>
-                            </div>
-                        )}
-
-                        {isError && (
-                            <div className="text-sm text-destructive pt-1">
-                                {item.error || "Unknown error occurred"}
-                            </div>
-                        )}
                     </div>
                 </div>
             </CardContent>

web/src/components/ui/ProgressBar.tsx

@@ -14,6 +14,10 @@ const Progress = React.forwardRef<HTMLDivElement, ProgressProps>(
         return (
             <div
                 ref={ref}
+                role="progressbar"
+                aria-valuemin={0}
+                aria-valuemax={max}
+                aria-valuenow={percent}
                 className={cn(
                     "relative h-2 w-full overflow-hidden rounded-full bg-secondary",
                     className

web/src/components/ui/Textarea.tsx

@@ -1,22 +0,0 @@
-import * as React from "react";
-import { cn } from "../../lib/utils";
-
-export type TextareaProps = React.TextareaHTMLAttributes<HTMLTextAreaElement>;
-
-const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
-    ({ className, ...props }, ref) => {
-        return (
-            <textarea
-                className={cn(
-                    "flex min-h-[80px] w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
-                    className
-                )}
-                ref={ref}
-                {...props}
-            />
-        );
-    }
-);
-Textarea.displayName = "Textarea";
-
-export { Textarea };

web/src/context/SessionContext.tsx

@@ -1,4 +1,4 @@
-import React, { createContext, useContext, useEffect, useState } from "react";
+import React, { createContext, useCallback, useContext, useEffect, useState } from "react";
 
 type SessionData = {
     sessionId: string;
@@ -63,7 +63,7 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
     }, [sessionId]);
 
     // Poll Tasks
-    const refreshTasks = async () => {
+    const refreshTasks = useCallback(async () => {
         if (!sessionId) return;
         try {
             const res = await fetch(`${API_URL}/api/tasks`, {
@@ -76,7 +76,7 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
         } catch (err) {
             console.error("Failed to fetch tasks", err);
         }
-    };
+    }, [sessionId]);
 
     useEffect(() => {
         if (!sessionId) return;
@@ -87,10 +87,10 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
         // Poll every 2 seconds
         const interval = setInterval(refreshTasks, 2000);
         return () => clearInterval(interval);
-    }, [sessionId]);
+    }, [sessionId, refreshTasks]);
 
     const queueDownload = async (url: string) => {
-        if (!sessionId) return;
+        if (!sessionId) throw new Error("Session not ready, try again in a moment");
         try {
             const res = await fetch(`${API_URL}/api/queue`, {
                 method: "POST",
@@ -101,7 +101,10 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
                 body: JSON.stringify({ url }),
             });
 
-            if (!res.ok) throw new Error("Failed to queue download");
+            if (!res.ok) {
+                const body = (await res.json().catch(() => null)) as { error?: string } | null;
+                throw new Error(body?.error || "Failed to queue download");
+            }
 
             await refreshTasks(); // Immediate refresh
 

web/src/index.css

@@ -45,7 +45,7 @@
     --accent: 217.2 32.6% 17.5%;
     --accent-foreground: 210 40% 98%;
 
-    --destructive: 0 62.8% 30.6%;
+    --destructive: 0 72% 54%;
     --destructive-foreground: 210 40% 98%;
 
     --border: 217.2 32.6% 17.5%;