wip: snapshot das alterações não commitadas (2026-10-20)

Origem: D:/Documents/Github/Downloader
Arquivos omitidos (segredos, bancos de dados, logs, >50 MB): 0

.claude/settings.local.json

@@ -0,0 +1,9 @@
+{
+  "permissions": {
+    "allow": [
+      "mcp__plugin_context-mode_context-mode__ctx_batch_execute",
+      "mcp__context-mode__ctx_batch_execute",
+      "mcp__context-mode__ctx_execute_file"
+    ]
+  }
+}

.github/workflows/ci.yml

@@ -1,27 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 12.8.1
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm typecheck
-      - run: pnpm lint
-      - run: pnpm test
-      - run: pnpm build

.gitignore

@@ -5,9 +5,6 @@ build/
 coverage/
 .npm/
 
-# Arquivos baixados pelas sessoes do Ephemeral Downloader
-server/storage/
-
 # Environment
 .env
 .env.local

.graphifyignore

@@ -0,0 +1,21 @@
+node_modules/
+.next/
+dist/
+build/
+out/
+coverage/
+.git/
+.pnpm-store/
+.cache/
+*.log
+.env
+.env.*
+__pycache__/
+*.pyc
+.venv/
+venv/
+target/
+*.exe
+*.dll
+*.so
+*.dylib

.openclaude-profile.json

@@ -0,0 +1,9 @@
+{
+  "profile": "codex",
+  "env": {
+    "OPENAI_BASE_URL": "https://chatgpt.com/backend-api/codex",
+    "OPENAI_MODEL": "codexplan",
+    "CHATGPT_ACCOUNT_ID": "6dbec33c-c751-4383-b112-bfc776f39ed7"
+  },
+  "createdAt": "2026-04-05T18:55:08.995Z"
+}

README.md

@@ -1,157 +1,153 @@
-# Ephemeral Downloader
+## Ephemeral Downloader
 
-**Proxy de download efêmero: a sua VPS baixa o arquivo por uma rota melhor e entrega para o seu navegador, com os arquivos apagados automaticamente depois.**
+Um proxy de download efêmero para você usar a **sua VPS como ponte de alta velocidade** entre servidores lentos e a sua máquina local.
 
-[![CI](https://github.com/evandrodevbr/Downloader/actions/workflows/ci.yml/badge.svg)](https://github.com/evandrodevbr/Downloader/actions/workflows/ci.yml)
-![Node](https://img.shields.io/badge/Node-%3E%3D20.19-5FA04E?logo=nodedotjs&logoColor=white)
-![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)
-![Fastify](https://img.shields.io/badge/Fastify-5-000000?logo=fastify&logoColor=white)
-![React](https://img.shields.io/badge/React-19-61DAFB?logo=react&logoColor=black)
-![Vite](https://img.shields.io/badge/Vite-7-646CFF?logo=vite&logoColor=white)
-![pnpm](https://img.shields.io/badge/pnpm-9%2B-F69220?logo=pnpm&logoColor=white)
+Em vez de baixar direto de um host congestionado, você aponta o link para o Ephemeral Downloader, que:
 
-## Sobre
+- Faz o download via VPS (geralmente com rota/peering melhor).
+- Transmite o arquivo por **streaming** para o seu navegador.
+- Libera os recursos assim que o download termina.
 
-Baixar um arquivo grande direto de um host congestionado costuma ser lento, e muitas vezes o gargalo não é a sua internet nem o servidor de origem, e sim o caminho entre eles. O Ephemeral Downloader coloca a sua VPS no meio: o servidor faz o download (normalmente com peering melhor), mostra o progresso em tempo real e entrega o arquivo para você pelo navegador.
+Simples, focado e pensado para quem vive baixando ISOs, ROMs e arquivos grandes.
 
-O projeto é focado em uso efêmero. O arquivo fica em um diretório temporário da sessão no servidor e é apagado quando a sessão expira (1 hora sem interação). Não é um proxy de streaming puro: o download passa pelo disco do servidor antes de chegar até você.
+---
 
-## Como funciona
+## Como funciona (visão rápida)
 
-```
-navegador (React + Vite)
-   │  POST /api/queue {url}                 GET /api/tasks (polling de 2 s)
-   ▼                                                   ▲
-Fastify (server/)  ──undici GET──▶  host de origem      │
-   │                                                   │
-   ▼                                                   │
-server/storage/<id-da-sessao>/<task>_<arquivo> ────────┘
-   ▲
-   │  GET /api/download/:taskId (arquivo concluído)
-navegador
-```
+- **Frontend (React + Vite)**
 
-- `POST /api/queue` enfileira a URL e o backend baixa com `undici`, gravando em `server/storage/<id-da-sessão>/` por um pipeline (respeita backpressure e só marca a task como concluída depois do arquivo em disco).
-- O frontend faz polling de `GET /api/tasks` a cada 2 segundos e mostra status, progresso, bytes recebidos, total e velocidade em MB/s e Mbps.
-- Quando a task conclui, o botão "Save to Disk" busca `GET /api/download/:taskId` e salva o arquivo.
-- Em produção o próprio Fastify serve o build do Vite na raiz, com fallback da SPA.
-- `GET /stream` é o proxy antigo, mantido apenas respondendo 410 (descontinuado).
+  - Interface SPA com campo de texto para múltiplos links (um por linha).
+  - Lista de downloads recentes com:
+    - Progresso em tempo real.
+    - Tamanho total e já baixado.
+    - Velocidade em **MB/s** e **Mbps**.
+    - Botão para **retomar downloads** que falharam dentro da mesma sessão.
 
-## Stack
+- **Backend (Fastify + Streams)**
+  - Rota `GET /stream?url=...&offset=...` que:
+    - Faz `HEAD` na origem para validar o link e obter `Content-Length`.
+    - Faz `GET` (ou `Range: bytes=offset-` para retomada).
+    - Faz o **streaming direto** para o cliente, sem guardar arquivo em disco.
+  - Em produção, também serve o build do frontend (Vite) na própria porta do servidor.
 
-| Camada | Escolha |
-|---|---|
-| Runtime | Node.js 20.19 ou superior |
-| Backend | Fastify 5, undici 7 (cliente HTTP), zod (validação) |
-| Frontend | React 19, Vite 7, Tailwind CSS 4, lucide-react |
-| Linguagem | TypeScript 5.9 |
-| Monorepo | pnpm workspaces (`server` e `web`) |
-| Deploy | nixpacks (`nixpacks.toml`) |
+---
 
 ## Requisitos
 
-- Node.js 20.19 ou superior para rodar e fazer o build (exigência do Vite 7 e do undici 7). Para rodar os testes (vitest 5) use Node 22.12 ou superior.
-- pnpm 9 ou superior (verificado no pnpm 12.8.1 com Node 26.7.0; o lockfile é o formato 9.0)
-- Portas livres: backend (padrão 3000) e Vite (5173) em desenvolvimento
+- Node.js **>= 20**
+- `pnpm` **>= 8**
 
-Observação sobre pnpm: a seção `overrides` do `pnpm-workspace.yaml` (fastify e undici com versão mínima de segurança) só é aplicada pelo pnpm 10 ou superior. Com pnpm 9 ela é ignorada.
+---
 
-## Início rápido
+## Instalação
+
+Clone o repositório e instale as dependências:
 
 ```bash
+git clone <seu-fork-ou-repo> Downloader
+cd Downloader
 pnpm install
+```
 
-# desenvolvimento: Fastify (3000) + Vite (5173) juntos
+---
+
+## Scripts principais
+
+Na raiz do projeto:
+
+- **Desenvolvimento (backend + frontend juntos)**:
+
+```bash
 pnpm dev
-# abra http://localhost:5173
 ```
 
-Em desenvolvimento o Vite encaminha `/api` para o backend (proxy configurado em `web/vite.config.ts`), então não é preciso arquivo `.env`. Se a porta 3000 estiver ocupada:
+Isso sobe:
+
+- Fastify em `http://localhost:3000`
+- Vite em `http://localhost:5173`
+
+- **Build de produção (server + web)**:
 
 ```bash
-PORT=3100 VITE_API_PROXY=http://localhost:3100 pnpm dev
-```
-
-## Uso
-
-1. Cole a URL direta (http ou https) de um arquivo e clique em **Download**.
-2. A lista de downloads mostra status, progresso, tamanho e velocidade, atualizada a cada 2 segundos.
-3. Quando o download conclui, use **Save to Disk** para salvar o arquivo na sua máquina.
-4. A sessão dura 1 hora de inatividade (o contador reinicia a cada interação) e depois os arquivos são apagados do servidor.
-
-## API
-
-| Método | Rota | O que faz |
-|---|---|---|
-| GET | `/health` | Devolve `{"status":"ok"}`. |
-| GET | `/` | Serve a SPA (build do Vite). |
-| GET | `/api/session` | Cria ou recupera a sessão e devolve `sessionId`, `expiresAt` e `remainingMs`. O id também vem no header `x-session-id`. |
-| POST | `/api/queue` | Corpo `{"url":"https://..."}`. Enfileira e inicia o download, devolvendo a task criada. |
-| GET | `/api/tasks` | Lista as tasks da sessão (usado no polling da interface). |
-| GET | `/api/download/:taskId` | Entrega o arquivo concluído da task. |
-| GET | `/stream` | Descontinuado: responde 410. |
-
-A sessão é identificada pelo header `x-session-id` (a interface guarda o id em `localStorage`). Erros observados: 400 para URL inválida (`{"error":"Invalid URL"}`), com protocolo que não seja http/https, apontando para endereço local ou privado, ou para download não pronto; 403 para task de outra sessão e 404 para task inexistente. Se a origem falhar (por exemplo, 404 no host de origem), a task fica com `status: "error"` e a mensagem em `error`. O servidor segue até 5 redirects; um nome de domínio que resolva para IP privado também faz a task terminar em erro.
-
-## Produção
-
-```bash
-pnpm build            # server: tsc | web: tsc -b && vite build
-PORT=3000 pnpm start  # node server/dist/index.js: API + build do front na mesma porta
-```
-
-O `nixpacks.toml` descreve esse fluxo: build em `pnpm install --frozen-lockfile && pnpm build` e start em `pnpm start`.
-
-## Configuração
-
-| Variável | Onde | Padrão | O que faz |
-|---|---|---|---|
-| `PORT` | backend | `3000` | Porta do Fastify. |
-| `STORAGE_ROOT` | backend | `server/storage` | Diretório onde ficam os arquivos das sessões. |
-| `ALLOW_PRIVATE_NETWORK` | backend | desligado | Com `true`, permite baixar de `localhost` e de endereços de rede privada. Por padrão o servidor recusa esses destinos (proteção contra SSRF). |
-| `VITE_API_URL` | frontend | mesma origem | Host da API, se for diferente do que serve o front. |
-| `VITE_API_PROXY` | frontend (dev) | `http://localhost:3000` | Alvo do proxy de `/api` no Vite. |
-
-## Estrutura do projeto
-
-```
-server/                 backend Fastify
-├── src/index.ts            rotas (/health, /api/*), CORS e static do front
-├── src/lib/
-│   ├── DownloadManager.ts  download da origem com undici e gravação na sessão
-│   ├── SessionManager.ts   sessões, expiração (1 h) e limpeza dos arquivos
-│   └── netGuard.ts         validação de URL e bloqueio de destinos privados (SSRF)
-└── test/                   testes (vitest)
-web/                    frontend React + Vite
-├── src/context/            SessionContext (sessão e polling das tasks)
-├── src/components/         ui/ (Input, Button, Card, Alert...) e feature/ (form, item, timer)
-└── vite.config.ts          proxy de /api em desenvolvimento
-.agent/                 scaffolding de agentes de IA (não faz parte do runtime)
-.github/workflows/      CI (typecheck, lint, testes e build)
-nixpacks.toml           comandos de build e start do deploy
-pnpm-workspace.yaml     workspaces, allowBuilds e overrides
-```
-
-## Testes e desenvolvimento
-
-```bash
-pnpm typecheck   # tsc nos dois pacotes
-pnpm lint        # eslint no web
-pnpm test        # vitest no server e no web
 pnpm build
 ```
 
-Os testes do servidor cobrem a validação de URL e o bloqueio de IPs privados, o tratamento de redirects, a expiração de sessões (com remoção das tasks e dos arquivos) e a validação do id de sessão. Os do web cobrem os estados do componente `DownloadItem`. O mesmo conjunto roda no GitHub Actions (`.github/workflows/ci.yml`).
+- **Start de produção (tudo pela porta 3000)**:
 
-## Estado atual e limitações
+```bash
+pnpm start
+```
 
-- Sessões e tasks ficam em memória: reiniciar o servidor perde a lista de tasks (os arquivos em disco são removidos pelo coletor depois de 1 hora).
-- Sem autenticação: qualquer um que alcance o servidor pode enfileirar downloads (de destinos públicos). Coloque atrás de VPN, autenticação reversa ou firewall.
-- Não há retomada de download nem uso de `Range` no fluxo atual (o parâmetro `offset` do antigo `/stream` não existe mais).
-- Não há limite de tamanho, banda ou cota: um link muito grande ocupa o disco do servidor até a sessão expirar.
-- "Save to Disk" carrega o arquivo inteiro na memória do navegador (`blob()`) antes de salvar, o que pesa em arquivos muito grandes.
-- O diretório `.agent/` é scaffolding de ferramentas de IA e não é usado pela aplicação.
+O servidor Fastify:
 
-## Licença
+- Servirá o build do Vite na raiz (`/`).
+- Continuará expondo `GET /stream` para o proxy de download.
 
-Sem licença definida no repositório: não existe arquivo `LICENSE` e o `package.json` está marcado como `private`. Defina uma licença antes de reutilizar ou publicar o código.
+---
+
+## Configuração de ambiente
+
+### Desenvolvimento
+
+Por padrão o frontend conversa com o backend em:
+
+```ts
+const API_URL = import.meta.env.VITE_API_URL ?? "http://localhost:3000";
+```
+
+Se você mudar a porta ou rodar o backend em outro host, basta criar um arquivo `.env` dentro de `web/`:
+
+```bash
+VITE_API_URL=http://seu-backend:3000
+```
+
+### Produção (Nixpacks ou similar)
+
+- Defina a variável `PORT` (a maioria das plataformas faz isso automaticamente).
+- O servidor Fastify faz fallback para `3000` se `PORT` não estiver definida.
+- O arquivo `nixpacks.toml` já descreve:
+  - Comando de build: `pnpm build`
+  - Comando de start: `pnpm start`
+
+---
+
+## Fluxo de uso típico
+
+1. Você tem uma **VPS bem localizada** (por exemplo, no mesmo continente do servidor de origem).
+2. No seu desktop/notebook, abre o Ephemeral Downloader.
+3. Cola um ou mais links HTTP/HTTPS diretos (por exemplo, ROMs no SourceForge).
+4. Clica em **“Iniciar download”**.
+5. A VPS baixa em alta velocidade e o app:
+   - Mostra o progresso.
+   - Indica tamanho total / baixado.
+   - Mostra velocidade agregada em MB/s e Mbps.
+6. Se a conexão cair, você pode **retomar** dentro da mesma sessão.
+
+---
+
+## Limitações intencionais
+
+- **Retomada entre sessões** (fechar aba / desligar máquina) **não é suportada**.
+  - O projeto é focado em uso efêmero, sem manter arquivos em disco no servidor.
+- O servidor realiza apenas:
+  - Validação básica de URL (somente `http`/`https`).
+  - Proxy por streaming com **backpressure** nativo do Node.js.
+  - Nenhuma autenticação ou controle de cota por usuário (idealmente coloque atrás de VPN, auth reverso ou firewall).
+
+---
+
+## Ideias futuras
+
+- Autenticação simples para restringir o painel.
+- Limite de banda por IP/usuário.
+- Modo “linha de comando” usando a mesma API do servidor.
+
+---
+
+## Por que esse projeto existe?
+
+Porque às vezes o problema não é a sua internet nem o servidor de origem, e sim o **caminho entre eles**.
+
+Colocando uma VPS no meio do caminho, você “puxa” o arquivo por uma rota melhor até a VPS e, de lá, faz o streaming até você com muito mais previsibilidade.
+
+O Ephemeral Downloader encapsula essa ideia em uma interface simples, focada em quem só quer **colar o link, apertar um botão e acompanhar o progresso**.

package.json

@@ -8,13 +8,11 @@
     "dev:server": "pnpm --filter server dev",
     "dev:web": "pnpm --filter web dev",
     "build": "pnpm -r build",
-    "start": "pnpm --filter server start",
-    "test": "pnpm -r --if-present test",
-    "lint": "pnpm -r --if-present lint",
-    "typecheck": "pnpm -r --if-present typecheck"
+    "start": "pnpm --filter server start"
   },
   "workspaces": [
     "server",
     "web"
-  ]
-}
+  ],
+  "packageManager": "[email protected]"
+}

pnpm-lock.yaml

@@ -1,161 +1,3 @@
----
-lockfileVersion: '9.0'
-
-importers:
-
-  .:
-    configDependencies: {}
-    packageManagerDependencies:
-      pnpm:
-        specifier: 12.8.1
-        version: 12.8.1
-
-packages:
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-siDxcidfz5eM6L2tJfik+i2bbUEw8UC7MZ3Yl2HYdRmqbdhHGAOQACtOOu6QVW4Jul4/w5wVKm+wM8ACtgh1Pg==}
-    cpu: [arm64]
-    os: [android]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-0F/uqPRc3aN4vLHsa0f+6fTtmsigFQ9/yxEU43fionF//pNHEd5e97b3w/nKIgqYMCUQCJphmBRMA9Q8/wlo9Q==}
-    cpu: [x64]
-    os: [android]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-/rwavvMQJsl2RIxOHBnDF+4Gk+fhQFAY4M3PQZoKskJOEnaJcygG9p1xby6wcQcbS4d9dIubv09CQhufTgfmpw==}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-htYt2gN7zqJKLhC99Ft6EUiO7myjZAZXfmGCTJUL1v+o7vE9hZdE1+fAkk4Oj1ZHNRti6b2woOxEkRkAusi8OQ==}
-    cpu: [x64]
-    os: [darwin]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-PB5BULNgytxvExoOXUUeseS/DcpPENs+cg3iA6xHHeaLT4ctEGKSGXEbuj7USeqvo8JBpAx039hivnbzGqDwnA==}
-    cpu: [x64]
-    os: [freebsd]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-kKeyC/ArjrgdciQRBrOL0j9HtOI4gDRgoyP+eJ1CQKyadpKlf/DhDDyspXe07R3B9KagTVLUF2nlt6Dr5quFIg==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-q4s9a9X2O3N9aeUFooW24orNrxvu20+jyVUFR5RanPCqOKKPBrgs2iywMkBBx1aXkkzdWT54/mfz8Be8sJlWEw==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-F7XSjKJthwCh/L6abZiMpAfo2Cm61SZIT3e4dfgiIjESndlWaXCnfLKngSgZ/SEMsdmHT6dud3+kWIB3tw0/xQ==}
-    cpu: [ppc64]
-    os: [linux]
-    libc: [glibc]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-z1ecpIK/ZY08Unk69KWWE9867oaKUytGUjrHnBoGFAAhsK+q+0cfvBH+f5fWobJ7FX97leMlLO+gkJolddM45Q==}
-    cpu: [riscv64]
-    os: [linux]
-    libc: [glibc]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-KU6tnrBfu4uKXTq6N5qJwSm8FSrs9Wc8b5AUEsHK9bRXwNdsZ1/lRxG1++X29SKRW9OSNuDSjxASv5mAvGo1gA==}
-    cpu: [s390x]
-    os: [linux]
-    libc: [glibc]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-eUE8BWJkDr2tJb/yrk0yVnszlmNqFarVxUlqiZ9BAkct28Nq/5g2H0tvMDmPA7fAQW3STNj+omJPPRVT+4s5sQ==}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-8bDZ0lZlCdi2rvnFul7EYgcC7zKeWSe76y8JV2oXobaS8p9i9d6PSf6LgLtTM0fI7R9Oh4eLCbveXyNDMmvZ+g==}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-MsT0dlrRxnCRCHCaosNbhWpEiAFnFuMEu3KuDJDU41BXgTwiINxU8goloUSUDejWZUqKaUqNC/qUTihl9nFtqg==}
-    cpu: [arm64]
-    os: [win32]
-
-  '@pnpm/[email protected]':
-    resolution: {integrity: sha512-SWtPe0PsbTTk//gJND10tMdOfCYjrkq5+qV49hzVhY7xz2iJ339Rc+xwASlcvbwTfrvH39YNqpKYibD+CRGLwA==}
-    cpu: [x64]
-    os: [win32]
-
-  [email protected]:
-    resolution: {integrity: sha512-9kupB1B/XOr+BsjTjmBS0BeURFgOwSed3Vv8EctIqoomRLZlmOB+dh2oSHKp/FfV+QK4f6SdAkGY1VhhKqu+RQ==}
-    engines: {node: '>=18.*'}
-    hasBin: true
-
-snapshots:
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  '@pnpm/[email protected]':
-    optional: true
-
-  [email protected]:
-    optionalDependencies:
-      '@pnpm/exe.android-arm64': 12.8.1
-      '@pnpm/exe.android-x64': 12.8.1
-      '@pnpm/exe.darwin-arm64': 12.8.1
-      '@pnpm/exe.darwin-x64': 12.8.1
-      '@pnpm/exe.freebsd-x64': 12.8.1
-      '@pnpm/exe.linux-arm64': 12.8.1
-      '@pnpm/exe.linux-arm64-musl': 12.8.1
-      '@pnpm/exe.linux-ppc64': 12.8.1
-      '@pnpm/exe.linux-riscv64': 12.8.1
-      '@pnpm/exe.linux-s390x': 12.8.1
-      '@pnpm/exe.linux-x64': 12.8.1
-      '@pnpm/exe.linux-x64-musl': 12.8.1
-      '@pnpm/exe.win32-arm64': 12.8.1
-      '@pnpm/exe.win32-x64': 12.8.1
-
----
 lockfileVersion: '9.0'
 
 settings:
@@ -198,9 +40,6 @@ importers:
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
-      vitest:
-        specifier: ^5.0.3
-        version: 5.0.3(@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
 
   web:
     dependencies:
@@ -219,6 +58,9 @@ importers:
       tailwind-merge:
         specifier: ^3.4.0
         version: 3.4.0
+      uuid:
+        specifier: ^13.0.0
+        version: 13.0.0
       zod:
         specifier: ^3.25.76
         version: 3.25.76
@@ -240,19 +82,19 @@ importers:
         version: 19.2.3(@types/[email protected])
       '@vitejs/plugin-react':
         specifier: ^5.1.1
-        version: 5.1.1([email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+        version: 5.1.1([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
       autoprefixer:
         specifier: ^10.4.24
         version: 10.4.24([email protected])
       eslint:
         specifier: ^9.39.1
-        version: 9.39.1([email protected])([email protected])
+        version: 9.39.1([email protected])
       eslint-plugin-react-hooks:
         specifier: ^7.0.1
-        version: 7.0.1([email protected]([email protected])([email protected]))([email protected])
+        version: 7.0.1([email protected]([email protected]))
       eslint-plugin-react-refresh:
         specifier: ^0.4.24
-        version: 0.4.24([email protected]([email protected])([email protected]))
+        version: 0.4.24([email protected]([email protected]))
       globals:
         specifier: ^16.5.0
         version: 16.5.0
@@ -267,13 +109,10 @@ importers:
         version: 5.9.3
       typescript-eslint:
         specifier: ^8.46.4
-        version: 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+        version: 8.47.0([email protected]([email protected]))([email protected])
       vite:
         specifier: ^7.2.4
         version: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
-      vitest:
-        specifier: ^5.0.3
-        version: 5.0.3(@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
 
 packages:
 
@@ -777,9 +616,6 @@ packages:
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
-  '@jridgewell/[email protected]':
-    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
-
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
@@ -1015,12 +851,6 @@ packages:
   '@types/[email protected]':
     resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
 
-  '@types/[email protected]':
-    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
-
-  '@types/[email protected]':
-    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
-
   '@types/[email protected]':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
@@ -1106,20 +936,6 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@vitest/[email protected]':
-    resolution: {integrity: sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==}
-    peerDependencies:
-      msw: ^2.4.9
-      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
-    peerDependenciesMeta:
-      msw:
-        optional: true
-      vite:
-        optional: true
-
-  '@vitest/[email protected]':
-    resolution: {integrity: sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==}
-
   [email protected]:
     resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
 
@@ -1154,10 +970,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
-  [email protected]:
-    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
-    engines: {node: '>=12'}
-
   [email protected]:
     resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
     engines: {node: '>=8.0.0'}
@@ -1221,10 +1033,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-BCfFL1sHijQlBGWBMuJyhZUhzo7wer5sVj9hqekB/7xn0Ypy+pER/edCYQm4exbXj4WiySGp40P8UuTh6w1srg==}
 
-  [email protected]:
-    resolution: {integrity: sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==}
-    engines: {node: '>=18'}
-
   [email protected]:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
@@ -1295,9 +1103,6 @@ packages:
     resolution: {integrity: sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==}
     engines: {node: '>=10.13.0'}
 
-  [email protected]:
-    resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
-
   [email protected]:
     resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
     engines: {node: '>=18'}
@@ -1345,7 +1150,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-BhHmn2yNOFA9H9JmmIVKJmd288g9hrVRDkdoIgRCRuSySRUHH7r/DI6aAXW9T1WwUuY3DFgrcaqB+deURBLR5g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
     peerDependencies:
       jiti: '*'
@@ -1369,17 +1173,10 @@ packages:
     resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
     engines: {node: '>=4.0'}
 
-  [email protected]:
-    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
-
   [email protected]:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
-  [email protected]:
-    resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
-    engines: {node: '>=12.0.0'}
-
   [email protected]:
     resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
 
@@ -1681,9 +1478,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
-  [email protected]:
-    resolution: {integrity: sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==}
-
   [email protected]:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
@@ -1726,10 +1520,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
 
-  [email protected]:
-    resolution: {integrity: sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==}
-    engines: {node: '>=12.20.0'}
-
   [email protected]:
     resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
     engines: {node: '>=14.0.0'}
@@ -1773,10 +1563,6 @@ packages:
     resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
     engines: {node: '>=12'}
 
-  [email protected]:
-    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
-    engines: {node: '>=12'}
-
   [email protected]:
     resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
 
@@ -1912,9 +1698,6 @@ packages:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
 
-  [email protected]:
-    resolution: {integrity: sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==}
-
   [email protected]:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
@@ -1937,22 +1720,10 @@ packages:
     resolution: {integrity: sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==}
     engines: {node: '>=20'}
 
-  [email protected]:
-    resolution: {integrity: sha512-IAbQaPJIIdhVxi0mqy9lez1wEwje0UQf9F1vwtbelEG5Nbgn0nPOxCvU+mNeNS9gyJTAhrHp74CbUaSynQpZcQ==}
-    engines: {node: '>=20.0.0'}
-
-  [email protected]:
-    resolution: {integrity: sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==}
-    engines: {node: '>=18'}
-
   [email protected]:
     resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
     engines: {node: '>=12.0.0'}
 
-  [email protected]:
-    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
-    engines: {node: '>=12.0.0'}
-
   [email protected]:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
@@ -2014,6 +1785,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
+  [email protected]:
+    resolution: {integrity: sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==}
+    hasBin: true
+
   [email protected]:
     resolution: {integrity: sha512-NL8jTlbo0Tn4dUEXEsUg8KeyG/Lkmc4Fnzb8JXN/Ykm9G4HNImjtABMJgkQoVjOBN/j2WAwDTRytdqJbZsah7w==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -2054,57 +1829,11 @@ packages:
       yaml:
         optional: true
 
-  [email protected]:
-    resolution: {integrity: sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==}
-    engines: {node: ^22.12.0 || ^24.0.0 || >=26.0.0}
-    hasBin: true
-    peerDependencies:
-      '@edge-runtime/vm': '*'
-      '@opentelemetry/api': ^1.9.0
-      '@types/node': ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 5.0.3
-      '@vitest/browser-preview': 5.0.3
-      '@vitest/browser-webdriverio': ^5.0.0-beta.5 || >=5.0.0
-      '@vitest/coverage-istanbul': 5.0.3
-      '@vitest/coverage-v8': 5.0.3
-      '@vitest/ui': 5.0.3
-      happy-dom: '*'
-      jsdom: '*'
-      vite: ^6.4.0 || ^7.0.0 || ^8.0.0
-    peerDependenciesMeta:
-      '@edge-runtime/vm':
-        optional: true
-      '@opentelemetry/api':
-        optional: true
-      '@types/node':
-        optional: true
-      '@vitest/browser-playwright':
-        optional: true
-      '@vitest/browser-preview':
-        optional: true
-      '@vitest/browser-webdriverio':
-        optional: true
-      '@vitest/coverage-istanbul':
-        optional: true
-      '@vitest/coverage-v8':
-        optional: true
-      '@vitest/ui':
-        optional: true
-      happy-dom:
-        optional: true
-      jsdom:
-        optional: true
-
   [email protected]:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
     hasBin: true
 
-  [email protected]:
-    resolution: {integrity: sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==}
-    engines: {node: '>=20.11'}
-    hasBin: true
-
   [email protected]:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
@@ -2137,20 +1866,20 @@ snapshots:
 
   '@babel/[email protected]': {}
 
-  '@babel/[email protected]([email protected])':
+  '@babel/[email protected]':
     dependencies:
       '@babel/code-frame': 7.27.1
       '@babel/generator': 7.28.5
       '@babel/helper-compilation-targets': 7.27.2
-      '@babel/helper-module-transforms': 7.28.3(@babel/[email protected]([email protected]))([email protected])
+      '@babel/helper-module-transforms': 7.28.3(@babel/[email protected])
       '@babel/helpers': 7.28.4
       '@babel/parser': 7.28.5
       '@babel/template': 7.27.2
-      '@babel/traverse': 7.28.5([email protected])
+      '@babel/traverse': 7.28.5
       '@babel/types': 7.28.5
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -2175,19 +1904,19 @@ snapshots:
 
   '@babel/[email protected]': {}
 
-  '@babel/[email protected]([email protected])':
+  '@babel/[email protected]':
     dependencies:
-      '@babel/traverse': 7.28.5([email protected])
+      '@babel/traverse': 7.28.5
       '@babel/types': 7.28.5
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/[email protected](@babel/[email protected]([email protected]))([email protected])':
+  '@babel/[email protected](@babel/[email protected])':
     dependencies:
-      '@babel/core': 7.28.5([email protected])
-      '@babel/helper-module-imports': 7.27.1([email protected])
+      '@babel/core': 7.28.5
+      '@babel/helper-module-imports': 7.27.1
       '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.28.5([email protected])
+      '@babel/traverse': 7.28.5
     transitivePeerDependencies:
       - supports-color
 
@@ -2208,14 +1937,14 @@ snapshots:
     dependencies:
       '@babel/types': 7.28.5
 
-  '@babel/[email protected](@babel/[email protected]([email protected]))':
+  '@babel/[email protected](@babel/[email protected])':
     dependencies:
-      '@babel/core': 7.28.5([email protected])
+      '@babel/core': 7.28.5
       '@babel/helper-plugin-utils': 7.27.1
 
-  '@babel/[email protected](@babel/[email protected]([email protected]))':
+  '@babel/[email protected](@babel/[email protected])':
     dependencies:
-      '@babel/core': 7.28.5([email protected])
+      '@babel/core': 7.28.5
       '@babel/helper-plugin-utils': 7.27.1
 
   '@babel/[email protected]':
@@ -2224,7 +1953,7 @@ snapshots:
       '@babel/parser': 7.28.5
       '@babel/types': 7.28.5
 
-  '@babel/[email protected]([email protected])':
+  '@babel/[email protected]':
     dependencies:
       '@babel/code-frame': 7.27.1
       '@babel/generator': 7.28.5
@@ -2232,7 +1961,7 @@ snapshots:
       '@babel/parser': 7.28.5
       '@babel/template': 7.27.2
       '@babel/types': 7.28.5
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
@@ -2397,17 +2126,17 @@ snapshots:
   '@esbuild/[email protected]':
     optional: true
 
-  '@eslint-community/[email protected]([email protected]([email protected])([email protected]))':
+  '@eslint-community/[email protected]([email protected]([email protected]))':
     dependencies:
-      eslint: 9.39.1([email protected])([email protected])
+      eslint: 9.39.1([email protected])
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/[email protected]': {}
 
-  '@eslint/[email protected]([email protected])':
+  '@eslint/[email protected]':
     dependencies:
       '@eslint/object-schema': 2.1.7
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -2420,10 +2149,10 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/[email protected]([email protected])':
+  '@eslint/[email protected]':
     dependencies:
       ajv: 6.12.6
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -2517,12 +2246,10 @@ snapshots:
 
   '@jridgewell/[email protected]': {}
 
-  '@jridgewell/[email protected]': {}
-
   '@jridgewell/[email protected]':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
-      '@jridgewell/sourcemap-codec': 1.6.0
+      '@jridgewell/sourcemap-codec': 1.5.5
 
   '@lukeed/[email protected]': {}
 
@@ -2698,13 +2425,6 @@ snapshots:
     dependencies:
       '@babel/types': 7.28.5
 
-  '@types/[email protected]':
-    dependencies:
-      '@types/deep-eql': 4.0.2
-      assertion-error: 2.0.1
-
-  '@types/[email protected]': {}
-
   '@types/[email protected]': {}
 
   '@types/[email protected]': {}
@@ -2725,15 +2445,15 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
-  '@typescript-eslint/[email protected](@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]))([email protected]([email protected])([email protected]))([email protected])([email protected])':
+  '@typescript-eslint/[email protected](@typescript-eslint/[email protected]([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+      '@typescript-eslint/parser': 8.47.0([email protected]([email protected]))([email protected])
       '@typescript-eslint/scope-manager': 8.47.0
-      '@typescript-eslint/type-utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+      '@typescript-eslint/type-utils': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
       '@typescript-eslint/visitor-keys': 8.47.0
-      eslint: 9.39.1([email protected])([email protected])
+      eslint: 9.39.1([email protected])
       graphemer: 1.4.0
       ignore: 7.0.5
       natural-compare: 1.4.0
@@ -2742,23 +2462,23 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
     dependencies:
       '@typescript-eslint/scope-manager': 8.47.0
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
       '@typescript-eslint/visitor-keys': 8.47.0
-      debug: 4.4.3([email protected])
-      eslint: 9.39.1([email protected])([email protected])
+      debug: 4.4.3
+      eslint: 9.39.1([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected])([email protected])':
+  '@typescript-eslint/[email protected]([email protected])':
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.47.0([email protected])
       '@typescript-eslint/types': 8.47.0
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -2772,13 +2492,13 @@ snapshots:
     dependencies:
       typescript: 5.9.3
 
-  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
     dependencies:
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      debug: 4.4.3([email protected])
-      eslint: 9.39.1([email protected])([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
+      debug: 4.4.3
+      eslint: 9.39.1([email protected])
       ts-api-utils: 2.1.0([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -2786,13 +2506,13 @@ snapshots:
 
   '@typescript-eslint/[email protected]': {}
 
-  '@typescript-eslint/[email protected]([email protected])([email protected])':
+  '@typescript-eslint/[email protected]([email protected])':
     dependencies:
-      '@typescript-eslint/project-service': 8.47.0([email protected])([email protected])
+      '@typescript-eslint/project-service': 8.47.0([email protected])
       '@typescript-eslint/tsconfig-utils': 8.47.0([email protected])
       '@typescript-eslint/types': 8.47.0
       '@typescript-eslint/visitor-keys': 8.47.0
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
@@ -2802,13 +2522,13 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected])([email protected]))
+      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected]))
       '@typescript-eslint/scope-manager': 8.47.0
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
-      eslint: 9.39.1([email protected])([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      eslint: 9.39.1([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -2818,11 +2538,11 @@ snapshots:
       '@typescript-eslint/types': 8.47.0
       eslint-visitor-keys: 4.2.1
 
-  '@vitejs/[email protected]([email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+  '@vitejs/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5([email protected])
-      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/[email protected]([email protected]))
-      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/[email protected]([email protected]))
+      '@babel/core': 7.28.5
+      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/[email protected])
+      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/[email protected])
       '@rolldown/pluginutils': 1.0.0-beta.47
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
@@ -2830,26 +2550,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
-    dependencies:
-      '@jridgewell/trace-mapping': 0.3.31
-      '@vitest/spy': 5.0.3
-      estree-walker: 3.0.3
-      magic-string: 1.4.3
-    optionalDependencies:
-      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
-
-  '@vitest/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
-    dependencies:
-      '@jridgewell/trace-mapping': 0.3.31
-      '@vitest/spy': 5.0.3
-      estree-walker: 3.0.3
-      magic-string: 1.4.3
-    optionalDependencies:
-      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
-
-  '@vitest/[email protected]': {}
-
   [email protected]: {}
 
   [email protected]([email protected]):
@@ -2882,8 +2582,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]([email protected]):
@@ -2949,8 +2647,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]:
     dependencies:
       ansi-styles: 4.3.0
@@ -2980,11 +2676,9 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]):
+  [email protected]:
     dependencies:
       ms: 2.1.3
-    optionalDependencies:
-      supports-color: 7.2.0
 
   [email protected]: {}
 
@@ -3003,8 +2697,6 @@ snapshots:
       graceful-fs: 4.2.11
       tapable: 2.3.0
 
-  [email protected]: {}
-
   [email protected]:
     optionalDependencies:
       '@esbuild/aix-ppc64': 0.25.12
@@ -3069,20 +2761,20 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]([email protected])([email protected]))([email protected]):
+  [email protected]([email protected]([email protected])):
     dependencies:
-      '@babel/core': 7.28.5([email protected])
+      '@babel/core': 7.28.5
       '@babel/parser': 7.28.5
-      eslint: 9.39.1([email protected])([email protected])
+      eslint: 9.39.1([email protected])
       hermes-parser: 0.25.1
       zod: 3.25.76
       zod-validation-error: 4.0.2([email protected])
     transitivePeerDependencies:
       - supports-color
 
-  [email protected]([email protected]([email protected])([email protected])):
+  [email protected]([email protected]([email protected])):
     dependencies:
-      eslint: 9.39.1([email protected])([email protected])
+      eslint: 9.39.1([email protected])
 
   [email protected]:
     dependencies:
@@ -3093,14 +2785,14 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected])([email protected]):
+  [email protected]([email protected]):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected])([email protected]))
+      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected]))
       '@eslint-community/regexpp': 4.12.2
-      '@eslint/config-array': 0.21.1([email protected])
+      '@eslint/config-array': 0.21.1
       '@eslint/config-helpers': 0.4.2
       '@eslint/core': 0.17.0
-      '@eslint/eslintrc': 3.3.1([email protected])
+      '@eslint/eslintrc': 3.3.1
       '@eslint/js': 9.39.1
       '@eslint/plugin-kit': 0.4.1
       '@humanfs/node': 0.16.7
@@ -3110,7 +2802,7 @@ snapshots:
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3([email protected])
+      debug: 4.4.3
       escape-string-regexp: 4.0.0
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -3150,14 +2842,8 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]:
-    dependencies:
-      '@types/estree': 1.0.8
-
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]: {}
@@ -3217,10 +2903,6 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.3
 
-  [email protected]([email protected]):
-    optionalDependencies:
-      picomatch: 4.0.7
-
   [email protected]:
     dependencies:
       flat-cache: 4.0.1
@@ -3433,10 +3115,6 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  [email protected]:
-    dependencies:
-      '@jridgewell/sourcemap-codec': 1.6.0
-
   [email protected]: {}
 
   [email protected]:
@@ -3468,8 +3146,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]:
@@ -3508,8 +3184,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]:
     dependencies:
       split2: 4.2.0
@@ -3639,8 +3313,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]:
@@ -3657,20 +3329,11 @@ snapshots:
     dependencies:
       real-require: 0.2.0
 
-  [email protected]: {}
-
-  [email protected]: {}
-
   [email protected]:
     dependencies:
       fdir: 6.5.0([email protected])
       picomatch: 4.0.3
 
-  [email protected]:
-    dependencies:
-      fdir: 6.5.0([email protected])
-      picomatch: 4.0.7
-
   [email protected]:
     dependencies:
       is-number: 7.0.0
@@ -3694,13 +3357,13 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
-  [email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]):
+  [email protected]([email protected]([email protected]))([email protected]):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.47.0(@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]))([email protected]([email protected])([email protected]))([email protected])([email protected])
-      '@typescript-eslint/parser': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
-      eslint: 9.39.1([email protected])([email protected])
+      '@typescript-eslint/eslint-plugin': 8.47.0(@typescript-eslint/[email protected]([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])
+      '@typescript-eslint/parser': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
+      eslint: 9.39.1([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -3727,6 +3390,8 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
+  [email protected]: {}
+
   [email protected](@types/[email protected])([email protected])([email protected])([email protected]):
     dependencies:
       esbuild: 0.25.12
@@ -3742,69 +3407,10 @@ snapshots:
       lightningcss: 1.30.2
       tsx: 4.21.0
 
-  [email protected](@types/[email protected])([email protected])([email protected])([email protected]):
-    dependencies:
-      esbuild: 0.25.12
-      fdir: 6.5.0([email protected])
-      picomatch: 4.0.3
-      postcss: 8.5.6
-      rollup: 4.53.3
-      tinyglobby: 0.2.15
-    optionalDependencies:
-      '@types/node': 25.2.3
-      fsevents: 2.3.3
-      jiti: 2.6.1
-      lightningcss: 1.30.2
-      tsx: 4.21.0
-
-  [email protected](@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected])):
-    dependencies:
-      '@types/chai': 5.2.3
-      '@vitest/mocker': 5.0.3([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
-      chai: 6.3.0
-      es-module-lexer: 2.3.2
-      expect-type: 1.4.0
-      magic-string: 1.4.3
-      obug: 2.2.1
-      picomatch: 4.0.7
-      std-env: 4.3.0
-      tinybench: 6.2.1
-      tinyexec: 1.3.1
-      tinyglobby: 0.2.17
-      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
-      why-is-node-running: 3.2.1
-    optionalDependencies:
-      '@types/node': 24.10.1
-    transitivePeerDependencies:
-      - msw
-
-  [email protected](@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected])):
-    dependencies:
-      '@types/chai': 5.2.3
-      '@vitest/mocker': 5.0.3([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
-      chai: 6.3.0
-      es-module-lexer: 2.3.2
-      expect-type: 1.4.0
-      magic-string: 1.4.3
-      obug: 2.2.1
-      picomatch: 4.0.7
-      std-env: 4.3.0
-      tinybench: 6.2.1
-      tinyexec: 1.3.1
-      tinyglobby: 0.2.17
-      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
-      why-is-node-running: 3.2.1
-    optionalDependencies:
-      '@types/node': 25.2.3
-    transitivePeerDependencies:
-      - msw
-
   [email protected]:
     dependencies:
       isexe: 2.0.0
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]: {}

pnpm-workspace.yaml

@@ -2,17 +2,9 @@ packages:
   - server
   - web
 
-# pnpm 11/12: sem isto o install falha com ERR_PNPM_IGNORED_BUILDS,
-# porque o esbuild (usado pelo Vite) precisa rodar script de build. 
-allowBuilds:
-  esbuild: true
-
-# Chave equivalente para pnpm 9/10 (ignorada pelo pnpm 12).
 onlyBuiltDependencies:
   - esbuild
 
-# Overrides de segurança. Atenção: pnpm 9 e anterior ignoram esta seção
-# (o pnpm 10+ lê overrides de pnpm-workspace.yaml).
 overrides:
   fastify@<5.7.2: '>=5.7.2'
   fastify@<=5.7.2: '>=5.7.3'

server/dist/index.js

@@ -0,0 +1,153 @@
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import fastifyStatic from "@fastify/static";
+import { z } from "zod";
+import { request } from "undici";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+const app = Fastify({
+    logger: true,
+});
+// Registro de CORS básico para permitir o frontend em desenvolvimento/produção.
+await app.register(cors, {
+    origin: true,
+});
+// Servir frontend buildado (Vite) em produção, similar ao Next.js.
+const currentFile = fileURLToPath(import.meta.url);
+const currentDir = dirname(currentFile);
+const clientDistPath = resolve(currentDir, "../../web/dist");
+await app.register(fastifyStatic, {
+    root: clientDistPath,
+    prefix: "/",
+    index: ["index.html"],
+});
+// Rota explícita para a SPA na raiz, útil especialmente em ambientes de deploy.
+app.get("/", (_request, reply) => {
+    return reply.sendFile("index.html");
+});
+app.get("/health", async () => {
+    return { status: "ok" };
+});
+const streamQuerySchema = z.object({
+    url: z
+        .string()
+        .url("URL inválida")
+        .refine((value) => {
+        // Evita SSRF localizando apenas http/https genérico.
+        return value.startsWith("http://") || value.startsWith("https://");
+    }, { message: "Apenas URLs HTTP/HTTPS são permitidas." }),
+    // Offset opcional em bytes para retomar download dentro da mesma sessão.
+    offset: z
+        .string()
+        .regex(/^\d+$/)
+        .transform((value) => Number.parseInt(value, 10))
+        .optional(),
+});
+app.get("/stream", async (requestFastify, reply) => {
+    const parseResult = streamQuerySchema.safeParse(requestFastify.query);
+    if (!parseResult.success) {
+        const firstError = parseResult.error.errors[0]?.message ?? "Parâmetros inválidos";
+        reply.status(400);
+        return { error: firstError };
+    }
+    const { url, offset } = parseResult.data;
+    try {
+        // HEAD para validar link e obter metadados.
+        const headResponse = await request(url, {
+            method: "HEAD",
+            // timeout conservador, em produção pode ser configurável.
+            headersTimeout: 15000,
+        });
+        if (headResponse.statusCode && headResponse.statusCode >= 400) {
+            reply.status(502);
+            return { error: "Não foi possível acessar o recurso de origem." };
+        }
+        const contentType = headResponse.headers["content-type"] ?? "application/octet-stream";
+        const contentLength = headResponse.headers["content-length"];
+        const originDisposition = headResponse.headers["content-disposition"];
+        // Nome de arquivo derivado do header Content-Disposition ou da URL.
+        const fallbackName = (() => {
+            try {
+                const parsedUrl = new URL(url);
+                const nameFromPath = parsedUrl.pathname.split("/").filter(Boolean).pop();
+                return nameFromPath ?? "download.bin";
+            }
+            catch {
+                return "download.bin";
+            }
+        })();
+        const filename = (() => {
+            if (typeof originDisposition === "string") {
+                const match = /filename\*?=(?:UTF-8''|")?([^";]+)/i.exec(originDisposition);
+                if (match?.[1]) {
+                    return decodeURIComponent(match[1].replace(/"/g, ""));
+                }
+            }
+            return fallbackName;
+        })();
+        const headers = {};
+        if (typeof offset === "number" && Number.isFinite(offset) && offset > 0) {
+            headers.Range = `bytes=${offset}-`;
+        }
+        // GET streaming da origem (possivelmente com Range para retomada).
+        const originResponse = await request(url, {
+            method: "GET",
+            headers,
+            headersTimeout: 30000,
+            maxRedirections: 3,
+        });
+        if (!originResponse.body) {
+            reply.status(502);
+            return { error: "Resposta de origem sem corpo para streaming." };
+        }
+        if (originResponse.statusCode && originResponse.statusCode >= 400) {
+            reply.status(originResponse.statusCode);
+            return { error: "Falha ao obter o arquivo de origem." };
+        }
+        const normalizedLength = Array.isArray(contentLength)
+            ? contentLength[0]
+            : contentLength;
+        // Configura headers de resposta para o cliente final.
+        reply.headers({
+            "Content-Type": Array.isArray(contentType) ? contentType[0] : contentType,
+            ...(normalizedLength
+                ? {
+                    "Content-Length": normalizedLength,
+                    "X-Origin-Content-Length": normalizedLength,
+                }
+                : {}),
+            "Content-Disposition": `attachment; filename="${filename}"`,
+        });
+        // Entregamos o stream diretamente para o Fastify gerenciar (pipe + backpressure).
+        return reply.send(originResponse.body);
+    }
+    catch (error) {
+        requestFastify.log.error({ err: error, url }, "Erro durante o streaming do arquivo");
+        if (!reply.sent) {
+            // Em caso de falha antes de iniciar o streaming, respondemos com JSON.
+            return reply
+                .status(502)
+                .send({ error: "Erro ao realizar o proxy do arquivo." });
+        }
+        // Se a resposta já foi enviada/fechada, apenas não fazemos mais nada.
+    }
+});
+// Fallback para SPA: qualquer rota GET não atendida cai no index.html.
+app.setNotFoundHandler((requestFastify, reply) => {
+    if (requestFastify.method === "GET") {
+        return reply.sendFile("index.html");
+    }
+    reply.status(404).send({ error: "Recurso não encontrado." });
+});
+const port = Number(process.env.PORT) || 3000;
+try {
+    await app.listen({
+        port,
+        host: "0.0.0.0",
+    });
+    app.log.info(`Server listening on port ${port}`);
+}
+catch (err) {
+    app.log.error(err);
+    process.exit(1);
+}

server/package.json

@@ -7,9 +7,7 @@
   "scripts": {
     "dev": "tsx src/index.ts",
     "build": "tsc -p tsconfig.json",
-    "start": "node dist/index.js",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run"
+    "start": "node dist/index.js"
   },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
@@ -21,7 +19,6 @@
   "devDependencies": {
     "@types/node": "^25.2.3",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^5.0.3"
+    "typescript": "^5.9.3"
   }
 }

server/src/index.ts

@@ -2,18 +2,18 @@ import Fastify, { FastifyRequest, FastifyReply } from "fastify";
 import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import { z } from "zod";
-import { Agent, interceptors, setGlobalDispatcher } from "undici";
+import { Agent, setGlobalDispatcher } from "undici";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-import { sessionManager } from "./lib/SessionManager.js";
-import { DownloadManager } from "./lib/DownloadManager.js";
-import { UrlNotAllowedError, createGuardedConnector } from "./lib/netGuard.js";
+import { sessionManager } from "./lib/SessionManager";
+import { DownloadManager } from "./lib/DownloadManager";
 
 // Otimização: Agente HTTP global com conexões persistentes e timeout relaxado.
 // Isso ajuda a manter a performance em downloads paralelos e evita gargalos de socket.
 const agent = new Agent({
-  // O conector recusa destinos locais/privados (SSRF), inclusive em redirects.
-  connect: createGuardedConnector({ timeout: 30_000 }),
+  connect: {
+    timeout: 30_000,
+  },
   pipelining: 1,
   keepAliveTimeout: 10_000,
   connections: 500, // Aumenta limite de conexões simultâneas
@@ -51,11 +51,17 @@ app.get("/health", async () => {
   return { status: "ok" };
 });
 
-// Segue até 5 redirects (links de download costumam redirecionar); sem isso o
-// corpo da resposta 3xx era salvo como se fosse o arquivo.
-const downloadManager = new DownloadManager(
-  agent.compose(interceptors.redirect({ maxRedirections: 5 })),
-);
+const streamQuerySchema = z.object({
+  url: z.string().url("URL inválida").startsWith("http", "Apenas HTTP/HTTPS permitidos"),
+  // Offset opcional em bytes para retomar download.
+  offset: z
+    .string()
+    .regex(/^\d+$/)
+    .transform((value) => Number.parseInt(value, 10))
+    .optional(),
+});
+
+const downloadManager = new DownloadManager(agent);
 
 // Helper to get session from header
 const getSession = (req: FastifyRequest, reply: FastifyReply) => {
@@ -89,12 +95,8 @@ app.post("/api/queue", async (request, reply) => {
   const parse = queueSchema.safeParse(request.body);
   if (!parse.success) return reply.status(400).send({ error: "Invalid URL" });
 
-  try {
-    return await downloadManager.queueDownload(session.id, parse.data.url);
-  } catch (err) {
-    if (err instanceof UrlNotAllowedError) return reply.status(400).send({ error: err.message });
-    throw err;
-  }
+  const task = await downloadManager.queueDownload(session.id, parse.data.url);
+  return task;
 });
 
 // 3. List Tasks (Polling)
@@ -116,14 +118,11 @@ app.get("/api/download/:taskId", async (request, reply) => {
   if (task.status !== "completed") return reply.status(400).send({ error: "Download not ready" });
 
   const sessionPath = sessionManager.getSessionPath(session.id);
-  const fileName = `${task.id}_${task.filename}`;
+  const filePath = resolve(sessionPath, `${task.id}_${task.filename}`);
 
   try {
     sessionManager.touch(session.id); // Reset timer on interaction
-    // O @fastify/static resolve caminhos a partir do `root` do plugin (web/dist),
-    // então o root do diretório da sessão é passado por requisição.
-    // Sem isso a resposta era o index.html da SPA, não o arquivo baixado.
-    return reply.sendFile(fileName, sessionPath);
+    return reply.download(filePath, task.filename); // requires @fastify/static or sendFile
   } catch (e) {
     return reply.status(404).send({ error: "File removed or missing" });
   }

server/src/lib/DownloadManager.ts

@@ -1,11 +1,8 @@
-import { createWriteStream, existsSync } from "node:fs";
-import { basename, join } from "node:path";
-import { pipeline } from "node:stream/promises";
-import { Transform } from "node:stream";
+import { createWriteStream, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { request, Dispatcher } from "undici";
 import { randomUUID } from "node:crypto";
-import { sessionManager } from "./SessionManager.js";
-import { assertDownloadableUrl } from "./netGuard.js";
+import { sessionManager } from "./SessionManager";
 
 type DownloadStatus = "queued" | "downloading" | "completed" | "error";
 
@@ -24,32 +21,13 @@ export type DownloadTask = {
 };
 
 // Map to store active task metadata in memory (for speed)
-// Ideally this would be persisted to JSON in the session folder for crash recovery.
-// As tasks de uma sessão são removidas quando ela expira (ver construtor), então o
-// mapa não cresce sem limite num servidor de longa duração.
+// Ideally this would be persisted to JSON in the session folder for crash recovery
 const tasks = new Map<string, DownloadTask>();
-
-// decodeURIComponent lança em sequências inválidas (ex.: "%E0%A4%A"); nesse caso
-// mantém o texto original em vez de falhar o download inteiro.
-function safeDecode(value: string): string {
-    try {
-        return decodeURIComponent(value);
-    } catch {
-        return value;
-    }
-}
+const agent = new Dispatcher(); // Should use the global agent from index.ts ideally, or pass it in.
 
 export class DownloadManager {
 
-    constructor(private globalAgent: Dispatcher) {
-        sessionManager.onDestroy((sessionId) => this.dropSession(sessionId));
-    }
-
-    private dropSession(sessionId: string) {
-        for (const [id, task] of tasks) {
-            if (task.sessionId === sessionId) tasks.delete(id);
-        }
-    }
+    constructor(private globalAgent: Dispatcher) { }
 
     public getTasks(sessionId: string): DownloadTask[] {
         return Array.from(tasks.values()).filter(t => t.sessionId === sessionId);
@@ -60,13 +38,15 @@ export class DownloadManager {
     }
 
     public async queueDownload(sessionId: string, url: string): Promise<DownloadTask> {
-        const parsedUrl = assertDownloadableUrl(url);
         const id = randomUUID();
 
         // Try to determine filename
         let filename = "download.bin";
-        const lastSegment = parsedUrl.pathname.split("/").pop();
-        if (lastSegment) filename = basename(lastSegment);
+        try {
+            const u = new URL(url);
+            const p = u.pathname.split("/").pop();
+            if (p) filename = p;
+        } catch { }
 
         const task: DownloadTask = {
             id,
@@ -105,7 +85,7 @@ export class DownloadManager {
                 headers: { "User-Agent": "Ephemeral-Downloader/2.0" }
             });
 
-            if (response.statusCode >= 300) {
+            if (response.statusCode >= 400) {
                 throw new Error(`HTTP Error ${response.statusCode}`);
             }
 
@@ -114,12 +94,7 @@ export class DownloadManager {
             if (typeof disposition === "string") {
                 const match = /filename\*?=(?:UTF-8''|")?([^";]+)/i.exec(disposition);
                 if (match?.[1]) {
-                    // O header vem do host de origem: usar apenas o nome base evita
-                    // caminho relativo (../) escrevendo fora do diretório da sessão.
-                    const headerName = basename(safeDecode(match[1].replace(/"/g, "")));
-                    if (headerName) {
-                        task.filename = headerName;
-                    }
+                    task.filename = decodeURIComponent(match[1].replace(/"/g, ""));
                 }
             }
 
@@ -135,38 +110,29 @@ export class DownloadManager {
             let lastUpdate = Date.now();
             let bytesAtLastUpdate = 0;
 
-            // Contador de progresso no meio do pipeline: mantém o cálculo de
-            // velocidade/progresso sem ler o stream manualmente.
-            const progressTracker = new Transform({
-                transform(chunk, _encoding, callback) {
-                    task.receivedBytes += chunk.length;
+            for await (const chunk of response.body) {
+                fileStream.write(chunk);
+                task.receivedBytes += chunk.length;
 
-                    const now = Date.now();
-                    if (now - lastUpdate > 500) { // Update speed every 500ms
-                        const diff = now - lastUpdate;
-                        const bytesDiff = task.receivedBytes - bytesAtLastUpdate;
-                        task.speed = (bytesDiff / diff) * 1000;
+                const now = Date.now();
+                if (now - lastUpdate > 500) { // Update speed every 500ms
+                    const diff = now - lastUpdate;
+                    const bytesDiff = task.receivedBytes - bytesAtLastUpdate;
+                    task.speed = (bytesDiff / diff) * 1000;
 
-                        if (task.totalBytes > 0) {
-                            task.progress = Math.round((task.receivedBytes / task.totalBytes) * 100);
-                        }
-
-                        lastUpdate = now;
-                        bytesAtLastUpdate = task.receivedBytes;
-
-                        // Touch session to keep it alive during download
-                        sessionManager.touch(task.sessionId);
+                    if (task.totalBytes > 0) {
+                        task.progress = Math.round((task.receivedBytes / task.totalBytes) * 100);
                     }
 
-                    callback(null, chunk);
-                },
-            });
+                    lastUpdate = now;
+                    bytesAtLastUpdate = task.receivedBytes;
 
-            // `pipeline` espera o flush em disco e propaga erro de escrita.
-            // Antes o status virava "completed" antes do arquivo terminar de
-            // ser gravado e o download podia sair truncado.
-            await pipeline(response.body, progressTracker, fileStream);
+                    // Touch session to keep it alive during download
+                    sessionManager.touch(task.sessionId);
+                }
+            }
 
+            fileStream.end();
             task.status = "completed";
             task.progress = 100;
             task.speed = 0;

server/src/lib/SessionManager.ts

@@ -1,23 +1,10 @@
 import { existsSync, mkdirSync, rmSync, readdirSync, statSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 
-// A raiz de armazenamento é ancorada no diretório do próprio módulo (server/),
-// e não no `process.cwd()`: com o cwd errado (por exemplo rodando via
-// `pnpm --filter server start`, que executa dentro de server/) os arquivos
-// acabavam em server/server/storage. STORAGE_ROOT permite sobrescrever.
-const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
-const SERVER_ROOT = resolve(MODULE_DIR, "..", "..");
-const STORAGE_ROOT = process.env.STORAGE_ROOT
-    ? resolve(process.env.STORAGE_ROOT)
-    : resolve(SERVER_ROOT, "storage");
+const STORAGE_ROOT = resolve(process.cwd(), "server/storage");
 const SESSION_TIMEOUT_MS = 60 * 60 * 1000; // 1 Hour
 
-// O id vem do header x-session-id e vira nome de diretório: aceitar só UUID
-// impede path traversal (por exemplo "..", que apagaria server/ na expiração).
-const SESSION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
 type SessionData = {
     id: string;
     lastActive: number;
@@ -25,7 +12,6 @@ type SessionData = {
 
 export class SessionManager {
     private sessions: Map<string, SessionData> = new Map();
-    private destroyListeners: Array<(sessionId: string) => void> = [];
 
     constructor() {
         // Ensure storage root exists
@@ -34,8 +20,7 @@ export class SessionManager {
         }
 
         // Start Garbage Collector
-        // unref: o coletor não deve impedir o processo de encerrar (nem os testes).
-        setInterval(() => this.cleanup(), 60 * 1000).unref(); // Check every minute
+        setInterval(() => this.cleanup(), 60 * 1000); // Check every minute
         console.log("[SessionManager] Garbage Collector started.");
     }
 
@@ -45,8 +30,6 @@ export class SessionManager {
     public getSession(id?: string): SessionData {
         const now = Date.now();
 
-        if (id !== undefined && !SESSION_ID_PATTERN.test(id)) id = undefined;
-
         if (id && this.sessions.has(id)) {
             const session = this.sessions.get(id)!;
             session.lastActive = now;
@@ -97,14 +80,6 @@ export class SessionManager {
         }
     }
 
-    /**
-     * Registra um callback chamado quando uma sessão é destruída (expiração),
-     * para quem guarda estado por sessão poder descartá-lo.
-     */
-    public onDestroy(listener: (sessionId: string) => void) {
-        this.destroyListeners.push(listener);
-    }
-
     /**
      * Removes expired sessions and deletes their files.
      */
@@ -144,7 +119,6 @@ export class SessionManager {
 
     private destroySession(id: string) {
         this.sessions.delete(id);
-        for (const listener of this.destroyListeners) listener(id);
         const path = this.getSessionPath(id);
         if (existsSync(path)) {
             try {

server/src/lib/netGuard.ts

@@ -1,164 +0,0 @@
-import { lookup as dnsLookup } from "node:dns";
-import { isIP } from "node:net";
-import { buildConnector } from "undici";
-
-/**
- * Proteção contra SSRF: o servidor baixa qualquer URL que o cliente enviar,
- * então por padrão ele recusa endereços de loopback, rede privada, link-local
- * (inclui o endpoint de metadados de nuvem 169.254.169.254) e similares.
- *
- * Para rodar o servidor numa rede privada e baixar de hosts internos de
- * propósito, defina ALLOW_PRIVATE_NETWORK=true.
- */
-
-export class UrlNotAllowedError extends Error {
-    constructor(message: string) {
-        super(message);
-        this.name = "UrlNotAllowedError";
-    }
-}
-
-const allowPrivateNetwork = () => process.env.ALLOW_PRIVATE_NETWORK === "true";
-
-function parseIPv4(ip: string): number[] | null {
-    const parts = ip.split(".").map(Number);
-    return parts.length === 4 && parts.every((n) => Number.isInteger(n) && n >= 0 && n <= 255)
-        ? parts
-        : null;
-}
-
-// Faixas IPv4 não públicas: [primeiro octeto, 2º octeto mín., 2º octeto máx.],
-// e o terceiro octeto só importa em 192.0.0.0/24.
-const BLOCKED_IPV4_RANGES: Array<[number, number, number]> = [
-    [0, 0, 255], // "esta rede"
-    [10, 0, 255], // privada
-    [127, 0, 255], // loopback
-    [100, 64, 127], // CGNAT
-    [169, 254, 254], // link-local / metadados de nuvem
-    [172, 16, 31], // privada
-    [192, 168, 168], // privada
-    [198, 18, 19], // benchmarking
-];
-
-function isBlockedIPv4([a, b, c]: number[]): boolean {
-    if (a >= 224) return true; // multicast, reservado e broadcast
-    if (a === 192 && b === 0 && c === 0) return true; // IETF protocol assignments
-    return BLOCKED_IPV4_RANGES.some(([first, min, max]) => a === first && b >= min && b <= max);
-}
-
-/** Troca um IPv4 embutido no fim ("::ffff:1.2.3.4") por dois grupos hexa. */
-function expandEmbeddedIPv4(text: string): string | null {
-    const embedded = text.match(/^(.*:)(\d+\.\d+\.\d+\.\d+)$/);
-    if (!embedded) return text;
-    const v4 = parseIPv4(embedded[2]);
-    if (!v4) return null;
-    return `${embedded[1]}${((v4[0] << 8) | v4[1]).toString(16)}:${((v4[2] << 8) | v4[3]).toString(16)}`;
-}
-
-/** Expande um IPv6 para 8 grupos de 16 bits (ou null se for inválido). */
-function parseIPv6(ip: string): number[] | null {
-    const text = expandEmbeddedIPv4(ip.split("%")[0].toLowerCase()); // remove zone id
-    if (text === null) return null;
-
-    const halves = text.split("::");
-    if (halves.length > 2) return null;
-    const head = halves[0] ? halves[0].split(":") : [];
-    const tail = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
-    const missing = 8 - head.length - tail.length;
-    const compressed = halves.length === 2;
-    if (compressed ? missing < 1 : missing !== 0) return null;
-
-    const groups = [...head, ...Array(missing).fill("0"), ...tail].map((g) => parseInt(g, 16));
-    return groups.every((g) => g >= 0 && g <= 0xffff) ? groups : null;
-}
-
-function isReservedIPv6Prefix(first: number): boolean {
-    return (
-        (first & 0xfe00) === 0xfc00 || // fc00::/7 (unique local)
-        (first & 0xffc0) === 0xfe80 || // fe80::/10 (link-local)
-        (first & 0xff00) === 0xff00 // multicast
-    );
-}
-
-function isBlockedIPv6(ip: string): boolean {
-    const g = parseIPv6(ip);
-    if (!g) return true; // não conseguiu interpretar: recusa por segurança
-
-    const zeros = (from: number, to: number) => g.slice(from, to).every((x) => x === 0);
-    const embeddedV4 = [g[6] >> 8, g[6] & 0xff, g[7] >> 8, g[7] & 0xff];
-
-    if (zeros(0, 7) && g[7] <= 1) return true; // :: e ::1
-    if (zeros(0, 5) && g[5] === 0xffff) return isBlockedIPv4(embeddedV4); // ::ffff:a.b.c.d
-    if (g[0] === 0x64 && g[1] === 0xff9b && zeros(2, 6)) return isBlockedIPv4(embeddedV4); // NAT64
-    return isReservedIPv6Prefix(g[0]);
-}
-
-/** true se o endereço IP (v4 ou v6) pertence a uma faixa não pública. */
-export function isBlockedAddress(ip: string): boolean {
-    const family = isIP(ip);
-    if (family === 4) return isBlockedIPv4(parseIPv4(ip)!);
-    if (family === 6) return isBlockedIPv6(ip);
-    return true;
-}
-
-function isBlockedHostname(hostname: string): boolean {
-    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-    if (host === "localhost" || host.endsWith(".localhost")) return true;
-    return isIP(host) !== 0 && isBlockedAddress(host);
-}
-
-/**
- * Valida a URL antes de enfileirar: só http/https e, a menos que
- * ALLOW_PRIVATE_NETWORK=true, nada de localhost ou IP privado literal.
- * Nomes de domínio que resolvem para IP privado são barrados na conexão.
- */
-export function assertDownloadableUrl(rawUrl: string): URL {
-    let url: URL;
-    try {
-        url = new URL(rawUrl);
-    } catch {
-        throw new UrlNotAllowedError("Invalid URL");
-    }
-
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new UrlNotAllowedError("Only http and https URLs are allowed");
-    }
-    if (!allowPrivateNetwork() && isBlockedHostname(url.hostname)) {
-        throw new UrlNotAllowedError("URLs pointing to local or private addresses are not allowed");
-    }
-    return url;
-}
-
-/**
- * Conector do undici que revalida o destino em cada conexão (inclusive nos
- * redirects): IP literal é checado antes de conectar e nomes são checados no
- * IP já resolvido, o que também cobre DNS rebinding.
- */
-export function createGuardedConnector(options: buildConnector.BuildOptions): buildConnector.connector {
-    const connect = buildConnector({
-        ...options,
-        lookup: (hostname, lookupOptions, callback) => {
-            dnsLookup(hostname, lookupOptions, (err, address, family) => {
-                if (err) return callback(err, address as never, family as never);
-                const list = Array.isArray(address) ? address.map((a) => a.address) : [address];
-                const blocked = !allowPrivateNetwork() && list.some(isBlockedAddress);
-                if (blocked) {
-                    return callback(
-                        new UrlNotAllowedError(`${hostname} resolves to a local or private address`),
-                        address as never,
-                        family as never,
-                    );
-                }
-                callback(null, address as never, family as never);
-            });
-        },
-    } as buildConnector.BuildOptions);
-
-    return (opts, callback) => {
-        if (!allowPrivateNetwork() && isBlockedHostname(opts.hostname)) {
-            callback(new UrlNotAllowedError("Blocked local or private address"), null);
-            return;
-        }
-        connect(opts, callback);
-    };
-}

server/test/helpers.ts

@@ -1,18 +0,0 @@
-import { mkdtempSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { vi } from "vitest";
-
-/**
- * Carrega os módulos do servidor com um STORAGE_ROOT temporário.
- * O SessionManager lê a variável e cria o singleton no import, então o módulo
- * precisa ser reimportado a cada teste.
- */
-export async function loadModules() {
-    const storageRoot = mkdtempSync(join(tmpdir(), "downloader-test-"));
-    process.env.STORAGE_ROOT = storageRoot;
-    vi.resetModules();
-    const { sessionManager } = await import("../src/lib/SessionManager.js");
-    const { DownloadManager } = await import("../src/lib/DownloadManager.js");
-    return { storageRoot, sessionManager, DownloadManager };
-}

server/test/netGuard.test.ts

@@ -1,188 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { rmSync } from "node:fs";
-import { Agent, interceptors } from "undici";
-import {
-    UrlNotAllowedError,
-    assertDownloadableUrl,
-    createGuardedConnector,
-    isBlockedAddress,
-} from "../src/lib/netGuard.js";
-import { loadModules } from "./helpers.js";
-
-// Resolve "internal.test" para um IP privado e o resto para um público,
-// sem depender de DNS real.
-vi.mock("node:dns", () => ({
-    lookup: (
-        host: string,
-        opts: { all?: boolean },
-        cb: (err: Error | null, address: unknown, family?: number) => void,
-    ) => {
-        const address = host === "internal.test" ? "10.0.0.5" : "93.184.216.34";
-        if (opts?.all) cb(null, [{ address, family: 4 }]);
-        else cb(null, address, 4);
-    },
-}));
-
-afterEach(() => {
-    delete process.env.ALLOW_PRIVATE_NETWORK;
-});
-
-describe("isBlockedAddress", () => {
-    it.each([
-        "0.0.0.0", "10.1.2.3", "100.64.0.1", "127.0.0.1", "169.254.169.254",
-        "172.16.0.1", "172.31.255.255", "192.168.1.1", "198.18.0.1", "224.0.0.1",
-        "255.255.255.255", "::", "::1", "fc00::1", "fd12:3456::1", "fe80::1",
-        "ff02::1", "::ffff:127.0.0.1", "::ffff:7f00:1", "::ffff:10.0.0.1",
-        "64:ff9b::7f00:1",
-    ])("bloqueia %s", (ip) => {
-        expect(isBlockedAddress(ip)).toBe(true);
-    });
-
-    it.each([
-        "8.8.8.8", "1.1.1.1", "93.184.216.34", "172.15.0.1", "172.32.0.1",
-        "100.63.0.1", "198.20.0.1", "2606:4700:4700::1111", "::ffff:8.8.8.8",
-    ])("permite %s", (ip) => {
-        expect(isBlockedAddress(ip)).toBe(false);
-    });
-
-    it("bloqueia o que não é IP", () => {
-        expect(isBlockedAddress("example.com")).toBe(true);
-    });
-});
-
-describe("assertDownloadableUrl", () => {
-    it("aceita http e https públicos", () => {
-        expect(assertDownloadableUrl("https://example.com/a.zip").hostname).toBe("example.com");
-        expect(assertDownloadableUrl("http://8.8.8.8/a.zip").hostname).toBe("8.8.8.8");
-    });
-
-    it.each(["ftp://example.com/a", "file:///etc/passwd", "javascript:alert(1)"])(
-        "recusa o protocolo de %s",
-        (url) => {
-            expect(() => assertDownloadableUrl(url)).toThrow(/http and https/);
-        },
-    );
-
-    it("recusa URL inválida", () => {
-        expect(() => assertDownloadableUrl("not a url")).toThrow(UrlNotAllowedError);
-    });
-
-    it.each([
-        "http://localhost:3000/", "http://app.localhost/", "http://127.0.0.1/",
-        "http://[::1]/", "http://169.254.169.254/latest/meta-data/",
-        "http://10.0.0.1/", "http://192.168.0.10:8080/", "http://[::ffff:127.0.0.1]/",
-        "http://2130706433/", // 127.0.0.1 em decimal: o parser do WHATWG normaliza
-    ])("recusa %s", (url) => {
-        expect(() => assertDownloadableUrl(url)).toThrow(/local or private/);
-    });
-
-    it("libera endereços privados com ALLOW_PRIVATE_NETWORK=true", () => {
-        process.env.ALLOW_PRIVATE_NETWORK = "true";
-        expect(assertDownloadableUrl("http://127.0.0.1/").hostname).toBe("127.0.0.1");
-    });
-});
-
-describe("createGuardedConnector", () => {
-    const connect = (hostname: string) =>
-        new Promise<Error | null>((done) => {
-            const connector = createGuardedConnector({ timeout: 2000 });
-            connector({ hostname, host: hostname, protocol: "http:", port: "9" }, (err, socket) => {
-                socket?.destroy();
-                done(err);
-            });
-        });
-
-    it("recusa IP literal privado antes de conectar", async () => {
-        expect(await connect("127.0.0.1")).toBeInstanceOf(UrlNotAllowedError);
-    });
-
-    it("recusa nome que resolve para IP privado", async () => {
-        const err = await connect("internal.test");
-        expect(err).toBeInstanceOf(UrlNotAllowedError);
-        expect(err?.message).toMatch(/internal\.test resolves/);
-    });
-
-    it("deixa passar nome que resolve para IP público (falha só ao conectar)", async () => {
-        const err = await connect("public.test");
-        expect(err).not.toBeInstanceOf(UrlNotAllowedError);
-    });
-});
-
-describe("DownloadManager com a proteção", () => {
-    let origin: Server | undefined;
-
-    afterEach(async () => {
-        if (origin) await new Promise((done) => origin!.close(done));
-        origin = undefined;
-    });
-
-    async function startOrigin(handler: Parameters<typeof createServer>[1]) {
-        origin = createServer(handler);
-        await new Promise<void>((done) => origin!.listen(0, "127.0.0.1", done));
-        return (origin.address() as AddressInfo).port;
-    }
-
-    async function waitWhileDownloading(read: () => string | undefined) {
-        for (let i = 0; i < 500 && read() === "downloading"; i++) {
-            await new Promise((done) => setTimeout(done, 5));
-        }
-    }
-
-    it("recusa enfileirar URL privada", async () => {
-        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
-        const manager = new DownloadManager(new Agent());
-        const session = sessionManager.getSession();
-        // loadModules() reimporta os módulos, então a classe não é a mesma: compara pelo nome.
-        await expect(manager.queueDownload(session.id, "http://127.0.0.1:1/x")).rejects.toMatchObject({
-            name: "UrlNotAllowedError",
-        });
-        expect(manager.getTasks(session.id)).toEqual([]);
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-
-    it("segue redirect e salva o arquivo final, não o corpo do 302", async () => {
-        process.env.ALLOW_PRIVATE_NETWORK = "true";
-        const port = await startOrigin((req, res) => {
-            if (req.url === "/start") {
-                res.writeHead(302, { location: "/final.bin" });
-                res.end("redirecting");
-                return;
-            }
-            res.setHeader("content-length", "5");
-            res.end("hello");
-        });
-
-        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
-        const agent = new Agent({ connect: createGuardedConnector({ timeout: 2000 }) }).compose(
-            interceptors.redirect({ maxRedirections: 5 }),
-        );
-        const manager = new DownloadManager(agent);
-        const session = sessionManager.getSession();
-        const task = await manager.queueDownload(session.id, `http://127.0.0.1:${port}/start`);
-        await waitWhileDownloading(() => manager.getTask(task.id)?.status);
-
-        const finished = manager.getTask(task.id)!;
-        expect(finished.status).toBe("completed");
-        expect(finished.totalBytes).toBe(5);
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-
-    it("marca erro quando a resposta 3xx não é seguida", async () => {
-        process.env.ALLOW_PRIVATE_NETWORK = "true";
-        const port = await startOrigin((_req, res) => {
-            res.writeHead(302);
-            res.end("nope");
-        });
-
-        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
-        const manager = new DownloadManager(new Agent());
-        const session = sessionManager.getSession();
-        const task = await manager.queueDownload(session.id, `http://127.0.0.1:${port}/`);
-        await waitWhileDownloading(() => manager.getTask(task.id)?.status);
-
-        expect(manager.getTask(task.id)).toMatchObject({ status: "error", error: "HTTP Error 302" });
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-});

server/test/sessions.test.ts

@@ -1,106 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { existsSync, readdirSync, rmSync } from "node:fs";
-import { sep } from "node:path";
-import { Agent } from "undici";
-import { loadModules } from "./helpers.js";
-
-const HOUR = 60 * 60 * 1000;
-
-let origin: Server;
-let originUrl: string;
-
-beforeEach(async () => {
-    process.env.ALLOW_PRIVATE_NETWORK = "true"; // a origem de teste está em 127.0.0.1
-    vi.useFakeTimers({ toFake: ["setInterval", "Date"] });
-    origin = createServer((_req, res) => {
-        res.setHeader("content-length", "5");
-        res.end("hello");
-    });
-    await new Promise<void>((done) => origin.listen(0, "127.0.0.1", done));
-    originUrl = `http://127.0.0.1:${(origin.address() as AddressInfo).port}/file.txt`;
-});
-
-afterEach(async () => {
-    delete process.env.ALLOW_PRIVATE_NETWORK;
-    vi.useRealTimers();
-    await new Promise((done) => origin.close(done));
-});
-
-async function waitForStatus(
-    read: () => string | undefined,
-    wanted: string,
-) {
-    for (let i = 0; i < 500 && read() !== wanted; i++) {
-        await new Promise((done) => setImmediate(done));
-    }
-    expect(read()).toBe(wanted);
-}
-
-describe("tasks e sessões", () => {
-    it("descarta as tasks e os arquivos quando a sessão expira", async () => {
-        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
-        const manager = new DownloadManager(new Agent());
-
-        const session = sessionManager.getSession();
-        const task = await manager.queueDownload(session.id, originUrl);
-        await waitForStatus(() => manager.getTask(task.id)?.status, "completed");
-        expect(readdirSync(`${storageRoot}/${session.id}`)).toHaveLength(1);
-
-        vi.setSystemTime(Date.now() + HOUR + 1000);
-        vi.advanceTimersByTime(60_000); // dispara o coletor
-
-        expect(manager.getTask(task.id)).toBeUndefined();
-        expect(manager.getTasks(session.id)).toEqual([]);
-        expect(existsSync(`${storageRoot}/${session.id}`)).toBe(false);
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-
-    it("mantém as tasks de outras sessões ainda ativas", async () => {
-        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
-        const manager = new DownloadManager(new Agent());
-
-        const expiring = sessionManager.getSession();
-        await manager.queueDownload(expiring.id, originUrl);
-
-        vi.setSystemTime(Date.now() + HOUR - 1000);
-        const alive = sessionManager.getSession(); // criada perto do fim da outra
-        const kept = await manager.queueDownload(alive.id, originUrl);
-        vi.setSystemTime(Date.now() + 2000);
-        vi.advanceTimersByTime(60_000);
-
-        expect(manager.getTasks(expiring.id)).toEqual([]);
-        expect(manager.getTask(kept.id)).toBeDefined();
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-});
-
-describe("id de sessão", () => {
-    it("aceita um UUID já conhecido", async () => {
-        const { sessionManager, storageRoot } = await loadModules();
-        const first = sessionManager.getSession();
-        expect(sessionManager.getSession(first.id).id).toBe(first.id);
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-
-    it.each(["..", ".", "../../etc", "a/b", "not-a-uuid", ""])(
-        "ignora o id inválido %j e cria outra sessão",
-        async (bad) => {
-            const { sessionManager, storageRoot } = await loadModules();
-            const session = sessionManager.getSession(bad);
-            expect(session.id).toMatch(/^[0-9a-f-]{36}$/);
-            expect(sessionManager.getSessionPath(session.id)).toBe(`${storageRoot}${sep}${session.id}`);
-            rmSync(storageRoot, { recursive: true, force: true });
-        },
-    );
-
-    it("não deixa um id '..' apagar a pasta pai quando expira", async () => {
-        const { sessionManager, storageRoot } = await loadModules();
-        sessionManager.getSession("..");
-        vi.setSystemTime(Date.now() + HOUR + 1000);
-        vi.advanceTimersByTime(60_000);
-        expect(existsSync(storageRoot)).toBe(true);
-        rmSync(storageRoot, { recursive: true, force: true });
-    });
-});

web/README.md

@@ -0,0 +1,73 @@
+# React + TypeScript + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
+
+## React Compiler
+
+The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
+
+## Expanding the ESLint configuration
+
+If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
+
+```js
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      // Other configs...
+
+      // Remove tseslint.configs.recommended and replace with this
+      tseslint.configs.recommendedTypeChecked,
+      // Alternatively, use this for stricter rules
+      tseslint.configs.strictTypeChecked,
+      // Optionally, add this for stylistic rules
+      tseslint.configs.stylisticTypeChecked,
+
+      // Other configs...
+    ],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.node.json', './tsconfig.app.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+      // other options...
+    },
+  },
+])
+```
+
+You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
+
+```js
+// eslint.config.js
+import reactX from 'eslint-plugin-react-x'
+import reactDom from 'eslint-plugin-react-dom'
+
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      // Other configs...
+      // Enable lint rules for React
+      reactX.configs['recommended-typescript'],
+      // Enable lint rules for React DOM
+      reactDom.configs.recommended,
+    ],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.node.json', './tsconfig.app.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+      // other options...
+    },
+  },
+])
+```

web/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Ephemeral Downloader</title>
+    <title>web</title>
   </head>
   <body>
     <div id="root"></div>

web/package.json

@@ -7,8 +7,6 @@
     "dev": "vite",
     "build": "tsc -b && vite build",
     "lint": "eslint .",
-    "test": "vitest run",
-    "typecheck": "tsc -b",
     "preview": "vite preview"
   },
   "dependencies": {
@@ -17,6 +15,7 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "tailwind-merge": "^3.4.0",
+    "uuid": "^13.0.0",
     "zod": "^3.25.76"
   },
   "devDependencies": {
@@ -35,7 +34,6 @@
     "tailwindcss": "^4.1.18",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.46.4",
-    "vite": "^7.2.4",
-    "vitest": "^5.0.3"
+    "vite": "^7.2.4"
   }
 }

web/src/App.tsx

@@ -1,25 +1,43 @@
+import { AlertCircle, HardDrive, Server } from "lucide-react";
 import { DownloadForm } from "./components/feature/DownloadForm";
 import { DownloadItem } from "./components/feature/DownloadItem";
-import { Layout } from "./components/ui/Layout";
-import { Alert, AlertDescription, AlertTitle } from "./components/ui/Alert";
-import { AlertCircle } from "lucide-react";
-import { SessionProvider, useSession } from "./context/SessionContext";
 import { SessionTimer } from "./components/feature/SessionTimer";
+import { Alert, AlertDescription, AlertTitle } from "./components/ui/Alert";
+import { Layout } from "./components/ui/Layout";
+import { SessionProvider } from "./context/SessionContext";
+import { useSession } from "./context/session-context";
 
 function DownloadList() {
   const { tasks, expiresAt } = useSession();
 
   return (
-    <div className="space-y-4">
-      <div className="flex items-center justify-between">
-        <h2 className="text-xl font-semibold tracking-tight">Active Downloads</h2>
-        <SessionTimer expiresAt={expiresAt} />
+    <section className="space-y-5">
+      <div className="flex flex-col gap-4 rounded-[2rem] border border-border/70 bg-card/60 p-6 shadow-[0_24px_80px_-40px_rgba(15,23,42,0.95)] backdrop-blur-xl md:flex-row md:items-center md:justify-between">
+        <div className="space-y-2">
+          <p className="text-xs font-semibold uppercase tracking-[0.24em] text-primary/80">
+            Transfer activity
+          </p>
+          <h2 className="text-2xl font-semibold tracking-tight text-foreground">
+            Downloads in this session
+          </h2>
+          <p className="max-w-2xl text-sm leading-6 text-muted-foreground">
+            Monitor queue status, transfer speed and final files from a single workspace.
+          </p>
+        </div>
+        <SessionTimer expiresAt={expiresAt} className="md:min-w-[260px]" />
       </div>
 
       {tasks.length === 0 ? (
-        <div className="flex flex-col items-center justify-center py-12 text-center text-muted-foreground border-2 border-dashed rounded-lg bg-card/50">
-          <p>No downloads in session</p>
-          <p className="text-xs opacity-70">Files are removed after 1 hour of inactivity</p>
+        <div className="rounded-[2rem] border border-dashed border-border/80 bg-card/35 px-6 py-14 text-center shadow-[0_24px_80px_-50px_rgba(15,23,42,0.95)]">
+          <p className="text-xs font-semibold uppercase tracking-[0.24em] text-primary/75">
+            Queue is empty
+          </p>
+          <h3 className="mt-3 text-2xl font-semibold tracking-tight text-foreground">
+            No downloads yet
+          </h3>
+          <p className="mx-auto mt-3 max-w-xl text-sm leading-6 text-muted-foreground">
+            Your queued, active and completed transfers will appear here with progress, speed and the final save action.
+          </p>
         </div>
       ) : (
         <div className="grid gap-4">
@@ -28,42 +46,77 @@ function DownloadList() {
           ))}
         </div>
       )}
-    </div>
+    </section>
   );
 }
 
 function Main() {
-  const { queueDownload } = useSession();
+  const { queueDownload, sessionId } = useSession();
+
+  const handleDownload = async (url: string): Promise<void> => {
+    await queueDownload(url);
+  };
 
   return (
     <Layout>
-      <div className="grid gap-8 lg:grid-cols-12">
-        {/* Left Column: Input Form */}
-        <div className="lg:col-span-4 space-y-6">
-          <div className="sticky top-24 space-y-6">
-            <section className="space-y-4">
-              <div className="space-y-2">
-                <h2 className="text-xl font-semibold tracking-tight">New Download</h2>
-                <p className="text-sm text-muted-foreground">
-                  Paste a link to start. Files are downloaded to the server first.
+      <div className="grid gap-8 xl:grid-cols-[minmax(0,430px)_minmax(0,1fr)] xl:items-start">
+        <div className="space-y-6 xl:sticky xl:top-28">
+          <section className="rounded-[2rem] border border-border/70 bg-card/55 p-6 shadow-[0_24px_90px_-45px_rgba(15,23,42,0.98)] backdrop-blur-xl md:p-7">
+            <span className="inline-flex rounded-full border border-primary/20 bg-primary/10 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.24em] text-primary">
+              Private download workspace
+            </span>
+
+            <div className="mt-5 space-y-3">
+              <h1 className="max-w-lg text-3xl font-semibold tracking-tight text-foreground md:text-[2.5rem] md:leading-[1.05]">
+                Queue secure transfers from a cleaner control panel.
+              </h1>
+              <p className="max-w-xl text-sm leading-7 text-muted-foreground md:text-[0.95rem]">
+                Paste a file URL, let the server fetch it first, then keep every transfer visible until the session window expires.
+              </p>
+            </div>
+
+            <div className="mt-6 grid gap-3 sm:grid-cols-2">
+              <div className="rounded-[1.5rem] border border-white/6 bg-background/45 p-4">
+                <Server className="h-5 w-5 text-primary" />
+                <p className="mt-4 text-sm font-semibold text-foreground">Server-side transfer</p>
+                <p className="mt-2 text-sm leading-6 text-muted-foreground">
+                  Downloads are fetched on the VPS first, then exposed as a final file in your session.
                 </p>
               </div>
-              <DownloadForm onDownload={queueDownload} />
-            </section>
+              <div className="rounded-[1.5rem] border border-white/6 bg-background/45 p-4">
+                <HardDrive className="h-5 w-5 text-primary" />
+                <p className="mt-4 text-sm font-semibold text-foreground">Ephemeral storage</p>
+                <p className="mt-2 text-sm leading-6 text-muted-foreground">
+                  Files stay available for one hour of activity and are removed automatically after expiration.
+                </p>
+              </div>
+            </div>
+          </section>
 
-            <Alert variant="destructive">
-              <AlertCircle className="h-4 w-4" />
-              <AlertTitle>Ephemeral Session</AlertTitle>
-              <AlertDescription>
-                Files are stored for <strong>1 hour</strong>. The timer resets on interaction.
-                After expiration, all files are permanently deleted.
-              </AlertDescription>
-            </Alert>
-          </div>
+          <section className="rounded-[2rem] border border-border/70 bg-card/70 p-6 shadow-[0_24px_90px_-45px_rgba(15,23,42,0.98)] backdrop-blur-xl md:p-7">
+            <div className="space-y-2">
+              <p className="text-xs font-semibold uppercase tracking-[0.24em] text-primary/80">New transfer</p>
+              <h2 className="text-2xl font-semibold tracking-tight text-foreground">Start a new download</h2>
+              <p className="text-sm leading-6 text-muted-foreground">
+                Paste a direct file URL to add it to the active session queue.
+              </p>
+            </div>
+
+            <div className="mt-6">
+              <DownloadForm onDownload={handleDownload} isReady={Boolean(sessionId)} />
+            </div>
+          </section>
+
+          <Alert variant="destructive">
+            <AlertCircle className="h-4 w-4" />
+            <AlertTitle>Ephemeral session policy</AlertTitle>
+            <AlertDescription>
+              Files are stored for <strong>1 hour</strong>. The timer resets on activity, and once the session expires every stored file is deleted permanently.
+            </AlertDescription>
+          </Alert>
         </div>
 
-        {/* Right Column: Downloads List */}
-        <div className="lg:col-span-8">
+        <div className="min-w-0">
           <DownloadList />
         </div>
       </div>

web/src/assets/react.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>

web/src/components/feature/DownloadForm.tsx

@@ -1,23 +1,32 @@
 import { useState } from "react";
+import { Download, Loader2 } from "lucide-react";
+import { z } from "zod";
 import { Button } from "../ui/Button";
 import { Input } from "../ui/Input";
-import { Download } from "lucide-react";
-import { z } from "zod";
 
 const formSchema = z.object({
     url: z.string().url("Please enter a valid URL"),
 });
 
 interface DownloadFormProps {
-    onDownload: (url: string) => Promise<void>;
+    onDownload: (url: string) => Promise<void> | void;
+    isReady: boolean;
 }
 
-export function DownloadForm({ onDownload }: DownloadFormProps) {
+function getErrorMessage(error: unknown): string {
+    if (error instanceof Error && error.message) {
+        return error.message;
+    }
+
+    return "Unable to queue the download right now.";
+}
+
+export function DownloadForm({ onDownload, isReady }: DownloadFormProps) {
     const [url, setUrl] = useState("");
     const [error, setError] = useState<string | null>(null);
-    const [submitting, setSubmitting] = useState(false);
+    const [isSubmitting, setIsSubmitting] = useState(false);
 
-    const handleSubmit = async (e: React.FormEvent) => {
+    const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
         e.preventDefault();
         setError(null);
 
@@ -28,40 +37,53 @@ export function DownloadForm({ onDownload }: DownloadFormProps) {
             return;
         }
 
-        setSubmitting(true);
+        if (!isReady) {
+            setError("Session is still initializing. Try again in a moment.");
+            return;
+        }
+
         try {
+            setIsSubmitting(true);
             await onDownload(url);
             setUrl("");
-        } catch (err) {
-            setError(err instanceof Error ? err.message : "Failed to queue download");
+        } catch (submitError: unknown) {
+            setError(getErrorMessage(submitError));
         } finally {
-            setSubmitting(false);
+            setIsSubmitting(false);
         }
     };
 
     return (
-        <form onSubmit={handleSubmit} className="flex w-full flex-col gap-4">
-            <div className="flex w-full items-start gap-2">
-                <div className="flex-1 space-y-1">
-                    <Input
-                        type="url"
-                        aria-label="File URL"
-                        aria-invalid={error ? true : undefined}
-                        aria-describedby={error ? "url-error" : undefined}
-                        placeholder="https://example.com/file.zip"
-                        value={url}
-                        onChange={(e) => setUrl(e.target.value)}
-                        className={error ? "border-destructive focus-visible:ring-destructive" : ""}
-                    />
-                    {error && (
-                        <p id="url-error" role="alert" className="text-xs text-destructive">
-                            {error}
-                        </p>
-                    )}
+        <form onSubmit={handleSubmit} className="flex w-full flex-col gap-5">
+            <div className="space-y-3">
+                <label htmlFor="download-url" className="text-sm font-semibold text-foreground">
+                    File URL
+                </label>
+                <Input
+                    id="download-url"
+                    type="url"
+                    placeholder="https://example.com/file.zip"
+                    value={url}
+                    onChange={(e) => setUrl(e.target.value)}
+                    disabled={isSubmitting}
+                    className={error ? "border-destructive/60 focus-visible:ring-destructive/15" : ""}
+                />
+                <div className="flex flex-col gap-2 text-xs text-muted-foreground sm:flex-row sm:items-center sm:justify-between">
+                    <span>Use a direct file link whenever possible for faster server-side fetching.</span>
+                    <span className="font-medium text-primary/80">
+                        {isReady ? "Validated before queueing" : "Preparing session"}
+                    </span>
                 </div>
-                <Button type="submit" disabled={submitting}>
-                    <Download className="mr-2 h-4 w-4" />
-                    Download
+                {error ? <p className="text-sm text-destructive">{error}</p> : null}
+            </div>
+
+            <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                <p className="max-w-sm text-sm leading-6 text-muted-foreground">
+                    The transfer starts on the server first, then becomes available in your session list.
+                </p>
+                <Button type="submit" disabled={!isReady || isSubmitting} className="w-full gap-2 sm:w-auto sm:min-w-[180px]">
+                    {isSubmitting ? <Loader2 className="h-4 w-4 animate-spin" /> : <Download className="h-4 w-4" />}
+                    {isSubmitting ? "Queueing..." : "Queue download"}
                 </Button>
             </div>
         </form>

web/src/components/feature/DownloadItem.test.tsx

@@ -1,109 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { renderToStaticMarkup } from "react-dom/server";
-import { DownloadItem, type DownloadItemData } from "./DownloadItem";
-
-const base: DownloadItemData = {
-    id: "t1",
-    sessionId: "s1",
-    url: "https://example.com/file.zip",
-    filename: "file.zip",
-    status: "downloading",
-    progress: 40,
-    totalBytes: 10 * 1024 * 1024,
-    receivedBytes: 4 * 1024 * 1024,
-    speed: 2 * 1024 * 1024,
-    createdAt: 0,
-};
-
-const render = (patch: Partial<DownloadItemData> = {}) =>
-    renderToStaticMarkup(<DownloadItem item={{ ...base, ...patch }} />);
-
-describe("DownloadItem", () => {
-    describe("em andamento (caminho principal)", () => {
-        const html = render();
-
-        it("mostra status, bytes, velocidade e porcentagem", () => {
-            expect(html).toContain("downloading");
-            expect(html).toContain("4.0 MB");
-            expect(html).toContain("10.0 MB");
-            expect(html).toContain("2.00 MB/s");
-            expect(html).toContain("40%");
-        });
-
-        it("usa o spinner e não mostra botão nem erro", () => {
-            expect(html).toContain("animate-spin");
-            expect(html).not.toContain("Save to Disk");
-            expect(html).not.toContain("Ready for download");
-        });
-    });
-
-    describe("status queued", () => {
-        it("mostra a mensagem de fila e o ícone pulsante", () => {
-            const html = render({ status: "queued" });
-            expect(html).toContain("Queued on server...");
-            expect(html).toContain("animate-pulse");
-            expect(html).not.toContain("animate-spin");
-        });
-    });
-
-    describe("status completed", () => {
-        const html = render({ status: "completed", progress: 100 });
-
-        it("mostra o botão de salvar e o tamanho final", () => {
-            expect(html).toContain("Save to Disk");
-            expect(html).toContain("Ready for download (10.0 MB)");
-        });
-
-        it("esconde a seção de progresso", () => {
-            expect(html).not.toContain("MB/s");
-            expect(html).not.toContain("100%");
-        });
-    });
-
-    describe("status error", () => {
-        it("mostra a mensagem de erro da task", () => {
-            const html = render({ status: "error", error: "HTTP Error 404" });
-            expect(html).toContain("HTTP Error 404");
-            expect(html).not.toContain("Save to Disk");
-            expect(html).not.toContain("MB/s");
-        });
-
-        it("usa a mensagem padrão sem detalhe de erro", () => {
-            expect(render({ status: "error" })).toContain("Unknown error occurred");
-        });
-    });
-
-    describe("título", () => {
-        it("usa o nome do arquivo", () => {
-            expect(render()).toContain('title="file.zip"');
-        });
-
-        it("cai para a URL quando não há nome do arquivo", () => {
-            expect(render({ filename: "" })).toContain(
-                'title="https://example.com/file.zip"'
-            );
-        });
-    });
-
-    describe("valores zerados durante o download", () => {
-        it("tamanho total desconhecido mostra ??", () => {
-            expect(render({ totalBytes: 0 })).toContain("??");
-        });
-
-        it("sem velocidade mostra 0 B/s", () => {
-            expect(render({ speed: 0 })).toContain("0 B/s");
-        });
-
-        it("sem progresso mostra 0%", () => {
-            expect(render({ progress: 0 })).toContain(">0%<");
-        });
-
-        it("sem bytes recebidos mostra hífen", () => {
-            expect(render({ receivedBytes: 0 })).toContain("- / 10.0 MB");
-        });
-
-        it("arredonda a porcentagem", () => {
-            expect(render({ progress: 40.6 })).toContain("41%");
-        });
-    });
-});

web/src/components/feature/DownloadItem.tsx

@@ -1,147 +1,218 @@
-import type { ReactNode } from "react";
+import { useState } from "react";
 import {
     FileCheck,
     FileWarning,
+    HardDrive,
     Loader2,
     Server,
-    HardDrive
 } from "lucide-react";
+import { DownloadStatus, DownloadTask, useSession } from "../../context/session-context";
+import { formatBytes, formatSpeed } from "../../lib/utils";
 import { Button } from "../ui/Button";
 import { Card, CardContent } from "../ui/Card";
 import { Progress } from "../ui/ProgressBar";
-import { formatBytes, formatSpeed } from "../../lib/utils";
 
-// Mesma origem por padrão (em produção o Fastify serve a API e o build do front).
-// Defina VITE_API_URL para apontar para outro host.
 const API_URL = import.meta.env.VITE_API_URL || "";
-
-export type DownloadStatus = "queued" | "downloading" | "completed" | "error";
-
-export type DownloadItemData = {
-    id: string;
-    sessionId: string;
-    url: string;
-    filename: string;
-    status: DownloadStatus;
-    progress: number;
-    totalBytes: number;
-    receivedBytes: number;
-    speed: number;
-    error?: string;
-    createdAt: number;
-};
+const createdAtFormatter = new Intl.DateTimeFormat(undefined, {
+    hour: "2-digit",
+    minute: "2-digit",
+});
 
 interface DownloadItemProps {
-    item: DownloadItemData;
+    item: DownloadTask;
 }
 
-const ICON_BOX = "flex h-10 w-10 items-center justify-center rounded-full";
-
-const STATUS_ICON: Record<DownloadStatus, { box: string; icon: ReactNode }> = {
-    completed: { box: "bg-green-500/10 text-green-500", icon: <FileCheck className="h-5 w-5" /> },
-    error: { box: "bg-destructive/10 text-destructive", icon: <FileWarning className="h-5 w-5" /> },
-    queued: {
-        box: "bg-secondary text-secondary-foreground",
-        icon: <Server className="h-5 w-5 animate-pulse" />,
-    },
-    downloading: { box: "bg-primary/10 text-primary", icon: <Loader2 className="h-5 w-5 animate-spin" /> },
+const statusLabel: Record<DownloadStatus, string> = {
+    queued: "Queued",
+    downloading: "Transferring",
+    completed: "Ready",
+    error: "Issue",
 };
 
-function StatusIcon({ status }: { status: DownloadStatus }) {
-    const { box, icon } = STATUS_ICON[status];
-    return <div className={`${ICON_BOX} ${box}`}>{icon}</div>;
-}
-
-function ProgressSection({ item }: { item: DownloadItemData }) {
-    const total = item.totalBytes ? formatBytes(item.totalBytes) : "??";
-
-    return (
-        <div className="space-y-2 pt-2">
-            <div className="flex justify-between text-xs text-muted-foreground">
-                <span>{item.status === "queued" ? "Queued on server..." : item.status}</span>
-                <span>{formatBytes(item.receivedBytes || 0)} / {total}</span>
-            </div>
-            <Progress value={item.progress || 0} className="h-1.5" />
-            <div className="flex justify-between text-xs text-muted-foreground">
-                <span>{item.speed ? formatSpeed(item.speed) : "0 B/s"}</span>
-                <span>{item.progress ? `${Math.round(item.progress)}%` : "0%"}</span>
-            </div>
-        </div>
-    );
-}
-
-function StatusDetails({ item }: { item: DownloadItemData }) {
-    if (item.status === "completed") {
-        return (
-            <div className="pt-2 flex items-center gap-2 text-xs text-green-500">
-                <FileCheck className="w-3 h-3" />
-                <span>Ready for download ({formatBytes(item.totalBytes)})</span>
-            </div>
-        );
+function getDownloadErrorMessage(error: unknown): string {
+    if (error instanceof Error && error.message) {
+        return error.message;
     }
 
-    if (item.status === "error") {
-        return (
-            <div className="text-sm text-destructive pt-1">
-                {item.error || "Unknown error occurred"}
-            </div>
-        );
-    }
-
-    return <ProgressSection item={item} />;
-}
-
-async function saveToDisk(item: DownloadItemData) {
-    try {
-        const sessionId = localStorage.getItem("downloader_session_id") || "";
-        const res = await fetch(`${API_URL}/api/download/${item.id}`, {
-            headers: { "x-session-id": sessionId }
-        });
-        if (!res.ok) throw new Error("Download failed");
-
-        const blob = await res.blob();
-        const url = window.URL.createObjectURL(blob);
-        const a = document.createElement("a");
-        a.href = url;
-        a.download = item.filename;
-        document.body.appendChild(a);
-        a.click();
-        window.URL.revokeObjectURL(url);
-        document.body.removeChild(a);
-    } catch {
-        alert("Failed to download file");
-    }
+    return "Failed to download file.";
 }
 
 export function DownloadItem({ item }: DownloadItemProps) {
-    return (
-        <Card className="overflow-hidden transition-all hover:bg-muted/50">
-            <CardContent className="p-4">
-                <div className="flex items-start gap-4">
-                    <div className="mt-1">
-                        <StatusIcon status={item.status} />
-                    </div>
+    const { sessionId } = useSession();
+    const [downloadError, setDownloadError] = useState<string | null>(null);
+    const [isSaving, setIsSaving] = useState(false);
+    const isCompleted = item.status === "completed";
+    const isError = item.status === "error";
+    const isQueued = item.status === "queued";
 
-                    <div className="flex-1 space-y-1 min-w-0">
-                        <div className="flex items-start justify-between gap-2">
-                            <div className="space-y-1 truncate">
-                                <h3 className="font-medium leading-none truncate" title={item.filename || item.url}>
-                                    {item.filename || item.url}
-                                </h3>
-                                <p className="text-xs text-muted-foreground truncate" title={item.url}>
-                                    {item.url}
-                                </p>
+    const statusBadgeClass = isCompleted
+        ? "border-emerald-400/20 bg-emerald-400/10 text-emerald-300"
+        : isError
+            ? "border-destructive/30 bg-destructive/10 text-destructive"
+            : isQueued
+                ? "border-amber-400/20 bg-amber-400/10 text-amber-300"
+                : "border-primary/20 bg-primary/10 text-primary";
+
+    const statusDetail = isCompleted
+        ? "File cached and ready to be saved locally."
+        : isError
+            ? "The transfer stopped before completion."
+            : isQueued
+                ? "Waiting for the server to start processing."
+                : "Receiving data from the source URL.";
+
+    const handleDownloadFile = async (): Promise<void> => {
+        try {
+            setDownloadError(null);
+            setIsSaving(true);
+            const response = await fetch(`${API_URL}/api/download/${item.id}`, {
+                headers: { "x-session-id": sessionId },
+            });
+
+            if (!response.ok) {
+                throw new Error("Failed to fetch the stored file.");
+            }
+
+            const blob = await response.blob();
+            const url = window.URL.createObjectURL(blob);
+            const anchor = document.createElement("a");
+            anchor.href = url;
+            anchor.download = item.filename;
+            document.body.appendChild(anchor);
+            anchor.click();
+            window.URL.revokeObjectURL(url);
+            document.body.removeChild(anchor);
+        } catch (error: unknown) {
+            setDownloadError(getDownloadErrorMessage(error));
+        } finally {
+            setIsSaving(false);
+        }
+    };
+
+    return (
+        <Card className="group overflow-hidden border-border/80 bg-card/75 transition-all duration-200 hover:-translate-y-0.5 hover:border-primary/25 hover:bg-card/90">
+            <CardContent className="p-5">
+                <div className="flex flex-col gap-5">
+                    <div className="flex flex-col gap-4 lg:flex-row lg:items-start lg:justify-between">
+                        <div className="flex min-w-0 gap-4">
+                            <div className="mt-1">
+                                {isCompleted ? (
+                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-emerald-400/20 bg-emerald-400/10 text-emerald-300">
+                                        <FileCheck className="h-5 w-5" />
+                                    </div>
+                                ) : isError ? (
+                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-destructive/30 bg-destructive/10 text-destructive">
+                                        <FileWarning className="h-5 w-5" />
+                                    </div>
+                                ) : isQueued ? (
+                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-amber-400/20 bg-amber-400/10 text-amber-300">
+                                        <Server className="h-5 w-5" />
+                                    </div>
+                                ) : (
+                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-primary/20 bg-primary/10 text-primary">
+                                        <Loader2 className="h-5 w-5 animate-spin" />
+                                    </div>
+                                )}
+                            </div>
+
+                            <div className="min-w-0 space-y-3">
+                                <div className="flex flex-wrap items-center gap-2">
+                                    <span className={`inline-flex rounded-full border px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.2em] ${statusBadgeClass}`}>
+                                        {statusLabel[item.status]}
+                                    </span>
+                                    <span className="text-xs text-muted-foreground">
+                                        Created at {createdAtFormatter.format(item.createdAt)}
+                                    </span>
+                                </div>
+
+                                <div className="space-y-1">
+                                    <h3 className="truncate text-base font-semibold tracking-tight text-foreground" title={item.filename || item.url}>
+                                        {item.filename || item.url}
+                                    </h3>
+                                    <p className="truncate text-sm text-muted-foreground" title={item.url}>
+                                        {item.url}
+                                    </p>
+                                </div>
                             </div>
-                            {item.status === "completed" && (
-                                <Button size="sm" onClick={() => saveToDisk(item)} className="shrink-0 gap-2">
-                                    <HardDrive className="w-4 h-4" />
-                                    Save to Disk
-                                </Button>
-                            )}
                         </div>
 
-                        <StatusDetails item={item} />
+                        {isCompleted ? (
+                            <Button size="sm" onClick={handleDownloadFile} disabled={isSaving} className="w-full gap-2 lg:w-auto lg:shrink-0">
+                                {isSaving ? <Loader2 className="h-4 w-4 animate-spin" /> : <HardDrive className="h-4 w-4" />}
+                                {isSaving ? "Saving..." : "Save file"}
+                            </Button>
+                        ) : null}
                     </div>
+
+                    <div className="grid gap-3 md:grid-cols-3">
+                        <div className="rounded-[1.25rem] border border-white/6 bg-background/35 p-4">
+                            <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
+                                Status
+                            </p>
+                            <p className="mt-2 text-sm font-medium text-foreground">{statusDetail}</p>
+                        </div>
+                        <div className="rounded-[1.25rem] border border-white/6 bg-background/35 p-4">
+                            <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
+                                Size
+                            </p>
+                            <p className="mt-2 text-sm font-medium text-foreground">
+                                {item.totalBytes ? formatBytes(item.totalBytes) : "Unknown until available"}
+                            </p>
+                        </div>
+                        <div className="rounded-[1.25rem] border border-white/6 bg-background/35 p-4">
+                            <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
+                                Throughput
+                            </p>
+                            <p className="mt-2 text-sm font-medium text-foreground">
+                                {item.speed ? formatSpeed(item.speed) : "Waiting for activity"}
+                            </p>
+                        </div>
+                    </div>
+
+                    {!isCompleted && !isError ? (
+                        <div className="rounded-[1.5rem] border border-white/6 bg-background/45 p-4">
+                            <div className="flex items-center justify-between text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
+                                <span>{isQueued ? "Waiting on server" : "Transfer progress"}</span>
+                                <span>{item.progress ? `${Math.round(item.progress)}%` : "0%"}</span>
+                            </div>
+                            <Progress
+                                value={item.progress || 0}
+                                className="mt-3"
+                                indicatorClassName={isQueued ? "opacity-60" : undefined}
+                            />
+                            <div className="mt-3 flex flex-col gap-2 text-sm text-muted-foreground sm:flex-row sm:items-center sm:justify-between">
+                                <span>
+                                    {formatBytes(item.receivedBytes || 0)} / {item.totalBytes ? formatBytes(item.totalBytes) : "Unknown"}
+                                </span>
+                                <span>{item.speed ? formatSpeed(item.speed) : "No transfer speed yet"}</span>
+                            </div>
+                        </div>
+                    ) : null}
+
+                    {isCompleted ? (
+                        <div className="rounded-[1.5rem] border border-emerald-400/20 bg-emerald-400/10 p-4 text-sm text-foreground">
+                            <p className="font-semibold text-emerald-300">Transfer completed successfully</p>
+                            <p className="mt-2 text-muted-foreground">
+                                The file is ready in the current session and can be saved to disk at any time before expiration.
+                            </p>
+                        </div>
+                    ) : null}
+
+                    {downloadError ? (
+                        <div className="rounded-[1.5rem] border border-destructive/30 bg-destructive/10 p-4 text-sm text-foreground">
+                            <p className="font-semibold text-destructive">Unable to save file</p>
+                            <p className="mt-2 text-muted-foreground">{downloadError}</p>
+                        </div>
+                    ) : null}
+
+                    {isError ? (
+                        <div className="rounded-[1.5rem] border border-destructive/30 bg-destructive/10 p-4 text-sm text-foreground">
+                            <p className="font-semibold text-destructive">Transfer failed</p>
+                            <p className="mt-2 text-muted-foreground">
+                                {item.error || "Unknown error occurred during the transfer."}
+                            </p>
+                        </div>
+                    ) : null}
                 </div>
             </CardContent>
         </Card>

web/src/components/feature/SessionTimer.tsx

@@ -12,7 +12,9 @@ export function SessionTimer({ expiresAt, className }: SessionTimerProps) {
     const [isCritical, setIsCritical] = useState(false);
 
     useEffect(() => {
-        if (!expiresAt) return;
+        if (!expiresAt) {
+            return;
+        }
 
         const tick = () => {
             const now = Date.now();
@@ -29,20 +31,47 @@ export function SessionTimer({ expiresAt, className }: SessionTimerProps) {
             const seconds = Math.floor((diff % 60000) / 1000);
 
             setTimeLeft(`${minutes.toString().padStart(2, "0")}:${seconds.toString().padStart(2, "0")}`);
-            setIsCritical(minutes < 5); // Critical if less than 5 minutes
+            setIsCritical(minutes < 5);
         };
 
-        tick(); // Initial call
+        tick();
         const interval = setInterval(tick, 1000);
         return () => clearInterval(interval);
     }, [expiresAt]);
 
-    if (!expiresAt) return null;
+    if (!expiresAt) {
+        return null;
+    }
 
     return (
-        <div className={cn("flex items-center gap-2 text-sm font-medium", isCritical ? "text-destructive" : "text-muted-foreground", className)}>
-            <Clock className="w-4 h-4" />
-            <span>Session: {timeLeft}</span>
+        <div
+            className={cn(
+                "inline-flex items-center justify-between gap-4 rounded-[1.5rem] border px-4 py-3 shadow-[0_20px_60px_-40px_rgba(15,23,42,0.95)] backdrop-blur-xl",
+                isCritical
+                    ? "border-destructive/30 bg-destructive/10"
+                    : "border-primary/20 bg-primary/10",
+                className
+            )}
+        >
+            <div className="flex items-center gap-3">
+                <div
+                    className={cn(
+                        "flex h-10 w-10 items-center justify-center rounded-[1rem] border",
+                        isCritical
+                            ? "border-destructive/30 bg-destructive/10 text-destructive"
+                            : "border-primary/20 bg-primary/10 text-primary"
+                    )}
+                >
+                    <Clock className="h-4 w-4" />
+                </div>
+                <div>
+                    <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
+                        Session window
+                    </p>
+                    <p className="mt-1 text-sm font-semibold text-foreground">Expires in {timeLeft}</p>
+                </div>
+            </div>
+            <span className="text-xs font-medium text-muted-foreground">Auto cleanup</span>
         </div>
     );
 }

web/src/components/ui/Alert.tsx

@@ -1,5 +1,5 @@
-import * as React from "react"
-import { cn } from "../../lib/utils"
+import * as React from "react";
+import { cn } from "../../lib/utils";
 
 const Alert = React.forwardRef<
     HTMLDivElement,
@@ -9,15 +9,15 @@ const Alert = React.forwardRef<
         ref={ref}
         role="alert"
         className={cn(
-            "relative w-full rounded-lg border p-4 [&>svg~*]:pl-7 [&>svg+div]:translate-y-[-3px] [&>svg]:absolute [&>svg]:left-4 [&>svg]:top-4 [&>svg]:text-foreground",
+            "relative w-full rounded-[1.5rem] border border-border/70 bg-card/70 p-5 text-foreground shadow-[0_24px_80px_-40px_rgba(15,23,42,0.9)] backdrop-blur-xl [&>svg~*]:pl-8 [&>svg+div]:translate-y-[-2px] [&>svg]:absolute [&>svg]:left-5 [&>svg]:top-5 [&>svg]:text-foreground",
             variant === "destructive" &&
-            "border-destructive/50 text-destructive dark:border-destructive [&>svg]:text-destructive",
+            "border-destructive/30 bg-destructive/10 text-destructive-foreground [&>svg]:text-destructive",
             className
         )}
         {...props}
     />
-))
-Alert.displayName = "Alert"
+));
+Alert.displayName = "Alert";
 
 const AlertTitle = React.forwardRef<
     HTMLParagraphElement,
@@ -25,11 +25,11 @@ const AlertTitle = React.forwardRef<
 >(({ className, ...props }, ref) => (
     <h5
         ref={ref}
-        className={cn("mb-1 font-medium leading-none tracking-tight", className)}
+        className={cn("mb-1 font-semibold leading-none tracking-tight", className)}
         {...props}
     />
-))
-AlertTitle.displayName = "AlertTitle"
+));
+AlertTitle.displayName = "AlertTitle";
 
 const AlertDescription = React.forwardRef<
     HTMLParagraphElement,
@@ -37,10 +37,10 @@ const AlertDescription = React.forwardRef<
 >(({ className, ...props }, ref) => (
     <div
         ref={ref}
-        className={cn("text-sm [&_p]:leading-relaxed", className)}
+        className={cn("text-sm text-muted-foreground [&_p]:leading-relaxed", className)}
         {...props}
     />
-))
-AlertDescription.displayName = "AlertDescription"
+));
+AlertDescription.displayName = "AlertDescription";
 
-export { Alert, AlertTitle, AlertDescription }
+export { Alert, AlertTitle, AlertDescription };

web/src/components/ui/Button.tsx

@@ -1,8 +1,7 @@
 import * as React from "react";
 import { cn } from "../../lib/utils";
 
-export interface ButtonProps
-    extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+export interface ButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
     variant?: "default" | "secondary" | "outline" | "ghost" | "destructive";
     size?: "default" | "sm" | "lg" | "icon";
 }
@@ -12,21 +11,22 @@ const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
         return (
             <button
                 className={cn(
-                    "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+                    "inline-flex items-center justify-center whitespace-nowrap rounded-2xl border border-transparent text-sm font-semibold tracking-[-0.01em] text-foreground shadow-[0_18px_40px_-24px_rgba(15,23,42,0.9)] transition-all duration-200 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50",
                     {
-                        "bg-primary text-primary-foreground hover:bg-primary/90":
+                        "bg-[linear-gradient(135deg,rgba(125,211,252,1),rgba(34,211,238,0.9))] text-slate-950 hover:brightness-105 hover:shadow-[0_22px_48px_-24px_rgba(34,211,238,0.6)]":
                             variant === "default",
-                        "bg-secondary text-secondary-foreground hover:bg-secondary/80":
+                        "border-border/70 bg-secondary/80 text-secondary-foreground hover:bg-secondary":
                             variant === "secondary",
-                        "border border-input bg-background hover:bg-accent hover:text-accent-foreground":
+                        "border-border/70 bg-background/60 text-foreground hover:bg-accent/70":
                             variant === "outline",
-                        "hover:bg-accent hover:text-accent-foreground": variant === "ghost",
-                        "bg-destructive text-destructive-foreground hover:bg-destructive/90":
+                        "border-transparent bg-transparent text-muted-foreground shadow-none hover:bg-accent/60 hover:text-foreground":
+                            variant === "ghost",
+                        "border-destructive/40 bg-destructive/90 text-destructive-foreground hover:bg-destructive":
                             variant === "destructive",
-                        "h-10 px-4 py-2": size === "default",
-                        "h-9 rounded-md px-3": size === "sm",
-                        "h-11 rounded-md px-8": size === "lg",
-                        "h-10 w-10": size === "icon",
+                        "h-11 px-5 py-2.5": size === "default",
+                        "h-10 rounded-xl px-4": size === "sm",
+                        "h-12 px-6 text-sm": size === "lg",
+                        "h-11 w-11 rounded-2xl": size === "icon",
                     },
                     className
                 )}

web/src/components/ui/Card.tsx

@@ -8,7 +8,7 @@ const Card = React.forwardRef<
     <div
         ref={ref}
         className={cn(
-            "rounded-lg border bg-card text-card-foreground shadow-sm",
+            "rounded-[1.75rem] border border-border/70 bg-card/80 text-card-foreground shadow-[0_24px_80px_-40px_rgba(15,23,42,0.95)] backdrop-blur-xl",
             className
         )}
         {...props}
@@ -22,11 +22,11 @@ const CardHeader = React.forwardRef<
 >(({ className, ...props }, ref) => (
     <div
         ref={ref}
-        className={cn("flex flex-col space-y-1.5 p-6", className)}
+        className={cn("flex flex-col space-y-2 p-6", className)}
         {...props}
     />
 ));
-Card.displayName = "CardHeader";
+CardHeader.displayName = "CardHeader";
 
 const CardTitle = React.forwardRef<
     HTMLParagraphElement,

web/src/components/ui/Input.tsx

@@ -9,7 +9,7 @@ const Input = React.forwardRef<HTMLInputElement, InputProps>(
             <input
                 type={type}
                 className={cn(
-                    "flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
+                    "flex h-12 w-full rounded-2xl border border-input/80 bg-background/70 px-4 py-3 text-sm text-foreground shadow-[inset_0_1px_0_rgba(255,255,255,0.03)] outline-none ring-offset-background transition-all placeholder:text-muted-foreground/80 focus-visible:border-primary/60 focus-visible:ring-4 focus-visible:ring-primary/15 disabled:cursor-not-allowed disabled:opacity-50",
                     className
                 )}
                 ref={ref}

web/src/components/ui/Layout.tsx

@@ -7,31 +7,48 @@ type LayoutProps = {
 
 export function Layout({ children }: LayoutProps) {
     return (
-        <div className="min-h-screen bg-background text-foreground font-sans antialiased selection:bg-primary selection:text-primary-foreground">
-            <div className="absolute inset-0 -z-10 h-full w-full bg-background bg-[linear-gradient(to_right,#8080800a_1px,transparent_1px),linear-gradient(to_bottom,#8080800a_1px,transparent_1px)] bg-[size:14px_24px]"></div>
-            <div className="absolute left-0 right-0 top-0 -z-10 m-auto h-[310px] w-[310px] rounded-full bg-primary/20 opacity-20 blur-[100px]"></div>
+        <div className="relative min-h-screen overflow-hidden bg-background text-foreground selection:bg-primary/20 selection:text-foreground">
+            <div className="pointer-events-none absolute inset-0 -z-20 bg-[radial-gradient(circle_at_top,rgba(34,211,238,0.14),transparent_0_30%),linear-gradient(to_right,rgba(148,163,184,0.04)_1px,transparent_1px),linear-gradient(to_bottom,rgba(148,163,184,0.04)_1px,transparent_1px)] bg-[auto,72px_72px,72px_72px]" />
+            <div className="pointer-events-none absolute inset-x-0 top-[-120px] -z-10 mx-auto h-[360px] w-[min(760px,100%)] rounded-full bg-[radial-gradient(circle,rgba(56,189,248,0.18),transparent_65%)] blur-3xl" />
+            <div className="pointer-events-none absolute bottom-[-180px] right-[-80px] -z-10 h-[340px] w-[340px] rounded-full bg-[radial-gradient(circle,rgba(34,211,238,0.14),transparent_70%)] blur-3xl" />
 
-            <header className="sticky top-0 z-50 w-full border-b border-border/40 bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
-                <div className="container flex h-14 max-w-screen-2xl items-center px-4 md:px-8">
-                    <div className="mr-4 flex items-center space-x-2">
-                        <div className="flex aspect-square size-8 items-center justify-center rounded-lg bg-primary text-primary-foreground">
-                            <MoveDown className="size-5" />
+            <header className="sticky top-0 z-50 border-b border-white/6 bg-[rgba(8,13,22,0.78)] backdrop-blur-2xl">
+                <div className="mx-auto flex h-20 w-full max-w-[1400px] items-center justify-between px-4 md:px-8">
+                    <div className="flex items-center gap-4">
+                        <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-primary/20 bg-primary/10 text-primary shadow-[0_18px_48px_-28px_rgba(34,211,238,0.8)]">
+                            <MoveDown className="h-5 w-5" />
                         </div>
-                        <span className="hidden font-bold sm:inline-block">
-                            Ephemeral Downloader
-                        </span>
-                    </div>
-                    <div className="flex flex-1 items-center justify-end space-x-2 md:justify-end">
-                        <nav className="flex items-center space-x-2 text-sm font-medium text-muted-foreground">
-                            <div className="flex items-center gap-2 rounded-full border border-border bg-secondary/50 px-3 py-1 text-xs">
-                                <Server className="size-3" />
-                                <span>VPS Proxy Active</span>
+                        <div>
+                            <p className="text-[11px] font-semibold uppercase tracking-[0.28em] text-primary/80">
+                                Downloader
+                            </p>
+                            <div className="mt-1 flex flex-wrap items-center gap-3">
+                                <span className="text-sm font-semibold text-foreground md:text-base">
+                                    Ephemeral transfer console
+                                </span>
+                                <span className="hidden text-sm text-muted-foreground md:inline">
+                                    Download workflow with session-bound storage
+                                </span>
                             </div>
-                        </nav>
+                        </div>
+                    </div>
+
+                    <div className="hidden items-center gap-3 md:flex">
+                        <div className="rounded-full border border-white/6 bg-white/4 px-4 py-2 text-right">
+                            <p className="text-[11px] font-semibold uppercase tracking-[0.2em] text-muted-foreground">
+                                Environment
+                            </p>
+                            <p className="mt-1 text-sm font-medium text-foreground">Production-ready shell</p>
+                        </div>
+                        <div className="inline-flex items-center gap-2 rounded-full border border-primary/20 bg-primary/10 px-4 py-2 text-sm font-medium text-primary">
+                            <Server className="h-4 w-4" />
+                            <span>Proxy active</span>
+                        </div>
                     </div>
                 </div>
             </header>
-            <main className="container max-w-screen-xl py-6 md:py-10 px-4 md:px-8">
+
+            <main className="relative mx-auto w-full max-w-[1400px] px-4 pb-10 pt-8 md:px-8 md:pb-16 md:pt-10">
                 {children}
             </main>
         </div>

web/src/components/ui/ProgressBar.tsx

@@ -14,19 +14,15 @@ const Progress = React.forwardRef<HTMLDivElement, ProgressProps>(
         return (
             <div
                 ref={ref}
-                role="progressbar"
-                aria-valuemin={0}
-                aria-valuemax={max}
-                aria-valuenow={percent}
                 className={cn(
-                    "relative h-2 w-full overflow-hidden rounded-full bg-secondary",
+                    "relative h-2.5 w-full overflow-hidden rounded-full bg-white/6",
                     className
                 )}
                 {...props}
             >
                 <div
                     className={cn(
-                        "h-full w-full flex-1 bg-primary transition-all duration-200 ease-in-out",
+                        "h-full w-full flex-1 rounded-full bg-[linear-gradient(90deg,rgba(125,211,252,0.95),rgba(34,211,238,0.95))] transition-all duration-300 ease-out",
                         indicatorClassName
                     )}
                     style={{ transform: `translateX(-${100 - (percent / max) * 100}%)` }}

web/src/components/ui/Textarea.tsx

@@ -0,0 +1,22 @@
+import * as React from "react";
+import { cn } from "../../lib/utils";
+
+export type TextareaProps = React.TextareaHTMLAttributes<HTMLTextAreaElement>;
+
+const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
+    ({ className, ...props }, ref) => {
+        return (
+            <textarea
+                className={cn(
+                    "flex min-h-[120px] w-full rounded-2xl border border-input/80 bg-background/70 px-4 py-3 text-sm text-foreground shadow-[inset_0_1px_0_rgba(255,255,255,0.03)] outline-none ring-offset-background transition-all placeholder:text-muted-foreground/80 focus-visible:border-primary/60 focus-visible:ring-4 focus-visible:ring-primary/15 disabled:cursor-not-allowed disabled:opacity-50",
+                    className
+                )}
+                ref={ref}
+                {...props}
+            />
+        );
+    }
+);
+Textarea.displayName = "Textarea";
+
+export { Textarea };

web/src/context/SessionContext.tsx

@@ -1,34 +1,5 @@
-import React, { createContext, useCallback, useContext, useEffect, useState } from "react";
-
-type SessionData = {
-    sessionId: string;
-    expiresAt: string;
-    remainingMs: number;
-};
-
-type DownloadTask = {
-    id: string;
-    sessionId: string;
-    url: string;
-    filename: string;
-    status: "queued" | "downloading" | "completed" | "error";
-    progress: number;
-    totalBytes: number;
-    receivedBytes: number;
-    speed: number;
-    error?: string;
-    createdAt: number;
-};
-
-type SessionContextType = {
-    sessionId: string;
-    tasks: DownloadTask[];
-    expiresAt: string | null;
-    queueDownload: (url: string) => Promise<void>;
-    refreshTasks: () => void;
-};
-
-const SessionContext = createContext<SessionContextType | null>(null);
+import React, { useCallback, useEffect, useState } from "react";
+import { DownloadTask, SessionContext, SessionData } from "./session-context";
 
 const API_URL = import.meta.env.VITE_API_URL || "";
 
@@ -39,86 +10,106 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
     const [tasks, setTasks] = useState<DownloadTask[]>([]);
     const [expiresAt, setExpiresAt] = useState<string | null>(null);
 
-    // Initialize Session
     useEffect(() => {
         const initSession = async () => {
             try {
                 const headers: Record<string, string> = {};
-                if (sessionId) headers["x-session-id"] = sessionId;
+                if (sessionId) {
+                    headers["x-session-id"] = sessionId;
+                }
 
-                const res = await fetch(`${API_URL}/api/session`, { headers });
-                const data = (await res.json()) as SessionData;
+                const response = await fetch(`${API_URL}/api/session`, { headers });
+                if (!response.ok) {
+                    throw new Error("Failed to initialize session.");
+                }
+
+                const data = (await response.json()) as SessionData;
 
                 if (data.sessionId && data.sessionId !== sessionId) {
                     setSessionId(data.sessionId);
                     localStorage.setItem("downloader_session_id", data.sessionId);
                 }
                 setExpiresAt(data.expiresAt);
-            } catch (err) {
-                console.error("Failed to init session", err);
+            } catch {
+                setExpiresAt(null);
             }
         };
 
-        initSession();
+        void initSession();
     }, [sessionId]);
 
-    // Poll Tasks
-    const refreshTasks = useCallback(async () => {
-        if (!sessionId) return;
+    const refreshTasks = useCallback(async (): Promise<void> => {
+        if (!sessionId) {
+            return;
+        }
+
         try {
-            const res = await fetch(`${API_URL}/api/tasks`, {
+            const response = await fetch(`${API_URL}/api/tasks`, {
                 headers: { "x-session-id": sessionId },
             });
-            if (res.ok) {
-                const data = await res.json();
-                setTasks(data);
+
+            if (!response.ok) {
+                throw new Error("Failed to fetch tasks.");
             }
-        } catch (err) {
-            console.error("Failed to fetch tasks", err);
+
+            const data = (await response.json()) as DownloadTask[];
+            setTasks(data);
+        } catch {
+            return;
         }
     }, [sessionId]);
 
     useEffect(() => {
-        if (!sessionId) return;
+        if (!sessionId) {
+            return;
+        }
 
-        // Initial fetch
-        refreshTasks();
+        const syncTasks = async (): Promise<void> => {
+            await refreshTasks();
+        };
+
+        void syncTasks();
+
+        const interval = setInterval(() => {
+            void refreshTasks();
+        }, 2000);
 
-        // Poll every 2 seconds
-        const interval = setInterval(refreshTasks, 2000);
         return () => clearInterval(interval);
-    }, [sessionId, refreshTasks]);
+    }, [refreshTasks, sessionId]);
+
+    const queueDownload = async (url: string): Promise<void> => {
+        if (!sessionId) {
+            throw new Error("Session is still initializing. Try again in a moment.");
+        }
+
+        const response = await fetch(`${API_URL}/api/queue`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "x-session-id": sessionId,
+            },
+            body: JSON.stringify({ url }),
+        });
+
+        if (!response.ok) {
+            throw new Error("Failed to queue download.");
+        }
+
+        await refreshTasks();
 
-    const queueDownload = async (url: string) => {
-        if (!sessionId) throw new Error("Session not ready, try again in a moment");
         try {
-            const res = await fetch(`${API_URL}/api/queue`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    "x-session-id": sessionId,
-                },
-                body: JSON.stringify({ url }),
+            const sessionResponse = await fetch(`${API_URL}/api/session`, {
+                headers: { "x-session-id": sessionId },
             });
 
-            if (!res.ok) {
-                const body = (await res.json().catch(() => null)) as { error?: string } | null;
-                throw new Error(body?.error || "Failed to queue download");
+            if (!sessionResponse.ok) {
+                return;
             }
 
-            await refreshTasks(); // Immediate refresh
-
-            // Update expiration from action
-            // Ideally we should re-fetch /api/session here too, or just rely on the side-effect
-            const sessionRes = await fetch(`${API_URL}/api/session`, {
-                headers: { "x-session-id": sessionId }
-            });
-            const sessionData = await sessionRes.json();
+            const sessionData = (await sessionResponse.json()) as SessionData;
             setExpiresAt(sessionData.expiresAt);
-
-        } catch (err) {
-            console.error(err);
-            throw err;
+        } catch {
+            return;
         }
     };
 
@@ -128,12 +119,3 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
         </SessionContext.Provider>
     );
 }
-
-// O hook é exportado junto do provider de propósito: o arquivo é o módulo do
-// contexto da sessão. A regra abaixo só afeta o Fast Refresh em desenvolvimento.
-// eslint-disable-next-line react-refresh/only-export-components
-export function useSession() {
-    const context = useContext(SessionContext);
-    if (!context) throw new Error("useSession must be used within SessionProvider");
-    return context;
-}

web/src/context/session-context.ts

@@ -0,0 +1,43 @@
+import { createContext, useContext } from "react";
+
+export type SessionData = {
+    sessionId: string;
+    expiresAt: string;
+    remainingMs: number;
+};
+
+export type DownloadStatus = "queued" | "downloading" | "completed" | "error";
+
+export type DownloadTask = {
+    id: string;
+    sessionId: string;
+    url: string;
+    filename: string;
+    status: DownloadStatus;
+    progress: number;
+    totalBytes: number;
+    receivedBytes: number;
+    speed: number;
+    error?: string;
+    createdAt: number;
+};
+
+export type SessionContextType = {
+    sessionId: string;
+    tasks: DownloadTask[];
+    expiresAt: string | null;
+    queueDownload: (url: string) => Promise<void>;
+    refreshTasks: () => Promise<void>;
+};
+
+export const SessionContext = createContext<SessionContextType | null>(null);
+
+export function useSession(): SessionContextType {
+    const context = useContext(SessionContext);
+
+    if (!context) {
+        throw new Error("useSession must be used within SessionProvider");
+    }
+
+    return context;
+}

web/src/index.css

@@ -4,6 +4,9 @@
   --color-background: hsl(var(--background));
   --color-foreground: hsl(var(--foreground));
 
+  --color-card: hsl(var(--card));
+  --color-card-foreground: hsl(var(--card-foreground));
+
   --color-primary: hsl(var(--primary));
   --color-primary-foreground: hsl(var(--primary-foreground));
 
@@ -24,42 +27,94 @@
   --color-ring: hsl(var(--ring));
 
   --radius-lg: var(--radius);
-  --radius-md: calc(var(--radius) - 2px);
-  --radius-sm: calc(var(--radius) - 4px);
+  --radius-md: calc(var(--radius) - 4px);
+  --radius-sm: calc(var(--radius) - 8px);
 }
 
 @layer base {
   :root {
-    --background: 222.2 84% 4.9%;
-    --foreground: 210 40% 98%;
+    --background: 222 36% 8%;
+    --foreground: 210 40% 96%;
 
-    --primary: 210 40% 98%;
-    --primary-foreground: 222.2 47.4% 11.2%;
+    --card: 222 31% 12%;
+    --card-foreground: 210 40% 96%;
 
-    --secondary: 217.2 32.6% 17.5%;
-    --secondary-foreground: 210 40% 98%;
+    --primary: 191 95% 67%;
+    --primary-foreground: 222 47% 11%;
 
-    --muted: 217.2 32.6% 17.5%;
-    --muted-foreground: 215 20.2% 65.1%;
+    --secondary: 223 24% 18%;
+    --secondary-foreground: 210 40% 96%;
 
-    --accent: 217.2 32.6% 17.5%;
-    --accent-foreground: 210 40% 98%;
+    --muted: 223 19% 22%;
+    --muted-foreground: 214 18% 70%;
 
-    --destructive: 0 72% 54%;
-    --destructive-foreground: 210 40% 98%;
+    --accent: 222 24% 17%;
+    --accent-foreground: 210 40% 96%;
 
-    --border: 217.2 32.6% 17.5%;
-    --input: 217.2 32.6% 17.5%;
-    --ring: 212.7 26.8% 83.9%;
+    --destructive: 0 72% 56%;
+    --destructive-foreground: 0 0% 100%;
 
-    --radius: 0.5rem;
+    --border: 223 17% 22%;
+    --input: 223 17% 22%;
+    --ring: 191 95% 67%;
+
+    --radius: 1.5rem;
   }
 
   * {
     @apply border-border;
   }
 
-  body {
-    @apply bg-background text-foreground;
+  html {
+    color-scheme: dark;
   }
-}
+
+  body {
+    @apply min-h-screen bg-background text-foreground antialiased;
+    font-family:
+      Inter,
+      ui-sans-serif,
+      system-ui,
+      -apple-system,
+      BlinkMacSystemFont,
+      "Segoe UI",
+      sans-serif;
+    background-image:
+      radial-gradient(circle at top, rgba(56, 189, 248, 0.12), transparent 0 32%),
+      radial-gradient(circle at 80% 18%, rgba(14, 165, 233, 0.08), transparent 0 22%),
+      linear-gradient(180deg, rgba(255, 255, 255, 0.02), transparent 28%),
+      linear-gradient(135deg, #080d16 0%, #0d1320 52%, #090d16 100%);
+  }
+
+  #root {
+    min-height: 100vh;
+  }
+
+  ::selection {
+    background: hsl(var(--primary) / 0.25);
+    color: hsl(var(--foreground));
+  }
+
+  ::-webkit-scrollbar {
+    width: 10px;
+    height: 10px;
+  }
+
+  ::-webkit-scrollbar-track {
+    background: rgba(15, 23, 42, 0.35);
+  }
+
+  ::-webkit-scrollbar-thumb {
+    background: rgba(148, 163, 184, 0.22);
+    border-radius: 999px;
+    border: 2px solid transparent;
+    background-clip: padding-box;
+  }
+
+  ::-webkit-scrollbar-thumb:hover {
+    background: rgba(148, 163, 184, 0.32);
+    border-radius: 999px;
+    border: 2px solid transparent;
+    background-clip: padding-box;
+  }
+}

web/vite.config.ts

@@ -4,16 +4,4 @@ import react from '@vitejs/plugin-react'
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [react()],
-  server: {
-    // O frontend chama a API na mesma origem (URL relativa). Em produção quem
-    // serve o build é o próprio Fastify; em desenvolvimento este proxy encaminha
-    // /api para o backend. Ajuste o alvo com VITE_API_PROXY se o backend não
-    // estiver na porta padrão (3000).
-    proxy: {
-      '/api': {
-        target: process.env.VITE_API_PROXY ?? 'http://localhost:3000',
-        changeOrigin: true,
-      },
-    },
-  },
 })