refactor(server): reduz a complexidade das funções de netGuard

- SSRF: /api/queue aceitava qualquer URL, inclusive localhost, rede
  privada e 169.254.169.254. Agora só http/https e, por padrão, nada de
  endereço local/privado (checagem na fila e no conector do undici, que
  cobre DNS rebinding e redirects). ALLOW_PRIVATE_NETWORK=true libera.
- O header x-session-id virava nome de diretório sem validação; com ".."
  a expiração faria rmSync em server/. Agora só UUID é aceito.
- Respostas 3xx eram salvas como se fossem o arquivo; agora segue até 5
  redirects e trata 3xx restante como erro.
- decodeURIComponent inválido no Content-Disposition derrubava o download.
- web: useCallback em refreshTasks (corrige o warning exhaustive-deps).

.claude/settings.local.json

@@ -1,9 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "mcp__plugin_context-mode_context-mode__ctx_batch_execute",
-      "mcp__context-mode__ctx_batch_execute",
-      "mcp__context-mode__ctx_execute_file"
-    ]
-  }
-}

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 12.8.1
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm lint
+      - run: pnpm test
+      - run: pnpm build

.gitignore

@@ -5,6 +5,9 @@ build/
 coverage/
 .npm/
 
+# Arquivos baixados pelas sessoes do Ephemeral Downloader
+server/storage/
+
 # Environment
 .env
 .env.local

.graphifyignore

@@ -1,21 +0,0 @@
-node_modules/
-.next/
-dist/
-build/
-out/
-coverage/
-.git/
-.pnpm-store/
-.cache/
-*.log
-.env
-.env.*
-__pycache__/
-*.pyc
-.venv/
-venv/
-target/
-*.exe
-*.dll
-*.so
-*.dylib

.openclaude-profile.json

@@ -1,9 +0,0 @@
-{
-  "profile": "codex",
-  "env": {
-    "OPENAI_BASE_URL": "https://chatgpt.com/backend-api/codex",
-    "OPENAI_MODEL": "codexplan",
-    "CHATGPT_ACCOUNT_ID": "6dbec33c-c751-4383-b112-bfc776f39ed7"
-  },
-  "createdAt": "2026-04-05T18:55:08.995Z"
-}

README.md

@@ -1,153 +1,157 @@
-## Ephemeral Downloader
+# Ephemeral Downloader
 
-Um proxy de download efêmero para você usar a **sua VPS como ponte de alta velocidade** entre servidores lentos e a sua máquina local.
+**Proxy de download efêmero: a sua VPS baixa o arquivo por uma rota melhor e entrega para o seu navegador, com os arquivos apagados automaticamente depois.**
 
-Em vez de baixar direto de um host congestionado, você aponta o link para o Ephemeral Downloader, que:
+[![CI](https://github.com/evandrodevbr/Downloader/actions/workflows/ci.yml/badge.svg)](https://github.com/evandrodevbr/Downloader/actions/workflows/ci.yml)
+![Node](https://img.shields.io/badge/Node-%3E%3D20.19-5FA04E?logo=nodedotjs&logoColor=white)
+![TypeScript](https://img.shields.io/badge/TypeScript-5.9-3178C6?logo=typescript&logoColor=white)
+![Fastify](https://img.shields.io/badge/Fastify-5-000000?logo=fastify&logoColor=white)
+![React](https://img.shields.io/badge/React-19-61DAFB?logo=react&logoColor=black)
+![Vite](https://img.shields.io/badge/Vite-7-646CFF?logo=vite&logoColor=white)
+![pnpm](https://img.shields.io/badge/pnpm-9%2B-F69220?logo=pnpm&logoColor=white)
 
-- Faz o download via VPS (geralmente com rota/peering melhor).
-- Transmite o arquivo por **streaming** para o seu navegador.
-- Libera os recursos assim que o download termina.
+## Sobre
 
-Simples, focado e pensado para quem vive baixando ISOs, ROMs e arquivos grandes.
+Baixar um arquivo grande direto de um host congestionado costuma ser lento, e muitas vezes o gargalo não é a sua internet nem o servidor de origem, e sim o caminho entre eles. O Ephemeral Downloader coloca a sua VPS no meio: o servidor faz o download (normalmente com peering melhor), mostra o progresso em tempo real e entrega o arquivo para você pelo navegador.
 
----
+O projeto é focado em uso efêmero. O arquivo fica em um diretório temporário da sessão no servidor e é apagado quando a sessão expira (1 hora sem interação). Não é um proxy de streaming puro: o download passa pelo disco do servidor antes de chegar até você.
 
-## Como funciona (visão rápida)
+## Como funciona
 
-- **Frontend (React + Vite)**
+```
+navegador (React + Vite)
+   │  POST /api/queue {url}                 GET /api/tasks (polling de 2 s)
+   ▼                                                   ▲
+Fastify (server/)  ──undici GET──▶  host de origem      │
+   │                                                   │
+   ▼                                                   │
+server/storage/<id-da-sessao>/<task>_<arquivo> ────────┘
+   ▲
+   │  GET /api/download/:taskId (arquivo concluído)
+navegador
+```
 
-  - Interface SPA com campo de texto para múltiplos links (um por linha).
-  - Lista de downloads recentes com:
-    - Progresso em tempo real.
-    - Tamanho total e já baixado.
-    - Velocidade em **MB/s** e **Mbps**.
-    - Botão para **retomar downloads** que falharam dentro da mesma sessão.
+- `POST /api/queue` enfileira a URL e o backend baixa com `undici`, gravando em `server/storage/<id-da-sessão>/` por um pipeline (respeita backpressure e só marca a task como concluída depois do arquivo em disco).
+- O frontend faz polling de `GET /api/tasks` a cada 2 segundos e mostra status, progresso, bytes recebidos, total e velocidade em MB/s e Mbps.
+- Quando a task conclui, o botão "Save to Disk" busca `GET /api/download/:taskId` e salva o arquivo.
+- Em produção o próprio Fastify serve o build do Vite na raiz, com fallback da SPA.
+- `GET /stream` é o proxy antigo, mantido apenas respondendo 410 (descontinuado).
 
-- **Backend (Fastify + Streams)**
-  - Rota `GET /stream?url=...&offset=...` que:
-    - Faz `HEAD` na origem para validar o link e obter `Content-Length`.
-    - Faz `GET` (ou `Range: bytes=offset-` para retomada).
-    - Faz o **streaming direto** para o cliente, sem guardar arquivo em disco.
-  - Em produção, também serve o build do frontend (Vite) na própria porta do servidor.
+## Stack
 
----
+| Camada | Escolha |
+|---|---|
+| Runtime | Node.js 20.19 ou superior |
+| Backend | Fastify 5, undici 7 (cliente HTTP), zod (validação) |
+| Frontend | React 19, Vite 7, Tailwind CSS 4, lucide-react |
+| Linguagem | TypeScript 5.9 |
+| Monorepo | pnpm workspaces (`server` e `web`) |
+| Deploy | nixpacks (`nixpacks.toml`) |
 
 ## Requisitos
 
-- Node.js **>= 20**
-- `pnpm` **>= 8**
+- Node.js 20.19 ou superior para rodar e fazer o build (exigência do Vite 7 e do undici 7). Para rodar os testes (vitest 5) use Node 22.12 ou superior.
+- pnpm 9 ou superior (verificado no pnpm 12.8.1 com Node 26.7.0; o lockfile é o formato 9.0)
+- Portas livres: backend (padrão 3000) e Vite (5173) em desenvolvimento
 
----
+Observação sobre pnpm: a seção `overrides` do `pnpm-workspace.yaml` (fastify e undici com versão mínima de segurança) só é aplicada pelo pnpm 10 ou superior. Com pnpm 9 ela é ignorada.
 
-## Instalação
-
-Clone o repositório e instale as dependências:
+## Início rápido
 
 ```bash
-git clone <seu-fork-ou-repo> Downloader
-cd Downloader
 pnpm install
-```
 
----
-
-## Scripts principais
-
-Na raiz do projeto:
-
-- **Desenvolvimento (backend + frontend juntos)**:
-
-```bash
+# desenvolvimento: Fastify (3000) + Vite (5173) juntos
 pnpm dev
+# abra http://localhost:5173
 ```
 
-Isso sobe:
-
-- Fastify em `http://localhost:3000`
-- Vite em `http://localhost:5173`
-
-- **Build de produção (server + web)**:
+Em desenvolvimento o Vite encaminha `/api` para o backend (proxy configurado em `web/vite.config.ts`), então não é preciso arquivo `.env`. Se a porta 3000 estiver ocupada:
 
 ```bash
+PORT=3100 VITE_API_PROXY=http://localhost:3100 pnpm dev
+```
+
+## Uso
+
+1. Cole a URL direta (http ou https) de um arquivo e clique em **Download**.
+2. A lista de downloads mostra status, progresso, tamanho e velocidade, atualizada a cada 2 segundos.
+3. Quando o download conclui, use **Save to Disk** para salvar o arquivo na sua máquina.
+4. A sessão dura 1 hora de inatividade (o contador reinicia a cada interação) e depois os arquivos são apagados do servidor.
+
+## API
+
+| Método | Rota | O que faz |
+|---|---|---|
+| GET | `/health` | Devolve `{"status":"ok"}`. |
+| GET | `/` | Serve a SPA (build do Vite). |
+| GET | `/api/session` | Cria ou recupera a sessão e devolve `sessionId`, `expiresAt` e `remainingMs`. O id também vem no header `x-session-id`. |
+| POST | `/api/queue` | Corpo `{"url":"https://..."}`. Enfileira e inicia o download, devolvendo a task criada. |
+| GET | `/api/tasks` | Lista as tasks da sessão (usado no polling da interface). |
+| GET | `/api/download/:taskId` | Entrega o arquivo concluído da task. |
+| GET | `/stream` | Descontinuado: responde 410. |
+
+A sessão é identificada pelo header `x-session-id` (a interface guarda o id em `localStorage`). Erros observados: 400 para URL inválida (`{"error":"Invalid URL"}`), com protocolo que não seja http/https, apontando para endereço local ou privado, ou para download não pronto; 403 para task de outra sessão e 404 para task inexistente. Se a origem falhar (por exemplo, 404 no host de origem), a task fica com `status: "error"` e a mensagem em `error`. O servidor segue até 5 redirects; um nome de domínio que resolva para IP privado também faz a task terminar em erro.
+
+## Produção
+
+```bash
+pnpm build            # server: tsc | web: tsc -b && vite build
+PORT=3000 pnpm start  # node server/dist/index.js: API + build do front na mesma porta
+```
+
+O `nixpacks.toml` descreve esse fluxo: build em `pnpm install --frozen-lockfile && pnpm build` e start em `pnpm start`.
+
+## Configuração
+
+| Variável | Onde | Padrão | O que faz |
+|---|---|---|---|
+| `PORT` | backend | `3000` | Porta do Fastify. |
+| `STORAGE_ROOT` | backend | `server/storage` | Diretório onde ficam os arquivos das sessões. |
+| `ALLOW_PRIVATE_NETWORK` | backend | desligado | Com `true`, permite baixar de `localhost` e de endereços de rede privada. Por padrão o servidor recusa esses destinos (proteção contra SSRF). |
+| `VITE_API_URL` | frontend | mesma origem | Host da API, se for diferente do que serve o front. |
+| `VITE_API_PROXY` | frontend (dev) | `http://localhost:3000` | Alvo do proxy de `/api` no Vite. |
+
+## Estrutura do projeto
+
+```
+server/                 backend Fastify
+├── src/index.ts            rotas (/health, /api/*), CORS e static do front
+├── src/lib/
+│   ├── DownloadManager.ts  download da origem com undici e gravação na sessão
+│   ├── SessionManager.ts   sessões, expiração (1 h) e limpeza dos arquivos
+│   └── netGuard.ts         validação de URL e bloqueio de destinos privados (SSRF)
+└── test/                   testes (vitest)
+web/                    frontend React + Vite
+├── src/context/            SessionContext (sessão e polling das tasks)
+├── src/components/         ui/ (Input, Button, Card, Alert...) e feature/ (form, item, timer)
+└── vite.config.ts          proxy de /api em desenvolvimento
+.agent/                 scaffolding de agentes de IA (não faz parte do runtime)
+.github/workflows/      CI (typecheck, lint, testes e build)
+nixpacks.toml           comandos de build e start do deploy
+pnpm-workspace.yaml     workspaces, allowBuilds e overrides
+```
+
+## Testes e desenvolvimento
+
+```bash
+pnpm typecheck   # tsc nos dois pacotes
+pnpm lint        # eslint no web
+pnpm test        # vitest no server e no web
 pnpm build
 ```
 
-- **Start de produção (tudo pela porta 3000)**:
+Os testes do servidor cobrem a validação de URL e o bloqueio de IPs privados, o tratamento de redirects, a expiração de sessões (com remoção das tasks e dos arquivos) e a validação do id de sessão. Os do web cobrem os estados do componente `DownloadItem`. O mesmo conjunto roda no GitHub Actions (`.github/workflows/ci.yml`).
 
-```bash
-pnpm start
-```
+## Estado atual e limitações
 
-O servidor Fastify:
+- Sessões e tasks ficam em memória: reiniciar o servidor perde a lista de tasks (os arquivos em disco são removidos pelo coletor depois de 1 hora).
+- Sem autenticação: qualquer um que alcance o servidor pode enfileirar downloads (de destinos públicos). Coloque atrás de VPN, autenticação reversa ou firewall.
+- Não há retomada de download nem uso de `Range` no fluxo atual (o parâmetro `offset` do antigo `/stream` não existe mais).
+- Não há limite de tamanho, banda ou cota: um link muito grande ocupa o disco do servidor até a sessão expirar.
+- "Save to Disk" carrega o arquivo inteiro na memória do navegador (`blob()`) antes de salvar, o que pesa em arquivos muito grandes.
+- O diretório `.agent/` é scaffolding de ferramentas de IA e não é usado pela aplicação.
 
-- Servirá o build do Vite na raiz (`/`).
-- Continuará expondo `GET /stream` para o proxy de download.
+## Licença
 
----
-
-## Configuração de ambiente
-
-### Desenvolvimento
-
-Por padrão o frontend conversa com o backend em:
-
-```ts
-const API_URL = import.meta.env.VITE_API_URL ?? "http://localhost:3000";
-```
-
-Se você mudar a porta ou rodar o backend em outro host, basta criar um arquivo `.env` dentro de `web/`:
-
-```bash
-VITE_API_URL=http://seu-backend:3000
-```
-
-### Produção (Nixpacks ou similar)
-
-- Defina a variável `PORT` (a maioria das plataformas faz isso automaticamente).
-- O servidor Fastify faz fallback para `3000` se `PORT` não estiver definida.
-- O arquivo `nixpacks.toml` já descreve:
-  - Comando de build: `pnpm build`
-  - Comando de start: `pnpm start`
-
----
-
-## Fluxo de uso típico
-
-1. Você tem uma **VPS bem localizada** (por exemplo, no mesmo continente do servidor de origem).
-2. No seu desktop/notebook, abre o Ephemeral Downloader.
-3. Cola um ou mais links HTTP/HTTPS diretos (por exemplo, ROMs no SourceForge).
-4. Clica em **“Iniciar download”**.
-5. A VPS baixa em alta velocidade e o app:
-   - Mostra o progresso.
-   - Indica tamanho total / baixado.
-   - Mostra velocidade agregada em MB/s e Mbps.
-6. Se a conexão cair, você pode **retomar** dentro da mesma sessão.
-
----
-
-## Limitações intencionais
-
-- **Retomada entre sessões** (fechar aba / desligar máquina) **não é suportada**.
-  - O projeto é focado em uso efêmero, sem manter arquivos em disco no servidor.
-- O servidor realiza apenas:
-  - Validação básica de URL (somente `http`/`https`).
-  - Proxy por streaming com **backpressure** nativo do Node.js.
-  - Nenhuma autenticação ou controle de cota por usuário (idealmente coloque atrás de VPN, auth reverso ou firewall).
-
----
-
-## Ideias futuras
-
-- Autenticação simples para restringir o painel.
-- Limite de banda por IP/usuário.
-- Modo “linha de comando” usando a mesma API do servidor.
-
----
-
-## Por que esse projeto existe?
-
-Porque às vezes o problema não é a sua internet nem o servidor de origem, e sim o **caminho entre eles**.
-
-Colocando uma VPS no meio do caminho, você “puxa” o arquivo por uma rota melhor até a VPS e, de lá, faz o streaming até você com muito mais previsibilidade.
-
-O Ephemeral Downloader encapsula essa ideia em uma interface simples, focada em quem só quer **colar o link, apertar um botão e acompanhar o progresso**.
+Sem licença definida no repositório: não existe arquivo `LICENSE` e o `package.json` está marcado como `private`. Defina uma licença antes de reutilizar ou publicar o código.

package.json

@@ -8,11 +8,13 @@
     "dev:server": "pnpm --filter server dev",
     "dev:web": "pnpm --filter web dev",
     "build": "pnpm -r build",
-    "start": "pnpm --filter server start"
+    "start": "pnpm --filter server start",
+    "test": "pnpm -r --if-present test",
+    "lint": "pnpm -r --if-present lint",
+    "typecheck": "pnpm -r --if-present typecheck"
   },
   "workspaces": [
     "server",
     "web"
-  ],
-  "packageManager": "[email protected]"
-}
+  ]
+}

pnpm-lock.yaml

@@ -1,3 +1,161 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.8.1
+        version: 12.8.1
+
+packages:
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-siDxcidfz5eM6L2tJfik+i2bbUEw8UC7MZ3Yl2HYdRmqbdhHGAOQACtOOu6QVW4Jul4/w5wVKm+wM8ACtgh1Pg==}
+    cpu: [arm64]
+    os: [android]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-0F/uqPRc3aN4vLHsa0f+6fTtmsigFQ9/yxEU43fionF//pNHEd5e97b3w/nKIgqYMCUQCJphmBRMA9Q8/wlo9Q==}
+    cpu: [x64]
+    os: [android]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-/rwavvMQJsl2RIxOHBnDF+4Gk+fhQFAY4M3PQZoKskJOEnaJcygG9p1xby6wcQcbS4d9dIubv09CQhufTgfmpw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-htYt2gN7zqJKLhC99Ft6EUiO7myjZAZXfmGCTJUL1v+o7vE9hZdE1+fAkk4Oj1ZHNRti6b2woOxEkRkAusi8OQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-PB5BULNgytxvExoOXUUeseS/DcpPENs+cg3iA6xHHeaLT4ctEGKSGXEbuj7USeqvo8JBpAx039hivnbzGqDwnA==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-kKeyC/ArjrgdciQRBrOL0j9HtOI4gDRgoyP+eJ1CQKyadpKlf/DhDDyspXe07R3B9KagTVLUF2nlt6Dr5quFIg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-q4s9a9X2O3N9aeUFooW24orNrxvu20+jyVUFR5RanPCqOKKPBrgs2iywMkBBx1aXkkzdWT54/mfz8Be8sJlWEw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-F7XSjKJthwCh/L6abZiMpAfo2Cm61SZIT3e4dfgiIjESndlWaXCnfLKngSgZ/SEMsdmHT6dud3+kWIB3tw0/xQ==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-z1ecpIK/ZY08Unk69KWWE9867oaKUytGUjrHnBoGFAAhsK+q+0cfvBH+f5fWobJ7FX97leMlLO+gkJolddM45Q==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-KU6tnrBfu4uKXTq6N5qJwSm8FSrs9Wc8b5AUEsHK9bRXwNdsZ1/lRxG1++X29SKRW9OSNuDSjxASv5mAvGo1gA==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-eUE8BWJkDr2tJb/yrk0yVnszlmNqFarVxUlqiZ9BAkct28Nq/5g2H0tvMDmPA7fAQW3STNj+omJPPRVT+4s5sQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-8bDZ0lZlCdi2rvnFul7EYgcC7zKeWSe76y8JV2oXobaS8p9i9d6PSf6LgLtTM0fI7R9Oh4eLCbveXyNDMmvZ+g==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-MsT0dlrRxnCRCHCaosNbhWpEiAFnFuMEu3KuDJDU41BXgTwiINxU8goloUSUDejWZUqKaUqNC/qUTihl9nFtqg==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/[email protected]':
+    resolution: {integrity: sha512-SWtPe0PsbTTk//gJND10tMdOfCYjrkq5+qV49hzVhY7xz2iJ339Rc+xwASlcvbwTfrvH39YNqpKYibD+CRGLwA==}
+    cpu: [x64]
+    os: [win32]
+
+  [email protected]:
+    resolution: {integrity: sha512-9kupB1B/XOr+BsjTjmBS0BeURFgOwSed3Vv8EctIqoomRLZlmOB+dh2oSHKp/FfV+QK4f6SdAkGY1VhhKqu+RQ==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  '@pnpm/[email protected]':
+    optional: true
+
+  [email protected]:
+    optionalDependencies:
+      '@pnpm/exe.android-arm64': 12.8.1
+      '@pnpm/exe.android-x64': 12.8.1
+      '@pnpm/exe.darwin-arm64': 12.8.1
+      '@pnpm/exe.darwin-x64': 12.8.1
+      '@pnpm/exe.freebsd-x64': 12.8.1
+      '@pnpm/exe.linux-arm64': 12.8.1
+      '@pnpm/exe.linux-arm64-musl': 12.8.1
+      '@pnpm/exe.linux-ppc64': 12.8.1
+      '@pnpm/exe.linux-riscv64': 12.8.1
+      '@pnpm/exe.linux-s390x': 12.8.1
+      '@pnpm/exe.linux-x64': 12.8.1
+      '@pnpm/exe.linux-x64-musl': 12.8.1
+      '@pnpm/exe.win32-arm64': 12.8.1
+      '@pnpm/exe.win32-x64': 12.8.1
+
+---
 lockfileVersion: '9.0'
 
 settings:
@@ -40,6 +198,9 @@ importers:
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
+      vitest:
+        specifier: ^5.0.3
+        version: 5.0.3(@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
 
   web:
     dependencies:
@@ -58,9 +219,6 @@ importers:
       tailwind-merge:
         specifier: ^3.4.0
         version: 3.4.0
-      uuid:
-        specifier: ^13.0.0
-        version: 13.0.0
       zod:
         specifier: ^3.25.76
         version: 3.25.76
@@ -82,19 +240,19 @@ importers:
         version: 19.2.3(@types/[email protected])
       '@vitejs/plugin-react':
         specifier: ^5.1.1
-        version: 5.1.1([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+        version: 5.1.1([email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
       autoprefixer:
         specifier: ^10.4.24
         version: 10.4.24([email protected])
       eslint:
         specifier: ^9.39.1
-        version: 9.39.1([email protected])
+        version: 9.39.1([email protected])([email protected])
       eslint-plugin-react-hooks:
         specifier: ^7.0.1
-        version: 7.0.1([email protected]([email protected]))
+        version: 7.0.1([email protected]([email protected])([email protected]))([email protected])
       eslint-plugin-react-refresh:
         specifier: ^0.4.24
-        version: 0.4.24([email protected]([email protected]))
+        version: 0.4.24([email protected]([email protected])([email protected]))
       globals:
         specifier: ^16.5.0
         version: 16.5.0
@@ -109,10 +267,13 @@ importers:
         version: 5.9.3
       typescript-eslint:
         specifier: ^8.46.4
-        version: 8.47.0([email protected]([email protected]))([email protected])
+        version: 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
       vite:
         specifier: ^7.2.4
         version: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+      vitest:
+        specifier: ^5.0.3
+        version: 5.0.3(@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
 
 packages:
 
@@ -616,6 +777,9 @@ packages:
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
+  '@jridgewell/[email protected]':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
@@ -851,6 +1015,12 @@ packages:
   '@types/[email protected]':
     resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
 
+  '@types/[email protected]':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/[email protected]':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
   '@types/[email protected]':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
 
@@ -936,6 +1106,20 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
+  '@vitest/[email protected]':
+    resolution: {integrity: sha512-T8sWAIbkSyAjkwTcaEc3Iu0o9A27X1/kdXrizhZkGuSKScRQtRzclfAMpOTcGdXCsqxeWlpGy3XjqaW8CpLORg==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/[email protected]':
+    resolution: {integrity: sha512-XhFysQTB8AZ+P4gMi+Lpo99vg2AZi0qKpaB9yXQl37+CaMEAPO3iH/wGVnSyL5MPERiLezpqTVtrR6UZH5GCXg==}
+
   [email protected]:
     resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
 
@@ -970,6 +1154,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
+  [email protected]:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
   [email protected]:
     resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
     engines: {node: '>=8.0.0'}
@@ -1033,6 +1221,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-BCfFL1sHijQlBGWBMuJyhZUhzo7wer5sVj9hqekB/7xn0Ypy+pER/edCYQm4exbXj4WiySGp40P8UuTh6w1srg==}
 
+  [email protected]:
+    resolution: {integrity: sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==}
+    engines: {node: '>=18'}
+
   [email protected]:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
@@ -1103,6 +1295,9 @@ packages:
     resolution: {integrity: sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==}
     engines: {node: '>=10.13.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
+
   [email protected]:
     resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
     engines: {node: '>=18'}
@@ -1150,6 +1345,7 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-BhHmn2yNOFA9H9JmmIVKJmd288g9hrVRDkdoIgRCRuSySRUHH7r/DI6aAXW9T1WwUuY3DFgrcaqB+deURBLR5g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
     peerDependencies:
       jiti: '*'
@@ -1173,10 +1369,17 @@ packages:
     resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
     engines: {node: '>=4.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
   [email protected]:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
+    engines: {node: '>=12.0.0'}
+
   [email protected]:
     resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
 
@@ -1478,6 +1681,9 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  [email protected]:
+    resolution: {integrity: sha512-z12OxmaPGE0F4xlpGdjuAUckipLpQlTAuAmyGhNoD7ODpYUzvDfvtxUbjM/jwznyP178oju/KDdyi220wNJ0RQ==}
+
   [email protected]:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
@@ -1520,6 +1726,10 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
 
+  [email protected]:
+    resolution: {integrity: sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==}
+    engines: {node: '>=12.20.0'}
+
   [email protected]:
     resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
     engines: {node: '>=14.0.0'}
@@ -1563,6 +1773,10 @@ packages:
     resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
     engines: {node: '>=12'}
 
+  [email protected]:
+    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
+    engines: {node: '>=12'}
+
   [email protected]:
     resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
 
@@ -1698,6 +1912,9 @@ packages:
     resolution: {integrity: sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==}
     engines: {node: '>= 0.8'}
 
+  [email protected]:
+    resolution: {integrity: sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==}
+
   [email protected]:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
@@ -1720,10 +1937,22 @@ packages:
     resolution: {integrity: sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==}
     engines: {node: '>=20'}
 
+  [email protected]:
+    resolution: {integrity: sha512-IAbQaPJIIdhVxi0mqy9lez1wEwje0UQf9F1vwtbelEG5Nbgn0nPOxCvU+mNeNS9gyJTAhrHp74CbUaSynQpZcQ==}
+    engines: {node: '>=20.0.0'}
+
+  [email protected]:
+    resolution: {integrity: sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==}
+    engines: {node: '>=18'}
+
   [email protected]:
     resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
     engines: {node: '>=12.0.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
   [email protected]:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
@@ -1785,10 +2014,6 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
-  [email protected]:
-    resolution: {integrity: sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==}
-    hasBin: true
-
   [email protected]:
     resolution: {integrity: sha512-NL8jTlbo0Tn4dUEXEsUg8KeyG/Lkmc4Fnzb8JXN/Ykm9G4HNImjtABMJgkQoVjOBN/j2WAwDTRytdqJbZsah7w==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -1829,11 +2054,57 @@ packages:
       yaml:
         optional: true
 
+  [email protected]:
+    resolution: {integrity: sha512-xMw97S3rjdtj5dkVat7jCsqWBpvchs3RlpQctUqwJD0KkERk40vz2fJ77lDwW/Vzh/pk18eItYAzkodhSes3jQ==}
+    engines: {node: ^22.12.0 || ^24.0.0 || >=26.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 5.0.3
+      '@vitest/browser-preview': 5.0.3
+      '@vitest/browser-webdriverio': ^5.0.0-beta.5 || >=5.0.0
+      '@vitest/coverage-istanbul': 5.0.3
+      '@vitest/coverage-v8': 5.0.3
+      '@vitest/ui': 5.0.3
+      happy-dom: '*'
+      jsdom: '*'
+      vite: ^6.4.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
   [email protected]:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
     hasBin: true
 
+  [email protected]:
+    resolution: {integrity: sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==}
+    engines: {node: '>=20.11'}
+    hasBin: true
+
   [email protected]:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
@@ -1866,20 +2137,20 @@ snapshots:
 
   '@babel/[email protected]': {}
 
-  '@babel/[email protected]':
+  '@babel/[email protected]([email protected])':
     dependencies:
       '@babel/code-frame': 7.27.1
       '@babel/generator': 7.28.5
       '@babel/helper-compilation-targets': 7.27.2
-      '@babel/helper-module-transforms': 7.28.3(@babel/[email protected])
+      '@babel/helper-module-transforms': 7.28.3(@babel/[email protected]([email protected]))([email protected])
       '@babel/helpers': 7.28.4
       '@babel/parser': 7.28.5
       '@babel/template': 7.27.2
-      '@babel/traverse': 7.28.5
+      '@babel/traverse': 7.28.5([email protected])
       '@babel/types': 7.28.5
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 6.3.1
@@ -1904,19 +2175,19 @@ snapshots:
 
   '@babel/[email protected]': {}
 
-  '@babel/[email protected]':
+  '@babel/[email protected]([email protected])':
     dependencies:
-      '@babel/traverse': 7.28.5
+      '@babel/traverse': 7.28.5([email protected])
       '@babel/types': 7.28.5
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/[email protected](@babel/[email protected])':
+  '@babel/[email protected](@babel/[email protected]([email protected]))([email protected])':
     dependencies:
-      '@babel/core': 7.28.5
-      '@babel/helper-module-imports': 7.27.1
+      '@babel/core': 7.28.5([email protected])
+      '@babel/helper-module-imports': 7.27.1([email protected])
       '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.28.5
+      '@babel/traverse': 7.28.5([email protected])
     transitivePeerDependencies:
       - supports-color
 
@@ -1937,14 +2208,14 @@ snapshots:
     dependencies:
       '@babel/types': 7.28.5
 
-  '@babel/[email protected](@babel/[email protected])':
+  '@babel/[email protected](@babel/[email protected]([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
       '@babel/helper-plugin-utils': 7.27.1
 
-  '@babel/[email protected](@babel/[email protected])':
+  '@babel/[email protected](@babel/[email protected]([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
       '@babel/helper-plugin-utils': 7.27.1
 
   '@babel/[email protected]':
@@ -1953,7 +2224,7 @@ snapshots:
       '@babel/parser': 7.28.5
       '@babel/types': 7.28.5
 
-  '@babel/[email protected]':
+  '@babel/[email protected]([email protected])':
     dependencies:
       '@babel/code-frame': 7.27.1
       '@babel/generator': 7.28.5
@@ -1961,7 +2232,7 @@ snapshots:
       '@babel/parser': 7.28.5
       '@babel/template': 7.27.2
       '@babel/types': 7.28.5
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
     transitivePeerDependencies:
       - supports-color
 
@@ -2126,17 +2397,17 @@ snapshots:
   '@esbuild/[email protected]':
     optional: true
 
-  '@eslint-community/[email protected]([email protected]([email protected]))':
+  '@eslint-community/[email protected]([email protected]([email protected])([email protected]))':
     dependencies:
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/[email protected]': {}
 
-  '@eslint/[email protected]':
+  '@eslint/[email protected]([email protected])':
     dependencies:
       '@eslint/object-schema': 2.1.7
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -2149,10 +2420,10 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/[email protected]':
+  '@eslint/[email protected]([email protected])':
     dependencies:
       ajv: 6.12.6
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -2246,10 +2517,12 @@ snapshots:
 
   '@jridgewell/[email protected]': {}
 
+  '@jridgewell/[email protected]': {}
+
   '@jridgewell/[email protected]':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
 
   '@lukeed/[email protected]': {}
 
@@ -2425,6 +2698,13 @@ snapshots:
     dependencies:
       '@babel/types': 7.28.5
 
+  '@types/[email protected]':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/[email protected]': {}
+
   '@types/[email protected]': {}
 
   '@types/[email protected]': {}
@@ -2445,15 +2725,15 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
-  '@typescript-eslint/[email protected](@typescript-eslint/[email protected]([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected](@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]))([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/parser': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
       '@typescript-eslint/scope-manager': 8.47.0
-      '@typescript-eslint/type-utils': 8.47.0([email protected]([email protected]))([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
+      '@typescript-eslint/type-utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
       '@typescript-eslint/visitor-keys': 8.47.0
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       graphemer: 1.4.0
       ignore: 7.0.5
       natural-compare: 1.4.0
@@ -2462,23 +2742,23 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
       '@typescript-eslint/scope-manager': 8.47.0
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
       '@typescript-eslint/visitor-keys': 8.47.0
-      debug: 4.4.3
-      eslint: 9.39.1([email protected])
+      debug: 4.4.3([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected])':
+  '@typescript-eslint/[email protected]([email protected])([email protected])':
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.47.0([email protected])
       '@typescript-eslint/types': 8.47.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -2492,13 +2772,13 @@ snapshots:
     dependencies:
       typescript: 5.9.3
 
-  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
-      debug: 4.4.3
-      eslint: 9.39.1([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+      debug: 4.4.3([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       ts-api-utils: 2.1.0([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -2506,13 +2786,13 @@ snapshots:
 
   '@typescript-eslint/[email protected]': {}
 
-  '@typescript-eslint/[email protected]([email protected])':
+  '@typescript-eslint/[email protected]([email protected])([email protected])':
     dependencies:
-      '@typescript-eslint/project-service': 8.47.0([email protected])
+      '@typescript-eslint/project-service': 8.47.0([email protected])([email protected])
       '@typescript-eslint/tsconfig-utils': 8.47.0([email protected])
       '@typescript-eslint/types': 8.47.0
       '@typescript-eslint/visitor-keys': 8.47.0
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
@@ -2522,13 +2802,13 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/[email protected]([email protected]([email protected]))([email protected])':
+  '@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected])':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected]))
+      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected])([email protected]))
       '@typescript-eslint/scope-manager': 8.47.0
       '@typescript-eslint/types': 8.47.0
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
-      eslint: 9.39.1([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -2538,11 +2818,11 @@ snapshots:
       '@typescript-eslint/types': 8.47.0
       eslint-visitor-keys: 4.2.1
 
-  '@vitejs/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+  '@vitejs/[email protected]([email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
     dependencies:
-      '@babel/core': 7.28.5
-      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/[email protected])
-      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/[email protected])
+      '@babel/core': 7.28.5([email protected])
+      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/[email protected]([email protected]))
+      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/[email protected]([email protected]))
       '@rolldown/pluginutils': 1.0.0-beta.47
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
@@ -2550,6 +2830,26 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@vitest/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      '@vitest/spy': 5.0.3
+      estree-walker: 3.0.3
+      magic-string: 1.4.3
+    optionalDependencies:
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+
+  '@vitest/[email protected]([email protected](@types/[email protected])([email protected])([email protected])([email protected]))':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      '@vitest/spy': 5.0.3
+      estree-walker: 3.0.3
+      magic-string: 1.4.3
+    optionalDependencies:
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+
+  '@vitest/[email protected]': {}
+
   [email protected]: {}
 
   [email protected]([email protected]):
@@ -2582,6 +2882,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]([email protected]):
@@ -2647,6 +2949,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]:
     dependencies:
       ansi-styles: 4.3.0
@@ -2676,9 +2980,11 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]:
+  [email protected]([email protected]):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 7.2.0
 
   [email protected]: {}
 
@@ -2697,6 +3003,8 @@ snapshots:
       graceful-fs: 4.2.11
       tapable: 2.3.0
 
+  [email protected]: {}
+
   [email protected]:
     optionalDependencies:
       '@esbuild/aix-ppc64': 0.25.12
@@ -2761,20 +3069,20 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]([email protected])):
+  [email protected]([email protected]([email protected])([email protected]))([email protected]):
     dependencies:
-      '@babel/core': 7.28.5
+      '@babel/core': 7.28.5([email protected])
       '@babel/parser': 7.28.5
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       hermes-parser: 0.25.1
       zod: 3.25.76
       zod-validation-error: 4.0.2([email protected])
     transitivePeerDependencies:
       - supports-color
 
-  [email protected]([email protected]([email protected])):
+  [email protected]([email protected]([email protected])([email protected])):
     dependencies:
-      eslint: 9.39.1([email protected])
+      eslint: 9.39.1([email protected])([email protected])
 
   [email protected]:
     dependencies:
@@ -2785,14 +3093,14 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]):
+  [email protected]([email protected])([email protected]):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected]))
+      '@eslint-community/eslint-utils': 4.9.0([email protected]([email protected])([email protected]))
       '@eslint-community/regexpp': 4.12.2
-      '@eslint/config-array': 0.21.1
+      '@eslint/config-array': 0.21.1([email protected])
       '@eslint/config-helpers': 0.4.2
       '@eslint/core': 0.17.0
-      '@eslint/eslintrc': 3.3.1
+      '@eslint/eslintrc': 3.3.1([email protected])
       '@eslint/js': 9.39.1
       '@eslint/plugin-kit': 0.4.1
       '@humanfs/node': 0.16.7
@@ -2802,7 +3110,7 @@ snapshots:
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3
+      debug: 4.4.3([email protected])
       escape-string-regexp: 4.0.0
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -2842,8 +3150,14 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]:
+    dependencies:
+      '@types/estree': 1.0.8
+
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]: {}
@@ -2903,6 +3217,10 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.3
 
+  [email protected]([email protected]):
+    optionalDependencies:
+      picomatch: 4.0.7
+
   [email protected]:
     dependencies:
       flat-cache: 4.0.1
@@ -3115,6 +3433,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  [email protected]:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+
   [email protected]: {}
 
   [email protected]:
@@ -3146,6 +3468,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]:
@@ -3184,6 +3508,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]:
     dependencies:
       split2: 4.2.0
@@ -3313,6 +3639,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]:
@@ -3329,11 +3657,20 @@ snapshots:
     dependencies:
       real-require: 0.2.0
 
+  [email protected]: {}
+
+  [email protected]: {}
+
   [email protected]:
     dependencies:
       fdir: 6.5.0([email protected])
       picomatch: 4.0.3
 
+  [email protected]:
+    dependencies:
+      fdir: 6.5.0([email protected])
+      picomatch: 4.0.7
+
   [email protected]:
     dependencies:
       is-number: 7.0.0
@@ -3357,13 +3694,13 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
-  [email protected]([email protected]([email protected]))([email protected]):
+  [email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.47.0(@typescript-eslint/[email protected]([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])
-      '@typescript-eslint/parser': 8.47.0([email protected]([email protected]))([email protected])
-      '@typescript-eslint/typescript-estree': 8.47.0([email protected])
-      '@typescript-eslint/utils': 8.47.0([email protected]([email protected]))([email protected])
-      eslint: 9.39.1([email protected])
+      '@typescript-eslint/eslint-plugin': 8.47.0(@typescript-eslint/[email protected]([email protected]([email protected])([email protected]))([email protected])([email protected]))([email protected]([email protected])([email protected]))([email protected])([email protected])
+      '@typescript-eslint/parser': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+      '@typescript-eslint/typescript-estree': 8.47.0([email protected])([email protected])
+      '@typescript-eslint/utils': 8.47.0([email protected]([email protected])([email protected]))([email protected])([email protected])
+      eslint: 9.39.1([email protected])([email protected])
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -3390,8 +3727,6 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  [email protected]: {}
-
   [email protected](@types/[email protected])([email protected])([email protected])([email protected]):
     dependencies:
       esbuild: 0.25.12
@@ -3407,10 +3742,69 @@ snapshots:
       lightningcss: 1.30.2
       tsx: 4.21.0
 
+  [email protected](@types/[email protected])([email protected])([email protected])([email protected]):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0([email protected])
+      picomatch: 4.0.3
+      postcss: 8.5.6
+      rollup: 4.53.3
+      tinyglobby: 0.2.15
+    optionalDependencies:
+      '@types/node': 25.2.3
+      fsevents: 2.3.3
+      jiti: 2.6.1
+      lightningcss: 1.30.2
+      tsx: 4.21.0
+
+  [email protected](@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected])):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/mocker': 5.0.3([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+      chai: 6.3.0
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 1.4.3
+      obug: 2.2.1
+      picomatch: 4.0.7
+      std-env: 4.3.0
+      tinybench: 6.2.1
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+      why-is-node-running: 3.2.1
+    optionalDependencies:
+      '@types/node': 24.10.1
+    transitivePeerDependencies:
+      - msw
+
+  [email protected](@types/[email protected])([email protected](@types/[email protected])([email protected])([email protected])([email protected])):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/mocker': 5.0.3([email protected](@types/[email protected])([email protected])([email protected])([email protected]))
+      chai: 6.3.0
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 1.4.3
+      obug: 2.2.1
+      picomatch: 4.0.7
+      std-env: 4.3.0
+      tinybench: 6.2.1
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      vite: 7.2.4(@types/[email protected])([email protected])([email protected])([email protected])
+      why-is-node-running: 3.2.1
+    optionalDependencies:
+      '@types/node': 25.2.3
+    transitivePeerDependencies:
+      - msw
+
   [email protected]:
     dependencies:
       isexe: 2.0.0
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]: {}

pnpm-workspace.yaml

@@ -2,9 +2,17 @@ packages:
   - server
   - web
 
+# pnpm 11/12: sem isto o install falha com ERR_PNPM_IGNORED_BUILDS,
+# porque o esbuild (usado pelo Vite) precisa rodar script de build. 
+allowBuilds:
+  esbuild: true
+
+# Chave equivalente para pnpm 9/10 (ignorada pelo pnpm 12).
 onlyBuiltDependencies:
   - esbuild
 
+# Overrides de segurança. Atenção: pnpm 9 e anterior ignoram esta seção
+# (o pnpm 10+ lê overrides de pnpm-workspace.yaml).
 overrides:
   fastify@<5.7.2: '>=5.7.2'
   fastify@<=5.7.2: '>=5.7.3'

server/dist/index.js

@@ -1,153 +0,0 @@
-import Fastify from "fastify";
-import cors from "@fastify/cors";
-import fastifyStatic from "@fastify/static";
-import { z } from "zod";
-import { request } from "undici";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-const app = Fastify({
-    logger: true,
-});
-// Registro de CORS básico para permitir o frontend em desenvolvimento/produção.
-await app.register(cors, {
-    origin: true,
-});
-// Servir frontend buildado (Vite) em produção, similar ao Next.js.
-const currentFile = fileURLToPath(import.meta.url);
-const currentDir = dirname(currentFile);
-const clientDistPath = resolve(currentDir, "../../web/dist");
-await app.register(fastifyStatic, {
-    root: clientDistPath,
-    prefix: "/",
-    index: ["index.html"],
-});
-// Rota explícita para a SPA na raiz, útil especialmente em ambientes de deploy.
-app.get("/", (_request, reply) => {
-    return reply.sendFile("index.html");
-});
-app.get("/health", async () => {
-    return { status: "ok" };
-});
-const streamQuerySchema = z.object({
-    url: z
-        .string()
-        .url("URL inválida")
-        .refine((value) => {
-        // Evita SSRF localizando apenas http/https genérico.
-        return value.startsWith("http://") || value.startsWith("https://");
-    }, { message: "Apenas URLs HTTP/HTTPS são permitidas." }),
-    // Offset opcional em bytes para retomar download dentro da mesma sessão.
-    offset: z
-        .string()
-        .regex(/^\d+$/)
-        .transform((value) => Number.parseInt(value, 10))
-        .optional(),
-});
-app.get("/stream", async (requestFastify, reply) => {
-    const parseResult = streamQuerySchema.safeParse(requestFastify.query);
-    if (!parseResult.success) {
-        const firstError = parseResult.error.errors[0]?.message ?? "Parâmetros inválidos";
-        reply.status(400);
-        return { error: firstError };
-    }
-    const { url, offset } = parseResult.data;
-    try {
-        // HEAD para validar link e obter metadados.
-        const headResponse = await request(url, {
-            method: "HEAD",
-            // timeout conservador, em produção pode ser configurável.
-            headersTimeout: 15000,
-        });
-        if (headResponse.statusCode && headResponse.statusCode >= 400) {
-            reply.status(502);
-            return { error: "Não foi possível acessar o recurso de origem." };
-        }
-        const contentType = headResponse.headers["content-type"] ?? "application/octet-stream";
-        const contentLength = headResponse.headers["content-length"];
-        const originDisposition = headResponse.headers["content-disposition"];
-        // Nome de arquivo derivado do header Content-Disposition ou da URL.
-        const fallbackName = (() => {
-            try {
-                const parsedUrl = new URL(url);
-                const nameFromPath = parsedUrl.pathname.split("/").filter(Boolean).pop();
-                return nameFromPath ?? "download.bin";
-            }
-            catch {
-                return "download.bin";
-            }
-        })();
-        const filename = (() => {
-            if (typeof originDisposition === "string") {
-                const match = /filename\*?=(?:UTF-8''|")?([^";]+)/i.exec(originDisposition);
-                if (match?.[1]) {
-                    return decodeURIComponent(match[1].replace(/"/g, ""));
-                }
-            }
-            return fallbackName;
-        })();
-        const headers = {};
-        if (typeof offset === "number" && Number.isFinite(offset) && offset > 0) {
-            headers.Range = `bytes=${offset}-`;
-        }
-        // GET streaming da origem (possivelmente com Range para retomada).
-        const originResponse = await request(url, {
-            method: "GET",
-            headers,
-            headersTimeout: 30000,
-            maxRedirections: 3,
-        });
-        if (!originResponse.body) {
-            reply.status(502);
-            return { error: "Resposta de origem sem corpo para streaming." };
-        }
-        if (originResponse.statusCode && originResponse.statusCode >= 400) {
-            reply.status(originResponse.statusCode);
-            return { error: "Falha ao obter o arquivo de origem." };
-        }
-        const normalizedLength = Array.isArray(contentLength)
-            ? contentLength[0]
-            : contentLength;
-        // Configura headers de resposta para o cliente final.
-        reply.headers({
-            "Content-Type": Array.isArray(contentType) ? contentType[0] : contentType,
-            ...(normalizedLength
-                ? {
-                    "Content-Length": normalizedLength,
-                    "X-Origin-Content-Length": normalizedLength,
-                }
-                : {}),
-            "Content-Disposition": `attachment; filename="${filename}"`,
-        });
-        // Entregamos o stream diretamente para o Fastify gerenciar (pipe + backpressure).
-        return reply.send(originResponse.body);
-    }
-    catch (error) {
-        requestFastify.log.error({ err: error, url }, "Erro durante o streaming do arquivo");
-        if (!reply.sent) {
-            // Em caso de falha antes de iniciar o streaming, respondemos com JSON.
-            return reply
-                .status(502)
-                .send({ error: "Erro ao realizar o proxy do arquivo." });
-        }
-        // Se a resposta já foi enviada/fechada, apenas não fazemos mais nada.
-    }
-});
-// Fallback para SPA: qualquer rota GET não atendida cai no index.html.
-app.setNotFoundHandler((requestFastify, reply) => {
-    if (requestFastify.method === "GET") {
-        return reply.sendFile("index.html");
-    }
-    reply.status(404).send({ error: "Recurso não encontrado." });
-});
-const port = Number(process.env.PORT) || 3000;
-try {
-    await app.listen({
-        port,
-        host: "0.0.0.0",
-    });
-    app.log.info(`Server listening on port ${port}`);
-}
-catch (err) {
-    app.log.error(err);
-    process.exit(1);
-}

server/package.json

@@ -7,7 +7,9 @@
   "scripts": {
     "dev": "tsx src/index.ts",
     "build": "tsc -p tsconfig.json",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "@fastify/cors": "^11.2.0",
@@ -19,6 +21,7 @@
   "devDependencies": {
     "@types/node": "^25.2.3",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.3"
   }
 }

server/src/index.ts

@@ -2,18 +2,18 @@ import Fastify, { FastifyRequest, FastifyReply } from "fastify";
 import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import { z } from "zod";
-import { Agent, setGlobalDispatcher } from "undici";
+import { Agent, interceptors, setGlobalDispatcher } from "undici";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-import { sessionManager } from "./lib/SessionManager";
-import { DownloadManager } from "./lib/DownloadManager";
+import { sessionManager } from "./lib/SessionManager.js";
+import { DownloadManager } from "./lib/DownloadManager.js";
+import { UrlNotAllowedError, createGuardedConnector } from "./lib/netGuard.js";
 
 // Otimização: Agente HTTP global com conexões persistentes e timeout relaxado.
 // Isso ajuda a manter a performance em downloads paralelos e evita gargalos de socket.
 const agent = new Agent({
-  connect: {
-    timeout: 30_000,
-  },
+  // O conector recusa destinos locais/privados (SSRF), inclusive em redirects.
+  connect: createGuardedConnector({ timeout: 30_000 }),
   pipelining: 1,
   keepAliveTimeout: 10_000,
   connections: 500, // Aumenta limite de conexões simultâneas
@@ -51,17 +51,11 @@ app.get("/health", async () => {
   return { status: "ok" };
 });
 
-const streamQuerySchema = z.object({
-  url: z.string().url("URL inválida").startsWith("http", "Apenas HTTP/HTTPS permitidos"),
-  // Offset opcional em bytes para retomar download.
-  offset: z
-    .string()
-    .regex(/^\d+$/)
-    .transform((value) => Number.parseInt(value, 10))
-    .optional(),
-});
-
-const downloadManager = new DownloadManager(agent);
+// Segue até 5 redirects (links de download costumam redirecionar); sem isso o
+// corpo da resposta 3xx era salvo como se fosse o arquivo.
+const downloadManager = new DownloadManager(
+  agent.compose(interceptors.redirect({ maxRedirections: 5 })),
+);
 
 // Helper to get session from header
 const getSession = (req: FastifyRequest, reply: FastifyReply) => {
@@ -95,8 +89,12 @@ app.post("/api/queue", async (request, reply) => {
   const parse = queueSchema.safeParse(request.body);
   if (!parse.success) return reply.status(400).send({ error: "Invalid URL" });
 
-  const task = await downloadManager.queueDownload(session.id, parse.data.url);
-  return task;
+  try {
+    return await downloadManager.queueDownload(session.id, parse.data.url);
+  } catch (err) {
+    if (err instanceof UrlNotAllowedError) return reply.status(400).send({ error: err.message });
+    throw err;
+  }
 });
 
 // 3. List Tasks (Polling)
@@ -118,11 +116,14 @@ app.get("/api/download/:taskId", async (request, reply) => {
   if (task.status !== "completed") return reply.status(400).send({ error: "Download not ready" });
 
   const sessionPath = sessionManager.getSessionPath(session.id);
-  const filePath = resolve(sessionPath, `${task.id}_${task.filename}`);
+  const fileName = `${task.id}_${task.filename}`;
 
   try {
     sessionManager.touch(session.id); // Reset timer on interaction
-    return reply.download(filePath, task.filename); // requires @fastify/static or sendFile
+    // O @fastify/static resolve caminhos a partir do `root` do plugin (web/dist),
+    // então o root do diretório da sessão é passado por requisição.
+    // Sem isso a resposta era o index.html da SPA, não o arquivo baixado.
+    return reply.sendFile(fileName, sessionPath);
   } catch (e) {
     return reply.status(404).send({ error: "File removed or missing" });
   }

server/src/lib/DownloadManager.ts

@@ -1,8 +1,11 @@
-import { createWriteStream, existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { createWriteStream, existsSync } from "node:fs";
+import { basename, join } from "node:path";
+import { pipeline } from "node:stream/promises";
+import { Transform } from "node:stream";
 import { request, Dispatcher } from "undici";
 import { randomUUID } from "node:crypto";
-import { sessionManager } from "./SessionManager";
+import { sessionManager } from "./SessionManager.js";
+import { assertDownloadableUrl } from "./netGuard.js";
 
 type DownloadStatus = "queued" | "downloading" | "completed" | "error";
 
@@ -21,13 +24,32 @@ export type DownloadTask = {
 };
 
 // Map to store active task metadata in memory (for speed)
-// Ideally this would be persisted to JSON in the session folder for crash recovery
+// Ideally this would be persisted to JSON in the session folder for crash recovery.
+// As tasks de uma sessão são removidas quando ela expira (ver construtor), então o
+// mapa não cresce sem limite num servidor de longa duração.
 const tasks = new Map<string, DownloadTask>();
-const agent = new Dispatcher(); // Should use the global agent from index.ts ideally, or pass it in.
+
+// decodeURIComponent lança em sequências inválidas (ex.: "%E0%A4%A"); nesse caso
+// mantém o texto original em vez de falhar o download inteiro.
+function safeDecode(value: string): string {
+    try {
+        return decodeURIComponent(value);
+    } catch {
+        return value;
+    }
+}
 
 export class DownloadManager {
 
-    constructor(private globalAgent: Dispatcher) { }
+    constructor(private globalAgent: Dispatcher) {
+        sessionManager.onDestroy((sessionId) => this.dropSession(sessionId));
+    }
+
+    private dropSession(sessionId: string) {
+        for (const [id, task] of tasks) {
+            if (task.sessionId === sessionId) tasks.delete(id);
+        }
+    }
 
     public getTasks(sessionId: string): DownloadTask[] {
         return Array.from(tasks.values()).filter(t => t.sessionId === sessionId);
@@ -38,15 +60,13 @@ export class DownloadManager {
     }
 
     public async queueDownload(sessionId: string, url: string): Promise<DownloadTask> {
+        const parsedUrl = assertDownloadableUrl(url);
         const id = randomUUID();
 
         // Try to determine filename
         let filename = "download.bin";
-        try {
-            const u = new URL(url);
-            const p = u.pathname.split("/").pop();
-            if (p) filename = p;
-        } catch { }
+        const lastSegment = parsedUrl.pathname.split("/").pop();
+        if (lastSegment) filename = basename(lastSegment);
 
         const task: DownloadTask = {
             id,
@@ -85,7 +105,7 @@ export class DownloadManager {
                 headers: { "User-Agent": "Ephemeral-Downloader/2.0" }
             });
 
-            if (response.statusCode >= 400) {
+            if (response.statusCode >= 300) {
                 throw new Error(`HTTP Error ${response.statusCode}`);
             }
 
@@ -94,7 +114,12 @@ export class DownloadManager {
             if (typeof disposition === "string") {
                 const match = /filename\*?=(?:UTF-8''|")?([^";]+)/i.exec(disposition);
                 if (match?.[1]) {
-                    task.filename = decodeURIComponent(match[1].replace(/"/g, ""));
+                    // O header vem do host de origem: usar apenas o nome base evita
+                    // caminho relativo (../) escrevendo fora do diretório da sessão.
+                    const headerName = basename(safeDecode(match[1].replace(/"/g, "")));
+                    if (headerName) {
+                        task.filename = headerName;
+                    }
                 }
             }
 
@@ -110,29 +135,38 @@ export class DownloadManager {
             let lastUpdate = Date.now();
             let bytesAtLastUpdate = 0;
 
-            for await (const chunk of response.body) {
-                fileStream.write(chunk);
-                task.receivedBytes += chunk.length;
+            // Contador de progresso no meio do pipeline: mantém o cálculo de
+            // velocidade/progresso sem ler o stream manualmente.
+            const progressTracker = new Transform({
+                transform(chunk, _encoding, callback) {
+                    task.receivedBytes += chunk.length;
 
-                const now = Date.now();
-                if (now - lastUpdate > 500) { // Update speed every 500ms
-                    const diff = now - lastUpdate;
-                    const bytesDiff = task.receivedBytes - bytesAtLastUpdate;
-                    task.speed = (bytesDiff / diff) * 1000;
+                    const now = Date.now();
+                    if (now - lastUpdate > 500) { // Update speed every 500ms
+                        const diff = now - lastUpdate;
+                        const bytesDiff = task.receivedBytes - bytesAtLastUpdate;
+                        task.speed = (bytesDiff / diff) * 1000;
 
-                    if (task.totalBytes > 0) {
-                        task.progress = Math.round((task.receivedBytes / task.totalBytes) * 100);
+                        if (task.totalBytes > 0) {
+                            task.progress = Math.round((task.receivedBytes / task.totalBytes) * 100);
+                        }
+
+                        lastUpdate = now;
+                        bytesAtLastUpdate = task.receivedBytes;
+
+                        // Touch session to keep it alive during download
+                        sessionManager.touch(task.sessionId);
                     }
 
-                    lastUpdate = now;
-                    bytesAtLastUpdate = task.receivedBytes;
+                    callback(null, chunk);
+                },
+            });
 
-                    // Touch session to keep it alive during download
-                    sessionManager.touch(task.sessionId);
-                }
-            }
+            // `pipeline` espera o flush em disco e propaga erro de escrita.
+            // Antes o status virava "completed" antes do arquivo terminar de
+            // ser gravado e o download podia sair truncado.
+            await pipeline(response.body, progressTracker, fileStream);
 
-            fileStream.end();
             task.status = "completed";
             task.progress = 100;
             task.speed = 0;

server/src/lib/SessionManager.ts

@@ -1,10 +1,23 @@
 import { existsSync, mkdirSync, rmSync, readdirSync, statSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 
-const STORAGE_ROOT = resolve(process.cwd(), "server/storage");
+// A raiz de armazenamento é ancorada no diretório do próprio módulo (server/),
+// e não no `process.cwd()`: com o cwd errado (por exemplo rodando via
+// `pnpm --filter server start`, que executa dentro de server/) os arquivos
+// acabavam em server/server/storage. STORAGE_ROOT permite sobrescrever.
+const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
+const SERVER_ROOT = resolve(MODULE_DIR, "..", "..");
+const STORAGE_ROOT = process.env.STORAGE_ROOT
+    ? resolve(process.env.STORAGE_ROOT)
+    : resolve(SERVER_ROOT, "storage");
 const SESSION_TIMEOUT_MS = 60 * 60 * 1000; // 1 Hour
 
+// O id vem do header x-session-id e vira nome de diretório: aceitar só UUID
+// impede path traversal (por exemplo "..", que apagaria server/ na expiração).
+const SESSION_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 type SessionData = {
     id: string;
     lastActive: number;
@@ -12,6 +25,7 @@ type SessionData = {
 
 export class SessionManager {
     private sessions: Map<string, SessionData> = new Map();
+    private destroyListeners: Array<(sessionId: string) => void> = [];
 
     constructor() {
         // Ensure storage root exists
@@ -20,7 +34,8 @@ export class SessionManager {
         }
 
         // Start Garbage Collector
-        setInterval(() => this.cleanup(), 60 * 1000); // Check every minute
+        // unref: o coletor não deve impedir o processo de encerrar (nem os testes).
+        setInterval(() => this.cleanup(), 60 * 1000).unref(); // Check every minute
         console.log("[SessionManager] Garbage Collector started.");
     }
 
@@ -30,6 +45,8 @@ export class SessionManager {
     public getSession(id?: string): SessionData {
         const now = Date.now();
 
+        if (id !== undefined && !SESSION_ID_PATTERN.test(id)) id = undefined;
+
         if (id && this.sessions.has(id)) {
             const session = this.sessions.get(id)!;
             session.lastActive = now;
@@ -80,6 +97,14 @@ export class SessionManager {
         }
     }
 
+    /**
+     * Registra um callback chamado quando uma sessão é destruída (expiração),
+     * para quem guarda estado por sessão poder descartá-lo.
+     */
+    public onDestroy(listener: (sessionId: string) => void) {
+        this.destroyListeners.push(listener);
+    }
+
     /**
      * Removes expired sessions and deletes their files.
      */
@@ -119,6 +144,7 @@ export class SessionManager {
 
     private destroySession(id: string) {
         this.sessions.delete(id);
+        for (const listener of this.destroyListeners) listener(id);
         const path = this.getSessionPath(id);
         if (existsSync(path)) {
             try {

server/src/lib/netGuard.ts

@@ -0,0 +1,164 @@
+import { lookup as dnsLookup } from "node:dns";
+import { isIP } from "node:net";
+import { buildConnector } from "undici";
+
+/**
+ * Proteção contra SSRF: o servidor baixa qualquer URL que o cliente enviar,
+ * então por padrão ele recusa endereços de loopback, rede privada, link-local
+ * (inclui o endpoint de metadados de nuvem 169.254.169.254) e similares.
+ *
+ * Para rodar o servidor numa rede privada e baixar de hosts internos de
+ * propósito, defina ALLOW_PRIVATE_NETWORK=true.
+ */
+
+export class UrlNotAllowedError extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = "UrlNotAllowedError";
+    }
+}
+
+const allowPrivateNetwork = () => process.env.ALLOW_PRIVATE_NETWORK === "true";
+
+function parseIPv4(ip: string): number[] | null {
+    const parts = ip.split(".").map(Number);
+    return parts.length === 4 && parts.every((n) => Number.isInteger(n) && n >= 0 && n <= 255)
+        ? parts
+        : null;
+}
+
+// Faixas IPv4 não públicas: [primeiro octeto, 2º octeto mín., 2º octeto máx.],
+// e o terceiro octeto só importa em 192.0.0.0/24.
+const BLOCKED_IPV4_RANGES: Array<[number, number, number]> = [
+    [0, 0, 255], // "esta rede"
+    [10, 0, 255], // privada
+    [127, 0, 255], // loopback
+    [100, 64, 127], // CGNAT
+    [169, 254, 254], // link-local / metadados de nuvem
+    [172, 16, 31], // privada
+    [192, 168, 168], // privada
+    [198, 18, 19], // benchmarking
+];
+
+function isBlockedIPv4([a, b, c]: number[]): boolean {
+    if (a >= 224) return true; // multicast, reservado e broadcast
+    if (a === 192 && b === 0 && c === 0) return true; // IETF protocol assignments
+    return BLOCKED_IPV4_RANGES.some(([first, min, max]) => a === first && b >= min && b <= max);
+}
+
+/** Troca um IPv4 embutido no fim ("::ffff:1.2.3.4") por dois grupos hexa. */
+function expandEmbeddedIPv4(text: string): string | null {
+    const embedded = text.match(/^(.*:)(\d+\.\d+\.\d+\.\d+)$/);
+    if (!embedded) return text;
+    const v4 = parseIPv4(embedded[2]);
+    if (!v4) return null;
+    return `${embedded[1]}${((v4[0] << 8) | v4[1]).toString(16)}:${((v4[2] << 8) | v4[3]).toString(16)}`;
+}
+
+/** Expande um IPv6 para 8 grupos de 16 bits (ou null se for inválido). */
+function parseIPv6(ip: string): number[] | null {
+    const text = expandEmbeddedIPv4(ip.split("%")[0].toLowerCase()); // remove zone id
+    if (text === null) return null;
+
+    const halves = text.split("::");
+    if (halves.length > 2) return null;
+    const head = halves[0] ? halves[0].split(":") : [];
+    const tail = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+    const missing = 8 - head.length - tail.length;
+    const compressed = halves.length === 2;
+    if (compressed ? missing < 1 : missing !== 0) return null;
+
+    const groups = [...head, ...Array(missing).fill("0"), ...tail].map((g) => parseInt(g, 16));
+    return groups.every((g) => g >= 0 && g <= 0xffff) ? groups : null;
+}
+
+function isReservedIPv6Prefix(first: number): boolean {
+    return (
+        (first & 0xfe00) === 0xfc00 || // fc00::/7 (unique local)
+        (first & 0xffc0) === 0xfe80 || // fe80::/10 (link-local)
+        (first & 0xff00) === 0xff00 // multicast
+    );
+}
+
+function isBlockedIPv6(ip: string): boolean {
+    const g = parseIPv6(ip);
+    if (!g) return true; // não conseguiu interpretar: recusa por segurança
+
+    const zeros = (from: number, to: number) => g.slice(from, to).every((x) => x === 0);
+    const embeddedV4 = [g[6] >> 8, g[6] & 0xff, g[7] >> 8, g[7] & 0xff];
+
+    if (zeros(0, 7) && g[7] <= 1) return true; // :: e ::1
+    if (zeros(0, 5) && g[5] === 0xffff) return isBlockedIPv4(embeddedV4); // ::ffff:a.b.c.d
+    if (g[0] === 0x64 && g[1] === 0xff9b && zeros(2, 6)) return isBlockedIPv4(embeddedV4); // NAT64
+    return isReservedIPv6Prefix(g[0]);
+}
+
+/** true se o endereço IP (v4 ou v6) pertence a uma faixa não pública. */
+export function isBlockedAddress(ip: string): boolean {
+    const family = isIP(ip);
+    if (family === 4) return isBlockedIPv4(parseIPv4(ip)!);
+    if (family === 6) return isBlockedIPv6(ip);
+    return true;
+}
+
+function isBlockedHostname(hostname: string): boolean {
+    const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+    if (host === "localhost" || host.endsWith(".localhost")) return true;
+    return isIP(host) !== 0 && isBlockedAddress(host);
+}
+
+/**
+ * Valida a URL antes de enfileirar: só http/https e, a menos que
+ * ALLOW_PRIVATE_NETWORK=true, nada de localhost ou IP privado literal.
+ * Nomes de domínio que resolvem para IP privado são barrados na conexão.
+ */
+export function assertDownloadableUrl(rawUrl: string): URL {
+    let url: URL;
+    try {
+        url = new URL(rawUrl);
+    } catch {
+        throw new UrlNotAllowedError("Invalid URL");
+    }
+
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new UrlNotAllowedError("Only http and https URLs are allowed");
+    }
+    if (!allowPrivateNetwork() && isBlockedHostname(url.hostname)) {
+        throw new UrlNotAllowedError("URLs pointing to local or private addresses are not allowed");
+    }
+    return url;
+}
+
+/**
+ * Conector do undici que revalida o destino em cada conexão (inclusive nos
+ * redirects): IP literal é checado antes de conectar e nomes são checados no
+ * IP já resolvido, o que também cobre DNS rebinding.
+ */
+export function createGuardedConnector(options: buildConnector.BuildOptions): buildConnector.connector {
+    const connect = buildConnector({
+        ...options,
+        lookup: (hostname, lookupOptions, callback) => {
+            dnsLookup(hostname, lookupOptions, (err, address, family) => {
+                if (err) return callback(err, address as never, family as never);
+                const list = Array.isArray(address) ? address.map((a) => a.address) : [address];
+                const blocked = !allowPrivateNetwork() && list.some(isBlockedAddress);
+                if (blocked) {
+                    return callback(
+                        new UrlNotAllowedError(`${hostname} resolves to a local or private address`),
+                        address as never,
+                        family as never,
+                    );
+                }
+                callback(null, address as never, family as never);
+            });
+        },
+    } as buildConnector.BuildOptions);
+
+    return (opts, callback) => {
+        if (!allowPrivateNetwork() && isBlockedHostname(opts.hostname)) {
+            callback(new UrlNotAllowedError("Blocked local or private address"), null);
+            return;
+        }
+        connect(opts, callback);
+    };
+}

server/test/helpers.ts

@@ -0,0 +1,18 @@
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { vi } from "vitest";
+
+/**
+ * Carrega os módulos do servidor com um STORAGE_ROOT temporário.
+ * O SessionManager lê a variável e cria o singleton no import, então o módulo
+ * precisa ser reimportado a cada teste.
+ */
+export async function loadModules() {
+    const storageRoot = mkdtempSync(join(tmpdir(), "downloader-test-"));
+    process.env.STORAGE_ROOT = storageRoot;
+    vi.resetModules();
+    const { sessionManager } = await import("../src/lib/SessionManager.js");
+    const { DownloadManager } = await import("../src/lib/DownloadManager.js");
+    return { storageRoot, sessionManager, DownloadManager };
+}

server/test/netGuard.test.ts

@@ -0,0 +1,188 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { rmSync } from "node:fs";
+import { Agent, interceptors } from "undici";
+import {
+    UrlNotAllowedError,
+    assertDownloadableUrl,
+    createGuardedConnector,
+    isBlockedAddress,
+} from "../src/lib/netGuard.js";
+import { loadModules } from "./helpers.js";
+
+// Resolve "internal.test" para um IP privado e o resto para um público,
+// sem depender de DNS real.
+vi.mock("node:dns", () => ({
+    lookup: (
+        host: string,
+        opts: { all?: boolean },
+        cb: (err: Error | null, address: unknown, family?: number) => void,
+    ) => {
+        const address = host === "internal.test" ? "10.0.0.5" : "93.184.216.34";
+        if (opts?.all) cb(null, [{ address, family: 4 }]);
+        else cb(null, address, 4);
+    },
+}));
+
+afterEach(() => {
+    delete process.env.ALLOW_PRIVATE_NETWORK;
+});
+
+describe("isBlockedAddress", () => {
+    it.each([
+        "0.0.0.0", "10.1.2.3", "100.64.0.1", "127.0.0.1", "169.254.169.254",
+        "172.16.0.1", "172.31.255.255", "192.168.1.1", "198.18.0.1", "224.0.0.1",
+        "255.255.255.255", "::", "::1", "fc00::1", "fd12:3456::1", "fe80::1",
+        "ff02::1", "::ffff:127.0.0.1", "::ffff:7f00:1", "::ffff:10.0.0.1",
+        "64:ff9b::7f00:1",
+    ])("bloqueia %s", (ip) => {
+        expect(isBlockedAddress(ip)).toBe(true);
+    });
+
+    it.each([
+        "8.8.8.8", "1.1.1.1", "93.184.216.34", "172.15.0.1", "172.32.0.1",
+        "100.63.0.1", "198.20.0.1", "2606:4700:4700::1111", "::ffff:8.8.8.8",
+    ])("permite %s", (ip) => {
+        expect(isBlockedAddress(ip)).toBe(false);
+    });
+
+    it("bloqueia o que não é IP", () => {
+        expect(isBlockedAddress("example.com")).toBe(true);
+    });
+});
+
+describe("assertDownloadableUrl", () => {
+    it("aceita http e https públicos", () => {
+        expect(assertDownloadableUrl("https://example.com/a.zip").hostname).toBe("example.com");
+        expect(assertDownloadableUrl("http://8.8.8.8/a.zip").hostname).toBe("8.8.8.8");
+    });
+
+    it.each(["ftp://example.com/a", "file:///etc/passwd", "javascript:alert(1)"])(
+        "recusa o protocolo de %s",
+        (url) => {
+            expect(() => assertDownloadableUrl(url)).toThrow(/http and https/);
+        },
+    );
+
+    it("recusa URL inválida", () => {
+        expect(() => assertDownloadableUrl("not a url")).toThrow(UrlNotAllowedError);
+    });
+
+    it.each([
+        "http://localhost:3000/", "http://app.localhost/", "http://127.0.0.1/",
+        "http://[::1]/", "http://169.254.169.254/latest/meta-data/",
+        "http://10.0.0.1/", "http://192.168.0.10:8080/", "http://[::ffff:127.0.0.1]/",
+        "http://2130706433/", // 127.0.0.1 em decimal: o parser do WHATWG normaliza
+    ])("recusa %s", (url) => {
+        expect(() => assertDownloadableUrl(url)).toThrow(/local or private/);
+    });
+
+    it("libera endereços privados com ALLOW_PRIVATE_NETWORK=true", () => {
+        process.env.ALLOW_PRIVATE_NETWORK = "true";
+        expect(assertDownloadableUrl("http://127.0.0.1/").hostname).toBe("127.0.0.1");
+    });
+});
+
+describe("createGuardedConnector", () => {
+    const connect = (hostname: string) =>
+        new Promise<Error | null>((done) => {
+            const connector = createGuardedConnector({ timeout: 2000 });
+            connector({ hostname, host: hostname, protocol: "http:", port: "9" }, (err, socket) => {
+                socket?.destroy();
+                done(err);
+            });
+        });
+
+    it("recusa IP literal privado antes de conectar", async () => {
+        expect(await connect("127.0.0.1")).toBeInstanceOf(UrlNotAllowedError);
+    });
+
+    it("recusa nome que resolve para IP privado", async () => {
+        const err = await connect("internal.test");
+        expect(err).toBeInstanceOf(UrlNotAllowedError);
+        expect(err?.message).toMatch(/internal\.test resolves/);
+    });
+
+    it("deixa passar nome que resolve para IP público (falha só ao conectar)", async () => {
+        const err = await connect("public.test");
+        expect(err).not.toBeInstanceOf(UrlNotAllowedError);
+    });
+});
+
+describe("DownloadManager com a proteção", () => {
+    let origin: Server | undefined;
+
+    afterEach(async () => {
+        if (origin) await new Promise((done) => origin!.close(done));
+        origin = undefined;
+    });
+
+    async function startOrigin(handler: Parameters<typeof createServer>[1]) {
+        origin = createServer(handler);
+        await new Promise<void>((done) => origin!.listen(0, "127.0.0.1", done));
+        return (origin.address() as AddressInfo).port;
+    }
+
+    async function waitWhileDownloading(read: () => string | undefined) {
+        for (let i = 0; i < 500 && read() === "downloading"; i++) {
+            await new Promise((done) => setTimeout(done, 5));
+        }
+    }
+
+    it("recusa enfileirar URL privada", async () => {
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+        const session = sessionManager.getSession();
+        // loadModules() reimporta os módulos, então a classe não é a mesma: compara pelo nome.
+        await expect(manager.queueDownload(session.id, "http://127.0.0.1:1/x")).rejects.toMatchObject({
+            name: "UrlNotAllowedError",
+        });
+        expect(manager.getTasks(session.id)).toEqual([]);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it("segue redirect e salva o arquivo final, não o corpo do 302", async () => {
+        process.env.ALLOW_PRIVATE_NETWORK = "true";
+        const port = await startOrigin((req, res) => {
+            if (req.url === "/start") {
+                res.writeHead(302, { location: "/final.bin" });
+                res.end("redirecting");
+                return;
+            }
+            res.setHeader("content-length", "5");
+            res.end("hello");
+        });
+
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const agent = new Agent({ connect: createGuardedConnector({ timeout: 2000 }) }).compose(
+            interceptors.redirect({ maxRedirections: 5 }),
+        );
+        const manager = new DownloadManager(agent);
+        const session = sessionManager.getSession();
+        const task = await manager.queueDownload(session.id, `http://127.0.0.1:${port}/start`);
+        await waitWhileDownloading(() => manager.getTask(task.id)?.status);
+
+        const finished = manager.getTask(task.id)!;
+        expect(finished.status).toBe("completed");
+        expect(finished.totalBytes).toBe(5);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it("marca erro quando a resposta 3xx não é seguida", async () => {
+        process.env.ALLOW_PRIVATE_NETWORK = "true";
+        const port = await startOrigin((_req, res) => {
+            res.writeHead(302);
+            res.end("nope");
+        });
+
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+        const session = sessionManager.getSession();
+        const task = await manager.queueDownload(session.id, `http://127.0.0.1:${port}/`);
+        await waitWhileDownloading(() => manager.getTask(task.id)?.status);
+
+        expect(manager.getTask(task.id)).toMatchObject({ status: "error", error: "HTTP Error 302" });
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+});

server/test/sessions.test.ts

@@ -0,0 +1,106 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { sep } from "node:path";
+import { Agent } from "undici";
+import { loadModules } from "./helpers.js";
+
+const HOUR = 60 * 60 * 1000;
+
+let origin: Server;
+let originUrl: string;
+
+beforeEach(async () => {
+    process.env.ALLOW_PRIVATE_NETWORK = "true"; // a origem de teste está em 127.0.0.1
+    vi.useFakeTimers({ toFake: ["setInterval", "Date"] });
+    origin = createServer((_req, res) => {
+        res.setHeader("content-length", "5");
+        res.end("hello");
+    });
+    await new Promise<void>((done) => origin.listen(0, "127.0.0.1", done));
+    originUrl = `http://127.0.0.1:${(origin.address() as AddressInfo).port}/file.txt`;
+});
+
+afterEach(async () => {
+    delete process.env.ALLOW_PRIVATE_NETWORK;
+    vi.useRealTimers();
+    await new Promise((done) => origin.close(done));
+});
+
+async function waitForStatus(
+    read: () => string | undefined,
+    wanted: string,
+) {
+    for (let i = 0; i < 500 && read() !== wanted; i++) {
+        await new Promise((done) => setImmediate(done));
+    }
+    expect(read()).toBe(wanted);
+}
+
+describe("tasks e sessões", () => {
+    it("descarta as tasks e os arquivos quando a sessão expira", async () => {
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+
+        const session = sessionManager.getSession();
+        const task = await manager.queueDownload(session.id, originUrl);
+        await waitForStatus(() => manager.getTask(task.id)?.status, "completed");
+        expect(readdirSync(`${storageRoot}/${session.id}`)).toHaveLength(1);
+
+        vi.setSystemTime(Date.now() + HOUR + 1000);
+        vi.advanceTimersByTime(60_000); // dispara o coletor
+
+        expect(manager.getTask(task.id)).toBeUndefined();
+        expect(manager.getTasks(session.id)).toEqual([]);
+        expect(existsSync(`${storageRoot}/${session.id}`)).toBe(false);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it("mantém as tasks de outras sessões ainda ativas", async () => {
+        const { sessionManager, DownloadManager, storageRoot } = await loadModules();
+        const manager = new DownloadManager(new Agent());
+
+        const expiring = sessionManager.getSession();
+        await manager.queueDownload(expiring.id, originUrl);
+
+        vi.setSystemTime(Date.now() + HOUR - 1000);
+        const alive = sessionManager.getSession(); // criada perto do fim da outra
+        const kept = await manager.queueDownload(alive.id, originUrl);
+        vi.setSystemTime(Date.now() + 2000);
+        vi.advanceTimersByTime(60_000);
+
+        expect(manager.getTasks(expiring.id)).toEqual([]);
+        expect(manager.getTask(kept.id)).toBeDefined();
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+});
+
+describe("id de sessão", () => {
+    it("aceita um UUID já conhecido", async () => {
+        const { sessionManager, storageRoot } = await loadModules();
+        const first = sessionManager.getSession();
+        expect(sessionManager.getSession(first.id).id).toBe(first.id);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+
+    it.each(["..", ".", "../../etc", "a/b", "not-a-uuid", ""])(
+        "ignora o id inválido %j e cria outra sessão",
+        async (bad) => {
+            const { sessionManager, storageRoot } = await loadModules();
+            const session = sessionManager.getSession(bad);
+            expect(session.id).toMatch(/^[0-9a-f-]{36}$/);
+            expect(sessionManager.getSessionPath(session.id)).toBe(`${storageRoot}${sep}${session.id}`);
+            rmSync(storageRoot, { recursive: true, force: true });
+        },
+    );
+
+    it("não deixa um id '..' apagar a pasta pai quando expira", async () => {
+        const { sessionManager, storageRoot } = await loadModules();
+        sessionManager.getSession("..");
+        vi.setSystemTime(Date.now() + HOUR + 1000);
+        vi.advanceTimersByTime(60_000);
+        expect(existsSync(storageRoot)).toBe(true);
+        rmSync(storageRoot, { recursive: true, force: true });
+    });
+});

web/README.md

@@ -1,73 +0,0 @@
-# React + TypeScript + Vite
-
-This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
-
-Currently, two official plugins are available:
-
-- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
-- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
-
-## React Compiler
-
-The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
-
-## Expanding the ESLint configuration
-
-If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
-
-```js
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-
-      // Remove tseslint.configs.recommended and replace with this
-      tseslint.configs.recommendedTypeChecked,
-      // Alternatively, use this for stricter rules
-      tseslint.configs.strictTypeChecked,
-      // Optionally, add this for stylistic rules
-      tseslint.configs.stylisticTypeChecked,
-
-      // Other configs...
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
-```
-
-You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
-
-```js
-// eslint.config.js
-import reactX from 'eslint-plugin-react-x'
-import reactDom from 'eslint-plugin-react-dom'
-
-export default defineConfig([
-  globalIgnores(['dist']),
-  {
-    files: ['**/*.{ts,tsx}'],
-    extends: [
-      // Other configs...
-      // Enable lint rules for React
-      reactX.configs['recommended-typescript'],
-      // Enable lint rules for React DOM
-      reactDom.configs.recommended,
-    ],
-    languageOptions: {
-      parserOptions: {
-        project: ['./tsconfig.node.json', './tsconfig.app.json'],
-        tsconfigRootDir: import.meta.dirname,
-      },
-      // other options...
-    },
-  },
-])
-```

web/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>web</title>
+    <title>Ephemeral Downloader</title>
   </head>
   <body>
     <div id="root"></div>

web/package.json

@@ -7,6 +7,8 @@
     "dev": "vite",
     "build": "tsc -b && vite build",
     "lint": "eslint .",
+    "test": "vitest run",
+    "typecheck": "tsc -b",
     "preview": "vite preview"
   },
   "dependencies": {
@@ -15,7 +17,6 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "tailwind-merge": "^3.4.0",
-    "uuid": "^13.0.0",
     "zod": "^3.25.76"
   },
   "devDependencies": {
@@ -34,6 +35,7 @@
     "tailwindcss": "^4.1.18",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.46.4",
-    "vite": "^7.2.4"
+    "vite": "^7.2.4",
+    "vitest": "^5.0.3"
   }
 }

web/src/App.tsx

@@ -1,43 +1,25 @@
-import { AlertCircle, HardDrive, Server } from "lucide-react";
 import { DownloadForm } from "./components/feature/DownloadForm";
 import { DownloadItem } from "./components/feature/DownloadItem";
-import { SessionTimer } from "./components/feature/SessionTimer";
-import { Alert, AlertDescription, AlertTitle } from "./components/ui/Alert";
 import { Layout } from "./components/ui/Layout";
-import { SessionProvider } from "./context/SessionContext";
-import { useSession } from "./context/session-context";
+import { Alert, AlertDescription, AlertTitle } from "./components/ui/Alert";
+import { AlertCircle } from "lucide-react";
+import { SessionProvider, useSession } from "./context/SessionContext";
+import { SessionTimer } from "./components/feature/SessionTimer";
 
 function DownloadList() {
   const { tasks, expiresAt } = useSession();
 
   return (
-    <section className="space-y-5">
-      <div className="flex flex-col gap-4 rounded-[2rem] border border-border/70 bg-card/60 p-6 shadow-[0_24px_80px_-40px_rgba(15,23,42,0.95)] backdrop-blur-xl md:flex-row md:items-center md:justify-between">
-        <div className="space-y-2">
-          <p className="text-xs font-semibold uppercase tracking-[0.24em] text-primary/80">
-            Transfer activity
-          </p>
-          <h2 className="text-2xl font-semibold tracking-tight text-foreground">
-            Downloads in this session
-          </h2>
-          <p className="max-w-2xl text-sm leading-6 text-muted-foreground">
-            Monitor queue status, transfer speed and final files from a single workspace.
-          </p>
-        </div>
-        <SessionTimer expiresAt={expiresAt} className="md:min-w-[260px]" />
+    <div className="space-y-4">
+      <div className="flex items-center justify-between">
+        <h2 className="text-xl font-semibold tracking-tight">Active Downloads</h2>
+        <SessionTimer expiresAt={expiresAt} />
       </div>
 
       {tasks.length === 0 ? (
-        <div className="rounded-[2rem] border border-dashed border-border/80 bg-card/35 px-6 py-14 text-center shadow-[0_24px_80px_-50px_rgba(15,23,42,0.95)]">
-          <p className="text-xs font-semibold uppercase tracking-[0.24em] text-primary/75">
-            Queue is empty
-          </p>
-          <h3 className="mt-3 text-2xl font-semibold tracking-tight text-foreground">
-            No downloads yet
-          </h3>
-          <p className="mx-auto mt-3 max-w-xl text-sm leading-6 text-muted-foreground">
-            Your queued, active and completed transfers will appear here with progress, speed and the final save action.
-          </p>
+        <div className="flex flex-col items-center justify-center py-12 text-center text-muted-foreground border-2 border-dashed rounded-lg bg-card/50">
+          <p>No downloads in session</p>
+          <p className="text-xs opacity-70">Files are removed after 1 hour of inactivity</p>
         </div>
       ) : (
         <div className="grid gap-4">
@@ -46,77 +28,42 @@ function DownloadList() {
           ))}
         </div>
       )}
-    </section>
+    </div>
   );
 }
 
 function Main() {
-  const { queueDownload, sessionId } = useSession();
-
-  const handleDownload = async (url: string): Promise<void> => {
-    await queueDownload(url);
-  };
+  const { queueDownload } = useSession();
 
   return (
     <Layout>
-      <div className="grid gap-8 xl:grid-cols-[minmax(0,430px)_minmax(0,1fr)] xl:items-start">
-        <div className="space-y-6 xl:sticky xl:top-28">
-          <section className="rounded-[2rem] border border-border/70 bg-card/55 p-6 shadow-[0_24px_90px_-45px_rgba(15,23,42,0.98)] backdrop-blur-xl md:p-7">
-            <span className="inline-flex rounded-full border border-primary/20 bg-primary/10 px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.24em] text-primary">
-              Private download workspace
-            </span>
-
-            <div className="mt-5 space-y-3">
-              <h1 className="max-w-lg text-3xl font-semibold tracking-tight text-foreground md:text-[2.5rem] md:leading-[1.05]">
-                Queue secure transfers from a cleaner control panel.
-              </h1>
-              <p className="max-w-xl text-sm leading-7 text-muted-foreground md:text-[0.95rem]">
-                Paste a file URL, let the server fetch it first, then keep every transfer visible until the session window expires.
-              </p>
-            </div>
-
-            <div className="mt-6 grid gap-3 sm:grid-cols-2">
-              <div className="rounded-[1.5rem] border border-white/6 bg-background/45 p-4">
-                <Server className="h-5 w-5 text-primary" />
-                <p className="mt-4 text-sm font-semibold text-foreground">Server-side transfer</p>
-                <p className="mt-2 text-sm leading-6 text-muted-foreground">
-                  Downloads are fetched on the VPS first, then exposed as a final file in your session.
+      <div className="grid gap-8 lg:grid-cols-12">
+        {/* Left Column: Input Form */}
+        <div className="lg:col-span-4 space-y-6">
+          <div className="sticky top-24 space-y-6">
+            <section className="space-y-4">
+              <div className="space-y-2">
+                <h2 className="text-xl font-semibold tracking-tight">New Download</h2>
+                <p className="text-sm text-muted-foreground">
+                  Paste a link to start. Files are downloaded to the server first.
                 </p>
               </div>
-              <div className="rounded-[1.5rem] border border-white/6 bg-background/45 p-4">
-                <HardDrive className="h-5 w-5 text-primary" />
-                <p className="mt-4 text-sm font-semibold text-foreground">Ephemeral storage</p>
-                <p className="mt-2 text-sm leading-6 text-muted-foreground">
-                  Files stay available for one hour of activity and are removed automatically after expiration.
-                </p>
-              </div>
-            </div>
-          </section>
+              <DownloadForm onDownload={queueDownload} />
+            </section>
 
-          <section className="rounded-[2rem] border border-border/70 bg-card/70 p-6 shadow-[0_24px_90px_-45px_rgba(15,23,42,0.98)] backdrop-blur-xl md:p-7">
-            <div className="space-y-2">
-              <p className="text-xs font-semibold uppercase tracking-[0.24em] text-primary/80">New transfer</p>
-              <h2 className="text-2xl font-semibold tracking-tight text-foreground">Start a new download</h2>
-              <p className="text-sm leading-6 text-muted-foreground">
-                Paste a direct file URL to add it to the active session queue.
-              </p>
-            </div>
-
-            <div className="mt-6">
-              <DownloadForm onDownload={handleDownload} isReady={Boolean(sessionId)} />
-            </div>
-          </section>
-
-          <Alert variant="destructive">
-            <AlertCircle className="h-4 w-4" />
-            <AlertTitle>Ephemeral session policy</AlertTitle>
-            <AlertDescription>
-              Files are stored for <strong>1 hour</strong>. The timer resets on activity, and once the session expires every stored file is deleted permanently.
-            </AlertDescription>
-          </Alert>
+            <Alert variant="destructive">
+              <AlertCircle className="h-4 w-4" />
+              <AlertTitle>Ephemeral Session</AlertTitle>
+              <AlertDescription>
+                Files are stored for <strong>1 hour</strong>. The timer resets on interaction.
+                After expiration, all files are permanently deleted.
+              </AlertDescription>
+            </Alert>
+          </div>
         </div>
 
-        <div className="min-w-0">
+        {/* Right Column: Downloads List */}
+        <div className="lg:col-span-8">
           <DownloadList />
         </div>
       </div>

web/src/assets/react.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="35.93" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 228"><path fill="#00D8FF" d="M210.483 73.824a171.49 171.49 0 0 0-8.24-2.597c.465-1.9.893-3.777 1.273-5.621c6.238-30.281 2.16-54.676-11.769-62.708c-13.355-7.7-35.196.329-57.254 19.526a171.23 171.23 0 0 0-6.375 5.848a155.866 155.866 0 0 0-4.241-3.917C100.759 3.829 77.587-4.822 63.673 3.233C50.33 10.957 46.379 33.89 51.995 62.588a170.974 170.974 0 0 0 1.892 8.48c-3.28.932-6.445 1.924-9.474 2.98C17.309 83.498 0 98.307 0 113.668c0 15.865 18.582 31.778 46.812 41.427a145.52 145.52 0 0 0 6.921 2.165a167.467 167.467 0 0 0-2.01 9.138c-5.354 28.2-1.173 50.591 12.134 58.266c13.744 7.926 36.812-.22 59.273-19.855a145.567 145.567 0 0 0 5.342-4.923a168.064 168.064 0 0 0 6.92 6.314c21.758 18.722 43.246 26.282 56.54 18.586c13.731-7.949 18.194-32.003 12.4-61.268a145.016 145.016 0 0 0-1.535-6.842c1.62-.48 3.21-.974 4.76-1.488c29.348-9.723 48.443-25.443 48.443-41.52c0-15.417-17.868-30.326-45.517-39.844Zm-6.365 70.984c-1.4.463-2.836.91-4.3 1.345c-3.24-10.257-7.612-21.163-12.963-32.432c5.106-11 9.31-21.767 12.459-31.957c2.619.758 5.16 1.557 7.61 2.4c23.69 8.156 38.14 20.213 38.14 29.504c0 9.896-15.606 22.743-40.946 31.14Zm-10.514 20.834c2.562 12.94 2.927 24.64 1.23 33.787c-1.524 8.219-4.59 13.698-8.382 15.893c-8.067 4.67-25.32-1.4-43.927-17.412a156.726 156.726 0 0 1-6.437-5.87c7.214-7.889 14.423-17.06 21.459-27.246c12.376-1.098 24.068-2.894 34.671-5.345a134.17 134.17 0 0 1 1.386 6.193ZM87.276 214.515c-7.882 2.783-14.16 2.863-17.955.675c-8.075-4.657-11.432-22.636-6.853-46.752a156.923 156.923 0 0 1 1.869-8.499c10.486 2.32 22.093 3.988 34.498 4.994c7.084 9.967 14.501 19.128 21.976 27.15a134.668 134.668 0 0 1-4.877 4.492c-9.933 8.682-19.886 14.842-28.658 17.94ZM50.35 144.747c-12.483-4.267-22.792-9.812-29.858-15.863c-6.35-5.437-9.555-10.836-9.555-15.216c0-9.322 13.897-21.212 37.076-29.293c2.813-.98 5.757-1.905 8.812-2.773c3.204 10.42 7.406 21.315 12.477 32.332c-5.137 11.18-9.399 22.249-12.634 32.792a134.718 134.718 0 0 1-6.318-1.979Zm12.378-84.26c-4.811-24.587-1.616-43.134 6.425-47.789c8.564-4.958 27.502 2.111 47.463 19.835a144.318 144.318 0 0 1 3.841 3.545c-7.438 7.987-14.787 17.08-21.808 26.988c-12.04 1.116-23.565 2.908-34.161 5.309a160.342 160.342 0 0 1-1.76-7.887Zm110.427 27.268a347.8 347.8 0 0 0-7.785-12.803c8.168 1.033 15.994 2.404 23.343 4.08c-2.206 7.072-4.956 14.465-8.193 22.045a381.151 381.151 0 0 0-7.365-13.322Zm-45.032-43.861c5.044 5.465 10.096 11.566 15.065 18.186a322.04 322.04 0 0 0-30.257-.006c4.974-6.559 10.069-12.652 15.192-18.18ZM82.802 87.83a323.167 323.167 0 0 0-7.227 13.238c-3.184-7.553-5.909-14.98-8.134-22.152c7.304-1.634 15.093-2.97 23.209-3.984a321.524 321.524 0 0 0-7.848 12.897Zm8.081 65.352c-8.385-.936-16.291-2.203-23.593-3.793c2.26-7.3 5.045-14.885 8.298-22.6a321.187 321.187 0 0 0 7.257 13.246c2.594 4.48 5.28 8.868 8.038 13.147Zm37.542 31.03c-5.184-5.592-10.354-11.779-15.403-18.433c4.902.192 9.899.29 14.978.29c5.218 0 10.376-.117 15.453-.343c-4.985 6.774-10.018 12.97-15.028 18.486Zm52.198-57.817c3.422 7.8 6.306 15.345 8.596 22.52c-7.422 1.694-15.436 3.058-23.88 4.071a382.417 382.417 0 0 0 7.859-13.026a347.403 347.403 0 0 0 7.425-13.565Zm-16.898 8.101a358.557 358.557 0 0 1-12.281 19.815a329.4 329.4 0 0 1-23.444.823c-7.967 0-15.716-.248-23.178-.732a310.202 310.202 0 0 1-12.513-19.846h.001a307.41 307.41 0 0 1-10.923-20.627a310.278 310.278 0 0 1 10.89-20.637l-.001.001a307.318 307.318 0 0 1 12.413-19.761c7.613-.576 15.42-.876 23.31-.876H128c7.926 0 15.743.303 23.354.883a329.357 329.357 0 0 1 12.335 19.695a358.489 358.489 0 0 1 11.036 20.54a329.472 329.472 0 0 1-11 20.722Zm22.56-122.124c8.572 4.944 11.906 24.881 6.52 51.026c-.344 1.668-.73 3.367-1.15 5.09c-10.622-2.452-22.155-4.275-34.23-5.408c-7.034-10.017-14.323-19.124-21.64-27.008a160.789 160.789 0 0 1 5.888-5.4c18.9-16.447 36.564-22.941 44.612-18.3ZM128 90.808c12.625 0 22.86 10.235 22.86 22.86s-10.235 22.86-22.86 22.86s-22.86-10.235-22.86-22.86s10.235-22.86 22.86-22.86Z"></path></svg>

web/src/components/feature/DownloadForm.tsx

@@ -1,32 +1,23 @@
 import { useState } from "react";
-import { Download, Loader2 } from "lucide-react";
-import { z } from "zod";
 import { Button } from "../ui/Button";
 import { Input } from "../ui/Input";
+import { Download } from "lucide-react";
+import { z } from "zod";
 
 const formSchema = z.object({
     url: z.string().url("Please enter a valid URL"),
 });
 
 interface DownloadFormProps {
-    onDownload: (url: string) => Promise<void> | void;
-    isReady: boolean;
+    onDownload: (url: string) => Promise<void>;
 }
 
-function getErrorMessage(error: unknown): string {
-    if (error instanceof Error && error.message) {
-        return error.message;
-    }
-
-    return "Unable to queue the download right now.";
-}
-
-export function DownloadForm({ onDownload, isReady }: DownloadFormProps) {
+export function DownloadForm({ onDownload }: DownloadFormProps) {
     const [url, setUrl] = useState("");
     const [error, setError] = useState<string | null>(null);
-    const [isSubmitting, setIsSubmitting] = useState(false);
+    const [submitting, setSubmitting] = useState(false);
 
-    const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
+    const handleSubmit = async (e: React.FormEvent) => {
         e.preventDefault();
         setError(null);
 
@@ -37,53 +28,40 @@ export function DownloadForm({ onDownload, isReady }: DownloadFormProps) {
             return;
         }
 
-        if (!isReady) {
-            setError("Session is still initializing. Try again in a moment.");
-            return;
-        }
-
+        setSubmitting(true);
         try {
-            setIsSubmitting(true);
             await onDownload(url);
             setUrl("");
-        } catch (submitError: unknown) {
-            setError(getErrorMessage(submitError));
+        } catch (err) {
+            setError(err instanceof Error ? err.message : "Failed to queue download");
         } finally {
-            setIsSubmitting(false);
+            setSubmitting(false);
         }
     };
 
     return (
-        <form onSubmit={handleSubmit} className="flex w-full flex-col gap-5">
-            <div className="space-y-3">
-                <label htmlFor="download-url" className="text-sm font-semibold text-foreground">
-                    File URL
-                </label>
-                <Input
-                    id="download-url"
-                    type="url"
-                    placeholder="https://example.com/file.zip"
-                    value={url}
-                    onChange={(e) => setUrl(e.target.value)}
-                    disabled={isSubmitting}
-                    className={error ? "border-destructive/60 focus-visible:ring-destructive/15" : ""}
-                />
-                <div className="flex flex-col gap-2 text-xs text-muted-foreground sm:flex-row sm:items-center sm:justify-between">
-                    <span>Use a direct file link whenever possible for faster server-side fetching.</span>
-                    <span className="font-medium text-primary/80">
-                        {isReady ? "Validated before queueing" : "Preparing session"}
-                    </span>
+        <form onSubmit={handleSubmit} className="flex w-full flex-col gap-4">
+            <div className="flex w-full items-start gap-2">
+                <div className="flex-1 space-y-1">
+                    <Input
+                        type="url"
+                        aria-label="File URL"
+                        aria-invalid={error ? true : undefined}
+                        aria-describedby={error ? "url-error" : undefined}
+                        placeholder="https://example.com/file.zip"
+                        value={url}
+                        onChange={(e) => setUrl(e.target.value)}
+                        className={error ? "border-destructive focus-visible:ring-destructive" : ""}
+                    />
+                    {error && (
+                        <p id="url-error" role="alert" className="text-xs text-destructive">
+                            {error}
+                        </p>
+                    )}
                 </div>
-                {error ? <p className="text-sm text-destructive">{error}</p> : null}
-            </div>
-
-            <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                <p className="max-w-sm text-sm leading-6 text-muted-foreground">
-                    The transfer starts on the server first, then becomes available in your session list.
-                </p>
-                <Button type="submit" disabled={!isReady || isSubmitting} className="w-full gap-2 sm:w-auto sm:min-w-[180px]">
-                    {isSubmitting ? <Loader2 className="h-4 w-4 animate-spin" /> : <Download className="h-4 w-4" />}
-                    {isSubmitting ? "Queueing..." : "Queue download"}
+                <Button type="submit" disabled={submitting}>
+                    <Download className="mr-2 h-4 w-4" />
+                    Download
                 </Button>
             </div>
         </form>

web/src/components/feature/DownloadItem.test.tsx

@@ -0,0 +1,109 @@
+import { describe, expect, it } from "vitest";
+import { renderToStaticMarkup } from "react-dom/server";
+import { DownloadItem, type DownloadItemData } from "./DownloadItem";
+
+const base: DownloadItemData = {
+    id: "t1",
+    sessionId: "s1",
+    url: "https://example.com/file.zip",
+    filename: "file.zip",
+    status: "downloading",
+    progress: 40,
+    totalBytes: 10 * 1024 * 1024,
+    receivedBytes: 4 * 1024 * 1024,
+    speed: 2 * 1024 * 1024,
+    createdAt: 0,
+};
+
+const render = (patch: Partial<DownloadItemData> = {}) =>
+    renderToStaticMarkup(<DownloadItem item={{ ...base, ...patch }} />);
+
+describe("DownloadItem", () => {
+    describe("em andamento (caminho principal)", () => {
+        const html = render();
+
+        it("mostra status, bytes, velocidade e porcentagem", () => {
+            expect(html).toContain("downloading");
+            expect(html).toContain("4.0 MB");
+            expect(html).toContain("10.0 MB");
+            expect(html).toContain("2.00 MB/s");
+            expect(html).toContain("40%");
+        });
+
+        it("usa o spinner e não mostra botão nem erro", () => {
+            expect(html).toContain("animate-spin");
+            expect(html).not.toContain("Save to Disk");
+            expect(html).not.toContain("Ready for download");
+        });
+    });
+
+    describe("status queued", () => {
+        it("mostra a mensagem de fila e o ícone pulsante", () => {
+            const html = render({ status: "queued" });
+            expect(html).toContain("Queued on server...");
+            expect(html).toContain("animate-pulse");
+            expect(html).not.toContain("animate-spin");
+        });
+    });
+
+    describe("status completed", () => {
+        const html = render({ status: "completed", progress: 100 });
+
+        it("mostra o botão de salvar e o tamanho final", () => {
+            expect(html).toContain("Save to Disk");
+            expect(html).toContain("Ready for download (10.0 MB)");
+        });
+
+        it("esconde a seção de progresso", () => {
+            expect(html).not.toContain("MB/s");
+            expect(html).not.toContain("100%");
+        });
+    });
+
+    describe("status error", () => {
+        it("mostra a mensagem de erro da task", () => {
+            const html = render({ status: "error", error: "HTTP Error 404" });
+            expect(html).toContain("HTTP Error 404");
+            expect(html).not.toContain("Save to Disk");
+            expect(html).not.toContain("MB/s");
+        });
+
+        it("usa a mensagem padrão sem detalhe de erro", () => {
+            expect(render({ status: "error" })).toContain("Unknown error occurred");
+        });
+    });
+
+    describe("título", () => {
+        it("usa o nome do arquivo", () => {
+            expect(render()).toContain('title="file.zip"');
+        });
+
+        it("cai para a URL quando não há nome do arquivo", () => {
+            expect(render({ filename: "" })).toContain(
+                'title="https://example.com/file.zip"'
+            );
+        });
+    });
+
+    describe("valores zerados durante o download", () => {
+        it("tamanho total desconhecido mostra ??", () => {
+            expect(render({ totalBytes: 0 })).toContain("??");
+        });
+
+        it("sem velocidade mostra 0 B/s", () => {
+            expect(render({ speed: 0 })).toContain("0 B/s");
+        });
+
+        it("sem progresso mostra 0%", () => {
+            expect(render({ progress: 0 })).toContain(">0%<");
+        });
+
+        it("sem bytes recebidos mostra hífen", () => {
+            expect(render({ receivedBytes: 0 })).toContain("- / 10.0 MB");
+        });
+
+        it("arredonda a porcentagem", () => {
+            expect(render({ progress: 40.6 })).toContain("41%");
+        });
+    });
+});

web/src/components/feature/DownloadItem.tsx

@@ -1,218 +1,147 @@
-import { useState } from "react";
+import type { ReactNode } from "react";
 import {
     FileCheck,
     FileWarning,
-    HardDrive,
     Loader2,
     Server,
+    HardDrive
 } from "lucide-react";
-import { DownloadStatus, DownloadTask, useSession } from "../../context/session-context";
-import { formatBytes, formatSpeed } from "../../lib/utils";
 import { Button } from "../ui/Button";
 import { Card, CardContent } from "../ui/Card";
 import { Progress } from "../ui/ProgressBar";
+import { formatBytes, formatSpeed } from "../../lib/utils";
 
+// Mesma origem por padrão (em produção o Fastify serve a API e o build do front).
+// Defina VITE_API_URL para apontar para outro host.
 const API_URL = import.meta.env.VITE_API_URL || "";
-const createdAtFormatter = new Intl.DateTimeFormat(undefined, {
-    hour: "2-digit",
-    minute: "2-digit",
-});
 
-interface DownloadItemProps {
-    item: DownloadTask;
-}
+export type DownloadStatus = "queued" | "downloading" | "completed" | "error";
 
-const statusLabel: Record<DownloadStatus, string> = {
-    queued: "Queued",
-    downloading: "Transferring",
-    completed: "Ready",
-    error: "Issue",
+export type DownloadItemData = {
+    id: string;
+    sessionId: string;
+    url: string;
+    filename: string;
+    status: DownloadStatus;
+    progress: number;
+    totalBytes: number;
+    receivedBytes: number;
+    speed: number;
+    error?: string;
+    createdAt: number;
 };
 
-function getDownloadErrorMessage(error: unknown): string {
-    if (error instanceof Error && error.message) {
-        return error.message;
+interface DownloadItemProps {
+    item: DownloadItemData;
+}
+
+const ICON_BOX = "flex h-10 w-10 items-center justify-center rounded-full";
+
+const STATUS_ICON: Record<DownloadStatus, { box: string; icon: ReactNode }> = {
+    completed: { box: "bg-green-500/10 text-green-500", icon: <FileCheck className="h-5 w-5" /> },
+    error: { box: "bg-destructive/10 text-destructive", icon: <FileWarning className="h-5 w-5" /> },
+    queued: {
+        box: "bg-secondary text-secondary-foreground",
+        icon: <Server className="h-5 w-5 animate-pulse" />,
+    },
+    downloading: { box: "bg-primary/10 text-primary", icon: <Loader2 className="h-5 w-5 animate-spin" /> },
+};
+
+function StatusIcon({ status }: { status: DownloadStatus }) {
+    const { box, icon } = STATUS_ICON[status];
+    return <div className={`${ICON_BOX} ${box}`}>{icon}</div>;
+}
+
+function ProgressSection({ item }: { item: DownloadItemData }) {
+    const total = item.totalBytes ? formatBytes(item.totalBytes) : "??";
+
+    return (
+        <div className="space-y-2 pt-2">
+            <div className="flex justify-between text-xs text-muted-foreground">
+                <span>{item.status === "queued" ? "Queued on server..." : item.status}</span>
+                <span>{formatBytes(item.receivedBytes || 0)} / {total}</span>
+            </div>
+            <Progress value={item.progress || 0} className="h-1.5" />
+            <div className="flex justify-between text-xs text-muted-foreground">
+                <span>{item.speed ? formatSpeed(item.speed) : "0 B/s"}</span>
+                <span>{item.progress ? `${Math.round(item.progress)}%` : "0%"}</span>
+            </div>
+        </div>
+    );
+}
+
+function StatusDetails({ item }: { item: DownloadItemData }) {
+    if (item.status === "completed") {
+        return (
+            <div className="pt-2 flex items-center gap-2 text-xs text-green-500">
+                <FileCheck className="w-3 h-3" />
+                <span>Ready for download ({formatBytes(item.totalBytes)})</span>
+            </div>
+        );
     }
 
-    return "Failed to download file.";
+    if (item.status === "error") {
+        return (
+            <div className="text-sm text-destructive pt-1">
+                {item.error || "Unknown error occurred"}
+            </div>
+        );
+    }
+
+    return <ProgressSection item={item} />;
+}
+
+async function saveToDisk(item: DownloadItemData) {
+    try {
+        const sessionId = localStorage.getItem("downloader_session_id") || "";
+        const res = await fetch(`${API_URL}/api/download/${item.id}`, {
+            headers: { "x-session-id": sessionId }
+        });
+        if (!res.ok) throw new Error("Download failed");
+
+        const blob = await res.blob();
+        const url = window.URL.createObjectURL(blob);
+        const a = document.createElement("a");
+        a.href = url;
+        a.download = item.filename;
+        document.body.appendChild(a);
+        a.click();
+        window.URL.revokeObjectURL(url);
+        document.body.removeChild(a);
+    } catch {
+        alert("Failed to download file");
+    }
 }
 
 export function DownloadItem({ item }: DownloadItemProps) {
-    const { sessionId } = useSession();
-    const [downloadError, setDownloadError] = useState<string | null>(null);
-    const [isSaving, setIsSaving] = useState(false);
-    const isCompleted = item.status === "completed";
-    const isError = item.status === "error";
-    const isQueued = item.status === "queued";
-
-    const statusBadgeClass = isCompleted
-        ? "border-emerald-400/20 bg-emerald-400/10 text-emerald-300"
-        : isError
-            ? "border-destructive/30 bg-destructive/10 text-destructive"
-            : isQueued
-                ? "border-amber-400/20 bg-amber-400/10 text-amber-300"
-                : "border-primary/20 bg-primary/10 text-primary";
-
-    const statusDetail = isCompleted
-        ? "File cached and ready to be saved locally."
-        : isError
-            ? "The transfer stopped before completion."
-            : isQueued
-                ? "Waiting for the server to start processing."
-                : "Receiving data from the source URL.";
-
-    const handleDownloadFile = async (): Promise<void> => {
-        try {
-            setDownloadError(null);
-            setIsSaving(true);
-            const response = await fetch(`${API_URL}/api/download/${item.id}`, {
-                headers: { "x-session-id": sessionId },
-            });
-
-            if (!response.ok) {
-                throw new Error("Failed to fetch the stored file.");
-            }
-
-            const blob = await response.blob();
-            const url = window.URL.createObjectURL(blob);
-            const anchor = document.createElement("a");
-            anchor.href = url;
-            anchor.download = item.filename;
-            document.body.appendChild(anchor);
-            anchor.click();
-            window.URL.revokeObjectURL(url);
-            document.body.removeChild(anchor);
-        } catch (error: unknown) {
-            setDownloadError(getDownloadErrorMessage(error));
-        } finally {
-            setIsSaving(false);
-        }
-    };
-
     return (
-        <Card className="group overflow-hidden border-border/80 bg-card/75 transition-all duration-200 hover:-translate-y-0.5 hover:border-primary/25 hover:bg-card/90">
-            <CardContent className="p-5">
-                <div className="flex flex-col gap-5">
-                    <div className="flex flex-col gap-4 lg:flex-row lg:items-start lg:justify-between">
-                        <div className="flex min-w-0 gap-4">
-                            <div className="mt-1">
-                                {isCompleted ? (
-                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-emerald-400/20 bg-emerald-400/10 text-emerald-300">
-                                        <FileCheck className="h-5 w-5" />
-                                    </div>
-                                ) : isError ? (
-                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-destructive/30 bg-destructive/10 text-destructive">
-                                        <FileWarning className="h-5 w-5" />
-                                    </div>
-                                ) : isQueued ? (
-                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-amber-400/20 bg-amber-400/10 text-amber-300">
-                                        <Server className="h-5 w-5" />
-                                    </div>
-                                ) : (
-                                    <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-primary/20 bg-primary/10 text-primary">
-                                        <Loader2 className="h-5 w-5 animate-spin" />
-                                    </div>
-                                )}
-                            </div>
-
-                            <div className="min-w-0 space-y-3">
-                                <div className="flex flex-wrap items-center gap-2">
-                                    <span className={`inline-flex rounded-full border px-3 py-1 text-[11px] font-semibold uppercase tracking-[0.2em] ${statusBadgeClass}`}>
-                                        {statusLabel[item.status]}
-                                    </span>
-                                    <span className="text-xs text-muted-foreground">
-                                        Created at {createdAtFormatter.format(item.createdAt)}
-                                    </span>
-                                </div>
-
-                                <div className="space-y-1">
-                                    <h3 className="truncate text-base font-semibold tracking-tight text-foreground" title={item.filename || item.url}>
-                                        {item.filename || item.url}
-                                    </h3>
-                                    <p className="truncate text-sm text-muted-foreground" title={item.url}>
-                                        {item.url}
-                                    </p>
-                                </div>
-                            </div>
-                        </div>
-
-                        {isCompleted ? (
-                            <Button size="sm" onClick={handleDownloadFile} disabled={isSaving} className="w-full gap-2 lg:w-auto lg:shrink-0">
-                                {isSaving ? <Loader2 className="h-4 w-4 animate-spin" /> : <HardDrive className="h-4 w-4" />}
-                                {isSaving ? "Saving..." : "Save file"}
-                            </Button>
-                        ) : null}
+        <Card className="overflow-hidden transition-all hover:bg-muted/50">
+            <CardContent className="p-4">
+                <div className="flex items-start gap-4">
+                    <div className="mt-1">
+                        <StatusIcon status={item.status} />
                     </div>
 
-                    <div className="grid gap-3 md:grid-cols-3">
-                        <div className="rounded-[1.25rem] border border-white/6 bg-background/35 p-4">
-                            <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
-                                Status
-                            </p>
-                            <p className="mt-2 text-sm font-medium text-foreground">{statusDetail}</p>
-                        </div>
-                        <div className="rounded-[1.25rem] border border-white/6 bg-background/35 p-4">
-                            <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
-                                Size
-                            </p>
-                            <p className="mt-2 text-sm font-medium text-foreground">
-                                {item.totalBytes ? formatBytes(item.totalBytes) : "Unknown until available"}
-                            </p>
-                        </div>
-                        <div className="rounded-[1.25rem] border border-white/6 bg-background/35 p-4">
-                            <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
-                                Throughput
-                            </p>
-                            <p className="mt-2 text-sm font-medium text-foreground">
-                                {item.speed ? formatSpeed(item.speed) : "Waiting for activity"}
-                            </p>
+                    <div className="flex-1 space-y-1 min-w-0">
+                        <div className="flex items-start justify-between gap-2">
+                            <div className="space-y-1 truncate">
+                                <h3 className="font-medium leading-none truncate" title={item.filename || item.url}>
+                                    {item.filename || item.url}
+                                </h3>
+                                <p className="text-xs text-muted-foreground truncate" title={item.url}>
+                                    {item.url}
+                                </p>
+                            </div>
+                            {item.status === "completed" && (
+                                <Button size="sm" onClick={() => saveToDisk(item)} className="shrink-0 gap-2">
+                                    <HardDrive className="w-4 h-4" />
+                                    Save to Disk
+                                </Button>
+                            )}
                         </div>
+
+                        <StatusDetails item={item} />
                     </div>
-
-                    {!isCompleted && !isError ? (
-                        <div className="rounded-[1.5rem] border border-white/6 bg-background/45 p-4">
-                            <div className="flex items-center justify-between text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
-                                <span>{isQueued ? "Waiting on server" : "Transfer progress"}</span>
-                                <span>{item.progress ? `${Math.round(item.progress)}%` : "0%"}</span>
-                            </div>
-                            <Progress
-                                value={item.progress || 0}
-                                className="mt-3"
-                                indicatorClassName={isQueued ? "opacity-60" : undefined}
-                            />
-                            <div className="mt-3 flex flex-col gap-2 text-sm text-muted-foreground sm:flex-row sm:items-center sm:justify-between">
-                                <span>
-                                    {formatBytes(item.receivedBytes || 0)} / {item.totalBytes ? formatBytes(item.totalBytes) : "Unknown"}
-                                </span>
-                                <span>{item.speed ? formatSpeed(item.speed) : "No transfer speed yet"}</span>
-                            </div>
-                        </div>
-                    ) : null}
-
-                    {isCompleted ? (
-                        <div className="rounded-[1.5rem] border border-emerald-400/20 bg-emerald-400/10 p-4 text-sm text-foreground">
-                            <p className="font-semibold text-emerald-300">Transfer completed successfully</p>
-                            <p className="mt-2 text-muted-foreground">
-                                The file is ready in the current session and can be saved to disk at any time before expiration.
-                            </p>
-                        </div>
-                    ) : null}
-
-                    {downloadError ? (
-                        <div className="rounded-[1.5rem] border border-destructive/30 bg-destructive/10 p-4 text-sm text-foreground">
-                            <p className="font-semibold text-destructive">Unable to save file</p>
-                            <p className="mt-2 text-muted-foreground">{downloadError}</p>
-                        </div>
-                    ) : null}
-
-                    {isError ? (
-                        <div className="rounded-[1.5rem] border border-destructive/30 bg-destructive/10 p-4 text-sm text-foreground">
-                            <p className="font-semibold text-destructive">Transfer failed</p>
-                            <p className="mt-2 text-muted-foreground">
-                                {item.error || "Unknown error occurred during the transfer."}
-                            </p>
-                        </div>
-                    ) : null}
                 </div>
             </CardContent>
         </Card>

web/src/components/feature/SessionTimer.tsx

@@ -12,9 +12,7 @@ export function SessionTimer({ expiresAt, className }: SessionTimerProps) {
     const [isCritical, setIsCritical] = useState(false);
 
     useEffect(() => {
-        if (!expiresAt) {
-            return;
-        }
+        if (!expiresAt) return;
 
         const tick = () => {
             const now = Date.now();
@@ -31,47 +29,20 @@ export function SessionTimer({ expiresAt, className }: SessionTimerProps) {
             const seconds = Math.floor((diff % 60000) / 1000);
 
             setTimeLeft(`${minutes.toString().padStart(2, "0")}:${seconds.toString().padStart(2, "0")}`);
-            setIsCritical(minutes < 5);
+            setIsCritical(minutes < 5); // Critical if less than 5 minutes
         };
 
-        tick();
+        tick(); // Initial call
         const interval = setInterval(tick, 1000);
         return () => clearInterval(interval);
     }, [expiresAt]);
 
-    if (!expiresAt) {
-        return null;
-    }
+    if (!expiresAt) return null;
 
     return (
-        <div
-            className={cn(
-                "inline-flex items-center justify-between gap-4 rounded-[1.5rem] border px-4 py-3 shadow-[0_20px_60px_-40px_rgba(15,23,42,0.95)] backdrop-blur-xl",
-                isCritical
-                    ? "border-destructive/30 bg-destructive/10"
-                    : "border-primary/20 bg-primary/10",
-                className
-            )}
-        >
-            <div className="flex items-center gap-3">
-                <div
-                    className={cn(
-                        "flex h-10 w-10 items-center justify-center rounded-[1rem] border",
-                        isCritical
-                            ? "border-destructive/30 bg-destructive/10 text-destructive"
-                            : "border-primary/20 bg-primary/10 text-primary"
-                    )}
-                >
-                    <Clock className="h-4 w-4" />
-                </div>
-                <div>
-                    <p className="text-[11px] font-semibold uppercase tracking-[0.22em] text-muted-foreground/75">
-                        Session window
-                    </p>
-                    <p className="mt-1 text-sm font-semibold text-foreground">Expires in {timeLeft}</p>
-                </div>
-            </div>
-            <span className="text-xs font-medium text-muted-foreground">Auto cleanup</span>
+        <div className={cn("flex items-center gap-2 text-sm font-medium", isCritical ? "text-destructive" : "text-muted-foreground", className)}>
+            <Clock className="w-4 h-4" />
+            <span>Session: {timeLeft}</span>
         </div>
     );
 }

web/src/components/ui/Alert.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
-import { cn } from "../../lib/utils";
+import * as React from "react"
+import { cn } from "../../lib/utils"
 
 const Alert = React.forwardRef<
     HTMLDivElement,
@@ -9,15 +9,15 @@ const Alert = React.forwardRef<
         ref={ref}
         role="alert"
         className={cn(
-            "relative w-full rounded-[1.5rem] border border-border/70 bg-card/70 p-5 text-foreground shadow-[0_24px_80px_-40px_rgba(15,23,42,0.9)] backdrop-blur-xl [&>svg~*]:pl-8 [&>svg+div]:translate-y-[-2px] [&>svg]:absolute [&>svg]:left-5 [&>svg]:top-5 [&>svg]:text-foreground",
+            "relative w-full rounded-lg border p-4 [&>svg~*]:pl-7 [&>svg+div]:translate-y-[-3px] [&>svg]:absolute [&>svg]:left-4 [&>svg]:top-4 [&>svg]:text-foreground",
             variant === "destructive" &&
-            "border-destructive/30 bg-destructive/10 text-destructive-foreground [&>svg]:text-destructive",
+            "border-destructive/50 text-destructive dark:border-destructive [&>svg]:text-destructive",
             className
         )}
         {...props}
     />
-));
-Alert.displayName = "Alert";
+))
+Alert.displayName = "Alert"
 
 const AlertTitle = React.forwardRef<
     HTMLParagraphElement,
@@ -25,11 +25,11 @@ const AlertTitle = React.forwardRef<
 >(({ className, ...props }, ref) => (
     <h5
         ref={ref}
-        className={cn("mb-1 font-semibold leading-none tracking-tight", className)}
+        className={cn("mb-1 font-medium leading-none tracking-tight", className)}
         {...props}
     />
-));
-AlertTitle.displayName = "AlertTitle";
+))
+AlertTitle.displayName = "AlertTitle"
 
 const AlertDescription = React.forwardRef<
     HTMLParagraphElement,
@@ -37,10 +37,10 @@ const AlertDescription = React.forwardRef<
 >(({ className, ...props }, ref) => (
     <div
         ref={ref}
-        className={cn("text-sm text-muted-foreground [&_p]:leading-relaxed", className)}
+        className={cn("text-sm [&_p]:leading-relaxed", className)}
         {...props}
     />
-));
-AlertDescription.displayName = "AlertDescription";
+))
+AlertDescription.displayName = "AlertDescription"
 
-export { Alert, AlertTitle, AlertDescription };
+export { Alert, AlertTitle, AlertDescription }

web/src/components/ui/Button.tsx

@@ -1,7 +1,8 @@
 import * as React from "react";
 import { cn } from "../../lib/utils";
 
-export interface ButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement> {
+export interface ButtonProps
+    extends React.ButtonHTMLAttributes<HTMLButtonElement> {
     variant?: "default" | "secondary" | "outline" | "ghost" | "destructive";
     size?: "default" | "sm" | "lg" | "icon";
 }
@@ -11,22 +12,21 @@ const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
         return (
             <button
                 className={cn(
-                    "inline-flex items-center justify-center whitespace-nowrap rounded-2xl border border-transparent text-sm font-semibold tracking-[-0.01em] text-foreground shadow-[0_18px_40px_-24px_rgba(15,23,42,0.9)] transition-all duration-200 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background disabled:pointer-events-none disabled:opacity-50",
+                    "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
                     {
-                        "bg-[linear-gradient(135deg,rgba(125,211,252,1),rgba(34,211,238,0.9))] text-slate-950 hover:brightness-105 hover:shadow-[0_22px_48px_-24px_rgba(34,211,238,0.6)]":
+                        "bg-primary text-primary-foreground hover:bg-primary/90":
                             variant === "default",
-                        "border-border/70 bg-secondary/80 text-secondary-foreground hover:bg-secondary":
+                        "bg-secondary text-secondary-foreground hover:bg-secondary/80":
                             variant === "secondary",
-                        "border-border/70 bg-background/60 text-foreground hover:bg-accent/70":
+                        "border border-input bg-background hover:bg-accent hover:text-accent-foreground":
                             variant === "outline",
-                        "border-transparent bg-transparent text-muted-foreground shadow-none hover:bg-accent/60 hover:text-foreground":
-                            variant === "ghost",
-                        "border-destructive/40 bg-destructive/90 text-destructive-foreground hover:bg-destructive":
+                        "hover:bg-accent hover:text-accent-foreground": variant === "ghost",
+                        "bg-destructive text-destructive-foreground hover:bg-destructive/90":
                             variant === "destructive",
-                        "h-11 px-5 py-2.5": size === "default",
-                        "h-10 rounded-xl px-4": size === "sm",
-                        "h-12 px-6 text-sm": size === "lg",
-                        "h-11 w-11 rounded-2xl": size === "icon",
+                        "h-10 px-4 py-2": size === "default",
+                        "h-9 rounded-md px-3": size === "sm",
+                        "h-11 rounded-md px-8": size === "lg",
+                        "h-10 w-10": size === "icon",
                     },
                     className
                 )}

web/src/components/ui/Card.tsx

@@ -8,7 +8,7 @@ const Card = React.forwardRef<
     <div
         ref={ref}
         className={cn(
-            "rounded-[1.75rem] border border-border/70 bg-card/80 text-card-foreground shadow-[0_24px_80px_-40px_rgba(15,23,42,0.95)] backdrop-blur-xl",
+            "rounded-lg border bg-card text-card-foreground shadow-sm",
             className
         )}
         {...props}
@@ -22,11 +22,11 @@ const CardHeader = React.forwardRef<
 >(({ className, ...props }, ref) => (
     <div
         ref={ref}
-        className={cn("flex flex-col space-y-2 p-6", className)}
+        className={cn("flex flex-col space-y-1.5 p-6", className)}
         {...props}
     />
 ));
-CardHeader.displayName = "CardHeader";
+Card.displayName = "CardHeader";
 
 const CardTitle = React.forwardRef<
     HTMLParagraphElement,

web/src/components/ui/Input.tsx

@@ -9,7 +9,7 @@ const Input = React.forwardRef<HTMLInputElement, InputProps>(
             <input
                 type={type}
                 className={cn(
-                    "flex h-12 w-full rounded-2xl border border-input/80 bg-background/70 px-4 py-3 text-sm text-foreground shadow-[inset_0_1px_0_rgba(255,255,255,0.03)] outline-none ring-offset-background transition-all placeholder:text-muted-foreground/80 focus-visible:border-primary/60 focus-visible:ring-4 focus-visible:ring-primary/15 disabled:cursor-not-allowed disabled:opacity-50",
+                    "flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
                     className
                 )}
                 ref={ref}

web/src/components/ui/Layout.tsx

@@ -7,48 +7,31 @@ type LayoutProps = {
 
 export function Layout({ children }: LayoutProps) {
     return (
-        <div className="relative min-h-screen overflow-hidden bg-background text-foreground selection:bg-primary/20 selection:text-foreground">
-            <div className="pointer-events-none absolute inset-0 -z-20 bg-[radial-gradient(circle_at_top,rgba(34,211,238,0.14),transparent_0_30%),linear-gradient(to_right,rgba(148,163,184,0.04)_1px,transparent_1px),linear-gradient(to_bottom,rgba(148,163,184,0.04)_1px,transparent_1px)] bg-[auto,72px_72px,72px_72px]" />
-            <div className="pointer-events-none absolute inset-x-0 top-[-120px] -z-10 mx-auto h-[360px] w-[min(760px,100%)] rounded-full bg-[radial-gradient(circle,rgba(56,189,248,0.18),transparent_65%)] blur-3xl" />
-            <div className="pointer-events-none absolute bottom-[-180px] right-[-80px] -z-10 h-[340px] w-[340px] rounded-full bg-[radial-gradient(circle,rgba(34,211,238,0.14),transparent_70%)] blur-3xl" />
+        <div className="min-h-screen bg-background text-foreground font-sans antialiased selection:bg-primary selection:text-primary-foreground">
+            <div className="absolute inset-0 -z-10 h-full w-full bg-background bg-[linear-gradient(to_right,#8080800a_1px,transparent_1px),linear-gradient(to_bottom,#8080800a_1px,transparent_1px)] bg-[size:14px_24px]"></div>
+            <div className="absolute left-0 right-0 top-0 -z-10 m-auto h-[310px] w-[310px] rounded-full bg-primary/20 opacity-20 blur-[100px]"></div>
 
-            <header className="sticky top-0 z-50 border-b border-white/6 bg-[rgba(8,13,22,0.78)] backdrop-blur-2xl">
-                <div className="mx-auto flex h-20 w-full max-w-[1400px] items-center justify-between px-4 md:px-8">
-                    <div className="flex items-center gap-4">
-                        <div className="flex h-12 w-12 items-center justify-center rounded-[1.25rem] border border-primary/20 bg-primary/10 text-primary shadow-[0_18px_48px_-28px_rgba(34,211,238,0.8)]">
-                            <MoveDown className="h-5 w-5" />
-                        </div>
-                        <div>
-                            <p className="text-[11px] font-semibold uppercase tracking-[0.28em] text-primary/80">
-                                Downloader
-                            </p>
-                            <div className="mt-1 flex flex-wrap items-center gap-3">
-                                <span className="text-sm font-semibold text-foreground md:text-base">
-                                    Ephemeral transfer console
-                                </span>
-                                <span className="hidden text-sm text-muted-foreground md:inline">
-                                    Download workflow with session-bound storage
-                                </span>
-                            </div>
+            <header className="sticky top-0 z-50 w-full border-b border-border/40 bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
+                <div className="container flex h-14 max-w-screen-2xl items-center px-4 md:px-8">
+                    <div className="mr-4 flex items-center space-x-2">
+                        <div className="flex aspect-square size-8 items-center justify-center rounded-lg bg-primary text-primary-foreground">
+                            <MoveDown className="size-5" />
                         </div>
+                        <span className="hidden font-bold sm:inline-block">
+                            Ephemeral Downloader
+                        </span>
                     </div>
-
-                    <div className="hidden items-center gap-3 md:flex">
-                        <div className="rounded-full border border-white/6 bg-white/4 px-4 py-2 text-right">
-                            <p className="text-[11px] font-semibold uppercase tracking-[0.2em] text-muted-foreground">
-                                Environment
-                            </p>
-                            <p className="mt-1 text-sm font-medium text-foreground">Production-ready shell</p>
-                        </div>
-                        <div className="inline-flex items-center gap-2 rounded-full border border-primary/20 bg-primary/10 px-4 py-2 text-sm font-medium text-primary">
-                            <Server className="h-4 w-4" />
-                            <span>Proxy active</span>
-                        </div>
+                    <div className="flex flex-1 items-center justify-end space-x-2 md:justify-end">
+                        <nav className="flex items-center space-x-2 text-sm font-medium text-muted-foreground">
+                            <div className="flex items-center gap-2 rounded-full border border-border bg-secondary/50 px-3 py-1 text-xs">
+                                <Server className="size-3" />
+                                <span>VPS Proxy Active</span>
+                            </div>
+                        </nav>
                     </div>
                 </div>
             </header>
-
-            <main className="relative mx-auto w-full max-w-[1400px] px-4 pb-10 pt-8 md:px-8 md:pb-16 md:pt-10">
+            <main className="container max-w-screen-xl py-6 md:py-10 px-4 md:px-8">
                 {children}
             </main>
         </div>

web/src/components/ui/ProgressBar.tsx

@@ -14,15 +14,19 @@ const Progress = React.forwardRef<HTMLDivElement, ProgressProps>(
         return (
             <div
                 ref={ref}
+                role="progressbar"
+                aria-valuemin={0}
+                aria-valuemax={max}
+                aria-valuenow={percent}
                 className={cn(
-                    "relative h-2.5 w-full overflow-hidden rounded-full bg-white/6",
+                    "relative h-2 w-full overflow-hidden rounded-full bg-secondary",
                     className
                 )}
                 {...props}
             >
                 <div
                     className={cn(
-                        "h-full w-full flex-1 rounded-full bg-[linear-gradient(90deg,rgba(125,211,252,0.95),rgba(34,211,238,0.95))] transition-all duration-300 ease-out",
+                        "h-full w-full flex-1 bg-primary transition-all duration-200 ease-in-out",
                         indicatorClassName
                     )}
                     style={{ transform: `translateX(-${100 - (percent / max) * 100}%)` }}

web/src/components/ui/Textarea.tsx

@@ -1,22 +0,0 @@
-import * as React from "react";
-import { cn } from "../../lib/utils";
-
-export type TextareaProps = React.TextareaHTMLAttributes<HTMLTextAreaElement>;
-
-const Textarea = React.forwardRef<HTMLTextAreaElement, TextareaProps>(
-    ({ className, ...props }, ref) => {
-        return (
-            <textarea
-                className={cn(
-                    "flex min-h-[120px] w-full rounded-2xl border border-input/80 bg-background/70 px-4 py-3 text-sm text-foreground shadow-[inset_0_1px_0_rgba(255,255,255,0.03)] outline-none ring-offset-background transition-all placeholder:text-muted-foreground/80 focus-visible:border-primary/60 focus-visible:ring-4 focus-visible:ring-primary/15 disabled:cursor-not-allowed disabled:opacity-50",
-                    className
-                )}
-                ref={ref}
-                {...props}
-            />
-        );
-    }
-);
-Textarea.displayName = "Textarea";
-
-export { Textarea };

web/src/context/SessionContext.tsx

@@ -1,5 +1,34 @@
-import React, { useCallback, useEffect, useState } from "react";
-import { DownloadTask, SessionContext, SessionData } from "./session-context";
+import React, { createContext, useCallback, useContext, useEffect, useState } from "react";
+
+type SessionData = {
+    sessionId: string;
+    expiresAt: string;
+    remainingMs: number;
+};
+
+type DownloadTask = {
+    id: string;
+    sessionId: string;
+    url: string;
+    filename: string;
+    status: "queued" | "downloading" | "completed" | "error";
+    progress: number;
+    totalBytes: number;
+    receivedBytes: number;
+    speed: number;
+    error?: string;
+    createdAt: number;
+};
+
+type SessionContextType = {
+    sessionId: string;
+    tasks: DownloadTask[];
+    expiresAt: string | null;
+    queueDownload: (url: string) => Promise<void>;
+    refreshTasks: () => void;
+};
+
+const SessionContext = createContext<SessionContextType | null>(null);
 
 const API_URL = import.meta.env.VITE_API_URL || "";
 
@@ -10,106 +39,86 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
     const [tasks, setTasks] = useState<DownloadTask[]>([]);
     const [expiresAt, setExpiresAt] = useState<string | null>(null);
 
+    // Initialize Session
     useEffect(() => {
         const initSession = async () => {
             try {
                 const headers: Record<string, string> = {};
-                if (sessionId) {
-                    headers["x-session-id"] = sessionId;
-                }
+                if (sessionId) headers["x-session-id"] = sessionId;
 
-                const response = await fetch(`${API_URL}/api/session`, { headers });
-                if (!response.ok) {
-                    throw new Error("Failed to initialize session.");
-                }
-
-                const data = (await response.json()) as SessionData;
+                const res = await fetch(`${API_URL}/api/session`, { headers });
+                const data = (await res.json()) as SessionData;
 
                 if (data.sessionId && data.sessionId !== sessionId) {
                     setSessionId(data.sessionId);
                     localStorage.setItem("downloader_session_id", data.sessionId);
                 }
                 setExpiresAt(data.expiresAt);
-            } catch {
-                setExpiresAt(null);
+            } catch (err) {
+                console.error("Failed to init session", err);
             }
         };
 
-        void initSession();
+        initSession();
     }, [sessionId]);
 
-    const refreshTasks = useCallback(async (): Promise<void> => {
-        if (!sessionId) {
-            return;
-        }
-
+    // Poll Tasks
+    const refreshTasks = useCallback(async () => {
+        if (!sessionId) return;
         try {
-            const response = await fetch(`${API_URL}/api/tasks`, {
+            const res = await fetch(`${API_URL}/api/tasks`, {
                 headers: { "x-session-id": sessionId },
             });
-
-            if (!response.ok) {
-                throw new Error("Failed to fetch tasks.");
+            if (res.ok) {
+                const data = await res.json();
+                setTasks(data);
             }
-
-            const data = (await response.json()) as DownloadTask[];
-            setTasks(data);
-        } catch {
-            return;
+        } catch (err) {
+            console.error("Failed to fetch tasks", err);
         }
     }, [sessionId]);
 
     useEffect(() => {
-        if (!sessionId) {
-            return;
-        }
+        if (!sessionId) return;
 
-        const syncTasks = async (): Promise<void> => {
-            await refreshTasks();
-        };
-
-        void syncTasks();
-
-        const interval = setInterval(() => {
-            void refreshTasks();
-        }, 2000);
+        // Initial fetch
+        refreshTasks();
 
+        // Poll every 2 seconds
+        const interval = setInterval(refreshTasks, 2000);
         return () => clearInterval(interval);
-    }, [refreshTasks, sessionId]);
-
-    const queueDownload = async (url: string): Promise<void> => {
-        if (!sessionId) {
-            throw new Error("Session is still initializing. Try again in a moment.");
-        }
-
-        const response = await fetch(`${API_URL}/api/queue`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "x-session-id": sessionId,
-            },
-            body: JSON.stringify({ url }),
-        });
-
-        if (!response.ok) {
-            throw new Error("Failed to queue download.");
-        }
-
-        await refreshTasks();
+    }, [sessionId, refreshTasks]);
 
+    const queueDownload = async (url: string) => {
+        if (!sessionId) throw new Error("Session not ready, try again in a moment");
         try {
-            const sessionResponse = await fetch(`${API_URL}/api/session`, {
-                headers: { "x-session-id": sessionId },
+            const res = await fetch(`${API_URL}/api/queue`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-session-id": sessionId,
+                },
+                body: JSON.stringify({ url }),
             });
 
-            if (!sessionResponse.ok) {
-                return;
+            if (!res.ok) {
+                const body = (await res.json().catch(() => null)) as { error?: string } | null;
+                throw new Error(body?.error || "Failed to queue download");
             }
 
-            const sessionData = (await sessionResponse.json()) as SessionData;
+            await refreshTasks(); // Immediate refresh
+
+            // Update expiration from action
+            // Ideally we should re-fetch /api/session here too, or just rely on the side-effect
+            const sessionRes = await fetch(`${API_URL}/api/session`, {
+                headers: { "x-session-id": sessionId }
+            });
+            const sessionData = await sessionRes.json();
             setExpiresAt(sessionData.expiresAt);
-        } catch {
-            return;
+
+        } catch (err) {
+            console.error(err);
+            throw err;
         }
     };
 
@@ -119,3 +128,12 @@ export function SessionProvider({ children }: { children: React.ReactNode }) {
         </SessionContext.Provider>
     );
 }
+
+// O hook é exportado junto do provider de propósito: o arquivo é o módulo do
+// contexto da sessão. A regra abaixo só afeta o Fast Refresh em desenvolvimento.
+// eslint-disable-next-line react-refresh/only-export-components
+export function useSession() {
+    const context = useContext(SessionContext);
+    if (!context) throw new Error("useSession must be used within SessionProvider");
+    return context;
+}

web/src/context/session-context.ts

@@ -1,43 +0,0 @@
-import { createContext, useContext } from "react";
-
-export type SessionData = {
-    sessionId: string;
-    expiresAt: string;
-    remainingMs: number;
-};
-
-export type DownloadStatus = "queued" | "downloading" | "completed" | "error";
-
-export type DownloadTask = {
-    id: string;
-    sessionId: string;
-    url: string;
-    filename: string;
-    status: DownloadStatus;
-    progress: number;
-    totalBytes: number;
-    receivedBytes: number;
-    speed: number;
-    error?: string;
-    createdAt: number;
-};
-
-export type SessionContextType = {
-    sessionId: string;
-    tasks: DownloadTask[];
-    expiresAt: string | null;
-    queueDownload: (url: string) => Promise<void>;
-    refreshTasks: () => Promise<void>;
-};
-
-export const SessionContext = createContext<SessionContextType | null>(null);
-
-export function useSession(): SessionContextType {
-    const context = useContext(SessionContext);
-
-    if (!context) {
-        throw new Error("useSession must be used within SessionProvider");
-    }
-
-    return context;
-}

web/src/index.css

@@ -4,9 +4,6 @@
   --color-background: hsl(var(--background));
   --color-foreground: hsl(var(--foreground));
 
-  --color-card: hsl(var(--card));
-  --color-card-foreground: hsl(var(--card-foreground));
-
   --color-primary: hsl(var(--primary));
   --color-primary-foreground: hsl(var(--primary-foreground));
 
@@ -27,94 +24,42 @@
   --color-ring: hsl(var(--ring));
 
   --radius-lg: var(--radius);
-  --radius-md: calc(var(--radius) - 4px);
-  --radius-sm: calc(var(--radius) - 8px);
+  --radius-md: calc(var(--radius) - 2px);
+  --radius-sm: calc(var(--radius) - 4px);
 }
 
 @layer base {
   :root {
-    --background: 222 36% 8%;
-    --foreground: 210 40% 96%;
+    --background: 222.2 84% 4.9%;
+    --foreground: 210 40% 98%;
 
-    --card: 222 31% 12%;
-    --card-foreground: 210 40% 96%;
+    --primary: 210 40% 98%;
+    --primary-foreground: 222.2 47.4% 11.2%;
 
-    --primary: 191 95% 67%;
-    --primary-foreground: 222 47% 11%;
+    --secondary: 217.2 32.6% 17.5%;
+    --secondary-foreground: 210 40% 98%;
 
-    --secondary: 223 24% 18%;
-    --secondary-foreground: 210 40% 96%;
+    --muted: 217.2 32.6% 17.5%;
+    --muted-foreground: 215 20.2% 65.1%;
 
-    --muted: 223 19% 22%;
-    --muted-foreground: 214 18% 70%;
+    --accent: 217.2 32.6% 17.5%;
+    --accent-foreground: 210 40% 98%;
 
-    --accent: 222 24% 17%;
-    --accent-foreground: 210 40% 96%;
+    --destructive: 0 72% 54%;
+    --destructive-foreground: 210 40% 98%;
 
-    --destructive: 0 72% 56%;
-    --destructive-foreground: 0 0% 100%;
+    --border: 217.2 32.6% 17.5%;
+    --input: 217.2 32.6% 17.5%;
+    --ring: 212.7 26.8% 83.9%;
 
-    --border: 223 17% 22%;
-    --input: 223 17% 22%;
-    --ring: 191 95% 67%;
-
-    --radius: 1.5rem;
+    --radius: 0.5rem;
   }
 
   * {
     @apply border-border;
   }
 
-  html {
-    color-scheme: dark;
-  }
-
   body {
-    @apply min-h-screen bg-background text-foreground antialiased;
-    font-family:
-      Inter,
-      ui-sans-serif,
-      system-ui,
-      -apple-system,
-      BlinkMacSystemFont,
-      "Segoe UI",
-      sans-serif;
-    background-image:
-      radial-gradient(circle at top, rgba(56, 189, 248, 0.12), transparent 0 32%),
-      radial-gradient(circle at 80% 18%, rgba(14, 165, 233, 0.08), transparent 0 22%),
-      linear-gradient(180deg, rgba(255, 255, 255, 0.02), transparent 28%),
-      linear-gradient(135deg, #080d16 0%, #0d1320 52%, #090d16 100%);
+    @apply bg-background text-foreground;
   }
-
-  #root {
-    min-height: 100vh;
-  }
-
-  ::selection {
-    background: hsl(var(--primary) / 0.25);
-    color: hsl(var(--foreground));
-  }
-
-  ::-webkit-scrollbar {
-    width: 10px;
-    height: 10px;
-  }
-
-  ::-webkit-scrollbar-track {
-    background: rgba(15, 23, 42, 0.35);
-  }
-
-  ::-webkit-scrollbar-thumb {
-    background: rgba(148, 163, 184, 0.22);
-    border-radius: 999px;
-    border: 2px solid transparent;
-    background-clip: padding-box;
-  }
-
-  ::-webkit-scrollbar-thumb:hover {
-    background: rgba(148, 163, 184, 0.32);
-    border-radius: 999px;
-    border: 2px solid transparent;
-    background-clip: padding-box;
-  }
-}
+}

web/vite.config.ts

@@ -4,4 +4,16 @@ import react from '@vitejs/plugin-react'
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [react()],
+  server: {
+    // O frontend chama a API na mesma origem (URL relativa). Em produção quem
+    // serve o build é o próprio Fastify; em desenvolvimento este proxy encaminha
+    // /api para o backend. Ajuste o alvo com VITE_API_PROXY se o backend não
+    // estiver na porta padrão (3000).
+    proxy: {
+      '/api': {
+        target: process.env.VITE_API_PROXY ?? 'http://localhost:3000',
+        changeOrigin: true,
+      },
+    },
+  },
 })