From 9126b3bbe1c06cfa131ed90ad295a3890d16e523 Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 02:16:54 -0300
Subject: [PATCH 01/12] =?UTF-8?q?perf:=20connection=5Flimit=20para=20ambie?=
 =?UTF-8?q?nte=20dev=20e=20corre=C3=A7=C3=A3o=20de=20cache?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- LOG_QUERIES=1 acrescenta "query" ao log do PrismaClient
- LOG_HTTP=1 loga "método caminho status duração_ms" por request via
  middleware em server/index.ts
- compression() registrado antes das rotas: gzip/brotli nas respostas
  (bundle JS/CSS e JSON grandes) — cada KB ajuda na viagem até o navegador
- index.html passa a ir com Cache-Control: no-cache (revalida a cada
  load para pegar deploy novo); assets com hash continuam immutable
- correção incidental: sendFile(path.join(...)) falhava com 404 quando
  o diretório do projeto tem algum segmento começando com "." (o
  módulo `send` aplica o check de dotfile no path absoluto inteiro);
  trocado para sendFile("index.html", { root: clientDist }), que checa
  só o path relativo ao root
- connection_limit do Prisma configurável via DB_CONNECTION_LIMIT, com
  padrão 10 em produção e 2 fora dela: o pooler do Supabase em modo
  sessão limita a 15 clientes no total, e um `npm run dev` local com 10
  conexões disputava slots com o container em produção (EMAXCONNSESSION)
- adiciona compression e @types/compression
---
 .env.example                |   5 +-
 .gitignore                  |   3 ++
 package-lock.json           | 101 ++++++++++++++++++++++++++++++++----
 package.json                |   2 +
 server/index.ts             |  25 ++++++++-
 server/lib/prisma.server.ts |  19 +++++--
 6 files changed, 138 insertions(+), 17 deletions(-)

diff --git a/.env.example b/.env.example
index d0e28d9..e28cc4f 100644
--- a/.env.example
+++ b/.env.example
@@ -3,4 +3,7 @@ DIRECT_URL="postgresql://postgres:password@db.supabase.co:5432/postgres"
 VITE_SUPABASE_URL="https://your-project.supabase.co"
 VITE_SUPABASE_ANON_KEY="your-anon-key"
 SUPABASE_SERVICE_ROLE_KEY="your-service-role-key"
-SESSION_SECRET="sua-chave-secreta" 
\ No newline at end of file
+SESSION_SECRET="sua-chave-secreta" 
+# Opcional: conexões do pool do Prisma por processo (padrão: 10 em produção, 2 fora dela).
+# O pooler do Supabase em modo sessão aceita 15 clientes no total.
+# DB_CONNECTION_LIMIT=2
diff --git a/.gitignore b/.gitignore
index 60903a6..b9a7a6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,6 @@ yarn-error.log*
 *.swp
 *.swo
 localhost.har
+
+# Specs e rascunhos locais
+.tmp/
diff --git a/package-lock.json b/package-lock.json
index 89ae33d..839cb21 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,9 @@
         "@supabase/ssr": "^0.12.0",
         "@supabase/supabase-js": "^2.110.0",
         "@tanstack/react-query": "^5.102.8",
+        "@types/compression": "^1.8.1",
         "clsx": "2.1.1",
+        "compression": "^1.8.2",
         "dotenv": "^17.4.2",
         "express": "^5.2.1",
         "lucide-react": "0.473.0",
@@ -1436,18 +1438,26 @@
       "version": "1.19.6",
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
       "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/connect": "*",
         "@types/node": "*"
       }
     },
+    "node_modules/@types/compression": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/@types/compression/-/compression-1.8.1.tgz",
+      "integrity": "sha512-kCFuWS0ebDbmxs0AXYn6e2r2nrGAb5KwQhknjSPSPgJcGd8+HVSILlUyFhGqML2gk39HcG7D1ydW9/qpYkN00Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/express": "*",
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/connect": {
       "version": "3.4.38",
       "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
       "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1462,7 +1472,6 @@
       "version": "5.0.6",
       "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.6.tgz",
       "integrity": "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/body-parser": "*",
@@ -1474,7 +1483,6 @@
       "version": "5.1.3",
       "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.3.tgz",
       "integrity": "sha512-dPfW8NFiOF4wOHc7+N/QSxlY9cfSsenewGbAz8C8U/MULPd/YZ27LvJUIlzaXie7e6Ove9YunJGgC9tbHD2cKw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -1487,7 +1495,6 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
       "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/multer": {
@@ -1504,7 +1511,6 @@
       "version": "22.13.0",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.13.0.tgz",
       "integrity": "sha512-ClIbNe36lawluuvq3+YYhnIN2CELi+6q8NpnM7PYp4hBn/TatfboPgVSm2rwKRfnV2M+Ty9GWDFI64KEe+kysA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~6.20.0"
@@ -1514,14 +1520,12 @@
       "version": "6.15.1",
       "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz",
       "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
       "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/react": {
@@ -1544,7 +1548,6 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
       "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -1554,7 +1557,6 @@
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-2.2.0.tgz",
       "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/http-errors": "*",
@@ -1979,6 +1981,56 @@
         "node": ">= 6"
       }
     },
+    "node_modules/compressible": {
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
+      "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": ">= 1.43.0 < 2"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/compression": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz",
+      "integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "3.1.2",
+        "compressible": "~2.0.18",
+        "debug": "2.6.9",
+        "destroy": "1.2.0",
+        "negotiator": "~0.6.4",
+        "on-headers": "~1.1.0",
+        "safe-buffer": "5.2.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/compression/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/compression/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
     "node_modules/concat-stream": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-2.0.0.tgz",
@@ -2112,6 +2164,16 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
     "node_modules/didyoumean": {
       "version": "1.2.2",
       "dev": true,
@@ -2906,6 +2968,15 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
+    "node_modules/negotiator": {
+      "version": "0.6.4",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
+      "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/node-releases": {
       "version": "2.0.37",
       "dev": true,
@@ -2963,6 +3034,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/on-headers": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
+      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/once": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
@@ -4449,7 +4529,6 @@
       "version": "6.20.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
       "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/unpipe": {
diff --git a/package.json b/package.json
index a7a28a0..0b9139f 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,9 @@
     "@supabase/ssr": "^0.12.0",
     "@supabase/supabase-js": "^2.110.0",
     "@tanstack/react-query": "^5.102.8",
+    "@types/compression": "^1.8.1",
     "clsx": "2.1.1",
+    "compression": "^1.8.2",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
     "lucide-react": "0.473.0",
diff --git a/server/index.ts b/server/index.ts
index df29c81..0eb9348 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -1,5 +1,6 @@
 import "dotenv/config";
 import express from "express";
+import compression from "compression";
 import path from "node:path";
 import fs from "node:fs";
 import { requireUser, requireAdmin, type AuthedResponse } from "./middlewares/auth";
@@ -19,6 +20,23 @@ const clientDist = path.resolve(process.cwd(), "dist/client");
 
 const app = express();
 app.disable("x-powered-by");
+
+//LOG_HTTP=1 registra método, caminho, status e duração de cada request — sem
+//a env, nenhum middleware extra é adicionado.
+if (process.env.LOG_HTTP === "1") {
+  app.use((req, res, next) => {
+    const inicio = Date.now();
+    res.on("finish", () => {
+      console.log(`${req.method} ${req.path} ${res.statusCode} ${Date.now() - inicio}ms`);
+    });
+    next();
+  });
+}
+
+//Gzip/brotli nas respostas — a VPS fica na Europa, então cada KB a menos
+//conta na viagem até o navegador (BR).
+app.use(compression());
+
 app.use(express.json({ limit: "2mb" }));
 
 const api = express.Router();
@@ -49,7 +67,12 @@ if (process.env.NODE_ENV === "production" && fs.existsSync(clientDist)) {
   );
   app.use((req, res, next) => {
     if (req.method === "GET" && !req.path.startsWith("/api")) {
-      res.sendFile(path.join(clientDist, "index.html"));
+      // index.html não tem hash no nome: precisa revalidar a cada load para
+      // pegar o novo deploy (os assets com hash é que ficam "immutable").
+      // { root } em vez de path.join: sendFile aplica o check de dotfile no
+      // path absoluto inteiro, e falha se algum diretório pai começar com "."
+      res.setHeader("Cache-Control", "no-cache");
+      res.sendFile("index.html", { root: clientDist });
       return;
     }
     next();
diff --git a/server/lib/prisma.server.ts b/server/lib/prisma.server.ts
index 87098f5..c3d3559 100644
--- a/server/lib/prisma.server.ts
+++ b/server/lib/prisma.server.ts
@@ -9,9 +9,15 @@ function buildDatasourceUrl(): string | undefined {
   if (!base) return undefined;
   try {
     const url = new URL(base);
-    // Cap no pool para não esgotar o pooler do Supabase e timeout para não
-    // deixar request travado esperando conexão (o gargalo é latência EU).
-    url.searchParams.set("connection_limit", "10");
+    //Cap no pool: o pooler do Supabase em modo sessão limita o total de clientes
+    //(15 no plano atual) e cada processo segura `connection_limit` conexões.
+    //Produção fica com 10; fora dela o padrão é 2, para um `npm run dev` local
+    //não disputar slots com o container em produção. DB_CONNECTION_LIMIT
+    //sobrescreve. pool_timeout evita request travado esperando conexão (a VPS
+    //fica na EU e o banco no BR, então cada ida ao banco já custa ~200 ms).
+    const connectionLimit =
+      process.env.DB_CONNECTION_LIMIT || (process.env.NODE_ENV === "production" ? "10" : "2");
+    url.searchParams.set("connection_limit", connectionLimit);
     url.searchParams.set("pool_timeout", "20");
     return url.toString();
   } catch {
@@ -19,8 +25,13 @@ function buildDatasourceUrl(): string | undefined {
   }
 }
 
+//LOG_QUERIES=1 acrescenta "query" ao log do Prisma — útil para contar viagens
+//de rede ao banco sem mexer em nada quando a env não está setada.
+const logLevels: ("query" | "warn" | "error")[] =
+  process.env.LOG_QUERIES === "1" ? ["query", "warn", "error"] : ["warn", "error"];
+
 const prisma = global.__prisma ?? new PrismaClient({
-  log: ["warn", "error"],
+  log: logLevels,
   datasourceUrl: buildDatasourceUrl(),
 });
 

From c579663fa51f13ea9d2da367fb73550c4c579c64 Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 07:02:51 -0300
Subject: [PATCH 02/12] =?UTF-8?q?perf:=20abrir=20pastas=20fica=20mais=20r?=
 =?UTF-8?q?=C3=A1pido=20e=20sem=20requests=20perdidas=20no=20boot=20e=20no?=
 =?UTF-8?q?=20hover?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- login e recarregar a página passam a usar só a request de boot (/init) para
  saber quem é o usuário, eliminando uma chamada extra só para isso
- abrir uma pasta ou trocar de pasta dispara a busca na hora; o atraso de
  digitação só entra quando o usuário está de fato digitando num filtro, e
  uma busca em andamento é cancelada se a tela mudar antes dela terminar
- corrigido o cache do "pré-carregamento" ao passar o mouse pelas pastas na
  barra lateral: a chave usada para guardar o resultado agora é a mesma usada
  ao abrir a pasta, então o hover realmente evita a busca repetida; o
  pré-carregamento só dispara depois de um instante parado sobre a pasta e é
  cancelado se o mouse sair antes disso
- pastas passam a ser identificadas pelo nome (já único) tanto ao carregar a
  grade quanto ao mover/excluir em lote, permitindo abrir a grade de uma
  pasta em paralelo com o carregamento da barra lateral em vez de esperar por
  ela; a API continua aceitando o identificador antigo e devolve erro claro
  para um nome de pasta inexistente
---
 app/components/Sidebar.tsx                    |   4 +-
 app/components/SidebarFolderItem.tsx          |   5 +-
 app/context/AuthContext.tsx                   |  11 +-
 app/hooks/useOperacoesGridData.ts             | 125 ++++++++++++++----
 app/lib/query.ts                              |   6 +-
 app/pages/OperacoesPage.tsx                   |  21 ++-
 app/views/OperacoesView.tsx                   |  13 +-
 .../services/operacao-query-builder.server.ts |  18 ++-
 server/services/operacao.server.ts            |   5 +-
 9 files changed, 154 insertions(+), 54 deletions(-)

diff --git a/app/components/Sidebar.tsx b/app/components/Sidebar.tsx
index 9261a47..834b223 100644
--- a/app/components/Sidebar.tsx
+++ b/app/components/Sidebar.tsx
@@ -5,7 +5,7 @@ import { useIsFetching } from "@tanstack/react-query";
 import { buscarNomeUsuario } from "~/utils/formatters";
 import { api, errorMessage } from "~/lib/api";
 import { queryClient, queryKeys, useFaturistas } from "~/lib/query";
-import { prefetchOperacoes } from "~/hooks/useOperacoesGridData";
+import { prefetchOperacoes, cancelPrefetch } from "~/hooks/useOperacoesGridData";
 import { useUI } from "~/hooks/use-ui";
 import { COLOR_NAMES, PRESET_COLORS, SidebarFolderItem } from "./SidebarFolderItem";
 
@@ -108,7 +108,7 @@ export const Sidebar = React.memo(({
               )}
             </NavLink>
 
-            <NavLink to="/caixa-de-entrada" onMouseEnter={() => prefetchOperacoes(null)} title={emissaoAntigasPorPasta.inbox ? `${emissaoAntigasPorPasta.inbox} emissão(ões) antiga(s) na Caixa de Entrada` : undefined} className={({ isActive }) => `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${isActive ? 'text-primary bg-primary/10 dark:bg-transparent before:absolute before:-left-2 before:top-1/2 before:-translate-y-1/2 before:w-1 before:h-5 before:bg-primary before:rounded-r' : 'text-text-muted hover:text-text hover:bg-surface-light'}`}>
+            <NavLink to="/caixa-de-entrada" onMouseEnter={() => prefetchOperacoes({ pastaId: null })} onMouseLeave={cancelPrefetch} title={emissaoAntigasPorPasta.inbox ? `${emissaoAntigasPorPasta.inbox} emissão(ões) antiga(s) na Caixa de Entrada` : undefined} className={({ isActive }) => `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${isActive ? 'text-primary bg-primary/10 dark:bg-transparent before:absolute before:-left-2 before:top-1/2 before:-translate-y-1/2 before:w-1 before:h-5 before:bg-primary before:rounded-r' : 'text-text-muted hover:text-text hover:bg-surface-light'}`}>
               {({ isActive }) => (
                 <>
                   <div className="flex items-center gap-2.5">
diff --git a/app/components/SidebarFolderItem.tsx b/app/components/SidebarFolderItem.tsx
index bbf56f8..996a5a0 100644
--- a/app/components/SidebarFolderItem.tsx
+++ b/app/components/SidebarFolderItem.tsx
@@ -4,7 +4,7 @@ import { NavLink } from "react-router";
 import { useUI } from "~/hooks/use-ui";
 import { api, errorMessage } from "~/lib/api";
 import { queryClient, queryKeys, useFaturistas } from "~/lib/query";
-import { prefetchOperacoes } from "~/hooks/useOperacoesGridData";
+import { prefetchOperacoes, cancelPrefetch } from "~/hooks/useOperacoesGridData";
 
 export const PRESET_COLORS = ["#64748b", "#3b82f6", "#10b981", "#f59e0b", "#ef4444", "#8b5cf6", "#ec4899"];
 
@@ -149,7 +149,8 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
     <div className={`relative group/item ${isPending ? 'opacity-50 pointer-events-none' : ''}`}>
       <NavLink
         to={`/pastas/${encodeURIComponent(folder.nome)}`}
-        onMouseEnter={() => prefetchOperacoes(folder.id)}
+        onMouseEnter={() => prefetchOperacoes({ pastaId: null, pastaNome: folder.nome })}
+        onMouseLeave={cancelPrefetch}
         className={({ isActive }) =>
           `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${
             isActive
diff --git a/app/context/AuthContext.tsx b/app/context/AuthContext.tsx
index 8c0773e..a366079 100644
--- a/app/context/AuthContext.tsx
+++ b/app/context/AuthContext.tsx
@@ -1,7 +1,7 @@
 import { createContext, useCallback, useContext, useEffect, useMemo, useState } from "react";
 import { useNavigate } from "react-router";
 import { api } from "~/lib/api";
-import { queryClient, queryKeys } from "~/lib/query";
+import { queryClient, queryKeys, fetchInit } from "~/lib/query";
 
 type AuthContextType = {
   user: any | null;
@@ -19,8 +19,10 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
   useEffect(() => {
     let alive = true;
-    api
-      .get<{ user: any }>("/auth/me")
+    // Boot com uma única request: /init já traz o usuário (sem /auth/me à parte).
+    // retry: false — deslogado, /init dá 401 e não adianta tentar de novo.
+    queryClient
+      .fetchQuery({ queryKey: queryKeys.init, queryFn: fetchInit, staleTime: 60_000, retry: false })
       .then((d) => {
         if (alive) setUser(d.user);
       })
@@ -45,9 +47,8 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   const signIn = useCallback(
     async (email: string, password: string, redirectTo = "/caixa-de-entrada") => {
       await api.post("/auth/login", { email, password });
-      const d = await api.get<{ user: any }>("/auth/me");
+      const d = await queryClient.fetchQuery({ queryKey: queryKeys.init, queryFn: fetchInit, staleTime: 60_000, retry: false });
       setUser(d.user);
-      queryClient.invalidateQueries({ queryKey: queryKeys.init });
       navigate(redirectTo, { replace: true });
     },
     [navigate]
diff --git a/app/hooks/useOperacoesGridData.ts b/app/hooks/useOperacoesGridData.ts
index dbccb24..103f7b7 100644
--- a/app/hooks/useOperacoesGridData.ts
+++ b/app/hooks/useOperacoesGridData.ts
@@ -43,46 +43,100 @@ export interface GridMeta {
 
 const EMPTY_META: GridMeta = { total: 0, totalVl: 0, page: 0, limit: 200, totalPages: 0 };
 
+// Chave de filtros/ordenação: mesma função usada pelo hook (com o estado
+// atual) e pelo prefetch (sem filtros), para as duas baterem no mesmo cache —
+// era aqui que o bug antigo estava (prefetch usava "{}" na mão).
+function computeFiltersKey(columnFilters: Record<string, any>, sortColumns: any[]): string {
+  return JSON.stringify({ columnFilters, sortColumns });
+}
+
+export const EMPTY_FILTERS_KEY = computeFiltersKey({}, []);
+
+// Identifica a pasta pedida: pastaNome (rota de pasta, único no banco) tem
+// prioridade sobre pastaId; inbox = null/sem nome.
+export interface PastaIdentificador {
+  pastaId: number | null;
+  pastaNome?: string;
+}
+
+function pastaChave(pasta: PastaIdentificador): string {
+  return pasta.pastaNome ?? String(pasta.pastaId ?? "inbox");
+}
+
+function aplicarPastaNosParams(p: URLSearchParams, pasta: PastaIdentificador) {
+  if (pasta.pastaNome) p.set("pastaNome", pasta.pastaNome);
+  else if (pasta.pastaId != null) p.set("pastaId", String(pasta.pastaId));
+}
+
 // Cache cliente da primeira página por pasta+filtros. O gargalo é a latência de
 // rede (VPS/DB na Europa), então voltar a uma pasta já visitada deve ser
 // instantâneo — os dados antigos aparecem na hora e revalidam em background.
 const GRID_CACHE_TTL = 60_000;
 const gridCache = new Map<string, { dados: any[]; meta: GridMeta; ts: number }>();
 
-function cacheKeyOf(pastaId: number | null, filtersKey: string) {
-  return `${pastaId ?? "inbox"}|${filtersKey}`;
+function cacheKeyOf(pasta: PastaIdentificador, filtersKey: string) {
+  return `${pastaChave(pasta)}|${filtersKey}`;
 }
 
-function buildPage1Params(pastaId: number | null, limit = "200") {
+function buildPage1Params(pasta: PastaIdentificador, limit = "200") {
   const p = new URLSearchParams();
-  if (pastaId != null) p.set("pastaId", String(pastaId));
+  aplicarPastaNosParams(p, pasta);
   p.set("page", "1");
   p.set("limit", limit);
   return p.toString();
 }
 
-//Prefetch leve usado no hover da sidebar para pré-carregar a primeira página
-//da pasta antes mesmo do usuário clicar.
-export async function prefetchOperacoes(pastaId: number | null) {
-  const key = cacheKeyOf(pastaId, "{}");
+// Agendamento do prefetch (hover na sidebar): só dispara 150ms depois do
+// mouse parar numa pasta; cancelPrefetch() (onMouseLeave) aborta o timer e a
+// request em voo, evitando rajada de queries ao passar rápido pela lista.
+let prefetchTimeout: ReturnType<typeof setTimeout> | null = null;
+let prefetchController: AbortController | null = null;
+
+export function prefetchOperacoes(pasta: PastaIdentificador) {
+  cancelPrefetch();
+  prefetchTimeout = setTimeout(() => {
+    prefetchTimeout = null;
+    executarPrefetch(pasta);
+  }, 150);
+}
+
+export function cancelPrefetch() {
+  if (prefetchTimeout) {
+    clearTimeout(prefetchTimeout);
+    prefetchTimeout = null;
+  }
+  if (prefetchController) {
+    prefetchController.abort();
+    prefetchController = null;
+  }
+}
+
+async function executarPrefetch(pasta: PastaIdentificador) {
+  const key = cacheKeyOf(pasta, EMPTY_FILTERS_KEY);
   const cached = gridCache.get(key);
   if (cached && Date.now() - cached.ts < GRID_CACHE_TTL) return;
 
+  const controller = new AbortController();
+  prefetchController = controller;
   try {
-    const res = await api.get<{ data: any[]; meta: GridMeta }>(`/operacoes?${buildPage1Params(pastaId)}`);
+    const res = await api.get<{ data: any[]; meta: GridMeta }>(`/operacoes?${buildPage1Params(pasta)}`, controller.signal);
     gridCache.set(key, { dados: res.data, meta: res.meta, ts: Date.now() });
   } catch {
-    // prefetch falhou — a navegação normal resolve
+    // prefetch falhou ou foi cancelado — a navegação normal resolve
+  } finally {
+    if (prefetchController === controller) prefetchController = null;
   }
 }
 
 export function useOperacoesGridData({
   pastaId,
+  pastaNome,
   columnFilters,
   sortColumns,
   enabled = true,
 }: {
   pastaId: number | null;
+  pastaNome?: string;
   columnFilters: Record<string, any>;
   sortColumns: any[];
   enabled?: boolean;
@@ -95,16 +149,19 @@ export function useOperacoesGridData({
   const [searchParams] = useSearchParams();
   const seqRef = useRef(0);
   const loadingMoreRef = useRef(false);
+  // Última combinação pasta+filtros processada — usada para só aplicar o
+  // debounce de digitação quando é a MESMA pasta e só os filtros mudaram.
+  const lastRunRef = useRef<{ pasta: string; filters: string } | null>(null);
 
   const filtersKey = useMemo(
-    () => JSON.stringify({ columnFilters, sortColumns }),
+    () => computeFiltersKey(columnFilters, sortColumns),
     [columnFilters, sortColumns]
   );
 
   const buildParams = useCallback(
     (page: number) => {
       const p = new URLSearchParams();
-      if (pastaId != null) p.set("pastaId", String(pastaId));
+      aplicarPastaNosParams(p, { pastaId, pastaNome });
       p.set("page", String(page));
       p.set("limit", searchParams.get("limit") || "200");
       const sort = sortColumns?.[0];
@@ -118,17 +175,30 @@ export function useOperacoesGridData({
       }
       return p.toString();
     },
-    [pastaId, sortColumns, columnFilters, searchParams]
+    [pastaId, pastaNome, sortColumns, columnFilters, searchParams]
   );
 
   // Carrega a primeira página. Se já existe cache fresco, mostra na hora e
-  // revalida em background; senão busca com um debounce curto (200ms).
+  // revalida em background; senão busca — com debounce curto (200ms) só
+  // quando é digitação de filtro na mesma pasta; troca de pasta/montagem
+  // dispara na hora.
   useEffect(() => {
     if (!enabled) return;
     const seq = ++seqRef.current;
-    const key = cacheKeyOf(pastaId, filtersKey);
+    const pasta = { pastaId, pastaNome };
+    const chave = pastaChave(pasta);
+    // Só é "digitação" quando a pasta é a mesma, os filtros mudaram e ainda há
+    // filtro ativo — limpar filtros (ex.: ao trocar de pasta) dispara na hora.
+    const isFilterChange =
+      lastRunRef.current?.pasta === chave &&
+      lastRunRef.current?.filters !== filtersKey &&
+      filtersKey !== EMPTY_FILTERS_KEY;
+    lastRunRef.current = { pasta: chave, filters: filtersKey };
+
+    const key = cacheKeyOf(pasta, filtersKey);
     const cached = gridCache.get(key);
     const url = `/operacoes?${buildParams(1)}`;
+    const controller = new AbortController();
 
     const storeResult = (raw: { data: any[]; meta: GridMeta }) => {
       gridCache.set(key, { dados: raw.data, meta: raw.meta, ts: Date.now() });
@@ -136,14 +206,14 @@ export function useOperacoesGridData({
 
     const fetchSilently = async () => {
       try {
-        const res = await api.get<{ data: any[]; meta: GridMeta }>(url);
+        const res = await api.get<{ data: any[]; meta: GridMeta }>(url, controller.signal);
         if (seq !== seqRef.current) return;
         storeResult(res);
         setDados(processarDatas(res.data));
         setMeta(res.meta);
         setStatus("idle");
       } catch {
-        // mantém os dados em cache mesmo se o refresh falhar
+        // mantém os dados em cache mesmo se o refresh falhar (inclui abort)
       }
     };
 
@@ -151,13 +221,14 @@ export function useOperacoesGridData({
       setStatus("loading");
       setError(null);
       try {
-        const res = await api.get<{ data: any[]; meta: GridMeta }>(url);
+        const res = await api.get<{ data: any[]; meta: GridMeta }>(url, controller.signal);
         if (seq !== seqRef.current) return;
         storeResult(res);
         setDados(processarDatas(res.data));
         setMeta(res.meta);
         setStatus("idle");
       } catch (err: any) {
+        if (err?.name === "AbortError") return; // cancelado pelo cleanup do efeito — não é erro
         if (seq !== seqRef.current) return;
         setStatus("error");
         setError(err?.message || "Erro ao carregar operações.");
@@ -170,13 +241,17 @@ export function useOperacoesGridData({
       setStatus("idle");
       setError(null);
       const t = setTimeout(() => fetchSilently(), 250);
-      return () => clearTimeout(t);
+      return () => { clearTimeout(t); controller.abort(); };
     }
 
     setStatus("loading");
-    const t = setTimeout(() => fetchFresh(), 200);
-    return () => clearTimeout(t);
-  }, [pastaId, filtersKey, enabled, buildParams]);
+    if (isFilterChange) {
+      const t = setTimeout(() => fetchFresh(), 200);
+      return () => { clearTimeout(t); controller.abort(); };
+    }
+    fetchFresh();
+    return () => controller.abort();
+  }, [pastaId, pastaNome, filtersKey, enabled, buildParams]);
 
   // Recarrega a primeira página (após mutações), ignorando o cache.
   const refresh = useCallback(async () => {
@@ -185,7 +260,7 @@ export function useOperacoesGridData({
     try {
       const res = await api.get<{ data: any[]; meta: GridMeta }>(`/operacoes?${buildParams(1)}`);
       if (seq !== seqRef.current) return;
-      gridCache.set(cacheKeyOf(pastaId, filtersKey), { dados: res.data, meta: res.meta, ts: Date.now() });
+      gridCache.set(cacheKeyOf({ pastaId, pastaNome }, filtersKey), { dados: res.data, meta: res.meta, ts: Date.now() });
       setDados(processarDatas(res.data));
       setMeta(res.meta);
       setStatus("idle");
@@ -194,7 +269,7 @@ export function useOperacoesGridData({
       setStatus("error");
       setError(err?.message || "Erro ao recarregar operações.");
     }
-  }, [buildParams, pastaId, filtersKey]);
+  }, [buildParams, pastaId, pastaNome, filtersKey]);
 
   // Scroll infinito: carrega a próxima página e faz append sem duplicar
   const handleScroll = useCallback(
@@ -230,4 +305,4 @@ export function useOperacoesGridData({
   );
 
   return { dados, setDados, meta, status, error, handleScroll, refresh };
-}
\ No newline at end of file
+}
diff --git a/app/lib/query.ts b/app/lib/query.ts
index 380a1cd..e84f504 100644
--- a/app/lib/query.ts
+++ b/app/lib/query.ts
@@ -30,13 +30,17 @@ export interface InitData {
   emissaoAntigasPorPasta: Record<string, number>;
 }
 
+// Extraída para ser reaproveitada pelo AuthContext (boot com uma única
+// request: sem /auth/me separado, ver AuthContext.tsx).
+export const fetchInit = () => api.get<InitData>("/init");
+
 // Dados de boot (sidebar + ordem de colunas). Mantidos frescos com polling
 // leve apenas com a aba em foco — é o que dá o "tempo real" dos contadores
 // da sidebar sem custo quando o usuário não está olhando.
 export function useInit() {
   return useQuery({
     queryKey: queryKeys.init,
-    queryFn: () => api.get<InitData>("/init"),
+    queryFn: fetchInit,
     staleTime: 60_000,
     refetchOnWindowFocus: true,
     refetchInterval: 120_000,
diff --git a/app/pages/OperacoesPage.tsx b/app/pages/OperacoesPage.tsx
index e9bc4f0..618ae9c 100644
--- a/app/pages/OperacoesPage.tsx
+++ b/app/pages/OperacoesPage.tsx
@@ -6,22 +6,17 @@ export function OperacoesPage() {
   const { nome } = useParams();
   const { data: init } = useInit();
 
-  // Rota de pasta (/pastas/:nome)
+  // Rota de pasta (/pastas/:nome): renderiza pelo nome da URL direto, em
+  // paralelo com o /init (não espera resolver o id da pasta); só redireciona
+  // para a inbox quando o /init chega e a pasta não existe.
   if (nome) {
-    const pasta = (init?.pastas || []).find((p: any) => p.nome === decodeURIComponent(nome));
-    if (init && !pasta) return <Navigate to="/caixa-de-entrada" replace />;
-    if (!pasta) return <GridLoading />;
-    return <OperacoesView pastaId={pasta.id} nomePasta={pasta.nome} showImport={false} />;
+    const nomePasta = decodeURIComponent(nome);
+    if (init && !(init.pastas || []).some((p: any) => p.nome === nomePasta)) {
+      return <Navigate to="/caixa-de-entrada" replace />;
+    }
+    return <OperacoesView pastaNome={nomePasta} nomePasta={nomePasta} showImport={false} />;
   }
 
   // Caixa de entrada (/caixa-de-entrada)
   return <OperacoesView pastaId={null} nomePasta="Caixa de Entrada" showImport />;
 }
-
-function GridLoading() {
-  return (
-    <div className="flex-1 flex items-center justify-center bg-bg">
-      <p className="text-xs font-bold text-text-muted uppercase tracking-widest animate-pulse">Carregando...</p>
-    </div>
-  );
-}
diff --git a/app/views/OperacoesView.tsx b/app/views/OperacoesView.tsx
index 78eb7e3..edab4c8 100644
--- a/app/views/OperacoesView.tsx
+++ b/app/views/OperacoesView.tsx
@@ -20,11 +20,12 @@ import DataGrid from "react-data-grid";
 
 interface OperacoesViewProps {
   pastaId?: number | null;
+  pastaNome?: string;
   nomePasta: string;
   showImport?: boolean;
 }
 
-export function OperacoesView({ pastaId = null, nomePasta, showImport = true }: OperacoesViewProps) {
+export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport = true }: OperacoesViewProps) {
   const { data: init } = useInit();
   const pastas = init?.pastas || [];
   const columnOrder = init?.columnOrder ?? null;
@@ -55,7 +56,7 @@ export function OperacoesView({ pastaId = null, nomePasta, showImport = true }:
   const [sortColumns, setSortColumns] = useState<any[]>([]);
   const [importing, setImporting] = useState(false);
 
-  const grid = useOperacoesGridData({ pastaId, columnFilters, sortColumns });
+  const grid = useOperacoesGridData({ pastaId, pastaNome, columnFilters, sortColumns });
   const { dados, setDados, meta, status, error: gridError, handleScroll, refresh } = grid;
 
   const [currentMetaTotal, setCurrentMetaTotal] = useState(0);
@@ -73,10 +74,14 @@ export function OperacoesView({ pastaId = null, nomePasta, showImport = true }:
     if (!location.state) {
       setColumnFilters({});
     }
-  }, [pastaId, location.pathname, location.state, setColumnFilters, resetSelection]);
+  }, [pastaId, pastaNome, location.pathname, location.state, setColumnFilters, resetSelection]);
 
+  // Envia pastaNome quando a pasta é identificada por nome (rota /pastas/:nome),
+  // para que mover/excluir "selecionar todas" fiquem restritos a ela.
   const getActiveFilters = () => {
-    const activeFilters: Record<string, any> = { ...Object.fromEntries(searchParams), pastaId };
+    const activeFilters: Record<string, any> = { ...Object.fromEntries(searchParams) };
+    if (pastaNome) activeFilters.pastaNome = pastaNome;
+    else activeFilters.pastaId = pastaId;
     for (const [key, filter] of Object.entries(columnFilters)) {
       if (isFilterEmpty(filter)) continue;
       activeFilters[`colFilter_${key}`] = `${filter.type}:${filter.value}`;
diff --git a/server/services/operacao-query-builder.server.ts b/server/services/operacao-query-builder.server.ts
index 6688cfb..3ab87b0 100644
--- a/server/services/operacao-query-builder.server.ts
+++ b/server/services/operacao-query-builder.server.ts
@@ -1,8 +1,24 @@
 import { PrazoService, type PrazoRegras } from "./prazo.server";
+import { PastaService } from "./pasta.server";
 
 const MILIS_DIA = 24 * 60 * 60 * 1000;
 
 export class OperacaoQueryBuilder {
+  // Resolve o identificador da pasta: pastaNome (rota de pasta, cacheada via
+  // PastaService) tem prioridade sobre pastaId; nome inexistente vira 404.
+  static async resolverPastaId(pastaId: any, filtros: any): Promise<number | null> {
+    if (filtros?.pastaNome) {
+      const pasta = await PastaService.buscarPorNome(String(filtros.pastaNome));
+      if (!pasta) {
+        const err: any = new Error("Pasta não encontrada.");
+        err.status = 404;
+        throw err;
+      }
+      return pasta.id;
+    }
+    return pastaId && pastaId !== "null" ? Number(pastaId) : null;
+  }
+
   // Condição SQL de "emissão antiga": fora do prazo padrão ou do prazo
   // específico do cliente (nm_pessoa_pagador). Compartilhada com
   // `emissoesAntigasPorPasta` para que o filtro e os contadores batam.
@@ -151,7 +167,7 @@ export class OperacaoQueryBuilder {
       whereAnd.push(`${condition} $${params.length}`);
     };
 
-    const pid = pastaId && pastaId !== "null" ? Number(pastaId) : null;
+    const pid = await this.resolverPastaId(pastaId, filtros);
 
     // Filtros especiais por coluna (sem valor digitado, baseados em regra de negócio)
     if (this.temFiltro(filtros, "dt_emissao_", "antigos")) {
diff --git a/server/services/operacao.server.ts b/server/services/operacao.server.ts
index d57ba9e..4615acd 100644
--- a/server/services/operacao.server.ts
+++ b/server/services/operacao.server.ts
@@ -73,6 +73,9 @@ export class OperacaoService {
     const offset = (p - 1) * l;
 
     const orderClause = this.montarOrderBy(filtros);
+    // Resolve pastaNome -> pastaId uma vez (cache) para usar tanto no WHERE
+    // quanto nas placas duplicadas, que hoje recebem o pastaId cru.
+    const pid = await OperacaoQueryBuilder.resolverPastaId(pastaId, filtros);
     const whereClause = await OperacaoQueryBuilder.construirWhere(pastaId, filtros);
     const cacheKey = JSON.stringify({ sql: whereClause.sql, params: whereClause.params });
     const cachedEntry = this.countCache.get(cacheKey);
@@ -99,7 +102,7 @@ export class OperacaoService {
       `, ...whereClause.params);
 
     const [placasDuplicadas, regras] = await Promise.all([
-      this.placasDuplicadasDaPasta(pastaId),
+      this.placasDuplicadasDaPasta(pid),
       PrazoService.regras(),
     ]);
     const agora = Date.now();

From f39b7fcb519fd17ab51f290b6e6eb450d4b43dfb Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 09:03:14 -0300
Subject: [PATCH 03/12] =?UTF-8?q?perf:=20menos=20idas=20ao=20banco/Supabas?=
 =?UTF-8?q?e=20ao=20abrir=20pastas,=20listar=20usu=C3=A1rios=20e=20editar?=
 =?UTF-8?q?=20status?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Grid de operações: query principal, placas duplicadas e regras de prazo
  agora disparam juntas (antes a principal esperava terminar para só então
  buscar as outras duas).
- Editar o status de uma operação grava tudo em uma única instrução no banco
  (antes eram duas idas: uma para conferir o status atual, outra para salvar),
  sem mudar quando a data de status é atualizada.
- Novo cache em memória (server/lib/cache.ts) para dados que mudam pouco:
  lista de usuários do Supabase e ordem das colunas da grid. Fica quente por
  ~10 minutos e é invalidado nas telas de gestão de usuários assim que algo
  muda (criar, editar, bloquear, ativar, excluir).
- O servidor já aquece esses caches e outros dados de boot logo ao subir, para
  que o primeiro acesso de cada usuário não pague essa espera.
- A lista de faturistas só é buscada quando o formulário de criar/editar
  pasta está aberto, em vez de em toda navegação pela sidebar.
- Sessão própria de 30 dias guardada em cookie assinado, sem depender mais de
  chamadas ao Supabase a cada requisição para saber quem é o usuário logado
  (só login, logout e a tela de usuários continuam falando com o Supabase).
  Rebaixar ou bloquear alguém pelo painel passa a valer em poucos minutos.
- Tela de perfil: os dados da página carregam em paralelo, e renomear o
  próprio usuário usa o mesmo caminho administrativo já usado na tela de
  usuários, refletindo o novo nome sem precisar relogar.
- Removido código que não era mais usado depois dessas mudanças de sessão.
---
 app/components/Sidebar.tsx               |   6 +-
 app/components/SidebarFolderItem.tsx     |   3 +-
 app/lib/query.ts                         |   7 +-
 index.html                               |   6 +-
 package-lock.json                        | 462 +++++++++++++----------
 package.json                             |  12 +-
 public/apple-touch-icon.png              | Bin 0 -> 3701 bytes
 public/favicon.ico                       | Bin 0 -> 15086 bytes
 public/favicon.svg                       |  10 +
 server/index.ts                          |  20 +
 server/lib/cache.ts                      |  17 +
 server/lib/http.ts                       |  16 -
 server/middlewares/auth.ts               |  47 ++-
 server/routes/auth.ts                    |  50 +--
 server/routes/perfil.ts                  |  28 +-
 server/routes/usuarios.ts                |   6 +
 server/services/auth.server.ts           | 140 +------
 server/services/config.server.ts         |  26 +-
 server/services/dashboard.server.ts      |  12 +-
 server/services/operacao.server.ts       |  40 +-
 server/services/session.server.ts        |  10 +-
 server/services/supabase-admin.server.ts |  87 +++--
 server/services/supabase.server.ts       |  46 +--
 23 files changed, 535 insertions(+), 516 deletions(-)
 create mode 100644 public/apple-touch-icon.png
 create mode 100644 public/favicon.svg
 create mode 100644 server/lib/cache.ts
 delete mode 100644 server/lib/http.ts

diff --git a/app/components/Sidebar.tsx b/app/components/Sidebar.tsx
index 834b223..1af9c0f 100644
--- a/app/components/Sidebar.tsx
+++ b/app/components/Sidebar.tsx
@@ -33,8 +33,6 @@ export const Sidebar = React.memo(({
 
   const isFetching = useIsFetching() > 0;
   const { alert: showAlert } = useUI();
-  const { data: faturistasData } = useFaturistas();
-  const faturistas = faturistasData?.faturistas || [];
 
   const [newFolderName, setNewFolderName] = useState("");
   const [newFolderColor, setNewFolderColor] = useState(PRESET_COLORS[0]);
@@ -44,6 +42,10 @@ export const Sidebar = React.memo(({
   const [searchQuery, setSearchQuery] = useState("");
   const [filterColor, setFilterColor] = useState("");
 
+  // Só busca a lista de faturistas com o formulário de nova pasta aberto.
+  const { data: faturistasData } = useFaturistas(isAddingFolder);
+  const faturistas = faturistasData?.faturistas || [];
+
   const normalize = (value: string) => value.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "");
 
   const filteredPastas = useMemo(() => {
diff --git a/app/components/SidebarFolderItem.tsx b/app/components/SidebarFolderItem.tsx
index 996a5a0..8de604e 100644
--- a/app/components/SidebarFolderItem.tsx
+++ b/app/components/SidebarFolderItem.tsx
@@ -39,7 +39,8 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
   const [editingFaturista, setEditingFaturista] = useState(folder.faturistaId || "");
   const [isPending, setIsPending] = useState(false);
   const { confirm: confirmAction, alert: showAlert } = useUI();
-  const { data: faturistasData } = useFaturistas();
+  // Só busca a lista de faturistas com o formulário de edição aberto.
+  const { data: faturistasData } = useFaturistas(isEditing);
   const faturistas = faturistasData?.faturistas || [];
 
   const refreshFolders = () => {
diff --git a/app/lib/query.ts b/app/lib/query.ts
index e84f504..2d41b40 100644
--- a/app/lib/query.ts
+++ b/app/lib/query.ts
@@ -54,12 +54,15 @@ export interface Faturista {
   email: string;
 }
 
-// Lista de usuários ativos que podem ser atribuídos como faturista de uma pasta.
-export function useFaturistas() {
+// Lista de usuários ativos que podem ser atribuídos como faturista de uma
+// pasta. Só busca quando o formulário de criar/editar pasta está aberto —
+// o select não aparece em mais lugar nenhum.
+export function useFaturistas(enabled: boolean) {
   return useQuery({
     queryKey: queryKeys.faturistas,
     queryFn: () => api.get<{ faturistas: Faturista[] }>("/pastas/faturistas"),
     staleTime: 60_000,
+    enabled,
   });
 }
 
diff --git a/index.html b/index.html
index cd00545..d6a1be1 100644
--- a/index.html
+++ b/index.html
@@ -4,7 +4,11 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Logicell</title>
-    <link rel="icon" type="image/x-icon" href="/favicon.ico" />
+    <!-- Ícone do site: o mesmo logo da sidebar. SVG para navegadores modernos,
+         .ico (16/32/48) como fallback e PNG 180px para tela inicial no iOS. -->
+    <link rel="icon" href="/favicon.ico" sizes="any" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="anonymous" />
     <link
diff --git a/package-lock.json b/package-lock.json
index 839cb21..dd98c33 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,7 +20,7 @@
         "react": "19.0.0",
         "react-data-grid": "7.0.0-beta.47",
         "react-dom": "19.0.0",
-        "react-router": "7.15.1",
+        "react-router": "^7.18.3",
         "tailwind-merge": "3.5.0",
         "xlsx": "0.18.5",
         "zustand": "^5.0.14"
@@ -34,12 +34,12 @@
         "@vitejs/plugin-react": "^4.7.0",
         "autoprefixer": "10.4.20",
         "concurrently": "^10.0.5",
-        "postcss": "8.5.1",
+        "postcss": "^8.5.28",
         "prisma": "5.22.0",
         "tailwindcss": "3.4.17",
         "tsx": "^4.23.13",
         "typescript": "5.7.3",
-        "vite": "6.0.11",
+        "vite": "^6.4.3",
         "vite-tsconfig-paths": "5.1.4"
       },
       "engines": {
@@ -58,11 +58,13 @@
       }
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -71,7 +73,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.0",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -79,19 +83,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -107,21 +113,15 @@
         "url": "https://opencollective.com/babel"
       }
     },
-    "node_modules/@babel/core/node_modules/semver": {
-      "version": "6.3.1",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -131,12 +131,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -145,16 +147,10 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
-      "version": "6.3.1",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -162,25 +158,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -200,7 +200,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -208,7 +210,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -216,7 +220,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -224,23 +230,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.2",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -282,29 +292,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -312,21 +326,23 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.24.2.tgz",
-      "integrity": "sha512-thpVCb/rhxE/BnMLQ7GReQLLN8q9qbHmI55F4489/ByVg2aQaQ6kbcLb6FHkocZzQhxc4gx0sCk0tJkKBFzDhA==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
       "cpu": [
         "ppc64"
       ],
@@ -341,9 +357,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.24.2.tgz",
-      "integrity": "sha512-tmwl4hJkCfNHwFB3nBa8z1Uy3ypZpxqxfTQOcHX+xRByyYgunVbZ9MzUUfb0RxaHIMnbHagwAxuTL+tnNM+1/Q==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
       "cpu": [
         "arm"
       ],
@@ -358,9 +374,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.24.2.tgz",
-      "integrity": "sha512-cNLgeqCqV8WxfcTIOeL4OAtSmL8JjcN6m09XIgro1Wi7cF4t/THaWEa7eL5CMoMBdjoHOTh/vwTO/o2TRXIyzg==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
       "cpu": [
         "arm64"
       ],
@@ -375,9 +391,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.24.2.tgz",
-      "integrity": "sha512-B6Q0YQDqMx9D7rvIcsXfmJfvUYLoP722bgfBlO5cGvNVb5V/+Y7nhBE3mHV9OpxBf4eAS2S68KZztiPaWq4XYw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
       "cpu": [
         "x64"
       ],
@@ -392,9 +408,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.24.2.tgz",
-      "integrity": "sha512-kj3AnYWc+CekmZnS5IPu9D+HWtUI49hbnyqk0FLEJDbzCIQt7hg7ucF1SQAilhtYpIujfaHr6O0UHlzzSPdOeA==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
       "cpu": [
         "arm64"
       ],
@@ -409,9 +425,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.24.2.tgz",
-      "integrity": "sha512-WeSrmwwHaPkNR5H3yYfowhZcbriGqooyu3zI/3GGpF8AyUdsrrP0X6KumITGA9WOyiJavnGZUwPGvxvwfWPHIA==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
       "cpu": [
         "x64"
       ],
@@ -426,9 +442,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.24.2.tgz",
-      "integrity": "sha512-UN8HXjtJ0k/Mj6a9+5u6+2eZ2ERD7Edt1Q9IZiB5UZAIdPnVKDoG7mdTVGhHJIeEml60JteamR3qhsr1r8gXvg==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
       "cpu": [
         "arm64"
       ],
@@ -443,9 +459,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.24.2.tgz",
-      "integrity": "sha512-TvW7wE/89PYW+IevEJXZ5sF6gJRDY/14hyIGFXdIucxCsbRmLUcjseQu1SyTko+2idmCw94TgyaEZi9HUSOe3Q==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
       "cpu": [
         "x64"
       ],
@@ -460,9 +476,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.24.2.tgz",
-      "integrity": "sha512-n0WRM/gWIdU29J57hJyUdIsk0WarGd6To0s+Y+LwvlC55wt+GT/OgkwoXCXvIue1i1sSNWblHEig00GBWiJgfA==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
       "cpu": [
         "arm"
       ],
@@ -477,9 +493,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.24.2.tgz",
-      "integrity": "sha512-7HnAD6074BW43YvvUmE/35Id9/NB7BeX5EoNkK9obndmZBUk8xmJJeU7DwmUeN7tkysslb2eSl6CTrYz6oEMQg==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
       "cpu": [
         "arm64"
       ],
@@ -494,9 +510,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.24.2.tgz",
-      "integrity": "sha512-sfv0tGPQhcZOgTKO3oBE9xpHuUqguHvSo4jl+wjnKwFpapx+vUDcawbwPNuBIAYdRAvIDBfZVvXprIj3HA+Ugw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
       "cpu": [
         "ia32"
       ],
@@ -511,9 +527,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.24.2.tgz",
-      "integrity": "sha512-CN9AZr8kEndGooS35ntToZLTQLHEjtVB5n7dl8ZcTZMonJ7CCfStrYhrzF97eAecqVbVJ7APOEe18RPI4KLhwQ==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
       "cpu": [
         "loong64"
       ],
@@ -528,9 +544,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.24.2.tgz",
-      "integrity": "sha512-iMkk7qr/wl3exJATwkISxI7kTcmHKE+BlymIAbHO8xanq/TjHaaVThFF6ipWzPHryoFsesNQJPE/3wFJw4+huw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
       "cpu": [
         "mips64el"
       ],
@@ -545,9 +561,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.24.2.tgz",
-      "integrity": "sha512-shsVrgCZ57Vr2L8mm39kO5PPIb+843FStGt7sGGoqiiWYconSxwTiuswC1VJZLCjNiMLAMh34jg4VSEQb+iEbw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
       "cpu": [
         "ppc64"
       ],
@@ -562,9 +578,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.24.2.tgz",
-      "integrity": "sha512-4eSFWnU9Hhd68fW16GD0TINewo1L6dRrB+oLNNbYyMUAeOD2yCK5KXGK1GH4qD/kT+bTEXjsyTCiJGHPZ3eM9Q==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
       "cpu": [
         "riscv64"
       ],
@@ -579,9 +595,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.24.2.tgz",
-      "integrity": "sha512-S0Bh0A53b0YHL2XEXC20bHLuGMOhFDO6GN4b3YjRLK//Ep3ql3erpNcPlEFed93hsQAjAQDNsvcK+hV90FubSw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
       "cpu": [
         "s390x"
       ],
@@ -596,7 +612,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.24.2",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
       "cpu": [
         "x64"
       ],
@@ -611,9 +629,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.24.2.tgz",
-      "integrity": "sha512-wuLK/VztRRpMt9zyHSazyCVdCXlpHkKm34WUyinD2lzK07FAHTq0KQvZZlXikNWkDGoT6x3TD51jKQ7gMVpopw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
       "cpu": [
         "arm64"
       ],
@@ -628,9 +646,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.24.2.tgz",
-      "integrity": "sha512-VefFaQUc4FMmJuAxmIHgUmfNiLXY438XrL4GDNV1Y1H/RW3qow68xTwjZKfj/+Plp9NANmzbH5R40Meudu8mmw==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
       "cpu": [
         "x64"
       ],
@@ -645,9 +663,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.24.2.tgz",
-      "integrity": "sha512-YQbi46SBct6iKnszhSvdluqDmxCJA+Pu280Av9WICNwQmMxV7nLRHZfjQzwbPs3jeWnuAhE9Jy0NrnJ12Oz+0A==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
       "cpu": [
         "arm64"
       ],
@@ -662,9 +680,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.24.2.tgz",
-      "integrity": "sha512-+iDS6zpNM6EnJyWv0bMGLWSWeXGN/HTaF/LXHXHwejGsVi+ooqDfMCCTerNFxEkM3wYVcExkeGXNqshc9iMaOA==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
       "cpu": [
         "x64"
       ],
@@ -696,9 +714,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.24.2.tgz",
-      "integrity": "sha512-hTdsW27jcktEvpwNHJU4ZwWFGkz2zRJUz8pvddmXPtXDzVKTTINmlmga3ZzwcuMpUvLw7JkLy9QLKyGpD2Yxig==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
       "cpu": [
         "x64"
       ],
@@ -713,9 +731,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.24.2.tgz",
-      "integrity": "sha512-LihEQ2BBKVFLOC9ZItT9iFprsE9tqjDjnbulhHoFxYQtQfai7qfluVODIYxt1PgdoyQkz23+01rzwNwYfutxUQ==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
       "cpu": [
         "arm64"
       ],
@@ -730,9 +748,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.24.2.tgz",
-      "integrity": "sha512-q+iGUwfs8tncmFC9pcnD5IvRHAzmbwQ3GPS5/ceCyHdjXubwQWI12MKWSNSMYLJMq23/IUCvJMS76PDqXe1fxA==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
       "cpu": [
         "ia32"
       ],
@@ -747,9 +765,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.24.2.tgz",
-      "integrity": "sha512-7VTgWzgMGvup6aSqDPLiW5zHaxYJGTO4OokMjIlrCtf+VpEL+cXKtCvg723iguPYI5oaUNdS+/V7OU2gvXVWEg==",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
       "cpu": [
         "x64"
       ],
@@ -1745,7 +1763,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.19",
+      "version": "2.11.23",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.23.tgz",
+      "integrity": "sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -1815,7 +1835,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
+      "version": "4.28.9",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz",
+      "integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==",
       "dev": true,
       "funding": [
         {
@@ -1833,11 +1855,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.20",
+        "caniuse-lite": "^1.0.30001810",
+        "electron-to-chromium": "^1.5.420",
+        "node-releases": "^2.0.54",
+        "update-browserslist-db": "^1.3.2"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1902,7 +1924,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001788",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -2213,7 +2237,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.339",
+      "version": "1.5.427",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.427.tgz",
+      "integrity": "sha512-n14zb3FdsChZ2BNobqNHAJMcP3ifFv4paox2LvCrfVAQcqGiSURgbJl+PfMpHVCNFkStnNc+RRVtPBTVW5PDgw==",
       "dev": true,
       "license": "ISC"
     },
@@ -2256,7 +2282,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.24.2",
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -2267,31 +2295,49 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.24.2",
-        "@esbuild/android-arm": "0.24.2",
-        "@esbuild/android-arm64": "0.24.2",
-        "@esbuild/android-x64": "0.24.2",
-        "@esbuild/darwin-arm64": "0.24.2",
-        "@esbuild/darwin-x64": "0.24.2",
-        "@esbuild/freebsd-arm64": "0.24.2",
-        "@esbuild/freebsd-x64": "0.24.2",
-        "@esbuild/linux-arm": "0.24.2",
-        "@esbuild/linux-arm64": "0.24.2",
-        "@esbuild/linux-ia32": "0.24.2",
-        "@esbuild/linux-loong64": "0.24.2",
-        "@esbuild/linux-mips64el": "0.24.2",
-        "@esbuild/linux-ppc64": "0.24.2",
-        "@esbuild/linux-riscv64": "0.24.2",
-        "@esbuild/linux-s390x": "0.24.2",
-        "@esbuild/linux-x64": "0.24.2",
-        "@esbuild/netbsd-arm64": "0.24.2",
-        "@esbuild/netbsd-x64": "0.24.2",
-        "@esbuild/openbsd-arm64": "0.24.2",
-        "@esbuild/openbsd-x64": "0.24.2",
-        "@esbuild/sunos-x64": "0.24.2",
-        "@esbuild/win32-arm64": "0.24.2",
-        "@esbuild/win32-ia32": "0.24.2",
-        "@esbuild/win32-x64": "0.24.2"
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
+      }
+    },
+    "node_modules/esbuild/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/escalade": {
@@ -2733,11 +2779,15 @@
     },
     "node_modules/js-tokens": {
       "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/jsesc": {
-      "version": "3.0.2",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -2776,6 +2826,8 @@
     },
     "node_modules/lru-cache": {
       "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2952,7 +3004,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
+      "version": "3.3.19",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
       "dev": true,
       "funding": [
         {
@@ -2978,9 +3032,14 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.37",
+      "version": "2.0.55",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz",
+      "integrity": "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
@@ -3097,7 +3156,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.1",
+      "version": "8.5.28",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
+      "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
       "dev": true,
       "funding": [
         {
@@ -3115,7 +3176,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.8",
+        "nanoid": "^3.3.18",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -3222,7 +3283,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.2",
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3352,7 +3415,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.15.1",
+      "version": "7.18.3",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.3.tgz",
+      "integrity": "sha512-gyXgtdr5uACJ5b1Q4udzjVV+tb/rlHIMJKuJ0e89R4Kzgz47z/rgP0dIKxktqIEUhDHluGTPJJH/wRha7CyqsA==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -3549,6 +3614,16 @@
       "version": "0.25.0",
       "license": "MIT"
     },
+    "node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
     "node_modules/send": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
@@ -4539,7 +4614,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.3.tgz",
+      "integrity": "sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==",
       "dev": true,
       "funding": [
         {
@@ -4579,13 +4656,18 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.0.11",
+      "version": "6.4.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
+      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "^0.24.2",
-        "postcss": "^8.4.49",
-        "rollup": "^4.23.0"
+        "esbuild": "^0.25.0",
+        "fdir": "^6.4.4",
+        "picomatch": "^4.0.2",
+        "postcss": "^8.5.3",
+        "rollup": "^4.34.9",
+        "tinyglobby": "^0.2.13"
       },
       "bin": {
         "vite": "bin/vite.js"
@@ -4735,6 +4817,8 @@
     },
     "node_modules/yallist": {
       "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
       "dev": true,
       "license": "ISC"
     },
diff --git a/package.json b/package.json
index 0b9139f..7c616ed 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "react": "19.0.0",
     "react-data-grid": "7.0.0-beta.47",
     "react-dom": "19.0.0",
-    "react-router": "7.15.1",
+    "react-router": "^7.18.3",
     "tailwind-merge": "3.5.0",
     "xlsx": "0.18.5",
     "zustand": "^5.0.14"
@@ -51,12 +51,18 @@
     "@vitejs/plugin-react": "^4.7.0",
     "autoprefixer": "10.4.20",
     "concurrently": "^10.0.5",
-    "postcss": "8.5.1",
+    "postcss": "^8.5.28",
     "prisma": "5.22.0",
     "tailwindcss": "3.4.17",
     "tsx": "^4.23.13",
     "typescript": "5.7.3",
-    "vite": "6.0.11",
+    "vite": "^6.4.3",
     "vite-tsconfig-paths": "5.1.4"
+  },
+  "allowScripts": {
+    "@prisma/client": true,
+    "@prisma/engines": true,
+    "esbuild": true,
+    "prisma": true
   }
 }
diff --git a/public/apple-touch-icon.png b/public/apple-touch-icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..c288c28f4edba3ee89689d332eee1f8ea24f7327
GIT binary patch
literal 3701
zcma)9cQ72>*VbFK)%ym~SIJ9==siT=C=q4x23ftVC_$DL2}!gN)&?7*6GRuCNW(_&
ztP*7{tF6wr`M&vPet-Vv&U4S5J9o~UGxy%}Jm;mQxe*fs9|IW~8I$o{eQT1f`wKc6
z(yTE+^AE|;xZN|-C%gJP^4p5j$;g<cjrDczhoSIu;Q_W|y#2d7&GgqHFUYAAVFql%
z4bqh|AGsXJVI{DxGH`_fn~$uyQIbt7qi=DXgSYHbchX%W)Q1lr>m6!fg>qI88|4_N
zMq_2k9n(^@QxIQ@V;mQd2+$L)C*hikyx(#nhr)HEXHiG9kwZ4U#`W7qxiuVCZ;AwN
z^WA2c1oAMxjXLm*iL>!AmZ`qxb-X_0q2&Le#Gr=UOtv}~1yyu-MEk>QM==EOQ6OO{
zSW=t}{LH%G7JZ|`vo$!M(hxdq`rpn0sumMF3Pr1@lstZgG=NMRh*&iW6(P4dSa2<*
zUXJ<?**gk%QJh^?9kcycGOpkpXyS(+0;N+W3spOl<4X-1uBj15P(c>;EV?0n$|?+=
z`|+OSAKFgNN&gkZBt7UuR$gGjG_N5omMY>+?i&w4fR`jbsjyrxP%vq%O-Dt*C*Kn%
zD!F8?1g7-0D;$G@+P^zN!In%k-0P~RK1x4R0&4?`>CHIrjmGIH{n5e%ACeIR*cDV#
zi2AmxUJyAMoANxvb81461}gOO*^<5so{l^}3@{K9v>CNy76!}Kd?k`gCavBm+}l1+
zQIrPu51*Ra8-0{fRrq2pMImYNHBIiLH=5%=2e*?kW2fNGk#9L#fT{?P`Lf($OV0aQ
z>eGj(tVC-{fhDMx@R!max7eJ=8f)+d3)i0tdir>?y{B(l$3i9e)%f*>#waoB&k+yw
zcO*f!H}%w7XyzZ}9|e3i9iWdhN5A4n`Ai<A^t8(@AH8Yd6jA3J2nSh}N6eHQr3{W6
zL3X7Bv{N$Zu~w9Lfg$Vq=3=G@V2~u2uq)TDmEp~#$eH{#ZM%(YmMGpZW8GtPwn>I&
zak2apt(9u|K^Iy90b3{CV*)UdcVf<rVh)JLtC`*SB~r!gDnAi=6d#q0v0HbotD%pS
zWfWe5atDM>$m|m}bQ=RX**pL-aW($!+lBjph$^9OA!SiTei7bKvV>Hy8iRa@rtS_l
zh~!Gu<oA8pQ#3ARnIFI<iijx-_RwNJSUuI>>I1~zO$)q_+l{x-WDd#AHv9qT?zr-t
zhz8%*<F@*0yLcVUNssLbHN2U4BJB@EC+zZ){52a|_6J(>1g&KI)CmZm4~IU#=Du!B
za}OXwmrll^7!vcN#K@M8^Lqn357f$#n$08i=~)4fJ9_1-T`F6+G^mcsp%C$*TQ^gj
z^)Y%&^dPke$0~BYK=!RVw`C!sXq3XlbV68P+vEmD#LNV=5-O7_B*wLOJuFp-@=N8S
zyuPV%zCqdD{{kF2a-HQrtQ1Nqn1M86XW3O>bBgAwn}x<lyZK>7<;Ds6)Ggm)lgyt1
zQPiBGrgrQVhck=C$z2!nI?g#&;>{dmcK}yU^=Nx8YywX0M=}t&4JHLq+MQcDRX4KP
zZax=M=5aoDKJ8%)a8OlO8@glx%_c?VCxOE9`F?<vd)LkS=<ILugTi_0y=zzw;w3t{
z6`L5(-UbrJhLBYv;cmcnVD6(9is0Jwwn$E#Hc(MI>NBt3s|&=1Fe(X_FYz5|ZkicG
zY3C-mu9twU>Qp~b36L0vXO_zFh$opgvEdZs{fa7;eG)o+=ssm$k3!F$DE*siI@ipG
z({9~8f2gpgIbw7B^A>IjX_ssbrFd^EcGi_j+cH!9k+b1eJlJB^INyEy%PukDA?$T^
z9gW{picma#dsS27VU8|#u7q-nT`{I@{4&z^Za%mwh@+xeS`D44&99)oME&Zg(Z3R-
zY+jVia!Kt&6$l3k-_FixkJAC&5-|+TmY?FplW9F!xH9Bk+|=cW0F=IteCO+8bXVPT
z2a5Nuj~VN!?ko>;K~)b0gIPKlCe&w-LP^2J3Hgi5AtHuliBkJF(zW{?_Y(-jv%!Xo
z^8v!Bjly7$@55EmMR~iPLYK}=ssxAU0#dbY^x_K?-i;A6F~0)rgKr6-7O@FbcOKOW
zLFq#n9;uG9t-t*NB?Tpw*=Kn#A1vohO2M;}D1Q6G_G~ar{wrf+F(r#>XBq?B`l}M}
zItx@76YPY}UQ=cg*?k>8$l8I<wWVh_q<sj++`#ZItBitW;wmM)*wz{M*f*P8dT+o7
zOIi%irdb+40|Q-<rlj=Zr&x-)wZ!1095?x}*$7b327>hH6aNDyMgCoUqYKVvF$X#d
zwWIB}*o*hozO-LXaxb!$GHpj}LNj}j1#iD==S6{jA<2r9aZwMd=6nfj^~5_rlg~w4
zPFvD@k!IiS=Ub?<`Dp^pVPP8Goza9<cYHFk5i+kw=$^rjPmbw`Sq7WcLY1Wy-Pbo?
z5`L+#b*)3Yz0S~k3pso~PEo4MSu0~c)|-^RQuYz_pi4fEvva>BP!ra%wXH-5w9^P=
zzm@a$RC^(yN`uHaTtQFx{E2GDV=~SDGj}QTftW<k7b$FA6ke(6xHn*$`5v2hs7yUv
z6T*7F7aMS9A7Zta8=BLLoV)9r-w|VYtkqPj6JXXoA0Srap<=D*`()GW>@`sP$}KD0
zTIs@Bm6uDMSuNCP#D%p=Q_zqRKHf%LbM~}ak{pK*dauo7CM)bWVc{2Bk$9mn)zkJi
z>4wE&@E82d_L8TYZbgCsa4WIu(>rC-7w-C*Gq)2-41~X1evyZ4JB4_LM1=!zq6cb+
z*rOUxdB-NI=%b@#7qzvprkDnekiexv(eBbp37yd`8xAdYEw?B{G&Jfs3S>X0%0pJ}
z{5dZbKU!jK3COLpCp29l+ak)8&o$3q!15>j;tyxK@$P0USC6C5ko(F+9IYNLH8`2Q
z{Br&R=bGS)x3ymjG_EP>y@Mgs3Lg!j?wV=tU$`t9gh*gL0cYA;gn!N-`-b5yG+WLl
zhBW5G`GE~OQAzvwtLDCwhB?*ZglTcRWA8?l<PK&T7y3^Z`MsK$a3=0Krg|Z}(~Y07
z5hByK@Z~utv~440UD8HHg3F<bzo7nrU&R6qw>(VcHHrPF2a>x{=s4FtpR9l6P(+t0
zM*fBRwc38*rr!dmd{^I-)|s`mbnL{t(@4dQVvl0m4%ZleCb?+J?6+CkaZxAB)Oqp1
z_tfqh>KjrZ7bgmqh}$(m-@jKAbR`9Oo|;8h&M|03a|lI<@f!V!B~{jfn!M`%R|(AZ
z^7@-40h_IovE*ah$~-4dUZ<Fu%SUmG=R=+J2|X3yg3@q*q3uY3!;D(T{3JyV4!<#6
z?fI^o4aY9i_F$r)W4P7qw<97Lmp<RaNc^-XHZ%=nYW+}pvS!hF*m11`$nJJkgej*k
z@6m$IV<=RvRGWxt_QA7-%9z)(g!i=F-Y(uvODdK?2wD37ZIc~caQZQ9gb-rKh+Bpj
z(qU8~>1rk_V<VxlzWcd+$Jm`X-_Hd%#s#=bSwft99vyX~&bFQ$Mc1uirx&L2@v0da
zy~t&envqavR0!4ixq8;^uNUn@K6Tu_Co@HzKR0dIyp^TEaJj6@$7c<fQp;QQOA*7v
zP#2@xIvSx1&yYiy#LHVbDc`lZ8MkPQGkUCgTvu2lrz($-t`FJ2oK&?Du-nT2Uj;U_
zlMak8a&%K=*}PJvxl*vJH3mPnYMx~+WXU1i2e>dkEeygGB5<zK;eW|r7nPIfR1LJa
z@OQzQ*eHAbk2jVMn^H8cOJYtFFR1MQGO$6V0cE{*qW=#7@9$S01$`!CiA$;@V|3W0
zKM#V+Dg$Ku`3m~zu<w?nBpp$28?^u;H5G5*ek(SM8tI30*dArWJr+r-h>uWO+pLPa
zbU<4LmsRxgAtrJ4D@jJM;Fh;SoqyFkTwS{@z8QfaxXP;9JUA}I3CbK9I=*6!o*UUs
zAA}2ay5$T1fFcO!+_sfF?HE-|W2v}Oqme@z>%8oW(AY-AWt4v!eyH-B?*oxbq@<hc
z1osis0e+JbV#V=Sn|x{l;}zAnAM?iLQ2;b`9O&%kT~$;_!fBiGJy=$<ogZqf8}_j&
zZMAGhMn5v9#6BaMu`e6VA%@^il(4TTIy_jNw=<VsVptJ(000lY%1CnUNPFR<GCG_7
zTkM-|B_>Bh^R|&0!>CWbjrtl4vs{)|x?!+us$*+C>nPdr$xd|+`BOP#I(emAoiKA{
z7}t768RtL<q%FA?L2wf_K;1J}b@)0rS1{s<vv9MbL>!ca2;Z5~Rb#g=6Ubu^Y}7oM
z+w8DMQIED(n$o@7{A~(j_aM|Ro;Yp7IN0G=P4jkio(&(eez6@spAnp6QoYk+3N!?i
z!wWS2O5<_zkyB(Y?&Xn@^<)QwIE8$epWchX++rYm+jHJ?O?R>4c~6c!qhQgXJ%g}f
zc)XIrMnSoT#=hptdYMTKZ{I%<FNkj<XcF$GoHVAVqr^1}uFfnm^72$iYSD}r-EHlE
zW<ks8LAOUY_gg?ia6osFU^&fg+(_Mb2(pDQycIOhC->OwVqA%U$XT*EXo(mj;Sb^b
z-%2wT?$F6&sDlq#9ZtlN-YL5<+gs@7baj=Q`|%Oha_8FIzsB^AQ=lC0C^Dja<*czx
z5Z=h|ur@U{&~H-lkanW~rN0Y<6sGd&+i$`Xo~^FjU%|b}p%3YL>RS_EV{fXxF9u<-
zgw}~;$K@8OIV^?;)1RhIFkF*BLX<I10~38dXo@6;z55U=^W2+~#QtdaaI$JG%z_U(
z`*&iS;XP5JC@|Em24E(e$h1<r3V~*SBJx%3UtQAPpBRk3yZ#zN>LbaF4b1hcbRn_-
E15|w%6aWAK

literal 0
HcmV?d00001

diff --git a/public/favicon.ico b/public/favicon.ico
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..c9731e2aa4a4a9cf7e30648fa0266fae30c6bba2 100644
GIT binary patch
literal 15086
zcmeHOS!`5Q7(S#dCT_f-5d^Bypr}cW#s_`DxFkj}K8W$fL=6mWp>@HC5M!GVR1(?J
zM%EBTM5qu1WJwBG7DWvxP^5)|V2~w%&=wS>Eua54XAbwyow+mj-kCeoiJau`+5Y7_
z|5@hTb551&p^8-BzDnX^RoYXjN0d^<#X7%K$`?vmNl7e!w^C2{Q|cb!kt&hU<q|0+
ze8~dJ)j&j4olu()(oh@5sAU+XZl^AksUgCDE{#kwooA^-<W>fd)%u7dqS^z?M^tNq
z?3f<F*Y9a!+L=$~pO1$DXO94Xx9WKEgTN1qfz}gN8F}1vtf>aRtp)b127Xxyl=TAk
zeghodq02Vc0OUy}@2sb;+7Y@PKd%5*Oz<b)ycyW=5%B$|z`?CR#SN+DH_ZYj-D%Ou
zW}sy|uw`~?S+;4~<G?B5KXcfkW4nO~1Kn-9`NDg7CgX?mWw~pAq{mPfn|pr-&~c8k
z(K)E+FL8Kj3wc&@-cq)@2mb~Ol;t{8EHq4r>r*sv;YkxPTHPl&rVBL+T@cE&kEx?k
z^iGrYX{eidj8wgauSTdd3pU*_Q}-;PUUnQY+Z#i)>%>!U#~|t29NIQmX3+;IRribS
zFnw<9Ipa=_2cemHXuHP3F&R<6=FPsIV_wz<r|+_r_p-0hw#Hs3zgNS7nrDIXK8g0z
z)n~GfRNe&qu@_eZ)0H<`7}C`TwLRrwVAof`xntV&=@#H*lTO#YrS0=KmE{a4_DlMZ
zPE&@mQy#K#`o(c{r`BcuHm(P@&DXj0A8NgeMwwb*>pWne@Yn-&__b^Jjh=-s16`da
zC+QApm-vQ!pGS20l`FP-;iZfTMxWo<E<fWbz1QNtiD{$D*l%2$SZ|j%{C;9D^2Yww
zxfUkcDDQ2g<I8hlpSE|e()PJ$^JCM_Yg%A0bEci`=iZomWQM=aTjRtj=OwSTq{hGO
z4b62@<{tZ?Wt+}lJPS-NNiCZWgBSa>=?vMhO>8D`4RND&A80Oq1F$c+9%O4@?p%Ki
zo@6m?r}L-Z`sn(*93T!iI`R{+Zi;-vT%UdWe(@G2e>V2`L4D7?PrmnG{2mC3KT|n=
zXFVX)l?M!+{ML(p1B_O)^I*Tme1oAv^%47<bB1Az+Qe@@V?XKxjo}l)5N2QSJFC`d
zI}V2)4;+*Ggf0qYI>xADU-UamzV+<3m~K_-<_4vTs^yq~Bt@Zy>X@Adu}RxJrzjD6
zMd<1|#a)u|5n|_+W2K$zgqnnMv8K^Rlgy#DLgnV%)dy^aS5-gJ!M^Sg%Cw&|mFKu$
zBy^jXHb|SF6W)A&ySlZvO|T75)ds;`DHP^Bcf;njyi4Y5MY1+X+ny2Z`8cofirw(B
z4I}Jrkh7)%-E_<t%+8qSBUk5x_<n)pojlz=KZkt~JI^kJapUx7M{Io`SAf1ZZ7CD%
z>kAe?f8!$RK*8eA-JZboceZ1$Lz(O3xe&>#F2DR<_4?(j8VWRR1UmlJw7(vxy4SrO
ze);|4@xwoHFmS0Y@x+98(eDmQY=d8ZKUlo-PAmpC&IESW>HBhn-uU0-w=amtKkr33
z|CaMc6P)~Ke$zUsn>M`S@xwR%7U04egCIVh{sb`fF{|u&qlJO@=be|WI;N&RDre14
z#+R8KZH(_{$@{^Wiua2$V<9oFpAL{rIJm{K|4x5XYQ^=_q#tKkd1q>IsU@EZlb<@i
zb1;G9XU8IwON{H@wCpFt@08$M2kJDz`KH1TPB&gVex^%%>bD-oriu5gk-DPf_%B~F
zTvlxOo%-Ey1T9adpKoR6zogH{d0x$V$}+nRyZ_H0cjr&0->xUqbWr_H{BAgc>UY!U
zEDx&R3x3{t9{JH4Q>&}u`_PFcNIoq5#D3^I3p?)%?e};=uqKlU13&K;4m8ALUs{=c
z-?Kg0#-B^<*}~7eX7kpp{dBzFzpMzy?`A9o_5b@rES$+w9PeRc&&2-|1|&nR%eXIE
zGB#YlC-Xml>*tR2M&=%xh}%wC?;QC)gYQF({;=aE<?ep;TJ!s^+~IZl<Lz4k-d|@D
z!q`_jai+>ox&z>QSB@V)wBs{i&I|eTeX2HHtNXwAOD^uT!tyb(x8!UM&i-6!7VL$7
ze#<+ru=+P_y}a8UBvgp^7oFyASnw|_z&@C7?(kywFom=Zwc|C_-{6nlgGJQy(g)r7
z?$^wvF5a=*v75A%zuwK;K>t=6yvbszXFqhuvDEJ7cV|0d_t|r$9o=DFqR;CDQ?V0g
zy1d8@;(G(34U*<>T{hkwnQ`nE(?)a5<~Z{|Q*KzVu%b$-e;5yrzFU&lLrNWGzK>E3
qjEm&|rWngBCKEGzEm$6?X42-L2Ij?YM;VJB<xN)9ug1^D@BaZow7QxA

literal 0
HcmV?d00001

diff --git a/public/favicon.svg b/public/favicon.svg
new file mode 100644
index 0000000..3c826f6
--- /dev/null
+++ b/public/favicon.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <!-- Mesmo logo da sidebar: quadrado azul (cor primary do tema, #0066ff) com o ícone "truck" do lucide em branco -->
+  <rect width="64" height="64" rx="16" fill="#0066ff"/>
+  <g transform="translate(12.8 12.8) scale(1.6)" fill="none" stroke="#ffffff" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M5 18H3c-.6 0-1-.4-1-1V7c0-.6.4-1 1-1h10c.6 0 1 .4 1 1v11"/>
+    <path d="M14 9h4l4 4v4c0 .6-.4 1-1 1h-2"/>
+    <circle cx="7" cy="18" r="2"/>
+    <circle cx="17" cy="18" r="2"/>
+  </g>
+</svg>
diff --git a/server/index.ts b/server/index.ts
index 0eb9348..cb50749 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -14,6 +14,11 @@ import { automacoesRouter } from "./routes/automacoes";
 import { prazosRouter } from "./routes/prazos";
 import { usuariosRouter } from "./routes/usuarios";
 import { perfilRouter } from "./routes/perfil";
+import { SupabaseAdminService } from "./services/supabase-admin.server";
+import { PrazoService } from "./services/prazo.server";
+import { PastaService } from "./services/pasta.server";
+import { OrdemColunasService } from "./services/config.server";
+import { DashboardService } from "./services/dashboard.server";
 
 //Em produção, serve o build estático do SPA com fallback para index.html
 const clientDist = path.resolve(process.cwd(), "dist/client");
@@ -89,6 +94,21 @@ app.use((err: any, _req: express.Request, res: express.Response, _next: express.
 const port = Number(process.env.PORT) || 3000;
 app.listen(port, () => {
   console.log(`[Logicell API] rodando em http://localhost:${port}`);
+
+  // Aquecimento: popula os caches em memória logo no boot para que o
+  // primeiro request de cada usuário não pague a ida ao Supabase/banco.
+  // Erros aqui não derrubam o servidor — só ficam registrados no log.
+  Promise.allSettled([
+    SupabaseAdminService.listarUsuarios(),
+    PrazoService.regras(),
+    PastaService.listar(),
+    OrdemColunasService.get(),
+    DashboardService.opcoes(),
+  ]).then((resultados) => {
+    resultados.forEach((r) => {
+      if (r.status === "rejected") console.error("[Aquecimento] falhou:", r.reason);
+    });
+  });
 });
 
 export type { AuthedResponse };
diff --git a/server/lib/cache.ts b/server/lib/cache.ts
new file mode 100644
index 0000000..4a57f93
--- /dev/null
+++ b/server/lib/cache.ts
@@ -0,0 +1,17 @@
+//Cache em memória com TTL para dados que mudam pouco (usuários do Supabase,
+//ordem de colunas, regras de prazo). Uma instância só: sem Redis por ora.
+interface Entry { value: unknown; expiresAt: number }
+const store = new Map<string, Entry>();
+
+export async function getOrSet<T>(key: string, ttlMs: number, loader: () => Promise<T>): Promise<T> {
+  const hit = store.get(key);
+  if (hit && Date.now() < hit.expiresAt) return hit.value as T;
+  const value = await loader();
+  store.set(key, { value, expiresAt: Date.now() + ttlMs });
+  return value;
+}
+
+export function invalidate(prefix?: string): void {
+  if (!prefix) { store.clear(); return; }
+  for (const k of store.keys()) if (k.startsWith(prefix)) store.delete(k);
+}
diff --git a/server/lib/http.ts b/server/lib/http.ts
deleted file mode 100644
index 3324e3a..0000000
--- a/server/lib/http.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { Response } from "express";
-
-//Aplica os headers (ex.: Set-Cookie gerado pelo Supabase ao renovar tokens)
-//produzidos pelo client SSR nas rotas do Express.
-export function applySupabaseHeaders(res: Response, headers: Headers): void {
-  const anyHeaders = headers as any;
-  const setCookies: string[] =
-    typeof anyHeaders.getSetCookie === "function" ? (anyHeaders.getSetCookie() as string[]) : [];
-
-  headers.forEach((value, key) => {
-    if (key.toLowerCase() === "set-cookie") return;
-    res.setHeader(key, value);
-  });
-
-  setCookies.forEach((cookie) => res.append("Set-Cookie", cookie));
-}
diff --git a/server/middlewares/auth.ts b/server/middlewares/auth.ts
index 0f29185..b7e015f 100644
--- a/server/middlewares/auth.ts
+++ b/server/middlewares/auth.ts
@@ -1,10 +1,6 @@
 import type { NextFunction, Request, Response } from "express";
-import {
-  requireAdminByCookie,
-  resolveAuth,
-  type AuthedUser,
-} from "../services/auth.server";
-import { applySupabaseHeaders } from "../lib/http";
+import { resolveAuth, type AuthedUser } from "../services/auth.server";
+import { SupabaseAdminService } from "../services/supabase-admin.server";
 
 export interface AuthedResponse extends Response {
   locals: { user?: AuthedUser; [key: string]: any };
@@ -23,17 +19,27 @@ export function getUser(res: AuthedResponse): AuthedUser {
   return res.locals.user;
 }
 
+//A sessão é local (cookie de 30 dias, sem rede). Para um bloqueio ou exclusão
+//feitos depois do login valerem antes disso, confere o usuário na lista
+//cacheada do Supabase: sem rede na maioria das requests (cache de 10 min,
+//invalidado na hora pelas telas de usuários). Se o Supabase estiver fora, a
+//consulta devolve undefined e a request segue só com o cookie.
 export async function requireUser(req: Request, res: AuthedResponse, next: NextFunction) {
   try {
-    const { user, headers } = await resolveAuth(getCookieHeader(req));
+    const user = resolveAuth(getCookieHeader(req));
     if (!user) {
       const err: any = new Error("Não autenticado");
       err.status = 401;
       throw err;
     }
-    // Aplica cookies de rotação do refresh_token — sem isso, o Supabase renova
-    // o token a cada request e estoura o rate-limit de auth (429).
-    applySupabaseHeaders(res, headers);
+
+    const conta = await SupabaseAdminService.buscarPorId(user.id);
+    if (conta === null || conta?.bloqueado) {
+      const err: any = new Error("Sessão encerrada. Entre novamente.");
+      err.status = 401;
+      throw err;
+    }
+
     res.locals.user = user;
     next();
   } catch (err) {
@@ -41,13 +47,28 @@ export async function requireUser(req: Request, res: AuthedResponse, next: NextF
   }
 }
 
+//Além do cookie dizer "admin", confere na lista cacheada que o usuário continua
+//admin — rebaixamento pelo app vale na hora (invalidação), pelo painel do
+//Supabase em até 10 min (TTL do cache), sem chamada remota por request.
 export async function requireAdmin(req: Request, res: AuthedResponse, next: NextFunction) {
   try {
-    const { user, headers } = await requireAdminByCookie(getCookieHeader(req));
-    applySupabaseHeaders(res, headers);
+    const user = resolveAuth(getCookieHeader(req));
+    if (!user || user.app_metadata.role !== "admin") {
+      const err: any = new Error("Acesso restrito a administradores");
+      err.status = 403;
+      throw err;
+    }
+
+    const admin = await SupabaseAdminService.buscarPorId(user.id);
+    if (!admin || admin.bloqueado || admin.role !== "admin") {
+      const err: any = new Error("Acesso restrito a administradores");
+      err.status = 403;
+      throw err;
+    }
+
     res.locals.user = user;
     next();
   } catch (err) {
     next(err);
   }
-}
\ No newline at end of file
+}
diff --git a/server/routes/auth.ts b/server/routes/auth.ts
index 735f190..3a31250 100644
--- a/server/routes/auth.ts
+++ b/server/routes/auth.ts
@@ -1,12 +1,13 @@
 import { Router } from "express";
-import { createSupabaseServerClient } from "../services/supabase.server";
+import { createSupabaseAuthClient } from "../services/supabase.server";
 import { sessionStorage } from "../services/session.server";
 import { resolveAuth } from "../services/auth.server";
 import { getCookieHeader } from "../middlewares/auth";
-import { applySupabaseHeaders } from "../lib/http";
 
 export const authRouter = Router();
 
+const SESSAO_DURACAO_SEGUNDOS = 60 * 60 * 24 * 30; // 30 dias
+
 authRouter.post("/login", async (req, res, next) => {
   try {
     const email = String(req.body?.email || "").trim();
@@ -17,49 +18,38 @@ authRouter.post("/login", async (req, res, next) => {
       return;
     }
 
-    const cookieHeader = getCookieHeader(req);
-    const { supabase, response } = await createSupabaseServerClient(cookieHeader);
-
+    const supabase = createSupabaseAuthClient();
     const { data, error } = await supabase.auth.signInWithPassword({ email, password });
 
-    if (error) {
-      res.status(401).json({ error: error.message });
+    if (error || !data.user) {
+      res.status(401).json({ error: error?.message || "Não autenticado" });
       return;
     }
 
-    const session = sessionStorage.getSession(cookieHeader);
-    session.access_token = data.session?.access_token;
-    session.refresh_token = data.session?.refresh_token;
-
-    applySupabaseHeaders(res, response.headers);
-    res.append("Set-Cookie", sessionStorage.commitSession(session));
+    // Sessão própria de 30 dias: só o que cabe no cookie, sem tokens do
+    // Supabase e sem renovação remota depois disso (ver session.server.ts).
+    res.append("Set-Cookie", sessionStorage.commitSession({
+      sub: data.user.id,
+      email: data.user.email || "",
+      role: data.user.app_metadata?.role === "admin" ? "admin" : "usuario",
+      nome: data.user.user_metadata?.nome || "",
+      exp: Math.floor(Date.now() / 1000) + SESSAO_DURACAO_SEGUNDOS,
+    }));
     res.json({ success: true });
   } catch (err) {
     next(err);
   }
 });
 
-authRouter.post("/logout", async (req, res, next) => {
-  try {
-    const cookieHeader = getCookieHeader(req);
-    const { supabase, response } = await createSupabaseServerClient(cookieHeader, {
-      skipSessionSync: true,
-    });
-    await supabase.auth.signOut().catch(() => null);
-
-    applySupabaseHeaders(res, response.headers);
-    res.append("Set-Cookie", sessionStorage.destroySession());
-    res.json({ success: true });
-  } catch (err) {
-    next(err);
-  }
+authRouter.post("/logout", (_req, res) => {
+  res.append("Set-Cookie", sessionStorage.destroySession());
+  res.json({ success: true });
 });
 
 //Retorna o usuário autenticado ou null (200) — o cliente decide o redirect.
-authRouter.get("/me", async (req, res, next) => {
+authRouter.get("/me", (req, res, next) => {
   try {
-    const { user, headers } = await resolveAuth(getCookieHeader(req));
-    applySupabaseHeaders(res, headers);
+    const user = resolveAuth(getCookieHeader(req));
     res.json({ user });
   } catch (err) {
     next(err);
diff --git a/server/routes/perfil.ts b/server/routes/perfil.ts
index 398dcf8..99cb52e 100644
--- a/server/routes/perfil.ts
+++ b/server/routes/perfil.ts
@@ -1,8 +1,8 @@
 import { Router } from "express";
 import prisma from "../lib/prisma.server";
-import { createSupabaseServerClient } from "../services/supabase.server";
+import { SupabaseAdminService } from "../services/supabase-admin.server";
+import { sessionStorage, getSession } from "../services/session.server";
 import { getUser, getCookieHeader, type AuthedResponse } from "../middlewares/auth";
-import { applySupabaseHeaders } from "../lib/http";
 
 export const perfilRouter = Router();
 
@@ -19,11 +19,10 @@ function parseId(value: any): number {
 perfilRouter.get("/", async (_req, res: AuthedResponse, next) => {
   try {
     const user = getUser(res);
-    const totalPlanilhas = await prisma.importacao.count();
-    const ultimasImportacoes = await prisma.importacao.findMany({
-      orderBy: { createdAt: "desc" },
-      take: 5,
-    });
+    const [totalPlanilhas, ultimasImportacoes] = await Promise.all([
+      prisma.importacao.count(),
+      prisma.importacao.findMany({ orderBy: { createdAt: "desc" }, take: 5 }),
+    ]);
 
     res.json({ user, ultimasImportacoes, stats: { totalPlanilhas } });
   } catch (err) {
@@ -34,23 +33,18 @@ perfilRouter.get("/", async (_req, res: AuthedResponse, next) => {
 perfilRouter.patch("/", async (req, res: AuthedResponse, next) => {
   try {
     const user = getUser(res);
-    const cookieHeader = getCookieHeader(req);
     const nome = String(req.body?.nome || "").trim();
     if (!nome) {
       res.status(400).json({ error: "Nome não pode estar vazio" });
       return;
     }
 
-    const { supabase, response } = await createSupabaseServerClient(cookieHeader);
-    const { error } = await supabase.auth.updateUser({
-      data: { nome, nickname: nome },
-    });
+    await SupabaseAdminService.renomear(user.id, nome);
 
-    applySupabaseHeaders(res, response.headers);
-    if (error) {
-      res.status(400).json({ error: error.message });
-      return;
-    }
+    // Atualiza o cookie de sessão com o novo nome — sem isso, o nome só
+    // mudaria no próximo login (a sessão é local, ver session.server.ts).
+    const session = getSession(getCookieHeader(req));
+    res.append("Set-Cookie", sessionStorage.commitSession({ ...session, nome }));
 
     res.json({ success: true, user: { ...user, user_metadata: { ...user.user_metadata, nome } } });
   } catch (err) {
diff --git a/server/routes/usuarios.ts b/server/routes/usuarios.ts
index 51ea24a..6927a14 100644
--- a/server/routes/usuarios.ts
+++ b/server/routes/usuarios.ts
@@ -2,6 +2,7 @@ import { Router } from "express";
 import { SupabaseAdminService } from "../services/supabase-admin.server";
 import { PastaService } from "../services/pasta.server";
 import { getUser, type AuthedResponse } from "../middlewares/auth";
+import { invalidate } from "../lib/cache";
 
 export const usuariosRouter = Router();
 
@@ -76,6 +77,7 @@ usuariosRouter.post("/", async (req, res: AuthedResponse, next) => {
     }
 
     const usuario = await SupabaseAdminService.criarUsuario({ email, senha, nome, role });
+    invalidate("usuarios");
     res.json({ success: true, mensagem: `Usuário "${usuario.email}" criado com sucesso.` });
   } catch (err) {
     next(traduzirErroSupabase(err));
@@ -116,6 +118,7 @@ usuariosRouter.patch("/:id", async (req, res: AuthedResponse, next) => {
     await SupabaseAdminService.renomear(usuarioId, nome);
     await SupabaseAdminService.atualizarCargo(usuarioId, role);
     if (novaSenha) await SupabaseAdminService.redefinirSenha(usuarioId, novaSenha);
+    invalidate("usuarios");
 
     res.json({
       success: true,
@@ -136,6 +139,7 @@ usuariosRouter.post("/:id/bloquear", async (req, res: AuthedResponse, next) => {
     }
     await PastaService.removerFaturista(usuarioId);
     await SupabaseAdminService.bloquear(usuarioId);
+    invalidate("usuarios");
     res.json({ success: true, mensagem: "Usuário bloqueado com sucesso. As pastas em que ele era faturista ficaram sem responsável." });
   } catch (err) {
     next(traduzirErroSupabase(err));
@@ -146,6 +150,7 @@ usuariosRouter.post("/:id/ativar", async (req, res: AuthedResponse, next) => {
   try {
     const usuarioId = parseId(req.params.id);
     await SupabaseAdminService.ativar(usuarioId);
+    invalidate("usuarios");
     res.json({ success: true, mensagem: "Usuário ativado com sucesso." });
   } catch (err) {
     next(traduzirErroSupabase(err));
@@ -167,6 +172,7 @@ usuariosRouter.delete("/:id", async (req, res: AuthedResponse, next) => {
     }
     await PastaService.removerFaturista(usuarioId);
     await SupabaseAdminService.excluir(usuarioId);
+    invalidate("usuarios");
     res.json({ success: true, mensagem: "Usuário excluído com sucesso. As pastas em que ele era faturista ficaram sem responsável." });
   } catch (err) {
     next(traduzirErroSupabase(err));
diff --git a/server/services/auth.server.ts b/server/services/auth.server.ts
index e04b986..86c51f2 100644
--- a/server/services/auth.server.ts
+++ b/server/services/auth.server.ts
@@ -1,135 +1,27 @@
 import { getSession } from "./session.server";
-import { createSupabaseServerClient } from "./supabase.server";
 
 export interface AuthedUser {
   id: string;
-  aud?: string;
-  role?: string;
   email?: string;
-  app_metadata?: any;
-  user_metadata?: any;
-  created_at?: string;
+  app_metadata: { role: string };
+  user_metadata: { nome: string };
 }
 
-function parseJwt(token: string): Record<string, any> | null {
-  try {
-    const base64Url = token.split(".")[1];
-    const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-    const jsonPayload = decodeURIComponent(
-      atob(base64)
-        .split("")
-        .map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2))
-        .join("")
-    );
-    return JSON.parse(jsonPayload);
-  } catch {
-    return null;
-  }
-}
-
-export function isAdmin(user: any) {
-  return user?.app_metadata?.role === "admin";
-}
-
-//Validação local ultra-rápida (0ms de rede): decodifica o JWT do cookie.
-//Enquanto o token ainda não expirou, retorna o usuário SEM chamar o Supabase
-//— isso evita gastar o rate-limit de auth a cada request.
-export function getUserFromJwt(cookieHeader?: string | null): AuthedUser | null {
-  const session = getSession(cookieHeader);
-  const accessToken = session.access_token;
-  if (!accessToken) return null;
-
-  const decoded = parseJwt(accessToken);
-  const now = Math.floor(Date.now() / 1000);
-
-  if (decoded && decoded.exp > now) {
-    return {
-      id: decoded.sub,
-      aud: decoded.aud || "authenticated",
-      role: decoded.role || "authenticated",
-      email: decoded.email,
-      app_metadata: decoded.app_metadata || {},
-      user_metadata: decoded.user_metadata || {},
-      created_at: "",
-    };
-  }
-  return null;
-}
-
-//Cache em memória da validação remota por access token. Quando o token expira,
-//o refresh do Supabase é caro (rede) e rotaciona o refresh_token — sem cache,
-//vários requests paralelos tentavam renovar ao mesmo tempo, estourando o
-//rate-limit de auth (429). Com cache, renovamos no máximo 1x a cada 30s.
-const remoteUserCache = new Map<string, { user: AuthedUser | null; ts: number }>();
-const REMOTE_CACHE_TTL = 30_000;
-
-//Resolve o usuário da requisição e retorna também os headers gerados pelo
-//Supabase (ex.: Set-Cookie com o refresh_token rotacionado). O middleware de
-//auth deve aplicar esses headers na resposta para NÃO repetir o refresh em
-//todo request.
-export async function resolveAuth(
-  cookieHeader?: string | null
-): Promise<{ user: AuthedUser | null; headers: Headers }> {
-  const local = getUserFromJwt(cookieHeader);
-  if (local) return { user: local, headers: new Headers() };
-
+//Resolve o usuário direto do cookie de sessão (HMAC, ver session.server.ts):
+//nenhuma chamada de rede ao Supabase por request. Cookie ausente, inválido ou
+//com `exp` vencido (sessão de 30 dias) resolve para null — sem sessão remota
+//para renovar, o cliente decide o redirect para o login.
+export function resolveAuth(cookieHeader?: string | null): AuthedUser | null {
   const session = getSession(cookieHeader);
-  const accessToken = session.access_token;
-
-  if (accessToken) {
-    const cached = remoteUserCache.get(accessToken);
-    if (cached && Date.now() - cached.ts < REMOTE_CACHE_TTL) {
-      return { user: cached.user, headers: new Headers() };
-    }
-  }
+  if (!session.sub || !session.exp) return null;
 
-  try {
-    const { supabase, response } = await createSupabaseServerClient(cookieHeader);
-    const {
-      data: { user },
-      error,
-    } = await supabase.auth.getUser();
-
-    const result = (user as AuthedUser) ?? null;
-    if (!error && accessToken) {
-      remoteUserCache.set(accessToken, { user: result, ts: Date.now() });
-    }
-    return { user: result, headers: response.headers };
-  } catch {
-    // Falha de rede / rate-limit transitório: não derruba a sessão se ainda
-    // existe um token local minimamente válido.
-    return { user: getUserFromJwt(cookieHeader), headers: new Headers() };
-  }
-}
+  const agora = Math.floor(Date.now() / 1000);
+  if (session.exp < agora) return null;
 
-//Verifica se há um usuário sem disparar redirect.
-export async function getUserByCookie(cookieHeader?: string | null): Promise<AuthedUser | null> {
-  const { user } = await resolveAuth(cookieHeader);
-  return user;
+  return {
+    id: session.sub,
+    email: session.email,
+    app_metadata: { role: session.role === "admin" ? "admin" : "usuario" },
+    user_metadata: { nome: session.nome || "" },
+  };
 }
-
-//Validação REMOTA (getUser) para que rebaixamentos e bloqueios de cargo
-//tenham efeito imediato no acesso. Também aplica a rotação do refresh token.
-export async function requireAdminByCookie(
-  cookieHeader?: string | null
-): Promise<{ user: AuthedUser; headers: Headers }> {
-  const { supabase, response } = await createSupabaseServerClient(cookieHeader);
-  const {
-    data: { user },
-    error,
-  } = await supabase.auth.getUser();
-
-  if (error || !user) {
-    const err: any = new Error("Não autenticado");
-    err.status = 401;
-    throw err;
-  }
-
-  if (!isAdmin(user)) {
-    const err: any = new Error("Acesso restrito a administradores");
-    err.status = 403;
-    throw err;
-  }
-
-  return { user: user as AuthedUser, headers: response.headers };
-}
\ No newline at end of file
diff --git a/server/services/config.server.ts b/server/services/config.server.ts
index ae24815..8b53c7f 100644
--- a/server/services/config.server.ts
+++ b/server/services/config.server.ts
@@ -1,22 +1,30 @@
 import db from "../lib/prisma.server";
+import { getOrSet, invalidate } from "../lib/cache";
+
+const ORDEM_CACHE_KEY = "ordemColunas";
+const ORDEM_TTL = 1000 * 60 * 10; // 10 minutos
 
 export const OrdemColunasService = {
   get: async () => {
-    const conf = await db.ordemColunas.findUnique({ where: { id: 1 } });
-    if (!conf) return null;
-    try {
-      return JSON.parse(conf.ordem);
-    } catch {
-      return conf.ordem;
-    }
+    return getOrSet(ORDEM_CACHE_KEY, ORDEM_TTL, async () => {
+      const conf = await db.ordemColunas.findUnique({ where: { id: 1 } });
+      if (!conf) return null;
+      try {
+        return JSON.parse(conf.ordem);
+      } catch {
+        return conf.ordem;
+      }
+    });
   },
-  
+
   set: async (valor: any) => {
     const v = typeof valor === 'string' ? valor : JSON.stringify(valor);
-    return db.ordemColunas.upsert({
+    const resultado = await db.ordemColunas.upsert({
       where: { id: 1 },
       update: { ordem: v },
       create: { id: 1, ordem: v }
     });
+    invalidate(ORDEM_CACHE_KEY);
+    return resultado;
   }
 };
diff --git a/server/services/dashboard.server.ts b/server/services/dashboard.server.ts
index 804ed27..452ea74 100644
--- a/server/services/dashboard.server.ts
+++ b/server/services/dashboard.server.ts
@@ -256,11 +256,6 @@ function parseDataUTC(valor: any): Date | null {
 //faturista. Otimizado para a latência do banco: poucas idas ao banco + cache em
 //memória (o cache só é usado quando não há filtros ativos).
 export class DashboardService {
-  // Nomes dos faturistas vêm do Supabase (rede) — cache longo.
-  private static nomesCache: Map<string, string> | null = null;
-  private static nomesCacheTime = 0;
-  private static readonly NOMES_TTL = 1000 * 60 * 10; // 10 minutos
-
   // O resumo inteiro é cacheado no servidor: o client já faz polling de 30s,
   // então o custo alto (rede + Supabase) acontece no máximo 1x por 30s.
   private static resumoCache: DashboardResumo | null = null;
@@ -271,10 +266,9 @@ export class DashboardService {
   private static opcoesCacheTime = 0;
   private static readonly OPCOES_TTL = 1000 * 60 * 5;
 
+  // Lista de usuários já vem cacheada de SupabaseAdminService (A6a) — sem
+  // cache próprio aqui para não duplicar a mesma informação em dois lugares.
   private static async nomesFaturista(): Promise<Map<string, string>> {
-    if (this.nomesCache && Date.now() - this.nomesCacheTime < this.NOMES_TTL) {
-      return this.nomesCache;
-    }
     const nomes = new Map<string, string>();
     try {
       const { usuarios } = await SupabaseAdminService.listarUsuarios(1, 1000);
@@ -282,8 +276,6 @@ export class DashboardService {
     } catch {
       // mantém fallback (id) se o Supabase falhar
     }
-    this.nomesCache = nomes;
-    this.nomesCacheTime = Date.now();
     return nomes;
   }
 
diff --git a/server/services/operacao.server.ts b/server/services/operacao.server.ts
index 4615acd..d423567 100644
--- a/server/services/operacao.server.ts
+++ b/server/services/operacao.server.ts
@@ -84,8 +84,11 @@ export class OperacaoService {
     // Uma única ida ao banco: COUNT e SUM vêm como colunas de janela (OVER()),
     // eliminando a segunda query (COUNT+SUM) que antes dobrava o round-trip
     // de rede — o gargalo real aqui é latência (VPS/DB na Europa), não o SQL.
-    const data = await prisma.$queryRawUnsafe<any[]>(`
-        SELECT 
+    // As duas outras queries (placas duplicadas e regras de prazo) não dependem
+    // do resultado da principal: disparam todas juntas no mesmo Promise.all.
+    const [data, placasDuplicadas, regras] = await Promise.all([
+      prisma.$queryRawUnsafe<any[]>(`
+        SELECT
           o.id, o.nm_agencia, o.dt_emissao_, o.cd_pessoa_pagador, o.nm_pessoa_pagador,
           o.nr_cpf_cnpj_raiz, o.nr_cpf_cnpj_pagador, o.nr_ctrc, o.status, o.comentarios,
           o.id_tipo_documento, o.nm_pessoa_remetente, o.nm_cidade_origem, o.ds_sigla_origem,
@@ -99,9 +102,7 @@ export class OperacaoService {
         ${whereClause.sql}
         ${orderClause}
         LIMIT ${l} OFFSET ${offset}
-      `, ...whereClause.params);
-
-    const [placasDuplicadas, regras] = await Promise.all([
+      `, ...whereClause.params),
       this.placasDuplicadasDaPasta(pid),
       PrazoService.regras(),
     ]);
@@ -302,24 +303,23 @@ export class OperacaoService {
     } else if (campo.startsWith("vl_")) {
       valorLimpo = Number(valorNovo.replace(",", "."));
     }
-    
-    const dataUpdate: any = { [campo]: valorLimpo };
+
     if (campo === "status") {
-      const operacaoAtual = await prisma.operacao.findUnique({
-        where: { id },
-        select: { status: true }
-      });
-      if (operacaoAtual?.status !== valorLimpo) {
-        dataUpdate.data_status = new Date();
-      }
+      // Uma única ida ao banco: o CASE só grava data_status quando o status
+      // muda de fato (IS DISTINCT FROM cobre o caso de status atual nulo) —
+      // antes eram 2 idas (findUnique para comparar + update).
+      await prisma.$executeRawUnsafe(
+        `UPDATE "Operacao"
+         SET status = $1,
+             data_status = CASE WHEN status IS DISTINCT FROM $1 THEN now() ELSE data_status END
+         WHERE id = $2`,
+        valorLimpo,
+        id
+      );
+      return;
     }
-    
-    const operacaoAtualizada = await prisma.operacao.update({ 
-      where: { id }, 
-      data: dataUpdate 
-    });
 
-    return operacaoAtualizada;
+    await prisma.operacao.update({ where: { id }, data: { [campo]: valorLimpo } });
   }
 
   static async bulkUpdate(ids: number[], campo: string, valor: string) {
diff --git a/server/services/session.server.ts b/server/services/session.server.ts
index cc7506f..0925af5 100644
--- a/server/services/session.server.ts
+++ b/server/services/session.server.ts
@@ -8,9 +8,15 @@ if (!sessionSecret) {
 export const SESSION_COOKIE_NAME = "__logicell_session";
 const COOKIE_MAX_AGE = 60 * 60 * 24 * 30; // 30 dias
 
+// Sessão própria (sem Supabase por request): os dados do usuário ficam no
+// próprio cookie, assinado por HMAC. `exp` em segundos Unix, 30 dias a partir
+// do login — sem refresh remoto, ver auth.server.ts.
 export interface SessionData {
-  access_token?: string;
-  refresh_token?: string;
+  sub?: string;
+  email?: string;
+  role?: string;
+  nome?: string;
+  exp?: number;
 }
 
 function sign(value: string): string {
diff --git a/server/services/supabase-admin.server.ts b/server/services/supabase-admin.server.ts
index 33242ea..baa488e 100644
--- a/server/services/supabase-admin.server.ts
+++ b/server/services/supabase-admin.server.ts
@@ -1,4 +1,5 @@
 import { createClient } from "@supabase/supabase-js";
+import { getOrSet } from "../lib/cache";
 
 export interface UsuarioAdmin {
   id: string;
@@ -12,6 +13,10 @@ export interface UsuarioAdmin {
 const ROLE_ADMIN = "admin";
 const ROLE_USUARIO = "usuario";
 const BAN_PERMANENTE = "876000h"; // 100 anos = banimento efetivamente permanente
+//Lista completa de usuários do Supabase muda pouco: cacheada 10 min e paginada
+//em memória (listarUsuarios, contarAdmins e quem mais precisar da lista toda).
+const USUARIOS_CACHE_KEY = "usuarios";
+const USUARIOS_TTL = 1000 * 60 * 10; // 10 minutos
 
 //Client administrativo do Supabase (service_role).
 //IMPORTANTE: Este arquivo é exclusivo do servidor. A service role key
@@ -45,38 +50,56 @@ function mapearUsuario(u: any): UsuarioAdmin {
   };
 }
 
-export const SupabaseAdminService = {
-  //Lista todos os usuários (consultando todas as páginas do Supabase), ordena
-  //alfabeticamente por nome e devolve apenas a fatia da página pedida — assim a
-  //ordenação continua correta mesmo quando a base passa de uma página (200).
-  async listarUsuarios(page = 1, perPage = 200) {
-    const supabase = createSupabaseAdminClient();
-    const totalUsuarios: any[] = [];
+//Busca todas as páginas do Supabase, já mapeadas e ordenadas por nome —
+//chamada só pelo getOrSet abaixo, no máximo 1x a cada TTL.
+async function carregarUsuarios(): Promise<UsuarioAdmin[]> {
+  const supabase = createSupabaseAdminClient();
+  const totalUsuarios: any[] = [];
 
-    for (let pagina = 1; ; pagina++) {
-      const { data, error } = await supabase.auth.admin.listUsers({ page: pagina, perPage: 1000 });
-      if (error) throw error;
+  for (let pagina = 1; ; pagina++) {
+    const { data, error } = await supabase.auth.admin.listUsers({ page: pagina, perPage: 1000 });
+    if (error) throw error;
 
-      const users = data?.users || [];
-      totalUsuarios.push(...users);
+    const users = data?.users || [];
+    totalUsuarios.push(...users);
 
-      if (!users.length || (data?.total ?? 0) <= pagina * 1000) break;
-    }
+    if (!users.length || (data?.total ?? 0) <= pagina * 1000) break;
+  }
 
-    const chave = (u: any) => {
-      const nome = (u.user_metadata?.nome || u.user_metadata?.nickname || u.email || "")
-        .trim()
-        .toLowerCase();
-      return nome.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
-    };
+  const chave = (u: any) => {
+    const nome = (u.user_metadata?.nome || u.user_metadata?.nickname || u.email || "")
+      .trim()
+      .toLowerCase();
+    return nome.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+  };
 
-    totalUsuarios.sort((a, b) => chave(a).localeCompare(chave(b)));
+  totalUsuarios.sort((a, b) => chave(a).localeCompare(chave(b)));
+  return totalUsuarios.map(mapearUsuario);
+}
 
+export const SupabaseAdminService = {
+  //Lista completa vem do cache (getOrSet); a paginação pedida é só uma fatia
+  //em memória — a ordenação continua correta mesmo com a base > 1 página.
+  async listarUsuarios(page = 1, perPage = 200) {
+    const totalUsuarios = await getOrSet(USUARIOS_CACHE_KEY, USUARIOS_TTL, carregarUsuarios);
     const inicio = (page - 1) * perPage;
-    const usuarios = totalUsuarios.slice(inicio, inicio + perPage).map(mapearUsuario);
+    const usuarios = totalUsuarios.slice(inicio, inicio + perPage);
     return { usuarios, total: totalUsuarios.length };
   },
 
+  //Procura um usuário na lista cacheada (sem rede na maioria das vezes).
+  //null = não existe mais; undefined = não deu para consultar (Supabase fora),
+  //e quem chama decide se segue só com o cookie.
+  async buscarPorId(id: string): Promise<UsuarioAdmin | null | undefined> {
+    try {
+      const totalUsuarios = await getOrSet(USUARIOS_CACHE_KEY, USUARIOS_TTL, carregarUsuarios);
+      return totalUsuarios.find((u) => u.id === id) ?? null;
+    } catch (err) {
+      console.error("[Auth] não foi possível consultar a lista de usuários:", err);
+      return undefined;
+    }
+  },
+
   async criarUsuario(dados: { email: string; senha: string; nome: string; role: string }) {
     const supabase = createSupabaseAdminClient();
     const role = dados.role === ROLE_ADMIN ? ROLE_ADMIN : ROLE_USUARIO;
@@ -148,23 +171,9 @@ export const SupabaseAdminService = {
     if (error) throw error;
   },
 
-  //Conta quantos usuários são admin consultando todas as páginas (máx. 1000 por página).
+  //Conta quantos usuários são admin sobre a lista cacheada (sem ida ao Supabase).
   async contarAdmins() {
-    const supabase = createSupabaseAdminClient();
-    let pagina = 1;
-    let totalAdmins = 0;
-
-    for (;;) {
-      const { data, error } = await supabase.auth.admin.listUsers({ page: pagina, perPage: 1000 });
-      if (error) throw error;
-
-      const users = data?.users || [];
-      totalAdmins += users.filter((u: any) => u.app_metadata?.role === ROLE_ADMIN).length;
-
-      if (!users.length || (data?.total ?? 0) <= pagina * 1000) break;
-      pagina += 1;
-    }
-
-    return totalAdmins;
+    const totalUsuarios = await getOrSet(USUARIOS_CACHE_KEY, USUARIOS_TTL, carregarUsuarios);
+    return totalUsuarios.filter((u) => u.role === ROLE_ADMIN).length;
   },
 };
\ No newline at end of file
diff --git a/server/services/supabase.server.ts b/server/services/supabase.server.ts
index 39e8d0e..e7cb1bc 100644
--- a/server/services/supabase.server.ts
+++ b/server/services/supabase.server.ts
@@ -1,10 +1,10 @@
-import { createServerClient, parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
-import { getSession } from "./session.server";
+import { createClient } from "@supabase/supabase-js";
 
-export async function createSupabaseServerClient(
-  cookieHeader?: string | null,
-  options?: { skipSessionSync?: boolean }
-) {
+//Client do Supabase usado exclusivamente pelo login: valida e-mail/senha e
+//devolve os dados do usuário (id, e-mail, role, nome) para montar o cookie de
+//sessão próprio (ver session.server.ts). Sem sincronização de cookies do
+//Supabase — a sessão da aplicação é local, resolvida sem rede (A9).
+export function createSupabaseAuthClient() {
   const supabaseUrl = process.env.VITE_SUPABASE_URL || "";
   const supabaseAnonKey = process.env.VITE_SUPABASE_ANON_KEY || "";
 
@@ -12,37 +12,7 @@ export async function createSupabaseServerClient(
     throw new Error("VITE_SUPABASE_URL and VITE_SUPABASE_ANON_KEY must be set");
   }
 
-  const response = {
-    headers: new Headers(),
-  };
-
-  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
-    cookies: {
-      getAll() {
-        return (cookieHeader ? parseCookieHeader(cookieHeader) : []).map((c) => ({
-          name: c.name,
-          value: c.value ?? "",
-        }));
-      },
-      setAll(cookiesToSet) {
-        cookiesToSet.forEach(({ name, value, options }) =>
-          response.headers.append("Set-Cookie", serializeCookieHeader(name, value, options))
-        );
-      },
-    },
+  return createClient(supabaseUrl, supabaseAnonKey, {
+    auth: { autoRefreshToken: false, persistSession: false },
   });
-
-  // SINCRONIZAÇÃO: Carrega os tokens do nosso cookie de sessão corporativo
-  const session = getSession(cookieHeader);
-  const accessToken = session.access_token;
-  const refreshToken = session.refresh_token;
-
-  if (accessToken && !options?.skipSessionSync) {
-    await supabase.auth.setSession({
-      access_token: accessToken,
-      refresh_token: refreshToken || "",
-    });
-  }
-
-  return { supabase, response };
 }

From e3890f199cf5750f0605073d6caf878fedc8843c Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 09:11:58 -0300
Subject: [PATCH 04/12] =?UTF-8?q?perf:=20bundle=20com=20chunk=20por=20p?=
 =?UTF-8?q?=C3=A1gina?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- A planilha de exportação (xlsx, ~1 MB) só é baixada quando o usuário
  realmente clica em "Exportar Excel", em vez de entrar no pacote inicial.
- Dashboard, Automações, Usuários, Perfil e Login viram pedaços separados do
  bundle, carregados só na primeira vez que a tela é aberta; a tela de
  operações (a mais usada) continua no pacote principal.
- Se um novo deploy apagar os pedaços antigos do site enquanto alguém ainda
  está com a aba aberta, o app recarrega a página sozinho para buscar a
  versão nova (no máximo uma vez por minuto, pra não entrar em loop).
- A folha de estilo das fontes do Google deixou de travar a primeira pintura
  da página: ela carrega em paralelo e só é aplicada quando termina.
---
 app/AppRoutes.tsx            | 45 ++++++++++++++++++++----------------
 app/components/AppLayout.tsx |  8 +++++--
 app/main.tsx                 | 12 ++++++++++
 app/utils/export.ts          |  5 ++--
 app/views/OperacoesView.tsx  |  6 ++---
 index.html                   |  9 ++++++++
 6 files changed, 57 insertions(+), 28 deletions(-)

diff --git a/app/AppRoutes.tsx b/app/AppRoutes.tsx
index 3f28727..af05e42 100644
--- a/app/AppRoutes.tsx
+++ b/app/AppRoutes.tsx
@@ -1,12 +1,15 @@
+import { lazy, Suspense } from "react";
 import { Navigate, Outlet, Route, Routes, useLocation } from "react-router";
 import { useAuth } from "~/context/AuthContext";
 import { AppLayout } from "~/components/AppLayout";
-import { LoginPage } from "~/pages/LoginPage";
-import { DashboardPage } from "~/pages/DashboardPage";
 import { OperacoesPage } from "~/pages/OperacoesPage";
-import { AutomacoesPage } from "~/pages/AutomacoesPage";
-import { UsuariosPage } from "~/pages/UsuariosPage";
-import { PerfilPage } from "~/pages/PerfilPage";
+
+//Páginas menos acessadas ficam em chunks separados, baixados só quando visitadas
+const LoginPage = lazy(() => import("~/pages/LoginPage").then((m) => ({ default: m.LoginPage })));
+const DashboardPage = lazy(() => import("~/pages/DashboardPage").then((m) => ({ default: m.DashboardPage })));
+const AutomacoesPage = lazy(() => import("~/pages/AutomacoesPage").then((m) => ({ default: m.AutomacoesPage })));
+const UsuariosPage = lazy(() => import("~/pages/UsuariosPage").then((m) => ({ default: m.UsuariosPage })));
+const PerfilPage = lazy(() => import("~/pages/PerfilPage").then((m) => ({ default: m.PerfilPage })));
 
 function SplashScreen() {
   return (
@@ -43,24 +46,26 @@ function RequireAdmin() {
 
 export function AppRoutes() {
   return (
-    <Routes>
-      <Route path="/login" element={<LoginPage />} />
+    <Suspense fallback={<SplashScreen />}>
+      <Routes>
+        <Route path="/login" element={<LoginPage />} />
 
-      <Route element={<RequireAuth />}>
-        <Route element={<AppLayout />}>
-          <Route index element={<Navigate to="/caixa-de-entrada" replace />} />
-          <Route path="dashboard" element={<DashboardPage />} />
-          <Route path="caixa-de-entrada" element={<OperacoesPage />} />
-          <Route path="pastas/:nome" element={<OperacoesPage />} />
-          <Route path="automacoes" element={<AutomacoesPage />} />
-          <Route path="perfil" element={<PerfilPage />} />
-          <Route element={<RequireAdmin />}>
-            <Route path="admin/usuarios" element={<UsuariosPage />} />
+        <Route element={<RequireAuth />}>
+          <Route element={<AppLayout />}>
+            <Route index element={<Navigate to="/caixa-de-entrada" replace />} />
+            <Route path="dashboard" element={<DashboardPage />} />
+            <Route path="caixa-de-entrada" element={<OperacoesPage />} />
+            <Route path="pastas/:nome" element={<OperacoesPage />} />
+            <Route path="automacoes" element={<AutomacoesPage />} />
+            <Route path="perfil" element={<PerfilPage />} />
+            <Route element={<RequireAdmin />}>
+              <Route path="admin/usuarios" element={<UsuariosPage />} />
+            </Route>
           </Route>
         </Route>
-      </Route>
 
-      <Route path="*" element={<Navigate to="/" replace />} />
-    </Routes>
+        <Route path="*" element={<Navigate to="/" replace />} />
+      </Routes>
+    </Suspense>
   );
 }
diff --git a/app/components/AppLayout.tsx b/app/components/AppLayout.tsx
index ca81290..d232f12 100644
--- a/app/components/AppLayout.tsx
+++ b/app/components/AppLayout.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { Suspense, useCallback, useEffect, useMemo, useState } from "react";
 import { Outlet } from "react-router";
 import { useAuth } from "~/context/AuthContext";
 import { UIContext } from "~/hooks/use-ui";
@@ -71,7 +71,11 @@ export function AppLayout() {
           setIsCollapsed={setIsCollapsed}
         />
         <main className="flex-1 flex flex-col min-w-0 bg-transparent overflow-hidden h-full">
-          <Outlet />
+          {/* Boundary interno: enquanto o chunk de uma página lazy baixa, a
+              sidebar continua no lugar (o Suspense de AppRoutes só cobre o login) */}
+          <Suspense fallback={null}>
+            <Outlet />
+          </Suspense>
         </main>
       </div>
 
diff --git a/app/main.tsx b/app/main.tsx
index bb90d7a..421bd37 100644
--- a/app/main.tsx
+++ b/app/main.tsx
@@ -6,6 +6,18 @@ import { AuthProvider } from "./context/AuthContext";
 import { AppRoutes } from "./AppRoutes";
 import "./styles/tailwind.css";
 
+//Um deploy pode apagar os chunks antigos enquanto uma aba aberta ainda os pede
+//(rotas lazy). Recarrega a página para buscar os chunks novos, no máximo 1x/min.
+window.addEventListener("vite:preloadError", () => {
+  const chave = "logicell-last-reload";
+  const agora = Date.now();
+  const ultima = Number(sessionStorage.getItem(chave) || 0);
+  if (agora - ultima > 60_000) {
+    sessionStorage.setItem(chave, String(agora));
+    window.location.reload();
+  }
+});
+
 createRoot(document.getElementById("root")!).render(
   <QueryClientProvider client={queryClient}>
     <BrowserRouter>
diff --git a/app/utils/export.ts b/app/utils/export.ts
index 147246c..5f35e92 100644
--- a/app/utils/export.ts
+++ b/app/utils/export.ts
@@ -1,8 +1,9 @@
-import * as XLSX from "xlsx";
 import { formatarData } from "./formatters";
 
-export function exportarExcel(dados: any[], colunas: any[], nomePasta: string, showAlert: any) {
+export async function exportarExcel(dados: any[], colunas: any[], nomePasta: string, showAlert: any) {
   try {
+    //xlsx só é baixado quando o usuário realmente exporta (~1 MB fora do bundle principal)
+    const XLSX = await import("xlsx");
     const exportData = dados.map(row => {
       const obj: any = {};
       colunas.forEach(col => {
diff --git a/app/views/OperacoesView.tsx b/app/views/OperacoesView.tsx
index edab4c8..e42ce58 100644
--- a/app/views/OperacoesView.tsx
+++ b/app/views/OperacoesView.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useMemo, useRef, useState } from "react";
 import { useLocation, useSearchParams } from "react-router";
 
-import { useOperacoesGridState } from "~/hooks/useOperacoesGridState";
+import { useOperacoesGridState, COLUNAS_OPERACAO } from "~/hooks/useOperacoesGridState";
 import { useOperacoesGridData, isFilterEmpty } from "~/hooks/useOperacoesGridData";
 import { useOperacoesStore } from "~/store/useOperacoesStore";
 import "react-data-grid/lib/styles.css";
@@ -126,9 +126,7 @@ export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport
   const onFillEnd = useMemo(() => (colKey: string) => handleFillEndRef.current(colKey), []);
 
   const lidarExportarExcel = () => {
-    import("~/hooks/useOperacoesGridState").then(({ COLUNAS_OPERACAO }) => {
-      exportarExcel(dadosRef.current, COLUNAS_OPERACAO, nomePasta, showAlert);
-    });
+    exportarExcel(dadosRef.current, COLUNAS_OPERACAO, nomePasta, showAlert);
   };
 
   const colDefs = useMemo(() => getOperacoesColumns({
diff --git a/index.html b/index.html
index d6a1be1..dc8eb9d 100644
--- a/index.html
+++ b/index.html
@@ -11,10 +11,19 @@
     <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="anonymous" />
+    <!-- Fonte não bloqueia a 1ª pintura: carrega como "print" e vira "all" ao terminar -->
     <link
       rel="stylesheet"
       href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&family=Inter:wght@400;500;600&family=JetBrains+Mono:wght@400;700&display=swap"
+      media="print"
+      onload="this.media='all'"
     />
+    <noscript>
+      <link
+        rel="stylesheet"
+        href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&family=Inter:wght@400;500;600&family=JetBrains+Mono:wght@400;700&display=swap"
+      />
+    </noscript>
     <script>
       try {
         if (localStorage.getItem("logicell-theme") === "dark") {

From 5162429386587a4e3f70aad73a9f1d1ab0ad1f50 Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 09:24:28 -0300
Subject: [PATCH 05/12] perf: dashboard atualiza sem piscar e grid edita sem
 varredura na tela toda
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Cache do resumo da dashboard no servidor passa de 30s para 60s, maior que
  o intervalo de atualização automática do cliente, para o segundo poll
  aproveitar o cache em vez de recalcular tudo de novo
- useDashboard e useDashboardFaturista mantêm os números anteriores na tela
  ao trocar de filtro, com uma leve redução de opacidade até a resposta
  nova chegar, em vez de sumir o conteúdo; o polling em segundo plano
  atualiza os números sem mexer na tela
- formatarMoeda reaproveita uma única instância de Intl.NumberFormat em vez
  de criar uma nova a cada valor formatado (grid e dashboard formatam muitos
  valores por render)
- Editar uma célula da grid de operações deixou de re-varrer todas as linhas
  carregadas a cada edição; a atualização local já era aplicada por outro
  caminho, então o passo redundante foi removido
---
 app/lib/query.ts                    |  6 +++++-
 app/utils/formatters.ts             |  6 +++++-
 app/views/DashboardView.tsx         | 16 ++++++++++++----
 app/views/OperacoesView.tsx         |  6 ++----
 server/services/dashboard.server.ts |  6 +++---
 5 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/app/lib/query.ts b/app/lib/query.ts
index 2d41b40..b19d6a5 100644
--- a/app/lib/query.ts
+++ b/app/lib/query.ts
@@ -1,4 +1,4 @@
-import { QueryClient, useQuery } from "@tanstack/react-query";
+import { keepPreviousData, QueryClient, useQuery } from "@tanstack/react-query";
 import { api } from "./api";
 
 export const queryClient = new QueryClient({
@@ -199,6 +199,8 @@ export function useDashboard(filtros: DashboardFiltros = {}) {
     refetchOnWindowFocus: true,
     refetchInterval: 30_000,
     refetchIntervalInBackground: false,
+    // Mantém os números anteriores na tela ao trocar de filtro, até a resposta chegar.
+    placeholderData: keepPreviousData,
   });
 }
 
@@ -227,6 +229,8 @@ export function useDashboardFaturista(
       api.get<DashboardFaturistaDetalhe>(`/dashboard/faturistas/${encodeURIComponent(chave)}${qs}`),
     enabled,
     staleTime: 60_000,
+    // Mantém os números anteriores na tela ao trocar de filtro, até a resposta chegar.
+    placeholderData: keepPreviousData,
   });
 }
 
diff --git a/app/utils/formatters.ts b/app/utils/formatters.ts
index 20fd8c5..2b1cca4 100644
--- a/app/utils/formatters.ts
+++ b/app/utils/formatters.ts
@@ -1,7 +1,11 @@
 //Utilitários de formatação de dados para a UI brasileira.
+//Instância única: criar um Intl.NumberFormat por chamada é caro e a grid/dashboard
+//formatam muitos valores por render.
+const BRL = new Intl.NumberFormat('pt-BR', { style: 'currency', currency: 'BRL' });
+
 export const formatarMoeda = (val: any) => {
   if (val === null || val === undefined) return "-";
-  return new Intl.NumberFormat('pt-BR', { style: 'currency', currency: 'BRL' }).format(Number(val));
+  return BRL.format(Number(val));
 };
 
 export const formatarData = (val: any) => {
diff --git a/app/views/DashboardView.tsx b/app/views/DashboardView.tsx
index 8e52152..e4a4063 100644
--- a/app/views/DashboardView.tsx
+++ b/app/views/DashboardView.tsx
@@ -265,7 +265,7 @@ function FaturistaDetalhe({
   faturistaId: string | null;
   filtros: DashboardFiltros;
 }) {
-  const { data, isLoading, isError } = useDashboardFaturista(faturistaId, filtros, true);
+  const { data, isLoading, isError, isPlaceholderData } = useDashboardFaturista(faturistaId, filtros, true);
 
   if (isLoading) {
     return (
@@ -286,7 +286,10 @@ function FaturistaDetalhe({
   }
 
   return (
-    <div className="px-5 py-5 bg-surface/40">
+    // Ao trocar de filtro, os números anteriores ficam em tela (keepPreviousData)
+    // com opacidade menor até a resposta chegar. isPlaceholderData (e não
+    // isFetching) para o polling em segundo plano não escurecer a tela.
+    <div className={`px-5 py-5 bg-surface/40 transition-opacity duration-200 ${isPlaceholderData ? "opacity-60" : ""}`}>
       <p className="text-[10px] font-bold text-text-dim uppercase tracking-widest mb-4">
         Período: {formatarData(data.primeiraEmissao)} → {formatarData(data.ultimaEmissao)}
       </p>
@@ -489,7 +492,7 @@ function GeralConteudo({
 export function DashboardView() {
   const [filtros, setFiltros] = useState<DashboardFiltros>({});
 
-  const { data, isLoading, isError } = useDashboard(filtros);
+  const { data, isLoading, isError, isPlaceholderData } = useDashboard(filtros);
   const { data: opcoes } = useDashboardOpcoes();
 
   const geral = data?.geral;
@@ -537,7 +540,12 @@ export function DashboardView() {
             </p>
           </div>
         ) : (
-          <GeralConteudo geral={geral} filtros={filtros} />
+          // keepPreviousData mantém os números do filtro anterior em tela; a
+          // opacidade cai um pouco só enquanto eles são placeholder (troca de
+          // filtro), não no polling em segundo plano.
+          <div className={`transition-opacity duration-200 ${isPlaceholderData ? "opacity-60" : ""}`}>
+            <GeralConteudo geral={geral} filtros={filtros} />
+          </div>
         )}
       </div>
     </div>
diff --git a/app/views/OperacoesView.tsx b/app/views/OperacoesView.tsx
index e42ce58..a5e02e5 100644
--- a/app/views/OperacoesView.tsx
+++ b/app/views/OperacoesView.tsx
@@ -260,14 +260,12 @@ export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport
                 .catch((err) => showAlert({ title: "Erro ao salvar", message: errorMessage(err), variant: "error" }));
             }}
             onRowsChange={(newRows: any[], { indexes, column }: any) => {
+              // handleLocalUpdate já aplica o valor em `dados`; o setDados que
+              // varria todas as linhas com .map + .find era redundante (e quadrático).
               if (indexes.length > 0 && column) {
                 const row = newRows[indexes[0]];
                 handleLocalUpdate(row.id, column.key, row[column.key]);
               }
-              setDados((prev: any[]) => prev.map((d: any) => {
-                const updatedRow = newRows.find(nr => nr.id === d.id);
-                return updatedRow ? updatedRow : d;
-              }));
             }}
             className="h-full w-full rdg-light dark:rdg-dark rounded-none border-0"
             rowHeight={36}
diff --git a/server/services/dashboard.server.ts b/server/services/dashboard.server.ts
index 452ea74..ed01b5b 100644
--- a/server/services/dashboard.server.ts
+++ b/server/services/dashboard.server.ts
@@ -256,11 +256,11 @@ function parseDataUTC(valor: any): Date | null {
 //faturista. Otimizado para a latência do banco: poucas idas ao banco + cache em
 //memória (o cache só é usado quando não há filtros ativos).
 export class DashboardService {
-  // O resumo inteiro é cacheado no servidor: o client já faz polling de 30s,
-  // então o custo alto (rede + Supabase) acontece no máximo 1x por 30s.
+  // O resumo inteiro é cacheado no servidor: o client faz polling de 30s, e o
+  // TTL maior que o intervalo garante que o 2º poll seja cache hit.
   private static resumoCache: DashboardResumo | null = null;
   private static resumoCacheTime = 0;
-  private static readonly RESUMO_TTL = 1000 * 30;
+  private static readonly RESUMO_TTL = 1000 * 60;
 
   private static opcoesCache: DashboardOpcoes | null = null;
   private static opcoesCacheTime = 0;

From f21746e9bc51ee3c38286e165b67f30fe34d9f3c Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 09:34:31 -0300
Subject: [PATCH 06/12] feat: faixa de progresso no topo e skeletons loading
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Contador global de requests em voo (app/lib/loading.ts) ligado ao
  fetch wrapper (app/lib/api.ts), acendendo uma faixa fina no topo
  (TopProgress) sempre que algo está carregando — grid, dashboard,
  troca de página, polls em segundo plano — sem depender só do React
  Query, já que a grid busca dados manualmente.
- Splash inicial e troca de rota lazy usam a mesma faixa/barrinha em
  vez de texto piscando, e a sidebar não troca mais o ícone por um
  spinner a cada request (evita re-render desnecessário).
- Novo componente Skeleton (bloco cinza pulsando) e util cn (clsx +
  tailwind-merge) reaproveitados para desenhar a forma do conteúdo
  enquanto carrega: grid de operações, dashboard (geral e por
  faturista), perfil e lista de prazos. O conteúdo não some mais para
  dar lugar a um texto — só aparece a faixa do topo quando já há dados
  em tela e o carregamento é uma atualização em segundo plano.
---
 app/AppRoutes.tsx              |  4 ++-
 app/components/AppLayout.tsx   | 16 ++++++++++-
 app/components/Sidebar.tsx     | 10 ++-----
 app/components/Skeleton.tsx    |  8 ++++++
 app/components/TopProgress.tsx | 20 ++++++++++++++
 app/lib/api.ts                 | 47 ++++++++++++++++++--------------
 app/lib/loading.ts             | 36 ++++++++++++++++++++++++
 app/pages/PerfilPage.tsx       |  8 ++++--
 app/utils/cn.ts                |  9 ++++++
 app/views/DashboardView.tsx    | 50 ++++++++++++++++++++++++++--------
 app/views/OperacoesView.tsx    | 25 ++++++++++++++++-
 app/views/PrazosView.tsx       |  7 +++--
 tailwind.config.js             |  6 ++++
 13 files changed, 199 insertions(+), 47 deletions(-)
 create mode 100644 app/components/Skeleton.tsx
 create mode 100644 app/components/TopProgress.tsx
 create mode 100644 app/lib/loading.ts
 create mode 100644 app/utils/cn.ts

diff --git a/app/AppRoutes.tsx b/app/AppRoutes.tsx
index af05e42..76107e2 100644
--- a/app/AppRoutes.tsx
+++ b/app/AppRoutes.tsx
@@ -23,7 +23,9 @@ function SplashScreen() {
             <circle cx="17" cy="18" r="2" />
           </svg>
         </div>
-        <p className="text-xs font-bold text-text-muted uppercase tracking-widest animate-pulse">Carregando...</p>
+        <div className="w-24 h-1 rounded-full bg-surface-light overflow-hidden">
+          <div className="h-full bg-primary rounded-full animate-loading" />
+        </div>
       </div>
     </div>
   );
diff --git a/app/components/AppLayout.tsx b/app/components/AppLayout.tsx
index d232f12..6a3b181 100644
--- a/app/components/AppLayout.tsx
+++ b/app/components/AppLayout.tsx
@@ -3,8 +3,21 @@ import { Outlet } from "react-router";
 import { useAuth } from "~/context/AuthContext";
 import { UIContext } from "~/hooks/use-ui";
 import { useInit } from "~/lib/query";
+import { iniciar, terminar } from "~/lib/loading";
 import { Sidebar } from "~/components/Sidebar";
 import { GlobalModal } from "~/components/GlobalModal";
+import { TopProgress } from "~/components/TopProgress";
+
+// Fallback do Suspense interno: enquanto o chunk de uma página lazy baixa,
+// acende a faixa do topo (mesmo contador de lib/loading.ts) sem desmontar a
+// sidebar nem trocar o layout por uma tela de carregamento.
+function RotaCarregando() {
+  useEffect(() => {
+    iniciar();
+    return () => terminar();
+  }, []);
+  return null;
+}
 
 export function AppLayout() {
   const { user } = useAuth();
@@ -59,6 +72,7 @@ export function AppLayout() {
 
   return (
     <UIContext.Provider value={uiContextValue}>
+      <TopProgress />
       <div className="flex h-screen w-screen overflow-hidden transition-colors duration-500">
         <Sidebar
           pastas={pastas}
@@ -73,7 +87,7 @@ export function AppLayout() {
         <main className="flex-1 flex flex-col min-w-0 bg-transparent overflow-hidden h-full">
           {/* Boundary interno: enquanto o chunk de uma página lazy baixa, a
               sidebar continua no lugar (o Suspense de AppRoutes só cobre o login) */}
-          <Suspense fallback={null}>
+          <Suspense fallback={<RotaCarregando />}>
             <Outlet />
           </Suspense>
         </main>
diff --git a/app/components/Sidebar.tsx b/app/components/Sidebar.tsx
index 1af9c0f..29385bb 100644
--- a/app/components/Sidebar.tsx
+++ b/app/components/Sidebar.tsx
@@ -1,7 +1,6 @@
-import { CheckCircle2, Inbox, LayoutDashboard, Moon, Plus, Search, ShieldCheck, Sun, Truck, User as UserIcon, X, Zap, Loader2, Menu } from "lucide-react";
+import { CheckCircle2, Inbox, LayoutDashboard, Moon, Plus, Search, ShieldCheck, Sun, Truck, User as UserIcon, X, Zap, Menu } from "lucide-react";
 import React, { useCallback, useMemo, useState } from "react";
 import { NavLink } from "react-router";
-import { useIsFetching } from "@tanstack/react-query";
 import { buscarNomeUsuario } from "~/utils/formatters";
 import { api, errorMessage } from "~/lib/api";
 import { queryClient, queryKeys, useFaturistas } from "~/lib/query";
@@ -31,7 +30,6 @@ export const Sidebar = React.memo(({
   setIsCollapsed
 }: SidebarProps) => {
 
-  const isFetching = useIsFetching() > 0;
   const { alert: showAlert } = useUI();
 
   const [newFolderName, setNewFolderName] = useState("");
@@ -80,11 +78,7 @@ export const Sidebar = React.memo(({
       <div className="h-[64px] flex items-center px-4 border-b border-glass-border shrink-0">
         <div className="flex items-center gap-2.5 overflow-hidden">
           <div className="p-1.5 bg-primary rounded-lg text-white shrink-0 shadow-primary-glow">
-            {isFetching ? (
-              <Loader2 size={18} strokeWidth={2.5} className="animate-spin" />
-            ) : (
-              <Truck size={18} strokeWidth={2.5} />
-            )}
+            <Truck size={18} strokeWidth={2.5} />
           </div>
           {!isCollapsed && <h1 className="text-lg font-bold uppercase tracking-tighter text-text">Logicell</h1>}
         </div>
diff --git a/app/components/Skeleton.tsx b/app/components/Skeleton.tsx
new file mode 100644
index 0000000..00cd7ea
--- /dev/null
+++ b/app/components/Skeleton.tsx
@@ -0,0 +1,8 @@
+import type { HTMLAttributes } from "react";
+import { cn } from "~/utils/cn";
+
+//Bloco cinza pulsando com a forma do conteúdo que vai aparecer — usado em vez
+//de um texto de carregamento, para o conteúdo nunca "sumir" da tela.
+export function Skeleton({ className, ...props }: HTMLAttributes<HTMLDivElement>) {
+  return <div className={cn("animate-pulse rounded-xl bg-surface-light", className)} {...props} />;
+}
diff --git a/app/components/TopProgress.tsx b/app/components/TopProgress.tsx
new file mode 100644
index 0000000..b16fe4d
--- /dev/null
+++ b/app/components/TopProgress.tsx
@@ -0,0 +1,20 @@
+import { useRequestsEmVoo } from "~/lib/loading";
+
+//Faixa fina no topo que acende enquanto há alguma request em voo (grid,
+//dashboard, troca de página lazy, polls em segundo plano). Sutil (2px) e
+//indeterminada — não representa progresso real, só "algo está carregando".
+export function TopProgress() {
+  const emVoo = useRequestsEmVoo();
+  if (emVoo === 0) return null;
+
+  return (
+    <div
+      role="status"
+      aria-live="polite"
+      className="fixed inset-x-0 top-0 z-[10002] h-0.5 overflow-hidden pointer-events-none"
+    >
+      <div className="h-full bg-primary animate-loading" />
+      <span className="sr-only">Carregando</span>
+    </div>
+  );
+}
diff --git a/app/lib/api.ts b/app/lib/api.ts
index 466cca8..87f39bd 100644
--- a/app/lib/api.ts
+++ b/app/lib/api.ts
@@ -1,3 +1,5 @@
+import { iniciar, terminar } from "~/lib/loading";
+
 export class ApiError extends Error {
   status: number;
   constructor(message: string, status: number) {
@@ -19,30 +21,35 @@ async function request<T>(path: string, options: RequestOptions = {}): Promise<T
   const headers: Record<string, string> = {};
   if (body !== undefined && !formData) headers["Content-Type"] = "application/json";
 
-  const res = await fetch(`/api${path}`, {
-    method,
-    credentials: "include",
-    signal,
-    headers,
-    body: formData ?? (body !== undefined ? JSON.stringify(body) : undefined),
-  });
-
-  let data: any = null;
+  iniciar();
   try {
-    data = await res.json();
-  } catch {
-    data = null;
-  }
+    const res = await fetch(`/api${path}`, {
+      method,
+      credentials: "include",
+      signal,
+      headers,
+      body: formData ?? (body !== undefined ? JSON.stringify(body) : undefined),
+    });
 
-  if (!res.ok) {
-    if (res.status === 401) {
-      window.dispatchEvent(new Event("auth:unauthorized"));
+    let data: any = null;
+    try {
+      data = await res.json();
+    } catch {
+      data = null;
     }
-    const message = data?.error || data?.message || `Erro ${res.status}`;
-    throw new ApiError(message, res.status);
-  }
 
-  return data as T;
+    if (!res.ok) {
+      if (res.status === 401) {
+        window.dispatchEvent(new Event("auth:unauthorized"));
+      }
+      const message = data?.error || data?.message || `Erro ${res.status}`;
+      throw new ApiError(message, res.status);
+    }
+
+    return data as T;
+  } finally {
+    terminar();
+  }
 }
 
 export const api = {
diff --git a/app/lib/loading.ts b/app/lib/loading.ts
new file mode 100644
index 0000000..763a47a
--- /dev/null
+++ b/app/lib/loading.ts
@@ -0,0 +1,36 @@
+import { useSyncExternalStore } from "react";
+
+//Contador de requests em voo. A grid faz api.get manual (fora do React
+//Query), então useIsFetching() sozinho não bastaria para acender a faixa do
+//topo — request() em lib/api.ts chama iniciar()/terminar() em toda chamada,
+//React Query ou manual, e useRequestsEmVoo() expõe o valor via
+//useSyncExternalStore.
+let emVoo = 0;
+const listeners = new Set<() => void>();
+
+function emitir() {
+  for (const listener of listeners) listener();
+}
+
+export function iniciar(): void {
+  emVoo += 1;
+  emitir();
+}
+
+export function terminar(): void {
+  emVoo = Math.max(0, emVoo - 1);
+  emitir();
+}
+
+function subscribe(listener: () => void): () => void {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+function getSnapshot(): number {
+  return emVoo;
+}
+
+export function useRequestsEmVoo(): number {
+  return useSyncExternalStore(subscribe, getSnapshot);
+}
diff --git a/app/pages/PerfilPage.tsx b/app/pages/PerfilPage.tsx
index e6e718b..c68a2ef 100644
--- a/app/pages/PerfilPage.tsx
+++ b/app/pages/PerfilPage.tsx
@@ -3,6 +3,7 @@ import { useAuth } from "~/context/AuthContext";
 import { api } from "~/lib/api";
 import { ProfileCard } from "~/components/ProfileCard";
 import { RecentImportsList } from "~/components/RecentImportsList";
+import { Skeleton } from "~/components/Skeleton";
 
 export function PerfilPage() {
   const { signOut } = useAuth();
@@ -13,8 +14,11 @@ export function PerfilPage() {
 
   if (!data) {
     return (
-      <div className="flex-1 flex items-center justify-center bg-bg">
-        <p className="text-xs font-bold text-text-muted uppercase tracking-widest animate-pulse">Carregando...</p>
+      <div className="flex-1 flex flex-col bg-bg h-full overflow-y-auto custom-scrollbar p-6 md:p-8">
+        <div className="max-w-[1000px] mx-auto w-full flex flex-col gap-6">
+          <Skeleton className="h-40" />
+          <Skeleton className="h-64" />
+        </div>
       </div>
     );
   }
diff --git a/app/utils/cn.ts b/app/utils/cn.ts
new file mode 100644
index 0000000..ed3388c
--- /dev/null
+++ b/app/utils/cn.ts
@@ -0,0 +1,9 @@
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+//Junta classes condicionais (clsx) e resolve conflitos do Tailwind (twMerge).
+//Vários arquivos já redeclaram essa função localmente; não refatorar os
+//outros para usar esta.
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
diff --git a/app/views/DashboardView.tsx b/app/views/DashboardView.tsx
index e4a4063..2ed9a9f 100644
--- a/app/views/DashboardView.tsx
+++ b/app/views/DashboardView.tsx
@@ -11,6 +11,7 @@ import {
   type DashboardOpcoes,
 } from "~/lib/query";
 import { formatarData, formatarMoeda } from "~/utils/formatters";
+import { Skeleton } from "~/components/Skeleton";
 
 type ItemBarra = { label: string; valor: number; quantidade: number; cor?: string | null };
 type FiltroCampo = keyof DashboardFiltros;
@@ -72,6 +73,41 @@ function BarList({
   );
 }
 
+// Skeleton do acordeão da dashboard, mostrado só no primeiro carregamento
+// (com keepPreviousData, os polls seguintes mantêm o conteúdo anterior em tela).
+function DashboardSkeleton() {
+  return (
+    <div className="bg-card-bg border border-glass-border rounded-2xl shadow-card overflow-hidden">
+      <div className="p-5 border-b border-glass-border">
+        <Skeleton className="h-10 w-48" />
+      </div>
+      <div className="p-5 flex flex-col gap-3">
+        {Array.from({ length: 4 }).map((_, i) => (
+          <Skeleton key={i} className="h-14" />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+// Skeleton do detalhe do faturista: 5 MiniStat + 3 cards de distribuição.
+function FaturistaDetalheSkeleton() {
+  return (
+    <div className="px-5 py-5 bg-surface/40">
+      <div className="grid grid-cols-2 md:grid-cols-3 xl:grid-cols-5 gap-3 mb-5">
+        {Array.from({ length: 5 }).map((_, i) => (
+          <Skeleton key={i} className="h-16" />
+        ))}
+      </div>
+      <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-3">
+        {Array.from({ length: 3 }).map((_, i) => (
+          <Skeleton key={i} className="h-64" />
+        ))}
+      </div>
+    </div>
+  );
+}
+
 function MiniStat({ label, valor, sub }: { label: string; valor: string; sub?: string }) {
   return (
     <div className="bg-card-bg border border-glass-border rounded-xl px-4 py-3">
@@ -268,13 +304,7 @@ function FaturistaDetalhe({
   const { data, isLoading, isError, isPlaceholderData } = useDashboardFaturista(faturistaId, filtros, true);
 
   if (isLoading) {
-    return (
-      <div className="px-5 py-8 text-center">
-        <p className="text-xs font-bold text-text-muted uppercase tracking-widest animate-pulse">
-          Carregando faturista...
-        </p>
-      </div>
-    );
+    return <FaturistaDetalheSkeleton />;
   }
 
   if (isError || !data) {
@@ -534,11 +564,7 @@ export function DashboardView() {
             </p>
           </div>
         ) : isLoading || !geral ? (
-          <div className="bg-card-bg border border-glass-border rounded-2xl p-6 shadow-card">
-            <p className="text-xs font-bold text-text-muted uppercase tracking-widest text-center py-10 animate-pulse">
-              Carregando...
-            </p>
-          </div>
+          <DashboardSkeleton />
         ) : (
           // keepPreviousData mantém os números do filtro anterior em tela; a
           // opacidade cai um pouco só enquanto eles são placeholder (troca de
diff --git a/app/views/OperacoesView.tsx b/app/views/OperacoesView.tsx
index a5e02e5..4d6890e 100644
--- a/app/views/OperacoesView.tsx
+++ b/app/views/OperacoesView.tsx
@@ -11,6 +11,7 @@ import { useUI } from "~/hooks/use-ui";
 import { exportarExcel } from "~/utils/export";
 import { ColumnFilterMenu } from "~/components/ColumnFilterMenu";
 import { ImportModal } from "~/components/ImportModal";
+import { Skeleton } from "~/components/Skeleton";
 import { OperacoesToolbarView } from "./OperacoesToolbarView";
 import { getOperacoesColumns } from "./OperacoesColumns";
 import { api, errorMessage } from "~/lib/api";
@@ -25,6 +26,26 @@ interface OperacoesViewProps {
   showImport?: boolean;
 }
 
+// Skeleton da grid: overlay sobre o container (que já é `relative`), visível
+// só na primeira carga da pasta (ainda sem dados) — trocar filtro com dados
+// já em tela não mostra isto, só a faixa do topo.
+const LARGURAS_SKELETON = ["w-10", "w-16", "w-24", "w-14", "w-20", "w-28", "w-12", "w-32"];
+
+function GridSkeleton() {
+  return (
+    <div className="absolute inset-0 pointer-events-none bg-bg/80 overflow-hidden">
+      <div className="h-[42px] border-b border-glass-border" />
+      {Array.from({ length: 15 }).map((_, i) => (
+        <div key={i} className="h-9 flex items-center gap-3 px-3 border-b border-glass-border/60">
+          {Array.from({ length: 6 + (i % 3) }).map((_, j) => (
+            <Skeleton key={j} className={`h-4 ${LARGURAS_SKELETON[(i + j) % LARGURAS_SKELETON.length]}`} />
+          ))}
+        </div>
+      ))}
+    </div>
+  );
+}
+
 export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport = true }: OperacoesViewProps) {
   const { data: init } = useInit();
   const pastas = init?.pastas || [];
@@ -194,7 +215,7 @@ export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport
         />
 
         <div
-          className="flex-1 w-full min-h-0 min-w-0 text-xs"
+          className="flex-1 w-full min-h-0 min-w-0 text-xs relative"
           style={{ "--rdg-font-family": "inherit", "--rdg-font-size": "12px" } as any}
           onScrollCapture={handleScroll}
         >
@@ -272,6 +293,8 @@ export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport
             headerRowHeight={42}
           />
 
+          {status === "loading" && dados.length === 0 && <GridSkeleton />}
+
           <ColumnFilterMenu
             openFilterCol={openFilterCol}
             setOpenFilterCol={setOpenFilterCol}
diff --git a/app/views/PrazosView.tsx b/app/views/PrazosView.tsx
index 4293782..3907c59 100644
--- a/app/views/PrazosView.tsx
+++ b/app/views/PrazosView.tsx
@@ -3,6 +3,7 @@ import { useCallback, useEffect, useMemo, useState } from "react";
 import { useUI } from "~/hooks/use-ui";
 import { api, errorMessage } from "~/lib/api";
 import { queryClient, queryKeys, usePrazos } from "~/lib/query";
+import { Skeleton } from "~/components/Skeleton";
 
 export function PrazosView() {
   const { data, isFetching } = usePrazos();
@@ -282,8 +283,10 @@ export function PrazosView() {
           )}
 
           {isFetching && clientes.length === 0 ? (
-            <div className="flex items-center justify-center py-10 text-text-muted">
-              <Loader2 size={20} className="animate-spin" />
+            <div className="flex flex-col gap-2">
+              {Array.from({ length: 3 }).map((_, i) => (
+                <Skeleton key={i} className="h-12" />
+              ))}
             </div>
           ) : clientesFiltrados.length === 0 ? (
             <div className="py-10 flex flex-col items-center justify-center text-center border border-dashed border-glass-border rounded-xl">
diff --git a/tailwind.config.js b/tailwind.config.js
index 4fb5cf8..db80952 100644
--- a/tailwind.config.js
+++ b/tailwind.config.js
@@ -66,10 +66,16 @@ export default {
           '0%': { opacity: 0 },
           '100%': { opacity: 1 },
         },
+        loading: {
+          '0%': { width: '0%', marginLeft: '0%' },
+          '50%': { width: '100%', marginLeft: '0%' },
+          '100%': { width: '0%', marginLeft: '100%' },
+        },
       },
       animation: {
         modalIn: 'modalIn 0.35s cubic-bezier(0.34, 1.56, 0.64, 1)',
         fadeIn: 'fadeIn 0.25s cubic-bezier(0.16, 1, 0.3, 1)',
+        loading: 'loading 1.4s ease-in-out infinite',
       },
     },
   },

From 040f0396a8be903ff5e67054fc8c61c7f7c82500 Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Sun, 13 Sep 2026 11:21:35 -0300
Subject: [PATCH 07/12] =?UTF-8?q?perf:=20otimizado=20importa=C3=A7=C3=A3o?=
 =?UTF-8?q?=20e=20restaura=C3=A7=C3=A3o=20de=20planilhas?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Backup do estado anterior, remoção das linhas que saíram da planilha (modo
  Substituir) e inserção das novas linhas passam a ser feitos direto no
  Postgres (json_agg / json_populate_recordset), sem trazer a tabela inteira
  de operações para o Node nem fatiar a inserção em vários lotes.
- O parse da planilha roda antes de qualquer consulta ao banco, e o backup da
  versão anterior sai em paralelo com a busca das regras de automação, caindo
  de mais de dez idas sequenciais ao banco por importação para poucas.
- O parser evita reprocessar a planilha inteira só para achar a linha do
  cabeçalho e reaproveita as normalizações de nome de coluna já calculadas,
  deixando o parse mais leve em arquivos com milhares de linhas.
- A restauração de um snapshot ganha mais tempo de transação, para não
  estourar em planilhas maiores.
---
 server/services/backup.server.ts           |  70 ++++++++-----
 server/services/excel-parser.server.ts     |  62 ++++++++----
 server/services/motor-roteamento.server.ts |  15 +--
 server/services/operacao-import.server.ts  | 112 ++++++++++++---------
 4 files changed, 160 insertions(+), 99 deletions(-)

diff --git a/server/services/backup.server.ts b/server/services/backup.server.ts
index 490014b..f500110 100644
--- a/server/services/backup.server.ts
+++ b/server/services/backup.server.ts
@@ -2,26 +2,40 @@ import prisma from "../lib/prisma.server";
 import { PastaService } from "./pasta.server";
 import { OperacaoService } from "./operacao.server";
 
-export class BackupService {
-  static async criarBackup(importacaoId: number) {
-    const todasPastas = await prisma.pasta.findMany();
-    const todasRegras = await prisma.regraAutomacao.findMany();
-    const todasOperacoes = await prisma.operacao.findMany();
+//json_agg devolve timestamps sem timezone ("2026-09-13T12:00:00.000", sem
+//"Z"); sem isso o JS interpretaria a string como hora local do processo e
+//deslocaria o valor. Trata a ausência de timezone como UTC (mesma leitura
+//que o Prisma faz da coluna "timestamp without time zone").
+function paraDataUTC(valor: any): Date | undefined {
+  if (!valor) return undefined;
+  if (typeof valor === "string" && !/[Zz]|[+-]\d\d:?\d\d$/.test(valor)) {
+    return new Date(`${valor}Z`);
+  }
+  return new Date(valor);
+}
 
-    await (prisma as any).snapshotImportacao.upsert({
-      where: { importacaoId },
-      update: {
-        pastas: todasPastas,
-        regras: todasRegras,
-        operacoes: todasOperacoes
-      },
-      create: {
-        importacaoId,
-        pastas: todasPastas,
-        regras: todasRegras,
-        operacoes: todasOperacoes
-      }
-    });
+export class BackupService {
+  //Tira a "foto" inteira dentro do Postgres (json_agg): nenhuma linha da
+  //Operacao passa pelo Node, então 7 mil registros não cruzam a rede duas
+  //vezes. json_agg serializa datas sem timezone ("...T12:00:00.000", sem "Z");
+  //ver paraDataUTC nos métodos de restauração abaixo. A própria query acha a
+  //última importação (subquery), então o chamador não precisa de um SELECT
+  //separado antes — se ainda não existe nenhuma importação, a subquery não
+  //retorna linha e o INSERT vira um no-op.
+  static async criarBackup() {
+    await prisma.$executeRawUnsafe(
+      `INSERT INTO "SnapshotImportacao" ("importacaoId", pastas, regras, operacoes, "createdAt")
+       SELECT ultima.id,
+         COALESCE((SELECT json_agg(p) FROM "Pasta" p), '[]'::json),
+         COALESCE((SELECT json_agg(r) FROM "RegraAutomacao" r), '[]'::json),
+         COALESCE((SELECT json_agg(o) FROM "Operacao" o), '[]'::json),
+         now()
+       FROM (SELECT id FROM "Importacao" ORDER BY "createdAt" DESC LIMIT 1) AS ultima
+       ON CONFLICT ("importacaoId") DO UPDATE SET
+         pastas = EXCLUDED.pastas,
+         regras = EXCLUDED.regras,
+         operacoes = EXCLUDED.operacoes`
+    );
   }
 
   static async restaurarBackup(importacaoId: number) {
@@ -33,12 +47,14 @@ export class BackupService {
       throw new Error("Nenhum backup encontrado para esta importação.");
     }
 
+    // Snapshot com ~7 mil operações pode passar do timeout padrão de 5 s do
+    // Prisma; 60 s de folga (maxWait = tempo esperando um slot do pool).
     await prisma.$transaction(async (tx) => {
       await BackupService.limparDadosAtuais(tx);
       await BackupService.restaurarPastas(tx, snapshot.pastas);
       await BackupService.restaurarRegras(tx, snapshot.regras);
       await BackupService.restaurarOperacoes(tx, snapshot.operacoes);
-    });
+    }, { timeout: 60_000, maxWait: 10_000 });
 
     await BackupService.resetarSequencias();
 
@@ -60,8 +76,8 @@ export class BackupService {
     if (!Array.isArray(pastasRaw) || pastasRaw.length === 0) return;
     const pastas = pastasRaw.map((p: any) => ({
       ...p,
-      createdAt: p.createdAt ? new Date(p.createdAt) : undefined,
-      updatedAt: p.updatedAt ? new Date(p.updatedAt) : undefined,
+      createdAt: paraDataUTC(p.createdAt),
+      updatedAt: paraDataUTC(p.updatedAt),
     }));
     await tx.pasta.createMany({ data: pastas });
   }
@@ -70,7 +86,7 @@ export class BackupService {
     if (!Array.isArray(regrasRaw) || regrasRaw.length === 0) return;
     const regras = regrasRaw.map((r: any) => ({
       ...r,
-      createdAt: r.createdAt ? new Date(r.createdAt) : undefined,
+      createdAt: paraDataUTC(r.createdAt),
     }));
     await tx.regraAutomacao.createMany({ data: regras });
   }
@@ -84,9 +100,11 @@ export class BackupService {
     const ops = operacoesRaw.map((op: any) => ({
       ...op,
       importacaoId: op.importacaoId && validImportIds.has(op.importacaoId) ? op.importacaoId : null,
-      createdAt: op.createdAt ? new Date(op.createdAt) : undefined,
-      updatedAt: op.updatedAt ? new Date(op.updatedAt) : undefined,
-      dt_emissao_: op.dt_emissao_ ? new Date(op.dt_emissao_) : undefined,
+      createdAt: paraDataUTC(op.createdAt),
+      updatedAt: paraDataUTC(op.updatedAt),
+      dt_emissao_: paraDataUTC(op.dt_emissao_) ?? null,
+      dt_quitacao_saldo: paraDataUTC(op.dt_quitacao_saldo) ?? null,
+      data_status: paraDataUTC(op.data_status) ?? null,
     }));
     await tx.operacao.createMany({ data: ops });
   }
diff --git a/server/services/excel-parser.server.ts b/server/services/excel-parser.server.ts
index 58098c9..791cb57 100644
--- a/server/services/excel-parser.server.ts
+++ b/server/services/excel-parser.server.ts
@@ -3,6 +3,28 @@ import crypto from "crypto";
 import * as XLSX from "xlsx";
 import { DateParser } from "../utils/date-parser";
 
+//Normaliza um cabeçalho (maiúsculas, sem acento, sem espaço/underscore) para
+//comparar com as chaves conhecidas do De-Para. As mesmas chaves (das colunas
+//da planilha e das listas de candidatos abaixo) se repetem em todas as ~7 mil
+//linhas do arquivo — um cache evita refazer a mesma limpeza de string milhares
+//de vezes por importação.
+const cacheNormalizacao = new Map<string, string>();
+function normalizarChave(valor: string): string {
+  const hit = cacheNormalizacao.get(valor);
+  if (hit !== undefined) return hit;
+  const limpo = valor.toUpperCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[\s_]+/g, "");
+  cacheNormalizacao.set(valor, limpo);
+  return limpo;
+}
+
+//Colunas obrigatórias — computado 1x no carregamento do módulo, não a cada planilha importada.
+const REQUIRED_CHECKS = [
+  { name: "AGÊNCIA", keys: ["NMAGENCIA", "AGENCIA"] },
+  { name: "CTRC", keys: ["NRCTRC", "CTRC", "CTE"] },
+  { name: "NF", keys: ["NRNF", "NF", "NOTAFISCAL"] },
+  { name: "VALOR TOTAL", keys: ["VLTOTAL", "VALORTOTAL", "TOTAL", "VALOR"] }
+];
+
 // Utilitário Server-Side para Ler e Padronizar Arquivos Excel
 // Realiza toda a extração, Mapeamento (De-Para das colunas) e Validação.
 export class ExcelParser {
@@ -13,19 +35,27 @@ export class ExcelParser {
   }
 
 //Converte um buffer de Excel cru para uma lista de operações rigidamente validadas e tipadas
-  static analisarBuffer(buffer: Buffer, importacaoId: number): { operacoes: Prisma.OperacaoCreateManyInput[], totalLido: number } {
+  static analisarBuffer(buffer: Buffer): { operacoes: Prisma.OperacaoCreateManyInput[], totalLido: number } {
     const workbook = XLSX.read(buffer, { type: "buffer", cellDates: true });
     const sheet = workbook.Sheets[workbook.SheetNames[0]];
     
-    // Converte para matriz 2D para procurar onde estão os cabeçalhos
-    const dataAsArray: any[][] = XLSX.utils.sheet_to_json(sheet, { header: 1 });
+    const ref = sheet["!ref"];
+    if (!ref) throw new Error("Planilha vazia");
+
+    // 1ª passada: só as 2 primeiras linhas, para achar onde está o cabeçalho —
+    // evita converter a planilha inteira (~7 mil linhas) duas vezes.
+    // Linhas contadas a partir do início da área usada (!ref), que nem sempre é A1.
+    const fullRange = XLSX.utils.decode_range(ref);
+    const primeiraLinha = fullRange.s.r;
+    const headerRange = { s: { r: primeiraLinha, c: fullRange.s.c }, e: { r: Math.min(primeiraLinha + 1, fullRange.e.r), c: fullRange.e.c } };
+    const dataAsArray: any[][] = XLSX.utils.sheet_to_json(sheet, { header: 1, range: headerRange });
     if (dataAsArray.length === 0) throw new Error("Planilha vazia");
 
     let headerRowIndex = 0;
     
     // Conforme sua regra: Verifica a linha 1 (índice 0), se não achar as chaves exatas da interface, tenta a linha 2 (índice 1).
     for (let i = 0; i < Math.min(2, dataAsArray.length); i++) {
-      const rowStr = (dataAsArray[i] || []).map(String).map(s => s.toUpperCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[\s_]+/g, ""));
+      const rowStr = (dataAsArray[i] || []).map(v => normalizarChave(String(v)));
       // Procurando chaves comuns
       if (rowStr.includes("NMAGENCIA") || rowStr.includes("AGENCIA") || rowStr.includes("NRCTRC") || rowStr.includes("CTRC") || rowStr.includes("VLTOTAL") || rowStr.includes("VALORTOTAL")) {
           headerRowIndex = i;
@@ -33,20 +63,13 @@ export class ExcelParser {
       }
     }
 
-    const rawData: any[] = XLSX.utils.sheet_to_json(sheet, { range: headerRowIndex });
+    const rawData: any[] = XLSX.utils.sheet_to_json(sheet, { range: primeiraLinha + headerRowIndex });
 
     if (rawData.length === 0) throw new Error("Não há dados na planilha além dos cabeçalhos");
 
     // Validação de Cabeçalhos
-    const availableHeaders = Object.keys(rawData[0]).map(h => h.toUpperCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[\s_]+/g, ""));
-    const requiredChecks = [
-      { name: "AGÊNCIA", keys: ["NMAGENCIA", "AGENCIA"] },
-      { name: "CTRC", keys: ["NRCTRC", "CTRC", "CTE"] },
-      { name: "NF", keys: ["NRNF", "NF", "NOTAFISCAL"] },
-      { name: "VALOR TOTAL", keys: ["VLTOTAL", "VALORTOTAL", "TOTAL", "VALOR"] }
-    ];
-
-    const missing = requiredChecks.filter(check => 
+    const availableHeaders = Object.keys(rawData[0]).map(normalizarChave);
+    const missing = REQUIRED_CHECKS.filter(check => 
       !check.keys.some(k => availableHeaders.includes(k))
     );
 
@@ -55,7 +78,7 @@ export class ExcelParser {
     }
 
     const operacoes = rawData
-      .map((row, index) => this.mapearLinha(row, importacaoId, index))
+      .map((row, index) => this.mapearLinha(row, index))
       .filter((op): op is Prisma.OperacaoCreateManyInput => op !== null);
 
     return { operacoes, totalLido: rawData.length };
@@ -75,18 +98,16 @@ export class ExcelParser {
     return Number.isFinite(normalizado) && normalizado === 0;
   }
 
-  private static mapearLinha(row: any, importacaoId: number, _index: number): Prisma.OperacaoCreateManyInput | null {
+  private static mapearLinha(row: any, _index: number): Prisma.OperacaoCreateManyInput | null {
     const rowNorm: Record<string, any> = {};
     for (const [k, v] of Object.entries(row)) {
-      const cleanKey = String(k).toUpperCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[\s_]+/g, "");
-      rowNorm[cleanKey] = v;
+      rowNorm[normalizarChave(String(k))] = v;
     }
 
     const get = (keys: string | string[]) => {
       const arr = Array.isArray(keys) ? keys : [keys];
       for (const k of arr) {
-        const cleanKey = k.toUpperCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[\s_]+/g, "");
-        const val = rowNorm[cleanKey];
+        const val = rowNorm[normalizarChave(k)];
         if (val !== undefined && val !== null && String(val).trim() !== "") return val;
       }
       return null;
@@ -107,7 +128,6 @@ export class ExcelParser {
     }
     
     const op = {
-      importacaoId,
       nm_agencia: this.padronizarAgencia(String(get(["nm_agencia", "AGÊNCIA", "AGENCIA"]) || "DESCONHECIDA")),
       dt_emissao_: dt_emissao_ || null,
       cd_pessoa_pagador: String(get(["cd_pessoa_pagador", "CÓD. PAGADOR", "COD PAGADOR", "CÓDIGO"]) || ""),
diff --git a/server/services/motor-roteamento.server.ts b/server/services/motor-roteamento.server.ts
index 2d74378..9a96a30 100644
--- a/server/services/motor-roteamento.server.ts
+++ b/server/services/motor-roteamento.server.ts
@@ -1,14 +1,17 @@
-import { AutomacaoService } from "./automacao.server";
+export interface MapasRoteamento {
+  mapaAgencia: Map<string, number[]>;
+  mapaCliente: Map<string, number[]>;
+  mapaProdutosPorPasta: Map<number, Set<string>>;
+}
 
 export class MotorRoteamentoService {
   /**
    * Processa uma lista de operações recém-importadas da planilha e define
-   * o `pastaId` de cada uma delas com base nas regras cadastradas no sistema.
-   * Modifica a array de operações in-place.
+   * o `pastaId` de cada uma delas com base nos mapas de roteamento (já
+   * buscados pelo chamador, em paralelo com o resto da importação — ver
+   * operacao-import.server.ts). Modifica a array de operações in-place.
    */
-  static async aplicarRegrasRoteamento(operacoes: any[]) {
-    const mapas = await AutomacaoService.obterMapasRoteamento();
-    
+  static aplicarRegrasRoteamento(operacoes: any[], mapas: MapasRoteamento) {
     if (mapas.mapaAgencia.size === 0 && mapas.mapaCliente.size === 0) {
       return; // Nenhuma regra de automação cadastrada
     }
diff --git a/server/services/operacao-import.server.ts b/server/services/operacao-import.server.ts
index 19a7e8f..d712fe3 100644
--- a/server/services/operacao-import.server.ts
+++ b/server/services/operacao-import.server.ts
@@ -4,64 +4,69 @@ import prisma from "../lib/prisma.server";
 import { ExcelParser } from "./excel-parser.server";
 import { OperacaoService } from "./operacao.server";
 import { PastaService } from "./pasta.server";
+import { AutomacaoService } from "./automacao.server";
 import { MotorRoteamentoService } from "./motor-roteamento.server";
 import { BackupService } from "./backup.server";
 
+//Colunas da Operacao preenchidas pela planilha (De-Para do excel-parser +
+//importacaoId/pastaId/hash_assinatura, atribuídos depois do parse). Usada
+//pelo INSERT ... SELECT ... FROM json_populate_recordset abaixo (B3): mesma
+//ordem nas duas listas de colunas da query.
+const COLUNAS_OPERACAO = [
+  "importacaoId", "pastaId", "nm_agencia", "cd_pessoa_pagador", "nm_pessoa_pagador", "nr_cpf_cnpj_raiz",
+  "nr_cpf_cnpj_pagador", "nr_ctrc", "id_tipo_documento", "nm_pessoa_remetente", "nm_cidade_origem", "ds_sigla_origem",
+  "nm_pessoa_destinatario", "nm_cidade_destino", "ds_sigla_destino", "nm_produto", "vl_peso", "vl_tarifa", "vl_total",
+  "nr_nf", "ds_placa", "nm_pessoa_matriz", "nr_contrato", "nr_chave_acesso", "nm_pessoa_usuario_lancamento",
+  "id_tipo_ctrc", "nm_proprietario_posse_cavalo", "nm_motorista", "status", "comentarios", "dt_emissao_",
+  "dt_quitacao_saldo", "hash_assinatura",
+] as const;
+const COLUNAS_OPERACAO_SQL = COLUNAS_OPERACAO.map(c => `"${c}"`).join(",");
+
 export class OperacaoImportService {
   static async processarPlanilha(buffer: Buffer, originalName: string, usuario: string = "Sistema", modo: string = "SUBSTITUIR") {
     OperacaoService.invalidarCache();
     const hash = crypto.createHash("sha256").update(buffer).digest("hex");
 
-    // MÁQUINA DO TEMPO (BACKUP DA VERSÃO ANTERIOR)
-    // Antes de processar a nova planilha, pegamos a última importação (que é a versão atual do usuário)
-    // e tiramos uma "foto" do banco de dados com todas as alterações manuais que ele fez até agora.
-    const ultimaImportacao = await prisma.importacao.findFirst({
-      orderBy: { createdAt: 'desc' }
-    });
-
-    if (ultimaImportacao) {
-      await BackupService.criarBackup(ultimaImportacao.id);
-    }
-    // ----------------------------------------------------
-
-    const importacao = await prisma.importacao.create({
-      data: { nomeArquivo: originalName, usuario, qtdRegistros: 0, hashArquivo: hash }
-    });
-
-    const parsedData = ExcelParser.analisarBuffer(buffer, importacao.id);
+    // Parse (CPU, não depende do banco) antes de qualquer query.
+    const parsedData = ExcelParser.analisarBuffer(buffer);
     const spreadsheetOps = parsedData.operacoes;
 
-    // --- AUTOMAÇÃO (ROTEAMENTO) ---
-    await MotorRoteamentoService.aplicarRegrasRoteamento(spreadsheetOps);
+    // MÁQUINA DO TEMPO (BACKUP DA VERSÃO ANTERIOR, já acha a última importação
+    // sozinha) + mapas de roteamento: nenhum depende do outro, então saem no
+    // mesmo lote em vez de em sequência. Aguardados juntos: uma falha no
+    // backup vira erro desta request, não uma rejeição solta que derruba o
+    // processo.
+    const [mapas] = await Promise.all([
+      AutomacaoService.obterMapasRoteamento(),
+      BackupService.criarBackup(),
+    ]);
 
-    const spreadsheetSignatures = new Set(spreadsheetOps.map((op: any) => op.hash_assinatura));
+    // --- AUTOMAÇÃO (ROTEAMENTO) ---
+    MotorRoteamentoService.aplicarRegrasRoteamento(spreadsheetOps, mapas);
 
-    const inboxItems = await prisma.operacao.findMany({
-      select: { id: true, hash_assinatura: true }
+    const importacao = await prisma.importacao.create({
+      data: { nomeArquivo: originalName, usuario, qtdRegistros: parsedData.totalLido, hashArquivo: hash }
     });
 
-    const removidos = await this.aplicarRegraSubstituicao(modo, inboxItems, spreadsheetSignatures);
+    for (const op of spreadsheetOps as any[]) {
+      op.importacaoId = importacao.id;
+    }
 
-    const resultado = await prisma.operacao.createMany({ 
-      data: spreadsheetOps as any,
-      skipDuplicates: true 
-    });
+    const spreadsheetSignatures = spreadsheetOps.map((op: any) => op.hash_assinatura as string);
+
+    const removidos = await this.aplicarRegraSubstituicao(modo, spreadsheetSignatures);
+    const adicionados = await this.inserirOperacoes(spreadsheetOps);
 
-    await prisma.importacao.update({
-      where: { id: importacao.id },
-      data: { qtdRegistros: parsedData.totalLido }
-    });
-        
     PastaService.invalidarCache();
-    OperacaoService.invalidarCache(); 
+    OperacaoService.invalidarCache();
 
-    return { 
-      totalLido: parsedData.totalLido, 
-      adicionados: resultado.count, 
-      ignorados: parsedData.totalLido - resultado.count,
+    return {
+      totalLido: parsedData.totalLido,
+      adicionados,
+      ignorados: parsedData.totalLido - adicionados,
       removidos,
       modo,
-      importId: importacao.id 
+      importId: importacao.id
     };
   }
 
@@ -69,16 +74,31 @@ export class OperacaoImportService {
     await BackupService.restaurarBackup(importacaoId);
   }
 
-  private static async aplicarRegraSubstituicao(modo: string, inboxItems: { id: number, hash_assinatura: string | null }[], spreadsheetSignatures: Set<string>): Promise<number> {
+  //Substituição em 1 ida: apaga direto no banco quem não veio na planilha nova,
+  //sem trazer a tabela inteira para o Node primeiro.
+  private static async aplicarRegraSubstituicao(modo: string, assinaturas: string[]): Promise<number> {
     if (modo !== "SUBSTITUIR") return 0;
 
-    const idsParaApagar = inboxItems
-      .filter(item => item.hash_assinatura && !spreadsheetSignatures.has(item.hash_assinatura))
-      .map(item => item.id);
-
-    if (idsParaApagar.length === 0) return 0;
+    return prisma.$executeRawUnsafe(
+      `DELETE FROM "Operacao" WHERE hash_assinatura IS NOT NULL AND NOT (hash_assinatura = ANY($1::text[]))`,
+      assinaturas
+    );
+  }
 
-    const resultDel = await prisma.operacao.deleteMany({ where: { id: { in: idsParaApagar } } });
-    return resultDel.count;
+  //Inserção em 1 ida: json_populate_recordset casa os campos do JSON pelas
+  //colunas da Operacao. ON CONFLICT DO NOTHING sem alvo é o mesmo que o
+  //skipDuplicates do createMany antigo (ignora qualquer violação de unique,
+  //na prática a de hash_assinatura) e não depende de o índice ter esse nome
+  //no banco. createdAt/updatedAt não vêm da planilha — preenchidos com now().
+  private static async inserirOperacoes(spreadsheetOps: any[]): Promise<number> {
+    if (spreadsheetOps.length === 0) return 0;
+
+    return prisma.$executeRawUnsafe(
+      `INSERT INTO "Operacao" (${COLUNAS_OPERACAO_SQL}, "createdAt", "updatedAt")
+       SELECT ${COLUNAS_OPERACAO_SQL}, now(), now()
+       FROM json_populate_recordset(NULL::"Operacao", $1::json)
+       ON CONFLICT DO NOTHING`,
+      JSON.stringify(spreadsheetOps)
+    );
   }
 }

From 7c720321c434bf8067f9e7d82fd3db5b0e198fd3 Mon Sep 17 00:00:00 2001
From: "Glauber.x86" <glauber800br@gmail.com>
Date: Mon, 14 Sep 2026 04:12:49 -0300
Subject: [PATCH 08/12] perf: grid sem request duplicada ao trocar de pasta
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Reabre e refaz automaticamente a primeira consulta que falhar por queda de
  conexão com o banco (comum após um tempo sem uso), sem o usuário precisar
  recarregar a página
- Mantém a conexão com o banco e o cache de usuários sempre "quentes" em
  produção, para a primeira requisição depois de um tempo parado não pagar o
  preço de reconectar
- Remove o cache condicional (ETag/304) das respostas da API, que fazia o
  navegador travar requisições repetidas sem ganho nenhum de velocidade
- Corrige o health check por HEAD na raiz do site, hoje respondendo 404
- Adiciona um header de diagnóstico (Server-Timing) nas rotas mais usadas,
  detalhando quanto tempo cada etapa (autenticação, banco, total) levou no
  servidor
- Evita que abrir/trocar de pasta na grid dispare requisições repetidas ou
  abortadas: limpar os filtros ao trocar de pasta não recria mais objetos
  desnecessários, e a busca reaproveita o resultado do prefetch feito no
  hover da sidebar em vez de refazer a mesma chamada
- Skeleton com cor própria (`--skeleton`) nos dois temas, em vez de reusar o
  tom de superfície, e bordas mais suaves na grade de carregamento da lista
- Limpa as linhas da pasta anterior ao trocar de pasta, para o skeleton
  aparecer no lugar delas em vez de piscar dados da pasta antiga
---
 app/components/Skeleton.tsx              |  2 +-
 app/hooks/useOperacoesGridData.ts        | 62 ++++++++++++++++++++++--
 app/styles/tailwind.css                  |  3 ++
 app/views/OperacoesView.tsx              |  9 ++--
 server/index.ts                          | 40 ++++++++++++++-
 server/lib/cache.ts                      | 10 ++++
 server/lib/prisma.server.ts              | 53 +++++++++++++++++---
 server/lib/timing.ts                     | 25 ++++++++++
 server/middlewares/auth.ts               |  3 ++
 server/routes/dashboard.ts               |  2 +
 server/routes/init.ts                    |  2 +
 server/routes/operacoes.ts               |  5 +-
 server/services/operacao.server.ts       |  3 ++
 server/services/supabase-admin.server.ts |  9 +++-
 tailwind.config.js                       |  1 +
 15 files changed, 212 insertions(+), 17 deletions(-)
 create mode 100644 server/lib/timing.ts

diff --git a/app/components/Skeleton.tsx b/app/components/Skeleton.tsx
index 00cd7ea..df49f6e 100644
--- a/app/components/Skeleton.tsx
+++ b/app/components/Skeleton.tsx
@@ -4,5 +4,5 @@ import { cn } from "~/utils/cn";
 //Bloco cinza pulsando com a forma do conteúdo que vai aparecer — usado em vez
 //de um texto de carregamento, para o conteúdo nunca "sumir" da tela.
 export function Skeleton({ className, ...props }: HTMLAttributes<HTMLDivElement>) {
-  return <div className={cn("animate-pulse rounded-xl bg-surface-light", className)} {...props} />;
+  return <div className={cn("animate-pulse rounded-xl bg-skeleton", className)} {...props} />;
 }
diff --git a/app/hooks/useOperacoesGridData.ts b/app/hooks/useOperacoesGridData.ts
index 103f7b7..1f94f30 100644
--- a/app/hooks/useOperacoesGridData.ts
+++ b/app/hooks/useOperacoesGridData.ts
@@ -111,6 +111,11 @@ export function cancelPrefetch() {
   }
 }
 
+// Prefetch em voo por chave de cache: se o clique acontecer antes do hover
+// terminar, o hook espera esta mesma Promise em vez de disparar outra request
+// igual (era a causa das 3 requests iguais por clique no HAR).
+const prefetchEmVoo = new Map<string, Promise<{ data: any[]; meta: GridMeta }>>();
+
 async function executarPrefetch(pasta: PastaIdentificador) {
   const key = cacheKeyOf(pasta, EMPTY_FILTERS_KEY);
   const cached = gridCache.get(key);
@@ -118,13 +123,16 @@ async function executarPrefetch(pasta: PastaIdentificador) {
 
   const controller = new AbortController();
   prefetchController = controller;
+  const promise = api.get<{ data: any[]; meta: GridMeta }>(`/operacoes?${buildPage1Params(pasta)}`, controller.signal);
+  prefetchEmVoo.set(key, promise);
   try {
-    const res = await api.get<{ data: any[]; meta: GridMeta }>(`/operacoes?${buildPage1Params(pasta)}`, controller.signal);
+    const res = await promise;
     gridCache.set(key, { dados: res.data, meta: res.meta, ts: Date.now() });
   } catch {
     // prefetch falhou ou foi cancelado — a navegação normal resolve
   } finally {
     if (prefetchController === controller) prefetchController = null;
+    if (prefetchEmVoo.get(key) === promise) prefetchEmVoo.delete(key);
   }
 }
 
@@ -158,6 +166,13 @@ export function useOperacoesGridData({
     [columnFilters, sortColumns]
   );
 
+  // columnFilters muda de referência a cada `setColumnFilters({})` (mesmo com
+  // o mesmo conteúdo) — ler pelo ref evita que isso recrie buildParams (e, com
+  // ele, o efeito de dados abaixo, que reexecutaria e abortaria a request em
+  // voo). filtersKey (string) nas deps já cobre mudança real de filtro/ordenação.
+  const columnFiltersRef = useRef(columnFilters);
+  columnFiltersRef.current = columnFilters;
+
   const buildParams = useCallback(
     (page: number) => {
       const p = new URLSearchParams();
@@ -169,13 +184,13 @@ export function useOperacoesGridData({
         p.set("sortCol", String(sort.columnKey));
         p.set("sortDir", sort.direction === "DESC" ? "desc" : "asc");
       }
-      for (const [key, filter] of Object.entries(columnFilters)) {
+      for (const [key, filter] of Object.entries(columnFiltersRef.current)) {
         if (isFilterEmpty(filter)) continue;
         p.set(`colFilter_${key}`, `${(filter as any).type}:${(filter as any).value}`);
       }
       return p.toString();
     },
-    [pastaId, pastaNome, sortColumns, columnFilters, searchParams]
+    [pastaId, pastaNome, sortColumns, filtersKey, searchParams]
   );
 
   // Carrega a primeira página. Se já existe cache fresco, mostra na hora e
@@ -193,12 +208,20 @@ export function useOperacoesGridData({
       lastRunRef.current?.pasta === chave &&
       lastRunRef.current?.filters !== filtersKey &&
       filtersKey !== EMPTY_FILTERS_KEY;
+    // Troca de pasta: o componente fica montado entre rotas, então `dados`
+    // guarda as linhas da pasta anterior. Precisamos saber disso para limpar o
+    // estado e deixar o skeleton aparecer (senão dados.length !== 0 o esconde).
+    const isPastaChange = lastRunRef.current !== null && lastRunRef.current.pasta !== chave;
     lastRunRef.current = { pasta: chave, filters: filtersKey };
 
     const key = cacheKeyOf(pasta, filtersKey);
     const cached = gridCache.get(key);
     const url = `/operacoes?${buildParams(1)}`;
     const controller = new AbortController();
+    // Só usado pelo caminho do prefetch em voo abaixo: sua Promise não está
+    // amarrada a este controller, então precisamos saber se o efeito já foi
+    // desmontado/reexecutado para não atualizar estado depois disso.
+    let cleaned = false;
 
     const storeResult = (raw: { data: any[]; meta: GridMeta }) => {
       gridCache.set(key, { dados: raw.data, meta: raw.meta, ts: Date.now() });
@@ -244,6 +267,39 @@ export function useOperacoesGridData({
       return () => { clearTimeout(t); controller.abort(); };
     }
 
+    // Hover + clique na mesma pasta: o prefetch do hover já está em voo para
+    // esta chave — espera o resultado dele em vez de disparar outra request
+    // (a página fica com o skeleton, sem debounce, igual ao caminho normal).
+    const emVoo = prefetchEmVoo.get(key);
+    if (emVoo) {
+      if (isPastaChange) {
+        setDados([]);
+        setMeta(EMPTY_META);
+      }
+      setStatus("loading");
+      emVoo
+        .then((res) => {
+          if (cleaned || seq !== seqRef.current) return;
+          storeResult(res);
+          setDados(processarDatas(res.data));
+          setMeta(res.meta);
+          setStatus("idle");
+        })
+        .catch(() => {
+          // prefetch abortado (ex.: mouse saiu para outra pasta) — busca do zero
+          if (cleaned || seq !== seqRef.current) return;
+          fetchFresh();
+        });
+      return () => { cleaned = true; controller.abort(); };
+    }
+
+    // Sem cache fresco: ao trocar de pasta, zera os dados da pasta anterior
+    // para o skeleton aparecer (e não piscar as linhas erradas). Digitação de
+    // filtro na mesma pasta mantém os dados em tela — só a faixa do topo.
+    if (isPastaChange) {
+      setDados([]);
+      setMeta(EMPTY_META);
+    }
     setStatus("loading");
     if (isFilterChange) {
       const t = setTimeout(() => fetchFresh(), 200);
diff --git a/app/styles/tailwind.css b/app/styles/tailwind.css
index 525c0ea..ca4f6a5 100644
--- a/app/styles/tailwind.css
+++ b/app/styles/tailwind.css
@@ -24,6 +24,7 @@
     --border-focus:  rgba(0, 102, 255, 0.4);
     --surface:       rgba(0, 0, 0, 0.03);
     --surface-light: rgba(0, 0, 0, 0.05);
+    --skeleton:      rgba(0, 0, 0, 0.06);
 
     --shadow-card: 0 2px 8px rgba(0, 0, 0, 0.06), 0 1px 2px rgba(0, 0, 0, 0.04);
     --shadow-card-elevated: 0 4px 16px rgba(0, 0, 0, 0.08), 0 12px 32px rgba(0, 0, 0, 0.06);
@@ -59,6 +60,8 @@
     --border-focus:  rgba(0, 102, 255, 0.4);
     --surface:       rgba(255, 255, 255, 0.03);
     --surface-light: rgba(255, 255, 255, 0.06);
+    /* Skeleton: cinza-azulado (slate) sobre o fundo escuro, em vez de branco */
+    --skeleton:      #1b2532;
 
     --shadow-card: 0 4px 12px rgba(0, 0, 0, 0.1);
     --shadow-card-elevated: 0 10px 40px rgba(0, 0, 0, 0.1), 0 20px 50px rgba(0, 0, 0, 0.45);
diff --git a/app/views/OperacoesView.tsx b/app/views/OperacoesView.tsx
index 4d6890e..954dd96 100644
--- a/app/views/OperacoesView.tsx
+++ b/app/views/OperacoesView.tsx
@@ -34,9 +34,9 @@ const LARGURAS_SKELETON = ["w-10", "w-16", "w-24", "w-14", "w-20", "w-28", "w-12
 function GridSkeleton() {
   return (
     <div className="absolute inset-0 pointer-events-none bg-bg/80 overflow-hidden">
-      <div className="h-[42px] border-b border-glass-border" />
+      <div className="h-[42px] border-b border-glass-border/30" />
       {Array.from({ length: 15 }).map((_, i) => (
-        <div key={i} className="h-9 flex items-center gap-3 px-3 border-b border-glass-border/60">
+        <div key={i} className="h-9 flex items-center gap-3 px-3 border-b border-glass-border/20">
           {Array.from({ length: 6 + (i % 3) }).map((_, j) => (
             <Skeleton key={j} className={`h-4 ${LARGURAS_SKELETON[(i + j) % LARGURAS_SKELETON.length]}`} />
           ))}
@@ -93,7 +93,10 @@ export function OperacoesView({ pastaId = null, pastaNome, nomePasta, showImport
   useEffect(() => {
     resetSelection();
     if (!location.state) {
-      setColumnFilters({});
+      // Só cria objeto novo quando há filtro pra limpar — {} de novo (mesma
+      // pasta ou montagem) mudaria a referência de columnFilters à toa e
+      // recriaria buildParams, reexecutando o efeito de dados do grid.
+      setColumnFilters((prev) => (Object.keys(prev).length ? {} : prev));
     }
   }, [pastaId, pastaNome, location.pathname, location.state, setColumnFilters, resetSelection]);
 
diff --git a/server/index.ts b/server/index.ts
index cb50749..2dca99e 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -14,17 +14,24 @@ import { automacoesRouter } from "./routes/automacoes";
 import { prazosRouter } from "./routes/prazos";
 import { usuariosRouter } from "./routes/usuarios";
 import { perfilRouter } from "./routes/perfil";
-import { SupabaseAdminService } from "./services/supabase-admin.server";
+import { SupabaseAdminService, renovarUsuarios } from "./services/supabase-admin.server";
 import { PrazoService } from "./services/prazo.server";
 import { PastaService } from "./services/pasta.server";
 import { OrdemColunasService } from "./services/config.server";
 import { DashboardService } from "./services/dashboard.server";
+import { iniciarTiming } from "./lib/timing";
+import prisma from "./lib/prisma.server";
 
 //Em produção, serve o build estático do SPA com fallback para index.html
 const clientDist = path.resolve(process.cwd(), "dist/client");
 
 const app = express();
 app.disable("x-powered-by");
+//Sem ETag/304 nas respostas da API (res.send/json): o condicional não
+//economizava nada (o servidor calculava tudo de qualquer forma) e fazia o
+//Chrome serializar requests iguais em voo. express.static mantém seu próprio
+//ETag para os assets.
+app.set("etag", false);
 
 //LOG_HTTP=1 registra método, caminho, status e duração de cada request — sem
 //a env, nenhum middleware extra é adicionado.
@@ -45,6 +52,13 @@ app.use(compression());
 app.use(express.json({ limit: "2mb" }));
 
 const api = express.Router();
+//Toda resposta da API é dinâmica: sem cache HTTP condicional. Também começa a
+//cronometrar a request aqui (Server-Timing só é aplicado no fim de cada rota).
+api.use((_req, res, next) => {
+  res.set("Cache-Control", "no-store");
+  iniciarTiming(res);
+  next();
+});
 api.use("/auth", authRouter);
 api.use(requireUser);
 api.use("/init", initRouter);
@@ -71,7 +85,7 @@ if (process.env.NODE_ENV === "production" && fs.existsSync(clientDist)) {
     })
   );
   app.use((req, res, next) => {
-    if (req.method === "GET" && !req.path.startsWith("/api")) {
+    if ((req.method === "GET" || req.method === "HEAD") && !req.path.startsWith("/api")) {
       // index.html não tem hash no nome: precisa revalidar a cada load para
       // pegar o novo deploy (os assets com hash é que ficam "immutable").
       // { root } em vez de path.join: sendFile aplica o check de dotfile no
@@ -109,6 +123,28 @@ app.listen(port, () => {
       if (r.status === "rejected") console.error("[Aquecimento] falhou:", r.reason);
     });
   });
+
+  if (process.env.NODE_ENV === "production") {
+    // O balanceador da AWS na frente do pooler do Supabase (modo sessão,
+    // aws-1-sa-east-1) derruba conexões ociosas sem avisar; um SELECT 1 por
+    // minuto em até 3 conexões do pool evita que a próxima request pague
+    // reconexão + handshake TLS EU→BR. unref() para não travar o shutdown.
+    const keepAlive = setInterval(() => {
+      Promise.all([
+        prisma.$queryRaw`SELECT 1`,
+        prisma.$queryRaw`SELECT 1`,
+        prisma.$queryRaw`SELECT 1`,
+      ]).catch((err) => console.error("[Keep-alive] falhou:", err));
+    }, 60_000);
+    keepAlive.unref();
+
+    // Cache de usuários sempre quente: renova antes do TTL vencer, sem janela
+    // sem dados (renovar só troca o valor depois que o loader termina).
+    const renovarCache = setInterval(() => {
+      renovarUsuarios().catch((err) => console.error("[Cache] renovarUsuarios falhou:", err));
+    }, 5 * 60_000);
+    renovarCache.unref();
+  }
 });
 
 export type { AuthedResponse };
diff --git a/server/lib/cache.ts b/server/lib/cache.ts
index 4a57f93..928ce93 100644
--- a/server/lib/cache.ts
+++ b/server/lib/cache.ts
@@ -15,3 +15,13 @@ export function invalidate(prefix?: string): void {
   if (!prefix) { store.clear(); return; }
   for (const k of store.keys()) if (k.startsWith(prefix)) store.delete(k);
 }
+
+//Renova um valor sem janela vazia: só troca o que está guardado depois que o
+//loader termina (diferente de invalidate+getOrSet, que deixaria uma request
+//no meio pagando o loader de novo). Erro do loader propaga: quem chama decide
+//se tenta de novo depois; o valor antigo continua servindo até então.
+export async function renovar<T>(key: string, ttlMs: number, loader: () => Promise<T>): Promise<T> {
+  const value = await loader();
+  store.set(key, { value, expiresAt: Date.now() + ttlMs });
+  return value;
+}
diff --git a/server/lib/prisma.server.ts b/server/lib/prisma.server.ts
index c3d3559..06d4d0b 100644
--- a/server/lib/prisma.server.ts
+++ b/server/lib/prisma.server.ts
@@ -1,7 +1,7 @@
-import { PrismaClient } from "@prisma/client";
+import { Prisma, PrismaClient } from "@prisma/client";
 
 declare global {
-  var __prisma: PrismaClient | undefined;
+  var __prisma: ReturnType<typeof criarClient> | undefined;
 }
 
 function buildDatasourceUrl(): string | undefined {
@@ -30,10 +30,51 @@ function buildDatasourceUrl(): string | undefined {
 const logLevels: ("query" | "warn" | "error")[] =
   process.env.LOG_QUERIES === "1" ? ["query", "warn", "error"] : ["warn", "error"];
 
-const prisma = global.__prisma ?? new PrismaClient({
-  log: logLevels,
-  datasourceUrl: buildDatasourceUrl(),
-});
+//Operações de leitura: seguras para refazer sem duplicar efeito colateral
+//(escritas ficam de fora do retry por isso). Cobre modelos e as chamadas raw.
+const OPERACOES_LEITURA = new Set([
+  "findMany", "findFirst", "findUnique", "findFirstOrThrow", "findUniqueOrThrow",
+  "count", "aggregate", "groupBy", "$queryRaw", "$queryRawUnsafe",
+]);
+
+//O pooler do Supabase (modo sessão, aws-1-sa-east-1) derruba conexões ociosas
+//sem avisar; a 1ª query após um tempo parado falha com P1001/P1002/P1017 (ou
+//PrismaClientInitializationError/"Can't reach database server") em vez de só
+//reconectar. Isolado para o retry abaixo reusar.
+function isErroDeConexao(err: unknown): boolean {
+  if (err instanceof Prisma.PrismaClientKnownRequestError) {
+    return err.code === "P1001" || err.code === "P1002" || err.code === "P1017";
+  }
+  if (err instanceof Prisma.PrismaClientInitializationError) return true;
+  const msg = err instanceof Error ? err.message : String(err);
+  return msg.includes("Can't reach database server");
+}
+
+function criarClient() {
+  return new PrismaClient({
+    log: logLevels,
+    datasourceUrl: buildDatasourceUrl(),
+  }).$extends({
+    query: {
+      //$allOperations sob `query` (Prisma 5) cobre modelos e raw no mesmo
+      //lugar. Refaz uma vez, só leitura, dando ~250ms para o engine
+      //reconectar (a 2ª tentativa já paga o handshake, não a request do
+      //usuário original).
+      async $allOperations({ model, operation, args, query }) {
+        try {
+          return await query(args);
+        } catch (err) {
+          if (!OPERACOES_LEITURA.has(operation) || !isErroDeConexao(err)) throw err;
+          console.warn(`[Prisma] refazendo ${model ?? ""}.${operation} após erro de conexão`);
+          await new Promise((resolve) => setTimeout(resolve, 250));
+          return query(args);
+        }
+      },
+    },
+  });
+}
+
+const prisma = global.__prisma ?? criarClient();
 
 if (process.env.NODE_ENV !== "production") {
   global.__prisma = prisma;
diff --git a/server/lib/timing.ts b/server/lib/timing.ts
new file mode 100644
index 0000000..a2cc33c
--- /dev/null
+++ b/server/lib/timing.ts
@@ -0,0 +1,25 @@
+import type { Response } from "express";
+
+//Header Server-Timing: mostra no DevTools quanto tempo cada etapa gastou no
+//servidor (auth, db, app) sem precisar abrir o log do Dokploy. iniciarTiming
+//roda cedo (middleware do router api); marcar registra uma etapa já medida
+//por fora; aplicarServerTiming monta o header antes do res.json.
+interface Marca { nome: string; dur: number }
+
+export function iniciarTiming(res: Response): void {
+  res.locals.timing = { t0: Date.now(), marcas: [] as Marca[] };
+}
+
+export function marcar(res: Response, nome: string, inicio: number): void {
+  const timing = res.locals.timing;
+  if (!timing) return;
+  timing.marcas.push({ nome, dur: Date.now() - inicio });
+}
+
+export function aplicarServerTiming(res: Response): void {
+  const timing = res.locals.timing;
+  if (!timing) return;
+  const partes = timing.marcas.map((m: Marca) => `${m.nome};dur=${m.dur}`);
+  partes.push(`app;dur=${Date.now() - timing.t0}`);
+  res.set("Server-Timing", partes.join(", "));
+}
diff --git a/server/middlewares/auth.ts b/server/middlewares/auth.ts
index b7e015f..158c0f0 100644
--- a/server/middlewares/auth.ts
+++ b/server/middlewares/auth.ts
@@ -1,6 +1,7 @@
 import type { NextFunction, Request, Response } from "express";
 import { resolveAuth, type AuthedUser } from "../services/auth.server";
 import { SupabaseAdminService } from "../services/supabase-admin.server";
+import { marcar } from "../lib/timing";
 
 export interface AuthedResponse extends Response {
   locals: { user?: AuthedUser; [key: string]: any };
@@ -33,7 +34,9 @@ export async function requireUser(req: Request, res: AuthedResponse, next: NextF
       throw err;
     }
 
+    const inicio = Date.now();
     const conta = await SupabaseAdminService.buscarPorId(user.id);
+    marcar(res, "auth", inicio);
     if (conta === null || conta?.bloqueado) {
       const err: any = new Error("Sessão encerrada. Entre novamente.");
       err.status = 401;
diff --git a/server/routes/dashboard.ts b/server/routes/dashboard.ts
index 221a3e9..ac188da 100644
--- a/server/routes/dashboard.ts
+++ b/server/routes/dashboard.ts
@@ -1,5 +1,6 @@
 import { Router } from "express";
 import { DashboardService, type DashboardFiltros } from "../services/dashboard.server";
+import { aplicarServerTiming } from "../lib/timing";
 
 export const dashboardRouter = Router();
 
@@ -25,6 +26,7 @@ function parseFiltros(query: Record<string, any>): DashboardFiltros {
 dashboardRouter.get("/", async (req, res, next) => {
   try {
     const resumo = await DashboardService.resumo(parseFiltros(req.query as Record<string, any>));
+    aplicarServerTiming(res);
     res.json(resumo);
   } catch (err) {
     next(err);
diff --git a/server/routes/init.ts b/server/routes/init.ts
index 351bc8a..a300b38 100644
--- a/server/routes/init.ts
+++ b/server/routes/init.ts
@@ -3,6 +3,7 @@ import { PastaService } from "../services/pasta.server";
 import { OperacaoService } from "../services/operacao.server";
 import { OrdemColunasService } from "../services/config.server";
 import { getUser, type AuthedResponse } from "../middlewares/auth";
+import { aplicarServerTiming } from "../lib/timing";
 
 export const initRouter = Router();
 
@@ -15,5 +16,6 @@ initRouter.get("/", async (_req, res: AuthedResponse) => {
     OrdemColunasService.get().catch(() => null),
     OperacaoService.contarEmissoesAntigasPorPasta().catch(() => ({})),
   ]);
+  aplicarServerTiming(res);
   res.json({ user, pastas, totalInbox, columnOrder, emissaoAntigasPorPasta });
 });
diff --git a/server/routes/operacoes.ts b/server/routes/operacoes.ts
index ac0cc43..7df618a 100644
--- a/server/routes/operacoes.ts
+++ b/server/routes/operacoes.ts
@@ -3,6 +3,7 @@ import multer from "multer";
 import { OperacaoService } from "../services/operacao.server";
 import { OperacaoImportService } from "../services/operacao-import.server";
 import { getUser, type AuthedResponse } from "../middlewares/auth";
+import { aplicarServerTiming } from "../lib/timing";
 
 const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 25 * 1024 * 1024 } });
 
@@ -35,7 +36,9 @@ operacoesRouter.get("/", async (req, res: AuthedResponse, next) => {
   try {
     getUser(res);
     const params = parseParams(req.query as Record<string, unknown>);
-    const dados = await OperacaoService.listarOperacoesLocal(params);
+    const { dbMs, ...dados } = await OperacaoService.listarOperacoesLocal(params);
+    res.locals.timing.marcas.push({ nome: "db", dur: dbMs });
+    aplicarServerTiming(res);
     res.json(dados);
   } catch (err) {
     next(err);
diff --git a/server/services/operacao.server.ts b/server/services/operacao.server.ts
index d423567..bac32ac 100644
--- a/server/services/operacao.server.ts
+++ b/server/services/operacao.server.ts
@@ -86,6 +86,7 @@ export class OperacaoService {
     // de rede — o gargalo real aqui é latência (VPS/DB na Europa), não o SQL.
     // As duas outras queries (placas duplicadas e regras de prazo) não dependem
     // do resultado da principal: disparam todas juntas no mesmo Promise.all.
+    const dbInicio = Date.now();
     const [data, placasDuplicadas, regras] = await Promise.all([
       prisma.$queryRawUnsafe<any[]>(`
         SELECT
@@ -106,6 +107,7 @@ export class OperacaoService {
       this.placasDuplicadasDaPasta(pid),
       PrazoService.regras(),
     ]);
+    const dbMs = Date.now() - dbInicio;
     const agora = Date.now();
     const MILIS_DIA = 24 * 60 * 60 * 1000;
 
@@ -152,6 +154,7 @@ export class OperacaoService {
     return {
       data: sanitizedData,
       meta: { total, totalVl, page: p, limit: l, totalPages: Math.ceil(total / l) },
+      dbMs,
     };
   }
 
diff --git a/server/services/supabase-admin.server.ts b/server/services/supabase-admin.server.ts
index baa488e..0a4d47b 100644
--- a/server/services/supabase-admin.server.ts
+++ b/server/services/supabase-admin.server.ts
@@ -1,5 +1,5 @@
 import { createClient } from "@supabase/supabase-js";
-import { getOrSet } from "../lib/cache";
+import { getOrSet, renovar } from "../lib/cache";
 
 export interface UsuarioAdmin {
   id: string;
@@ -77,6 +77,13 @@ async function carregarUsuarios(): Promise<UsuarioAdmin[]> {
   return totalUsuarios.map(mapearUsuario);
 }
 
+//Recarrega a lista antes do TTL vencer (chamado por um setInterval de 5 min em
+//produção) — assim o cache nunca fica frio e ninguém paga a ida ao Supabase
+//Auth só por má sorte de horário.
+export async function renovarUsuarios(): Promise<UsuarioAdmin[]> {
+  return renovar(USUARIOS_CACHE_KEY, USUARIOS_TTL, carregarUsuarios);
+}
+
 export const SupabaseAdminService = {
   //Lista completa vem do cache (getOrSet); a paginação pedida é só uma fatia
   //em memória — a ordenação continua correta mesmo com a base > 1 página.
diff --git a/tailwind.config.js b/tailwind.config.js
index db80952..2339ac7 100644
--- a/tailwind.config.js
+++ b/tailwind.config.js
@@ -24,6 +24,7 @@ export default {
         'border-focus': 'var(--border-focus)',
         surface: 'var(--surface)',
         'surface-light': 'var(--surface-light)',
+        skeleton: 'var(--skeleton)',
         'badge-primary-text': 'var(--badge-primary-text)',
         'badge-primary-bg': 'var(--badge-primary-bg)',
         'badge-error-text': 'var(--badge-error-text)',

From 5df8554740621ce253df5da4818a6f14fd5f5b0f Mon Sep 17 00:00:00 2001
From: pauloeduas-software <pauloeduas.software@gmail.com>
Date: Mon, 14 Sep 2026 11:11:14 -0300
Subject: [PATCH 09/12] feat: permitir criar e editar pasta sem faturista

---
 app/components/Sidebar.tsx           |  6 +++---
 app/components/SidebarFolderItem.tsx |  6 +++---
 server/routes/pastas.ts              | 12 ++----------
 server/services/pasta.server.ts      | 18 ++++++++----------
 4 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/app/components/Sidebar.tsx b/app/components/Sidebar.tsx
index 29385bb..296ba11 100644
--- a/app/components/Sidebar.tsx
+++ b/app/components/Sidebar.tsx
@@ -57,7 +57,7 @@ export const Sidebar = React.memo(({
 
   const handleCreateFolder = useCallback(async (e: React.FormEvent) => {
     e.preventDefault();
-    if (!newFolderName.trim() || !newFolderFaturista || isCreating) return;
+    if (!newFolderName.trim() || isCreating) return;
     setIsCreating(true);
     try {
       await api.post("/pastas", { nome: newFolderName, cor: newFolderColor, faturistaId: newFolderFaturista });
@@ -219,7 +219,7 @@ export const Sidebar = React.memo(({
                   onChange={e => setNewFolderFaturista(e.target.value)}
                   className="w-full bg-card-bg dark:bg-bg rounded-lg px-2 py-1 text-xs font-bold outline-none border border-[rgba(0,0,0,0.12)] dark:border-glass-border focus:border-primary text-text"
                 >
-                  <option value="" disabled>Faturista responsável...</option>
+                  <option value="">Sem faturista</option>
                   {faturistas.map(f => (
                     <option key={f.id} value={f.id}>{f.nome || f.email}</option>
                   ))}
@@ -232,7 +232,7 @@ export const Sidebar = React.memo(({
                   </div>
                   <div className="flex gap-1">
                     <button type="button" onClick={() => setIsAddingFolder(false)} className="p-1 hover:text-rose-500"><X size={14}/></button>
-                    <button type="submit" disabled={isCreating || !newFolderFaturista} className="p-1 hover:text-emerald-500 disabled:opacity-40"><CheckCircle2 size={14}/></button>
+                    <button type="submit" disabled={isCreating} className="p-1 hover:text-emerald-500 disabled:opacity-40"><CheckCircle2 size={14}/></button>
                   </div>
                 </div>
               </form>
diff --git a/app/components/SidebarFolderItem.tsx b/app/components/SidebarFolderItem.tsx
index 8de604e..1529510 100644
--- a/app/components/SidebarFolderItem.tsx
+++ b/app/components/SidebarFolderItem.tsx
@@ -56,7 +56,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
   }, [folder]);
 
   const submitRename = useCallback(async () => {
-    if (!editingValue.trim() || !editingFaturista || isPending) return;
+    if (!editingValue.trim() || isPending) return;
     setIsPending(true);
     try {
       await api.patch(`/pastas/${folder.id}`, { nome: editingValue, cor: editingColor, faturistaId: editingFaturista });
@@ -109,7 +109,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
           onChange={(e) => setEditingFaturista(e.target.value)}
           className="w-full bg-card-bg dark:bg-bg border border-[rgba(0,0,0,0.12)] dark:border-glass-border rounded-lg px-2 py-1 text-xs font-bold outline-none focus:border-primary text-text"
         >
-          <option value="" disabled>Faturista responsável...</option>
+          <option value="">Sem faturista</option>
           {faturistas.map((f) => (
             <option key={f.id} value={f.id}>{f.nome || f.email}</option>
           ))}
@@ -137,7 +137,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
             <button onClick={cancelEdit} className="p-1 hover:text-rose-500">
               <X size={14} />
             </button>
-            <button onClick={submitRename} disabled={isPending || !editingFaturista} className="p-1 hover:text-emerald-500 disabled:opacity-40">
+            <button onClick={submitRename} disabled={isPending} className="p-1 hover:text-emerald-500 disabled:opacity-40">
               <CheckCircle2 size={14} />
             </button>
           </div>
diff --git a/server/routes/pastas.ts b/server/routes/pastas.ts
index e2be51c..87c3c38 100644
--- a/server/routes/pastas.ts
+++ b/server/routes/pastas.ts
@@ -38,11 +38,7 @@ pastasRouter.post("/", async (req, res, next) => {
       res.status(400).json({ error: "Informe o nome da pasta." });
       return;
     }
-    if (!faturistaId) {
-      res.status(400).json({ error: "Informe o faturista responsável pela pasta." });
-      return;
-    }
-    const pasta = await PastaService.criar(nome, cor, faturistaId);
+    const pasta = await PastaService.criar(nome, cor, faturistaId || null);
     res.json({ success: true, pasta });
   } catch (err: any) {
     if (!err?.status) err.status = 400;
@@ -60,11 +56,7 @@ pastasRouter.patch("/:id", async (req, res, next) => {
       res.status(400).json({ error: "Informe o nome da pasta." });
       return;
     }
-    if (!faturistaId) {
-      res.status(400).json({ error: "Informe o faturista responsável pela pasta." });
-      return;
-    }
-    const pasta = await PastaService.atualizar(id, nome, cor, faturistaId);
+    const pasta = await PastaService.atualizar(id, nome, cor, faturistaId || null);
     res.json({ success: true, pasta });
   } catch (err: any) {
     if (!err?.status) err.status = 400;
diff --git a/server/services/pasta.server.ts b/server/services/pasta.server.ts
index 36e197f..8b73569 100644
--- a/server/services/pasta.server.ts
+++ b/server/services/pasta.server.ts
@@ -71,13 +71,12 @@ export class PastaService {
     });
   }
 
-  static async criar(nome: string, cor?: string, faturistaId?: string) {
+  static async criar(nome: string, cor?: string, faturistaId?: string | null) {
     this.invalidarCache();
 
-    if (!faturistaId) {
-      throw new Error("Informe o faturista responsável pela pasta.");
+    if (faturistaId) {
+      await this.validarFaturista(faturistaId);
     }
-    await this.validarFaturista(faturistaId);
 
     // Validar se já existe
     const existe = await prisma.pasta.findUnique({ where: { nome } });
@@ -86,7 +85,7 @@ export class PastaService {
     }
 
     const pasta = await prisma.pasta.create({
-      data: { nome, cor, faturistaId }
+      data: { nome, cor, faturistaId: faturistaId || null }
     });
 
 
@@ -94,7 +93,7 @@ export class PastaService {
     return pasta;
   }
 
-  static async atualizar(id: number, nome: string, cor?: string, faturistaId?: string) {
+  static async atualizar(id: number, nome: string, cor?: string, faturistaId?: string | null) {
     this.invalidarCache();
     
     // Validar se o novo nome já existe para outra pasta
@@ -108,15 +107,14 @@ export class PastaService {
       throw new Error("Já existe uma pasta com este nome.");
     }
 
-    if (!faturistaId) {
-      throw new Error("Informe o faturista responsável pela pasta.");
+    if (faturistaId) {
+      await this.validarFaturista(faturistaId);
     }
-    await this.validarFaturista(faturistaId);
 
 
     const pasta = await prisma.pasta.update({
       where: { id },
-      data: { nome, cor, faturistaId }
+      data: { nome, cor, faturistaId: faturistaId || null }
     });
 
 

From c1f266680f148d45fd8a72ef0d292ac810eda765 Mon Sep 17 00:00:00 2001
From: pauloeduas-software <pauloeduas.software@gmail.com>
Date: Mon, 28 Sep 2026 09:24:37 -0300
Subject: [PATCH 10/12] =?UTF-8?q?feat:=20filtro=20de=20emiss=C3=B5es=20ant?=
 =?UTF-8?q?igas=20no=20dashboard=20e=20nova=20barra=20de=20filtros?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/lib/query.ts                    |   3 +
 app/views/DashboardView.tsx         | 393 ++++++++++++++++++++--------
 server/routes/dashboard.ts          |   1 +
 server/services/dashboard.server.ts |   8 +
 4 files changed, 298 insertions(+), 107 deletions(-)

diff --git a/app/lib/query.ts b/app/lib/query.ts
index b19d6a5..5936e5f 100644
--- a/app/lib/query.ts
+++ b/app/lib/query.ts
@@ -100,6 +100,8 @@ export interface DashboardFiltros {
   tipoDocumento?: string;
   tipoCte?: string;
   agencia?: string;
+  // "1" = só emissões antigas (fora do prazo padrão/do cliente).
+  antigas?: string;
 }
 
 export interface DashboardGeral {
@@ -184,6 +186,7 @@ export function filtrosParaQuery(filtros: DashboardFiltros): string {
   if (filtros.tipoDocumento) p.set("tipo", filtros.tipoDocumento);
   if (filtros.tipoCte) p.set("tipoCte", filtros.tipoCte);
   if (filtros.agencia) p.set("agencia", filtros.agencia);
+  if (filtros.antigas) p.set("antigas", filtros.antigas);
   const qs = p.toString();
   return qs ? `?${qs}` : "";
 }
diff --git a/app/views/DashboardView.tsx b/app/views/DashboardView.tsx
index 2ed9a9f..c263e38 100644
--- a/app/views/DashboardView.tsx
+++ b/app/views/DashboardView.tsx
@@ -1,5 +1,5 @@
-import { ChevronDown, Filter, Users, X } from "lucide-react";
-import { Fragment, useState } from "react";
+import { Check, ChevronDown, ChevronLeft, ChevronRight, Filter, Plus, Search, Users, X } from "lucide-react";
+import { Fragment, useCallback, useEffect, useMemo, useState } from "react";
 import {
   useDashboard,
   useDashboardFaturista,
@@ -154,8 +154,196 @@ function DistribuicaoCard({
 // Barra de filtros globais
 // ---------------------------------------------------------------------------
 
-const SELECT_CLS =
-  "h-9 flex-1 min-w-[140px] max-w-[220px] bg-surface border border-glass-border rounded-lg px-3 text-xs font-bold text-text outline-none focus:border-primary cursor-pointer";
+type OpcaoFiltro = { valor: string; label: string };
+
+// Campos oferecidos no menu "+ Filtro". As sentinelas ("sem", "inbox",
+// "__vazio__") entram no fim de cada lista, como nos selects antigos.
+const CAMPOS_FILTRO: {
+  campo: FiltroCampo;
+  label: string;
+  busca?: boolean;
+  opcoes: (o?: DashboardOpcoes) => OpcaoFiltro[];
+}[] = [
+  {
+    campo: "faturistaId",
+    label: "Faturista",
+    opcoes: (o) => [
+      ...(o?.faturistas.map((f) => ({ valor: f.id, label: f.nome })) ?? []),
+      { valor: "sem", label: "Sem faturista" },
+    ],
+  },
+  {
+    campo: "pastaId",
+    label: "Pasta",
+    busca: true,
+    opcoes: (o) => [
+      ...(o?.pastas.map((p) => ({ valor: String(p.id), label: p.nome })) ?? []),
+      { valor: "inbox", label: "Caixa de Entrada" },
+    ],
+  },
+  {
+    campo: "pagador",
+    label: "Cliente",
+    busca: true,
+    opcoes: (o) => o?.clientes.map((c) => ({ valor: c, label: c })) ?? [],
+  },
+  {
+    campo: "status",
+    label: "Status",
+    opcoes: (o) => [
+      ...(o?.status.map((s) => ({ valor: s, label: s })) ?? []),
+      { valor: "__vazio__", label: "Sem status" },
+    ],
+  },
+  {
+    campo: "tipoDocumento",
+    label: "Tipo",
+    opcoes: (o) => [
+      ...(o?.tiposDocumento.map((t) => ({ valor: t, label: t })) ?? []),
+      { valor: "__vazio__", label: "Não informado" },
+    ],
+  },
+  {
+    campo: "tipoCte",
+    label: "Tipo de CTe",
+    opcoes: (o) => [
+      ...(o?.tiposCte.map((t) => ({ valor: t, label: t })) ?? []),
+      { valor: "__vazio__", label: "Não informado" },
+    ],
+  },
+  {
+    campo: "agencia",
+    label: "Agência",
+    busca: true,
+    opcoes: (o) => [
+      ...(o?.agencias.map((a) => ({ valor: a, label: a })) ?? []),
+      { valor: "__vazio__", label: "Sem agência" },
+    ],
+  },
+];
+
+// Lista de clientes pode ter milhares de itens: renderiza só os primeiros.
+const MAX_OPCOES_VISIVEIS = 200;
+
+function MenuFiltro({
+  campoInicial,
+  filtros,
+  opcoes,
+  onEscolher,
+  onFechar,
+}: {
+  campoInicial: FiltroCampo | null;
+  filtros: DashboardFiltros;
+  opcoes?: DashboardOpcoes;
+  onEscolher: (campo: FiltroCampo, valor: string) => void;
+  onFechar: () => void;
+}) {
+  const [campo, setCampo] = useState<FiltroCampo | null>(campoInicial);
+  const [busca, setBusca] = useState("");
+
+  useEffect(() => {
+    const onKey = (e: KeyboardEvent) => e.key === "Escape" && onFechar();
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [onFechar]);
+
+  const def = CAMPOS_FILTRO.find((c) => c.campo === campo);
+
+  const lista = useMemo(() => {
+    if (!def) return [];
+    const termo = busca.trim().toLowerCase();
+    const todas = def.opcoes(opcoes);
+    return termo ? todas.filter((o) => o.label.toLowerCase().includes(termo)) : todas;
+  }, [def, opcoes, busca]);
+
+  return (
+    <>
+      <div className="fixed inset-0 z-40" onClick={onFechar} />
+      <div className="absolute left-0 top-full mt-2 z-50 w-72 bg-card-bg border border-glass-border rounded-xl shadow-[0_20px_60px_rgba(0,0,0,0.25)] overflow-hidden">
+        {!def ? (
+          <div className="p-1.5">
+            <p className="px-2.5 pt-1.5 pb-2 text-[10px] font-bold uppercase tracking-widest text-text-muted">
+              Filtrar por
+            </p>
+            {CAMPOS_FILTRO.map((c) => (
+              <button
+                key={c.campo}
+                type="button"
+                onClick={() => setCampo(c.campo)}
+                className="w-full flex items-center justify-between px-2.5 py-2 rounded-lg text-xs font-bold text-text hover:bg-surface transition-colors"
+              >
+                <span>{c.label}</span>
+                <span className="flex items-center gap-1.5">
+                  {filtros[c.campo] && <span className="w-1.5 h-1.5 rounded-full bg-primary" />}
+                  <ChevronRight size={14} className="text-text-muted" />
+                </span>
+              </button>
+            ))}
+          </div>
+        ) : (
+          <div className="flex flex-col">
+            <div className="flex items-center gap-2 px-2 py-2 border-b border-glass-border">
+              <button
+                type="button"
+                onClick={() => {
+                  setCampo(null);
+                  setBusca("");
+                }}
+                className="p-1 rounded-md text-text-muted hover:text-text hover:bg-surface transition-colors"
+                aria-label="Voltar"
+              >
+                <ChevronLeft size={14} />
+              </button>
+              {def.busca || lista.length > 8 ? (
+                <div className="flex-1 flex items-center gap-2 min-w-0">
+                  <Search size={13} className="text-text-muted shrink-0" />
+                  <input
+                    autoFocus
+                    value={busca}
+                    onChange={(e) => setBusca(e.target.value)}
+                    placeholder={`Buscar ${def.label.toLowerCase()}...`}
+                    className="flex-1 min-w-0 bg-transparent text-xs font-medium text-text placeholder:text-text-muted outline-none"
+                  />
+                </div>
+              ) : (
+                <span className="text-[10px] font-bold uppercase tracking-widest text-text-muted">
+                  {def.label}
+                </span>
+              )}
+            </div>
+            <div className="max-h-72 overflow-y-auto custom-scrollbar p-1.5">
+              {lista.length === 0 ? (
+                <p className="px-2.5 py-4 text-xs text-text-muted text-center">Nada encontrado.</p>
+              ) : (
+                lista.slice(0, MAX_OPCOES_VISIVEIS).map((o) => {
+                  const ativo = filtros[def.campo] === o.valor;
+                  return (
+                    <button
+                      key={o.valor}
+                      type="button"
+                      onClick={() => onEscolher(def.campo, ativo ? "" : o.valor)}
+                      className={`w-full flex items-center justify-between gap-2 px-2.5 py-2 rounded-lg text-xs text-left transition-colors ${
+                        ativo ? "bg-badge-primary-bg text-badge-primary-text font-bold" : "text-text font-medium hover:bg-surface"
+                      }`}
+                    >
+                      <span className="truncate">{o.label}</span>
+                      {ativo && <Check size={14} className="shrink-0" />}
+                    </button>
+                  );
+                })
+              )}
+              {lista.length > MAX_OPCOES_VISIVEIS && (
+                <p className="px-2.5 py-2 text-[11px] text-text-muted text-center">
+                  Mostrando {MAX_OPCOES_VISIVEIS} de {lista.length}. Refine a busca.
+                </p>
+              )}
+            </div>
+          </div>
+        )}
+      </div>
+    </>
+  );
+}
 
 function FiltrosBar({
   filtros,
@@ -168,122 +356,113 @@ function FiltrosBar({
   onLimpar: () => void;
   opcoes?: DashboardOpcoes;
 }) {
-  const temFiltro = Object.values(filtros).some(Boolean);
+  // null = menu fechado; "novo" = abre na lista de campos; campo = edita o chip.
+  const [menu, setMenu] = useState<FiltroCampo | "novo" | null>(null);
+  const fecharMenu = useCallback(() => setMenu(null), []);
 
-  return (
-    <div className="bg-card-bg border border-glass-border rounded-2xl p-4 shadow-card flex flex-wrap xl:flex-nowrap items-center gap-3">
-      <div className="flex items-center gap-2 text-text-muted shrink-0">
-        <Filter size={14} strokeWidth={2.5} />
-        <span className="text-[10px] font-bold uppercase tracking-widest">Filtros</span>
-      </div>
-
-      <select
-        value={filtros.faturistaId ?? ""}
-        onChange={(e) => onChange("faturistaId", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todos os faturistas</option>
-        {opcoes?.faturistas.map((f) => (
-          <option key={f.id} value={f.id}>
-            {f.nome}
-          </option>
-        ))}
-        <option value="sem">Sem faturista</option>
-      </select>
-
-      <select
-        value={filtros.pastaId ?? ""}
-        onChange={(e) => onChange("pastaId", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todas as pastas</option>
-        {opcoes?.pastas.map((p) => (
-          <option key={p.id} value={String(p.id)}>
-            {p.nome}
-          </option>
-        ))}
-        <option value="inbox">Caixa de Entrada</option>
-      </select>
-
-      <select
-        value={filtros.pagador ?? ""}
-        onChange={(e) => onChange("pagador", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todos os clientes</option>
-        {opcoes?.clientes.map((c) => (
-          <option key={c} value={c}>
-            {c}
-          </option>
-        ))}
-      </select>
+  const temFiltro = Object.values(filtros).some(Boolean);
+  const ativos = CAMPOS_FILTRO.filter((c) => filtros[c.campo]);
+  const soAntigas = filtros.antigas === "1";
 
-      <select
-        value={filtros.status ?? ""}
-        onChange={(e) => onChange("status", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todos os status</option>
-        {opcoes?.status.map((s) => (
-          <option key={s} value={s}>
-            {s}
-          </option>
-        ))}
-        <option value="__vazio__">Sem status</option>
-      </select>
+  const rotuloValor = (def: (typeof CAMPOS_FILTRO)[number], valor: string) =>
+    def.opcoes(opcoes).find((o) => o.valor === valor)?.label ?? valor;
 
-      <select
-        value={filtros.tipoDocumento ?? ""}
-        onChange={(e) => onChange("tipoDocumento", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todos os tipos</option>
-        {opcoes?.tiposDocumento.map((t) => (
-          <option key={t} value={t}>
-            {t}
-          </option>
-        ))}
-        <option value="__vazio__">Não informado</option>
-      </select>
+  const escolher = (campo: FiltroCampo, valor: string) => {
+    onChange(campo, valor);
+    setMenu(null);
+  };
 
-      <select
-        value={filtros.tipoCte ?? ""}
-        onChange={(e) => onChange("tipoCte", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todos os tipos de CTe</option>
-        {opcoes?.tiposCte.map((t) => (
-          <option key={t} value={t}>
-            {t}
-          </option>
-        ))}
-        <option value="__vazio__">Não informado</option>
-      </select>
+  return (
+    <div className="bg-card-bg border border-glass-border rounded-2xl px-4 py-3 shadow-card flex flex-wrap items-center gap-2">
+      {ativos.map((def) => (
+        <div key={def.campo} className="relative">
+          <div className="flex items-center h-8 rounded-lg bg-badge-primary-bg text-xs overflow-hidden">
+            <button
+              type="button"
+              onClick={() => setMenu(def.campo)}
+              className="flex items-center gap-1 pl-2.5 pr-1.5 h-full max-w-[260px] hover:opacity-80 transition-opacity"
+            >
+              <span className="font-medium text-text-muted">{def.label}:</span>
+              <span className="font-bold text-badge-primary-text truncate">
+                {rotuloValor(def, filtros[def.campo]!)}
+              </span>
+            </button>
+            <button
+              type="button"
+              onClick={() => onChange(def.campo, "")}
+              className="h-full px-1.5 text-badge-primary-text opacity-70 hover:opacity-100 transition-opacity"
+              aria-label={`Remover filtro ${def.label}`}
+            >
+              <X size={13} />
+            </button>
+          </div>
+          {menu === def.campo && (
+            <MenuFiltro
+              campoInicial={def.campo}
+              filtros={filtros}
+              opcoes={opcoes}
+              onEscolher={escolher}
+              onFechar={fecharMenu}
+            />
+          )}
+        </div>
+      ))}
 
-      <select
-        value={filtros.agencia ?? ""}
-        onChange={(e) => onChange("agencia", e.target.value)}
-        className={SELECT_CLS}
-      >
-        <option value="">Todas as agências</option>
-        {opcoes?.agencias.map((a) => (
-          <option key={a} value={a}>
-            {a}
-          </option>
-        ))}
-        <option value="__vazio__">Sem agência</option>
-      </select>
+      <div className="relative">
+        <button
+          type="button"
+          onClick={() => setMenu(menu === "novo" ? null : "novo")}
+          className="flex items-center gap-1.5 h-8 px-3 rounded-lg border border-dashed border-glass-border text-xs font-bold text-text-muted hover:text-text hover:border-primary hover:bg-surface transition-all"
+        >
+          <Filter size={13} strokeWidth={2.5} />
+          {ativos.length === 0 ? "Adicionar filtro" : "Filtro"}
+          <Plus size={13} strokeWidth={2.5} />
+        </button>
+        {menu === "novo" && (
+          <MenuFiltro
+            campoInicial={null}
+            filtros={filtros}
+            opcoes={opcoes}
+            onEscolher={escolher}
+            onFechar={fecharMenu}
+          />
+        )}
+      </div>
 
       {temFiltro && (
         <button
           type="button"
           onClick={onLimpar}
-          className="flex items-center gap-1.5 h-9 px-3 rounded-lg bg-surface border border-glass-border text-[11px] font-bold text-text-muted hover:text-badge-error-text hover:border-badge-error-text/40 transition-all shrink-0"
+          className="h-8 px-2 text-[11px] font-bold text-text-muted hover:text-badge-error-text transition-colors"
         >
-          <X size={13} />
-          Limpar filtros
+          Limpar
         </button>
       )}
+
+      <button
+        type="button"
+        role="switch"
+        aria-checked={soAntigas}
+        onClick={() => onChange("antigas", soAntigas ? "" : "1")}
+        className={`ml-auto flex items-center gap-2 h-8 px-3 rounded-lg border text-xs font-bold transition-all ${
+          soAntigas
+            ? "bg-badge-warning-bg border-transparent text-badge-warning-text"
+            : "bg-surface border-glass-border text-text-muted hover:text-text"
+        }`}
+      >
+        <span
+          className={`relative w-7 h-4 rounded-full transition-colors ${
+            soAntigas ? "bg-warning" : "bg-text-muted"
+          }`}
+        >
+          <span
+            className={`absolute top-0.5 left-0.5 w-3 h-3 rounded-full bg-white shadow transition-transform ${
+              soAntigas ? "translate-x-3" : ""
+            }`}
+          />
+        </span>
+        Só emissões antigas
+      </button>
     </div>
   );
 }
diff --git a/server/routes/dashboard.ts b/server/routes/dashboard.ts
index ac188da..9c43736 100644
--- a/server/routes/dashboard.ts
+++ b/server/routes/dashboard.ts
@@ -19,6 +19,7 @@ function parseFiltros(query: Record<string, any>): DashboardFiltros {
     tipoDocumento: texto(query.tipo),
     tipoCte: texto(query.tipoCte),
     agencia: texto(query.agencia),
+    antigas: query.antigas === "1" ? "1" : undefined,
   };
 }
 
diff --git a/server/services/dashboard.server.ts b/server/services/dashboard.server.ts
index ed01b5b..b9f4ea9 100644
--- a/server/services/dashboard.server.ts
+++ b/server/services/dashboard.server.ts
@@ -32,6 +32,8 @@ export interface DashboardFiltros {
   tipoDocumento?: string | null;
   tipoCte?: string | null;
   agencia?: string | null;
+  // "1" = só emissões antigas (mesma regra de prazo do filtro "Antigos" da grid).
+  antigas?: string | null;
 }
 
 export interface DashboardGeral {
@@ -369,6 +371,12 @@ export class DashboardService {
 
     const params: any[] = [];
     const conds = this.construirWhereFiltros(filtros, params);
+    // A CTE lê "Operacao" sem alias, então o próprio nome da tabela serve de prefixo.
+    if (filtros.antigas) {
+      conds.push(
+        `("Operacao".dt_emissao_ IS NOT NULL AND ${OperacaoQueryBuilder.construirCondicaoAntigas(regras, params, `"Operacao"`)})`
+      );
+    }
     const whereSql = conds.length > 0 ? `WHERE ${conds.join(" AND ")}` : "";
     const condicaoAntigas = OperacaoQueryBuilder.construirCondicaoAntigas(regras, params, "f");
 

From 98b121076cd80c6f491e1d1ee88f2bb031817db9 Mon Sep 17 00:00:00 2001
From: pauloeduas-software <pauloeduas.software@gmail.com>
Date: Tue, 29 Sep 2026 13:05:02 -0300
Subject: [PATCH 11/12] =?UTF-8?q?feat:=20vincular=20faturistas=20e=20geren?=
 =?UTF-8?q?ciar=20automa=C3=A7=C3=B5es=20restrito=20a=20administradores?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- A página de Automações passa a ser exclusiva de administradores: o link some
  do menu para os demais usuários, a rota redireciona para o início e a API
  de regras (listar, criar e remover) responde 403 para quem não é admin
- Criar, renomear e trocar a cor de pastas continua liberado para todos, mas o
  seletor de faturista só aparece para administradores, e a lista de
  faturistas só é carregada para eles
- O servidor recusa (403) qualquer tentativa de um não-admin de definir ou
  remover o faturista de uma pasta, mesmo chamando a API direto
- Corrige a edição de pasta por não-admins apagando o faturista sem querer:
  antes o formulário sempre enviava o campo, e renomear a pasta a deixava sem
  responsável; agora, sem o campo, o faturista atual é mantido
- A checagem de admin (cookie + cadastro atual no Supabase) foi extraída para
  ehAdmin(), reaproveitada pelo requireAdmin e pelas rotas de pasta, então um
  rebaixamento de cargo vale na hora também para essas ações
---
 app/AppRoutes.tsx                    |  2 +-
 app/components/Sidebar.tsx           | 58 ++++++++++++++++------------
 app/components/SidebarFolderItem.tsx | 37 +++++++++++-------
 server/index.ts                      |  2 +-
 server/middlewares/auth.ts           | 15 ++++---
 server/routes/pastas.ts              | 32 ++++++++++-----
 server/services/pasta.server.ts      |  3 +-
 7 files changed, 89 insertions(+), 60 deletions(-)

diff --git a/app/AppRoutes.tsx b/app/AppRoutes.tsx
index 76107e2..d466875 100644
--- a/app/AppRoutes.tsx
+++ b/app/AppRoutes.tsx
@@ -58,9 +58,9 @@ export function AppRoutes() {
             <Route path="dashboard" element={<DashboardPage />} />
             <Route path="caixa-de-entrada" element={<OperacoesPage />} />
             <Route path="pastas/:nome" element={<OperacoesPage />} />
-            <Route path="automacoes" element={<AutomacoesPage />} />
             <Route path="perfil" element={<PerfilPage />} />
             <Route element={<RequireAdmin />}>
+              <Route path="automacoes" element={<AutomacoesPage />} />
               <Route path="admin/usuarios" element={<UsuariosPage />} />
             </Route>
           </Route>
diff --git a/app/components/Sidebar.tsx b/app/components/Sidebar.tsx
index 296ba11..8d9f1b0 100644
--- a/app/components/Sidebar.tsx
+++ b/app/components/Sidebar.tsx
@@ -40,8 +40,10 @@ export const Sidebar = React.memo(({
   const [searchQuery, setSearchQuery] = useState("");
   const [filterColor, setFilterColor] = useState("");
 
-  // Só busca a lista de faturistas com o formulário de nova pasta aberto.
-  const { data: faturistasData } = useFaturistas(isAddingFolder);
+  const isAdmin = user?.app_metadata?.role === "admin";
+
+  // Só busca a lista de faturistas (admin) com o formulário de nova pasta aberto.
+  const { data: faturistasData } = useFaturistas(isAddingFolder && isAdmin);
   const faturistas = faturistasData?.faturistas || [];
 
   const normalize = (value: string) => value.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "");
@@ -60,7 +62,11 @@ export const Sidebar = React.memo(({
     if (!newFolderName.trim() || isCreating) return;
     setIsCreating(true);
     try {
-      await api.post("/pastas", { nome: newFolderName, cor: newFolderColor, faturistaId: newFolderFaturista });
+      await api.post("/pastas", {
+        nome: newFolderName,
+        cor: newFolderColor,
+        ...(isAdmin && { faturistaId: newFolderFaturista }),
+      });
       setNewFolderName("");
       setNewFolderColor(PRESET_COLORS[0]);
       setNewFolderFaturista("");
@@ -71,7 +77,7 @@ export const Sidebar = React.memo(({
     } finally {
       setIsCreating(false);
     }
-  }, [newFolderName, newFolderColor, newFolderFaturista, isCreating, showAlert]);
+  }, [newFolderName, newFolderColor, newFolderFaturista, isAdmin, isCreating, showAlert]);
 
   return (
     <aside className={`${isCollapsed ? 'w-[72px]' : 'w-[240px]'} bg-card-bg dark:bg-bg border-r border-glass-border transition-all duration-300 flex flex-col relative z-20`}>
@@ -129,16 +135,18 @@ export const Sidebar = React.memo(({
               )}
             </NavLink>
 
-            <NavLink to="/automacoes" className={({ isActive }) => `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${isActive ? 'text-primary bg-primary/10 dark:bg-transparent before:absolute before:-left-2 before:top-1/2 before:-translate-y-1/2 before:w-1 before:h-5 before:bg-primary before:rounded-r' : 'text-text-muted hover:text-text hover:bg-surface-light'}`}>
-              {() => (
-                <div className="flex items-center gap-2.5">
-                  <Zap size={18} className="shrink-0" />
-                  {!isCollapsed && <span>Automações</span>}
-                </div>
-              )}
-            </NavLink>
+            {isAdmin && (
+              <NavLink to="/automacoes" className={({ isActive }) => `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${isActive ? 'text-primary bg-primary/10 dark:bg-transparent before:absolute before:-left-2 before:top-1/2 before:-translate-y-1/2 before:w-1 before:h-5 before:bg-primary before:rounded-r' : 'text-text-muted hover:text-text hover:bg-surface-light'}`}>
+                {() => (
+                  <div className="flex items-center gap-2.5">
+                    <Zap size={18} className="shrink-0" />
+                    {!isCollapsed && <span>Automações</span>}
+                  </div>
+                )}
+              </NavLink>
+            )}
 
-            {user?.app_metadata?.role === "admin" && (
+            {isAdmin && (
               <NavLink to="/admin/usuarios" className={({ isActive }) => `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${isActive ? 'text-primary bg-primary/10 dark:bg-transparent before:absolute before:-left-2 before:top-1/2 before:-translate-y-1/2 before:w-1 before:h-5 before:bg-primary before:rounded-r' : 'text-text-muted hover:text-text hover:bg-surface-light'}`}>
                 {() => (
                   <div className="flex items-center gap-2.5">
@@ -214,16 +222,18 @@ export const Sidebar = React.memo(({
             {isAddingFolder && !isCollapsed && (
               <form onSubmit={handleCreateFolder} className="px-3 mb-2 space-y-2 bg-surface rounded-xl p-2 border border-glass-border">
                 <input autoFocus value={newFolderName} onChange={e => setNewFolderName(e.target.value)} placeholder="Nome..." className="w-full bg-card-bg dark:bg-bg rounded-lg px-2 py-1 text-xs font-bold outline-none border border-[rgba(0,0,0,0.12)] dark:border-glass-border focus:border-primary text-text placeholder:text-text-dim" />
-                <select
-                  value={newFolderFaturista}
-                  onChange={e => setNewFolderFaturista(e.target.value)}
-                  className="w-full bg-card-bg dark:bg-bg rounded-lg px-2 py-1 text-xs font-bold outline-none border border-[rgba(0,0,0,0.12)] dark:border-glass-border focus:border-primary text-text"
-                >
-                  <option value="">Sem faturista</option>
-                  {faturistas.map(f => (
-                    <option key={f.id} value={f.id}>{f.nome || f.email}</option>
-                  ))}
-                </select>
+                {isAdmin && (
+                  <select
+                    value={newFolderFaturista}
+                    onChange={e => setNewFolderFaturista(e.target.value)}
+                    className="w-full bg-card-bg dark:bg-bg rounded-lg px-2 py-1 text-xs font-bold outline-none border border-[rgba(0,0,0,0.12)] dark:border-glass-border focus:border-primary text-text"
+                  >
+                    <option value="">Sem faturista</option>
+                    {faturistas.map(f => (
+                      <option key={f.id} value={f.id}>{f.nome || f.email}</option>
+                    ))}
+                  </select>
+                )}
                 <div className="flex justify-between items-center px-1">
                   <div className="flex gap-1.5">
                     {PRESET_COLORS.map(c => (
@@ -239,7 +249,7 @@ export const Sidebar = React.memo(({
             )}
 
             {filteredPastas.map((p: any) => (
-              <SidebarFolderItem key={p.id} folder={p} isCollapsed={isCollapsed} antigas={emissaoAntigasPorPasta[String(p.id)] ?? 0} />
+              <SidebarFolderItem key={p.id} folder={p} isCollapsed={isCollapsed} antigas={emissaoAntigasPorPasta[String(p.id)] ?? 0} isAdmin={isAdmin} />
             ))}
 
             {!isCollapsed && pastas.length > 0 && filteredPastas.length === 0 && (
diff --git a/app/components/SidebarFolderItem.tsx b/app/components/SidebarFolderItem.tsx
index 1529510..5d4ddc9 100644
--- a/app/components/SidebarFolderItem.tsx
+++ b/app/components/SidebarFolderItem.tsx
@@ -30,17 +30,18 @@ interface SidebarFolderItemProps {
   folder: FolderType;
   isCollapsed: boolean;
   antigas?: number;
+  isAdmin?: boolean;
 }
 
-export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0 }: SidebarFolderItemProps) => {
+export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0, isAdmin = false }: SidebarFolderItemProps) => {
   const [isEditing, setIsEditing] = useState(false);
   const [editingValue, setEditingValue] = useState(folder.nome);
   const [editingColor, setEditingColor] = useState(folder.cor || PRESET_COLORS[0]);
   const [editingFaturista, setEditingFaturista] = useState(folder.faturistaId || "");
   const [isPending, setIsPending] = useState(false);
   const { confirm: confirmAction, alert: showAlert } = useUI();
-  // Só busca a lista de faturistas com o formulário de edição aberto.
-  const { data: faturistasData } = useFaturistas(isEditing);
+  // Só busca a lista de faturistas (admin) com o formulário de edição aberto.
+  const { data: faturistasData } = useFaturistas(isEditing && isAdmin);
   const faturistas = faturistasData?.faturistas || [];
 
   const refreshFolders = () => {
@@ -59,7 +60,11 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
     if (!editingValue.trim() || isPending) return;
     setIsPending(true);
     try {
-      await api.patch(`/pastas/${folder.id}`, { nome: editingValue, cor: editingColor, faturistaId: editingFaturista });
+      await api.patch(`/pastas/${folder.id}`, {
+        nome: editingValue,
+        cor: editingColor,
+        ...(isAdmin && { faturistaId: editingFaturista }),
+      });
       setIsEditing(false);
       refreshFolders();
     } catch (err) {
@@ -67,7 +72,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
     } finally {
       setIsPending(false);
     }
-  }, [editingValue, editingColor, editingFaturista, isPending, folder.id]);
+  }, [editingValue, editingColor, editingFaturista, isAdmin, isPending, folder.id]);
 
   const handleDelete = useCallback((e: React.MouseEvent) => {
     e.preventDefault();
@@ -104,16 +109,18 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0
           onKeyDown={(e) => e.key === "Enter" && submitRename()}
           className="w-full bg-card-bg dark:bg-bg border border-[rgba(0,0,0,0.12)] dark:border-glass-border rounded-lg px-2 py-1 text-xs font-bold outline-none focus:border-primary text-text placeholder:text-text-dim"
         />
-        <select
-          value={editingFaturista}
-          onChange={(e) => setEditingFaturista(e.target.value)}
-          className="w-full bg-card-bg dark:bg-bg border border-[rgba(0,0,0,0.12)] dark:border-glass-border rounded-lg px-2 py-1 text-xs font-bold outline-none focus:border-primary text-text"
-        >
-          <option value="">Sem faturista</option>
-          {faturistas.map((f) => (
-            <option key={f.id} value={f.id}>{f.nome || f.email}</option>
-          ))}
-        </select>
+        {isAdmin && (
+          <select
+            value={editingFaturista}
+            onChange={(e) => setEditingFaturista(e.target.value)}
+            className="w-full bg-card-bg dark:bg-bg border border-[rgba(0,0,0,0.12)] dark:border-glass-border rounded-lg px-2 py-1 text-xs font-bold outline-none focus:border-primary text-text"
+          >
+            <option value="">Sem faturista</option>
+            {faturistas.map((f) => (
+              <option key={f.id} value={f.id}>{f.nome || f.email}</option>
+            ))}
+          </select>
+        )}
         <div className="flex justify-between items-center px-1">
           <div className="flex gap-1.5">
             {PRESET_COLORS.map((c) => (
diff --git a/server/index.ts b/server/index.ts
index 2dca99e..8774e66 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -66,7 +66,7 @@ api.use("/pastas", pastasRouter);
 api.use("/colunas", colunasRouter);
 api.use("/operacoes", operacoesRouter);
 api.use("/dashboard", dashboardRouter);
-api.use("/automacoes", automacoesRouter);
+api.use("/automacoes", requireAdmin, automacoesRouter);
 api.use("/prazos", prazosRouter);
 api.use("/perfil", perfilRouter);
 api.use("/usuarios", requireAdmin, usuariosRouter);
diff --git a/server/middlewares/auth.ts b/server/middlewares/auth.ts
index 158c0f0..6a4c796 100644
--- a/server/middlewares/auth.ts
+++ b/server/middlewares/auth.ts
@@ -53,17 +53,16 @@ export async function requireUser(req: Request, res: AuthedResponse, next: NextF
 //Além do cookie dizer "admin", confere na lista cacheada que o usuário continua
 //admin — rebaixamento pelo app vale na hora (invalidação), pelo painel do
 //Supabase em até 10 min (TTL do cache), sem chamada remota por request.
+export async function ehAdmin(user: AuthedUser | null | undefined): Promise<boolean> {
+  if (!user || user.app_metadata.role !== "admin") return false;
+  const admin = await SupabaseAdminService.buscarPorId(user.id);
+  return !!admin && !admin.bloqueado && admin.role === "admin";
+}
+
 export async function requireAdmin(req: Request, res: AuthedResponse, next: NextFunction) {
   try {
     const user = resolveAuth(getCookieHeader(req));
-    if (!user || user.app_metadata.role !== "admin") {
-      const err: any = new Error("Acesso restrito a administradores");
-      err.status = 403;
-      throw err;
-    }
-
-    const admin = await SupabaseAdminService.buscarPorId(user.id);
-    if (!admin || admin.bloqueado || admin.role !== "admin") {
+    if (!user || !(await ehAdmin(user))) {
       const err: any = new Error("Acesso restrito a administradores");
       err.status = 403;
       throw err;
diff --git a/server/routes/pastas.ts b/server/routes/pastas.ts
index 87c3c38..290bb97 100644
--- a/server/routes/pastas.ts
+++ b/server/routes/pastas.ts
@@ -1,6 +1,7 @@
 import { Router } from "express";
 import { PastaService } from "../services/pasta.server";
 import { SupabaseAdminService } from "../services/supabase-admin.server";
+import { ehAdmin, getUser, requireAdmin, type AuthedResponse } from "../middlewares/auth";
 
 export const pastasRouter = Router();
 
@@ -14,10 +15,21 @@ function parseId(value: any): number {
   return id;
 }
 
-// Lista usuários ativos disponíveis para serem faturistas de uma pasta.
-// Acessível a qualquer usuário autenticado (mesmo não-admin), pois a criação
-// e edição de pastas não é restrita a administradores.
-pastasRouter.get("/faturistas", async (_req, res, next) => {
+//Criar e editar pasta é liberado a qualquer usuário, mas vincular faturista é
+//só de admin. Sem o campo no body, a pasta mantém o faturista atual (edição)
+//ou fica sem (criação); um não-admin mandando o campo recebe 403.
+async function lerFaturista(req: any, res: AuthedResponse): Promise<string | null | undefined> {
+  if (req.body?.faturistaId === undefined) return undefined;
+  if (!(await ehAdmin(getUser(res)))) {
+    const err: any = new Error("Apenas administradores podem vincular faturistas.");
+    err.status = 403;
+    throw err;
+  }
+  return String(req.body.faturistaId || "").trim() || null;
+}
+
+// Lista usuários ativos disponíveis para serem faturistas de uma pasta (só admin).
+pastasRouter.get("/faturistas", requireAdmin, async (_req, res, next) => {
   try {
     const { usuarios } = await SupabaseAdminService.listarUsuarios(1, 1000);
     const faturistas = usuarios
@@ -29,16 +41,16 @@ pastasRouter.get("/faturistas", async (_req, res, next) => {
   }
 });
 
-pastasRouter.post("/", async (req, res, next) => {
+pastasRouter.post("/", async (req, res: AuthedResponse, next) => {
   try {
     const nome = String(req.body?.nome || "").trim();
     const cor = req.body?.cor ? String(req.body.cor) : undefined;
-    const faturistaId = String(req.body?.faturistaId || "").trim();
     if (!nome) {
       res.status(400).json({ error: "Informe o nome da pasta." });
       return;
     }
-    const pasta = await PastaService.criar(nome, cor, faturistaId || null);
+    const faturistaId = await lerFaturista(req, res);
+    const pasta = await PastaService.criar(nome, cor, faturistaId ?? null);
     res.json({ success: true, pasta });
   } catch (err: any) {
     if (!err?.status) err.status = 400;
@@ -46,17 +58,17 @@ pastasRouter.post("/", async (req, res, next) => {
   }
 });
 
-pastasRouter.patch("/:id", async (req, res, next) => {
+pastasRouter.patch("/:id", async (req, res: AuthedResponse, next) => {
   try {
     const id = parseId(req.params.id);
     const nome = String(req.body?.nome || "").trim();
     const cor = req.body?.cor ? String(req.body.cor) : undefined;
-    const faturistaId = String(req.body?.faturistaId || "").trim();
     if (!nome) {
       res.status(400).json({ error: "Informe o nome da pasta." });
       return;
     }
-    const pasta = await PastaService.atualizar(id, nome, cor, faturistaId || null);
+    const faturistaId = await lerFaturista(req, res);
+    const pasta = await PastaService.atualizar(id, nome, cor, faturistaId);
     res.json({ success: true, pasta });
   } catch (err: any) {
     if (!err?.status) err.status = 400;
diff --git a/server/services/pasta.server.ts b/server/services/pasta.server.ts
index 8b73569..991c2ab 100644
--- a/server/services/pasta.server.ts
+++ b/server/services/pasta.server.ts
@@ -114,7 +114,8 @@ export class PastaService {
 
     const pasta = await prisma.pasta.update({
       where: { id },
-      data: { nome, cor, faturistaId: faturistaId || null }
+      //undefined mantém o faturista atual (Prisma ignora o campo)
+      data: { nome, cor, faturistaId: faturistaId === undefined ? undefined : faturistaId || null }
     });
 
 

From 77136e5825d0579459e980d83e86a7374cc435dc Mon Sep 17 00:00:00 2001
From: pauloeduas-software <pauloeduas.software@gmail.com>
Date: Wed, 30 Sep 2026 08:38:29 -0300
Subject: [PATCH 12/12] =?UTF-8?q?feat:=20cargo=20de=20gestor=20e=20atualiz?=
 =?UTF-8?q?a=C3=A7=C3=A3o=20de=20cargo=20sem=20relogin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Novo cargo "gestor" entre usuário e admin: acessa automações/prazos,
  dashboard geral e vincula faturistas às pastas; gestão de usuários
  continua exclusiva do admin
- /automacoes e /prazos passam a exigir gestor ou admin (antes prazos
  era aberto a todos); regras de roteamento e prazos seguem aplicadas
  a qualquer usuário
- Dashboard do usuário comum vem restrito às pastas em que ele é o
  faturista: o servidor força o filtro, bloqueia detalhe de outros
  faturistas/pastas e a tela esconde o filtro de faturista e a Caixa
  de Entrada; gestor e admin continuam com a visão geral
- Middlewares requireAdmin/requireGestor validam o cargo pela lista
  cacheada do Supabase, não pelo cookie
- Cargo alterado depois do login é aplicado na hora: o servidor
  regrava o cookie e o front atualiza menus e rotas via /init
- Corrige trava do último admin, que impedia alterar o cargo de
  qualquer usuário quando havia apenas um admin
- Edição de célula aceita apenas as colunas editáveis da grid,
  bloqueando alteração de campos internos (hash, importacaoId, pastaId)
---
 app/AppRoutes.tsx                        | 11 ++--
 app/components/Sidebar.tsx               | 18 ++++---
 app/components/SidebarFolderItem.tsx     | 14 ++---
 app/components/UsuarioModal.tsx          | 32 ++++++------
 app/components/UsuariosTable.tsx         |  6 ++-
 app/context/AuthContext.tsx              | 13 +++++
 app/lib/query.ts                         |  2 +-
 app/utils/cargos.ts                      | 19 +++++++
 app/views/DashboardView.tsx              | 32 ++++++++++--
 server/index.ts                          |  6 +--
 server/middlewares/auth.ts               | 66 ++++++++++++++++--------
 server/routes/auth.ts                    |  3 +-
 server/routes/dashboard.ts               | 47 ++++++++++++++---
 server/routes/pastas.ts                  | 14 ++---
 server/routes/usuarios.ts                | 26 +++++++---
 server/services/auth.server.ts           |  5 +-
 server/services/dashboard.server.ts      |  4 +-
 server/services/operacao.server.ts       | 18 +++++++
 server/services/supabase-admin.server.ts | 21 +++++---
 19 files changed, 259 insertions(+), 98 deletions(-)
 create mode 100644 app/utils/cargos.ts

diff --git a/app/AppRoutes.tsx b/app/AppRoutes.tsx
index d466875..5c2761e 100644
--- a/app/AppRoutes.tsx
+++ b/app/AppRoutes.tsx
@@ -3,6 +3,7 @@ import { Navigate, Outlet, Route, Routes, useLocation } from "react-router";
 import { useAuth } from "~/context/AuthContext";
 import { AppLayout } from "~/components/AppLayout";
 import { OperacoesPage } from "~/pages/OperacoesPage";
+import { ehAdmin, ehGestor } from "~/utils/cargos";
 
 //Páginas menos acessadas ficam em chunks separados, baixados só quando visitadas
 const LoginPage = lazy(() => import("~/pages/LoginPage").then((m) => ({ default: m.LoginPage })));
@@ -40,9 +41,9 @@ function RequireAuth() {
   return <Outlet />;
 }
 
-function RequireAdmin() {
+function RequireCargo({ permitido }: { permitido: (user: any) => boolean }) {
   const { user } = useAuth();
-  if (user?.app_metadata?.role !== "admin") return <Navigate to="/" replace />;
+  if (!permitido(user)) return <Navigate to="/" replace />;
   return <Outlet />;
 }
 
@@ -55,12 +56,14 @@ export function AppRoutes() {
         <Route element={<RequireAuth />}>
           <Route element={<AppLayout />}>
             <Route index element={<Navigate to="/caixa-de-entrada" replace />} />
-            <Route path="dashboard" element={<DashboardPage />} />
             <Route path="caixa-de-entrada" element={<OperacoesPage />} />
             <Route path="pastas/:nome" element={<OperacoesPage />} />
             <Route path="perfil" element={<PerfilPage />} />
-            <Route element={<RequireAdmin />}>
+            <Route path="dashboard" element={<DashboardPage />} />
+            <Route element={<RequireCargo permitido={ehGestor} />}>
               <Route path="automacoes" element={<AutomacoesPage />} />
+            </Route>
+            <Route element={<RequireCargo permitido={ehAdmin} />}>
               <Route path="admin/usuarios" element={<UsuariosPage />} />
             </Route>
           </Route>
diff --git a/app/components/Sidebar.tsx b/app/components/Sidebar.tsx
index 8d9f1b0..64eede9 100644
--- a/app/components/Sidebar.tsx
+++ b/app/components/Sidebar.tsx
@@ -2,6 +2,7 @@ import { CheckCircle2, Inbox, LayoutDashboard, Moon, Plus, Search, ShieldCheck,
 import React, { useCallback, useMemo, useState } from "react";
 import { NavLink } from "react-router";
 import { buscarNomeUsuario } from "~/utils/formatters";
+import { ehAdmin, ehGestor } from "~/utils/cargos";
 import { api, errorMessage } from "~/lib/api";
 import { queryClient, queryKeys, useFaturistas } from "~/lib/query";
 import { prefetchOperacoes, cancelPrefetch } from "~/hooks/useOperacoesGridData";
@@ -40,10 +41,11 @@ export const Sidebar = React.memo(({
   const [searchQuery, setSearchQuery] = useState("");
   const [filterColor, setFilterColor] = useState("");
 
-  const isAdmin = user?.app_metadata?.role === "admin";
+  const isAdmin = ehAdmin(user);
+  const isGestor = ehGestor(user);
 
-  // Só busca a lista de faturistas (admin) com o formulário de nova pasta aberto.
-  const { data: faturistasData } = useFaturistas(isAddingFolder && isAdmin);
+  // Só busca a lista de faturistas (gestor/admin) com o formulário de nova pasta aberto.
+  const { data: faturistasData } = useFaturistas(isAddingFolder && isGestor);
   const faturistas = faturistasData?.faturistas || [];
 
   const normalize = (value: string) => value.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "");
@@ -65,7 +67,7 @@ export const Sidebar = React.memo(({
       await api.post("/pastas", {
         nome: newFolderName,
         cor: newFolderColor,
-        ...(isAdmin && { faturistaId: newFolderFaturista }),
+        ...(isGestor && { faturistaId: newFolderFaturista }),
       });
       setNewFolderName("");
       setNewFolderColor(PRESET_COLORS[0]);
@@ -77,7 +79,7 @@ export const Sidebar = React.memo(({
     } finally {
       setIsCreating(false);
     }
-  }, [newFolderName, newFolderColor, newFolderFaturista, isAdmin, isCreating, showAlert]);
+  }, [newFolderName, newFolderColor, newFolderFaturista, isGestor, isCreating, showAlert]);
 
   return (
     <aside className={`${isCollapsed ? 'w-[72px]' : 'w-[240px]'} bg-card-bg dark:bg-bg border-r border-glass-border transition-all duration-300 flex flex-col relative z-20`}>
@@ -135,7 +137,7 @@ export const Sidebar = React.memo(({
               )}
             </NavLink>
 
-            {isAdmin && (
+            {isGestor && (
               <NavLink to="/automacoes" className={({ isActive }) => `flex items-center justify-between px-3 py-2.5 rounded-xl text-xs font-bold transition-all relative ${isActive ? 'text-primary bg-primary/10 dark:bg-transparent before:absolute before:-left-2 before:top-1/2 before:-translate-y-1/2 before:w-1 before:h-5 before:bg-primary before:rounded-r' : 'text-text-muted hover:text-text hover:bg-surface-light'}`}>
                 {() => (
                   <div className="flex items-center gap-2.5">
@@ -222,7 +224,7 @@ export const Sidebar = React.memo(({
             {isAddingFolder && !isCollapsed && (
               <form onSubmit={handleCreateFolder} className="px-3 mb-2 space-y-2 bg-surface rounded-xl p-2 border border-glass-border">
                 <input autoFocus value={newFolderName} onChange={e => setNewFolderName(e.target.value)} placeholder="Nome..." className="w-full bg-card-bg dark:bg-bg rounded-lg px-2 py-1 text-xs font-bold outline-none border border-[rgba(0,0,0,0.12)] dark:border-glass-border focus:border-primary text-text placeholder:text-text-dim" />
-                {isAdmin && (
+                {isGestor && (
                   <select
                     value={newFolderFaturista}
                     onChange={e => setNewFolderFaturista(e.target.value)}
@@ -249,7 +251,7 @@ export const Sidebar = React.memo(({
             )}
 
             {filteredPastas.map((p: any) => (
-              <SidebarFolderItem key={p.id} folder={p} isCollapsed={isCollapsed} antigas={emissaoAntigasPorPasta[String(p.id)] ?? 0} isAdmin={isAdmin} />
+              <SidebarFolderItem key={p.id} folder={p} isCollapsed={isCollapsed} antigas={emissaoAntigasPorPasta[String(p.id)] ?? 0} podeVincularFaturista={isGestor} />
             ))}
 
             {!isCollapsed && pastas.length > 0 && filteredPastas.length === 0 && (
diff --git a/app/components/SidebarFolderItem.tsx b/app/components/SidebarFolderItem.tsx
index 5d4ddc9..7b17054 100644
--- a/app/components/SidebarFolderItem.tsx
+++ b/app/components/SidebarFolderItem.tsx
@@ -30,18 +30,18 @@ interface SidebarFolderItemProps {
   folder: FolderType;
   isCollapsed: boolean;
   antigas?: number;
-  isAdmin?: boolean;
+  podeVincularFaturista?: boolean;
 }
 
-export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0, isAdmin = false }: SidebarFolderItemProps) => {
+export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0, podeVincularFaturista = false }: SidebarFolderItemProps) => {
   const [isEditing, setIsEditing] = useState(false);
   const [editingValue, setEditingValue] = useState(folder.nome);
   const [editingColor, setEditingColor] = useState(folder.cor || PRESET_COLORS[0]);
   const [editingFaturista, setEditingFaturista] = useState(folder.faturistaId || "");
   const [isPending, setIsPending] = useState(false);
   const { confirm: confirmAction, alert: showAlert } = useUI();
-  // Só busca a lista de faturistas (admin) com o formulário de edição aberto.
-  const { data: faturistasData } = useFaturistas(isEditing && isAdmin);
+  // Só busca a lista de faturistas (gestor/admin) com o formulário de edição aberto.
+  const { data: faturistasData } = useFaturistas(isEditing && podeVincularFaturista);
   const faturistas = faturistasData?.faturistas || [];
 
   const refreshFolders = () => {
@@ -63,7 +63,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0,
       await api.patch(`/pastas/${folder.id}`, {
         nome: editingValue,
         cor: editingColor,
-        ...(isAdmin && { faturistaId: editingFaturista }),
+        ...(podeVincularFaturista && { faturistaId: editingFaturista }),
       });
       setIsEditing(false);
       refreshFolders();
@@ -72,7 +72,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0,
     } finally {
       setIsPending(false);
     }
-  }, [editingValue, editingColor, editingFaturista, isAdmin, isPending, folder.id]);
+  }, [editingValue, editingColor, editingFaturista, podeVincularFaturista, isPending, folder.id]);
 
   const handleDelete = useCallback((e: React.MouseEvent) => {
     e.preventDefault();
@@ -109,7 +109,7 @@ export const SidebarFolderItem = React.memo(({ folder, isCollapsed, antigas = 0,
           onKeyDown={(e) => e.key === "Enter" && submitRename()}
           className="w-full bg-card-bg dark:bg-bg border border-[rgba(0,0,0,0.12)] dark:border-glass-border rounded-lg px-2 py-1 text-xs font-bold outline-none focus:border-primary text-text placeholder:text-text-dim"
         />
-        {isAdmin && (
+        {podeVincularFaturista && (
           <select
             value={editingFaturista}
             onChange={(e) => setEditingFaturista(e.target.value)}
diff --git a/app/components/UsuarioModal.tsx b/app/components/UsuarioModal.tsx
index cd99f67..96492a3 100644
--- a/app/components/UsuarioModal.tsx
+++ b/app/components/UsuarioModal.tsx
@@ -1,5 +1,6 @@
 import { Loader2, Pencil, UserPlus, X } from "lucide-react";
 import { useState } from "react";
+import { CARGO_LABEL, type Cargo } from "~/utils/cargos";
 
 export type UsuarioModalMode = "criar" | "editar";
 
@@ -22,7 +23,9 @@ export function UsuarioModal({ mode, usuario, carregando, erro, onSubmit, onClos
   const [email, setEmail] = useState(usuario?.email || "");
   const [senha, setSenha] = useState("");
   const [novaSenha, setNovaSenha] = useState("");
-  const [role, setRole] = useState<"admin" | "usuario">(usuario?.role === "admin" ? "admin" : "usuario");
+  const [role, setRole] = useState<Cargo>(
+    usuario?.role === "admin" || usuario?.role === "gestor" ? usuario.role : "usuario"
+  );
 
   const config = MODAL_CONFIG[mode];
   const Icon = config.icone;
@@ -137,22 +140,17 @@ export function UsuarioModal({ mode, usuario, carregando, erro, onSubmit, onClos
             <div className="flex flex-col gap-2">
               <label className="text-[10px] font-bold uppercase tracking-widest text-text-muted">Cargo</label>
               <div className="flex bg-surface p-1 rounded-xl border border-glass-border h-11 items-center self-start">
-                <button
-                  type="button"
-                  onClick={() => setRole("usuario")}
-                  disabled={carregando}
-                  className={`px-4 h-full flex items-center justify-center text-sm font-bold rounded-lg transition-all ${role === "usuario" ? "bg-card-bg text-text shadow-sm border border-glass-border" : "text-text-muted hover:text-text border border-transparent"}`}
-                >
-                  Usuário
-                </button>
-                <button
-                  type="button"
-                  onClick={() => setRole("admin")}
-                  disabled={carregando}
-                  className={`px-4 h-full flex items-center justify-center text-sm font-bold rounded-lg transition-all ${role === "admin" ? "bg-card-bg text-text shadow-sm border border-glass-border" : "text-text-muted hover:text-text border border-transparent"}`}
-                >
-                  Administrador
-                </button>
+                {(["usuario", "gestor", "admin"] as const).map((cargo) => (
+                  <button
+                    key={cargo}
+                    type="button"
+                    onClick={() => setRole(cargo)}
+                    disabled={carregando}
+                    className={`px-4 h-full flex items-center justify-center text-sm font-bold rounded-lg transition-all ${role === cargo ? "bg-card-bg text-text shadow-sm border border-glass-border" : "text-text-muted hover:text-text border border-transparent"}`}
+                  >
+                    {CARGO_LABEL[cargo]}
+                  </button>
+                ))}
               </div>
             </div>
           )}
diff --git a/app/components/UsuariosTable.tsx b/app/components/UsuariosTable.tsx
index 728d926..64a491a 100644
--- a/app/components/UsuariosTable.tsx
+++ b/app/components/UsuariosTable.tsx
@@ -84,10 +84,12 @@ export function UsuariosTable({
                       className={`text-[9px] font-bold uppercase tracking-widest px-2 py-1 rounded-md whitespace-nowrap ${
                         u.role === "admin"
                           ? "bg-badge-primary-bg text-badge-primary-text"
-                          : "bg-surface text-text-muted border border-glass-border"
+                          : u.role === "gestor"
+                            ? "bg-amber-500/10 text-amber-600 dark:text-amber-400 border border-amber-500/20"
+                            : "bg-surface text-text-muted border border-glass-border"
                       }`}
                     >
-                      {u.role === "admin" ? "Admin" : "Usuário"}
+                      {u.role === "admin" ? "Admin" : u.role === "gestor" ? "Gestor" : "Usuário"}
                     </span>
                   </td>
                   <td className="px-5 py-3.5">
diff --git a/app/context/AuthContext.tsx b/app/context/AuthContext.tsx
index a366079..d64cd00 100644
--- a/app/context/AuthContext.tsx
+++ b/app/context/AuthContext.tsx
@@ -33,6 +33,18 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         if (alive) setIsLoading(false);
       });
 
+    //O /init é refeito periodicamente (useInit) e o servidor devolve o cargo
+    //atual — assim uma promoção/rebaixamento atualiza menus e rotas sem relogin.
+    const unsubscribe = queryClient.getQueryCache().subscribe((event) => {
+      if (event.type !== "updated" || event.query.queryKey[0] !== queryKeys.init[0]) return;
+      const novo = (event.query.state.data as any)?.user;
+      if (!novo) return;
+      //Só atualiza quem já está logado — um /init atrasado não reloga após o logout.
+      setUser((atual: any) =>
+        !atual || atual.app_metadata?.role === novo.app_metadata?.role ? atual : novo
+      );
+    });
+
     const handleUnauthorized = () => {
       setUser(null);
       navigate("/login");
@@ -40,6 +52,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     window.addEventListener("auth:unauthorized", handleUnauthorized);
     return () => {
       alive = false;
+      unsubscribe();
       window.removeEventListener("auth:unauthorized", handleUnauthorized);
     };
   }, [navigate]);
diff --git a/app/lib/query.ts b/app/lib/query.ts
index 5936e5f..89c1cdd 100644
--- a/app/lib/query.ts
+++ b/app/lib/query.ts
@@ -169,7 +169,7 @@ export interface DashboardFaturistaDetalhe {
 // Opções distintas para os selects de filtro.
 export interface DashboardOpcoes {
   faturistas: { id: string; nome: string }[];
-  pastas: { id: number; nome: string }[];
+  pastas: { id: number; nome: string; faturistaId: string | null }[];
   clientes: string[];
   status: string[];
   tiposDocumento: string[];
diff --git a/app/utils/cargos.ts b/app/utils/cargos.ts
new file mode 100644
index 0000000..5f6601e
--- /dev/null
+++ b/app/utils/cargos.ts
@@ -0,0 +1,19 @@
+//Espelha os cargos do servidor (supabase-admin.server.ts). A checagem aqui é só
+//para esconder menus/rotas — quem barra de verdade é o middleware da API.
+export type Cargo = "usuario" | "gestor" | "admin";
+
+export const CARGO_LABEL: Record<Cargo, string> = {
+  usuario: "Usuário",
+  gestor: "Gestor",
+  admin: "Administrador",
+};
+
+export function cargoDe(user: any): Cargo {
+  const role = user?.app_metadata?.role;
+  return role === "admin" || role === "gestor" ? role : "usuario";
+}
+
+export const ehAdmin = (user: any) => cargoDe(user) === "admin";
+
+//Gestor ou acima: dashboard, automações e vínculo de faturistas.
+export const ehGestor = (user: any) => cargoDe(user) !== "usuario";
diff --git a/app/views/DashboardView.tsx b/app/views/DashboardView.tsx
index c263e38..87ac9ed 100644
--- a/app/views/DashboardView.tsx
+++ b/app/views/DashboardView.tsx
@@ -12,6 +12,8 @@ import {
 } from "~/lib/query";
 import { formatarData, formatarMoeda } from "~/utils/formatters";
 import { Skeleton } from "~/components/Skeleton";
+import { useAuth } from "~/context/AuthContext";
+import { ehGestor } from "~/utils/cargos";
 
 type ItemBarra = { label: string; valor: number; quantidade: number; cor?: string | null };
 type FiltroCampo = keyof DashboardFiltros;
@@ -155,6 +157,7 @@ function DistribuicaoCard({
 // ---------------------------------------------------------------------------
 
 type OpcaoFiltro = { valor: string; label: string };
+type CampoFiltro = (typeof CAMPOS_FILTRO)[number];
 
 // Campos oferecidos no menu "+ Filtro". As sentinelas ("sem", "inbox",
 // "__vazio__") entram no fim de cada lista, como nos selects antigos.
@@ -222,16 +225,28 @@ const CAMPOS_FILTRO: {
   },
 ];
 
+//Usuário comum só vê as próprias pastas (o servidor força o recorte): sem filtro
+//de faturista nem a Caixa de Entrada, que não tem dono.
+const CAMPOS_FILTRO_USUARIO: CampoFiltro[] = CAMPOS_FILTRO
+  .filter((c) => c.campo !== "faturistaId")
+  .map((c) =>
+    c.campo === "pastaId"
+      ? { ...c, opcoes: (o?: DashboardOpcoes) => c.opcoes(o).filter((p) => p.valor !== "inbox") }
+      : c
+  );
+
 // Lista de clientes pode ter milhares de itens: renderiza só os primeiros.
 const MAX_OPCOES_VISIVEIS = 200;
 
 function MenuFiltro({
+  campos,
   campoInicial,
   filtros,
   opcoes,
   onEscolher,
   onFechar,
 }: {
+  campos: CampoFiltro[];
   campoInicial: FiltroCampo | null;
   filtros: DashboardFiltros;
   opcoes?: DashboardOpcoes;
@@ -247,7 +262,7 @@ function MenuFiltro({
     return () => window.removeEventListener("keydown", onKey);
   }, [onFechar]);
 
-  const def = CAMPOS_FILTRO.find((c) => c.campo === campo);
+  const def = campos.find((c) => c.campo === campo);
 
   const lista = useMemo(() => {
     if (!def) return [];
@@ -265,7 +280,7 @@ function MenuFiltro({
             <p className="px-2.5 pt-1.5 pb-2 text-[10px] font-bold uppercase tracking-widest text-text-muted">
               Filtrar por
             </p>
-            {CAMPOS_FILTRO.map((c) => (
+            {campos.map((c) => (
               <button
                 key={c.campo}
                 type="button"
@@ -346,11 +361,13 @@ function MenuFiltro({
 }
 
 function FiltrosBar({
+  campos,
   filtros,
   onChange,
   onLimpar,
   opcoes,
 }: {
+  campos: CampoFiltro[];
   filtros: DashboardFiltros;
   onChange: OnChangeFiltro;
   onLimpar: () => void;
@@ -361,10 +378,10 @@ function FiltrosBar({
   const fecharMenu = useCallback(() => setMenu(null), []);
 
   const temFiltro = Object.values(filtros).some(Boolean);
-  const ativos = CAMPOS_FILTRO.filter((c) => filtros[c.campo]);
+  const ativos = campos.filter((c) => filtros[c.campo]);
   const soAntigas = filtros.antigas === "1";
 
-  const rotuloValor = (def: (typeof CAMPOS_FILTRO)[number], valor: string) =>
+  const rotuloValor = (def: CampoFiltro, valor: string) =>
     def.opcoes(opcoes).find((o) => o.valor === valor)?.label ?? valor;
 
   const escolher = (campo: FiltroCampo, valor: string) => {
@@ -398,6 +415,7 @@ function FiltrosBar({
           </div>
           {menu === def.campo && (
             <MenuFiltro
+              campos={campos}
               campoInicial={def.campo}
               filtros={filtros}
               opcoes={opcoes}
@@ -420,6 +438,7 @@ function FiltrosBar({
         </button>
         {menu === "novo" && (
           <MenuFiltro
+            campos={campos}
             campoInicial={null}
             filtros={filtros}
             opcoes={opcoes}
@@ -699,6 +718,8 @@ function GeralConteudo({
 // ---------------------------------------------------------------------------
 
 export function DashboardView() {
+  const { user } = useAuth();
+  const gestor = ehGestor(user);
   const [filtros, setFiltros] = useState<DashboardFiltros>({});
 
   const { data, isLoading, isError, isPlaceholderData } = useDashboard(filtros);
@@ -724,12 +745,13 @@ export function DashboardView() {
           <div>
             <h1 className="text-xl font-bold text-text tracking-tight">Dashboard</h1>
             <p className="text-xs font-medium text-text-muted mt-1">
-              Visão geral das pastas e documentos
+              {gestor ? "Visão geral das pastas e documentos" : "Visão geral das suas pastas e documentos"}
             </p>
           </div>
         </div>
 
         <FiltrosBar
+          campos={gestor ? CAMPOS_FILTRO : CAMPOS_FILTRO_USUARIO}
           filtros={filtros}
           onChange={setFiltro}
           onLimpar={limparFiltros}
diff --git a/server/index.ts b/server/index.ts
index 8774e66..0a2dbb1 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -3,7 +3,7 @@ import express from "express";
 import compression from "compression";
 import path from "node:path";
 import fs from "node:fs";
-import { requireUser, requireAdmin, type AuthedResponse } from "./middlewares/auth";
+import { requireUser, requireAdmin, requireGestor, type AuthedResponse } from "./middlewares/auth";
 import { authRouter } from "./routes/auth";
 import { initRouter } from "./routes/init";
 import { pastasRouter } from "./routes/pastas";
@@ -66,8 +66,8 @@ api.use("/pastas", pastasRouter);
 api.use("/colunas", colunasRouter);
 api.use("/operacoes", operacoesRouter);
 api.use("/dashboard", dashboardRouter);
-api.use("/automacoes", requireAdmin, automacoesRouter);
-api.use("/prazos", prazosRouter);
+api.use("/automacoes", requireGestor, automacoesRouter);
+api.use("/prazos", requireGestor, prazosRouter);
 api.use("/perfil", perfilRouter);
 api.use("/usuarios", requireAdmin, usuariosRouter);
 app.use("/api", api);
diff --git a/server/middlewares/auth.ts b/server/middlewares/auth.ts
index 6a4c796..26ddac3 100644
--- a/server/middlewares/auth.ts
+++ b/server/middlewares/auth.ts
@@ -1,6 +1,7 @@
 import type { NextFunction, Request, Response } from "express";
 import { resolveAuth, type AuthedUser } from "../services/auth.server";
-import { SupabaseAdminService } from "../services/supabase-admin.server";
+import { SupabaseAdminService, type Cargo } from "../services/supabase-admin.server";
+import { getSession, sessionStorage } from "../services/session.server";
 import { marcar } from "../lib/timing";
 
 export interface AuthedResponse extends Response {
@@ -43,6 +44,14 @@ export async function requireUser(req: Request, res: AuthedResponse, next: NextF
       throw err;
     }
 
+    //Cargo mudou depois do login (promoção ou rebaixamento): vale o da lista e
+    //o cookie é regravado, sem exigir novo login.
+    if (conta && conta.role !== user.app_metadata.role) {
+      user.app_metadata.role = conta.role;
+      const session = getSession(getCookieHeader(req));
+      res.append("Set-Cookie", sessionStorage.commitSession({ ...session, role: conta.role }));
+    }
+
     res.locals.user = user;
     next();
   } catch (err) {
@@ -50,27 +59,42 @@ export async function requireUser(req: Request, res: AuthedResponse, next: NextF
   }
 }
 
-//Além do cookie dizer "admin", confere na lista cacheada que o usuário continua
-//admin — rebaixamento pelo app vale na hora (invalidação), pelo painel do
-//Supabase em até 10 min (TTL do cache), sem chamada remota por request.
-export async function ehAdmin(user: AuthedUser | null | undefined): Promise<boolean> {
-  if (!user || user.app_metadata.role !== "admin") return false;
-  const admin = await SupabaseAdminService.buscarPorId(user.id);
-  return !!admin && !admin.bloqueado && admin.role === "admin";
+//O cargo que vale é o da lista cacheada, não o do cookie — mudança pelo app
+//vale na hora (invalidação), pelo painel do Supabase em até 10 min (TTL do
+//cache), sem chamada remota por request. Supabase fora do ar nega o acesso.
+async function temCargo(user: AuthedUser | null | undefined, cargos: Cargo[]): Promise<boolean> {
+  if (!user) return false;
+  const conta = await SupabaseAdminService.buscarPorId(user.id);
+  return !!conta && !conta.bloqueado && cargos.includes(conta.role);
 }
 
-export async function requireAdmin(req: Request, res: AuthedResponse, next: NextFunction) {
-  try {
-    const user = resolveAuth(getCookieHeader(req));
-    if (!user || !(await ehAdmin(user))) {
-      const err: any = new Error("Acesso restrito a administradores");
-      err.status = 403;
-      throw err;
-    }
+export function ehAdmin(user: AuthedUser | null | undefined): Promise<boolean> {
+  return temCargo(user, ["admin"]);
+}
 
-    res.locals.user = user;
-    next();
-  } catch (err) {
-    next(err);
-  }
+//Gestor ou acima (admin herda tudo que o gestor pode).
+export function ehGestor(user: AuthedUser | null | undefined): Promise<boolean> {
+  return temCargo(user, ["admin", "gestor"]);
+}
+
+function exigir(verificar: (user: AuthedUser | null) => Promise<boolean>, mensagem: string) {
+  return async (req: Request, res: AuthedResponse, next: NextFunction) => {
+    try {
+      //Normalmente já resolvido (e com o cargo atualizado) pelo requireUser.
+      const user = res.locals.user ?? resolveAuth(getCookieHeader(req));
+      if (!user || !(await verificar(user))) {
+        const err: any = new Error(mensagem);
+        err.status = 403;
+        throw err;
+      }
+
+      res.locals.user = user;
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
 }
+
+export const requireAdmin = exigir(ehAdmin, "Acesso restrito a administradores");
+export const requireGestor = exigir(ehGestor, "Acesso restrito a gestores e administradores");
diff --git a/server/routes/auth.ts b/server/routes/auth.ts
index 3a31250..1e29917 100644
--- a/server/routes/auth.ts
+++ b/server/routes/auth.ts
@@ -3,6 +3,7 @@ import { createSupabaseAuthClient } from "../services/supabase.server";
 import { sessionStorage } from "../services/session.server";
 import { resolveAuth } from "../services/auth.server";
 import { getCookieHeader } from "../middlewares/auth";
+import { normalizarCargo } from "../services/supabase-admin.server";
 
 export const authRouter = Router();
 
@@ -31,7 +32,7 @@ authRouter.post("/login", async (req, res, next) => {
     res.append("Set-Cookie", sessionStorage.commitSession({
       sub: data.user.id,
       email: data.user.email || "",
-      role: data.user.app_metadata?.role === "admin" ? "admin" : "usuario",
+      role: normalizarCargo(data.user.app_metadata?.role),
       nome: data.user.user_metadata?.nome || "",
       exp: Math.floor(Date.now() / 1000) + SESSAO_DURACAO_SEGUNDOS,
     }));
diff --git a/server/routes/dashboard.ts b/server/routes/dashboard.ts
index 9c43736..a145b08 100644
--- a/server/routes/dashboard.ts
+++ b/server/routes/dashboard.ts
@@ -1,5 +1,7 @@
 import { Router } from "express";
 import { DashboardService, type DashboardFiltros } from "../services/dashboard.server";
+import { PastaService } from "../services/pasta.server";
+import { ehGestor, getUser, type AuthedResponse } from "../middlewares/auth";
 import { aplicarServerTiming } from "../lib/timing";
 
 export const dashboardRouter = Router();
@@ -8,6 +10,19 @@ function texto(value: any): string | undefined {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
 }
 
+//Gestor e admin veem tudo. O usuário comum só vê o próprio recorte: devolve o
+//id dele (faturista das pastas) para forçar o filtro, ou null se não há restrição.
+async function faturistaRestrito(res: AuthedResponse): Promise<string | null> {
+  const user = getUser(res);
+  return (await ehGestor(user)) ? null : user.id;
+}
+
+function negar(): never {
+  const err: any = new Error("Você só pode ver o dashboard das suas pastas.");
+  err.status = 403;
+  throw err;
+}
+
 // Lê os filtros globais da querystring.
 // faturista=<id|sem> · cliente=<pagador> · status= · tipo= · agencia=
 function parseFiltros(query: Record<string, any>): DashboardFiltros {
@@ -24,9 +39,12 @@ function parseFiltros(query: Record<string, any>): DashboardFiltros {
 }
 
 //Visão geral + lista de pastas (valor, quantidade, atrasos, faturista...).
-dashboardRouter.get("/", async (req, res, next) => {
+dashboardRouter.get("/", async (req, res: AuthedResponse, next) => {
   try {
-    const resumo = await DashboardService.resumo(parseFiltros(req.query as Record<string, any>));
+    const filtros = parseFiltros(req.query as Record<string, any>);
+    const restrito = await faturistaRestrito(res);
+    if (restrito) filtros.faturistaId = restrito;
+    const resumo = await DashboardService.resumo(filtros);
     aplicarServerTiming(res);
     res.json(resumo);
   } catch (err) {
@@ -35,19 +53,31 @@ dashboardRouter.get("/", async (req, res, next) => {
 });
 
 //Listas distintas para os selects de filtro.
-dashboardRouter.get("/opcoes", async (_req, res, next) => {
+dashboardRouter.get("/opcoes", async (_req, res: AuthedResponse, next) => {
   try {
-    res.json(await DashboardService.opcoes());
+    const opcoes = await DashboardService.opcoes();
+    const restrito = await faturistaRestrito(res);
+    if (restrito) {
+      res.json({
+        ...opcoes,
+        faturistas: opcoes.faturistas.filter((f) => f.id === restrito),
+        pastas: opcoes.pastas.filter((p) => p.faturistaId === restrito),
+      });
+      return;
+    }
+    res.json(opcoes);
   } catch (err) {
     next(err);
   }
 });
 
 //Detalhe agregado de um faturista ("sem" = Caixa de Entrada + pastas sem dono).
-dashboardRouter.get("/faturistas/:faturistaId", async (req, res, next) => {
+dashboardRouter.get("/faturistas/:faturistaId", async (req, res: AuthedResponse, next) => {
   try {
     const raw = req.params.faturistaId;
     const faturistaId = raw === "sem" ? null : raw;
+    const restrito = await faturistaRestrito(res);
+    if (restrito && faturistaId !== restrito) negar();
     const detalhe = await DashboardService.faturistaDetalhe(
       faturistaId,
       parseFiltros(req.query as Record<string, any>)
@@ -59,7 +89,7 @@ dashboardRouter.get("/faturistas/:faturistaId", async (req, res, next) => {
 });
 
 //Detalhamento de uma pasta ("inbox" = Caixa de Entrada).
-dashboardRouter.get("/pastas/:pastaId", async (req, res, next) => {
+dashboardRouter.get("/pastas/:pastaId", async (req, res: AuthedResponse, next) => {
   try {
     const raw = req.params.pastaId;
     let pastaId: number | null;
@@ -73,6 +103,11 @@ dashboardRouter.get("/pastas/:pastaId", async (req, res, next) => {
       }
       pastaId = parsed;
     }
+    const restrito = await faturistaRestrito(res);
+    if (restrito) {
+      const pasta = pastaId === null ? null : await PastaService.buscarPorId(pastaId);
+      if (pasta?.faturistaId !== restrito) negar();
+    }
     const detalhe = await DashboardService.pastaDetalhe(pastaId);
     res.json(detalhe);
   } catch (err) {
diff --git a/server/routes/pastas.ts b/server/routes/pastas.ts
index 290bb97..dfbd071 100644
--- a/server/routes/pastas.ts
+++ b/server/routes/pastas.ts
@@ -1,7 +1,7 @@
 import { Router } from "express";
 import { PastaService } from "../services/pasta.server";
 import { SupabaseAdminService } from "../services/supabase-admin.server";
-import { ehAdmin, getUser, requireAdmin, type AuthedResponse } from "../middlewares/auth";
+import { ehGestor, getUser, requireGestor, type AuthedResponse } from "../middlewares/auth";
 
 export const pastasRouter = Router();
 
@@ -16,20 +16,20 @@ function parseId(value: any): number {
 }
 
 //Criar e editar pasta é liberado a qualquer usuário, mas vincular faturista é
-//só de admin. Sem o campo no body, a pasta mantém o faturista atual (edição)
-//ou fica sem (criação); um não-admin mandando o campo recebe 403.
+//só de gestor ou admin. Sem o campo no body, a pasta mantém o faturista atual
+//(edição) ou fica sem (criação); um usuário comum mandando o campo recebe 403.
 async function lerFaturista(req: any, res: AuthedResponse): Promise<string | null | undefined> {
   if (req.body?.faturistaId === undefined) return undefined;
-  if (!(await ehAdmin(getUser(res)))) {
-    const err: any = new Error("Apenas administradores podem vincular faturistas.");
+  if (!(await ehGestor(getUser(res)))) {
+    const err: any = new Error("Apenas gestores e administradores podem vincular faturistas.");
     err.status = 403;
     throw err;
   }
   return String(req.body.faturistaId || "").trim() || null;
 }
 
-// Lista usuários ativos disponíveis para serem faturistas de uma pasta (só admin).
-pastasRouter.get("/faturistas", requireAdmin, async (_req, res, next) => {
+// Lista usuários ativos disponíveis para serem faturistas de uma pasta (gestor ou admin).
+pastasRouter.get("/faturistas", requireGestor, async (_req, res, next) => {
   try {
     const { usuarios } = await SupabaseAdminService.listarUsuarios(1, 1000);
     const faturistas = usuarios
diff --git a/server/routes/usuarios.ts b/server/routes/usuarios.ts
index 6927a14..12b709e 100644
--- a/server/routes/usuarios.ts
+++ b/server/routes/usuarios.ts
@@ -1,5 +1,5 @@
 import { Router } from "express";
-import { SupabaseAdminService } from "../services/supabase-admin.server";
+import { CARGOS, SupabaseAdminService, type Cargo } from "../services/supabase-admin.server";
 import { PastaService } from "../services/pasta.server";
 import { getUser, type AuthedResponse } from "../middlewares/auth";
 import { invalidate } from "../lib/cache";
@@ -8,6 +8,16 @@ export const usuariosRouter = Router();
 
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
+const CARGO_LABEL: Record<Cargo, string> = {
+  admin: "Administrador",
+  gestor: "Gestor",
+  usuario: "Usuário",
+};
+
+function cargoValido(role: string): role is Cargo {
+  return (CARGOS as readonly string[]).includes(role);
+}
+
 function traduzirErroSupabase(err: any): string {
   const msg = String(err?.message || err || "Erro desconhecido");
 
@@ -71,7 +81,7 @@ usuariosRouter.post("/", async (req, res: AuthedResponse, next) => {
       res.status(400).json({ error: "Informe o nome do usuário." });
       return;
     }
-    if (role !== "admin" && role !== "usuario") {
+    if (!cargoValido(role)) {
       res.status(400).json({ error: "Cargo inválido." });
       return;
     }
@@ -96,7 +106,7 @@ usuariosRouter.patch("/:id", async (req, res: AuthedResponse, next) => {
       res.status(400).json({ error: "Informe o nome do usuário." });
       return;
     }
-    if (role !== "admin" && role !== "usuario") {
+    if (!cargoValido(role)) {
       res.status(400).json({ error: "Cargo inválido." });
       return;
     }
@@ -109,8 +119,11 @@ usuariosRouter.patch("/:id", async (req, res: AuthedResponse, next) => {
       return;
     }
 
+    //Só barra quando quem perde o cargo é justamente o último admin — trocar
+    //o cargo de outros usuários (ex.: usuário → gestor) segue liberado.
+    const alvo = await SupabaseAdminService.buscarPorId(usuarioId);
     const totalAdmins = await SupabaseAdminService.contarAdmins();
-    if (totalAdmins <= 1 && role !== "admin") {
+    if (alvo?.role === "admin" && totalAdmins <= 1 && role !== "admin") {
       res.status(400).json({ error: "Não é possível rebaixar o último administrador do sistema." });
       return;
     }
@@ -122,7 +135,7 @@ usuariosRouter.patch("/:id", async (req, res: AuthedResponse, next) => {
 
     res.json({
       success: true,
-      mensagem: `Usuário atualizado com cargo de ${role === "admin" ? "Administrador" : "Usuário"}.`,
+      mensagem: `Usuário atualizado com cargo de ${CARGO_LABEL[role]}.`,
     });
   } catch (err) {
     next(traduzirErroSupabase(err));
@@ -165,8 +178,9 @@ usuariosRouter.delete("/:id", async (req, res: AuthedResponse, next) => {
       res.status(400).json({ error: "Você não pode excluir a própria conta." });
       return;
     }
+    const alvo = await SupabaseAdminService.buscarPorId(usuarioId);
     const totalAdmins = await SupabaseAdminService.contarAdmins();
-    if (totalAdmins <= 1) {
+    if (alvo?.role === "admin" && totalAdmins <= 1) {
       res.status(400).json({ error: "Não é possível excluir o último administrador do sistema." });
       return;
     }
diff --git a/server/services/auth.server.ts b/server/services/auth.server.ts
index 86c51f2..038fa3e 100644
--- a/server/services/auth.server.ts
+++ b/server/services/auth.server.ts
@@ -1,9 +1,10 @@
 import { getSession } from "./session.server";
+import { normalizarCargo, type Cargo } from "./supabase-admin.server";
 
 export interface AuthedUser {
   id: string;
   email?: string;
-  app_metadata: { role: string };
+  app_metadata: { role: Cargo };
   user_metadata: { nome: string };
 }
 
@@ -21,7 +22,7 @@ export function resolveAuth(cookieHeader?: string | null): AuthedUser | null {
   return {
     id: session.sub,
     email: session.email,
-    app_metadata: { role: session.role === "admin" ? "admin" : "usuario" },
+    app_metadata: { role: normalizarCargo(session.role) },
     user_metadata: { nome: session.nome || "" },
   };
 }
diff --git a/server/services/dashboard.server.ts b/server/services/dashboard.server.ts
index b9f4ea9..a24db41 100644
--- a/server/services/dashboard.server.ts
+++ b/server/services/dashboard.server.ts
@@ -101,7 +101,7 @@ export interface DashboardFaturistaDetalhe {
 // Opções para os selects de filtro da dashboard.
 export interface DashboardOpcoes {
   faturistas: { id: string; nome: string }[];
-  pastas: { id: number; nome: string }[];
+  pastas: { id: number; nome: string; faturistaId: string | null }[];
   clientes: string[];
   status: string[];
   tiposDocumento: string[];
@@ -559,7 +559,7 @@ export class DashboardService {
       .sort((a, b) => a.nome.localeCompare(b.nome, "pt-BR"));
 
     const pastasOpcoes = [...pastas]
-      .map((p) => ({ id: p.id, nome: p.nome }))
+      .map((p) => ({ id: p.id, nome: p.nome, faturistaId: p.faturistaId }))
       .sort((a, b) => a.nome.localeCompare(b.nome, "pt-BR"));
 
     const opcoes: DashboardOpcoes = {
diff --git a/server/services/operacao.server.ts b/server/services/operacao.server.ts
index bac32ac..616327c 100644
--- a/server/services/operacao.server.ts
+++ b/server/services/operacao.server.ts
@@ -12,6 +12,19 @@ export interface BulkActionParams {
   excludedIds?: number[];
 }
 
+//Colunas que a grid deixa editar (COLUNAS_OPERACAO no front). Fora daqui —
+//id, pastaId, importacaoId, hash_assinatura, createdAt... — só o sistema grava:
+//mexer no hash quebra a deduplicação da importação e no importacaoId o desfazer.
+const CAMPOS_EDITAVEIS = new Set([
+  "nm_agencia", "dt_emissao_", "nm_proprietario_posse_cavalo", "nm_pessoa_pagador",
+  "nr_cpf_cnpj_raiz", "nr_cpf_cnpj_pagador", "nr_ctrc", "status", "data_status",
+  "id_solicitacao", "dt_quitacao_saldo", "comentarios", "id_tipo_documento",
+  "nm_pessoa_remetente", "nm_cidade_origem", "ds_sigla_origem", "nm_pessoa_destinatario",
+  "nm_cidade_destino", "ds_sigla_destino", "nm_produto", "vl_peso", "vl_tarifa",
+  "vl_total", "nr_nf", "ds_placa", "nm_pessoa_matriz", "nr_contrato", "nr_chave_acesso",
+  "nm_pessoa_usuario_lancamento", "id_tipo_ctrc", "cd_pessoa_pagador", "nm_motorista",
+]);
+
 //OperacaoService
 //Responsabilidade: Interações puras de Banco de Dados com a tabela Operacao.
 //Transformações de dados, validações complexas e regras de negócio de parsing
@@ -296,6 +309,11 @@ export class OperacaoService {
   }
 
   static async update(id: number, campo: string, valorNovo: string) {
+    if (!CAMPOS_EDITAVEIS.has(campo)) {
+      const err: any = new Error("Campo não permitido para edição.");
+      err.status = 400;
+      throw err;
+    }
     this.invalidarCache();
 
     let valorLimpo: any = valorNovo;
diff --git a/server/services/supabase-admin.server.ts b/server/services/supabase-admin.server.ts
index 0a4d47b..4bed132 100644
--- a/server/services/supabase-admin.server.ts
+++ b/server/services/supabase-admin.server.ts
@@ -5,13 +5,22 @@ export interface UsuarioAdmin {
   id: string;
   email: string;
   nome: string;
-  role: "admin" | "usuario";
+  role: Cargo;
   criadoEm: string | null;
   bloqueado: boolean;
 }
 
-const ROLE_ADMIN = "admin";
-const ROLE_USUARIO = "usuario";
+//Cargos em ordem crescente de acesso: usuário (caixa de entrada e pastas),
+//gestor (+ dashboard e automações) e admin (+ gestão de usuários).
+export const CARGOS = ["usuario", "gestor", "admin"] as const;
+export type Cargo = (typeof CARGOS)[number];
+
+const ROLE_ADMIN: Cargo = "admin";
+
+//Qualquer valor desconhecido (ou ausente) cai no cargo de menor acesso.
+export function normalizarCargo(role: unknown): Cargo {
+  return CARGOS.includes(role as Cargo) ? (role as Cargo) : "usuario";
+}
 const BAN_PERMANENTE = "876000h"; // 100 anos = banimento efetivamente permanente
 //Lista completa de usuários do Supabase muda pouco: cacheada 10 min e paginada
 //em memória (listarUsuarios, contarAdmins e quem mais precisar da lista toda).
@@ -38,7 +47,7 @@ function createSupabaseAdminClient() {
 }
 
 function mapearUsuario(u: any): UsuarioAdmin {
-  const role = u.app_metadata?.role === ROLE_ADMIN ? ROLE_ADMIN : ROLE_USUARIO;
+  const role = normalizarCargo(u.app_metadata?.role);
   const bloqueado = !!u.banned_until && new Date(u.banned_until).getTime() > Date.now();
   return {
     id: u.id,
@@ -109,7 +118,7 @@ export const SupabaseAdminService = {
 
   async criarUsuario(dados: { email: string; senha: string; nome: string; role: string }) {
     const supabase = createSupabaseAdminClient();
-    const role = dados.role === ROLE_ADMIN ? ROLE_ADMIN : ROLE_USUARIO;
+    const role = normalizarCargo(dados.role);
 
     const { data, error } = await supabase.auth.admin.createUser({
       email: dados.email,
@@ -125,7 +134,7 @@ export const SupabaseAdminService = {
 
   async atualizarCargo(usuarioId: string, role: string) {
     const supabase = createSupabaseAdminClient();
-    const novoRole = role === ROLE_ADMIN ? ROLE_ADMIN : ROLE_USUARIO;
+    const novoRole = normalizarCargo(role);
 
     const { error } = await supabase.auth.admin.updateUserById(usuarioId, {
       app_metadata: { role: novoRole },