chore: prepara versao 2.7.9

docs: versiona instrucoes dos agentes
ci: publica releases somente por tags semver
2026-07-09 03:16:01 +00:00 · 2026-06-21 12:20:12 -03:00 · 2026-06-21 12:20:01 -03:00 · 2026-06-21 12:19:53 -03:00 · 2026-06-21 11:54:27 -03:00 · 2026-06-21 11:54:19 -03:00
31 changed files with 4722 additions and 256 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Next.js types
+        run: pnpm exec next typegen
+
+      - name: Typecheck
+        run: pnpm exec tsc --noEmit
+
+      - name: Lint
+        run: pnpm run lint
+
+      - name: Build application
+        run: pnpm run build
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -1,87 +0,0 @@
-name: Build and Push to Docker Hub
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - 'v*.*.*'
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-env:
-  DOCKER_IMAGE_NAME: openmonetis
-
-jobs:
-  quality:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: 22
-          cache: 'pnpm'
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Lint
-        run: pnpm run lint
-
-  build-and-push:
-    runs-on: ubuntu-latest
-    needs: quality
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Extract metadata (tags, labels)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USERNAME }}/${{ env.DOCKER_IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=sha,prefix={{branch}}-
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          platforms: linux/amd64,linux/arm64
-
-      - name: Image digest
-        run: echo ${{ steps.meta.outputs.digest }}
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,58 +2,151 @@ name: Release

 on:
  push:
-    branches:
-      - main
+    tags:
+      - "v*.*.*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  DOCKER_IMAGE_NAME: openmonetis
+
+permissions:
+  contents: read

 jobs:
-  release:
+  quality:
    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Validate release version
+        shell: bash
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PACKAGE_VERSION="$(jq -r '.version' package.json)"
+
+          if [[ ! "$TAG_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "A tag $GITHUB_REF_NAME não segue o formato vX.Y.Z."
+            exit 1
+          fi
+
+          if [[ "$TAG_VERSION" != "$PACKAGE_VERSION" ]]; then
+            echo "A tag $GITHUB_REF_NAME não corresponde à versão $PACKAGE_VERSION do package.json."
+            exit 1
+          fi
+
+          if ! grep -Fq "## [$TAG_VERSION]" CHANGELOG.md; then
+            echo "A versão $TAG_VERSION não foi encontrada no CHANGELOG.md."
+            exit 1
+          fi
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Next.js types
+        run: pnpm exec next typegen
+
+      - name: Typecheck
+        run: pnpm exec tsc --noEmit
+
+      - name: Lint
+        run: pnpm run lint
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: quality
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ secrets.DOCKER_USERNAME }}/${{ env.DOCKER_IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest
+
+      - name: Build and push Docker image
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
+
+      - name: Image digest
+        run: echo "${{ steps.build.outputs.digest }}"
+
+  github-release:
+    runs-on: ubuntu-latest
+    needs: docker
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Read version from package.json
-        id: version
-        run: |
-          VERSION=$(jq -r '.version' package.json)
-          echo "value=$VERSION" >> $GITHUB_OUTPUT
-          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Check if tag already exists
-        id: tag_check
-        run: |
-          if git ls-remote --tags origin "refs/tags/v${{ steps.version.outputs.value }}" | grep -q .; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi

      - name: Extract changelog for this version
-        if: steps.tag_check.outputs.exists == 'false'
        id: changelog
+        shell: bash
        run: |
-          VERSION="${{ steps.version.outputs.value }}"
-          # Extrai o bloco entre ## [X.Y.Z] e o próximo ## [
-          NOTES=$(awk "/^## \[$VERSION\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
-          # Remove linhas em branco do início e fim
-          NOTES=$(echo "$NOTES" | sed '/./,$!d' | sed -e :a -e '/^\n*$/{$d;N;ba}')
+          VERSION="${GITHUB_REF_NAME#v}"
+          NOTES=$(awk -v version="$VERSION" '
+            index($0, "## [" version "]") == 1 { found=1; next }
+            found && /^## \[/ { exit }
+            found && !started && /^[[:space:]]*$/ { next }
+            found { started=1; print }
+          ' CHANGELOG.md)
+
+          if [[ -z "$NOTES" ]]; then
+            echo "Não foi possível extrair as notas da versão $VERSION."
+            exit 1
+          fi
+
          {
            echo "notes<<EOF"
            echo "$NOTES"
            echo "EOF"
-          } >> $GITHUB_OUTPUT
+          } >> "$GITHUB_OUTPUT"

-      - name: Create tag and GitHub Release
-        if: steps.tag_check.outputs.exists == 'false'
+      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
-          tag_name: ${{ steps.version.outputs.tag }}
-          name: ${{ steps.version.outputs.tag }}
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
          body: ${{ steps.changelog.outputs.notes }}
          draft: false
          prerelease: false
--- a/.gitignore
+++ b/.gitignore
@@ -105,7 +105,6 @@ docker-compose.override.yml
 .gemini/
 .cursor/
 QWEN.md
-AGENTS.md
 .codex
 # === Backups locais ===
 /backup/
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,366 @@
+# AGENTS.md - OpenMonetis
+
+> Self-hosted personal finance app (Next.js 16, React 19, PostgreSQL, Drizzle ORM, Better Auth, Tailwind 4, shadcn/ui).
+> Portuguese UI, English folders/imports. Linter: Biome 2.x. Package manager: pnpm.
+
+## Related Projects
+
+- **OpenMonetis Companion** (`~/github/openmonetis-companion`): Android app que captura notificacoes de apps bancarios e envia para o OpenMonetis via API. Os itens chegam na feature `inbox` para revisao.
+
+---
+
+## Critical Rules
+
+1. **Sempre filtrar por `userId`** em queries.
+2. **Usar `getAdminPayerId(userId)`** de `src/shared/lib/payers/get-admin-id.ts` ao inves de JOIN com `payers` para descobrir o admin.
+3. **Periods** usam formato `YYYY-MM` (ex: `"2025-11"`). Utils em `src/shared/utils/period/`.
+4. **Moeda**: R$ com 2 decimais. DB: `numeric(12, 2)`. Utils em `src/shared/utils/currency.ts`.
+5. **Revalidation**: usar `revalidateForEntity("entity")` de `src/shared/lib/actions/helpers.ts` apos mutations.
+6. **Versionamento e publicação**: registrar mudancas no `CHANGELOG.md` seguindo Keep a Changelog, também alterar o `package.json` e o badge de versão do `README.md`. Cada versão deve ter um parágrafo introdutório em linguagem humana logo abaixo do cabeçalho `## [x.y.z]`, antes das seções `### Adicionado/Alterado/Removido` — descrevendo em prosa o que a versão representa (ex: "Esta versão foca em polimento visual e reorganização interna..."). A `main` executa somente a CI; imagens Docker e GitHub Releases são publicadas exclusivamente por tags SemVer no formato `vX.Y.Z`. Antes de criar a tag, confirmar que a CI da `main` passou e que tag, `package.json`, `CHANGELOG.md` e badge do `README.md` usam a mesma versão. A tag deve apontar para o commit validado. Criar ou enviar uma tag dispara publicação externa (`X.Y.Z`, `X.Y`, `X` e `latest` no Docker Hub, seguida da GitHub Release), portanto agentes nunca devem criar ou fazer push de tags sem autorização explícita do usuário. Não voltar a publicar `latest` diretamente de pushes na `main`.
+7. **Comunicacao**: responder em portugues clara e direta com o time.
+8. **Commit messages**: agrupar por natureza. em pt-br. seguindo o padrao do sistema.
+9. **README.md**: sempre que fizer alteracoes significativas, atualize o README.md.
+
+---
+
+## Architecture
+
+### Feature-First
+
+- `src/app/`: roteamento, layouts, loading states e paginas finas
+- `src/features/`: codigo de dominio por feature
+- `src/shared/`: tudo que e genuinamente reutilizado entre features
+- `src/db/`: schema do banco
+
+### Regra Feature vs Shared
+
+Use esta pergunta:
+
+> Se eu deletar esta feature, este arquivo deveria sumir junto?
+
+- Sim: vai para `src/features/<feature>/`
+- Nao: vai para `src/shared/`
+
+### Features nao importam outras features
+
+Se um contrato cruza dominios, ele deve morar em `src/shared/`.
+
+**Excecao intencional: `attachments` depende de `transactions`**
+
+`src/features/attachments` importa `TransactionDialog`, `TransactionDetailsDialog` e `TransactionItem` diretamente de `src/features/transactions`. Isso e uma dependencia explicita e aceita: anexos sao semanticamente uma extensao de lancamentos — existem por causa deles e nao fazem sentido sem esse contexto. Mover esses componentes para `shared/` seria errado (eles pertencem a transactions). Nao tratar isso como bug a corrigir.
+
+Exemplos comuns:
+
+- auth: `src/shared/lib/auth/*`
+- db: `src/shared/lib/db.ts`
+- revalidation helpers: `src/shared/lib/actions/*`
+- payers cross-domain helpers: `src/shared/lib/payers/*`
+- period/currency/date: `src/shared/utils/*`
+- shadcn/ui: `src/shared/components/ui/*`
+
+---
+
+## Directory Structure
+
+```text
+src/
+├── app/
+│   ├── (auth)/
+│   │   ├── login/page.tsx
+│   │   └── signup/page.tsx
+│   ├── (dashboard)/
+│   │   ├── dashboard/
+│   │   ├── transactions/
+│   │   ├── cards/
+│   │   │   └── [cardId]/invoice/
+│   │   ├── accounts/
+│   │   │   └── [accountId]/statement/
+│   │   ├── categories/
+│   │   │   ├── [categoryId]/
+│   │   │   └── history/
+│   │   ├── budgets/
+│   │   ├── payers/
+│   │   │   └── [payerId]/
+│   │   ├── notes/
+│   │   ├── insights/
+│   │   ├── calendar/
+│   │   ├── inbox/
+│   │   ├── attachments/
+│   │   ├── changelog/
+│   │   ├── reports/
+│   │   │   ├── category-trends/
+│   │   │   ├── card-usage/
+│   │   │   ├── installment-analysis/
+│   │   │   └── establishments/
+│   │   └── settings/
+│   ├── (landing-page)/
+│   ├── api/
+│   ├── globals.css
+│   └── layout.tsx
+├── features/                      # cada feature segue: actions.ts, queries.ts, actions/, components/, hooks/, lib/
+│   ├── auth/
+│   ├── landing/
+│   ├── dashboard/
+│   ├── transactions/
+│   ├── cards/
+│   ├── invoices/
+│   ├── accounts/
+│   ├── categories/
+│   ├── budgets/
+│   ├── payers/
+│   ├── notes/
+│   ├── insights/
+│   ├── calendar/
+│   ├── inbox/
+│   ├── attachments/
+│   ├── reports/
+│   └── settings/
+├── shared/
+│   ├── components/
+│   │   ├── ui/                # shadcn/ui primitives
+│   │   ├── navigation/        # navbar, sidebar, breadcrumbs
+│   │   ├── providers/         # React context providers
+│   │   ├── brand/             # logos do app (logo, logo-icon, logo-text)
+│   │   ├── widgets/           # widget-card, widget-empty-state, expandable-widget-card
+│   │   ├── feedback/          # empty-state, status-dot, payment-success
+│   │   ├── month-picker/
+│   │   ├── logo-picker/
+│   │   ├── calculator/
+│   │   ├── entity-avatar/
+│   │   └── skeletons/
+│   ├── hooks/
+│   ├── lib/
+│   │   ├── actions/
+│   │   ├── auth/
+│   │   ├── accounts/
+│   │   ├── cards/
+│   │   ├── calculator/
+│   │   ├── categories/
+│   │   ├── email/
+│   │   ├── import/
+│   │   ├── installments/
+│   │   ├── invoices/
+│   │   ├── logo/
+│   │   ├── notifications/
+│   │   ├── payers/
+│   │   ├── schemas/
+│   │   ├── storage/
+│   │   ├── transfers/
+│   │   ├── types/
+│   │   ├── version/
+│   │   └── db.ts
+│   └── utils/
+│       ├── period/
+│       ├── calculator.ts
+│       ├── calendar.ts
+│       ├── category-colors.ts
+│       ├── currency.ts
+│       ├── date.ts
+│       ├── export-branding.ts
+│       ├── fetch-json.ts
+│       ├── financial-dates.ts
+│       ├── icons.tsx
+│       ├── id.ts
+│       ├── initials.ts
+│       ├── math.ts
+│       ├── number.ts
+│       ├── percentage.ts
+│       ├── string.ts
+│       └── ui.ts
+└── db/
+    └── schema.ts
+```
+
+### Estrutura interna padrão de uma feature
+
+Toda feature em `src/features/<nome>/` segue:
+
+```text
+<feature>/
+├── actions.ts        # entry point de Server Actions (barrel quando há actions/)
+├── queries.ts        # entry point de leitura do banco
+├── actions/          # (opcional) Server Actions divididas por domínio quando o volume cresce
+├── components/       # componentes de UI da feature
+├── hooks/            # React hooks específicos da feature
+└── lib/              # helpers, types, sub-queries e constantes internas
+```
+
+`actions.ts` e `queries.ts` são as portas de entrada da feature. Tudo que é helper interno fica em `lib/`. Componentes e hooks ficam nas pastas com nome óbvio.
+
+---
+
+## Import Patterns
+
+### Preferidos
+
+```ts
+import { getUser } from "@/shared/lib/auth/server";
+import { revalidateForEntity } from "@/shared/lib/actions/helpers";
+import { parsePeriodParam } from "@/shared/utils/period";
+import { TransactionsPage } from "@/features/transactions/components/page/transactions-page";
+import { fetchLancamentos } from "@/features/transactions/queries";
+```
+
+### Evitar
+
+```ts
+import { Something } from "@/components/...";
+import { Something } from "@/lib/...";
+import { something } from "@/app/(dashboard)/...";
+```
+
+---
+
+## App Router Pattern
+
+Paginas em `src/app/` devem ser finas:
+
+```ts
+import { getUser } from "@/shared/lib/auth/server";
+import { TransactionsPage } from "@/features/transactions/components/page/transactions-page";
+import { fetchLancamentos } from "@/features/transactions/queries";
+
+export default async function Page() {
+  const user = await getUser();
+  const data = await fetchLancamentos([/* filters */]);
+  return <TransactionsPage {...data} />;
+}
+```
+
+Layouts, `loading.tsx` e metadata continuam em `src/app/`.
+
+---
+
+## Naming
+
+### Routes / folders
+
+| Portugues | English |
+|---|---|
+| `lancamentos` | `transactions` |
+| `cartoes` | `cards` |
+| `contas` | `accounts` |
+| `categorias` | `categories` |
+| `orcamentos` | `budgets` |
+| `pessoas` | `payers` |
+
+> **Nota:** o conceito de "pagador" foi renomeado para **"pessoa"** na UI (labels, toasts, textos visíveis ao usuário). O código, rotas e schema continuam usando o termo original em inglês (`payer`, `payerId`, `adminPayerId`) e em português interno (`pagador` como variável). Não renomear esses identificadores — a divergência entre UI e código é intencional e documentada.
+| `anotacoes` | `notes` |
+| `calendario` | `calendar` |
+| `ajustes` | `settings` |
+| `pre-lancamentos` | `inbox` |
+| `relatorios/tendencias` | `reports/category-trends` |
+| `relatorios/uso-cartoes` | `reports/card-usage` |
+| `relatorios/analise-parcelas` | `reports/installment-analysis` |
+| `relatorios/estabelecimentos` | `reports/establishments` |
+| `contas/[contaId]/extrato` | `accounts/[accountId]/statement` |
+| `cartoes/[cartaoId]/fatura` | `cards/[cardId]/invoice` |
+| `categorias/historico` | `categories/history` |
+| `changelog` | `settings/changelog` |
+
+### Files
+
+- preferir `kebab-case`
+- preferir nomes em ingles
+- manter nomes internos de tipos/funcoes somente quando a troca aumentar risco sem ganho real
+
+---
+
+## Commands
+
+```bash
+pnpm run dev
+pnpm run build
+pnpm run lint
+pnpm run lint:fix
+pnpm exec next typegen
+pnpm exec tsc --noEmit
+pnpm run db:generate
+pnpm run db:push
+pnpm run db:studio
+pnpm run docker:up:db
+```
+
+---
+
+## Revalidation
+
+Arquivo: `src/shared/lib/actions/helpers.ts`
+
+- atualizar sempre os paths em ingles
+- lembrar de manter a tag `"dashboard"` para invalidacoes financeiras
+
+---
+
+## Auth
+
+- `getUser()` / `getUserId()` em `src/shared/lib/auth/server.ts`
+- sessao deduplicada por request com `React.cache()`
+
+---
+
+## Dashboard Fetcher
+
+Padrao recomendado:
+
+```ts
+import { getAdminPayerId } from "@/shared/lib/payers/get-admin-id";
+
+export async function fetchData(userId: string, period: string) {
+  const adminPayerId = await getAdminPayerId(userId);
+  if (!adminPayerId) return [];
+
+  return db.query.transactions.findMany({
+    where: /* sempre com userId + adminPayerId + period */,
+  });
+}
+```
+
+---
+
+## New Feature Checklist
+
+1. Criar a rota fina em `src/app/(dashboard)/<feature>/page.tsx`
+2. Criar a feature em `src/features/<feature>/`
+3. Separar:
+   - `components/`
+   - `queries.ts` (entry point de leitura)
+   - `actions.ts` (entry point de Server Actions; vira barrel quando crescer e migrar para `actions/`)
+   - `lib/` para helpers internos, sub-queries por tópico, types e constantes da feature
+   - `types.ts` ou `schemas.ts` quando fizer sentido (alternativa a `lib/`)
+   - `hooks/` quando houver hooks específicos da feature
+4. Extrair para `src/shared/` tudo que for reutilizavel
+5. Atualizar navegacao e `revalidateForEntity()` se a feature tiver CRUD
+6. Rodar:
+   - `pnpm exec next typegen`
+   - `pnpm exec tsc --noEmit`
+   - `pnpm run lint`
+
+---
+
+## Security Rules
+
+Regras aplicadas automaticamente ao gerar codigo.
+
+### Secrets
+Nunca colocar API keys, credenciais de banco ou tokens em codigo frontend. Evitar variaveis prefixadas com `NEXT_PUBLIC_` para dados sensiveis — estas sao bundladas no cliente. Usar variaveis server-side apenas. `.env` deve estar no `.gitignore` antes do primeiro commit. `.env.example` deve ter apenas placeholders.
+
+### Autenticacao & Autorizacao
+Toda rota protegida em `src/app/api/` requer `getUser()` ou `getOptionalUserSession()` antes de qualquer logica, retornando 401 para nao autenticados. Rotas com IDs de recursos devem verificar ownership: `eq(table.userId, userId)`. Rotas admin devem checar role e retornar 403 para nao-admins. Session cookies em Better Auth ja tem `httpOnly`, `secure` e `sameSite` configurados — nao alterar.
+
+### Input & Output
+Usar Drizzle ORM (parametrizado por padrao) — nunca concatenar input de usuario em SQL. Validar todo input com Zod antes de usar. Upload de arquivos: usar whitelist de MIME types (`ALLOWED_MIME_TYPES`), presigned URLs para S3, token de upload assinado com verificacao pos-upload. Nunca usar `dangerouslySetInnerHTML` com conteudo de usuario.
+
+### Headers & CSP
+CSP definida em `src/proxy.ts` via middleware — alterar la, nao em `next.config.ts`. Headers de seguranca (HSTS, X-Frame-Options, etc.) definidos em `next.config.ts`. Nao remover nem enfraquecer essas configuracoes.
+
+### Rate Limiting
+Login: 5 tentativas/min. Signup: 3 tentativas/min. API tokens: 100 req/min (inbox), 20 req/min (batch). Configurado em `src/shared/lib/auth/config.ts` e nas rotas de inbox. Nao remover.
+
+### Tratamento de Erros
+Erros nao devem expor stack traces, paths ou nomes de bibliotecas ao cliente. Usar mensagens genericas: `"Algo deu errado"`. Logar detalhes apenas no servidor com `console.error()`.
+
+### Dependencias
+Verificar pacotes novos sugeridos pela IA em npmjs.com antes de instalar. Red flags: menos de 1.000 downloads/semana, publicado nos ultimos 30 dias, nome muito parecido com pacote popular. Rodar `pnpm audit` periodicamente.
+
+---
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,27 @@ Todas as mudanças notáveis deste projeto serão documentadas neste arquivo.
 O formato é baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.1.0/),
 e este projeto adere ao [Versionamento Semântico](https://semver.org/lang/pt-BR/).

+## [2.7.9] - 2026-06-21
+
+Esta versão torna a publicação mais previsível ao separar a validação contínua da entrega de versões oficiais. Pull requests e a branch principal continuam sendo verificadas, enquanto imagens Docker e releases passam a ser produzidas somente a partir de uma tag SemVer validada.
+
+### Alterado
+- CI: pull requests e pushes na `main` agora executam geração de tipos, verificação TypeScript, lint e build sem publicar imagens.
+- Releases: tags `vX.Y.Z` agora validam sua correspondência com o `package.json` e o `CHANGELOG.md` antes de publicar as imagens Docker e criar a GitHub Release.
+- Docker: as tags versionadas e `latest` passam a ser publicadas exclusivamente por releases oficiais, depois das verificações de qualidade.
+
+## [2.7.8] - 2026-06-21
+
+Esta versão deixa documentos e comprovantes mais fáceis de guardar e encontrar sem tirar o foco da rotina financeira. Agora é possível manter arquivos junto às notas, consultar a galeria por pessoa com identificação visual e abrir uma categoria diretamente das tendências do dashboard, sempre preservando o contexto do período selecionado.
+
+### Adicionado
+- Anotações: itens do tipo `Nota` agora aceitam anexos PDF, JPEG, PNG e WebP na criação e na edição, com consulta e download nos detalhes e respeito ao limite configurado pelo usuário.
+- Anexos: a galeria agora oferece filtro por pessoa, incluindo a pessoa principal, pessoas específicas e uma visão consolidada de todas as pessoas.
+
+### Alterado
+- Anexos: os cards da galeria agora identificam a pessoa vinculada ao lançamento e o filtro exibe os respectivos avatares, preservando o contexto quando vários responsáveis são exibidos.
+- Dashboard: os nomes no widget `Tendências de categorias` agora levam aos detalhes da categoria mantendo o período selecionado.
+
 ## [2.7.7] - 2026-06-20

 Esta versão faz ajustes pontuais de leitura nos resumos financeiros e no dashboard, reforçando a identidade visual de cartões e contas e deixando as listas dos widgets mais consistentes sem alterar a estrutura de navegação das páginas.
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@

 > **Não há versão online hospedada.** Você precisa clonar o repositório e rodar localmente ou no seu próprio servidor.

-[![Version](https://img.shields.io/badge/version-2.7.7-blue?style=flat-square)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.7.9-blue?style=flat-square)](CHANGELOG.md)
 [![Next.js](https://img.shields.io/badge/Next.js-black?style=flat-square&logo=next.js)](https://nextjs.org/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-blue?style=flat-square&logo=typescript)](https://www.typescriptlang.org/)
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-blue?style=flat-square&logo=postgresql)](https://www.postgresql.org/)
@@ -79,7 +79,7 @@ A ideia é simples: ter um lugar onde consigo ver todas as minhas contas, cartõ

 👥 **Gestão colaborativa** — Pagadores com permissões (admin/viewer), notificações automáticas por e-mail, códigos de compartilhamento.

-📝 **Anotações e tarefas** — Notas de texto, listas com checkboxes, sistema de arquivamento.
+📝 **Anotações e tarefas** — Notas de texto com anexos, listas com checkboxes e sistema de arquivamento.

 📅 **Calendário financeiro** — Visualize todos os lançamentos em um calendário mensal.

@@ -623,6 +623,17 @@ A regra é: `actions.ts` e `queries.ts` são as portas de entrada da feature. Tu

 Antes de começar, leia o [`CLAUDE.md`](CLAUDE.md) — ele documenta a arquitetura, convenções de nomenclatura, regras de queries e o checklist para novas features. Use TypeScript, commits semânticos e mantenha o `CHANGELOG.md` atualizado.

+### Publicando uma versão
+
+As validações rodam em pull requests e em cada push na `main`. A publicação só começa quando uma tag SemVer aponta para um commit validado e a versão da tag corresponde ao `package.json` e ao `CHANGELOG.md`.
+
+```bash
+git tag -a v2.7.9 -m "v2.7.9"
+git push origin v2.7.9
+```
+
+O workflow da tag valida o código, publica as imagens Docker versionadas e `latest` e, somente depois, cria a GitHub Release com as notas do changelog.
+
 ---

 ## 💖 Apoie o Projeto
--- a/drizzle/0031_lame_cerise.sql
+++ b/drizzle/0031_lame_cerise.sql
@@ -0,0 +1,9 @@
+CREATE TABLE "anotacao_anexos" (
+	"anotacao_id" uuid NOT NULL,
+	"anexo_id" uuid NOT NULL,
+	CONSTRAINT "anotacao_anexos_anotacao_id_anexo_id_pk" PRIMARY KEY("anotacao_id","anexo_id")
+);
+--> statement-breakpoint
+ALTER TABLE "anotacao_anexos" ADD CONSTRAINT "anotacao_anexos_anotacao_id_anotacoes_id_fk" FOREIGN KEY ("anotacao_id") REFERENCES "public"."anotacoes"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "anotacao_anexos" ADD CONSTRAINT "anotacao_anexos_anexo_id_anexos_id_fk" FOREIGN KEY ("anexo_id") REFERENCES "public"."anexos"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "anotacao_anexos_anexo_id_idx" ON "anotacao_anexos" USING btree ("anexo_id");
--- a/drizzle/meta/0031_snapshot.json
+++ b/drizzle/meta/0031_snapshot.json
--- a/drizzle/meta/_journal.json
+++ b/drizzle/meta/_journal.json
@@ -211,6 +211,13 @@
 			"when": 1780150535055,
 			"tag": "0030_complete_umar",
 			"breakpoints": true
+		},
+		{
+			"idx": 31,
+			"version": "7",
+			"when": 1782051007412,
+			"tag": "0031_lame_cerise",
+			"breakpoints": true
 		}
 	]
 }
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "openmonetis",
-	"version": "2.7.7",
+	"version": "2.7.9",
 	"private": true,
 	"packageManager": "pnpm@11.1.3",
 	"scripts": {
--- a/src/app/(dashboard)/attachments/page.tsx
+++ b/src/app/(dashboard)/attachments/page.tsx
@@ -1,6 +1,6 @@
 import { connection } from "next/server";
 import { AttachmentsPage } from "@/features/attachments/components/attachments-page";
-import { fetchAttachmentsForPeriod } from "@/features/attachments/queries";
+import { fetchAttachmentsPageData } from "@/features/attachments/queries";
 import { getUserId } from "@/shared/lib/auth/server";
 import { parsePeriodParam } from "@/shared/utils/period";

@@ -26,11 +26,14 @@ export default async function Page({ searchParams }: PageProps) {
 	const periodoParam = getSingleParam(resolvedSearchParams, "periodo");
 	const { period } = parsePeriodParam(periodoParam);

-	const attachments = await fetchAttachmentsForPeriod(userId, period);
+	const data = await fetchAttachmentsPageData(userId, period);

 	return (
 		<main className="flex flex-col gap-6">
-			<AttachmentsPage attachments={attachments} />
+			<AttachmentsPage
+				attachments={data?.attachments ?? []}
+				adminPayerId={data?.adminPayerId ?? ""}
+			/>
 		</main>
 	);
 }
--- a/src/app/(dashboard)/notes/page.tsx
+++ b/src/app/(dashboard)/notes/page.tsx
@@ -1,16 +1,24 @@
 import { connection } from "next/server";
 import { NotesPage } from "@/features/notes/components/notes-page";
 import { fetchAllNotesForUser } from "@/features/notes/queries";
+import { fetchUserPreferences } from "@/features/settings/queries";
 import { getUserId } from "@/shared/lib/auth/server";

 export default async function Page() {
 	await connection();
 	const userId = await getUserId();
-	const { activeNotes, archivedNotes } = await fetchAllNotesForUser(userId);
+	const [{ activeNotes, archivedNotes }, preferences] = await Promise.all([
+		fetchAllNotesForUser(userId),
+		fetchUserPreferences(userId),
+	]);

 	return (
 		<main className="flex flex-col gap-6">
-			<NotesPage notes={activeNotes} archivedNotes={archivedNotes} />
+			<NotesPage
+				notes={activeNotes}
+				archivedNotes={archivedNotes}
+				attachmentMaxSizeMb={preferences?.attachmentMaxSizeMb ?? 50}
+			/>
 		</main>
 	);
 }
--- a/src/db/schema.ts
+++ b/src/db/schema.ts
@@ -847,11 +847,12 @@ export const budgetsRelations = relations(budgets, ({ one }) => ({
 	}),
 }));

-export const notesRelations = relations(notes, ({ one }) => ({
+export const notesRelations = relations(notes, ({ one, many }) => ({
 	user: one(user, {
 		fields: [notes.userId],
 		references: [user.id],
 	}),
+	noteAttachments: many(noteAttachments),
 }));

 export const savedInsightsRelations = relations(savedInsights, ({ one }) => ({
@@ -972,6 +973,24 @@ export const transactionAttachments = pgTable(
 	}),
 );

+export const noteAttachments = pgTable(
+	"anotacao_anexos",
+	{
+		noteId: uuid("anotacao_id")
+			.notNull()
+			.references(() => notes.id, { onDelete: "cascade" }),
+		attachmentId: uuid("anexo_id")
+			.notNull()
+			.references(() => attachments.id, { onDelete: "cascade" }),
+	},
+	(table) => ({
+		pk: primaryKey({ columns: [table.noteId, table.attachmentId] }),
+		attachmentIdIdx: index("anotacao_anexos_anexo_id_idx").on(
+			table.attachmentId,
+		),
+	}),
+);
+
 export const importCategoryMappings = pgTable(
 	"import_category_mappings",
 	{
@@ -1044,6 +1063,7 @@ export const attachmentsRelations = relations(attachments, ({ one, many }) => ({
 		references: [user.id],
 	}),
 	transactionAttachments: many(transactionAttachments),
+	noteAttachments: many(noteAttachments),
 }));

 export const transactionAttachmentsRelations = relations(
@@ -1060,8 +1080,23 @@ export const transactionAttachmentsRelations = relations(
 	}),
 );

+export const noteAttachmentsRelations = relations(
+	noteAttachments,
+	({ one }) => ({
+		note: one(notes, {
+			fields: [noteAttachments.noteId],
+			references: [notes.id],
+		}),
+		attachment: one(attachments, {
+			fields: [noteAttachments.attachmentId],
+			references: [attachments.id],
+		}),
+	}),
+);
+
 export type Attachment = typeof attachments.$inferSelect;
 export type TransactionAttachment = typeof transactionAttachments.$inferSelect;
+export type NoteAttachment = typeof noteAttachments.$inferSelect;

 export const establishmentLogosRelations = relations(
 	establishmentLogos,
--- a/src/features/attachments/components/attachment-grid-item.tsx
+++ b/src/features/attachments/components/attachment-grid-item.tsx
@@ -162,9 +162,15 @@ export function AttachmentGridItem({
 				</div>

 				{/* Data */}
-				<span className="text-xs text-muted-foreground">
-					{formatDate(attachment.purchaseDate)}
-				</span>
+				<div className="flex min-w-0 items-center gap-1 text-xs text-muted-foreground">
+					<span className="shrink-0">
+						{formatDate(attachment.purchaseDate)}
+					</span>
+					<span aria-hidden>·</span>
+					<span className="truncate" title={attachment.payerName}>
+						{attachment.payerName}
+					</span>
+				</div>

 				{/* Transação e Valor */}
 				<div className="flex items-start justify-between gap-2">
--- a/src/features/attachments/components/attachments-page.tsx
+++ b/src/features/attachments/components/attachments-page.tsx
@@ -4,6 +4,8 @@ import {
 	RiAttachmentLine,
 	RiFilePdf2Line,
 	RiImageLine,
+	RiUserLine,
+	RiVerifiedBadgeFill,
 } from "@remixicon/react";
 import { useRouter } from "next/navigation";
 import type React from "react";
@@ -17,9 +19,17 @@ import type { TransactionDialogOptions } from "@/features/transactions/actions/f
 import { fetchTransactionDialogOptionsAction } from "@/features/transactions/actions/fetch-dialog-options";
 import { TransactionDetailsDialog } from "@/features/transactions/components/dialogs/transaction-details-dialog";
 import { TransactionDialog } from "@/features/transactions/components/dialogs/transaction-dialog/transaction-dialog";
+import { PayerSelectContent } from "@/features/transactions/components/select-items";
 import type { TransactionItem } from "@/features/transactions/components/types";
 import { EmptyState } from "@/shared/components/feedback/empty-state";
 import { Card, CardContent } from "@/shared/components/ui/card";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@/shared/components/ui/select";
 import { cn } from "@/shared/utils/ui";

 type FilterType = "all" | "images" | "pdfs";
@@ -73,11 +83,18 @@ const FILTERS: {

 interface AttachmentsPageProps {
 	attachments: AttachmentForPeriod[];
+	adminPayerId: string;
 }

-export function AttachmentsPage({ attachments }: AttachmentsPageProps) {
+const ALL_PAYERS = "all";
+
+export function AttachmentsPage({
+	attachments,
+	adminPayerId,
+}: AttachmentsPageProps) {
 	const router = useRouter();
 	const [filter, setFilter] = useState<FilterType>("all");
+	const [payerFilter, setPayerFilter] = useState(adminPayerId);
 	const [selectedIndex, setSelectedIndex] = useState(-1);
 	const [transactionDetails, setTransactionDetails] =
 		useState<TransactionItem | null>(null);
@@ -93,21 +110,44 @@ export function AttachmentsPage({ attachments }: AttachmentsPageProps) {
 	const [dialogOptions, setDialogOptions] =
 		useState<TransactionDialogOptions | null>(null);

-	const filteredAttachments = attachments.filter((a) => {
+	const payerOptions = Array.from(
+		new Map(
+			attachments.map((attachment) => [
+				attachment.payerId,
+				{
+					value: attachment.payerId,
+					label: attachment.payerName,
+					avatarUrl: attachment.payerAvatarUrl,
+				},
+			]),
+		).values(),
+	).sort((a, b) =>
+		a.label.localeCompare(b.label, "pt-BR", { sensitivity: "base" }),
+	);
+
+	const payerAttachments = attachments.filter(
+		(attachment) =>
+			payerFilter === ALL_PAYERS || attachment.payerId === payerFilter,
+	);
+	const selectedPayer = payerOptions.find(
+		(option) => option.value === payerFilter,
+	);
+
+	const filteredAttachments = payerAttachments.filter((a) => {
 		if (filter === "images") return a.mimeType.startsWith("image/");
 		if (filter === "pdfs") return a.mimeType === "application/pdf";
 		return true;
 	});

-	const imageCount = attachments.filter((a) =>
+	const imageCount = payerAttachments.filter((a) =>
 		a.mimeType.startsWith("image/"),
 	).length;
-	const pdfCount = attachments.filter(
+	const pdfCount = payerAttachments.filter(
 		(a) => a.mimeType === "application/pdf",
 	).length;

 	const counts: Record<FilterType, number> = {
-		all: attachments.length,
+		all: payerAttachments.length,
 		images: imageCount,
 		pdfs: pdfCount,
 	};
@@ -161,36 +201,98 @@ export function AttachmentsPage({ attachments }: AttachmentsPageProps) {
 									{filter !== "all" &&
 										` · ${FILTERS.find((f) => f.value === filter)?.label.toLowerCase()}`}
 								</p>
-								<div className="flex items-center gap-1 rounded-lg border p-1">
-									{FILTERS.map(({ value, label, icon }) => (
-										<button
-											key={value}
-											type="button"
-											onClick={() => {
-												setFilter(value);
-												setSelectedIndex(-1);
-											}}
-											className={cn(
-												"flex items-center gap-1.5 rounded-md px-2.5 py-1 text-xs font-medium transition-colors",
-												filter === value
-													? "bg-primary text-primary-foreground [&_svg]:opacity-100"
-													: "text-muted-foreground hover:text-foreground",
-											)}
+								<div className="flex w-full flex-wrap items-center justify-end gap-2 sm:w-auto">
+									<Select
+										value={payerFilter}
+										onValueChange={(value) => {
+											setPayerFilter(value);
+											setSelectedIndex(-1);
+										}}
+									>
+										<SelectTrigger
+											size="sm"
+											className="min-w-44 flex-1 sm:flex-none"
 										>
-											<span className={cn(filter !== value && "opacity-60")}>
-												{icon}
-											</span>
-											{label}{" "}
-											<span
+											<SelectValue placeholder="Pessoa">
+												{payerFilter === ALL_PAYERS ? (
+													<span className="flex items-center gap-2">
+														<RiUserLine className="size-4" />
+														Todas as pessoas
+													</span>
+												) : selectedPayer ? (
+													<span className="flex items-center gap-1.5">
+														<PayerSelectContent
+															label={selectedPayer.label}
+															avatarUrl={selectedPayer.avatarUrl}
+														/>
+														{selectedPayer.value === adminPayerId && (
+															<RiVerifiedBadgeFill
+																className="size-4 text-blue-500"
+																aria-label="Pessoa principal"
+															/>
+														)}
+													</span>
+												) : null}
+											</SelectValue>
+										</SelectTrigger>
+										<SelectContent align="end">
+											<SelectItem value={ALL_PAYERS}>
+												<span className="flex items-center gap-2">
+													<span className="flex size-6 items-center justify-center rounded-full bg-muted">
+														<RiUserLine className="size-3.5" />
+													</span>
+													Todas as pessoas
+												</span>
+											</SelectItem>
+											{payerOptions.map((option) => (
+												<SelectItem key={option.value} value={option.value}>
+													<span className="flex items-center gap-1.5">
+														<PayerSelectContent
+															label={option.label}
+															avatarUrl={option.avatarUrl}
+														/>
+														{option.value === adminPayerId && (
+															<RiVerifiedBadgeFill
+																className="size-4 text-blue-500"
+																aria-label="Pessoa principal"
+															/>
+														)}
+													</span>
+												</SelectItem>
+											))}
+										</SelectContent>
+									</Select>
+									<div className="flex items-center gap-1 rounded-lg border p-1">
+										{FILTERS.map(({ value, label, icon }) => (
+											<button
+												key={value}
+												type="button"
+												onClick={() => {
+													setFilter(value);
+													setSelectedIndex(-1);
+												}}
 												className={cn(
-													"tabular-nums",
-													filter === value ? "opacity-80" : "opacity-60",
+													"flex items-center gap-1.5 rounded-md px-2.5 py-1 text-xs font-medium transition-colors",
+													filter === value
+														? "bg-primary text-primary-foreground [&_svg]:opacity-100"
+														: "text-muted-foreground hover:text-foreground",
 												)}
 											>
-												({counts[value]})
-											</span>
-										</button>
-									))}
+												<span className={cn(filter !== value && "opacity-60")}>
+													{icon}
+												</span>
+												{label}{" "}
+												<span
+													className={cn(
+														"tabular-nums",
+														filter === value ? "opacity-80" : "opacity-60",
+													)}
+												>
+													({counts[value]})
+												</span>
+											</button>
+										))}
+									</div>
 								</div>
 							</div>

@@ -199,7 +301,11 @@ export function AttachmentsPage({ attachments }: AttachmentsPageProps) {
 									<EmptyState
 										media={<RiAttachmentLine className="size-6 text-primary" />}
 										title="Nenhum anexo encontrado"
-										description="Não há anexos do tipo selecionado neste mês."
+										description={
+											payerAttachments.length === 0
+												? "Não há anexos desta pessoa neste mês."
+												: "Não há anexos do tipo selecionado neste mês."
+										}
 									/>
 								</div>
 							) : (
--- a/src/features/attachments/queries.ts
+++ b/src/features/attachments/queries.ts
@@ -3,6 +3,7 @@ import { cacheLife, cacheTag } from "next/cache";
 import {
 	attachments,
 	categories,
+	payers,
 	transactionAttachments,
 	transactions,
 } from "@/db/schema";
@@ -21,11 +22,20 @@ export type AttachmentForPeriod = {
 	purchaseDate: Date;
 	categoryName: string | null;
 	categoryIcon: string | null;
+	payerId: string;
+	payerName: string;
+	payerAvatarUrl: string | null;
+};
+
+export type AttachmentsPageData = {
+	attachments: AttachmentForPeriod[];
+	adminPayerId: string;
 };

 export async function fetchAttachmentsForPeriod(
 	userId: string,
 	period: string,
+	payerScope?: string | "all",
 ): Promise<AttachmentForPeriod[]> {
 	"use cache";
 	cacheTag(`dashboard-${userId}`);
@@ -33,8 +43,9 @@ export async function fetchAttachmentsForPeriod(

 	const adminPayerId = await getAdminPayerId(userId);
 	if (!adminPayerId) return [];
+	const payerId = payerScope ?? adminPayerId;

-	return db
+	const rows = await db
 		.select({
 			attachmentId: attachments.id,
 			fileName: attachments.fileName,
@@ -47,6 +58,9 @@ export async function fetchAttachmentsForPeriod(
 			purchaseDate: transactions.purchaseDate,
 			categoryName: categories.name,
 			categoryIcon: categories.icon,
+			payerId: payers.id,
+			payerName: payers.name,
+			payerAvatarUrl: payers.avatarUrl,
 		})
 		.from(transactionAttachments)
 		.innerJoin(
@@ -61,10 +75,32 @@ export async function fetchAttachmentsForPeriod(
 			and(
 				eq(transactionAttachments.transactionId, transactions.id),
 				eq(transactions.userId, userId),
-				eq(transactions.payerId, adminPayerId),
 				eq(transactions.period, period),
+				payerId === "all" ? undefined : eq(transactions.payerId, payerId),
+			),
+		)
+		.innerJoin(
+			payers,
+			and(eq(transactions.payerId, payers.id), eq(payers.userId, userId)),
+		)
+		.leftJoin(
+			categories,
+			and(
+				eq(transactions.categoryId, categories.id),
+				eq(categories.userId, userId),
 			),
 		)
-		.leftJoin(categories, eq(transactions.categoryId, categories.id))
 		.orderBy(desc(transactions.purchaseDate), desc(attachments.id));
+
+	return rows;
+}
+
+export async function fetchAttachmentsPageData(
+	userId: string,
+	period: string,
+): Promise<AttachmentsPageData | null> {
+	const adminPayerId = await getAdminPayerId(userId);
+	if (!adminPayerId) return null;
+	const rows = await fetchAttachmentsForPeriod(userId, period, "all");
+	return { attachments: rows, adminPayerId };
 }
--- a/src/features/dashboard/components/widgets/category-trends-widget.tsx
+++ b/src/features/dashboard/components/widgets/category-trends-widget.tsx
@@ -6,6 +6,7 @@ import {
 	RiHistoryLine,
 	RiLineChartLine,
 } from "@remixicon/react";
+import Link from "next/link";
 import type { DashboardCategoryBreakdownItem } from "@/features/dashboard/categories/category-breakdown-helpers";
 import { dashboardWidgetListStyles as styles } from "@/features/dashboard/components/dashboard-widget-list-styles";
 import { PercentageChangeIndicator } from "@/features/dashboard/components/percentage-change-indicator";
@@ -13,14 +14,18 @@ import { CategoryIconBadge } from "@/shared/components/entity-avatar";
 import MoneyValues from "@/shared/components/money-values";
 import { WidgetEmptyState } from "@/shared/components/widgets/widget-empty-state";
 import { formatPercentage } from "@/shared/utils/percentage";
+import { formatPeriodForUrl } from "@/shared/utils/period";

 type CategoryTrendsWidgetProps = {
 	categories: DashboardCategoryBreakdownItem[];
+	period: string;
 };

 export function CategoryTrendsWidget({
 	categories,
+	period,
 }: CategoryTrendsWidgetProps) {
+	const periodParam = formatPeriodForUrl(period);
 	const trending = categories
 		.filter((c) => c.percentageChange !== null && c.previousAmount > 0)
 		.sort(
@@ -53,7 +58,12 @@ export function CategoryTrendsWidget({
 								size="md"
 							/>
 							<div className={styles.textStack}>
-								<p className={styles.title}>{category.categoryName}</p>
+								<Link
+									href={`/categories/${category.categoryId}?periodo=${periodParam}`}
+									className={styles.titleLink}
+								>
+									<span className="truncate">{category.categoryName}</span>
+								</Link>
 								<p className={styles.meta}>
 									<span
 										className="inline-flex items-center gap-1"
--- a/src/features/dashboard/notes/notes-mappers.ts
+++ b/src/features/dashboard/notes/notes-mappers.ts
@@ -9,6 +9,7 @@ const mapDashboardNoteToNote = (note: DashboardNote): Note => ({
 	tasks: note.tasks,
 	archived: note.archived,
 	createdAt: note.createdAt,
+	attachments: [],
 });

 export const mapDashboardNotesToNotes = (notes: DashboardNote[]) =>
--- a/src/features/dashboard/widget-registry/widget-config.tsx
+++ b/src/features/dashboard/widget-registry/widget-config.tsx
@@ -174,9 +174,10 @@ export const widgetsConfig: WidgetConfig[] = [
 		title: "Tendências de categorias",
 		subtitle: "Top 10 maiores variações vs. mês anterior",
 		icon: <RiLineChartLine className="size-4" />,
-		component: ({ data }) => (
+		component: ({ data, period }) => (
 			<CategoryTrendsWidget
 				categories={data.expensesByCategoryData.categories}
+				period={period}
 			/>
 		),
 	},
--- a/src/features/notes/actions.ts
+++ b/src/features/notes/actions.ts
@@ -1,8 +1,8 @@
 "use server";

-import { and, eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { z } from "zod";
-import { notes } from "@/db/schema";
+import { attachments, noteAttachments, notes } from "@/db/schema";
 import {
 	handleActionError,
 	revalidateForEntity,
@@ -10,6 +10,7 @@ import {
 import { getUser } from "@/shared/lib/auth/server";
 import { db } from "@/shared/lib/db";
 import { uuidSchema } from "@/shared/lib/schemas/common";
+import { deleteS3Object } from "@/shared/lib/storage/presign";
 import type { ActionResult } from "@/shared/lib/types/actions";

 const taskSchema = z.object({
@@ -70,25 +71,42 @@ type NoteDeleteInput = z.infer<typeof deleteNoteSchema>;

 export async function createNoteAction(
 	input: NoteCreateInput,
-): Promise<ActionResult> {
+): Promise<ActionResult<{ noteId: string }>> {
 	try {
 		const user = await getUser();
 		const data = createNoteSchema.parse(input);

-		await db.insert(notes).values({
-			title: data.title,
-			description: data.description,
-			type: data.type,
-			tasks:
-				data.tasks && data.tasks.length > 0 ? JSON.stringify(data.tasks) : null,
-			userId: user.id,
-		});
+		const [created] = await db
+			.insert(notes)
+			.values({
+				title: data.title,
+				description: data.description,
+				type: data.type,
+				tasks:
+					data.tasks && data.tasks.length > 0
+						? JSON.stringify(data.tasks)
+						: null,
+				userId: user.id,
+			})
+			.returning({ id: notes.id });
+
+		if (!created) {
+			return { success: false, error: "Não foi possível criar a anotação." };
+		}

 		revalidateForEntity("notes", user.id);

-		return { success: true, message: "Anotação criada com sucesso." };
+		return {
+			success: true,
+			message: "Anotação criada com sucesso.",
+			data: { noteId: created.id },
+		};
 	} catch (error) {
-		return handleActionError(error);
+		const result = handleActionError(error);
+		return {
+			success: false,
+			error: result.success ? "Ocorreu um erro inesperado." : result.error,
+		};
 	}
 }

@@ -135,6 +153,25 @@ export async function deleteNoteAction(
 		const user = await getUser();
 		const data = deleteNoteSchema.parse(input);

+		const linkedAttachments = await db
+			.select({ id: attachments.id, fileKey: attachments.fileKey })
+			.from(noteAttachments)
+			.innerJoin(
+				attachments,
+				and(
+					eq(noteAttachments.attachmentId, attachments.id),
+					eq(attachments.userId, user.id),
+				),
+			)
+			.innerJoin(
+				notes,
+				and(
+					eq(noteAttachments.noteId, notes.id),
+					eq(notes.id, data.id),
+					eq(notes.userId, user.id),
+				),
+			);
+
 		const [deleted] = await db
 			.delete(notes)
 			.where(and(eq(notes.id, data.id), eq(notes.userId, user.id)))
@@ -147,6 +184,23 @@ export async function deleteNoteAction(
 			};
 		}

+		if (linkedAttachments.length > 0) {
+			await Promise.all(
+				linkedAttachments.map((attachment) =>
+					deleteS3Object(attachment.fileKey),
+				),
+			);
+			await db.delete(attachments).where(
+				and(
+					eq(attachments.userId, user.id),
+					inArray(
+						attachments.id,
+						linkedAttachments.map((attachment) => attachment.id),
+					),
+				),
+			);
+		}
+
 		revalidateForEntity("notes", user.id);

 		return { success: true, message: "Anotação removida com sucesso." };
--- a/src/features/notes/actions/attachments.ts
+++ b/src/features/notes/actions/attachments.ts
@@ -0,0 +1,279 @@
+"use server";
+
+import crypto, { randomUUID } from "node:crypto";
+import { and, eq } from "drizzle-orm";
+import { z } from "zod/v4";
+import {
+	attachments,
+	noteAttachments,
+	notes,
+	userPreferences,
+} from "@/db/schema";
+import {
+	handleActionError,
+	revalidateForEntity,
+} from "@/shared/lib/actions/helpers";
+import {
+	ALLOWED_MIME_TYPES,
+	ATTACHMENT_SIZE_OPTIONS,
+} from "@/shared/lib/attachments/config";
+import { getUser } from "@/shared/lib/auth/server";
+import { db } from "@/shared/lib/db";
+import {
+	createPresignedPutUrl,
+	deleteS3Object,
+	headS3Object,
+} from "@/shared/lib/storage/presign";
+import type { ActionResult } from "@/shared/lib/types/actions";
+
+const UPLOAD_TOKEN_EXPIRY_SECONDS = 10 * 60;
+const MAX_NOTE_FILE_SIZE = Math.max(...ATTACHMENT_SIZE_OPTIONS) * 1024 * 1024;
+
+const presignSchema = z.object({
+	noteId: z.string().uuid(),
+	fileName: z.string().min(1).max(255),
+	mimeType: z.enum(ALLOWED_MIME_TYPES),
+	fileSize: z.number().positive().max(MAX_NOTE_FILE_SIZE),
+});
+
+const tokenPayloadSchema = presignSchema.extend({
+	userId: z.string().min(1),
+	fileKey: z.string().min(1),
+	exp: z.number().int(),
+});
+
+type UploadTokenPayload = z.infer<typeof tokenPayloadSchema>;
+
+type PresignResult =
+	| { success: true; presignedUrl: string; uploadToken: string }
+	| { success: false; error: string };
+
+export type NoteAttachmentData = {
+	attachmentId: string;
+	fileName: string;
+	fileSize: number;
+	mimeType: string;
+};
+
+function getUploadTokenSecret(): string {
+	const secret = process.env.BETTER_AUTH_SECRET;
+	if (!secret) throw new Error("BETTER_AUTH_SECRET is required.");
+	return secret;
+}
+
+function encode(value: string): string {
+	return Buffer.from(value).toString("base64url");
+}
+
+function signUploadToken(payload: UploadTokenPayload): string {
+	const encoded = encode(JSON.stringify(payload));
+	const signature = crypto
+		.createHmac("sha256", getUploadTokenSecret())
+		.update(encoded)
+		.digest("base64url");
+	return `${encoded}.${signature}`;
+}
+
+function verifyUploadToken(token: string): UploadTokenPayload | null {
+	try {
+		const [encoded, signature] = token.split(".");
+		if (!encoded || !signature) return null;
+		const expected = crypto
+			.createHmac("sha256", getUploadTokenSecret())
+			.update(encoded)
+			.digest("base64url");
+		if (
+			signature.length !== expected.length ||
+			!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
+		) {
+			return null;
+		}
+		const parsed = tokenPayloadSchema.safeParse(
+			JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")),
+		);
+		if (!parsed.success || parsed.data.exp < Math.floor(Date.now() / 1000)) {
+			return null;
+		}
+		if (!parsed.data.fileKey.startsWith(`${parsed.data.userId}/`)) return null;
+		return parsed.data;
+	} catch {
+		return null;
+	}
+}
+
+async function findOwnedNote(noteId: string, userId: string) {
+	const [note] = await db
+		.select({ id: notes.id, type: notes.type })
+		.from(notes)
+		.where(and(eq(notes.id, noteId), eq(notes.userId, userId)));
+	return note?.type === "nota" ? note : null;
+}
+
+async function getAttachmentLimitBytes(userId: string): Promise<number> {
+	const [preferences] = await db
+		.select({ maxSizeMb: userPreferences.attachmentMaxSizeMb })
+		.from(userPreferences)
+		.where(eq(userPreferences.userId, userId));
+	return (preferences?.maxSizeMb ?? 50) * 1024 * 1024;
+}
+
+export async function getPresignedNoteAttachmentUploadUrlAction(input: {
+	noteId: string;
+	fileName: string;
+	mimeType: string;
+	fileSize: number;
+}): Promise<PresignResult> {
+	try {
+		const user = await getUser();
+		const data = presignSchema.parse(input);
+		if (data.fileSize > (await getAttachmentLimitBytes(user.id))) {
+			return {
+				success: false,
+				error: "O arquivo excede o limite configurado para anexos.",
+			};
+		}
+		if (!(await findOwnedNote(data.noteId, user.id))) {
+			return { success: false, error: "Nota não encontrada." };
+		}
+
+		const extensions: Record<(typeof ALLOWED_MIME_TYPES)[number], string> = {
+			"application/pdf": "pdf",
+			"image/jpeg": "jpg",
+			"image/png": "png",
+			"image/webp": "webp",
+		};
+		const extension = extensions[data.mimeType];
+		const fileKey = `${user.id}/${randomUUID()}.${extension}`;
+		const presignedUrl = await createPresignedPutUrl(fileKey, data.mimeType);
+		const uploadToken = signUploadToken({
+			...data,
+			userId: user.id,
+			fileKey,
+			exp: Math.floor(Date.now() / 1000) + UPLOAD_TOKEN_EXPIRY_SECONDS,
+		});
+		return { success: true, presignedUrl, uploadToken };
+	} catch (error) {
+		const result = handleActionError(error);
+		return {
+			success: false,
+			error: result.success ? "Algo deu errado." : result.error,
+		};
+	}
+}
+
+export async function confirmNoteAttachmentUploadAction(input: {
+	uploadToken: string;
+}): Promise<ActionResult<NoteAttachmentData>> {
+	try {
+		const user = await getUser();
+		const payload = verifyUploadToken(input.uploadToken);
+		if (!payload || payload.userId !== user.id) {
+			return { success: false, error: "Upload de anexo inválido ou expirado." };
+		}
+		if (!(await findOwnedNote(payload.noteId, user.id))) {
+			return { success: false, error: "Nota não encontrada." };
+		}
+
+		const metadata = await headS3Object(payload.fileKey);
+		if (
+			!metadata.contentLength ||
+			metadata.contentLength !== payload.fileSize ||
+			metadata.contentLength > MAX_NOTE_FILE_SIZE ||
+			metadata.contentType !== payload.mimeType
+		) {
+			return {
+				success: false,
+				error: "O arquivo enviado não confere com o upload autorizado.",
+			};
+		}
+
+		const [attachment] = await db
+			.insert(attachments)
+			.values({
+				userId: user.id,
+				fileKey: payload.fileKey,
+				fileName: payload.fileName,
+				fileSize: payload.fileSize,
+				mimeType: payload.mimeType,
+			})
+			.returning({ id: attachments.id });
+		if (!attachment)
+			return { success: false, error: "Não foi possível salvar o anexo." };
+
+		await db.insert(noteAttachments).values({
+			noteId: payload.noteId,
+			attachmentId: attachment.id,
+		});
+		revalidateForEntity("notes", user.id);
+		return {
+			success: true,
+			message: "Anexo enviado.",
+			data: {
+				attachmentId: attachment.id,
+				fileName: payload.fileName,
+				fileSize: payload.fileSize,
+				mimeType: payload.mimeType,
+			},
+		};
+	} catch (error) {
+		const result = handleActionError(error);
+		return {
+			success: false,
+			error: result.success ? "Ocorreu um erro inesperado." : result.error,
+		};
+	}
+}
+
+export async function removeNoteAttachmentAction(input: {
+	noteId: string;
+	attachmentId: string;
+}): Promise<ActionResult> {
+	try {
+		const user = await getUser();
+		const data = z
+			.object({ noteId: z.string().uuid(), attachmentId: z.string().uuid() })
+			.parse(input);
+		if (!(await findOwnedNote(data.noteId, user.id))) {
+			return { success: false, error: "Nota não encontrada." };
+		}
+		const [attachment] = await db
+			.select({ fileKey: attachments.fileKey })
+			.from(noteAttachments)
+			.innerJoin(
+				attachments,
+				and(
+					eq(noteAttachments.attachmentId, attachments.id),
+					eq(attachments.userId, user.id),
+				),
+			)
+			.where(
+				and(
+					eq(noteAttachments.noteId, data.noteId),
+					eq(noteAttachments.attachmentId, data.attachmentId),
+				),
+			);
+		if (!attachment) return { success: false, error: "Anexo não encontrado." };
+
+		await db
+			.delete(noteAttachments)
+			.where(
+				and(
+					eq(noteAttachments.noteId, data.noteId),
+					eq(noteAttachments.attachmentId, data.attachmentId),
+				),
+			);
+		await deleteS3Object(attachment.fileKey);
+		await db
+			.delete(attachments)
+			.where(
+				and(
+					eq(attachments.id, data.attachmentId),
+					eq(attachments.userId, user.id),
+				),
+			);
+		revalidateForEntity("notes", user.id);
+		return { success: true, message: "Anexo removido." };
+	} catch (error) {
+		return handleActionError(error);
+	}
+}
--- a/src/features/notes/components/note-attachments-field.tsx
+++ b/src/features/notes/components/note-attachments-field.tsx
@@ -0,0 +1,345 @@
+"use client";
+
+import {
+	RiAttachment2,
+	RiCloseLine,
+	RiDeleteBinLine,
+	RiDownloadLine,
+	RiFileImageLine,
+	RiFilePdf2Line,
+} from "@remixicon/react";
+import { useRef, useState } from "react";
+import { toast } from "sonner";
+import {
+	confirmNoteAttachmentUploadAction,
+	getPresignedNoteAttachmentUploadUrlAction,
+	removeNoteAttachmentAction,
+} from "@/features/notes/actions/attachments";
+import type { NoteAttachment } from "@/features/notes/components/types";
+import { Button } from "@/shared/components/ui/button";
+import {
+	Dialog,
+	DialogClose,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "@/shared/components/ui/dialog";
+import {
+	ALLOWED_MIME_TYPES,
+	DEFAULT_MAX_FILE_SIZE_MB,
+} from "@/shared/lib/attachments/config";
+
+type UploadResult =
+	| { success: true; attachment: NoteAttachment }
+	| { success: false; error: string };
+
+export async function uploadNoteAttachment(
+	noteId: string,
+	file: File,
+): Promise<UploadResult> {
+	try {
+		const presign = await getPresignedNoteAttachmentUploadUrlAction({
+			noteId,
+			fileName: file.name,
+			fileSize: file.size,
+			mimeType: file.type,
+		});
+		if (!presign.success) return presign;
+
+		const uploaded = await fetch(presign.presignedUrl, {
+			method: "PUT",
+			body: file,
+			headers: { "Content-Type": file.type },
+		});
+		if (!uploaded.ok) {
+			return { success: false, error: "Não foi possível enviar o arquivo." };
+		}
+
+		const confirmed = await confirmNoteAttachmentUploadAction({
+			uploadToken: presign.uploadToken,
+		});
+		if (!confirmed.success || !confirmed.data) {
+			return {
+				success: false,
+				error: confirmed.success
+					? "Não foi possível salvar o anexo."
+					: confirmed.error,
+			};
+		}
+		return { success: true, attachment: confirmed.data };
+	} catch {
+		return {
+			success: false,
+			error: "Não foi possível enviar o arquivo agora.",
+		};
+	}
+}
+
+function formatBytes(bytes: number): string {
+	if (bytes < 1024) return `${bytes} B`;
+	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+	return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+function validateFile(file: File, maxSizeMb: number): string | null {
+	if (
+		!ALLOWED_MIME_TYPES.includes(
+			file.type as (typeof ALLOWED_MIME_TYPES)[number],
+		)
+	) {
+		return "Tipo não suportado. Use PDF, JPEG, PNG ou WebP.";
+	}
+	if (file.size > maxSizeMb * 1024 * 1024) {
+		return `O arquivo deve ter no máximo ${maxSizeMb}MB.`;
+	}
+	return null;
+}
+
+interface NoteAttachmentsFieldProps {
+	noteId?: string;
+	attachments: NoteAttachment[];
+	pendingFiles: File[];
+	onAttachmentsChange: (attachments: NoteAttachment[]) => void;
+	onPendingFilesChange: (files: File[]) => void;
+	onBusyChange?: (busy: boolean) => void;
+	maxSizeMb?: number;
+	disabled?: boolean;
+	readonly?: boolean;
+}
+
+export function NoteAttachmentsField({
+	noteId,
+	attachments,
+	pendingFiles,
+	onAttachmentsChange,
+	onPendingFilesChange,
+	onBusyChange,
+	maxSizeMb = DEFAULT_MAX_FILE_SIZE_MB,
+	disabled = false,
+	readonly = false,
+}: NoteAttachmentsFieldProps) {
+	const inputRef = useRef<HTMLInputElement>(null);
+	const [uploading, setUploading] = useState(false);
+	const [removing, setRemoving] = useState<NoteAttachment | null>(null);
+	const [isRemoving, setIsRemoving] = useState(false);
+	const [openingId, setOpeningId] = useState<string | null>(null);
+
+	async function addFiles(files: File[]) {
+		const valid: File[] = [];
+		for (const file of files) {
+			const error = validateFile(file, maxSizeMb);
+			if (error) toast.error(`${file.name}: ${error}`);
+			else valid.push(file);
+		}
+		if (valid.length === 0) return;
+
+		if (!noteId) {
+			onPendingFilesChange([...pendingFiles, ...valid]);
+			return;
+		}
+
+		setUploading(true);
+		onBusyChange?.(true);
+		const added: NoteAttachment[] = [];
+		for (const file of valid) {
+			const result = await uploadNoteAttachment(noteId, file);
+			if (result.success) added.push(result.attachment);
+			else toast.error(`${file.name}: ${result.error}`);
+		}
+		setUploading(false);
+		onBusyChange?.(false);
+		if (added.length > 0) {
+			onAttachmentsChange([...attachments, ...added]);
+			toast.success(
+				added.length === 1
+					? "Anexo enviado."
+					: `${added.length} anexos enviados.`,
+			);
+		}
+	}
+
+	async function downloadAttachment(attachment: NoteAttachment) {
+		setOpeningId(attachment.attachmentId);
+		try {
+			const response = await fetch(
+				`/api/attachments/${attachment.attachmentId}/presign`,
+			);
+			if (!response.ok) throw new Error();
+			const { url } = (await response.json()) as { url: string };
+			const anchor = document.createElement("a");
+			anchor.href = url;
+			anchor.download = attachment.fileName;
+			anchor.target = "_blank";
+			anchor.rel = "noreferrer";
+			anchor.click();
+		} catch {
+			toast.error("Não foi possível baixar o anexo agora.");
+		} finally {
+			setOpeningId(null);
+		}
+	}
+
+	async function confirmRemove() {
+		if (!noteId || !removing) return;
+		setIsRemoving(true);
+		onBusyChange?.(true);
+		const result = await removeNoteAttachmentAction({
+			noteId,
+			attachmentId: removing.attachmentId,
+		});
+		setIsRemoving(false);
+		onBusyChange?.(false);
+		if (result.success) {
+			onAttachmentsChange(
+				attachments.filter(
+					(item) => item.attachmentId !== removing.attachmentId,
+				),
+			);
+			setRemoving(null);
+			toast.success(result.message);
+		} else {
+			toast.error(result.error);
+		}
+	}
+
+	return (
+		<div className="space-y-1.5">
+			<p className="text-xs font-medium">Anexos</p>
+			<input
+				ref={inputRef}
+				type="file"
+				multiple
+				className="hidden"
+				accept={ALLOWED_MIME_TYPES.join(",")}
+				onChange={(event) => {
+					void addFiles(Array.from(event.target.files ?? []));
+					event.target.value = "";
+				}}
+			/>
+
+			{attachments.length > 0 && (
+				<div className="space-y-1.5">
+					{attachments.map((attachment) => (
+						<div
+							key={attachment.attachmentId}
+							className="flex min-w-0 items-center gap-2 rounded-md border px-3 py-2 text-sm"
+						>
+							{attachment.mimeType === "application/pdf" ? (
+								<RiFilePdf2Line className="size-4 shrink-0 text-red-500" />
+							) : (
+								<RiFileImageLine className="size-4 shrink-0 text-blue-500" />
+							)}
+							<div className="min-w-0 flex-1">
+								<p className="truncate font-medium" title={attachment.fileName}>
+									{attachment.fileName}
+								</p>
+								<p className="text-xs text-muted-foreground">
+									{formatBytes(attachment.fileSize)}
+								</p>
+							</div>
+							<Button
+								type="button"
+								variant="ghost"
+								size="icon"
+								className="size-7 shrink-0"
+								disabled={openingId === attachment.attachmentId}
+								onClick={() => void downloadAttachment(attachment)}
+								aria-label={`Baixar ${attachment.fileName}`}
+							>
+								<RiDownloadLine className="size-4" />
+							</Button>
+							{!readonly && (
+								<Button
+									type="button"
+									variant="ghost"
+									size="icon"
+									className="size-7 shrink-0 text-destructive hover:text-destructive"
+									disabled={disabled}
+									onClick={() => setRemoving(attachment)}
+									aria-label={`Remover ${attachment.fileName}`}
+								>
+									<RiDeleteBinLine className="size-4" />
+								</Button>
+							)}
+						</div>
+					))}
+				</div>
+			)}
+
+			{pendingFiles.map((file, index) => (
+				<div
+					key={`${file.name}-${file.size}-${file.lastModified}-${index}`}
+					className="flex min-w-0 items-center gap-2 rounded-md border border-dashed px-3 py-2 text-sm"
+				>
+					<RiAttachment2 className="size-4 shrink-0 text-muted-foreground" />
+					<div className="min-w-0 flex-1">
+						<p className="truncate font-medium">{file.name}</p>
+						<p className="text-xs text-muted-foreground">
+							Será enviado ao salvar
+						</p>
+					</div>
+					<Button
+						type="button"
+						variant="ghost"
+						size="icon"
+						className="size-7 shrink-0"
+						onClick={() =>
+							onPendingFilesChange(
+								pendingFiles.filter((_, fileIndex) => fileIndex !== index),
+							)
+						}
+						aria-label={`Cancelar ${file.name}`}
+					>
+						<RiCloseLine className="size-4" />
+					</Button>
+				</div>
+			))}
+
+			{!readonly && (
+				<button
+					type="button"
+					className="flex min-h-16 w-full items-center justify-center gap-2 rounded-md border border-dashed px-3 text-sm text-muted-foreground transition-colors hover:border-foreground/40 hover:text-foreground disabled:pointer-events-none disabled:opacity-50"
+					onClick={() => inputRef.current?.click()}
+					disabled={disabled || uploading}
+				>
+					<RiAttachment2 className="size-4" />
+					<span>{uploading ? "Enviando..." : "Adicionar anexos"}</span>
+					<span className="hidden text-xs sm:inline">
+						PDF ou imagem · máx. {maxSizeMb} MB
+					</span>
+				</button>
+			)}
+
+			<Dialog
+				open={Boolean(removing)}
+				onOpenChange={(open) => !open && setRemoving(null)}
+			>
+				<DialogContent className="sm:max-w-sm">
+					<DialogHeader>
+						<DialogTitle>Remover anexo?</DialogTitle>
+						<DialogDescription>
+							O arquivo {removing?.fileName} será removido desta nota.
+						</DialogDescription>
+					</DialogHeader>
+					<DialogFooter>
+						<DialogClose asChild>
+							<Button type="button" variant="outline" disabled={isRemoving}>
+								Cancelar
+							</Button>
+						</DialogClose>
+						<Button
+							type="button"
+							variant="destructive"
+							disabled={isRemoving}
+							onClick={() => void confirmRemove()}
+						>
+							{isRemoving ? "Removendo..." : "Remover"}
+						</Button>
+					</DialogFooter>
+				</DialogContent>
+			</Dialog>
+		</div>
+	);
+}
--- a/src/features/notes/components/note-card.tsx
+++ b/src/features/notes/components/note-card.tsx
@@ -2,6 +2,7 @@

 import {
 	RiArchiveLine,
+	RiAttachment2,
 	RiCheckLine,
 	RiDeleteBin5Line,
 	RiFileList2Line,
@@ -87,11 +88,19 @@ export function NoteCard({
 							</span>
 						)}
 					</div>
-					{isTask && (
-						<Badge variant="outline" className="shrink-0 text-xs">
-							{completedCount}/{totalCount} concluídas
-						</Badge>
-					)}
+					<div className="flex shrink-0 flex-col items-end gap-1.5">
+						{isTask && (
+							<Badge variant="outline" className="shrink-0 text-xs">
+								{completedCount}/{totalCount} concluídas
+							</Badge>
+						)}
+						{!isTask && note.attachments.length > 0 && (
+							<Badge variant="outline" className="gap-1 text-xs">
+								<RiAttachment2 className="size-3.5" />
+								{note.attachments.length}
+							</Badge>
+						)}
+					</div>
 				</div>

 				{isTask ? (
--- a/src/features/notes/components/note-details-dialog.tsx
+++ b/src/features/notes/components/note-details-dialog.tsx
@@ -1,6 +1,7 @@
 "use client";

 import { RiCheckLine, RiSubtractLine } from "@remixicon/react";
+import { NoteAttachmentsField } from "@/features/notes/components/note-attachments-field";
 import {
 	buildNoteDisplayTitle,
 	formatNoteCreatedAtLong,
@@ -85,8 +86,20 @@ export function NoteDetailsDialog({
 						))}
 					</div>
 				) : (
-					<div className="max-h-[320px] overflow-auto whitespace-pre-line wrap-break-word text-sm text-foreground">
-						{note.description}
+					<div className="max-h-[55vh] space-y-4 overflow-auto">
+						<div className="whitespace-pre-line wrap-break-word text-sm text-foreground">
+							{note.description}
+						</div>
+						{note.attachments.length > 0 && (
+							<NoteAttachmentsField
+								noteId={note.id}
+								attachments={note.attachments}
+								pendingFiles={[]}
+								onAttachmentsChange={() => undefined}
+								onPendingFilesChange={() => undefined}
+								readonly
+							/>
+						)}
 					</div>
 				)}

--- a/src/features/notes/components/note-dialog.tsx
+++ b/src/features/notes/components/note-dialog.tsx
@@ -15,6 +15,10 @@ import {
 } from "react";
 import { toast } from "sonner";
 import { createNoteAction, updateNoteAction } from "@/features/notes/actions";
+import {
+	NoteAttachmentsField,
+	uploadNoteAttachment,
+} from "@/features/notes/components/note-attachments-field";
 import { Button } from "@/shared/components/ui/button";
 import { Checkbox } from "@/shared/components/ui/checkbox";
 import {
@@ -34,6 +38,7 @@ import { useFormState } from "@/shared/hooks/use-form-state";
 import { cn } from "@/shared/utils/ui";
 import {
 	type Note,
+	type NoteAttachment,
 	type NoteFormValues,
 	sortTasksByStatus,
 	type Task,
@@ -46,6 +51,7 @@ interface NoteDialogProps {
 	note?: Note;
 	open?: boolean;
 	onOpenChange?: (open: boolean) => void;
+	attachmentMaxSizeMb?: number;
 }

 const MAX_TITLE = 30;
@@ -69,12 +75,16 @@ export function NoteDialog({
 	note,
 	open,
 	onOpenChange,
+	attachmentMaxSizeMb,
 }: NoteDialogProps) {
 	const [isPending, startTransition] = useTransition();
 	const [errorMessage, setErrorMessage] = useState<string | null>(null);
 	const [newTaskText, setNewTaskText] = useState("");
 	const [editingTaskId, setEditingTaskId] = useState<string | null>(null);
 	const [editingTaskText, setEditingTaskText] = useState("");
+	const [noteAttachments, setNoteAttachments] = useState<NoteAttachment[]>([]);
+	const [pendingFiles, setPendingFiles] = useState<File[]>([]);
+	const [isAttachmentPending, setIsAttachmentPending] = useState(false);

 	const titleRef = useRef<HTMLInputElement>(null);
 	const descRef = useRef<HTMLTextAreaElement>(null);
@@ -99,6 +109,9 @@ export function NoteDialog({
 			setNewTaskText("");
 			setEditingTaskId(null);
 			setEditingTaskText("");
+			setNoteAttachments(note?.attachments ?? []);
+			setPendingFiles([]);
+			setIsAttachmentPending(false);
 			requestAnimationFrame(() => titleRef.current?.focus());
 		}
 	}, [dialogOpen, note, resetForm]);
@@ -137,12 +150,14 @@ export function NoteDialog({

 	const disableSubmit =
 		isPending ||
+		isAttachmentPending ||
 		onlySpaces ||
 		unchanged ||
 		invalidLen ||
 		Boolean(editingTaskId);

 	const handleOpenChange = (v: boolean) => {
+		if (!v && (isPending || isAttachmentPending)) return;
 		setDialogOpen(v);
 		if (!v) setErrorMessage(null);
 	};
@@ -252,7 +267,9 @@ export function NoteDialog({
 		}

 		startTransition(async () => {
-			let result: { success: boolean; message?: string; error?: string };
+			let result:
+				| Awaited<ReturnType<typeof createNoteAction>>
+				| Awaited<ReturnType<typeof updateNoteAction>>;
 			if (mode === "create") {
 				result = await createNoteAction(payload);
 			} else {
@@ -266,7 +283,31 @@ export function NoteDialog({
 			}

 			if (result.success) {
-				toast.success(result.message);
+				if (mode === "create" && pendingFiles.length > 0) {
+					const noteId = "data" in result ? result.data?.noteId : undefined;
+					if (noteId) {
+						let failedUploads = 0;
+						for (const file of pendingFiles) {
+							const upload = await uploadNoteAttachment(noteId, file);
+							if (!upload.success) failedUploads += 1;
+						}
+						if (failedUploads > 0) {
+							toast.warning(
+								failedUploads === 1
+									? "A nota foi salva, mas um anexo não pôde ser enviado."
+									: `A nota foi salva, mas ${failedUploads} anexos não puderam ser enviados.`,
+							);
+						} else {
+							toast.success(
+								pendingFiles.length === 1
+									? "Anotação e anexo salvos."
+									: "Anotação e anexos salvos.",
+							);
+						}
+					}
+				} else {
+					toast.success(result.message);
+				}
 				setDialogOpen(false);
 				return;
 			}
@@ -355,35 +396,48 @@ export function NoteDialog({
 					</div>

 					{isNote && (
-						<div className="space-y-1">
-							<div className="flex items-center justify-between">
-								<Label htmlFor="note-description">Conteúdo</Label>
-								<span
-									className={cn(
-										"text-xs",
-										descCount > MAX_DESC
-											? "text-destructive"
-											: "text-muted-foreground",
-									)}
-								>
-									{descCount}/{MAX_DESC}
-								</span>
+						<div className="space-y-3">
+							<div className="space-y-1">
+								<div className="flex items-center justify-between">
+									<Label htmlFor="note-description">Conteúdo</Label>
+									<span
+										className={cn(
+											"text-xs",
+											descCount > MAX_DESC
+												? "text-destructive"
+												: "text-muted-foreground",
+										)}
+									>
+										{descCount}/{MAX_DESC}
+									</span>
+								</div>
+								<Textarea
+									id="note-description"
+									className="field-sizing-fixed"
+									ref={descRef}
+									value={formState.description}
+									onChange={(e) => updateField("description", e.target.value)}
+									placeholder="Detalhe sua anotação..."
+									rows={5}
+									maxLength={MAX_DESC + 10}
+									disabled={isPending}
+									required
+								/>
+								<p className="text-xs text-muted-foreground">
+									Ctrl+Enter para salvar
+								</p>
 							</div>
-							<Textarea
-								id="note-description"
-								className="field-sizing-fixed"
-								ref={descRef}
-								value={formState.description}
-								onChange={(e) => updateField("description", e.target.value)}
-								placeholder="Detalhe sua anotação..."
-								rows={5}
-								maxLength={MAX_DESC + 10}
+
+							<NoteAttachmentsField
+								noteId={mode === "update" ? note?.id : undefined}
+								attachments={noteAttachments}
+								pendingFiles={pendingFiles}
+								onAttachmentsChange={setNoteAttachments}
+								onPendingFilesChange={setPendingFiles}
+								onBusyChange={setIsAttachmentPending}
+								maxSizeMb={attachmentMaxSizeMb}
 								disabled={isPending}
-								required
 							/>
-							<p className="text-xs text-muted-foreground">
-								Ctrl+Enter para salvar
-							</p>
 						</div>
 					)}

@@ -517,7 +571,7 @@ export function NoteDialog({
 						type="button"
 						variant="outline"
 						onClick={() => handleOpenChange(false)}
-						disabled={isPending}
+						disabled={isPending || isAttachmentPending}
 					>
 						Cancelar
 					</Button>
--- a/src/features/notes/components/notes-page.tsx
+++ b/src/features/notes/components/notes-page.tsx
@@ -22,9 +22,14 @@ import type { Note } from "./types";
 interface NotesPageProps {
 	notes: Note[];
 	archivedNotes: Note[];
+	attachmentMaxSizeMb?: number;
 }

-export function NotesPage({ notes, archivedNotes }: NotesPageProps) {
+export function NotesPage({
+	notes,
+	archivedNotes,
+	attachmentMaxSizeMb,
+}: NotesPageProps) {
 	const [activeTab, setActiveTab] = useState("ativas");
 	const [createOpen, setCreateOpen] = useState(false);
 	const [editOpen, setEditOpen] = useState(false);
@@ -192,6 +197,7 @@ export function NotesPage({ notes, archivedNotes }: NotesPageProps) {
 						mode="create"
 						open={createOpen}
 						onOpenChange={handleCreateOpenChange}
+						attachmentMaxSizeMb={attachmentMaxSizeMb}
 						trigger={
 							<Button className="w-full sm:w-auto">
 								<RiAddFill className="size-4" />
@@ -222,6 +228,7 @@ export function NotesPage({ notes, archivedNotes }: NotesPageProps) {
 				note={noteToEdit ?? undefined}
 				open={editOpen}
 				onOpenChange={handleEditOpenChange}
+				attachmentMaxSizeMb={attachmentMaxSizeMb}
 			/>

 			<NoteDetailsDialog
--- a/src/features/notes/components/types.ts
+++ b/src/features/notes/components/types.ts
@@ -14,6 +14,14 @@ export interface Note {
 	tasks?: Task[];
 	archived: boolean;
 	createdAt: string;
+	attachments: NoteAttachment[];
+}
+
+export interface NoteAttachment {
+	attachmentId: string;
+	fileName: string;
+	fileSize: number;
+	mimeType: string;
 }

 export interface NoteFormValues {
--- a/src/features/notes/queries.ts
+++ b/src/features/notes/queries.ts
@@ -1,7 +1,14 @@
-import { and, eq } from "drizzle-orm";
-import { type Note, notes } from "@/db/schema";
+import { and, desc, eq } from "drizzle-orm";
+import { attachments, type Note, noteAttachments, notes } from "@/db/schema";
 import { db } from "@/shared/lib/db";

+export type NoteAttachmentData = {
+	attachmentId: string;
+	fileName: string;
+	fileSize: number;
+	mimeType: string;
+};
+
 type Task = {
 	id: string;
 	text: string;
@@ -16,6 +23,7 @@ type NoteData = {
 	tasks?: Task[];
 	archived: boolean;
 	createdAt: string;
+	attachments: NoteAttachmentData[];
 };

 function parseTasks(value: string | null): Task[] | undefined {
@@ -31,7 +39,10 @@ function parseTasks(value: string | null): Task[] | undefined {
 	}
 }

-function toNoteData(note: Note): NoteData {
+function toNoteData(
+	note: Note,
+	linkedAttachments: NoteAttachmentData[],
+): NoteData {
 	return {
 		id: note.id,
 		title: (note.title ?? "").trim(),
@@ -40,34 +51,53 @@ function toNoteData(note: Note): NoteData {
 		tasks: parseTasks(note.tasks),
 		archived: note.archived,
 		createdAt: note.createdAt.toISOString(),
+		attachments: linkedAttachments,
 	};
 }

-async function fetchNotesForUser(userId: string): Promise<NoteData[]> {
-	const noteRows = await db.query.notes.findMany({
-		where: and(eq(notes.userId, userId), eq(notes.archived, false)),
-		orderBy: (table, { desc }) => [desc(table.createdAt)],
-	});
-
-	return noteRows.map(toNoteData);
-}
-
 export async function fetchAllNotesForUser(
 	userId: string,
 ): Promise<{ activeNotes: NoteData[]; archivedNotes: NoteData[] }> {
-	const [activeNotes, archivedNotes] = await Promise.all([
-		fetchNotesForUser(userId),
-		fetchArchivedForUser(userId),
+	const [noteRows, attachmentRows] = await Promise.all([
+		db.query.notes.findMany({
+			where: eq(notes.userId, userId),
+			orderBy: (table, { desc }) => [desc(table.createdAt)],
+		}),
+		db
+			.select({
+				noteId: noteAttachments.noteId,
+				attachmentId: attachments.id,
+				fileName: attachments.fileName,
+				fileSize: attachments.fileSize,
+				mimeType: attachments.mimeType,
+			})
+			.from(noteAttachments)
+			.innerJoin(
+				notes,
+				and(eq(noteAttachments.noteId, notes.id), eq(notes.userId, userId)),
+			)
+			.innerJoin(
+				attachments,
+				and(
+					eq(noteAttachments.attachmentId, attachments.id),
+					eq(attachments.userId, userId),
+				),
+			)
+			.orderBy(desc(attachments.createdAt)),
 	]);

-	return { activeNotes, archivedNotes };
-}
+	const attachmentsByNote = new Map<string, NoteAttachmentData[]>();
+	for (const { noteId, ...attachment } of attachmentRows) {
+		const current = attachmentsByNote.get(noteId) ?? [];
+		current.push(attachment);
+		attachmentsByNote.set(noteId, current);
+	}
+	const mapped = noteRows.map((note) =>
+		toNoteData(note, attachmentsByNote.get(note.id) ?? []),
+	);

-async function fetchArchivedForUser(userId: string): Promise<NoteData[]> {
-	const noteRows = await db.query.notes.findMany({
-		where: and(eq(notes.userId, userId), eq(notes.archived, true)),
-		orderBy: (table, { desc }) => [desc(table.createdAt)],
-	});
-
-	return noteRows.map(toNoteData);
+	return {
+		activeNotes: mapped.filter((note) => !note.archived),
+		archivedNotes: mapped.filter((note) => note.archived),
+	};
 }
--- a/src/features/transactions/lib/attachments-config.ts
+++ b/src/features/transactions/lib/attachments-config.ts
@@ -1,13 +1,7 @@
-export const ALLOWED_MIME_TYPES = [
-	"application/pdf",
-	"image/jpeg",
-	"image/png",
-	"image/webp",
-] as const;
-
-export const DEFAULT_MAX_FILE_SIZE_MB = 50;
-
-export const MAX_FILE_SIZE = DEFAULT_MAX_FILE_SIZE_MB * 1024 * 1024; // 50MB (fallback)
-
-export const ATTACHMENT_SIZE_OPTIONS = [5, 10, 25, 50, 100] as const;
-export type AttachmentSizeOption = (typeof ATTACHMENT_SIZE_OPTIONS)[number];
+export {
+	ALLOWED_MIME_TYPES,
+	ATTACHMENT_SIZE_OPTIONS,
+	type AttachmentSizeOption,
+	DEFAULT_MAX_FILE_SIZE_MB,
+	MAX_FILE_SIZE,
+} from "@/shared/lib/attachments/config";
--- a/src/shared/lib/attachments/config.ts
+++ b/src/shared/lib/attachments/config.ts
@@ -0,0 +1,11 @@
+export const ALLOWED_MIME_TYPES = [
+	"application/pdf",
+	"image/jpeg",
+	"image/png",
+	"image/webp",
+] as const;
+
+export const DEFAULT_MAX_FILE_SIZE_MB = 50;
+export const ATTACHMENT_SIZE_OPTIONS = [5, 10, 25, 50, 100] as const;
+export type AttachmentSizeOption = (typeof ATTACHMENT_SIZE_OPTIONS)[number];
+export const MAX_FILE_SIZE = DEFAULT_MAX_FILE_SIZE_MB * 1024 * 1024;
Author	SHA1	Message	Date
Felipe Coutinho	be6fa6dcfc	chore: prepara versao 2.7.9	2026-06-21 12:20:12 -03:00
Felipe Coutinho	954fdc148e	docs: versiona instrucoes dos agentes	2026-06-21 12:20:01 -03:00
Felipe Coutinho	fb1759c2ee	ci: publica releases somente por tags semver	2026-06-21 12:19:53 -03:00
Felipe Coutinho	b1b2f5fe0d	chore: prepara versão 2.7.8	2026-06-21 11:54:27 -03:00
Felipe Coutinho	4d62abfc6b	feat(dashboard): vincula tendências às categorias	2026-06-21 11:54:19 -03:00
Felipe Coutinho	1660f68a4b	feat(anexos): adiciona filtro por pessoa	2026-06-21 11:54:15 -03:00
Felipe Coutinho	d363662548	feat(anotações): permite anexos em notas	2026-06-21 11:54:05 -03:00