@zenifra/cli 0.2.6 → 0.3.1

package/README.md

@@ -43,7 +43,7 @@ zenifra auth logout
 zenifra auth logout --revoke
 zenifra profile list
 zenifra profile show
-zenifra profile add --name staging --description Homologacao --api-base https://api-stg.zenifra.com/v1 --mode api-key --key znf_sua_chave
+zenifra profile add --name staging --description Homologacao --api-base https://api.example.test/v1 --mode api-key --key znf_sua_chave
 zenifra profile use staging
 zenifra profile edit staging --description "Homologacao interna"
 zenifra profile remove staging
@@ -148,14 +148,55 @@ Fluxos:
 - `zenifra deploy`: dispara o build/deploy GitHub e retorna o `build_id`
 - `zenifra deploy watch`: usa esse `build_id` para acompanhar o build em tempo real e imprimir os logs incrementais ate o fim
 
+Antes de uma mutacao, confirme o perfil, a API e a organizacao ativa. Para criacoes, confirme tambem o catalogo, plano, pagamento, exposicao, dominio, origem do deploy, porta, instancias e ambientes. Depois, leia o projeto de volta e acompanhe o build/deployment ate um estado terminal.
+
+O dominio principal e um dominio personalizado sao campos diferentes. Nao repita o dominio principal em `config.custom_domains`; depois de adicionar um dominio personalizado, valide DNS/TLS e leia a URL final antes de considerar a operacao concluida.
+
 Se voce rodar apenas `zenifra deploy`, a CLI mostra a ajuda especifica do comando com uso, flags, exemplos e exemplo de retorno.
 
+## Login pelo navegador (OAuth)
+
+Enderecos em `example.test` sao ficticios; substitua pela API autorizada do seu ambiente.
+
+Use uma API com o login OAuth da CLI habilitado. O comando abre o Console para voce
+entrar, concluir a verificacao de seguranca e aprovar o acesso da CLI a sua conta:
+
+```bash
+zenifra auth login --oauth --profile staging --api-base https://api.example.test/v1
+zenifra orgs
+zenifra org set --org <id>
+zenifra projects
+```
+
+Para executar a copia local deste repositorio, substitua `zenifra` por
+`node bin/zenifra.mjs`. Para uma API local, use seu endereco loopback, por exemplo
+`--api-base http://127.0.0.1:3000/v1`. Enderecos externos exigem HTTPS.
+
+- `--read-only` solicita somente leitura; as permissoes da sua organizacao continuam valendo.
+- `--no-browser` mostra o endereco para abrir manualmente no navegador da mesma maquina.
+- O retorno usa uma porta local temporaria em `127.0.0.1`; nao precisa cadastrar uma porta fixa.
+- O login aguarda ate tres minutos. Use `Ctrl+C` para cancelar.
+- Os tokens ficam no perfil local privado e sao renovados automaticamente antes de expirar.
+- Nao altere `--api-base` ou `ZENIFRA_API_URL` para reutilizar o token em outra API: crie outro perfil.
+- `ZENIFRA_API_KEY` continua tendo prioridade e gera um aviso quando substitui um perfil OAuth.
+
+```bash
+zenifra auth logout                    # remove apenas a autenticacao local
+zenifra auth logout --revoke           # revoga somente a conexao OAuth deste perfil
+```
+
+Sem `--oauth`, `auth login` mantem o login por email, senha e verificacao.
+Uma falha ao renovar a sessao exige novo login; a CLI nao repete automaticamente
+operacoes de alteracao. Se um comando for encerrado abruptamente e deixar
+`profiles.lock`, verifique o PID indicado nesse arquivo e remova o lock somente
+depois de confirmar que o comando terminou.
+
 ## Configuracao
 
 - API padrao: `https://api.zenifra.com/v1`
-- Override de API: `ZENIFRA_API_URL=https://api-stg.zenifra.com/v1`
+- Override de API: `ZENIFRA_API_URL=https://api.example.test/v1`
 - API key global: `ZENIFRA_API_KEY=znf_sua_chave`
-- Timeout de cada request HTTP: `ZENIFRA_HTTP_TIMEOUT_MS=30000`
+- Timeout padrao de cada request HTTP: 5 minutos (`ZENIFRA_HTTP_TIMEOUT_MS=300000`). A variavel permite ajustar esse limite.
 - Store local de perfis: `~/.config/zenifra-cli/profiles.json`
 - Override do diretorio local: `ZENIFRA_CONFIG_DIR=/path/custom`
 
@@ -185,12 +226,13 @@ A CLI agora trabalha com um perfil ativo. Cada perfil pode ter:
 - credencial:
   - `api_key` para automacao organizacional
   - `access_token` para login pessoal, com `selectedOrganizationId`
+  - `oauth` para login pelo navegador, com renovacao automatica e organizacao selecionada
 
 Exemplos:
 
 ```bash
 zenifra profile add --name prod --description Producao --api-base https://api.zenifra.com/v1 --mode api-key --key znf_sua_chave
-zenifra profile add --name staging --description Homologacao --api-base https://api-stg.zenifra.com/v1 --mode login
+zenifra profile add --name staging --description Homologacao --api-base https://api.example.test/v1 --mode login
 zenifra profile list
 zenifra profile show staging
 zenifra profile use prod
@@ -202,7 +244,7 @@ Regras de precedencia:
 - `ZENIFRA_API_URL` sobrescreve a API base do perfil ativo apenas para a execucao atual
 - `auth login` e `auth api-key` operam no perfil ativo por padrao
 - `auth login --profile <name>` e `auth api-key --profile <name>` atualizam ou criam outro perfil e o tornam ativo
-- `auth logout` remove somente a autenticacao local; `auth logout --revoke` tambem invalida as sessoes de login do usuario no servidor
+- `auth logout` remove somente a autenticacao local; `auth logout --revoke` revoga somente a conexao do perfil OAuth, ou as sessoes do usuario para login por senha
 - `auth logout --revoke` exige um perfil autenticado por login e nao revoga API keys
 
 Migracao:
@@ -279,15 +321,23 @@ Observacoes do wizard:
 - em projetos de banco, o wizard nao pergunta `username`, `password` nem `database name`
 - em projetos de banco, a CLI preenche apenas campos tecnicos minimos exigidos pela validacao atual da API
 - em projetos Valkey, a capacidade é definida pelo plano e a CLI não pergunta instâncias, imagem, variáveis de ambiente ou exposição HTTP
-- a conexão mascarada pode ser consultada a qualquer momento; a credencial completa aparece apenas na criação ou em uma rotação concluída
+- a conexão mascarada pode ser consultada a qualquer momento; uma rotação concluída pode salvar a conexão utilizável em arquivo privado com `--connection-file <path>`
 - `valkey credentials rotate` retorna uma operação assíncrona; use `--wait` ou `valkey credentials status` para acompanhar
 
+Exemplo de entrega segura para automação local:
+
+```bash
+zenifra valkey credentials rotate --project <project-id> --wait --connection-file /caminho/privado/redis-url.txt --json
+```
+
+O arquivo é criado com permissão privada; a conexão não aparece na saída do comando quando essa opção é usada.
+
 ## Regressao manual de auto-scaling em staging
 
-O teste de staging cria projetos, gera trafego, consulta consumo e remove somente os projetos criados pela propria execucao. Ele rejeita a API de producao e exige habilitacao explicita das mutacoes.
+O teste de staging cria projetos, gera trafego, consulta consumo e remove somente os projetos criados pela propria execucao. Ele exige uma API de teste explicita, rejeita a API de producao e exige habilitacao explicita das mutacoes. O exemplo abaixo usa uma API local de teste.
 
 ```bash
-export ZENIFRA_API_URL_STG=https://api-stg.zenifra.com/v1
+export ZENIFRA_API_URL_STG=http://127.0.0.1:3000/v1
 export ZENIFRA_API_KEY_STG=znf_sua_chave_de_staging
 export ZENIFRA_STAGING_ALLOW_MUTATIONS=1
 npm run test:staging:autoscaling

package/bin/lib/oauth-page.mjs

@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto';
+
+const style = `
+* { box-sizing: border-box; }
+:root { color-scheme: dark; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+body { margin: 0; min-height: 100vh; min-height: 100svh; display: grid; place-items: center; background: #09090b; color: #fafafa; padding: 32px 20px; }
+.page { width: min(100%, 480px); }
+.brand { display: flex; align-items: center; justify-content: center; gap: 9px; margin-bottom: 36px; font-size: 23px; font-weight: 650; letter-spacing: -.8px; }
+.brand svg { width: 34px; height: 34px; fill: currentColor; }
+.card { padding: 42px 36px 32px; border: 1px solid #29292f; border-radius: 24px; background: #111114; box-shadow: 0 24px 80px #0005; text-align: center; }
+.status { display: grid; place-items: center; width: 76px; height: 76px; margin: 0 auto 28px; border-radius: 50%; color: #6ee7b7; background: #142d25; border: 1px solid #2a5344; box-shadow: 0 0 0 8px #142d2545; }
+.status svg { width: 34px; height: 34px; }
+.cancelled .status { color: #d4d4d8; background: #232329; border-color: #3f3f46; box-shadow: 0 0 0 8px #23232965; }
+.eyebrow { margin: 0 0 12px; color: #a1a1aa; font-size: 11px; font-weight: 650; letter-spacing: 2px; text-transform: uppercase; }
+h1 { margin: 0; font-size: clamp(27px, 5vw, 34px); line-height: 1.2; font-weight: 650; letter-spacing: -1.1px; }
+.description { margin: 16px auto 28px; max-width: 340px; color: #a1a1aa; font-size: 15px; line-height: 1.7; }
+.next { display: flex; align-items: center; gap: 14px; padding: 18px; text-align: left; background: #1a1a1f; border: 1px solid #303036; border-radius: 12px; }
+.terminal { flex: 0 0 auto; display: grid; place-items: center; width: 40px; height: 40px; border: 1px solid #3a3a42; border-radius: 9px; background: #24242b; }
+.terminal svg { width: 21px; height: 21px; }
+.next strong { display: block; font-size: 14px; font-weight: 600; }
+.next p { margin: 5px 0 0; color: #a1a1aa; font-size: 12px; line-height: 1.6; }
+.close { margin: 25px 0 0; color: #a1a1aa; font-size: 12px; line-height: 1.6; }
+.footer { margin: 24px 0 0; text-align: center; color: #a1a1aa; font-size: 12px; }
+@media (max-width: 420px) { .card { padding: 34px 22px 26px; } .brand { margin-bottom: 28px; } .next { padding: 14px; gap: 11px; } }
+`;
+
+export const oauthPagePolicy = `default-src 'none'; style-src 'sha256-${createHash('sha256').update(style).digest('base64')}'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`;
+
+export function oauthCallbackPage(cancelled = false) {
+  const title = cancelled ? 'Login cancelado' : 'Autorização recebida';
+  const description = cancelled
+    ? 'Você cancelou a autorização. Nenhum novo acesso foi concedido ao CLI.'
+    : 'Sua autorização foi enviada ao Zenifra CLI. Continue no terminal para concluir o login.';
+  const icon = cancelled ? '<path d="m8 8 8 8M16 8l-8 8"/>' : '<path d="m5 12 4 4L19 6"/>';
+  return `<!doctype html>
+<html lang="pt-BR">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="dark">
+<title>${title} · Zenifra CLI</title>
+<style>${style}</style>
+</head>
+<body>
+<main class="page${cancelled ? ' cancelled' : ''}">
+  <div class="brand" aria-label="Zenifra">
+    <svg viewBox="0 0 1000 1000" aria-hidden="true"><path d="M298.27,353.7l-82.91,229.13c82.68-78.72,163.4-112.86,290.82-112.86h3.22c126.61-1.58,264.38-96.29,323.98-218.5h-395.9c-56.45,0-118.78,45.77-139.21,102.22Z"/><path d="M493.82,530.02h-3.22c-126.61,1.58-264.38,96.29-323.98,218.5h395.9c56.45,0,118.78-45.77,139.21-102.22l82.91-229.13c-82.68,78.72-163.4,112.86-290.82,112.86Z"/></svg>
+    <span>zenifra</span>
+  </div>
+  <section class="card" aria-labelledby="title">
+    <div class="status" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">${icon}</svg></div>
+    <p class="eyebrow">Zenifra CLI</p>
+    <h1 id="title">${title}</h1>
+    <p class="description">${description}</p>
+    <div class="next">
+      <span class="terminal" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="m5 7 5 5-5 5M13 17h6"/></svg></span>
+      <div><strong>Volte ao seu terminal</strong><p>${cancelled ? 'Inicie um novo login quando quiser.' : 'A confirmação do login aparecerá por lá.'}</p></div>
+    </div>
+    <p class="close">Você já pode fechar esta aba.</p>
+  </section>
+  <p class="footer">Seu próximo passo está no terminal.</p>
+</main>
+</body>
+</html>`;
+}

package/bin/lib/oauth.mjs

@@ -0,0 +1,152 @@
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { oauthCallbackPage, oauthPagePolicy } from './oauth-page.mjs';
+
+const CLIENT_ID = 'zenifra-cli';
+const fail = () => new Error('Resposta OAuth invalida. Tente fazer login novamente.');
+export function oauthTarget(apiBase) {
+  let url;
+  try { url = new URL(apiBase); } catch { throw fail(); }
+  if (url.username || url.password || url.search || url.hash || url.pathname !== '/v1'
+    || !(url.protocol === 'https:' || (url.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(url.hostname)))) {
+    throw new Error('OAuth exige uma API HTTPS com caminho /v1 (HTTP permitido somente em loopback local).');
+  }
+  return { issuer: url.origin, resource: `${url.origin}/v1`, clientId: CLIENT_ID };
+}
+export function validateOAuthProfile(oauth, apiBase) {
+  const target = oauthTarget(apiBase);
+  if (!oauth || oauth.issuer !== target.issuer || oauth.resource !== target.resource || oauth.clientId !== CLIENT_ID) {
+    throw new Error('O perfil OAuth pertence a outra API. Use a API original ou faca login em outro perfil.');
+  }
+  return target;
+}
+function checkCancelled(signal) {
+  if (signal?.aborted) throw new Error('Login OAuth cancelado.');
+}
+async function jsonRequest(url, options = {}, signal) {
+  checkCancelled(signal);
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  const timer = setTimeout(cancel, 30_000);
+  signal?.addEventListener('abort', cancel, { once: true });
+  try {
+    let response;
+    try { response = await fetch(url, { ...options, redirect: 'error', signal: controller.signal }); }
+    catch { checkCancelled(signal); throw new Error('Nao foi possivel conectar ao OAuth. Tente novamente.'); }
+    checkCancelled(signal);
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new Error('OAuth recusou a solicitacao. Faca login novamente; nenhuma operacao foi repetida.');
+    }
+    const reader = response.body.getReader(); let length = 0; const chunks = [];
+    try {
+      while (true) {
+        const { done, value } = await reader.read(); if (done) break;
+        length += value.length; if (length > 65536) throw fail(); chunks.push(value);
+      }
+      checkCancelled(signal);
+      return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    } catch { await reader.cancel().catch(() => {}); checkCancelled(signal); throw fail(); }
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener('abort', cancel);
+  }
+}
+
+function tokens(value, target, previousScope) {
+  const scope = value?.scope ?? previousScope;
+  if (!value || typeof value.access_token !== 'string' || !value.access_token || value.access_token.length > 16384
+    || /\s/.test(value.access_token) || typeof value.refresh_token !== 'string' || !value.refresh_token || value.refresh_token.length > 16384
+    || /\s/.test(value.refresh_token) || String(value.token_type).toLowerCase() !== 'bearer'
+    || !Number.isSafeInteger(value.expires_in) || value.expires_in <= 0 || value.expires_in > 86400
+    || typeof scope !== 'string' || !scope.split(' ').includes('cli:read')
+    || scope.split(' ').some(s => !['cli:read', 'cli:write', 'offline_access'].includes(s))) throw fail();
+  return { authMode: 'oauth', accessToken: value.access_token, apiKey: undefined,
+    oauth: { ...target, refreshToken: value.refresh_token, expiresAt: Date.now() + value.expires_in * 1000, scope } };
+}
+async function tokenRequest(target, parameters, previousScope, signal) {
+  const value = await jsonRequest(`${target.issuer}/v1/oauth/token`, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body: new URLSearchParams({ client_id: CLIENT_ID, resource: target.resource, ...parameters }),
+  }, signal);
+  checkCancelled(signal);
+  const result = tokens(value, target, previousScope);
+  if (previousScope && result.oauth.scope.split(' ').some(s => !previousScope.split(' ').includes(s))) throw fail();
+  return result;
+}
+export async function refreshOAuth(oauth) {
+  const target = validateOAuthProfile(oauth, oauth.resource);
+  if (!oauth.refreshToken) throw fail();
+  return tokenRequest(target, { grant_type: 'refresh_token', refresh_token: oauth.refreshToken }, oauth.scope);
+}
+export async function revokeOAuth(oauth, apiBase) {
+  const target = validateOAuthProfile(oauth, apiBase);
+  let response;
+  try {
+    response = await fetch(`${target.issuer}/v1/oauth/revoke`, { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(30_000),
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ client_id: CLIENT_ID, token: oauth.refreshToken, token_type_hint: 'refresh_token' }) });
+  } catch { throw new Error('Nao foi possivel revogar a conexao OAuth. O perfil foi preservado.'); }
+  await response.body?.cancel();
+  if (!response.ok) throw new Error('A revogacao OAuth falhou. O perfil foi preservado.');
+}
+export function openBrowser(url) {
+  const executable = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32.exe' : 'xdg-open';
+  const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+  return new Promise(resolve => {
+    const child = spawn(executable, args, { shell: false, stdio: 'ignore', windowsHide: true });
+    const timer = setTimeout(() => { child.unref(); resolve(false); }, 3000);
+    child.once('error', () => { clearTimeout(timer); resolve(false); }); child.once('exit', code => { clearTimeout(timer); resolve(code === 0); });
+  });
+}
+export async function oauthLogin(apiBase, { readOnly = false, onAuthorize, timeoutMs = 180_000, signal } = {}) {
+  const target = oauthTarget(apiBase);
+  const metadata = await jsonRequest(`${target.issuer}/.well-known/oauth-authorization-server`, {}, signal);
+  if (metadata.issuer !== target.issuer || metadata.authorization_endpoint !== `${target.issuer}/v1/oauth/authorize`
+    || metadata.token_endpoint !== `${target.issuer}/v1/oauth/token` || metadata.revocation_endpoint !== `${target.issuer}/v1/oauth/revoke`
+    || !metadata.code_challenge_methods_supported?.includes('S256') || metadata.authorization_response_iss_parameter_supported !== true) throw fail();
+  const state = randomBytes(32).toString('base64url'); const verifier = randomBytes(48).toString('base64url');
+  const scope = readOnly ? 'cli:read offline_access' : 'cli:read cli:write offline_access';
+  let resolveCode, rejectCode, accepted = false, port;
+  const pending = new Promise((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
+  // Attach a handler before invoking asynchronous browser launch.
+  pending.catch(() => {});
+  const server = createServer({ maxHeaderSize: 8192 }, (req, res) => {
+    res.setHeader('Cache-Control', 'no-store'); res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    res.setHeader('Content-Security-Policy', "default-src 'none'"); res.setHeader('Referrer-Policy', 'no-referrer');
+    const reject = () => { res.writeHead(400); res.end('Callback OAuth invalido.'); };
+    if (accepted || req.method !== 'GET' || req.headers.host !== `127.0.0.1:${port}` || !req.url?.startsWith('/oauth/callback?') || req.url.length > 8192) return reject();
+    const url = new URL(req.url, `http://127.0.0.1:${port}`); const p = url.searchParams;
+    if (url.pathname !== '/oauth/callback' || [...p.keys()].some(k => !['code','state','iss','error','error_description','error_uri'].includes(k) || p.getAll(k).length !== 1)) return reject();
+    const candidate = Buffer.from(p.get('state') || '');
+    if (candidate.length !== state.length || !timingSafeEqual(candidate, Buffer.from(state)) || p.get('iss') !== target.issuer
+      || (p.has('code') === p.has('error')) || (p.has('code') && !/^[\x21-\x7e]{1,2048}$/.test(p.get('code')))) return reject();
+    accepted = true;
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('Content-Security-Policy', oauthPagePolicy);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.end(oauthCallbackPage(p.has('error')));
+    if (p.has('error')) rejectCode(new Error('Login OAuth cancelado ou recusado.')); else resolveCode(p.get('code'));
+  });
+  const sockets = new Set();
+  server.on('connection', socket => { sockets.add(socket); socket.once('close', () => sockets.delete(socket)); });
+  server.requestTimeout = 10_000; server.headersTimeout = 10_000;
+  const cancel = () => rejectCode(new Error('Login OAuth cancelado.'));
+  let timer;
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+    port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/oauth/callback`;
+    const authorize = new URL(metadata.authorization_endpoint);
+    authorize.search = new URLSearchParams({ client_id: CLIENT_ID, response_type: 'code', redirect_uri: redirectUri, resource: target.resource,
+      scope, state, code_challenge: createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' }).toString();
+    timer = setTimeout(() => rejectCode(new Error('Tempo de login OAuth esgotado. Tente novamente.')), timeoutMs);
+    signal?.addEventListener('abort', cancel, { once: true }); if (signal?.aborted) cancel();
+    await onAuthorize(authorize.toString());
+    const code = await pending;
+    return await tokenRequest(target, { grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: redirectUri }, scope, signal);
+  } finally {
+    clearTimeout(timer); signal?.removeEventListener('abort', cancel); for (const socket of sockets) socket.destroy(); await new Promise(resolve => server.close(resolve));
+  }
+}

package/bin/lib/profile-store.mjs

@@ -0,0 +1,56 @@
+import { mkdir, chmod, open, rename, unlink } from 'node:fs/promises';
+import { unlinkSync, lstatSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export async function withProfileLock(directory, action, { timeoutMs = 35_000, signal } = {}) {
+  signal?.throwIfAborted();
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  const path = join(directory, 'profiles.lock');
+  const deadline = Date.now() + timeoutMs;
+  let handle;
+  while (!handle) {
+    signal?.throwIfAborted();
+    try { handle = await open(path, 'wx', 0o600); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      if (Date.now() >= deadline) throw new Error(`Perfis ocupados: ${path}. Aguarde o outro comando. Se ele terminou, verifique o PID no arquivo e remova somente esse lock antes de tentar novamente.`);
+      await new Promise(resolve => setTimeout(resolve, 50));
+    }
+  }
+  const identity = await handle.stat();
+  const cleanup = () => {
+    try {
+      const current = lstatSync(path);
+      if (current.ino === identity.ino && current.dev === identity.dev) unlinkSync(path);
+    } catch {}
+  };
+  const interrupt = () => { cleanup(); process.exit(130); };
+  process.once('exit', cleanup);
+  if (!signal) { process.once('SIGINT', interrupt); process.once('SIGTERM', interrupt); }
+  try {
+    signal?.throwIfAborted();
+    await handle.writeFile(String(process.pid));
+    signal?.throwIfAborted();
+    return await action();
+  }
+  finally {
+    process.removeListener('exit', cleanup); process.removeListener('SIGINT', interrupt); process.removeListener('SIGTERM', interrupt);
+    cleanup(); await handle.close();
+  }
+}
+export async function atomicPrivateWrite(path, content, { signal } = {}) {
+  signal?.throwIfAborted();
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  const handle = await open(temporary, 'wx', 0o600);
+  try {
+    signal?.throwIfAborted();
+    await handle.writeFile(content, 'utf8');
+    await handle.sync();
+    await handle.close();
+    signal?.throwIfAborted();
+    await rename(temporary, path);
+  }
+  finally { await handle.close().catch(() => {}); await unlink(temporary).catch(() => {}); }
+}

package/bin/lib/public-ux.mjs

@@ -0,0 +1,40 @@
+import { atomicPrivateWrite } from './profile-store.mjs';
+
+const MASKED_SECRET_PATTERN = /\*{4,}|\[redacted\]|<redacted>/i;
+
+function normalizeDomain(value) {
+  return String(value || '').trim().replace(/\.+$/, '').toLowerCase();
+}
+
+export function normalizeCustomDomains(domains, { primaryDomain } = {}) {
+  if (!Array.isArray(domains)) return [];
+  const normalized = domains.map(normalizeDomain).filter(Boolean);
+  const seen = new Set();
+  for (const domain of normalized) {
+    if (seen.has(domain)) throw new Error(`Duplicate custom domain: ${domain}`);
+    seen.add(domain);
+  }
+  const primary = normalizeDomain(primaryDomain);
+  if (primary && seen.has(primary)) {
+    throw new Error(`Custom domain conflicts with the primary domain: ${primary}`);
+  }
+  return normalized;
+}
+
+export function validateValkeyConnection(value) {
+  const connection = String(value ?? '');
+  if (!connection || connection.trim() === '' || MASKED_SECRET_PATTERN.test(connection)) {
+    throw new Error('The Valkey connection is masked. Rotate credentials and save the one-time connection securely.');
+  }
+  return connection;
+}
+
+export async function writeValkeyConnectionFile(path, value) {
+  const connection = validateValkeyConnection(value);
+  await atomicPrivateWrite(path, connection);
+  return connection;
+}
+
+export function isMaskedSecret(value) {
+  return MASKED_SECRET_PATTERN.test(String(value || ''));
+}

package/bin/zenifra.mjs

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
 
 import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, rm, writeFile, chmod } from 'node:fs/promises';
+import { readFile, rm } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
 import process from 'node:process';
 import readline from 'node:readline/promises';
+import { oauthLogin, openBrowser, validateOAuthProfile, refreshOAuth, revokeOAuth } from './lib/oauth.mjs';
+import { withProfileLock, atomicPrivateWrite } from './lib/profile-store.mjs';
+import { normalizeCustomDomains, writeValkeyConnectionFile } from './lib/public-ux.mjs';
 
 const DEFAULT_API_BASE_URL = 'https://api.zenifra.com/v1';
 const DOCS_BASE_URL = 'https://docs.zenifra.com/pt';
@@ -23,13 +26,17 @@ const SESSION_FILE = join(SESSION_DIR, 'session.json');
 const PROFILES_FILE = join(SESSION_DIR, 'profiles.json');
 const PROFILE_STORE_VERSION = 1;
 const DEFAULT_PROFILE_NAME = 'default';
-const DEFAULT_HTTP_TIMEOUT_MS = 30_000;
+const DEFAULT_HTTP_TIMEOUT_MS = 300_000;
 const KNOWN_FLAG_NAMES = new Set([
   'apiBase',
+  'oauth',
+  'readOnly',
+  'noBrowser',
   'branch',
   'build',
   'challengeToken',
   'code',
+  'connectionFile',
   'commitSha',
   'config',
   'count',
@@ -58,6 +65,7 @@ const KNOWN_FLAG_NAMES = new Set([
   'operation',
   'page',
   'password',
+  'path',
   'paymentMode',
   'plan',
   'profile',
@@ -158,7 +166,7 @@ function usage() {
 
 Usage:
   zenifra help <command>
-  zenifra auth login [--profile <name>] [--api-base <url>] [--code <code>]
+  zenifra auth login [--profile <name>] [--api-base <url>] [--code <code>] [--oauth] [--read-only] [--no-browser]
   zenifra auth api-key --key <znf_key> [--profile <name>] [--api-base <url>]
   zenifra auth logout [--profile <name>] [--revoke]
   zenifra profile list [--json]
@@ -182,6 +190,10 @@ Usage:
   zenifra project logs --project <id> [--instance <id>] [--json]
   zenifra project metrics --project <id> [--instance <id>] [--json]
   zenifra project metrics capabilities --project <id> [--json]
+  zenifra project healthcheck get --project <id> [--json]
+  zenifra project healthcheck set --project <id> --path /health [--json]
+  zenifra project healthcheck disable --project <id> [--json]
+  zenifra project healthcheck failures --project <id> [--page <n>] [--limit <n>] [--json]
   zenifra project network --project <id> [--view <summary|status-codes|routes|user-agents|request-events|source-ips>] [--json]
   zenifra project image set --project <id> --image <image> [--json]
   zenifra project exposure set --project <id> --exposure <public|private> [--json]
@@ -214,7 +226,7 @@ Run "zenifra help <command>" or "zenifra <command> --help" for command-specific
 const HELP_SPECS = [
   {
     command: 'auth',
-    usage: 'zenifra auth\n  zenifra auth login [--profile <name>] [--api-base <url>] [--code <code>]\n  zenifra auth api-key --key <znf_key> [--profile <name>] [--api-base <url>]\n  zenifra auth logout [--profile <name>] [--revoke]',
+    usage: 'zenifra auth\n  zenifra auth login [--profile <name>] [--api-base <url>] [--code <code>] [--oauth] [--read-only] [--no-browser]\n  zenifra auth api-key --key <znf_key> [--profile <name>] [--api-base <url>]\n  zenifra auth logout [--profile <name>] [--revoke]',
     description: 'Gerencia a autenticacao dos perfis locais da CLI.',
     examples: ['zenifra auth', 'zenifra auth login --profile staging', 'zenifra auth api-key --profile prod --key znf_0123456789abcdef01234567_abcd...'],
     output: 'Zenifra CLI - auth',
@@ -222,9 +234,12 @@ const HELP_SPECS = [
   },
   {
     command: 'auth login',
-    usage: 'zenifra auth login [--profile <name>] [--api-base <url>] [--code <code>]',
+    usage: 'zenifra auth login [--profile <name>] [--api-base <url>] [--code <code>] [--oauth] [--read-only] [--no-browser]',
     description: 'Autentica um usuario Zenifra no perfil ativo ou em um perfil especifico.',
     flags: [
+      '--oauth           Entra pelo navegador usando OAuth e PKCE.',
+      '--read-only       Solicita somente leitura com --oauth.',
+      '--no-browser      Mostra o endereco sem abrir o navegador com --oauth.',
       '--profile <name>  Atualiza ou cria o perfil informado e o torna ativo.',
       '--api-base <url>  Usa uma API diferente da producao.',
       '--code <code>     Informa o codigo de desafio sem prompt interativo.',
@@ -246,7 +261,7 @@ const HELP_SPECS = [
     command: 'auth logout',
     usage: 'zenifra auth logout [--profile <name>] [--revoke]',
     description: 'Remove a autenticacao do perfil ativo ou do perfil informado.',
-    flags: ['--profile <name>  Limpa outro perfil sem trocar o perfil ativo.', '--revoke          Revoga as sessoes de usuario no servidor antes de limpar o perfil.'],
+    flags: ['--profile <name>  Limpa outro perfil sem trocar o perfil ativo.', '--revoke          Revoga a conexao OAuth deste perfil, ou as sessoes do login por senha, antes de limpar o perfil.'],
     examples: ['zenifra auth logout', 'zenifra auth logout --profile staging', 'zenifra auth logout --revoke'],
     output: 'Autenticacao removida do perfil active.',
     notes: ['Sem --revoke, remove somente a credencial local. A revogacao invalida as sessoes de login do usuario e nao se aplica a API keys.'],
@@ -255,7 +270,7 @@ const HELP_SPECS = [
     command: 'profile',
     usage: 'zenifra profile\n  zenifra profile list [--json]\n  zenifra profile show [<name>] [--json]\n  zenifra profile add [--name <name>] [--description <text>] [--api-base <url>] [--mode <api-key|login>] [--key <znf_key>] [--json]\n  zenifra profile edit <name> [--description <text>] [--api-base <url>] [--json]\n  zenifra profile use <name> [--json]\n  zenifra profile remove <name> [--json]',
     description: 'Gerencia perfis de ambiente locais, incluindo API base, descricao e credenciais.',
-    examples: ['zenifra profile', 'zenifra profile list', 'zenifra profile add --name staging --description Homologacao --api-base https://api-stg.zenifra.com/v1 --mode api-key --key znf_0123...'],
+    examples: ['zenifra profile', 'zenifra profile list', 'zenifra profile add --name staging --description Homologacao --api-base https://api.example.test/v1 --mode api-key --key znf_0123...'],
     output: 'Zenifra CLI - profile',
     notes: ['Use "zenifra help profile <subcomando>" para detalhes de list, show, add, edit, use e remove.'],
   },
@@ -265,7 +280,7 @@ const HELP_SPECS = [
     description: 'Lista os perfis locais configurados e indica o perfil ativo.',
     flags: ['--json  Imprime a resposta em JSON.'],
     examples: ['zenifra profile list', 'zenifra profile list --json'],
-    output: 'Nome      Tipo         API base                      Ativo  Descricao\nprod      api_key      https://api.zenifra.com/v1    yes    Producao\nstaging   access_token https://api-stg.zenifra.com/v1 no     Homologacao',
+    output: 'Nome      Tipo         API base                      Ativo  Descricao\nprod      api_key      https://api.zenifra.com/v1    yes    Producao\nstaging   access_token https://api.example.test/v1 no     Homologacao',
     jsonOutput: '[{"name":"prod","auth_mode":"api_key","api_base_url":"https://api.zenifra.com/v1","active":true}]',
   },
   {
@@ -282,7 +297,7 @@ const HELP_SPECS = [
     usage: 'zenifra profile add [--name <name>] [--description <text>] [--api-base <url>] [--mode <api-key|login>] [--key <znf_key>] [--json]',
     description: 'Cria um novo perfil e opcionalmente autentica via API key ou login de usuario.',
     flags: ['--name <name>          Nome do perfil.', '--description <text>   Descricao opcional.', '--api-base <url>       API base do perfil.', '--mode <mode>          api-key ou login.', '--key <znf_key>        API key para modo api-key.', '--json                 Imprime a resposta em JSON.'],
-    examples: ['zenifra profile add --name staging --description Homologacao --api-base https://api-stg.zenifra.com/v1 --mode api-key --key znf_0123...', 'zenifra profile add'],
+    examples: ['zenifra profile add --name staging --description Homologacao --api-base https://api.example.test/v1 --mode api-key --key znf_0123...', 'zenifra profile add'],
     output: 'Perfil staging salvo e definido como ativo.',
     jsonOutput: '{"name":"staging","auth_mode":"api_key","active":true}',
   },
@@ -381,18 +396,18 @@ const HELP_SPECS = [
   },
   {
     command: 'valkey credentials rotate',
-    usage: 'zenifra valkey credentials rotate --project <id> [--idempotency-key <key>] [--wait] [--interval <seconds>] [--timeout <seconds>] [--json]',
+    usage: 'zenifra valkey credentials rotate --project <id> [--idempotency-key <key>] [--wait] [--interval <seconds>] [--timeout <seconds>] [--connection-file <path>] [--json]',
     description: 'Solicita a renovacao da credencial e retorna uma operacao acompanhavel.',
-    flags: ['--project <id>          ID do projeto.', '--idempotency-key <key> Chave para repetir a mesma solicitacao.', '--wait                  Aguarda a conclusao.', '--interval <seconds>    Intervalo do polling. Padrao: 2.', '--timeout <seconds>     Timeout total. Padrao: 900.', '--json                  Imprime a resposta em JSON.'],
+    flags: ['--project <id>          ID do projeto.', '--idempotency-key <key> Chave para repetir a mesma solicitacao.', '--wait                  Aguarda a conclusao.', '--interval <seconds>    Intervalo do polling. Padrao: 2.', '--timeout <seconds>     Timeout total. Padrao: 900.', '--connection-file <path> Salva a conexao concluida em arquivo privado.', '--json                  Imprime a resposta em JSON.'],
     examples: ['zenifra valkey credentials rotate --project proj_1', 'zenifra valkey credentials rotate --project proj_1 --wait --timeout 120'],
     output: 'Operacao aceita: rotation_123\nEstado: accepted',
     notes: ['Salve a nova string de conexao quando a operacao atingir completed.'],
   },
   {
     command: 'valkey credentials status',
-    usage: 'zenifra valkey credentials status --project <id> --operation <id> [--json]',
+    usage: 'zenifra valkey credentials status --project <id> --operation <id> [--connection-file <path>] [--json]',
     description: 'Consulta o estado de uma renovacao de credencial Valkey.',
-    flags: ['--project <id>     ID do projeto.', '--operation <id>   ID da operacao.', '--json             Imprime a resposta em JSON.'],
+    flags: ['--project <id>     ID do projeto.', '--operation <id>   ID da operacao.', '--connection-file <path> Salva a conexao concluida em arquivo privado.', '--json             Imprime a resposta em JSON.'],
     examples: ['zenifra valkey credentials status --project proj_1 --operation rotation_123'],
     output: 'Operacao: rotation_123\nEstado: completed',
   },
@@ -417,7 +432,7 @@ const HELP_SPECS = [
   },
   {
     command: 'project',
-    usage: 'zenifra project\n  zenifra project info --project <id> [--json]\n  zenifra project url --project <id> [--json]\n  zenifra project logs --project <id> [--instance <id>] [--json]\n  zenifra project metrics --project <id> [--instance <id>] [--json]\n  zenifra project metrics capabilities --project <id> [--json]\n  zenifra project network --project <id> [--view <summary|status-codes|routes|user-agents|request-events|source-ips>] [--json]\n  zenifra project image set --project <id> --image <image> [--json]\n  zenifra project exposure set --project <id> --exposure <public|private> [--json]\n  zenifra project envs --project <id> [--json] [--show-values]\n  zenifra project env add --project <id> --name <name> --value <value> [--json]\n  zenifra project env update --project <id> --name <name> --value <value> [--json]\n  zenifra project env remove --project <id> --name <name> [--json]\n  zenifra project autoscaling --project <id> [--json]\n  zenifra project autoscaling set --project <id> --min <n> --max <n> [--cpu <percent>] [--memory <percent>] [--json]\n  zenifra project autoscaling disable --project <id> [--json]\n  zenifra project autoscaling events --project <id> [--direction <scale_up|scale_down>] [--from <iso>] [--to <iso>] [--page <n>] [--limit <n>] [--json]\n  zenifra project billing usage --project <id> [--from <iso>] [--to <iso>] [--page <n>] [--limit <n>] [--json]\n  zenifra project instances --project <id> [--json]\n  zenifra project instances set --project <id> --count <n> [--json]',
+    usage: 'zenifra project\n  zenifra project info --project <id> [--json]\n  zenifra project url --project <id> [--json]\n  zenifra project logs --project <id> [--instance <id>] [--json]\n  zenifra project metrics --project <id> [--instance <id>] [--json]\n  zenifra project metrics capabilities --project <id> [--json]\n  zenifra project healthcheck get --project <id> [--json]\n  zenifra project healthcheck set --project <id> --path /health [--json]\n  zenifra project healthcheck disable --project <id> [--json]\n  zenifra project healthcheck failures --project <id> [--page <n>] [--limit <n>] [--json]\n  zenifra project network --project <id> [--view <summary|status-codes|routes|user-agents|request-events|source-ips>] [--json]\n  zenifra project image set --project <id> --image <image> [--json]\n  zenifra project exposure set --project <id> --exposure <public|private> [--json]\n  zenifra project envs --project <id> [--json] [--show-values]\n  zenifra project env add --project <id> --name <name> --value <value> [--json]\n  zenifra project env update --project <id> --name <name> --value <value> [--json]\n  zenifra project env remove --project <id> --name <name> [--json]\n  zenifra project autoscaling --project <id> [--json]\n  zenifra project autoscaling set --project <id> --min <n> --max <n> [--cpu <percent>] [--memory <percent>] [--json]\n  zenifra project autoscaling disable --project <id> [--json]\n  zenifra project autoscaling events --project <id> [--direction <scale_up|scale_down>] [--from <iso>] [--to <iso>] [--page <n>] [--limit <n>] [--json]\n  zenifra project billing usage --project <id> [--from <iso>] [--to <iso>] [--page <n>] [--limit <n>] [--json]\n  zenifra project instances --project <id> [--json]\n  zenifra project instances set --project <id> --count <n> [--json]',
     description: 'Agrupa comandos operacionais e de introspecao sobre um projeto especifico.',
     examples: ['zenifra project', 'zenifra project info --project proj_1', 'zenifra project env add --project proj_1 --name NODE_ENV --value production'],
     output: 'Zenifra CLI - project',
@@ -475,6 +490,52 @@ const HELP_SPECS = [
     jsonOutput: '{"access":"snapshot","groups":["resources","capacity","clients","activity","key_lifecycle","profile","reliability"],"refresh_seconds":60,"history":null}',
     notes: ['A API permanece como fonte de autorizacao. A CLI nao mantem uma lista local de planos.'],
   },
+  {
+    command: 'project healthcheck',
+    usage: 'zenifra project healthcheck\n  zenifra project healthcheck get --project <id> [--json]\n  zenifra project healthcheck set --project <id> --path /health [--json]\n  zenifra project healthcheck disable --project <id> [--json]\n  zenifra project healthcheck failures --project <id> [--page <n>] [--limit <n>] [--json]',
+    description: 'Consulta e gerencia a verificacao de saude de um projeto HTTP.',
+    examples: ['zenifra project healthcheck get --project 507f1f77bcf86cd799439012', 'zenifra project healthcheck failures --project 507f1f77bcf86cd799439012'],
+    output: 'Zenifra CLI - project healthcheck',
+    notes: ['Use "zenifra help project healthcheck <subcomando>" para detalhes de get, set, disable e failures.'],
+  },
+  {
+    command: 'project healthcheck get',
+    usage: 'zenifra project healthcheck get --project <id> [--json]',
+    description: 'Mostra a configuracao e o estado atual da verificacao de saude do projeto.',
+    flags: ['--project <id>  ID do projeto.', '--json          Imprime a resposta publica em JSON.'],
+    examples: ['zenifra project healthcheck get --project 507f1f77bcf86cd799439012'],
+    output: 'Campo       Valor\n----------  ----------\nStatus      ativo\nRota        /health\nVerificacao configurada',
+    jsonOutput: '{"available":true,"healthcheck":{"enabled":true,"path":"/health"},"interval_seconds":60,"retention_days":30}',
+  },
+  {
+    command: 'project healthcheck set',
+    usage: 'zenifra project healthcheck set --project <id> --path /health [--json]',
+    description: 'Ativa a verificacao de saude do projeto usando a rota informada.',
+    flags: ['--project <id>  ID do projeto.', '--path <path>   Rota HTTP absoluta da aplicacao.', '--json          Imprime a resposta publica em JSON.'],
+    examples: ['zenifra project healthcheck set --project 507f1f77bcf86cd799439012 --path /health'],
+    output: 'Verificacao de saude ativada.\nRota: /health',
+    jsonOutput: '{"healthcheck":{"enabled":true,"path":"/health"},"interval_seconds":60,"retention_days":30}',
+    notes: ['A rota deve comecar com / e nao pode conter host, query string ou fragmento.'],
+  },
+  {
+    command: 'project healthcheck disable',
+    usage: 'zenifra project healthcheck disable --project <id> [--json]',
+    description: 'Desativa a verificacao de saude do projeto sem apagar a rota configurada.',
+    flags: ['--project <id>  ID do projeto.', '--json          Imprime a resposta publica em JSON.'],
+    examples: ['zenifra project healthcheck disable --project 507f1f77bcf86cd799439012'],
+    output: 'Verificacao de saude desativada.',
+    jsonOutput: '{"healthcheck":{"enabled":false,"path":"/health"},"interval_seconds":60,"retention_days":30}',
+  },
+  {
+    command: 'project healthcheck failures',
+    usage: 'zenifra project healthcheck failures --project <id> [--page <n>] [--limit <n>] [--json]',
+    description: 'Lista as falhas publicas de verificacao de saude dos ultimos 30 dias.',
+    flags: ['--project <id>  ID do projeto.', '--page <n>      Pagina. Padrao da API: 1.', '--limit <n>     Itens por pagina. Maximo: 100.', '--json          Imprime a resposta publica em JSON.'],
+    examples: ['zenifra project healthcheck failures --project 507f1f77bcf86cd799439012', 'zenifra project healthcheck failures --project 507f1f77bcf86cd799439012 --page 2 --limit 10'],
+    output: 'Quando                    Status\n2026-08-31T12:00:00.000Z  503',
+    jsonOutput: '{"failures":[{"occurred_at":"2026-08-31T12:00:00.000Z","status_code":503}],"pagination":{"page":1,"limit":10,"total":1,"total_pages":1}}',
+    notes: ['O historico e limitado aos 30 dias anteriores.'],
+  },
   {
     command: 'project network',
     usage: 'zenifra project network --project <id> [--view <summary|status-codes|routes|user-agents|request-events|source-ips>] [--json]',
@@ -816,7 +877,11 @@ function normalizeProfileRecord(name, profile = {}) {
   return {
     name,
     description: profile.description ? String(profile.description) : '',
-    authMode: profile.authMode === 'access_token' ? 'access_token' : 'api_key',
+    authMode: ['oauth', 'access_token'].includes(profile.authMode) ? profile.authMode : 'api_key',
+    oauth: profile.authMode === 'oauth' && isRecord(profile.oauth) ? {
+      issuer: profile.oauth.issuer, resource: profile.oauth.resource, clientId: profile.oauth.clientId,
+      refreshToken: profile.oauth.refreshToken, expiresAt: profile.oauth.expiresAt, scope: profile.oauth.scope,
+    } : undefined,
     apiBaseUrl: normalizeApiBaseUrl(profile.apiBaseUrl),
     apiKey: profile.apiKey ? String(profile.apiKey) : undefined,
     accessToken: profile.accessToken ? String(profile.accessToken) : undefined,
@@ -840,13 +905,36 @@ function sanitizeProfileStore(store) {
   return next;
 }
 
-async function writeProfileStore(store) {
+let profileBaseline = emptyProfileStore();
+const sameProfileValue = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+async function readCurrentProfileStore() {
+  try { return sanitizeProfileStore(JSON.parse(await readFile(PROFILES_FILE, 'utf8'))); }
+  catch (error) { if (error.code === 'ENOENT') return emptyProfileStore(); throw new CliError('Arquivo de perfis invalido. Verifique sua configuracao local.'); }
+}
+async function saveProfileStore(store, { signal } = {}) {
   const normalized = sanitizeProfileStore(store);
-  await mkdir(dirname(PROFILES_FILE), { recursive: true });
-  await writeFile(PROFILES_FILE, `${JSON.stringify(normalized, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  await chmod(PROFILES_FILE, 0o600).catch(() => undefined);
+  await atomicPrivateWrite(PROFILES_FILE, `${JSON.stringify(normalized, null, 2)}\n`, { signal });
+  profileBaseline = structuredClone(normalized);
   return normalized;
 }
+async function writeProfileStore(store, { signal } = {}) {
+  const proposed = sanitizeProfileStore(store);
+  const baseline = profileBaseline;
+  return withProfileLock(SESSION_DIR, async () => {
+    const current = await readCurrentProfileStore();
+    for (const name of new Set([...Object.keys(baseline.profiles), ...Object.keys(proposed.profiles)])) {
+      const before = baseline.profiles[name], after = proposed.profiles[name];
+      if (sameProfileValue(before, after)) continue;
+      if (!sameProfileValue(current.profiles[name], before)) {
+        throw new CliError('O perfil foi alterado por outro comando. Repita o comando para usar a configuracao atual.');
+      }
+      if (after) current.profiles[name] = after; else delete current.profiles[name];
+    }
+    if (proposed.activeProfile !== baseline.activeProfile) current.activeProfile = proposed.activeProfile;
+    signal?.throwIfAborted();
+    return saveProfileStore(current, { signal });
+  }, { signal });
+}
 
 async function readLegacySession() {
   if (!existsSync(SESSION_FILE)) return null;
@@ -882,7 +970,9 @@ async function migrateLegacySession() {
 async function readProfileStore() {
   if (existsSync(PROFILES_FILE)) {
     try {
-      return sanitizeProfileStore(JSON.parse(await readFile(PROFILES_FILE, 'utf8')));
+      const store = sanitizeProfileStore(JSON.parse(await readFile(PROFILES_FILE, 'utf8')));
+      profileBaseline = structuredClone(store);
+      return store;
     } catch {
       throw new CliError(`Store de perfis invalido em ${PROFILES_FILE}. Corrija o arquivo ou remova-o para recriar.`);
     }
@@ -919,17 +1009,17 @@ function getProfileRecord(session, explicitName) {
   return store.profiles[name] ? { name, profile: store.profiles[name], store } : null;
 }
 
-async function persistSession(session) {
+async function persistSession(session, { signal } = {}) {
   const store = getStore(session);
   const profileName = getProfileName(session);
   if (!profileName) {
-    return writeProfileStore(store);
+    return writeProfileStore(store, { signal });
   }
   store.profiles[profileName] = normalizeProfileRecord(profileName, session);
   if (!store.activeProfile || store.activeProfile === profileName) {
     store.activeProfile = profileName;
   }
-  const normalized = await writeProfileStore(store);
+  const normalized = await writeProfileStore(store, { signal });
   session.__store = normalized;
   session.__profileName = profileName;
   return normalized;
@@ -1438,7 +1528,14 @@ async function request(session, flags, method, path, {
   credential: credentialOverride,
   headers: extraHeaders = {},
 } = {}) {
-  const credential = credentialOverride || resolveCredential(session);
+  if (tokenRequired && !credentialOverride && session.authMode === 'oauth') {
+    if (process.env.ZENIFRA_API_KEY) {
+      if (!session.__oauthShadowWarned) process.stderr.write('Aviso: ZENIFRA_API_KEY tem prioridade sobre o perfil OAuth.\n');
+      session.__oauthShadowWarned = true;
+    } else await prepareOAuthCredential(session, flags);
+  }
+  let credential = credentialOverride || resolveCredential(session);
+  if (!tokenRequired && session.authMode === 'oauth' && credential?.source === 'profile') credential = null;
   if (tokenRequired && !credential) {
     throw new CliError('Voce precisa autenticar primeiro: zenifra auth login, zenifra auth api-key --key <znf_key> ou ZENIFRA_API_KEY.');
   }
@@ -1470,6 +1567,7 @@ async function request(session, flags, method, path, {
       headers,
       body: body === undefined ? undefined : JSON.stringify(body),
       signal: AbortSignal.timeout(timeoutMs),
+      ...(session.authMode === 'oauth' && credential?.source === 'profile' ? { redirect: 'error' } : {}),
     });
   } catch (error) {
     if (error?.name === 'TimeoutError' || error?.name === 'AbortError') {
@@ -1696,7 +1794,7 @@ function buildLogLineOf(log) {
 }
 
 function requireProjectId(flags, commandKey) {
-  if (!flags.project) {
+  if (!flags.project || flags.project === true) {
     printCommandHelpAndFail(commandKey)
     return null
   }
@@ -1816,7 +1914,55 @@ async function resolveOrgId(session, flags, { interactive = true } = {}) {
   return session.selectedOrganizationId;
 }
 
+async function handleOAuthLogin(session, flags) {
+  if (['email', 'password', 'code', 'totp', 'challengeToken', 'key'].some(key => flags[key])) {
+    throw new CliError('Use --oauth sem senha, codigo ou API key.');
+  }
+  const target = ensureProfile(session, flags.profile, { activate: true });
+  const base = apiBaseUrl(target, flags);
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  process.once('SIGINT', cancel); process.once('SIGTERM', cancel);
+  try {
+    const login = await oauthLogin(base, { readOnly: Boolean(flags.readOnly), signal: controller.signal,
+      onAuthorize: async url => {
+        process.stdout.write(`Abra este endereco no navegador para entrar:\n${url}\n`);
+        if (!flags.noBrowser) {
+          const opened = await openBrowser(url);
+          if (!opened) process.stderr.write('Nao foi possivel abrir o navegador. Abra o endereco acima manualmente.\n');
+        }
+      },
+    });
+    if (controller.signal.aborted) throw new CliError('Login OAuth cancelado.');
+    Object.assign(target, login, { apiBaseUrl: base, selectedOrganizationId: undefined, updatedAt: new Date().toISOString() });
+    await persistSession(target, { signal: controller.signal });
+    if (controller.signal.aborted) throw new CliError('Login OAuth cancelado.');
+    Object.assign(session, buildSession(target.__store));
+    process.stdout.write('Login OAuth realizado com sucesso.\n');
+    if (process.env.ZENIFRA_API_KEY) process.stderr.write('Aviso: ZENIFRA_API_KEY tem prioridade sobre este perfil OAuth nos comandos.\n');
+  } finally { process.removeListener('SIGINT', cancel); process.removeListener('SIGTERM', cancel); }
+}
+
+async function prepareOAuthCredential(session, flags) {
+  validateOAuthProfile(session.oauth, apiBaseUrl(session, flags));
+  if (!Number.isFinite(session.oauth.expiresAt)) throw new CliError('Perfil OAuth invalido. Faca login novamente.');
+  await withProfileLock(SESSION_DIR, async () => {
+    const store = await readCurrentProfileStore();
+    const current = store.profiles[getProfileName(session)];
+    if (current?.authMode !== 'oauth' || !current.accessToken) throw new CliError('Sessao OAuth encerrada. Faca login novamente.');
+    validateOAuthProfile(current.oauth, apiBaseUrl(session, flags));
+    if (!Number.isFinite(current.oauth.expiresAt)) throw new CliError('Perfil OAuth invalido. Faca login novamente.');
+    if (current.oauth.expiresAt <= Date.now() + 30_000) {
+      Object.assign(current, await refreshOAuth(current.oauth), { updatedAt: new Date().toISOString() });
+      await saveProfileStore(store);
+    } else profileBaseline = structuredClone(store);
+    Object.assign(session, current, { __store: store });
+  });
+}
+
 async function handleLogin(session, flags) {
+  if (flags.oauth) return handleOAuthLogin(session, flags);
+  if (flags.readOnly || flags.noBrowser) throw new CliError('--read-only e --no-browser exigem --oauth.');
   const targetSession = ensureProfile(session, flags.profile, { activate: Boolean(flags.profile) || !getProfileName(session) });
   const email = String(flags.email || await prompt('Email'));
   const password = String(flags.password || await promptHidden('Senha'));
@@ -1908,6 +2054,20 @@ async function handleLogout(session, flags) {
     throw new CliError('Nenhum perfil ativo configurado. Crie um perfil com "zenifra profile add" ou autentique com "zenifra auth login".');
   }
   const target = requireExistingProfile(session, targetName);
+  if (target.authMode === 'oauth') {
+    await withProfileLock(SESSION_DIR, async () => {
+      const store = await readCurrentProfileStore();
+      const current = store.profiles[getProfileName(target)];
+      if (current?.authMode !== 'oauth') throw new CliError('Perfil alterado. Repita o logout.');
+      if (flags.revoke) await revokeOAuth(current.oauth, apiBaseUrl(target, flags));
+      Object.assign(current, { oauth: undefined, accessToken: undefined, apiKey: undefined,
+        selectedOrganizationId: undefined, authMode: 'api_key', updatedAt: new Date().toISOString() });
+      session.__store = await saveProfileStore(store);
+      if (target.__profileName === getProfileName(session)) Object.assign(session, buildSession(session.__store));
+    });
+    process.stdout.write(`Autenticacao removida do perfil ${target.__profileName}${flags.revoke ? ' e conexao OAuth revogada' : ''}.\n`);
+    return;
+  }
   if (flags.revoke) {
     if (!target.accessToken) {
       throw new CliError('A revogacao exige um perfil autenticado por login de usuario; API keys devem ser revogadas na organizacao.');
@@ -1920,6 +2080,7 @@ async function handleLogout(session, flags) {
       },
     });
   }
+  target.oauth = undefined;
   target.accessToken = undefined;
   target.apiKey = undefined;
   target.selectedOrganizationId = undefined;
@@ -1942,7 +2103,7 @@ function profileOutput(profile, activeName) {
   return {
     name: profile.name,
     description: profile.description || '',
-    auth_mode: profile.accessToken ? 'access_token' : profile.apiKey ? 'api_key' : profile.authMode || 'api_key',
+    auth_mode: profile.authMode === 'oauth' ? 'oauth' : profile.accessToken ? 'access_token' : profile.apiKey ? 'api_key' : profile.authMode || 'api_key',
     api_base_url: profile.apiBaseUrl || DEFAULT_API_BASE_URL,
     selected_organization_id: profile.selectedOrganizationId,
     has_api_key: Boolean(profile.apiKey),
@@ -3332,6 +3493,9 @@ async function handleProjectCreate(session, flags) {
   const plan = wizardPayload?.plan || flags.plan || await prompt('Plano');
   const paymentMode = wizardPayload?.payment_mode || flags.paymentMode || await prompt('Modo de pagamento');
   const config = wizardPayload?.config || await parseConfig(flags.config || await prompt('Config JSON ou @arquivo'));
+  if (Array.isArray(config?.custom_domains)) {
+    config.custom_domains = normalizeCustomDomains(config.custom_domains, { primaryDomain: config.domain });
+  }
   const typeProject = normalizeTypeProject(config?.type_project);
   const valkeyCatalog = typeProject === 'valkey'
     ? requireValkeyCatalog(unwrapData(await request(session, flags, 'GET', '/managed-services/catalog')))
@@ -3850,6 +4014,118 @@ async function handleProjectAutoscalingEvents(session, flags) {
   printAutoscalingEvents(data);
 }
 
+function publicHealthcheckValue(value) {
+  if (value === undefined || value === null || value === '') return '-';
+  if (typeof value === 'object') return '-';
+  return String(value);
+}
+
+function healthcheckForOutput(data) {
+  if (data?.healthcheck && typeof data.healthcheck === 'object' && !Array.isArray(data.healthcheck)) {
+    return data.healthcheck;
+  }
+  return data || {};
+}
+
+function printHealthcheck(data) {
+  const healthcheck = healthcheckForOutput(data);
+  const rows = [
+    { field: 'Status', value: healthcheck.enabled === true ? 'ativo' : healthcheck.enabled === false ? 'inativo' : 'indisponivel' },
+    { field: 'Rota', value: publicHealthcheckValue(healthcheck.path) },
+    { field: 'Verificacao', value: publicHealthcheckValue(healthcheck.status || healthcheck.state || (healthcheck.enabled ? 'configurada' : 'desativada')) },
+  ];
+  if (healthcheck.last_check_at !== undefined) rows.push({ field: 'Ultima verificacao', value: publicHealthcheckValue(healthcheck.last_check_at) });
+  if (healthcheck.last_failure_at !== undefined) rows.push({ field: 'Ultima falha', value: publicHealthcheckValue(healthcheck.last_failure_at) });
+  printTable(rows, [
+    { label: 'Campo', value: (row) => row.field },
+    { label: 'Valor', value: (row) => row.value },
+  ]);
+}
+
+function validateHealthcheckPath(value) {
+  const path = String(value || '').trim();
+  if (!path.startsWith('/')
+    || path.startsWith('//')
+    || path.includes('?')
+    || path.includes('#')
+    || path.includes('\\')
+    || /\s/.test(path)) {
+    throw new CliError('Informe --path como uma rota absoluta, iniciada por /, sem host, query string ou fragmento.');
+  }
+  return path;
+}
+
+function healthcheckFailuresOf(data) {
+  if (Array.isArray(data)) return data;
+  return Array.isArray(data?.failures) ? data.failures : [];
+}
+
+function printHealthcheckFailures(data) {
+  const failures = healthcheckFailuresOf(data);
+  printTable(failures, [
+    { label: 'Quando', value: (failure) => publicHealthcheckValue(failure.occurred_at || failure.observed_at) },
+    { label: 'Status', value: (failure) => publicHealthcheckValue(failure.status_code) },
+  ]);
+
+  const pagination = data?.pagination;
+  if (pagination && pagination.total_pages === undefined && pagination.pages !== undefined) {
+    printPagination({ ...pagination, total_pages: pagination.pages }, 'falha');
+    return;
+  }
+  printPagination(pagination, 'falha');
+}
+
+async function handleProjectHealthcheckGet(session, flags) {
+  const projectId = requireProjectId(flags, 'project healthcheck get');
+  if (!projectId) return;
+  const orgId = await resolveOrgId(session, flags);
+  const data = unwrapData(await request(session, flags, 'GET', `/project/${projectId}/healthcheck`, { orgId }));
+  if (flags.json) return printJson(data);
+  printHealthcheck(data);
+}
+
+async function handleProjectHealthcheckSet(session, flags) {
+  const projectId = requireProjectId(flags, 'project healthcheck set');
+  if (!projectId) return;
+  if (flags.path === undefined || flags.path === true || flags.path === '') {
+    printCommandHelpAndFail('project healthcheck set');
+    return;
+  }
+  const path = validateHealthcheckPath(flags.path);
+  const orgId = await resolveOrgId(session, flags);
+  const payload = await request(session, flags, 'PATCH', `/project/${projectId}/healthcheck`, {
+    orgId,
+    body: { healthcheck: { enabled: true, path } },
+  });
+  const data = unwrapData(payload);
+  if (flags.json) return printJson(data);
+  process.stdout.write(`Verificacao de saude ativada.\nRota: ${path}\n`);
+}
+
+async function handleProjectHealthcheckDisable(session, flags) {
+  const projectId = requireProjectId(flags, 'project healthcheck disable');
+  if (!projectId) return;
+  const orgId = await resolveOrgId(session, flags);
+  const payload = await request(session, flags, 'PATCH', `/project/${projectId}/healthcheck`, {
+    orgId,
+    body: { healthcheck: { enabled: false } },
+  });
+  const data = unwrapData(payload);
+  if (flags.json) return printJson(data);
+  process.stdout.write('Verificacao de saude desativada.\n');
+}
+
+async function handleProjectHealthcheckFailures(session, flags) {
+  const projectId = requireProjectId(flags, 'project healthcheck failures');
+  if (!projectId) return;
+  validateProjectListFlags(flags, { maxLimit: 100 });
+  const orgId = await resolveOrgId(session, flags);
+  const query = buildQuery(flags, ['page', 'limit']);
+  const data = unwrapData(await request(session, flags, 'GET', `/project/${projectId}/healthcheck/failures${query}`, { orgId }));
+  if (flags.json) return printJson(data);
+  printHealthcheckFailures(data);
+}
+
 async function handleProjectBillingUsage(session, flags) {
   const projectId = requireProjectId(flags, 'project billing usage');
   if (!projectId) return;
@@ -3956,6 +4232,17 @@ async function handleValkeyCredentialStatus(session, flags) {
     `/managed-services/${projectId}/credential-rotations/${flags.operation}`,
     { orgId },
   ));
+  if (flags.connectionFile) {
+    await writeValkeyConnectionFile(String(flags.connectionFile), data.connection_string);
+    if (flags.json) return printJson({
+      operation_id: data.operation_id,
+      state: data.state,
+      connection_saved: true,
+      connection_file: String(flags.connectionFile),
+    });
+    process.stdout.write(`Credencial concluida e salva em ${flags.connectionFile}.\n`);
+    return;
+  }
   if (flags.json) return printJson(data);
   printValkeyRotation(data);
 }
@@ -3978,6 +4265,17 @@ async function handleValkeyCredentialRotate(session, flags) {
 
   if (flags.wait) {
     const completed = await waitForValkeyRotation(session, flags, projectId, accepted.operation_id, orgId);
+    if (flags.connectionFile) {
+      await writeValkeyConnectionFile(String(flags.connectionFile), completed.connection_string);
+      if (flags.json) return printJson({
+        operation_id: completed.operation_id,
+        state: completed.state,
+        connection_saved: true,
+        connection_file: String(flags.connectionFile),
+      });
+      process.stdout.write(`Credencial concluida e salva em ${flags.connectionFile}.\n`);
+      return;
+    }
     if (flags.json) return printJson(completed);
     printValkeyRotation(completed);
     return;
@@ -4221,6 +4519,14 @@ async function main() {
     if (command === 'valkey' && subcommand === 'connection') return handleValkeyConnection(session, flags);
     if (command === 'valkey' && subcommand === 'credentials' && positional[2] === 'rotate') return handleValkeyCredentialRotate(session, flags);
     if (command === 'valkey' && subcommand === 'credentials' && positional[2] === 'status') return handleValkeyCredentialStatus(session, flags);
+    if (command === 'project' && subcommand === 'healthcheck' && positional.length === 2) {
+      process.stdout.write(commandHelp(['project', 'healthcheck']));
+      return;
+    }
+    if (command === 'project' && subcommand === 'healthcheck' && positional[2] === 'get') return handleProjectHealthcheckGet(session, flags);
+    if (command === 'project' && subcommand === 'healthcheck' && positional[2] === 'set') return handleProjectHealthcheckSet(session, flags);
+    if (command === 'project' && subcommand === 'healthcheck' && positional[2] === 'disable') return handleProjectHealthcheckDisable(session, flags);
+    if (command === 'project' && subcommand === 'healthcheck' && positional[2] === 'failures') return handleProjectHealthcheckFailures(session, flags);
     if (command === 'project' && subcommand === 'info') return handleProjectInfo(session, flags);
     if (command === 'project' && subcommand === 'url') return handleProjectUrl(session, flags);
     if (command === 'project' && subcommand === 'logs') return handleProjectLogs(session, flags);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zenifra/cli",
-  "version": "0.2.6",
+  "version": "0.3.1",
   "description": "Official Zenifra command line interface.",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "README.md"
   ],
   "scripts": {
-    "check": "node --check bin/zenifra.mjs && npm run check:staging-autoscaling-regression",
+    "check": "node --check bin/zenifra.mjs && node --check bin/lib/oauth.mjs && node --check bin/lib/oauth-page.mjs && node --check bin/lib/profile-store.mjs && npm run check:staging-autoscaling-regression",
     "check:staging-autoscaling-regression": "node --check scripts/staging-autoscaling-regression.mjs",
     "test:staging:autoscaling": "node scripts/staging-autoscaling-regression.mjs",
     "test": "node --test"