onveloz 0.0.0-beta.39 → 0.0.0-beta.40

package/dist/index.mjs

@@ -34,7 +34,7 @@ const SERVICE_TYPES = [
 	"WORKER",
 	"DATABASE"
 ];
-const BUILD_TIMEOUT_MS = 600 * 1e3;
+const BUILD_TIMEOUT_MS = 2700 * 1e3;
 const DEPLOY_TIMEOUT_MS = 300 * 1e3;
 const DATABASE_PROVISION_TIMEOUT_MS = 300 * 1e3;
 const DATABASE_WAITING_ON_PROVIDER_AFTER_MS = 60 * 1e3;
@@ -307,6 +307,18 @@ const PROJECT_FLAG_DEFINITIONS = {
 	}
 };
 const PROJECT_FLAG_KEYS = Object.keys(PROJECT_FLAG_DEFINITIONS);
+/** All known boolean org flags. Used for validation and UI rendering. */
+const ORGANIZATION_FLAG_DEFINITIONS = {
+	browserApi: {
+		label: "Browser API",
+		description: "Concede a esta organização acesso à API de navegador (sessões de navegador gerenciadas). Sem a flag, o recurso fica restrito a administradores da plataforma."
+	},
+	managedAuth: {
+		label: "Autenticação Gerenciada",
+		description: "Concede a esta organização acesso à Autenticação Gerenciada (login hospedado pela Veloz para os apps do cliente). Sem a flag, o recurso fica restrito a administradores da plataforma."
+	}
+};
+const ORGANIZATION_FLAG_KEYS = Object.keys(ORGANIZATION_FLAG_DEFINITIONS);
 /**
 * Allowlist of user-configurable PostgreSQL parameters with validation bounds.
 * PGTune-relevant params + commonly tuned settings.
@@ -642,7 +654,7 @@ const ServiceConfigSchema = z$1.object({
 const ProjectConfigSchema = z$1.object({
 	id: z$1.string().optional(),
 	name: z$1.string().optional(),
-	slug: z$1.string().regex(/^[a-z0-9-]+$/).optional()
+	slug: z$1.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).optional()
 });
 const ServiceDefaultsSchema = z$1.object({
 	type: ServiceTypeSchema.optional(),
@@ -886,6 +898,44 @@ function getGitBranch() {
 	}
 }
 
+//#endregion
+//#region src/lib/mcp.ts
+const MCP_SERVER_INSTRUCTIONS = [
+	"Use Veloz tools for platform operations and start with read-only discovery tools.",
+	"Before calling a tool annotated as destructive, obtain explicit confirmation for the exact action.",
+	"When a destructive tool accepts userConfirmation, pass the user's confirmation text in that field.",
+	"Deploy is non-blocking: after deploy, poll builds_show until the status is terminal, then use builds_logs when the build fails.",
+	"Treat credentials, API keys, and environment variables as secrets and never expose them unnecessarily."
+].join(" ");
+const MCP_READ_ONLY = { annotations: {
+	readOnlyHint: true,
+	destructiveHint: false,
+	openWorldHint: true
+} };
+const MCP_DESTRUCTIVE = {
+	annotations: {
+		readOnlyHint: false,
+		destructiveHint: true,
+		idempotentHint: false,
+		openWorldHint: true
+	},
+	instructions: "This tool can cause an irreversible or externally visible change. Call it only after the user explicitly confirms the exact action."
+};
+const MCP_CONFIRMATION_REQUIRED = {
+	...MCP_DESTRUCTIVE,
+	instructions: "This tool requires explicit confirmation for the exact action. Pass the user's confirmation text in userConfirmation."
+};
+const MCP_DEPLOY = {
+	description: "Start a Veloz deployment. In MCP mode this returns as soon as the build is queued and does not wait for completion.",
+	annotations: {
+		readOnlyHint: false,
+		destructiveHint: false,
+		idempotentHint: false,
+		openWorldHint: true
+	},
+	instructions: "Read deploymentId from the result, poll builds_show until status is LIVE, BUILD_FAILED, DEPLOY_FAILED, FAILED, or CANCELLED, and call builds_logs when the build fails."
+};
+
 //#endregion
 //#region ../../packages/api/src/client.ts
 function createClient(baseUrl, headers) {
@@ -907,6 +957,16 @@ function createClient(baseUrl, headers) {
 function isMcpMode() {
 	return process.env.VELOZ_MCP === "true";
 }
+/**
+* True when the CLI is being driven by an AI coding agent rather than a human.
+* Covers Claude Code (`CLAUDECODE` / `CLAUDE_CODE_ENTRYPOINT`), generic agent
+* runners (`AI_AGENT`), and MCP mode. Used to skip interactive / nested-AI
+* flows like the `veloz init` wizard — an agent should drive `veloz deploy`
+* directly instead of spawning a second agent inside the CLI.
+*/
+function isAiAgent() {
+	return isMcpMode() || Boolean(process.env.CLAUDECODE) || Boolean(process.env.CLAUDE_CODE_ENTRYPOINT) || Boolean(process.env.AI_AGENT);
+}
 /** Write a line to the safe output stream (stderr in MCP mode, stdout otherwise). */
 function log(message) {
 	if (isMcpMode()) process.stderr.write(`${message}\n`);
@@ -1154,6 +1214,7 @@ async function performLogin(apiUrl) {
 function registerLogin(cli$1) {
 	cli$1.command("login", {
 		description: "Autenticar na plataforma Veloz",
+		mcp: false,
 		options: z.object({
 			apiUrl: z.string().optional().describe("URL da API Veloz"),
 			apiKey: z.string().optional().describe("Chave de API (para CI/automação)")
@@ -1185,6 +1246,7 @@ function registerLogin(cli$1) {
 	});
 	cli$1.command("logout", {
 		description: "Encerrar sessão na plataforma Veloz",
+		mcp: false,
 		output: z.object({ loggedOut: z.boolean() }),
 		run() {
 			if (!isAuthenticated()) {
@@ -1273,7 +1335,7 @@ async function requireAuth(options) {
 
 //#endregion
 //#region src/lib/client.ts
-const CLI_VERSION = "0.0.0-beta.39";
+const CLI_VERSION = "0.0.0-beta.40";
 const USER_AGENT = `veloz-cli/${CLI_VERSION}`;
 /**
 * Client source — "cli" by default; the init wizard sets this to "cli-wizard"
@@ -1353,6 +1415,7 @@ const requireAuth$1 = middleware(async (c, next) => {
 const projectsGroup = Cli.create("projects", { description: "Gerenciar projetos" });
 projectsGroup.command("list", {
 	description: "Listar todos os projetos",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	output: z.object({ items: z.array(z.object({
 		id: z.string(),
@@ -1386,6 +1449,7 @@ projectsGroup.command("list", {
 const orgsGroup = Cli.create("orgs", { description: "Gerenciar workspaces (organizações) do usuário" });
 orgsGroup.command("list", {
 	description: "Listar workspaces que você pertence",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	output: z.object({ items: z.array(z.object({
 		id: z.string(),
@@ -1933,6 +1997,7 @@ async function resolveProjectId(projectFlag) {
 const envGroup = Cli.create("env", { description: "Gerenciar variáveis de ambiente. Valores suportam interpolação no deploy: ${OUTRA_VAR} referencia outra variável do mesmo serviço (inclui vars auto-injetadas como DATABASE_URL/REDIS_URL/PORT/NODE_ENV); $${LITERAL} preserva um ${...} literal; ${{servico.propriedade}} referencia outro serviço (ex: ${{postgres.url}})." });
 envGroup.command("list", {
 	description: "Listar variáveis de ambiente",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Filtrar por serviço (chave ou nome)"),
@@ -2040,6 +2105,7 @@ envGroup.command("set", {
 });
 envGroup.command("delete", {
 	description: "Remover variável de ambiente",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ chave: z.string().describe("Chave da variável de ambiente") }),
 	options: z.object({
@@ -2073,6 +2139,7 @@ envGroup.command("delete", {
 });
 envGroup.command("import", {
 	description: "Importar variáveis de ambiente de um arquivo .env ou colar diretamente. Valores com ${OUTRA_VAR} são salvos como referência e resolvidos no deploy (contra as outras vars do serviço, incluindo auto-injetadas). Use $${LITERAL} para preservar.",
+	mcp: false,
 	middleware: [requireAuth$1],
 	args: z.object({ arquivo: z.string().optional().describe("Caminho do arquivo .env") }),
 	options: z.object({
@@ -2165,6 +2232,7 @@ envGroup.command("import", {
 });
 envGroup.command("export", {
 	description: "Exportar variáveis de ambiente para um arquivo .env",
+	mcp: false,
 	middleware: [requireAuth$1],
 	args: z.object({ arquivo: z.string().optional().describe("Caminho do arquivo de saída") }),
 	options: z.object({
@@ -2235,6 +2303,7 @@ function printDnsRecords(records) {
 const domainsGroup = Cli.create("domains", { description: "Gerenciar domínios personalizados" });
 domainsGroup.command("list", {
 	description: "Listar domínios dos serviços",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Filtrar por serviço (chave ou nome)"),
@@ -2362,12 +2431,13 @@ domainsGroup.command("verify", {
 });
 domainsGroup.command("search", {
 	description: "Buscar domínios disponíveis para registro",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ query: z.string().describe("Nome do domínio a buscar (ex: meusite)") }),
-	output: z.array(z.object({
+	output: z.object({ items: z.array(z.object({
 		domain: z.string(),
 		available: z.boolean()
-	})),
+	})) }),
 	async run(c) {
 		const client = await getClient();
 		const results = await withSpinner({
@@ -2376,17 +2446,18 @@ domainsGroup.command("search", {
 		});
 		if (results.length === 0) {
 			info("Nenhum resultado encontrado.");
-			return [];
+			return { items: [] };
 		}
 		for (const r of results) {
 			const status = r.available ? chalk.green("Disponível") : chalk.red("Indisponível");
 			console.log(`  ${chalk.bold(r.domain.padEnd(30))} ${status}`);
 		}
-		return results;
+		return { items: results };
 	}
 });
 domainsGroup.command("buy", {
 	description: "Registrar um domínio",
+	mcp: MCP_DESTRUCTIVE,
 	middleware: [requireAuth$1],
 	args: z.object({ dominio: z.string().describe("Domínio a registrar (ex: meusite.com)") }),
 	options: z.object({ service: z.string().optional().describe("Conectar ao serviço automaticamente") }),
@@ -2417,13 +2488,14 @@ domainsGroup.command("buy", {
 });
 domainsGroup.command("purchased", {
 	description: "Listar domínios registrados",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
-	output: z.array(z.object({
+	output: z.object({ items: z.array(z.object({
 		id: z.string(),
 		domain: z.string(),
 		status: z.string(),
 		expiresAt: z.string().nullable()
-	})),
+	})) }),
 	async run() {
 		const client = await getClient();
 		const purchased = await withSpinner({
@@ -2432,9 +2504,9 @@ domainsGroup.command("purchased", {
 		});
 		if (purchased.length === 0) {
 			info("Nenhum domínio registrado.");
-			return [];
+			return { items: [] };
 		}
-		const statusLabels$1 = {
+		const statusLabels$2 = {
 			REGISTERING: chalk.yellow("Registrando"),
 			PROPAGATING: chalk.yellow("Propagando DNS"),
 			ACTIVE: chalk.green("Ativo"),
@@ -2442,20 +2514,21 @@ domainsGroup.command("purchased", {
 			EXPIRED: chalk.red("Expirado")
 		};
 		for (const d of purchased) {
-			const status = statusLabels$1[d.status] ?? d.status;
+			const status = statusLabels$2[d.status] ?? d.status;
 			const expires = d.expiresAt ? new Date(d.expiresAt).toLocaleDateString("pt-BR") : "—";
 			console.log(`  ${d.id}  ${chalk.bold(d.domain.padEnd(30))} ${status}  Expira: ${expires}`);
 		}
-		return purchased.map((d) => ({
+		return { items: purchased.map((d) => ({
 			id: d.id,
 			domain: d.domain,
 			status: d.status,
 			expiresAt: d.expiresAt ? new Date(d.expiresAt).toISOString() : null
-		}));
+		})) };
 	}
 });
 domainsGroup.command("delete", {
 	description: "Remover domínio",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ domainId: z.string().describe("ID do domínio") }),
 	options: z.object({ userConfirmation: z.string().optional() }),
@@ -2474,6 +2547,237 @@ domainsGroup.command("delete", {
 	}
 });
 
+//#endregion
+//#region src/commands/email.ts
+const statusLabels$1 = {
+	PENDING: chalk.yellow("Pendente"),
+	VERIFYING: chalk.yellow("Verificando"),
+	ACTIVE: chalk.green("Ativo"),
+	FAILED: chalk.red("Falhou")
+};
+async function getEmailClient() {
+	return (await getClient()).email;
+}
+function printDkimRecords(records) {
+	if (records.length === 0) return;
+	console.log();
+	console.log(chalk.yellow.bold("  Registros DNS a publicar (DKIM):"));
+	for (const r of records) console.log(`    ${chalk.cyan(r.type.padEnd(5))} ${chalk.white(r.name)}  →  ${chalk.white(r.value)}`);
+	console.log();
+	console.log(chalk.dim("  Após publicar, rode `veloz email verify <id>` para confirmar a verificação."));
+	console.log();
+}
+const emailGroup = Cli.create("email", {
+	description: "Gerenciar envio de e-mail transacional",
+	aliases: ["emails"]
+});
+emailGroup.command("list", {
+	description: "Listar domínios remetentes",
+	mcp: MCP_READ_ONLY,
+	middleware: [requireAuth$1],
+	output: z.object({ items: z.array(z.object({
+		id: z.string(),
+		domain: z.string(),
+		status: z.string(),
+		emailsSentThisPeriod: z.number()
+	})) }),
+	async run() {
+		const spin = spinner("Carregando domínios de e-mail...");
+		const domains = await (await getEmailClient()).listDomains();
+		spin.stop();
+		if (domains.length === 0) {
+			info("Nenhum domínio remetente configurado. Use `veloz email add <domínio>`.");
+			return { items: [] };
+		}
+		for (const d of domains) console.log(`  ${d.id}  ${chalk.bold(d.domain.padEnd(30))} ${statusLabels$1[d.status] ?? d.status}  ${chalk.dim(`${d.emailsSentThisPeriod} enviados`)}`);
+		return { items: domains.map((d) => ({
+			id: d.id,
+			domain: d.domain,
+			status: d.status,
+			emailsSentThisPeriod: d.emailsSentThisPeriod
+		})) };
+	}
+});
+emailGroup.command("add", {
+	description: "Registrar um domínio remetente",
+	middleware: [requireAuth$1],
+	args: z.object({ dominio: z.string().describe("Domínio remetente (ex: mail.meusite.com)") }),
+	async run(c) {
+		const email = await getEmailClient();
+		const result$2 = await withSpinner({
+			text: `Registrando ${chalk.bold(c.args.dominio)}...`,
+			fn: () => email.provisionDomain({ domain: c.args.dominio })
+		});
+		success(`Domínio ${chalk.bold(result$2.domain)} registrado!`);
+		printDkimRecords(result$2.dkimRecords);
+		return c.ok({
+			id: result$2.id,
+			domain: result$2.domain,
+			status: result$2.status,
+			dkimRecords: result$2.dkimRecords
+		}, { cta: { commands: [{
+			command: `email verify ${result$2.id}`,
+			description: "Verificar configuração DKIM"
+		}, {
+			command: "email list",
+			description: "Listar domínios remetentes"
+		}] } });
+	}
+});
+emailGroup.command("verify", {
+	description: "Verificar a configuração DKIM de um domínio remetente",
+	middleware: [requireAuth$1],
+	args: z.object({ emailDomainId: z.string().describe("ID do domínio remetente") }),
+	async run(c) {
+		const email = await getEmailClient();
+		const result$2 = await withSpinner({
+			text: "Verificando DKIM...",
+			fn: () => email.verifyDomain({ emailDomainId: c.args.emailDomainId })
+		});
+		if (result$2.ready) success(`Domínio ${chalk.bold(result$2.domain.domain)} verificado e pronto para enviar!`);
+		else {
+			console.log(chalk.yellow(`\n⚠ ${chalk.bold(result$2.domain.domain)} ainda não verificado (${result$2.domain.status}).`));
+			if (result$2.domain.dkimRecords.length > 0) {
+				info("Confirme que os registros DKIM abaixo estão publicados:");
+				printDkimRecords(result$2.domain.dkimRecords);
+			}
+		}
+		return {
+			ready: result$2.ready,
+			domain: result$2.domain.domain,
+			status: result$2.domain.status
+		};
+	}
+});
+emailGroup.command("remove", {
+	description: "Remover um domínio remetente",
+	mcp: MCP_CONFIRMATION_REQUIRED,
+	middleware: [requireAuth$1],
+	args: z.object({ emailDomainId: z.string().describe("ID do domínio remetente") }),
+	options: z.object({ userConfirmation: z.string().optional() }),
+	async run(c) {
+		requireMcpConfirmation(c.options.userConfirmation, `remover domínio remetente "${c.args.emailDomainId}"`);
+		const email = await getEmailClient();
+		await withSpinner({
+			text: "Removendo domínio...",
+			fn: () => email.deleteDomain({ emailDomainId: c.args.emailDomainId })
+		});
+		success("Domínio remetente removido.");
+		return {
+			deleted: true,
+			emailDomainId: c.args.emailDomainId
+		};
+	}
+});
+emailGroup.command("send", {
+	description: "Enviar um e-mail transacional",
+	mcp: MCP_DESTRUCTIVE,
+	middleware: [requireAuth$1],
+	options: z.object({
+		from: z.string().describe("Endereço remetente (em um domínio verificado)"),
+		to: z.string().describe("Destinatário"),
+		subject: z.string().describe("Assunto"),
+		text: z.string().optional().describe("Corpo em texto puro"),
+		html: z.string().optional().describe("Corpo em HTML")
+	}),
+	output: z.object({ messageId: z.string() }),
+	async run(c) {
+		if (!c.options.text && !c.options.html) {
+			info("Informe --text e/ou --html com o corpo do e-mail.");
+			return { messageId: "" };
+		}
+		const email = await getEmailClient();
+		const result$2 = await withSpinner({
+			text: `Enviando e-mail para ${chalk.bold(c.options.to)}...`,
+			fn: () => email.send({
+				from: c.options.from,
+				to: [c.options.to],
+				subject: c.options.subject,
+				text: c.options.text,
+				html: c.options.html
+			})
+		});
+		success(`E-mail enviado (id: ${chalk.dim(result$2.messageId)}).`);
+		return result$2;
+	}
+});
+emailGroup.command("keys", {
+	description: "Listar chaves de API de e-mail (vmail_*)",
+	mcp: MCP_READ_ONLY,
+	middleware: [requireAuth$1],
+	output: z.object({ items: z.array(z.object({
+		id: z.string(),
+		name: z.string().nullable(),
+		prefix: z.string().nullable(),
+		start: z.string().nullable()
+	})) }),
+	async run() {
+		const email = await getEmailClient();
+		const keys$1 = await withSpinner({
+			text: "Carregando chaves...",
+			fn: () => email.listApiKeys()
+		});
+		if (keys$1.length === 0) {
+			info("Nenhuma chave de e-mail. Use `veloz email key-create <nome>`.");
+			return { items: [] };
+		}
+		for (const k of keys$1) {
+			const masked = k.start ? `${k.prefix ?? "vmail"}_${k.start}…` : k.prefix ?? "vmail";
+			console.log(`  ${k.id}  ${chalk.bold(k.name ?? "—")}  ${chalk.dim(masked)}`);
+		}
+		return { items: keys$1.map((k) => ({
+			id: k.id,
+			name: k.name,
+			prefix: k.prefix,
+			start: k.start
+		})) };
+	}
+});
+emailGroup.command("key-create", {
+	description: "Criar uma chave de API de e-mail (vmail_*)",
+	middleware: [requireAuth$1],
+	args: z.object({ nome: z.string().describe("Nome da chave") }),
+	output: z.object({
+		id: z.string(),
+		name: z.string(),
+		key: z.string()
+	}),
+	async run(c) {
+		const email = await getEmailClient();
+		const created = await withSpinner({
+			text: "Criando chave...",
+			fn: () => email.createApiKey({ name: c.args.nome })
+		});
+		success("Chave criada. Copie agora — ela não será exibida novamente:");
+		console.log(`\n  ${chalk.bold(created.key)}\n`);
+		return {
+			id: created.id,
+			name: created.name,
+			key: created.key
+		};
+	}
+});
+emailGroup.command("key-revoke", {
+	description: "Revogar uma chave de API de e-mail",
+	mcp: MCP_CONFIRMATION_REQUIRED,
+	middleware: [requireAuth$1],
+	args: z.object({ keyId: z.string().describe("ID da chave") }),
+	options: z.object({ userConfirmation: z.string().optional() }),
+	async run(c) {
+		requireMcpConfirmation(c.options.userConfirmation, `revogar chave "${c.args.keyId}"`);
+		const email = await getEmailClient();
+		await withSpinner({
+			text: "Revogando chave...",
+			fn: () => email.revokeApiKey({ keyId: c.args.keyId })
+		});
+		success("Chave revogada.");
+		return {
+			revoked: true,
+			keyId: c.args.keyId
+		};
+	}
+});
+
 //#endregion
 //#region src/lib/volume-config.ts
 function updateServiceVolumesInConfig(serviceKey, updater) {
@@ -2528,6 +2832,7 @@ async function promptAndSyncDeployment(serviceId) {
 const volumesGroup = Cli.create("volumes", { description: "Gerenciar volumes persistentes" });
 volumesGroup.command("list", {
 	description: "Listar volumes dos serviços",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Filtrar por serviço (chave ou nome)"),
@@ -2669,6 +2974,7 @@ volumesGroup.command("expand", {
 });
 volumesGroup.command("delete", {
 	description: "Remover um volume do serviço (dados mantidos por 30 dias)",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ volume: z.string().describe("Nome ou ID do volume") }),
 	options: z.object({
@@ -2801,6 +3107,7 @@ function printServiceConfig(service$2) {
 const configGroup = Cli.create("config", { description: "Gerenciar configuração de serviços" });
 configGroup.command("show", {
 	description: "Mostrar configurações atuais dos serviços",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Filtrar por serviço (chave ou nome)"),
@@ -2917,6 +3224,7 @@ configGroup.command("set", {
 });
 configGroup.command("edit", {
 	description: "Editar configurações interativamente",
+	mcp: false,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Serviço alvo (chave ou nome)"),
@@ -2978,6 +3286,7 @@ configGroup.command("edit", {
 });
 configGroup.command("reset", {
 	description: "Resetar configurações para os padrões",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	options: z.object({
 		build: z.boolean().default(false).describe("Resetar comando de build"),
@@ -3097,6 +3406,7 @@ apikeyGroup.command("create", {
 });
 apikeyGroup.command("list", {
 	description: "Listar chaves de API",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	output: z.object({ items: z.array(z.object({
 		name: z.string(),
@@ -3124,6 +3434,7 @@ apikeyGroup.command("list", {
 });
 apikeyGroup.command("delete", {
 	description: "Deletar uma chave de API",
+	mcp: MCP_DESTRUCTIVE,
 	middleware: [requireAuth$1],
 	args: z.object({ keyId: z.string().describe("ID da chave de API") }),
 	output: z.object({ deleted: z.boolean() }),
@@ -3201,6 +3512,7 @@ function parseDatabaseEngine(value) {
 const dbGroup = Cli.create("db", { description: "Gerenciar bancos de dados" });
 dbGroup.command("list", {
 	description: "Listar bancos de dados do projeto",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({ project: z.string().optional().describe("Projeto (nome, slug ou ID)") }),
 	output: z.object({ items: z.array(z.object({
@@ -3342,6 +3654,7 @@ dbGroup.command("create", {
 });
 dbGroup.command("credentials", {
 	description: "Exibir credenciais de um banco de dados",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ name: z.string().describe("Nome ou ID do banco de dados") }),
 	options: z.object({ project: z.string().optional().describe("Projeto (nome, slug ou ID)") }),
@@ -3351,7 +3664,9 @@ dbGroup.command("credentials", {
 		username: z.string(),
 		password: z.string(),
 		database: z.string(),
-		connectionUrl: z.string()
+		connectionUrl: z.string(),
+		poolerUrl: z.string().nullable(),
+		poolerPort: z.number().nullable()
 	}),
 	async run(c) {
 		const db = await resolveDatabaseByName(await getProjectId(c.options.project), c.args.name);
@@ -3367,12 +3682,14 @@ dbGroup.command("credentials", {
 		console.log(`  ${chalk.dim("Senha:")}      ${creds.password}`);
 		console.log(`  ${chalk.dim("Banco:")}      ${creds.database}`);
 		console.log(`  ${chalk.dim("URL:")}        ${creds.connectionUrl}`);
+		if (creds.poolerUrl) console.log(`  ${chalk.dim("URL (pooler):")} ${creds.poolerUrl}`);
 		console.log();
 		return creds;
 	}
 });
 dbGroup.command("delete", {
 	description: "Excluir um banco de dados",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ name: z.string().describe("Nome ou ID do banco de dados") }),
 	options: z.object({
@@ -3426,6 +3743,7 @@ dbGroup.command("delete", {
 });
 dbGroup.command("restart", {
 	description: "Reiniciar um banco de dados",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ name: z.string().describe("Nome ou ID do banco de dados") }),
 	options: z.object({
@@ -3609,6 +3927,7 @@ dbGroup.command("update", {
 });
 dbGroup.command("query", {
 	description: "Executar uma consulta no banco de dados",
+	mcp: MCP_DESTRUCTIVE,
 	middleware: [requireAuth$1],
 	args: z.object({ name: z.string().describe("Nome ou ID do banco de dados") }),
 	options: z.object({
@@ -3666,11 +3985,13 @@ const ENGINE_CONNECT_HINTS = {
 };
 dbGroup.command("tunnel", {
 	description: "Criar túnel local para um banco de dados",
+	mcp: false,
 	middleware: [requireAuth$1],
 	args: z.object({ name: z.string().describe("Nome ou ID do banco de dados") }),
 	options: z.object({
 		project: z.string().optional().describe("Projeto (nome, slug ou ID)"),
-		port: z.number().optional().describe("Porta local (padrão: porta do engine)")
+		port: z.number().optional().describe("Porta local (padrão: porta do engine)"),
+		pooler: z.boolean().optional().describe("Conectar via PgBouncer (pooling de transações) em vez de conexão direta")
 	}),
 	alias: { port: "p" },
 	async run(c) {
@@ -3688,7 +4009,10 @@ dbGroup.command("tunnel", {
 		const server = net.createServer(async (socket) => {
 			let session;
 			try {
-				session = await client.databases.createTunnelSession({ serviceId: db.id });
+				session = await client.databases.createTunnelSession({
+					serviceId: db.id,
+					pooler: c.options.pooler
+				});
 			} catch (err) {
 				const message = err instanceof Error ? err.message : "Erro desconhecido";
 				console.log(chalk.red(`  Falha ao criar sessão de túnel: ${message}`));
@@ -3732,7 +4056,7 @@ dbGroup.command("tunnel", {
 		});
 		server.listen(localPort, "127.0.0.1", () => {
 			console.log();
-			success(`Túnel ${engineLabel} ativo para ${chalk.bold(db.name)}`);
+			success(`Túnel ${engineLabel} ativo para ${chalk.bold(db.name)}${c.options.pooler ? chalk.dim(" (pooler)") : ""}`);
 			console.log();
 			console.log(`  ${chalk.dim("Endereço local:")}  ${chalk.bold(`127.0.0.1:${localPort}`)}`);
 			console.log(`  ${chalk.dim("URL de conexão:")} ${chalk.cyan(localUrl)}`);
@@ -3759,6 +4083,7 @@ dbGroup.command("tunnel", {
 });
 dbGroup.command("config", {
 	description: "Ver ou alterar configuração do PostgreSQL",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ name: z.string().describe("Nome ou ID do banco de dados") }),
 	options: z.object({
@@ -3874,6 +4199,7 @@ dbGroup.command("config", {
 const templateGroup = Cli.create("template", { description: "Gerenciar templates de deploy" });
 templateGroup.command("list", {
 	description: "Listar templates disponíveis",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	output: z.object({ items: z.array(z.object({
 		slug: z.string(),
@@ -3910,6 +4236,7 @@ templateGroup.command("list", {
 });
 templateGroup.command("deploy", {
 	description: "Fazer deploy de um template (cria um novo projeto automaticamente)",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ slug: z.string().describe("Slug do template (ex: n8n, metabase)") }),
 	options: z.object({
@@ -3971,6 +4298,36 @@ templateGroup.command("deploy", {
 	}
 });
 
+//#endregion
+//#region src/lib/retry.ts
+async function withRetry(fn$2, maxRetries = 3) {
+	let orgSwitched = false;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await fn$2();
+	} catch (error) {
+		if (!orgSwitched && isOrgMismatchError(error)) {
+			if (applyOrgMismatchSwitch(error)) {
+				orgSwitched = true;
+				continue;
+			}
+		}
+		if (attempt >= maxRetries) throw error;
+		const rateLimit = isRateLimitError(error);
+		if (rateLimit) {
+			const waitMs = Math.min(rateLimit.retryAfterMs, 3e4);
+			await new Promise((r) => {
+				setTimeout(r, waitMs);
+			});
+		} else {
+			const delay$2 = Math.min(1e3 * Math.pow(2, attempt), 1e4);
+			await new Promise((r) => {
+				setTimeout(r, delay$2);
+			});
+		}
+	}
+	throw new Error("Max retries exceeded");
+}
+
 //#endregion
 //#region src/commands/services.ts
 const servicesGroup = Cli.create("services", {
@@ -3979,6 +4336,7 @@ const servicesGroup = Cli.create("services", {
 });
 servicesGroup.command("list", {
 	description: "Listar serviços do projeto",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({ project: z.string().optional().describe("Projeto (nome, slug ou ID)") }),
 	output: z.object({ items: z.array(z.object({
@@ -3998,7 +4356,7 @@ servicesGroup.command("list", {
 		const services = await withSpinner({
 			text: "Carregando serviços...",
 			fn: async () => {
-				return (await Promise.all([...projectIds].map((pid) => client.services.list({ projectId: pid })))).flat();
+				return (await Promise.all([...projectIds].map((pid) => withRetry(() => client.services.list({ projectId: pid }))))).flat();
 			}
 		});
 		if (services.length === 0) {
@@ -4015,6 +4373,7 @@ servicesGroup.command("list", {
 });
 servicesGroup.command("delete", {
 	description: "Deletar um serviço",
+	mcp: MCP_CONFIRMATION_REQUIRED,
 	middleware: [requireAuth$1],
 	args: z.object({ service: z.string().optional().describe("Nome ou ID do serviço") }),
 	options: z.object({
@@ -4033,7 +4392,7 @@ servicesGroup.command("delete", {
 		const services = await withSpinner({
 			text: "Carregando serviços...",
 			fn: async () => {
-				return (await Promise.all([...projectIds].map((pid) => client.services.list({ projectId: pid })))).flat();
+				return (await Promise.all([...projectIds].map((pid) => withRetry(() => client.services.list({ projectId: pid }))))).flat();
 			}
 		});
 		if (services.length === 0) {
@@ -4067,7 +4426,7 @@ servicesGroup.command("delete", {
 		}
 		await withSpinner({
 			text: `Deletando serviço "${serviceToDelete.name}"...`,
-			fn: () => client.services.delete({ serviceId: serviceToDelete.id })
+			fn: () => withRetry(() => client.services.delete({ serviceId: serviceToDelete.id }))
 		});
 		success(`Serviço "${serviceToDelete.name}" deletado com sucesso!`);
 		return c.ok({
@@ -4197,6 +4556,7 @@ function printInsightsHint() {
 const metricsGroup = Cli.create("metrics", { description: "Visualizar métricas dos serviços" });
 metricsGroup.command("show", {
 	description: "Exibir métricas atuais do serviço",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Filtrar por serviço ou banco de dados"),
@@ -4311,6 +4671,7 @@ metricsGroup.command("show", {
 });
 metricsGroup.command("range", {
 	description: "Exibir métricas em intervalo de tempo com sparklines",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Filtrar por serviço ou banco de dados"),
@@ -4388,6 +4749,7 @@ metricsGroup.command("range", {
 });
 metricsGroup.command("query", {
 	description: "Executar consulta MetricsQL personalizada",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ query: z.string().describe("Consulta MetricsQL (ex: up, rate(http_requests[5m]))") }),
 	options: z.object({
@@ -4468,6 +4830,7 @@ metricsGroup.command("query", {
 });
 metricsGroup.command("list", {
 	description: "Listar nomes de métricas disponíveis",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		match: z.string().optional().describe("Filtrar por seletor (ex: \"{job=\\\"node\\\"}\", \"traefik_.*\")"),
@@ -4501,6 +4864,7 @@ metricsGroup.command("list", {
 });
 metricsGroup.command("labels", {
 	description: "Listar labels disponíveis ou valores de um label específico",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		label: z.string().optional().describe("Nome do label para listar valores (ex: pod, namespace)"),
@@ -4540,6 +4904,7 @@ metricsGroup.command("labels", {
 });
 metricsGroup.command("series", {
 	description: "Encontrar séries de métricas por seletor",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ match: z.string().describe("Seletor de séries (ex: \"traefik_service_requests_total\", '{__name__=~\"pg_.*\"}')") }),
 	options: z.object({ limit: z.number().default(100).describe("Número máximo de séries") }),
@@ -4806,6 +5171,7 @@ const QUERY_HELP_SECTIONS$1 = [
 ];
 metricsGroup.command("query-help", {
 	description: "Referência de MetricsQL para consultas de métricas",
+	mcp: MCP_READ_ONLY,
 	outputPolicy: "agent-only",
 	output: z.object({ sections: z.array(z.object({
 		title: z.string(),
@@ -4832,6 +5198,7 @@ metricsGroup.command("query-help", {
 });
 metricsGroup.command("help", {
 	description: "Referência de métricas disponíveis e seus campos",
+	mcp: MCP_READ_ONLY,
 	outputPolicy: "agent-only",
 	output: z.object({ sections: z.array(z.object({
 		title: z.string(),
@@ -4920,6 +5287,10 @@ async function fetchRecent(services, maxNameLen, tailLines) {
 const logsGroup = Cli.create("logs", { description: "Visualizar logs dos serviços" });
 logsGroup.command("show", {
 	description: "Visualizar logs recentes ou acompanhar em tempo real",
+	mcp: {
+		...MCP_READ_ONLY,
+		instructions: "Never call this tool with follow=true in MCP mode because it opens a long-lived log stream. Use follow=false and poll again when fresh logs are needed."
+	},
 	middleware: [requireAuth$1],
 	options: z.object({
 		follow: z.boolean().optional().describe("Acompanhar logs em tempo real"),
@@ -4932,6 +5303,10 @@ logsGroup.command("show", {
 		tail: "n"
 	},
 	async run(c) {
+		if (c.options.follow && isMcpMode()) return c.error({
+			code: "MCP_FOLLOW_UNSUPPORTED",
+			message: "Long-lived log streaming is not supported over MCP. Use follow=false and poll again for fresh logs."
+		});
 		const spin = spinner("Carregando logs...");
 		const { services, maxNameLen } = await resolveAllServices(c.options.service, c.options.project);
 		const tailLines = c.options.tail;
@@ -4951,6 +5326,7 @@ logsGroup.command("show", {
 });
 logsGroup.command("search", {
 	description: "Pesquisar logs com consultas LogsQL",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ query: z.string().default("").describe("Consulta LogsQL (ex: error, ~\"regex\", field:value)") }),
 	options: z.object({
@@ -5141,6 +5517,7 @@ const QUERY_HELP_SECTIONS = [
 ];
 logsGroup.command("query-help", {
 	description: "Referência de sintaxe LogsQL para pesquisa de logs",
+	mcp: MCP_READ_ONLY,
 	outputPolicy: "agent-only",
 	output: z.object({ sections: z.array(z.object({
 		title: z.string(),
@@ -5177,6 +5554,7 @@ logsGroup.command("query-help", {
 const githubGroup = Cli.create("github", { description: "Gerenciar integração com GitHub" });
 githubGroup.command("setup", {
 	description: "Configurar GitHub App para deploy automático via webhook",
+	mcp: false,
 	middleware: [requireAuth$1],
 	options: z.object({ project: z.string().optional().describe("ID do projeto a conectar") }),
 	alias: { project: "p" },
@@ -5321,6 +5699,7 @@ githubGroup.command("setup", {
 });
 githubGroup.command("status", {
 	description: "Verificar status da integração GitHub do projeto",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	output: z.object({
 		connected: z.boolean(),
@@ -5436,7 +5815,7 @@ const TERMINAL_STATUSES = new Set([
 
 //#endregion
 //#region src/lib/deploy-stream.ts
-const DASHBOARD_BASE$1 = process.env.VELOZ_WEB_URL || "https://app.onveloz.com";
+const DASHBOARD_BASE$2 = process.env.VELOZ_WEB_URL || "https://app.onveloz.com";
 /**
 * Fetch deployment details from the API and enrich a DeployStreamResult
 * with metadata useful for agents (failReason, commit info, duration, dashboard link).
@@ -5452,7 +5831,7 @@ async function enrichResult(client, result$2) {
 		result$2.branch = d.branch ?? null;
 		if (d.startedAt && d.finishedAt) result$2.durationSeconds = Math.round((new Date(d.finishedAt).getTime() - new Date(d.startedAt).getTime()) / 1e3);
 		if (projectId) {
-			result$2.dashboardUrl = `${DASHBOARD_BASE$1}/projetos/${projectId}/servicos/${d.serviceId}/deploys/${d.id}`;
+			result$2.dashboardUrl = `${DASHBOARD_BASE$2}/projetos/${projectId}/servicos/${d.serviceId}/deploys/${d.id}`;
 			const project = await client.projects.get({ projectId }).catch(() => null);
 			if (project) result$2.organizationId = project.organizationId ?? null;
 		}
@@ -5613,6 +5992,8 @@ async function streamDeploymentLogs(deploymentId, serviceId, serviceName) {
 		process.stdout.write(`${header}\n`);
 	}
 	let finalStatus = "";
+	let finalErrorSummary = null;
+	let finalFailReason = null;
 	try {
 		const stream = await client.logs.streamBuildLogs({ deploymentId });
 		for await (const event of stream) if (event.type === "status") {
@@ -5632,7 +6013,10 @@ async function streamDeploymentLogs(deploymentId, serviceId, serviceName) {
 		}
 	} catch {
 		try {
-			finalStatus = (await client.deployments.get({ deploymentId })).status;
+			const d = await client.deployments.get({ deploymentId });
+			finalStatus = d.status;
+			finalErrorSummary = d.errorSummary ?? finalErrorSummary;
+			finalFailReason = d.failReason ?? finalFailReason;
 			try {
 				const logs = await client.logs.getBuildLogs({ deploymentId });
 				if (logs.buildLogs) allLogLines.push(...logs.buildLogs.split("\n"));
@@ -5640,8 +6024,12 @@ async function streamDeploymentLogs(deploymentId, serviceId, serviceName) {
 		} catch {}
 	}
 	if (!TERMINAL_STATUSES.has(finalStatus)) try {
-		finalStatus = (await client.deployments.get({ deploymentId })).status;
+		const d = await client.deployments.get({ deploymentId });
+		finalStatus = d.status;
+		finalErrorSummary = d.errorSummary ?? finalErrorSummary;
+		finalFailReason = d.failReason ?? finalFailReason;
 	} catch {}
+	const finalReason = finalErrorSummary ?? finalFailReason;
 	if (isGHA) endGroup();
 	const urls = finalStatus === "LIVE" ? await fetchDeployUrls$1(client, serviceId) : [];
 	if (finalStatus === "LIVE") {
@@ -5652,6 +6040,7 @@ async function streamDeploymentLogs(deploymentId, serviceId, serviceName) {
 		const hints = getFailureHints$1(finalStatus);
 		if (mcp) {
 			log(`✗ Deploy finalizou: ${label}`);
+			if (finalReason) log(`Motivo: ${finalReason}`);
 			for (const line of allLogLines) if (line.trim()) log(`[build] ${line.trim()}`);
 			for (const hint of hints) log(`  → ${hint}`);
 		} else if (isTTY && allLogLines.length > 0) {
@@ -5664,11 +6053,12 @@ async function streamDeploymentLogs(deploymentId, serviceId, serviceName) {
 		}
 		if (isGHA) {
 			const msg = serviceName ? `Deploy de ${serviceName} finalizou com status: ${label}` : `Deploy finalizou com status: ${label}`;
-			process.stdout.write(`::error::${msg}\n`);
+			process.stdout.write(`::error::${finalReason ? `${msg} — ${finalReason}` : msg}\n`);
 			for (const hint of hints) process.stdout.write(`  ${hint}\n`);
 		} else if (!mcp) {
 			const errorMsg = serviceName ? `Deploy de ${chalk.bold(serviceName)} finalizou: ${label}` : `Deploy finalizou: ${label}`;
 			console.error(chalk.red(`\n✗ ${errorMsg}`));
+			if (finalReason) console.error(chalk.red(`  ${chalk.bold("Motivo:")} ${finalReason}`));
 			for (const hint of hints) console.error(chalk.yellow(`  → ${hint}`));
 			console.error(chalk.yellow(`  → Use 'veloz builds logs ${deploymentId}' para ver os logs completos`));
 		}
@@ -5729,6 +6119,7 @@ const buildsGroup = Cli.create("builds", {
 });
 buildsGroup.command("list", {
 	description: "Listar builds recentes de um serviço",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	options: z.object({
 		service: z.string().optional().describe("Nome ou ID do serviço"),
@@ -5750,11 +6141,11 @@ buildsGroup.command("list", {
 		const client = await getClient();
 		const deployments = await withSpinner({
 			text: "Carregando builds...",
-			fn: () => client.deployments.list({
+			fn: () => withRetry(() => client.deployments.list({
 				serviceId,
 				limit: c.options.limit,
 				offset: 0
-			})
+			}))
 		});
 		if (deployments.length === 0) {
 			info("Nenhum build encontrado para este serviço.");
@@ -5790,6 +6181,7 @@ buildsGroup.command("list", {
 });
 buildsGroup.command("show", {
 	description: "Exibir detalhes de um build específico",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ id: z.string().describe("ID do build (completo ou parcial)") }),
 	options: z.object({
@@ -5817,17 +6209,17 @@ buildsGroup.command("show", {
 		try {
 			deployment = await withSpinner({
 				text: "Carregando build...",
-				fn: () => client.deployments.get({ deploymentId: searchId })
+				fn: () => withRetry(() => client.deployments.get({ deploymentId: searchId }))
 			});
 		} catch {
 			const serviceId = await resolveServiceId(c.options.service, c.options.project);
 			deployment = (await withSpinner({
 				text: "Buscando build...",
-				fn: () => client.deployments.list({
+				fn: () => withRetry(() => client.deployments.list({
 					serviceId,
 					limit: 50,
 					offset: 0
-				})
+				}))
 			})).find((d) => d.id.startsWith(searchId));
 			if (!deployment) throw new Error(`Build "${searchId}" não encontrado.`);
 		}
@@ -5875,6 +6267,7 @@ buildsGroup.command("show", {
 });
 buildsGroup.command("logs", {
 	description: "Exibir logs de build de um deploy",
+	mcp: MCP_READ_ONLY,
 	middleware: [requireAuth$1],
 	args: z.object({ id: z.string().describe("ID do build (completo ou parcial)") }),
 	options: z.object({
@@ -5892,16 +6285,16 @@ buildsGroup.command("logs", {
 		const searchId = c.args.id;
 		let deploymentId = searchId;
 		try {
-			deploymentId = (await client.deployments.get({ deploymentId: searchId })).id;
+			deploymentId = (await withRetry(() => client.deployments.get({ deploymentId: searchId }))).id;
 		} catch {
 			const serviceId = await resolveServiceId(c.options.service, c.options.project);
 			const found = (await withSpinner({
 				text: "Buscando build...",
-				fn: () => client.deployments.list({
+				fn: () => withRetry(() => client.deployments.list({
 					serviceId,
 					limit: 50,
 					offset: 0
-				})
+				}))
 			})).find((d) => d.id.startsWith(searchId));
 			if (!found) {
 				warn(`Build "${searchId}" não encontrado.`);
@@ -5915,7 +6308,7 @@ buildsGroup.command("logs", {
 		}
 		const result$2 = await withSpinner({
 			text: "Carregando logs de build...",
-			fn: () => client.logs.getBuildLogs({ deploymentId })
+			fn: () => withRetry(() => client.logs.getBuildLogs({ deploymentId }))
 		});
 		if (!result$2.buildLogs) {
 			info("Nenhum log de build disponível para este deploy.");
@@ -5925,7 +6318,7 @@ buildsGroup.command("logs", {
 				logs: ""
 			};
 		}
-		const deployment = await client.deployments.get({ deploymentId });
+		const deployment = await withRetry(() => client.deployments.get({ deploymentId }));
 		if (process.stdout.isTTY) {
 			const icon = getStatusIcon(deployment.status);
 			const label = statusLabels[deployment.status] ?? deployment.status;
@@ -5986,6 +6379,7 @@ buildsGroup.command("logs", {
 function registerLink(cli$1) {
 	cli$1.command("link", {
 		description: "Verificar vínculo do projeto com Veloz",
+		mcp: MCP_READ_ONLY,
 		output: z.object({
 			project: z.object({
 				id: z.string(),
@@ -22743,6 +23137,25 @@ function resolveProductionStartCmd(scripts, pm) {
 	if (isDevScript(scripts.start)) return null;
 	return pmRun(pm, "start");
 }
+/**
+* Resolve a production start command for a deployable app.
+*
+* Precedence: a valid (non-dev) `start` script → `<pm> run start`; otherwise the
+* framework's canonical default (`next start`, `node dist/main.js`, …). For a
+* monorepo app in a subdirectory the command is prefixed with `cd <appPath> &&`
+* so it runs from the app even though the builder's WORKDIR is the repo root —
+* what plain pnpm/yarn workspaces (no `NIXPACKS_<TOOL>_APP_NAME` targeting) need
+* to avoid "No start command could be found". Returns null for STATIC apps.
+*/
+function resolveAppStartCommand(pkg, pm, framework, appPath) {
+	if (framework && framework.type === "STATIC") return null;
+	const path$1 = appPath && appPath !== "." && appPath !== "/" ? appPath : null;
+	const inApp = (cmd) => path$1 ? `cd ${path$1} && ${cmd}` : cmd;
+	const scripts = pkg.scripts ?? {};
+	if (scripts.start && !isDevScript(scripts.start)) return inApp(pmRun(pm, "start"));
+	if (framework?.startCommand) return inApp(framework.startCommand);
+	return null;
+}
 /** Safely parse a JSON string as PkgJson. */
 function safeParsePkg(content) {
 	try {
@@ -23744,13 +24157,9 @@ const detectMonorepo = (pm) => gen(function* () {
 					...appFramework,
 					buildCommand: pmRun(pm, `build:${appName}`)
 				};
-				if (nested.scripts?.start && !isDevScript(nested.scripts.start)) appFramework = {
+				appFramework = {
 					...appFramework,
-					startCommand: null
-				};
-				else if (appFramework.startCommand) appFramework = {
-					...appFramework,
-					startCommand: `cd ${appPath} && ${appFramework.startCommand}`
+					startCommand: resolveAppStartCommand(nested, pm, appFramework, appPath)
 				};
 			}
 			let nodeVersion;
@@ -24387,7 +24796,7 @@ const LOGO_LINES$1 = [
 ];
 const BRAND_COLOR$1 = "#FF4D00";
 function getVersion() {
-	return "0.0.0-beta.39";
+	return "0.0.0-beta.40";
 }
 function printBanner(subtitle) {
 	const version$2 = getVersion();
@@ -24417,36 +24826,6 @@ function stripAnsi(str) {
 	return str.replace(/\u001B\[[0-9;]*m/g, "");
 }
 
-//#endregion
-//#region src/lib/retry.ts
-async function withRetry(fn$2, maxRetries = 3) {
-	let orgSwitched = false;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		return await fn$2();
-	} catch (error) {
-		if (!orgSwitched && isOrgMismatchError(error)) {
-			if (applyOrgMismatchSwitch(error)) {
-				orgSwitched = true;
-				continue;
-			}
-		}
-		if (attempt >= maxRetries) throw error;
-		const rateLimit = isRateLimitError(error);
-		if (rateLimit) {
-			const waitMs = Math.min(rateLimit.retryAfterMs, 3e4);
-			await new Promise((r) => {
-				setTimeout(r, waitMs);
-			});
-		} else {
-			const delay$2 = Math.min(1e3 * Math.pow(2, attempt), 1e4);
-			await new Promise((r) => {
-				setTimeout(r, delay$2);
-			});
-		}
-	}
-	throw new Error("Max retries exceeded");
-}
-
 //#endregion
 //#region src/lib/deploy-core.ts
 async function fetchDeployUrls(client, serviceId) {
@@ -24659,6 +25038,60 @@ async function deployMultipleServices(services, options) {
 	if (failed.length > 0 && !process.env.VELOZ_MCP) process.exit(1);
 	return results;
 }
+const DASHBOARD_BASE$1 = process.env.VELOZ_WEB_URL || "https://app.onveloz.com";
+/**
+* Trigger deploys for 1-to-N services and return immediately, without waiting
+* for the build to finish. Uploads the source once per project, creates each
+* deployment, and starts its build, then reports the initial status.
+*
+* Used in MCP mode so an AI agent driving `veloz deploy` is not blocked for the
+* full build duration (builds can run for many minutes). The caller follows the
+* build to completion with `veloz builds logs <id>` / `veloz builds show <id>`.
+*/
+async function startDeploys(services, options) {
+	const { projectRoot } = options;
+	const client = await getClient();
+	const sizeInBytes = await calculateDirectorySize(projectRoot);
+	const sizeMB = Math.round(sizeInBytes / (1024 * 1024) * 10) / 10;
+	const baseTarball = await createBaseTarball(projectRoot);
+	const uniqueProjectIds = [...new Set(services.map((s) => s.projectId))];
+	const objectKeyByProject = /* @__PURE__ */ new Map();
+	try {
+		await Promise.all(uniqueProjectIds.map(async (pid) => {
+			const key = await withRetry(() => uploadSharedSource(client, pid, baseTarball.tarPath));
+			objectKeyByProject.set(pid, key);
+		}));
+	} finally {
+		await cleanupTarball(baseTarball);
+	}
+	info(`Upload concluído${sizeMB > 5 ? ` (${sizeMB} MB)` : ""}`);
+	return await Promise.all(services.map(async (service$2) => {
+		const deployment = await withRetry(() => client.deployments.create({
+			serviceId: service$2.serviceId,
+			serviceConfig: service$2.serviceConfig,
+			config: service$2.config
+		}));
+		await withRetry(() => client.deployments.startBuild({
+			deploymentId: deployment.id,
+			objectKey: objectKeyByProject.get(service$2.projectId) ?? ""
+		}));
+		let status = "QUEUED";
+		try {
+			status = (await client.deployments.get({ deploymentId: deployment.id })).status;
+		} catch {}
+		const followCommand = `veloz builds show ${deployment.id}`;
+		success(`Deploy iniciado para ${service$2.serviceName}. Acompanhe com: ${followCommand}`);
+		return {
+			deploymentId: deployment.id,
+			status,
+			logs: [],
+			urls: [],
+			serviceName: service$2.serviceName,
+			dashboardUrl: `${DASHBOARD_BASE$1}/projetos/${service$2.projectId}/servicos/${service$2.serviceId}/deploys/${deployment.id}`,
+			followCommand
+		};
+	}));
+}
 /**
 * Unified deploy function for 1-to-N services.
 *
@@ -25511,7 +25944,7 @@ async function fetchLatestVersion() {
 	}
 }
 function getCurrentVersion() {
-	return "0.0.0-beta.39";
+	return "0.0.0-beta.40";
 }
 /**
 * Install a specific CLI version. Returns true on success.
@@ -25785,6 +26218,40 @@ const SERVICE_TYPE_LABELS = {
 	WORKER: "Worker",
 	DATABASE: "Banco de Dados"
 };
+/**
+* Detect-then-require a start command for long-lived process services (WEB/WORKER).
+*
+* A WEB/WORKER service with no resolvable start command dead-ends in a cryptic
+* "No start command could be found" deep in the build (or, worse, a service that
+* starts a dev server and crash-loops). We catch it before the upload: try local
+* framework detection and fill the command when found, otherwise fail fast with
+* an actionable message. STATIC/DATABASE services and Dockerfile builds (own CMD)
+* are exempt. Mutates `serviceConf.startCommand` in place when a command is found.
+*/
+function ensureStartCommand(serviceConf, configSnapshot, serviceName) {
+	if (!serviceConf) return;
+	const type = serviceConf.type;
+	if (type !== "WEB" && type !== "WORKER") return;
+	if (serviceConf.startCommand) return;
+	if (configSnapshot?.build?.method === "dockerfile") return;
+	const root = serviceConf.rootDirectory && serviceConf.rootDirectory !== "/" ? serviceConf.rootDirectory : ".";
+	let analysis = null;
+	try {
+		analysis = detectLocalRepo$1(root);
+	} catch {
+		analysis = null;
+	}
+	const detected = analysis?.framework?.startCommand ?? null;
+	if (detected) {
+		serviceConf.startCommand = detected;
+		info(`Comando de start detectado para ${chalk.bold(serviceName)}: ${chalk.dim(detected)}`);
+		return;
+	}
+	const typeLabel = type === "WEB" ? "web" : "worker";
+	const fw = analysis?.framework;
+	if (fw && fw.type === "STATIC") throw new Error(`O serviço "${serviceName}" parece ser um site estático (${fw.name}), mas está configurado como "${typeLabel}". Defina "type": "static" no veloz.json para servi-lo como arquivos estáticos, ou defina "runtime.command" se ele roda um processo.`);
+	throw new Error(`O serviço "${serviceName}" (${typeLabel}) não tem um comando de start e não foi possível detectar um automaticamente. Defina "runtime.command" no veloz.json (ex.: "node dist/index.js") e refaça o deploy.`);
+}
 function prepareServicesForDeploy(services) {
 	const velozConfig = loadConfig$1();
 	const allWarnings = [];
@@ -25802,6 +26269,7 @@ function prepareServicesForDeploy(services) {
 	return services.map((svc) => {
 		const serviceConf = resolveServiceConf(velozConfig, svc.serviceId);
 		const configSnapshot = resolveServiceConfigSnapshot(velozConfig, svc.serviceId);
+		ensureStartCommand(serviceConf, configSnapshot, svc.serviceName);
 		return {
 			serviceId: svc.serviceId,
 			serviceName: svc.serviceName,
@@ -25818,6 +26286,7 @@ async function triggerDeploy(serviceId, serviceName) {
 	const velozConfig = loadConfig$1();
 	const serviceConf = resolveServiceConf(velozConfig, serviceId);
 	const configSnapshot = resolveServiceConfigSnapshot(velozConfig, serviceId);
+	ensureStartCommand(serviceConf, configSnapshot, serviceName ?? serviceId);
 	const warnings = runPreDeployChecks(serviceConf?.rootDirectory || ".");
 	if (warnings.length > 0) printDeployWarnings(warnings);
 	const spinUpload = spinner(serviceName ? `Fazendo upload ${chalk.bold(serviceName)}...` : "Fazendo upload do código...");
@@ -26635,7 +27104,8 @@ async function addServiceFlow(existingConfig, opts) {
 }
 function registerDeploy(cli$1) {
 	cli$1.command("deploy", {
-		description: "Fazer deploy do serviço. Returns streamed progress events. The last event (type='result') contains: deploymentId, status (LIVE/BUILD_FAILED/DEPLOY_FAILED/FAILED/CANCELLED), urls, failReason, errorSummary, commitSha, branch, durationSeconds, dashboardUrl, and logs.",
+		description: "Fazer deploy do serviço",
+		mcp: MCP_DEPLOY,
 		middleware: [requireAuth$1],
 		options: z.object({
 			all: z.boolean().optional().describe("Deploy todos os serviços do monorepo"),
@@ -26846,7 +27316,20 @@ async function* headlessDeployFlow(opts) {
 		}
 		servicesToProcess = matched;
 	}
-	const results = await deployServices(await prepareServicesForDeploy(servicesToProcess), {
+	const servicesToDeploy = await prepareServicesForDeploy(servicesToProcess);
+	if (!opts.wait) {
+		const triggered = await startDeploys(servicesToDeploy, {
+			projectRoot: process.cwd(),
+			output: createDeployOutput()
+		});
+		for (const result$2 of triggered) yield {
+			type: "result",
+			message: `Deploy iniciado (${result$2.status}). O build está em andamento e pode levar alguns minutos. Acompanhe o status com "veloz builds show ${result$2.deploymentId}" (repita até o status ser terminal: LIVE, BUILD_FAILED, DEPLOY_FAILED, FAILED ou CANCELLED) e veja os logs com "veloz builds logs ${result$2.deploymentId}".`,
+			data: result$2
+		};
+		return;
+	}
+	const results = await deployServices(servicesToDeploy, {
 		projectRoot: process.cwd(),
 		output: createDeployOutput()
 	});
@@ -27258,6 +27741,7 @@ function registerUse(cli$1) {
 function registerWhoami(cli$1) {
 	cli$1.command("whoami", {
 		description: "Mostrar usuário e workspace ativo",
+		mcp: MCP_READ_ONLY,
 		middleware: [requireAuth$1],
 		output: z.object({
 			name: z.string(),
@@ -27510,6 +27994,7 @@ async function pruneRemovedEntries(config, existingConfig, services, databases)
 function registerUpdate(cli$1) {
 	cli$1.command("update", {
 		description: "Atualizar a CLI para a versão mais recente",
+		mcp: false,
 		output: z.object({
 			updated: z.boolean(),
 			version: z.string().nullable()
@@ -30599,7 +31084,7 @@ function PickerMenu({ items, onSelect, onCancel }) {
 
 //#endregion
 //#region src/wizard/ui/primitives/ScreenLayout.tsx
-const version = "0.0.0-beta.39";
+const version = "0.0.0-beta.40";
 const LOGO_LINES = [
 	"██╗   ██╗███████╗██╗      ██████╗ ███████╗",
 	"██║   ██║██╔════╝██║     ██╔═══██╗╚══███╔╝",
@@ -34602,6 +35087,7 @@ function detectGitRemote(cwd) {
 function registerInit(cli$1) {
 	cli$1.command("init", {
 		description: "Wizard de deploy — configura e faz deploy do projeto automaticamente",
+		mcp: false,
 		options: z.object({
 			framework: z.string().optional().describe("Forçar framework específico (ex: nextjs-app-router, express)"),
 			ci: z.boolean().default(false).describe("Modo CI — pula o wizard de IA e faz deploy direto via veloz deploy")
@@ -34612,7 +35098,8 @@ function registerInit(cli$1) {
 		},
 		output: z.object({
 			success: z.boolean(),
-			url: z.string().optional()
+			url: z.string().optional(),
+			hint: z.string().optional()
 		}),
 		outputPolicy: "agent-only",
 		async run(c) {
@@ -34646,6 +35133,16 @@ function registerInit(cli$1) {
 }
 async function runInitFlow(c, logger, cwd) {
 	const forcedFramework = c.options.framework;
+	if (isAiAgent() && !c.options.ci) {
+		logger.log("mode", "AI agent detected — skipping wizard, guiding to veloz deploy");
+		await ensureSkillForAgent(logger);
+		info("Detectado agente de IA. O wizard de IA foi ignorado.");
+		info("Para fazer deploy, execute: veloz deploy");
+		return {
+			success: true,
+			hint: "Ambiente de agente de IA detectado. Execute `veloz deploy` para fazer deploy. A skill da Veloz foi instalada em .claude/skills/ com a referência completa de comandos."
+		};
+	}
 	const analysis = detectLocalRepo(cwd);
 	logger.log("detection", "repo analysis complete", {
 		framework: analysis.framework?.name ?? null,
@@ -35004,6 +35501,29 @@ async function pollGithubInstallation(_store, owner) {
 	return null;
 }
 /**
+* Install the Veloz agent skill into `.claude/skills/` for an AI agent that ran
+* `veloz init`, unless it is already present. Best-effort: a failure is surfaced
+* as a hint, never fatal — the agent can still run `veloz deploy`.
+*/
+async function ensureSkillForAgent(logger) {
+	if (checkAiSetup().skillsInstalled) {
+		logger.log("ai-setup", "skill already installed — skipping");
+		return;
+	}
+	const result$2 = await runVelozSubcommand([
+		"skills",
+		"add",
+		"--no-global"
+	]);
+	if (result$2.ok) {
+		logger.log("ai-setup", "skills add succeeded");
+		success("Skill da Veloz instalada em .claude/skills/");
+	} else {
+		logger.log("ai-setup", "skills add failed", { stderr: result$2.stderr });
+		warn("Não foi possível instalar a skill. Execute manualmente: veloz skills add");
+	}
+}
+/**
 * In CI / non-TTY contexts (real CI runners, MCP tool calls, Claude Code's
 * bash tool), `veloz init` delegates to the deterministic deploy flow rather
 * than spawning a Claude Code agent. The deploy flow auto-bootstraps the
@@ -35032,7 +35552,8 @@ async function runHeadless(opts) {
 		let url;
 		for await (const event of headlessDeployFlow({
 			all: true,
-			yes: true
+			yes: true,
+			wait: true
 		})) if (event.type === "result") {
 			const data = event.data;
 			if (data?.status === "LIVE") {
@@ -35229,13 +35750,18 @@ async function runOrgCreationFlow(store, apiUrl) {
 //#region src/index.ts
 if (process.argv.includes("--mcp")) process.env.VELOZ_MCP = "true";
 const cli = Cli.create("veloz", {
-	version: "0.0.0-beta.39",
+	version: "0.0.0-beta.40",
 	description: "CLI da plataforma Veloz — deploy rápido para o Brasil",
 	env: z.object({ VELOZ_ENV: z.string().optional().describe("Ambiente alvo (ex: preview, staging)") }),
-	mcp: { command: "npx -y onveloz --mcp" }
+	globals: z.object({ env: z.string().optional().describe("Ambiente alvo (ex: preview, staging)") }),
+	globalAlias: { env: "e" },
+	mcp: {
+		command: "npx -y onveloz --mcp",
+		instructions: MCP_SERVER_INSTRUCTIONS
+	}
 });
 cli.use(async (c, next) => {
-	const env = c.env.VELOZ_ENV;
+	const env = c.globals.env ?? c.env.VELOZ_ENV;
 	if (env) setActiveEnv(env);
 	await next();
 });
@@ -35329,6 +35855,7 @@ cli.command(projectsGroup);
 cli.command(orgsGroup);
 cli.command(envGroup);
 cli.command(domainsGroup);
+cli.command(emailGroup);
 cli.command(volumesGroup);
 cli.command(configGroup);
 cli.command(apikeyGroup);