@lanonasis/cli 3.6.5 → 3.7.0

package/dist/commands/auth.js

@@ -1,29 +1,23 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.diagnoseCommand = diagnoseCommand;
-exports.loginCommand = loginCommand;
-const chalk_1 = __importDefault(require("chalk"));
-const inquirer_1 = __importDefault(require("inquirer"));
-const ora_1 = __importDefault(require("ora"));
-const open_1 = __importDefault(require("open"));
-const crypto_1 = __importDefault(require("crypto"));
-const http_1 = __importDefault(require("http"));
-const url_1 = __importDefault(require("url"));
-const api_js_1 = require("../utils/api.js");
-const config_js_1 = require("../utils/config.js");
+import chalk from 'chalk';
+import inquirer from 'inquirer';
+import ora from 'ora';
+import open from 'open';
+import crypto from 'crypto';
+import http from 'http';
+import url from 'url';
+import axios from 'axios';
+import { apiClient } from '../utils/api.js';
+import { CLIConfig } from '../utils/config.js';
 // Color scheme
 const colors = {
-    primary: chalk_1.default.blue.bold,
-    success: chalk_1.default.green,
-    warning: chalk_1.default.yellow,
-    error: chalk_1.default.red,
-    info: chalk_1.default.cyan,
-    accent: chalk_1.default.magenta,
-    muted: chalk_1.default.gray,
-    highlight: chalk_1.default.white.bold
+    primary: chalk.blue.bold,
+    success: chalk.green,
+    warning: chalk.yellow,
+    error: chalk.red,
+    info: chalk.cyan,
+    accent: chalk.magenta,
+    muted: chalk.gray,
+    highlight: chalk.white.bold
 };
 // Helper function to handle authentication delays
 async function handleAuthDelay(config) {
@@ -32,15 +26,15 @@ async function handleAuthDelay(config) {
         const failureCount = config.getFailureCount();
         const lastFailure = config.getLastAuthFailure();
         console.log();
-        console.log(chalk_1.default.yellow(`⚠️  Multiple authentication failures detected (${failureCount} attempts)`));
+        console.log(chalk.yellow(`⚠️  Multiple authentication failures detected (${failureCount} attempts)`));
         if (lastFailure) {
             const lastFailureDate = new Date(lastFailure);
-            console.log(chalk_1.default.gray(`Last failure: ${lastFailureDate.toLocaleString()}`));
+            console.log(chalk.gray(`Last failure: ${lastFailureDate.toLocaleString()}`));
         }
-        console.log(chalk_1.default.yellow(`Waiting ${Math.round(delayMs / 1000)} seconds before retry...`));
-        console.log(chalk_1.default.gray('This delay helps prevent account lockouts and reduces server load.'));
+        console.log(chalk.yellow(`Waiting ${Math.round(delayMs / 1000)} seconds before retry...`));
+        console.log(chalk.gray('This delay helps prevent account lockouts and reduces server load.'));
         // Show countdown
-        const spinner = (0, ora_1.default)(`Waiting ${Math.round(delayMs / 1000)} seconds...`).start();
+        const spinner = ora(`Waiting ${Math.round(delayMs / 1000)} seconds...`).start();
         await new Promise(resolve => setTimeout(resolve, delayMs));
         spinner.succeed('Ready to retry authentication');
         console.log();
@@ -54,70 +48,70 @@ async function handleAuthenticationFailure(error, config, authMethod = 'jwt') {
     // Determine error type and provide specific guidance
     const errorType = categorizeAuthError(error);
     console.log();
-    console.log(chalk_1.default.red('✖ Authentication failed'));
+    console.log(chalk.red('✖ Authentication failed'));
     switch (errorType) {
         case 'invalid_credentials':
-            console.log(chalk_1.default.red('Invalid credentials provided'));
+            console.log(chalk.red('Invalid credentials provided'));
             if (authMethod === 'vendor_key') {
-                console.log(chalk_1.default.gray('• Verify the vendor key matches the value shown in your dashboard'));
-                console.log(chalk_1.default.gray('• Confirm the key is active and has not been revoked'));
-                console.log(chalk_1.default.gray('• Ensure you copied the entire key without extra spaces'));
+                console.log(chalk.gray('• Verify the vendor key matches the value shown in your dashboard'));
+                console.log(chalk.gray('• Confirm the key is active and has not been revoked'));
+                console.log(chalk.gray('• Ensure you copied the entire key without extra spaces'));
             }
             else {
-                console.log(chalk_1.default.gray('• Double-check your email and password'));
-                console.log(chalk_1.default.gray('• Passwords are case-sensitive'));
-                console.log(chalk_1.default.gray('• Consider resetting your password if needed'));
+                console.log(chalk.gray('• Double-check your email and password'));
+                console.log(chalk.gray('• Passwords are case-sensitive'));
+                console.log(chalk.gray('• Consider resetting your password if needed'));
             }
             break;
         case 'network_error':
-            console.log(chalk_1.default.red('Network connection failed'));
-            console.log(chalk_1.default.gray('• Check your internet connection'));
-            console.log(chalk_1.default.gray('• Verify you can access https://auth.lanonasis.com'));
-            console.log(chalk_1.default.gray('• Try again in a few moments'));
+            console.log(chalk.red('Network connection failed'));
+            console.log(chalk.gray('• Check your internet connection'));
+            console.log(chalk.gray('• Verify you can access https://auth.lanonasis.com'));
+            console.log(chalk.gray('• Try again in a few moments'));
             if (failureCount >= 2) {
-                console.log(chalk_1.default.gray('• Consider using a different network if issues persist'));
+                console.log(chalk.gray('• Consider using a different network if issues persist'));
             }
             break;
         case 'server_error':
-            console.log(chalk_1.default.red('Server temporarily unavailable'));
-            console.log(chalk_1.default.gray('• The authentication service may be experiencing issues'));
-            console.log(chalk_1.default.gray('• Please try again in a few minutes'));
-            console.log(chalk_1.default.gray('• Check https://status.lanonasis.com for service status'));
+            console.log(chalk.red('Server temporarily unavailable'));
+            console.log(chalk.gray('• The authentication service may be experiencing issues'));
+            console.log(chalk.gray('• Please try again in a few minutes'));
+            console.log(chalk.gray('• Check https://status.lanonasis.com for service status'));
             break;
         case 'rate_limited':
-            console.log(chalk_1.default.red('Too many authentication attempts'));
-            console.log(chalk_1.default.gray('• Please wait before trying again'));
-            console.log(chalk_1.default.gray('• Rate limiting helps protect your account'));
-            console.log(chalk_1.default.gray('• Consider using a vendor key for automated access'));
+            console.log(chalk.red('Too many authentication attempts'));
+            console.log(chalk.gray('• Please wait before trying again'));
+            console.log(chalk.gray('• Rate limiting helps protect your account'));
+            console.log(chalk.gray('• Consider using a vendor key for automated access'));
             break;
         case 'expired_token':
-            console.log(chalk_1.default.red('Authentication token has expired'));
-            console.log(chalk_1.default.gray('• Please log in again to refresh your session'));
-            console.log(chalk_1.default.gray('• Consider using a vendor key for longer-term access'));
+            console.log(chalk.red('Authentication token has expired'));
+            console.log(chalk.gray('• Please log in again to refresh your session'));
+            console.log(chalk.gray('• Consider using a vendor key for longer-term access'));
             await config.clearInvalidCredentials();
             break;
         default:
-            console.log(chalk_1.default.red(`Unexpected error: ${error.message || 'Unknown error'}`));
-            console.log(chalk_1.default.gray('• Please try again'));
-            console.log(chalk_1.default.gray('• If the problem persists, contact support'));
+            console.log(chalk.red(`Unexpected error: ${error.message || 'Unknown error'}`));
+            console.log(chalk.gray('• Please try again'));
+            console.log(chalk.gray('• If the problem persists, contact support'));
     }
     // Progressive guidance for repeated failures
     if (failureCount >= 3) {
         console.log();
-        console.log(chalk_1.default.yellow('💡 Multiple failures detected. Recovery options:'));
+        console.log(chalk.yellow('💡 Multiple failures detected. Recovery options:'));
         if (authMethod === 'vendor_key') {
-            console.log(chalk_1.default.cyan('• Generate a new vendor key from your dashboard'));
-            console.log(chalk_1.default.cyan('• Try: lanonasis auth logout && lanonasis auth login'));
-            console.log(chalk_1.default.cyan('• Switch to browser login: lanonasis auth login (choose Browser Login)'));
+            console.log(chalk.cyan('• Generate a new vendor key from your dashboard'));
+            console.log(chalk.cyan('• Try: lanonasis auth logout && lanonasis auth login'));
+            console.log(chalk.cyan('• Switch to browser login: lanonasis auth login (choose Browser Login)'));
         }
         else {
-            console.log(chalk_1.default.cyan('• Reset your password if you\'re unsure'));
-            console.log(chalk_1.default.cyan('• Try vendor key authentication instead'));
-            console.log(chalk_1.default.cyan('• Clear stored config: lanonasis auth logout'));
+            console.log(chalk.cyan('• Reset your password if you\'re unsure'));
+            console.log(chalk.cyan('• Try vendor key authentication instead'));
+            console.log(chalk.cyan('• Clear stored config: lanonasis auth logout'));
         }
         if (failureCount >= 5) {
-            console.log(chalk_1.default.yellow('• Consider contacting support if issues persist'));
-            console.log(chalk_1.default.gray('• Include error details and your email address'));
+            console.log(chalk.yellow('• Consider contacting support if issues persist'));
+            console.log(chalk.gray('• Include error details and your email address'));
         }
     }
 }
@@ -181,9 +175,9 @@ function categorizeAuthError(error) {
  */
 function generatePKCE() {
     // Generate random verifier (43-128 chars, base64url)
-    const verifier = crypto_1.default.randomBytes(32).toString('base64url');
+    const verifier = crypto.randomBytes(32).toString('base64url');
     // Generate challenge: base64url(sha256(verifier))
-    const challenge = crypto_1.default
+    const challenge = crypto
         .createHash('sha256')
         .update(verifier)
         .digest('base64url');
@@ -194,8 +188,8 @@ function generatePKCE() {
  */
 function createCallbackServer(port = 8888) {
     return new Promise((resolve, reject) => {
-        const server = http_1.default.createServer((req, res) => {
-            const parsedUrl = url_1.default.parse(req.url, true);
+        const server = http.createServer((req, res) => {
+            const parsedUrl = url.parse(req.url, true);
             if (parsedUrl.pathname === '/callback') {
                 const { code, state, error, error_description } = parsedUrl.query;
                 // Send response to browser
@@ -237,7 +231,7 @@ function createCallbackServer(port = 8888) {
             }
         });
         server.listen(port, () => {
-            console.log(chalk_1.default.gray(`   Local callback server listening on port ${port}`));
+            console.log(chalk.gray(`   Local callback server listening on port ${port}`));
         });
         // Timeout after 5 minutes
         setTimeout(() => {
@@ -249,16 +243,40 @@ function createCallbackServer(port = 8888) {
 /**
  * Exchange authorization code for OAuth2 tokens
  */
-async function exchangeCodeForTokens(code, verifier, authBase) {
+async function exchangeCodeForTokens(code, verifier, authBase, redirectUri) {
     const tokenEndpoint = `${authBase}/oauth/token`;
-    const response = await api_js_1.apiClient.post(tokenEndpoint, {
-        grant_type: 'authorization_code',
-        code,
-        code_verifier: verifier,
-        client_id: 'lanonasis-cli',
-        redirect_uri: 'http://localhost:8888/callback'
-    });
-    return response;
+    try {
+        // Use axios directly to have full control over error handling
+        const response = await axios.post(tokenEndpoint, {
+            grant_type: 'authorization_code',
+            code,
+            code_verifier: verifier,
+            client_id: 'lanonasis-cli',
+            redirect_uri: redirectUri
+        }, {
+            headers: {
+                'Content-Type': 'application/json',
+            }
+        });
+        return response.data;
+    }
+    catch (error) {
+        // Extract detailed error information from axios error response
+        if (error.response) {
+            const errorData = error.response.data || {};
+            const status = error.response.status;
+            const errorMessage = errorData.error_description || errorData.error || error.message || `Request failed with status code ${status}`;
+            const details = errorData.details;
+            const enhancedError = new Error(errorMessage);
+            enhancedError.response = error.response;
+            enhancedError.status = status;
+            enhancedError.details = details;
+            enhancedError.errorData = errorData;
+            throw enhancedError;
+        }
+        // If it's not an axios error, just rethrow
+        throw error;
+    }
 }
 /**
  * Refresh OAuth2 access token using refresh token
@@ -270,7 +288,7 @@ async function refreshOAuth2Token(config) {
     }
     try {
         const authBase = config.getDiscoveredApiUrl();
-        const response = await api_js_1.apiClient.post(`${authBase}/oauth/token`, {
+        const response = await apiClient.post(`${authBase}/oauth/token`, {
             grant_type: 'refresh_token',
             refresh_token: refreshToken,
             client_id: 'lanonasis-cli'
@@ -283,14 +301,14 @@ async function refreshOAuth2Token(config) {
         return true;
     }
     catch (error) {
-        console.error(chalk_1.default.yellow('⚠️  Token refresh failed, please re-authenticate'));
+        console.error(chalk.yellow('⚠️  Token refresh failed, please re-authenticate'));
         return false;
     }
 }
-async function diagnoseCommand() {
-    const config = new config_js_1.CLIConfig();
+export async function diagnoseCommand() {
+    const config = new CLIConfig();
     await config.init();
-    console.log(chalk_1.default.blue.bold('🔍 Authentication Diagnostic'));
+    console.log(chalk.blue.bold('🔍 Authentication Diagnostic'));
     console.log(colors.info('━'.repeat(50)));
     console.log();
     const diagnostics = {
@@ -306,146 +324,146 @@ async function diagnoseCommand() {
         deviceId: null
     };
     // Step 1: Check if config exists
-    console.log(chalk_1.default.cyan('1. Configuration File'));
+    console.log(chalk.cyan('1. Configuration File'));
     try {
         const configExists = await config.exists();
         diagnostics.configExists = configExists;
         if (configExists) {
-            console.log(chalk_1.default.green('   ✓ Config file exists at'), config.getConfigPath());
+            console.log(chalk.green('   ✓ Config file exists at'), config.getConfigPath());
         }
         else {
-            console.log(chalk_1.default.red('   ✖ Config file not found at'), config.getConfigPath());
-            console.log(chalk_1.default.gray('   → Run: lanonasis auth login'));
+            console.log(chalk.red('   ✖ Config file not found at'), config.getConfigPath());
+            console.log(chalk.gray('   → Run: lanonasis auth login'));
         }
     }
     catch (error) {
-        console.log(chalk_1.default.red('   ✖ Error checking config:'), error instanceof Error ? error.message : 'Unknown error');
+        console.log(chalk.red('   ✖ Error checking config:'), error instanceof Error ? error.message : 'Unknown error');
     }
     // Step 2: Check stored credentials
-    console.log(chalk_1.default.cyan('\n2. Stored Credentials'));
+    console.log(chalk.cyan('\n2. Stored Credentials'));
     const token = config.getToken();
     const vendorKey = config.getVendorKey();
     const authMethod = config.get('authMethod');
     if (vendorKey) {
         diagnostics.hasCredentials = true;
         diagnostics.credentialType = 'vendor_key';
-        console.log(chalk_1.default.green('   ✓ Vendor key found'));
+        console.log(chalk.green('   ✓ Vendor key found'));
         // Validate vendor key presence
         const formatValidation = config.validateVendorKeyFormat(vendorKey);
         if (formatValidation !== true) {
-            console.log(chalk_1.default.red(`   ✖ Vendor key issue: ${formatValidation}`));
+            console.log(chalk.red(`   ✖ Vendor key issue: ${formatValidation}`));
         }
     }
     else if (token) {
         diagnostics.hasCredentials = true;
         diagnostics.credentialType = authMethod === 'oauth' ? 'oauth' : 'jwt';
-        console.log(chalk_1.default.green(`   ✓ ${diagnostics.credentialType.toUpperCase()} token found`));
+        console.log(chalk.green(`   ✓ ${diagnostics.credentialType.toUpperCase()} token found`));
         // Check token expiry
         try {
             const isAuth = await config.isAuthenticated();
             if (!isAuth) {
                 diagnostics.tokenExpired = true;
-                console.log(chalk_1.default.red('   ✖ Token is expired'));
+                console.log(chalk.red('   ✖ Token is expired'));
             }
             else {
-                console.log(chalk_1.default.green('   ✓ Token is not expired'));
+                console.log(chalk.green('   ✓ Token is not expired'));
             }
         }
         catch (error) {
-            console.log(chalk_1.default.yellow('   ⚠ Could not validate token expiry'));
+            console.log(chalk.yellow('   ⚠ Could not validate token expiry'));
             if (process.env.CLI_VERBOSE === 'true' && error instanceof Error) {
-                console.log(chalk_1.default.gray(`     ${error.message}`));
+                console.log(chalk.gray(`     ${error.message}`));
             }
         }
     }
     else {
-        console.log(chalk_1.default.red('   ✖ No credentials found'));
-        console.log(chalk_1.default.gray('   → Run: lanonasis auth login'));
+        console.log(chalk.red('   ✖ No credentials found'));
+        console.log(chalk.gray('   → Run: lanonasis auth login'));
     }
     // Step 3: Check authentication failures
-    console.log(chalk_1.default.cyan('\n3. Authentication History'));
+    console.log(chalk.cyan('\n3. Authentication History'));
     diagnostics.authFailures = config.getFailureCount();
     diagnostics.lastFailure = config.getLastAuthFailure() ?? null;
     if (diagnostics.authFailures === 0) {
-        console.log(chalk_1.default.green('   ✓ No recent authentication failures'));
+        console.log(chalk.green('   ✓ No recent authentication failures'));
     }
     else {
-        console.log(chalk_1.default.yellow(`   ⚠ ${diagnostics.authFailures} recent authentication failures`));
+        console.log(chalk.yellow(`   ⚠ ${diagnostics.authFailures} recent authentication failures`));
         if (diagnostics.lastFailure) {
             const lastFailureDate = new Date(diagnostics.lastFailure);
-            console.log(chalk_1.default.gray(`     Last failure: ${lastFailureDate.toLocaleString()}`));
+            console.log(chalk.gray(`     Last failure: ${lastFailureDate.toLocaleString()}`));
         }
         if (config.shouldDelayAuth()) {
             const delayMs = config.getAuthDelayMs();
-            console.log(chalk_1.default.yellow(`   ⚠ Authentication delay active: ${Math.round(delayMs / 1000)}s`));
+            console.log(chalk.yellow(`   ⚠ Authentication delay active: ${Math.round(delayMs / 1000)}s`));
         }
     }
     // Step 4: Test credential validation against server
-    console.log(chalk_1.default.cyan('\n4. Server Validation'));
+    console.log(chalk.cyan('\n4. Server Validation'));
     if (diagnostics.hasCredentials) {
-        const spinner = (0, ora_1.default)('Testing credentials against server...').start();
+        const spinner = ora('Testing credentials against server...').start();
         try {
             const isValid = await config.validateStoredCredentials();
             diagnostics.credentialsValid = isValid;
             if (isValid) {
                 spinner.succeed('Credentials are valid');
-                console.log(chalk_1.default.green('   ✓ Server authentication successful'));
+                console.log(chalk.green('   ✓ Server authentication successful'));
             }
             else {
                 spinner.fail('Credentials are invalid');
-                console.log(chalk_1.default.red('   ✖ Server rejected credentials'));
-                console.log(chalk_1.default.gray('   → Try: lanonasis auth login'));
+                console.log(chalk.red('   ✖ Server rejected credentials'));
+                console.log(chalk.gray('   → Try: lanonasis auth login'));
             }
         }
         catch (error) {
             spinner.fail('Server validation failed');
-            console.log(chalk_1.default.red('   ✖ Could not validate with server:'));
-            console.log(chalk_1.default.gray(`     ${error instanceof Error ? error.message : 'Unknown error'}`));
+            console.log(chalk.red('   ✖ Could not validate with server:'));
+            console.log(chalk.gray(`     ${error instanceof Error ? error.message : 'Unknown error'}`));
         }
     }
     else {
-        console.log(chalk_1.default.gray('   - Skipped (no credentials to validate)'));
+        console.log(chalk.gray('   - Skipped (no credentials to validate)'));
     }
     // Step 5: Test endpoint connectivity
-    console.log(chalk_1.default.cyan('\n5. Endpoint Connectivity'));
-    const spinner2 = (0, ora_1.default)('Testing authentication endpoints...').start();
+    console.log(chalk.cyan('\n5. Endpoint Connectivity'));
+    const spinner2 = ora('Testing authentication endpoints...').start();
     try {
         await config.discoverServices();
         diagnostics.serviceDiscovery = true;
         const services = config.get('discoveredServices');
         if (services) {
             spinner2.succeed('Authentication endpoints reachable');
-            console.log(chalk_1.default.green('   ✓ Service discovery successful'));
-            console.log(chalk_1.default.gray(`     Auth endpoint: ${services.auth_base}`));
+            console.log(chalk.green('   ✓ Service discovery successful'));
+            console.log(chalk.gray(`     Auth endpoint: ${services.auth_base}`));
             diagnostics.endpointsReachable = true;
         }
         else {
             spinner2.warn('Using fallback endpoints');
-            console.log(chalk_1.default.yellow('   ⚠ Service discovery failed, using fallbacks'));
+            console.log(chalk.yellow('   ⚠ Service discovery failed, using fallbacks'));
             diagnostics.endpointsReachable = true; // Fallbacks still work
         }
     }
     catch (error) {
         spinner2.fail('Endpoint connectivity failed');
-        console.log(chalk_1.default.red('   ✖ Cannot reach authentication endpoints'));
-        console.log(chalk_1.default.gray(`     ${error instanceof Error ? error.message : 'Unknown error'}`));
-        console.log(chalk_1.default.gray('   → Check internet connection'));
+        console.log(chalk.red('   ✖ Cannot reach authentication endpoints'));
+        console.log(chalk.gray(`     ${error instanceof Error ? error.message : 'Unknown error'}`));
+        console.log(chalk.gray('   → Check internet connection'));
     }
     // Step 6: Device identification
-    console.log(chalk_1.default.cyan('\n6. Device Information'));
+    console.log(chalk.cyan('\n6. Device Information'));
     try {
         const deviceId = await config.getDeviceId();
         diagnostics.deviceId = deviceId;
-        console.log(chalk_1.default.green('   ✓ Device ID:'), chalk_1.default.gray(deviceId));
+        console.log(chalk.green('   ✓ Device ID:'), chalk.gray(deviceId));
     }
     catch (error) {
-        console.log(chalk_1.default.yellow('   ⚠ Could not get device ID'));
+        console.log(chalk.yellow('   ⚠ Could not get device ID'));
         if (process.env.CLI_VERBOSE === 'true' && error instanceof Error) {
-            console.log(chalk_1.default.gray(`     ${error.message}`));
+            console.log(chalk.gray(`     ${error.message}`));
         }
     }
     // Summary and recommendations
-    console.log(chalk_1.default.blue.bold('\n📋 Diagnostic Summary'));
+    console.log(chalk.blue.bold('\n📋 Diagnostic Summary'));
     console.log(colors.info('━'.repeat(50)));
     const issues = [];
     const recommendations = [];
@@ -474,32 +492,32 @@ async function diagnoseCommand() {
         recommendations.push('Check internet connection and firewall settings');
     }
     if (issues.length === 0) {
-        console.log(chalk_1.default.green('✅ All authentication checks passed!'));
-        console.log(chalk_1.default.cyan('   Your authentication is working correctly.'));
+        console.log(chalk.green('✅ All authentication checks passed!'));
+        console.log(chalk.cyan('   Your authentication is working correctly.'));
     }
     else {
-        console.log(chalk_1.default.red(`❌ Found ${issues.length} issue(s):`));
+        console.log(chalk.red(`❌ Found ${issues.length} issue(s):`));
         issues.forEach(issue => {
-            console.log(chalk_1.default.red(`   • ${issue}`));
+            console.log(chalk.red(`   • ${issue}`));
         });
-        console.log(chalk_1.default.yellow('\n💡 Recommended actions:'));
+        console.log(chalk.yellow('\n💡 Recommended actions:'));
         recommendations.forEach(rec => {
-            console.log(chalk_1.default.cyan(`   • ${rec}`));
+            console.log(chalk.cyan(`   • ${rec}`));
         });
     }
     // Additional troubleshooting info
     if (diagnostics.authFailures > 0 || !diagnostics.credentialsValid) {
-        console.log(chalk_1.default.gray('\n🔧 Additional troubleshooting:'));
-        console.log(chalk_1.default.gray('   • Verify the vendor key matches the value shown in your dashboard'));
-        console.log(chalk_1.default.gray('   • Check if your key is active in the dashboard'));
-        console.log(chalk_1.default.gray('   • Try browser authentication: lanonasis auth login (choose Browser Login)'));
-        console.log(chalk_1.default.gray('   • Contact support if issues persist'));
+        console.log(chalk.gray('\n🔧 Additional troubleshooting:'));
+        console.log(chalk.gray('   • Verify the vendor key matches the value shown in your dashboard'));
+        console.log(chalk.gray('   • Check if your key is active in the dashboard'));
+        console.log(chalk.gray('   • Try browser authentication: lanonasis auth login (choose Browser Login)'));
+        console.log(chalk.gray('   • Contact support if issues persist'));
     }
 }
-async function loginCommand(options) {
-    const config = new config_js_1.CLIConfig();
+export async function loginCommand(options) {
+    const config = new CLIConfig();
     await config.init();
-    console.log(chalk_1.default.blue.bold('🔐 Onasis-Core Golden Contract Authentication'));
+    console.log(chalk.blue.bold('🔐 Onasis-Core Golden Contract Authentication'));
     console.log(colors.info('━'.repeat(50)));
     console.log();
     // Debug: Check options
@@ -521,7 +539,7 @@ async function loginCommand(options) {
         return;
     }
     // Show authentication options
-    const authChoice = await inquirer_1.default.prompt([
+    const authChoice = await inquirer.prompt([
         {
             type: 'list',
             name: 'method',
@@ -557,14 +575,14 @@ async function loginCommand(options) {
 async function handleVendorKeyAuth(vendorKey, config) {
     // Check for authentication delay before attempting
     await handleAuthDelay(config);
-    const spinner = (0, ora_1.default)('Validating vendor key...').start();
+    const spinner = ora('Validating vendor key...').start();
     try {
         await config.setVendorKey(vendorKey);
         // Test the vendor key with a health check
-        await api_js_1.apiClient.get('/health');
+        await apiClient.get('/health');
         spinner.succeed('Vendor key authentication successful');
         console.log();
-        console.log(chalk_1.default.green('✓ Authenticated with vendor key'));
+        console.log(chalk.green('✓ Authenticated with vendor key'));
         console.log(colors.info('Ready to use Onasis-Core services'));
     }
     catch (error) {
@@ -576,16 +594,16 @@ async function handleVendorKeyAuth(vendorKey, config) {
 }
 async function handleVendorKeyFlow(config) {
     console.log();
-    console.log(chalk_1.default.yellow('🔑 Vendor Key Authentication'));
-    console.log(chalk_1.default.gray('Vendor keys provide secure API access for automation and integrations.'));
+    console.log(chalk.yellow('🔑 Vendor Key Authentication'));
+    console.log(chalk.gray('Vendor keys provide secure API access for automation and integrations.'));
     console.log();
     // Enhanced guidance for obtaining vendor keys
-    console.log(chalk_1.default.cyan('📋 How to get your vendor key:'));
-    console.log(chalk_1.default.gray('1. Visit your Lanonasis dashboard at https://dashboard.lanonasis.com'));
-    console.log(chalk_1.default.gray('2. Navigate to Settings → API Keys'));
-    console.log(chalk_1.default.gray('3. Click "Generate New Key" and copy the full key value'));
+    console.log(chalk.cyan('📋 How to get your vendor key:'));
+    console.log(chalk.gray('1. Visit your Lanonasis dashboard at https://dashboard.lanonasis.com'));
+    console.log(chalk.gray('2. Navigate to Settings → API Keys'));
+    console.log(chalk.gray('3. Click "Generate New Key" and copy the full key value'));
     console.log();
-    const { vendorKey } = await inquirer_1.default.prompt([
+    const { vendorKey } = await inquirer.prompt([
         {
             type: 'password',
             name: 'vendorKey',
@@ -600,10 +618,10 @@ async function handleVendorKeyFlow(config) {
 }
 async function handleOAuthFlow(config) {
     console.log();
-    console.log(chalk_1.default.yellow('🌐 Browser-Based OAuth2 Authentication'));
-    console.log(chalk_1.default.gray('Secure authentication using OAuth2 with PKCE'));
+    console.log(chalk.yellow('🌐 Browser-Based OAuth2 Authentication'));
+    console.log(chalk.gray('Secure authentication using OAuth2 with PKCE'));
     console.log();
-    const { openBrowser } = await inquirer_1.default.prompt([
+    const { openBrowser } = await inquirer.prompt([
         {
             type: 'confirm',
             name: 'openBrowser',
@@ -612,41 +630,49 @@ async function handleOAuthFlow(config) {
         }
     ]);
     if (!openBrowser) {
-        console.log(chalk_1.default.yellow('⚠️  Authentication cancelled'));
+        console.log(chalk.yellow('⚠️  Authentication cancelled'));
         return;
     }
     try {
         // Generate PKCE challenge
         const pkce = generatePKCE();
-        console.log(chalk_1.default.gray('   ✓ Generated PKCE challenge'));
+        console.log(chalk.gray('   ✓ Generated PKCE challenge'));
         // Start local callback server
         const callbackPort = 8888;
         const callbackPromise = createCallbackServer(callbackPort);
-        console.log(chalk_1.default.gray(`   ✓ Started local callback server on port ${callbackPort}`));
+        console.log(chalk.gray(`   ✓ Started local callback server on port ${callbackPort}`));
         // Build OAuth2 authorization URL
         const authBase = config.getDiscoveredApiUrl();
+        const redirectUri = `http://localhost:${callbackPort}/callback`;
         const authUrl = new URL(`${authBase}/oauth/authorize`);
         authUrl.searchParams.set('response_type', 'code');
         authUrl.searchParams.set('client_id', 'lanonasis-cli');
-        authUrl.searchParams.set('redirect_uri', `http://localhost:${callbackPort}/callback`);
+        authUrl.searchParams.set('redirect_uri', redirectUri);
         authUrl.searchParams.set('scope', 'read write offline_access');
         authUrl.searchParams.set('code_challenge', pkce.challenge);
         authUrl.searchParams.set('code_challenge_method', 'S256');
-        authUrl.searchParams.set('state', crypto_1.default.randomBytes(16).toString('hex'));
+        authUrl.searchParams.set('state', crypto.randomBytes(16).toString('hex'));
         console.log();
         console.log(colors.info('Opening browser for authentication...'));
-        await (0, open_1.default)(authUrl.toString());
+        await open(authUrl.toString());
         console.log(colors.info('Waiting for authentication in browser...'));
         console.log(colors.muted(`If browser doesn't open, visit: ${authUrl.toString()}`));
         console.log();
         // Wait for callback
-        const spinner = (0, ora_1.default)('Waiting for authorization...').start();
+        const spinner = ora('Waiting for authorization...').start();
         const { code } = await callbackPromise;
         spinner.succeed('Authorization code received');
         // Exchange code for tokens
         spinner.text = 'Exchanging code for access tokens...';
         spinner.start();
-        const tokens = await exchangeCodeForTokens(code, pkce.verifier, authBase);
+        // Debug logging in verbose mode
+        if (process.env.CLI_VERBOSE === 'true') {
+            console.log(chalk.dim(`   Code length: ${code.length}`));
+            console.log(chalk.dim(`   Verifier length: ${pkce.verifier.length}`));
+            console.log(chalk.dim(`   Redirect URI: ${redirectUri}`));
+            console.log(chalk.dim(`   Token endpoint: ${authBase}/oauth/token`));
+        }
+        const tokens = await exchangeCodeForTokens(code, pkce.verifier, authBase, redirectUri);
         spinner.succeed('Access tokens received');
         // Store tokens
         await config.setToken(tokens.access_token);
@@ -654,27 +680,68 @@ async function handleOAuthFlow(config) {
         await config.set('token_expires_at', Date.now() + (tokens.expires_in * 1000));
         await config.set('authMethod', 'oauth2');
         console.log();
-        console.log(chalk_1.default.green('✓ OAuth2 authentication successful'));
+        console.log(chalk.green('✓ OAuth2 authentication successful'));
         console.log(colors.info('You can now use Lanonasis services'));
         process.exit(0);
     }
     catch (error) {
-        console.error(chalk_1.default.red('✖ OAuth2 authentication failed'));
+        console.error(chalk.red('✖ OAuth2 authentication failed'));
+        // Display detailed error information
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        console.error(chalk_1.default.gray(`   ${errorMessage}`));
+        console.error(chalk.gray(`   ${errorMessage}`));
+        // Show validation details if available
+        if (error.details) {
+            console.error(chalk.yellow('\n   Validation errors:'));
+            for (const [field, messages] of Object.entries(error.details)) {
+                const msgArray = Array.isArray(messages) ? messages : [messages];
+                msgArray.forEach((msg) => {
+                    console.error(chalk.gray(`     • ${field}: ${msg}`));
+                });
+            }
+        }
+        // Show error data if available
+        if (error.errorData) {
+            const errorData = error.errorData;
+            if (errorData.error) {
+                console.error(chalk.yellow(`\n   Error: ${errorData.error}`));
+            }
+            if (errorData.error_description) {
+                console.error(chalk.gray(`   ${errorData.error_description}`));
+            }
+            // Show details if not already shown above
+            if (!error.details && errorData.details) {
+                console.error(chalk.yellow('\n   Details:'));
+                console.error(chalk.gray(JSON.stringify(errorData.details, null, 2)));
+            }
+        }
+        // Show full error response in verbose mode
+        if (process.env.CLI_VERBOSE === 'true') {
+            if (error.response?.data) {
+                console.error(chalk.dim('\n   Full error response:'));
+                console.error(chalk.dim(JSON.stringify(error.response.data, null, 2)));
+            }
+            if (error.response?.config) {
+                console.error(chalk.dim('\n   Request config:'));
+                console.error(chalk.dim(JSON.stringify({
+                    url: error.response.config.url,
+                    method: error.response.config.method,
+                    data: error.response.config.data
+                }, null, 2)));
+            }
+        }
         process.exit(1);
     }
 }
 async function handleCredentialsFlow(options, config) {
     console.log();
-    console.log(chalk_1.default.yellow('⚙️  Username/Password Authentication'));
+    console.log(chalk.yellow('⚙️  Username/Password Authentication'));
     console.log();
     // Check for authentication delay before attempting
     await handleAuthDelay(config);
     let { email, password } = options;
     // Get credentials if not provided
     if (!email || !password) {
-        const answers = await inquirer_1.default.prompt([
+        const answers = await inquirer.prompt([
             {
                 type: 'input',
                 name: 'email',
@@ -696,14 +763,14 @@ async function handleCredentialsFlow(options, config) {
         email = answers.email;
         password = answers.password;
     }
-    const spinner = (0, ora_1.default)('Authenticating...').start();
+    const spinner = ora('Authenticating...').start();
     try {
-        const response = await api_js_1.apiClient.login(email, password);
+        const response = await apiClient.login(email, password);
         // Store token and user info
         await config.setToken(response.token);
         spinner.succeed('Login successful');
         console.log();
-        console.log(chalk_1.default.green('✓ Authenticated successfully'));
+        console.log(chalk.green('✓ Authenticated successfully'));
         console.log(`Welcome, ${response.user.email}!`);
         if (response.user.organization_id) {
             console.log(`Organization: ${response.user.organization_id}`);
@@ -718,7 +785,7 @@ async function handleCredentialsFlow(options, config) {
         const errorResponse = error && typeof error === 'object' && 'response' in error ? error.response : null;
         if (errorResponse && typeof errorResponse === 'object' && 'status' in errorResponse && errorResponse.status === 401) {
             console.log();
-            const answer = await inquirer_1.default.prompt([
+            const answer = await inquirer.prompt([
                 {
                     type: 'confirm',
                     name: 'register',
@@ -736,9 +803,9 @@ async function handleCredentialsFlow(options, config) {
 }
 async function registerFlow(defaultEmail) {
     console.log();
-    console.log(chalk_1.default.blue.bold('📝 Create New Account'));
+    console.log(chalk.blue.bold('📝 Create New Account'));
     console.log();
-    const answers = await inquirer_1.default.prompt([
+    const answers = await inquirer.prompt([
         {
             type: 'input',
             name: 'email',
@@ -772,14 +839,14 @@ async function registerFlow(defaultEmail) {
             default: ''
         }
     ]);
-    const spinner = (0, ora_1.default)('Creating account...').start();
+    const spinner = ora('Creating account...').start();
     try {
-        const response = await api_js_1.apiClient.register(answers.email, answers.password, answers.organizationName || undefined);
-        const config = new config_js_1.CLIConfig();
+        const response = await apiClient.register(answers.email, answers.password, answers.organizationName || undefined);
+        const config = new CLIConfig();
         await config.setToken(response.token);
         spinner.succeed('Account created successfully');
         console.log();
-        console.log(chalk_1.default.green('✓ Account created and authenticated'));
+        console.log(chalk.green('✓ Account created and authenticated'));
         console.log(`Welcome to MaaS, ${response.user.email}!`);
         if (answers.organizationName) {
             console.log(`Organization: ${answers.organizationName}`);
@@ -789,7 +856,7 @@ async function registerFlow(defaultEmail) {
     catch (error) {
         spinner.fail('Registration failed');
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        console.error(chalk_1.default.red('✖ Registration failed:'), errorMessage);
+        console.error(chalk.red('✖ Registration failed:'), errorMessage);
         process.exit(1);
     }
 }