@lanonasis/cli 3.7.2 → 3.7.4

package/README.md

@@ -26,14 +26,25 @@ lanonasis --version  # or onasis --version
 onasis guide
 
 # Quick manual setup
-onasis init                                    # Initialize configuration
-onasis login --vendor-key pk_xxx.sk_xxx      # Authenticate with vendor key
-onasis health                                 # Verify system health
+onasis init                                      # Initialize configuration
+onasis login --vendor-key <your-vendor-key>      # Authenticate with vendor key
+onasis health                                   # Verify system health
 
 # Create your first memory
 onasis memory create --title "Welcome" --content "My first memory"
 ```
 
+## 🤖 Claude Desktop Integration
+
+For instant Claude Desktop MCP integration with OAuth2 authentication, see our [Claude Desktop Setup Guide](./CLAUDE_DESKTOP_SETUP.md).
+
+**Quick Links**:
+- **Authorization Endpoint**: `https://auth.lanonasis.com/oauth/authorize`
+- **Client ID**: `claude-desktop`
+- **Scopes**: `mcp:full memories:read memories:write`
+
+The guide includes complete OAuth2 configuration, available MCP tools, and troubleshooting steps.
+
 ## 🎯 Command Aliases
 
 The CLI supports multiple command aliases for different use cases:
@@ -74,10 +85,10 @@ onasis login --vendor-key pk_xxxxx.sk_xxxxx  // ✅ Automatically hashed
 
 ### 1. Vendor Key Authentication (Recommended)
 
-Best for API integrations and automation:
+Best for API integrations and automation. Copy the vendor key value exactly as shown in your LanOnasis dashboard (keys may vary in format):
 
 ```bash
-onasis login --vendor-key pk_xxxxx.sk_xxxxx
+onasis login --vendor-key <your-vendor-key>
 ```
 
 ### 2. OAuth Browser Authentication
@@ -277,7 +288,7 @@ Location: `~/.maas/config.json`
   "apiUrl": "https://api.lanonasis.com/api/v1",
   "defaultOutputFormat": "table",
   "mcpPreference": "auto",
-  "vendorKey": "pk_xxxxx.sk_xxxxx"
+  "vendorKey": "<your-vendor-key>"
 }
 ```
 
@@ -363,7 +374,7 @@ onasis auth status
 
 # Re-authenticate
 onasis auth logout
-onasis login --vendor-key pk_xxx.sk_xxx
+onasis login --vendor-key <your-vendor-key>
 ```
 
 #### Connection Issues

package/dist/commands/auth.js

@@ -305,6 +305,40 @@ async function refreshOAuth2Token(config) {
         return false;
     }
 }
+/**
+ * Exchange Supabase JWT token for auth-gateway API key
+ * This enables CLI to work with MCP WebSocket and all services seamlessly
+ */
+async function exchangeSupabaseTokenForApiKey(supabaseToken, config) {
+    try {
+        const discoveredServices = config.get('discoveredServices');
+        const authBase = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
+        if (process.env.CLI_VERBOSE === 'true') {
+            console.log(chalk.dim(`   Exchanging token at: ${authBase}/v1/auth/token/exchange`));
+        }
+        const response = await axios.post(`${authBase}/v1/auth/token/exchange`, {
+            project_scope: 'lanonasis-maas',
+            platform: 'cli'
+        }, {
+            headers: {
+                'Authorization': `Bearer ${supabaseToken}`,
+                'Content-Type': 'application/json',
+                'X-Project-Scope': 'lanonasis-maas'
+            }
+        });
+        return {
+            access_token: response.data.access_token,
+            user: response.data.user
+        };
+    }
+    catch (error) {
+        console.error(chalk.yellow('⚠️  Token exchange failed:', error.message));
+        if (process.env.CLI_VERBOSE === 'true' && error.response) {
+            console.error(chalk.dim('   Response:', JSON.stringify(error.response.data, null, 2)));
+        }
+        return null;
+    }
+}
 export async function diagnoseCommand() {
     const config = new CLIConfig();
     await config.init();
@@ -674,14 +708,33 @@ async function handleOAuthFlow(config) {
         }
         const tokens = await exchangeCodeForTokens(code, pkce.verifier, authBase, redirectUri);
         spinner.succeed('Access tokens received');
-        // Store tokens
+        // Store OAuth tokens
         await config.setToken(tokens.access_token);
         await config.set('refresh_token', tokens.refresh_token);
         await config.set('token_expires_at', Date.now() + (tokens.expires_in * 1000));
-        await config.set('authMethod', 'oauth2');
-        console.log();
-        console.log(chalk.green('✓ OAuth2 authentication successful'));
-        console.log(colors.info('You can now use Lanonasis services'));
+        // Exchange for unified API key
+        spinner.text = 'Configuring unified access...';
+        spinner.start();
+        const exchangeResult = await exchangeSupabaseTokenForApiKey(tokens.access_token, config);
+        if (exchangeResult) {
+            // Store the auth-gateway API key for MCP and other services
+            await config.setVendorKey(exchangeResult.access_token);
+            await config.set('authMethod', 'oauth2');
+            spinner.succeed('Unified authentication configured');
+            console.log();
+            console.log(chalk.green('✓ OAuth2 authentication successful'));
+            console.log(colors.info('You can now use all Lanonasis services'));
+            console.log(chalk.gray('✓ MCP, API, and CLI access configured'));
+        }
+        else {
+            // Fallback
+            await config.set('authMethod', 'oauth2');
+            spinner.warn('Token exchange failed, OAuth token stored');
+            console.log();
+            console.log(chalk.green('✓ OAuth2 authentication successful'));
+            console.log(colors.info('You can now use Lanonasis services'));
+            console.log(chalk.yellow('⚠️  Some services may require re-authentication'));
+        }
         process.exit(0);
     }
     catch (error) {
@@ -766,16 +819,32 @@ async function handleCredentialsFlow(options, config) {
     const spinner = ora('Authenticating...').start();
     try {
         const response = await apiClient.login(email, password);
-        // Store token and user info
-        await config.setToken(response.token);
+        if (process.env.CLI_VERBOSE === 'true') {
+            console.log(chalk.dim('   Login response:'), JSON.stringify(response, null, 2));
+        }
+        // The auth-gateway login endpoint already returns the correct token format
+        // No need to exchange - this token works with all services (MCP, API, CLI)
+        const authToken = response.token || response.access_token;
+        if (!authToken) {
+            throw new Error('No token received from login response');
+        }
+        if (process.env.CLI_VERBOSE === 'true') {
+            console.log(chalk.dim(`   JWT received (length: ${authToken.length})`));
+        }
+        // Store JWT token for API authentication
+        await config.setToken(authToken);
+        await config.set('authMethod', 'jwt');
         spinner.succeed('Login successful');
         console.log();
         console.log(chalk.green('✓ Authenticated successfully'));
         console.log(`Welcome, ${response.user.email}!`);
-        if (response.user.organization_id) {
-            console.log(`Organization: ${response.user.organization_id}`);
+        if (response.user.role) {
+            console.log(`Role: ${response.user.role}`);
         }
-        console.log(`Plan: ${response.user.plan || 'free'}`);
+        console.log(chalk.gray('✓ API access configured'));
+        console.log();
+        console.log(chalk.dim('Note: MCP WebSocket commands require a vendor key.'));
+        console.log(chalk.dim('Run'), chalk.white('onasis auth vendor-key <key>'), chalk.dim('to configure MCP access.'));
     }
     catch (error) {
         spinner.fail('Login failed');

package/dist/mcp/access-control.js

@@ -64,8 +64,16 @@ export class MemoryAccessControl {
             // Get shared memories based on permissions
             const sharedMemories = await this.getSharedMemories(userId, appId);
             // Combine and deduplicate
-            const allMemories = [...new Set([...ownMemories, ...sharedMemories])];
-            return allMemories;
+            const combined = [...ownMemories, ...sharedMemories];
+            const deduped = [];
+            const seen = new Set();
+            combined.forEach(memoryId => {
+                if (!seen.has(memoryId)) {
+                    seen.add(memoryId);
+                    deduped.push(memoryId);
+                }
+            });
+            return deduped;
         }
         catch (error) {
             logger.error('Failed to get accessible memories', { error, userId, appId });

package/dist/mcp/client/enhanced-client.js

@@ -45,11 +45,11 @@ export class EnhancedMCPClient extends EventEmitter {
         }));
         await Promise.allSettled(connectionPromises);
         // Start health monitoring for connected servers
-        for (const [name, success] of results) {
+        results.forEach((success, name) => {
             if (success) {
                 this.startHealthMonitoring(name);
             }
-        }
+        });
         return results;
     }
     /**
@@ -327,12 +327,12 @@ export class EnhancedMCPClient extends EventEmitter {
      */
     async disconnectAll() {
         // Stop all health monitoring
-        for (const interval of this.healthCheckIntervals.values()) {
+        this.healthCheckIntervals.forEach(interval => {
             clearInterval(interval);
-        }
+        });
         this.healthCheckIntervals.clear();
         // Disconnect all clients
-        for (const [name, client] of this.clients) {
+        await Promise.all(Array.from(this.clients.entries()).map(async ([name, client]) => {
             try {
                 await client.close();
                 console.log(chalk.gray(`Disconnected from ${name}`));
@@ -340,7 +340,7 @@ export class EnhancedMCPClient extends EventEmitter {
             catch {
                 console.log(chalk.yellow(`Warning: Error disconnecting from ${name}`));
             }
-        }
+        }));
         this.clients.clear();
         this.transports.clear();
         this.connectionStatus.clear();

package/dist/mcp/schemas/tool-schemas.d.ts

@@ -202,13 +202,13 @@ export declare const SystemConfigSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     value?: any;
     action?: "get" | "set" | "reset";
-    key?: string;
     scope?: "user" | "global";
+    key?: string;
 }, {
     value?: any;
     action?: "get" | "set" | "reset";
-    key?: string;
     scope?: "user" | "global";
+    key?: string;
 }>;
 export declare const BulkOperationSchema: z.ZodObject<{
     operation: z.ZodEnum<["create", "update", "delete"]>;
@@ -580,13 +580,13 @@ export declare const MCPSchemas: {
         }, "strip", z.ZodTypeAny, {
             value?: any;
             action?: "get" | "set" | "reset";
-            key?: string;
             scope?: "user" | "global";
+            key?: string;
         }, {
             value?: any;
             action?: "get" | "set" | "reset";
-            key?: string;
             scope?: "user" | "global";
+            key?: string;
         }>;
     };
     operations: {

package/dist/mcp/server/lanonasis-server.js

@@ -916,7 +916,7 @@ Please choose an option (1-4):`
             connectionsByTransport: {}
         };
         const fiveMinutesAgo = Date.now() - (5 * 60 * 1000);
-        for (const connection of this.connectionPool.values()) {
+        this.connectionPool.forEach(connection => {
             // Count as active if there was activity in the last 5 minutes
             if (connection.lastActivity.getTime() > fiveMinutesAgo) {
                 stats.activeConnections++;
@@ -926,7 +926,7 @@ Please choose an option (1-4):`
             }
             stats.connectionsByTransport[connection.transport] =
                 (stats.connectionsByTransport[connection.transport] || 0) + 1;
-        }
+        });
         return stats;
     }
     /**
@@ -953,12 +953,13 @@ Please choose an option (1-4):`
     cleanupStaleConnections() {
         const tenMinutesAgo = Date.now() - (10 * 60 * 1000);
         const staleConnections = [];
-        for (const [clientId, connection] of this.connectionPool.entries()) {
+        this.connectionPool.forEach((connection, clientId) => {
             if (connection.lastActivity.getTime() < tenMinutesAgo) {
                 staleConnections.push(clientId);
             }
-        }
-        for (const clientId of staleConnections) {
+        });
+        for (let i = 0; i < staleConnections.length; i++) {
+            const clientId = staleConnections[i];
             this.removeConnection(clientId);
             if (this.options.verbose) {
                 console.log(chalk.yellow(`🧹 Cleaned up stale connection: ${clientId}`));
@@ -1385,12 +1386,12 @@ Please choose an option (1-4):`
      */
     getTransportStatus() {
         const failures = {};
-        for (const [transport, failure] of this.transportFailures.entries()) {
+        this.transportFailures.forEach((failure, transport) => {
             failures[transport] = {
                 count: failure.count,
                 lastFailure: failure.lastFailure.toISOString()
             };
-        }
+        });
         return {
             supportedTransports: this.supportedTransports,
             preferredTransport: this.options.preferredTransport || 'stdio',

package/dist/mcp/transports/transport-manager.js

@@ -411,9 +411,9 @@ export class MCPTransportManager {
      */
     getStatuses() {
         const statuses = {};
-        for (const [name, transport] of this.transports) {
+        this.transports.forEach((transport, name) => {
             statuses[name] = transport.isConnected();
-        }
+        });
         return statuses;
     }
     /**

package/dist/mcp-server.js

@@ -51,10 +51,14 @@ export class CLIMCPServer {
         }
         candidates.add(join(process.cwd(), 'mcp-server/dist/cli-aligned-mcp-server.js'));
         candidates.add(join(__dirname, '../../../mcp-server/dist/cli-aligned-mcp-server.js'));
-        for (const candidate of candidates) {
-            if (candidate && existsSync(candidate)) {
-                return candidate;
+        let resolvedPath = null;
+        candidates.forEach(candidate => {
+            if (!resolvedPath && candidate && existsSync(candidate)) {
+                resolvedPath = candidate;
             }
+        });
+        if (resolvedPath) {
+            return resolvedPath;
         }
         throw new Error('Unable to locate the CLI-aligned MCP server. Set MCP_SERVER_PATH or install @lanonasis/mcp-server.');
     }

package/dist/utils/api.js

@@ -101,64 +101,64 @@ export class APIClient {
     }
     // Memory operations - aligned with existing schema
     async createMemory(data) {
-        const response = await this.client.post('/api/v1/memory', data);
+        const response = await this.client.post('/memory', data);
         return response.data;
     }
     async getMemories(params = {}) {
-        const response = await this.client.get('/api/v1/memory', { params });
+        const response = await this.client.get('/memory', { params });
         return response.data;
     }
     async getMemory(id) {
-        const response = await this.client.get(`/api/v1/memory/${id}`);
+        const response = await this.client.get(`/memory/${id}`);
         return response.data;
     }
     async updateMemory(id, data) {
-        const response = await this.client.put(`/api/v1/memory/${id}`, data);
+        const response = await this.client.put(`/memory/${id}`, data);
         return response.data;
     }
     async deleteMemory(id) {
-        await this.client.delete(`/api/v1/memory/${id}`);
+        await this.client.delete(`/memory/${id}`);
     }
     async searchMemories(query, options = {}) {
-        const response = await this.client.post('/api/v1/memory/search', {
+        const response = await this.client.post('/memory/search', {
             query,
             ...options
         });
         return response.data;
     }
     async getMemoryStats() {
-        const response = await this.client.get('/api/v1/memory/stats');
+        const response = await this.client.get('/memory/stats');
         return response.data;
     }
     async bulkDeleteMemories(memoryIds) {
-        const response = await this.client.post('/api/v1/memory/bulk/delete', {
+        const response = await this.client.post('/memory/bulk/delete', {
             memory_ids: memoryIds
         });
         return response.data;
     }
     // Topic operations - working with existing memory_topics table
     async createTopic(data) {
-        const response = await this.client.post('/api/v1/topics', data);
+        const response = await this.client.post('/topics', data);
         return response.data;
     }
     async getTopics() {
-        const response = await this.client.get('/api/v1/topics');
+        const response = await this.client.get('/topics');
         return response.data;
     }
     async getTopic(id) {
-        const response = await this.client.get(`/api/v1/topics/${id}`);
+        const response = await this.client.get(`/topics/${id}`);
         return response.data;
     }
     async updateTopic(id, data) {
-        const response = await this.client.put(`/api/v1/topics/${id}`, data);
+        const response = await this.client.put(`/topics/${id}`, data);
         return response.data;
     }
     async deleteTopic(id) {
-        await this.client.delete(`/api/v1/topics/${id}`);
+        await this.client.delete(`/topics/${id}`);
     }
     // Health check
     async getHealth() {
-        const response = await this.client.get('/api/v1/health');
+        const response = await this.client.get('/health');
         return response.data;
     }
     // Generic HTTP methods

package/dist/utils/config.d.ts

@@ -61,7 +61,9 @@ export declare class CLIConfig {
     private acquireLock;
     private releaseLock;
     getApiUrl(): string;
+    getApiUrlsWithFallbacks(): string[];
     discoverServices(verbose?: boolean): Promise<void>;
+    private normalizeServiceError;
     private handleServiceDiscoveryFailure;
     private categorizeServiceDiscoveryError;
     private resolveFallbackEndpoints;

package/dist/utils/config.js

@@ -4,6 +4,7 @@ import * as os from 'os';
 import { jwtDecode } from 'jwt-decode';
 import { randomUUID } from 'crypto';
 import { ApiKeyStorage } from '@lanonasis/oauth-client';
+import axios from 'axios';
 export class CLIConfig {
     configDir;
     configPath;
@@ -169,12 +170,23 @@ export class CLIConfig {
     getApiUrl() {
         return process.env.MEMORY_API_URL ||
             this.config.apiUrl ||
-            'https://mcp.lanonasis.com/api/v1';
+            'https://api.lanonasis.com';
+    }
+    // Get API URLs with fallbacks - try multiple endpoints
+    getApiUrlsWithFallbacks() {
+        const primary = this.getApiUrl();
+        const fallbacks = [
+            'https://api.lanonasis.com',
+            'https://mcp.lanonasis.com'
+        ];
+        // Remove duplicates and return primary first
+        return [primary, ...fallbacks.filter(url => url !== primary)];
     }
     // Enhanced Service Discovery Integration
     async discoverServices(verbose = false) {
-        // Skip service discovery in test environment
-        if (process.env.NODE_ENV === 'test' || process.env.SKIP_SERVICE_DISCOVERY === 'true') {
+        const isTestEnvironment = process.env.NODE_ENV === 'test';
+        const forceDiscovery = process.env.FORCE_SERVICE_DISCOVERY === 'true';
+        if ((isTestEnvironment && !forceDiscovery) || process.env.SKIP_SERVICE_DISCOVERY === 'true') {
             if (!this.config.discoveredServices) {
                 this.config.discoveredServices = {
                     auth_base: 'https://auth.lanonasis.com',
@@ -187,26 +199,47 @@ export class CLIConfig {
             }
             return;
         }
-        const discoveryUrl = 'https://mcp.lanonasis.com/.well-known/onasis.json';
-        try {
-            // Use axios instead of fetch for consistency
-            const axios = (await import('axios')).default;
-            if (verbose) {
-                console.log(`🔍 Discovering services from ${discoveryUrl}...`);
-            }
-            const response = await axios.get(discoveryUrl, {
-                timeout: 10000,
-                maxRedirects: 5,
-                proxy: false, // Bypass proxy to avoid redirect loops
-                headers: {
-                    'User-Agent': 'Lanonasis-CLI/3.0.13'
+        // Try multiple discovery URLs with fallbacks
+        const discoveryUrls = [
+            'https://api.lanonasis.com/.well-known/onasis.json',
+            'https://mcp.lanonasis.com/.well-known/onasis.json'
+        ];
+        let response = null;
+        let lastError = null;
+        // Use axios instead of fetch for consistency
+        const axios = (await import('axios')).default;
+        for (const discoveryUrl of discoveryUrls) {
+            try {
+                if (verbose) {
+                    console.log(`🔍 Discovering services from ${discoveryUrl}...`);
                 }
-            });
-            // Map discovery response to our config format
+                response = await axios.get(discoveryUrl, {
+                    timeout: 10000,
+                    maxRedirects: 5,
+                    proxy: false, // Bypass proxy to avoid redirect loops
+                    headers: {
+                        'User-Agent': 'Lanonasis-CLI/3.0.13'
+                    }
+                });
+                if (verbose) {
+                    console.log(`✓ Successfully discovered services from ${discoveryUrl}`);
+                }
+                break; // Success, exit loop
+            }
+            catch (err) {
+                lastError = err;
+                if (verbose) {
+                    console.log(`⚠️  Failed to discover from ${discoveryUrl}, trying next...`);
+                }
+                continue;
+            }
+        }
+        if (!response) {
+            throw lastError || new Error('All service discovery URLs failed');
+        }
+        try {
             const discovered = response.data;
-            // Extract auth base, but filter out localhost URLs
             let authBase = discovered.auth?.base || discovered.auth?.login?.replace('/auth/login', '') || '';
-            // Override localhost with production auth endpoint
             if (authBase.includes('localhost') || authBase.includes('127.0.0.1')) {
                 authBase = 'https://auth.lanonasis.com';
             }
@@ -220,7 +253,6 @@ export class CLIConfig {
                 project_scope: 'lanonasis-maas'
             };
             this.config.apiUrl = memoryBase;
-            // Mark discovery as successful
             this.config.lastServiceDiscovery = new Date().toISOString();
             await this.save();
             if (verbose) {
@@ -231,9 +263,23 @@ export class CLIConfig {
             }
         }
         catch (error) {
-            // Enhanced error handling with user-visible messages
-            await this.handleServiceDiscoveryFailure(error, verbose);
+            const normalizedError = this.normalizeServiceError(error);
+            await this.handleServiceDiscoveryFailure(normalizedError, verbose);
+        }
+    }
+    normalizeServiceError(error) {
+        if (error && typeof error === 'object') {
+            if (error instanceof Error) {
+                return {
+                    ...error,
+                    message: error.message
+                };
+            }
+            return error;
         }
+        return {
+            message: typeof error === 'string' ? error : JSON.stringify(error)
+        };
     }
     async handleServiceDiscoveryFailure(error, verbose) {
         const errorType = this.categorizeServiceDiscoveryError(error);
@@ -260,7 +306,6 @@ export class CLIConfig {
                     console.log(`   Reason: ${error.message || 'Unknown error'}`);
             }
         }
-        // Use cached endpoints if available and recent (within 24 hours)
         if (this.config.discoveredServices && this.config.lastServiceDiscovery) {
             const lastDiscovery = new Date(this.config.lastServiceDiscovery);
             const hoursSinceDiscovery = (Date.now() - lastDiscovery.getTime()) / (1000 * 60 * 60);
@@ -277,7 +322,6 @@ export class CLIConfig {
             project_scope: 'lanonasis-maas'
         };
         this.config.apiUrl = fallback.endpoints.memory_base;
-        // Mark as fallback (don't set lastServiceDiscovery)
         await this.save();
         this.logFallbackUsage(fallback.source, this.config.discoveredServices);
         if (verbose) {
@@ -297,7 +341,7 @@ export class CLIConfig {
                     return 'timeout';
             }
         }
-        if (error.response?.status >= 500) {
+        if ((error.response?.status ?? 0) >= 500) {
             return 'server_error';
         }
         if (error.response?.status === 404) {
@@ -387,9 +431,17 @@ export class CLIConfig {
             // Initialize with defaults first
             await this.discoverServices();
         }
+        const currentServices = this.config.discoveredServices ?? {
+            auth_base: 'https://auth.lanonasis.com',
+            memory_base: 'https://mcp.lanonasis.com/api/v1',
+            mcp_base: 'https://mcp.lanonasis.com/api/v1',
+            mcp_ws_base: 'wss://mcp.lanonasis.com/ws',
+            mcp_sse_base: 'https://mcp.lanonasis.com/api/v1/events',
+            project_scope: 'lanonasis-maas'
+        };
         // Merge manual overrides with existing endpoints
         this.config.discoveredServices = {
-            ...this.config.discoveredServices,
+            ...currentServices,
             ...endpoints
         };
         // Mark as manually configured
@@ -449,56 +501,26 @@ export class CLIConfig {
         return true;
     }
     async validateVendorKeyWithServer(vendorKey) {
+        if (process.env.SKIP_SERVER_VALIDATION === 'true') {
+            return;
+        }
         try {
             // Import axios dynamically to avoid circular dependency
-            const axios = (await import('axios')).default;
             // Ensure service discovery is done
             await this.discoverServices();
             const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            const normalizedBase = authBase.replace(/\/$/, '');
-            // Try multiple validation endpoints
-            const validationEndpoints = [
-                `${normalizedBase}/api/v1/auth/validate`,
-                `${normalizedBase}/api/v1/auth/validate-vendor-key`,
-                `${normalizedBase}/v1/auth/validate`
-            ];
-            let lastError;
-            let validated = false;
-            for (const endpoint of validationEndpoints) {
-                try {
-                    const response = await axios.post(endpoint, { key: vendorKey }, {
-                        headers: {
-                            'X-API-Key': vendorKey,
-                            'X-Auth-Method': 'vendor_key',
-                            'X-Project-Scope': 'lanonasis-maas',
-                            'Content-Type': 'application/json'
-                        },
-                        timeout: 10000,
-                        proxy: false
-                    });
-                    // Check if response indicates validation success
-                    if (response.data && (response.data.valid === true || response.data.success === true)) {
-                        validated = true;
-                        break;
-                    }
-                }
-                catch (error) {
-                    lastError = error;
-                    // Continue to next endpoint if this one fails
-                    continue;
-                }
-            }
-            if (!validated && lastError) {
-                throw lastError;
-            }
-            else if (!validated) {
-                throw new Error('Vendor key validation failed: Unable to validate key with server');
-            }
+            // Use pingAuthHealth for validation (simpler and more reliable)
+            await this.pingAuthHealth(axios, authBase, {
+                'X-API-Key': vendorKey,
+                'X-Auth-Method': 'vendor_key',
+                'X-Project-Scope': 'lanonasis-maas'
+            }, { timeout: 10000, proxy: false });
         }
         catch (error) {
+            const normalizedError = this.normalizeServiceError(error);
             // Provide specific error messages based on response
-            if (error.response?.status === 401) {
-                const errorData = error.response.data;
+            if (normalizedError.response?.status === 401) {
+                const errorData = normalizedError.response.data;
                 if (errorData?.error?.includes('expired') || errorData?.message?.includes('expired')) {
                     throw new Error('Vendor key validation failed: Key has expired. Please generate a new key from your dashboard.');
                 }
@@ -512,29 +534,29 @@ export class CLIConfig {
                     throw new Error('Vendor key validation failed: Authentication failed. The key may be invalid, expired, or revoked.');
                 }
             }
-            else if (error.response?.status === 403) {
+            else if (normalizedError.response?.status === 403) {
                 throw new Error('Vendor key access denied. The key may not have sufficient permissions for this operation.');
             }
-            else if (error.response?.status === 429) {
+            else if (normalizedError.response?.status === 429) {
                 throw new Error('Too many validation attempts. Please wait a moment before trying again.');
             }
-            else if (error.response?.status >= 500) {
+            else if ((normalizedError.response?.status ?? 0) >= 500) {
                 throw new Error('Server error during validation. Please try again in a few moments.');
             }
-            else if (error.code === 'ECONNREFUSED') {
+            else if (normalizedError.code === 'ECONNREFUSED') {
                 throw new Error('Cannot connect to authentication server. Please check your internet connection and try again.');
             }
-            else if (error.code === 'ENOTFOUND') {
+            else if (normalizedError.code === 'ENOTFOUND') {
                 throw new Error('Authentication server not found. Please check your internet connection.');
             }
-            else if (error.code === 'ETIMEDOUT') {
+            else if (normalizedError.code === 'ETIMEDOUT') {
                 throw new Error('Validation request timed out. Please check your internet connection and try again.');
             }
-            else if (error.code === 'ECONNRESET') {
+            else if (normalizedError.code === 'ECONNRESET') {
                 throw new Error('Connection was reset during validation. Please try again.');
             }
             else {
-                throw new Error(`Vendor key validation failed: ${error.message || 'Unknown error'}`);
+                throw new Error(`Vendor key validation failed: ${normalizedError.message || 'Unknown error'}`);
             }
         }
     }
@@ -697,7 +719,6 @@ export class CLIConfig {
         // If not locally valid, attempt server verification before failing
         if (!locallyValid) {
             try {
-                const axios = (await import('axios')).default;
                 const endpoints = [
                     'http://localhost:4000/v1/auth/verify-token',
                     'https://auth.lanonasis.com/v1/auth/verify-token'
@@ -734,7 +755,6 @@ export class CLIConfig {
         }
         // Verify with server (security check) for tokens that haven't been validated recently
         try {
-            const axios = (await import('axios')).default;
             // Try auth-gateway first (port 4000), then fall back to Netlify function
             const endpoints = [
                 'http://localhost:4000/v1/auth/verify-token',
@@ -846,7 +866,6 @@ export class CLIConfig {
                 return false;
             }
             // Import axios dynamically to avoid circular dependency
-            const axios = (await import('axios')).default;
             // Ensure service discovery is done
             await this.discoverServices();
             const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
@@ -891,7 +910,6 @@ export class CLIConfig {
             // Refresh if token expires within 5 minutes
             if (exp > 0 && (exp - now) < 300) {
                 // Import axios dynamically
-                const axios = (await import('axios')).default;
                 await this.discoverServices();
                 const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
                 // Attempt token refresh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.7.2",
+  "version": "3.7.4",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",