@lanonasis/cli 3.9.5 → 3.9.6

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.6] - 2026-02-21
+
+### 🐛 Bug Fixes
+
+- **Reliable Memory Auth Routing**: Memory CRUD and search operations now consistently route through the API gateway (`https://api.lanonasis.com`) to avoid MCP endpoint contract mismatches.
+- **Legacy Endpoint Compatibility**: Added fallback support for deployments that still expose RPC-style memory routes (`/api/v1/memory/*`) when REST routes return `400/405`.
+- **Auth Status Accuracy**: `status` now validates live auth state against the auth verify endpoint before reporting authenticated session state.
+- **OAuth Session Stability**: Requests proactively refresh OAuth/JWT sessions to reduce intermittent `memory login required` errors during long-running CLI usage.
+- **Response Normalization**: Memory get/list/search handlers normalize wrapped gateway responses (`{ data: ... }`) for consistent CLI behavior across environments.
+
+### 📚 Documentation
+
+- Clarified auth flow behavior for vendor keys and bearer tokens.
+- Added release notes for endpoint override guidance and memory transport behavior.
+
 ## [3.9.3] - 2026-02-02
 
 ### ✨ Features

package/README.md

@@ -1,11 +1,11 @@
-# @lanonasis/cli v3.9.3 - Enterprise Security & Professional UX
+# @lanonasis/cli v3.9.6 - Auth Routing & Memory Reliability
 
 [![NPM Version](https://img.shields.io/npm/v/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![Downloads](https://img.shields.io/npm/dt/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Golden Contract](https://img.shields.io/badge/Onasis--Core-v0.1%20Compliant-gold)](https://api.lanonasis.com/.well-known/onasis.json)
 
-🎉 **NEW IN v3.9.3**: Fixed JWT authentication routing for username/password login, resolved frozen terminal during interactive input, and added non-interactive vendor key authentication (`-k` flag). Professional CLI UX with seamless inline text editing, intelligent MCP connection management, and first-run onboarding.
+🎉 **NEW IN v3.9.6**: Fixed memory auth routing to the API gateway, added compatibility fallbacks for legacy memory endpoints, improved auth status verification, and stabilized OAuth/JWT refresh behavior during CLI memory operations.
 
 ## 🚀 Quick Start
 
@@ -129,23 +129,19 @@ maas memory list
 
 ## 🔐 Security & Authentication
 
-### Enterprise-Grade SHA-256 Security (v3.7.0+)
+### Enterprise-Grade API Key Handling
 
-All API keys are now secured with SHA-256 cryptographic hashing:
+The CLI uses secure local storage and sends credentials in the expected wire format:
 
-- ✅ **Automatic Hash Normalization**: Keys are automatically hashed before transmission
-- ✅ **Double-Hash Prevention**: Smart detection prevents re-hashing already hashed keys
-- ✅ **Cross-Platform Compatibility**: Works seamlessly across Node.js and browser environments
-- ✅ **Zero Configuration**: Security is automatic and transparent
-
-```typescript
-// Hash utilities are built-in and automatic
-// Your vendor keys are automatically secured
-onasis login --vendor-key pk_xxxxx.sk_xxxxx  // ✅ Automatically hashed
-```
+- ✅ **Encrypted At Rest**: Vendor keys are stored in encrypted local storage (keytar when available, encrypted file fallback otherwise).
+- ✅ **Correct On-Wire Format**: Vendor key auth sends the raw vendor key in `X-API-Key` over HTTPS.
+- ✅ **Single Server-Side Hash Validation**: The API validates keys with server-side hashing and does not require client-side hashing.
+- ✅ **Token-First Sessions**: OAuth/JWT sessions use `Authorization: Bearer <token>` and refresh automatically before expiry.
 
 ### Authentication Methods
 
+> Transport note: for memory commands, keep `manualEndpointOverrides=false` so requests route through `https://api.lanonasis.com`.
+
 ### 1. Vendor Key Authentication (Recommended)
 
 Best for API integrations and automation. Copy the vendor key value exactly as shown in your LanOnasis dashboard (keys may vary in format):

package/dist/index-simple.js

@@ -553,18 +553,30 @@ program
     .action(async () => {
     // Initialize config first
     await cliConfig.init();
-    const isAuth = await cliConfig.isAuthenticated();
+    const verification = await cliConfig.verifyCurrentCredentialsWithServer().catch((error) => ({
+        valid: false,
+        method: 'none',
+        endpoint: undefined,
+        reason: error instanceof Error ? error.message : String(error)
+    }));
+    const isAuth = verification.valid;
     const apiUrl = cliConfig.getApiUrl();
     console.log(chalk.blue.bold('MaaS CLI Status'));
     console.log(`API URL: ${apiUrl}`);
     console.log(`Authenticated: ${isAuth ? chalk.green('Yes') : chalk.red('No')}`);
+    if (process.env.CLI_VERBOSE === 'true' && verification.endpoint) {
+        console.log(`Verified via: ${verification.endpoint}`);
+    }
     if (isAuth) {
         const user = await cliConfig.getCurrentUser();
         if (user) {
             console.log(`User: ${user.email}`);
             console.log(`Plan: ${user.plan}`);
         }
+        return;
     }
+    console.log(chalk.yellow(`Auth check: ${verification.reason || 'Credential validation failed'}`));
+    console.log(chalk.yellow('Please run:'), chalk.white('lanonasis auth login'));
 });
 // Health command using the healthCheck function
 program

package/dist/index.js

@@ -630,18 +630,30 @@ program
     .description('Show overall system status')
     .action(async () => {
     await cliConfig.init();
-    const isAuth = await cliConfig.isAuthenticated();
+    const verification = await cliConfig.verifyCurrentCredentialsWithServer().catch((error) => ({
+        valid: false,
+        method: 'none',
+        endpoint: undefined,
+        reason: error instanceof Error ? error.message : String(error)
+    }));
+    const isAuth = verification.valid;
     const apiUrl = cliConfig.getApiUrl();
     console.log(chalk.blue.bold('MaaS CLI Status'));
     console.log(`API URL: ${apiUrl}`);
     console.log(`Authenticated: ${isAuth ? chalk.green('Yes') : chalk.red('No')}`);
+    if (process.env.CLI_VERBOSE === 'true' && verification.endpoint) {
+        console.log(`Verified via: ${verification.endpoint}`);
+    }
     if (isAuth) {
         const user = await cliConfig.getCurrentUser();
         if (user) {
             console.log(`User: ${user.email}`);
             console.log(`Plan: ${user.plan}`);
         }
+        return;
     }
+    console.log(chalk.yellow(`Auth check: ${verification.reason || 'Credential validation failed'}`));
+    console.log(chalk.yellow('Please run:'), chalk.white('lanonasis auth login'));
 });
 // Health command using the healthCheck function
 program

package/dist/mcp/schemas/tool-schemas.d.ts

@@ -14,16 +14,16 @@ export declare const MemoryCreateSchema: z.ZodObject<{
     title?: string;
     content?: string;
     tags?: string[];
+    memory_type?: "context" | "reference" | "note";
     topic_id?: string;
     metadata?: Record<string, any>;
-    memory_type?: "context" | "reference" | "note";
 }, {
     title?: string;
     content?: string;
     tags?: string[];
+    memory_type?: "context" | "reference" | "note";
     topic_id?: string;
     metadata?: Record<string, any>;
-    memory_type?: "context" | "reference" | "note";
 }>;
 export declare const MemorySearchSchema: z.ZodObject<{
     query: z.ZodString;
@@ -36,16 +36,16 @@ export declare const MemorySearchSchema: z.ZodObject<{
     query?: string;
     tags?: string[];
     limit?: number;
+    memory_type?: "context" | "reference" | "note";
     topic_id?: string;
     threshold?: number;
-    memory_type?: "context" | "reference" | "note";
 }, {
     query?: string;
     tags?: string[];
     limit?: number;
+    memory_type?: "context" | "reference" | "note";
     topic_id?: string;
     threshold?: number;
-    memory_type?: "context" | "reference" | "note";
 }>;
 export declare const MemoryUpdateSchema: z.ZodObject<{
     memory_id: z.ZodString;
@@ -58,16 +58,16 @@ export declare const MemoryUpdateSchema: z.ZodObject<{
     title?: string;
     content?: string;
     tags?: string[];
+    memory_type?: "context" | "reference" | "note";
     memory_id?: string;
     metadata?: Record<string, any>;
-    memory_type?: "context" | "reference" | "note";
 }, {
     title?: string;
     content?: string;
     tags?: string[];
+    memory_type?: "context" | "reference" | "note";
     memory_id?: string;
     metadata?: Record<string, any>;
-    memory_type?: "context" | "reference" | "note";
 }>;
 export declare const MemoryDeleteSchema: z.ZodObject<{
     memory_id: z.ZodString;
@@ -90,19 +90,19 @@ export declare const MemoryListSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     tags?: string[];
     limit?: number;
-    topic_id?: string;
-    order?: "desc" | "asc";
-    memory_type?: "context" | "reference" | "note";
     offset?: number;
+    memory_type?: "context" | "reference" | "note";
+    topic_id?: string;
     sort_by?: "title" | "created_at" | "updated_at";
+    order?: "desc" | "asc";
 }, {
     tags?: string[];
     limit?: number;
-    topic_id?: string;
-    order?: "desc" | "asc";
-    memory_type?: "context" | "reference" | "note";
     offset?: number;
+    memory_type?: "context" | "reference" | "note";
+    topic_id?: string;
     sort_by?: "title" | "created_at" | "updated_at";
+    order?: "desc" | "asc";
 }>;
 export declare const TopicCreateSchema: z.ZodObject<{
     name: z.ZodString;
@@ -386,16 +386,16 @@ export declare const MCPSchemas: {
             title?: string;
             content?: string;
             tags?: string[];
+            memory_type?: "context" | "reference" | "note";
             topic_id?: string;
             metadata?: Record<string, any>;
-            memory_type?: "context" | "reference" | "note";
         }, {
             title?: string;
             content?: string;
             tags?: string[];
+            memory_type?: "context" | "reference" | "note";
             topic_id?: string;
             metadata?: Record<string, any>;
-            memory_type?: "context" | "reference" | "note";
         }>;
         search: z.ZodObject<{
             query: z.ZodString;
@@ -408,16 +408,16 @@ export declare const MCPSchemas: {
             query?: string;
             tags?: string[];
             limit?: number;
+            memory_type?: "context" | "reference" | "note";
             topic_id?: string;
             threshold?: number;
-            memory_type?: "context" | "reference" | "note";
         }, {
             query?: string;
             tags?: string[];
             limit?: number;
+            memory_type?: "context" | "reference" | "note";
             topic_id?: string;
             threshold?: number;
-            memory_type?: "context" | "reference" | "note";
         }>;
         update: z.ZodObject<{
             memory_id: z.ZodString;
@@ -430,16 +430,16 @@ export declare const MCPSchemas: {
             title?: string;
             content?: string;
             tags?: string[];
+            memory_type?: "context" | "reference" | "note";
             memory_id?: string;
             metadata?: Record<string, any>;
-            memory_type?: "context" | "reference" | "note";
         }, {
             title?: string;
             content?: string;
             tags?: string[];
+            memory_type?: "context" | "reference" | "note";
             memory_id?: string;
             metadata?: Record<string, any>;
-            memory_type?: "context" | "reference" | "note";
         }>;
         delete: z.ZodObject<{
             memory_id: z.ZodString;
@@ -462,19 +462,19 @@ export declare const MCPSchemas: {
         }, "strip", z.ZodTypeAny, {
             tags?: string[];
             limit?: number;
-            topic_id?: string;
-            order?: "desc" | "asc";
-            memory_type?: "context" | "reference" | "note";
             offset?: number;
+            memory_type?: "context" | "reference" | "note";
+            topic_id?: string;
             sort_by?: "title" | "created_at" | "updated_at";
+            order?: "desc" | "asc";
         }, {
             tags?: string[];
             limit?: number;
-            topic_id?: string;
-            order?: "desc" | "asc";
-            memory_type?: "context" | "reference" | "note";
             offset?: number;
+            memory_type?: "context" | "reference" | "note";
+            topic_id?: string;
             sort_by?: "title" | "created_at" | "updated_at";
+            order?: "desc" | "asc";
         }>;
     };
     topic: {

package/dist/utils/api.d.ts

@@ -153,6 +153,7 @@ export declare class APIClient {
     private client;
     private config;
     private normalizeMemoryEntry;
+    private shouldUseLegacyMemoryRpcFallback;
     constructor();
     login(email: string, password: string): Promise<AuthResponse>;
     register(email: string, password: string, organizationName?: string): Promise<AuthResponse>;

package/dist/utils/api.js

@@ -25,6 +25,21 @@ export class APIClient {
         }
         return payload;
     }
+    shouldUseLegacyMemoryRpcFallback(error) {
+        const status = error?.response?.status;
+        const errorData = error?.response?.data;
+        const message = `${errorData?.error || ''} ${errorData?.message || ''}`.toLowerCase();
+        if (status === 405) {
+            return true;
+        }
+        if (status === 400 && message.includes('memory id is required')) {
+            return true;
+        }
+        if (status === 400 && message.includes('method not allowed')) {
+            return true;
+        }
+        return false;
+    }
     constructor() {
         this.config = new CLIConfig();
         this.client = axios.create({
@@ -43,12 +58,14 @@ export class APIClient {
             const authMethod = this.config.get('authMethod');
             const vendorKey = await this.config.getVendorKeyAsync();
             const token = this.config.getToken();
+            const isMemoryEndpoint = typeof config.url === 'string' && config.url.startsWith('/api/v1/memories');
             const forceApiFromEnv = process.env.LANONASIS_FORCE_API === 'true'
                 || process.env.CLI_FORCE_API === 'true'
                 || process.env.ONASIS_FORCE_API === 'true';
             const forceApiFromConfig = this.config.get('forceApi') === true
                 || this.config.get('connectionTransport') === 'api';
-            const forceDirectApi = forceApiFromEnv || forceApiFromConfig;
+            // Memory CRUD/search endpoints should always use the API gateway path.
+            const forceDirectApi = forceApiFromEnv || forceApiFromConfig || isMemoryEndpoint;
             const prefersTokenAuth = Boolean(token) && (authMethod === 'jwt' || authMethod === 'oauth' || authMethod === 'oauth2');
             const useVendorKeyAuth = Boolean(vendorKey) && !prefersTokenAuth;
             // Determine the correct API base URL:
@@ -183,11 +200,91 @@ export class APIClient {
             return response.data;
         }
         catch (error) {
-            // Backward-compatible fallback: newer API contracts may reject GET list and prefer search-only.
+            // Backward-compatible fallback: newer API contracts may reject GET list.
             if (error?.response?.status === 405) {
                 const limit = Number(params.limit || 20);
                 const page = Number(params.page || 1);
                 const offset = Number(params.offset ?? Math.max(0, (page - 1) * limit));
+                // Preferred fallback: POST list endpoint (avoids triggering vector search for plain listings).
+                const listPayload = {
+                    limit,
+                    offset
+                };
+                if (params.memory_type) {
+                    listPayload.memory_type = params.memory_type;
+                }
+                if (params.tags) {
+                    listPayload.tags = Array.isArray(params.tags)
+                        ? params.tags
+                        : String(params.tags).split(',').map((tag) => tag.trim()).filter(Boolean);
+                }
+                if (params.topic_id) {
+                    listPayload.topic_id = params.topic_id;
+                }
+                if (params.user_id) {
+                    listPayload.user_id = params.user_id;
+                }
+                if (params.sort || params.sort_by) {
+                    listPayload.sort_by = params.sort_by || params.sort;
+                }
+                if (params.order || params.sort_order) {
+                    listPayload.sort_order = params.sort_order || params.order;
+                }
+                for (const endpoint of ['/api/v1/memories/list', '/api/v1/memory/list']) {
+                    try {
+                        const listResponse = await this.client.post(endpoint, listPayload);
+                        const payload = listResponse.data || {};
+                        const resultsArray = Array.isArray(payload.data)
+                            ? payload.data
+                            : Array.isArray(payload.memories)
+                                ? payload.memories
+                                : Array.isArray(payload.results)
+                                    ? payload.results
+                                    : [];
+                        const memories = resultsArray.map((entry) => this.normalizeMemoryEntry(entry));
+                        const pagination = (payload.pagination && typeof payload.pagination === 'object')
+                            ? payload.pagination
+                            : {};
+                        const total = Number.isFinite(Number(pagination.total))
+                            ? Number(pagination.total)
+                            : Number.isFinite(Number(payload.total))
+                                ? Number(payload.total)
+                                : memories.length;
+                        const pages = Number.isFinite(Number(pagination.total_pages))
+                            ? Number(pagination.total_pages)
+                            : Number.isFinite(Number(pagination.pages))
+                                ? Number(pagination.pages)
+                                : Math.max(1, Math.ceil(total / limit));
+                        const currentPage = Number.isFinite(Number(pagination.page))
+                            ? Number(pagination.page)
+                            : Math.max(1, Math.floor(offset / limit) + 1);
+                        const hasMore = typeof pagination.has_more === 'boolean'
+                            ? pagination.has_more
+                            : typeof pagination.has_next === 'boolean'
+                                ? pagination.has_next
+                                : (offset + memories.length) < total;
+                        return {
+                            ...payload,
+                            data: memories,
+                            memories,
+                            pagination: {
+                                total,
+                                limit,
+                                offset,
+                                has_more: hasMore,
+                                page: currentPage,
+                                pages
+                            }
+                        };
+                    }
+                    catch (listError) {
+                        if (listError?.response?.status === 404 || listError?.response?.status === 405) {
+                            continue;
+                        }
+                        throw listError;
+                    }
+                }
+                // Secondary fallback: search endpoint for legacy contracts that expose only search.
                 const searchPayload = {
                     query: '*',
                     limit,
@@ -251,15 +348,51 @@ export class APIClient {
         }
     }
     async getMemory(id) {
-        const response = await this.client.get(`/api/v1/memories/${id}`);
-        return this.normalizeMemoryEntry(response.data);
+        try {
+            const response = await this.client.get(`/api/v1/memories/${id}`);
+            return this.normalizeMemoryEntry(response.data);
+        }
+        catch (error) {
+            if (this.shouldUseLegacyMemoryRpcFallback(error)) {
+                const fallback = await this.client.post('/api/v1/memory/get', { id });
+                const payload = fallback.data && typeof fallback.data === 'object'
+                    ? fallback.data.data ?? fallback.data
+                    : fallback.data;
+                return this.normalizeMemoryEntry(payload);
+            }
+            throw error;
+        }
     }
     async updateMemory(id, data) {
-        const response = await this.client.put(`/api/v1/memories/${id}`, data);
-        return this.normalizeMemoryEntry(response.data);
+        try {
+            const response = await this.client.put(`/api/v1/memories/${id}`, data);
+            return this.normalizeMemoryEntry(response.data);
+        }
+        catch (error) {
+            if (this.shouldUseLegacyMemoryRpcFallback(error)) {
+                const fallback = await this.client.post('/api/v1/memory/update', {
+                    id,
+                    ...data
+                });
+                const payload = fallback.data && typeof fallback.data === 'object'
+                    ? fallback.data.data ?? fallback.data
+                    : fallback.data;
+                return this.normalizeMemoryEntry(payload);
+            }
+            throw error;
+        }
     }
     async deleteMemory(id) {
-        await this.client.delete(`/api/v1/memories/${id}`);
+        try {
+            await this.client.delete(`/api/v1/memories/${id}`);
+        }
+        catch (error) {
+            if (this.shouldUseLegacyMemoryRpcFallback(error)) {
+                await this.client.post('/api/v1/memory/delete', { id });
+                return;
+            }
+            throw error;
+        }
     }
     async searchMemories(query, options = {}) {
         const response = await this.client.post('/api/v1/memories/search', {

package/dist/utils/config.d.ts

@@ -34,6 +34,12 @@ interface CLIConfigData {
     lastAuthFailure?: string | undefined;
     [key: string]: unknown;
 }
+export type RemoteAuthVerification = {
+    valid: boolean;
+    method: 'token' | 'vendor_key' | 'none';
+    endpoint?: string;
+    reason?: string;
+};
 export declare class CLIConfig {
     private configDir;
     private configPath;
@@ -70,6 +76,11 @@ export declare class CLIConfig {
     private resolveFallbackEndpoints;
     private logFallbackUsage;
     private pingAuthHealth;
+    private getAuthVerificationEndpoints;
+    private extractAuthErrorMessage;
+    private verifyTokenWithAuthGateway;
+    private verifyVendorKeyWithAuthGateway;
+    verifyCurrentCredentialsWithServer(): Promise<RemoteAuthVerification>;
     setManualEndpoints(endpoints: Partial<CLIConfigData['discoveredServices']>): Promise<void>;
     hasManualEndpointOverrides(): boolean;
     clearManualEndpointOverrides(): Promise<void>;

package/dist/utils/config.js

@@ -434,6 +434,200 @@ export class CLIConfig {
         }
         throw new Error('Auth health endpoints unreachable');
     }
+    getAuthVerificationEndpoints(pathname) {
+        const authBase = (this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com').replace(/\/$/, '');
+        return Array.from(new Set([
+            `${authBase}${pathname}`,
+            `https://auth.lanonasis.com${pathname}`,
+            `http://localhost:4000${pathname}`
+        ]));
+    }
+    extractAuthErrorMessage(payload) {
+        if (!payload || typeof payload !== 'object') {
+            return undefined;
+        }
+        const data = payload;
+        const fields = ['message', 'error', 'reason', 'code'];
+        for (const field of fields) {
+            const value = data[field];
+            if (typeof value === 'string' && value.trim().length > 0) {
+                return value;
+            }
+        }
+        return undefined;
+    }
+    async verifyTokenWithAuthGateway(token) {
+        const headers = {
+            'Authorization': `Bearer ${token}`,
+            'X-Project-Scope': 'lanonasis-maas'
+        };
+        let fallbackReason = 'Unable to verify token with auth gateway';
+        // Primary check (required by auth contract): /v1/auth/verify
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true || Boolean(payload.payload)) {
+                    return { valid: true, method: 'token', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'token',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'Token is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                const responseCode = typeof responsePayload?.code === 'string' ? responsePayload.code : undefined;
+                const reason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+                fallbackReason = reason;
+                // If auth gateway explicitly rejected token, stop early.
+                if ((normalizedError.response?.status === 401 || normalizedError.response?.status === 403) &&
+                    responseCode &&
+                    responseCode !== 'AUTH_TOKEN_MISSING') {
+                    return { valid: false, method: 'token', endpoint, reason };
+                }
+            }
+        }
+        // Fallback for deployments where proxy layers strip Authorization headers.
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify-token')) {
+            try {
+                const response = await axios.post(endpoint, { token }, {
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-Project-Scope': 'lanonasis-maas'
+                    },
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true) {
+                    return { valid: true, method: 'token', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'token',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'Token is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                fallbackReason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+            }
+        }
+        return {
+            valid: false,
+            method: 'token',
+            reason: fallbackReason
+        };
+    }
+    async verifyVendorKeyWithAuthGateway(vendorKey) {
+        const headers = {
+            'X-API-Key': vendorKey,
+            'X-Auth-Method': 'vendor_key',
+            'X-Project-Scope': 'lanonasis-maas'
+        };
+        let fallbackReason = 'Unable to verify API key with auth gateway';
+        // Primary check (required by auth contract): /v1/auth/verify
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true || Boolean(payload.payload)) {
+                    return { valid: true, method: 'vendor_key', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'vendor_key',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'API key is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                const responseCode = typeof responsePayload?.code === 'string' ? responsePayload.code : undefined;
+                const reason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+                fallbackReason = reason;
+                // If auth gateway explicitly rejected API key, stop early.
+                if ((normalizedError.response?.status === 401 || normalizedError.response?.status === 403) &&
+                    responseCode &&
+                    responseCode !== 'AUTH_TOKEN_MISSING') {
+                    return { valid: false, method: 'vendor_key', endpoint, reason };
+                }
+            }
+        }
+        // Fallback for deployments where reverse proxies don't forward custom auth headers on /verify.
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify-api-key')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true) {
+                    return { valid: true, method: 'vendor_key', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'vendor_key',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'API key is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                fallbackReason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+            }
+        }
+        return {
+            valid: false,
+            method: 'vendor_key',
+            reason: fallbackReason
+        };
+    }
+    async verifyCurrentCredentialsWithServer() {
+        await this.refreshTokenIfNeeded();
+        await this.discoverServices();
+        const token = this.getToken();
+        const vendorKey = await this.getVendorKeyAsync();
+        if (this.config.authMethod === 'vendor_key' && vendorKey) {
+            return this.verifyVendorKeyWithAuthGateway(vendorKey);
+        }
+        if (token) {
+            return this.verifyTokenWithAuthGateway(token);
+        }
+        if (vendorKey) {
+            return this.verifyVendorKeyWithAuthGateway(vendorKey);
+        }
+        return {
+            valid: false,
+            method: 'none',
+            reason: 'No credentials configured'
+        };
+    }
     // Manual endpoint override functionality
     async setManualEndpoints(endpoints) {
         if (!this.config.discoveredServices) {
@@ -520,16 +714,12 @@ export class CLIConfig {
             return;
         }
         try {
-            // Import axios dynamically to avoid circular dependency
-            // Ensure service discovery is done
             await this.discoverServices();
-            const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            // Use pingAuthHealth for validation (simpler and more reliable)
-            await this.pingAuthHealth(axios, authBase, {
-                'X-API-Key': vendorKey,
-                'X-Auth-Method': 'vendor_key',
-                'X-Project-Scope': 'lanonasis-maas'
-            }, { timeout: 10000, proxy: false });
+            const verification = await this.verifyVendorKeyWithAuthGateway(vendorKey);
+            if (verification.valid) {
+                return;
+            }
+            throw new Error(verification.reason || 'Authentication failed. The key may be invalid, expired, or revoked.');
         }
         catch (error) {
             const normalizedError = this.normalizeServiceError(error);
@@ -701,21 +891,17 @@ export class CLIConfig {
             }
             // Vendor key not recently validated - verify with server
             try {
-                await this.discoverServices();
-                const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-                // Ping auth health with vendor key to verify it's still valid
-                await this.pingAuthHealth(axios, authBase, {
-                    'X-API-Key': vendorKey,
-                    'X-Auth-Method': 'vendor_key',
-                    'X-Project-Scope': 'lanonasis-maas'
-                }, { timeout: 5000, proxy: false });
+                const verification = await this.verifyVendorKeyWithAuthGateway(vendorKey);
+                if (!verification.valid) {
+                    throw new Error(verification.reason || 'Vendor key validation failed');
+                }
                 // Update last validated timestamp on success
                 this.config.lastValidated = new Date().toISOString();
                 await this.save().catch(() => { }); // Don't fail auth check if save fails
                 this.authCheckCache = { isValid: true, timestamp: Date.now() };
                 return true;
             }
-            catch (error) {
+            catch {
                 // Server validation failed - check for grace period (7 days offline)
                 const gracePeriod = 7 * 24 * 60 * 60 * 1000;
                 const withinGracePeriod = lastValidated &&
@@ -947,22 +1133,14 @@ export class CLIConfig {
             if (!vendorKey && !token) {
                 return false;
             }
-            // Import axios dynamically to avoid circular dependency
-            // Ensure service discovery is done
-            await this.discoverServices();
-            const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            const headers = {
-                'X-Project-Scope': 'lanonasis-maas'
-            };
-            if (vendorKey) {
-                headers['X-API-Key'] = vendorKey;
-                headers['X-Auth-Method'] = 'vendor_key';
-            }
-            else if (token) {
-                headers['Authorization'] = `Bearer ${token}`;
-                headers['X-Auth-Method'] = 'jwt';
+            const verification = this.config.authMethod === 'vendor_key' && vendorKey
+                ? await this.verifyVendorKeyWithAuthGateway(vendorKey)
+                : token
+                    ? await this.verifyTokenWithAuthGateway(token)
+                    : await this.verifyVendorKeyWithAuthGateway(vendorKey);
+            if (!verification.valid) {
+                throw new Error(verification.reason || 'Stored credentials are invalid');
             }
-            await this.pingAuthHealth(axios, authBase, headers);
             // Update last validated timestamp
             this.config.lastValidated = new Date().toISOString();
             await this.resetFailureCount();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.5",
+  "version": "3.9.6",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -73,14 +73,14 @@
     "zod": "^3.24.4"
   },
   "devDependencies": {
-    "@jest/globals": "^29.7.0",
+    "@jest/globals": "^27.5.1",
     "@types/cli-progress": "^3.11.6",
     "@types/inquirer": "^9.0.7",
     "@types/node": "^22.19.3",
     "@types/ws": "^8.5.12",
     "fast-check": "^3.15.1",
-    "jest": "^29.7.0",
-    "rimraf": "^5.0.7",
+    "jest": "^25.0.0",
+    "rimraf": "^6.1.3",
     "ts-jest": "^29.1.1",
     "typescript": "^5.7.2"
   },