@norbix.ai/cli 0.1.0 → 0.2.0

package/README.md

@@ -4,7 +4,7 @@ Manage your Norbix projects from the terminal. Built on top of the official
 [`@norbix.ai/ts`](https://www.npmjs.com/package/@norbix.ai/ts) SDK, so every
 command talks to the same API the SDK does.
 
-Works on **macOS**, **Linux** and **Windows** (Node.js 18+).
+Works on **macOS**, **Linux** and **Windows** (Node.js 22+).
 
 ## Install
 
@@ -39,7 +39,7 @@ norbix scheduler list
 | `norbix login` / `logout` / `whoami` | Authenticate and inspect the current context |
 | `norbix config list/get/set/unset` | Manage the local config file |
 | `norbix db find/get/count/insert/update/delete/aggregate` | Work with database collections |
-| `norbix files list/info/upload/download/sign/delete` | Upload, download and manage files |
+| `norbix files list/info/upload/download/sign/delete/publish/unpublish` | Upload, download, manage and publish files |
 | `norbix users list/get/invite/block/unblock/delete` | Manage project users (membership) |
 | `norbix env list/use/delete` | Manage project environments |
 | `norbix logs list/trail` | Read project logs, follow one correlation ID |
@@ -52,25 +52,62 @@ norbix scheduler list
 | `norbix payments integrations/triggers/trigger/enable/disable` | Payment integrations and triggers |
 | `norbix integrations <module>` | List integrations of any module |
 | `norbix module enable/disable <name>` | Turn a whole project module on or off |
-| `norbix api <path>` | Call ANY endpoint directly (like `gh api`) — full API coverage |
+| `norbix hub <module> <words...>` | Call ANY hub endpoint with plain words (see below) |
+| `norbix api <module> <words...>` | Same for the data-plane API |
+| `norbix raw <path>` | Low-level HTTP escape hatch (hub by default, `--api` for API) |
+
+### Plain-word access to every endpoint
+
+`norbix hub` and `norbix api` resolve SDK methods from plain words — every
+current and future SDK method is callable without waiting for a dedicated
+command:
+
+```sh
+norbix hub                                     # list modules
+norbix hub database                            # list database methods
+norbix hub database aggregates get             # plural  = list
+norbix hub database aggregate get maggr_123    # singular = one item
+norbix hub database aggregates delete maggr_123 --schemaId sch_456
+norbix hub scheduler tasks get --pageSize 100
+norbix hub email templates get                 # email/sms/push route into notifications
+```
+
+The first positional value becomes `id`; `--field value` flags become request
+fields. Destructive verbs (delete, remove, rotate, ...) ask for confirmation
+unless `--yes`. Add `--dry-run` to preview the exact SDK call.
 | `norbix autocomplete` | Set up shell tab-completion (bash/zsh) |
 
 Run `norbix <topic> --help` for flags and examples.
 
-## Configuration
+## Configuration: profiles + sessions
+
+Two ways to authenticate, and they work together:
+
+**Profiles (AWS-style)** — one INI file at `~/.norbix/config`, set up with:
+
+```sh
+norbix configure                      # writes the [default] profile
+norbix configure --profile fitskin    # a named profile
+norbix db find orders --profile fitskin
+```
 
-Every setting is resolved in this order (most specific wins):
+It asks for a service-user API key, project ID, optional account ID and
+environment (empty = PROD). A profile can also override the endpoints
+(`api_url` / `hub_url`) for localhost or self-hosted installations.
+`--profile` (or `NORBIX_PROFILE`) always uses exactly that profile and
+ignores any login session — predictable for scripts.
 
-1. **Flag** — `--project`, `--env`, `--region`, `--api-key`
-2. **Environment variable** — `NORBIX_PROJECT_ID`, `NORBIX_ENV`, `NORBIX_REGION`,
-   `NORBIX_API_KEY`, `NORBIX_API_URL`, `NORBIX_HUB_URL`
-3. **Config file** — written by `norbix login` and `norbix config set`
+**Sessions** — `norbix login` stores a session in `~/.norbix/session.json`.
+While it is valid, every command (in every terminal window) uses it.
+`norbix logout` removes it. Profiles are untouched by login/logout.
 
-The config file lives in your user config folder (`~/.config/norbix/config.json`
-on macOS/Linux, `%LOCALAPPDATA%\norbix\config.json` on Windows) and is created
-with owner-only permissions (0600).
+Resolution order (most specific wins): flags → `NORBIX_*` env vars →
+`--profile` (profile only) → session → `[default]` profile.
+`norbix whoami` shows exactly what was resolved and verifies it against the
+server. Defaults endpoints are `https://api.norbix.ai` and
+`https://hub.norbix.ai`. See `AUTH_DESIGN.md` for the full design.
 
-For CI/CD, skip `login` and use environment variables only:
+For CI/CD, use environment variables only:
 
 ```sh
 export NORBIX_API_KEY=nbk_...
@@ -111,6 +148,81 @@ norbix files download invoices/2026/invoice.pdf
 
 Or pass `--integration <id>` (env var: `NORBIX_FILES_INTEGRATION_ID`).
 
+### The eight file commands
+
+| Command | What it does |
+| --- | --- |
+| `norbix files list [path]` | List the files and folders under a path. No path lists the root. |
+| `norbix files info <path>` | Show one file's details: size, type, when it changed. |
+| `norbix files sign <path> [--expires <seconds>]` | Get a temporary web address for the file that anyone with the link can open. |
+| `norbix files upload <local> [remote]` | Upload a file. Without `remote` it keeps its own name in the root folder. |
+| `norbix files download <remote> [local]` | Download a file. Without `local` it keeps its own name in the current folder. |
+| `norbix files delete <path> [--yes]` | Delete one file. Asks first unless you pass `--yes`. |
+| `norbix files publish <path> [--folder]` | Give the file — or the whole folder — a link anyone can open, and print it. |
+| `norbix files unpublish <path> [--folder]` | Take that link away again. |
+
+Upload and download take more than one step, so the file bytes never pass
+through Norbix:
+
+* **upload** — ask for a short-lived upload address, send the bytes straight to
+  storage, then tell Norbix the upload finished.
+* **download** — ask for a short-lived download address, then fetch the bytes
+  from storage.
+
+`--content-type` overrides the type on upload; without it the type is guessed
+from the file name.
+
+### Publishing a file
+
+`sign` and `publish` both give you a web address, and they are not the same
+thing:
+
+* **`sign`** hands out a *temporary* address that expires by itself. Good for a
+  download button on a page somebody is already signed in to.
+* **`publish`** makes the file public *until you say otherwise*. The address
+  has no expiry and no sign-in: it works in an e-mail, in an `<img src>`, or in
+  a browser on somebody else's phone.
+
+```sh
+norbix files publish invoices/2026/invoice.pdf
+# https://api.norbix.ai/v3/files/public/nbpf_7hK2abc/invoice.pdf
+
+norbix files unpublish invoices/2026/invoice.pdf
+# invoices/2026/invoice.pdf is private again — its link now gives a 404
+```
+
+`--folder` does the same for a whole folder. That is **one** record however
+many files sit under it, and every file inside becomes readable by putting its
+path inside the folder after the link:
+
+```sh
+norbix files publish invoices --folder
+# https://api.norbix.ai/v3/files/public/nbpf_folder1/
+#   → .../nbpf_folder1/2026/invoice.pdf
+```
+
+Four rules worth knowing:
+
+* Publishing the same thing twice gives the same link back — the first one is
+  already in somebody's hands.
+* A file cannot be unpublished on its own while a folder above it is public.
+  The command says so and names the folder to switch off instead.
+* Unpublishing a folder takes back every link inside it, per-file links
+  included.
+* Every dead link answers the same plain `404`: unknown, renamed, unpublished,
+  deleted. A more precise answer would tell a stranger that the file is there.
+
+## Tests
+
+```sh
+npm test
+```
+
+The tests build the CLI and run each command through oclif with `fetch`
+replaced, so nothing leaves the machine and no account is needed. `HOME` points
+at an empty temporary folder during the run, so your own `~/.norbix` settings
+and login session are never read.
+
 ## Roadmap
 
 - Standalone binaries (no Node needed): Homebrew, curl installer, Scoop/winget

package/dist/base.js

@@ -1,15 +1,22 @@
 import { Norbix, NorbixError } from '@norbix.ai/ts';
 import { Command, Flags } from '@oclif/core';
+import { DEFAULT_API_URL, DEFAULT_HUB_URL, isSessionValid, readProfiles, readSession, } from './lib/profiles.js';
 import { readStore } from './lib/store.js';
 /**
  * Base class for every Norbix CLI command.
  *
- * Resolution order for every setting (most specific wins):
- *   1. command-line flag        (--project, --env, --region, --api-key)
- *   2. environment variable     (NORBIX_PROJECT_ID, NORBIX_ENV, ...)
- *   3. local config file        (written by `norbix login` / `norbix config set`)
+ * Resolution order (most specific wins):
+ *   1. command-line flags
+ *   2. environment variables (NORBIX_*)
+ *   3a. --profile / NORBIX_PROFILE set  → that profile from ~/.norbix/config
+ *       ONLY. The login session is intentionally ignored: --profile means
+ *       "act as exactly this identity", good for scripts.
+ *   3b. no profile chosen → active login session (~/.norbix/session.json)
+ *       wins; the [default] profile fills anything the session doesn't have;
+ *       the legacy per-OS config.json is the last fallback.
  *
- * Flags declare `env:` so oclif applies (1) and (2); (3) happens here.
+ * Default endpoints are https://api.norbix.ai and https://hub.norbix.ai;
+ * a profile can override them (self-hosted, localhost, custom domain).
  */
 export class BaseCommand extends Command {
     static enableJsonFlag = true;
@@ -30,7 +37,7 @@ export class BaseCommand extends Command {
             helpGroup: 'GLOBAL',
         }),
         'api-key': Flags.string({
-            description: 'API key (overrides a stored login token)',
+            description: 'API key (overrides profile and session)',
             env: 'NORBIX_API_KEY',
             helpGroup: 'GLOBAL',
         }),
@@ -39,34 +46,96 @@ export class BaseCommand extends Command {
             env: 'NORBIX_ACCOUNT_ID',
             helpGroup: 'GLOBAL',
         }),
+        profile: Flags.string({
+            description: 'Use this profile from ~/.norbix/config (ignores the login session)',
+            env: 'NORBIX_PROFILE',
+            helpGroup: 'GLOBAL',
+        }),
     };
     readStore() {
         return readStore(this.config.configDir);
     }
     resolveContext(flags) {
-        const stored = this.readStore();
+        const profiles = readProfiles();
+        const legacy = this.readStore();
+        const explicitProfile = flags.profile;
+        let prof = {};
+        let profileName;
+        let session;
+        if (explicitProfile) {
+            prof = profiles[explicitProfile] ?? {};
+            profileName = explicitProfile;
+            if (!profiles[explicitProfile]) {
+                this.error(`Profile "${explicitProfile}" not found in ~/.norbix/config.\n` +
+                    `Run \`norbix configure --profile ${explicitProfile}\` to create it, or \`norbix profiles\` to list existing ones.`);
+            }
+        }
+        else {
+            prof = profiles.default ?? {};
+            profileName = profiles.default ? 'default' : undefined;
+            const s = readSession();
+            if (isSessionValid(s))
+                session = s;
+        }
         const apiKeyOverride = flags['api-key'];
+        const bearerToken = apiKeyOverride ? undefined : session?.bearerToken;
+        const apiKey = apiKeyOverride ?? (bearerToken ? undefined : (prof.api_key ?? legacy.apiKey));
+        const authSource = apiKeyOverride
+            ? 'flag/env api key'
+            : bearerToken
+                ? 'session'
+                : prof.api_key
+                    ? `profile [${profileName ?? 'default'}]`
+                    : legacy.apiKey
+                        ? 'legacy config'
+                        : 'none';
+        const apiUrlBase = prof.api_url ?? (explicitProfile ? undefined : legacy.apiUrl) ?? DEFAULT_API_URL;
+        const hubUrlBase = prof.hub_url ?? (explicitProfile ? undefined : legacy.hubUrl) ?? DEFAULT_HUB_URL;
+        const region = flags.region ?? (explicitProfile ? prof.region : (session?.region ?? prof.region ?? legacy.region));
+        // Region subdomain (api.norbix.ai → nb-eu-germany.api.norbix.ai) is only
+        // composed for the default domains — a custom URL is never rewritten.
+        const withRegion = (url, isDefault) => isDefault && region ? url.replace('://', `://${region}.`) : url;
+        const usesDefaultEndpoints = apiUrlBase === DEFAULT_API_URL || hubUrlBase === DEFAULT_HUB_URL;
         return {
-            stored,
-            projectId: flags.project ?? stored.projectId,
-            accountId: flags.account ?? stored.accountId,
-            env: flags.env ?? stored.env,
-            region: flags.region ?? stored.region,
-            apiKey: apiKeyOverride ?? (stored.bearerToken ? undefined : stored.apiKey),
-            // An explicit --api-key / NORBIX_API_KEY wins over a stored login token.
-            bearerToken: apiKeyOverride ? undefined : stored.bearerToken,
-            apiUrl: stored.apiUrl ?? process.env.NORBIX_API_URL,
-            hubUrl: stored.hubUrl ?? process.env.NORBIX_HUB_URL,
+            usesDefaultEndpoints,
+            projectId: flags.project ??
+                (explicitProfile ? prof.project_id : (session?.projectId ?? prof.project_id ?? legacy.projectId)),
+            accountId: flags.account ??
+                (explicitProfile ? prof.account_id : (session?.accountId ?? prof.account_id ?? legacy.accountId)),
+            env: flags.env ?? (explicitProfile ? prof.env : (session?.env ?? prof.env ?? legacy.env)),
+            region,
+            apiKey,
+            bearerToken,
+            apiUrl: withRegion(apiUrlBase, apiUrlBase === DEFAULT_API_URL),
+            hubUrl: withRegion(hubUrlBase, hubUrlBase === DEFAULT_HUB_URL),
+            filesIntegrationId: prof.files_integration_id ?? (explicitProfile ? undefined : legacy.filesIntegrationId),
+            authSource,
+            profileName,
+            userName: session?.userName,
+            stored: legacy,
         };
     }
-    /** Build an SDK client from flags + env + config file. Errors politely when auth is missing. */
+    /**
+     * Rule: with the default *.norbix.ai endpoints a region is REQUIRED (the
+     * real endpoint is <region>.api.norbix.ai). With custom endpoints
+     * (localhost, self-hosted, custom domain) a region is optional.
+     */
+    assertEndpoints(ctx) {
+        if (ctx.usesDefaultEndpoints && !ctx.region) {
+            this.error('Region is required when using the default norbix.ai endpoints.\n' +
+                'Set it with `norbix configure` (region field), pass --region <code> (e.g. nb-eu-germany),\n' +
+                'or set custom api_url / hub_url in the profile for self-hosted installations.');
+        }
+    }
+    /** Build an SDK client from the resolved context. Errors politely when auth is missing. */
     client(flags, opts = {}) {
         const ctx = this.resolveContext(flags);
+        this.assertEndpoints(ctx);
         if (!ctx.projectId) {
-            this.error('No project ID configured.\nRun `norbix login`, or `norbix config set projectId <id>`, or pass --project.');
+            this.error('No project ID configured.\nRun `norbix configure` (or `norbix login`), or pass --project.');
         }
         if (opts.requireAuth !== false && !ctx.apiKey && !ctx.bearerToken) {
-            this.error('Not authenticated. Run `norbix login` or pass --api-key.');
+            this.error('Not authenticated.\nRun `norbix login` (browser/user session) or `norbix configure` (API key profile), or pass --api-key.');
         }
         return new Norbix({
             projectId: ctx.projectId,
@@ -75,6 +144,8 @@ export class BaseCommand extends Command {
             bearerToken: ctx.bearerToken,
             env: ctx.env,
             region: ctx.region,
+            // Always explicit: CLI defaults are api/hub.norbix.ai (the SDK's own
+            // defaults still point at .dev — tracked as an SDK bug).
             baseUrl: { api: ctx.apiUrl, hub: ctx.hubUrl },
         }, 
         // The CLI already resolved env vars itself — don't let the SDK re-read them.
@@ -90,9 +161,7 @@ export class BaseCommand extends Command {
         if (error instanceof NorbixError) {
             const status = error.status;
             const suffix = status ? ` (HTTP ${status})` : '';
-            const hint = status === 401
-                ? '\nYour session may have expired. Run `norbix login` again.'
-                : '';
+            const hint = status === 401 ? '\nYour session may have expired. Run `norbix login` again.' : '';
             return this.error(`${error.message}${suffix}${hint}`);
         }
         return super.catch(error);

package/dist/commands/api.js

@@ -1,87 +1,21 @@
-import { Args, Flags } from '@oclif/core';
-import { BaseCommand } from '../base.js';
-import { readJsonInput } from '../lib/json.js';
-const DEFAULT_API = 'https://api.norbix.dev';
-const DEFAULT_HUB = 'https://hub.norbix.dev';
-/**
- * Raw escape hatch (like `gh api`): call ANY Norbix endpoint, including the
- * ones this CLI has no dedicated command for yet. Sends the same auth and
- * scope headers the SDK transport sends.
- */
-export default class Api extends BaseCommand {
-    static description = `Call any Norbix endpoint directly (escape hatch, like \`gh api\`).
+import { NamespaceCommand } from '../lib/namespace-command.js';
+export default class ApiNs extends NamespaceCommand {
+    target = 'api';
+    static description = `Call any data-plane API endpoint with plain words.
 
-Sends your auth token plus project/account/env/region headers automatically.
-Use {version} in the path and it becomes v2.`;
+Grammar: norbix api <module> <words...> [id] [--field value]
+Same engine as \`norbix hub\` — see \`norbix hub --help\`. For raw HTTP paths
+use \`norbix raw\`.`;
+    static strict = false;
     static examples = [
-        '<%= config.bin %> api /v2/logs/settings --hub',
-        `<%= config.bin %> api '/{version}/database/collections/orders/count' --query filter='{"status":"paid"}'`,
-        `<%= config.bin %> api /v2/scheduler/tasks --hub --method POST --body '{"name":"nightly",...}'`,
+        '<%= config.bin %> api                          # list modules',
+        '<%= config.bin %> api database                 # list database methods',
+        '<%= config.bin %> api database find --collectionName orders --pageSize 20',
+        '<%= config.bin %> api membership users get',
     ];
-    static args = {
-        path: Args.string({ required: true, description: 'Endpoint path, e.g. /v2/logs or /{version}/logs' }),
-    };
-    static flags = {
-        hub: Flags.boolean({ description: 'Call the Hub service instead of the API service', default: false }),
-        method: Flags.string({ char: 'X', description: 'HTTP method', default: 'GET', options: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] }),
-        body: Flags.string({ char: 'b', description: 'JSON request body (or `-` for stdin)' }),
-        query: Flags.string({ char: 'q', description: 'Query parameter key=value (repeatable)', multiple: true }),
-    };
     async run() {
-        const { args, flags } = await this.parse(Api);
-        const ctx = this.resolveContext(flags);
-        if (!ctx.projectId)
-            this.error('No project ID configured. Run `norbix login` or pass --project.');
-        const token = ctx.bearerToken ?? ctx.apiKey;
-        if (!token)
-            this.error('Not authenticated. Run `norbix login` or pass --api-key.');
-        // Base URL: custom > default (+ region subdomain, same rule as the SDK).
-        let base = flags.hub ? (ctx.hubUrl ?? DEFAULT_HUB) : (ctx.apiUrl ?? DEFAULT_API);
-        const usesDefault = flags.hub ? !ctx.hubUrl : !ctx.apiUrl;
-        if (usesDefault && ctx.region)
-            base = base.replace('://', `://${ctx.region}.`);
-        const path = args.path.replace('{version}', 'v2');
-        const url = new URL(base.replace(/\/$/, '') + (path.startsWith('/') ? path : `/${path}`));
-        for (const pair of flags.query ?? []) {
-            const eq = pair.indexOf('=');
-            if (eq < 1)
-                this.error(`--query must be key=value, got "${pair}"`);
-            url.searchParams.append(pair.slice(0, eq), pair.slice(eq + 1));
-        }
-        const headers = {
-            Accept: 'application/json',
-            Authorization: `Bearer ${token}`,
-            'norbix-project-id': ctx.projectId,
-            'X-CM-ProjectId': ctx.projectId,
-        };
-        if (ctx.accountId) {
-            headers['norbix-account-id'] = ctx.accountId;
-            headers['X-CM-AccountId'] = ctx.accountId;
-        }
-        if (ctx.env && ctx.env !== 'PROD')
-            headers['norbix-env'] = ctx.env;
-        if (ctx.region)
-            headers['nb-region'] = ctx.region;
-        let body;
-        if (flags.body) {
-            body = await readJsonInput(flags.body, 'body');
-            headers['Content-Type'] = 'application/json';
-        }
-        const res = await fetch(url, { method: flags.method, headers, body });
-        const text = await res.text();
-        let data;
-        try {
-            data = JSON.parse(text);
-        }
-        catch {
-            data = text;
-        }
-        if (!res.ok) {
-            this.warn(`HTTP ${res.status} ${res.statusText}`);
-            this.print(data);
-            this.exit(1);
-        }
-        this.print(data);
-        return data;
+        const { flagArgv, rest, help } = this.splitArgv();
+        const { flags } = await this.parse(ApiNs, flagArgv);
+        return this.dispatch(rest, flags, help);
     }
 }

package/dist/commands/configure.js

@@ -0,0 +1,68 @@
+import { input, password as passwordPrompt } from '@inquirer/prompts';
+import { Flags } from '@oclif/core';
+import { BaseCommand } from '../base.js';
+import { DEFAULT_API_URL, DEFAULT_HUB_URL, PROFILES_PATH, readProfiles, writeProfile, } from '../lib/profiles.js';
+import { redact } from '../lib/store.js';
+export default class Configure extends BaseCommand {
+    static description = `Set up a profile in ~/.norbix/config (like \`aws configure\`).
+
+Asks for a service-user API key, project ID, and optional account ID and
+environment. Use --profile to create or edit a named profile; without it the
+[default] profile is written. Later, run any command with
+--profile <name> to use exactly that profile.`;
+    static examples = [
+        '<%= config.bin %> configure',
+        '<%= config.bin %> configure --profile fitskin-prod',
+        '<%= config.bin %> configure --profile localhost --api-url http://localhost:5001 --hub-url http://localhost:5002',
+    ];
+    static flags = {
+        'api-url': Flags.string({ description: `API endpoint (default: ${DEFAULT_API_URL})` }),
+        'hub-url': Flags.string({ description: `Hub endpoint (default: ${DEFAULT_HUB_URL})` }),
+    };
+    async run() {
+        const { flags } = await this.parse(Configure);
+        const name = flags.profile ?? 'default';
+        const existing = readProfiles()[name] ?? {};
+        this.log(`Configuring profile [${name}] in ${PROFILES_PATH}`);
+        // Same interaction style as `aws configure`: show the current value
+        // (redacted for the key), keep it when the user just presses ENTER.
+        const keyLabel = existing.api_key
+            ? `Service user API key [${redact(existing.api_key)}]:`
+            : 'Service user API key:';
+        const apiKeyInput = await passwordPrompt({ message: keyLabel, mask: '*' });
+        const apiKey = apiKeyInput || existing.api_key;
+        const projectId = (await input({ message: 'Project ID:', default: existing.project_id })) || undefined;
+        const accountId = (await input({
+            message: 'Account ID (optional, for account-level commands):',
+            default: existing.account_id ?? '',
+        })) || undefined;
+        const env = (await input({
+            message: 'Environment (optional, empty = PROD):',
+            default: existing.env ?? '',
+        })) || undefined;
+        // With the default norbix.ai endpoints the region is REQUIRED (requests
+        // go to <region>.api.norbix.ai). With custom endpoints it is optional.
+        const usesDefaultEndpoints = !(flags['api-url'] ?? existing.api_url) && !(flags['hub-url'] ?? existing.hub_url);
+        const region = (await input({
+            message: usesDefaultEndpoints
+                ? 'Region (REQUIRED, e.g. nb-eu-germany):'
+                : 'Region (optional with custom endpoints):',
+            default: existing.region ?? '',
+            validate: (v) => (!usesDefaultEndpoints || v.trim() ? true : 'Region is required when using the default norbix.ai endpoints.'),
+        })) || undefined;
+        writeProfile(name, {
+            api_key: apiKey,
+            project_id: projectId,
+            account_id: accountId,
+            env,
+            region,
+            api_url: flags['api-url'] ?? existing.api_url,
+            hub_url: flags['hub-url'] ?? existing.hub_url,
+            files_integration_id: existing.files_integration_id,
+        });
+        this.log(`Profile [${name}] saved.`);
+        if (name !== 'default')
+            this.log(`Use it with: norbix <command> --profile ${name}`);
+        return { profile: name, saved: true };
+    }
+}

package/dist/commands/env/use.js

@@ -1,17 +1,46 @@
 import { Args } from '@oclif/core';
 import { BaseCommand } from '../../base.js';
+import { isSessionValid, readProfiles, readSession, writeProfile, writeSession } from '../../lib/profiles.js';
 import { writeStore } from '../../lib/store.js';
 export default class EnvUse extends BaseCommand {
-    static description = 'Set the default environment for all future commands (stored locally)';
-    static examples = ['<%= config.bin %> env use TEST', '<%= config.bin %> env use PROD'];
+    static description = `Set the default environment for future commands.
+
+Written to the active session when you are logged in; with --profile it is
+written into that profile in ~/.norbix/config; otherwise to the [default]
+profile. Override per command with --env.`;
+    static examples = [
+        '<%= config.bin %> env use TEST',
+        '<%= config.bin %> env use PROD',
+        '<%= config.bin %> env use STAGING --profile fitskin-prod',
+    ];
     static args = {
         name: Args.string({ required: true, description: 'Environment name (e.g. PROD, TEST)' }),
     };
     async run() {
-        const { args } = await this.parse(EnvUse);
-        const stored = this.readStore();
-        writeStore(this.config.configDir, { ...stored, env: args.name });
-        this.print(`Default environment set to ${args.name}. Override per command with --env.`);
-        return { env: args.name };
+        const { args, flags } = await this.parse(EnvUse);
+        if (flags.profile) {
+            const prof = readProfiles()[flags.profile];
+            if (!prof)
+                this.error(`Profile "${flags.profile}" not found. Run \`norbix configure --profile ${flags.profile}\` first.`);
+            writeProfile(flags.profile, { ...prof, env: args.name });
+            this.print(`Profile [${flags.profile}] now defaults to environment ${args.name}.`);
+            return { env: args.name, profile: flags.profile };
+        }
+        const session = readSession();
+        if (isSessionValid(session)) {
+            writeSession({ ...session, env: args.name });
+            this.print(`Session now targets environment ${args.name}.`);
+            return { env: args.name, target: 'session' };
+        }
+        const prof = readProfiles().default;
+        if (prof) {
+            writeProfile('default', { ...prof, env: args.name });
+            this.print(`Profile [default] now defaults to environment ${args.name}.`);
+            return { env: args.name, profile: 'default' };
+        }
+        // Last resort: legacy config location.
+        writeStore(this.config.configDir, { ...this.readStore(), env: args.name });
+        this.print(`Default environment set to ${args.name}.`);
+        return { env: args.name, target: 'legacy' };
     }
 }

package/dist/commands/files/delete.js

@@ -15,7 +15,7 @@ export default class FilesDelete extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(FilesDelete);
         const client = this.client(flags);
-        const integration = resolveIntegration(flags.integration, this.readStore().filesIntegrationId);
+        const integration = resolveIntegration(flags.integration, this.resolveContext(flags).filesIntegrationId);
         if (!integration) {
             this.error('No files integration ID. Pass --integration or run `norbix config set filesIntegrationId <id>`.');
         }

package/dist/commands/files/download.js

@@ -22,7 +22,7 @@ export default class FilesDownload extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(FilesDownload);
         const client = this.client(flags);
-        const integration = resolveIntegration(flags.integration, this.readStore().filesIntegrationId);
+        const integration = resolveIntegration(flags.integration, this.resolveContext(flags).filesIntegrationId);
         if (!integration) {
             this.error('No files integration ID. Pass --integration or run `norbix config set filesIntegrationId <id>`.');
         }

package/dist/commands/files/info.js

@@ -13,7 +13,7 @@ export default class FilesInfo extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(FilesInfo);
         const client = this.client(flags);
-        const integration = resolveIntegration(flags.integration, this.readStore().filesIntegrationId);
+        const integration = resolveIntegration(flags.integration, this.resolveContext(flags).filesIntegrationId);
         if (!integration) {
             this.error('No files integration ID. Pass --integration or run `norbix config set filesIntegrationId <id>`.');
         }

package/dist/commands/files/list.js

@@ -16,7 +16,7 @@ export default class FilesList extends BaseCommand {
     async run() {
         const { args, flags } = await this.parse(FilesList);
         const client = this.client(flags);
-        const integration = resolveIntegration(flags.integration, this.readStore().filesIntegrationId);
+        const integration = resolveIntegration(flags.integration, this.resolveContext(flags).filesIntegrationId);
         if (!integration) {
             this.error('No files integration ID. Pass --integration or run `norbix config set filesIntegrationId <id>`.');
         }

package/dist/commands/files/publish.js

@@ -0,0 +1,38 @@
+import { Args, Flags } from '@oclif/core';
+import { BaseCommand } from '../../base.js';
+import { integrationFlag, resolveIntegration } from '../../lib/files.js';
+import { callPublicFiles, publicUrlFor } from '../../lib/publicFiles.js';
+export default class FilesPublish extends BaseCommand {
+    static args = {
+        remote: Args.string({ description: 'Remote file path, or folder prefix with --folder', required: true }),
+    };
+    static description = 'Make a file (or a whole folder) readable by anyone holding its link — no sign-in needed';
+    static examples = [
+        '<%= config.bin %> files publish invoices/2026/invoice.pdf',
+        '<%= config.bin %> files publish invoices --folder',
+    ];
+    static flags = {
+        folder: Flags.boolean({
+            description: 'Publish the whole folder prefix instead of one file',
+        }),
+        integration: integrationFlag,
+    };
+    async run() {
+        const { args, flags } = await this.parse(FilesPublish);
+        const ctx = this.resolveContext(flags);
+        // Builds nothing itself, but it is what refuses early and with a useful
+        // sentence when there is no project or no credentials.
+        this.client(flags);
+        const integration = resolveIntegration(flags.integration, ctx.filesIntegrationId);
+        if (!integration) {
+            this.error('No files integration ID. Pass --integration or run `norbix config set filesIntegrationId <id>`.');
+        }
+        const result = await callPublicFiles(ctx, flags.folder ? 'makeFolderPublic' : 'makeFilePublic', { filesIntegrationId: integration, path: args.remote });
+        if (!result.id) {
+            this.error('The gateway did not return a public id.');
+        }
+        const url = publicUrlFor(ctx.apiUrl, result.id, args.remote, flags.folder);
+        this.print(url);
+        return { publicId: result.id, publicUrl: url };
+    }
+}