@norrix/cli 0.0.21 → 0.0.25

package/dist/lib/commands.js

@@ -7,17 +7,51 @@ import * as os from 'os';
 import { fileURLToPath } from 'url';
 import archiver from 'archiver';
 // import FormData from 'form-data';
-import { configureAmplify } from './amplify-config.js';
+import { configureAmplify, loadCliEnvFiles } from './amplify-config.js';
 import { computeFingerprint, writeRuntimeFingerprintFile } from './fingerprinting.js';
+import { loadNorrixConfig, hasNorrixConfig, saveNorrixConfig } from './config.js';
+import { detectWorkspaceContext, getNxProjectDependencies, getWorkspaceDependenciesFallback, createWorkspaceManifest, logWorkspaceContext, isAtWorkspaceRoot, discoverNativeScriptApps, getWorkspaceContextForApp, } from './workspace.js';
 import { signIn as amplifySignIn, signOut as amplifySignOut, getCurrentUser, fetchAuthSession, } from 'aws-amplify/auth';
 import crypto from 'crypto';
 import { Amplify } from 'aws-amplify';
-// Initialize Amplify once at startup
-configureAmplify();
+import { PROD_DEFAULTS } from './prod-defaults.js';
+import { DEV_DEFAULTS } from './dev-defaults.js';
+let CURRENT_ENV = 'prod';
+let CURRENT_DEFAULTS = PROD_DEFAULTS;
+let API_URL = PROD_DEFAULTS.apiUrl;
+let IS_INITIALIZED = false;
+function defaultsForEnv(env) {
+    return env === 'dev' ? DEV_DEFAULTS : PROD_DEFAULTS;
+}
+/**
+ * Initialize runtime config for this CLI process.
+ *
+ * - Loads env files (user config always; package-root only in dev)
+ * - Selects dev/prod in-code defaults
+ * - Configures Amplify Auth/Storage
+ * - Computes the API base URL used by commands
+ */
+export function initNorrixCli(env = 'prod') {
+    // Allow re-init when running tests or when the caller changes env.
+    if (IS_INITIALIZED && env === CURRENT_ENV)
+        return;
+    CURRENT_ENV = env;
+    loadCliEnvFiles(env);
+    CURRENT_DEFAULTS = defaultsForEnv(env);
+    configureAmplify(env);
+    API_URL = process.env.NORRIX_API_URL || CURRENT_DEFAULTS.apiUrl;
+    IS_INITIALIZED = true;
+}
+function ensureInitialized() {
+    if (!IS_INITIALIZED) {
+        initNorrixCli('prod');
+    }
+}
 /**
  * Return Authorization header containing the current Cognito ID token (if signed in).
  */
 async function getAuthHeaders() {
+    ensureInitialized();
     try {
         const session = await fetchAuthSession();
         const idToken = session.tokens?.idToken?.toString();
@@ -41,8 +75,8 @@ async function getAuthHeaders() {
  * The Next.js API then dispatches validated build/submit/update tasks to WarpBuild
  * (GitHub Actions) for heavyweight processing.
  */
-// Config (will be moved to a config file/env variables later)
-const API_URL = process.env.NORRIX_API_URL || 'http://localhost:3000/api';
+// NOTE: API_URL is initialized by initNorrixCli(). We keep a prod fallback for
+// library consumers that import functions directly without running the CLI entrypoint.
 // Get dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -95,6 +129,7 @@ function encryptSecretsIfConfigured(secrets) {
  * falls back to AWS SDK v3 in pure Node (where FileReader is unavailable).
  */
 async function putObjectToStorage(key, data) {
+    ensureInitialized();
     // CLI always runs in Node; use AWS SDK v3 directly
     await uploadToS3Sdk(key, data);
 }
@@ -102,10 +137,10 @@ function getS3BucketRegionFromAmplify() {
     const cfg = Amplify.getConfig?.() ?? {};
     const bucket = cfg?.Storage?.S3?.bucket ||
         process.env.NORRIX_STORAGE_BUCKET_NAME ||
-        process.env.NEXT_PUBLIC_STORAGE_BUCKET_NAME;
+        process.env.NORRIX_S3_BUCKET;
     const region = cfg?.Storage?.S3?.region ||
         process.env.NORRIX_STORAGE_BUCKET_REGION ||
-        process.env.NEXT_PUBLIC_STORAGE_BUCKET_REGION ||
+        process.env.NORRIX_AWS_REGION ||
         process.env.AWS_REGION ||
         process.env.AWS_DEFAULT_REGION;
     if (!bucket || !region) {
@@ -145,6 +180,7 @@ async function uploadToS3Sdk(key, data) {
     await client.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: data }));
 }
 export async function printFingerprint(cliPlatformArg, appId, verbose = false) {
+    ensureInitialized();
     try {
         const projectRoot = process.cwd();
         const platform = (cliPlatformArg || '').toLowerCase() || undefined;
@@ -350,6 +386,7 @@ function printFingerprintComparisonDetails(fromLabel, fromFp, toLabel, toFp) {
     return hashesMatch;
 }
 export async function compareFingerprint(fromId, toArg, verbose = false) {
+    ensureInitialized();
     try {
         if (!fromId) {
             throw new Error('Missing required --from <id> argument');
@@ -600,20 +637,106 @@ function getAndroidVersionFromAppGradle() {
     }
 }
 /**
- * Creates a zip file of the current directory (NativeScript project)
+ * Resolve workspace context for a command.
+ *
+ * When running from workspace root:
+ * - If --project is provided, use that project
+ * - Otherwise, discover NativeScript apps and prompt for selection
+ *
+ * When running from within an app directory:
+ * - Use the current directory's context
+ *
+ * @param projectArg - Optional project name from --project flag
+ * @param spinner - Optional spinner to stop before prompting
+ */
+async function resolveWorkspaceContext(projectArg, spinner) {
+    const originalCwd = process.cwd();
+    // If we're at workspace root (has nx.json but no nativescript.config)
+    if (isAtWorkspaceRoot()) {
+        // If --project was provided, use it
+        if (projectArg) {
+            const ctx = getWorkspaceContextForApp(projectArg);
+            if (!ctx) {
+                const apps = discoverNativeScriptApps();
+                const appNames = apps.map((a) => a.name).join(', ');
+                throw new Error(`Project '${projectArg}' not found in workspace. Available NativeScript apps: ${appNames || 'none'}`);
+            }
+            // Change to the app directory for subsequent operations
+            process.chdir(ctx.appRoot);
+            return { workspaceContext: ctx, originalCwd };
+        }
+        // Discover NativeScript apps and prompt for selection
+        const apps = discoverNativeScriptApps();
+        if (apps.length === 0) {
+            throw new Error('No NativeScript apps found in this workspace. ' +
+                'Run this command from within a NativeScript app directory, or ensure your apps have nativescript.config.ts files.');
+        }
+        if (apps.length === 1) {
+            // Only one app, use it automatically
+            if (spinner)
+                spinner.stop();
+            console.log(`Found NativeScript app: ${apps[0].name} (${apps[0].path})`);
+            const ctx = getWorkspaceContextForApp(apps[0].name);
+            if (ctx) {
+                process.chdir(ctx.appRoot);
+                return { workspaceContext: ctx, originalCwd };
+            }
+        }
+        // Multiple apps - stop spinner before prompting
+        if (spinner)
+            spinner.stop();
+        // Multiple apps - prompt for selection
+        const { selectedApp } = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'selectedApp',
+                message: 'Select a NativeScript app:',
+                choices: apps.map((app) => ({
+                    name: `${app.name} (${app.path})`,
+                    value: app.name,
+                })),
+                pageSize: 15, // Show more items to avoid scroll issues
+                loop: false, // Don't loop back to start when at end
+            },
+        ]);
+        const ctx = getWorkspaceContextForApp(selectedApp);
+        if (!ctx) {
+            throw new Error(`Failed to get context for selected app: ${selectedApp}`);
+        }
+        process.chdir(ctx.appRoot);
+        return { workspaceContext: ctx, originalCwd };
+    }
+    // Not at workspace root - use current directory
+    const ctx = detectWorkspaceContext();
+    return { workspaceContext: ctx, originalCwd };
+}
+/**
+ * Creates a zip file of the current directory (NativeScript project).
+ * For Nx workspaces, this includes the app, dependent libs, and workspace config files.
+ * For standalone projects, this zips the current directory.
+ */
+async function zipProject(projectName, isUpdate = false, verbose = false) {
+    const workspaceCtx = detectWorkspaceContext();
+    if (workspaceCtx.type === 'nx') {
+        return zipWorkspaceProject(projectName, workspaceCtx, isUpdate, verbose);
+    }
+    else {
+        return zipStandaloneProject(projectName, workspaceCtx, isUpdate);
+    }
+}
+/**
+ * Zip a standalone NativeScript project (original behavior)
  */
-async function zipProject(projectName, isUpdate = false) {
+async function zipStandaloneProject(projectName, workspaceCtx, isUpdate = false) {
     return new Promise((resolve, reject) => {
         const outputPath = path.join(process.cwd(), `${projectName}.zip`);
         const output = fs.createWriteStream(outputPath);
         const archive = archiver('zip', {
-            zlib: { level: 9 }, // Compression level
+            zlib: { level: 9 },
         });
-        // Listen for all archive data to be written
         output.on('close', () => {
-            resolve(outputPath);
+            resolve({ zipPath: outputPath, workspaceContext: workspaceCtx });
         });
-        // Listen for warnings and errors
         archive.on('warning', (err) => {
             if (err.code === 'ENOENT') {
                 console.warn('Archive warning:', err);
@@ -625,9 +748,8 @@ async function zipProject(projectName, isUpdate = false) {
         archive.on('error', (err) => {
             reject(err);
         });
-        // Pipe archive data to the file
         archive.pipe(output);
-        // Determine the primary app directory (prefer appPath from NativeScript config)
+        // Determine the primary app directory
         const nsAppPath = getNativeScriptAppPath();
         const nsAppDir = nsAppPath
             ? path.join(process.cwd(), nsAppPath)
@@ -647,18 +769,12 @@ async function zipProject(projectName, isUpdate = false) {
         }
         else {
             console.warn('Warning: app directory not found in the project root');
-            const checked = [nsAppDir, srcDir, appDir].filter(Boolean).join(', ');
-            console.warn(`Checked locations: ${checked}`);
-            console.log('Creating an empty app directory in the zip');
         }
-        // For both builds/updates, include App_Resources and exclude node_modules.
-        // For OTA updates specifically, we also exclude the runtime fingerprint
-        // file, since it reflects the native store binary, not the OTA payload.
         const ignorePatterns = [
-            'node_modules/**', // Always exclude node_modules
-            '*.zip', // Exclude existing zip files
-            'platforms/**', // Exclude platform-specific directories
-            'hooks/**', // Exclude hooks directory
+            'node_modules/**',
+            '*.zip',
+            'platforms/**',
+            'hooks/**',
         ];
         if (isUpdate) {
             ignorePatterns.push('**/assets/norrix.fingerprint.json');
@@ -667,7 +783,132 @@ async function zipProject(projectName, isUpdate = false) {
             cwd: process.cwd(),
             ignore: ignorePatterns,
         });
-        // Finalize the archive
+        archive.finalize();
+    });
+}
+/**
+ * Zip an Nx workspace project including the app and its dependencies
+ */
+async function zipWorkspaceProject(projectName, workspaceCtx, isUpdate = false, verbose = false) {
+    return new Promise((resolve, reject) => {
+        const outputPath = path.join(workspaceCtx.appRoot, `${projectName}.zip`);
+        const output = fs.createWriteStream(outputPath);
+        const archive = archiver('zip', {
+            zlib: { level: 9 },
+        });
+        output.on('close', () => {
+            resolve({ zipPath: outputPath, workspaceContext: workspaceCtx });
+        });
+        archive.on('warning', (err) => {
+            if (err.code === 'ENOENT') {
+                if (verbose)
+                    console.warn('Archive warning:', err);
+            }
+            else {
+                reject(err);
+            }
+        });
+        archive.on('error', (err) => {
+            reject(err);
+        });
+        archive.pipe(output);
+        logWorkspaceContext(workspaceCtx, verbose);
+        // Get workspace dependencies using Nx CLI (preferred) or fallback
+        let deps;
+        if (workspaceCtx.projectName) {
+            deps = getNxProjectDependencies(workspaceCtx.projectName, workspaceCtx.workspaceRoot, verbose);
+        }
+        if (!deps) {
+            if (verbose) {
+                console.log('[workspace] Using fallback dependency detection');
+            }
+            deps = getWorkspaceDependenciesFallback(workspaceCtx, verbose);
+        }
+        // Create manifest for CI
+        const manifest = createWorkspaceManifest(workspaceCtx, deps);
+        archive.append(JSON.stringify(manifest, null, 2), {
+            name: '.norrix/manifest.json',
+        });
+        // Base ignore patterns for the entire workspace
+        const ignorePatterns = [
+            '**/node_modules/**',
+            '**/*.zip',
+            '**/platforms/**',
+            '**/dist/**',
+            '**/.git/**',
+            '**/hooks/**',
+            // Exclude other apps (not the current one)
+            'apps/**',
+        ];
+        if (isUpdate) {
+            ignorePatterns.push('**/assets/norrix.fingerprint.json');
+        }
+        // 1. Add the app itself at its relative workspace path
+        console.log(`Adding app: ${workspaceCtx.relativeAppPath}`);
+        archive.directory(workspaceCtx.appRoot, workspaceCtx.relativeAppPath, (entry) => {
+            // Filter out node_modules, platforms, etc.
+            if (entry.name.includes('node_modules') ||
+                entry.name.includes('platforms') ||
+                entry.name.endsWith('.zip')) {
+                return false;
+            }
+            if (isUpdate && entry.name.includes('norrix.fingerprint.json')) {
+                return false;
+            }
+            return entry;
+        });
+        // 2. Add dependent libs
+        if (deps.libPaths.length > 0) {
+            console.log(`Adding ${deps.libPaths.length} library dependencies`);
+            for (const libPath of deps.libPaths) {
+                const absoluteLibPath = path.join(workspaceCtx.workspaceRoot, libPath);
+                if (fs.existsSync(absoluteLibPath)) {
+                    if (verbose) {
+                        console.log(`  - ${libPath}`);
+                    }
+                    archive.directory(absoluteLibPath, libPath, (entry) => {
+                        if (entry.name.includes('node_modules')) {
+                            return false;
+                        }
+                        return entry;
+                    });
+                }
+            }
+        }
+        // 3. Add root config files
+        console.log('Adding workspace root configuration files');
+        for (const configFile of deps.rootConfigs) {
+            const configPath = path.join(workspaceCtx.workspaceRoot, configFile);
+            if (fs.existsSync(configPath)) {
+                if (verbose) {
+                    console.log(`  - ${configFile}`);
+                }
+                archive.file(configPath, { name: configFile });
+            }
+        }
+        // 4. Add tools directory if it exists and is referenced
+        for (const toolPath of deps.toolPaths) {
+            const absoluteToolPath = path.join(workspaceCtx.workspaceRoot, toolPath);
+            if (fs.existsSync(absoluteToolPath) && fs.statSync(absoluteToolPath).isDirectory()) {
+                console.log(`Adding tools: ${toolPath}`);
+                archive.directory(absoluteToolPath, toolPath, (entry) => {
+                    if (entry.name.includes('node_modules')) {
+                        return false;
+                    }
+                    return entry;
+                });
+            }
+        }
+        // 5. Add asset paths if they exist
+        for (const assetPath of deps.assetPaths) {
+            const absoluteAssetPath = path.join(workspaceCtx.workspaceRoot, assetPath);
+            if (fs.existsSync(absoluteAssetPath) && fs.statSync(absoluteAssetPath).isDirectory()) {
+                if (verbose) {
+                    console.log(`Adding assets: ${assetPath}`);
+                }
+                archive.directory(absoluteAssetPath, assetPath);
+            }
+        }
         archive.finalize();
     });
 }
@@ -675,15 +916,33 @@ async function zipProject(projectName, isUpdate = false) {
  * Build command implementation
  * Uploads project to S3 and triggers build via the Next.js API gateway -> WarpBuild
  */
-export async function build(cliPlatformArg, cliConfigurationArg, verbose = false) {
+export async function build(cliPlatformArg, cliConfigurationArg, cliDistributionArg, verbose = false, options // string for backwards compatibility with old projectArg
+) {
+    // Normalize options - support both new object and legacy string projectArg
+    const opts = typeof options === 'string' ? { project: options } : (options || {});
+    ensureInitialized();
     let spinner;
+    let originalCwd;
     try {
         spinner = ora('Preparing app for building...');
         spinner.start();
+        // 0. Resolve workspace context (handles --project and prompting)
+        const resolved = await resolveWorkspaceContext(opts.project, spinner);
+        originalCwd = resolved.originalCwd;
+        const workspaceCtx = resolved.workspaceContext;
+        // Restart spinner after potential prompts
+        if (!spinner.isSpinning) {
+            spinner.start('Preparing app for building...');
+        }
+        // Load Norrix config file if present
+        const norrixConfig = await loadNorrixConfig(process.cwd());
+        if (workspaceCtx.type === 'nx' && verbose) {
+            logWorkspaceContext(workspaceCtx, verbose);
+        }
         // 1. Get project info
         const projectName = await getProjectName();
-        // 2. Determine platform (CLI arg preferred, otherwise prompt)
-        let platform = (cliPlatformArg || '').toLowerCase();
+        // 2. Determine platform (CLI arg preferred, then config, otherwise prompt)
+        let platform = (cliPlatformArg || norrixConfig.defaultPlatform || '').toLowerCase();
         const validPlatforms = ['android', 'ios', 'visionos'];
         spinner.stop();
         if (!validPlatforms.includes(platform)) {
@@ -712,6 +971,64 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
             ]);
             configuration = answer.configuration;
         }
+        const normalizeIosDistribution = (input) => {
+            const v = String(input ?? '')
+                .trim()
+                .toLowerCase();
+            if (!v)
+                return undefined;
+            if (v === 'enterprise' ||
+                v === 'inhouse' ||
+                v === 'in-house' ||
+                v === 'in_house') {
+                return 'enterprise';
+            }
+            if (v === 'adhoc' || v === 'ad-hoc' || v === 'ad_hoc' || v === 'ad hoc') {
+                return 'adhoc';
+            }
+            if (v === 'appstore' ||
+                v === 'app-store' ||
+                v === 'app store' ||
+                v === 'store' ||
+                v === 'app_store') {
+                return 'appstore';
+            }
+            return undefined;
+        };
+        // 2.2 iOS distribution type (release only): CLI arg > config file > prompt
+        let distributionType;
+        if (platform === 'ios' && configuration === 'release') {
+            // Try CLI arg first
+            distributionType = normalizeIosDistribution(cliDistributionArg);
+            if (!distributionType && cliDistributionArg) {
+                throw new Error(`Invalid iOS distribution type '${cliDistributionArg}'. Use 'appstore', 'adhoc', or 'enterprise'.`);
+            }
+            // Fall back to config file
+            if (!distributionType && norrixConfig.ios?.distributionType) {
+                distributionType = norrixConfig.ios.distributionType;
+            }
+            // Prompt if still not set (unless non-interactive mode)
+            if (!distributionType && !opts.nonInteractive) {
+                const { distribution } = await inquirer.prompt([
+                    {
+                        type: 'list',
+                        name: 'distribution',
+                        message: 'Distribution Type:',
+                        choices: [
+                            { name: 'App Store', value: 'appstore' },
+                            { name: 'Ad Hoc', value: 'adhoc' },
+                            { name: 'Enterprise', value: 'enterprise' },
+                        ],
+                        default: 'appstore',
+                    },
+                ]);
+                distributionType = distribution;
+            }
+            // Default to appstore in non-interactive mode if nothing else provided
+            if (!distributionType) {
+                distributionType = 'appstore';
+            }
+        }
         const appleVersionInfo = platform === 'ios' || platform === 'visionos'
             ? getAppleVersionFromInfoPlist(platform)
             : {};
@@ -781,7 +1098,31 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
         if (configuration === 'release') {
             spinner.stop();
             if (platform === 'ios') {
+                // Determine Team ID from: CLI flag > config file > prompt
+                const configTeamId = norrixConfig.ios?.teamId;
+                const resolvedTeamId = opts.teamId || configTeamId;
+                // If we have teamId from CLI or config, and non-interactive mode, skip prompts
+                const shouldPromptForTeamId = !resolvedTeamId && !opts.nonInteractive;
                 const iosAnswers = await inquirer.prompt([
+                    {
+                        type: 'input',
+                        name: 'teamId',
+                        message: 'Apple Developer Team ID (required for code signing, e.g. "ABC123XYZ"):',
+                        default: resolvedTeamId || '',
+                        when: () => shouldPromptForTeamId || !resolvedTeamId,
+                        validate: (input) => {
+                            // Team ID is optional if user provides their own p12/profile
+                            // but we'll strongly recommend it
+                            if (!input.trim()) {
+                                return true; // Allow empty, workflow will try to proceed without it
+                            }
+                            // Basic validation: Apple Team IDs are typically 10 alphanumeric chars
+                            if (/^[A-Z0-9]{10}$/.test(input.trim())) {
+                                return true;
+                            }
+                            return 'Team ID should be 10 alphanumeric characters (e.g. "ABC123XYZ"). Leave empty to skip.';
+                        },
+                    },
                     {
                         type: 'input',
                         name: 'p12Path',
@@ -804,7 +1145,7 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
                     {
                         type: 'confirm',
                         name: 'hasAscKey',
-                        message: 'Provide App Store Connect API Key? (optional, for App Store operations)',
+                        message: 'Provide App Store Connect API Key? (optional, for auto-provisioning)',
                         default: false,
                     },
                     {
@@ -828,23 +1169,24 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
                         default: '',
                         when: (a) => a.hasAscKey,
                     },
-                    {
-                        type: 'input',
-                        name: 'ascTeamId',
-                        message: 'Apple Developer Team ID (optional, required for API-key provisioning):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
                 ]);
+                // Use resolved teamId from CLI/config, or from prompt
+                const finalTeamId = resolvedTeamId || iosAnswers.teamId?.trim();
                 iosCredentials = {
+                    teamId: finalTeamId || undefined,
                     p12Base64: readOptionalFileAsBase64(iosAnswers.p12Path),
                     p12Password: iosAnswers.p12Password || undefined,
                     mobileprovisionBase64: readOptionalFileAsBase64(iosAnswers.mobileprovisionPath),
                     ascApiKeyId: iosAnswers.ascApiKeyId || undefined,
                     ascIssuerId: iosAnswers.ascIssuerId || undefined,
                     ascPrivateKey: readOptionalFileAsBase64(iosAnswers.ascPrivateKeyPath),
-                    ascTeamId: iosAnswers.ascTeamId || undefined,
+                    // Track paths for config saving (not sent to API)
+                    _p12Path: iosAnswers.p12Path || undefined,
+                    _mobileprovisionPath: iosAnswers.mobileprovisionPath || undefined,
                 };
+                if (finalTeamId) {
+                    console.log(`Using Apple Team ID: ${finalTeamId}`);
+                }
             }
             else if (platform === 'android') {
                 const androidAnswers = await inquirer.prompt([
@@ -895,6 +1237,66 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
                     keyPassword: androidAnswers.keyPassword || undefined,
                     playServiceAccountJson: readOptionalFileAsBase64(androidAnswers.playJsonPath),
                 };
+                // Track Android paths for config saving
+                androidCredentials._keystorePath = androidAnswers.keystorePath || undefined;
+                androidCredentials._keyAlias = androidAnswers.keyAlias || undefined;
+            }
+            // Offer to save config if no norrix.config.ts exists and we collected useful values
+            const appRoot = process.cwd();
+            if (!hasNorrixConfig(appRoot) && !opts.nonInteractive) {
+                // Collect saveable values
+                const saveableOptions = {
+                    platform: platform,
+                };
+                if (platform === 'ios' && iosCredentials) {
+                    if (iosCredentials.teamId) {
+                        saveableOptions.teamId = iosCredentials.teamId;
+                    }
+                    if (distributionType) {
+                        saveableOptions.distributionType = distributionType;
+                    }
+                    // Don't save actual credential file paths since they may contain secrets
+                    // But save paths that users can re-use
+                    if (iosCredentials._p12Path) {
+                        saveableOptions.p12Path = iosCredentials._p12Path;
+                    }
+                    if (iosCredentials._mobileprovisionPath) {
+                        saveableOptions.provisioningProfilePath = iosCredentials._mobileprovisionPath;
+                    }
+                }
+                if (platform === 'android' && androidCredentials) {
+                    if (androidCredentials._keystorePath) {
+                        saveableOptions.keystorePath = androidCredentials._keystorePath;
+                    }
+                    if (androidCredentials._keyAlias) {
+                        saveableOptions.keyAlias = androidCredentials._keyAlias;
+                    }
+                }
+                // Only offer to save if we have something useful
+                const hasSaveableValues = saveableOptions.teamId ||
+                    saveableOptions.distributionType ||
+                    saveableOptions.p12Path ||
+                    saveableOptions.provisioningProfilePath ||
+                    saveableOptions.keystorePath;
+                if (hasSaveableValues) {
+                    const { shouldSave } = await inquirer.prompt([
+                        {
+                            type: 'confirm',
+                            name: 'shouldSave',
+                            message: 'Save these settings to norrix.config.ts for future builds?',
+                            default: true,
+                        },
+                    ]);
+                    if (shouldSave) {
+                        try {
+                            const savedPath = saveNorrixConfig(appRoot, saveableOptions);
+                            console.log(`✓ Configuration saved to ${path.basename(savedPath)}`);
+                        }
+                        catch (saveError) {
+                            console.warn(`Warning: Could not save config file: ${saveError.message}`);
+                        }
+                    }
+                }
             }
             spinner.start('Creating project archive...');
         }
@@ -906,8 +1308,8 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
         });
         writeRuntimeFingerprintFile(projectRoot, fingerprint, platform);
         spinner.start('Creating project archive...');
-        // 3. Zip the project
-        const zipPath = await zipProject(projectName, false);
+        // 3. Zip the project (workspace-aware)
+        const { zipPath, workspaceContext } = await zipProject(projectName, false, verbose);
         spinner.text = 'Project archive created';
         // 4. Upload the project zip to S3
         spinner.text = 'Working...';
@@ -934,16 +1336,27 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
         catch {
             inferredAppId = undefined;
         }
+        // Include workspace info for CI to properly navigate the project structure
+        const workspaceInfo = workspaceContext.type === 'nx' ? {
+            workspaceType: workspaceContext.type,
+            appPath: workspaceContext.relativeAppPath,
+            projectName: workspaceContext.projectName,
+        } : undefined;
         const response = await axios.post(`${API_URL}/build`, {
             projectName,
             appId: inferredAppId,
             platform,
+            // Forward CLI verbosity so CI can enable expensive logs (e.g. `ns --log trace`).
+            verbose: Boolean(verbose),
             version: version || '',
             buildNumber: buildNumber || '',
             configuration,
+            ...(distributionType ? { distributionType } : {}),
             fingerprint,
             // Provide the relative key (without public/) – the workflow prepends public/
             s3Key: s3KeyRel,
+            // Workspace context for Nx monorepos
+            ...(workspaceInfo ? { workspace: workspaceInfo } : {}),
             // Only include raw credentials if not encrypted
             ...(encryptedSecrets ? { encryptedSecrets } : {}),
             ...(!encryptedSecrets && iosCredentials ? { iosCredentials } : {}),
@@ -959,6 +1372,9 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
         // 6. Clean up the zip file
         fs.unlinkSync(zipPath);
         const buildId = response.data.id;
+        const dispatchedEnv = response?.data?.norrixEnv
+            ? String(response.data.norrixEnv).trim()
+            : undefined;
         // Prefer printing what the backend recorded (in case it normalizes values)
         // but fall back to local inputs/inferred values if the record is not yet available.
         let recordedVersion = String(version || '').trim() || undefined;
@@ -984,11 +1400,38 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
         spinner.succeed('Build started successfully!');
         console.log('✅ Your app is being built on Norrix.');
         console.log(`   Build ID: ${buildId}`);
+        console.log(`   Backend API: ${API_URL}`);
+        if (process.env.NORRIX_API_URL) {
+            console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
+        }
+        if (dispatchedEnv) {
+            console.log(`   Backend env: ${dispatchedEnv}`);
+        }
         console.log(formatVersionBuildLine(recordedVersion, recordedBuildNumber));
         console.log(`   Platform: ${platform}`);
+        if (distributionType) {
+            console.log(`   Distribution: ${distributionType === 'enterprise'
+                ? 'Enterprise'
+                : distributionType === 'adhoc'
+                    ? 'Ad Hoc'
+                    : 'App Store'}`);
+        }
         console.log(`   You can check the status with: norrix build-status ${buildId}`);
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            process.chdir(originalCwd);
+        }
     }
     catch (error) {
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            try {
+                process.chdir(originalCwd);
+            }
+            catch {
+                // Ignore chdir errors during error handling
+            }
+        }
         const apiMessage = (error?.response?.data &&
             (error.response.data.error || error.response.data.message)) ||
             undefined;
@@ -1020,6 +1463,7 @@ export async function build(cliPlatformArg, cliConfigurationArg, verbose = false
  * Submits the built app to app stores via the Next.js API gateway
  */
 export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
+    ensureInitialized();
     const spinner = ora('Preparing app for submission...');
     try {
         spinner.start();
@@ -1191,6 +1635,9 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
             ...credentials,
         }, { headers: await getAuthHeaders() });
         const submitId = response.data.id;
+        const dispatchedEnv = response?.data?.norrixEnv
+            ? String(response.data.norrixEnv).trim()
+            : undefined;
         spinner.succeed('Submission started successfully!');
         // Try to print the exact version/buildNumber of what was submitted.
         // Prefer the selected build metadata, but fall back to fetching by ID
@@ -1230,6 +1677,13 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
         }
         console.log('✅ Your app submission request was received.');
         console.log(`   Submission ID: ${submitId}`);
+        console.log(`   Backend API: ${API_URL}`);
+        if (process.env.NORRIX_API_URL) {
+            console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
+        }
+        if (dispatchedEnv) {
+            console.log(`   Backend env: ${dispatchedEnv}`);
+        }
         console.log(`   Platform: ${platform === 'android' ? 'Google Play Store' : 'Apple App Store'}`);
         console.log(formatVersionBuildLine(submittedVersion, submittedBuildNumber));
         console.log(`   Track: ${track}`);
@@ -1268,11 +1722,27 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
  * Update command implementation
  * Publishes over-the-air updates to deployed apps via the Next.js API gateway
  */
-export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
+export async function update(cliPlatformArg, cliVersionArg, verbose = false, options // string for backwards compatibility with old projectArg
+) {
+    // Normalize options - support both new object and legacy string projectArg
+    const opts = typeof options === 'string' ? { project: options } : (options || {});
+    ensureInitialized();
     let spinner;
+    let originalCwd;
     try {
         spinner = ora('Preparing over-the-air update...');
         spinner.start();
+        // 0. Resolve workspace context (handles --project and prompting)
+        const resolved = await resolveWorkspaceContext(opts.project, spinner);
+        originalCwd = resolved.originalCwd;
+        const workspaceCtx = resolved.workspaceContext;
+        // Restart spinner after potential prompts
+        if (!spinner.isSpinning) {
+            spinner.start('Preparing over-the-air update...');
+        }
+        if (workspaceCtx.type === 'nx' && verbose) {
+            logWorkspaceContext(workspaceCtx, verbose);
+        }
         // Normalize and/or ask for platform first (CLI arg takes precedence if valid)
         let platform = (cliPlatformArg || '').toLowerCase();
         const validPlatforms = ['android', 'ios', 'visionos'];
@@ -1308,27 +1778,45 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         // Ask for app ID and version first
         spinner.stop();
         const cliVersion = (cliVersionArg || '').trim();
-        const baseAnswers = await inquirer.prompt([
-            {
-                type: 'input',
-                name: 'appId',
-                message: 'Enter the App ID to update:',
-                default: inferredAppId || '',
-                validate: (input) => input.length > 0 || 'App ID is required',
-            },
-            {
-                type: 'input',
-                name: 'version',
-                message: inferredVersion
-                    ? `Update version (${inferredVersion}, enter to accept):`
-                    : 'Update version:',
-                default: inferredVersion,
-                when: () => !cliVersion,
-                validate: (input) => input.length > 0 || 'Version is required',
-            },
-        ]);
-        const appId = baseAnswers.appId;
-        const version = (cliVersion || baseAnswers.version);
+        // Resolve appId: CLI flag → inferred → prompt
+        let appId;
+        if (opts.appId) {
+            appId = opts.appId;
+        }
+        else {
+            const { appId: promptedAppId } = await inquirer.prompt([
+                {
+                    type: 'input',
+                    name: 'appId',
+                    message: 'Enter the App ID to update:',
+                    default: inferredAppId || '',
+                    validate: (input) => input.length > 0 || 'App ID is required',
+                },
+            ]);
+            appId = promptedAppId;
+        }
+        // Resolve version: CLI arg → inferred → prompt
+        let version;
+        if (cliVersion) {
+            version = cliVersion;
+        }
+        else if (inferredVersion && opts.nonInteractive) {
+            version = inferredVersion;
+        }
+        else {
+            const { version: promptedVersion } = await inquirer.prompt([
+                {
+                    type: 'input',
+                    name: 'version',
+                    message: inferredVersion
+                        ? `Update version (${inferredVersion}, enter to accept):`
+                        : 'Update version:',
+                    default: inferredVersion,
+                    validate: (input) => input.length > 0 || 'Version is required',
+                },
+            ]);
+            version = promptedVersion;
+        }
         // Ask the server what the next buildNumber would be for this app so we
         // can present a sensible default in the prompt, matching what the API
         // will auto-increment to if left blank.
@@ -1352,38 +1840,51 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
             : platform === 'android'
                 ? androidVersionInfo.buildNumber
                 : undefined;
-        const { buildNumber: promptedBuildNumber, notes } = await inquirer.prompt([
-            {
-                type: 'input',
-                name: 'buildNumber',
-                message: (() => {
-                    if (serverSuggestedBuildNumber) {
-                        return `Update build number (${serverSuggestedBuildNumber}, enter to accept or override; blank to auto increment from server):`;
-                    }
-                    if (localInferredBuildNumber) {
-                        return `Update build number (${localInferredBuildNumber}, enter to auto increment from server):`;
-                    }
-                    return 'Update build number (leave blank to auto increment from server):';
-                })(),
-                default: serverSuggestedBuildNumber || localInferredBuildNumber || '',
-                validate: (input) => {
-                    const val = String(input).trim();
-                    if (!val)
-                        return true; // allow blank -> server will auto-increment
-                    if (!/^\d+$/.test(val)) {
-                        return 'Build number must be a positive integer or blank to auto-increment';
-                    }
-                    return true;
+        // Resolve buildNumber: CLI flag → server suggestion → local inferred → prompt
+        let buildNumber;
+        let notes = '';
+        if (opts.buildNumber) {
+            buildNumber = opts.buildNumber;
+        }
+        else if (opts.nonInteractive) {
+            // In non-interactive mode, use server suggestion or leave undefined for auto-increment
+            buildNumber = serverSuggestedBuildNumber || localInferredBuildNumber || undefined;
+        }
+        else {
+            const buildPromptAnswers = await inquirer.prompt([
+                {
+                    type: 'input',
+                    name: 'buildNumber',
+                    message: (() => {
+                        if (serverSuggestedBuildNumber) {
+                            return `Update build number (${serverSuggestedBuildNumber}, enter to accept or override; blank to auto increment from server):`;
+                        }
+                        if (localInferredBuildNumber) {
+                            return `Update build number (${localInferredBuildNumber}, enter to auto increment from server):`;
+                        }
+                        return 'Update build number (leave blank to auto increment from server):';
+                    })(),
+                    default: serverSuggestedBuildNumber || localInferredBuildNumber || '',
+                    validate: (input) => {
+                        const val = String(input).trim();
+                        if (!val)
+                            return true; // allow blank -> server will auto-increment
+                        if (!/^\d+$/.test(val)) {
+                            return 'Build number must be a positive integer or blank to auto-increment';
+                        }
+                        return true;
+                    },
                 },
-            },
-            {
-                type: 'input',
-                name: 'notes',
-                message: 'Release notes (optional):',
-                default: '',
-            },
-        ]);
-        const buildNumber = String(promptedBuildNumber || '').trim() || undefined;
+                {
+                    type: 'input',
+                    name: 'notes',
+                    message: 'Release notes (optional):',
+                    default: '',
+                },
+            ]);
+            buildNumber = String(buildPromptAnswers.buildNumber || '').trim() || undefined;
+            notes = buildPromptAnswers.notes || '';
+        }
         // Check the app directory structure before packaging
         const srcAppDir = path.join(process.cwd(), 'src', 'app');
         const appDir = path.join(process.cwd(), 'app');
@@ -1460,9 +1961,9 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         // fingerprint JSON under the app source tree is the
         // single source of truth for OTA compatibility.
         spinner.start('Packaging for over-the-air update...');
-        // Create the update bundle - pass true to include node_modules for updates
+        // Create the update bundle (workspace-aware) - pass true to include node_modules for updates
         const projectName = await getProjectName();
-        const zipPath = await zipProject(projectName, true);
+        const { zipPath, workspaceContext } = await zipProject(projectName, true, verbose);
         spinner.text = 'Uploading update to Norrix cloud storage...';
         const fileBuffer = fs.readFileSync(zipPath);
         const updateFolder = `update-${Date.now()}`;
@@ -1470,6 +1971,12 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         const s3KeyRel = `updates/${updateFolder}/${appId}-${safeVersion}.zip`;
         await putObjectToStorage(`public/${s3KeyRel}`, fileBuffer);
         spinner.text = 'Upload complete. Starting update...';
+        // Include workspace info for CI to properly navigate the project structure
+        const workspaceInfo = workspaceContext.type === 'nx' ? {
+            workspaceType: workspaceContext.type,
+            appPath: workspaceContext.relativeAppPath,
+            projectName: workspaceContext.projectName,
+        } : undefined;
         const response = await axios.post(`${API_URL}/update`, {
             appId,
             platform,
@@ -1479,6 +1986,8 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
             fingerprint,
             // Provide the relative key (without public/). Consumers will prepend public/
             s3Key: s3KeyRel,
+            // Workspace context for Nx monorepos
+            ...(workspaceInfo ? { workspace: workspaceInfo } : {}),
         }, {
             headers: {
                 'Content-Type': 'application/json',
@@ -1488,6 +1997,9 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         // Clean up the zip file
         fs.unlinkSync(zipPath);
         const updateId = response.data.id;
+        const dispatchedEnv = response?.data?.norrixEnv
+            ? String(response.data.norrixEnv).trim()
+            : undefined;
         // Prefer the backend-recorded values (especially buildNumber when auto-incremented).
         let recordedUpdateVersion = String(version || '').trim() || undefined;
         let recordedUpdateBuildNumber = (response?.data?.buildNumber
@@ -1516,10 +2028,30 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         spinner.succeed('Update published successfully!');
         console.log('✅ Your update has been published.');
         console.log(`   Update ID: ${updateId}`);
+        console.log(`   Backend API: ${API_URL}`);
+        if (process.env.NORRIX_API_URL) {
+            console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
+        }
+        if (dispatchedEnv) {
+            console.log(`   Backend env: ${dispatchedEnv}`);
+        }
         console.log(formatVersionBuildLine(recordedUpdateVersion, recordedUpdateBuildNumber));
         console.log(`   You can check the status with: norrix update-status ${updateId}`);
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            process.chdir(originalCwd);
+        }
     }
     catch (error) {
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            try {
+                process.chdir(originalCwd);
+            }
+            catch {
+                // Ignore chdir errors during error handling
+            }
+        }
         const apiMessage = (error?.response?.data &&
             (error.response.data.error || error.response.data.message)) ||
             undefined;
@@ -1548,6 +2080,7 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
  * Checks the status of a build via the Next.js API gateway
  */
 export async function buildStatus(buildId, verbose = false) {
+    ensureInitialized();
     try {
         const spinner = ora(`Checking status of build ${buildId}...`).start();
         const response = await axios.get(`${API_URL}/build/${buildId}`, {
@@ -1585,6 +2118,7 @@ export async function buildStatus(buildId, verbose = false) {
  * Checks the status of a submission via the Next.js API gateway
  */
 export async function submitStatus(submitId, verbose = false) {
+    ensureInitialized();
     try {
         const spinner = ora(`Checking status of submission ${submitId}...`).start();
         const response = await axios.get(`${API_URL}/submit/${submitId}`, {
@@ -1618,6 +2152,7 @@ export async function submitStatus(submitId, verbose = false) {
  * Checks the status of an update via the Next.js API gateway
  */
 export async function updateStatus(updateId, verbose = false) {
+    ensureInitialized();
     try {
         const spinner = ora(`Checking status of update ${updateId}...`).start();
         const response = await axios.get(`${API_URL}/update/${updateId}`, {
@@ -1650,6 +2185,7 @@ export async function updateStatus(updateId, verbose = false) {
  * Sign-In command implementation (email / password via Cognito)
  */
 export async function signIn(verbose = false) {
+    ensureInitialized();
     try {
         const answers = await inquirer.prompt([
             {
@@ -1697,6 +2233,7 @@ export async function signIn(verbose = false) {
  * Sign-Out command implementation
  */
 export async function signOut(verbose = false) {
+    ensureInitialized();
     try {
         const spinner = ora('Signing out...').start();
         await amplifySignOut();
@@ -1721,6 +2258,7 @@ export async function signOut(verbose = false) {
  * Upload a file to S3 via Amplify Storage
  */
 export async function uploadFile(filePath, options, verbose = false) {
+    ensureInitialized();
     try {
         const resolvedPath = path.resolve(process.cwd(), filePath);
         if (!fs.existsSync(resolvedPath)) {
@@ -1751,6 +2289,7 @@ export async function uploadFile(filePath, options, verbose = false) {
  * Current User command implementation
  */
 export async function currentUser(verbose = false) {
+    ensureInitialized();
     try {
         const spinner = ora('Fetching current user...').start();
         let user;
@@ -1802,6 +2341,7 @@ export async function currentUser(verbose = false) {
  * Open billing checkout for the current organization
  */
 export async function billingCheckout(priceId, verbose = false) {
+    ensureInitialized();
     try {
         if (!priceId) {
             const a = await inquirer.prompt([
@@ -1834,6 +2374,7 @@ export async function billingCheckout(priceId, verbose = false) {
  * Open Stripe billing portal for the current organization
  */
 export async function billingPortal(verbose = false) {
+    ensureInitialized();
     try {
         const spinner = ora('Creating billing portal session...').start();
         const res = await axios.post(`${API_URL}/billing/portal`, {}, { headers: await getAuthHeaders() });