@norrix/cli 0.0.24 → 0.0.26

package/dist/lib/commands.js

@@ -9,14 +9,18 @@ import archiver from 'archiver';
 // import FormData from 'form-data';
 import { configureAmplify, loadCliEnvFiles } from './amplify-config.js';
 import { computeFingerprint, writeRuntimeFingerprintFile } from './fingerprinting.js';
+import { loadNorrixConfig, hasNorrixConfig, saveNorrixConfig } from './config.js';
+import { detectWorkspaceContext, getNxProjectDependencies, getWorkspaceDependenciesFallback, createWorkspaceManifest, logWorkspaceContext, isAtWorkspaceRoot, discoverNativeScriptApps, getWorkspaceContextForApp, detectNxBuildConfigurations, } from './workspace.js';
 import { signIn as amplifySignIn, signOut as amplifySignOut, getCurrentUser, fetchAuthSession, } from 'aws-amplify/auth';
 import crypto from 'crypto';
 import { Amplify } from 'aws-amplify';
 import { PROD_DEFAULTS } from './prod-defaults.js';
 import { DEV_DEFAULTS } from './dev-defaults.js';
+import { clearSelectedOrgId, getSelectedOrgId, setSelectedOrgId } from './cli-settings.js';
 let CURRENT_ENV = 'prod';
 let CURRENT_DEFAULTS = PROD_DEFAULTS;
 let API_URL = PROD_DEFAULTS.apiUrl;
+let CURRENT_ORG_ID;
 let IS_INITIALIZED = false;
 function defaultsForEnv(env) {
     return env === 'dev' ? DEV_DEFAULTS : PROD_DEFAULTS;
@@ -38,6 +42,10 @@ export function initNorrixCli(env = 'prod') {
     CURRENT_DEFAULTS = defaultsForEnv(env);
     configureAmplify(env);
     API_URL = process.env.NORRIX_API_URL || CURRENT_DEFAULTS.apiUrl;
+    // Load persisted org selection for this env + API URL profile (if any).
+    // Allow per-invocation override via NORRIX_ORG_ID env var.
+    const envOrg = (process.env.NORRIX_ORG_ID ?? '').toString().trim();
+    CURRENT_ORG_ID = envOrg || getSelectedOrgId(env, API_URL);
     IS_INITIALIZED = true;
 }
 function ensureInitialized() {
@@ -48,19 +56,168 @@ function ensureInitialized() {
 /**
  * Return Authorization header containing the current Cognito ID token (if signed in).
  */
-async function getAuthHeaders() {
+async function getAuthHeaders(options) {
     ensureInitialized();
+    const headers = {};
     try {
         const session = await fetchAuthSession();
         const idToken = session.tokens?.idToken?.toString();
         if (idToken) {
-            return { Authorization: `Bearer ${idToken}` };
+            headers.Authorization = `Bearer ${idToken}`;
         }
     }
     catch (_) {
         /* not signed in */
     }
-    return {};
+    if (options?.includeOrg !== false && CURRENT_ORG_ID) {
+        headers['X-Norrix-Org-Id'] = CURRENT_ORG_ID;
+    }
+    return headers;
+}
+function setCurrentOrgId(orgId) {
+    const v = (orgId ?? '').toString().trim();
+    CURRENT_ORG_ID = v ? v : undefined;
+}
+async function fetchOrganizations(verbose = false) {
+    ensureInitialized();
+    try {
+        const res = await axios.get(`${API_URL}/orgs`, {
+            headers: await getAuthHeaders({ includeOrg: false }),
+        });
+        const organizations = Array.isArray(res.data?.organizations)
+            ? res.data.organizations
+            : [];
+        const selectedOrganizationId = res.data?.selectedOrganizationId
+            ? String(res.data.selectedOrganizationId)
+            : undefined;
+        return { organizations, selectedOrganizationId };
+    }
+    catch (err) {
+        if (verbose) {
+            console.error('--- Verbose error details (orgs fetch) ---');
+            console.error(err);
+            if (err?.response) {
+                console.error('Axios response status:', err.response.status);
+                console.error('Axios response data:', err.response.data);
+            }
+        }
+        throw err;
+    }
+}
+async function ensureOrgSelected(params) {
+    ensureInitialized();
+    const explicit = (params.orgIdArg ?? process.env.NORRIX_ORG_ID ?? '')
+        .toString()
+        .trim();
+    if (explicit) {
+        setCurrentOrgId(explicit);
+        return explicit;
+    }
+    const stored = getSelectedOrgId(CURRENT_ENV, API_URL);
+    if (!params.requireSelection) {
+        if (stored)
+            setCurrentOrgId(stored);
+        return stored;
+    }
+    // Validate stored selection (and discover orgs for prompting).
+    const { organizations } = await fetchOrganizations(Boolean(params.verbose));
+    const normalizedOrgs = organizations.filter((o) => o && o.id);
+    if (stored && normalizedOrgs.some((o) => o.id === stored)) {
+        setCurrentOrgId(stored);
+        return stored;
+    }
+    if (stored) {
+        clearSelectedOrgId(CURRENT_ENV, API_URL);
+    }
+    if (normalizedOrgs.length === 1) {
+        const only = normalizedOrgs[0];
+        setSelectedOrgId(CURRENT_ENV, API_URL, only.id);
+        setCurrentOrgId(only.id);
+        return only.id;
+    }
+    if (params.nonInteractive) {
+        throw new Error('No organization selected. Use --org <orgId> or run `norrix orgs select`.');
+    }
+    if (!normalizedOrgs.length) {
+        throw new Error('No organizations found for this user.');
+    }
+    const choices = normalizedOrgs.map((o) => {
+        const suffix = o.id.length > 8 ? o.id.slice(-8) : o.id;
+        return {
+            name: `${o.name} (${o.role}) • …${suffix}`,
+            value: o.id,
+        };
+    });
+    const { orgId } = await inquirer.prompt([
+        {
+            type: 'list',
+            name: 'orgId',
+            message: params.promptMessage || 'Select organization:',
+            choices,
+        },
+    ]);
+    const selected = String(orgId || '').trim();
+    if (!selected) {
+        throw new Error('Organization selection cancelled.');
+    }
+    setSelectedOrgId(CURRENT_ENV, API_URL, selected);
+    setCurrentOrgId(selected);
+    return selected;
+}
+export async function orgsList(verbose = false) {
+    ensureInitialized();
+    try {
+        const { organizations, selectedOrganizationId } = await fetchOrganizations(verbose);
+        if (!organizations.length) {
+            console.log('No organizations found.');
+            return;
+        }
+        console.log('Organizations:');
+        for (const o of organizations) {
+            const selectedMark = selectedOrganizationId && o.id === selectedOrganizationId ? ' (selected)' : '';
+            console.log(`- ${o.name} [${o.role}] ${o.id}${selectedMark}`);
+        }
+    }
+    catch (err) {
+        ora().fail(`Failed to list organizations: ${err?.message || err}`);
+        if (verbose && err?.response) {
+            console.error('Axios response status:', err.response.status);
+            console.error('Axios response data:', err.response.data);
+        }
+    }
+}
+export async function orgsSelect(verbose = false) {
+    ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            requireSelection: true,
+            nonInteractive: false,
+            verbose,
+            promptMessage: 'Select default organization for this environment:',
+        });
+        if (CURRENT_ORG_ID) {
+            console.log(`✅ Selected organization: ${CURRENT_ORG_ID}`);
+        }
+    }
+    catch (err) {
+        ora().fail(`Failed to select organization: ${err?.message || err}`);
+        if (verbose && err?.response) {
+            console.error('Axios response status:', err.response.status);
+            console.error('Axios response data:', err.response.data);
+        }
+    }
+}
+export async function orgsCurrent() {
+    ensureInitialized();
+    const envOrg = (process.env.NORRIX_ORG_ID ?? '').toString().trim();
+    const stored = getSelectedOrgId(CURRENT_ENV, API_URL);
+    const current = envOrg || stored;
+    if (!current) {
+        console.log('No default organization selected for this environment.');
+        console.log('Run `norrix orgs select` or pass `--org <orgId>`.');
+        return;
+    }
+    console.log(`Current organization for ${CURRENT_ENV} (${API_URL}): ${current}`);
 }
 /**
  * Norrix CLI Command Implementations
@@ -78,6 +235,16 @@ async function getAuthHeaders() {
 // Get dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+/**
+ * Safely trim a string value, returning undefined for empty/null values.
+ * Handles both CLI args and config file values to ensure no trailing/leading whitespace.
+ */
+function trimString(input) {
+    if (input == null)
+        return undefined;
+    const trimmed = String(input).trim();
+    return trimmed || undefined;
+}
 function normalizePath(input) {
     if (!input)
         return undefined;
@@ -635,20 +802,105 @@ function getAndroidVersionFromAppGradle() {
     }
 }
 /**
- * Creates a zip file of the current directory (NativeScript project)
+ * Resolve workspace context for a command.
+ *
+ * When running from workspace root:
+ * - If --project is provided, use that project
+ * - Otherwise, discover NativeScript apps and prompt for selection
+ *
+ * When running from within an app directory:
+ * - Use the current directory's context
+ *
+ * @param projectArg - Optional project name from --project flag
+ * @param spinner - Optional spinner to stop before prompting
  */
-async function zipProject(projectName, isUpdate = false) {
+async function resolveWorkspaceContext(projectArg, spinner) {
+    const originalCwd = process.cwd();
+    // If we're at workspace root (has nx.json but no nativescript.config)
+    if (isAtWorkspaceRoot()) {
+        // If --project was provided, use it
+        if (projectArg) {
+            const ctx = getWorkspaceContextForApp(projectArg);
+            if (!ctx) {
+                const apps = discoverNativeScriptApps();
+                const appNames = apps.map((a) => a.name).join(', ');
+                throw new Error(`Project '${projectArg}' not found in workspace. Available NativeScript apps: ${appNames || 'none'}`);
+            }
+            // Change to the app directory for subsequent operations
+            process.chdir(ctx.appRoot);
+            return { workspaceContext: ctx, originalCwd };
+        }
+        // Discover NativeScript apps and prompt for selection
+        const apps = discoverNativeScriptApps();
+        if (apps.length === 0) {
+            throw new Error('No NativeScript apps found in this workspace. ' +
+                'Run this command from within a NativeScript app directory, or ensure your apps have nativescript.config.ts files.');
+        }
+        if (apps.length === 1) {
+            // Only one app, use it automatically
+            if (spinner)
+                spinner.stop();
+            console.log(`Found NativeScript app: ${apps[0].name} (${apps[0].path})`);
+            const ctx = getWorkspaceContextForApp(apps[0].name);
+            if (ctx) {
+                process.chdir(ctx.appRoot);
+                return { workspaceContext: ctx, originalCwd };
+            }
+        }
+        // Multiple apps - stop spinner before prompting
+        if (spinner)
+            spinner.stop();
+        // Multiple apps - prompt for selection
+        const { selectedApp } = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'selectedApp',
+                message: 'Select a NativeScript app:',
+                choices: apps.map((app) => ({
+                    name: `${app.name} (${app.path})`,
+                    value: app.name,
+                })),
+                pageSize: 15, // Show more items to avoid scroll issues
+                loop: false, // Don't loop back to start when at end
+            },
+        ]);
+        const ctx = getWorkspaceContextForApp(selectedApp);
+        if (!ctx) {
+            throw new Error(`Failed to get context for selected app: ${selectedApp}`);
+        }
+        process.chdir(ctx.appRoot);
+        return { workspaceContext: ctx, originalCwd };
+    }
+    // Not at workspace root - use current directory
+    const ctx = detectWorkspaceContext();
+    return { workspaceContext: ctx, originalCwd };
+}
+/**
+ * Creates a zip file of the current directory (NativeScript project).
+ * For Nx workspaces, this includes the app, dependent libs, and workspace config files.
+ * For standalone projects, this zips the current directory.
+ */
+async function zipProject(projectName, workspaceCtx, isUpdate = false, verbose = false) {
+    if (workspaceCtx.type === 'nx') {
+        return zipWorkspaceProject(projectName, workspaceCtx, isUpdate, verbose);
+    }
+    else {
+        return zipStandaloneProject(projectName, workspaceCtx, isUpdate);
+    }
+}
+/**
+ * Zip a standalone NativeScript project (original behavior)
+ */
+async function zipStandaloneProject(projectName, workspaceCtx, isUpdate = false) {
     return new Promise((resolve, reject) => {
         const outputPath = path.join(process.cwd(), `${projectName}.zip`);
         const output = fs.createWriteStream(outputPath);
         const archive = archiver('zip', {
-            zlib: { level: 9 }, // Compression level
+            zlib: { level: 9 },
         });
-        // Listen for all archive data to be written
         output.on('close', () => {
-            resolve(outputPath);
+            resolve({ zipPath: outputPath, workspaceContext: workspaceCtx });
         });
-        // Listen for warnings and errors
         archive.on('warning', (err) => {
             if (err.code === 'ENOENT') {
                 console.warn('Archive warning:', err);
@@ -660,9 +912,8 @@ async function zipProject(projectName, isUpdate = false) {
         archive.on('error', (err) => {
             reject(err);
         });
-        // Pipe archive data to the file
         archive.pipe(output);
-        // Determine the primary app directory (prefer appPath from NativeScript config)
+        // Determine the primary app directory
         const nsAppPath = getNativeScriptAppPath();
         const nsAppDir = nsAppPath
             ? path.join(process.cwd(), nsAppPath)
@@ -682,18 +933,12 @@ async function zipProject(projectName, isUpdate = false) {
         }
         else {
             console.warn('Warning: app directory not found in the project root');
-            const checked = [nsAppDir, srcDir, appDir].filter(Boolean).join(', ');
-            console.warn(`Checked locations: ${checked}`);
-            console.log('Creating an empty app directory in the zip');
         }
-        // For both builds/updates, include App_Resources and exclude node_modules.
-        // For OTA updates specifically, we also exclude the runtime fingerprint
-        // file, since it reflects the native store binary, not the OTA payload.
         const ignorePatterns = [
-            'node_modules/**', // Always exclude node_modules
-            '*.zip', // Exclude existing zip files
-            'platforms/**', // Exclude platform-specific directories
-            'hooks/**', // Exclude hooks directory
+            'node_modules/**',
+            '*.zip',
+            'platforms/**',
+            'hooks/**',
         ];
         if (isUpdate) {
             ignorePatterns.push('**/assets/norrix.fingerprint.json');
@@ -702,7 +947,217 @@ async function zipProject(projectName, isUpdate = false) {
             cwd: process.cwd(),
             ignore: ignorePatterns,
         });
-        // Finalize the archive
+        archive.finalize();
+    });
+}
+/**
+ * Zip an Nx workspace project including the app and its dependencies
+ */
+async function zipWorkspaceProject(projectName, workspaceCtx, isUpdate = false, verbose = false) {
+    return new Promise((resolve, reject) => {
+        const outputPath = path.join(workspaceCtx.appRoot, `${projectName}.zip`);
+        const output = fs.createWriteStream(outputPath);
+        const archive = archiver('zip', {
+            zlib: { level: 9 },
+        });
+        output.on('close', () => {
+            resolve({ zipPath: outputPath, workspaceContext: workspaceCtx });
+        });
+        archive.on('warning', (err) => {
+            if (err.code === 'ENOENT') {
+                if (verbose)
+                    console.warn('Archive warning:', err);
+            }
+            else {
+                reject(err);
+            }
+        });
+        archive.on('error', (err) => {
+            reject(err);
+        });
+        archive.pipe(output);
+        logWorkspaceContext(workspaceCtx, verbose);
+        // Get workspace dependencies using Nx CLI (preferred) with fallback supplementation
+        let deps;
+        if (workspaceCtx.projectName) {
+            deps = getNxProjectDependencies(workspaceCtx.projectName, workspaceCtx.workspaceRoot, verbose, workspaceCtx.appRoot // Pass appRoot for webpack alias detection
+            );
+        }
+        // Always supplement with fallback detection to catch anything Nx might miss
+        // (e.g., dynamic imports, SCSS dependencies, transitive deps from source scanning)
+        const fallbackDeps = getWorkspaceDependenciesFallback(workspaceCtx, verbose);
+        if (deps) {
+            // Merge fallback libs into Nx-detected libs
+            const mergedLibPaths = new Set(deps.libPaths);
+            for (const libPath of fallbackDeps.libPaths) {
+                if (!mergedLibPaths.has(libPath)) {
+                    mergedLibPaths.add(libPath);
+                    if (verbose) {
+                        console.log(`[workspace] Fallback added additional lib: ${libPath}`);
+                    }
+                }
+            }
+            deps.libPaths = Array.from(mergedLibPaths);
+            // Also merge local file deps
+            const mergedLocalFileDeps = new Set(deps.localFileDeps);
+            for (const dep of fallbackDeps.localFileDeps) {
+                mergedLocalFileDeps.add(dep);
+            }
+            deps.localFileDeps = Array.from(mergedLocalFileDeps);
+        }
+        else {
+            if (verbose) {
+                console.log('[workspace] Using fallback dependency detection (Nx CLI not available)');
+            }
+            deps = fallbackDeps;
+        }
+        // Create manifest for CI
+        const manifest = createWorkspaceManifest(workspaceCtx, deps);
+        archive.append(JSON.stringify(manifest, null, 2), {
+            name: '.norrix/manifest.json',
+        });
+        // Base ignore patterns for the entire workspace
+        const ignorePatterns = [
+            '**/node_modules/**',
+            '**/*.zip',
+            '**/platforms/**',
+            '**/dist/**',
+            '**/.git/**',
+            '**/hooks/**',
+            // Exclude other apps (not the current one)
+            'apps/**',
+        ];
+        if (isUpdate) {
+            ignorePatterns.push('**/assets/norrix.fingerprint.json');
+        }
+        // 1. Add the app itself at its relative workspace path
+        console.log(`Adding app: ${workspaceCtx.relativeAppPath}`);
+        archive.directory(workspaceCtx.appRoot, workspaceCtx.relativeAppPath, (entry) => {
+            // Filter out node_modules, platforms, etc.
+            if (entry.name.includes('node_modules') ||
+                entry.name.includes('platforms') ||
+                entry.name.endsWith('.zip')) {
+                return false;
+            }
+            if (isUpdate && entry.name.includes('norrix.fingerprint.json')) {
+                return false;
+            }
+            return entry;
+        });
+        // 2. Add dependent libs
+        if (deps.libPaths.length > 0) {
+            console.log(`Adding ${deps.libPaths.length} library dependencies`);
+            for (const libPath of deps.libPaths) {
+                const absoluteLibPath = path.join(workspaceCtx.workspaceRoot, libPath);
+                if (fs.existsSync(absoluteLibPath)) {
+                    if (verbose) {
+                        console.log(`  - ${libPath}`);
+                    }
+                    archive.directory(absoluteLibPath, libPath, (entry) => {
+                        if (entry.name.includes('node_modules')) {
+                            return false;
+                        }
+                        return entry;
+                    });
+                }
+            }
+        }
+        // 3. Add root config files
+        console.log('Adding workspace root configuration files');
+        for (const configFile of deps.rootConfigs) {
+            const configPath = path.join(workspaceCtx.workspaceRoot, configFile);
+            if (fs.existsSync(configPath)) {
+                if (verbose) {
+                    console.log(`  - ${configFile}`);
+                }
+                archive.file(configPath, { name: configFile });
+            }
+        }
+        // 4. Add tools directory if it exists and is referenced
+        for (const toolPath of deps.toolPaths) {
+            const absoluteToolPath = path.join(workspaceCtx.workspaceRoot, toolPath);
+            if (fs.existsSync(absoluteToolPath) && fs.statSync(absoluteToolPath).isDirectory()) {
+                console.log(`Adding tools: ${toolPath}`);
+                archive.directory(absoluteToolPath, toolPath, (entry) => {
+                    if (entry.name.includes('node_modules')) {
+                        return false;
+                    }
+                    return entry;
+                });
+            }
+        }
+        // 5. Add asset paths if they exist
+        for (const assetPath of deps.assetPaths) {
+            const absoluteAssetPath = path.join(workspaceCtx.workspaceRoot, assetPath);
+            if (fs.existsSync(absoluteAssetPath) && fs.statSync(absoluteAssetPath).isDirectory()) {
+                if (verbose) {
+                    console.log(`Adding assets: ${assetPath}`);
+                }
+                archive.directory(absoluteAssetPath, assetPath);
+            }
+        }
+        // 6. Add local file dependencies (file: protocol paths from package.json)
+        // Skip any that are already covered by libPaths to avoid duplicate entries
+        if (deps.localFileDeps && deps.localFileDeps.length > 0) {
+            const addedDirs = new Set();
+            // Filter out local deps that are subdirectories of already-added libs
+            const filteredLocalDeps = deps.localFileDeps.filter(localDep => {
+                // Check if this local dep is inside any of the lib paths
+                for (const libPath of deps.libPaths) {
+                    if (localDep.startsWith(libPath + '/') || localDep === libPath) {
+                        if (verbose) {
+                            console.log(`  - ${localDep} (skipped, covered by ${libPath})`);
+                        }
+                        return false;
+                    }
+                }
+                return true;
+            });
+            if (filteredLocalDeps.length > 0) {
+                console.log(`Adding ${filteredLocalDeps.length} local file dependencies`);
+            }
+            for (const localDep of filteredLocalDeps) {
+                const absoluteLocalPath = path.join(workspaceCtx.workspaceRoot, localDep);
+                if (fs.existsSync(absoluteLocalPath)) {
+                    const stat = fs.statSync(absoluteLocalPath);
+                    if (stat.isFile()) {
+                        // For files, ensure the parent directory structure is maintained
+                        if (verbose) {
+                            console.log(`  - ${localDep} (file)`);
+                        }
+                        archive.file(absoluteLocalPath, { name: localDep });
+                        // Also add the directory if it hasn't been added yet (for other potential files)
+                        const parentDir = path.dirname(localDep);
+                        if (parentDir && parentDir !== '.' && !addedDirs.has(parentDir)) {
+                            // We just add the file, not the whole directory
+                        }
+                    }
+                    else if (stat.isDirectory()) {
+                        // Skip if this directory or a parent is already in libPaths
+                        const alreadyCovered = deps.libPaths.some(libPath => localDep.startsWith(libPath + '/') || libPath.startsWith(localDep + '/'));
+                        if (alreadyCovered) {
+                            if (verbose) {
+                                console.log(`  - ${localDep} (skipped, overlaps with libPaths)`);
+                            }
+                            continue;
+                        }
+                        if (verbose) {
+                            console.log(`  - ${localDep} (directory)`);
+                        }
+                        archive.directory(absoluteLocalPath, localDep, (entry) => {
+                            if (entry.name.includes('node_modules')) {
+                                return false;
+                            }
+                            return entry;
+                        });
+                        addedDirs.add(localDep);
+                    }
+                }
+                else if (verbose) {
+                    console.log(`  - ${localDep} (not found, skipping)`);
+                }
+            }
+        }
         archive.finalize();
     });
 }
@@ -710,16 +1165,50 @@ async function zipProject(projectName, isUpdate = false) {
  * Build command implementation
  * Uploads project to S3 and triggers build via the Next.js API gateway -> WarpBuild
  */
-export async function build(cliPlatformArg, cliConfigurationArg, cliDistributionArg, verbose = false) {
+export async function build(cliPlatformArg, cliConfigurationArg, cliDistributionArg, verbose = false, options // string for backwards compatibility with old projectArg
+) {
+    // Normalize options - support both new object and legacy string projectArg
+    const opts = typeof options === 'string' ? { project: options } : (options || {});
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: opts.org,
+            nonInteractive: opts.nonInteractive,
+            requireSelection: true,
+            verbose,
+            promptMessage: 'Select organization for this build:',
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        if (verbose && error?.response) {
+            console.error('Axios response status:', error.response.status);
+            console.error('Axios response data:', error.response.data);
+        }
+        return;
+    }
     let spinner;
+    let originalCwd;
     try {
         spinner = ora('Preparing app for building...');
         spinner.start();
+        // 0. Resolve workspace context (handles --project and prompting)
+        const resolved = await resolveWorkspaceContext(opts.project, spinner);
+        originalCwd = resolved.originalCwd;
+        const workspaceCtx = resolved.workspaceContext;
+        // Restart spinner after potential prompts
+        if (!spinner.isSpinning) {
+            spinner.start('Preparing app for building...');
+        }
+        // Load Norrix config file if present
+        const norrixConfig = await loadNorrixConfig(process.cwd());
+        if (workspaceCtx.type === 'nx' && verbose) {
+            logWorkspaceContext(workspaceCtx, verbose);
+        }
         // 1. Get project info
         const projectName = await getProjectName();
-        // 2. Determine platform (CLI arg preferred, otherwise prompt)
-        let platform = (cliPlatformArg || '').toLowerCase();
+        // 2. Determine platform (CLI arg preferred, then config, otherwise prompt)
+        let platform = (cliPlatformArg || norrixConfig.defaultPlatform || '').toLowerCase();
         const validPlatforms = ['android', 'ios', 'visionos'];
         spinner.stop();
         if (!validPlatforms.includes(platform)) {
@@ -748,6 +1237,31 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             ]);
             configuration = answer.configuration;
         }
+        // 2.2 Determine Nx configuration for workspace builds (CLI arg preferred, then prompt if available)
+        let nxConfiguration = opts.nxConfiguration;
+        if (!nxConfiguration && workspaceCtx.type === 'nx' && !opts.nonInteractive) {
+            const nxConfigs = detectNxBuildConfigurations(workspaceCtx.appRoot);
+            if (nxConfigs && nxConfigs.configurations.length > 0) {
+                const choices = nxConfigs.configurations.map((c) => ({
+                    name: c === nxConfigs.defaultConfiguration ? `${c} (default)` : c,
+                    value: c,
+                }));
+                // Add option to skip/use default
+                choices.unshift({ name: '(none - use defaults)', value: '' });
+                const { chosenNxConfig } = await inquirer.prompt([
+                    {
+                        type: 'list',
+                        name: 'chosenNxConfig',
+                        message: 'Nx build configuration (environment):',
+                        choices,
+                        default: nxConfigs.defaultConfiguration || '',
+                    },
+                ]);
+                nxConfiguration = chosenNxConfig || undefined;
+            }
+        }
+        // Store resolved nxConfiguration back to opts for later use
+        opts.nxConfiguration = nxConfiguration;
         const normalizeIosDistribution = (input) => {
             const v = String(input ?? '')
                 .trim()
@@ -772,14 +1286,20 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             }
             return undefined;
         };
-        // 2.2 iOS distribution type (release only)
+        // 2.2 iOS distribution type (release only): CLI arg > config file > prompt
         let distributionType;
         if (platform === 'ios' && configuration === 'release') {
+            // Try CLI arg first
             distributionType = normalizeIosDistribution(cliDistributionArg);
             if (!distributionType && cliDistributionArg) {
                 throw new Error(`Invalid iOS distribution type '${cliDistributionArg}'. Use 'appstore', 'adhoc', or 'enterprise'.`);
             }
-            if (!distributionType) {
+            // Fall back to config file
+            if (!distributionType && norrixConfig.ios?.distributionType) {
+                distributionType = norrixConfig.ios.distributionType;
+            }
+            // Prompt if still not set (unless non-interactive mode)
+            if (!distributionType && !opts.nonInteractive) {
                 const { distribution } = await inquirer.prompt([
                     {
                         type: 'list',
@@ -795,6 +1315,10 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                 ]);
                 distributionType = distribution;
             }
+            // Default to appstore in non-interactive mode if nothing else provided
+            if (!distributionType) {
+                distributionType = 'appstore';
+            }
         }
         const appleVersionInfo = platform === 'ios' || platform === 'visionos'
             ? getAppleVersionFromInfoPlist(platform)
@@ -865,70 +1389,148 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         if (configuration === 'release') {
             spinner.stop();
             if (platform === 'ios') {
-                const iosAnswers = await inquirer.prompt([
-                    {
-                        type: 'input',
-                        name: 'p12Path',
-                        message: 'Path to iOS .p12 certificate (optional):',
-                        default: '',
-                    },
-                    {
-                        type: 'password',
-                        name: 'p12Password',
-                        message: 'Password for .p12 (if any):',
-                        mask: '*',
-                        default: '',
-                    },
-                    {
-                        type: 'input',
-                        name: 'mobileprovisionPath',
-                        message: 'Path to provisioning profile .mobileprovision (optional):',
-                        default: '',
-                    },
-                    {
-                        type: 'confirm',
-                        name: 'hasAscKey',
-                        message: 'Provide App Store Connect API Key? (optional, for App Store operations)',
-                        default: false,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascApiKeyId',
-                        message: 'ASC API Key ID (optional):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascIssuerId',
-                        message: 'ASC Issuer ID (optional):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascPrivateKeyPath',
-                        message: 'Path to ASC private key .p8 (optional):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascTeamId',
-                        message: 'Apple Developer Team ID (optional, required for API-key provisioning):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                ]);
-                iosCredentials = {
-                    p12Base64: readOptionalFileAsBase64(iosAnswers.p12Path),
-                    p12Password: iosAnswers.p12Password || undefined,
-                    mobileprovisionBase64: readOptionalFileAsBase64(iosAnswers.mobileprovisionPath),
-                    ascApiKeyId: iosAnswers.ascApiKeyId || undefined,
-                    ascIssuerId: iosAnswers.ascIssuerId || undefined,
-                    ascPrivateKey: readOptionalFileAsBase64(iosAnswers.ascPrivateKeyPath),
-                    ascTeamId: iosAnswers.ascTeamId || undefined,
-                };
+                // Resolve values from: CLI flags > config file (trimmed to handle whitespace)
+                const configTeamId = norrixConfig.ios?.teamId;
+                const configP12Path = norrixConfig.ios?.p12Path;
+                const configProfilePath = norrixConfig.ios?.provisioningProfilePath;
+                const configAscKeyId = norrixConfig.ios?.ascApiKeyId;
+                const configAscIssuerId = norrixConfig.ios?.ascIssuerId;
+                const configAscKeyPath = norrixConfig.ios?.ascPrivateKeyPath;
+                const resolvedTeamId = trimString(opts.teamId) || configTeamId;
+                const resolvedP12Path = trimString(opts.p12Path) || configP12Path;
+                const resolvedP12Password = trimString(opts.p12Password);
+                const resolvedProfilePath = trimString(opts.profilePath) || configProfilePath;
+                const resolvedAscKeyId = trimString(opts.ascKeyId) || configAscKeyId;
+                const resolvedAscIssuerId = trimString(opts.ascIssuerId) || configAscIssuerId;
+                const resolvedAscKeyPath = trimString(opts.ascKeyPath) || configAscKeyPath;
+                if (opts.nonInteractive) {
+                    // Non-interactive mode: use CLI flags and config values only
+                    iosCredentials = {
+                        teamId: resolvedTeamId || undefined,
+                        p12Base64: readOptionalFileAsBase64(resolvedP12Path),
+                        p12Password: resolvedP12Password || undefined,
+                        mobileprovisionBase64: readOptionalFileAsBase64(resolvedProfilePath),
+                        ascApiKeyId: resolvedAscKeyId || undefined,
+                        ascIssuerId: resolvedAscIssuerId || undefined,
+                        ascPrivateKey: readOptionalFileAsBase64(resolvedAscKeyPath),
+                    };
+                    if (resolvedTeamId) {
+                        console.log(`Using Apple Team ID: ${resolvedTeamId}`);
+                    }
+                    if (resolvedAscKeyId) {
+                        console.log(`Using ASC API Key: ${resolvedAscKeyId}`);
+                    }
+                }
+                else {
+                    // Interactive mode: prompt for values with CLI/config as defaults
+                    // Flow: Team ID -> ASC Key (recommended) -> If no ASC, then .p12/.mobileprovision
+                    const iosAnswers = await inquirer.prompt([
+                        {
+                            type: 'input',
+                            name: 'teamId',
+                            message: 'Apple Developer Team ID (required for code signing, e.g. "ABC123XYZ"):',
+                            default: resolvedTeamId || '',
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return true; // Allow empty, workflow will try to proceed without it
+                                }
+                                if (/^[A-Z0-9]{10}$/.test(input.trim())) {
+                                    return true;
+                                }
+                                return 'Team ID should be 10 alphanumeric characters (e.g. "ABC123XYZ"). Leave empty to skip.';
+                            },
+                        },
+                        // ASC API Key is the recommended approach - ask first
+                        {
+                            type: 'confirm',
+                            name: 'useAscKey',
+                            message: 'Use App Store Connect API Key for auto-provisioning? (recommended)',
+                            default: Boolean(resolvedAscKeyId) || true,
+                        },
+                        {
+                            type: 'input',
+                            name: 'ascApiKeyId',
+                            message: 'ASC API Key ID:',
+                            default: resolvedAscKeyId || '',
+                            when: (a) => a.useAscKey,
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return 'API Key ID is required when using ASC Key';
+                                }
+                                return true;
+                            },
+                        },
+                        {
+                            type: 'input',
+                            name: 'ascIssuerId',
+                            message: 'ASC Issuer ID:',
+                            default: resolvedAscIssuerId || '',
+                            when: (a) => a.useAscKey,
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return 'Issuer ID is required when using ASC Key';
+                                }
+                                return true;
+                            },
+                        },
+                        {
+                            type: 'input',
+                            name: 'ascPrivateKeyPath',
+                            message: 'Path to ASC private key .p8:',
+                            default: resolvedAscKeyPath || '',
+                            when: (a) => a.useAscKey,
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return 'Path to .p8 key file is required when using ASC Key';
+                                }
+                                return true;
+                            },
+                        },
+                        // Only ask for .p12/.mobileprovision if NOT using ASC Key
+                        {
+                            type: 'input',
+                            name: 'p12Path',
+                            message: 'Path to iOS .p12 certificate (optional):',
+                            default: resolvedP12Path || '',
+                            when: (a) => !a.useAscKey,
+                        },
+                        {
+                            type: 'password',
+                            name: 'p12Password',
+                            message: 'Password for .p12 (if any):',
+                            mask: '*',
+                            default: '',
+                            when: (a) => !a.useAscKey && a.p12Path,
+                        },
+                        {
+                            type: 'input',
+                            name: 'mobileprovisionPath',
+                            message: 'Path to provisioning profile .mobileprovision (optional):',
+                            default: resolvedProfilePath || '',
+                            when: (a) => !a.useAscKey,
+                        },
+                    ]);
+                    // Use resolved teamId from CLI/config, or from prompt
+                    const finalTeamId = trimString(iosAnswers.teamId) || resolvedTeamId;
+                    iosCredentials = {
+                        teamId: finalTeamId || undefined,
+                        p12Base64: readOptionalFileAsBase64(iosAnswers.p12Path),
+                        p12Password: trimString(iosAnswers.p12Password),
+                        mobileprovisionBase64: readOptionalFileAsBase64(iosAnswers.mobileprovisionPath),
+                        ascApiKeyId: trimString(iosAnswers.ascApiKeyId),
+                        ascIssuerId: trimString(iosAnswers.ascIssuerId),
+                        ascPrivateKey: readOptionalFileAsBase64(iosAnswers.ascPrivateKeyPath),
+                        // Track paths for config saving (not sent to API)
+                        _p12Path: trimString(iosAnswers.p12Path),
+                        _mobileprovisionPath: trimString(iosAnswers.mobileprovisionPath),
+                        _ascApiKeyId: trimString(iosAnswers.ascApiKeyId),
+                        _ascIssuerId: trimString(iosAnswers.ascIssuerId),
+                        _ascPrivateKeyPath: trimString(iosAnswers.ascPrivateKeyPath),
+                    };
+                    if (finalTeamId) {
+                        console.log(`Using Apple Team ID: ${finalTeamId}`);
+                    }
+                }
             }
             else if (platform === 'android') {
                 const androidAnswers = await inquirer.prompt([
@@ -974,11 +1576,82 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                 ]);
                 androidCredentials = {
                     keystoreBase64: readOptionalFileAsBase64(androidAnswers.keystorePath),
-                    keystorePassword: androidAnswers.keystorePassword || undefined,
-                    keyAlias: androidAnswers.keyAlias || undefined,
-                    keyPassword: androidAnswers.keyPassword || undefined,
+                    keystorePassword: trimString(androidAnswers.keystorePassword),
+                    keyAlias: trimString(androidAnswers.keyAlias),
+                    keyPassword: trimString(androidAnswers.keyPassword),
                     playServiceAccountJson: readOptionalFileAsBase64(androidAnswers.playJsonPath),
                 };
+                // Track Android paths for config saving
+                androidCredentials._keystorePath = trimString(androidAnswers.keystorePath);
+                androidCredentials._keyAlias = trimString(androidAnswers.keyAlias);
+            }
+            // Offer to save config if no norrix.config.ts exists and we collected useful values
+            const appRoot = process.cwd();
+            if (!hasNorrixConfig(appRoot) && !opts.nonInteractive) {
+                // Collect saveable values
+                const saveableOptions = {
+                    platform: platform,
+                };
+                if (platform === 'ios' && iosCredentials) {
+                    if (iosCredentials.teamId) {
+                        saveableOptions.teamId = iosCredentials.teamId;
+                    }
+                    if (distributionType) {
+                        saveableOptions.distributionType = distributionType;
+                    }
+                    // Don't save actual credential file paths since they may contain secrets
+                    // But save paths that users can re-use
+                    if (iosCredentials._p12Path) {
+                        saveableOptions.p12Path = iosCredentials._p12Path;
+                    }
+                    if (iosCredentials._mobileprovisionPath) {
+                        saveableOptions.provisioningProfilePath = iosCredentials._mobileprovisionPath;
+                    }
+                    // Save ASC API Key details for future builds
+                    if (iosCredentials._ascApiKeyId) {
+                        saveableOptions.ascApiKeyId = iosCredentials._ascApiKeyId;
+                    }
+                    if (iosCredentials._ascIssuerId) {
+                        saveableOptions.ascIssuerId = iosCredentials._ascIssuerId;
+                    }
+                    if (iosCredentials._ascPrivateKeyPath) {
+                        saveableOptions.ascPrivateKeyPath = iosCredentials._ascPrivateKeyPath;
+                    }
+                }
+                if (platform === 'android' && androidCredentials) {
+                    if (androidCredentials._keystorePath) {
+                        saveableOptions.keystorePath = androidCredentials._keystorePath;
+                    }
+                    if (androidCredentials._keyAlias) {
+                        saveableOptions.keyAlias = androidCredentials._keyAlias;
+                    }
+                }
+                // Only offer to save if we have something useful
+                const hasSaveableValues = saveableOptions.teamId ||
+                    saveableOptions.distributionType ||
+                    saveableOptions.p12Path ||
+                    saveableOptions.provisioningProfilePath ||
+                    saveableOptions.keystorePath ||
+                    saveableOptions.ascApiKeyId;
+                if (hasSaveableValues) {
+                    const { shouldSave } = await inquirer.prompt([
+                        {
+                            type: 'confirm',
+                            name: 'shouldSave',
+                            message: 'Save these settings to norrix.config.ts for future builds?',
+                            default: true,
+                        },
+                    ]);
+                    if (shouldSave) {
+                        try {
+                            const savedPath = saveNorrixConfig(appRoot, saveableOptions);
+                            console.log(`✓ Configuration saved to ${path.basename(savedPath)}`);
+                        }
+                        catch (saveError) {
+                            console.warn(`Warning: Could not save config file: ${saveError.message}`);
+                        }
+                    }
+                }
             }
             spinner.start('Creating project archive...');
         }
@@ -990,8 +1663,8 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         });
         writeRuntimeFingerprintFile(projectRoot, fingerprint, platform);
         spinner.start('Creating project archive...');
-        // 3. Zip the project
-        const zipPath = await zipProject(projectName, false);
+        // 3. Zip the project (workspace-aware)
+        const { zipPath, workspaceContext } = await zipProject(projectName, workspaceCtx, false, verbose);
         spinner.text = 'Project archive created';
         // 4. Upload the project zip to S3
         spinner.text = 'Working...';
@@ -1018,6 +1691,17 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         catch {
             inferredAppId = undefined;
         }
+        // Include workspace info for CI to properly navigate the project structure
+        const workspaceInfo = workspaceContext.type === 'nx' ? {
+            workspaceType: workspaceContext.type,
+            appPath: workspaceContext.relativeAppPath,
+            projectName: workspaceContext.projectName,
+        } : undefined;
+        // For standalone projects, use the project option or infer from app ID/package name
+        // This allows env vars to be scoped to specific standalone projects within an org
+        const standaloneProjectName = workspaceContext.type === 'standalone'
+            ? (opts.project || inferredAppId || projectName)
+            : undefined;
         const response = await axios.post(`${API_URL}/build`, {
             projectName,
             appId: inferredAppId,
@@ -1027,10 +1711,18 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             version: version || '',
             buildNumber: buildNumber || '',
             configuration,
+            // Nx configuration (e.g., 'prod', 'stg', 'dev') for monorepo builds
+            ...(opts.nxConfiguration ? { nxConfiguration: opts.nxConfiguration } : {}),
             ...(distributionType ? { distributionType } : {}),
+            // Android package type override (apk or aab) - takes precedence over distributionType
+            ...(opts.androidPackageType ? { androidPackageType: opts.androidPackageType } : {}),
             fingerprint,
             // Provide the relative key (without public/) – the workflow prepends public/
             s3Key: s3KeyRel,
+            // Workspace context for Nx monorepos
+            ...(workspaceInfo ? { workspace: workspaceInfo } : {}),
+            // For standalone projects, include project name for env var scoping
+            ...(standaloneProjectName ? { projectName: standaloneProjectName } : {}),
             // Only include raw credentials if not encrypted
             ...(encryptedSecrets ? { encryptedSecrets } : {}),
             ...(!encryptedSecrets && iosCredentials ? { iosCredentials } : {}),
@@ -1091,8 +1783,21 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                     : 'App Store'}`);
         }
         console.log(`   You can check the status with: norrix build-status ${buildId}`);
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            process.chdir(originalCwd);
+        }
     }
     catch (error) {
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            try {
+                process.chdir(originalCwd);
+            }
+            catch {
+                // Ignore chdir errors during error handling
+            }
+        }
         const apiMessage = (error?.response?.data &&
             (error.response.data.error || error.response.data.message)) ||
             undefined;
@@ -1123,8 +1828,25 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
  * Submit command implementation
  * Submits the built app to app stores via the Next.js API gateway
  */
-export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
+export async function submit(cliPlatformArg, cliTrackArg, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: Boolean(options?.nonInteractive),
+            requireSelection: true,
+            verbose,
+            promptMessage: 'Select organization for this submission:',
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        if (verbose && error?.response) {
+            console.error('Axios response status:', error.response.status);
+            console.error('Axios response data:', error.response.data);
+        }
+        return;
+    }
     const spinner = ora('Preparing app for submission...');
     try {
         spinner.start();
@@ -1383,12 +2105,44 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
  * Update command implementation
  * Publishes over-the-air updates to deployed apps via the Next.js API gateway
  */
-export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
+export async function update(cliPlatformArg, cliVersionArg, verbose = false, options // string for backwards compatibility with old projectArg
+) {
+    // Normalize options - support both new object and legacy string projectArg
+    const opts = typeof options === 'string' ? { project: options } : (options || {});
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: opts.org,
+            nonInteractive: opts.nonInteractive,
+            requireSelection: true,
+            verbose,
+            promptMessage: 'Select organization for this update:',
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        if (verbose && error?.response) {
+            console.error('Axios response status:', error.response.status);
+            console.error('Axios response data:', error.response.data);
+        }
+        return;
+    }
     let spinner;
+    let originalCwd;
     try {
         spinner = ora('Preparing over-the-air update...');
         spinner.start();
+        // 0. Resolve workspace context (handles --project and prompting)
+        const resolved = await resolveWorkspaceContext(opts.project, spinner);
+        originalCwd = resolved.originalCwd;
+        const workspaceCtx = resolved.workspaceContext;
+        // Restart spinner after potential prompts
+        if (!spinner.isSpinning) {
+            spinner.start('Preparing over-the-air update...');
+        }
+        if (workspaceCtx.type === 'nx' && verbose) {
+            logWorkspaceContext(workspaceCtx, verbose);
+        }
         // Normalize and/or ask for platform first (CLI arg takes precedence if valid)
         let platform = (cliPlatformArg || '').toLowerCase();
         const validPlatforms = ['android', 'ios', 'visionos'];
@@ -1405,6 +2159,33 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
             platform = chosenPlatform;
             spinner.start('Preparing over-the-air update...');
         }
+        // Determine Nx configuration for workspace builds (CLI arg preferred, then prompt if available)
+        let nxConfiguration = opts.nxConfiguration;
+        if (!nxConfiguration && workspaceCtx.type === 'nx' && !opts.nonInteractive) {
+            spinner.stop();
+            const nxConfigs = detectNxBuildConfigurations(workspaceCtx.appRoot);
+            if (nxConfigs && nxConfigs.configurations.length > 0) {
+                const choices = nxConfigs.configurations.map((c) => ({
+                    name: c === nxConfigs.defaultConfiguration ? `${c} (default)` : c,
+                    value: c,
+                }));
+                // Add option to skip/use default
+                choices.unshift({ name: '(none - use defaults)', value: '' });
+                const { chosenNxConfig } = await inquirer.prompt([
+                    {
+                        type: 'list',
+                        name: 'chosenNxConfig',
+                        message: 'Nx build configuration (environment):',
+                        choices,
+                        default: nxConfigs.defaultConfiguration || '',
+                    },
+                ]);
+                nxConfiguration = chosenNxConfig || undefined;
+            }
+            spinner.start('Preparing over-the-air update...');
+        }
+        // Store resolved nxConfiguration back to opts for later use
+        opts.nxConfiguration = nxConfiguration;
         // Infer version from native project files (same as build)
         const appleVersionInfo = platform === 'ios' || platform === 'visionos'
             ? getAppleVersionFromInfoPlist(platform)
@@ -1424,27 +2205,45 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         // Ask for app ID and version first
         spinner.stop();
         const cliVersion = (cliVersionArg || '').trim();
-        const baseAnswers = await inquirer.prompt([
-            {
-                type: 'input',
-                name: 'appId',
-                message: 'Enter the App ID to update:',
-                default: inferredAppId || '',
-                validate: (input) => input.length > 0 || 'App ID is required',
-            },
-            {
-                type: 'input',
-                name: 'version',
-                message: inferredVersion
-                    ? `Update version (${inferredVersion}, enter to accept):`
-                    : 'Update version:',
-                default: inferredVersion,
-                when: () => !cliVersion,
-                validate: (input) => input.length > 0 || 'Version is required',
-            },
-        ]);
-        const appId = baseAnswers.appId;
-        const version = (cliVersion || baseAnswers.version);
+        // Resolve appId: CLI flag → inferred → prompt
+        let appId;
+        if (opts.appId) {
+            appId = opts.appId;
+        }
+        else {
+            const { appId: promptedAppId } = await inquirer.prompt([
+                {
+                    type: 'input',
+                    name: 'appId',
+                    message: 'Enter the App ID to update:',
+                    default: inferredAppId || '',
+                    validate: (input) => input.length > 0 || 'App ID is required',
+                },
+            ]);
+            appId = promptedAppId;
+        }
+        // Resolve version: CLI arg → inferred → prompt
+        let version;
+        if (cliVersion) {
+            version = cliVersion;
+        }
+        else if (inferredVersion && opts.nonInteractive) {
+            version = inferredVersion;
+        }
+        else {
+            const { version: promptedVersion } = await inquirer.prompt([
+                {
+                    type: 'input',
+                    name: 'version',
+                    message: inferredVersion
+                        ? `Update version (${inferredVersion}, enter to accept):`
+                        : 'Update version:',
+                    default: inferredVersion,
+                    validate: (input) => input.length > 0 || 'Version is required',
+                },
+            ]);
+            version = promptedVersion;
+        }
         // Ask the server what the next buildNumber would be for this app so we
         // can present a sensible default in the prompt, matching what the API
         // will auto-increment to if left blank.
@@ -1468,38 +2267,51 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
             : platform === 'android'
                 ? androidVersionInfo.buildNumber
                 : undefined;
-        const { buildNumber: promptedBuildNumber, notes } = await inquirer.prompt([
-            {
-                type: 'input',
-                name: 'buildNumber',
-                message: (() => {
-                    if (serverSuggestedBuildNumber) {
-                        return `Update build number (${serverSuggestedBuildNumber}, enter to accept or override; blank to auto increment from server):`;
-                    }
-                    if (localInferredBuildNumber) {
-                        return `Update build number (${localInferredBuildNumber}, enter to auto increment from server):`;
-                    }
-                    return 'Update build number (leave blank to auto increment from server):';
-                })(),
-                default: serverSuggestedBuildNumber || localInferredBuildNumber || '',
-                validate: (input) => {
-                    const val = String(input).trim();
-                    if (!val)
-                        return true; // allow blank -> server will auto-increment
-                    if (!/^\d+$/.test(val)) {
-                        return 'Build number must be a positive integer or blank to auto-increment';
-                    }
-                    return true;
+        // Resolve buildNumber: CLI flag → server suggestion → local inferred → prompt
+        let buildNumber;
+        let notes = '';
+        if (opts.buildNumber) {
+            buildNumber = opts.buildNumber;
+        }
+        else if (opts.nonInteractive) {
+            // In non-interactive mode, use server suggestion or leave undefined for auto-increment
+            buildNumber = serverSuggestedBuildNumber || localInferredBuildNumber || undefined;
+        }
+        else {
+            const buildPromptAnswers = await inquirer.prompt([
+                {
+                    type: 'input',
+                    name: 'buildNumber',
+                    message: (() => {
+                        if (serverSuggestedBuildNumber) {
+                            return `Update build number (${serverSuggestedBuildNumber}, enter to accept or override; blank to auto increment from server):`;
+                        }
+                        if (localInferredBuildNumber) {
+                            return `Update build number (${localInferredBuildNumber}, enter to auto increment from server):`;
+                        }
+                        return 'Update build number (leave blank to auto increment from server):';
+                    })(),
+                    default: serverSuggestedBuildNumber || localInferredBuildNumber || '',
+                    validate: (input) => {
+                        const val = String(input).trim();
+                        if (!val)
+                            return true; // allow blank -> server will auto-increment
+                        if (!/^\d+$/.test(val)) {
+                            return 'Build number must be a positive integer or blank to auto-increment';
+                        }
+                        return true;
+                    },
                 },
-            },
-            {
-                type: 'input',
-                name: 'notes',
-                message: 'Release notes (optional):',
-                default: '',
-            },
-        ]);
-        const buildNumber = String(promptedBuildNumber || '').trim() || undefined;
+                {
+                    type: 'input',
+                    name: 'notes',
+                    message: 'Release notes (optional):',
+                    default: '',
+                },
+            ]);
+            buildNumber = String(buildPromptAnswers.buildNumber || '').trim() || undefined;
+            notes = buildPromptAnswers.notes || '';
+        }
         // Check the app directory structure before packaging
         const srcAppDir = path.join(process.cwd(), 'src', 'app');
         const appDir = path.join(process.cwd(), 'app');
@@ -1576,9 +2388,9 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         // fingerprint JSON under the app source tree is the
         // single source of truth for OTA compatibility.
         spinner.start('Packaging for over-the-air update...');
-        // Create the update bundle - pass true to include node_modules for updates
+        // Create the update bundle (workspace-aware) - pass true to include node_modules for updates
         const projectName = await getProjectName();
-        const zipPath = await zipProject(projectName, true);
+        const { zipPath, workspaceContext } = await zipProject(projectName, workspaceCtx, true, verbose);
         spinner.text = 'Uploading update to Norrix cloud storage...';
         const fileBuffer = fs.readFileSync(zipPath);
         const updateFolder = `update-${Date.now()}`;
@@ -1586,6 +2398,17 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         const s3KeyRel = `updates/${updateFolder}/${appId}-${safeVersion}.zip`;
         await putObjectToStorage(`public/${s3KeyRel}`, fileBuffer);
         spinner.text = 'Upload complete. Starting update...';
+        // Include workspace info for CI to properly navigate the project structure
+        const workspaceInfo = workspaceContext.type === 'nx' ? {
+            workspaceType: workspaceContext.type,
+            appPath: workspaceContext.relativeAppPath,
+            projectName: workspaceContext.projectName,
+        } : undefined;
+        // For standalone projects, use the project option or infer from app ID
+        // This allows env vars to be scoped to specific standalone projects within an org
+        const standaloneProjectName = workspaceContext.type === 'standalone'
+            ? (opts.project || appId)
+            : undefined;
         const response = await axios.post(`${API_URL}/update`, {
             appId,
             platform,
@@ -1593,8 +2416,14 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
             buildNumber: buildNumber || '',
             releaseNotes: notes,
             fingerprint,
+            // Nx configuration (e.g., 'prod', 'stg', 'dev') for monorepo builds
+            ...(opts.nxConfiguration ? { nxConfiguration: opts.nxConfiguration } : {}),
             // Provide the relative key (without public/). Consumers will prepend public/
             s3Key: s3KeyRel,
+            // Workspace context for Nx monorepos
+            ...(workspaceInfo ? { workspace: workspaceInfo } : {}),
+            // For standalone projects, include project name for env var scoping
+            ...(standaloneProjectName ? { projectName: standaloneProjectName } : {}),
         }, {
             headers: {
                 'Content-Type': 'application/json',
@@ -1644,8 +2473,21 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
         }
         console.log(formatVersionBuildLine(recordedUpdateVersion, recordedUpdateBuildNumber));
         console.log(`   You can check the status with: norrix update-status ${updateId}`);
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            process.chdir(originalCwd);
+        }
     }
     catch (error) {
+        // Restore original cwd if we changed it
+        if (originalCwd && process.cwd() !== originalCwd) {
+            try {
+                process.chdir(originalCwd);
+            }
+            catch {
+                // Ignore chdir errors during error handling
+            }
+        }
         const apiMessage = (error?.response?.data &&
             (error.response.data.error || error.response.data.message)) ||
             undefined;
@@ -1673,8 +2515,20 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false) {
  * Build Status command implementation
  * Checks the status of a build via the Next.js API gateway
  */
-export async function buildStatus(buildId, verbose = false) {
+export async function buildStatus(buildId, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: true,
+            requireSelection: false,
+            verbose,
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        return;
+    }
     try {
         const spinner = ora(`Checking status of build ${buildId}...`).start();
         const response = await axios.get(`${API_URL}/build/${buildId}`, {
@@ -1711,8 +2565,20 @@ export async function buildStatus(buildId, verbose = false) {
  * Submit Status command implementation
  * Checks the status of a submission via the Next.js API gateway
  */
-export async function submitStatus(submitId, verbose = false) {
+export async function submitStatus(submitId, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: true,
+            requireSelection: false,
+            verbose,
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        return;
+    }
     try {
         const spinner = ora(`Checking status of submission ${submitId}...`).start();
         const response = await axios.get(`${API_URL}/submit/${submitId}`, {
@@ -1745,8 +2611,20 @@ export async function submitStatus(submitId, verbose = false) {
  * Update Status command implementation
  * Checks the status of an update via the Next.js API gateway
  */
-export async function updateStatus(updateId, verbose = false) {
+export async function updateStatus(updateId, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: true,
+            requireSelection: false,
+            verbose,
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        return;
+    }
     try {
         const spinner = ora(`Checking status of update ${updateId}...`).start();
         const response = await axios.get(`${API_URL}/update/${updateId}`, {
@@ -1991,4 +2869,310 @@ export async function billingPortal(verbose = false) {
         }
     }
 }
+function normalizeVisibilityType(input) {
+    if (!input)
+        return 'secret';
+    if (input === 'plaintext' || input === 'secret')
+        return input;
+    console.error('Error: --visibility must be either "plaintext" or "secret"');
+    process.exit(1);
+}
+/**
+ * Set an environment variable for build-time injection
+ */
+export async function envSet(name, value, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        const visibilityType = normalizeVisibilityType(options.visibilityType);
+        // Validate secret name (env var format)
+        if (!/^[A-Z_][A-Z0-9_]*$/i.test(name)) {
+            console.error('Error: Name must be a valid environment variable name (alphanumeric and underscores, cannot start with a number)');
+            process.exit(1);
+        }
+        spinner = ora(`Setting env var "${name}"...`).start();
+        const payload = {
+            type: 'variable',
+            name,
+            visibilityType,
+            project: options.project,
+        };
+        if (visibilityType === 'plaintext') {
+            payload.value = value;
+        }
+        else {
+            Object.assign(payload, encryptSecretValue(value));
+        }
+        const res = await axios.post(`${API_URL}/env`, payload, {
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env var "${name}" set successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to set env var: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-set) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Upload an environment file for build-time injection
+ */
+export async function envSetFile(name, filePath, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        const visibilityType = normalizeVisibilityType(options.visibilityType);
+        const resolvedPath = normalizePath(filePath);
+        if (!resolvedPath || !fs.existsSync(resolvedPath)) {
+            console.error(`Error: File not found: ${filePath}`);
+            process.exit(1);
+        }
+        spinner = ora(`Uploading env file "${name}"...`).start();
+        // Read and encode file content
+        const fileContent = fs.readFileSync(resolvedPath);
+        const base64Content = fileContent.toString('base64');
+        const payload = {
+            type: 'file',
+            name,
+            visibilityType,
+            destPath: options.destPath || name,
+            project: options.project,
+        };
+        if (visibilityType === 'plaintext') {
+            payload.value = base64Content;
+        }
+        else {
+            Object.assign(payload, encryptSecretValue(base64Content));
+        }
+        const res = await axios.post(`${API_URL}/env`, payload, {
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env file "${name}" uploaded successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to upload env file: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-set-file) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * List all environment variables/files for a project
+ */
+export async function envList(verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        spinner = ora('Fetching env vars...').start();
+        const params = new URLSearchParams();
+        if (options.project) {
+            params.set('project', options.project);
+        }
+        const res = await axios.get(`${API_URL}/env?${params.toString()}`, {
+            headers: await getAuthHeaders(),
+        });
+        spinner.stop();
+        const envs = res.data?.envs || [];
+        const projectName = options.project || res.data?.project || 'default';
+        if (envs.length === 0) {
+            console.log(`\nNo environment variables found for project: ${projectName}`);
+            console.log('\nTo add env vars/files, use:');
+            console.log('  norrix env set <name> <value>');
+            console.log('  norrix env set-file <name> <path>');
+            return;
+        }
+        console.log(`\nEnvironment variables for project: ${projectName}\n`);
+        // Separate variables and files
+        const variables = envs.filter((e) => e.type === 'variable');
+        const files = envs.filter((e) => e.type === 'file');
+        if (variables.length > 0) {
+            console.log('Variables:');
+            for (const variable of variables) {
+                const dateStr = variable.updatedAt
+                    ? `set ${new Date(variable.updatedAt).toLocaleDateString()}`
+                    : '';
+                const visibility = variable.visibilityType || variable.visibility || 'secret';
+                console.log(`  • ${variable.name} (${visibility}${dateStr ? `, ${dateStr}` : ''})`);
+            }
+        }
+        if (files.length > 0) {
+            if (variables.length > 0)
+                console.log('');
+            console.log('Files:');
+            for (const file of files) {
+                const dateStr = file.updatedAt
+                    ? `set ${new Date(file.updatedAt).toLocaleDateString()}`
+                    : '';
+                const visibility = file.visibilityType || file.visibility || 'secret';
+                const destPath = file.destPath || file.name;
+                console.log(`  • ${file.name} → ${destPath} (${visibility}${dateStr ? `, ${dateStr}` : ''})`);
+            }
+        }
+        console.log('');
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to list env vars: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-list) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Delete an environment variable
+ */
+export async function envDelete(name, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        spinner = ora(`Deleting env var "${name}"...`).start();
+        const res = await axios.delete(`${API_URL}/env`, {
+            data: {
+                type: 'variable',
+                name,
+                project: options.project,
+            },
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env var "${name}" deleted successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to delete env var: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-delete) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Delete an environment file
+ */
+export async function envDeleteFile(name, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        spinner = ora(`Deleting env file "${name}"...`).start();
+        const res = await axios.delete(`${API_URL}/env`, {
+            data: {
+                type: 'file',
+                name,
+                project: options.project,
+            },
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env file "${name}" deleted successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to delete env file: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-delete-file) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Encrypt a secret value using the Norrix public key (envelope encryption)
+ */
+function encryptSecretValue(value) {
+    const publicKeyPem = process.env.NORRIX_BUILD_PUBLIC_KEY;
+    if (!publicKeyPem) {
+        // If no public key is configured, send value in a format the server can handle
+        // The server will encrypt at rest using its own key
+        return {
+            encryptedValue: Buffer.from(value, 'utf8').toString('base64'),
+            encryptedKey: '',
+            iv: '',
+            tag: '',
+        };
+    }
+    const nodeCrypto = crypto;
+    const aesKey = nodeCrypto.randomBytes(32); // AES-256
+    const iv = nodeCrypto.randomBytes(12); // GCM nonce
+    const cipher = nodeCrypto.createCipheriv('aes-256-gcm', aesKey, iv);
+    const plaintext = Buffer.from(value, 'utf8');
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const encryptedKey = nodeCrypto.publicEncrypt({ key: publicKeyPem, oaepHash: 'sha256' }, aesKey);
+    return {
+        encryptedValue: ciphertext.toString('base64'),
+        encryptedKey: encryptedKey.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: tag.toString('base64'),
+    };
+}
 //# sourceMappingURL=commands.js.map