@norrix/cli 0.0.25 → 0.0.27

package/dist/lib/commands.js

@@ -10,15 +10,17 @@ import archiver from 'archiver';
 import { configureAmplify, loadCliEnvFiles } from './amplify-config.js';
 import { computeFingerprint, writeRuntimeFingerprintFile } from './fingerprinting.js';
 import { loadNorrixConfig, hasNorrixConfig, saveNorrixConfig } from './config.js';
-import { detectWorkspaceContext, getNxProjectDependencies, getWorkspaceDependenciesFallback, createWorkspaceManifest, logWorkspaceContext, isAtWorkspaceRoot, discoverNativeScriptApps, getWorkspaceContextForApp, } from './workspace.js';
+import { detectWorkspaceContext, getNxProjectDependencies, getWorkspaceDependenciesFallback, createWorkspaceManifest, logWorkspaceContext, isAtWorkspaceRoot, discoverNativeScriptApps, getWorkspaceContextForApp, detectNxBuildConfigurations, } from './workspace.js';
 import { signIn as amplifySignIn, signOut as amplifySignOut, getCurrentUser, fetchAuthSession, } from 'aws-amplify/auth';
 import crypto from 'crypto';
 import { Amplify } from 'aws-amplify';
 import { PROD_DEFAULTS } from './prod-defaults.js';
 import { DEV_DEFAULTS } from './dev-defaults.js';
+import { clearSelectedOrgId, getSelectedOrgId, setSelectedOrgId } from './cli-settings.js';
 let CURRENT_ENV = 'prod';
 let CURRENT_DEFAULTS = PROD_DEFAULTS;
 let API_URL = PROD_DEFAULTS.apiUrl;
+let CURRENT_ORG_ID;
 let IS_INITIALIZED = false;
 function defaultsForEnv(env) {
     return env === 'dev' ? DEV_DEFAULTS : PROD_DEFAULTS;
@@ -40,6 +42,10 @@ export function initNorrixCli(env = 'prod') {
     CURRENT_DEFAULTS = defaultsForEnv(env);
     configureAmplify(env);
     API_URL = process.env.NORRIX_API_URL || CURRENT_DEFAULTS.apiUrl;
+    // Load persisted org selection for this env + API URL profile (if any).
+    // Allow per-invocation override via NORRIX_ORG_ID env var.
+    const envOrg = (process.env.NORRIX_ORG_ID ?? '').toString().trim();
+    CURRENT_ORG_ID = envOrg || getSelectedOrgId(env, API_URL);
     IS_INITIALIZED = true;
 }
 function ensureInitialized() {
@@ -48,21 +54,196 @@ function ensureInitialized() {
     }
 }
 /**
- * Return Authorization header containing the current Cognito ID token (if signed in).
+ * Check if an API key is configured for authentication.
+ * API key takes precedence over Cognito session for CI/enterprise workflows.
  */
-async function getAuthHeaders() {
+function getApiKey() {
+    const key = process.env.NORRIX_API_KEY?.trim();
+    if (key && key.startsWith('nrx_')) {
+        return key;
+    }
+    return undefined;
+}
+/**
+ * Return Authorization headers for API requests.
+ *
+ * Authentication precedence:
+ * 1. NORRIX_API_KEY environment variable (for CI/enterprise workflows)
+ * 2. Cognito session (interactive login via `norrix login`)
+ *
+ * When using an API key, the organization is determined by the key itself,
+ * so X-Norrix-Org-Id header is not needed.
+ */
+async function getAuthHeaders(options) {
     ensureInitialized();
+    const headers = {};
+    // Check for API key first (takes precedence for CI workflows)
+    const apiKey = getApiKey();
+    if (apiKey) {
+        headers['X-Api-Key'] = apiKey;
+        // API keys are org-scoped, so we don't need to send org header
+        return headers;
+    }
+    // Fall back to Cognito session
     try {
         const session = await fetchAuthSession();
         const idToken = session.tokens?.idToken?.toString();
         if (idToken) {
-            return { Authorization: `Bearer ${idToken}` };
+            headers.Authorization = `Bearer ${idToken}`;
         }
     }
     catch (_) {
         /* not signed in */
     }
-    return {};
+    if (options?.includeOrg !== false && CURRENT_ORG_ID) {
+        headers['X-Norrix-Org-Id'] = CURRENT_ORG_ID;
+    }
+    return headers;
+}
+function setCurrentOrgId(orgId) {
+    const v = (orgId ?? '').toString().trim();
+    CURRENT_ORG_ID = v ? v : undefined;
+}
+async function fetchOrganizations(verbose = false) {
+    ensureInitialized();
+    try {
+        const res = await axios.get(`${API_URL}/orgs`, {
+            headers: await getAuthHeaders({ includeOrg: false }),
+        });
+        const organizations = Array.isArray(res.data?.organizations)
+            ? res.data.organizations
+            : [];
+        const selectedOrganizationId = res.data?.selectedOrganizationId
+            ? String(res.data.selectedOrganizationId)
+            : undefined;
+        return { organizations, selectedOrganizationId };
+    }
+    catch (err) {
+        if (verbose) {
+            console.error('--- Verbose error details (orgs fetch) ---');
+            console.error(err);
+            if (err?.response) {
+                console.error('Axios response status:', err.response.status);
+                console.error('Axios response data:', err.response.data);
+            }
+        }
+        throw err;
+    }
+}
+async function ensureOrgSelected(params) {
+    ensureInitialized();
+    const explicit = (params.orgIdArg ?? process.env.NORRIX_ORG_ID ?? '')
+        .toString()
+        .trim();
+    if (explicit) {
+        setCurrentOrgId(explicit);
+        return explicit;
+    }
+    const stored = getSelectedOrgId(CURRENT_ENV, API_URL);
+    if (!params.requireSelection) {
+        if (stored)
+            setCurrentOrgId(stored);
+        return stored;
+    }
+    // Validate stored selection (and discover orgs for prompting).
+    const { organizations } = await fetchOrganizations(Boolean(params.verbose));
+    const normalizedOrgs = organizations.filter((o) => o && o.id);
+    if (stored && normalizedOrgs.some((o) => o.id === stored)) {
+        setCurrentOrgId(stored);
+        return stored;
+    }
+    if (stored) {
+        clearSelectedOrgId(CURRENT_ENV, API_URL);
+    }
+    if (normalizedOrgs.length === 1) {
+        const only = normalizedOrgs[0];
+        setSelectedOrgId(CURRENT_ENV, API_URL, only.id);
+        setCurrentOrgId(only.id);
+        return only.id;
+    }
+    if (params.nonInteractive) {
+        throw new Error('No organization selected. Use --org <orgId> or run `norrix orgs select`.');
+    }
+    if (!normalizedOrgs.length) {
+        throw new Error('No organizations found for this user.');
+    }
+    const choices = normalizedOrgs.map((o) => {
+        const suffix = o.id.length > 8 ? o.id.slice(-8) : o.id;
+        return {
+            name: `${o.name} (${o.role}) • …${suffix}`,
+            value: o.id,
+        };
+    });
+    const { orgId } = await inquirer.prompt([
+        {
+            type: 'list',
+            name: 'orgId',
+            message: params.promptMessage || 'Select organization:',
+            choices,
+        },
+    ]);
+    const selected = String(orgId || '').trim();
+    if (!selected) {
+        throw new Error('Organization selection cancelled.');
+    }
+    setSelectedOrgId(CURRENT_ENV, API_URL, selected);
+    setCurrentOrgId(selected);
+    return selected;
+}
+export async function orgsList(verbose = false) {
+    ensureInitialized();
+    try {
+        const { organizations, selectedOrganizationId } = await fetchOrganizations(verbose);
+        if (!organizations.length) {
+            console.log('No organizations found.');
+            return;
+        }
+        console.log('Organizations:');
+        for (const o of organizations) {
+            const selectedMark = selectedOrganizationId && o.id === selectedOrganizationId ? ' (selected)' : '';
+            console.log(`- ${o.name} [${o.role}] ${o.id}${selectedMark}`);
+        }
+    }
+    catch (err) {
+        ora().fail(`Failed to list organizations: ${err?.message || err}`);
+        if (verbose && err?.response) {
+            console.error('Axios response status:', err.response.status);
+            console.error('Axios response data:', err.response.data);
+        }
+    }
+}
+export async function orgsSelect(verbose = false) {
+    ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            requireSelection: true,
+            nonInteractive: false,
+            verbose,
+            promptMessage: 'Select default organization for this environment:',
+        });
+        if (CURRENT_ORG_ID) {
+            console.log(`✅ Selected organization: ${CURRENT_ORG_ID}`);
+        }
+    }
+    catch (err) {
+        ora().fail(`Failed to select organization: ${err?.message || err}`);
+        if (verbose && err?.response) {
+            console.error('Axios response status:', err.response.status);
+            console.error('Axios response data:', err.response.data);
+        }
+    }
+}
+export async function orgsCurrent() {
+    ensureInitialized();
+    const envOrg = (process.env.NORRIX_ORG_ID ?? '').toString().trim();
+    const stored = getSelectedOrgId(CURRENT_ENV, API_URL);
+    const current = envOrg || stored;
+    if (!current) {
+        console.log('No default organization selected for this environment.');
+        console.log('Run `norrix orgs select` or pass `--org <orgId>`.');
+        return;
+    }
+    console.log(`Current organization for ${CURRENT_ENV} (${API_URL}): ${current}`);
 }
 /**
  * Norrix CLI Command Implementations
@@ -80,6 +261,16 @@ async function getAuthHeaders() {
 // Get dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
+/**
+ * Safely trim a string value, returning undefined for empty/null values.
+ * Handles both CLI args and config file values to ensure no trailing/leading whitespace.
+ */
+function trimString(input) {
+    if (input == null)
+        return undefined;
+    const trimmed = String(input).trim();
+    return trimmed || undefined;
+}
 function normalizePath(input) {
     if (!input)
         return undefined;
@@ -715,8 +906,7 @@ async function resolveWorkspaceContext(projectArg, spinner) {
  * For Nx workspaces, this includes the app, dependent libs, and workspace config files.
  * For standalone projects, this zips the current directory.
  */
-async function zipProject(projectName, isUpdate = false, verbose = false) {
-    const workspaceCtx = detectWorkspaceContext();
+async function zipProject(projectName, workspaceCtx, isUpdate = false, verbose = false) {
     if (workspaceCtx.type === 'nx') {
         return zipWorkspaceProject(projectName, workspaceCtx, isUpdate, verbose);
     }
@@ -813,16 +1003,39 @@ async function zipWorkspaceProject(projectName, workspaceCtx, isUpdate = false,
         });
         archive.pipe(output);
         logWorkspaceContext(workspaceCtx, verbose);
-        // Get workspace dependencies using Nx CLI (preferred) or fallback
+        // Get workspace dependencies using Nx CLI (preferred) with fallback supplementation
         let deps;
         if (workspaceCtx.projectName) {
-            deps = getNxProjectDependencies(workspaceCtx.projectName, workspaceCtx.workspaceRoot, verbose);
+            deps = getNxProjectDependencies(workspaceCtx.projectName, workspaceCtx.workspaceRoot, verbose, workspaceCtx.appRoot // Pass appRoot for webpack alias detection
+            );
+        }
+        // Always supplement with fallback detection to catch anything Nx might miss
+        // (e.g., dynamic imports, SCSS dependencies, transitive deps from source scanning)
+        const fallbackDeps = getWorkspaceDependenciesFallback(workspaceCtx, verbose);
+        if (deps) {
+            // Merge fallback libs into Nx-detected libs
+            const mergedLibPaths = new Set(deps.libPaths);
+            for (const libPath of fallbackDeps.libPaths) {
+                if (!mergedLibPaths.has(libPath)) {
+                    mergedLibPaths.add(libPath);
+                    if (verbose) {
+                        console.log(`[workspace] Fallback added additional lib: ${libPath}`);
+                    }
+                }
+            }
+            deps.libPaths = Array.from(mergedLibPaths);
+            // Also merge local file deps
+            const mergedLocalFileDeps = new Set(deps.localFileDeps);
+            for (const dep of fallbackDeps.localFileDeps) {
+                mergedLocalFileDeps.add(dep);
+            }
+            deps.localFileDeps = Array.from(mergedLocalFileDeps);
         }
-        if (!deps) {
+        else {
             if (verbose) {
-                console.log('[workspace] Using fallback dependency detection');
+                console.log('[workspace] Using fallback dependency detection (Nx CLI not available)');
             }
-            deps = getWorkspaceDependenciesFallback(workspaceCtx, verbose);
+            deps = fallbackDeps;
         }
         // Create manifest for CI
         const manifest = createWorkspaceManifest(workspaceCtx, deps);
@@ -909,6 +1122,68 @@ async function zipWorkspaceProject(projectName, workspaceCtx, isUpdate = false,
                 archive.directory(absoluteAssetPath, assetPath);
             }
         }
+        // 6. Add local file dependencies (file: protocol paths from package.json)
+        // Skip any that are already covered by libPaths to avoid duplicate entries
+        if (deps.localFileDeps && deps.localFileDeps.length > 0) {
+            const addedDirs = new Set();
+            // Filter out local deps that are subdirectories of already-added libs
+            const filteredLocalDeps = deps.localFileDeps.filter(localDep => {
+                // Check if this local dep is inside any of the lib paths
+                for (const libPath of deps.libPaths) {
+                    if (localDep.startsWith(libPath + '/') || localDep === libPath) {
+                        if (verbose) {
+                            console.log(`  - ${localDep} (skipped, covered by ${libPath})`);
+                        }
+                        return false;
+                    }
+                }
+                return true;
+            });
+            if (filteredLocalDeps.length > 0) {
+                console.log(`Adding ${filteredLocalDeps.length} local file dependencies`);
+            }
+            for (const localDep of filteredLocalDeps) {
+                const absoluteLocalPath = path.join(workspaceCtx.workspaceRoot, localDep);
+                if (fs.existsSync(absoluteLocalPath)) {
+                    const stat = fs.statSync(absoluteLocalPath);
+                    if (stat.isFile()) {
+                        // For files, ensure the parent directory structure is maintained
+                        if (verbose) {
+                            console.log(`  - ${localDep} (file)`);
+                        }
+                        archive.file(absoluteLocalPath, { name: localDep });
+                        // Also add the directory if it hasn't been added yet (for other potential files)
+                        const parentDir = path.dirname(localDep);
+                        if (parentDir && parentDir !== '.' && !addedDirs.has(parentDir)) {
+                            // We just add the file, not the whole directory
+                        }
+                    }
+                    else if (stat.isDirectory()) {
+                        // Skip if this directory or a parent is already in libPaths
+                        const alreadyCovered = deps.libPaths.some(libPath => localDep.startsWith(libPath + '/') || libPath.startsWith(localDep + '/'));
+                        if (alreadyCovered) {
+                            if (verbose) {
+                                console.log(`  - ${localDep} (skipped, overlaps with libPaths)`);
+                            }
+                            continue;
+                        }
+                        if (verbose) {
+                            console.log(`  - ${localDep} (directory)`);
+                        }
+                        archive.directory(absoluteLocalPath, localDep, (entry) => {
+                            if (entry.name.includes('node_modules')) {
+                                return false;
+                            }
+                            return entry;
+                        });
+                        addedDirs.add(localDep);
+                    }
+                }
+                else if (verbose) {
+                    console.log(`  - ${localDep} (not found, skipping)`);
+                }
+            }
+        }
         archive.finalize();
     });
 }
@@ -921,6 +1196,23 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
     // Normalize options - support both new object and legacy string projectArg
     const opts = typeof options === 'string' ? { project: options } : (options || {});
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: opts.org,
+            nonInteractive: opts.nonInteractive,
+            requireSelection: true,
+            verbose,
+            promptMessage: 'Select organization for this build:',
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        if (verbose && error?.response) {
+            console.error('Axios response status:', error.response.status);
+            console.error('Axios response data:', error.response.data);
+        }
+        return;
+    }
     let spinner;
     let originalCwd;
     try {
@@ -971,6 +1263,31 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             ]);
             configuration = answer.configuration;
         }
+        // 2.2 Determine Nx configuration for workspace builds (CLI arg preferred, then prompt if available)
+        let nxConfiguration = opts.nxConfiguration;
+        if (!nxConfiguration && workspaceCtx.type === 'nx' && !opts.nonInteractive) {
+            const nxConfigs = detectNxBuildConfigurations(workspaceCtx.appRoot);
+            if (nxConfigs && nxConfigs.configurations.length > 0) {
+                const choices = nxConfigs.configurations.map((c) => ({
+                    name: c === nxConfigs.defaultConfiguration ? `${c} (default)` : c,
+                    value: c,
+                }));
+                // Add option to skip/use default
+                choices.unshift({ name: '(none - use defaults)', value: '' });
+                const { chosenNxConfig } = await inquirer.prompt([
+                    {
+                        type: 'list',
+                        name: 'chosenNxConfig',
+                        message: 'Nx build configuration (environment):',
+                        choices,
+                        default: nxConfigs.defaultConfiguration || '',
+                    },
+                ]);
+                nxConfiguration = chosenNxConfig || undefined;
+            }
+        }
+        // Store resolved nxConfiguration back to opts for later use
+        opts.nxConfiguration = nxConfiguration;
         const normalizeIosDistribution = (input) => {
             const v = String(input ?? '')
                 .trim()
@@ -1098,94 +1415,147 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         if (configuration === 'release') {
             spinner.stop();
             if (platform === 'ios') {
-                // Determine Team ID from: CLI flag > config file > prompt
+                // Resolve values from: CLI flags > config file (trimmed to handle whitespace)
                 const configTeamId = norrixConfig.ios?.teamId;
-                const resolvedTeamId = opts.teamId || configTeamId;
-                // If we have teamId from CLI or config, and non-interactive mode, skip prompts
-                const shouldPromptForTeamId = !resolvedTeamId && !opts.nonInteractive;
-                const iosAnswers = await inquirer.prompt([
-                    {
-                        type: 'input',
-                        name: 'teamId',
-                        message: 'Apple Developer Team ID (required for code signing, e.g. "ABC123XYZ"):',
-                        default: resolvedTeamId || '',
-                        when: () => shouldPromptForTeamId || !resolvedTeamId,
-                        validate: (input) => {
-                            // Team ID is optional if user provides their own p12/profile
-                            // but we'll strongly recommend it
-                            if (!input.trim()) {
-                                return true; // Allow empty, workflow will try to proceed without it
-                            }
-                            // Basic validation: Apple Team IDs are typically 10 alphanumeric chars
-                            if (/^[A-Z0-9]{10}$/.test(input.trim())) {
+                const configP12Path = norrixConfig.ios?.p12Path;
+                const configProfilePath = norrixConfig.ios?.provisioningProfilePath;
+                const configAscKeyId = norrixConfig.ios?.ascApiKeyId;
+                const configAscIssuerId = norrixConfig.ios?.ascIssuerId;
+                const configAscKeyPath = norrixConfig.ios?.ascPrivateKeyPath;
+                const resolvedTeamId = trimString(opts.teamId) || configTeamId;
+                const resolvedP12Path = trimString(opts.p12Path) || configP12Path;
+                const resolvedP12Password = trimString(opts.p12Password);
+                const resolvedProfilePath = trimString(opts.profilePath) || configProfilePath;
+                const resolvedAscKeyId = trimString(opts.ascKeyId) || configAscKeyId;
+                const resolvedAscIssuerId = trimString(opts.ascIssuerId) || configAscIssuerId;
+                const resolvedAscKeyPath = trimString(opts.ascKeyPath) || configAscKeyPath;
+                if (opts.nonInteractive) {
+                    // Non-interactive mode: use CLI flags and config values only
+                    iosCredentials = {
+                        teamId: resolvedTeamId || undefined,
+                        p12Base64: readOptionalFileAsBase64(resolvedP12Path),
+                        p12Password: resolvedP12Password || undefined,
+                        mobileprovisionBase64: readOptionalFileAsBase64(resolvedProfilePath),
+                        ascApiKeyId: resolvedAscKeyId || undefined,
+                        ascIssuerId: resolvedAscIssuerId || undefined,
+                        ascPrivateKey: readOptionalFileAsBase64(resolvedAscKeyPath),
+                    };
+                    if (resolvedTeamId) {
+                        console.log(`Using Apple Team ID: ${resolvedTeamId}`);
+                    }
+                    if (resolvedAscKeyId) {
+                        console.log(`Using ASC API Key: ${resolvedAscKeyId}`);
+                    }
+                }
+                else {
+                    // Interactive mode: prompt for values with CLI/config as defaults
+                    // Flow: Team ID -> ASC Key (recommended) -> If no ASC, then .p12/.mobileprovision
+                    const iosAnswers = await inquirer.prompt([
+                        {
+                            type: 'input',
+                            name: 'teamId',
+                            message: 'Apple Developer Team ID (required for code signing, e.g. "ABC123XYZ"):',
+                            default: resolvedTeamId || '',
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return true; // Allow empty, workflow will try to proceed without it
+                                }
+                                if (/^[A-Z0-9]{10}$/.test(input.trim())) {
+                                    return true;
+                                }
+                                return 'Team ID should be 10 alphanumeric characters (e.g. "ABC123XYZ"). Leave empty to skip.';
+                            },
+                        },
+                        // ASC API Key is the recommended approach - ask first
+                        {
+                            type: 'confirm',
+                            name: 'useAscKey',
+                            message: 'Use App Store Connect API Key for auto-provisioning? (recommended)',
+                            default: Boolean(resolvedAscKeyId) || true,
+                        },
+                        {
+                            type: 'input',
+                            name: 'ascApiKeyId',
+                            message: 'ASC API Key ID:',
+                            default: resolvedAscKeyId || '',
+                            when: (a) => a.useAscKey,
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return 'API Key ID is required when using ASC Key';
+                                }
                                 return true;
-                            }
-                            return 'Team ID should be 10 alphanumeric characters (e.g. "ABC123XYZ"). Leave empty to skip.';
+                            },
                         },
-                    },
-                    {
-                        type: 'input',
-                        name: 'p12Path',
-                        message: 'Path to iOS .p12 certificate (optional):',
-                        default: '',
-                    },
-                    {
-                        type: 'password',
-                        name: 'p12Password',
-                        message: 'Password for .p12 (if any):',
-                        mask: '*',
-                        default: '',
-                    },
-                    {
-                        type: 'input',
-                        name: 'mobileprovisionPath',
-                        message: 'Path to provisioning profile .mobileprovision (optional):',
-                        default: '',
-                    },
-                    {
-                        type: 'confirm',
-                        name: 'hasAscKey',
-                        message: 'Provide App Store Connect API Key? (optional, for auto-provisioning)',
-                        default: false,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascApiKeyId',
-                        message: 'ASC API Key ID (optional):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascIssuerId',
-                        message: 'ASC Issuer ID (optional):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascPrivateKeyPath',
-                        message: 'Path to ASC private key .p8 (optional):',
-                        default: '',
-                        when: (a) => a.hasAscKey,
-                    },
-                ]);
-                // Use resolved teamId from CLI/config, or from prompt
-                const finalTeamId = resolvedTeamId || iosAnswers.teamId?.trim();
-                iosCredentials = {
-                    teamId: finalTeamId || undefined,
-                    p12Base64: readOptionalFileAsBase64(iosAnswers.p12Path),
-                    p12Password: iosAnswers.p12Password || undefined,
-                    mobileprovisionBase64: readOptionalFileAsBase64(iosAnswers.mobileprovisionPath),
-                    ascApiKeyId: iosAnswers.ascApiKeyId || undefined,
-                    ascIssuerId: iosAnswers.ascIssuerId || undefined,
-                    ascPrivateKey: readOptionalFileAsBase64(iosAnswers.ascPrivateKeyPath),
-                    // Track paths for config saving (not sent to API)
-                    _p12Path: iosAnswers.p12Path || undefined,
-                    _mobileprovisionPath: iosAnswers.mobileprovisionPath || undefined,
-                };
-                if (finalTeamId) {
-                    console.log(`Using Apple Team ID: ${finalTeamId}`);
+                        {
+                            type: 'input',
+                            name: 'ascIssuerId',
+                            message: 'ASC Issuer ID:',
+                            default: resolvedAscIssuerId || '',
+                            when: (a) => a.useAscKey,
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return 'Issuer ID is required when using ASC Key';
+                                }
+                                return true;
+                            },
+                        },
+                        {
+                            type: 'input',
+                            name: 'ascPrivateKeyPath',
+                            message: 'Path to ASC private key .p8:',
+                            default: resolvedAscKeyPath || '',
+                            when: (a) => a.useAscKey,
+                            validate: (input) => {
+                                if (!input.trim()) {
+                                    return 'Path to .p8 key file is required when using ASC Key';
+                                }
+                                return true;
+                            },
+                        },
+                        // Only ask for .p12/.mobileprovision if NOT using ASC Key
+                        {
+                            type: 'input',
+                            name: 'p12Path',
+                            message: 'Path to iOS .p12 certificate (optional):',
+                            default: resolvedP12Path || '',
+                            when: (a) => !a.useAscKey,
+                        },
+                        {
+                            type: 'password',
+                            name: 'p12Password',
+                            message: 'Password for .p12 (if any):',
+                            mask: '*',
+                            default: '',
+                            when: (a) => !a.useAscKey && a.p12Path,
+                        },
+                        {
+                            type: 'input',
+                            name: 'mobileprovisionPath',
+                            message: 'Path to provisioning profile .mobileprovision (optional):',
+                            default: resolvedProfilePath || '',
+                            when: (a) => !a.useAscKey,
+                        },
+                    ]);
+                    // Use resolved teamId from CLI/config, or from prompt
+                    const finalTeamId = trimString(iosAnswers.teamId) || resolvedTeamId;
+                    iosCredentials = {
+                        teamId: finalTeamId || undefined,
+                        p12Base64: readOptionalFileAsBase64(iosAnswers.p12Path),
+                        p12Password: trimString(iosAnswers.p12Password),
+                        mobileprovisionBase64: readOptionalFileAsBase64(iosAnswers.mobileprovisionPath),
+                        ascApiKeyId: trimString(iosAnswers.ascApiKeyId),
+                        ascIssuerId: trimString(iosAnswers.ascIssuerId),
+                        ascPrivateKey: readOptionalFileAsBase64(iosAnswers.ascPrivateKeyPath),
+                        // Track paths for config saving (not sent to API)
+                        _p12Path: trimString(iosAnswers.p12Path),
+                        _mobileprovisionPath: trimString(iosAnswers.mobileprovisionPath),
+                        _ascApiKeyId: trimString(iosAnswers.ascApiKeyId),
+                        _ascIssuerId: trimString(iosAnswers.ascIssuerId),
+                        _ascPrivateKeyPath: trimString(iosAnswers.ascPrivateKeyPath),
+                    };
+                    if (finalTeamId) {
+                        console.log(`Using Apple Team ID: ${finalTeamId}`);
+                    }
                 }
             }
             else if (platform === 'android') {
@@ -1232,14 +1602,14 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                 ]);
                 androidCredentials = {
                     keystoreBase64: readOptionalFileAsBase64(androidAnswers.keystorePath),
-                    keystorePassword: androidAnswers.keystorePassword || undefined,
-                    keyAlias: androidAnswers.keyAlias || undefined,
-                    keyPassword: androidAnswers.keyPassword || undefined,
+                    keystorePassword: trimString(androidAnswers.keystorePassword),
+                    keyAlias: trimString(androidAnswers.keyAlias),
+                    keyPassword: trimString(androidAnswers.keyPassword),
                     playServiceAccountJson: readOptionalFileAsBase64(androidAnswers.playJsonPath),
                 };
                 // Track Android paths for config saving
-                androidCredentials._keystorePath = androidAnswers.keystorePath || undefined;
-                androidCredentials._keyAlias = androidAnswers.keyAlias || undefined;
+                androidCredentials._keystorePath = trimString(androidAnswers.keystorePath);
+                androidCredentials._keyAlias = trimString(androidAnswers.keyAlias);
             }
             // Offer to save config if no norrix.config.ts exists and we collected useful values
             const appRoot = process.cwd();
@@ -1263,6 +1633,16 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                     if (iosCredentials._mobileprovisionPath) {
                         saveableOptions.provisioningProfilePath = iosCredentials._mobileprovisionPath;
                     }
+                    // Save ASC API Key details for future builds
+                    if (iosCredentials._ascApiKeyId) {
+                        saveableOptions.ascApiKeyId = iosCredentials._ascApiKeyId;
+                    }
+                    if (iosCredentials._ascIssuerId) {
+                        saveableOptions.ascIssuerId = iosCredentials._ascIssuerId;
+                    }
+                    if (iosCredentials._ascPrivateKeyPath) {
+                        saveableOptions.ascPrivateKeyPath = iosCredentials._ascPrivateKeyPath;
+                    }
                 }
                 if (platform === 'android' && androidCredentials) {
                     if (androidCredentials._keystorePath) {
@@ -1277,7 +1657,8 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                     saveableOptions.distributionType ||
                     saveableOptions.p12Path ||
                     saveableOptions.provisioningProfilePath ||
-                    saveableOptions.keystorePath;
+                    saveableOptions.keystorePath ||
+                    saveableOptions.ascApiKeyId;
                 if (hasSaveableValues) {
                     const { shouldSave } = await inquirer.prompt([
                         {
@@ -1309,7 +1690,7 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         writeRuntimeFingerprintFile(projectRoot, fingerprint, platform);
         spinner.start('Creating project archive...');
         // 3. Zip the project (workspace-aware)
-        const { zipPath, workspaceContext } = await zipProject(projectName, false, verbose);
+        const { zipPath, workspaceContext } = await zipProject(projectName, workspaceCtx, false, verbose);
         spinner.text = 'Project archive created';
         // 4. Upload the project zip to S3
         spinner.text = 'Working...';
@@ -1342,6 +1723,11 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             appPath: workspaceContext.relativeAppPath,
             projectName: workspaceContext.projectName,
         } : undefined;
+        // For standalone projects, use the project option or infer from app ID/package name
+        // This allows env vars to be scoped to specific standalone projects within an org
+        const standaloneProjectName = workspaceContext.type === 'standalone'
+            ? (opts.project || inferredAppId || projectName)
+            : undefined;
         const response = await axios.post(`${API_URL}/build`, {
             projectName,
             appId: inferredAppId,
@@ -1351,12 +1737,18 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             version: version || '',
             buildNumber: buildNumber || '',
             configuration,
+            // Nx configuration (e.g., 'prod', 'stg', 'dev') for monorepo builds
+            ...(opts.nxConfiguration ? { nxConfiguration: opts.nxConfiguration } : {}),
             ...(distributionType ? { distributionType } : {}),
+            // Android package type override (apk or aab) - takes precedence over distributionType
+            ...(opts.androidPackageType ? { androidPackageType: opts.androidPackageType } : {}),
             fingerprint,
             // Provide the relative key (without public/) – the workflow prepends public/
             s3Key: s3KeyRel,
             // Workspace context for Nx monorepos
             ...(workspaceInfo ? { workspace: workspaceInfo } : {}),
+            // For standalone projects, include project name for env var scoping
+            ...(standaloneProjectName ? { projectName: standaloneProjectName } : {}),
             // Only include raw credentials if not encrypted
             ...(encryptedSecrets ? { encryptedSecrets } : {}),
             ...(!encryptedSecrets && iosCredentials ? { iosCredentials } : {}),
@@ -1462,8 +1854,25 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
  * Submit command implementation
  * Submits the built app to app stores via the Next.js API gateway
  */
-export async function submit(cliPlatformArg, cliTrackArg, verbose = false) {
+export async function submit(cliPlatformArg, cliTrackArg, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: Boolean(options?.nonInteractive),
+            requireSelection: true,
+            verbose,
+            promptMessage: 'Select organization for this submission:',
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        if (verbose && error?.response) {
+            console.error('Axios response status:', error.response.status);
+            console.error('Axios response data:', error.response.data);
+        }
+        return;
+    }
     const spinner = ora('Preparing app for submission...');
     try {
         spinner.start();
@@ -1727,6 +2136,23 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
     // Normalize options - support both new object and legacy string projectArg
     const opts = typeof options === 'string' ? { project: options } : (options || {});
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: opts.org,
+            nonInteractive: opts.nonInteractive,
+            requireSelection: true,
+            verbose,
+            promptMessage: 'Select organization for this update:',
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        if (verbose && error?.response) {
+            console.error('Axios response status:', error.response.status);
+            console.error('Axios response data:', error.response.data);
+        }
+        return;
+    }
     let spinner;
     let originalCwd;
     try {
@@ -1759,6 +2185,33 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
             platform = chosenPlatform;
             spinner.start('Preparing over-the-air update...');
         }
+        // Determine Nx configuration for workspace builds (CLI arg preferred, then prompt if available)
+        let nxConfiguration = opts.nxConfiguration;
+        if (!nxConfiguration && workspaceCtx.type === 'nx' && !opts.nonInteractive) {
+            spinner.stop();
+            const nxConfigs = detectNxBuildConfigurations(workspaceCtx.appRoot);
+            if (nxConfigs && nxConfigs.configurations.length > 0) {
+                const choices = nxConfigs.configurations.map((c) => ({
+                    name: c === nxConfigs.defaultConfiguration ? `${c} (default)` : c,
+                    value: c,
+                }));
+                // Add option to skip/use default
+                choices.unshift({ name: '(none - use defaults)', value: '' });
+                const { chosenNxConfig } = await inquirer.prompt([
+                    {
+                        type: 'list',
+                        name: 'chosenNxConfig',
+                        message: 'Nx build configuration (environment):',
+                        choices,
+                        default: nxConfigs.defaultConfiguration || '',
+                    },
+                ]);
+                nxConfiguration = chosenNxConfig || undefined;
+            }
+            spinner.start('Preparing over-the-air update...');
+        }
+        // Store resolved nxConfiguration back to opts for later use
+        opts.nxConfiguration = nxConfiguration;
         // Infer version from native project files (same as build)
         const appleVersionInfo = platform === 'ios' || platform === 'visionos'
             ? getAppleVersionFromInfoPlist(platform)
@@ -1963,7 +2416,7 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
         spinner.start('Packaging for over-the-air update...');
         // Create the update bundle (workspace-aware) - pass true to include node_modules for updates
         const projectName = await getProjectName();
-        const { zipPath, workspaceContext } = await zipProject(projectName, true, verbose);
+        const { zipPath, workspaceContext } = await zipProject(projectName, workspaceCtx, true, verbose);
         spinner.text = 'Uploading update to Norrix cloud storage...';
         const fileBuffer = fs.readFileSync(zipPath);
         const updateFolder = `update-${Date.now()}`;
@@ -1977,6 +2430,11 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
             appPath: workspaceContext.relativeAppPath,
             projectName: workspaceContext.projectName,
         } : undefined;
+        // For standalone projects, use the project option or infer from app ID
+        // This allows env vars to be scoped to specific standalone projects within an org
+        const standaloneProjectName = workspaceContext.type === 'standalone'
+            ? (opts.project || appId)
+            : undefined;
         const response = await axios.post(`${API_URL}/update`, {
             appId,
             platform,
@@ -1984,10 +2442,14 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
             buildNumber: buildNumber || '',
             releaseNotes: notes,
             fingerprint,
+            // Nx configuration (e.g., 'prod', 'stg', 'dev') for monorepo builds
+            ...(opts.nxConfiguration ? { nxConfiguration: opts.nxConfiguration } : {}),
             // Provide the relative key (without public/). Consumers will prepend public/
             s3Key: s3KeyRel,
             // Workspace context for Nx monorepos
             ...(workspaceInfo ? { workspace: workspaceInfo } : {}),
+            // For standalone projects, include project name for env var scoping
+            ...(standaloneProjectName ? { projectName: standaloneProjectName } : {}),
         }, {
             headers: {
                 'Content-Type': 'application/json',
@@ -2079,8 +2541,20 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
  * Build Status command implementation
  * Checks the status of a build via the Next.js API gateway
  */
-export async function buildStatus(buildId, verbose = false) {
+export async function buildStatus(buildId, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: true,
+            requireSelection: false,
+            verbose,
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        return;
+    }
     try {
         const spinner = ora(`Checking status of build ${buildId}...`).start();
         const response = await axios.get(`${API_URL}/build/${buildId}`, {
@@ -2117,8 +2591,20 @@ export async function buildStatus(buildId, verbose = false) {
  * Submit Status command implementation
  * Checks the status of a submission via the Next.js API gateway
  */
-export async function submitStatus(submitId, verbose = false) {
+export async function submitStatus(submitId, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: true,
+            requireSelection: false,
+            verbose,
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        return;
+    }
     try {
         const spinner = ora(`Checking status of submission ${submitId}...`).start();
         const response = await axios.get(`${API_URL}/submit/${submitId}`, {
@@ -2151,8 +2637,20 @@ export async function submitStatus(submitId, verbose = false) {
  * Update Status command implementation
  * Checks the status of an update via the Next.js API gateway
  */
-export async function updateStatus(updateId, verbose = false) {
+export async function updateStatus(updateId, verbose = false, options) {
     ensureInitialized();
+    try {
+        await ensureOrgSelected({
+            orgIdArg: options?.org,
+            nonInteractive: true,
+            requireSelection: false,
+            verbose,
+        });
+    }
+    catch (error) {
+        ora().fail(`Organization selection failed: ${error?.message || error}`);
+        return;
+    }
     try {
         const spinner = ora(`Checking status of update ${updateId}...`).start();
         const response = await axios.get(`${API_URL}/update/${updateId}`, {
@@ -2290,6 +2788,41 @@ export async function uploadFile(filePath, options, verbose = false) {
  */
 export async function currentUser(verbose = false) {
     ensureInitialized();
+    // Check for API key authentication first
+    const apiKey = getApiKey();
+    if (apiKey) {
+        const spinner = ora('Verifying API key...').start();
+        try {
+            // Make a request to verify the API key and get user info
+            const response = await axios.get(`${API_URL}/user`, {
+                headers: await getAuthHeaders(),
+            });
+            spinner.stop();
+            const user = response.data?.user;
+            if (user) {
+                console.log('🔑 Authenticated via API key');
+                console.log(`Email: ${user.email}`);
+                console.log(`Username: ${user.username ?? 'N/A'}`);
+                console.log(`Organization: ${response.data?.organization?.name ?? 'N/A'}`);
+                console.log(`API Key: ${apiKey.substring(0, 12)}...`);
+            }
+            else {
+                console.log('🔑 API key configured but unable to fetch user details.');
+            }
+            return;
+        }
+        catch (error) {
+            spinner.stop();
+            if (error?.response?.status === 401) {
+                console.log('⚠️  API key is invalid or expired.');
+            }
+            else {
+                console.log('⚠️  Failed to verify API key:', error?.message || error);
+            }
+            return;
+        }
+    }
+    // Fall back to Cognito session
     try {
         const spinner = ora('Fetching current user...').start();
         let user;
@@ -2309,6 +2842,10 @@ export async function currentUser(verbose = false) {
         spinner.stop();
         if (!user) {
             console.log('⚠️  No user is currently signed in.');
+            console.log('');
+            console.log('To authenticate, either:');
+            console.log('  • Run `norrix sign-in` for interactive login');
+            console.log('  • Set NORRIX_API_KEY environment variable for CI/automation');
             return;
         }
         console.log('Signed-in user info:');
@@ -2397,4 +2934,310 @@ export async function billingPortal(verbose = false) {
         }
     }
 }
+function normalizeVisibilityType(input) {
+    if (!input)
+        return 'secret';
+    if (input === 'plaintext' || input === 'secret')
+        return input;
+    console.error('Error: --visibility must be either "plaintext" or "secret"');
+    process.exit(1);
+}
+/**
+ * Set an environment variable for build-time injection
+ */
+export async function envSet(name, value, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        const visibilityType = normalizeVisibilityType(options.visibilityType);
+        // Validate secret name (env var format)
+        if (!/^[A-Z_][A-Z0-9_]*$/i.test(name)) {
+            console.error('Error: Name must be a valid environment variable name (alphanumeric and underscores, cannot start with a number)');
+            process.exit(1);
+        }
+        spinner = ora(`Setting env var "${name}"...`).start();
+        const payload = {
+            type: 'variable',
+            name,
+            visibilityType,
+            project: options.project,
+        };
+        if (visibilityType === 'plaintext') {
+            payload.value = value;
+        }
+        else {
+            Object.assign(payload, encryptSecretValue(value));
+        }
+        const res = await axios.post(`${API_URL}/env`, payload, {
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env var "${name}" set successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to set env var: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-set) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Upload an environment file for build-time injection
+ */
+export async function envSetFile(name, filePath, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        const visibilityType = normalizeVisibilityType(options.visibilityType);
+        const resolvedPath = normalizePath(filePath);
+        if (!resolvedPath || !fs.existsSync(resolvedPath)) {
+            console.error(`Error: File not found: ${filePath}`);
+            process.exit(1);
+        }
+        spinner = ora(`Uploading env file "${name}"...`).start();
+        // Read and encode file content
+        const fileContent = fs.readFileSync(resolvedPath);
+        const base64Content = fileContent.toString('base64');
+        const payload = {
+            type: 'file',
+            name,
+            visibilityType,
+            destPath: options.destPath || name,
+            project: options.project,
+        };
+        if (visibilityType === 'plaintext') {
+            payload.value = base64Content;
+        }
+        else {
+            Object.assign(payload, encryptSecretValue(base64Content));
+        }
+        const res = await axios.post(`${API_URL}/env`, payload, {
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env file "${name}" uploaded successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to upload env file: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-set-file) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * List all environment variables/files for a project
+ */
+export async function envList(verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        spinner = ora('Fetching env vars...').start();
+        const params = new URLSearchParams();
+        if (options.project) {
+            params.set('project', options.project);
+        }
+        const res = await axios.get(`${API_URL}/env?${params.toString()}`, {
+            headers: await getAuthHeaders(),
+        });
+        spinner.stop();
+        const envs = res.data?.envs || [];
+        const projectName = options.project || res.data?.project || 'default';
+        if (envs.length === 0) {
+            console.log(`\nNo environment variables found for project: ${projectName}`);
+            console.log('\nTo add env vars/files, use:');
+            console.log('  norrix env set <name> <value>');
+            console.log('  norrix env set-file <name> <path>');
+            return;
+        }
+        console.log(`\nEnvironment variables for project: ${projectName}\n`);
+        // Separate variables and files
+        const variables = envs.filter((e) => e.type === 'variable');
+        const files = envs.filter((e) => e.type === 'file');
+        if (variables.length > 0) {
+            console.log('Variables:');
+            for (const variable of variables) {
+                const dateStr = variable.updatedAt
+                    ? `set ${new Date(variable.updatedAt).toLocaleDateString()}`
+                    : '';
+                const visibility = variable.visibilityType || variable.visibility || 'secret';
+                console.log(`  • ${variable.name} (${visibility}${dateStr ? `, ${dateStr}` : ''})`);
+            }
+        }
+        if (files.length > 0) {
+            if (variables.length > 0)
+                console.log('');
+            console.log('Files:');
+            for (const file of files) {
+                const dateStr = file.updatedAt
+                    ? `set ${new Date(file.updatedAt).toLocaleDateString()}`
+                    : '';
+                const visibility = file.visibilityType || file.visibility || 'secret';
+                const destPath = file.destPath || file.name;
+                console.log(`  • ${file.name} → ${destPath} (${visibility}${dateStr ? `, ${dateStr}` : ''})`);
+            }
+        }
+        console.log('');
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to list env vars: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-list) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Delete an environment variable
+ */
+export async function envDelete(name, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        spinner = ora(`Deleting env var "${name}"...`).start();
+        const res = await axios.delete(`${API_URL}/env`, {
+            data: {
+                type: 'variable',
+                name,
+                project: options.project,
+            },
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env var "${name}" deleted successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to delete env var: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-delete) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Delete an environment file
+ */
+export async function envDeleteFile(name, verbose = false, options = {}) {
+    ensureInitialized();
+    let spinner;
+    try {
+        spinner = ora(`Deleting env file "${name}"...`).start();
+        const res = await axios.delete(`${API_URL}/env`, {
+            data: {
+                type: 'file',
+                name,
+                project: options.project,
+            },
+            headers: await getAuthHeaders(),
+        });
+        spinner.succeed(`Env file "${name}" deleted successfully`);
+        if (res.data?.message) {
+            console.log(res.data.message);
+        }
+    }
+    catch (error) {
+        const apiMessage = error?.response?.data?.error ||
+            error?.response?.data?.message ||
+            error?.message ||
+            String(error);
+        spinner?.fail(`Failed to delete env file: ${apiMessage}`);
+        if (verbose) {
+            console.error('--- Verbose error details (env-delete-file) ---');
+            console.error(error);
+            if (error?.response) {
+                console.error('Axios response status:', error.response.status);
+                console.error('Axios response data:', error.response.data);
+            }
+            if (error?.stack) {
+                console.error(error.stack);
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Encrypt a secret value using the Norrix public key (envelope encryption)
+ */
+function encryptSecretValue(value) {
+    const publicKeyPem = process.env.NORRIX_BUILD_PUBLIC_KEY;
+    if (!publicKeyPem) {
+        // If no public key is configured, send value in a format the server can handle
+        // The server will encrypt at rest using its own key
+        return {
+            encryptedValue: Buffer.from(value, 'utf8').toString('base64'),
+            encryptedKey: '',
+            iv: '',
+            tag: '',
+        };
+    }
+    const nodeCrypto = crypto;
+    const aesKey = nodeCrypto.randomBytes(32); // AES-256
+    const iv = nodeCrypto.randomBytes(12); // GCM nonce
+    const cipher = nodeCrypto.createCipheriv('aes-256-gcm', aesKey, iv);
+    const plaintext = Buffer.from(value, 'utf8');
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const encryptedKey = nodeCrypto.publicEncrypt({ key: publicKeyPem, oaepHash: 'sha256' }, aesKey);
+    return {
+        encryptedValue: ciphertext.toString('base64'),
+        encryptedKey: encryptedKey.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: tag.toString('base64'),
+    };
+}
 //# sourceMappingURL=commands.js.map