@norrix/cli 0.0.49 → 0.0.51

package/dist/lib/commands.js

@@ -10,6 +10,9 @@ import archiver from 'archiver';
 import { configureAmplify, loadCliEnvFiles } from './amplify-config.js';
 import { computeFingerprint, embedFingerprintInNativeResources, embedVersionInNativeResources, embedNxConfigurationInNativeResources, } from './fingerprinting.js';
 import { loadNorrixConfig, hasNorrixConfig, saveNorrixConfig, } from './config.js';
+import { fetchOrgEnvVarNames, getOrgEnvVarNamesForField, hasOrgEnvVar, } from './org-env-helper.js';
+import { smartPrompt } from './smart-prompt.js';
+import { ConfigValueTracker } from './config-tracker.js';
 import { detectWorkspaceContext, getNxProjectDependencies, getWorkspaceDependenciesFallback, createWorkspaceManifest, logWorkspaceContext, isAtWorkspaceRoot, discoverNativeScriptApps, getWorkspaceContextForApp, detectNxBuildConfigurations, } from './workspace.js';
 import { signIn as amplifySignIn, signOut as amplifySignOut, getCurrentUser, fetchAuthSession, } from 'aws-amplify/auth';
 import crypto from 'crypto';
@@ -895,7 +898,7 @@ async function getProjectName() {
         throw new Error(`Failed to get project name: ${error.message}`);
     }
 }
-async function getLatestSuccessfulBuildForApp(appId, platform, verbose = false) {
+async function getLatestSuccessfulBuildForApp(appId, platform, verbose = false, targetVersion) {
     try {
         const response = await axios.get(`${API_URL}/build`, {
             headers: await getAuthHeaders(),
@@ -907,23 +910,28 @@ async function getLatestSuccessfulBuildForApp(appId, platform, verbose = false)
         const matching = builds.filter((b) => {
             const bPlatform = (b.platform || '').toLowerCase();
             const bAppId = b.appId || b.bundleId || b.projectName;
-            return (b.status === 'success' &&
+            // Base filters: status, platform, appId
+            const baseMatch = b.status === 'success' &&
                 bPlatform === normalizedPlatform &&
-                bAppId === appId);
+                bAppId === appId;
+            // If a target version is specified, also filter by version
+            // This enables targeting specific version series for OTA updates (e.g., hotfix for 1.1.0 while 2.0.0 exists)
+            if (targetVersion && baseMatch) {
+                return b.version === targetVersion;
+            }
+            return baseMatch;
         });
         if (!matching.length)
             return undefined;
+        // Sort by timestamp (newest first) to get the most recently created build.
+        // This is more reliable than buildNumber because build numbers can reset
+        // when project names change or when migrating between different naming schemes.
         matching.sort((a, b) => {
-            const aNum = Number(a.buildNumber);
-            const bNum = Number(b.buildNumber);
-            if (!Number.isNaN(aNum) && !Number.isNaN(bNum) && aNum !== bNum) {
-                return aNum - bNum;
-            }
-            const aCreated = a.createdAt ? new Date(a.createdAt).getTime() : 0;
-            const bCreated = b.createdAt ? new Date(b.createdAt).getTime() : 0;
-            return aCreated - bCreated;
+            const aCreated = a.timestamp ? new Date(a.timestamp).getTime() : 0;
+            const bCreated = b.timestamp ? new Date(b.timestamp).getTime() : 0;
+            return bCreated - aCreated; // Descending order (newest first)
         });
-        return matching[matching.length - 1];
+        return matching[0]; // Return the newest build
     }
     catch (error) {
         if (verbose) {
@@ -1438,6 +1446,10 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         }
         return;
     }
+    // Fetch org environment variable names for smart prompting
+    const availableOrgEnvVars = await fetchOrgEnvVarNames(API_URL, await getAuthHeaders({ includeOrg: true }), verbose);
+    // Track user-provided values for potential config saving
+    const configTracker = new ConfigValueTracker();
     let spinner;
     let originalCwd;
     try {
@@ -1479,15 +1491,15 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             platform = chosenPlatform;
         }
         // 2.1 Determine configuration (CLI arg preferred, then config, otherwise prompt)
-        const validConfigurations = ['debug', 'release'];
+        const validConfigurations = ['release', 'debug'];
         let configuration = (cliConfigurationArg ||
             norrixConfig.defaultConfiguration ||
             '').toLowerCase();
         if (!validConfigurations.includes(configuration)) {
             if (opts.nonInteractive) {
-                // Default to 'debug' in non-interactive mode if not specified
-                configuration = 'debug';
-                logVerbose('No configuration specified, defaulting to debug', verbose);
+                // Default to 'release' in non-interactive mode if not specified
+                configuration = 'release';
+                logVerbose('No configuration specified, defaulting to release', verbose);
             }
             else {
                 const answer = await inquirer.prompt([
@@ -1496,7 +1508,7 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                         name: 'configuration',
                         message: 'Build configuration:',
                         choices: validConfigurations,
-                        default: norrixConfig.defaultConfiguration || 'debug',
+                        default: norrixConfig.defaultConfiguration || 'release',
                     },
                 ]);
                 configuration = answer.configuration;
@@ -1659,6 +1671,46 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
             buildNumber = cliBuildNumber;
             logVerbose(`Using build number from CLI flag: ${buildNumber}`, verbose);
         }
+        else if (platform === 'ios' || platform === 'visionos') {
+            const inferredApple = appleVersionInfo;
+            const inferredBuildNumber = inferredApple.buildNumber;
+            if (inferredBuildNumber) {
+                logVerbose(`Auto-detected iOS CFBundleVersion from Info.plist: ${inferredBuildNumber}`, verbose);
+            }
+            if (opts.nonInteractive) {
+                // In non-interactive mode, use inferred or leave undefined for auto-increment
+                buildNumber = inferredBuildNumber || undefined;
+                if (buildNumber) {
+                    logVerbose(`Using auto-detected build number: ${buildNumber}`, verbose);
+                }
+                else {
+                    logVerbose('Build number will be auto-incremented', verbose);
+                }
+            }
+            else {
+                const { iosBuildNumber } = await inquirer.prompt([
+                    {
+                        type: 'input',
+                        name: 'iosBuildNumber',
+                        message: inferredBuildNumber
+                            ? `App build number, aka CFBundleVersion (${inferredBuildNumber} - enter to auto increment):`
+                            : 'App build number, aka CFBundleVersion (enter to auto increment):',
+                        default: inferredBuildNumber || '',
+                        validate: (input) => {
+                            const val = String(input).trim();
+                            if (val === '')
+                                return true; // allow blank → auto-increment
+                            // iOS CFBundleVersion can be numeric or semver-like (e.g., "1.0.0" or "123")
+                            if (/^[\d.]+$/.test(val)) {
+                                return true;
+                            }
+                            return 'Enter a numeric build number (e.g., "123" or "1.0.0"). Leave empty to auto-increment.';
+                        },
+                    },
+                ]);
+                buildNumber = String(iosBuildNumber).trim() || undefined;
+            }
+        }
         else if (platform === 'android') {
             const inferredAndroid = androidVersionInfo;
             const inferredVersionCode = inferredAndroid.buildNumber;
@@ -1715,295 +1767,342 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
                 const configAscKeyId = norrixConfig.ios?.ascApiKeyId;
                 const configAscIssuerId = norrixConfig.ios?.ascIssuerId;
                 const configAscKeyPath = norrixConfig.ios?.ascPrivateKeyPath;
-                const resolvedTeamId = trimString(opts.teamId) || configTeamId;
-                const resolvedP12Path = trimString(opts.p12Path) || configP12Path;
-                const resolvedP12Password = trimString(opts.p12Password);
-                const resolvedProfilePath = trimString(opts.profilePath) || configProfilePath;
                 const resolvedAscKeyId = trimString(opts.ascKeyId) || configAscKeyId;
-                const resolvedAscIssuerId = trimString(opts.ascIssuerId) || configAscIssuerId;
-                const resolvedAscKeyPath = trimString(opts.ascKeyPath) || configAscKeyPath;
-                if (opts.nonInteractive) {
-                    // Non-interactive mode: use CLI flags and config values only
-                    iosCredentials = {
-                        teamId: resolvedTeamId || undefined,
-                        p12Base64: readOptionalFileAsBase64(resolvedP12Path),
-                        p12Password: resolvedP12Password || undefined,
-                        mobileprovisionBase64: readOptionalFileAsBase64(resolvedProfilePath),
-                        ascApiKeyId: resolvedAscKeyId || undefined,
-                        ascIssuerId: resolvedAscIssuerId || undefined,
-                        ascPrivateKey: readOptionalFileAsBase64(resolvedAscKeyPath),
-                    };
-                    if (resolvedTeamId) {
-                        console.log(`Using Apple Team ID: ${resolvedTeamId}`);
-                    }
-                    if (resolvedAscKeyId) {
-                        console.log(`Using ASC API Key: ${resolvedAscKeyId}`);
-                    }
-                }
-                else {
-                    // Interactive mode: prompt for values with CLI/config as defaults
-                    // Flow: Team ID -> ASC Key (recommended) -> If no ASC, then .p12/.mobileprovision
-                    const iosAnswers = await inquirer.prompt([
-                        {
-                            type: 'input',
-                            name: 'teamId',
-                            message: 'Apple Developer Team ID (required for code signing, e.g. "ABC123XYZ"):',
-                            default: resolvedTeamId || '',
-                            validate: (input) => {
-                                if (!input.trim()) {
-                                    return true; // Allow empty, workflow will try to proceed without it
-                                }
-                                if (/^[A-Z0-9]{10}$/.test(input.trim())) {
-                                    return true;
-                                }
-                                return 'Team ID should be 10 alphanumeric characters (e.g. "ABC123XYZ"). Leave empty to skip.';
-                            },
-                        },
-                        // ASC API Key is the recommended approach - ask first
+                // Use smart prompts for credentials
+                // Non-interactive mode will auto-select from CLI > org env > config > process env
+                // Interactive mode will confirm org env and config values before using them
+                // Team ID
+                const teamIdResult = await smartPrompt({
+                    name: 'teamId',
+                    message: 'Apple Developer Team ID (required for code signing, e.g. "ABC123XYZ"):',
+                    cliValue: opts.teamId,
+                    configValue: configTeamId,
+                    orgEnvVarNames: getOrgEnvVarNamesForField('teamId'),
+                    availableOrgEnvVars,
+                    nonInteractive: opts.nonInteractive,
+                    validate: (input) => {
+                        if (!input.trim()) {
+                            return true; // Allow empty, workflow will try to proceed without it
+                        }
+                        if (/^[A-Z0-9]{10}$/.test(input.trim())) {
+                            return true;
+                        }
+                        return 'Team ID should be 10 alphanumeric characters (e.g. "ABC123XYZ"). Leave empty to skip.';
+                    },
+                });
+                configTracker.track('teamId', teamIdResult.value, teamIdResult.source);
+                // ASC API Key is the recommended approach
+                // Check if any ASC credentials are available in org env vars
+                const hasAscOrgEnvVars = hasOrgEnvVar(getOrgEnvVarNamesForField('ascApiKeyId'), availableOrgEnvVars) ||
+                    hasOrgEnvVar(getOrgEnvVarNamesForField('ascIssuerId'), availableOrgEnvVars) ||
+                    hasOrgEnvVar(getOrgEnvVarNamesForField('ascPrivateKeyPath'), availableOrgEnvVars);
+                let useAscKey = Boolean(resolvedAscKeyId) || teamIdResult.source === 'org-env' || hasAscOrgEnvVars;
+                if (!opts.nonInteractive && teamIdResult.source !== 'org-env' && !hasAscOrgEnvVars) {
+                    // Ask if user wants to use ASC Key (only in interactive mode, and only if no org env vars)
+                    const { useAscKeyAnswer } = await inquirer.prompt([
                         {
                             type: 'confirm',
-                            name: 'useAscKey',
+                            name: 'useAscKeyAnswer',
                             message: 'Use App Store Connect API Key for auto-provisioning? (recommended)',
                             default: Boolean(resolvedAscKeyId) || true,
                         },
-                        {
-                            type: 'input',
-                            name: 'ascApiKeyId',
-                            message: 'ASC API Key ID:',
-                            default: resolvedAscKeyId || '',
-                            when: (a) => a.useAscKey,
-                            validate: (input) => {
-                                if (!input.trim()) {
-                                    return 'API Key ID is required when using ASC Key';
-                                }
-                                return true;
-                            },
-                        },
-                        {
-                            type: 'input',
-                            name: 'ascIssuerId',
-                            message: 'ASC Issuer ID:',
-                            default: resolvedAscIssuerId || '',
-                            when: (a) => a.useAscKey,
-                            validate: (input) => {
-                                if (!input.trim()) {
-                                    return 'Issuer ID is required when using ASC Key';
-                                }
-                                return true;
-                            },
+                    ]);
+                    useAscKey = useAscKeyAnswer;
+                }
+                // Collect ASC credentials if using ASC Key
+                let ascApiKeyIdResult;
+                let ascIssuerIdResult;
+                let ascPrivateKeyPathResult;
+                if (useAscKey) {
+                    ascApiKeyIdResult = await smartPrompt({
+                        name: 'ascApiKeyId',
+                        message: 'App Store Connect (ASC) API Key ID:',
+                        cliValue: opts.ascKeyId,
+                        configValue: configAscKeyId,
+                        orgEnvVarNames: getOrgEnvVarNamesForField('ascApiKeyId'),
+                        availableOrgEnvVars,
+                        nonInteractive: opts.nonInteractive,
+                        required: true,
+                        validate: (input) => {
+                            if (!input.trim()) {
+                                return 'API Key ID is required when using App Store Connect (ASC) Key';
+                            }
+                            return true;
                         },
-                        {
-                            type: 'input',
-                            name: 'ascPrivateKeyPath',
-                            message: 'Path to ASC private key .p8:',
-                            default: resolvedAscKeyPath || '',
-                            when: (a) => a.useAscKey,
-                            validate: (input) => {
-                                if (!input.trim()) {
-                                    return 'Path to .p8 key file is required when using ASC Key';
-                                }
-                                return true;
-                            },
+                    });
+                    configTracker.track('ascApiKeyId', ascApiKeyIdResult.value, ascApiKeyIdResult.source);
+                    ascIssuerIdResult = await smartPrompt({
+                        name: 'ascIssuerId',
+                        message: 'App Store Connect (ASC) Issuer ID:',
+                        cliValue: opts.ascIssuerId,
+                        configValue: configAscIssuerId,
+                        orgEnvVarNames: getOrgEnvVarNamesForField('ascIssuerId'),
+                        availableOrgEnvVars,
+                        nonInteractive: opts.nonInteractive,
+                        required: true,
+                        validate: (input) => {
+                            if (!input.trim()) {
+                                return 'Issuer ID is required when using App Store Connect (ASC) Key';
+                            }
+                            return true;
                         },
-                        // Only ask for .p12/.mobileprovision if NOT using ASC Key
-                        {
-                            type: 'input',
-                            name: 'p12Path',
-                            message: 'Path to iOS .p12 certificate (optional):',
-                            default: resolvedP12Path || '',
-                            when: (a) => !a.useAscKey,
+                    });
+                    configTracker.track('ascIssuerId', ascIssuerIdResult.value, ascIssuerIdResult.source);
+                    ascPrivateKeyPathResult = await smartPrompt({
+                        name: 'ascPrivateKeyPath',
+                        message: 'Path to App Store Connect (ASC) private key .p8:',
+                        cliValue: opts.ascKeyPath,
+                        configValue: configAscKeyPath,
+                        orgEnvVarNames: getOrgEnvVarNamesForField('ascPrivateKeyPath'),
+                        availableOrgEnvVars,
+                        nonInteractive: opts.nonInteractive,
+                        required: true,
+                        validate: (input) => {
+                            if (!input.trim()) {
+                                return 'Path to .p8 key file is required when using App Store Connect (ASC) Key';
+                            }
+                            return true;
                         },
-                        {
-                            type: 'password',
+                    });
+                    configTracker.track('ascPrivateKeyPath', ascPrivateKeyPathResult.value, ascPrivateKeyPathResult.source);
+                }
+                // Collect p12/mobileprovision credentials if NOT using ASC Key
+                let p12PathResult;
+                let p12PasswordResult;
+                let mobileprovisionPathResult;
+                if (!useAscKey) {
+                    p12PathResult = await smartPrompt({
+                        name: 'p12Path',
+                        message: 'Path to iOS .p12 certificate (optional):',
+                        cliValue: opts.p12Path,
+                        configValue: configP12Path,
+                        orgEnvVarNames: getOrgEnvVarNamesForField('p12Path'),
+                        availableOrgEnvVars,
+                        nonInteractive: opts.nonInteractive,
+                        required: false,
+                    });
+                    configTracker.track('p12Path', p12PathResult.value, p12PathResult.source);
+                    // Only prompt for p12 password if p12 path was provided
+                    if (p12PathResult.value) {
+                        p12PasswordResult = await smartPrompt({
                             name: 'p12Password',
                             message: 'Password for .p12 (if any):',
-                            mask: '*',
-                            default: '',
-                            when: (a) => !a.useAscKey && a.p12Path,
-                        },
-                        {
-                            type: 'input',
-                            name: 'mobileprovisionPath',
-                            message: 'Path to provisioning profile .mobileprovision (optional):',
-                            default: resolvedProfilePath || '',
-                            when: (a) => !a.useAscKey,
-                        },
-                    ]);
-                    // Use resolved teamId from CLI/config, or from prompt
-                    const finalTeamId = trimString(iosAnswers.teamId) || resolvedTeamId;
-                    iosCredentials = {
-                        teamId: finalTeamId || undefined,
-                        p12Base64: readOptionalFileAsBase64(iosAnswers.p12Path),
-                        p12Password: trimString(iosAnswers.p12Password),
-                        mobileprovisionBase64: readOptionalFileAsBase64(iosAnswers.mobileprovisionPath),
-                        ascApiKeyId: trimString(iosAnswers.ascApiKeyId),
-                        ascIssuerId: trimString(iosAnswers.ascIssuerId),
-                        ascPrivateKey: readOptionalFileAsBase64(iosAnswers.ascPrivateKeyPath),
-                        // Track paths for config saving (not sent to API)
-                        _p12Path: trimString(iosAnswers.p12Path),
-                        _mobileprovisionPath: trimString(iosAnswers.mobileprovisionPath),
-                        _ascApiKeyId: trimString(iosAnswers.ascApiKeyId),
-                        _ascIssuerId: trimString(iosAnswers.ascIssuerId),
-                        _ascPrivateKeyPath: trimString(iosAnswers.ascPrivateKeyPath),
-                    };
-                    if (finalTeamId) {
-                        console.log(`Using Apple Team ID: ${finalTeamId}`);
+                            cliValue: opts.p12Password,
+                            configValue: undefined, // Don't save passwords in config
+                            orgEnvVarNames: getOrgEnvVarNamesForField('p12Password'),
+                            availableOrgEnvVars,
+                            nonInteractive: opts.nonInteractive,
+                            mask: true,
+                            required: false,
+                        });
+                        configTracker.track('p12Password', p12PasswordResult.value, p12PasswordResult.source);
                     }
+                    mobileprovisionPathResult = await smartPrompt({
+                        name: 'provisioningProfilePath',
+                        message: 'Path to provisioning profile .mobileprovision (optional):',
+                        cliValue: opts.profilePath,
+                        configValue: configProfilePath,
+                        orgEnvVarNames: getOrgEnvVarNamesForField('provisioningProfilePath'),
+                        availableOrgEnvVars,
+                        nonInteractive: opts.nonInteractive,
+                        required: false,
+                    });
+                    configTracker.track('provisioningProfilePath', mobileprovisionPathResult.value, mobileprovisionPathResult.source);
+                }
+                // Build iosCredentials object
+                // If value is undefined (org env var), don't include in API request
+                iosCredentials = {
+                    teamId: teamIdResult.value || undefined,
+                    p12Base64: p12PathResult?.value ? readOptionalFileAsBase64(p12PathResult.value) : undefined,
+                    p12Password: p12PasswordResult?.value || undefined,
+                    mobileprovisionBase64: mobileprovisionPathResult?.value
+                        ? readOptionalFileAsBase64(mobileprovisionPathResult.value)
+                        : undefined,
+                    ascApiKeyId: ascApiKeyIdResult?.value || undefined,
+                    ascIssuerId: ascIssuerIdResult?.value || undefined,
+                    ascPrivateKey: ascPrivateKeyPathResult?.value
+                        ? readOptionalFileAsBase64(ascPrivateKeyPathResult.value)
+                        : undefined,
+                    // Track paths for config saving (not sent to API)
+                    _p12Path: p12PathResult?.value,
+                    _mobileprovisionPath: mobileprovisionPathResult?.value,
+                    _ascApiKeyId: ascApiKeyIdResult?.value,
+                    _ascIssuerId: ascIssuerIdResult?.value,
+                    _ascPrivateKeyPath: ascPrivateKeyPathResult?.value,
+                };
+                if (teamIdResult.value) {
+                    console.log(`Using Apple Team ID: ${teamIdResult.value}`);
+                }
+                if (teamIdResult.source === 'org-env') {
+                    console.log(`Using organization's iOS credentials`);
                 }
             }
             else if (platform === 'android') {
-                // Resolve values from: CLI flags > config file > environment variables
+                // Use smart prompts for Android credentials
                 const configKeystorePath = norrixConfig.android?.keystorePath;
                 const configKeyAlias = norrixConfig.android?.keyAlias;
-                const resolvedKeystorePath = trimString(opts.keystorePath) ||
-                    configKeystorePath ||
-                    process.env.KEYSTORE_PATH;
-                const resolvedKeystorePassword = trimString(opts.keystorePassword) || process.env.KEYSTORE_PASSWORD;
-                const resolvedKeyAlias = trimString(opts.keyAlias) ||
-                    configKeyAlias ||
-                    process.env.KEYSTORE_ALIAS;
-                const resolvedKeyPassword = trimString(opts.keyPassword) ||
-                    process.env.KEYSTORE_ALIAS_PASSWORD ||
-                    process.env.KEY_PASSWORD;
-                const resolvedPlayJsonPath = trimString(opts.playJsonPath) ||
-                    process.env.PLAY_SERVICE_ACCOUNT_JSON_PATH;
+                // Keystore path
+                const keystorePathResult = await smartPrompt({
+                    name: 'keystorePath',
+                    message: 'Path to Android keystore .jks/.keystore (optional):',
+                    cliValue: opts.keystorePath,
+                    configValue: configKeystorePath,
+                    orgEnvVarNames: getOrgEnvVarNamesForField('keystorePath'),
+                    availableOrgEnvVars,
+                    processEnvNames: ['KEYSTORE_PATH'],
+                    nonInteractive: opts.nonInteractive,
+                    required: false,
+                });
+                configTracker.track('keystorePath', keystorePathResult.value, keystorePathResult.source);
+                // Keystore password
+                const keystorePasswordResult = await smartPrompt({
+                    name: 'keystorePassword',
+                    message: 'Keystore password (optional):',
+                    cliValue: opts.keystorePassword,
+                    configValue: undefined, // Don't save passwords in config
+                    orgEnvVarNames: getOrgEnvVarNamesForField('keystorePassword'),
+                    availableOrgEnvVars,
+                    processEnvNames: ['KEYSTORE_PASSWORD'],
+                    nonInteractive: opts.nonInteractive,
+                    mask: true,
+                    required: false,
+                });
+                configTracker.track('keystorePassword', keystorePasswordResult.value, keystorePasswordResult.source);
+                // Key alias
+                const keyAliasResult = await smartPrompt({
+                    name: 'keyAlias',
+                    message: 'Key alias (optional):',
+                    cliValue: opts.keyAlias,
+                    configValue: configKeyAlias,
+                    orgEnvVarNames: getOrgEnvVarNamesForField('keyAlias'),
+                    availableOrgEnvVars,
+                    processEnvNames: ['KEYSTORE_ALIAS'],
+                    nonInteractive: opts.nonInteractive,
+                    required: false,
+                });
+                configTracker.track('keyAlias', keyAliasResult.value, keyAliasResult.source);
+                // Key password
+                const keyPasswordResult = await smartPrompt({
+                    name: 'keyPassword',
+                    message: 'Key password (optional):',
+                    cliValue: opts.keyPassword,
+                    configValue: undefined, // Don't save passwords in config
+                    orgEnvVarNames: getOrgEnvVarNamesForField('keyPassword'),
+                    availableOrgEnvVars,
+                    processEnvNames: ['KEYSTORE_ALIAS_PASSWORD', 'KEY_PASSWORD'],
+                    nonInteractive: opts.nonInteractive,
+                    mask: true,
+                    required: false,
+                });
+                configTracker.track('keyPassword', keyPasswordResult.value, keyPasswordResult.source);
+                // Google Play service account JSON
+                let playJsonPathResult;
+                // In non-interactive mode, check if value exists
                 if (opts.nonInteractive) {
-                    // Non-interactive mode: use CLI flags, config, and env vars only
-                    // All values are optional - the cloud build will use org-level credentials if not provided
-                    androidCredentials = {
-                        keystoreBase64: readOptionalFileAsBase64(resolvedKeystorePath),
-                        keystorePassword: resolvedKeystorePassword || undefined,
-                        keyAlias: resolvedKeyAlias || undefined,
-                        keyPassword: resolvedKeyPassword || undefined,
-                        playServiceAccountJson: readOptionalFileAsBase64(resolvedPlayJsonPath),
-                    };
-                    if (resolvedKeystorePath) {
-                        logVerbose(`Using keystore from: ${resolvedKeystorePath}`, verbose);
-                    }
-                    if (resolvedKeyAlias) {
-                        logVerbose(`Using key alias: ${resolvedKeyAlias}`, verbose);
-                    }
+                    playJsonPathResult = await smartPrompt({
+                        name: 'playServiceAccountJsonPath',
+                        message: 'Path to Google Play service account JSON (optional):',
+                        cliValue: opts.playJsonPath,
+                        configValue: undefined,
+                        orgEnvVarNames: getOrgEnvVarNamesForField('playServiceAccountJsonPath'),
+                        availableOrgEnvVars,
+                        processEnvNames: ['PLAY_SERVICE_ACCOUNT_JSON_PATH'],
+                        nonInteractive: true,
+                        required: false,
+                    });
                 }
                 else {
-                    // Interactive mode: prompt for values with CLI/config/env as defaults
-                    const androidAnswers = await inquirer.prompt([
-                        {
-                            type: 'input',
-                            name: 'keystorePath',
-                            message: 'Path to Android keystore .jks/.keystore (optional):',
-                            default: resolvedKeystorePath || '',
-                        },
-                        {
-                            type: 'password',
-                            name: 'keystorePassword',
-                            message: 'Keystore password (optional):',
-                            mask: '*',
-                            default: '',
-                        },
-                        {
-                            type: 'input',
-                            name: 'keyAlias',
-                            message: 'Key alias (optional):',
-                            default: resolvedKeyAlias || '',
-                        },
-                        {
-                            type: 'password',
-                            name: 'keyPassword',
-                            message: 'Key password (optional):',
-                            mask: '*',
-                            default: '',
-                        },
+                    // In interactive mode, ask if they want to provide it first
+                    const { hasPlayJson } = await inquirer.prompt([
                         {
                             type: 'confirm',
                             name: 'hasPlayJson',
                             message: 'Provide Google Play service account JSON? (optional, for Play operations)',
                             default: false,
                         },
-                        {
-                            type: 'input',
-                            name: 'playJsonPath',
-                            message: 'Path to Google Play service account JSON (optional):',
-                            default: '',
-                            when: (a) => a.hasPlayJson,
-                        },
                     ]);
-                    androidCredentials = {
-                        keystoreBase64: readOptionalFileAsBase64(androidAnswers.keystorePath),
-                        keystorePassword: trimString(androidAnswers.keystorePassword),
-                        keyAlias: trimString(androidAnswers.keyAlias),
-                        keyPassword: trimString(androidAnswers.keyPassword),
-                        playServiceAccountJson: readOptionalFileAsBase64(androidAnswers.playJsonPath),
-                    };
-                    // Track Android paths for config saving
-                    androidCredentials._keystorePath = trimString(androidAnswers.keystorePath);
-                    androidCredentials._keyAlias = trimString(androidAnswers.keyAlias);
+                    if (hasPlayJson) {
+                        playJsonPathResult = await smartPrompt({
+                            name: 'playServiceAccountJsonPath',
+                            message: 'Path to Google Play service account JSON (optional):',
+                            cliValue: opts.playJsonPath,
+                            configValue: undefined,
+                            orgEnvVarNames: getOrgEnvVarNamesForField('playServiceAccountJsonPath'),
+                            availableOrgEnvVars,
+                            processEnvNames: ['PLAY_SERVICE_ACCOUNT_JSON_PATH'],
+                            nonInteractive: false,
+                            required: false,
+                        });
+                    }
                 }
-            }
-            // Offer to save config if no norrix.config.ts exists and we collected useful values
-            const appRoot = process.cwd();
-            if (!hasNorrixConfig(appRoot) && !opts.nonInteractive) {
-                // Collect saveable values
-                const saveableOptions = {
-                    platform: platform,
+                if (playJsonPathResult) {
+                    configTracker.track('playServiceAccountJsonPath', playJsonPathResult.value, playJsonPathResult.source);
+                }
+                // Build androidCredentials object
+                androidCredentials = {
+                    keystoreBase64: keystorePathResult.value
+                        ? readOptionalFileAsBase64(keystorePathResult.value)
+                        : undefined,
+                    keystorePassword: keystorePasswordResult.value || undefined,
+                    keyAlias: keyAliasResult.value || undefined,
+                    keyPassword: keyPasswordResult.value || undefined,
+                    playServiceAccountJson: playJsonPathResult?.value
+                        ? readOptionalFileAsBase64(playJsonPathResult.value)
+                        : undefined,
                 };
-                if (platform === 'ios' && iosCredentials) {
-                    if (iosCredentials.teamId) {
-                        saveableOptions.teamId = iosCredentials.teamId;
-                    }
-                    if (distributionType) {
-                        saveableOptions.distributionType = distributionType;
-                    }
-                    // Don't save actual credential file paths since they may contain secrets
-                    // But save paths that users can re-use
-                    if (iosCredentials._p12Path) {
-                        saveableOptions.p12Path = iosCredentials._p12Path;
-                    }
-                    if (iosCredentials._mobileprovisionPath) {
-                        saveableOptions.provisioningProfilePath = iosCredentials._mobileprovisionPath;
-                    }
-                    // Save ASC API Key details for future builds
-                    if (iosCredentials._ascApiKeyId) {
-                        saveableOptions.ascApiKeyId = iosCredentials._ascApiKeyId;
-                    }
-                    if (iosCredentials._ascIssuerId) {
-                        saveableOptions.ascIssuerId = iosCredentials._ascIssuerId;
-                    }
-                    if (iosCredentials._ascPrivateKeyPath) {
-                        saveableOptions.ascPrivateKeyPath = iosCredentials._ascPrivateKeyPath;
-                    }
+                if (keystorePathResult.value) {
+                    logVerbose(`Using keystore from: ${keystorePathResult.value}`, verbose);
                 }
-                if (platform === 'android' && androidCredentials) {
-                    if (androidCredentials._keystorePath) {
-                        saveableOptions.keystorePath = androidCredentials._keystorePath;
-                    }
-                    if (androidCredentials._keyAlias) {
-                        saveableOptions.keyAlias = androidCredentials._keyAlias;
-                    }
+                if (keystorePathResult.source === 'org-env') {
+                    console.log(`Using organization's Android credentials`);
                 }
-                // Only offer to save if we have something useful
-                const hasSaveableValues = saveableOptions.teamId ||
-                    saveableOptions.distributionType ||
-                    saveableOptions.p12Path ||
-                    saveableOptions.provisioningProfilePath ||
-                    saveableOptions.keystorePath ||
-                    saveableOptions.ascApiKeyId;
-                if (hasSaveableValues) {
-                    const { shouldSave } = await inquirer.prompt([
-                        {
-                            type: 'confirm',
-                            name: 'shouldSave',
-                            message: 'Save these settings to norrix.config.ts for future builds?',
-                            default: true,
-                        },
-                    ]);
-                    if (shouldSave) {
-                        try {
-                            const savedPath = saveNorrixConfig(appRoot, saveableOptions);
-                            console.log(`✓ Configuration saved to ${path.basename(savedPath)}`);
+            }
+            // Offer to save config if user provided new values
+            const appRoot = process.cwd();
+            if (!opts.nonInteractive && configTracker.shouldOfferToSave()) {
+                const configExists = hasNorrixConfig(appRoot);
+                const { shouldSave } = await inquirer.prompt([
+                    {
+                        type: 'confirm',
+                        name: 'shouldSave',
+                        message: configExists
+                            ? 'Save new credential paths to norrix.config.ts?'
+                            : 'Save credential paths to norrix.config.ts for future builds?',
+                        default: true,
+                    },
+                ]);
+                if (shouldSave) {
+                    try {
+                        const userProvidedValues = configTracker.getUserProvidedValues();
+                        // Start with existing config values (if config exists)
+                        const existingConfig = configExists ? norrixConfig : {};
+                        const saveableOptions = {
+                            platform: platform,
+                        };
+                        // Merge: Start with existing config, then overlay user-provided values
+                        // iOS fields
+                        if (platform === 'ios') {
+                            saveableOptions.teamId = userProvidedValues.teamId || existingConfig.ios?.teamId;
+                            saveableOptions.ascApiKeyId = userProvidedValues.ascApiKeyId || existingConfig.ios?.ascApiKeyId;
+                            saveableOptions.ascIssuerId = userProvidedValues.ascIssuerId || existingConfig.ios?.ascIssuerId;
+                            saveableOptions.ascPrivateKeyPath = userProvidedValues.ascPrivateKeyPath || existingConfig.ios?.ascPrivateKeyPath;
+                            saveableOptions.p12Path = userProvidedValues.p12Path || existingConfig.ios?.p12Path;
+                            saveableOptions.provisioningProfilePath = userProvidedValues.provisioningProfilePath || existingConfig.ios?.provisioningProfilePath;
+                            saveableOptions.distributionType = (distributionType || existingConfig.ios?.distributionType);
                         }
-                        catch (saveError) {
-                            console.warn(`Warning: Could not save config file: ${saveError.message}`);
+                        // Android fields
+                        if (platform === 'android') {
+                            saveableOptions.keystorePath = userProvidedValues.keystorePath || existingConfig.android?.keystorePath;
+                            saveableOptions.keyAlias = userProvidedValues.keyAlias || existingConfig.android?.keyAlias;
+                            saveableOptions.distributionType = (distributionType || existingConfig.android?.distributionType);
                         }
+                        const savedPath = saveNorrixConfig(appRoot, saveableOptions);
+                        console.log(configExists
+                            ? `✓ Configuration updated in ${path.basename(savedPath)}`
+                            : `✓ Configuration saved to ${path.basename(savedPath)}`);
+                    }
+                    catch (saveError) {
+                        console.warn(`Warning: Could not save config file: ${saveError.message}`);
                     }
                 }
             }
@@ -2176,12 +2275,15 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         spinner.succeed('Build started successfully!');
         console.log('✅ Your app is being built on Norrix.');
         console.log(`   Build ID: ${buildId}`);
-        console.log(`   Backend API: ${API_URL}`);
-        if (process.env.NORRIX_API_URL) {
-            console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
-        }
-        if (dispatchedEnv) {
-            console.log(`   Backend env: ${dispatchedEnv}`);
+        // Only show backend details in dev mode
+        if (CURRENT_ENV === 'dev') {
+            console.log(`   Backend API: ${API_URL}`);
+            if (process.env.NORRIX_API_URL) {
+                console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
+            }
+            if (dispatchedEnv) {
+                console.log(`   Backend env: ${dispatchedEnv}`);
+            }
         }
         console.log(formatVersionBuildLine(recordedVersion, recordedBuildNumber));
         console.log(`   Platform: ${platform}`);
@@ -2234,6 +2336,41 @@ export async function build(cliPlatformArg, cliConfigurationArg, cliDistribution
         }
     }
 }
+/**
+ * Prompt for TestFlight group names for external testing distribution.
+ * Shows confirmation to use default group or enter custom group names.
+ */
+async function promptForTestFlightGroups(configGroups) {
+    const { useDefaultGroup } = await inquirer.prompt([
+        {
+            type: 'confirm',
+            name: 'useDefaultGroup',
+            message: `Use the default TestFlight group 'External Testers'?\n\n` +
+                `When using External testing, make sure the group exists in App Store Connect.\n` +
+                `Choose 'Y' if you have a group named 'External Testers' already created.\n` +
+                `Choose 'N' to enter custom group names.`,
+            default: true,
+        },
+    ]);
+    if (useDefaultGroup) {
+        return configGroups || ['External Testers'];
+    }
+    const { groupNames } = await inquirer.prompt([
+        {
+            type: 'input',
+            name: 'groupNames',
+            message: 'Please enter TestFlight group name(s) (comma-separated):',
+            validate: (input) => {
+                const trimmed = input.trim();
+                return trimmed.length > 0 || 'At least one group name is required';
+            },
+        },
+    ]);
+    return groupNames
+        .split(',')
+        .map((g) => g.trim())
+        .filter((g) => g.length > 0);
+}
 /**
  * Submit command implementation
  * Submits the built app to app stores via the Next.js API gateway
@@ -2270,6 +2407,10 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
         }
         // Load Norrix config file from the resolved app directory
         const norrixConfig = await loadNorrixConfig(process.cwd());
+        // Fetch org env vars for smart prompting
+        const availableOrgEnvVars = await fetchOrgEnvVarNames(API_URL, await getAuthHeaders({ includeOrg: true }), verbose);
+        // Track user-provided values for potential config saving
+        const configTracker = new ConfigValueTracker();
         if (verbose) {
             console.log(`[submit] Resolved workspace context: ${resolved.workspaceContext.type}`);
             console.log(`[submit] App root: ${resolved.workspaceContext.appRoot}`);
@@ -2277,8 +2418,15 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
             if (norrixConfig.ios?.ascApiKeyId) {
                 console.log(`[submit] Found ASC credentials in norrix.config.ts`);
             }
+            if (availableOrgEnvVars.length > 0) {
+                console.log(`[submit] Available org env vars: ${availableOrgEnvVars.join(', ')}`);
+            }
         }
-        // 1. Get available builds to show in prompt
+        // 1. Determine platform from CLI arg first (to filter builds)
+        const validPlatforms = ['android', 'ios', 'visionos'];
+        let platform = (cliPlatformArg || '').toLowerCase();
+        const platformSpecified = validPlatforms.includes(platform);
+        // 2. Get available builds to show in prompt
         spinner.text = 'Fetching available builds...';
         let availableBuilds = [];
         try {
@@ -2288,9 +2436,13 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
             if (buildsResponse.data.builds &&
                 Array.isArray(buildsResponse.data.builds)) {
                 // Filter for successful builds
-                availableBuilds = buildsResponse.data.builds
-                    .filter((build) => build.status === 'success')
-                    .map((build) => {
+                let builds = buildsResponse.data.builds
+                    .filter((build) => build.status === 'success');
+                // If platform was specified in CLI arg, filter to only that platform
+                if (platformSpecified) {
+                    builds = builds.filter((build) => build.platform === platform);
+                }
+                availableBuilds = builds.map((build) => {
                     return {
                         name: `${build.projectName} (${build.platform} - ${build.version} (${build.buildNumber}) - ${build.id})`,
                         value: build.id,
@@ -2304,7 +2456,7 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
         catch (error) {
             spinner.warn("Could not fetch builds. You'll need to enter the Build ID manually.");
         }
-        // 2. Gather submission details from user
+        // 3. Gather submission details from user
         spinner.stop();
         // Ask for build ID
         let buildId;
@@ -2330,9 +2482,7 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
             ]);
             buildId = buildIdAnswer.buildId;
         }
-        // Determine platform, preferring CLI arg, then build metadata, then prompt
-        let platform = (cliPlatformArg || '').toLowerCase();
-        const validPlatforms = ['android', 'ios', 'visionos'];
+        // If platform wasn't specified, determine from selected build or prompt
         // Fallback to platform from selected build if CLI arg missing/invalid
         if (!validPlatforms.includes(platform)) {
             const selectedBuild = availableBuilds.find((build) => build.value === buildId);
@@ -2352,26 +2502,53 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
             ]);
             platform = platformAnswer.platform;
         }
-        // Common configuration for both platforms (track)
+        // Platform-specific track configuration
         const validTracks = ['production', 'beta', 'alpha', 'internal'];
+        let trackChoices;
+        if (platform === 'ios' || platform === 'visionos') {
+            trackChoices = [
+                { name: 'Internal testing', value: 'internal' },
+                { name: 'External testing', value: 'beta' },
+            ];
+        }
+        else if (platform === 'android') {
+            trackChoices = [
+                { name: 'Internal testing', value: 'internal' },
+                { name: 'Closed testing', value: 'alpha' },
+                { name: 'Open testing', value: 'beta' },
+                { name: 'Production', value: 'production' },
+            ];
+        }
+        else {
+            // Fallback for unknown platforms
+            trackChoices = [
+                { name: 'Internal testing', value: 'internal' },
+                { name: 'External testing', value: 'beta' },
+            ];
+        }
+        // Show track prompt if not provided via CLI
         let track = (cliTrackArg || '').toLowerCase();
-        if (!validTracks.includes(track)) {
+        if (!validTracks.includes(track) && !options?.nonInteractive) {
             const trackAnswer = await inquirer.prompt([
                 {
                     type: 'list',
                     name: 'track',
                     message: 'Select release track:',
-                    choices: [
-                        { name: 'Production', value: 'production' },
-                        { name: 'Beta', value: 'beta' },
-                        { name: 'Alpha', value: 'alpha' },
-                        { name: 'Internal testing', value: 'internal' },
-                    ],
-                    default: 'production',
+                    choices: trackChoices,
+                    default: 'internal',
                 },
             ]);
             track = trackAnswer.track;
         }
+        // Validate track for platform
+        if ((platform === 'ios' || platform === 'visionos') && !['internal', 'beta'].includes(track)) {
+            if (options?.nonInteractive) {
+                throw new Error(`Invalid track '${track}' for iOS/visionOS. Use 'internal' or 'beta'.`);
+            }
+            // Fall back to internal if invalid
+            console.warn(`⚠️  Track '${track}' not supported for iOS/visionOS. Using 'internal'.`);
+            track = 'internal';
+        }
         // Platform-specific configuration
         let credentials = {};
         // For iOS, use config values or ask for App Store account
@@ -2410,35 +2587,49 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
                 };
             }
             else {
-                // Fall back to prompting for credentials
+                // Fall back to prompting for credentials using smart prompts
                 if (hasConfigAscCredentials && !fs.existsSync(configAscKeyPath)) {
                     console.warn(`⚠️ ASC private key not found at: ${configAscKeyPath}`);
                 }
-                const iosConfig = await inquirer.prompt([
+                // Use smart prompts for ASC credentials
+                const ascApiKeyIdResult = await smartPrompt({
+                    name: 'ascApiKeyId',
+                    message: 'App Store Connect (ASC) API Key ID (optional):',
+                    configValue: configAscKeyId,
+                    orgEnvVarNames: getOrgEnvVarNamesForField('ascApiKeyId'),
+                    availableOrgEnvVars,
+                    nonInteractive: options?.nonInteractive,
+                    required: false,
+                });
+                configTracker.track('ascApiKeyId', ascApiKeyIdResult.value, ascApiKeyIdResult.source);
+                const ascIssuerIdResult = await smartPrompt({
+                    name: 'ascIssuerId',
+                    message: 'App Store Connect (ASC) Issuer ID (optional):',
+                    configValue: configAscIssuerId,
+                    orgEnvVarNames: getOrgEnvVarNamesForField('ascIssuerId'),
+                    availableOrgEnvVars,
+                    nonInteractive: options?.nonInteractive,
+                    required: false,
+                });
+                configTracker.track('ascIssuerId', ascIssuerIdResult.value, ascIssuerIdResult.source);
+                const ascPrivateKeyPathResult = await smartPrompt({
+                    name: 'ascPrivateKeyPath',
+                    message: 'Path to App Store Connect (ASC) API key (optional):',
+                    configValue: configAscKeyPath,
+                    orgEnvVarNames: getOrgEnvVarNamesForField('ascPrivateKeyPath'),
+                    availableOrgEnvVars,
+                    nonInteractive: options?.nonInteractive,
+                    required: false,
+                });
+                configTracker.track('ascPrivateKeyPath', ascPrivateKeyPathResult.value, ascPrivateKeyPathResult.source);
+                // Non-credential prompts (username, generate certificate, notes)
+                const { appleId, generateCertificate, notes } = await inquirer.prompt([
                     {
                         type: 'input',
                         name: 'appleId',
                         message: 'App Store Connect username (optional):',
                         default: '',
                     },
-                    {
-                        type: 'input',
-                        name: 'apiKeyPath',
-                        message: 'Path to App Store Connect API key (optional):',
-                        default: configAscKeyPath || '',
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascKeyId',
-                        message: 'App Store Connect API Key ID (optional):',
-                        default: configAscKeyId || '',
-                    },
-                    {
-                        type: 'input',
-                        name: 'ascIssuerId',
-                        message: 'App Store Connect Issuer ID (optional):',
-                        default: configAscIssuerId || '',
-                    },
                     {
                         type: 'confirm',
                         name: 'generateCertificate',
@@ -2452,38 +2643,55 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
                         default: '',
                     },
                 ]);
+                // Collect TestFlight groups for external testing (beta track)
+                let testflightGroups;
+                if (track === 'beta' && !options?.nonInteractive) {
+                    testflightGroups = await promptForTestFlightGroups(norrixConfig.ios?.testflightGroups);
+                }
+                else if (track === 'beta') {
+                    // Non-interactive mode: use config groups or default
+                    testflightGroups = norrixConfig.ios?.testflightGroups || ['External Testers'];
+                }
                 // Build iOS credentials if provided
-                const ascKeyPath = normalizePath(iosConfig.apiKeyPath);
-                if (iosConfig.ascKeyId &&
-                    iosConfig.ascIssuerId &&
+                const ascKeyPath = normalizePath(ascPrivateKeyPathResult.value);
+                if (ascApiKeyIdResult.value &&
+                    ascIssuerIdResult.value &&
                     ascKeyPath &&
                     fs.existsSync(ascKeyPath)) {
                     const ascPrivateKeyContent = fs.readFileSync(ascKeyPath, 'utf8');
                     const ascPrivateKeyBase64 = Buffer.from(ascPrivateKeyContent).toString('base64');
                     credentials.iosCredentials = {
-                        ascApiKeyId: iosConfig.ascKeyId,
-                        ascIssuerId: iosConfig.ascIssuerId,
+                        ascApiKeyId: ascApiKeyIdResult.value,
+                        ascIssuerId: ascIssuerIdResult.value,
                         ascPrivateKey: ascPrivateKeyBase64,
                         ...(configTeamId ? { teamId: configTeamId } : {}),
+                        ...(testflightGroups ? { testflightGroups: testflightGroups.join(',') } : {}),
                     };
                 }
                 credentials = {
                     ...credentials,
-                    appleId: iosConfig.appleId,
-                    generateCertificate: iosConfig.generateCertificate,
-                    notes: iosConfig.notes,
+                    appleId,
+                    generateCertificate,
+                    notes,
                 };
             }
         }
         // For Android, ask for Play Store account
         if (platform === 'android') {
-            const androidConfig = await inquirer.prompt([
-                {
-                    type: 'input',
-                    name: 'serviceAccountKeyPath',
-                    message: 'Path to Google Play service account key (optional):',
-                    default: '',
-                },
+            // Use smart prompt for service account key
+            // Note: playServiceAccountJsonPath is not yet in NorrixAndroidConfig interface, so using undefined for now
+            const playServiceAccountJsonPathResult = await smartPrompt({
+                name: 'playServiceAccountJsonPath',
+                message: 'Path to Google Play service account key (optional):',
+                configValue: undefined, // Not yet supported in norrix.config.ts
+                orgEnvVarNames: getOrgEnvVarNamesForField('playServiceAccountJsonPath'),
+                availableOrgEnvVars,
+                nonInteractive: options?.nonInteractive,
+                required: false,
+            });
+            configTracker.track('playServiceAccountJsonPath', playServiceAccountJsonPathResult.value, playServiceAccountJsonPathResult.source);
+            // Non-credential prompts
+            const { generateKeystore, notes } = await inquirer.prompt([
                 {
                     type: 'confirm',
                     name: 'generateKeystore',
@@ -2498,9 +2706,9 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
                 },
             ]);
             credentials = {
-                serviceAccountKeyPath: androidConfig.serviceAccountKeyPath,
-                generateKeystore: androidConfig.generateKeystore,
-                notes: androidConfig.notes,
+                serviceAccountKeyPath: playServiceAccountJsonPathResult.value,
+                generateKeystore,
+                notes,
             };
         }
         spinner.start(`Submitting build to ${platform === 'android' ? 'Google Play' : 'App Store'}...`);
@@ -2554,17 +2762,72 @@ export async function submit(cliPlatformArg, cliTrackArg, verbose = false, optio
         }
         console.log('✅ Your app submission request was received.');
         console.log(`   Submission ID: ${submitId}`);
-        console.log(`   Backend API: ${API_URL}`);
-        if (process.env.NORRIX_API_URL) {
-            console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
-        }
-        if (dispatchedEnv) {
-            console.log(`   Backend env: ${dispatchedEnv}`);
+        // Only show backend details in dev mode
+        if (CURRENT_ENV === 'dev') {
+            console.log(`   Backend API: ${API_URL}`);
+            if (process.env.NORRIX_API_URL) {
+                console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
+            }
+            if (dispatchedEnv) {
+                console.log(`   Backend env: ${dispatchedEnv}`);
+            }
         }
         console.log(`   Platform: ${platform === 'android' ? 'Google Play Store' : 'Apple App Store'}`);
         console.log(formatVersionBuildLine(submittedVersion, submittedBuildNumber));
         console.log(`   Track: ${track}`);
         console.log(`   You can check the status with: norrix submit-status ${submitId}`);
+        // Offer to save config if user provided new values
+        const appRoot = process.cwd();
+        if (!options?.nonInteractive && configTracker.shouldOfferToSave()) {
+            const configExists = hasNorrixConfig(appRoot);
+            const { shouldSave } = await inquirer.prompt([
+                {
+                    type: 'confirm',
+                    name: 'shouldSave',
+                    message: configExists
+                        ? 'Save new credential paths to norrix.config.ts?'
+                        : 'Save credential paths to norrix.config.ts for future submissions?',
+                    default: true,
+                },
+            ]);
+            if (shouldSave) {
+                try {
+                    const userProvidedValues = configTracker.getUserProvidedValues();
+                    // Start with existing config values (if config exists)
+                    const existingConfig = configExists ? norrixConfig : {};
+                    const saveableOptions = {
+                        platform: platform,
+                    };
+                    // Merge: Start with existing config, then overlay user-provided values
+                    // iOS fields
+                    if (platform === 'ios') {
+                        saveableOptions.ascApiKeyId = userProvidedValues.ascApiKeyId || existingConfig.ios?.ascApiKeyId;
+                        saveableOptions.ascIssuerId = userProvidedValues.ascIssuerId || existingConfig.ios?.ascIssuerId;
+                        saveableOptions.ascPrivateKeyPath = userProvidedValues.ascPrivateKeyPath || existingConfig.ios?.ascPrivateKeyPath;
+                        // Preserve other iOS config values
+                        saveableOptions.teamId = existingConfig.ios?.teamId;
+                        saveableOptions.distributionType = existingConfig.ios?.distributionType;
+                        saveableOptions.p12Path = existingConfig.ios?.p12Path;
+                        saveableOptions.provisioningProfilePath = existingConfig.ios?.provisioningProfilePath;
+                    }
+                    // Android fields
+                    if (platform === 'android') {
+                        // Note: playServiceAccountJsonPath not yet in config interface
+                        // Preserve existing Android config values
+                        saveableOptions.keystorePath = existingConfig.android?.keystorePath;
+                        saveableOptions.keyAlias = existingConfig.android?.keyAlias;
+                        saveableOptions.distributionType = existingConfig.android?.distributionType;
+                    }
+                    const savedPath = saveNorrixConfig(appRoot, saveableOptions);
+                    console.log(configExists
+                        ? `✓ Configuration updated in ${path.basename(savedPath)}`
+                        : `✓ Configuration saved to ${path.basename(savedPath)}`);
+                }
+                catch (saveError) {
+                    console.warn(`Warning: Could not save config file: ${saveError.message}`);
+                }
+            }
+        }
         // Restore original cwd if we changed it
         if (originalCwd && process.cwd() !== originalCwd) {
             process.chdir(originalCwd);
@@ -2868,7 +3131,10 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
         // the user that this OTA will require a new store binary and let
         // them decide whether to proceed or cancel.
         try {
-            const latestBuild = await getLatestSuccessfulBuildForApp(appId, platform, verbose);
+            // When a specific version is provided, look for builds matching that version.
+            // This enables targeting specific version series for OTA updates (e.g., hotfix for 1.1.0 while 2.0.0 exists)
+            const latestBuild = await getLatestSuccessfulBuildForApp(appId, platform, verbose, version // Pass the target version to filter builds
+            );
             if (latestBuild?.id) {
                 const baseFp = await fetchBuildFingerprint(latestBuild.id, verbose);
                 if (baseFp) {
@@ -3016,12 +3282,15 @@ export async function update(cliPlatformArg, cliVersionArg, verbose = false, opt
         spinner.succeed('Update published successfully!');
         console.log('✅ Your update has been published.');
         console.log(`   Update ID: ${updateId}`);
-        console.log(`   Backend API: ${API_URL}`);
-        if (process.env.NORRIX_API_URL) {
-            console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
-        }
-        if (dispatchedEnv) {
-            console.log(`   Backend env: ${dispatchedEnv}`);
+        // Only show backend details in dev mode
+        if (CURRENT_ENV === 'dev') {
+            console.log(`   Backend API: ${API_URL}`);
+            if (process.env.NORRIX_API_URL) {
+                console.log(`   NORRIX_API_URL: ${process.env.NORRIX_API_URL}`);
+            }
+            if (dispatchedEnv) {
+                console.log(`   Backend env: ${dispatchedEnv}`);
+            }
         }
         console.log(formatVersionBuildLine(recordedUpdateVersion, recordedUpdateBuildNumber));
         console.log(`   You can check the status with: norrix update-status ${updateId}`);