@seeka-labs/cli-apps-azure 3.10.0 → 3.10.2

package/dist/index.cjs

@@ -5730,7 +5730,7 @@ var require_commander = __commonJS({
 var version;
 var init_package = __esm({
   "../cli-apps/package.json"() {
-    version = "3.10.0";
+    version = "3.10.2";
   }
 });
 
@@ -33490,140 +33490,6 @@ var init_auth = __esm({
   }
 });
 
-// src/github/services/repo/index.ts
-async function createRepository(octokit, options) {
-  try {
-    console.log(`
-\u{1F4E6} Creating GitHub repository: ${options.name}...`);
-    let data;
-    if (options.org) {
-      const response = await octokit.repos.createInOrg({
-        org: options.org,
-        name: options.name,
-        description: options.description || `Seeka app: ${options.name}`,
-        private: options.private ?? true,
-        auto_init: true
-        // Initialize with README
-      });
-      data = response.data;
-    } else {
-      const response = await octokit.repos.createForAuthenticatedUser({
-        name: options.name,
-        description: options.description || `Seeka app: ${options.name}`,
-        private: options.private ?? true,
-        auto_init: true
-        // Initialize with README
-      });
-      data = response.data;
-    }
-    console.log(`\u2713 Repository created: ${data.html_url}
-`);
-    await createBranchRuleset(octokit, data.owner.login, data.name);
-    return {
-      owner: data.owner.login,
-      repo: data.name
-    };
-  } catch (error) {
-    if (error.status === 422) {
-      throw new Error(`Repository '${options.name}' already exists`);
-    }
-    throw new Error(`Failed to create repository: ${error.message}`);
-  }
-}
-async function deleteRepositoryVariable(octokit, owner, repo, variableName) {
-  try {
-    await octokit.actions.deleteRepoVariable({
-      owner,
-      repo,
-      name: variableName
-    });
-    console.log(`  \u2713 Deleted repository variable: ${variableName}`);
-  } catch (error) {
-    if (error.status === 404) {
-      return;
-    }
-    throw new Error(`Failed to delete repository variable '${variableName}': ${error.message}`);
-  }
-}
-async function getAuthenticatedUser(octokit) {
-  try {
-    const { data } = await octokit.users.getAuthenticated();
-    return data.login;
-  } catch (error) {
-    throw new Error(`Failed to get authenticated user: ${error.message}`);
-  }
-}
-async function getUserOrganizations(octokit) {
-  try {
-    const { data } = await octokit.orgs.listForAuthenticatedUser();
-    return data.map((org) => ({
-      login: org.login,
-      description: org.description
-    }));
-  } catch (error) {
-    throw new Error(`Failed to get user organizations: ${error.message}`);
-  }
-}
-async function createBranchRuleset(octokit, owner, repo) {
-  try {
-    console.log(`\u{1F6E1}\uFE0F  Creating branch ruleset: "Org admins only allowed to commit to main branch"...`);
-    await octokit.request("POST /repos/{owner}/{repo}/rulesets", {
-      owner,
-      repo,
-      name: "Org admins only allowed to commit to main branch",
-      target: "branch",
-      enforcement: "active",
-      conditions: {
-        ref_name: {
-          include: ["refs/heads/main"],
-          exclude: []
-        }
-      },
-      rules: [
-        {
-          type: "pull_request",
-          parameters: {
-            required_approving_review_count: 1,
-            dismiss_stale_reviews_on_push: false,
-            require_code_owner_review: false,
-            require_last_push_approval: false,
-            required_review_thread_resolution: false
-          }
-        },
-        {
-          type: "creation"
-        },
-        {
-          type: "update"
-        },
-        {
-          type: "deletion"
-        },
-        {
-          type: "non_fast_forward"
-        }
-      ],
-      bypass_actors: [
-        {
-          actor_id: 1,
-          // Organization admin role
-          actor_type: "OrganizationAdmin",
-          bypass_mode: "always"
-        }
-      ]
-    });
-    console.log(`  \u2713 Branch ruleset created successfully
-`);
-  } catch (error) {
-    throw new Error(`Failed to create branch ruleset: ${error.message}`);
-  }
-}
-var init_repo = __esm({
-  "src/github/services/repo/index.ts"() {
-    "use strict";
-  }
-});
-
 // ../../node_modules/libsodium/dist/modules-esm/libsodium.mjs
 var __filename, __dirname3, Module, Module, root, window_, crypto_, randomValuesStandard, crypto, randomValueNodeJS, _Module, libsodium_default;
 var init_libsodium = __esm({
@@ -80164,6 +80030,199 @@ var init_libsodium_wrappers = __esm({
   }
 });
 
+// src/github/services/repo/index.ts
+async function createRepository(octokit, options) {
+  try {
+    console.log(`
+\u{1F4E6} Creating GitHub repository: ${options.name}...`);
+    let data;
+    if (options.org) {
+      const response = await octokit.repos.createInOrg({
+        org: options.org,
+        name: options.name,
+        description: options.description || `Seeka app: ${options.name}`,
+        private: options.private ?? true,
+        auto_init: true
+        // Initialize with README
+      });
+      data = response.data;
+    } else {
+      const response = await octokit.repos.createForAuthenticatedUser({
+        name: options.name,
+        description: options.description || `Seeka app: ${options.name}`,
+        private: options.private ?? true,
+        auto_init: true
+        // Initialize with README
+      });
+      data = response.data;
+    }
+    console.log(`\u2713 Repository created: ${data.html_url}
+`);
+    await createBranchRuleset(octokit, data.owner.login, data.name);
+    return {
+      owner: data.owner.login,
+      repo: data.name
+    };
+  } catch (error) {
+    if (error.status === 422) {
+      throw new Error(`Repository '${options.name}' already exists`);
+    }
+    throw new Error(`Failed to create repository: ${error.message}`);
+  }
+}
+async function setRepositoryVariable(octokit, owner, repo, variable) {
+  try {
+    let exists = false;
+    try {
+      await octokit.actions.getRepoVariable({
+        owner,
+        repo,
+        name: variable.name
+      });
+      exists = true;
+    } catch (error) {
+      if (error.status !== 404) {
+        throw error;
+      }
+    }
+    if (exists) {
+      await octokit.actions.updateRepoVariable({
+        owner,
+        repo,
+        name: variable.name,
+        value: variable.value
+      });
+    } else {
+      await octokit.actions.createRepoVariable({
+        owner,
+        repo,
+        name: variable.name,
+        value: variable.value
+      });
+    }
+    console.log(`  \u2713 Set repository variable: ${variable.name}`);
+  } catch (error) {
+    throw new Error(`Failed to set repository variable '${variable.name}': ${error.message}`);
+  }
+}
+async function deleteRepositoryVariable(octokit, owner, repo, variableName) {
+  try {
+    await octokit.actions.deleteRepoVariable({
+      owner,
+      repo,
+      name: variableName
+    });
+    console.log(`  \u2713 Deleted repository variable: ${variableName}`);
+  } catch (error) {
+    if (error.status === 404) {
+      return;
+    }
+    throw new Error(`Failed to delete repository variable '${variableName}': ${error.message}`);
+  }
+}
+async function getAuthenticatedUser(octokit) {
+  try {
+    const { data } = await octokit.users.getAuthenticated();
+    return data.login;
+  } catch (error) {
+    throw new Error(`Failed to get authenticated user: ${error.message}`);
+  }
+}
+async function getUserOrganizations(octokit) {
+  try {
+    const { data } = await octokit.orgs.listForAuthenticatedUser();
+    return data.map((org) => ({
+      login: org.login,
+      description: org.description
+    }));
+  } catch (error) {
+    throw new Error(`Failed to get user organizations: ${error.message}`);
+  }
+}
+async function createBranchRuleset(octokit, owner, repo) {
+  try {
+    console.log(`\u{1F6E1}\uFE0F  Creating branch ruleset: "Org admins only allowed to commit to main branch"...`);
+    await octokit.request("POST /repos/{owner}/{repo}/rulesets", {
+      owner,
+      repo,
+      name: "Org admins only allowed to commit to main branch",
+      target: "branch",
+      enforcement: "active",
+      conditions: {
+        ref_name: {
+          include: ["refs/heads/main"],
+          exclude: []
+        }
+      },
+      rules: [
+        {
+          type: "pull_request",
+          parameters: {
+            required_approving_review_count: 1,
+            dismiss_stale_reviews_on_push: false,
+            require_code_owner_review: false,
+            require_last_push_approval: false,
+            required_review_thread_resolution: false
+          }
+        },
+        {
+          type: "creation"
+        },
+        {
+          type: "update"
+        },
+        {
+          type: "deletion"
+        },
+        {
+          type: "non_fast_forward"
+        }
+      ],
+      bypass_actors: [
+        {
+          actor_id: 1,
+          // Organization admin role
+          actor_type: "OrganizationAdmin",
+          bypass_mode: "always"
+        }
+      ]
+    });
+    console.log(`  \u2713 Branch ruleset created successfully
+`);
+  } catch (error) {
+    throw new Error(`Failed to create branch ruleset: ${error.message}`);
+  }
+}
+async function encryptSecretValue(value, base64PublicKey) {
+  await libsodium_wrappers_default.ready;
+  const messageBytes = libsodium_wrappers_default.from_string(value);
+  const keyBytes = libsodium_wrappers_default.from_base64(base64PublicKey, libsodium_wrappers_default.base64_variants.ORIGINAL);
+  const encryptedBytes = libsodium_wrappers_default.crypto_box_seal(messageBytes, keyBytes);
+  return libsodium_wrappers_default.to_base64(encryptedBytes, libsodium_wrappers_default.base64_variants.ORIGINAL);
+}
+async function setRepositorySecret(octokit, owner, repo, secret) {
+  try {
+    const { data: keyData } = await octokit.actions.getRepoPublicKey({ owner, repo });
+    const encrypted_value = await encryptSecretValue(secret.value, keyData.key);
+    await octokit.actions.createOrUpdateRepoSecret({
+      owner,
+      repo,
+      secret_name: secret.name,
+      encrypted_value,
+      key_id: keyData.key_id
+    });
+    console.log(`  \u2713 Set repository secret: ${secret.name}`);
+  } catch (error) {
+    throw new Error(`Failed to set repository secret '${secret.name}': ${error.message}`);
+  }
+}
+var init_repo = __esm({
+  "src/github/services/repo/index.ts"() {
+    "use strict";
+    init_libsodium_wrappers();
+  }
+});
+
 // src/github/services/environment/index.ts
 async function createEnvironment(octokit, owner, repo, environmentName) {
   try {
@@ -80230,7 +80289,7 @@ async function getEnvironmentPublicKey(octokit, owner, repo, environmentName) {
     key_id: data.key_id
   };
 }
-async function encryptSecretValue(value, base64PublicKey) {
+async function encryptSecretValue2(value, base64PublicKey) {
   await libsodium_wrappers_default.ready;
   const messageBytes = libsodium_wrappers_default.from_string(value);
   const keyBytes = libsodium_wrappers_default.from_base64(base64PublicKey, libsodium_wrappers_default.base64_variants.ORIGINAL);
@@ -80240,7 +80299,7 @@ async function encryptSecretValue(value, base64PublicKey) {
 async function setEnvironmentSecret(octokit, owner, repo, environmentName, secret) {
   try {
     const { key, key_id } = await getEnvironmentPublicKey(octokit, owner, repo, environmentName);
-    const encrypted_value = await encryptSecretValue(secret.value, key);
+    const encrypted_value = await encryptSecretValue2(secret.value, key);
     await octokit.actions.createOrUpdateEnvironmentSecret({
       owner,
       repo,
@@ -104662,7 +104721,7 @@ npmScopes:
 var version2;
 var init_package2 = __esm({
   "package.json"() {
-    version2 = "3.10.0";
+    version2 = "3.10.2";
   }
 });
 
@@ -105035,6 +105094,18 @@ async function initAppCommand2(config) {
       private: true,
       org: selectedOwner
     });
+    if (answers.npmUsername) {
+      await setRepositoryVariable(octokit, owner, repo, {
+        name: "INTERNAL_NPM_AUTH_USERNAME",
+        value: answers.npmUsername
+      });
+    }
+    if (answers.npmPassword) {
+      await setRepositorySecret(octokit, owner, repo, {
+        name: "INTERNAL_NPM_AUTH_PASSWORD",
+        value: answers.npmPassword
+      });
+    }
     const prodEnvironmentName = `prod`;
     await createEnvironment(octokit, owner, repo, prodEnvironmentName);
     await setEnvironmentVariables(octokit, owner, repo, prodEnvironmentName, [
@@ -105207,72 +105278,81 @@ async function initEnvironmentCommand(config) {
     const environmentType = envTypeAnswer.environmentType;
     const isStaging = environmentType === "staging";
     const defaultEnvName = isStaging ? "stag" : "prod";
+    const appConfigPath = resolveAppConfigPath(process.cwd());
+    const appConfig = readJsonFile(appConfigPath);
+    const defaultGithubOwner = appConfig?.githubOwner ?? "";
+    const defaultAppName = appConfig?.appName ?? config.appName;
+    const existingEnvConfigPath = resolveEnvironmentConfigPath(process.cwd(), defaultEnvName);
+    const existingEnvConfig = readJsonFile(existingEnvConfigPath);
     const envSecretsPath = resolveEnvironmentSecretsConfigPath(defaultEnvName);
     let envSecretsConfig = readInitConfig(envSecretsPath);
     if (!envSecretsConfig && !isStaging) {
       const legacyPath = resolveSecretsConfigPath();
       envSecretsConfig = readInitConfig(legacyPath);
     }
-    const envDefaults = isStaging ? {} : envSecretsConfig?.environmentVariables ?? {};
+    const envDefaults = existingEnvConfig?.environmentVariables ?? envSecretsConfig?.environmentVariables ?? {};
+    const defaultAzureRg = existingEnvConfig?.azureFunctionResourceGroupName ?? config.azureFunctionResourceGroupName ?? "";
+    const defaultAzureFuncResourceName = existingEnvConfig?.azureFunctionResourceName ?? "";
     const answers = await dist_default12.prompt([
       {
         type: "input",
         name: "owner",
         message: addEnvCommand.interactive.owner.message,
+        default: defaultGithubOwner,
         validate: (input) => input.trim() !== "" || addEnvCommand.interactive.owner.validation.required
       },
       {
         type: "input",
         name: "repo",
         message: addEnvCommand.interactive.repo.message,
-        default: `seeka-app-${config.appName}`,
+        default: `seeka-app-${defaultAppName}`,
         validate: (input) => input.trim() !== "" || addEnvCommand.interactive.repo.validation.required
       },
       {
         type: "input",
         name: "environmentName",
         message: addEnvCommand.interactive.environmentName.message,
-        default: isStaging ? "stag" : "prod",
+        default: defaultEnvName,
         validate: (input) => input.trim() !== "" || addEnvCommand.interactive.environmentName.validation.required
       },
       {
         type: "input",
         name: "azureFunctionResourceGroupName",
         message: addEnvCommand.interactive.azureFunctionResourceGroupName.message,
-        default: config.azureFunctionResourceGroupName ?? "",
+        default: defaultAzureRg,
         validate: (input) => input.trim() !== "" || addEnvCommand.interactive.azureFunctionResourceGroupName.validation.required
       },
       {
         type: "input",
         name: "azureFuncResourceName",
         message: sharedEnvConfigPrompts.azureFuncResourceName.message,
-        default: isStaging ? `seeka-app-${config.appName}-staging` : `seeka-app-${config.appName}`,
+        default: defaultAzureFuncResourceName || (isStaging ? `seeka-app-${defaultAppName}-staging` : `seeka-app-${defaultAppName}`),
         validate: (input) => input.trim() !== "" || sharedEnvConfigPrompts.azureFuncResourceName.validation.required
       },
       {
         type: "input",
         name: "viteBaseUrl",
         message: addEnvCommand.interactive.viteBaseUrl.message,
-        default: `/${config.appName}/app/`,
+        default: envDefaults.VITE_BASE_URL || `/${defaultAppName}/app/`,
         validate: (input) => input.trim() !== "" || addEnvCommand.interactive.viteBaseUrl.validation.required
       },
       {
         type: "input",
         name: "viteUrlsSeekaApiCore",
         message: addEnvCommand.interactive.viteUrlsSeekaApiCore.message,
-        default: ""
+        default: envDefaults.VITE_URLS_SEEKA_API_CORE || ""
       },
       {
         type: "input",
         name: "viteUrlsSeekaAppCoreOrigin",
         message: addEnvCommand.interactive.viteUrlsSeekaAppCoreOrigin.message,
-        default: ""
+        default: envDefaults.VITE_URLS_SEEKA_APP_CORE_ORIGIN || ""
       },
       {
         type: "input",
         name: "hostingEnvName",
         message: addEnvCommand.interactive.hostingEnvName.message,
-        default: isStaging ? "stag" : "prod",
+        default: envDefaults.HOSTING_ENV_NAME || (isStaging ? "stag" : "prod"),
         validate: (input) => input.trim() !== "" || addEnvCommand.interactive.hostingEnvName.validation.required
       },
       {
@@ -105339,12 +105419,6 @@ async function initEnvironmentCommand(config) {
         message: sharedEnvConfigPrompts.otelExporterOtlpLogsHeaders.message,
         default: envDefaults.OTEL_EXPORTER_OTLP_LOGS_HEADERS ?? ""
       },
-      {
-        type: "input",
-        name: "selfHostBaseUrl",
-        message: sharedEnvConfigPrompts.selfHostBaseUrl.message,
-        default: isStaging ? `https://apps.seeka.services/${config.appName}-staging` : envDefaults.SELF_HOST_BASEURL ?? `https://apps.seeka.services/${config.appName}`
-      },
       {
         type: "input",
         name: "otelExporterOtlpTracesEndpoint",
@@ -105357,6 +105431,12 @@ async function initEnvironmentCommand(config) {
         message: sharedEnvConfigPrompts.otelExporterOtlpTracesHeaders.message,
         default: envDefaults.OTEL_EXPORTER_OTLP_TRACES_HEADERS ?? ""
       },
+      {
+        type: "input",
+        name: "selfHostBaseUrl",
+        message: sharedEnvConfigPrompts.selfHostBaseUrl.message,
+        default: envDefaults.SELF_HOST_BASEURL || (isStaging ? `https://apps.seeka.services/${defaultAppName}-staging` : `https://apps.seeka.services/${defaultAppName}`)
+      },
       {
         type: "input",
         name: "seekaIngestUrl",
@@ -105374,34 +105454,48 @@ async function initEnvironmentCommand(config) {
         name: "seekaTelemetryUrl",
         message: sharedEnvConfigPrompts.seekaTelemetryUrl.message,
         default: envDefaults.SEEKA_TELEMETRY_URL ?? ""
-      }
-    ]);
-    const { octokit } = await authenticateWithGitHub();
-    const configPath = config.__configPath ?? resolveInitConfigPath();
-    upsertInitConfig(configPath, {
-      orgName: config.orgName,
-      appName: config.appName,
-      azureFunctionResourceGroupName: answers.azureFunctionResourceGroupName
-    });
-    await setEnvironmentVariables(octokit, answers.owner, answers.repo, answers.environmentName, [
+      },
       {
-        name: "AZURE_FUNC_RESOURCE_NAME",
-        value: answers.azureFuncResourceName
+        type: "input",
+        name: "internalNpmAuthUsername",
+        message: "Enter internal NPM registry username (for pulling private @seeka-labs packages):",
+        default: "internal-seeka-developers-apps"
       },
       {
-        name: "AZURE_FUNC_RESOURCE_GROUP_NAME",
-        value: answers.azureFunctionResourceGroupName
+        type: "password",
+        name: "internalNpmAuthPassword",
+        message: "Enter internal NPM registry password (leave blank to skip updating the existing GitHub secret):",
+        mask: "*"
+      },
+      {
+        type: "input",
+        name: "azureClientIdSeekaAppDeployment",
+        message: "Enter AZURE_CLIENT_ID_SEEKA_APP_DEPLOYMENT (Azure AD app registration client ID for OIDC federation):",
+        default: envDefaults.AZURE_CLIENT_ID_SEEKA_APP_DEPLOYMENT || (isStaging ? "003d3b68-b4ca-4a5f-bbca-dd644fb16ee6" : ""),
+        validate: (input) => input.trim() !== "" || "AZURE_CLIENT_ID_SEEKA_APP_DEPLOYMENT is required"
+      },
+      {
+        type: "input",
+        name: "azureTenantId",
+        message: "Enter AZURE_TENANT_ID:",
+        default: envDefaults.AZURE_TENANT_ID ?? "",
+        validate: (input) => input.trim() !== "" || "AZURE_TENANT_ID is required"
+      },
+      {
+        type: "input",
+        name: "azureSubscriptionId",
+        message: "Enter AZURE_SUBSCRIPTION_ID:",
+        default: envDefaults.AZURE_SUBSCRIPTION_ID ?? "",
+        validate: (input) => input.trim() !== "" || "AZURE_SUBSCRIPTION_ID is required"
+      },
+      {
+        type: "input",
+        name: "hostingRegionName",
+        message: "Enter HOSTING_REGION_NAME (Azure region):",
+        default: envDefaults.HOSTING_REGION_NAME || "australiaeast",
+        validate: (input) => input.trim() !== "" || "HOSTING_REGION_NAME is required"
       }
     ]);
-    try {
-      await deleteRepositoryVariable(octokit, answers.owner, answers.repo, "AZURE_FUNC_RESOURCE_NAME");
-      await deleteRepositoryVariable(octokit, answers.owner, answers.repo, "AZURE_FUNC_RESOURCE_GROUP_NAME");
-      console.log("\n\u26A0\uFE0F  Repo-level AZURE_FUNC_RESOURCE_NAME and AZURE_FUNC_RESOURCE_GROUP_NAME have been removed.");
-      console.log("   Ensure your other environment also has these variables set at environment-level.");
-      console.log("   Run `seeka-azure update-env` for the other environment if needed.\n");
-    } catch {
-    }
-    await createEnvironment(octokit, answers.owner, answers.repo, answers.environmentName);
     const dataEncryptionKey = answers.dataEncryptionKey || generateGuidNoHyphens2();
     const envVars = {
       ...isStaging ? {} : config.environmentVariables ?? {},
@@ -105420,12 +105514,71 @@ async function initEnvironmentCommand(config) {
       SELF_HOST_BASEURL: answers.selfHostBaseUrl,
       SEEKA_INGEST_URL: answers.seekaIngestUrl,
       SEEKA_ISSUER_URL: answers.seekaIssuerUrl,
-      SEEKA_TELEMETRY_URL: answers.seekaTelemetryUrl
-    };
+      SEEKA_TELEMETRY_URL: answers.seekaTelemetryUrl,
+      // UI build-time vars (GitHub env-level vars, also persisted for re-use)
+      VITE_BASE_URL: answers.viteBaseUrl,
+      VITE_URLS_SEEKA_API_CORE: answers.viteUrlsSeekaApiCore,
+      VITE_URLS_SEEKA_APP_CORE_ORIGIN: answers.viteUrlsSeekaAppCoreOrigin,
+      HOSTING_ENV_NAME: answers.hostingEnvName,
+      // Azure OIDC deployment vars (GitHub env-level vars, plain text)
+      AZURE_CLIENT_ID_SEEKA_APP_DEPLOYMENT: answers.azureClientIdSeekaAppDeployment,
+      AZURE_TENANT_ID: answers.azureTenantId,
+      AZURE_SUBSCRIPTION_ID: answers.azureSubscriptionId,
+      HOSTING_REGION_NAME: answers.hostingRegionName
+    };
+    const appConfigWritePath = resolveAppConfigPath(process.cwd());
+    const existingAppConfig = readJsonFile(appConfigWritePath);
+    const mergedAppConfig = {
+      orgName: config.orgName ?? existingAppConfig?.orgName ?? "",
+      appName: config.appName ?? existingAppConfig?.appName ?? "",
+      template: existingAppConfig?.template ?? "azure-function",
+      githubOwner: answers.owner
+    };
+    writeJsonFile(appConfigWritePath, mergedAppConfig);
     const secretsConfigPath = resolveEnvironmentSecretsConfigPath(answers.environmentName);
     upsertSecretsConfig(secretsConfigPath, envVars);
-    const newEnvConfig = { environmentVariables: envVars };
-    writeJsonFile(resolveEnvironmentConfigPath(process.cwd(), answers.environmentName), newEnvConfig);
+    const envConfigToWrite = {
+      environmentVariables: envVars,
+      azureFunctionResourceGroupName: answers.azureFunctionResourceGroupName,
+      azureFunctionResourceName: answers.azureFuncResourceName,
+      githubEnvironmentName: answers.environmentName
+    };
+    writeJsonFile(resolveEnvironmentConfigPath(process.cwd(), answers.environmentName), envConfigToWrite);
+    console.log("\n\u{1F4BE} Saved inputs to .seeka/ locally. Re-run the command with the same env to resume if GitHub ops fail.\n");
+    const { octokit } = await authenticateWithGitHub();
+    if (answers.internalNpmAuthUsername) {
+      await setRepositoryVariable(octokit, answers.owner, answers.repo, {
+        name: "INTERNAL_NPM_AUTH_USERNAME",
+        value: answers.internalNpmAuthUsername
+      });
+    }
+    if (answers.internalNpmAuthPassword) {
+      await setRepositorySecret(octokit, answers.owner, answers.repo, {
+        name: "INTERNAL_NPM_AUTH_PASSWORD",
+        value: answers.internalNpmAuthPassword
+      });
+    } else {
+      console.log("\n  \u23ED\uFE0F  INTERNAL_NPM_AUTH_PASSWORD not provided - existing secret (if any) left in place.\n");
+    }
+    await createEnvironment(octokit, answers.owner, answers.repo, answers.environmentName);
+    await setEnvironmentVariables(octokit, answers.owner, answers.repo, answers.environmentName, [
+      {
+        name: "AZURE_FUNC_RESOURCE_NAME",
+        value: answers.azureFuncResourceName
+      },
+      {
+        name: "AZURE_FUNC_RESOURCE_GROUP_NAME",
+        value: answers.azureFunctionResourceGroupName
+      }
+    ]);
+    try {
+      await deleteRepositoryVariable(octokit, answers.owner, answers.repo, "AZURE_FUNC_RESOURCE_NAME");
+      await deleteRepositoryVariable(octokit, answers.owner, answers.repo, "AZURE_FUNC_RESOURCE_GROUP_NAME");
+      console.log("\n\u26A0\uFE0F  Repo-level AZURE_FUNC_RESOURCE_NAME and AZURE_FUNC_RESOURCE_GROUP_NAME have been removed.");
+      console.log("   Ensure your other environment also has these variables set at environment-level.");
+      console.log("   Run `seeka-azure update-env` for the other environment if needed.\n");
+    } catch {
+    }
     const secretsToSet = [
       { name: "SEEKA_APP_CFG_DATA_ENCRYPTION_KEY", value: envVars.DATA_ENCRYPTION_KEY },
       { name: "SEEKA_APP_CFG_SEEKA_APP_SECRET", value: envVars.SEEKA_APP_SECRET },
@@ -105445,7 +105598,7 @@ async function initEnvironmentCommand(config) {
       },
       {
         name: "VITE_URLS_SEEKA_APP_CORE_ORIGIN",
-        value: "https://seeka.app"
+        value: answers.viteUrlsSeekaAppCoreOrigin || "https://seeka.app"
       },
       {
         name: "HOSTING_ENV_NAME",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seeka-labs/cli-apps-azure",
-  "version": "3.10.0",
+  "version": "3.10.2",
   "type": "module",
   "description": "Seeka - Apps CLI - Azure",
   "author": "SEEKA <platform@seeka.co>",
@@ -33,7 +33,7 @@
   "devDependencies": {
     "@jest/globals": "^30",
     "@octokit/rest": "^22.0.1",
-    "@seeka-labs/cli-apps": "3.10.0",
+    "@seeka-labs/cli-apps": "3.10.2",
     "@types/cross-spawn": "^6",
     "@types/jest": "^30",
     "@types/libsodium-wrappers": "^0.7",