@hot-updater/azure 1.2.0-rc.12 → 1.2.0-rc.14

package/dist/functions/index.mjs

@@ -6104,6 +6104,10 @@ const nativeBuilds = defineTable({
 		type: "string",
 		maxLength: 255,
 		required: false
+	},
+	store_build: {
+		type: "boolean",
+		required: false
 	}
 }, {
 	key: ["id"],
@@ -6116,6 +6120,11 @@ const nativeBuilds = defineTable({
 			eq: ["scope_key", "build_key"],
 			sort: ["id"]
 		},
+		byStoreBuild: {
+			eq: ["scope_key", "store_build"],
+			sort: [],
+			unique: true
+		},
 		byChannel: {
 			eq: ["channel_id"],
 			sort: ["id"],
@@ -6311,10 +6320,7 @@ const LOG_TABLES = [
 const LEASE_TABLE = "aggregate_lease";
 const LEASE = { id: "compaction" };
 const LEASE_MS = 3e4;
-const WINDOW_MS$1 = {
-	log: 6e4,
-	memory: 15e3
-};
+const WINDOW_MS$1 = 6e4;
 const LOG_PAGE = 200;
 const GROUPS = {
 	commit: 1,
@@ -6322,7 +6328,6 @@ const GROUPS = {
 	flush: 256
 };
 const ATTEMPTS = 5;
-const MAX_BUFFERED = 1e4;
 const log$1 = defineTable({
 	id: {
 		type: "string",
@@ -6423,8 +6428,8 @@ const rewrite = (change, key, current) => {
 		previous: current
 	};
 };
-const compile = async (adapter, changes, shard) => {
-	const keys = changes.map(({ model, key }) => [...key.slice(0, -1), shard(model)]);
+const compile = async (adapter, changes) => {
+	const keys = changes.map(({ key }) => [...key.slice(0, -1), 0]);
 	const reads = /* @__PURE__ */ new Map();
 	changes.forEach((change, at) => {
 		if (rewrites(change)) reads.set(change.model, [...reads.get(change.model) ?? [], at]);
@@ -6470,7 +6475,7 @@ const encode$1 = async (changes) => {
 	const zipped = await deflate(json);
 	return zipped !== void 0 && zipped.length < json.length ? `z${zipped}` : json;
 };
-const createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "log", windowMs = WINDOW_MS$1[mode] }, now }) => {
+const createAggregateBatches = ({ engine, adapter, schema, batching: { windowMs = WINDOW_MS$1 }, now }) => {
 	if (!schema.models.has(LEASE_TABLE)) throw new DatabaseTransactionError("An engine that batches aggregates needs aggregateBatchingModule in its schema.");
 	const holder = crypto.randomUUID().replaceAll("-", "");
 	const table = (name) => schema.models.get(name).table;
@@ -6497,61 +6502,6 @@ const createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "l
 		}
 		return changes;
 	};
-	const apply = async (changes, shard) => {
-		let rest = changes;
-		let ops = [];
-		let read = true;
-		for (let failures = 0; rest.length > 0 && failures < ATTEMPTS;) try {
-			if (read) ops = await compile(adapter, rest, shard);
-			let size = rest.length;
-			const chunk = () => ops.slice(0, size).filter(isOp);
-			while (size > 1 && !adapter.fits(chunk())) size = Math.ceil(size / 2);
-			let result = { ok: true };
-			if (chunk().length > 0) result = await adapter.write(chunk()).catch((error) => {
-				warn("flush")(error);
-				return { ok: true };
-			});
-			read = !result.ok && !("retry" in result);
-			if (result.ok) {
-				rest = rest.slice(size);
-				ops = ops.slice(size);
-				failures = 0;
-			} else {
-				failures += 1;
-				if (!read) await sleep$1(failures);
-			}
-		} catch (error) {
-			warn("flush")(error);
-			return rest;
-		}
-		return rest;
-	};
-	let buffer = /* @__PURE__ */ new Map();
-	let timer;
-	let flushing;
-	const shards = /* @__PURE__ */ new Map();
-	const processShard = (model) => {
-		if (!shards.has(model)) shards.set(model, Math.floor(Math.random() * shapeOf(model).shards));
-		return shards.get(model);
-	};
-	const schedule = () => {
-		if (timer !== void 0 || buffer.size === 0) return;
-		timer = setTimeout(() => {
-			timer = void 0;
-			flushBuffer();
-		}, windowMs);
-		timer.unref?.();
-	};
-	const flushBuffer = () => flushing ??= (async () => {
-		clearTimeout(timer);
-		timer = void 0;
-		const pending = [...buffer.values()];
-		buffer = /* @__PURE__ */ new Map();
-		mergeAll(buffer, await apply(pending, processShard));
-	})().catch(warn("flush")).finally(() => {
-		flushing = void 0;
-		schedule();
-	});
 	let nextDue = 0;
 	let compacting;
 	const known = /* @__PURE__ */ new Map();
@@ -6673,7 +6623,7 @@ const createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "l
 			more
 		};
 	};
-	const rowsFor = async (changes) => (await compile(adapter, changes, () => 0)).filter(isOp);
+	const rowsFor = async (changes) => (await compile(adapter, changes)).filter(isOp);
 	const applyGroup = async (held, logs) => {
 		for (let count = logs.length; count > 0; count = Math.floor(count / 2)) {
 			const batch = logs.slice(0, count);
@@ -6753,19 +6703,6 @@ const createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "l
 	}))).then((pages) => pages.some((page) => page.rows.length > 0)).finally(() => {
 		checking = void 0;
 	});
-	const committed = async (changes) => {
-		if (mode === "log") {
-			if (now() >= nextDue) await compact(false, GROUPS.commit);
-			return;
-		}
-		mergeAll(buffer, changes.values());
-		schedule();
-		if (buffer.size >= MAX_BUFFERED) await flushBuffer();
-	};
-	const flush = async () => {
-		await flushBuffer();
-		if (mode === "log" && await hasPending()) await compact(true, GROUPS.flush);
-	};
 	return {
 		async transaction(fn) {
 			let changes = /* @__PURE__ */ new Map();
@@ -6791,7 +6728,7 @@ const createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "l
 						aggregate
 					});
 					if (failure) throw failure.error;
-					if (mode === "log" && attempt.size > 0) {
+					if (attempt.size > 0) {
 						const id = `${now().toString(36).padStart(9, "0")}${holder.slice(0, 8)}${crypto.randomUUID().slice(0, 8)}`;
 						const shard = Math.floor(Math.random() * LOG_TABLES.length);
 						const merged = mergeAll(/* @__PURE__ */ new Map(), attempt.values());
@@ -6805,24 +6742,18 @@ const createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "l
 					open = false;
 				}
 			});
-			if (changes.size > 0) await committed(changes);
+			if (changes.size > 0 && now() >= nextDue) await compact(false, GROUPS.commit);
 			return result;
 		},
 		async beforeRead(name) {
 			if (!isBatched(schema.models.get(name))) return;
-			if (buffer.size > 0 || flushing !== void 0) await flushBuffer();
-			if (mode === "log") {
-				if (await hasPending().catch((error) => {
-					warn("read")(error);
-					return false;
-				})) await compact(true, GROUPS.read);
-			}
+			if (await hasPending().catch((error) => {
+				warn("read")(error);
+				return false;
+			})) await compact(true, GROUPS.read);
 		},
-		flush,
-		async dispose() {
-			clearTimeout(timer);
-			timer = void 0;
-			await flush();
+		async flush() {
+			if (await hasPending()) await compact(true, GROUPS.flush);
 		}
 	};
 };
@@ -7788,9 +7719,6 @@ const createDatabaseEngine = ({ batching, now = Date.now, meter, ...options }) =
 		flush: async () => {
 			await batches?.flush();
 		},
-		dispose: async () => {
-			await batches?.dispose();
-		},
 		database(module) {
 			const name = (model) => module.namespace ? `${module.namespace}_${model}` : model;
 			return {
@@ -7858,8 +7786,7 @@ const createEngine = (database, { plugins = [], now = Date.now } = {}) => {
 			if (module === void 0) throw new HotUpdaterConfigError(`Plugin "${plugin.id}" is not one of this engine's plugins.`);
 			return engine.database(module);
 		},
-		flush: () => engine.flush(),
-		dispose: () => engine.dispose()
+		flush: () => engine.flush()
 	};
 };
 //#endregion
@@ -8118,7 +8045,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.12";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.14";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 const createVersionRouteHandlers = (plugins = []) => {
@@ -9226,8 +9153,12 @@ const pick = (row) => ({
 	build_number: row.build_number ?? null,
 	submitted_to: row.submitted_to ?? null,
 	submitted_at_ms: row.submitted_at_ms ?? null,
-	submitted_version: row.submitted_version ?? null
+	submitted_version: row.submitted_version ?? null,
+	store_build: row.store_build === true ? true : null
 });
+const SANDBOX_CHANNEL_PREFIX = "sandbox-";
+const OLDER_BUILDS_PAGE = 20;
+const MARK_ATTEMPTS = 8;
 const SUBMISSION_DESTINATIONS = {
 	android: "play-internal",
 	ios: "testflight"
@@ -9293,7 +9224,8 @@ const createNativeBuildApi = (db, { now = Date.now } = {}) => ({
 			build_number: registration.buildNumber ?? null,
 			submitted_to: null,
 			submitted_at_ms: null,
-			submitted_version: null
+			submitted_version: null,
+			store_build: null
 		};
 		for (let attempt = 1;; attempt += 1) {
 			await insertChannel(db, {
@@ -9331,21 +9263,45 @@ const createNativeBuildApi = (db, { now = Date.now } = {}) => ({
 		const scopeKey = nativeBuildScopeKey(scope);
 		const buildKey = options?.buildKey;
 		if (buildKey !== void 0 && !BUILD_KEY.test(buildKey)) throw new NativeBuildInputError("Invalid native build key: it must be nbk1: and a SHA-256.");
-		const { rows } = buildKey === void 0 ? await db.findMany("native_builds", {
-			index: "byScope",
-			where: { scope_key: scopeKey },
-			order: "desc",
-			limit: 1
-		}) : await db.findMany("native_builds", {
-			index: "byBuildKey",
-			where: {
+		if (options?.storeBuild) {
+			const marked = await db.findOne("native_builds", {
 				scope_key: scopeKey,
-				build_key: buildKey
-			},
-			order: "desc",
-			limit: 1
-		});
-		return rows[0] === void 0 ? null : pick(rows[0]);
+				store_build: true
+			});
+			return marked === null ? null : pick(marked);
+		}
+		const read = (limit, before) => {
+			const page = {
+				order: "desc",
+				limit,
+				...before === void 0 ? {} : { range: { lt: before } }
+			};
+			return buildKey === void 0 ? db.findMany("native_builds", {
+				index: "byScope",
+				where: { scope_key: scopeKey },
+				...page
+			}) : db.findMany("native_builds", {
+				index: "byBuildKey",
+				where: {
+					scope_key: scopeKey,
+					build_key: buildKey
+				},
+				...page
+			});
+		};
+		const { rows } = await read(1);
+		const newest = rows[0];
+		if (newest === void 0) return null;
+		const bundleId = options?.builtInOlderThan;
+		if (bundleId === void 0 || newest.min_bundle_id < bundleId) return pick(newest);
+		for (let before = newest.id;;) {
+			const { rows: older } = await read(OLDER_BUILDS_PAGE, before);
+			const usable = older.find(({ min_bundle_id }) => min_bundle_id < bundleId);
+			if (usable !== void 0) return pick(usable);
+			const last = older.at(-1);
+			if (older.length < OLDER_BUILDS_PAGE || last === void 0) return null;
+			before = last.id;
+		}
 	},
 	async recordNativeBuildSubmission(id, { destination, version }) {
 		if (version.trim().length === 0 || version.length > SUBMITTED_VERSION_MAX_LENGTH) throw new NativeBuildInputError(`Invalid native build submission: version must be the store's label of the build, up to ${SUBMITTED_VERSION_MAX_LENGTH} characters.`);
@@ -9366,6 +9322,49 @@ const createNativeBuildApi = (db, { now = Date.now } = {}) => ({
 			};
 		});
 	},
+	async markNativeBuild(id, { storeBuild }) {
+		for (let attempt = 1;; attempt += 1) try {
+			return await db.transaction(async (tx) => {
+				const row = await tx.findOne("native_builds", { id });
+				if (row === null) return null;
+				const build = pick(row);
+				if (!storeBuild) {
+					if (build.store_build !== null) tx.update("native_builds", row, { store_build: null });
+					return {
+						nativeBuild: {
+							...build,
+							store_build: null
+						},
+						previous: null
+					};
+				}
+				if (decodeChannelKey(build.channel_id.slice(8)).startsWith(SANDBOX_CHANNEL_PREFIX)) throw new NativeBuildInputError("A build on a sandbox channel can't be the store build.");
+				if (build.store_build !== null) return {
+					nativeBuild: build,
+					previous: null
+				};
+				const holder = await tx.findOne("native_builds", {
+					scope_key: build.scope_key,
+					store_build: true
+				});
+				if (holder !== null) tx.update("native_builds", holder, { store_build: null });
+				tx.update("native_builds", row, { store_build: true });
+				return {
+					nativeBuild: {
+						...build,
+						store_build: true
+					},
+					previous: holder === null ? null : {
+						...pick(holder),
+						store_build: null
+					}
+				};
+			});
+		} catch (error) {
+			if (attempt < MARK_ATTEMPTS && error instanceof DatabaseConstraintError && error.reason === "unique") continue;
+			throw error;
+		}
+	},
 	async deleteNativeBuild(id) {
 		return db.transaction(async (tx) => {
 			const row = await tx.findOne("native_builds", { id });
@@ -10392,7 +10391,13 @@ const createAdminRouteHandlers = () => ({
 		const url = new URL(request.url);
 		const scope = nativeBuildScopeOf(url);
 		const buildKey = url.searchParams.get("buildKey");
-		return json$2({ data: await refusingInvalid(() => buildKey === null ? core.findNativeBuild(scope) : core.findNativeBuild(scope, { buildKey })) });
+		const builtInOlderThan = url.searchParams.get("builtInOlderThan");
+		const options = {
+			...buildKey === null ? {} : { buildKey },
+			...url.searchParams.get("storeBuild") === "true" ? { storeBuild: true } : {},
+			...builtInOlderThan === null ? {} : { builtInOlderThan }
+		};
+		return json$2({ data: await refusingInvalid(() => Object.keys(options).length === 0 ? core.findNativeBuild(scope) : core.findNativeBuild(scope, options)) });
 	}),
 	getNativeBuild: onCore(async (core, _request, params) => json$2({ data: await core.getNativeBuild(requireRouteParam(params, "id")) })),
 	listNativeBuilds: onCore(async (core, request) => {
@@ -10413,6 +10418,12 @@ const createAdminRouteHandlers = () => ({
 		};
 		return json$2({ data: await refusingInvalid(() => core.recordNativeBuildSubmission(requireRouteParam(params, "id"), submission)) });
 	}),
+	markNativeBuild: onCore(async (core, request, params) => {
+		const input = await body$1(request);
+		if (!isRecord$5(input) || typeof input.storeBuild !== "boolean") throw new HandlerBadRequestError("A native build's store build mark needs storeBuild, true or false.");
+		const mark = { storeBuild: input.storeBuild };
+		return json$2({ data: await refusingInvalid(() => core.markNativeBuild(requireRouteParam(params, "id"), mark)) });
+	}),
 	deleteNativeBuild: onCore(async (core, _request, params) => json$2({ data: await core.deleteNativeBuild(requireRouteParam(params, "id")) })),
 	deleteBundles: onCore(async (core, request) => {
 		const { ids } = await body$1(request);
@@ -10557,6 +10568,11 @@ const ADMIN_ROUTES = [
 		path: "/native-builds/:id/submission",
 		handler: "recordNativeBuildSubmission"
 	},
+	{
+		method: "POST",
+		path: "/native-builds/:id/store-build",
+		handler: "markNativeBuild"
+	},
 	{
 		method: "DELETE",
 		path: "/native-builds/:id",

package/dist/index.cjs

@@ -811,23 +811,23 @@ const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 	"AuthenticationRequiredError",
 	"CredentialUnavailableError"
 ]);
-const SIGN_IN_HINT = [
-	"In CI, sign in with azure/login.",
-	"On your machine, run az login.",
-	"Or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET."
-];
-/** The widest line a message has: the CLI prints no wider. */
-const LINE_WIDTH = 76;
-/** `text`, such as Azure's own message, in lines that fit, broken at spaces. */
-const wrap = (text) => {
-	const lines = [];
-	let line = "";
-	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
-		lines.push(line);
-		line = word;
-	} else line = line ? `${line} ${word}` : word;
-	if (line) lines.push(line);
-	return lines;
+/** The variables `DefaultAzureCredential` signs in with first, if complete. */
+const environmentCredentialVariables = () => {
+	const { env } = process;
+	if (!env["AZURE_TENANT_ID"] || !env["AZURE_CLIENT_ID"]) return void 0;
+	if (env["AZURE_CLIENT_SECRET"]) return "AZURE_CLIENT_SECRET";
+	if (env["AZURE_CLIENT_CERTIFICATE_PATH"]) return "AZURE_CLIENT_CERTIFICATE_PATH";
+	if (env["AZURE_USERNAME"] && env["AZURE_PASSWORD"]) return "AZURE_PASSWORD";
+};
+/**
+* The one step that can fix the identity in use: `az login` changes nothing
+* while the environment's identity comes first.
+*/
+const signInHint = (credential) => {
+	if (credential !== void 0) return [`Check the credential passed to ${NAME}().`];
+	const variable = environmentCredentialVariables();
+	if (variable) return [`Fix or unset ${variable}, AZURE_TENANT_ID, and AZURE_CLIENT_ID.`];
+	return process.env["CI"] ? ["Sign in with azure/login."] : ["Sign in:", "az login"];
 };
 /** An error of one line each, for a terminal. */
 const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
@@ -940,56 +940,21 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 		const name = errorName(error);
 		const status = statusOf(error);
 		const code = innerCode(error) ?? error?.code;
-		const detail = wrap(`${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
-		const secret = `Secret: ${id}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
-			`${NAME} found no Azure identity to ${verb} a secret.`,
-			secret,
-			...wrap(`${errorMessage(error)}.`),
-			...SIGN_IN_HINT
-		], error);
-		if (status === 401) return failure([
-			`Azure Key Vault refused the sign-in to ${verb} a secret.`,
-			secret,
-			...detail,
-			"Sign in again.",
-			...SIGN_IN_HINT
-		], error);
-		if (code === "SecretDisabled") return failure([
-			`Azure Key Vault can't ${verb} a secret.`,
-			secret,
-			"Its current version is disabled. Enable it, or store a new value."
-		], error);
-		if (status === 403) return failure([
-			`Azure Key Vault refused to ${verb} a secret.`,
-			secret,
-			...detail,
-			`The Azure identity needs the ${role} role on the vault.`,
-			`With access policies, it needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.`,
-			"A firewall may also refuse this network."
-		], error);
-		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([
-			`Azure Key Vault can't ${verb} a secret: it is being deleted.`,
-			secret,
-			"Try again in a minute."
-		], error);
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([`${NAME} found no Azure identity.`, ...signInHint(credential)], error);
+		if (status === 401 || name === "AuthenticationError") return failure(["Azure rejected the sign-in.", ...signInHint(credential)], error);
+		if (/\bENOTFOUND\b/u.test(`${code} ${errorMessage(error)}`) && errorMessage(error).includes(vault().hostname)) return failure([`${NAME} can't find ${vault().hostname}.`, `Check ${vaultUrl === void 0 ? "vaultName" : "vaultUrl"}.`], error);
+		if (code === "SecretDisabled") return failure([`${id}'s current version is disabled. Enable it, or store a new value.`], error);
+		if (status === 403) return failure([`Azure Key Vault refused to ${verb} ${id}.`, code === "ForbiddenByFirewall" ? "Its firewall refuses this network." : code === "ForbiddenByPolicy" ? `The identity needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.` : `The identity needs the ${role} role on the vault.`], error);
+		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([`${id} is being deleted. Try again in a minute.`], error);
 		if (status === 409 || code === "ObjectIsDeletedButRecoverable") {
 			const vaultName = vaultLabel();
 			return failure([
-				`Azure Key Vault can't ${verb} a secret: it was deleted.`,
-				secret,
-				"Recover it, or purge it:",
-				`az keyvault secret recover --vault-name ${vaultName} \\`,
-				`  --name ${id}`,
-				`az keyvault secret purge --vault-name ${vaultName} \\`,
-				`  --name ${id}`
+				`${id} was deleted. Recover it, or purge it:`,
+				`az keyvault secret recover --vault-name ${vaultName} --name ${id}`,
+				`az keyvault secret purge --vault-name ${vaultName} --name ${id}`
 			], error);
 		}
-		return failure([
-			`Azure Key Vault failed to ${verb} a secret.`,
-			secret,
-			...detail
-		], error);
+		return failure([`Azure Key Vault failed to ${verb} ${id}.`, `${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`], error);
 	};
 	const read = async (client, id) => {
 		let value;

package/dist/index.d.cts

@@ -58,9 +58,8 @@ type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel" | "conn
   readonly containerId?: string;
   /**
    * Cosmos DB bills each item a write touches, so Insights' aggregates are
-   * batched: through log rows a compaction merges (the default), or
-   * `{ mode: "memory" }` on a long-lived server. `false` commits them with
-   * each event.
+   * batched: through log rows a compaction merges (the default). `false` commits
+   * them with each event.
    */
   readonly aggregateBatching?: EngineDatabase["aggregateBatching"] | false;
 };

package/dist/index.d.mts

@@ -58,9 +58,8 @@ type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel" | "conn
   readonly containerId?: string;
   /**
    * Cosmos DB bills each item a write touches, so Insights' aggregates are
-   * batched: through log rows a compaction merges (the default), or
-   * `{ mode: "memory" }` on a long-lived server. `false` commits them with
-   * each event.
+   * batched: through log rows a compaction merges (the default). `false` commits
+   * them with each event.
    */
   readonly aggregateBatching?: EngineDatabase["aggregateBatching"] | false;
 };

package/dist/index.mjs

@@ -810,23 +810,23 @@ const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 	"AuthenticationRequiredError",
 	"CredentialUnavailableError"
 ]);
-const SIGN_IN_HINT = [
-	"In CI, sign in with azure/login.",
-	"On your machine, run az login.",
-	"Or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET."
-];
-/** The widest line a message has: the CLI prints no wider. */
-const LINE_WIDTH = 76;
-/** `text`, such as Azure's own message, in lines that fit, broken at spaces. */
-const wrap = (text) => {
-	const lines = [];
-	let line = "";
-	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
-		lines.push(line);
-		line = word;
-	} else line = line ? `${line} ${word}` : word;
-	if (line) lines.push(line);
-	return lines;
+/** The variables `DefaultAzureCredential` signs in with first, if complete. */
+const environmentCredentialVariables = () => {
+	const { env } = process;
+	if (!env["AZURE_TENANT_ID"] || !env["AZURE_CLIENT_ID"]) return void 0;
+	if (env["AZURE_CLIENT_SECRET"]) return "AZURE_CLIENT_SECRET";
+	if (env["AZURE_CLIENT_CERTIFICATE_PATH"]) return "AZURE_CLIENT_CERTIFICATE_PATH";
+	if (env["AZURE_USERNAME"] && env["AZURE_PASSWORD"]) return "AZURE_PASSWORD";
+};
+/**
+* The one step that can fix the identity in use: `az login` changes nothing
+* while the environment's identity comes first.
+*/
+const signInHint = (credential) => {
+	if (credential !== void 0) return [`Check the credential passed to ${NAME}().`];
+	const variable = environmentCredentialVariables();
+	if (variable) return [`Fix or unset ${variable}, AZURE_TENANT_ID, and AZURE_CLIENT_ID.`];
+	return process.env["CI"] ? ["Sign in with azure/login."] : ["Sign in:", "az login"];
 };
 /** An error of one line each, for a terminal. */
 const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
@@ -939,56 +939,21 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 		const name = errorName(error);
 		const status = statusOf(error);
 		const code = innerCode(error) ?? error?.code;
-		const detail = wrap(`${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
-		const secret = `Secret: ${id}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
-			`${NAME} found no Azure identity to ${verb} a secret.`,
-			secret,
-			...wrap(`${errorMessage(error)}.`),
-			...SIGN_IN_HINT
-		], error);
-		if (status === 401) return failure([
-			`Azure Key Vault refused the sign-in to ${verb} a secret.`,
-			secret,
-			...detail,
-			"Sign in again.",
-			...SIGN_IN_HINT
-		], error);
-		if (code === "SecretDisabled") return failure([
-			`Azure Key Vault can't ${verb} a secret.`,
-			secret,
-			"Its current version is disabled. Enable it, or store a new value."
-		], error);
-		if (status === 403) return failure([
-			`Azure Key Vault refused to ${verb} a secret.`,
-			secret,
-			...detail,
-			`The Azure identity needs the ${role} role on the vault.`,
-			`With access policies, it needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.`,
-			"A firewall may also refuse this network."
-		], error);
-		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([
-			`Azure Key Vault can't ${verb} a secret: it is being deleted.`,
-			secret,
-			"Try again in a minute."
-		], error);
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([`${NAME} found no Azure identity.`, ...signInHint(credential)], error);
+		if (status === 401 || name === "AuthenticationError") return failure(["Azure rejected the sign-in.", ...signInHint(credential)], error);
+		if (/\bENOTFOUND\b/u.test(`${code} ${errorMessage(error)}`) && errorMessage(error).includes(vault().hostname)) return failure([`${NAME} can't find ${vault().hostname}.`, `Check ${vaultUrl === void 0 ? "vaultName" : "vaultUrl"}.`], error);
+		if (code === "SecretDisabled") return failure([`${id}'s current version is disabled. Enable it, or store a new value.`], error);
+		if (status === 403) return failure([`Azure Key Vault refused to ${verb} ${id}.`, code === "ForbiddenByFirewall" ? "Its firewall refuses this network." : code === "ForbiddenByPolicy" ? `The identity needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.` : `The identity needs the ${role} role on the vault.`], error);
+		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([`${id} is being deleted. Try again in a minute.`], error);
 		if (status === 409 || code === "ObjectIsDeletedButRecoverable") {
 			const vaultName = vaultLabel();
 			return failure([
-				`Azure Key Vault can't ${verb} a secret: it was deleted.`,
-				secret,
-				"Recover it, or purge it:",
-				`az keyvault secret recover --vault-name ${vaultName} \\`,
-				`  --name ${id}`,
-				`az keyvault secret purge --vault-name ${vaultName} \\`,
-				`  --name ${id}`
+				`${id} was deleted. Recover it, or purge it:`,
+				`az keyvault secret recover --vault-name ${vaultName} --name ${id}`,
+				`az keyvault secret purge --vault-name ${vaultName} --name ${id}`
 			], error);
 		}
-		return failure([
-			`Azure Key Vault failed to ${verb} a secret.`,
-			secret,
-			...detail
-		], error);
+		return failure([`Azure Key Vault failed to ${verb} ${id}.`, `${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`], error);
 	};
 	const read = async (client, id) => {
 		let value;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/azure",
   "type": "module",
-  "version": "1.2.0-rc.12",
+  "version": "1.2.0-rc.14",
   "description": "React Native OTA solution for self-hosted",
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
@@ -44,10 +44,10 @@
     "@azure/identity": "4.14.0",
     "@azure/keyvault-secrets": "4.11.2",
     "@azure/storage-blob": "12.34.0",
-    "@hot-updater/cli-tools": "1.2.0-rc.12",
-    "@hot-updater/plugin-core": "1.2.0-rc.12",
-    "@hot-updater/protocol": "1.2.0-rc.12",
-    "@hot-updater/server": "1.2.0-rc.12"
+    "@hot-updater/cli-tools": "1.2.0-rc.14",
+    "@hot-updater/protocol": "1.2.0-rc.14",
+    "@hot-updater/server": "1.2.0-rc.14",
+    "@hot-updater/plugin-core": "1.2.0-rc.14"
   },
   "devDependencies": {
     "@azure/functions": "4.16.5",
@@ -55,7 +55,7 @@
     "execa": "9.5.2",
     "jszip": "^3.10.1",
     "vitest": "4.1.4",
-    "@hot-updater/test-utils": "1.2.0-rc.12"
+    "@hot-updater/test-utils": "1.2.0-rc.14"
   },
   "scripts": {
     "build": "tsdown",