@hot-updater/azure 1.2.0-rc.4 → 1.2.0-rc.5

package/dist/functions/index.mjs

@@ -8118,7 +8118,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.4";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.5";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 const createVersionRouteHandlers = (plugins = []) => {
@@ -57415,12 +57415,19 @@ const PROTOCOL = "azblob";
 const SAS_EXPIRES_IN_MS = 36e5;
 const DELEGATION_KEY_LIFETIME_MS = 864e5;
 const isNotFound = (error) => error instanceof RestError && error.statusCode === 404;
-const serviceOf = (config) => "connectionString" in config ? BlobServiceClient.fromConnectionString(config.connectionString) : new BlobServiceClient(config.accountUrl, config.credential);
+const serviceOf = async (config) => {
+	if (!("connectionString" in config)) return new BlobServiceClient(config.accountUrl, config.credential);
+	const { connectionString } = config;
+	return BlobServiceClient.fromConnectionString(typeof connectionString === "function" ? await connectionString() : connectionString);
+};
 function azureBlobStorage(config) {
 	const { containerName, basePath, getDownloadUrl } = config;
 	let client;
-	const service = () => client ??= serviceOf(config);
-	const container = () => service().getContainerClient(containerName);
+	const service = () => client ??= serviceOf(config).catch((error) => {
+		client = void 0;
+		throw error;
+	});
+	const container = async () => (await service()).getContainerClient(containerName);
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {
@@ -57451,7 +57458,7 @@ function azureBlobStorage(config) {
 	const delegationKey = () => {
 		const now = Date.now();
 		if (delegation === void 0 || delegation.renewAt <= now) {
-			const key = service().getUserDelegationKey(/* @__PURE__ */ new Date(now - 3e5), new Date(now + DELEGATION_KEY_LIFETIME_MS));
+			const key = service().then((blobService) => blobService.getUserDelegationKey(/* @__PURE__ */ new Date(now - 3e5), new Date(now + DELEGATION_KEY_LIFETIME_MS)));
 			key.catch(() => {
 				delegation = void 0;
 			});
@@ -57463,7 +57470,7 @@ function azureBlobStorage(config) {
 		return delegation.key;
 	};
 	const signedUrl = async (key) => {
-		const blob = container().getBlobClient(key);
+		const blob = (await container()).getBlobClient(key);
 		const expiresOn = new Date(Date.now() + SAS_EXPIRES_IN_MS);
 		const permissions = BlobSASPermissions.parse("r");
 		if (blob.credential instanceof StorageSharedKeyCredential) return blob.generateSasUrl({
@@ -57484,7 +57491,8 @@ function azureBlobStorage(config) {
 		protocol: PROTOCOL,
 		async listObjects(prefix) {
 			const objects = [];
-			for await (const blob of container().listBlobsFlat({ prefix: getListPrefix(prefix) })) {
+			const blobs = await container();
+			for await (const blob of blobs.listBlobsFlat({ prefix: getListPrefix(prefix) })) {
 				const storageUri = getListedStorageUri(blob.name);
 				if (storageUri === null) continue;
 				objects.push({
@@ -57501,7 +57509,8 @@ function azureBlobStorage(config) {
 			for (let offset = 0; offset < keys.length; offset += 256) {
 				const batch = keys.slice(offset, offset + 256);
 				if (batch.length === 0) continue;
-				const failed = (await container().getBlobBatchClient().deleteBlobs(batch.map((key) => container().getBlobClient(key)))).subResponses.filter(({ status }) => status >= 300 && status !== 404);
+				const blobs = await container();
+				const failed = (await blobs.getBlobBatchClient().deleteBlobs(batch.map((key) => blobs.getBlobClient(key)))).subResponses.filter(({ status }) => status >= 300 && status !== 404);
 				if (failed.length > 0) throw new Error(`Failed to delete ${failed.length} Azure blob(s).`);
 			}
 		},
@@ -57511,7 +57520,7 @@ function azureBlobStorage(config) {
 				blobContentType: contentType,
 				blobCacheControl: "max-age=31536000"
 			} };
-			const blob = container().getBlockBlobClient(storageKey);
+			const blob = (await container()).getBlockBlobClient(storageKey);
 			if (contentLength === void 0) await blob.uploadData(new Uint8Array(await new Response(body).arrayBuffer()), options);
 			else {
 				const { Readable } = await import("node:stream");
@@ -57540,7 +57549,7 @@ function azureBlobStorage(config) {
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
-				const download = await container().getBlobClient(key).download();
+				const download = await (await container()).getBlobClient(key).download();
 				const body = download.readableStreamBody;
 				if (body === void 0) return { response: null };
 				const headers = new Headers();
@@ -57560,11 +57569,11 @@ function azureBlobStorage(config) {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			return { exists: await container().getBlobClient(key).exists() };
+			return { exists: await (await container()).getBlobClient(key).exists() };
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			await container().getBlobClient(key).deleteIfExists();
+			await (await container()).getBlobClient(key).deleteIfExists();
 			return { deleted: true };
 		}
 	});
@@ -70857,18 +70866,21 @@ const isWideAdd = (op) => op.type === "add" && Object.keys(op.by).length + (op.e
 const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(SqlState\(E(25P02|40001|40P01)\)/.test(String(error instanceof Error ? error.message : error));
 const createCosmosStore = ({ client, databaseId, containerId, engine, nativePageSize }) => {
 	let opened;
-	const open = () => opened ??= (() => {
-		const account = typeof client === "function" ? client() : client;
+	const open = () => opened ??= (async () => {
+		const account = typeof client === "function" ? await client() : client;
 		return {
 			client: account,
 			container: account.database(databaseId).container(containerId)
 		};
-	})();
-	const container = () => open().container;
+	})().catch((error) => {
+		opened = void 0;
+		throw error;
+	});
+	const container = async () => (await open()).container;
 	const readStates = async (ids, rowIds) => {
 		const states = /* @__PURE__ */ new Map();
 		for (const [group, projection] of [[ids.filter((id) => !rowIds.has(id)), ""], [ids.filter((id) => rowIds.has(id)), ", c.row"]]) for (let at = 0; at < group.length; at += GET_BATCH) {
-			const { resources } = await container().items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+			const { resources } = await (await container()).items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 			for (const { id, etag, v, expireAt, row } of resources) states.set(id, {
 				etag,
 				v,
@@ -71000,7 +71012,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 			const found = /* @__PURE__ */ new Map();
 			const ids = [...new Set(keys.map(cosmosItemId))];
 			for (let at = 0; at < ids.length; at += GET_BATCH) {
-				const { resources } = await container().items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+				const { resources } = await (await container()).items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 				for (const resource of resources) found.set(resource.id, toRow(resource.row));
 			}
 			return keys.map((key) => found.get(cosmosItemId(key)) ?? null);
@@ -71036,7 +71048,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					value: after
 				});
 			}
-			const { resources } = await container().items.query({
+			const { resources } = await (await container()).items.query({
 				query: `SELECT TOP @size c.sk, c.row FROM c WHERE ${filters.join(" AND ")} ORDER BY c.pk ${order === "asc" ? "ASC" : "DESC"}, c.sk ${order === "asc" ? "ASC" : "DESC"}`,
 				parameters
 			}, {
@@ -71086,7 +71098,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 				if (planned.length > BATCH_OPERATIONS) throw new Error(`A Cosmos DB batch takes ${BATCH_OPERATIONS} operations; this write needs ${planned.length}.`);
 				let results;
 				try {
-					const response = await container().items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
+					const response = await (await container()).items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
 					if (response.result === void 0) throw Object.assign(/* @__PURE__ */ new Error(`Cosmos DB refused the batch with status ${response.code}`), { code: response.code });
 					results = response.result;
 				} catch (error) {
@@ -71119,7 +71131,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		async deleteConsumed(keys) {
 			let remaining = [...new Set(keys.map(cosmosItemId))];
 			for (let attempt = 0; remaining.length > 0; attempt += 1) {
-				const failed = (await container().items.executeBulkOperations(remaining.map((id) => ({
+				const failed = (await (await container()).items.executeBulkOperations(remaining.map((id) => ({
 					operationType: "Delete",
 					id,
 					partitionKey: COSMOS_PARTITION
@@ -71138,8 +71150,8 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 			}
 		},
 		migrations: { async apply() {
-			if (engine !== void 0) await assertCosmosContainerReusable(container(), engine);
-			const { database } = await open().client.databases.createIfNotExists({ id: databaseId });
+			if (engine !== void 0) await assertCosmosContainerReusable(await container(), engine);
+			const { database } = await (await open()).client.databases.createIfNotExists({ id: databaseId });
 			const { resource } = await database.containers.createIfNotExists({
 				id: containerId,
 				partitionKey: { paths: [COSMOS_PARTITION_KEY_PATH] },
@@ -71176,8 +71188,12 @@ const adapterOf = (config) => {
 	const { databaseId = AZURE_COSMOS_V1_DATABASE, containerId = AZURE_COSMOS_V1_CONTAINER, aggregateBatching: _, ...connection } = config;
 	if (connection.consistencyLevel !== void 0 && connection.consistencyLevel !== "Strong") throw new Error(`cosmosDatabase reads with strong consistency; consistencyLevel "${String(connection.consistencyLevel)}" is weaker.`);
 	let client;
+	const { connectionString } = connection;
 	const store = createCosmosStore({
-		client: () => client ??= new CosmosClient(connection),
+		client: async () => client ??= new CosmosClient({
+			...connection,
+			connectionString: typeof connectionString === "function" ? await connectionString() : connectionString
+		}),
 		databaseId,
 		containerId,
 		engine: currentCosmosEngine()
@@ -71189,7 +71205,7 @@ const adapterOf = (config) => {
 };
 const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 const accountHostOf = ({ endpoint, connectionString }) => {
-	const url = endpoint ?? connectionString?.match(/AccountEndpoint=([^;]+)/iu)?.[1];
+	const url = endpoint ?? (typeof connectionString === "string" ? connectionString.match(/AccountEndpoint=([^;]+)/iu)?.[1] : void 0);
 	try {
 		return url === void 0 ? void 0 : new URL(url).hostname;
 	} catch {

package/dist/index.cjs

@@ -11,7 +11,11 @@ const SAS_EXPIRES_IN_MS = 36e5;
 /** A user delegation key signs SAS URLs for up to seven days; it is renewed well before. */
 const DELEGATION_KEY_LIFETIME_MS = 864e5;
 const isNotFound = (error) => error instanceof _azure_storage_blob.RestError && error.statusCode === 404;
-const serviceOf = (config) => "connectionString" in config ? _azure_storage_blob.BlobServiceClient.fromConnectionString(config.connectionString) : new _azure_storage_blob.BlobServiceClient(config.accountUrl, config.credential);
+const serviceOf = async (config) => {
+	if (!("connectionString" in config)) return new _azure_storage_blob.BlobServiceClient(config.accountUrl, config.credential);
+	const { connectionString } = config;
+	return _azure_storage_blob.BlobServiceClient.fromConnectionString(typeof connectionString === "function" ? await connectionString() : connectionString);
+};
 /**
 * Bundles in an Azure Blob Storage container. Without `getDownloadUrl`,
 * devices download through SAS URLs: signed with the account key when the
@@ -21,8 +25,11 @@ const serviceOf = (config) => "connectionString" in config ? _azure_storage_blob
 function azureBlobStorage(config) {
 	const { containerName, basePath, getDownloadUrl } = config;
 	let client;
-	const service = () => client ??= serviceOf(config);
-	const container = () => service().getContainerClient(containerName);
+	const service = () => client ??= serviceOf(config).catch((error) => {
+		client = void 0;
+		throw error;
+	});
+	const container = async () => (await service()).getContainerClient(containerName);
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {
@@ -54,7 +61,7 @@ function azureBlobStorage(config) {
 	const delegationKey = () => {
 		const now = Date.now();
 		if (delegation === void 0 || delegation.renewAt <= now) {
-			const key = service().getUserDelegationKey(/* @__PURE__ */ new Date(now - 3e5), new Date(now + DELEGATION_KEY_LIFETIME_MS));
+			const key = service().then((blobService) => blobService.getUserDelegationKey(/* @__PURE__ */ new Date(now - 3e5), new Date(now + DELEGATION_KEY_LIFETIME_MS)));
 			key.catch(() => {
 				delegation = void 0;
 			});
@@ -66,7 +73,7 @@ function azureBlobStorage(config) {
 		return delegation.key;
 	};
 	const signedUrl = async (key) => {
-		const blob = container().getBlobClient(key);
+		const blob = (await container()).getBlobClient(key);
 		const expiresOn = new Date(Date.now() + SAS_EXPIRES_IN_MS);
 		const permissions = _azure_storage_blob.BlobSASPermissions.parse("r");
 		if (blob.credential instanceof _azure_storage_blob.StorageSharedKeyCredential) return blob.generateSasUrl({
@@ -87,7 +94,8 @@ function azureBlobStorage(config) {
 		protocol: PROTOCOL,
 		async listObjects(prefix) {
 			const objects = [];
-			for await (const blob of container().listBlobsFlat({ prefix: getListPrefix(prefix) })) {
+			const blobs = await container();
+			for await (const blob of blobs.listBlobsFlat({ prefix: getListPrefix(prefix) })) {
 				const storageUri = getListedStorageUri(blob.name);
 				if (storageUri === null) continue;
 				objects.push({
@@ -104,7 +112,8 @@ function azureBlobStorage(config) {
 			for (let offset = 0; offset < keys.length; offset += 256) {
 				const batch = keys.slice(offset, offset + 256);
 				if (batch.length === 0) continue;
-				const failed = (await container().getBlobBatchClient().deleteBlobs(batch.map((key) => container().getBlobClient(key)))).subResponses.filter(({ status }) => status >= 300 && status !== 404);
+				const blobs = await container();
+				const failed = (await blobs.getBlobBatchClient().deleteBlobs(batch.map((key) => blobs.getBlobClient(key)))).subResponses.filter(({ status }) => status >= 300 && status !== 404);
 				if (failed.length > 0) throw new Error(`Failed to delete ${failed.length} Azure blob(s).`);
 			}
 		},
@@ -114,7 +123,7 @@ function azureBlobStorage(config) {
 				blobContentType: contentType,
 				blobCacheControl: "max-age=31536000"
 			} };
-			const blob = container().getBlockBlobClient(storageKey);
+			const blob = (await container()).getBlockBlobClient(storageKey);
 			if (contentLength === void 0) await blob.uploadData(new Uint8Array(await new Response(body).arrayBuffer()), options);
 			else {
 				const { Readable } = await import("node:stream");
@@ -143,7 +152,7 @@ function azureBlobStorage(config) {
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
-				const download = await container().getBlobClient(key).download();
+				const download = await (await container()).getBlobClient(key).download();
 				const body = download.readableStreamBody;
 				if (body === void 0) return { response: null };
 				const headers = new Headers();
@@ -163,11 +172,11 @@ function azureBlobStorage(config) {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			return { exists: await container().getBlobClient(key).exists() };
+			return { exists: await (await container()).getBlobClient(key).exists() };
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			await container().getBlobClient(key).deleteIfExists();
+			await (await container()).getBlobClient(key).deleteIfExists();
 			return { deleted: true };
 		}
 	});
@@ -385,14 +394,17 @@ const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(Sq
 */
 const createCosmosStore = ({ client, databaseId, containerId, engine, nativePageSize }) => {
 	let opened;
-	const open = () => opened ??= (() => {
-		const account = typeof client === "function" ? client() : client;
+	const open = () => opened ??= (async () => {
+		const account = typeof client === "function" ? await client() : client;
 		return {
 			client: account,
 			container: account.database(databaseId).container(containerId)
 		};
-	})();
-	const container = () => open().container;
+	})().catch((error) => {
+		opened = void 0;
+		throw error;
+	});
+	const container = async () => (await open()).container;
 	/**
 	* The state of the items `ids` names, by id, with the rows of `rowIds`;
 	* a missing item has none.
@@ -400,7 +412,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 	const readStates = async (ids, rowIds) => {
 		const states = /* @__PURE__ */ new Map();
 		for (const [group, projection] of [[ids.filter((id) => !rowIds.has(id)), ""], [ids.filter((id) => rowIds.has(id)), ", c.row"]]) for (let at = 0; at < group.length; at += GET_BATCH) {
-			const { resources } = await container().items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+			const { resources } = await (await container()).items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 			for (const { id, etag, v, expireAt, row } of resources) states.set(id, {
 				etag,
 				v,
@@ -538,7 +550,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 			const found = /* @__PURE__ */ new Map();
 			const ids = [...new Set(keys.map(cosmosItemId))];
 			for (let at = 0; at < ids.length; at += GET_BATCH) {
-				const { resources } = await container().items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+				const { resources } = await (await container()).items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 				for (const resource of resources) found.set(resource.id, toRow(resource.row));
 			}
 			return keys.map((key) => found.get(cosmosItemId(key)) ?? null);
@@ -574,7 +586,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					value: after
 				});
 			}
-			const { resources } = await container().items.query({
+			const { resources } = await (await container()).items.query({
 				query: `SELECT TOP @size c.sk, c.row FROM c WHERE ${filters.join(" AND ")} ORDER BY c.pk ${order === "asc" ? "ASC" : "DESC"}, c.sk ${order === "asc" ? "ASC" : "DESC"}`,
 				parameters
 			}, {
@@ -624,7 +636,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 				if (planned.length > BATCH_OPERATIONS) throw new Error(`A Cosmos DB batch takes ${BATCH_OPERATIONS} operations; this write needs ${planned.length}.`);
 				let results;
 				try {
-					const response = await container().items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
+					const response = await (await container()).items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
 					if (response.result === void 0) throw Object.assign(/* @__PURE__ */ new Error(`Cosmos DB refused the batch with status ${response.code}`), { code: response.code });
 					results = response.result;
 				} catch (error) {
@@ -658,7 +670,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		async deleteConsumed(keys) {
 			let remaining = [...new Set(keys.map(cosmosItemId))];
 			for (let attempt = 0; remaining.length > 0; attempt += 1) {
-				const failed = (await container().items.executeBulkOperations(remaining.map((id) => ({
+				const failed = (await (await container()).items.executeBulkOperations(remaining.map((id) => ({
 					operationType: "Delete",
 					id,
 					partitionKey: COSMOS_PARTITION
@@ -679,8 +691,8 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		migrations: { 
 		/** Creates the database and the container when they are missing. */
 async apply() {
-			if (engine !== void 0) await assertCosmosContainerReusable(container(), engine);
-			const { database } = await open().client.databases.createIfNotExists({ id: databaseId });
+			if (engine !== void 0) await assertCosmosContainerReusable(await container(), engine);
+			const { database } = await (await open()).client.databases.createIfNotExists({ id: databaseId });
 			const { resource } = await database.containers.createIfNotExists({
 				id: containerId,
 				partitionKey: { paths: [COSMOS_PARTITION_KEY_PATH] },
@@ -717,8 +729,12 @@ const adapterOf = (config) => {
 	const { databaseId = AZURE_COSMOS_V1_DATABASE, containerId = AZURE_COSMOS_V1_CONTAINER, aggregateBatching: _, ...connection } = config;
 	if (connection.consistencyLevel !== void 0 && connection.consistencyLevel !== "Strong") throw new Error(`cosmosDatabase reads with strong consistency; consistencyLevel "${String(connection.consistencyLevel)}" is weaker.`);
 	let client;
+	const { connectionString } = connection;
 	const store = createCosmosStore({
-		client: () => client ??= new _azure_cosmos.CosmosClient(connection),
+		client: async () => client ??= new _azure_cosmos.CosmosClient({
+			...connection,
+			connectionString: typeof connectionString === "function" ? await connectionString() : connectionString
+		}),
 		databaseId,
 		containerId,
 		engine: currentCosmosEngine()
@@ -747,7 +763,7 @@ const migrateCosmosDatabase = (config, plugins = []) => {
 const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 /** The account host a client reaches: its endpoint, or the connection string's. */
 const accountHostOf = ({ endpoint, connectionString }) => {
-	const url = endpoint ?? connectionString?.match(/AccountEndpoint=([^;]+)/iu)?.[1];
+	const url = endpoint ?? (typeof connectionString === "string" ? connectionString.match(/AccountEndpoint=([^;]+)/iu)?.[1] : void 0);
 	try {
 		return url === void 0 ? void 0 : new URL(url).hostname;
 	} catch {

package/dist/index.d.cts

@@ -5,7 +5,12 @@ import { CosmosClientOptions } from "@azure/cosmos";
 //#region src/azureBlobStorage.d.ts
 /** The account to connect to: its connection string, or its Blob endpoint and a credential. */
 type AzureBlobConnection = {
-  readonly connectionString: string;
+  /**
+   * The account's connection string, or a function that returns it,
+   * such as one that reads it with `secretEnv`: called on first use, so
+   * a config loads without it.
+   */
+  readonly connectionString: string | (() => string | Promise<string>);
 } | {
   /** The Blob service endpoint, such as `https://<account>.blob.core.windows.net`. */
   readonly accountUrl: string;
@@ -38,7 +43,14 @@ declare function azureBlobStorage(config: AzureBlobStorageConfig): StorageAdapte
  * `endpoint` with a `key` or Microsoft Entra `aadCredentials`. Reads must
  * be strongly consistent, so `consistencyLevel` takes only `"Strong"`.
  */
-type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel"> & {
+type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel" | "connectionString"> & {
+  /**
+   * The account's connection string, or a function that returns it, such as
+   * one that reads it with `secretEnv`: called on the first request, so a
+   * config loads without it. `endpoint` beside a function names the
+   * account to `hot-updater doctor`.
+   */
+  readonly connectionString?: string | (() => string | Promise<string>);
   readonly consistencyLevel?: "Strong";
   /** The database the container lives in. @default "hot-updater" */
   readonly databaseId?: string;

package/dist/index.d.mts

@@ -5,7 +5,12 @@ import { CosmosClientOptions } from "@azure/cosmos";
 //#region src/azureBlobStorage.d.ts
 /** The account to connect to: its connection string, or its Blob endpoint and a credential. */
 type AzureBlobConnection = {
-  readonly connectionString: string;
+  /**
+   * The account's connection string, or a function that returns it,
+   * such as one that reads it with `secretEnv`: called on first use, so
+   * a config loads without it.
+   */
+  readonly connectionString: string | (() => string | Promise<string>);
 } | {
   /** The Blob service endpoint, such as `https://<account>.blob.core.windows.net`. */
   readonly accountUrl: string;
@@ -38,7 +43,14 @@ declare function azureBlobStorage(config: AzureBlobStorageConfig): StorageAdapte
  * `endpoint` with a `key` or Microsoft Entra `aadCredentials`. Reads must
  * be strongly consistent, so `consistencyLevel` takes only `"Strong"`.
  */
-type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel"> & {
+type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel" | "connectionString"> & {
+  /**
+   * The account's connection string, or a function that returns it, such as
+   * one that reads it with `secretEnv`: called on the first request, so a
+   * config loads without it. `endpoint` beside a function names the
+   * account to `hot-updater doctor`.
+   */
+  readonly connectionString?: string | (() => string | Promise<string>);
   readonly consistencyLevel?: "Strong";
   /** The database the container lives in. @default "hot-updater" */
   readonly databaseId?: string;

package/dist/index.mjs

@@ -10,7 +10,11 @@ const SAS_EXPIRES_IN_MS = 36e5;
 /** A user delegation key signs SAS URLs for up to seven days; it is renewed well before. */
 const DELEGATION_KEY_LIFETIME_MS = 864e5;
 const isNotFound = (error) => error instanceof RestError && error.statusCode === 404;
-const serviceOf = (config) => "connectionString" in config ? BlobServiceClient.fromConnectionString(config.connectionString) : new BlobServiceClient(config.accountUrl, config.credential);
+const serviceOf = async (config) => {
+	if (!("connectionString" in config)) return new BlobServiceClient(config.accountUrl, config.credential);
+	const { connectionString } = config;
+	return BlobServiceClient.fromConnectionString(typeof connectionString === "function" ? await connectionString() : connectionString);
+};
 /**
 * Bundles in an Azure Blob Storage container. Without `getDownloadUrl`,
 * devices download through SAS URLs: signed with the account key when the
@@ -20,8 +24,11 @@ const serviceOf = (config) => "connectionString" in config ? BlobServiceClient.f
 function azureBlobStorage(config) {
 	const { containerName, basePath, getDownloadUrl } = config;
 	let client;
-	const service = () => client ??= serviceOf(config);
-	const container = () => service().getContainerClient(containerName);
+	const service = () => client ??= serviceOf(config).catch((error) => {
+		client = void 0;
+		throw error;
+	});
+	const container = async () => (await service()).getContainerClient(containerName);
 	const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
 	const getStorageKey = createStorageKeyBuilder(normalizedBasePath);
 	const getListPrefix = (prefix = "") => {
@@ -53,7 +60,7 @@ function azureBlobStorage(config) {
 	const delegationKey = () => {
 		const now = Date.now();
 		if (delegation === void 0 || delegation.renewAt <= now) {
-			const key = service().getUserDelegationKey(/* @__PURE__ */ new Date(now - 3e5), new Date(now + DELEGATION_KEY_LIFETIME_MS));
+			const key = service().then((blobService) => blobService.getUserDelegationKey(/* @__PURE__ */ new Date(now - 3e5), new Date(now + DELEGATION_KEY_LIFETIME_MS)));
 			key.catch(() => {
 				delegation = void 0;
 			});
@@ -65,7 +72,7 @@ function azureBlobStorage(config) {
 		return delegation.key;
 	};
 	const signedUrl = async (key) => {
-		const blob = container().getBlobClient(key);
+		const blob = (await container()).getBlobClient(key);
 		const expiresOn = new Date(Date.now() + SAS_EXPIRES_IN_MS);
 		const permissions = BlobSASPermissions.parse("r");
 		if (blob.credential instanceof StorageSharedKeyCredential) return blob.generateSasUrl({
@@ -86,7 +93,8 @@ function azureBlobStorage(config) {
 		protocol: PROTOCOL,
 		async listObjects(prefix) {
 			const objects = [];
-			for await (const blob of container().listBlobsFlat({ prefix: getListPrefix(prefix) })) {
+			const blobs = await container();
+			for await (const blob of blobs.listBlobsFlat({ prefix: getListPrefix(prefix) })) {
 				const storageUri = getListedStorageUri(blob.name);
 				if (storageUri === null) continue;
 				objects.push({
@@ -103,7 +111,8 @@ function azureBlobStorage(config) {
 			for (let offset = 0; offset < keys.length; offset += 256) {
 				const batch = keys.slice(offset, offset + 256);
 				if (batch.length === 0) continue;
-				const failed = (await container().getBlobBatchClient().deleteBlobs(batch.map((key) => container().getBlobClient(key)))).subResponses.filter(({ status }) => status >= 300 && status !== 404);
+				const blobs = await container();
+				const failed = (await blobs.getBlobBatchClient().deleteBlobs(batch.map((key) => blobs.getBlobClient(key)))).subResponses.filter(({ status }) => status >= 300 && status !== 404);
 				if (failed.length > 0) throw new Error(`Failed to delete ${failed.length} Azure blob(s).`);
 			}
 		},
@@ -113,7 +122,7 @@ function azureBlobStorage(config) {
 				blobContentType: contentType,
 				blobCacheControl: "max-age=31536000"
 			} };
-			const blob = container().getBlockBlobClient(storageKey);
+			const blob = (await container()).getBlockBlobClient(storageKey);
 			if (contentLength === void 0) await blob.uploadData(new Uint8Array(await new Response(body).arrayBuffer()), options);
 			else {
 				const { Readable } = await import("node:stream");
@@ -142,7 +151,7 @@ function azureBlobStorage(config) {
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
 			try {
-				const download = await container().getBlobClient(key).download();
+				const download = await (await container()).getBlobClient(key).download();
 				const body = download.readableStreamBody;
 				if (body === void 0) return { response: null };
 				const headers = new Headers();
@@ -162,11 +171,11 @@ function azureBlobStorage(config) {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			return { exists: await container().getBlobClient(key).exists() };
+			return { exists: await (await container()).getBlobClient(key).exists() };
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			await container().getBlobClient(key).deleteIfExists();
+			await (await container()).getBlobClient(key).deleteIfExists();
 			return { deleted: true };
 		}
 	});
@@ -384,14 +393,17 @@ const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(Sq
 */
 const createCosmosStore = ({ client, databaseId, containerId, engine, nativePageSize }) => {
 	let opened;
-	const open = () => opened ??= (() => {
-		const account = typeof client === "function" ? client() : client;
+	const open = () => opened ??= (async () => {
+		const account = typeof client === "function" ? await client() : client;
 		return {
 			client: account,
 			container: account.database(databaseId).container(containerId)
 		};
-	})();
-	const container = () => open().container;
+	})().catch((error) => {
+		opened = void 0;
+		throw error;
+	});
+	const container = async () => (await open()).container;
 	/**
 	* The state of the items `ids` names, by id, with the rows of `rowIds`;
 	* a missing item has none.
@@ -399,7 +411,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 	const readStates = async (ids, rowIds) => {
 		const states = /* @__PURE__ */ new Map();
 		for (const [group, projection] of [[ids.filter((id) => !rowIds.has(id)), ""], [ids.filter((id) => rowIds.has(id)), ", c.row"]]) for (let at = 0; at < group.length; at += GET_BATCH) {
-			const { resources } = await container().items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+			const { resources } = await (await container()).items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 			for (const { id, etag, v, expireAt, row } of resources) states.set(id, {
 				etag,
 				v,
@@ -537,7 +549,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 			const found = /* @__PURE__ */ new Map();
 			const ids = [...new Set(keys.map(cosmosItemId))];
 			for (let at = 0; at < ids.length; at += GET_BATCH) {
-				const { resources } = await container().items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+				const { resources } = await (await container()).items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 				for (const resource of resources) found.set(resource.id, toRow(resource.row));
 			}
 			return keys.map((key) => found.get(cosmosItemId(key)) ?? null);
@@ -573,7 +585,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					value: after
 				});
 			}
-			const { resources } = await container().items.query({
+			const { resources } = await (await container()).items.query({
 				query: `SELECT TOP @size c.sk, c.row FROM c WHERE ${filters.join(" AND ")} ORDER BY c.pk ${order === "asc" ? "ASC" : "DESC"}, c.sk ${order === "asc" ? "ASC" : "DESC"}`,
 				parameters
 			}, {
@@ -623,7 +635,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 				if (planned.length > BATCH_OPERATIONS) throw new Error(`A Cosmos DB batch takes ${BATCH_OPERATIONS} operations; this write needs ${planned.length}.`);
 				let results;
 				try {
-					const response = await container().items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
+					const response = await (await container()).items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
 					if (response.result === void 0) throw Object.assign(/* @__PURE__ */ new Error(`Cosmos DB refused the batch with status ${response.code}`), { code: response.code });
 					results = response.result;
 				} catch (error) {
@@ -657,7 +669,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		async deleteConsumed(keys) {
 			let remaining = [...new Set(keys.map(cosmosItemId))];
 			for (let attempt = 0; remaining.length > 0; attempt += 1) {
-				const failed = (await container().items.executeBulkOperations(remaining.map((id) => ({
+				const failed = (await (await container()).items.executeBulkOperations(remaining.map((id) => ({
 					operationType: "Delete",
 					id,
 					partitionKey: COSMOS_PARTITION
@@ -678,8 +690,8 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		migrations: { 
 		/** Creates the database and the container when they are missing. */
 async apply() {
-			if (engine !== void 0) await assertCosmosContainerReusable(container(), engine);
-			const { database } = await open().client.databases.createIfNotExists({ id: databaseId });
+			if (engine !== void 0) await assertCosmosContainerReusable(await container(), engine);
+			const { database } = await (await open()).client.databases.createIfNotExists({ id: databaseId });
 			const { resource } = await database.containers.createIfNotExists({
 				id: containerId,
 				partitionKey: { paths: [COSMOS_PARTITION_KEY_PATH] },
@@ -716,8 +728,12 @@ const adapterOf = (config) => {
 	const { databaseId = AZURE_COSMOS_V1_DATABASE, containerId = AZURE_COSMOS_V1_CONTAINER, aggregateBatching: _, ...connection } = config;
 	if (connection.consistencyLevel !== void 0 && connection.consistencyLevel !== "Strong") throw new Error(`cosmosDatabase reads with strong consistency; consistencyLevel "${String(connection.consistencyLevel)}" is weaker.`);
 	let client;
+	const { connectionString } = connection;
 	const store = createCosmosStore({
-		client: () => client ??= new CosmosClient(connection),
+		client: async () => client ??= new CosmosClient({
+			...connection,
+			connectionString: typeof connectionString === "function" ? await connectionString() : connectionString
+		}),
 		databaseId,
 		containerId,
 		engine: currentCosmosEngine()
@@ -746,7 +762,7 @@ const migrateCosmosDatabase = (config, plugins = []) => {
 const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 /** The account host a client reaches: its endpoint, or the connection string's. */
 const accountHostOf = ({ endpoint, connectionString }) => {
-	const url = endpoint ?? connectionString?.match(/AccountEndpoint=([^;]+)/iu)?.[1];
+	const url = endpoint ?? (typeof connectionString === "string" ? connectionString.match(/AccountEndpoint=([^;]+)/iu)?.[1] : void 0);
 	try {
 		return url === void 0 ? void 0 : new URL(url).hostname;
 	} catch {

package/dist/init/index.cjs

@@ -267,14 +267,17 @@ const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(Sq
 */
 const createCosmosStore = ({ client, databaseId, containerId, engine, nativePageSize }) => {
 	let opened;
-	const open = () => opened ??= (() => {
-		const account = typeof client === "function" ? client() : client;
+	const open = () => opened ??= (async () => {
+		const account = typeof client === "function" ? await client() : client;
 		return {
 			client: account,
 			container: account.database(databaseId).container(containerId)
 		};
-	})();
-	const container = () => open().container;
+	})().catch((error) => {
+		opened = void 0;
+		throw error;
+	});
+	const container = async () => (await open()).container;
 	/**
 	* The state of the items `ids` names, by id, with the rows of `rowIds`;
 	* a missing item has none.
@@ -282,7 +285,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 	const readStates = async (ids, rowIds) => {
 		const states = /* @__PURE__ */ new Map();
 		for (const [group, projection] of [[ids.filter((id) => !rowIds.has(id)), ""], [ids.filter((id) => rowIds.has(id)), ", c.row"]]) for (let at = 0; at < group.length; at += GET_BATCH) {
-			const { resources } = await container().items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+			const { resources } = await (await container()).items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 			for (const { id, etag, v, expireAt, row } of resources) states.set(id, {
 				etag,
 				v,
@@ -420,7 +423,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 			const found = /* @__PURE__ */ new Map();
 			const ids = [...new Set(keys.map(cosmosItemId))];
 			for (let at = 0; at < ids.length; at += GET_BATCH) {
-				const { resources } = await container().items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+				const { resources } = await (await container()).items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 				for (const resource of resources) found.set(resource.id, toRow(resource.row));
 			}
 			return keys.map((key) => found.get(cosmosItemId(key)) ?? null);
@@ -456,7 +459,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					value: after
 				});
 			}
-			const { resources } = await container().items.query({
+			const { resources } = await (await container()).items.query({
 				query: `SELECT TOP @size c.sk, c.row FROM c WHERE ${filters.join(" AND ")} ORDER BY c.pk ${order === "asc" ? "ASC" : "DESC"}, c.sk ${order === "asc" ? "ASC" : "DESC"}`,
 				parameters
 			}, {
@@ -506,7 +509,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 				if (planned.length > BATCH_OPERATIONS) throw new Error(`A Cosmos DB batch takes ${BATCH_OPERATIONS} operations; this write needs ${planned.length}.`);
 				let results;
 				try {
-					const response = await container().items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
+					const response = await (await container()).items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
 					if (response.result === void 0) throw Object.assign(/* @__PURE__ */ new Error(`Cosmos DB refused the batch with status ${response.code}`), { code: response.code });
 					results = response.result;
 				} catch (error) {
@@ -540,7 +543,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		async deleteConsumed(keys) {
 			let remaining = [...new Set(keys.map(cosmosItemId))];
 			for (let attempt = 0; remaining.length > 0; attempt += 1) {
-				const failed = (await container().items.executeBulkOperations(remaining.map((id) => ({
+				const failed = (await (await container()).items.executeBulkOperations(remaining.map((id) => ({
 					operationType: "Delete",
 					id,
 					partitionKey: COSMOS_PARTITION
@@ -561,8 +564,8 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		migrations: { 
 		/** Creates the database and the container when they are missing. */
 async apply() {
-			if (engine !== void 0) await assertCosmosContainerReusable(container(), engine);
-			const { database } = await open().client.databases.createIfNotExists({ id: databaseId });
+			if (engine !== void 0) await assertCosmosContainerReusable(await container(), engine);
+			const { database } = await (await open()).client.databases.createIfNotExists({ id: databaseId });
 			const { resource } = await database.containers.createIfNotExists({
 				id: containerId,
 				partitionKey: { paths: [COSMOS_PARTITION_KEY_PATH] },
@@ -599,8 +602,12 @@ const adapterOf = (config) => {
 	const { databaseId = AZURE_COSMOS_V1_DATABASE, containerId = AZURE_COSMOS_V1_CONTAINER, aggregateBatching: _, ...connection } = config;
 	if (connection.consistencyLevel !== void 0 && connection.consistencyLevel !== "Strong") throw new Error(`cosmosDatabase reads with strong consistency; consistencyLevel "${String(connection.consistencyLevel)}" is weaker.`);
 	let client;
+	const { connectionString } = connection;
 	const store = createCosmosStore({
-		client: () => client ??= new _azure_cosmos.CosmosClient(connection),
+		client: async () => client ??= new _azure_cosmos.CosmosClient({
+			...connection,
+			connectionString: typeof connectionString === "function" ? await connectionString() : connectionString
+		}),
 		databaseId,
 		containerId,
 		engine: currentCosmosEngine()
@@ -629,7 +636,7 @@ const migrateCosmosDatabase = (config, plugins = []) => {
 const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 /** The account host a client reaches: its endpoint, or the connection string's. */
 const accountHostOf = ({ endpoint, connectionString }) => {
-	const url = endpoint ?? connectionString?.match(/AccountEndpoint=([^;]+)/iu)?.[1];
+	const url = endpoint ?? (typeof connectionString === "string" ? connectionString.match(/AccountEndpoint=([^;]+)/iu)?.[1] : void 0);
 	try {
 		return url === void 0 ? void 0 : new URL(url).hostname;
 	} catch {
@@ -7451,26 +7458,38 @@ const verifyFunction = async (baseURL, { attempts = 60, delayMs = 5e3 } = {}) =>
 * import without its extension, so it names the container itself.
 */
 const BLOB_CONTAINER = "hot-updater";
-const getConfigScaffold = (build) => {
+/**
+* The config init writes. With the `resources` init set up, it names the
+* Cosmos DB account, and reads both connection strings with `secretEnv`,
+* from the environment and `.env.hotupdater`, then the config's `secrets`
+* adapter. Without them, as the agent scaffold writes it, it reads them
+* from the environment.
+*/
+const getConfigScaffold = (build, resources) => {
+	const read = (reader, name) => resources === void 0 ? `process.env.${name}!` : `async () =>
+      (await ${reader}()).${name}`;
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/azure",
 			named: ["azureBlobStorage"]
 		}],
 		configString: `azureBlobStorage({
-    connectionString: process.env.HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING!,
+    connectionString: ${read("storageSecrets", "HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING")},
     containerName: "${BLOB_CONTAINER}",
   })`
 	};
-	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase({
+	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/azure",
 			named: ["cosmosDatabase"]
 		}],
-		configString: `cosmosDatabase({
-    connectionString: process.env.HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING!,
+		configString: `cosmosDatabase({${resources?.cosmosEndpoint === void 0 ? "" : `
+    endpoint: ${JSON.stringify(resources.cosmosEndpoint)},`}
+    connectionString: ${read("databaseSecrets", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING")},
   })`
-	}).setPlugins({
+	};
+	const helperStatements = resources === void 0 ? [] : [(0, _hot_updater_cli_tools.secretEnvHelper)("storageSecrets", ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING"]), (0, _hot_updater_cli_tools.secretEnvHelper)("databaseSecrets", ["HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"])];
+	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
 			named: [
@@ -7480,7 +7499,12 @@ const getConfigScaffold = (build) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+	});
+	if (resources !== void 0) builder.addImport({
+		pkg: "hot-updater",
+		named: ["secretEnv"]
+	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n"));
+	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
 };
 //#endregion
 //#region iac/init/index.ts
@@ -7565,7 +7589,8 @@ const initProvider = {
 			optional: true,
 			preflight: false
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"]
 };
 //#endregion
 //#region iac/index.ts
@@ -7625,10 +7650,10 @@ const resolveName = async ({ input, saved, fallback, nonInteractive, validate, h
 		validate: (value) => validate(value) ? void 0 : hint
 	}));
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const cwd = (0, _hot_updater_cli_tools.getCwd)();
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile);
+	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(cwd, envFile, secretsEnv);
 	const initInputEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
 	const saved = Object.fromEntries(Object.entries(inputs).map(([name, input]) => [name, initInputEnv[input.envKey]?.trim() || void 0]));
 	const cliVersion = await azureCliVersion();
@@ -7835,7 +7860,8 @@ const runInit = async ({ build, envFile }) => {
 		await database.dispose?.();
 	}
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with Azure settings.");
-	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build), {
+	const cosmosEndpoint = /AccountEndpoint=([^;]+)/iu.exec(cosmosConnectionString)?.[1];
+	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, cosmosEndpoint === void 0 ? {} : { cosmosEndpoint }), {
 		cwd,
 		settings: "Azure"
 	});

package/dist/init/index.d.cts

@@ -81,6 +81,7 @@ declare const initProvider: {
       readonly preflight: false;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"];
 };
 //#endregion
 //#region iac/index.d.ts
@@ -94,6 +95,6 @@ declare const defaultResourceNames: (subscriptionId: string, resourceGroup: stri
   cosmosAccount: string;
   functionApp: string;
 };
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { AZURE_FUNCTION_PACKAGE, defaultResourceNames, initProvider, runInit };

package/dist/init/index.d.mts

@@ -81,6 +81,7 @@ declare const initProvider: {
       readonly preflight: false;
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"];
 };
 //#endregion
 //#region iac/index.d.ts
@@ -94,6 +95,6 @@ declare const defaultResourceNames: (subscriptionId: string, resourceGroup: stri
   cosmosAccount: string;
   functionApp: string;
 };
-declare const runInit: ({ build, envFile }: RunInitOptions) => Promise<void>;
+declare const runInit: ({ build, envFile, secretsEnv }: RunInitOptions) => Promise<void>;
 //#endregion
 export { AZURE_FUNCTION_PACKAGE, defaultResourceNames, initProvider, runInit };

package/dist/init/index.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { createHash } from "crypto";
 import path from "path";
-import { ConfigBuilder, InitError, assembleServer, createHotUpdaterConfigScaffoldFromBuilder, createZip, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, shouldAutoSelectOnlyInitResource, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, assembleServer, createHotUpdaterConfigScaffoldFromBuilder, createZip, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, secretEnvHelper, shouldAutoSelectOnlyInitResource, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { CosmosClient } from "@azure/cosmos";
 import { SETTINGS_TABLE, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, toolingTargetOf } from "@hot-updater/plugin-core";
@@ -262,14 +262,17 @@ const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(Sq
 */
 const createCosmosStore = ({ client, databaseId, containerId, engine, nativePageSize }) => {
 	let opened;
-	const open = () => opened ??= (() => {
-		const account = typeof client === "function" ? client() : client;
+	const open = () => opened ??= (async () => {
+		const account = typeof client === "function" ? await client() : client;
 		return {
 			client: account,
 			container: account.database(databaseId).container(containerId)
 		};
-	})();
-	const container = () => open().container;
+	})().catch((error) => {
+		opened = void 0;
+		throw error;
+	});
+	const container = async () => (await open()).container;
 	/**
 	* The state of the items `ids` names, by id, with the rows of `rowIds`;
 	* a missing item has none.
@@ -277,7 +280,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 	const readStates = async (ids, rowIds) => {
 		const states = /* @__PURE__ */ new Map();
 		for (const [group, projection] of [[ids.filter((id) => !rowIds.has(id)), ""], [ids.filter((id) => rowIds.has(id)), ", c.row"]]) for (let at = 0; at < group.length; at += GET_BATCH) {
-			const { resources } = await container().items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+			const { resources } = await (await container()).items.query(`SELECT c.id, c._etag AS etag, c.row._v AS v, c.expireAt${projection} FROM c WHERE c.id IN (${idList(group.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 			for (const { id, etag, v, expireAt, row } of resources) states.set(id, {
 				etag,
 				v,
@@ -415,7 +418,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 			const found = /* @__PURE__ */ new Map();
 			const ids = [...new Set(keys.map(cosmosItemId))];
 			for (let at = 0; at < ids.length; at += GET_BATCH) {
-				const { resources } = await container().items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
+				const { resources } = await (await container()).items.query(`SELECT c.id, c.row FROM c WHERE c.id IN (${idList(ids.slice(at, at + GET_BATCH))})`, { partitionKey: COSMOS_PARTITION }).fetchAll().catch(missingContainer);
 				for (const resource of resources) found.set(resource.id, toRow(resource.row));
 			}
 			return keys.map((key) => found.get(cosmosItemId(key)) ?? null);
@@ -451,7 +454,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					value: after
 				});
 			}
-			const { resources } = await container().items.query({
+			const { resources } = await (await container()).items.query({
 				query: `SELECT TOP @size c.sk, c.row FROM c WHERE ${filters.join(" AND ")} ORDER BY c.pk ${order === "asc" ? "ASC" : "DESC"}, c.sk ${order === "asc" ? "ASC" : "DESC"}`,
 				parameters
 			}, {
@@ -501,7 +504,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 				if (planned.length > BATCH_OPERATIONS) throw new Error(`A Cosmos DB batch takes ${BATCH_OPERATIONS} operations; this write needs ${planned.length}.`);
 				let results;
 				try {
-					const response = await container().items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
+					const response = await (await container()).items.batch(planned.map(({ operation }) => operation), COSMOS_PARTITION);
 					if (response.result === void 0) throw Object.assign(/* @__PURE__ */ new Error(`Cosmos DB refused the batch with status ${response.code}`), { code: response.code });
 					results = response.result;
 				} catch (error) {
@@ -535,7 +538,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		async deleteConsumed(keys) {
 			let remaining = [...new Set(keys.map(cosmosItemId))];
 			for (let attempt = 0; remaining.length > 0; attempt += 1) {
-				const failed = (await container().items.executeBulkOperations(remaining.map((id) => ({
+				const failed = (await (await container()).items.executeBulkOperations(remaining.map((id) => ({
 					operationType: "Delete",
 					id,
 					partitionKey: COSMOS_PARTITION
@@ -556,8 +559,8 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 		migrations: { 
 		/** Creates the database and the container when they are missing. */
 async apply() {
-			if (engine !== void 0) await assertCosmosContainerReusable(container(), engine);
-			const { database } = await open().client.databases.createIfNotExists({ id: databaseId });
+			if (engine !== void 0) await assertCosmosContainerReusable(await container(), engine);
+			const { database } = await (await open()).client.databases.createIfNotExists({ id: databaseId });
 			const { resource } = await database.containers.createIfNotExists({
 				id: containerId,
 				partitionKey: { paths: [COSMOS_PARTITION_KEY_PATH] },
@@ -594,8 +597,12 @@ const adapterOf = (config) => {
 	const { databaseId = AZURE_COSMOS_V1_DATABASE, containerId = AZURE_COSMOS_V1_CONTAINER, aggregateBatching: _, ...connection } = config;
 	if (connection.consistencyLevel !== void 0 && connection.consistencyLevel !== "Strong") throw new Error(`cosmosDatabase reads with strong consistency; consistencyLevel "${String(connection.consistencyLevel)}" is weaker.`);
 	let client;
+	const { connectionString } = connection;
 	const store = createCosmosStore({
-		client: () => client ??= new CosmosClient(connection),
+		client: async () => client ??= new CosmosClient({
+			...connection,
+			connectionString: typeof connectionString === "function" ? await connectionString() : connectionString
+		}),
 		databaseId,
 		containerId,
 		engine: currentCosmosEngine()
@@ -624,7 +631,7 @@ const migrateCosmosDatabase = (config, plugins = []) => {
 const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
 /** The account host a client reaches: its endpoint, or the connection string's. */
 const accountHostOf = ({ endpoint, connectionString }) => {
-	const url = endpoint ?? connectionString?.match(/AccountEndpoint=([^;]+)/iu)?.[1];
+	const url = endpoint ?? (typeof connectionString === "string" ? connectionString.match(/AccountEndpoint=([^;]+)/iu)?.[1] : void 0);
 	try {
 		return url === void 0 ? void 0 : new URL(url).hostname;
 	} catch {
@@ -7446,26 +7453,38 @@ const verifyFunction = async (baseURL, { attempts = 60, delayMs = 5e3 } = {}) =>
 * import without its extension, so it names the container itself.
 */
 const BLOB_CONTAINER = "hot-updater";
-const getConfigScaffold = (build) => {
+/**
+* The config init writes. With the `resources` init set up, it names the
+* Cosmos DB account, and reads both connection strings with `secretEnv`,
+* from the environment and `.env.hotupdater`, then the config's `secrets`
+* adapter. Without them, as the agent scaffold writes it, it reads them
+* from the environment.
+*/
+const getConfigScaffold = (build, resources) => {
+	const read = (reader, name) => resources === void 0 ? `process.env.${name}!` : `async () =>
+      (await ${reader}()).${name}`;
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/azure",
 			named: ["azureBlobStorage"]
 		}],
 		configString: `azureBlobStorage({
-    connectionString: process.env.HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING!,
+    connectionString: ${read("storageSecrets", "HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING")},
     containerName: "${BLOB_CONTAINER}",
   })`
 	};
-	return createHotUpdaterConfigScaffoldFromBuilder(new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase({
+	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/azure",
 			named: ["cosmosDatabase"]
 		}],
-		configString: `cosmosDatabase({
-    connectionString: process.env.HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING!,
+		configString: `cosmosDatabase({${resources?.cosmosEndpoint === void 0 ? "" : `
+    endpoint: ${JSON.stringify(resources.cosmosEndpoint)},`}
+    connectionString: ${read("databaseSecrets", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING")},
   })`
-	}).setPlugins({
+	};
+	const helperStatements = resources === void 0 ? [] : [secretEnvHelper("storageSecrets", ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING"]), secretEnvHelper("databaseSecrets", ["HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"])];
+	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
 			named: [
@@ -7475,7 +7494,12 @@ const getConfigScaffold = (build) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+	});
+	if (resources !== void 0) builder.addImport({
+		pkg: "hot-updater",
+		named: ["secretEnv"]
+	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n"));
+	return createHotUpdaterConfigScaffoldFromBuilder(builder, { helperStatements });
 };
 //#endregion
 //#region iac/init/index.ts
@@ -7560,7 +7584,8 @@ const initProvider = {
 			optional: true,
 			preflight: false
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"]
 };
 //#endregion
 //#region iac/index.ts
@@ -7620,10 +7645,10 @@ const resolveName = async ({ input, saved, fallback, nonInteractive, validate, h
 		validate: (value) => validate(value) ? void 0 : hint
 	}));
 };
-const runInit = async ({ build, envFile }) => {
+const runInit = async ({ build, envFile, secretsEnv }) => {
 	const cwd = getCwd();
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile);
+	const initEnvSources = await readHotUpdaterInitEnv(cwd, envFile, secretsEnv);
 	const initInputEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
 	const saved = Object.fromEntries(Object.entries(inputs).map(([name, input]) => [name, initInputEnv[input.envKey]?.trim() || void 0]));
 	const cliVersion = await azureCliVersion();
@@ -7830,7 +7855,8 @@ const runInit = async ({ build, envFile }) => {
 		await database.dispose?.();
 	}
 	p.log.success("Generated '.env.hotupdater' file with Azure settings.");
-	await writeHotUpdaterFiles(getConfigScaffold(build), {
+	const cosmosEndpoint = /AccountEndpoint=([^;]+)/iu.exec(cosmosConnectionString)?.[1];
+	await writeHotUpdaterFiles(getConfigScaffold(build, cosmosEndpoint === void 0 ? {} : { cosmosEndpoint }), {
 		cwd,
 		settings: "Azure"
 	});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/azure",
   "type": "module",
-  "version": "1.2.0-rc.4",
+  "version": "1.2.0-rc.5",
   "description": "React Native OTA solution for self-hosted",
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
@@ -42,10 +42,10 @@
     "@azure/core-auth": "1.11.0",
     "@azure/cosmos": "4.10.1",
     "@azure/storage-blob": "12.34.0",
-    "@hot-updater/plugin-core": "1.2.0-rc.4",
-    "@hot-updater/cli-tools": "1.2.0-rc.4",
-    "@hot-updater/server": "1.2.0-rc.4",
-    "@hot-updater/protocol": "1.2.0-rc.4"
+    "@hot-updater/cli-tools": "1.2.0-rc.5",
+    "@hot-updater/plugin-core": "1.2.0-rc.5",
+    "@hot-updater/protocol": "1.2.0-rc.5",
+    "@hot-updater/server": "1.2.0-rc.5"
   },
   "devDependencies": {
     "@azure/functions": "4.16.5",
@@ -53,7 +53,7 @@
     "execa": "9.5.2",
     "jszip": "^3.10.1",
     "vitest": "4.1.4",
-    "@hot-updater/test-utils": "1.2.0-rc.4"
+    "@hot-updater/test-utils": "1.2.0-rc.5"
   },
   "scripts": {
     "build": "tsdown",