@hot-updater/azure 1.2.0-rc.7 → 1.2.0-rc.9

package/dist/functions/index.mjs

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { EventEmitter } from "events";
+import Stream, { Duplex, Readable, Transform } from "node:stream";
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "node:crypto";
 import process$1 from "node:process";
 import os, { EOL } from "node:os";
@@ -7,7 +8,6 @@ import util, { inspect } from "node:util";
 import http from "node:http";
 import https from "node:https";
 import zlib from "node:zlib";
-import Stream, { Duplex, Readable, Transform } from "node:stream";
 import { Readable as Readable$1 } from "stream";
 import buffer from "node:buffer";
 import { Buffer as Buffer$1 } from "buffer";
@@ -8118,7 +8118,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.7";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.9";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 const createVersionRouteHandlers = (plugins = []) => {
@@ -57555,7 +57555,6 @@ function azureBlobStorage(config) {
 				const headers = new Headers();
 				if (download.contentType) headers.set("content-type", download.contentType);
 				if (download.contentLength !== void 0) headers.set("content-length", String(download.contentLength));
-				const { Readable } = await import("node:stream");
 				return { response: new Response(Readable.toWeb(body), { headers }) };
 			} catch (error) {
 				if (isNotFound(error)) return { response: null };

package/dist/index.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_stream = require("node:stream");
 let _azure_core_auth = require("@azure/core-auth");
 let _azure_storage_blob = require("@azure/storage-blob");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
@@ -158,8 +159,7 @@ function azureBlobStorage(config) {
 				const headers = new Headers();
 				if (download.contentType) headers.set("content-type", download.contentType);
 				if (download.contentLength !== void 0) headers.set("content-length", String(download.contentLength));
-				const { Readable } = await import("node:stream");
-				return { response: new Response(Readable.toWeb(body), { headers }) };
+				return { response: new Response(node_stream.Readable.toWeb(body), { headers }) };
 			} catch (error) {
 				if (isNotFound(error)) return { response: null };
 				throw error;
@@ -293,7 +293,7 @@ const TRANSIENT = /* @__PURE__ */ new Set([
 	503
 ]);
 /** An error's HTTP status, or its cause's: the SDK wraps some answers, such as a failed batch's. */
-const statusOf = (error) => {
+const statusOf$1 = (error) => {
 	for (let at = error; at !== null && typeof at === "object"; at = at.cause) {
 		const { statusCode, code } = at;
 		const status = statusCode ?? code;
@@ -302,7 +302,7 @@ const statusOf = (error) => {
 };
 /** A missing database or container reads as a missing schema, like SQL's 42P01. */
 const missingContainer = (error) => {
-	throw statusOf(error) === 404 ? Object.assign(new Error(error.message, { cause: error }), { code: "42P01" }) : error;
+	throw statusOf$1(error) === 404 ? Object.assign(new Error(error.message, { cause: error }), { code: "42P01" }) : error;
 };
 /** The header of a container read that reports its index transformation, in percent. */
 const INDEX_TRANSFORMATION_PROGRESS = "x-ms-documentdb-collection-index-transformation-progress";
@@ -380,7 +380,7 @@ const isWideAdd = (op) => op.type === "add" && Object.keys(op.by).length + (op.e
 * another one with these errors, having written nothing. Cosmos DB itself
 * runs the batches of a partition one at a time and never reports them.
 */
-const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(SqlState\(E(25P02|40001|40P01)\)/.test(String(error instanceof Error ? error.message : error));
+const emulatorAborted = (error) => statusOf$1(error) === 500 && /PostgresError\(SqlState\(E(25P02|40001|40P01)\)/.test(String(error instanceof Error ? error.message : error));
 /**
 * The key-value store over one Cosmos DB container of `{ pk, sk, row }`
 * items in one logical partition, read through the composite index on
@@ -641,7 +641,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					results = response.result;
 				} catch (error) {
 					if (emulatorAborted(error)) continue;
-					if (TRANSIENT.has(statusOf(error))) return {
+					if (TRANSIENT.has(statusOf$1(error))) return {
 						ok: false,
 						retry: true
 					};
@@ -675,7 +675,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					id,
 					partitionKey: COSMOS_PARTITION
 				}))).catch(missingContainer)).flatMap((result, at) => {
-					const status = result.response?.statusCode ?? statusOf(result.error);
+					const status = result.response?.statusCode ?? statusOf$1(result.error);
 					return typeof status === "number" && status < 400 || status === 404 ? [] : [{
 						id: remaining[at],
 						error: result.error,
@@ -793,6 +793,254 @@ const cosmosDatabase = (config) => {
 	};
 };
 //#endregion
+//#region src/keyVault.ts
+const NAME = "keyVault";
+const VAULT_NAME_PATTERN = /^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/u;
+/** The characters Key Vault takes in a secret's name. */
+const PREFIX_PATTERN = /^[A-Za-z0-9-]*$/u;
+/** Names Key Vault keeps as they are: lower case, digits, single hyphens. */
+const PLAIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const MAX_SECRET_NAME_LENGTH = 127;
+/** Key Vault's limit on a value, in characters: it refuses one more. */
+const MAX_SECRET_LENGTH = 25600;
+/** The tag that keeps the name a secret holds, which a mapped name hides. */
+const NAME_TAG = "hot-updater-name";
+/** Errors of `@azure/identity` finding no identity, or failing to sign in. */
+const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+	"AggregateAuthenticationError",
+	"AuthenticationRequiredError",
+	"CredentialUnavailableError"
+]);
+const SIGN_IN_HINT = [
+	"In CI, sign in with azure/login.",
+	"On your machine, run az login.",
+	"Or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET."
+];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as Azure's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
+const READ_ROLE = "Key Vault Secrets User";
+const WRITE_ROLE = "Key Vault Secrets Officer";
+const errorName = (error) => error instanceof Error ? error.name : "";
+/** The message's first line: Key Vault's next lines name the caller's IDs. */
+const errorMessage = (error) => ((error instanceof Error ? error.message : String(error)).split(/\r?\n/u, 1)[0] ?? "").replace(/\.+$/u, "");
+const innerCode = (error) => {
+	const inner = error?.details?.error;
+	return inner?.innerError?.code ?? inner?.innererror?.code;
+};
+const statusOf = (error) => error?.statusCode;
+const isLoopback = (hostname) => (/* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+])).has(hostname);
+const resolveVaultUrl = (vaultName, vaultUrl) => {
+	if (vaultName === void 0 === (vaultUrl === void 0)) throw new Error(`${NAME} needs a vaultName or a vaultUrl, and not both.`);
+	if (vaultName !== void 0) {
+		if (typeof vaultName !== "string" || !VAULT_NAME_PATTERN.test(vaultName)) throw failure([`${NAME} can't use the vault name ${JSON.stringify(vaultName)}.`, "Use 3 to 24 letters, digits, and single hyphens; start with a letter."]);
+		return new URL(`https://${vaultName.toLowerCase()}.vault.azure.net`);
+	}
+	let url;
+	try {
+		url = new URL(String(vaultUrl).trim());
+	} catch {
+		throw new Error(`${NAME} vaultUrl must be a valid URL.`);
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw failure([
+		`${NAME} can't use its vaultUrl.`,
+		"Use an HTTPS origin, such as https://my-vault.vault.azure.net.",
+		"Leave out credentials, a path, a query, and a fragment."
+	]);
+	return url;
+};
+/** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
+const mask = async (values) => {
+	const { registerSecretValue } = await import("@hot-updater/cli-tools");
+	for (const value of values) if (value) registerSecretValue(value);
+};
+/** `credential`, with each access token it returns masked. */
+const maskTokens = (credential) => ({ getToken: async (scopes, options) => {
+	const token = await credential.getToken(scopes, options);
+	await mask([token?.token]);
+	return token;
+} });
+/**
+* The Key Vault secret name of `name`, after `prefix`. Key Vault takes
+* only letters, digits, and `-` in a name, and matches names without
+* regard to case, so:
+*
+* - a name of lower-case letters and digits in words joined by single
+*   hyphens, such as `asc-api-key`, is kept as it is;
+* - any other name, such as `CLOUDFLARE_API_TOKEN` or `upload.keystore`,
+*   becomes its lower-cased words joined by `-`, then `--` and the first 10
+*   hex digits of the SHA-256 of the exact name:
+*   `cloudflare-api-token--<hash>`.
+*
+* A kept name never holds `--` and a mapped one always does, so no two
+* names share a secret, and `CLOUDFLARE_API_TOKEN` and
+* `cloudflare-api-token` stay apart. Each secret `set` stores is tagged
+* `hot-updater-name` with the name it holds.
+*/
+const keyVaultSecretName = (name, prefix = "hot-updater-") => {
+	if (PLAIN_NAME_PATTERN.test(name)) return `${prefix}${name}`;
+	return `${prefix}${name.toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "")}--${(0, node_crypto.createHash)("sha256").update(name).digest("hex").slice(0, 10)}`;
+};
+/**
+* Secrets from Azure Key Vault: each name is the secret `<prefix><name>`
+* of the vault, `hot-updater-asc-api-key` for `asc-api-key`, with any
+* other name mapped as `keyVaultSecretName` says, read at its current
+* version. `set` adds a new version of
+* the secret, which creates it when it does not exist; Key Vault keeps the
+* older versions. A name whose secret was deleted and is still recoverable
+* reads as missing, and `set` on it fails with the `az` commands that
+* recover or purge it. `@azure/keyvault-secrets`, and `@azure/identity`
+* without a `credential`, load on the first read or write, so a config
+* that only uses `azureBlobStorage` never loads them.
+*
+* @example
+* secrets: keyVault({ vaultName: "my-vault" })
+*/
+const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl }) => {
+	const vault = () => {
+		const url = resolveVaultUrl(vaultName, vaultUrl);
+		if (typeof prefix !== "string" || !PREFIX_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and - only.`);
+		return url;
+	};
+	const secretName = (name) => {
+		vault();
+		const id = keyVaultSecretName(name, prefix);
+		if (id.length > MAX_SECRET_NAME_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)} for ${JSON.stringify(name)}.`, `Key Vault takes up to ${MAX_SECRET_NAME_LENGTH} characters.`]);
+		return id;
+	};
+	/** The vault's name, for the az commands messages suggest. */
+	const vaultLabel = () => vault().hostname.split(".")[0];
+	let opened;
+	const open = () => {
+		const url = vault();
+		if (credential !== void 0 && !(0, _azure_core_auth.isTokenCredential)(credential)) throw new Error(`${NAME} credential must be a TokenCredential, such as one from @azure/identity.`);
+		opened ??= Promise.all([import("@azure/keyvault-secrets"), credential ?? import("@azure/identity").then(({ DefaultAzureCredential }) => new DefaultAzureCredential())]).then(([sdk, signWith]) => new sdk.SecretClient(url.origin, maskTokens(signWith), { disableChallengeResourceVerification: isLoopback(url.hostname) })).catch((error) => {
+			opened = void 0;
+			throw error;
+		});
+		return opened;
+	};
+	const describeFailure = (verb, id, error, role) => {
+		const name = errorName(error);
+		const status = statusOf(error);
+		const code = innerCode(error) ?? error?.code;
+		const detail = wrap(`${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no Azure identity to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (status === 401) return failure([
+			`Azure Key Vault refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"Sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (code === "SecretDisabled") return failure([
+			`Azure Key Vault can't ${verb} a secret.`,
+			secret,
+			"Its current version is disabled. Enable it, or store a new value."
+		], error);
+		if (status === 403) return failure([
+			`Azure Key Vault refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The Azure identity needs the ${role} role on the vault.`,
+			`With access policies, it needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.`,
+			"A firewall may also refuse this network."
+		], error);
+		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([
+			`Azure Key Vault can't ${verb} a secret: it is being deleted.`,
+			secret,
+			"Try again in a minute."
+		], error);
+		if (status === 409 || code === "ObjectIsDeletedButRecoverable") {
+			const vaultName = vaultLabel();
+			return failure([
+				`Azure Key Vault can't ${verb} a secret: it was deleted.`,
+				secret,
+				"Recover it, or purge it:",
+				`az keyvault secret recover --vault-name ${vaultName} \\`,
+				`  --name ${id}`,
+				`az keyvault secret purge --vault-name ${vaultName} \\`,
+				`  --name ${id}`
+			], error);
+		}
+		return failure([
+			`Azure Key Vault failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
+	};
+	const read = async (client, id) => {
+		let value;
+		try {
+			({value} = await client.getSecret(id));
+		} catch (error) {
+			if (statusOf(error) === 404 && /NotFound/u.test(error.code ?? "") && !/disabled/iu.test(errorMessage(error))) return;
+			throw describeFailure("read", id, error, READ_ROLE);
+		}
+		await mask([value]);
+		return value;
+	};
+	return {
+		name: NAME,
+		get: async (names) => {
+			const unique = [...new Set(names)];
+			const ids = unique.map(secretName);
+			const result = Object.create(null);
+			if (unique.length === 0) return result;
+			const client = await open();
+			const values = await Promise.all(ids.map((id) => read(client, id)));
+			unique.forEach((name, index) => {
+				result[name] = values[index];
+			});
+			return result;
+		},
+		set: async (name, value) => {
+			const id = secretName(name);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (value.length > MAX_SECRET_LENGTH) throw failure([`${NAME} can't store ${id}: it has ${value.length} characters.`, `Key Vault takes up to ${MAX_SECRET_LENGTH} characters per secret.`]);
+			await mask([value]);
+			const client = await open();
+			try {
+				await client.setSecret(id, value, { tags: { [NAME_TAG]: name } });
+			} catch (error) {
+				throw describeFailure("write", id, error, WRITE_ROLE);
+			}
+		},
+		describe: (name) => {
+			let url;
+			try {
+				url = vault().origin;
+			} catch {
+				url = String(vaultUrl ?? vaultName);
+			}
+			return `the secret ${JSON.stringify(keyVaultSecretName(name, prefix))} in Azure Key Vault (${url})`;
+		}
+	};
+};
+//#endregion
 exports.azureBlobStorage = azureBlobStorage;
 exports.cosmosDatabase = cosmosDatabase;
+exports.keyVault = keyVault;
 exports.migrateCosmosDatabase = migrateCosmosDatabase;

package/dist/index.d.cts

@@ -1,16 +1,16 @@
 import { TokenCredential } from "@azure/core-auth";
 import { StorageSharedKeyCredential } from "@azure/storage-blob";
-import { EngineDatabase, PluginTables, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { CosmosClientOptions } from "@azure/cosmos";
 //#region src/azureBlobStorage.d.ts
 /** The account to connect to: its connection string, or its Blob endpoint and a credential. */
 type AzureBlobConnection = {
   /**
    * The account's connection string, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on first use, so
-   * a config loads without it.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on
+   * first use, so a config loads without it.
    */
-  readonly connectionString: string | (() => string | Promise<string>);
+  readonly connectionString: Lazy<string>;
 } | {
   /** The Blob service endpoint, such as `https://<account>.blob.core.windows.net`. */
   readonly accountUrl: string;
@@ -46,11 +46,11 @@ declare function azureBlobStorage(config: AzureBlobStorageConfig): StorageAdapte
 type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel" | "connectionString"> & {
   /**
    * The account's connection string, or a function that returns it, such as
-   * one that reads it with `secretEnv`: called on the first request, so a
-   * config loads without it. `endpoint` beside a function names the
-   * account to `hot-updater doctor`.
+   * `secret("<name>")` in `hot-updater.config.ts`: called on the first
+   * request, so a config loads without it. `endpoint` beside a function
+   * names the account to `hot-updater doctor`.
    */
-  readonly connectionString?: string | (() => string | Promise<string>);
+  readonly connectionString?: Lazy<string>;
   readonly consistencyLevel?: "Strong";
   /** The database the container lives in. @default "hot-updater" */
   readonly databaseId?: string;
@@ -80,4 +80,51 @@ declare const migrateCosmosDatabase: (config: CosmosDatabaseConfig, plugins?: re
  */
 declare const cosmosDatabase: (config: CosmosDatabaseConfig) => EngineDatabase;
 //#endregion
-export { AzureBlobConnection, AzureBlobStorageConfig, CosmosDatabaseConfig, azureBlobStorage, cosmosDatabase, migrateCosmosDatabase };
+//#region src/keyVault.d.ts
+interface KeyVaultOptions {
+  /**
+   * The vault's name, which reads `https://<vaultName>.vault.azure.net`.
+   * Set it or `vaultUrl`.
+   */
+  readonly vaultName?: string;
+  /**
+   * The vault's URL, such as `https://my-vault.vault.azure.net`, for a
+   * vault outside Azure's public cloud. An HTTPS URL on a loopback address,
+   * such as a local emulator's, skips the check that the sign-in challenge
+   * names the vault's domain.
+   */
+  readonly vaultUrl?: string;
+  /**
+   * Put before each name to make its secret's name, so `secret("asc-api-key")`
+   * reads the secret `hot-updater-asc-api-key`. Letters, digits, and `-`.
+   *
+   * @default "hot-updater-"
+   */
+  readonly prefix?: string;
+  /**
+   * The Microsoft Entra identity to sign in with, such as a
+   * `ClientSecretCredential` from `@azure/identity`. Without it,
+   * `DefaultAzureCredential`: `AZURE_CLIENT_ID` and its siblings, or the
+   * federated token `azure/login` leaves in CI, then `az login` on your
+   * machine, or a managed identity.
+   */
+  readonly credential?: TokenCredential;
+}
+/**
+ * Secrets from Azure Key Vault: each name is the secret `<prefix><name>`
+ * of the vault, `hot-updater-asc-api-key` for `asc-api-key`, with any
+ * other name mapped as `keyVaultSecretName` says, read at its current
+ * version. `set` adds a new version of
+ * the secret, which creates it when it does not exist; Key Vault keeps the
+ * older versions. A name whose secret was deleted and is still recoverable
+ * reads as missing, and `set` on it fails with the `az` commands that
+ * recover or purge it. `@azure/keyvault-secrets`, and `@azure/identity`
+ * without a `credential`, load on the first read or write, so a config
+ * that only uses `azureBlobStorage` never loads them.
+ *
+ * @example
+ * secrets: keyVault({ vaultName: "my-vault" })
+ */
+declare const keyVault: ({ credential, prefix, vaultName, vaultUrl }: KeyVaultOptions) => SecretsAdapter;
+//#endregion
+export { AzureBlobConnection, AzureBlobStorageConfig, CosmosDatabaseConfig, KeyVaultOptions, azureBlobStorage, cosmosDatabase, keyVault, migrateCosmosDatabase };

package/dist/index.d.mts

@@ -1,16 +1,16 @@
 import { TokenCredential } from "@azure/core-auth";
 import { StorageSharedKeyCredential } from "@azure/storage-blob";
-import { EngineDatabase, PluginTables, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, PluginTables, SecretsAdapter, StorageAdapter, StorageAdapterWith } from "@hot-updater/plugin-core";
 import { CosmosClientOptions } from "@azure/cosmos";
 //#region src/azureBlobStorage.d.ts
 /** The account to connect to: its connection string, or its Blob endpoint and a credential. */
 type AzureBlobConnection = {
   /**
    * The account's connection string, or a function that returns it,
-   * such as one that reads it with `secretEnv`: called on first use, so
-   * a config loads without it.
+   * such as `secret("<name>")` in `hot-updater.config.ts`: called on
+   * first use, so a config loads without it.
    */
-  readonly connectionString: string | (() => string | Promise<string>);
+  readonly connectionString: Lazy<string>;
 } | {
   /** The Blob service endpoint, such as `https://<account>.blob.core.windows.net`. */
   readonly accountUrl: string;
@@ -46,11 +46,11 @@ declare function azureBlobStorage(config: AzureBlobStorageConfig): StorageAdapte
 type CosmosDatabaseConfig = Omit<CosmosClientOptions, "consistencyLevel" | "connectionString"> & {
   /**
    * The account's connection string, or a function that returns it, such as
-   * one that reads it with `secretEnv`: called on the first request, so a
-   * config loads without it. `endpoint` beside a function names the
-   * account to `hot-updater doctor`.
+   * `secret("<name>")` in `hot-updater.config.ts`: called on the first
+   * request, so a config loads without it. `endpoint` beside a function
+   * names the account to `hot-updater doctor`.
    */
-  readonly connectionString?: string | (() => string | Promise<string>);
+  readonly connectionString?: Lazy<string>;
   readonly consistencyLevel?: "Strong";
   /** The database the container lives in. @default "hot-updater" */
   readonly databaseId?: string;
@@ -80,4 +80,51 @@ declare const migrateCosmosDatabase: (config: CosmosDatabaseConfig, plugins?: re
  */
 declare const cosmosDatabase: (config: CosmosDatabaseConfig) => EngineDatabase;
 //#endregion
-export { AzureBlobConnection, AzureBlobStorageConfig, CosmosDatabaseConfig, azureBlobStorage, cosmosDatabase, migrateCosmosDatabase };
+//#region src/keyVault.d.ts
+interface KeyVaultOptions {
+  /**
+   * The vault's name, which reads `https://<vaultName>.vault.azure.net`.
+   * Set it or `vaultUrl`.
+   */
+  readonly vaultName?: string;
+  /**
+   * The vault's URL, such as `https://my-vault.vault.azure.net`, for a
+   * vault outside Azure's public cloud. An HTTPS URL on a loopback address,
+   * such as a local emulator's, skips the check that the sign-in challenge
+   * names the vault's domain.
+   */
+  readonly vaultUrl?: string;
+  /**
+   * Put before each name to make its secret's name, so `secret("asc-api-key")`
+   * reads the secret `hot-updater-asc-api-key`. Letters, digits, and `-`.
+   *
+   * @default "hot-updater-"
+   */
+  readonly prefix?: string;
+  /**
+   * The Microsoft Entra identity to sign in with, such as a
+   * `ClientSecretCredential` from `@azure/identity`. Without it,
+   * `DefaultAzureCredential`: `AZURE_CLIENT_ID` and its siblings, or the
+   * federated token `azure/login` leaves in CI, then `az login` on your
+   * machine, or a managed identity.
+   */
+  readonly credential?: TokenCredential;
+}
+/**
+ * Secrets from Azure Key Vault: each name is the secret `<prefix><name>`
+ * of the vault, `hot-updater-asc-api-key` for `asc-api-key`, with any
+ * other name mapped as `keyVaultSecretName` says, read at its current
+ * version. `set` adds a new version of
+ * the secret, which creates it when it does not exist; Key Vault keeps the
+ * older versions. A name whose secret was deleted and is still recoverable
+ * reads as missing, and `set` on it fails with the `az` commands that
+ * recover or purge it. `@azure/keyvault-secrets`, and `@azure/identity`
+ * without a `credential`, load on the first read or write, so a config
+ * that only uses `azureBlobStorage` never loads them.
+ *
+ * @example
+ * secrets: keyVault({ vaultName: "my-vault" })
+ */
+declare const keyVault: ({ credential, prefix, vaultName, vaultUrl }: KeyVaultOptions) => SecretsAdapter;
+//#endregion
+export { AzureBlobConnection, AzureBlobStorageConfig, CosmosDatabaseConfig, KeyVaultOptions, azureBlobStorage, cosmosDatabase, keyVault, migrateCosmosDatabase };

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { Readable } from "node:stream";
 import { isTokenCredential } from "@azure/core-auth";
 import { BlobSASPermissions, BlobServiceClient, RestError, StorageSharedKeyCredential, generateBlobSASQueryParameters } from "@azure/storage-blob";
 import { SETTINGS_TABLE, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, encodeKvKey, migrateCoreSchema, parseStorageUri, toolingTargetOf } from "@hot-updater/plugin-core";
@@ -157,7 +158,6 @@ function azureBlobStorage(config) {
 				const headers = new Headers();
 				if (download.contentType) headers.set("content-type", download.contentType);
 				if (download.contentLength !== void 0) headers.set("content-length", String(download.contentLength));
-				const { Readable } = await import("node:stream");
 				return { response: new Response(Readable.toWeb(body), { headers }) };
 			} catch (error) {
 				if (isNotFound(error)) return { response: null };
@@ -292,7 +292,7 @@ const TRANSIENT = /* @__PURE__ */ new Set([
 	503
 ]);
 /** An error's HTTP status, or its cause's: the SDK wraps some answers, such as a failed batch's. */
-const statusOf = (error) => {
+const statusOf$1 = (error) => {
 	for (let at = error; at !== null && typeof at === "object"; at = at.cause) {
 		const { statusCode, code } = at;
 		const status = statusCode ?? code;
@@ -301,7 +301,7 @@ const statusOf = (error) => {
 };
 /** A missing database or container reads as a missing schema, like SQL's 42P01. */
 const missingContainer = (error) => {
-	throw statusOf(error) === 404 ? Object.assign(new Error(error.message, { cause: error }), { code: "42P01" }) : error;
+	throw statusOf$1(error) === 404 ? Object.assign(new Error(error.message, { cause: error }), { code: "42P01" }) : error;
 };
 /** The header of a container read that reports its index transformation, in percent. */
 const INDEX_TRANSFORMATION_PROGRESS = "x-ms-documentdb-collection-index-transformation-progress";
@@ -379,7 +379,7 @@ const isWideAdd = (op) => op.type === "add" && Object.keys(op.by).length + (op.e
 * another one with these errors, having written nothing. Cosmos DB itself
 * runs the batches of a partition one at a time and never reports them.
 */
-const emulatorAborted = (error) => statusOf(error) === 500 && /PostgresError\(SqlState\(E(25P02|40001|40P01)\)/.test(String(error instanceof Error ? error.message : error));
+const emulatorAborted = (error) => statusOf$1(error) === 500 && /PostgresError\(SqlState\(E(25P02|40001|40P01)\)/.test(String(error instanceof Error ? error.message : error));
 /**
 * The key-value store over one Cosmos DB container of `{ pk, sk, row }`
 * items in one logical partition, read through the composite index on
@@ -640,7 +640,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					results = response.result;
 				} catch (error) {
 					if (emulatorAborted(error)) continue;
-					if (TRANSIENT.has(statusOf(error))) return {
+					if (TRANSIENT.has(statusOf$1(error))) return {
 						ok: false,
 						retry: true
 					};
@@ -674,7 +674,7 @@ const createCosmosStore = ({ client, databaseId, containerId, engine, nativePage
 					id,
 					partitionKey: COSMOS_PARTITION
 				}))).catch(missingContainer)).flatMap((result, at) => {
-					const status = result.response?.statusCode ?? statusOf(result.error);
+					const status = result.response?.statusCode ?? statusOf$1(result.error);
 					return typeof status === "number" && status < 400 || status === 404 ? [] : [{
 						id: remaining[at],
 						error: result.error,
@@ -792,4 +792,251 @@ const cosmosDatabase = (config) => {
 	};
 };
 //#endregion
-export { azureBlobStorage, cosmosDatabase, migrateCosmosDatabase };
+//#region src/keyVault.ts
+const NAME = "keyVault";
+const VAULT_NAME_PATTERN = /^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/u;
+/** The characters Key Vault takes in a secret's name. */
+const PREFIX_PATTERN = /^[A-Za-z0-9-]*$/u;
+/** Names Key Vault keeps as they are: lower case, digits, single hyphens. */
+const PLAIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const MAX_SECRET_NAME_LENGTH = 127;
+/** Key Vault's limit on a value, in characters: it refuses one more. */
+const MAX_SECRET_LENGTH = 25600;
+/** The tag that keeps the name a secret holds, which a mapped name hides. */
+const NAME_TAG = "hot-updater-name";
+/** Errors of `@azure/identity` finding no identity, or failing to sign in. */
+const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+	"AggregateAuthenticationError",
+	"AuthenticationRequiredError",
+	"CredentialUnavailableError"
+]);
+const SIGN_IN_HINT = [
+	"In CI, sign in with azure/login.",
+	"On your machine, run az login.",
+	"Or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET."
+];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as Azure's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
+const READ_ROLE = "Key Vault Secrets User";
+const WRITE_ROLE = "Key Vault Secrets Officer";
+const errorName = (error) => error instanceof Error ? error.name : "";
+/** The message's first line: Key Vault's next lines name the caller's IDs. */
+const errorMessage = (error) => ((error instanceof Error ? error.message : String(error)).split(/\r?\n/u, 1)[0] ?? "").replace(/\.+$/u, "");
+const innerCode = (error) => {
+	const inner = error?.details?.error;
+	return inner?.innerError?.code ?? inner?.innererror?.code;
+};
+const statusOf = (error) => error?.statusCode;
+const isLoopback = (hostname) => (/* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+])).has(hostname);
+const resolveVaultUrl = (vaultName, vaultUrl) => {
+	if (vaultName === void 0 === (vaultUrl === void 0)) throw new Error(`${NAME} needs a vaultName or a vaultUrl, and not both.`);
+	if (vaultName !== void 0) {
+		if (typeof vaultName !== "string" || !VAULT_NAME_PATTERN.test(vaultName)) throw failure([`${NAME} can't use the vault name ${JSON.stringify(vaultName)}.`, "Use 3 to 24 letters, digits, and single hyphens; start with a letter."]);
+		return new URL(`https://${vaultName.toLowerCase()}.vault.azure.net`);
+	}
+	let url;
+	try {
+		url = new URL(String(vaultUrl).trim());
+	} catch {
+		throw new Error(`${NAME} vaultUrl must be a valid URL.`);
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw failure([
+		`${NAME} can't use its vaultUrl.`,
+		"Use an HTTPS origin, such as https://my-vault.vault.azure.net.",
+		"Leave out credentials, a path, a query, and a fragment."
+	]);
+	return url;
+};
+/** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
+const mask = async (values) => {
+	const { registerSecretValue } = await import("@hot-updater/cli-tools");
+	for (const value of values) if (value) registerSecretValue(value);
+};
+/** `credential`, with each access token it returns masked. */
+const maskTokens = (credential) => ({ getToken: async (scopes, options) => {
+	const token = await credential.getToken(scopes, options);
+	await mask([token?.token]);
+	return token;
+} });
+/**
+* The Key Vault secret name of `name`, after `prefix`. Key Vault takes
+* only letters, digits, and `-` in a name, and matches names without
+* regard to case, so:
+*
+* - a name of lower-case letters and digits in words joined by single
+*   hyphens, such as `asc-api-key`, is kept as it is;
+* - any other name, such as `CLOUDFLARE_API_TOKEN` or `upload.keystore`,
+*   becomes its lower-cased words joined by `-`, then `--` and the first 10
+*   hex digits of the SHA-256 of the exact name:
+*   `cloudflare-api-token--<hash>`.
+*
+* A kept name never holds `--` and a mapped one always does, so no two
+* names share a secret, and `CLOUDFLARE_API_TOKEN` and
+* `cloudflare-api-token` stay apart. Each secret `set` stores is tagged
+* `hot-updater-name` with the name it holds.
+*/
+const keyVaultSecretName = (name, prefix = "hot-updater-") => {
+	if (PLAIN_NAME_PATTERN.test(name)) return `${prefix}${name}`;
+	return `${prefix}${name.toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "")}--${createHash("sha256").update(name).digest("hex").slice(0, 10)}`;
+};
+/**
+* Secrets from Azure Key Vault: each name is the secret `<prefix><name>`
+* of the vault, `hot-updater-asc-api-key` for `asc-api-key`, with any
+* other name mapped as `keyVaultSecretName` says, read at its current
+* version. `set` adds a new version of
+* the secret, which creates it when it does not exist; Key Vault keeps the
+* older versions. A name whose secret was deleted and is still recoverable
+* reads as missing, and `set` on it fails with the `az` commands that
+* recover or purge it. `@azure/keyvault-secrets`, and `@azure/identity`
+* without a `credential`, load on the first read or write, so a config
+* that only uses `azureBlobStorage` never loads them.
+*
+* @example
+* secrets: keyVault({ vaultName: "my-vault" })
+*/
+const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl }) => {
+	const vault = () => {
+		const url = resolveVaultUrl(vaultName, vaultUrl);
+		if (typeof prefix !== "string" || !PREFIX_PATTERN.test(prefix)) throw new Error(`${NAME}'s prefix takes letters, digits, and - only.`);
+		return url;
+	};
+	const secretName = (name) => {
+		vault();
+		const id = keyVaultSecretName(name, prefix);
+		if (id.length > MAX_SECRET_NAME_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)} for ${JSON.stringify(name)}.`, `Key Vault takes up to ${MAX_SECRET_NAME_LENGTH} characters.`]);
+		return id;
+	};
+	/** The vault's name, for the az commands messages suggest. */
+	const vaultLabel = () => vault().hostname.split(".")[0];
+	let opened;
+	const open = () => {
+		const url = vault();
+		if (credential !== void 0 && !isTokenCredential(credential)) throw new Error(`${NAME} credential must be a TokenCredential, such as one from @azure/identity.`);
+		opened ??= Promise.all([import("@azure/keyvault-secrets"), credential ?? import("@azure/identity").then(({ DefaultAzureCredential }) => new DefaultAzureCredential())]).then(([sdk, signWith]) => new sdk.SecretClient(url.origin, maskTokens(signWith), { disableChallengeResourceVerification: isLoopback(url.hostname) })).catch((error) => {
+			opened = void 0;
+			throw error;
+		});
+		return opened;
+	};
+	const describeFailure = (verb, id, error, role) => {
+		const name = errorName(error);
+		const status = statusOf(error);
+		const code = innerCode(error) ?? error?.code;
+		const detail = wrap(`${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no Azure identity to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (status === 401) return failure([
+			`Azure Key Vault refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"Sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (code === "SecretDisabled") return failure([
+			`Azure Key Vault can't ${verb} a secret.`,
+			secret,
+			"Its current version is disabled. Enable it, or store a new value."
+		], error);
+		if (status === 403) return failure([
+			`Azure Key Vault refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The Azure identity needs the ${role} role on the vault.`,
+			`With access policies, it needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.`,
+			"A firewall may also refuse this network."
+		], error);
+		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([
+			`Azure Key Vault can't ${verb} a secret: it is being deleted.`,
+			secret,
+			"Try again in a minute."
+		], error);
+		if (status === 409 || code === "ObjectIsDeletedButRecoverable") {
+			const vaultName = vaultLabel();
+			return failure([
+				`Azure Key Vault can't ${verb} a secret: it was deleted.`,
+				secret,
+				"Recover it, or purge it:",
+				`az keyvault secret recover --vault-name ${vaultName} \\`,
+				`  --name ${id}`,
+				`az keyvault secret purge --vault-name ${vaultName} \\`,
+				`  --name ${id}`
+			], error);
+		}
+		return failure([
+			`Azure Key Vault failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
+	};
+	const read = async (client, id) => {
+		let value;
+		try {
+			({value} = await client.getSecret(id));
+		} catch (error) {
+			if (statusOf(error) === 404 && /NotFound/u.test(error.code ?? "") && !/disabled/iu.test(errorMessage(error))) return;
+			throw describeFailure("read", id, error, READ_ROLE);
+		}
+		await mask([value]);
+		return value;
+	};
+	return {
+		name: NAME,
+		get: async (names) => {
+			const unique = [...new Set(names)];
+			const ids = unique.map(secretName);
+			const result = Object.create(null);
+			if (unique.length === 0) return result;
+			const client = await open();
+			const values = await Promise.all(ids.map((id) => read(client, id)));
+			unique.forEach((name, index) => {
+				result[name] = values[index];
+			});
+			return result;
+		},
+		set: async (name, value) => {
+			const id = secretName(name);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (value.length > MAX_SECRET_LENGTH) throw failure([`${NAME} can't store ${id}: it has ${value.length} characters.`, `Key Vault takes up to ${MAX_SECRET_LENGTH} characters per secret.`]);
+			await mask([value]);
+			const client = await open();
+			try {
+				await client.setSecret(id, value, { tags: { [NAME_TAG]: name } });
+			} catch (error) {
+				throw describeFailure("write", id, error, WRITE_ROLE);
+			}
+		},
+		describe: (name) => {
+			let url;
+			try {
+				url = vault().origin;
+			} catch {
+				url = String(vaultUrl ?? vaultName);
+			}
+			return `the secret ${JSON.stringify(keyVaultSecretName(name, prefix))} in Azure Key Vault (${url})`;
+		}
+	};
+};
+//#endregion
+export { azureBlobStorage, cosmosDatabase, keyVault, migrateCosmosDatabase };

package/dist/init/index.cjs

@@ -7460,21 +7460,18 @@ const verifyFunction = async (baseURL, { attempts = 60, delayMs = 5e3 } = {}) =>
 const BLOB_CONTAINER = "hot-updater";
 /**
 * The config init writes. With the `resources` init set up, it names the
-* Cosmos DB account, and reads both connection strings with `secretEnv`,
-* from the environment and `.env.hotupdater`, then the config's `secrets`
-* adapter. Without them, as the agent scaffold writes it, it reads them
-* from the environment.
+* Cosmos DB account. Either way it reads both connection strings with
+* `secret()`, from the environment and `.env.hotupdater`, then the config's
+* `secrets` adapter.
 */
 const getConfigScaffold = (build, resources) => {
-	const read = (reader, name) => resources === void 0 ? `process.env.${name}!` : `async () =>
-      (await ${reader}()).${name}`;
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/azure",
 			named: ["azureBlobStorage"]
 		}],
 		configString: `azureBlobStorage({
-    connectionString: ${read("storageSecrets", "HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING")},
+    connectionString: secret("HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING"),
     containerName: "${BLOB_CONTAINER}",
   })`
 	};
@@ -7485,10 +7482,9 @@ const getConfigScaffold = (build, resources) => {
 		}],
 		configString: `cosmosDatabase({${resources?.cosmosEndpoint === void 0 ? "" : `
     endpoint: ${JSON.stringify(resources.cosmosEndpoint)},`}
-    connectionString: ${read("databaseSecrets", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING")},
+    connectionString: secret("HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"),
   })`
 	};
-	const helperStatements = resources === void 0 ? [] : [(0, _hot_updater_cli_tools.secretEnvHelper)("storageSecrets", ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING"]), (0, _hot_updater_cli_tools.secretEnvHelper)("databaseSecrets", ["HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"])];
 	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
@@ -7499,12 +7495,11 @@ const getConfigScaffold = (build, resources) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	});
-	if (resources !== void 0) builder.addImport({
+	}).addImport({
 		pkg: "hot-updater",
-		named: ["secretEnv"]
-	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n"));
-	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder, { helperStatements });
+		named: ["secret"]
+	});
+	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder);
 };
 //#endregion
 //#region iac/init/index.ts

package/dist/init/index.mjs

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 import { createHash } from "crypto";
 import path from "path";
-import { ConfigBuilder, InitError, assembleServer, createHotUpdaterConfigScaffoldFromBuilder, createZip, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, secretEnvHelper, shouldAutoSelectOnlyInitResource, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
+import { ConfigBuilder, InitError, assembleServer, createHotUpdaterConfigScaffoldFromBuilder, createZip, getCwd, getHotUpdaterInitInputEnv, getInitProviderEnvVars, getInitProviderTextPromptValues, link, makeEnv, p, printAppSetup, provisionClientCredential, readHotUpdaterInitEnv, shouldAutoSelectOnlyInitResource, writeHotUpdaterFiles } from "@hot-updater/cli-tools";
 import { apiKeys, insights, remoteConfig } from "@hot-updater/server/plugins";
 import { CosmosClient } from "@azure/cosmos";
 import { SETTINGS_TABLE, createEngineDatabase, createKvAdapter, encodeKvKey, migrateCoreSchema, toolingTargetOf } from "@hot-updater/plugin-core";
@@ -7455,21 +7455,18 @@ const verifyFunction = async (baseURL, { attempts = 60, delayMs = 5e3 } = {}) =>
 const BLOB_CONTAINER = "hot-updater";
 /**
 * The config init writes. With the `resources` init set up, it names the
-* Cosmos DB account, and reads both connection strings with `secretEnv`,
-* from the environment and `.env.hotupdater`, then the config's `secrets`
-* adapter. Without them, as the agent scaffold writes it, it reads them
-* from the environment.
+* Cosmos DB account. Either way it reads both connection strings with
+* `secret()`, from the environment and `.env.hotupdater`, then the config's
+* `secrets` adapter.
 */
 const getConfigScaffold = (build, resources) => {
-	const read = (reader, name) => resources === void 0 ? `process.env.${name}!` : `async () =>
-      (await ${reader}()).${name}`;
 	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/azure",
 			named: ["azureBlobStorage"]
 		}],
 		configString: `azureBlobStorage({
-    connectionString: ${read("storageSecrets", "HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING")},
+    connectionString: secret("HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING"),
     containerName: "${BLOB_CONTAINER}",
   })`
 	};
@@ -7480,10 +7477,9 @@ const getConfigScaffold = (build, resources) => {
 		}],
 		configString: `cosmosDatabase({${resources?.cosmosEndpoint === void 0 ? "" : `
     endpoint: ${JSON.stringify(resources.cosmosEndpoint)},`}
-    connectionString: ${read("databaseSecrets", "HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING")},
+    connectionString: secret("HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"),
   })`
 	};
-	const helperStatements = resources === void 0 ? [] : [secretEnvHelper("storageSecrets", ["HOT_UPDATER_AZURE_STORAGE_CONNECTION_STRING"]), secretEnvHelper("databaseSecrets", ["HOT_UPDATER_AZURE_COSMOS_CONNECTION_STRING"])];
 	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
@@ -7494,12 +7490,11 @@ const getConfigScaffold = (build, resources) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	});
-	if (resources !== void 0) builder.addImport({
+	}).addImport({
 		pkg: "hot-updater",
-		named: ["secretEnv"]
-	}).setIntermediateCode(helperStatements.map(({ code }) => code).join("\n\n"));
-	return createHotUpdaterConfigScaffoldFromBuilder(builder, { helperStatements });
+		named: ["secret"]
+	});
+	return createHotUpdaterConfigScaffoldFromBuilder(builder);
 };
 //#endregion
 //#region iac/init/index.ts

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/azure",
   "type": "module",
-  "version": "1.2.0-rc.7",
+  "version": "1.2.0-rc.9",
   "description": "React Native OTA solution for self-hosted",
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
@@ -41,11 +41,13 @@
   "dependencies": {
     "@azure/core-auth": "1.11.0",
     "@azure/cosmos": "4.10.1",
+    "@azure/identity": "4.14.0",
+    "@azure/keyvault-secrets": "4.11.2",
     "@azure/storage-blob": "12.34.0",
-    "@hot-updater/cli-tools": "1.2.0-rc.7",
-    "@hot-updater/server": "1.2.0-rc.7",
-    "@hot-updater/plugin-core": "1.2.0-rc.7",
-    "@hot-updater/protocol": "1.2.0-rc.7"
+    "@hot-updater/cli-tools": "1.2.0-rc.9",
+    "@hot-updater/protocol": "1.2.0-rc.9",
+    "@hot-updater/server": "1.2.0-rc.9",
+    "@hot-updater/plugin-core": "1.2.0-rc.9"
   },
   "devDependencies": {
     "@azure/functions": "4.16.5",
@@ -53,7 +55,7 @@
     "execa": "9.5.2",
     "jszip": "^3.10.1",
     "vitest": "4.1.4",
-    "@hot-updater/test-utils": "1.2.0-rc.7"
+    "@hot-updater/test-utils": "1.2.0-rc.9"
   },
   "scripts": {
     "build": "tsdown",