@hot-updater/azure 1.2.0-rc.8 → 1.2.0-rc.9

package/dist/functions/index.mjs

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { EventEmitter } from "events";
+import Stream, { Duplex, Readable, Transform } from "node:stream";
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "node:crypto";
 import process$1 from "node:process";
 import os, { EOL } from "node:os";
@@ -7,7 +8,6 @@ import util, { inspect } from "node:util";
 import http from "node:http";
 import https from "node:https";
 import zlib from "node:zlib";
-import Stream, { Duplex, Readable, Transform } from "node:stream";
 import { Readable as Readable$1 } from "stream";
 import buffer from "node:buffer";
 import { Buffer as Buffer$1 } from "buffer";
@@ -8118,7 +8118,7 @@ const createKvAdapter = ({ store, tablePrefix = "" }) => {
 };
 //#endregion
 //#region ../../packages/server/dist/version.mjs
-const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.8";
+const HOT_UPDATER_SERVER_VERSION = "1.2.0-rc.9";
 //#endregion
 //#region ../../packages/server/dist/handlerVersionRoutes.mjs
 const createVersionRouteHandlers = (plugins = []) => {
@@ -57555,7 +57555,6 @@ function azureBlobStorage(config) {
 				const headers = new Headers();
 				if (download.contentType) headers.set("content-type", download.contentType);
 				if (download.contentLength !== void 0) headers.set("content-length", String(download.contentLength));
-				const { Readable } = await import("node:stream");
 				return { response: new Response(Readable.toWeb(body), { headers }) };
 			} catch (error) {
 				if (isNotFound(error)) return { response: null };

package/dist/index.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_stream = require("node:stream");
 let _azure_core_auth = require("@azure/core-auth");
 let _azure_storage_blob = require("@azure/storage-blob");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
@@ -158,8 +159,7 @@ function azureBlobStorage(config) {
 				const headers = new Headers();
 				if (download.contentType) headers.set("content-type", download.contentType);
 				if (download.contentLength !== void 0) headers.set("content-length", String(download.contentLength));
-				const { Readable } = await import("node:stream");
-				return { response: new Response(Readable.toWeb(body), { headers }) };
+				return { response: new Response(node_stream.Readable.toWeb(body), { headers }) };
 			} catch (error) {
 				if (isNotFound(error)) return { response: null };
 				throw error;
@@ -811,7 +811,26 @@ const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 	"AuthenticationRequiredError",
 	"CredentialUnavailableError"
 ]);
-const SIGN_IN_HINT = "In CI, sign in with azure/login; on your machine, run az login, or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET";
+const SIGN_IN_HINT = [
+	"In CI, sign in with azure/login.",
+	"On your machine, run az login.",
+	"Or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET."
+];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as Azure's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const READ_ROLE = "Key Vault Secrets User";
 const WRITE_ROLE = "Key Vault Secrets Officer";
 const errorName = (error) => error instanceof Error ? error.name : "";
@@ -830,7 +849,7 @@ const isLoopback = (hostname) => (/* @__PURE__ */ new Set([
 const resolveVaultUrl = (vaultName, vaultUrl) => {
 	if (vaultName === void 0 === (vaultUrl === void 0)) throw new Error(`${NAME} needs a vaultName or a vaultUrl, and not both.`);
 	if (vaultName !== void 0) {
-		if (typeof vaultName !== "string" || !VAULT_NAME_PATTERN.test(vaultName)) throw new Error(`${NAME} needs a vault name of 3 to 24 letters, digits, and single hyphens, starting with a letter, and ${JSON.stringify(vaultName)} is not one.`);
+		if (typeof vaultName !== "string" || !VAULT_NAME_PATTERN.test(vaultName)) throw failure([`${NAME} can't use the vault name ${JSON.stringify(vaultName)}.`, "Use 3 to 24 letters, digits, and single hyphens; start with a letter."]);
 		return new URL(`https://${vaultName.toLowerCase()}.vault.azure.net`);
 	}
 	let url;
@@ -839,7 +858,11 @@ const resolveVaultUrl = (vaultName, vaultUrl) => {
 	} catch {
 		throw new Error(`${NAME} vaultUrl must be a valid URL.`);
 	}
-	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw new Error(`${NAME} vaultUrl must be an HTTPS origin, such as https://my-vault.vault.azure.net, without credentials, a path, a query, or a fragment.`);
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw failure([
+		`${NAME} can't use its vaultUrl.`,
+		"Use an HTTPS origin, such as https://my-vault.vault.azure.net.",
+		"Leave out credentials, a path, a query, and a fragment."
+	]);
 	return url;
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -898,7 +921,7 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 	const secretName = (name) => {
 		vault();
 		const id = keyVaultSecretName(name, prefix);
-		if (id.length > MAX_SECRET_NAME_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)} for ${JSON.stringify(name)}: Key Vault takes up to ${MAX_SECRET_NAME_LENGTH} characters.`);
+		if (id.length > MAX_SECRET_NAME_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)} for ${JSON.stringify(name)}.`, `Key Vault takes up to ${MAX_SECRET_NAME_LENGTH} characters.`]);
 		return id;
 	};
 	/** The vault's name, for the az commands messages suggest. */
@@ -917,14 +940,56 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 		const name = errorName(error);
 		const status = statusOf(error);
 		const code = innerCode(error) ?? error?.code;
-		const detail = `${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable Azure identity to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (status === 401) return new Error(`Azure Key Vault refused the sign-in to ${verb} ${JSON.stringify(id)}, ${detail}. Sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (code === "SecretDisabled") return new Error(`Azure Key Vault cannot ${verb} ${JSON.stringify(id)}: its current version is disabled. Enable it, or store a new value.`, { cause: error });
-		if (status === 403) return new Error(`Azure Key Vault refused to ${verb} ${JSON.stringify(id)}, ${detail}. The Azure identity needs the ${role} role on the vault, or, on a vault with access policies, the secret permissions ${role === READ_ROLE ? "get" : "get and set"}; a firewall may also refuse this network.`, { cause: error });
-		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return new Error(`Azure Key Vault cannot ${verb} ${JSON.stringify(id)}: it is being deleted. Try again in a minute.`, { cause: error });
-		if (status === 409 || code === "ObjectIsDeletedButRecoverable") return new Error(`Azure Key Vault cannot ${verb} ${JSON.stringify(id)}: it was deleted and is still recoverable. Recover it with az keyvault secret recover --vault-name ${vaultLabel()} --name ${id}, or purge it with az keyvault secret purge --vault-name ${vaultLabel()} --name ${id}.`, { cause: error });
-		return new Error(`Azure Key Vault failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no Azure identity to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (status === 401) return failure([
+			`Azure Key Vault refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"Sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (code === "SecretDisabled") return failure([
+			`Azure Key Vault can't ${verb} a secret.`,
+			secret,
+			"Its current version is disabled. Enable it, or store a new value."
+		], error);
+		if (status === 403) return failure([
+			`Azure Key Vault refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The Azure identity needs the ${role} role on the vault.`,
+			`With access policies, it needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.`,
+			"A firewall may also refuse this network."
+		], error);
+		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([
+			`Azure Key Vault can't ${verb} a secret: it is being deleted.`,
+			secret,
+			"Try again in a minute."
+		], error);
+		if (status === 409 || code === "ObjectIsDeletedButRecoverable") {
+			const vaultName = vaultLabel();
+			return failure([
+				`Azure Key Vault can't ${verb} a secret: it was deleted.`,
+				secret,
+				"Recover it, or purge it:",
+				`az keyvault secret recover --vault-name ${vaultName} \\`,
+				`  --name ${id}`,
+				`az keyvault secret purge --vault-name ${vaultName} \\`,
+				`  --name ${id}`
+			], error);
+		}
+		return failure([
+			`Azure Key Vault failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async (client, id) => {
 		let value;
@@ -953,8 +1018,8 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 		},
 		set: async (name, value) => {
 			const id = secretName(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (value.length > MAX_SECRET_LENGTH) throw new Error(`${NAME} cannot store ${id}: Key Vault takes up to ${MAX_SECRET_LENGTH} characters per secret, and this value has ${value.length}.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (value.length > MAX_SECRET_LENGTH) throw failure([`${NAME} can't store ${id}: it has ${value.length} characters.`, `Key Vault takes up to ${MAX_SECRET_LENGTH} characters per secret.`]);
 			await mask([value]);
 			const client = await open();
 			try {

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { Readable } from "node:stream";
 import { isTokenCredential } from "@azure/core-auth";
 import { BlobSASPermissions, BlobServiceClient, RestError, StorageSharedKeyCredential, generateBlobSASQueryParameters } from "@azure/storage-blob";
 import { SETTINGS_TABLE, createEngineDatabase, createKvAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, encodeKvKey, migrateCoreSchema, parseStorageUri, toolingTargetOf } from "@hot-updater/plugin-core";
@@ -157,7 +158,6 @@ function azureBlobStorage(config) {
 				const headers = new Headers();
 				if (download.contentType) headers.set("content-type", download.contentType);
 				if (download.contentLength !== void 0) headers.set("content-length", String(download.contentLength));
-				const { Readable } = await import("node:stream");
 				return { response: new Response(Readable.toWeb(body), { headers }) };
 			} catch (error) {
 				if (isNotFound(error)) return { response: null };
@@ -810,7 +810,26 @@ const NO_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
 	"AuthenticationRequiredError",
 	"CredentialUnavailableError"
 ]);
-const SIGN_IN_HINT = "In CI, sign in with azure/login; on your machine, run az login, or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET";
+const SIGN_IN_HINT = [
+	"In CI, sign in with azure/login.",
+	"On your machine, run az login.",
+	"Or set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET."
+];
+/** The widest line a message has: the CLI prints no wider. */
+const LINE_WIDTH = 76;
+/** `text`, such as Azure's own message, in lines that fit, broken at spaces. */
+const wrap = (text) => {
+	const lines = [];
+	let line = "";
+	for (const word of text.split(/\s+/u).filter(Boolean)) if (line && line.length + 1 + word.length > LINE_WIDTH) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+};
+/** An error of one line each, for a terminal. */
+const failure = (lines, cause) => new Error(lines.join("\n"), cause === void 0 ? void 0 : { cause });
 const READ_ROLE = "Key Vault Secrets User";
 const WRITE_ROLE = "Key Vault Secrets Officer";
 const errorName = (error) => error instanceof Error ? error.name : "";
@@ -829,7 +848,7 @@ const isLoopback = (hostname) => (/* @__PURE__ */ new Set([
 const resolveVaultUrl = (vaultName, vaultUrl) => {
 	if (vaultName === void 0 === (vaultUrl === void 0)) throw new Error(`${NAME} needs a vaultName or a vaultUrl, and not both.`);
 	if (vaultName !== void 0) {
-		if (typeof vaultName !== "string" || !VAULT_NAME_PATTERN.test(vaultName)) throw new Error(`${NAME} needs a vault name of 3 to 24 letters, digits, and single hyphens, starting with a letter, and ${JSON.stringify(vaultName)} is not one.`);
+		if (typeof vaultName !== "string" || !VAULT_NAME_PATTERN.test(vaultName)) throw failure([`${NAME} can't use the vault name ${JSON.stringify(vaultName)}.`, "Use 3 to 24 letters, digits, and single hyphens; start with a letter."]);
 		return new URL(`https://${vaultName.toLowerCase()}.vault.azure.net`);
 	}
 	let url;
@@ -838,7 +857,11 @@ const resolveVaultUrl = (vaultName, vaultUrl) => {
 	} catch {
 		throw new Error(`${NAME} vaultUrl must be a valid URL.`);
 	}
-	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw new Error(`${NAME} vaultUrl must be an HTTPS origin, such as https://my-vault.vault.azure.net, without credentials, a path, a query, or a fragment.`);
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") throw failure([
+		`${NAME} can't use its vaultUrl.`,
+		"Use an HTTPS origin, such as https://my-vault.vault.azure.net.",
+		"Leave out credentials, a path, a query, and a fragment."
+	]);
 	return url;
 };
 /** Masks a value in the CLI's output, which loads `@hot-updater/cli-tools`. */
@@ -897,7 +920,7 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 	const secretName = (name) => {
 		vault();
 		const id = keyVaultSecretName(name, prefix);
-		if (id.length > MAX_SECRET_NAME_LENGTH) throw new Error(`${NAME} cannot name a secret ${JSON.stringify(id)} for ${JSON.stringify(name)}: Key Vault takes up to ${MAX_SECRET_NAME_LENGTH} characters.`);
+		if (id.length > MAX_SECRET_NAME_LENGTH) throw failure([`${NAME} can't name a secret ${JSON.stringify(id)} for ${JSON.stringify(name)}.`, `Key Vault takes up to ${MAX_SECRET_NAME_LENGTH} characters.`]);
 		return id;
 	};
 	/** The vault's name, for the az commands messages suggest. */
@@ -916,14 +939,56 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 		const name = errorName(error);
 		const status = statusOf(error);
 		const code = innerCode(error) ?? error?.code;
-		const detail = `${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}`;
-		if (NO_CREDENTIAL_ERRORS.has(name)) return new Error(`${NAME} found no usable Azure identity to ${verb} ${JSON.stringify(id)} (${errorMessage(error)}). ${SIGN_IN_HINT}.`, { cause: error });
-		if (status === 401) return new Error(`Azure Key Vault refused the sign-in to ${verb} ${JSON.stringify(id)}, ${detail}. Sign in again. ${SIGN_IN_HINT}.`, { cause: error });
-		if (code === "SecretDisabled") return new Error(`Azure Key Vault cannot ${verb} ${JSON.stringify(id)}: its current version is disabled. Enable it, or store a new value.`, { cause: error });
-		if (status === 403) return new Error(`Azure Key Vault refused to ${verb} ${JSON.stringify(id)}, ${detail}. The Azure identity needs the ${role} role on the vault, or, on a vault with access policies, the secret permissions ${role === READ_ROLE ? "get" : "get and set"}; a firewall may also refuse this network.`, { cause: error });
-		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return new Error(`Azure Key Vault cannot ${verb} ${JSON.stringify(id)}: it is being deleted. Try again in a minute.`, { cause: error });
-		if (status === 409 || code === "ObjectIsDeletedButRecoverable") return new Error(`Azure Key Vault cannot ${verb} ${JSON.stringify(id)}: it was deleted and is still recoverable. Recover it with az keyvault secret recover --vault-name ${vaultLabel()} --name ${id}, or purge it with az keyvault secret purge --vault-name ${vaultLabel()} --name ${id}.`, { cause: error });
-		return new Error(`Azure Key Vault failed to ${verb} ${JSON.stringify(id)}, ${detail}.`, { cause: error });
+		const detail = wrap(`${code || name || "Error"}${status ? ` (${status})` : ""}: ${errorMessage(error)}.`);
+		const secret = `Secret: ${id}`;
+		if (NO_CREDENTIAL_ERRORS.has(name)) return failure([
+			`${NAME} found no Azure identity to ${verb} a secret.`,
+			secret,
+			...wrap(`${errorMessage(error)}.`),
+			...SIGN_IN_HINT
+		], error);
+		if (status === 401) return failure([
+			`Azure Key Vault refused the sign-in to ${verb} a secret.`,
+			secret,
+			...detail,
+			"Sign in again.",
+			...SIGN_IN_HINT
+		], error);
+		if (code === "SecretDisabled") return failure([
+			`Azure Key Vault can't ${verb} a secret.`,
+			secret,
+			"Its current version is disabled. Enable it, or store a new value."
+		], error);
+		if (status === 403) return failure([
+			`Azure Key Vault refused to ${verb} a secret.`,
+			secret,
+			...detail,
+			`The Azure identity needs the ${role} role on the vault.`,
+			`With access policies, it needs the secret permissions ${role === READ_ROLE ? "get" : "get and set"}.`,
+			"A firewall may also refuse this network."
+		], error);
+		if (code === "ObjectIsBeingDeleted" || /being deleted/iu.test(errorMessage(error))) return failure([
+			`Azure Key Vault can't ${verb} a secret: it is being deleted.`,
+			secret,
+			"Try again in a minute."
+		], error);
+		if (status === 409 || code === "ObjectIsDeletedButRecoverable") {
+			const vaultName = vaultLabel();
+			return failure([
+				`Azure Key Vault can't ${verb} a secret: it was deleted.`,
+				secret,
+				"Recover it, or purge it:",
+				`az keyvault secret recover --vault-name ${vaultName} \\`,
+				`  --name ${id}`,
+				`az keyvault secret purge --vault-name ${vaultName} \\`,
+				`  --name ${id}`
+			], error);
+		}
+		return failure([
+			`Azure Key Vault failed to ${verb} a secret.`,
+			secret,
+			...detail
+		], error);
 	};
 	const read = async (client, id) => {
 		let value;
@@ -952,8 +1017,8 @@ const keyVault = ({ credential, prefix = "hot-updater-", vaultName, vaultUrl })
 		},
 		set: async (name, value) => {
 			const id = secretName(name);
-			if (typeof value !== "string" || value === "") throw new Error(`${NAME} cannot store an empty ${id}.`);
-			if (value.length > MAX_SECRET_LENGTH) throw new Error(`${NAME} cannot store ${id}: Key Vault takes up to ${MAX_SECRET_LENGTH} characters per secret, and this value has ${value.length}.`);
+			if (typeof value !== "string" || value === "") throw new Error(`${NAME} can't store an empty ${id}.`);
+			if (value.length > MAX_SECRET_LENGTH) throw failure([`${NAME} can't store ${id}: it has ${value.length} characters.`, `Key Vault takes up to ${MAX_SECRET_LENGTH} characters per secret.`]);
 			await mask([value]);
 			const client = await open();
 			try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/azure",
   "type": "module",
-  "version": "1.2.0-rc.8",
+  "version": "1.2.0-rc.9",
   "description": "React Native OTA solution for self-hosted",
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
@@ -44,10 +44,10 @@
     "@azure/identity": "4.14.0",
     "@azure/keyvault-secrets": "4.11.2",
     "@azure/storage-blob": "12.34.0",
-    "@hot-updater/protocol": "1.2.0-rc.8",
-    "@hot-updater/cli-tools": "1.2.0-rc.8",
-    "@hot-updater/plugin-core": "1.2.0-rc.8",
-    "@hot-updater/server": "1.2.0-rc.8"
+    "@hot-updater/cli-tools": "1.2.0-rc.9",
+    "@hot-updater/protocol": "1.2.0-rc.9",
+    "@hot-updater/server": "1.2.0-rc.9",
+    "@hot-updater/plugin-core": "1.2.0-rc.9"
   },
   "devDependencies": {
     "@azure/functions": "4.16.5",
@@ -55,7 +55,7 @@
     "execa": "9.5.2",
     "jszip": "^3.10.1",
     "vitest": "4.1.4",
-    "@hot-updater/test-utils": "1.2.0-rc.8"
+    "@hot-updater/test-utils": "1.2.0-rc.9"
   },
   "scripts": {
     "build": "tsdown",