fix: allow only keyvault name instead of full url.

src/cli.ts

@@ -34,11 +34,14 @@ function applyOverrides(options: Record<string, unknown>): void {
   if (options['renewalThreshold']) process.env['ACME_RENEWAL_THRESHOLD_DAYS'] = String(options['renewalThreshold']);
   if (options['logLevel']) process.env['ACME_LOG_LEVEL'] = String(options['logLevel']);
   if (options['http']) process.env['ACME_HTTP_PORT'] = String(options['http']);
+  if (options['keyvaultName'] && !options['keyvaultUrl'])
+    process.env['ACME_KEYVAULT_URL'] = `https://${options['keyvaultName']}.vault.azure.net`;
 }
 
 const sharedOptions = (cmd: Command): Command =>
   cmd
-    .option('--keyvault-url <url>', 'Azure KeyVault URL')
+    .option('--keyvault-name <name>', 'Azure KeyVault name (constructs https://<name>.vault.azure.net)')
+    .option('--keyvault-url <url>', 'Azure KeyVault URL (overrides --keyvault-name; use for sovereign clouds)')
     .option('--keyvault-resource-group <rg>', 'Resource group containing the Key Vault')
     .option('--subscription-id <id>', 'Azure subscription ID')
     .option('--resource-group <rg>', 'Resource group to scan (repeatable)', collect, [])

src/lib/config.ts

@@ -48,7 +48,10 @@ export function loadConfig(): Config {
   }
 
   return {
-    keyVaultUrl: process.env['ACME_KEYVAULT_URL'],
+    keyVaultUrl: process.env['ACME_KEYVAULT_URL'] ??
+      (process.env['ACME_KEYVAULT_NAME']
+        ? `https://${process.env['ACME_KEYVAULT_NAME']}.vault.azure.net`
+        : undefined),
     acmeDirectoryUrl: optionalEnv(
       'ACME_DIRECTORY_URL',
       'https://acme-v02.api.letsencrypt.org/directory'