fix: allow only keyvault name instead of full url.

src/cli.ts

@@ -34,11 +34,14 @@ function applyOverrides(options: Record<string, unknown>): void {
   if (options['renewalThreshold']) process.env['ACME_RENEWAL_THRESHOLD_DAYS'] = String(options['renewalThreshold']);
   if (options['logLevel']) process.env['ACME_LOG_LEVEL'] = String(options['logLevel']);
   if (options['http']) process.env['ACME_HTTP_PORT'] = String(options['http']);
+  if (options['keyvaultName'] && !options['keyvaultUrl'])
+    process.env['ACME_KEYVAULT_URL'] = `https://${options['keyvaultName']}.vault.azure.net`;
 }
 
 const sharedOptions = (cmd: Command): Command =>
   cmd
-    .option('--keyvault-url <url>', 'Azure KeyVault URL')
+    .option('--keyvault-name <name>', 'Azure KeyVault name (constructs https://<name>.vault.azure.net)')
+    .option('--keyvault-url <url>', 'Azure KeyVault URL (overrides --keyvault-name; use for sovereign clouds)')
     .option('--keyvault-resource-group <rg>', 'Resource group containing the Key Vault')
     .option('--subscription-id <id>', 'Azure subscription ID')
     .option('--resource-group <rg>', 'Resource group to scan (repeatable)', collect, [])