fix: download command now requires only keyvault URL.

src/lib/dns.ts

@@ -15,6 +15,7 @@ export async function scanDnsZones(
   credential: TokenCredential,
   config: Config
 ): Promise<DomainRecord[]> {
+  if (!config.subscriptionId) throw new Error('ACME_SUBSCRIPTION_ID is required for DNS zone scanning');
   const client = new DnsManagementClient(credential, config.subscriptionId);
   const results: DomainRecord[] = [];
   const seen = new Set<string>();
@@ -73,6 +74,7 @@ export class DnsChallengeManager implements ChallengeHandler {
     private readonly config: Config,
     private readonly log: (msg: string) => void
   ) {
+    if (!config.subscriptionId) throw new Error('ACME_SUBSCRIPTION_ID is required for DNS challenges');
     this.client = new DnsManagementClient(credential, config.subscriptionId);
   }