@hadoku/dev-vault 1.5.0 → 1.5.2

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026 WolffM
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -16,7 +16,22 @@ The shim used to live only inside the `hadoku_site` repo at
 clone `hadoku_site` as a sibling just to reach the vault. Publishing it removes
 that coupling: a child repo depends on a versioned package, not a sibling repo.
 
-## Install (one-time, per machine)
+## Outside the fleet: `@hadoku/dev-vault`
+
+The same package is published to the public npm registry as
+`@hadoku/dev-vault`, so someone holding a service grant can use it with no
+GitHub token and no clone of anything:
+
+```sh
+npx @hadoku/dev-vault login     # once a week: your own 7-day credential
+npx @hadoku/dev-vault --check   # what your .devvault.json can read
+npx @hadoku/dev-vault -- <command>
+```
+
+Everything below applies to it unchanged. It reaches the broker at
+`https://hadoku.me/mgmt`; nothing else needs to be reachable.
+
+## Install inside the fleet (one-time, per machine)
 
 The package lives on GitHub Packages under the `@wolffm` scope. GitHub Packages
 requires auth even to read, so add to your `~/.npmrc`:

package/login.mjs

@@ -21,8 +21,23 @@ import { mainCheckoutOf } from './key-file.mjs';
 export const EDGE = 'https://hadoku.me';
 const FILE = '.devvault.local.json';
 const POLL_MS = 3000;
+// A request lives a day (edge DEVICE_TTL_S), so the approver can get to it
+// later. Poll briskly while someone is likely approving right now, then slowly:
+// a day at 3s would be ~29k requests for one abandoned login.
+const BRISK_MS = 10 * 60 * 1000;
+const SLOW_POLL_MS = 30_000;
 const DAY_MS = 24 * 60 * 60 * 1000;
 
+/** 86_400_000 -> "24 hours", 600_000 -> "10 minutes". */
+export function spell(ms) {
+	const min = Math.round(ms / 60_000);
+	if (min % 60 === 0) {
+		const h = min / 60;
+		return `${h} hour${h === 1 ? '' : 's'}`;
+	}
+	return `${min} minute${min === 1 ? '' : 's'}`;
+}
+
 function runGit(cwd, args) {
 	const r = spawnSync('git', args, { cwd, encoding: 'utf-8' });
 	return r.status === 0 ? r.stdout.trim() : '';
@@ -94,9 +109,12 @@ export async function login({
 	log(`[dev-vault]   code ${userCode}  ·  ${host}${repo ? `  ·  ${repo}` : ''}`);
 	log('[dev-vault] waiting for approval…');
 
-	const deadline = now() + (Number(expiresIn) || 600) * 1000;
+	const ttlMs = (Number(expiresIn) || 600) * 1000;
+	const startedAt = now();
+	const deadline = startedAt + ttlMs;
+	log(`[dev-vault] (the link stays valid for ${spell(ttlMs)}; leave this running)`);
 	while (now() < deadline) {
-		await sleep(POLL_MS);
+		await sleep(now() - startedAt < BRISK_MS ? POLL_MS : SLOW_POLL_MS);
 		let polled;
 		try {
 			polled = await postJson(fetchImpl, `${base}/auth/service-access/device/poll`, {
@@ -129,6 +147,6 @@ export async function login({
 		);
 		return 0;
 	}
-	log('[dev-vault] login: nobody approved within 10 minutes. Run `dev-vault login` again.');
+	log(`[dev-vault] login: nobody approved within ${spell(ttlMs)}. Run \`dev-vault login\` again.`);
 	return 1;
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@hadoku/dev-vault",
-  "version": "1.5.0",
+  "version": "1.5.2",
+  "gitHead": "9010a68c19d319334869bb549bc90acc1ee4d0ca",
   "description": "Local-dev vault-broker shim — fetches secrets from the hadoku mgmt-api broker and execs a child command with them in process.env. Works for any consuming repo (Node or non-Node).",
   "type": "module",
   "bin": {
@@ -12,7 +13,8 @@
     "key-file.mjs",
     "install-id.mjs",
     "login.mjs",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "repository": {
     "type": "git",