@hadoku/dev-vault 1.5.4 → 1.5.5

package/login.mjs

@@ -73,10 +73,22 @@ async function postJson(fetchImpl, url, body) {
 		headers: { 'Content-Type': 'application/json' },
 		body: JSON.stringify(body),
 	});
-	const data = await res.json().catch(() => ({}));
-	return { status: res.status, data };
+	const data = await res.json().catch(() => null);
+	// Cloudflare's bot protection answers before hadoku.me sees the request:
+	// a 403 marked `cf-mitigated`, or one whose body is not our JSON. It
+	// refuses networks, not people (cloud VMs, Codespaces, some VPNs), so
+	// nothing about the person's grant or key is involved.
+	const blocked =
+		res.status === 403 && (res.headers?.get?.('cf-mitigated') != null || data === null);
+	return { status: res.status, data: data ?? {}, blocked };
 }
 
+const BLOCKED = [
+	'[dev-vault] login: Cloudflare refused this network before hadoku.me saw the request.',
+	'[dev-vault]   Its bot protection blocks cloud servers, Codespaces and some VPNs.',
+	'[dev-vault]   Run this from a home or office connection (or with the VPN off).',
+];
+
 /**
  * Run the login. Resolves to the process exit code: 0 written, 1 refused,
  * expired or unreachable.
@@ -99,6 +111,10 @@ export async function login({
 		log(`[dev-vault] login: cannot reach ${base}: ${err instanceof Error ? err.message : err}`);
 		return 1;
 	}
+	if (started.blocked) {
+		for (const line of BLOCKED) log(line);
+		return 1;
+	}
 	if (started.status !== 200) {
 		log(`[dev-vault] login: ${started.data.error ?? `HTTP ${started.status}`}`);
 		return 1;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hadoku/dev-vault",
-  "version": "1.5.4",
-  "gitHead": "8cfbe20817408d6aebc12bc03082e768c9a6c138",
+  "version": "1.5.5",
+  "gitHead": "00833df2e386ce613a5126f985cdbe6c42e649c0",
   "description": "Local-dev vault-broker shim — fetches secrets from the hadoku mgmt-api broker and execs a child command with them in process.env. Works for any consuming repo (Node or non-Node).",
   "type": "module",
   "bin": {