@fnndsc/porter 0.5.5 → 0.6.0

package/dist/tokens.js

@@ -0,0 +1,282 @@
+/**
+ * @file Door tokens: how a script comes through the door without a password.
+ *
+ * A token is minted once by a human login (a browser code or a password)
+ * and carried by scripts afterwards as `Authorization: Bearer …`. The door
+ * keeps only its hash, with the identity it is for, a name the operator
+ * can read (`cron@titan`), when it was minted and when it dies. A token
+ * dies on its day: no sliding refresh, so a leaked key in steady use still
+ * ends, and every script is re-blessed by a human on the horizon the
+ * operator set (`PORTER_TOKEN_DAYS`). Revocation is by name.
+ *
+ * Device codes are the browser half of `chell auth login`: chell asks for
+ * a short one-time code, the human opens the door's login page on any
+ * device, logs in with the code, and the door hands chell the token it
+ * minted. A code lives ten minutes and is taken once.
+ *
+ * The store is one JSON file at mode 0600 in the porter's own state, read
+ * at start and written whole on every change through a same-directory
+ * atomic rename; the plaintext is never in it.
+ *
+ * @module
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+/** What the plaintext starts with, so a token is recognisable in a log or a leak. */
+export const DOOR_TOKEN_PREFIX = 'pdt_';
+/** How long a device code waits to be authorised, in ms. */
+export const DEVICE_CODE_LIFE_MS = 10 * 60 * 1000;
+/** Makes a fresh plaintext token: 32 random bytes, base64url, prefixed. */
+export function token_make() {
+    return `${DOOR_TOKEN_PREFIX}${randomBytes(32).toString('base64url')}`;
+}
+/** Hashes a plaintext token the way the store keeps it. */
+export function token_hash(plain) {
+    return createHash('sha256').update(plain).digest('hex');
+}
+/** Whether a string looks like a door token, before any lookup. */
+export function token_looksLike(value) {
+    return value.startsWith(DOOR_TOKEN_PREFIX) && value.length > DOOR_TOKEN_PREFIX.length + 20;
+}
+/**
+ * The door's token store: minted, checked, revoked, listed, persisted.
+ */
+export class TokenStore {
+    path;
+    days;
+    now;
+    tokens = [];
+    /** The file as last read or written (mtime and size), so a change made by another process is noticed. */
+    stamp = '';
+    /**
+     * @param path - The JSON file; its directory is made (0700) when missing.
+     * @param days - How long a minted token lives.
+     * @param now - The clock, replaceable in tests.
+     */
+    constructor(path, days, now = () => new Date()) {
+        this.path = path;
+        this.days = days;
+        this.now = now;
+    }
+    /**
+     * Reads the file. A missing file is an empty store; a file that does not
+     * parse is refused loudly, since silently starting empty would let every
+     * script's key stop working with no word why.
+     */
+    load() {
+        if (!existsSync(this.path)) {
+            this.tokens = [];
+            this.stamp = '';
+            return;
+        }
+        const parsed = JSON.parse(readFileSync(this.path, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.tokens)) {
+            throw new Error(`the door's token store at ${this.path} is not a token file`);
+        }
+        this.tokens = parsed.tokens;
+        this.stamp = this.stamp_read();
+    }
+    /** The file's mtime and size as one string; empty when there is no file. */
+    stamp_read() {
+        try {
+            const facts = statSync(this.path);
+            return `${facts.mtimeMs}:${facts.size}`;
+        }
+        catch {
+            return '';
+        }
+    }
+    /**
+     * Re-reads the file when another process changed it: the porter's CLI
+     * (`--revoke`, `--mint`) writes the store from outside the running door,
+     * and a revocation the door did not notice would be no revocation.
+     */
+    refresh() {
+        if (this.stamp_read() !== this.stamp)
+            this.load();
+    }
+    /**
+     * Mints a token for an identity. A token of the same name for the same
+     * identity is replaced, so `login` again on the same host never leaves
+     * a forgotten key behind.
+     *
+     * @param identity - The canonical identity.
+     * @param user - The CUBE username.
+     * @param name - The operator-readable name.
+     * @returns The plaintext, shown once, and the record kept.
+     */
+    mint(identity, user, name) {
+        this.refresh();
+        const token = token_make();
+        const created = this.now();
+        const record = {
+            name,
+            identity,
+            user,
+            hash: token_hash(token),
+            created: created.toISOString(),
+            expires: new Date(created.getTime() + this.days * 24 * 3600 * 1000).toISOString(),
+            lastUsed: null,
+        };
+        this.tokens = this.tokens.filter((held) => !(held.identity === identity && held.name === name));
+        this.tokens.push(record);
+        this.save();
+        return { token, record };
+    }
+    /**
+     * Checks a presented plaintext against the store, in constant time per
+     * record, and says why when it fails.
+     *
+     * @param plain - The token as presented.
+     * @returns The record when it lets someone in.
+     */
+    check(plain) {
+        this.refresh();
+        const presented = Buffer.from(token_hash(plain), 'hex');
+        for (const record of this.tokens) {
+            const kept = Buffer.from(record.hash, 'hex');
+            if (kept.length !== presented.length || !timingSafeEqual(kept, presented))
+                continue;
+            if (Date.parse(record.expires) <= this.now().getTime())
+                return { ok: false, why: 'expired', record };
+            return { ok: true, record };
+        }
+        return { ok: false, why: 'unknown' };
+    }
+    /**
+     * Notes that a token just let someone in.
+     *
+     * @param record - The token that did.
+     */
+    touch(record) {
+        this.refresh();
+        record.lastUsed = this.now().toISOString();
+        this.save();
+    }
+    /**
+     * Revokes a user's tokens: one by name, or all of them.
+     *
+     * @param user - The CUBE username.
+     * @param name - The token's name, or undefined for every one of the user's.
+     * @returns How many went.
+     */
+    revoke(user, name) {
+        this.refresh();
+        const before = this.tokens.length;
+        this.tokens = this.tokens.filter((held) => !(held.user === user && (name === undefined || held.name === name)));
+        if (this.tokens.length !== before)
+            this.save();
+        return before - this.tokens.length;
+    }
+    /** @returns Every token the door knows, as kept (no plaintext exists to show). */
+    list() {
+        this.refresh();
+        return [...this.tokens];
+    }
+    /** Writes the whole store, mode 0600, through a same-directory atomic rename. */
+    save() {
+        const file = { schemaVersion: 1, tokens: this.tokens };
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temporary = `${this.path}.${process.pid}.tmp`;
+        writeFileSync(temporary, `${JSON.stringify(file, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+        renameSync(temporary, this.path);
+        chmodSync(this.path, 0o600);
+        this.stamp = this.stamp_read();
+    }
+}
+/** The letters a code is made of: no 0/O, 1/I/L, so it survives being read aloud. */
+const CODE_ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+/** Makes a code like `K7PD-3MXQ`. */
+export function deviceCode_make() {
+    const bytes = randomBytes(8);
+    let code = '';
+    for (let i = 0; i < 8; i++) {
+        if (i === 4)
+            code += '-';
+        code += CODE_ALPHABET[bytes[i] % CODE_ALPHABET.length];
+    }
+    return code;
+}
+/** Normalises a code as a human might type it: upper case, the dash optional. */
+export function deviceCode_normalise(typed) {
+    const letters = typed.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return letters.length === 8 ? `${letters.slice(0, 4)}-${letters.slice(4)}` : typed.trim().toUpperCase();
+}
+/**
+ * The device codes the door has out: issued by chell, authorised by a human
+ * on the login page, taken once by chell's poll.
+ */
+export class DeviceCodes {
+    now;
+    codes = new Map();
+    constructor(now = () => Date.now()) {
+        this.now = now;
+    }
+    /**
+     * Issues a code for a chell on a host.
+     *
+     * @param host - Where chell runs.
+     * @returns The code and when it stops being accepted.
+     */
+    issue(host) {
+        this.sweep();
+        let code = deviceCode_make();
+        while (this.codes.has(code))
+            code = deviceCode_make();
+        const issued = this.now();
+        this.codes.set(code, { host, issued, grant: null });
+        return { code, expires: new Date(issued + DEVICE_CODE_LIFE_MS).toISOString() };
+    }
+    /**
+     * Looks a code up for the login page.
+     *
+     * @param code - As typed.
+     * @returns The host chell runs on, or null when the code is not out.
+     */
+    host_of(code) {
+        this.sweep();
+        const held = this.codes.get(deviceCode_normalise(code));
+        return held === undefined || held.grant !== null ? null : held.host;
+    }
+    /**
+     * Authorises a code: a human logged in with it.
+     *
+     * @param code - As typed.
+     * @param grant - What chell gets.
+     * @returns Whether the code was waiting.
+     */
+    authorise(code, grant) {
+        this.sweep();
+        const held = this.codes.get(deviceCode_normalise(code));
+        if (held === undefined || held.grant !== null)
+            return false;
+        held.grant = grant;
+        return true;
+    }
+    /**
+     * Chell's poll: the grant once, pending while the human has not yet
+     * logged in, unknown after the code died or was taken.
+     *
+     * @param code - As chell was given it.
+     */
+    take(code) {
+        this.sweep();
+        const held = this.codes.get(code);
+        if (held === undefined)
+            return { state: 'unknown' };
+        if (held.grant === null)
+            return { state: 'pending' };
+        this.codes.delete(code);
+        return { state: 'authorised', grant: held.grant };
+    }
+    /** Forgets codes past their life. */
+    sweep() {
+        const cutoff = this.now() - DEVICE_CODE_LIFE_MS;
+        for (const [code, held] of this.codes) {
+            if (held.issued < cutoff)
+                this.codes.delete(code);
+        }
+    }
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAW,MAAM,CAAC;AAEhD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgC1D,2EAA2E;AAC3E,MAAM,UAAU,UAAU;IACxB,OAAO,GAAG,iBAAiB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM,GAAG,EAAE,CAAC;AAC7F,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,UAAU;IAWF;IACA;IACA;IAZX,MAAM,GAAgB,EAAE,CAAC;IACjC,yGAAyG;IACjG,KAAK,GAAW,EAAE,CAAC;IAE3B;;;;OAIG;IACH,YACmB,IAAY,EACZ,IAAY,EACZ,MAAkB,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE;QAFxC,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,QAAG,GAAH,GAAG,CAAqC;IACxD,CAAC;IAEJ;;;;OAIG;IACI,IAAI;QACT,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,MAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,IAAI,sBAAsB,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,MAAM,GAAI,MAAoB,CAAC,MAAM,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;IAED,4EAA4E;IACpE,UAAU;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,OAAO;QACb,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;;;;;;;;OASG;IACI,IAAI,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAY;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,KAAK,GAAW,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAS,IAAI,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,MAAM,GAAc;YACxB,IAAI;YACJ,QAAQ;YACR,IAAI;YACJ,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC;YACvB,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;YAC9B,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACjF,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAe,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,KAAa;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,SAAS,GAAW,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,GAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;gBAAE,SAAS;YACpF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACrG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,MAAiB;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,IAAY,EAAE,IAAa;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAAW,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAe,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;QACpI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,kFAAkF;IAC3E,IAAI;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACzE,IAAI;QACV,MAAM,IAAI,GAAc,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAClE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAW,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC5D,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjC,CAAC;CACF;AAkBD,qFAAqF;AACrF,MAAM,aAAa,GAAW,iCAAiC,CAAC;AAEhE,qCAAqC;AACrC,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAW,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,IAAI,GAAW,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,IAAI,GAAG,CAAC;QACzB,IAAI,IAAI,aAAa,CAAE,KAAK,CAAC,CAAC,CAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAW,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IAGc;IAFnB,KAAK,GAA4B,IAAI,GAAG,EAAE,CAAC;IAE5D,YAAoC,MAAoB,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAA5C,QAAG,GAAH,GAAG,CAAyC;IAAG,CAAC;IAEpF;;;;;OAKG;IACI,KAAK,CAAC,IAAY;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,GAAW,eAAe,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,eAAe,EAAE,CAAC;QACtD,MAAM,MAAM,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACI,OAAO,CAAC,IAAY;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,GAA2B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IACI,SAAS,CAAC,IAAY,EAAE,KAAkB;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,GAA2B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACI,IAAI,CAAC,IAAY;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,GAA2B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,qCAAqC;IAC7B,KAAK;QACX,MAAM,MAAM,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fnndsc/porter",
-  "version": "0.5.5",
+  "version": "0.6.0",
   "description": "PORTER: the mise display manager — logs an operator in, finds or starts their calypso, and shows them to argus",
   "type": "module",
   "main": "dist/porter.js",
@@ -19,7 +19,7 @@
     "@fastify/formbody": "^9.0.0",
     "@fastify/reply-from": "^12.6.5",
     "@fnndsc/calypso": "^0.19.6",
-    "@fnndsc/chell": "^5.10.3",
+    "@fnndsc/chell": "^5.11.0",
     "@fnndsc/menu": "^0.19.0",
     "fastify": "^5.12.5",
     "ws": "^8.18.0",