# Field-kit desk lab

Requires Node 22.15.1 or the reviewed Node 24.22.1 runtime. No npm dependencies or external database are needed for this in-memory project.

Save every supplied file in one empty folder, preserving names. Run npm test and npm run check. Generate a fresh 32-byte hexadecimal token with node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))" and set it as DESK_WRITE_TOKEN in your own terminal. Do not commit or share that value. Run npm start and open http://127.0.0.1:8131/. The dashboard is read-only. Writes require the ephemeral bearer token, JSON content type and {key,kitId,quantity} at POST /api/checkouts.

Everything is lost on restart. A receipt has persistent:false. Idempotency works only within this one process and at most 1000 accepted keys. This is not a real booking service, durable queue, multi-user login system, distributed inventory lock or production deployment. Do not expose it publicly. Public TLS, proxy, rate limiting, durable storage and operational recovery require separate work.