@camstack/system 1.2.147 → 1.2.148

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-FYZBHc3v.js");
+const require_manifest_python_deps = require("./manifest-python-deps-BV_Cy99l.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { F as createUdsLoggerWithControl, Ht as startRunnerHeapWatch, I as LocalChildClient, Nt as RUNNER_RSS_BUDGET_ENV, bt as resolveAddonClass, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-python-deps-DhT0oFOZ.mjs";
+import { F as createUdsLoggerWithControl, Ht as startRunnerHeapWatch, I as LocalChildClient, Nt as RUNNER_RSS_BUDGET_ENV, bt as resolveAddonClass, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-python-deps-DpRX9LtD.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/auth/auth-manager.d.ts

@@ -2,13 +2,29 @@ import { IScopedLogger, TokenPayload, SsoBridgeClaimsSchema } from '@camstack/ty
 import { z } from 'zod';
 export type { TokenPayload };
 export type AuthConfigReader = {
-    get<T>(path: string): T;
+    /**
+     * `undefined` is part of the contract, not an accident: a reader answers
+     * only the paths it can (`local-auth` pre-resolves a fixed set; a
+     * `ConfigManager` falls through to RUNTIME_DEFAULTS and then to nothing).
+     * Every consumer here must handle the absent case explicitly.
+     */
+    get<T>(path: string): T | undefined;
     update(section: string, data: Record<string, unknown>): void;
 };
 export declare class AuthManager {
     private readonly config;
     private readonly jwtSecret;
     private readonly logger;
+    /**
+     * Offending `auth.tokenExpiry` values already reported by this instance.
+     *
+     * `signToken` re-reads the setting on EVERY mint so an operator's change
+     * takes effect without a restart — which also means a bad value would log
+     * once per login and once per silent refresh from every viewer. The refusal
+     * must be visible, not repeated: the first mint after a bad save logs, the
+     * rest resolve silently to the same default until the value changes.
+     */
+    private readonly reportedInvalidExpiries;
     constructor(config: AuthConfigReader, logger?: IScopedLogger);
     signToken(payload: Omit<TokenPayload, 'iat' | 'exp'>): string;
     verifyToken(token: string): TokenPayload;

package/dist/auth/token-expiry.d.ts

@@ -0,0 +1,39 @@
+import { DEFAULT_TOKEN_EXPIRY, IScopedLogger } from '@camstack/types';
+/** Why a candidate value was refused. Feeds the log line, not the UI. */
+export type TokenExpiryRejection = 'not-a-string' | 'malformed' | 'too-short' | 'too-long';
+interface TokenExpiryOutcome {
+    /**
+     * Lifetime to hand `jwt.sign`, in SECONDS.
+     *
+     * Deliberately a number rather than the duration string: `expiresIn` accepts
+     * both, but the string branch re-parses through `ms` — which is the branch
+     * that reads a bare number as milliseconds. Resolving to seconds here means
+     * exactly one parser decides what the operator's text meant, and it is this
+     * one.
+     */
+    readonly seconds: number;
+    /** The duration string actually applied — for the log line and the UI story. */
+    readonly value: string;
+}
+export interface TokenExpiryRejected extends TokenExpiryOutcome {
+    readonly ok: false;
+    readonly reason: TokenExpiryRejection;
+}
+export interface TokenExpiryAccepted extends TokenExpiryOutcome {
+    readonly ok: true;
+    readonly reason?: undefined;
+}
+export type TokenExpiryResult = TokenExpiryAccepted | TokenExpiryRejected;
+/**
+ * Parse a configured `auth.tokenExpiry`. An absent/blank value is not a
+ * rejection — it is "operator never set it" and resolves to the default
+ * without a log line.
+ */
+export declare function parseTokenExpiry(configured: unknown): TokenExpiryResult;
+/**
+ * Report a refused `auth.tokenExpiry`. Separate from {@link parseTokenExpiry}
+ * so the caller owns HOW OFTEN it speaks — the signer re-reads the setting on
+ * every mint and must not turn one bad save into a line per login.
+ */
+export declare function logTokenExpiryRejection(configured: unknown, rejection: TokenExpiryRejected, logger: IScopedLogger): void;
+export { DEFAULT_TOKEN_EXPIRY };

package/dist/auth/user-manager.d.ts

@@ -14,7 +14,8 @@ export interface UserStorageAccess {
     getStore(): SettingsStoreClient;
 }
 export interface UserConfigReader {
-    get<T>(path: string): T;
+    /** See `AuthConfigReader.get` — a reader answers only the paths it resolved. */
+    get<T>(path: string): T | undefined;
 }
 export declare class UserManager {
     private readonly storageAccess;

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ot as errMsg, S as addonPagesCapability, kt as BaseAddon, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { Ot as errMsg, S as addonPagesCapability, kt as BaseAddon, tn as EventCategory } from "../../dist-BwD83D2f.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ot as errMsg, kt as BaseAddon, tn as EventCategory, w as addonWidgetsCapability } from "../../dist-DrBc-7Y3.mjs";
+import { Ot as errMsg, kt as BaseAddon, tn as EventCategory, w as addonWidgetsCapability } from "../../dist-BwD83D2f.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as createEvent, Ot as errMsg, T as alertsCapability, kt as BaseAddon, n as AlertSchema, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { Ht as createEvent, Ot as errMsg, T as alertsCapability, kt as BaseAddon, n as AlertSchema, tn as EventCategory } from "../../dist-BwD83D2f.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { D as backupCapability, kt as BaseAddon, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { D as backupCapability, kt as BaseAddon, tn as EventCategory } from "../../dist-BwD83D2f.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-DrBc-7Y3.mjs";
+import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-BwD83D2f.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { M as coreBlockIdFromAddonId, N as coreBlocksCapability, Ot as errMsg, c as CoreBlockSchema, j as coreBlockAddonId, kt as BaseAddon, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, u as DeclaredDevices } from "../../dist-DrBc-7Y3.mjs";
+import { M as coreBlockIdFromAddonId, N as coreBlocksCapability, Ot as errMsg, c as CoreBlockSchema, j as coreBlockAddonId, kt as BaseAddon, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, u as DeclaredDevices } from "../../dist-BwD83D2f.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-6w_JOqBg.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-Davtjo5p.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as buildStreamParamsConfigSchema, Ft as DeviceType, H as enumerateItemArrayFields, L as deviceManagerCapability, Nt as DeviceFeature, Ot as errMsg, Pt as DeviceRole, R as deviceStateCapability, Rt as WELL_KNOWN_TAB_MAP, U as enumerateSchemaFields, _ as STREAM_PROFILE_META, a as CAP_NAMES_WITH_STATUS, d as DeviceStatusSchema, en as sleep, ht as runtimeStatePolicyFor, kt as BaseAddon, lt as parseStreamParamsFormPatch, qt as isDeviceConfigCap, st as normalizeUnit, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory, z as deviceStatusCapability } from "../../dist-DrBc-7Y3.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CF5r4YKq.mjs";
+import { A as buildStreamParamsConfigSchema, Ft as DeviceType, H as enumerateItemArrayFields, L as deviceManagerCapability, Nt as DeviceFeature, Ot as errMsg, Pt as DeviceRole, R as deviceStateCapability, Rt as WELL_KNOWN_TAB_MAP, U as enumerateSchemaFields, _ as STREAM_PROFILE_META, a as CAP_NAMES_WITH_STATUS, d as DeviceStatusSchema, en as sleep, ht as runtimeStatePolicyFor, kt as BaseAddon, lt as parseStreamParamsFormPatch, qt as isDeviceConfigCap, st as normalizeUnit, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory, z as deviceStatusCapability } from "../../dist-BwD83D2f.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CRKpAmSn.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { B as doorbellCapability, Ft as DeviceType, Ht as createEvent, O as bareAddonId, Ot as errMsg, Q as isSourceCap, W as evaluateSensorEdge, Z as isSameAddonId, g as SOURCE_DEVICE_TYPES, h as SOURCE_CAPS, kt as BaseAddon, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { B as doorbellCapability, Ft as DeviceType, Ht as createEvent, O as bareAddonId, Ot as errMsg, Q as isSourceCap, W as evaluateSensorEdge, Z as isSameAddonId, g as SOURCE_DEVICE_TYPES, h as SOURCE_CAPS, kt as BaseAddon, tn as EventCategory } from "../../dist-BwD83D2f.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-DrBc-7Y3.mjs";
+import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-BwD83D2f.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as createEvent, Ot as errMsg, kt as BaseAddon, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { Ht as createEvent, Ot as errMsg, kt as BaseAddon, tn as EventCategory } from "../../dist-BwD83D2f.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-config-reader.d.ts

@@ -0,0 +1,20 @@
+import { AuthConfigReader } from '../../auth/auth-manager.js';
+/** The values `local-auth` pre-resolves before constructing its AuthManager. */
+export interface ResolvedAuthConfig {
+    readonly jwtSecret: string;
+    readonly adminUsername: string;
+    readonly adminPassword: string;
+    /**
+     * Operator-configured session lifetime. `undefined` when the `auth` section
+     * carries no value — the signer then applies `DEFAULT_TOKEN_EXPIRY`, which
+     * is where the default belongs (one default, one place).
+     */
+    readonly tokenExpiry: string | undefined;
+}
+/** Persist the generated JWT secret. Called by AuthManager on first boot. */
+export type AuthSectionWriter = (patch: Record<string, unknown>) => void;
+/**
+ * Every config path this reader can answer. Anything else resolves to
+ * `undefined` by construction — see the module docblock.
+ */
+export declare function createAuthConfigReader(resolved: ResolvedAuthConfig, writeAuthSection: AuthSectionWriter): AuthConfigReader;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-B-mBrEz9.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6017,8 +6017,158 @@ var require_jsonwebtoken = /* @__PURE__ */ require_chunk.__commonJSMin(((exports
 	};
 }));
 //#endregion
-//#region src/auth/auth-manager.ts
+//#region src/auth/token-expiry.ts
 var import_jsonwebtoken = /* @__PURE__ */ require_chunk.__toESM(require_jsonwebtoken());
+/**
+* Validation for the operator-configured session-JWT lifetime
+* (`auth.tokenExpiry`, System → Settings → Authentication → Token Expiry).
+*
+* WHY THIS EXISTS. The field is a free-text box that reaches `jwt.sign`'s
+* `expiresIn`. Two things go wrong without a gate in front of it:
+*
+*   1. `jsonwebtoken` THROWS on a value it cannot parse. The only caller is
+*      the login/refresh path, so one typo in a settings form turns every
+*      login into a 500 — a self-inflicted outage from a text field.
+*   2. `jsonwebtoken` hands a bare numeric STRING to `ms()`, which reads it
+*      as MILLISECONDS. An operator who types `3600` meaning "an hour" gets
+*      a token that dies in 3.6 seconds. A bare number is therefore rejected
+*      rather than interpreted — the field's own description, placeholder and
+*      default are all duration strings (`24h`, `7d`, `30d`).
+*
+* A rejection never becomes an unbounded lifetime — it resolves to
+* {@link DEFAULT_TOKEN_EXPIRY}, the single documented default — and it is
+* never silent: `parseTokenExpiry` reports the refusal in its result and
+* `logTokenExpiryRejection` renders it. The two are separate so the caller
+* owns how often it speaks; the signer re-reads on every mint.
+*/
+/**
+* The `ms`-compatible duration grammar `jsonwebtoken` accepts, MINUS the bare
+* number (see the docblock above). A unit is mandatory.
+*/
+var DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|milliseconds?|msecs?|s|secs?|seconds?|m|mins?|minutes?|h|hrs?|hours?|d|days?|w|weeks?|y|yrs?|years?)$/i;
+/** Multiplier from each accepted unit to milliseconds. */
+var UNIT_MS = {
+	ms: 1,
+	msec: 1,
+	msecs: 1,
+	millisecond: 1,
+	milliseconds: 1,
+	s: 1e3,
+	sec: 1e3,
+	secs: 1e3,
+	second: 1e3,
+	seconds: 1e3,
+	m: 6e4,
+	min: 6e4,
+	mins: 6e4,
+	minute: 6e4,
+	minutes: 6e4,
+	h: 36e5,
+	hr: 36e5,
+	hrs: 36e5,
+	hour: 36e5,
+	hours: 36e5,
+	d: 864e5,
+	day: 864e5,
+	days: 864e5,
+	w: 6048e5,
+	week: 6048e5,
+	weeks: 6048e5,
+	y: 315576e5,
+	yr: 315576e5,
+	yrs: 315576e5,
+	year: 315576e5,
+	years: 315576e5
+};
+/**
+* Shortest accepted lifetime. Below a minute the token expires inside the
+* round trip that issued it and the operator sees "logged out immediately",
+* which reads as a broken server rather than as a bad setting.
+*/
+var MIN_EXPIRY_MS = 6e4;
+/**
+* Longest accepted lifetime. A year is already far past "a device left
+* unopened for weeks"; anything longer is an infinite-lifetime token wearing
+* a duration string.
+*/
+var MAX_EXPIRY_MS = 365 * 864e5;
+/** Milliseconds for a duration string, or `null` when it is not one. */
+function durationMs(candidate) {
+	const match = DURATION_PATTERN.exec(candidate);
+	if (match === null) return null;
+	const amount = Number(match[1]);
+	const unitMs = UNIT_MS[match[2].toLowerCase()];
+	if (!Number.isFinite(amount) || unitMs === void 0) return null;
+	return amount * unitMs;
+}
+/**
+* The default, pre-parsed. Computed from {@link DEFAULT_TOKEN_EXPIRY} rather
+* than written out again — a second spelling of the same default is the defect
+* this module exists to close.
+*/
+var DEFAULT_SECONDS = (() => {
+	const ms = durationMs("30d");
+	/* c8 ignore next -- unreachable unless DEFAULT_TOKEN_EXPIRY stops being a duration */
+	if (ms === null) throw new Error(`DEFAULT_TOKEN_EXPIRY is not a duration: 30d`);
+	return ms / 1e3;
+})();
+function refuse(reason) {
+	return {
+		ok: false,
+		reason,
+		seconds: DEFAULT_SECONDS,
+		value: "30d"
+	};
+}
+/**
+* Parse a configured `auth.tokenExpiry`. An absent/blank value is not a
+* rejection — it is "operator never set it" and resolves to the default
+* without a log line.
+*/
+function parseTokenExpiry(configured) {
+	if (configured === void 0 || configured === null) return {
+		ok: true,
+		seconds: DEFAULT_SECONDS,
+		value: "30d"
+	};
+	if (typeof configured !== "string") return refuse("not-a-string");
+	const trimmed = configured.trim();
+	if (trimmed === "") return {
+		ok: true,
+		seconds: DEFAULT_SECONDS,
+		value: "30d"
+	};
+	const totalMs = durationMs(trimmed);
+	if (totalMs === null) return refuse("malformed");
+	if (totalMs < MIN_EXPIRY_MS) return refuse("too-short");
+	if (totalMs > MAX_EXPIRY_MS) return refuse("too-long");
+	return {
+		ok: true,
+		seconds: totalMs / 1e3,
+		value: trimmed
+	};
+}
+/** Human-readable tail for the rejection log line. */
+var REJECTION_DETAIL = {
+	"not-a-string": "value is not a string",
+	malformed: "not a duration string (expected e.g. 24h, 7d, 30d — a bare number is NOT seconds)",
+	"too-short": `shorter than the ${MIN_EXPIRY_MS / 1e3}s minimum`,
+	"too-long": `longer than the ${MAX_EXPIRY_MS / 864e5}d maximum`
+};
+/**
+* Report a refused `auth.tokenExpiry`. Separate from {@link parseTokenExpiry}
+* so the caller owns HOW OFTEN it speaks — the signer re-reads the setting on
+* every mint and must not turn one bad save into a line per login.
+*/
+function logTokenExpiryRejection(configured, rejection, logger) {
+	logger.warn(`auth.tokenExpiry REJECTED — ${REJECTION_DETAIL[rejection.reason]}; signing with the default 30d instead`, { meta: {
+		configured,
+		reason: rejection.reason,
+		applied: rejection.value
+	} });
+}
+//#endregion
+//#region src/auth/auth-manager.ts
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -6036,6 +6186,16 @@ var AuthManager = class {
 	config;
 	jwtSecret;
 	logger;
+	/**
+	* Offending `auth.tokenExpiry` values already reported by this instance.
+	*
+	* `signToken` re-reads the setting on EVERY mint so an operator's change
+	* takes effect without a restart — which also means a bad value would log
+	* once per login and once per silent refresh from every viewer. The refusal
+	* must be visible, not repeated: the first mint after a bad save logs, the
+	* rest resolve silently to the same default until the value changes.
+	*/
+	reportedInvalidExpiries = /* @__PURE__ */ new Set();
 	constructor(config, logger = noopLogger) {
 		this.config = config;
 		this.logger = logger;
@@ -6050,8 +6210,15 @@ var AuthManager = class {
 	}
 	signToken(payload) {
 		const configured = this.config.get("auth.tokenExpiry");
-		const expiresIn = typeof configured === "string" && configured.trim() !== "" ? configured.trim() : "30d";
-		return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn });
+		const parsed = parseTokenExpiry(configured);
+		if (!parsed.ok) {
+			const seen = typeof configured === "string" ? configured : JSON.stringify(configured);
+			if (!this.reportedInvalidExpiries.has(seen)) {
+				this.reportedInvalidExpiries.add(seen);
+				logTokenExpiryRejection(configured, parsed, this.logger);
+			}
+		}
+		return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: parsed.seconds });
 	}
 	verifyToken(token) {
 		return import_jsonwebtoken.verify(token, this.jwtSecret);
@@ -8822,6 +8989,38 @@ var TotpManager = class {
 	}
 };
 //#endregion
+//#region src/builtins/local-auth/auth-config-reader.ts
+/**
+* Every config path this reader can answer. Anything else resolves to
+* `undefined` by construction — see the module docblock.
+*/
+function createAuthConfigReader(resolved, writeAuthSection) {
+	return {
+		get(path) {
+			switch (path) {
+				case "auth.jwtSecret": return narrow(resolved.jwtSecret);
+				case "auth.adminUsername": return narrow(resolved.adminUsername);
+				case "auth.adminPassword": return narrow(resolved.adminPassword);
+				case "auth.tokenExpiry": return narrow(resolved.tokenExpiry);
+				default: return;
+			}
+		},
+		update(_section, data) {
+			if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
+		}
+	};
+}
+/**
+* The one documented type boundary in this module. `AuthConfigReader.get` is
+* the legacy `get<T>(path)` shape shared with `ConfigManager.get`, which is
+* likewise unchecked at runtime — every value returned here is a `string |
+* undefined` the caller immediately re-validates (`parseTokenExpiry`, the
+* truthiness gate on `jwtSecret`).
+*/
+function narrow(value) {
+	return value;
+}
+//#endregion
 //#region src/builtins/local-auth/auth-schema.ts
 /**
 * @durable class=config owner=local-auth
@@ -9470,19 +9669,14 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	}
 	async onInitialize() {
 		const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-		const resolvedJwtSecret = typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "";
-		const resolvedAdminUser = typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "";
-		const resolvedAdminPass = typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "";
-		const reader = {
-			get(path) {
-				if (path === "auth.jwtSecret") return resolvedJwtSecret;
-				if (path === "auth.adminUsername") return resolvedAdminUser;
-				if (path === "auth.adminPassword") return resolvedAdminPass;
-			},
-			update: (_section, data) => {
-				if (typeof data["jwtSecret"] === "string") this.ctx.settings?.setSection("auth", { jwtSecret: data["jwtSecret"] });
-			}
-		};
+		const reader = createAuthConfigReader({
+			jwtSecret: typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "",
+			adminUsername: typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "",
+			adminPassword: typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "",
+			tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0
+		}, (patch) => {
+			this.ctx.settings?.setSection("auth", patch);
+		});
 		this.authManager = new AuthManager(reader, this.ctx.logger);
 		const store = this.ctx.api?.settingsStore;
 		if (store) {