@camstack/system 1.2.147 → 1.2.149

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { E as authProviderCapability, Tt as userManagementCapability, kt as BaseAddon, r as ApiKeyRecordSchema, v as ScopedTokenSchema, x as UserRecordSchema } from "../../dist-DrBc-7Y3.mjs";
+import { E as authProviderCapability, Tt as userManagementCapability, kt as BaseAddon, r as ApiKeyRecordSchema, v as ScopedTokenSchema, x as UserRecordSchema } from "../../dist-CZWAU40-.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6000,7 +6000,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region src/auth/auth-manager.ts
+//#region src/auth/token-expiry.ts
 var import_jsonwebtoken = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		decode: require_decode(),
@@ -6011,6 +6011,156 @@ var import_jsonwebtoken = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 		TokenExpiredError: require_TokenExpiredError()
 	};
 })))());
+/**
+* Validation for the operator-configured session-JWT lifetime
+* (`auth.tokenExpiry`, System → Settings → Authentication → Token Expiry).
+*
+* WHY THIS EXISTS. The field is a free-text box that reaches `jwt.sign`'s
+* `expiresIn`. Two things go wrong without a gate in front of it:
+*
+*   1. `jsonwebtoken` THROWS on a value it cannot parse. The only caller is
+*      the login/refresh path, so one typo in a settings form turns every
+*      login into a 500 — a self-inflicted outage from a text field.
+*   2. `jsonwebtoken` hands a bare numeric STRING to `ms()`, which reads it
+*      as MILLISECONDS. An operator who types `3600` meaning "an hour" gets
+*      a token that dies in 3.6 seconds. A bare number is therefore rejected
+*      rather than interpreted — the field's own description, placeholder and
+*      default are all duration strings (`24h`, `7d`, `30d`).
+*
+* A rejection never becomes an unbounded lifetime — it resolves to
+* {@link DEFAULT_TOKEN_EXPIRY}, the single documented default — and it is
+* never silent: `parseTokenExpiry` reports the refusal in its result and
+* `logTokenExpiryRejection` renders it. The two are separate so the caller
+* owns how often it speaks; the signer re-reads on every mint.
+*/
+/**
+* The `ms`-compatible duration grammar `jsonwebtoken` accepts, MINUS the bare
+* number (see the docblock above). A unit is mandatory.
+*/
+var DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|milliseconds?|msecs?|s|secs?|seconds?|m|mins?|minutes?|h|hrs?|hours?|d|days?|w|weeks?|y|yrs?|years?)$/i;
+/** Multiplier from each accepted unit to milliseconds. */
+var UNIT_MS = {
+	ms: 1,
+	msec: 1,
+	msecs: 1,
+	millisecond: 1,
+	milliseconds: 1,
+	s: 1e3,
+	sec: 1e3,
+	secs: 1e3,
+	second: 1e3,
+	seconds: 1e3,
+	m: 6e4,
+	min: 6e4,
+	mins: 6e4,
+	minute: 6e4,
+	minutes: 6e4,
+	h: 36e5,
+	hr: 36e5,
+	hrs: 36e5,
+	hour: 36e5,
+	hours: 36e5,
+	d: 864e5,
+	day: 864e5,
+	days: 864e5,
+	w: 6048e5,
+	week: 6048e5,
+	weeks: 6048e5,
+	y: 315576e5,
+	yr: 315576e5,
+	yrs: 315576e5,
+	year: 315576e5,
+	years: 315576e5
+};
+/**
+* Shortest accepted lifetime. Below a minute the token expires inside the
+* round trip that issued it and the operator sees "logged out immediately",
+* which reads as a broken server rather than as a bad setting.
+*/
+var MIN_EXPIRY_MS = 6e4;
+/**
+* Longest accepted lifetime. A year is already far past "a device left
+* unopened for weeks"; anything longer is an infinite-lifetime token wearing
+* a duration string.
+*/
+var MAX_EXPIRY_MS = 365 * 864e5;
+/** Milliseconds for a duration string, or `null` when it is not one. */
+function durationMs(candidate) {
+	const match = DURATION_PATTERN.exec(candidate);
+	if (match === null) return null;
+	const amount = Number(match[1]);
+	const unitMs = UNIT_MS[match[2].toLowerCase()];
+	if (!Number.isFinite(amount) || unitMs === void 0) return null;
+	return amount * unitMs;
+}
+/**
+* The default, pre-parsed. Computed from {@link DEFAULT_TOKEN_EXPIRY} rather
+* than written out again — a second spelling of the same default is the defect
+* this module exists to close.
+*/
+var DEFAULT_SECONDS = (() => {
+	const ms = durationMs("30d");
+	/* c8 ignore next -- unreachable unless DEFAULT_TOKEN_EXPIRY stops being a duration */
+	if (ms === null) throw new Error(`DEFAULT_TOKEN_EXPIRY is not a duration: 30d`);
+	return ms / 1e3;
+})();
+function refuse(reason) {
+	return {
+		ok: false,
+		reason,
+		seconds: DEFAULT_SECONDS,
+		value: "30d"
+	};
+}
+/**
+* Parse a configured `auth.tokenExpiry`. An absent/blank value is not a
+* rejection — it is "operator never set it" and resolves to the default
+* without a log line.
+*/
+function parseTokenExpiry(configured) {
+	if (configured === void 0 || configured === null) return {
+		ok: true,
+		seconds: DEFAULT_SECONDS,
+		value: "30d"
+	};
+	if (typeof configured !== "string") return refuse("not-a-string");
+	const trimmed = configured.trim();
+	if (trimmed === "") return {
+		ok: true,
+		seconds: DEFAULT_SECONDS,
+		value: "30d"
+	};
+	const totalMs = durationMs(trimmed);
+	if (totalMs === null) return refuse("malformed");
+	if (totalMs < MIN_EXPIRY_MS) return refuse("too-short");
+	if (totalMs > MAX_EXPIRY_MS) return refuse("too-long");
+	return {
+		ok: true,
+		seconds: totalMs / 1e3,
+		value: trimmed
+	};
+}
+/** Human-readable tail for the rejection log line. */
+var REJECTION_DETAIL = {
+	"not-a-string": "value is not a string",
+	malformed: "not a duration string (expected e.g. 24h, 7d, 30d — a bare number is NOT seconds)",
+	"too-short": `shorter than the ${MIN_EXPIRY_MS / 1e3}s minimum`,
+	"too-long": `longer than the ${MAX_EXPIRY_MS / 864e5}d maximum`
+};
+/**
+* Report a refused `auth.tokenExpiry`. Separate from {@link parseTokenExpiry}
+* so the caller owns HOW OFTEN it speaks — the signer re-reads the setting on
+* every mint and must not turn one bad save into a line per login.
+*/
+function logTokenExpiryRejection(configured, rejection, logger) {
+	logger.warn(`auth.tokenExpiry REJECTED — ${REJECTION_DETAIL[rejection.reason]}; signing with the default 30d instead`, { meta: {
+		configured,
+		reason: rejection.reason,
+		applied: rejection.value
+	} });
+}
+//#endregion
+//#region src/auth/auth-manager.ts
 /** Minimal no-op logger for default parameter */
 var noopLogger = {
 	debug() {},
@@ -6028,6 +6178,16 @@ var AuthManager = class {
 	config;
 	jwtSecret;
 	logger;
+	/**
+	* Offending `auth.tokenExpiry` values already reported by this instance.
+	*
+	* `signToken` re-reads the setting on EVERY mint so an operator's change
+	* takes effect without a restart — which also means a bad value would log
+	* once per login and once per silent refresh from every viewer. The refusal
+	* must be visible, not repeated: the first mint after a bad save logs, the
+	* rest resolve silently to the same default until the value changes.
+	*/
+	reportedInvalidExpiries = /* @__PURE__ */ new Set();
 	constructor(config, logger = noopLogger) {
 		this.config = config;
 		this.logger = logger;
@@ -6042,8 +6202,15 @@ var AuthManager = class {
 	}
 	signToken(payload) {
 		const configured = this.config.get("auth.tokenExpiry");
-		const expiresIn = typeof configured === "string" && configured.trim() !== "" ? configured.trim() : "30d";
-		return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn });
+		const parsed = parseTokenExpiry(configured);
+		if (!parsed.ok) {
+			const seen = typeof configured === "string" ? configured : JSON.stringify(configured);
+			if (!this.reportedInvalidExpiries.has(seen)) {
+				this.reportedInvalidExpiries.add(seen);
+				logTokenExpiryRejection(configured, parsed, this.logger);
+			}
+		}
+		return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: parsed.seconds });
 	}
 	verifyToken(token) {
 		return import_jsonwebtoken.verify(token, this.jwtSecret);
@@ -8814,6 +8981,38 @@ var TotpManager = class {
 	}
 };
 //#endregion
+//#region src/builtins/local-auth/auth-config-reader.ts
+/**
+* Every config path this reader can answer. Anything else resolves to
+* `undefined` by construction — see the module docblock.
+*/
+function createAuthConfigReader(resolved, writeAuthSection) {
+	return {
+		get(path) {
+			switch (path) {
+				case "auth.jwtSecret": return narrow(resolved.jwtSecret);
+				case "auth.adminUsername": return narrow(resolved.adminUsername);
+				case "auth.adminPassword": return narrow(resolved.adminPassword);
+				case "auth.tokenExpiry": return narrow(resolved.tokenExpiry);
+				default: return;
+			}
+		},
+		update(_section, data) {
+			if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
+		}
+	};
+}
+/**
+* The one documented type boundary in this module. `AuthConfigReader.get` is
+* the legacy `get<T>(path)` shape shared with `ConfigManager.get`, which is
+* likewise unchecked at runtime — every value returned here is a `string |
+* undefined` the caller immediately re-validates (`parseTokenExpiry`, the
+* truthiness gate on `jwtSecret`).
+*/
+function narrow(value) {
+	return value;
+}
+//#endregion
 //#region src/builtins/local-auth/auth-schema.ts
 /**
 * @durable class=config owner=local-auth
@@ -9462,19 +9661,14 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-		const resolvedJwtSecret = typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "";
-		const resolvedAdminUser = typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "";
-		const resolvedAdminPass = typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "";
-		const reader = {
-			get(path) {
-				if (path === "auth.jwtSecret") return resolvedJwtSecret;
-				if (path === "auth.adminUsername") return resolvedAdminUser;
-				if (path === "auth.adminPassword") return resolvedAdminPass;
-			},
-			update: (_section, data) => {
-				if (typeof data["jwtSecret"] === "string") this.ctx.settings?.setSection("auth", { jwtSecret: data["jwtSecret"] });
-			}
-		};
+		const reader = createAuthConfigReader({
+			jwtSecret: typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "",
+			adminUsername: typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "",
+			adminPassword: typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "",
+			tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0
+		}, (patch) => {
+			this.ctx.settings?.setSection("auth", patch);
+		});
 		this.authManager = new AuthManager(reader, this.ctx.logger);
 		const store = this.ctx.api?.settingsStore;
 		if (store) {

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 const require_tls = require("../../tls-u8QCJCFE.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, nt as localNetworkCapability, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { kt as BaseAddon, nt as localNetworkCapability, tn as EventCategory } from "../../dist-CZWAU40-.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-CQhPGSJm.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-DrBc-7Y3.mjs";
+import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-CZWAU40-.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 let node_fs_promises = require("node:fs/promises");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as createEvent, Ot as errMsg, ft as reducePoints, kt as BaseAddon, ot as metricsProviderCapability, pt as resolveBucketMs, q as foldSnapshotByFunction, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { Ht as createEvent, Ot as errMsg, ft as reducePoints, kt as BaseAddon, ot as metricsProviderCapability, pt as resolveBucketMs, q as foldSnapshotByFunction, tn as EventCategory } from "../../dist-CZWAU40-.mjs";
 import { readFile, readdir } from "node:fs/promises";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_os = require("node:os");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Ot as errMsg, V as enumerateInferenceDevices, Wt as emitReadiness, kt as BaseAddon, tn as EventCategory, ut as platformProbeCapability, vt as scoreRuntimes } from "../../dist-DrBc-7Y3.mjs";
+import { Ot as errMsg, V as enumerateInferenceDevices, Wt as emitReadiness, kt as BaseAddon, tn as EventCategory, ut as platformProbeCapability, vt as scoreRuntimes } from "../../dist-CZWAU40-.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, tn as EventCategory } from "../../dist-DrBc-7Y3.mjs";
+import { kt as BaseAddon, tn as EventCategory } from "../../dist-CZWAU40-.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ft as DeviceType, I as deriveBatteryPresence, Jt as nodePin, Nt as DeviceFeature, O as bareAddonId, Ot as errMsg, bt as snapshotCapability, i as BatteryStatusSchema, k as batteryCapability, kt as BaseAddon, tn as EventCategory, wt as streamQualityLabel } from "../../dist-DrBc-7Y3.mjs";
+import { Ft as DeviceType, I as deriveBatteryPresence, Jt as nodePin, Nt as DeviceFeature, O as bareAddonId, Ot as errMsg, bt as snapshotCapability, i as BatteryStatusSchema, k as batteryCapability, kt as BaseAddon, tn as EventCategory, wt as streamQualityLabel } from "../../dist-CZWAU40-.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as storageProviderCapability, K as filesystemBrowseCapability, kt as BaseAddon } from "../../dist-DrBc-7Y3.mjs";
+import { Ct as storageProviderCapability, K as filesystemBrowseCapability, kt as BaseAddon } from "../../dist-CZWAU40-.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/retired-settings-keys.d.ts

@@ -88,6 +88,22 @@ export interface RetiredKeyLogger {
 /**
  * The dead keys, per row.
  *
+ * ## Addressing these rows
+ *
+ * Every namespace below is a FORKED addon, whose `ctx.settings` comes from
+ * `addon-context-factory` and writes `<addonId>:addon-settings` row `root`. The
+ * scoped table is therefore the right target — unlike the hub builtin whose
+ * mis-addressed spec is dissected at {@link RetiredRowSpec}. Confirmed per
+ * namespace against `packages/<pkg>/package.json`'s manifest `id`.
+ *
+ * ## `keys` vs `perNodeKeys` is a data-loss decision, not a style choice
+ *
+ * `perNodeKeys` matches `<key>` AND `<key>@<nodeId>`. That is right for a key
+ * whose per-node copies are all dead (the engine cascade, the decoder
+ * `backend`). It is WRONG for `probedBestHwaccel` / `probedBestAudioBackend`,
+ * where the bare key is unreachable residue but every `@<nodeId>` copy is the
+ * node's live probe result — those go under `keys`, which is exact-match.
+ *
  * `detection-pipeline` / `addon-settings` / `root` — every key in this row is
  * dead; the row itself is kept because the addon writes live keys into it
  * (`pipelineTemplates`, `videoPipelineSteps`).

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { St as storageMigrationCapability, Yt as parseJsonObject, b as StorageMigrationJobSchema, kt as BaseAddon, xt as storageCapability, y as StorageLocationTypeSchema, yt as settingsStoreCapability } from "../../dist-DrBc-7Y3.mjs";
+import { St as storageMigrationCapability, Yt as parseJsonObject, b as StorageMigrationJobSchema, kt as BaseAddon, xt as storageCapability, y as StorageLocationTypeSchema, yt as settingsStoreCapability } from "../../dist-CZWAU40-.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.
@@ -12,25 +12,26 @@ const require_dist = require("../../dist-Dl6MFXPr.js");
 * loader reads before any addon is instantiated — things that cannot
 * live inside an addon because changing them requires a server
 * restart (port, host, dataPath) or because they own no runtime
-* state of their own (auth token expiry, global ffmpeg binary path).
+* state of their own (the session token lifetime).
 *
-* Sections exposed:
+* Sections exposed — this list is the whole of it:
 *   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
 *   - auth       (tokenExpiry)
-*   - ffmpeg     (binaryPath, hwAccel, threadCount)
 *
 * Sections NOT exposed (each owned by the addon that implements them):
 *   - logging    → `winston-logging` addon (level + retention)
 *   - recording  → `recording` addon (segment duration, retention)
 *   - retention  → analytics / detection addons (per-table retention)
+*   - ffmpeg     → deleted outright; see the note beside the schema below.
 *
 * Implementation notes:
-*   - Runs only on the hub process (yml sections are hub-side state).
-*     On agent nodes this addon would still instantiate, but every
-*     `ctx.settings.getSection(section)` call would hit an empty
-*     ConfigManager section so the UI would show the schema defaults.
-*     In practice the built-in loader can skip it on agents; for now we
-*     just let it run everywhere because it's harmless.
+*   - Hub-only, and the manifest says so. `ctx.settings` here is
+*     `ConfigManager.createSettingsView`, whose `getSection`/`setSection`
+*     are the `system-settings` keyspace — the SAME keyspace
+*     `ConfigManager.get('auth.tokenExpiry')` resolves, which is what makes
+*     a Save on this form reach `AuthManager.signToken`. An agent's
+*     `ctx.settings` is a different view (`sections` collection) and would
+*     write somewhere nothing reads.
 *   - Reads via `ctx.settings.getSection(section)` and writes via
 *     `ctx.settings.setSection(section, patch)` — the explicit
 *     yml-section pair on `AddonSettingsApi`.
@@ -108,7 +109,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 				type: "text",
 				key: "tokenExpiry",
 				label: "Token Expiry",
-				description: "JWT token lifetime (e.g. 24h, 7d, 30d)",
+				description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected — it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
 				placeholder: "30d",
 				default: "30d"
 			}]

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Kt as hydrateSchema, Ot as errMsg, kt as BaseAddon } from "../../dist-DrBc-7Y3.mjs";
+import { Kt as hydrateSchema, Ot as errMsg, kt as BaseAddon } from "../../dist-CZWAU40-.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.
@@ -7,25 +7,26 @@ import { Kt as hydrateSchema, Ot as errMsg, kt as BaseAddon } from "../../dist-D
 * loader reads before any addon is instantiated — things that cannot
 * live inside an addon because changing them requires a server
 * restart (port, host, dataPath) or because they own no runtime
-* state of their own (auth token expiry, global ffmpeg binary path).
+* state of their own (the session token lifetime).
 *
-* Sections exposed:
+* Sections exposed — this list is the whole of it:
 *   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
 *   - auth       (tokenExpiry)
-*   - ffmpeg     (binaryPath, hwAccel, threadCount)
 *
 * Sections NOT exposed (each owned by the addon that implements them):
 *   - logging    → `winston-logging` addon (level + retention)
 *   - recording  → `recording` addon (segment duration, retention)
 *   - retention  → analytics / detection addons (per-table retention)
+*   - ffmpeg     → deleted outright; see the note beside the schema below.
 *
 * Implementation notes:
-*   - Runs only on the hub process (yml sections are hub-side state).
-*     On agent nodes this addon would still instantiate, but every
-*     `ctx.settings.getSection(section)` call would hit an empty
-*     ConfigManager section so the UI would show the schema defaults.
-*     In practice the built-in loader can skip it on agents; for now we
-*     just let it run everywhere because it's harmless.
+*   - Hub-only, and the manifest says so. `ctx.settings` here is
+*     `ConfigManager.createSettingsView`, whose `getSection`/`setSection`
+*     are the `system-settings` keyspace — the SAME keyspace
+*     `ConfigManager.get('auth.tokenExpiry')` resolves, which is what makes
+*     a Save on this form reach `AuthManager.signToken`. An agent's
+*     `ctx.settings` is a different view (`sections` collection) and would
+*     write somewhere nothing reads.
 *   - Reads via `ctx.settings.getSection(section)` and writes via
 *     `ctx.settings.setSection(section, patch)` — the explicit
 *     yml-section pair on `AddonSettingsApi`.
@@ -103,7 +104,7 @@ var SystemConfigAddon = class extends BaseAddon {
 				type: "text",
 				key: "tokenExpiry",
 				label: "Token Expiry",
-				description: "JWT token lifetime (e.g. 24h, 7d, 30d)",
+				description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected — it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
 				placeholder: "30d",
 				default: "30d"
 			}]

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Dl6MFXPr.js");
+const require_dist = require("../../dist-DdEXjTDo.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-DrBc-7Y3.mjs";
+import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-CZWAU40-.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";