camstack 1.2.51 → 1.2.52

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-HPFKAZ3A.js";
+} from "./chunk-YVH2KSTL.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-EJ6BGNVY.js");
+  await import("./launcher-7T4UUMOZ.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-EJ6BGNVY.js");
+  await import("./launcher-7T4UUMOZ.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-OVQWH2QN.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-7QG523MP.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-OVQWH2QN.js → discover-7QG523MP.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-HPFKAZ3A.js";
+} from "./chunk-YVH2KSTL.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/dist/{launcher-EJ6BGNVY.js → launcher-7T4UUMOZ.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Dl6MFXPr.js
-var require_dist_Dl6MFXPr = __commonJS({
-  "../system/dist/dist-Dl6MFXPr.js"(exports) {
+// ../system/dist/dist-B-mBrEz9.js
+var require_dist_B_mBrEz9 = __commonJS({
+  "../system/dist/dist-B-mBrEz9.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -48902,7 +48902,7 @@ var require_dist_Dl6MFXPr = __commonJS({
       "ffmpeg.binaryPath": "ffmpeg",
       "ffmpeg.hwAccel": "auto",
       "ffmpeg.threadCount": 0,
-      "auth.tokenExpiry": "7d"
+      "auth.tokenExpiry": "30d"
     };
     var AccessoryKind = {
       Siren: DeviceRole.Siren,
@@ -58395,7 +58395,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59214,7 +59214,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59308,7 +59308,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60205,11 +60205,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-6w_JOqBg.js
-var require_retired_settings_keys_6w_JOqBg = __commonJS({
-  "../system/dist/retired-settings-keys-6w_JOqBg.js"(exports) {
+// ../system/dist/retired-settings-keys-Davtjo5p.js
+var require_retired_settings_keys_Davtjo5p = __commonJS({
+  "../system/dist/retired-settings-keys-Davtjo5p.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62363,8 +62363,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
-    var require_retired_settings_keys = require_retired_settings_keys_6w_JOqBg();
+    var require_dist10 = require_dist_B_mBrEz9();
+    var require_retired_settings_keys = require_retired_settings_keys_Davtjo5p();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67113,7 +67113,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67250,7 +67250,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67440,7 +67440,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -71954,6 +71954,99 @@ var require_local_auth_addon = __commonJS({
       };
     }));
     var import_jsonwebtoken = /* @__PURE__ */ require_chunk.__toESM(require_jsonwebtoken());
+    var DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|milliseconds?|msecs?|s|secs?|seconds?|m|mins?|minutes?|h|hrs?|hours?|d|days?|w|weeks?|y|yrs?|years?)$/i;
+    var UNIT_MS = {
+      ms: 1,
+      msec: 1,
+      msecs: 1,
+      millisecond: 1,
+      milliseconds: 1,
+      s: 1e3,
+      sec: 1e3,
+      secs: 1e3,
+      second: 1e3,
+      seconds: 1e3,
+      m: 6e4,
+      min: 6e4,
+      mins: 6e4,
+      minute: 6e4,
+      minutes: 6e4,
+      h: 36e5,
+      hr: 36e5,
+      hrs: 36e5,
+      hour: 36e5,
+      hours: 36e5,
+      d: 864e5,
+      day: 864e5,
+      days: 864e5,
+      w: 6048e5,
+      week: 6048e5,
+      weeks: 6048e5,
+      y: 315576e5,
+      yr: 315576e5,
+      yrs: 315576e5,
+      year: 315576e5,
+      years: 315576e5
+    };
+    var MIN_EXPIRY_MS = 6e4;
+    var MAX_EXPIRY_MS = 365 * 864e5;
+    function durationMs(candidate) {
+      const match = DURATION_PATTERN.exec(candidate);
+      if (match === null) return null;
+      const amount = Number(match[1]);
+      const unitMs = UNIT_MS[match[2].toLowerCase()];
+      if (!Number.isFinite(amount) || unitMs === void 0) return null;
+      return amount * unitMs;
+    }
+    var DEFAULT_SECONDS = (() => {
+      const ms = durationMs("30d");
+      if (ms === null) throw new Error(`DEFAULT_TOKEN_EXPIRY is not a duration: 30d`);
+      return ms / 1e3;
+    })();
+    function refuse(reason) {
+      return {
+        ok: false,
+        reason,
+        seconds: DEFAULT_SECONDS,
+        value: "30d"
+      };
+    }
+    function parseTokenExpiry(configured) {
+      if (configured === void 0 || configured === null) return {
+        ok: true,
+        seconds: DEFAULT_SECONDS,
+        value: "30d"
+      };
+      if (typeof configured !== "string") return refuse("not-a-string");
+      const trimmed = configured.trim();
+      if (trimmed === "") return {
+        ok: true,
+        seconds: DEFAULT_SECONDS,
+        value: "30d"
+      };
+      const totalMs = durationMs(trimmed);
+      if (totalMs === null) return refuse("malformed");
+      if (totalMs < MIN_EXPIRY_MS) return refuse("too-short");
+      if (totalMs > MAX_EXPIRY_MS) return refuse("too-long");
+      return {
+        ok: true,
+        seconds: totalMs / 1e3,
+        value: trimmed
+      };
+    }
+    var REJECTION_DETAIL = {
+      "not-a-string": "value is not a string",
+      malformed: "not a duration string (expected e.g. 24h, 7d, 30d \u2014 a bare number is NOT seconds)",
+      "too-short": `shorter than the ${MIN_EXPIRY_MS / 1e3}s minimum`,
+      "too-long": `longer than the ${MAX_EXPIRY_MS / 864e5}d maximum`
+    };
+    function logTokenExpiryRejection(configured, rejection, logger) {
+      logger.warn(`auth.tokenExpiry REJECTED \u2014 ${REJECTION_DETAIL[rejection.reason]}; signing with the default 30d instead`, { meta: {
+        configured,
+        reason: rejection.reason,
+        applied: rejection.value
+      } });
+    }
     var noopLogger = {
       debug() {
       },
@@ -71974,6 +72067,16 @@ var require_local_auth_addon = __commonJS({
       config;
       jwtSecret;
       logger;
+      /**
+      * Offending `auth.tokenExpiry` values already reported by this instance.
+      *
+      * `signToken` re-reads the setting on EVERY mint so an operator's change
+      * takes effect without a restart — which also means a bad value would log
+      * once per login and once per silent refresh from every viewer. The refusal
+      * must be visible, not repeated: the first mint after a bad save logs, the
+      * rest resolve silently to the same default until the value changes.
+      */
+      reportedInvalidExpiries = /* @__PURE__ */ new Set();
       constructor(config, logger = noopLogger) {
         this.config = config;
         this.logger = logger;
@@ -71988,8 +72091,15 @@ var require_local_auth_addon = __commonJS({
       }
       signToken(payload) {
         const configured = this.config.get("auth.tokenExpiry");
-        const expiresIn = typeof configured === "string" && configured.trim() !== "" ? configured.trim() : "30d";
-        return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn });
+        const parsed = parseTokenExpiry(configured);
+        if (!parsed.ok) {
+          const seen = typeof configured === "string" ? configured : JSON.stringify(configured);
+          if (!this.reportedInvalidExpiries.has(seen)) {
+            this.reportedInvalidExpiries.add(seen);
+            logTokenExpiryRejection(configured, parsed, this.logger);
+          }
+        }
+        return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: parsed.seconds });
       }
       verifyToken(token2) {
         return import_jsonwebtoken.verify(token2, this.jwtSecret);
@@ -74276,6 +74386,30 @@ var require_local_auth_addon = __commonJS({
         return parseRow(results[0].data);
       }
     };
+    function createAuthConfigReader(resolved, writeAuthSection) {
+      return {
+        get(path) {
+          switch (path) {
+            case "auth.jwtSecret":
+              return narrow(resolved.jwtSecret);
+            case "auth.adminUsername":
+              return narrow(resolved.adminUsername);
+            case "auth.adminPassword":
+              return narrow(resolved.adminPassword);
+            case "auth.tokenExpiry":
+              return narrow(resolved.tokenExpiry);
+            default:
+              return;
+          }
+        },
+        update(_section, data) {
+          if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
+        }
+      };
+    }
+    function narrow(value) {
+      return value;
+    }
     var USERS_COLLECTION = "users";
     var API_KEYS_COLLECTION = "api_keys";
     var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
@@ -74806,19 +74940,14 @@ var require_local_auth_addon = __commonJS({
       }
       async onInitialize() {
         const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-        const resolvedJwtSecret = typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "";
-        const resolvedAdminUser = typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "";
-        const resolvedAdminPass = typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "";
-        const reader = {
-          get(path) {
-            if (path === "auth.jwtSecret") return resolvedJwtSecret;
-            if (path === "auth.adminUsername") return resolvedAdminUser;
-            if (path === "auth.adminPassword") return resolvedAdminPass;
-          },
-          update: (_section, data) => {
-            if (typeof data["jwtSecret"] === "string") this.ctx.settings?.setSection("auth", { jwtSecret: data["jwtSecret"] });
-          }
-        };
+        const reader = createAuthConfigReader({
+          jwtSecret: typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "",
+          adminUsername: typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "",
+          adminPassword: typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "",
+          tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0
+        }, (patch) => {
+          this.ctx.settings?.setSection("auth", patch);
+        });
         this.authManager = new AuthManager(reader, this.ctx.logger);
         const store = this.ctx.api?.settingsStore;
         if (store) {
@@ -75124,7 +75253,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -75689,7 +75818,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -77646,7 +77775,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -78762,8 +78891,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
-    var require_retired_settings_keys = require_retired_settings_keys_6w_JOqBg();
+    var require_dist10 = require_dist_B_mBrEz9();
+    var require_retired_settings_keys = require_retired_settings_keys_Davtjo5p();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -81042,7 +81171,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82923,7 +83052,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -82988,7 +83117,7 @@ var require_system_config_addon = __commonJS({
             type: "text",
             key: "tokenExpiry",
             label: "Token Expiry",
-            description: "JWT token lifetime (e.g. 24h, 7d, 30d)",
+            description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected \u2014 it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
             placeholder: "30d",
             default: "30d"
           }]
@@ -100984,7 +101113,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -113361,12 +113490,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-FYZBHc3v.js
-var require_manifest_python_deps_FYZBHc3v = __commonJS({
-  "../system/dist/manifest-python-deps-FYZBHc3v.js"(exports) {
+// ../system/dist/manifest-python-deps-BV_Cy99l.js
+var require_manifest_python_deps_BV_Cy99l = __commonJS({
+  "../system/dist/manifest-python-deps-BV_Cy99l.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_Dl6MFXPr();
+    require_dist_B_mBrEz9();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -124481,7 +124610,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_B_mBrEz9();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -124507,7 +124636,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_u8QCJCFE();
-    var require_manifest_python_deps = require_manifest_python_deps_FYZBHc3v();
+    var require_manifest_python_deps = require_manifest_python_deps_BV_Cy99l();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -231423,6 +231552,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     }
     var HF_REPO = "camstack/camstack-models";
     var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
+    var DEFAULT_TOKEN_EXPIRY = "30d";
     var RUNTIME_DEFAULTS = {
       "features.streaming": true,
       "features.notifications": true,
@@ -231451,7 +231581,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "ffmpeg.binaryPath": "ffmpeg",
       "ffmpeg.hwAccel": "auto",
       "ffmpeg.threadCount": 0,
-      "auth.tokenExpiry": "7d"
+      "auth.tokenExpiry": "30d"
     };
     var AccessoryKind = {
       Siren: require_sleep.DeviceRole.Siren,
@@ -246697,6 +246827,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
     exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
     exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
+    exports.DEFAULT_TOKEN_EXPIRY = DEFAULT_TOKEN_EXPIRY;
     exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
     exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
     exports.DETAIL_CROP_SECTION_ID = DETAIL_CROP_SECTION_ID;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.51",
+  "version": "1.2.52",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",