camstack 1.2.51 → 1.2.53

package/dist/{chunk-HPFKAZ3A.js → chunk-P6IF6IX5.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-Dolp38qx.mjs
+// ../types/dist/sleep-C9C8EoK8.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -17070,6 +17070,10 @@ var addonSettingsCapability = {
       kind: "mutation",
       auth: "admin"
     }),
+    getIntegrationSettings: method(external_exports.object({
+      addonId: external_exports.string(),
+      nodeId: external_exports.string().optional()
+    }), SettingsSchemaWithValuesSchema.nullable()),
     getDeviceSettings: method(external_exports.object({
       addonId: external_exports.string(),
       deviceId: external_exports.number(),
@@ -38487,6 +38491,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "addonSettings.getIntegrationSettings": {
+    capName: "addon-settings",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "addonSettings.updateDeviceSettings": {
     capName: "addon-settings",
     capScope: "system",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runDiscover
-} from "./chunk-HPFKAZ3A.js";
+} from "./chunk-P6IF6IX5.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -38,7 +38,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-EJ6BGNVY.js");
+  await import("./launcher-3YAJ644E.js");
 }
 
 // src/commands/agent.ts
@@ -83,7 +83,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-EJ6BGNVY.js");
+  await import("./launcher-3YAJ644E.js");
 }
 
 // src/commands/setup.ts
@@ -1130,7 +1130,7 @@ function isUnknown(_value) {
   return true;
 }
 async function resolveServerInteractive(presetNamespace) {
-  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-OVQWH2QN.js");
+  const { discoverNodes, resolveHubFromDiscovered, filterHubNodes, DEFAULT_HUB_HTTPS_PORT } = await import("./discover-255INDLH.js");
   if (presetNamespace) {
     const spinner4 = clack.spinner();
     spinner4.start(`Discovering hub on LAN (namespace "${presetNamespace}")`);

package/dist/{discover-OVQWH2QN.js → discover-255INDLH.js}

@@ -5,7 +5,7 @@ import {
   filterHubNodes,
   resolveHubFromDiscovered,
   runDiscover
-} from "./chunk-HPFKAZ3A.js";
+} from "./chunk-P6IF6IX5.js";
 import "./chunk-LMMQX4CK.js";
 export {
   DEFAULT_HUB_HTTPS_PORT,

package/dist/{launcher-EJ6BGNVY.js → launcher-3YAJ644E.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Dl6MFXPr.js
-var require_dist_Dl6MFXPr = __commonJS({
-  "../system/dist/dist-Dl6MFXPr.js"(exports) {
+// ../system/dist/dist-DdEXjTDo.js
+var require_dist_DdEXjTDo = __commonJS({
+  "../system/dist/dist-DdEXjTDo.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -24231,6 +24231,40 @@ var require_dist_Dl6MFXPr = __commonJS({
       deviceSettingsSchema() {
         return null;
       }
+      /**
+      * INTEGRATION-LEVEL SETTINGS — declare which of this addon's global sections
+      * ARE the configuration of its integration.
+      *
+      * Return the `ConfigSection.id`s, from {@link globalSettingsSchema}, that an
+      * operator should find on the addon's integration page (System →
+      * Integrations → <name>) rather than only in the cluster-wide list of every
+      * addon. Empty (the default) means the addon has no integration-level
+      * settings and no such surface is offered — this is opt-in, because whether
+      * an addon's configuration IS its integration's configuration depends on the
+      * nature of the integration.
+      *
+      * WHAT THIS IS NOT. It is not a scope. The selected sections keep living in
+      * the ONE global schema, in the ONE addon store, written by the ONE
+      * `updateGlobalSettings` path. There is deliberately no
+      * `updateIntegrationSettings`: a second write path is how a surface acquires
+      * a second store key, and this repo has shipped that twice (`btmPath@hub`,
+      * D266). Selecting sections cannot introduce a key that selecting cannot.
+      *
+      * WHY IT IS A LIST OF SECTION IDS AND NOT A MARKER ON THE SECTION.
+      * `ConfigFieldBase` used to carry `scope?: 'device' | 'global'` and it was
+      * removed with the reason recorded at
+      * `packages/types/src/interfaces/config-ui.ts:249` — *"a field's scope is
+      * determined by WHICH schema it lives in, not by a field-level marker."* A
+      * marker sprinkled across sections also has to borrow a field that already
+      * means something else; borrowing `section.tab` put the literal word
+      * "integration" into an operator-facing tab bar, because `tab` means "how to
+      * GROUP this visually" and cannot also mean "where this lives" (D269
+      * supersedes D268). One declaration, in one place, next to the schema whose
+      * ids it names.
+      */
+      integrationSettingSections() {
+        return [];
+      }
       async getGlobalSettings(overlay, cap, nodeId) {
         const schema = this.globalSettingsSchema(cap);
         if (!schema) return { sections: [] };
@@ -24241,6 +24275,55 @@ var require_dist_Dl6MFXPr = __commonJS({
         } : projected);
       }
       /**
+      * The integration-level view of this addon's settings: exactly the sections
+      * named by {@link integrationSettingSections}, hydrated from the SAME store
+      * `getGlobalSettings` reads, and narrowed to cluster-scoped fields.
+      *
+      * Returns `null` when the addon declared nothing — an addon that opts out has
+      * no integration settings surface at all, rather than an empty one that reads
+      * as a failed load.
+      *
+      * Three properties hold BY CONSTRUCTION, which is why they are here in core
+      * and not in whichever UI happens to render this:
+      *
+      *  1. **One key.** The payload is a SUBSET of the global schema, so a field
+      *     shown here is the same field, with the same bare key, that the addon's
+      *     own page shows. There is no integration-specific writer — callers save
+      *     through `updateGlobalSettings` — so a second store key is unreachable,
+      *     not merely discouraged.
+      *  2. **No node scope.** `perNode: true` fields are DROPPED. Their store key
+      *     is `<key>@<nodeId>` and an integration is not a node; whichever node
+      *     such a field silently picked would be a wrong answer for the operator
+      *     who opened the page (D266).
+      *  3. **No silent typo.** A declared id that names no section throws. The
+      *     alternative — skip it — turns a rename into a surface that quietly
+      *     empties, which looks exactly like an addon with nothing to configure.
+      */
+      async getIntegrationSettings(nodeId) {
+        const declared = this.integrationSettingSections();
+        if (declared.length === 0) return null;
+        const schema = this.globalSettingsSchema();
+        if (!schema) throw new Error(`${this.constructor.name}: integrationSettingSections() names [${declared.join(", ")}] but globalSettingsSchema() returns null.`);
+        const byId = new Map(schema.sections.map((section) => [section.id, section]));
+        const sections = [];
+        for (const id of declared) {
+          const section = byId.get(id);
+          if (!section) throw new Error(`${this.constructor.name}: integrationSettingSections() names unknown section "${id}". Known sections: [${[...byId.keys()].join(", ")}].`);
+          const fields = dropPerNodeFields(section.fields);
+          if (fields.length === 0) continue;
+          sections.push({
+            ...section,
+            fields
+          });
+        }
+        if (sections.length === 0) return null;
+        const projected = await this.resolveGlobalStore(nodeId);
+        return hydrateSchema({
+          ...schema,
+          sections
+        }, projected);
+      }
+      /**
       * The raw addon store PROJECTED onto the target node's bare per-node keys:
       * every `perNode: true` field carries THAT node's scoped value on its bare
       * key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -24540,6 +24623,33 @@ var require_dist_Dl6MFXPr = __commonJS({
         return {};
       }
     };
+    function dropPerNodeFields(fields) {
+      const kept = [];
+      for (const field of fields) {
+        if (field.type === "group") {
+          const inner = dropPerNodeFields(field.fields);
+          if (inner.length > 0) kept.push({
+            ...field,
+            fields: inner
+          });
+          continue;
+        }
+        if (field.type === "sub-tabs") {
+          const tabs = field.tabs.map((tab) => ({
+            ...tab,
+            fields: dropPerNodeFields(tab.fields)
+          })).filter((tab) => tab.fields.length > 0);
+          if (tabs.length > 0) kept.push({
+            ...field,
+            tabs
+          });
+          continue;
+        }
+        if ("perNode" in field && field.perNode === true) continue;
+        kept.push(field);
+      }
+      return kept;
+    }
     function collectPerNodeFieldKeys(fields) {
       const collected = [];
       for (const field of fields) {
@@ -27528,6 +27638,10 @@ var require_dist_Dl6MFXPr = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        getIntegrationSettings: method(zod.z.object({
+          addonId: zod.z.string(),
+          nodeId: zod.z.string().optional()
+        }), SettingsSchemaWithValuesSchema.nullable()),
         getDeviceSettings: method(zod.z.object({
           addonId: zod.z.string(),
           deviceId: zod.z.number(),
@@ -48902,7 +49016,7 @@ var require_dist_Dl6MFXPr = __commonJS({
       "ffmpeg.binaryPath": "ffmpeg",
       "ffmpeg.hwAccel": "auto",
       "ffmpeg.threadCount": 0,
-      "auth.tokenExpiry": "7d"
+      "auth.tokenExpiry": "30d"
     };
     var AccessoryKind = {
       Siren: DeviceRole.Siren,
@@ -49658,6 +49772,12 @@ var require_dist_Dl6MFXPr = __commonJS({
         addonId: null,
         access: "view"
       },
+      "addonSettings.getIntegrationSettings": {
+        capName: "addon-settings",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "addonSettings.updateDeviceSettings": {
         capName: "addon-settings",
         capScope: "system",
@@ -58395,7 +58515,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59214,7 +59334,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59308,7 +59428,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60205,28 +60325,88 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-6w_JOqBg.js
-var require_retired_settings_keys_6w_JOqBg = __commonJS({
-  "../system/dist/retired-settings-keys-6w_JOqBg.js"(exports) {
+// ../system/dist/retired-settings-keys-BXaTgLyZ.js
+var require_retired_settings_keys_BXaTgLyZ = __commonJS({
+  "../system/dist/retired-settings-keys-BXaTgLyZ.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
     }
-    var RETIRED_SETTINGS_KEYS = [{
-      namespace: "detection-pipeline",
-      collection: "addon-settings",
-      row: "root",
-      keys: ["pipelineSteps", "pipelineEngine"],
-      perNodeKeys: [
-        "engineRuntime",
-        "engineBackend",
-        "engineDevice",
-        "probedBestEngine"
-      ],
-      reason: "global step/engine seed and the per-node engine cascade \u2014 both removed; the live per-camera dispatch path never read either"
-    }];
+    var RETIRED_SETTINGS_KEYS = [
+      {
+        namespace: "detection-pipeline",
+        collection: "addon-settings",
+        row: "root",
+        keys: ["pipelineSteps", "pipelineEngine"],
+        perNodeKeys: [
+          "engineRuntime",
+          "engineBackend",
+          "engineDevice",
+          "probedBestEngine"
+        ],
+        reason: "global step/engine seed and the per-node engine cascade \u2014 both removed; the live per-camera dispatch path never read either"
+      },
+      {
+        namespace: "pipeline-orchestrator",
+        collection: "addon-settings",
+        row: "root",
+        keys: [
+          "enabledNodes",
+          "enabledDecoderNodes",
+          "enabledAudioNodes",
+          "remoteSourcingNodes",
+          "nativeLeaseTtlMs"
+        ],
+        perNodeKeys: ["backend"],
+        reason: 'the pre-singleton "enabled nodes" role model (node capability now lives per node in agent-settings and is derived by NodeTopology.refresh, never read from this row), `nativeLeaseTtlMs` superseded by `nativeLeaseActivityMs`, and the decoder `backend` selector whose resolver returns DEFAULT_DECODER_BACKEND unconditionally (decoder-backend.ts)'
+      },
+      {
+        namespace: "stream-broker",
+        collection: "addon-settings",
+        row: "root",
+        keys: [
+          "maxDecodeFps",
+          "initialReconnectDelayMs",
+          "maxReconnectDelayMs"
+        ],
+        perNodeKeys: [],
+        reason: "three form knobs deleted 2026-08-28 (D272): nothing capped decode fps, and the reconnect ladder has always run on the INITIAL/MAX_RECONNECT_DELAY_MS constants"
+      },
+      {
+        namespace: "embedding-encoder",
+        collection: "addon-settings",
+        row: "root",
+        keys: ["runtime", "backend"],
+        perNodeKeys: [],
+        reason: "two selects deleted 2026-08-28 (D272); their only reference was a withTags log field, and the CUDA/CoreML options named acceleration that has never existed \u2014 embedding inference is always ONNX in the embedded Python"
+      },
+      {
+        namespace: "audio-analyzer",
+        collection: "addon-settings",
+        row: "root",
+        keys: ["selectedAudioModel", "probedBestAudioBackend"],
+        perNodeKeys: [],
+        reason: "`selectedAudioModel` deleted 2026-08-28 (D272) \u2014 createAudioPipeline takes a backend and no model id, so it never reached inference; the BARE `probedBestAudioBackend` is pre-perNode residue that projectStore already drops (no bare fallback), so no node can ever read it"
+      },
+      {
+        namespace: "decoder-nodeav",
+        collection: "addon-settings",
+        row: "root",
+        keys: ["probedBestHwaccel"],
+        perNodeKeys: [],
+        reason: "bare pre-perNode residue \u2014 the live probe result is `probedBestHwaccel@<nodeId>` and `projectStore` deliberately drops the bare key, so nothing can read it"
+      },
+      {
+        namespace: "pipeline-analytics",
+        collection: "addon-settings",
+        row: "root",
+        keys: ["mediaAttachPolicy"],
+        perNodeKeys: [],
+        reason: "deleted 2026-08-28 (D272) \u2014 absent from MediaSettingsSchema, so the value was never even resolved, let alone read"
+      }
+    ];
     var RETIRED_SETTINGS_ROWS = [
       {
         collection: "addon-settings",
@@ -62363,8 +62543,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
-    var require_retired_settings_keys = require_retired_settings_keys_6w_JOqBg();
+    var require_dist10 = require_dist_DdEXjTDo();
+    var require_retired_settings_keys = require_retired_settings_keys_BXaTgLyZ();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67113,7 +67293,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67250,7 +67430,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67440,7 +67620,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -71954,6 +72134,99 @@ var require_local_auth_addon = __commonJS({
       };
     }));
     var import_jsonwebtoken = /* @__PURE__ */ require_chunk.__toESM(require_jsonwebtoken());
+    var DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|milliseconds?|msecs?|s|secs?|seconds?|m|mins?|minutes?|h|hrs?|hours?|d|days?|w|weeks?|y|yrs?|years?)$/i;
+    var UNIT_MS = {
+      ms: 1,
+      msec: 1,
+      msecs: 1,
+      millisecond: 1,
+      milliseconds: 1,
+      s: 1e3,
+      sec: 1e3,
+      secs: 1e3,
+      second: 1e3,
+      seconds: 1e3,
+      m: 6e4,
+      min: 6e4,
+      mins: 6e4,
+      minute: 6e4,
+      minutes: 6e4,
+      h: 36e5,
+      hr: 36e5,
+      hrs: 36e5,
+      hour: 36e5,
+      hours: 36e5,
+      d: 864e5,
+      day: 864e5,
+      days: 864e5,
+      w: 6048e5,
+      week: 6048e5,
+      weeks: 6048e5,
+      y: 315576e5,
+      yr: 315576e5,
+      yrs: 315576e5,
+      year: 315576e5,
+      years: 315576e5
+    };
+    var MIN_EXPIRY_MS = 6e4;
+    var MAX_EXPIRY_MS = 365 * 864e5;
+    function durationMs(candidate) {
+      const match = DURATION_PATTERN.exec(candidate);
+      if (match === null) return null;
+      const amount = Number(match[1]);
+      const unitMs = UNIT_MS[match[2].toLowerCase()];
+      if (!Number.isFinite(amount) || unitMs === void 0) return null;
+      return amount * unitMs;
+    }
+    var DEFAULT_SECONDS = (() => {
+      const ms = durationMs("30d");
+      if (ms === null) throw new Error(`DEFAULT_TOKEN_EXPIRY is not a duration: 30d`);
+      return ms / 1e3;
+    })();
+    function refuse(reason) {
+      return {
+        ok: false,
+        reason,
+        seconds: DEFAULT_SECONDS,
+        value: "30d"
+      };
+    }
+    function parseTokenExpiry(configured) {
+      if (configured === void 0 || configured === null) return {
+        ok: true,
+        seconds: DEFAULT_SECONDS,
+        value: "30d"
+      };
+      if (typeof configured !== "string") return refuse("not-a-string");
+      const trimmed = configured.trim();
+      if (trimmed === "") return {
+        ok: true,
+        seconds: DEFAULT_SECONDS,
+        value: "30d"
+      };
+      const totalMs = durationMs(trimmed);
+      if (totalMs === null) return refuse("malformed");
+      if (totalMs < MIN_EXPIRY_MS) return refuse("too-short");
+      if (totalMs > MAX_EXPIRY_MS) return refuse("too-long");
+      return {
+        ok: true,
+        seconds: totalMs / 1e3,
+        value: trimmed
+      };
+    }
+    var REJECTION_DETAIL = {
+      "not-a-string": "value is not a string",
+      malformed: "not a duration string (expected e.g. 24h, 7d, 30d \u2014 a bare number is NOT seconds)",
+      "too-short": `shorter than the ${MIN_EXPIRY_MS / 1e3}s minimum`,
+      "too-long": `longer than the ${MAX_EXPIRY_MS / 864e5}d maximum`
+    };
+    function logTokenExpiryRejection(configured, rejection, logger) {
+      logger.warn(`auth.tokenExpiry REJECTED \u2014 ${REJECTION_DETAIL[rejection.reason]}; signing with the default 30d instead`, { meta: {
+        configured,
+        reason: rejection.reason,
+        applied: rejection.value
+      } });
+    }
     var noopLogger = {
       debug() {
       },
@@ -71974,6 +72247,16 @@ var require_local_auth_addon = __commonJS({
       config;
       jwtSecret;
       logger;
+      /**
+      * Offending `auth.tokenExpiry` values already reported by this instance.
+      *
+      * `signToken` re-reads the setting on EVERY mint so an operator's change
+      * takes effect without a restart — which also means a bad value would log
+      * once per login and once per silent refresh from every viewer. The refusal
+      * must be visible, not repeated: the first mint after a bad save logs, the
+      * rest resolve silently to the same default until the value changes.
+      */
+      reportedInvalidExpiries = /* @__PURE__ */ new Set();
       constructor(config, logger = noopLogger) {
         this.config = config;
         this.logger = logger;
@@ -71988,8 +72271,15 @@ var require_local_auth_addon = __commonJS({
       }
       signToken(payload) {
         const configured = this.config.get("auth.tokenExpiry");
-        const expiresIn = typeof configured === "string" && configured.trim() !== "" ? configured.trim() : "30d";
-        return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn });
+        const parsed = parseTokenExpiry(configured);
+        if (!parsed.ok) {
+          const seen = typeof configured === "string" ? configured : JSON.stringify(configured);
+          if (!this.reportedInvalidExpiries.has(seen)) {
+            this.reportedInvalidExpiries.add(seen);
+            logTokenExpiryRejection(configured, parsed, this.logger);
+          }
+        }
+        return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: parsed.seconds });
       }
       verifyToken(token2) {
         return import_jsonwebtoken.verify(token2, this.jwtSecret);
@@ -74276,6 +74566,30 @@ var require_local_auth_addon = __commonJS({
         return parseRow(results[0].data);
       }
     };
+    function createAuthConfigReader(resolved, writeAuthSection) {
+      return {
+        get(path) {
+          switch (path) {
+            case "auth.jwtSecret":
+              return narrow(resolved.jwtSecret);
+            case "auth.adminUsername":
+              return narrow(resolved.adminUsername);
+            case "auth.adminPassword":
+              return narrow(resolved.adminPassword);
+            case "auth.tokenExpiry":
+              return narrow(resolved.tokenExpiry);
+            default:
+              return;
+          }
+        },
+        update(_section, data) {
+          if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
+        }
+      };
+    }
+    function narrow(value) {
+      return value;
+    }
     var USERS_COLLECTION = "users";
     var API_KEYS_COLLECTION = "api_keys";
     var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
@@ -74806,19 +75120,14 @@ var require_local_auth_addon = __commonJS({
       }
       async onInitialize() {
         const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-        const resolvedJwtSecret = typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "";
-        const resolvedAdminUser = typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "";
-        const resolvedAdminPass = typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "";
-        const reader = {
-          get(path) {
-            if (path === "auth.jwtSecret") return resolvedJwtSecret;
-            if (path === "auth.adminUsername") return resolvedAdminUser;
-            if (path === "auth.adminPassword") return resolvedAdminPass;
-          },
-          update: (_section, data) => {
-            if (typeof data["jwtSecret"] === "string") this.ctx.settings?.setSection("auth", { jwtSecret: data["jwtSecret"] });
-          }
-        };
+        const reader = createAuthConfigReader({
+          jwtSecret: typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "",
+          adminUsername: typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "",
+          adminPassword: typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "",
+          tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0
+        }, (patch) => {
+          this.ctx.settings?.setSection("auth", patch);
+        });
         this.authManager = new AuthManager(reader, this.ctx.logger);
         const store = this.ctx.api?.settingsStore;
         if (store) {
@@ -75124,7 +75433,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -75689,7 +75998,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -77646,7 +77955,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -78762,8 +79071,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
-    var require_retired_settings_keys = require_retired_settings_keys_6w_JOqBg();
+    var require_dist10 = require_dist_DdEXjTDo();
+    var require_retired_settings_keys = require_retired_settings_keys_BXaTgLyZ();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -81042,7 +81351,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82923,7 +83232,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -82988,7 +83297,7 @@ var require_system_config_addon = __commonJS({
             type: "text",
             key: "tokenExpiry",
             label: "Token Expiry",
-            description: "JWT token lifetime (e.g. 24h, 7d, 30d)",
+            description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected \u2014 it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
             placeholder: "30d",
             default: "30d"
           }]
@@ -100984,7 +101293,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -102927,9 +103236,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-9d8tJRbO.js
-var require_sleep_9d8tJRbO = __commonJS({
-  "../types/dist/sleep-9d8tJRbO.js"(exports) {
+// ../types/dist/sleep-DUxF5DdC.js
+var require_sleep_DUxF5DdC = __commonJS({
+  "../types/dist/sleep-DUxF5DdC.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -103418,6 +103727,40 @@ var require_sleep_9d8tJRbO = __commonJS({
       deviceSettingsSchema() {
         return null;
       }
+      /**
+      * INTEGRATION-LEVEL SETTINGS — declare which of this addon's global sections
+      * ARE the configuration of its integration.
+      *
+      * Return the `ConfigSection.id`s, from {@link globalSettingsSchema}, that an
+      * operator should find on the addon's integration page (System →
+      * Integrations → <name>) rather than only in the cluster-wide list of every
+      * addon. Empty (the default) means the addon has no integration-level
+      * settings and no such surface is offered — this is opt-in, because whether
+      * an addon's configuration IS its integration's configuration depends on the
+      * nature of the integration.
+      *
+      * WHAT THIS IS NOT. It is not a scope. The selected sections keep living in
+      * the ONE global schema, in the ONE addon store, written by the ONE
+      * `updateGlobalSettings` path. There is deliberately no
+      * `updateIntegrationSettings`: a second write path is how a surface acquires
+      * a second store key, and this repo has shipped that twice (`btmPath@hub`,
+      * D266). Selecting sections cannot introduce a key that selecting cannot.
+      *
+      * WHY IT IS A LIST OF SECTION IDS AND NOT A MARKER ON THE SECTION.
+      * `ConfigFieldBase` used to carry `scope?: 'device' | 'global'` and it was
+      * removed with the reason recorded at
+      * `packages/types/src/interfaces/config-ui.ts:249` — *"a field's scope is
+      * determined by WHICH schema it lives in, not by a field-level marker."* A
+      * marker sprinkled across sections also has to borrow a field that already
+      * means something else; borrowing `section.tab` put the literal word
+      * "integration" into an operator-facing tab bar, because `tab` means "how to
+      * GROUP this visually" and cannot also mean "where this lives" (D269
+      * supersedes D268). One declaration, in one place, next to the schema whose
+      * ids it names.
+      */
+      integrationSettingSections() {
+        return [];
+      }
       async getGlobalSettings(overlay, cap, nodeId) {
         const schema = this.globalSettingsSchema(cap);
         if (!schema) return { sections: [] };
@@ -103428,6 +103771,55 @@ var require_sleep_9d8tJRbO = __commonJS({
         } : projected);
       }
       /**
+      * The integration-level view of this addon's settings: exactly the sections
+      * named by {@link integrationSettingSections}, hydrated from the SAME store
+      * `getGlobalSettings` reads, and narrowed to cluster-scoped fields.
+      *
+      * Returns `null` when the addon declared nothing — an addon that opts out has
+      * no integration settings surface at all, rather than an empty one that reads
+      * as a failed load.
+      *
+      * Three properties hold BY CONSTRUCTION, which is why they are here in core
+      * and not in whichever UI happens to render this:
+      *
+      *  1. **One key.** The payload is a SUBSET of the global schema, so a field
+      *     shown here is the same field, with the same bare key, that the addon's
+      *     own page shows. There is no integration-specific writer — callers save
+      *     through `updateGlobalSettings` — so a second store key is unreachable,
+      *     not merely discouraged.
+      *  2. **No node scope.** `perNode: true` fields are DROPPED. Their store key
+      *     is `<key>@<nodeId>` and an integration is not a node; whichever node
+      *     such a field silently picked would be a wrong answer for the operator
+      *     who opened the page (D266).
+      *  3. **No silent typo.** A declared id that names no section throws. The
+      *     alternative — skip it — turns a rename into a surface that quietly
+      *     empties, which looks exactly like an addon with nothing to configure.
+      */
+      async getIntegrationSettings(nodeId) {
+        const declared = this.integrationSettingSections();
+        if (declared.length === 0) return null;
+        const schema = this.globalSettingsSchema();
+        if (!schema) throw new Error(`${this.constructor.name}: integrationSettingSections() names [${declared.join(", ")}] but globalSettingsSchema() returns null.`);
+        const byId = new Map(schema.sections.map((section) => [section.id, section]));
+        const sections = [];
+        for (const id of declared) {
+          const section = byId.get(id);
+          if (!section) throw new Error(`${this.constructor.name}: integrationSettingSections() names unknown section "${id}". Known sections: [${[...byId.keys()].join(", ")}].`);
+          const fields = dropPerNodeFields(section.fields);
+          if (fields.length === 0) continue;
+          sections.push({
+            ...section,
+            fields
+          });
+        }
+        if (sections.length === 0) return null;
+        const projected = await this.resolveGlobalStore(nodeId);
+        return hydrateSchema({
+          ...schema,
+          sections
+        }, projected);
+      }
+      /**
       * The raw addon store PROJECTED onto the target node's bare per-node keys:
       * every `perNode: true` field carries THAT node's scoped value on its bare
       * key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -103727,6 +104119,33 @@ var require_sleep_9d8tJRbO = __commonJS({
         return {};
       }
     };
+    function dropPerNodeFields(fields) {
+      const kept = [];
+      for (const field of fields) {
+        if (field.type === "group") {
+          const inner = dropPerNodeFields(field.fields);
+          if (inner.length > 0) kept.push({
+            ...field,
+            fields: inner
+          });
+          continue;
+        }
+        if (field.type === "sub-tabs") {
+          const tabs = field.tabs.map((tab) => ({
+            ...tab,
+            fields: dropPerNodeFields(tab.fields)
+          })).filter((tab) => tab.fields.length > 0);
+          if (tabs.length > 0) kept.push({
+            ...field,
+            tabs
+          });
+          continue;
+        }
+        if ("perNode" in field && field.perNode === true) continue;
+        kept.push(field);
+      }
+      return kept;
+    }
     function collectPerNodeFieldKeys(fields) {
       const collected = [];
       for (const field of fields) {
@@ -106483,7 +106902,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_9d8tJRbO();
+    var require_sleep = require_sleep_DUxF5DdC();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -113361,12 +113780,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-FYZBHc3v.js
-var require_manifest_python_deps_FYZBHc3v = __commonJS({
-  "../system/dist/manifest-python-deps-FYZBHc3v.js"(exports) {
+// ../system/dist/manifest-python-deps-CivtrAha.js
+var require_manifest_python_deps_CivtrAha = __commonJS({
+  "../system/dist/manifest-python-deps-CivtrAha.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_Dl6MFXPr();
+    require_dist_DdEXjTDo();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -124481,7 +124900,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Dl6MFXPr();
+    var require_dist10 = require_dist_DdEXjTDo();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -124507,7 +124926,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_u8QCJCFE();
-    var require_manifest_python_deps = require_manifest_python_deps_FYZBHc3v();
+    var require_manifest_python_deps = require_manifest_python_deps_CivtrAha();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -205223,7 +205642,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_9d8tJRbO();
+    var require_sleep = require_sleep_DUxF5DdC();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -208876,6 +209295,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        getIntegrationSettings: require_sleep.method(zod.z.object({
+          addonId: zod.z.string(),
+          nodeId: zod.z.string().optional()
+        }), SettingsSchemaWithValuesSchema.nullable()),
         getDeviceSettings: require_sleep.method(zod.z.object({
           addonId: zod.z.string(),
           deviceId: zod.z.number(),
@@ -209155,8 +209578,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     ];
     var DEFAULT_AUDIO_ANALYZER_CONFIG = {
       audioBackend: "auto",
-      probedBestAudioBackend: "",
-      selectedAudioModel: ""
+      probedBestAudioBackend: ""
     };
     var audioAnalyzerCapability = {
       name: "audio-analyzer",
@@ -231423,6 +231845,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     }
     var HF_REPO = "camstack/camstack-models";
     var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
+    var DEFAULT_TOKEN_EXPIRY = "30d";
     var RUNTIME_DEFAULTS = {
       "features.streaming": true,
       "features.notifications": true,
@@ -231451,7 +231874,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "ffmpeg.binaryPath": "ffmpeg",
       "ffmpeg.hwAccel": "auto",
       "ffmpeg.threadCount": 0,
-      "auth.tokenExpiry": "7d"
+      "auth.tokenExpiry": "30d"
     };
     var AccessoryKind = {
       Siren: require_sleep.DeviceRole.Siren,
@@ -235050,6 +235473,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "addonSettings.getIntegrationSettings": {
+        capName: "addon-settings",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "addonSettings.updateDeviceSettings": {
         capName: "addon-settings",
         capScope: "system",
@@ -243252,7 +243681,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         },
         addonSettings: {
           getGlobalSettings: (input) => dispatch("addonSettings", "getGlobalSettings", "query", input),
-          updateGlobalSettings: (input) => dispatch("addonSettings", "updateGlobalSettings", "mutation", input)
+          updateGlobalSettings: (input) => dispatch("addonSettings", "updateGlobalSettings", "mutation", input),
+          getIntegrationSettings: (input) => dispatch("addonSettings", "getIntegrationSettings", "query", input)
         },
         addonWidgets: { listWidgets: (input) => dispatch("addonWidgets", "listWidgets", "query", input) },
         alerts: {
@@ -246697,6 +247127,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
     exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
     exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
+    exports.DEFAULT_TOKEN_EXPIRY = DEFAULT_TOKEN_EXPIRY;
     exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
     exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
     exports.DETAIL_CROP_SECTION_ID = DETAIL_CROP_SECTION_ID;
@@ -412320,6 +412751,16 @@ var require_addon_settings_provider = __commonJS({
           }
           return forkedUpdate(input.addonId, "updateGlobalSettings", { patch: input.patch, ...input.nodeId ? { nodeId: input.nodeId } : {} }, input.nodeId);
         },
+        async getIntegrationSettings(input) {
+          if (gateway.isInProcess(input.addonId, input.nodeId)) {
+            const addon = getAddon(input.addonId);
+            if (!addon || typeof addon.getIntegrationSettings !== "function")
+              return null;
+            const result = await addon.getIntegrationSettings(input.nodeId);
+            return result ? reshapeForOutput(result) : null;
+          }
+          return forkedGet(input.addonId, "getIntegrationSettings", { ...input.nodeId ? { nodeId: input.nodeId } : {} }, input.nodeId);
+        },
         async getDeviceSettings(input) {
           if (gateway.isInProcess(input.addonId, input.nodeId)) {
             const addon = getAddon(input.addonId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camstack",
-  "version": "1.2.51",
+  "version": "1.2.53",
   "description": "CLI tool for managing and running CamStack server",
   "keywords": [
     "camstack",