@camstack/addon-auth 1.2.126 → 1.2.127

package/dist/{dist-DoUGHO_G.mjs → dist-UznM2RaH.mjs}

@@ -10577,6 +10577,57 @@ var ClipSearchStrictnessSchema = _enum([
 	"balanced",
 	"strict"
 ]);
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+/** Steps a root detector may declare it fills. */
+var FILLABLE_STEP_IDS = [
+	"animal-classifier",
+	"vehicle-classifier",
+	"package-detection"
+];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10646,11 +10697,11 @@ var ModelVariantGroupSchema = object({
 	/** Quantization axis. Omit ⇒ the fp32 base build. */
 	precision: _enum(["fp32", "int8"]).optional(),
 	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
+	* Training / latency-variant axis. Omit ⇒ the standard build. `test` marks
+	* an alternate training of the same family (Scrypted `relu_test`); chip
+	* label is "Test".
 	*/
-	optimization: _enum(["standard", "fast"]).optional(),
+	optimization: _enum(["standard", "test"]).optional(),
 	/**
 	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
 	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
@@ -10673,9 +10724,10 @@ var ModelProviderIdSchema = _enum([
 * are per upstream. A persisted custom-model row written when this field was a
 * string still parses — the string is lifted into `{ weights }`.
 *
-* Every licence surface (the admin "Models and licenses" page,
-* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
-* these records by `scripts/gen-model-licenses.ts` (D661).
+* Every machine licence surface (`THIRD_PARTY_MODELS.md`, the Hugging Face
+* model table) is GENERATED from these records by
+* `scripts/gen-model-licenses.ts` (D661). Operator-facing docs live in
+* `camstack/docs` → `/docs/detection/models`.
 */
 var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
 	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
@@ -10708,6 +10760,12 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 	/** True when the weights or their data forbid commercial use. */
 	nonCommercial: boolean().optional()
 }));
+/** One `fillsClassifierEffects` entry — see `ModelCatalogEntry.fillsClassifierEffects`. */
+var FillsClassifierEffectSchema = object({
+	stepId: _enum(FILLABLE_STEP_IDS),
+	labelToEffect: record(string(), string()),
+	uncovered: array(string()).readonly()
+});
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -10834,6 +10892,16 @@ var ModelCatalogEntrySchema = object({
 	*/
 	classMap: DetectionCatalogClassMapSchema.optional(),
 	/**
+	* The pipeline steps this ROOT detector already does the work of (D715):
+	* its labels name the effect the step exists to produce (`deer` for
+	* `animal-classifier`, `package` for `package-detection`). Derived from the
+	* labelmap by `deriveClassifierFills`, never hand-written; a COCO model
+	* declares none. Whether a declaration is honoured is the step's own
+	* `labelLink` policy (`resolveLabelLink`). `labelToEffect` values are in
+	* `FILLABLE_STEP_VOCABULARIES` (guard `check-label-link-vocabulary`).
+	*/
+	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional(),
+	/**
 	* The model's CLIP feature-space contract (text encoder, dimension, vector
 	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
 	* CLIP image encoder; its absence is what "not a CLIP model" means to the
@@ -14255,7 +14323,7 @@ DeviceType.Camera;
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.60.139/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -17247,7 +17315,7 @@ method(object({
 	timeoutMs: 6e5
 });
 method(object({
-	nodeId: string(),
+	targetNodeId: string(),
 	modelId: string(),
 	format: _enum(MODEL_FORMATS),
 	entry: ModelCatalogEntrySchema
@@ -17813,51 +17881,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	kind: "mutation",
 	auth: "admin"
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -19713,8 +19736,9 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	disabledTargetIds: array(string()).default([])
 });
 /**
-* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
-* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* The state-summary SECTIONS (D647 / D698 / D708): the D637 kind groups that
+* report a still-true state. `addons` is the crash-looped addons only and
+* `addon-updates` the addons that are behind (D708 split them). `backups-exports` and `alarm` are not sections — a completed
 * job is not an open state, and the alarm stays instant.
 */
 var NcStateSummarySectionIdSchema = _enum([
@@ -19726,6 +19750,7 @@ var NcStateSummarySectionIdSchema = _enum([
 	"detection-blind",
 	"nodes",
 	"addons",
+	"addon-updates",
 	"updates"
 ]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
@@ -20206,7 +20231,19 @@ var NcAlarmModeDelaysListSchema = array(object({
 	* When this mode may be armed. Absent / null = always allowed (same as a
 	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
 	*/
-	schedule: NcScheduleSchema.optional()
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* D706: while this mode's ENTRY DELAY runs, do the alarm rules' own pushes go out (as an
+	* intrusion naming the locations)? Absent = false — the entry-delay notification is the
+	* only one, and the matches ride the triggered notification's mosaic (D705).
+	*/
+	notifyDuringEntryDelay: boolean().optional(),
+	/**
+	* D706: notify "watched again" when a sensor this arm bypassed closes and opens again.
+	* Absent = false (logged, not sent). Even when true it is not sent when that same sensor
+	* is the one that starts the entry delay — the entry-delay notification already names it.
+	*/
+	notifySensorRewatched: boolean().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 var NcAlarmModeDelaysEditListSchema = array(object({
 	mode: AlarmArmModeSchema,
@@ -20215,7 +20252,11 @@ var NcAlarmModeDelaysEditListSchema = array(object({
 	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
 	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
 	/** Set a schedule, or `null` to clear (mode always allowed again). */
-	schedule: NcScheduleSchema.nullable().optional()
+	schedule: NcScheduleSchema.nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifyDuringEntryDelay: boolean().nullable().optional(),
+	/** D706: set the switch, or `null` to clear it (back to the default, false). */
+	notifySensorRewatched: boolean().nullable().optional()
 })).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
 var NcAlarmNonBlockingEditSchema = object({
@@ -21176,39 +21217,19 @@ Object.freeze(Object.fromEntries([{
 	label: "Face recognition model",
 	defaultModelId: "auraface-r100",
 	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
+	options: [{
+		id: "auraface-r100",
+		label: "AuraFace R100"
+	}]
 }, {
 	stepId: "clip-embedding",
 	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
+	defaultModelId: "siglip2-b16-224",
 	indexName: "the object semantic-search index",
-	options: [
-		{
-			id: "mobileclip-s1",
-			label: "MobileCLIP S1"
-		},
-		{
-			id: "mobileclip-s2",
-			label: "MobileCLIP S2"
-		},
-		{
-			id: "siglip2-b16-224",
-			label: "SigLIP2 B/16 (Apache-2.0)"
-		}
-	]
+	options: [{
+		id: "siglip2-b16-224",
+		label: "SigLIP2 B/16 (Apache-2.0)"
+	}]
 }].map((s) => [s.stepId, s.defaultModelId])));
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
@@ -23263,7 +23284,8 @@ var PipelineModelOptionSchema = object({
 	group: ModelVariantGroupSchema.optional(),
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
-	defaultConfidence: number().optional()
+	defaultConfidence: number().optional(),
+	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -24056,6 +24078,22 @@ var MotionSourceEnum = _enum([
 	"device-activity"
 ]);
 /**
+* What opened an on-motion detection SESSION: the motion source that passed the
+* camera's `motionSources` gate, and what raised it (the camera itself, or a
+* sensor the operator attached — D672). `sensorName` is the attached sensor's
+* device name as the orchestrator's camera-sensors resolution last read it;
+* absent when unknown or when the camera itself triggered.
+*
+* Carried on the session attach ONLY so the runner's `DetectionPhaseTransition`
+* can say what started the session (D672 rule 11, amended 2026-10-06). The
+* runner never decides anything on it.
+*/
+var SessionTriggerSchema = object({
+	source: MotionSourceEnum,
+	triggeredBy: MotionTriggeredBySchema,
+	sensorName: string().optional()
+});
+/**
 * List of motion sources active on a camera. Empty array is valid:
 * "no source" — happens for battery cams without firmware motion when
 * the operator hasn't opted into the SW analyzer (would hold the
@@ -24307,6 +24345,14 @@ var RunnerCameraConfigSchema = object({
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
+	* What opened this attach, on a SESSION attach only (see
+	* {@link SessionTriggerSchema}). OPTIONAL with no default: absent on a
+	* standing attach, an occupancy burst, a re-dispatch with no motion event
+	* behind it, and every attach from an orchestrator older than the field — the
+	* runner then names no source on the phase event.
+	*/
+	sessionTrigger: SessionTriggerSchema.optional(),
+	/**
 	* WHICH root detector runs for this camera. The detection counterpart of
 	* {@link motionSources}, same shape and same discipline: a per-camera list
 	* of sources the system understands, vendor-agnostic, owned here.
@@ -30565,7 +30611,7 @@ var LocalInterfaceSchema = object({
 	name: string(),
 	family: _enum(["IPv4", "IPv6"]),
 	address: string(),
-	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.10.10/24`). Empty when OS doesn't expose. */
 	cidr: string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: string(),
@@ -30619,7 +30665,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv4",
 		"lan-ipv6",
 		"public",
-		"loopback"
+		"loopback",
+		"app-link"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -30688,15 +30735,27 @@ var GetConnectionEndpointsResultSchema = object({
 	localPort: AdvertisedLocalPortSchema
 });
 /**
-* The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
-* AUTO (resolved from the candidate ranking at send time); `resolved` reports
-* what AUTO currently picks, so the UI can show the effective value either way.
+* The address flagged for notification links. `baseUrl: null` = AUTO, which
+* since D709 is the CamStack app link; `resolved` reports the effective value,
+* so the UI can show it either way.
 */
 var NotificationEndpointSchema = object({
 	/** The operator's explicit choice, or null for AUTO. */
 	baseUrl: string().nullable(),
-	/** What the ranking currently resolves to (null when nothing is reachable). */
-	resolved: string().nullable()
+	/**
+	* The effective flagged address: the explicit choice, else (AUTO) the
+	* CamStack app link `https://camstack.zentik.app` (D709). A pre-D709 hub
+	* answered the public tunnel / mesh here, or null.
+	*/
+	resolved: string().nullable(),
+	/**
+	* The hub origin an app link carries as `hub=` (D709): the hub's best
+	* public HTTPS address — the tunnel, then the mesh (Tailscale MagicDNS) —
+	* picked from this cap's own palette by `pickAppLinkHub`. `null` when the
+	* hub advertises neither; the app link is then minted without `hub=`.
+	* Absent on a pre-D709 hub.
+	*/
+	appLinkHub: string().nullable()
 });
 /**
 * The URLs the SDK / viewer should race for API access. `baseUrls` empty =
@@ -30750,7 +30809,11 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
-	scheme: _enum(["http", "https"]).optional()
+	scheme: _enum(["http", "https"]).optional(),
+	/** Append the CamStack app link entry (`kind: 'app-link'`, D709) —
+	*  an address notification links can be flagged with, not a hub
+	*  route. Default `false`: racers and rankers never see it. */
+	includeAppLink: boolean().optional()
 }), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -31011,7 +31074,7 @@ var MeshPeerSchema = object({
 	tags: array(string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.10.0/24"]`). */
 	advertisedRoutes: array(string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: string().nullable(),
@@ -31955,7 +32018,13 @@ var OsdStatusSchema = object({ overlays: array(object({
 	*/
 	availablePositions: array(OsdPositionEnum).readonly(),
 	/** Firmware does not allow editing the `text` field (e.g. timestamp). */
-	readOnly: boolean().optional()
+	readOnly: boolean().optional(),
+	/**
+	* Firmware text ceiling for this overlay. Absent = no known limit.
+	* The OSD manager truncates here on every write — never stores its own
+	* copy on the binding.
+	*/
+	maxCharacters: number().int().positive().optional()
 })).readonly() });
 var OsdOverlayPatchSchema = object({
 	enabled: boolean().optional(),
@@ -32006,7 +32075,9 @@ var OsdTemplateBindingSchema = object({
 	valuePath: string().min(1).max(64),
 	/** Convert TO this unit at render (`tryConvertUnit`). Absent = source unit. */
 	displayUnit: string().max(16).optional(),
-	maxDecimals: number().int().min(0).max(4).default(1)
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Raw value → display text (same shape as slot binding). Empty string hides. */
+	valueMap: record(string(), string()).optional()
 });
 /**
 * A named template: bindings (alias → leaf field) + a parser that
@@ -32056,18 +32127,11 @@ var OsdSlotBindingSchema = object({
 	source: OsdSourceSchema,
 	/** `${value}` and `${unit}` are substituted; every occurrence. */
 	template: string().max(96).default("${value}"),
-	/** Truncate with an ellipsis past this length. Absent = no limit. */
-	maxCharacters: number().int().min(4).max(64).optional(),
 	/**
 	* Decimal places for a numeric value. `0` yields an integer — the
 	* documented workaround for firmwares that reject `.` in overlay text.
 	*/
 	maxDecimals: number().int().min(0).max(4).default(1),
-	/**
-	* Appended via `${unit}` when no unit conversion produces a label.
-	* Prefer `source.displayUnit` for converted device-state values.
-	*/
-	unitLabel: string().max(8).optional(),
 	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
 	valueMap: record(string(), string()).optional(),
 	/** Time windows in which the slot is shown. Absent = always. */
@@ -32076,9 +32140,7 @@ var OsdSlotBindingSchema = object({
 	* Display gate, in the notification centre's condition vocabulary.
 	* Only the keys reported by `getConditionSupport` are accepted.
 	*/
-	conditions: NcConditionsSchema.optional(),
-	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
-	fallbackText: string().max(64).default("")
+	conditions: NcConditionsSchema.optional()
 });
 /** One camera slot, as the operator sees it: firmware truth + our binding. */
 var OsdSlotViewSchema = object({
@@ -47755,12 +47817,14 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 	{
 		id: "addons",
 		family: "system",
-		label: "Addons",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Addons stopped",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		id: "addon-updates",
+		family: "system",
+		label: "Addon updates",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		id: "updates",
@@ -47920,13 +47984,15 @@ var STATE_SUMMARY_SECTION_VARS = [
 	},
 	{
 		name: "summaryAddons",
-		label: "Summary: addons",
-		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
-		kinds: [
-			"addon-crash-loop",
-			"addon-update-available",
-			"addon-updated"
-		]
+		label: "Summary: addons stopped",
+		example: "hub — recorder stopped after repeated crashes",
+		kinds: ["addon-crash-loop"]
+	},
+	{
+		name: "summaryAddonUpdates",
+		label: "Summary: addon updates",
+		example: "hub:\n• @camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: ["addon-update-available", "addon-updated"]
 	},
 	{
 		name: "summaryUpdates",
@@ -48010,6 +48076,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -48050,6 +48117,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	...STATE_SUMMARY_VARS
 ];
 new Set([

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-Y4IbR-lV.js");
+const require_dist = require("../dist-CrTS14S8.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -134,7 +134,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "publicOrigin",
 					label: "Public origin",
-					description: "Where the email link points. Empty = read CAMSTACK_PUBLIC_ORIGIN env var.",
+					description: "Where the email link points. Empty = read CAMSTACK_HUB_PUBLIC_URL env var.",
 					default: ""
 				}),
 				this.field({
@@ -177,7 +177,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 	buildPublicOrigin() {
 		const configured = this.config.publicOrigin?.trim();
 		if (configured) return configured.replace(/\/+$/, "");
-		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+		return (process.env["CAMSTACK_HUB_PUBLIC_URL"] || "").replace(/\/+$/, "") || "https://localhost:4443";
 	}
 	async findUserByEmail(email) {
 		let users;

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-DoUGHO_G.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-UznM2RaH.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -129,7 +129,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 					type: "text",
 					key: "publicOrigin",
 					label: "Public origin",
-					description: "Where the email link points. Empty = read CAMSTACK_PUBLIC_ORIGIN env var.",
+					description: "Where the email link points. Empty = read CAMSTACK_HUB_PUBLIC_URL env var.",
 					default: ""
 				}),
 				this.field({
@@ -172,7 +172,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 	buildPublicOrigin() {
 		const configured = this.config.publicOrigin?.trim();
 		if (configured) return configured.replace(/\/+$/, "");
-		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+		return (process.env["CAMSTACK_HUB_PUBLIC_URL"] || "").replace(/\/+$/, "") || "https://localhost:4443";
 	}
 	async findUserByEmail(email) {
 		let users;