@camstack/addon-auth 1.2.127 → 1.2.128

package/dist/{dist-CrTS14S8.js → hub-browser-origin-XYN-h9Iy.js}

@@ -10578,57 +10578,15 @@ var ClipSearchStrictnessSchema = _enum([
 	"balanced",
 	"strict"
 ]);
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
-/** Steps a root detector may declare it fills. */
-var FILLABLE_STEP_IDS = [
+/** Steps whose effect a root label can BE. */
+var LABEL_SUPPLY_STEP_IDS = [
 	"animal-classifier",
 	"vehicle-classifier",
 	"package-detection"
 ];
+/** Steps whose box a root detection can BE. */
+var CROP_SUPPLY_STEP_IDS = ["plate-detection", "face-detection"];
+[...LABEL_SUPPLY_STEP_IDS, ...CROP_SUPPLY_STEP_IDS];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10761,12 +10719,35 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 	/** True when the weights or their data forbid commercial use. */
 	nonCommercial: boolean().optional()
 }));
-/** One `fillsClassifierEffects` entry — see `ModelCatalogEntry.fillsClassifierEffects`. */
-var FillsClassifierEffectSchema = object({
-	stepId: _enum(FILLABLE_STEP_IDS),
+/**
+* One step a ROOT detector can supply from its own output (D730) — see
+* `ModelCatalogEntry.suppliesSteps`.
+*
+* - `label`: the root's raw class IS the step's answer. `labelToEffect` maps
+*   the root's label to the step's vocabulary; `uncovered` is the vocabulary
+*   the root cannot produce (shown as unavailable, never a blocker).
+* - `crop`: the root draws the box the step would have found (`license_plate`
+*   for plate-detection, `face` for face-detection). The box becomes a detail
+*   child of the `parentMacro` detection that contains it — never a track.
+*/
+var RootStepSupplySchema = discriminatedUnion("kind", [object({
+	kind: literal("label"),
+	stepId: _enum(LABEL_SUPPLY_STEP_IDS),
 	labelToEffect: record(string(), string()),
 	uncovered: array(string()).readonly()
-});
+}), object({
+	kind: literal("crop"),
+	stepId: _enum(CROP_SUPPLY_STEP_IDS),
+	rootLabels: array(string()).readonly(),
+	parentMacro: _enum(["vehicle", "person"]),
+	childClass: _enum(["plate", "face"]),
+	/**
+	* The root's smaller input side, stamped on read by `rootSuppliesOf` from
+	* the model entry — what a step's `minRootInputPx` gate judges. Never
+	* stored by an import.
+	*/
+	rootInputPx: number().int().positive().optional()
+})]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -10893,15 +10874,15 @@ var ModelCatalogEntrySchema = object({
 	*/
 	classMap: DetectionCatalogClassMapSchema.optional(),
 	/**
-	* The pipeline steps this ROOT detector already does the work of (D715):
-	* its labels name the effect the step exists to produce (`deer` for
-	* `animal-classifier`, `package` for `package-detection`). Derived from the
-	* labelmap by `deriveClassifierFills`, never hand-written; a COCO model
-	* declares none. Whether a declaration is honoured is the step's own
-	* `labelLink` policy (`resolveLabelLink`). `labelToEffect` values are in
-	* `FILLABLE_STEP_VOCABULARIES` (guard `check-label-link-vocabulary`).
+	* The pipeline steps this ROOT detector can supply from its own output
+	* (D730): its labels name a step's effect (`deer` for `animal-classifier`)
+	* or draw a step's box (`license_plate` for `plate-detection`). Computed at
+	* import from THIS model's labelmap by `deriveRootSupplies`, never written
+	* by hand and never assumed per family; a row without it is derived on read
+	* (`rootSuppliesOf`). Whether a camera uses it is the step's own
+	* `useRootModel` flag (`resolveRootSupply`).
 	*/
-	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional(),
+	suppliesSteps: array(RootStepSupplySchema).readonly().optional(),
 	/**
 	* The model's CLIP feature-space contract (text encoder, dimension, vector
 	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
@@ -17882,6 +17863,51 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	kind: "mutation",
 	auth: "admin"
 });
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -18639,6 +18665,8 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-restarting",
+	"node-updating",
 	"node-inference-unavailable",
 	"detection-blind",
 	"addon-crash-loop",
@@ -23156,6 +23184,34 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	timestamp: number()
 });
 /**
+* A root model's boxes standing in for one crop-kind step's own inference
+* (D730) — see `runPipeline.suppliedRoot`.
+*/
+var SuppliedRootOutputSchema = object({
+	stepId: string(),
+	/** The root model that drew the boxes — stamped on the result. */
+	modelId: string(),
+	detections: array(object({
+		/** `[x1, y1, x2, y2]` in the pixels of the call's image. */
+		bbox: tuple([
+			number(),
+			number(),
+			number(),
+			number()
+		]),
+		score: number(),
+		/**
+		* Five facial landmarks in the same pixels — a face the step's own
+		* detector already re-found inside a root face box (D730), so its
+		* embedder child aligns it exactly as it aligns any detected face.
+		*/
+		landmarks: array(object({
+			x: number(),
+			y: number()
+		})).optional()
+	})).min(1)
+});
+/**
 * Reference to the frame's retained NATIVE surface + the parent crop's placement
 * within the frame, so the executor can re-cut a leaf child ROI at native
 * resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
@@ -23286,7 +23342,7 @@ var PipelineModelOptionSchema = object({
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
 	defaultConfidence: number().optional(),
-	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional()
+	suppliesSteps: array(RootStepSupplySchema).readonly().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -23554,7 +23610,16 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	* `device-not-servable`), and nothing reaches the camera's live
 	* trace stream. Absent ⇒ unchanged behaviour.
 	*/
-	replay: literal(true).optional()
+	replay: literal(true).optional(),
+	/**
+	* Root-supplied detections for the tree's ROOT step (D730). Set by
+	* `runDetailSubtree` when the camera's root model supplies a crop-kind
+	* step (a Frigate+ `license_plate` for `plate-detection`): the step is
+	* NOT inferred, these boxes are its output, and its children (the plate
+	* reader) run on them through their own crop policy. Boxes are in the
+	* PIXELS of the image this call carries. Absent ⇒ the root step runs.
+	*/
+	suppliedRoot: SuppliedRootOutputSchema.optional()
 }), PipelineRunResultBridge, { kind: "mutation" }), method(object({
 	steps: array(PipelineStepInputSchema).min(1),
 	frames: array(FrameInputSchema).min(1).max(255),
@@ -24656,7 +24721,22 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 	*/
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
-	steps: array(string()).optional()
+	steps: array(string()).optional(),
+	/**
+	* The camera's root model already drew this step's boxes (D730): a
+	* `license_plate` inside the parent vehicle. The named step is NOT
+	* inferred — these FRAME-space boxes are its output — and its
+	* requested children (the plate reader) run on them. Absent ⇒ every
+	* requested step infers as before.
+	*/
+	supplied: object({
+		stepId: string(),
+		modelId: string(),
+		boxes: array(object({
+			bbox: NativeCropBboxSchema,
+			score: number()
+		})).min(1)
+	}).optional()
 }), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
 	/** Catalog step id, e.g. `clip-embedding`. */
 	stepId: string(),
@@ -30769,6 +30849,27 @@ var ViewerEndpointsSchema = object({
 	/** What the ranking currently resolves to (may be empty if nothing is up). */
 	resolved: array(string()).readonly()
 });
+/**
+* One audience's hub address (see `hub-address.ts`): the operator's stored
+* override, the address in use, and where it came from.
+*/
+var HubAddressSnapshotSchema = object({
+	/** The operator's override, or null for automatic. */
+	override: string().nullable(),
+	/** The address in use, or null when nothing qualifies (never loopback). */
+	resolved: string().nullable(),
+	source: _enum([
+		"override",
+		"auto",
+		"none"
+	])
+});
+var HubAddressesSchema = object({
+	/** "Hub address for agents" — agents' bundle/model pulls, LAN devices. */
+	cluster: HubAddressSnapshotSchema,
+	/** "Public address for sign-in links" — e-mail links, OIDC, WebAuthn, OAuth2. */
+	browser: HubAddressSnapshotSchema
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -30815,7 +30916,13 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  an address notification links can be flagged with, not a hub
 	*  route. Default `false`: racers and rankers never see it. */
 	includeAppLink: boolean().optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), HubAddressesSchema), method(object({
+	audience: _enum(["cluster", "browser"]),
+	baseUrl: string().nullable()
+}), HubAddressesSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -31205,7 +31312,8 @@ object({
 	*   writes this slice (not even a boot seed), and neither does the runner's
 	*   phase machine: its phase is "a session is attached" for every on-motion
 	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
-	*   A provider's `isDetected` answers from the hub's slice.
+	*   A provider's `isDetected` and `getStatus` answer from the hub's slice
+	*   (`hubMotionNativeProvider`).
 	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
 	*   imports) — the provider pushes both edges itself, from the upstream
 	*   system's own state change. That is the sensor's own fact.
@@ -39282,6 +39390,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getHubAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getNotificationEndpoint": {
 		capName: "local-network",
 		capScope: "system",
@@ -39336,6 +39450,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setHubAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setNotificationEndpoint": {
 		capName: "local-network",
 		capScope: "system",
@@ -47735,6 +47855,8 @@ new Map(Object.entries({
 	"detection-blind": "device-events",
 	"node-online": "system",
 	"node-offline": "system",
+	"node-restarting": "system",
+	"node-updating": "system",
 	"node-inference-unavailable": "system",
 	"addon-crash-loop": "system",
 	"addon-update-available": "system",
@@ -47812,6 +47934,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -47833,6 +47956,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Server & container updates",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -47980,6 +48104,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -48001,6 +48126,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		example: "server 1.2.377 → 1.2.378",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -48033,7 +48159,7 @@ var STATE_SUMMARY_VARS = [
 	{
 		name: "summarySection",
 		label: "Summary: this section",
-		description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
+		description: "The section a per-section summary row is about; on a summary sent as one message, every section it reports, comma-separated.",
 		example: "Batterie scariche",
 		group: "system",
 		families: ["rule"],
@@ -48640,6 +48766,16 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getHubAddresses.query()).browser.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
 Object.defineProperty(exports, "BaseAddon", {
 	enumerable: true,
 	get: function() {
@@ -48688,6 +48824,12 @@ Object.defineProperty(exports, "errMsg", {
 		return errMsg;
 	}
 });
+Object.defineProperty(exports, "hubBrowserOrigin", {
+	enumerable: true,
+	get: function() {
+		return hubBrowserOrigin;
+	}
+});
 Object.defineProperty(exports, "loginMethodCapability", {
 	enumerable: true,
 	get: function() {

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CrTS14S8.js");
+const require_hub_browser_origin = require("../hub-browser-origin-XYN-h9Iy.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -38,7 +38,7 @@ var DEFAULT_CONFIG = {
 	defaultRole: "viewer",
 	ttlSec: 600
 };
-var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
+var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -53,7 +53,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
+		const routeProvider = require_hub_browser_origin.buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -80,15 +80,15 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
 		return [
 			{
-				capability: require_dist.authProviderCapability,
+				capability: require_hub_browser_origin.authProviderCapability,
 				provider: authProvider
 			},
 			{
-				capability: require_dist.addonRoutesCapability,
+				capability: require_hub_browser_origin.addonRoutesCapability,
 				provider: routeProvider
 			},
 			{
-				capability: require_dist.loginMethodCapability,
+				capability: require_hub_browser_origin.loginMethodCapability,
 				provider: loginMethodProvider
 			}
 		];
@@ -134,7 +134,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "publicOrigin",
 					label: "Public origin",
-					description: "Where the email link points. Empty = read CAMSTACK_HUB_PUBLIC_URL env var.",
+					description: "Where the email link points. Empty = the hub address from Network (public tunnel, then mesh, then LAN).",
 					default: ""
 				}),
 				this.field({
@@ -174,17 +174,17 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			]
 		}] });
 	}
-	buildPublicOrigin() {
+	async buildPublicOrigin() {
 		const configured = this.config.publicOrigin?.trim();
 		if (configured) return configured.replace(/\/+$/, "");
-		return (process.env["CAMSTACK_HUB_PUBLIC_URL"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+		return await require_hub_browser_origin.hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443";
 	}
 	async findUserByEmail(email) {
 		let users;
 		try {
 			users = await this.ctx.api.userManagement.listUsers.query();
 		} catch (err) {
-			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_dist.errMsg(err) } });
+			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
 			return null;
 		}
 		const needle = email.trim().toLowerCase();
@@ -273,12 +273,12 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
 				}));
 			} catch (err) {
-				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_dist.errMsg(err) } });
+				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
 				reply.code(503);
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
+			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
 			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
 				email,
 				link,
@@ -294,7 +294,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			reply.code(500);
 			reply.send({
 				error: "Magic-link request failed",
-				message: require_dist.errMsg(err)
+				message: require_hub_browser_origin.errMsg(err)
 			});
 		}
 	}

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-UznM2RaH.mjs";
+import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability, l as BaseAddon, n as addonRoutesCapability, o as loginMethodCapability, t as hubBrowserOrigin } from "../hub-browser-origin-DmRqQVDn.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -129,7 +129,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 					type: "text",
 					key: "publicOrigin",
 					label: "Public origin",
-					description: "Where the email link points. Empty = read CAMSTACK_HUB_PUBLIC_URL env var.",
+					description: "Where the email link points. Empty = the hub address from Network (public tunnel, then mesh, then LAN).",
 					default: ""
 				}),
 				this.field({
@@ -169,10 +169,10 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 			]
 		}] });
 	}
-	buildPublicOrigin() {
+	async buildPublicOrigin() {
 		const configured = this.config.publicOrigin?.trim();
 		if (configured) return configured.replace(/\/+$/, "");
-		return (process.env["CAMSTACK_HUB_PUBLIC_URL"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+		return await hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443";
 	}
 	async findUserByEmail(email) {
 		let users;
@@ -273,7 +273,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
+			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
 			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
 				email,
 				link,