@camstack/addon-auth 1.2.127 → 1.2.129

package/dist/{dist-UznM2RaH.mjs → hub-browser-origin-lAiHaCMe.mjs}

@@ -5378,7 +5378,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DXKLNFvA.mjs
+//#region ../types/dist/sleep-C16NCZR2.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -10577,57 +10577,15 @@ var ClipSearchStrictnessSchema = _enum([
 	"balanced",
 	"strict"
 ]);
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
-/** Steps a root detector may declare it fills. */
-var FILLABLE_STEP_IDS = [
+/** Steps whose effect a root label can BE. */
+var LABEL_SUPPLY_STEP_IDS = [
 	"animal-classifier",
 	"vehicle-classifier",
 	"package-detection"
 ];
+/** Steps whose box a root detection can BE. */
+var CROP_SUPPLY_STEP_IDS = ["plate-detection", "face-detection"];
+[...LABEL_SUPPLY_STEP_IDS, ...CROP_SUPPLY_STEP_IDS];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10760,12 +10718,35 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 	/** True when the weights or their data forbid commercial use. */
 	nonCommercial: boolean().optional()
 }));
-/** One `fillsClassifierEffects` entry — see `ModelCatalogEntry.fillsClassifierEffects`. */
-var FillsClassifierEffectSchema = object({
-	stepId: _enum(FILLABLE_STEP_IDS),
+/**
+* One step a ROOT detector can supply from its own output (D730) — see
+* `ModelCatalogEntry.suppliesSteps`.
+*
+* - `label`: the root's raw class IS the step's answer. `labelToEffect` maps
+*   the root's label to the step's vocabulary; `uncovered` is the vocabulary
+*   the root cannot produce (shown as unavailable, never a blocker).
+* - `crop`: the root draws the box the step would have found (`license_plate`
+*   for plate-detection, `face` for face-detection). The box becomes a detail
+*   child of the `parentMacro` detection that contains it — never a track.
+*/
+var RootStepSupplySchema = discriminatedUnion("kind", [object({
+	kind: literal("label"),
+	stepId: _enum(LABEL_SUPPLY_STEP_IDS),
 	labelToEffect: record(string(), string()),
 	uncovered: array(string()).readonly()
-});
+}), object({
+	kind: literal("crop"),
+	stepId: _enum(CROP_SUPPLY_STEP_IDS),
+	rootLabels: array(string()).readonly(),
+	parentMacro: _enum(["vehicle", "person"]),
+	childClass: _enum(["plate", "face"]),
+	/**
+	* The root's smaller input side, stamped on read by `rootSuppliesOf` from
+	* the model entry — what a step's `minRootInputPx` gate judges. Never
+	* stored by an import.
+	*/
+	rootInputPx: number().int().positive().optional()
+})]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -10892,15 +10873,15 @@ var ModelCatalogEntrySchema = object({
 	*/
 	classMap: DetectionCatalogClassMapSchema.optional(),
 	/**
-	* The pipeline steps this ROOT detector already does the work of (D715):
-	* its labels name the effect the step exists to produce (`deer` for
-	* `animal-classifier`, `package` for `package-detection`). Derived from the
-	* labelmap by `deriveClassifierFills`, never hand-written; a COCO model
-	* declares none. Whether a declaration is honoured is the step's own
-	* `labelLink` policy (`resolveLabelLink`). `labelToEffect` values are in
-	* `FILLABLE_STEP_VOCABULARIES` (guard `check-label-link-vocabulary`).
+	* The pipeline steps this ROOT detector can supply from its own output
+	* (D730): its labels name a step's effect (`deer` for `animal-classifier`)
+	* or draw a step's box (`license_plate` for `plate-detection`). Computed at
+	* import from THIS model's labelmap by `deriveRootSupplies`, never written
+	* by hand and never assumed per family; a row without it is derived on read
+	* (`rootSuppliesOf`). Whether a camera uses it is the step's own
+	* `useRootModel` flag (`resolveRootSupply`).
 	*/
-	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional(),
+	suppliesSteps: array(RootStepSupplySchema).readonly().optional(),
 	/**
 	* The model's CLIP feature-space contract (text encoder, dimension, vector
 	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
@@ -17881,6 +17862,51 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	kind: "mutation",
 	auth: "admin"
 });
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -18638,6 +18664,8 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-restarting",
+	"node-updating",
 	"node-inference-unavailable",
 	"detection-blind",
 	"addon-crash-loop",
@@ -23155,6 +23183,34 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	timestamp: number()
 });
 /**
+* A root model's boxes standing in for one crop-kind step's own inference
+* (D730) — see `runPipeline.suppliedRoot`.
+*/
+var SuppliedRootOutputSchema = object({
+	stepId: string(),
+	/** The root model that drew the boxes — stamped on the result. */
+	modelId: string(),
+	detections: array(object({
+		/** `[x1, y1, x2, y2]` in the pixels of the call's image. */
+		bbox: tuple([
+			number(),
+			number(),
+			number(),
+			number()
+		]),
+		score: number(),
+		/**
+		* Five facial landmarks in the same pixels — a face the step's own
+		* detector already re-found inside a root face box (D730), so its
+		* embedder child aligns it exactly as it aligns any detected face.
+		*/
+		landmarks: array(object({
+			x: number(),
+			y: number()
+		})).optional()
+	})).min(1)
+});
+/**
 * Reference to the frame's retained NATIVE surface + the parent crop's placement
 * within the frame, so the executor can re-cut a leaf child ROI at native
 * resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
@@ -23285,7 +23341,7 @@ var PipelineModelOptionSchema = object({
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
 	defaultConfidence: number().optional(),
-	fillsClassifierEffects: array(FillsClassifierEffectSchema).readonly().optional()
+	suppliesSteps: array(RootStepSupplySchema).readonly().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -23553,7 +23609,16 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	* `device-not-servable`), and nothing reaches the camera's live
 	* trace stream. Absent ⇒ unchanged behaviour.
 	*/
-	replay: literal(true).optional()
+	replay: literal(true).optional(),
+	/**
+	* Root-supplied detections for the tree's ROOT step (D730). Set by
+	* `runDetailSubtree` when the camera's root model supplies a crop-kind
+	* step (a Frigate+ `license_plate` for `plate-detection`): the step is
+	* NOT inferred, these boxes are its output, and its children (the plate
+	* reader) run on them through their own crop policy. Boxes are in the
+	* PIXELS of the image this call carries. Absent ⇒ the root step runs.
+	*/
+	suppliedRoot: SuppliedRootOutputSchema.optional()
 }), PipelineRunResultBridge, { kind: "mutation" }), method(object({
 	steps: array(PipelineStepInputSchema).min(1),
 	frames: array(FrameInputSchema).min(1).max(255),
@@ -24655,7 +24720,22 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 	*/
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
-	steps: array(string()).optional()
+	steps: array(string()).optional(),
+	/**
+	* The camera's root model already drew this step's boxes (D730): a
+	* `license_plate` inside the parent vehicle. The named step is NOT
+	* inferred — these FRAME-space boxes are its output — and its
+	* requested children (the plate reader) run on them. Absent ⇒ every
+	* requested step infers as before.
+	*/
+	supplied: object({
+		stepId: string(),
+		modelId: string(),
+		boxes: array(object({
+			bbox: NativeCropBboxSchema,
+			score: number()
+		})).min(1)
+	}).optional()
 }), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
 	/** Catalog step id, e.g. `clip-embedding`. */
 	stepId: string(),
@@ -27991,6 +28071,14 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	*/
 	alive: boolean()
 })), method(object({
+	deviceId: number().int().nonnegative(),
+	sessionId: string(),
+	downlinkMbps: number().nonnegative()
+}), object({
+	outcome: _enum(["switching", "held"]),
+	tier: CamProfileSchema.nullable(),
+	reason: string()
+}), { kind: "mutation" }), method(object({
 	deviceId: number().int().nonnegative(),
 	sessionId: string()
 }), WebrtcSessionDebugSchema, { kind: "query" });
@@ -30666,7 +30754,8 @@ var ConnectionEndpointSchema = object({
 		"lan-ipv6",
 		"public",
 		"loopback",
-		"app-link"
+		"app-link",
+		"custom"
 	]),
 	/**
 	* Originating-interface kind — `lan`/`wifi`/`docker`/`vpn`/`other`/
@@ -30768,6 +30857,76 @@ var ViewerEndpointsSchema = object({
 	/** What the ranking currently resolves to (may be empty if nothing is up). */
 	resolved: array(string()).readonly()
 });
+/**
+* DEPRECATED compatibility shape of `getHubAddresses` (D729 amendment, kept
+* one release for addons built against it): `cluster` is the `agents` role,
+* `browser` the `signIn` role; `override` is the flagged address.
+*/
+var HubAddressSnapshotSchema = object({
+	override: string().nullable(),
+	resolved: string().nullable(),
+	source: _enum([
+		"override",
+		"auto",
+		"none"
+	])
+});
+var HubAddressesSchema = object({
+	cluster: HubAddressSnapshotSchema,
+	browser: HubAddressSnapshotSchema
+});
+/**
+* What an address is used for (`hub-address.ts`). `viewer` is many-valued;
+* `notifications`, `agents` and `signIn` are carried by at most one address.
+*/
+var HubAddressRoleSchema = _enum([
+	"viewer",
+	"notifications",
+	"agents",
+	"signIn"
+]);
+var RoleSourceSchema = _enum([
+	"flagged",
+	"auto",
+	"none"
+]);
+/** One single-valued role: the flagged address, the one in use, and why. */
+var HubAddressRoleResolutionSchema = object({
+	/** The address carrying the flag, or null = automatic. */
+	flagged: string().nullable(),
+	/** The address in use, or null when nothing qualifies (never loopback). */
+	resolved: string().nullable(),
+	source: RoleSourceSchema
+});
+var HubViewerResolutionSchema = object({
+	/** The addresses flagged `viewer`, or empty = automatic. */
+	flagged: array(string()).readonly(),
+	/** What the apps race right now. */
+	resolved: array(string()).readonly(),
+	source: RoleSourceSchema
+});
+var HubAddressBookSchema = object({
+	rows: array(ConnectionEndpointSchema.extend({
+		/** In the hub's detected palette right now. */
+		detected: boolean(),
+		/** Entered by the operator (removable). */
+		custom: boolean(),
+		/** The roles explicitly flagged on this address. */
+		flags: array(HubAddressRoleSchema).readonly(),
+		/** The roles this address serves right now — flagged or automatic. */
+		inUse: array(HubAddressRoleSchema).readonly(),
+		/** The roles this address may be flagged with. */
+		eligible: array(HubAddressRoleSchema).readonly()
+	})).readonly(),
+	roles: object({
+		viewer: HubViewerResolutionSchema,
+		notifications: HubAddressRoleResolutionSchema,
+		agents: HubAddressRoleResolutionSchema,
+		signIn: HubAddressRoleResolutionSchema
+	}),
+	/** The `hub=` an app link carries (D709), or null. */
+	appLinkHub: string().nullable()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -30814,7 +30973,24 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*  an address notification links can be flagged with, not a hub
 	*  route. Default `false`: racers and rankers never see it. */
 	includeAppLink: boolean().optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(object({ scheme: _enum(["http", "https"]).optional() }).optional(), HubAddressBookSchema), method(object({
+	baseUrl: string(),
+	label: string().max(80)
+}), HubAddressBookSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ baseUrl: string() }), HubAddressBookSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	role: HubAddressRoleSchema,
+	baseUrl: string().nullable(),
+	enabled: boolean(),
+	acceptInsecureHttp: boolean().optional()
+}), HubAddressBookSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), HubAddressesSchema), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -31204,7 +31380,8 @@ object({
 	*   writes this slice (not even a boot seed), and neither does the runner's
 	*   phase machine: its phase is "a session is attached" for every on-motion
 	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
-	*   A provider's `isDetected` answers from the hub's slice.
+	*   A provider's `isDetected` and `getStatus` answer from the hub's slice
+	*   (`hubMotionNativeProvider`).
 	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
 	*   imports) — the provider pushes both edges itself, from the upstream
 	*   system's own state change. That is the sensor's own fact.
@@ -39263,12 +39440,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.addCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -39281,6 +39470,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getHubAddresses": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getNotificationEndpoint": {
 		capName: "local-network",
 		capScope: "system",
@@ -39317,6 +39512,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.removeCustomAddress": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
@@ -39329,6 +39530,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setAddressRole": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -43583,6 +43790,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"webrtcSession.applyDownlinkProbe": {
+		capName: "webrtc-session",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"webrtcSession.closeSession": {
 		capName: "webrtc-session",
 		capScope: "device",
@@ -47505,6 +47718,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"webrtcSession.applyDownlinkProbe": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.closeSession": [{
 		name: "deviceId",
 		form: "single",
@@ -47734,6 +47952,8 @@ new Map(Object.entries({
 	"detection-blind": "device-events",
 	"node-online": "system",
 	"node-offline": "system",
+	"node-restarting": "system",
+	"node-updating": "system",
 	"node-inference-unavailable": "system",
 	"addon-crash-loop": "system",
 	"addon-update-available": "system",
@@ -47811,6 +48031,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -47832,6 +48053,7 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 		label: "Server & container updates",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -47979,6 +48201,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		kinds: [
 			"node-offline",
 			"node-online",
+			"node-restarting",
 			"node-inference-unavailable"
 		]
 	},
@@ -48000,6 +48223,7 @@ var STATE_SUMMARY_SECTION_VARS = [
 		example: "server 1.2.377 → 1.2.378",
 		kinds: [
 			"server-update-available",
+			"node-updating",
 			"server-updated",
 			"wrapper-update-available"
 		]
@@ -48032,7 +48256,7 @@ var STATE_SUMMARY_VARS = [
 	{
 		name: "summarySection",
 		label: "Summary: this section",
-		description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
+		description: "The section a per-section summary row is about; on a summary sent as one message, every section it reports, comma-separated.",
 		example: "Batterie scariche",
 		group: "system",
 		families: ["rule"],
@@ -48639,4 +48863,14 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { loginMethodCapability as a, BaseAddon as c, number as d, object as f, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, string as p, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, boolean as u };
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getAddresses.query()).roles.signIn.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
+export { buildAddonRouteProvider as a, errMsg as c, boolean as d, number as f, authProviderCapability as i, BaseAddon as l, string as m, addonRoutesCapability as n, loginMethodCapability as o, object as p, addonWidgetsSourceCapability as r, userPasskeysCapability as s, hubBrowserOrigin as t, array as u };

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CrTS14S8.js");
+const require_hub_browser_origin = require("../hub-browser-origin-Cd5W-H0b.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -38,7 +38,7 @@ var DEFAULT_CONFIG = {
 	defaultRole: "viewer",
 	ttlSec: 600
 };
-var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
+var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -53,7 +53,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
+		const routeProvider = require_hub_browser_origin.buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -80,15 +80,15 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
 		return [
 			{
-				capability: require_dist.authProviderCapability,
+				capability: require_hub_browser_origin.authProviderCapability,
 				provider: authProvider
 			},
 			{
-				capability: require_dist.addonRoutesCapability,
+				capability: require_hub_browser_origin.addonRoutesCapability,
 				provider: routeProvider
 			},
 			{
-				capability: require_dist.loginMethodCapability,
+				capability: require_hub_browser_origin.loginMethodCapability,
 				provider: loginMethodProvider
 			}
 		];
@@ -134,7 +134,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "publicOrigin",
 					label: "Public origin",
-					description: "Where the email link points. Empty = read CAMSTACK_HUB_PUBLIC_URL env var.",
+					description: "Where the email link points. Empty = the hub address from Network (public tunnel, then mesh, then LAN).",
 					default: ""
 				}),
 				this.field({
@@ -174,17 +174,17 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			]
 		}] });
 	}
-	buildPublicOrigin() {
+	async buildPublicOrigin() {
 		const configured = this.config.publicOrigin?.trim();
 		if (configured) return configured.replace(/\/+$/, "");
-		return (process.env["CAMSTACK_HUB_PUBLIC_URL"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+		return await require_hub_browser_origin.hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443";
 	}
 	async findUserByEmail(email) {
 		let users;
 		try {
 			users = await this.ctx.api.userManagement.listUsers.query();
 		} catch (err) {
-			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_dist.errMsg(err) } });
+			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
 			return null;
 		}
 		const needle = email.trim().toLowerCase();
@@ -273,12 +273,12 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
 				}));
 			} catch (err) {
-				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_dist.errMsg(err) } });
+				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
 				reply.code(503);
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
+			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
 			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
 				email,
 				link,
@@ -294,7 +294,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			reply.code(500);
 			reply.send({
 				error: "Magic-link request failed",
-				message: require_dist.errMsg(err)
+				message: require_hub_browser_origin.errMsg(err)
 			});
 		}
 	}