@camstack/addon-auth 1.2.130 → 1.2.132

package/dist/hub-browser-origin-DohQUFPz.js

@@ -0,0 +1,16 @@
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
+Object.defineProperty(exports, "hubBrowserOrigin", {
+	enumerable: true,
+	get: function() {
+		return hubBrowserOrigin;
+	}
+});

package/dist/hub-browser-origin-LBBO5r05.mjs

@@ -0,0 +1,11 @@
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
+export { hubBrowserOrigin as t };

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,42 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
+const require_dist = require("../dist-DjCeMP9o.js");
+const require_hub_browser_origin = require("../hub-browser-origin-DohQUFPz.js");
+//#region src/magic-link/retire-enabled-flag.ts
+/** The retired settings key. */
+var RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. */
+var RETIREMENT_MARKER_KEY = "enabledFlagRetired";
+function deferred(reason) {
+	return {
+		kind: "deferred",
+		reason
+	};
+}
+function isMarked(read) {
+	return read.kind === "present" && read.value === true;
+}
+async function retireEnabledFlag(deps) {
+	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
+	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
+	if (isMarked(marker)) return { kind: "already-retired" };
+	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
+	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
+	const wasOn = flag.kind === "present" && flag.value === true;
+	if (!wasOn) try {
+		await deps.disableAtCapability();
+	} catch (err) {
+		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	await deps.commit();
+	if (!isMarked(await deps.readStoredKey("enabledFlagRetired"))) return deferred("retirement write did not land");
+	return {
+		kind: "retired",
+		capDisabled: !wasOn
+	};
+}
+//#endregion
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -18,10 +53,10 @@ const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
 *   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
 *      → hub verifies the bridge token and mints the real session.
 *
-* Delivery is pluggable. This addon ships a "log-only" mode by default
-* (writes the URL to the addon log so operators can copy it during
-* setup before SMTP is configured). Production deployments configure
-* the SMTP relay via global settings.
+* Delivery is pluggable. This addon ships a "log-only" mode by default,
+* which records that a link was requested but never writes the link
+* itself (it is a login credential — D783). Production deployments
+* configure the SMTP relay via global settings.
 *
 * Open follow-ups:
 *   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
@@ -29,16 +64,30 @@ const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
 *   - Throttle requests per-email (rate-limit window).
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
+/** Capability whose per-provider toggle is magic-link's ONE enable (Identity → Authentication). */
+var GOVERNING_CAPABILITY = "auth-provider";
+/** Backoff between retirement attempts — the first ones are refused until the
+*  provider registration reaches the hub. After the last, the next boot retries. */
+var RETIREMENT_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
 var DEFAULT_CONFIG = {
-	enabled: false,
 	displayName: "Email magic link",
-	icon: "mail",
+	icon: "mailbox",
 	publicOrigin: "",
 	deliveryMode: "log-only",
 	defaultRole: "viewer",
 	ttlSec: 600
 };
-var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
+var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
+	enabledFlagRetired = false;
+	retirementTimer = null;
+	shuttingDown = false;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -53,7 +102,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routeProvider = require_hub_browser_origin.buildAddonRouteProvider("auth-magic-link", [
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -78,32 +127,88 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		this.shuttingDown = false;
+		this.attemptEnabledFlagRetirement(0);
 		return [
 			{
-				capability: require_hub_browser_origin.authProviderCapability,
+				capability: require_dist.authProviderCapability,
 				provider: authProvider
 			},
 			{
-				capability: require_hub_browser_origin.addonRoutesCapability,
+				capability: require_dist.addonRoutesCapability,
 				provider: routeProvider
 			},
 			{
-				capability: require_hub_browser_origin.loginMethodCapability,
+				capability: require_dist.loginMethodCapability,
 				provider: loginMethodProvider
 			}
 		];
 	}
 	buildLoginMethods() {
-		if (!this.config.enabled) return [];
+		if (!this.enabledFlagRetired) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
 			label: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: this.config.icon || DEFAULT_CONFIG.icon,
+			icon: require_dist.isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
 			startUrl: "/addon/auth-magic-link/start",
 			stage: "primary"
 		}];
 	}
+	async onShutdown() {
+		this.shuttingDown = true;
+		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
+		this.retirementTimer = null;
+	}
+	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
+	async attemptEnabledFlagRetirement(attempt) {
+		if (this.shuttingDown) return;
+		let outcome;
+		try {
+			outcome = await retireEnabledFlag({
+				readStoredKey: (key) => this.readStoredGlobalKey(key),
+				disableAtCapability: async () => {
+					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+						capName: GOVERNING_CAPABILITY,
+						addonId: this.ctx.id,
+						enabled: false
+					});
+				},
+				commit: async () => {
+					const patch = {
+						[RETIRED_ENABLED_KEY]: void 0,
+						[RETIREMENT_MARKER_KEY]: true
+					};
+					await this.updateGlobalSettings(patch);
+				}
+			});
+		} catch (err) {
+			outcome = {
+				kind: "deferred",
+				reason: require_dist.errMsg(err)
+			};
+		}
+		if (outcome.kind !== "deferred") {
+			this.enabledFlagRetired = true;
+			if (outcome.kind === "retired") this.ctx.logger.info(outcome.capDisabled ? "Magic-link: the retired `enabled` setting was off — the provider is now DISABLED on Identity → Authentication; enable it there to offer magic-link login." : "Magic-link: the retired `enabled` setting was on — the provider stays enabled on Identity → Authentication.");
+			return;
+		}
+		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
+		if (delay === void 0) {
+			this.ctx.logger.warn("Magic-link: carrying the retired `enabled` setting over to the capability toggle failed — login button withheld until the next boot", { meta: { reason: outcome.reason } });
+			return;
+		}
+		this.ctx.logger.debug("Magic-link: enabled-flag retirement deferred", { meta: {
+			reason: outcome.reason,
+			attempt,
+			retryInMs: delay
+		} });
+		this.retirementTimer = setTimeout(() => {
+			this.retirementTimer = null;
+			this.attemptEnabledFlagRetirement(attempt + 1);
+		}, delay);
+		this.retirementTimer.unref?.();
+	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "magic-link",
@@ -111,13 +216,6 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
-				this.field({
-					type: "boolean",
-					key: "enabled",
-					label: "Enabled",
-					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
-					default: DEFAULT_CONFIG.enabled
-				}),
 				this.field({
 					type: "text",
 					key: "displayName",
@@ -125,9 +223,10 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 					default: DEFAULT_CONFIG.displayName
 				}),
 				this.field({
-					type: "text",
+					type: "icon",
 					key: "icon",
 					label: "Icon",
+					description: "Shown on the login button.",
 					default: DEFAULT_CONFIG.icon
 				}),
 				this.field({
@@ -141,7 +240,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 					type: "select",
 					key: "deliveryMode",
 					label: "Delivery mode",
-					description: "log-only writes the URL to the addon log (setup only). smtp uses the configured SMTP relay.",
+					description: "log-only records the request in the addon log but never the link (it is a login credential). smtp uses the configured SMTP relay.",
 					default: DEFAULT_CONFIG.deliveryMode,
 					options: [{
 						value: "log-only",
@@ -184,7 +283,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		try {
 			users = await this.ctx.api.userManagement.listUsers.query();
 		} catch (err) {
-			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
+			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_dist.errMsg(err) } });
 			return null;
 		}
 		const needle = email.trim().toLowerCase();
@@ -228,7 +327,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
   <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
   <button id="b" type="submit">Send login link</button>
   <div class="msg" id="m" hidden></div>
-  <p style="margin-top:1rem"><a href="/admin/login">Back to sign in</a></p>
+  <p style="margin-top:1rem"><a href="/login">Back to sign in</a></p>
 </form>
 <script>
   var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');
@@ -273,20 +372,20 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
 				}));
 			} catch (err) {
-				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
+				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_dist.errMsg(err) } });
 				reply.code(503);
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
-			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
+			`${await this.buildPublicOrigin()}${encodeURIComponent(token)}`;
+			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated — not delivered (log-only mode, link withheld)", { meta: {
 				email,
-				link,
-				ttlSec: this.config.ttlSec
+				ttlSec: this.config.ttlSec,
+				delivered: false
 			} });
-			else this.ctx.logger.warn("Magic link delivery: SMTP mode requested but no smtp-provider cap registered. Falling back to log.", { meta: {
+			else this.ctx.logger.warn("Magic link not delivered: SMTP mode requested but no smtp-provider cap registered", { meta: {
 				email,
-				link
+				delivered: false
 			} });
 			reply.code(200);
 			reply.send(ok);
@@ -294,7 +393,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.code(500);
 			reply.send({
 				error: "Magic-link request failed",
-				message: require_hub_browser_origin.errMsg(err)
+				message: require_dist.errMsg(err)
 			});
 		}
 	}

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,39 @@
-import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability, l as BaseAddon, n as addonRoutesCapability, o as loginMethodCapability, t as hubBrowserOrigin } from "../hub-browser-origin-B1o5vmQX.mjs";
+import { a as isDisplayIconKey, c as errMsg, i as buildAddonRouteProvider, l as BaseAddon, o as loginMethodCapability, r as authProviderCapability, t as addonRoutesCapability } from "../dist-DbaYwR-N.mjs";
+import { t as hubBrowserOrigin } from "../hub-browser-origin-LBBO5r05.mjs";
+//#region src/magic-link/retire-enabled-flag.ts
+/** The retired settings key. */
+var RETIRED_ENABLED_KEY = "enabled";
+/** Store key marking the retirement as done. Not a schema field. */
+var RETIREMENT_MARKER_KEY = "enabledFlagRetired";
+function deferred(reason) {
+	return {
+		kind: "deferred",
+		reason
+	};
+}
+function isMarked(read) {
+	return read.kind === "present" && read.value === true;
+}
+async function retireEnabledFlag(deps) {
+	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
+	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
+	if (isMarked(marker)) return { kind: "already-retired" };
+	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
+	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
+	const wasOn = flag.kind === "present" && flag.value === true;
+	if (!wasOn) try {
+		await deps.disableAtCapability();
+	} catch (err) {
+		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	await deps.commit();
+	if (!isMarked(await deps.readStoredKey("enabledFlagRetired"))) return deferred("retirement write did not land");
+	return {
+		kind: "retired",
+		capDisabled: !wasOn
+	};
+}
+//#endregion
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -13,10 +48,10 @@ import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability,
 *   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
 *      → hub verifies the bridge token and mints the real session.
 *
-* Delivery is pluggable. This addon ships a "log-only" mode by default
-* (writes the URL to the addon log so operators can copy it during
-* setup before SMTP is configured). Production deployments configure
-* the SMTP relay via global settings.
+* Delivery is pluggable. This addon ships a "log-only" mode by default,
+* which records that a link was requested but never writes the link
+* itself (it is a login credential — D783). Production deployments
+* configure the SMTP relay via global settings.
 *
 * Open follow-ups:
 *   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
@@ -24,16 +59,30 @@ import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability,
 *   - Throttle requests per-email (rate-limit window).
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
+/** Capability whose per-provider toggle is magic-link's ONE enable (Identity → Authentication). */
+var GOVERNING_CAPABILITY = "auth-provider";
+/** Backoff between retirement attempts — the first ones are refused until the
+*  provider registration reaches the hub. After the last, the next boot retries. */
+var RETIREMENT_RETRY_DELAYS_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
 var DEFAULT_CONFIG = {
-	enabled: false,
 	displayName: "Email magic link",
-	icon: "mail",
+	icon: "mailbox",
 	publicOrigin: "",
 	deliveryMode: "log-only",
 	defaultRole: "viewer",
 	ttlSec: 600
 };
 var AuthMagicLinkAddon = class extends BaseAddon {
+	enabledFlagRetired = false;
+	retirementTimer = null;
+	shuttingDown = false;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -73,6 +122,8 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		this.shuttingDown = false;
+		this.attemptEnabledFlagRetirement(0);
 		return [
 			{
 				capability: authProviderCapability,
@@ -89,16 +140,70 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		];
 	}
 	buildLoginMethods() {
-		if (!this.config.enabled) return [];
+		if (!this.enabledFlagRetired) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
 			label: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: this.config.icon || DEFAULT_CONFIG.icon,
+			icon: isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
 			startUrl: "/addon/auth-magic-link/start",
 			stage: "primary"
 		}];
 	}
+	async onShutdown() {
+		this.shuttingDown = true;
+		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
+		this.retirementTimer = null;
+	}
+	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
+	async attemptEnabledFlagRetirement(attempt) {
+		if (this.shuttingDown) return;
+		let outcome;
+		try {
+			outcome = await retireEnabledFlag({
+				readStoredKey: (key) => this.readStoredGlobalKey(key),
+				disableAtCapability: async () => {
+					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+						capName: GOVERNING_CAPABILITY,
+						addonId: this.ctx.id,
+						enabled: false
+					});
+				},
+				commit: async () => {
+					const patch = {
+						[RETIRED_ENABLED_KEY]: void 0,
+						[RETIREMENT_MARKER_KEY]: true
+					};
+					await this.updateGlobalSettings(patch);
+				}
+			});
+		} catch (err) {
+			outcome = {
+				kind: "deferred",
+				reason: errMsg(err)
+			};
+		}
+		if (outcome.kind !== "deferred") {
+			this.enabledFlagRetired = true;
+			if (outcome.kind === "retired") this.ctx.logger.info(outcome.capDisabled ? "Magic-link: the retired `enabled` setting was off — the provider is now DISABLED on Identity → Authentication; enable it there to offer magic-link login." : "Magic-link: the retired `enabled` setting was on — the provider stays enabled on Identity → Authentication.");
+			return;
+		}
+		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
+		if (delay === void 0) {
+			this.ctx.logger.warn("Magic-link: carrying the retired `enabled` setting over to the capability toggle failed — login button withheld until the next boot", { meta: { reason: outcome.reason } });
+			return;
+		}
+		this.ctx.logger.debug("Magic-link: enabled-flag retirement deferred", { meta: {
+			reason: outcome.reason,
+			attempt,
+			retryInMs: delay
+		} });
+		this.retirementTimer = setTimeout(() => {
+			this.retirementTimer = null;
+			this.attemptEnabledFlagRetirement(attempt + 1);
+		}, delay);
+		this.retirementTimer.unref?.();
+	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "magic-link",
@@ -106,13 +211,6 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
-				this.field({
-					type: "boolean",
-					key: "enabled",
-					label: "Enabled",
-					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
-					default: DEFAULT_CONFIG.enabled
-				}),
 				this.field({
 					type: "text",
 					key: "displayName",
@@ -120,9 +218,10 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 					default: DEFAULT_CONFIG.displayName
 				}),
 				this.field({
-					type: "text",
+					type: "icon",
 					key: "icon",
 					label: "Icon",
+					description: "Shown on the login button.",
 					default: DEFAULT_CONFIG.icon
 				}),
 				this.field({
@@ -136,7 +235,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 					type: "select",
 					key: "deliveryMode",
 					label: "Delivery mode",
-					description: "log-only writes the URL to the addon log (setup only). smtp uses the configured SMTP relay.",
+					description: "log-only records the request in the addon log but never the link (it is a login credential). smtp uses the configured SMTP relay.",
 					default: DEFAULT_CONFIG.deliveryMode,
 					options: [{
 						value: "log-only",
@@ -223,7 +322,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
   <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
   <button id="b" type="submit">Send login link</button>
   <div class="msg" id="m" hidden></div>
-  <p style="margin-top:1rem"><a href="/admin/login">Back to sign in</a></p>
+  <p style="margin-top:1rem"><a href="/login">Back to sign in</a></p>
 </form>
 <script>
   var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');
@@ -273,15 +372,15 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
 			}
-			const link = `${await this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
-			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
+			`${await this.buildPublicOrigin()}${encodeURIComponent(token)}`;
+			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated — not delivered (log-only mode, link withheld)", { meta: {
 				email,
-				link,
-				ttlSec: this.config.ttlSec
+				ttlSec: this.config.ttlSec,
+				delivered: false
 			} });
-			else this.ctx.logger.warn("Magic link delivery: SMTP mode requested but no smtp-provider cap registered. Falling back to log.", { meta: {
+			else this.ctx.logger.warn("Magic link not delivered: SMTP mode requested but no smtp-provider cap registered", { meta: {
 				email,
-				link
+				delivered: false
 			} });
 			reply.code(200);
 			reply.send(ok);