@camstack/addon-auth 1.2.134 → 1.2.136

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,5 +1,4 @@
-import { d as boolean, f as number, l as BaseAddon, m as string, n as addonWidgetsSourceCapability, o as loginMethodCapability, p as object, s as userPasskeysCapability, u as array } from "../dist-aH7jUuvS.mjs";
-import { t as hubBrowserOrigin } from "../hub-browser-origin-LBBO5r05.mjs";
+import { c as userPasskeysCapability, d as array, f as boolean, h as string, m as object, p as number, r as addonWidgetsSourceCapability, s as loginMethodCapability, u as BaseAddon } from "../dist-DMFGQOff.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";
@@ -12134,6 +12133,16 @@ async function verifyAuthenticationResponse(options) {
 * @module @simplewebauthn/server
 */
 //#endregion
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
 //#region src/webauthn/passkey-store.ts
 /**
 * Persistence layer for passkeys (credentials). One row per

package/dist/webauthn/{hostInit-BqtiJT2W.mjs → hostInit-MuJOFBLm.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.332",
+				version: "1.2.336",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.127",
+				version: "1.2.128",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.253",
+				version: "1.2.257",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-C_bpdIIi.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-BSmYiv_-.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.134",
-  "description": "Authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
+  "version": "1.2.136",
+  "description": "Authentication bundle — OIDC and WebAuthn/passkey. Multi-entry npm package shipping 2 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",
     "addon",
     "camstack-addon",
     "auth",
-    "magic-link",
     "oidc",
     "sso",
     "webauthn",
@@ -18,12 +17,8 @@
     "type": "git",
     "url": "https://github.com/camstack/server"
   },
-  "main": "./dist/magic-link/auth-magic-link.addon.js",
+  "main": "./dist/oidc/auth-oidc.addon.js",
   "exports": {
-    "./magic-link": {
-      "import": "./dist/magic-link/auth-magic-link.addon.mjs",
-      "require": "./dist/magic-link/auth-magic-link.addon.js"
-    },
     "./oidc": {
       "import": "./dist/oidc/auth-oidc.addon.mjs",
       "require": "./dist/oidc/auth-oidc.addon.js"
@@ -42,32 +37,9 @@
     "displayName": "Authentication",
     "bundle": {
       "displayName": "Authentication",
-      "description": "Magic-link, OIDC SSO, and WebAuthn/passkey login providers."
+      "description": "OIDC SSO and WebAuthn/passkey login providers."
     },
     "addons": [
-      {
-        "id": "auth-magic-link",
-        "execution": {
-          "group": "auth"
-        },
-        "category": "system",
-        "name": "Magic Link",
-        "icon": "assets/magic-link/icon.svg",
-        "description": "Passwordless email login. Sends a one-time link to the user's email; clicking it logs them in. SMTP delivery is configured per-deployment.",
-        "entry": "./dist/magic-link/auth-magic-link.addon.js",
-        "capabilities": [
-          {
-            "name": "auth-provider"
-          },
-          {
-            "name": "addon-routes"
-          },
-          {
-            "name": "login-method"
-          }
-        ],
-        "protected": true
-      },
       {
         "id": "auth-oidc",
         "execution": {

package/assets/magic-link/icon.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#e11d48" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-  <path d="M15 4V2M15 16v-2M8 9h2M20 9h2M17.8 11.8 19 13M17.8 6.2 19 5M12.2 6.2 11 5"/>
-  <path d="m3 21 9-9"/>
-  <path d="M15 9h.01"/>
-</svg>

package/dist/chunk-Cek0wNdY.js

@@ -1,64 +0,0 @@
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-//#endregion
-Object.defineProperty(exports, "__commonJSMin", {
-	enumerable: true,
-	get: function() {
-		return __commonJSMin;
-	}
-});
-Object.defineProperty(exports, "__esmMin", {
-	enumerable: true,
-	get: function() {
-		return __esmMin;
-	}
-});
-Object.defineProperty(exports, "__exportAll", {
-	enumerable: true,
-	get: function() {
-		return __exportAll;
-	}
-});
-Object.defineProperty(exports, "__toCommonJS", {
-	enumerable: true,
-	get: function() {
-		return __toCommonJS;
-	}
-});
-Object.defineProperty(exports, "__toESM", {
-	enumerable: true,
-	get: function() {
-		return __toESM;
-	}
-});

package/dist/hub-browser-origin-DohQUFPz.js

@@ -1,16 +0,0 @@
-//#region src/hub-browser-origin.ts
-async function hubBrowserOrigin(localNetwork, logger) {
-	try {
-		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
-	} catch (err) {
-		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		return null;
-	}
-}
-//#endregion
-Object.defineProperty(exports, "hubBrowserOrigin", {
-	enumerable: true,
-	get: function() {
-		return hubBrowserOrigin;
-	}
-});

package/dist/hub-browser-origin-LBBO5r05.mjs

@@ -1,11 +0,0 @@
-//#region src/hub-browser-origin.ts
-async function hubBrowserOrigin(localNetwork, logger) {
-	try {
-		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
-	} catch (err) {
-		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		return null;
-	}
-}
-//#endregion
-export { hubBrowserOrigin as t };

package/dist/magic-link/auth-magic-link.addon.js

@@ -1,418 +0,0 @@
-Object.defineProperties(exports, {
-	__esModule: { value: true },
-	[Symbol.toStringTag]: { value: "Module" }
-});
-require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-D5CZYR3c.js");
-const require_hub_browser_origin = require("../hub-browser-origin-DohQUFPz.js");
-//#region src/magic-link/retire-enabled-flag.ts
-/** The retired settings key. */
-var RETIRED_ENABLED_KEY = "enabled";
-/** Store key marking the retirement as done. Not a schema field. */
-var RETIREMENT_MARKER_KEY = "enabledFlagRetired";
-function deferred(reason) {
-	return {
-		kind: "deferred",
-		reason
-	};
-}
-function isMarked(read) {
-	return read.kind === "present" && read.value === true;
-}
-async function retireEnabledFlag(deps) {
-	const marker = await deps.readStoredKey(RETIREMENT_MARKER_KEY);
-	if (marker.kind === "unreadable") return deferred("settings store unreadable (marker)");
-	if (isMarked(marker)) return { kind: "already-retired" };
-	const flag = await deps.readStoredKey(RETIRED_ENABLED_KEY);
-	if (flag.kind === "unreadable") return deferred("settings store unreadable (enabled)");
-	const wasOn = flag.kind === "present" && flag.value === true;
-	if (!wasOn) try {
-		await deps.disableAtCapability();
-	} catch (err) {
-		return deferred(`capability toggle refused: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	await deps.commit();
-	if (!isMarked(await deps.readStoredKey("enabledFlagRetired"))) return deferred("retirement write did not land");
-	return {
-		kind: "retired",
-		capDisabled: !wasOn
-	};
-}
-//#endregion
-//#region src/magic-link/auth-magic-link.addon.ts
-/**
-* Magic-link authentication addon.
-*
-* Passwordless flow:
-*   1. Operator types their email on the login page → clicks "Send link".
-*   2. The addon's `/request` route accepts the email, looks up the user
-*      via `user-management.listUsers()`, mints a short-lived HMAC bridge
-*      token (via `sso-bridge` cap), and delivers a URL of the form
-*      `https://<hub>/addon/auth-magic-link/login?bridge=<token>` to the
-*      user's email.
-*   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
-*      → hub verifies the bridge token and mints the real session.
-*
-* Delivery is pluggable. This addon ships a "log-only" mode by default,
-* which records that a link was requested but never writes the link
-* itself (it is a login credential — D783). Production deployments
-* configure the SMTP relay via global settings.
-*
-* Open follow-ups:
-*   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
-*     declares `smtpProvider` cap if/when we ship an SMTP addon).
-*   - Throttle requests per-email (rate-limit window).
-*   - Auto-provision unknown emails (currently rejected for safety).
-*/
-/** Capability whose per-provider toggle is magic-link's ONE enable (Identity → Authentication). */
-var GOVERNING_CAPABILITY = "auth-provider";
-/** Backoff between retirement attempts — the first ones are refused until the
-*  provider registration reaches the hub. After the last, the next boot retries. */
-var RETIREMENT_RETRY_DELAYS_MS = [
-	1e3,
-	2e3,
-	5e3,
-	1e4,
-	3e4,
-	6e4
-];
-var DEFAULT_CONFIG = {
-	displayName: "Email magic link",
-	icon: "mailbox",
-	publicOrigin: "",
-	deliveryMode: "log-only",
-	defaultRole: "viewer",
-	ttlSec: 600
-};
-var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
-	enabledFlagRetired = false;
-	retirementTimer = null;
-	shuttingDown = false;
-	constructor() {
-		super({ ...DEFAULT_CONFIG });
-	}
-	async onInitialize() {
-		const authProvider = {
-			validateCredentials: async () => null,
-			validateToken: async () => null,
-			getLoginUrl: async () => {
-				throw new Error("Magic link does not support direct getLoginUrl — POST email to /addon/auth-magic-link/request");
-			},
-			handleCallback: async () => {
-				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
-			}
-		};
-		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
-			{
-				method: "GET",
-				path: "/start",
-				access: "public",
-				description: "Login-page landing: email-entry form that POSTs to /request",
-				handler: async (req, reply) => this.handleStart(req, reply)
-			},
-			{
-				method: "POST",
-				path: "/request",
-				access: "public",
-				description: "Request a magic link be delivered to the given email",
-				handler: async (req, reply) => this.handleRequest(req, reply)
-			},
-			{
-				method: "GET",
-				path: "/login",
-				access: "public",
-				description: "Click target embedded in the magic-link email",
-				handler: async (req, reply) => this.handleLogin(req, reply)
-			}
-		]);
-		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
-		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
-		this.shuttingDown = false;
-		this.attemptEnabledFlagRetirement(0);
-		return [
-			{
-				capability: require_dist.authProviderCapability,
-				provider: authProvider
-			},
-			{
-				capability: require_dist.addonRoutesCapability,
-				provider: routeProvider
-			},
-			{
-				capability: require_dist.loginMethodCapability,
-				provider: loginMethodProvider
-			}
-		];
-	}
-	buildLoginMethods() {
-		if (!this.enabledFlagRetired) return [];
-		return [{
-			kind: "redirect",
-			id: "auth-magic-link",
-			label: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: require_dist.isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
-			startUrl: "/addon/auth-magic-link/start",
-			stage: "primary"
-		}];
-	}
-	async onShutdown() {
-		this.shuttingDown = true;
-		if (this.retirementTimer !== null) clearTimeout(this.retirementTimer);
-		this.retirementTimer = null;
-	}
-	/** One attempt of the D777 carry-over; reschedules itself while deferred. */
-	async attemptEnabledFlagRetirement(attempt) {
-		if (this.shuttingDown) return;
-		let outcome;
-		try {
-			outcome = await retireEnabledFlag({
-				readStoredKey: (key) => this.readStoredGlobalKey(key),
-				disableAtCapability: async () => {
-					await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
-						capName: GOVERNING_CAPABILITY,
-						addonId: this.ctx.id,
-						enabled: false
-					});
-				},
-				commit: async () => {
-					const patch = {
-						[RETIRED_ENABLED_KEY]: void 0,
-						[RETIREMENT_MARKER_KEY]: true
-					};
-					await this.updateGlobalSettings(patch);
-				}
-			});
-		} catch (err) {
-			outcome = {
-				kind: "deferred",
-				reason: require_dist.errMsg(err)
-			};
-		}
-		if (outcome.kind !== "deferred") {
-			this.enabledFlagRetired = true;
-			if (outcome.kind === "retired") this.ctx.logger.info(outcome.capDisabled ? "Magic-link: the retired `enabled` setting was off — the provider is now DISABLED on Identity → Authentication; enable it there to offer magic-link login." : "Magic-link: the retired `enabled` setting was on — the provider stays enabled on Identity → Authentication.");
-			return;
-		}
-		const delay = RETIREMENT_RETRY_DELAYS_MS[attempt];
-		if (delay === void 0) {
-			this.ctx.logger.warn("Magic-link: carrying the retired `enabled` setting over to the capability toggle failed — login button withheld until the next boot", { meta: { reason: outcome.reason } });
-			return;
-		}
-		this.ctx.logger.debug("Magic-link: enabled-flag retirement deferred", { meta: {
-			reason: outcome.reason,
-			attempt,
-			retryInMs: delay
-		} });
-		this.retirementTimer = setTimeout(() => {
-			this.retirementTimer = null;
-			this.attemptEnabledFlagRetirement(attempt + 1);
-		}, delay);
-		this.retirementTimer.unref?.();
-	}
-	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "magic-link",
-			title: "Magic Link Settings",
-			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
-			columns: 1,
-			fields: [
-				this.field({
-					type: "text",
-					key: "displayName",
-					label: "Display name",
-					default: DEFAULT_CONFIG.displayName
-				}),
-				this.field({
-					type: "icon",
-					key: "icon",
-					label: "Icon",
-					description: "Shown on the login button.",
-					default: DEFAULT_CONFIG.icon
-				}),
-				this.field({
-					type: "text",
-					key: "publicOrigin",
-					label: "Public origin",
-					description: "Where the email link points. Empty = the hub address from Network (public tunnel, then mesh, then LAN).",
-					default: ""
-				}),
-				this.field({
-					type: "select",
-					key: "deliveryMode",
-					label: "Delivery mode",
-					description: "log-only records the request in the addon log but never the link (it is a login credential). smtp uses the configured SMTP relay.",
-					default: DEFAULT_CONFIG.deliveryMode,
-					options: [{
-						value: "log-only",
-						label: "Log-only (no email sent)"
-					}, {
-						value: "smtp",
-						label: "SMTP (when configured)"
-					}]
-				}),
-				this.field({
-					type: "select",
-					key: "defaultRole",
-					label: "Default role",
-					default: DEFAULT_CONFIG.defaultRole,
-					options: [{
-						value: "viewer",
-						label: "Viewer"
-					}, {
-						value: "admin",
-						label: "Admin"
-					}]
-				}),
-				this.field({
-					type: "number",
-					key: "ttlSec",
-					label: "Link TTL (seconds)",
-					description: "How long the magic link stays valid. Default 600 (10 min).",
-					default: DEFAULT_CONFIG.ttlSec
-				})
-			]
-		}] });
-	}
-	async buildPublicOrigin() {
-		const configured = this.config.publicOrigin?.trim();
-		if (configured) return configured.replace(/\/+$/, "");
-		return await require_hub_browser_origin.hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443";
-	}
-	async findUserByEmail(email) {
-		let users;
-		try {
-			users = await this.ctx.api.userManagement.listUsers.query();
-		} catch (err) {
-			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_dist.errMsg(err) } });
-			return null;
-		}
-		const needle = email.trim().toLowerCase();
-		for (const u of users) if (u.username.toLowerCase() === needle) return u;
-		return null;
-	}
-	/**
-	* Login-page landing for the magic-link `redirect` login method. Serves
-	* a self-contained email-entry page that POSTs to `/request`; the tiny
-	* inline script lives in the ADDON's served HTML (not the admin shell),
-	* keeping the login page free of any magic-link-specific JS. Always
-	* responds 200 (account-enumeration-safe, mirroring `/request`).
-	*/
-	async handleStart(_req, reply) {
-		const title = this.config.displayName || DEFAULT_CONFIG.displayName;
-		const html = `<!doctype html>
-<html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(title)}</title>
-<style>
-  :root { color-scheme: dark; }
-  body { margin:0; min-height:100vh; display:flex; align-items:center; justify-content:center;
-         background:#0b0d12; color:#e5e7eb; font:14px/1.5 system-ui,-apple-system,sans-serif; }
-  .card { width:100%; max-width:22rem; padding:1.5rem; border:1px solid #232733; border-radius:0.75rem;
-          background:#12151c; box-shadow:0 10px 30px rgba(0,0,0,.35); }
-  h1 { font-size:1rem; margin:0 0 1rem; }
-  label { font-size:.75rem; color:#9ca3af; display:block; margin-bottom:.35rem; }
-  input { width:100%; box-sizing:border-box; padding:.6rem .7rem; border-radius:.5rem;
-          border:1px solid #232733; background:#0b0d12; color:#e5e7eb; outline:none; }
-  input:focus { border-color:#6366f1; }
-  button { margin-top:1rem; width:100%; padding:.6rem; border:0; border-radius:.5rem; cursor:pointer;
-           background:#6366f1; color:#fff; font-weight:600; }
-  button:disabled { opacity:.5; cursor:default; }
-  .msg { margin-top:1rem; font-size:.8rem; color:#34d399; }
-  .err { color:#f87171; }
-  a { color:#9ca3af; font-size:.75rem; }
-</style></head>
-<body><form class="card" id="f">
-  <h1>${escapeHtml(title)}</h1>
-  <label for="email">Email address</label>
-  <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
-  <button id="b" type="submit">Send login link</button>
-  <div class="msg" id="m" hidden></div>
-  <p style="margin-top:1rem"><a href="/login">Back to sign in</a></p>
-</form>
-<script>
-  var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');
-  f.addEventListener('submit',function(e){e.preventDefault();b.disabled=true;m.hidden=true;m.className='msg';
-    fetch('/addon/auth-magic-link/request',{method:'POST',headers:{'content-type':'application/json'},
-      body:JSON.stringify({email:document.getElementById('email').value})})
-    .then(function(){m.textContent='If that email matches an account, a login link is on its way.';m.hidden=false;})
-    .catch(function(){m.className='msg err';m.textContent='Something went wrong. Please try again.';m.hidden=false;})
-    .finally(function(){b.disabled=false;});});
-<\/script>
-</body></html>`;
-		reply.code(200);
-		reply.header("Content-Type", "text/html; charset=utf-8");
-		reply.send(html);
-	}
-	async handleRequest(req, reply) {
-		try {
-			const body = req.body ?? {};
-			const email = typeof body.email === "string" ? body.email.trim() : "";
-			if (!email || !email.includes("@")) {
-				reply.code(400);
-				reply.send({ error: "A valid email address is required" });
-				return;
-			}
-			const ok = { sent: true };
-			const user = await this.findUserByEmail(email);
-			if (!user) {
-				reply.code(200);
-				reply.send(ok);
-				return;
-			}
-			let token;
-			try {
-				({token} = await this.ctx.api.ssoBridge.signBridgeToken.query({
-					claims: {
-						userId: user.id,
-						username: user.username,
-						isAdmin: user.isAdmin,
-						provider: "auth-magic-link",
-						email
-					},
-					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
-				}));
-			} catch (err) {
-				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_dist.errMsg(err) } });
-				reply.code(503);
-				reply.send({ error: "sso-bridge capability unavailable" });
-				return;
-			}
-			`${await this.buildPublicOrigin()}${encodeURIComponent(token)}`;
-			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated — not delivered (log-only mode, link withheld)", { meta: {
-				email,
-				ttlSec: this.config.ttlSec,
-				delivered: false
-			} });
-			else this.ctx.logger.warn("Magic link not delivered: SMTP mode requested but no smtp-provider cap registered", { meta: {
-				email,
-				delivered: false
-			} });
-			reply.code(200);
-			reply.send(ok);
-		} catch (err) {
-			reply.code(500);
-			reply.send({
-				error: "Magic-link request failed",
-				message: require_dist.errMsg(err)
-			});
-		}
-	}
-	async handleLogin(req, reply) {
-		const bridge = req.query["bridge"];
-		if (!bridge) {
-			reply.code(400);
-			reply.send({ error: "Missing bridge token" });
-			return;
-		}
-		reply.code(302);
-		reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridge)}`);
-		reply.send("");
-	}
-};
-/** Minimal HTML-attribute/text escaper for the interpolated page title. */
-function escapeHtml(value) {
-	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-//#endregion
-exports.AuthMagicLinkAddon = AuthMagicLinkAddon;
-exports.default = AuthMagicLinkAddon;