okengine 0.5.1 → 0.6.0

package/src/plugins/auth-delivery.mailpit.integration.test.ts

@@ -0,0 +1,330 @@
+/**
+ * Real Mailpit end-to-end: magic-link / email-otp request → SMTP → Mailpit API.
+ *
+ * Gated on a live Docker daemon — same real-skip pattern as pgvector /
+ * Meilisearch (`const live = … ? test : test.skip`). Never an empty pass.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { deriveInfrastructure, writeDerivedFiles } from "../docker/index.ts";
+import { oke } from "../kernel/app.ts";
+import { resetFlowSeq } from "../kernel/flow.ts";
+import { resetBindings } from "../kernel/on.ts";
+import { emailOtp } from "./email-otp.ts";
+import { magicLink } from "./magic-link.ts";
+
+const SECRET = "test-secret-at-least-16";
+const MAILPIT_IMAGE = "axllent/mailpit:v1.22.3";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+function dockerAvailable(): boolean {
+  try {
+    const proc = Bun.spawnSync(["docker", "info"], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    return proc.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+const DOCKER = dockerAvailable();
+if (!DOCKER) {
+  console.log("skip: mailpit e2e (docker daemon not available)");
+}
+const live = DOCKER ? test : test.skip;
+
+interface MailpitMessageSummary {
+  readonly ID: string;
+  readonly Subject: string;
+  readonly To: readonly { readonly Address: string }[];
+  readonly Snippet?: string;
+}
+
+interface MailpitMessage {
+  readonly ID: string;
+  readonly Subject: string;
+  readonly Text?: string;
+  readonly HTML?: string;
+  readonly To: readonly { readonly Address: string }[];
+}
+
+interface MailpitList {
+  readonly total: number;
+  readonly messages: readonly MailpitMessageSummary[];
+}
+
+async function waitForMailpit(uiUrl: string, timeoutMs = 30_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`${uiUrl}/api/v1/info`);
+      if (res.ok) return;
+    } catch {
+      // still starting
+    }
+    await Bun.sleep(250);
+  }
+  throw new Error(`mailpit not ready at ${uiUrl}`);
+}
+
+async function clearMailpit(uiUrl: string): Promise<void> {
+  await fetch(`${uiUrl}/api/v1/messages`, { method: "DELETE" });
+}
+
+async function waitForMessage(
+  uiUrl: string,
+  to: string,
+  timeoutMs = 15_000,
+): Promise<MailpitMessage> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const listRes = await fetch(`${uiUrl}/api/v1/messages`);
+    expect(listRes.ok).toBe(true);
+    const list = (await listRes.json()) as MailpitList;
+    const hit = list.messages.find((m) => m.To.some((addr) => addr.Address === to));
+    if (hit) {
+      const msgRes = await fetch(`${uiUrl}/api/v1/message/${hit.ID}`);
+      expect(msgRes.ok).toBe(true);
+      return (await msgRes.json()) as MailpitMessage;
+    }
+    await Bun.sleep(200);
+  }
+  throw new Error(`no Mailpit message for ${to} within ${timeoutMs}ms`);
+}
+
+function jsonPost(path: string, body: unknown): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("auth delivery — Mailpit integration", () => {
+  live(
+    "magic-link request lands a real email containing the token and link",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "oke-mailpit-ml-"));
+      const dockerDir = join(dir, "docker");
+      const project = `oke-mp-ml-${Date.now()}`;
+      const prevSmtp = process.env.SMTP_URL;
+      const prevOkeSmtp = process.env.OKE_CHANNEL_EMAIL_URL;
+
+      try {
+        // Offset host ports so a developer's already-running Mailpit on
+        // :1025/:8025 does not collide with the test stack.
+        const instanceId = crypto.randomUUID().replace(/-/g, "").slice(0, 6);
+        const derived = deriveInfrastructure({
+          images: { "channel.email": MAILPIT_IMAGE },
+          app: "mailpit-ml",
+          host: "127.0.0.1",
+          includeApp: false,
+          composeDir: "docker",
+          instanceId,
+        });
+        await writeDerivedFiles(derived, dockerDir, { writeStackEnv: true });
+
+        const composeFiles = ["compose.yml", "compose.channel.email.yml"];
+        const up = Bun.spawn(
+          [
+            "docker",
+            "compose",
+            "-p",
+            project,
+            ...composeFiles.flatMap((f) => ["-f", f]),
+            "up",
+            "-d",
+          ],
+          {
+            cwd: dockerDir,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: { ...process.env, ...derived.stackEnv },
+          },
+        );
+        const [upErr, upCode] = await Promise.all([new Response(up.stderr).text(), up.exited]);
+        expect(upCode).toBe(0);
+        if (upCode !== 0) console.error(upErr);
+
+        const uiUrl = derived.stackEnv.MAILPIT_UI_URL!;
+        const smtpUrl = derived.stackEnv.SMTP_URL!;
+        await waitForMailpit(uiUrl);
+        await clearMailpit(uiUrl);
+
+        process.env.SMTP_URL = smtpUrl;
+        process.env.OKE_CHANNEL_EMAIL_URL = smtpUrl;
+
+        const email = `ml-${crypto.randomUUID().slice(0, 8)}@example.com`;
+        const baseUrl = "http://app.test:6530";
+        const app = oke({
+          name: `mailpit-ml-${crypto.randomUUID()}`,
+          env: "test",
+          registry: "ignore",
+          gate: { auth: { secret: SECRET } },
+          config: {
+            drivers: { channel: { email: { test: "smtp" } } },
+          },
+        }).plug(
+          magicLink({
+            exposeDevToken: true,
+            baseUrl,
+          }),
+        );
+        await app.boot({ env: "test" });
+
+        const res = await app.fetch(jsonPost("/auth/magic-link/request", { email }));
+        expect(res.status).toBe(200);
+        const body = (await res.json()) as { data: { ok: true; devToken?: string } };
+        expect(body.data.ok).toBe(true);
+        expect(body.data.devToken).toBeTruthy();
+        const token = body.data.devToken!;
+        const expectedLink = `${baseUrl}/auth/magic-link/verify?token=${encodeURIComponent(token)}`;
+
+        const msg = await waitForMessage(uiUrl, email);
+        expect(msg.Subject).toBe("Your sign-in link");
+        const text = msg.Text ?? "";
+        const html = msg.HTML ?? "";
+        expect(text.includes(token) || html.includes(token)).toBe(true);
+        expect(text.includes(expectedLink) || html.includes(expectedLink)).toBe(true);
+
+        await app.stop();
+      } finally {
+        if (prevSmtp === undefined) delete process.env.SMTP_URL;
+        else process.env.SMTP_URL = prevSmtp;
+        if (prevOkeSmtp === undefined) delete process.env.OKE_CHANNEL_EMAIL_URL;
+        else process.env.OKE_CHANNEL_EMAIL_URL = prevOkeSmtp;
+
+        await Bun.spawn(
+          [
+            "docker",
+            "compose",
+            "-p",
+            project,
+            "-f",
+            "compose.yml",
+            "-f",
+            "compose.channel.email.yml",
+            "down",
+            "-v",
+          ],
+          { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+        ).exited.catch(() => {});
+        await rm(dir, { recursive: true, force: true }).catch(() => {});
+      }
+    },
+    120_000,
+  );
+
+  live(
+    "email-otp request lands a real email containing the OTP",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "oke-mailpit-otp-"));
+      const dockerDir = join(dir, "docker");
+      const project = `oke-mp-otp-${Date.now()}`;
+      const prevSmtp = process.env.SMTP_URL;
+      const prevOkeSmtp = process.env.OKE_CHANNEL_EMAIL_URL;
+
+      try {
+        const instanceId = crypto.randomUUID().replace(/-/g, "").slice(0, 6);
+        const derived = deriveInfrastructure({
+          images: { "channel.email": MAILPIT_IMAGE },
+          app: "mailpit-otp",
+          host: "127.0.0.1",
+          includeApp: false,
+          composeDir: "docker",
+          instanceId,
+        });
+        await writeDerivedFiles(derived, dockerDir, { writeStackEnv: true });
+
+        const composeFiles = ["compose.yml", "compose.channel.email.yml"];
+        const up = Bun.spawn(
+          [
+            "docker",
+            "compose",
+            "-p",
+            project,
+            ...composeFiles.flatMap((f) => ["-f", f]),
+            "up",
+            "-d",
+          ],
+          {
+            cwd: dockerDir,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: { ...process.env, ...derived.stackEnv },
+          },
+        );
+        const [upErr, upCode] = await Promise.all([new Response(up.stderr).text(), up.exited]);
+        expect(upCode).toBe(0);
+        if (upCode !== 0) console.error(upErr);
+
+        const uiUrl = derived.stackEnv.MAILPIT_UI_URL!;
+        const smtpUrl = derived.stackEnv.SMTP_URL!;
+        await waitForMailpit(uiUrl);
+        await clearMailpit(uiUrl);
+
+        process.env.SMTP_URL = smtpUrl;
+        process.env.OKE_CHANNEL_EMAIL_URL = smtpUrl;
+
+        const email = `otp-${crypto.randomUUID().slice(0, 8)}@example.com`;
+        const app = oke({
+          name: `mailpit-otp-${crypto.randomUUID()}`,
+          env: "test",
+          registry: "ignore",
+          gate: { auth: { secret: SECRET } },
+          config: {
+            drivers: { channel: { email: { test: "smtp" } } },
+          },
+        }).plug(emailOtp({ exposeDevOtp: true }));
+        await app.boot({ env: "test" });
+
+        const res = await app.fetch(jsonPost("/auth/email-otp/request", { email }));
+        expect(res.status).toBe(200);
+        const body = (await res.json()) as { data: { ok: true; devOtp?: string } };
+        expect(body.data.ok).toBe(true);
+        expect(body.data.devOtp).toMatch(/^\d{6}$/);
+        const otp = body.data.devOtp!;
+
+        const msg = await waitForMessage(uiUrl, email);
+        expect(msg.Subject).toBe("Your sign-in code");
+        const text = msg.Text ?? "";
+        const html = msg.HTML ?? "";
+        expect(text.includes(otp) || html.includes(otp)).toBe(true);
+
+        await app.stop();
+      } finally {
+        if (prevSmtp === undefined) delete process.env.SMTP_URL;
+        else process.env.SMTP_URL = prevSmtp;
+        if (prevOkeSmtp === undefined) delete process.env.OKE_CHANNEL_EMAIL_URL;
+        else process.env.OKE_CHANNEL_EMAIL_URL = prevOkeSmtp;
+
+        await Bun.spawn(
+          [
+            "docker",
+            "compose",
+            "-p",
+            project,
+            "-f",
+            "compose.yml",
+            "-f",
+            "compose.channel.email.yml",
+            "down",
+            "-v",
+          ],
+          { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+        ).exited.catch(() => {});
+        await rm(dir, { recursive: true, force: true }).catch(() => {});
+      }
+    },
+    120_000,
+  );
+});

package/src/plugins/auth-methods.security.test.ts

@@ -2,8 +2,8 @@
  * Exploit-proof security audit for the seven Gate auth method plugins.
  *
  * Real HTTP against a booted app — rate limits, gate posture, single-use tokens,
- * anonymous non-escalation, channel delivery gap, TOTP constant-time compare,
- * and WebAuthn signature + origin verification.
+ * anonymous non-escalation, Channel delivery (email wired / phone deferred),
+ * TOTP constant-time compare, and WebAuthn signature + origin verification.
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
@@ -420,8 +420,8 @@ describe("auth methods — anonymous non-escalation", () => {
   });
 });
 
-describe("auth methods — channel delivery gap", () => {
-  test("magic / email-otp / phone generate codes but do not expose them without exposeDev*", async () => {
+describe("auth methods — channel delivery", () => {
+  test("magic / email-otp send via fx.send; phone remains unwired; exposeDev* stays off by default", async () => {
     resetBindings();
     resetFlowSeq();
     const app = oke({
@@ -450,15 +450,17 @@ describe("auth methods — channel delivery gap", () => {
     expect(phoneBody.data.ok).toBe(true);
     expect(phoneBody.data.devOtp).toBeUndefined();
 
-    // No Channel import / send path in these plugins — codes exist only in the
-    // verification store (unreachable without exposeDev* or a future Channel wire).
     const magicSrc = await Bun.file(new URL("./magic-link.ts", import.meta.url)).text();
     const emailSrc = await Bun.file(new URL("./email-otp.ts", import.meta.url)).text();
     const phoneSrc = await Bun.file(new URL("./phone-number.ts", import.meta.url)).text();
-    for (const src of [magicSrc, emailSrc, phoneSrc]) {
-      expect(src).not.toMatch(/fx\.channel|channel\./);
-      expect(src).not.toMatch(/from ["'].*channel/);
-    }
+    expect(magicSrc).toMatch(/fx\.send/);
+    expect(magicSrc).toMatch(/channel\./);
+    expect(emailSrc).toMatch(/fx\.send/);
+    expect(emailSrc).toMatch(/channel\./);
+    // SMS delivery stays deferred — phone must not import Channel or fx.send.
+    expect(phoneSrc).not.toMatch(/fx\.send/);
+    expect(phoneSrc).not.toMatch(/channel\./);
+    expect(phoneSrc).not.toMatch(/from ["'].*channel/);
 
     await app.stop();
   });

package/src/plugins/email-otp.ts

@@ -1,5 +1,9 @@
 /**
  * Email OTP Gate auth method plugin.
+ *
+ * Delivers the one-time code via Channel (`fx.send` + `auth-email-otp`
+ * template). {@link EmailOtpOptions.exposeDevOtp} remains available for
+ * local DX without Mailpit / SMTP.
  */
 
 import {
@@ -17,6 +21,7 @@ import {
   putVerification,
   type VerificationStore,
 } from "../auth/verification.ts";
+import { channel } from "../elements/channel.ts";
 import { plugin, type PluginDef } from "../kernel/plugin.ts";
 import {
   AuthFailed,
@@ -32,6 +37,33 @@ import {
 
 const DEFAULT_TTL_MS = 10 * 60 * 1000;
 const MAX_ATTEMPTS = 5;
+const DEFAULT_FROM = "OKE <no-reply@oke.local>";
+
+/** Channel template for email OTP delivery. */
+export const emailOtpTemplate = channel.email({ from: DEFAULT_FROM }).template("auth-email-otp", {
+  description: "Email OTP sign-in code",
+  schema: z.object({
+    email: z.string(),
+    otp: z.string(),
+  }),
+  locales: ["en", "ar"],
+});
+
+/** Default EN/AR bodies for {@link emailOtpTemplate}. */
+export const emailOtpCatalog = {
+  "auth-email-otp": {
+    en: {
+      subject: "Your sign-in code",
+      text: "Your one-time sign-in code is: {{otp}}\n",
+      html: "<p>Your one-time sign-in code is:</p><p><strong>{{otp}}</strong></p>",
+    },
+    ar: {
+      subject: "رمز تسجيل الدخول",
+      text: "رمز تسجيل الدخول لمرة واحدة هو: {{otp}}\n",
+      html: '<p dir="rtl">رمز تسجيل الدخول لمرة واحدة هو:</p><p dir="rtl"><strong>{{otp}}</strong></p>',
+    },
+  },
+} as const;
 
 /** Options for {@link emailOtp}. */
 export interface EmailOtpOptions extends AuthMethodOptions {
@@ -41,6 +73,8 @@ export interface EmailOtpOptions extends AuthMethodOptions {
   readonly verifications?: VerificationStore;
   /** Return raw OTP in the request response (test / local). */
   readonly exposeDevOtp?: boolean;
+  /** Override the template `from` address. */
+  readonly from?: string;
 }
 
 /**
@@ -53,6 +87,17 @@ export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
   const identities = opts.identities ?? createIdentityStore();
   const verifications = opts.verifications ?? createVerificationStore();
   const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+  const tmpl =
+    opts.from !== undefined
+      ? channel.email({ from: opts.from }).template("auth-email-otp", {
+          description: "Email OTP sign-in code",
+          schema: z.object({
+            email: z.string(),
+            otp: z.string(),
+          }),
+          locales: ["en", "ar"],
+        })
+      : emailOtpTemplate;
 
   const request = flow({
     name: "auth.requestEmailOtp",
@@ -64,7 +109,8 @@ export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
       devOtp: z.string().optional(),
     }),
     errors: { AuthFailed, AuthRateLimited },
-    do: async (input) => {
+    effects: { sends: ["auth-email-otp"] },
+    do: async (input, fx) => {
       const email = normalizeEmail(input.email);
       if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
       const otp = generateOtp(6);
@@ -84,6 +130,10 @@ export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
         consumedAt: null,
         attempts: 0,
       });
+      await fx.send(tmpl, {
+        to: email,
+        data: { email, otp },
+      });
       return {
         ok: true as const,
         ...(opts.exposeDevOtp ? { devOtp: otp } : {}),
@@ -134,6 +184,9 @@ export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
 
   return plugin("emailOtp", { version: "0.0.1", config: { method: "email-otp" } })
     .needs("auth")
+    .needs("channel")
+    .channelTemplate(tmpl)
+    .channelCatalog(emailOtpCatalog)
     .binding(bindPublicAuth("/email-otp/request", request, "otp"))
     .binding(bindPublicAuth("/email-otp/verify", verify, "otp"));
 }

package/src/plugins/index.ts

@@ -16,9 +16,14 @@ export {
 } from "./config-source.ts";
 export { cors, type CorsOptions } from "./cors.ts";
 export { csrf, type CsrfOptions } from "./csrf.ts";
-export { emailOtp, type EmailOtpOptions } from "./email-otp.ts";
+export { emailOtp, emailOtpCatalog, emailOtpTemplate, type EmailOtpOptions } from "./email-otp.ts";
 export { ipAllowlist, type IpAllowlistOptions } from "./ip-allowlist.ts";
-export { magicLink, type MagicLinkOptions } from "./magic-link.ts";
+export {
+  magicLink,
+  magicLinkCatalog,
+  magicLinkTemplate,
+  type MagicLinkOptions,
+} from "./magic-link.ts";
 export { maintenanceMode, type MaintenanceModeOptions } from "./maintenance-mode.ts";
 export {
   createPasskeyStore,
@@ -57,9 +62,18 @@ export {
   type TwoFactorStore,
 } from "./two-factor.ts";
 export {
+  assertUsernamePolicy,
   createUsernameStore,
+  DEFAULT_RESERVED_USERNAMES,
+  DEFAULT_USERNAME_ALLOWED_CHARS,
+  DEFAULT_USERNAME_MAX_LENGTH,
+  DEFAULT_USERNAME_MIN_LENGTH,
+  resolveUsernamePolicy,
   username,
+  UsernamePolicyError,
+  type ResolvedUsernamePolicy,
   type UsernamePluginOptions,
+  type UsernamePolicyOptions,
   type UsernameRow,
   type UsernameStore,
 } from "./username.ts";

package/src/plugins/magic-link.ts

@@ -1,8 +1,9 @@
 /**
  * Magic-link Gate auth method plugin.
  *
- * Delivery via Channel is optional in v1 — when {@link MagicLinkOptions.exposeDevToken}
- * is set, the request response includes `devToken` for tests / local DX.
+ * Delivers the one-time token via Channel (`fx.send` + `auth-magic-link`
+ * template). {@link MagicLinkOptions.exposeDevToken} remains available for
+ * local DX without Mailpit / SMTP.
  */
 
 import {
@@ -18,6 +19,7 @@ import {
   putVerification,
   type VerificationStore,
 } from "../auth/verification.ts";
+import { channel } from "../elements/channel.ts";
 import { plugin, type PluginDef } from "../kernel/plugin.ts";
 import {
   AuthFailed,
@@ -32,6 +34,35 @@ import {
 } from "./auth/shared.ts";
 
 const DEFAULT_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_FROM = "OKE <no-reply@oke.local>";
+const DEFAULT_BASE_URL = "http://127.0.0.1:6530";
+
+/** Channel template for magic-link delivery. */
+export const magicLinkTemplate = channel.email({ from: DEFAULT_FROM }).template("auth-magic-link", {
+  description: "Magic-link sign-in email",
+  schema: z.object({
+    email: z.string(),
+    token: z.string(),
+    link: z.string(),
+  }),
+  locales: ["en", "ar"],
+});
+
+/** Default EN/AR bodies for {@link magicLinkTemplate}. */
+export const magicLinkCatalog = {
+  "auth-magic-link": {
+    en: {
+      subject: "Your sign-in link",
+      text: "Sign in with this link:\n{{link}}\n\nOr enter this token:\n{{token}}\n",
+      html: '<p>Sign in with this link:</p><p><a href="{{link}}">{{link}}</a></p><p>Or enter this token:</p><p><code>{{token}}</code></p>',
+    },
+    ar: {
+      subject: "رابط تسجيل الدخول",
+      text: "سجّل الدخول عبر هذا الرابط:\n{{link}}\n\nأو أدخل هذا الرمز:\n{{token}}\n",
+      html: '<p dir="rtl">سجّل الدخول عبر هذا الرابط:</p><p dir="rtl"><a href="{{link}}">{{link}}</a></p><p dir="rtl">أو أدخل هذا الرمز:</p><p dir="rtl"><code>{{token}}</code></p>',
+    },
+  },
+} as const;
 
 /** Options for {@link magicLink}. */
 export interface MagicLinkOptions extends AuthMethodOptions {
@@ -43,6 +74,13 @@ export interface MagicLinkOptions extends AuthMethodOptions {
   readonly verifications?: VerificationStore;
   /** Return raw token in the request response (test / local). */
   readonly exposeDevToken?: boolean;
+  /**
+   * App origin used to build the magic link (default `OKE_APP_URL` or
+   * `http://127.0.0.1:6530`).
+   */
+  readonly baseUrl?: string;
+  /** Override the template `from` address. */
+  readonly from?: string;
 }
 
 /**
@@ -55,6 +93,19 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
   const identities = opts.identities ?? createIdentityStore();
   const verifications = opts.verifications ?? createVerificationStore();
   const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+  const baseUrl = (opts.baseUrl ?? process.env.OKE_APP_URL ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+  const tmpl =
+    opts.from !== undefined
+      ? channel.email({ from: opts.from }).template("auth-magic-link", {
+          description: "Magic-link sign-in email",
+          schema: z.object({
+            email: z.string(),
+            token: z.string(),
+            link: z.string(),
+          }),
+          locales: ["en", "ar"],
+        })
+      : magicLinkTemplate;
 
   const request = flow({
     name: "auth.requestMagicLink",
@@ -66,7 +117,8 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
       devToken: z.string().optional(),
     }),
     errors: { AuthFailed, AuthRateLimited },
-    do: async (input) => {
+    effects: { sends: ["auth-magic-link"] },
+    do: async (input, fx) => {
       const email = normalizeEmail(input.email);
       if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
       const token = `ml_${crypto.randomUUID().replace(/-/g, "")}`;
@@ -80,6 +132,11 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
         consumedAt: null,
         attempts: 0,
       });
+      const link = `${baseUrl}/auth/magic-link/verify?token=${encodeURIComponent(token)}`;
+      await fx.send(tmpl, {
+        to: email,
+        data: { email, token, link },
+      });
       return {
         ok: true as const,
         ...(opts.exposeDevToken ? { devToken: token } : {}),
@@ -136,6 +193,9 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
 
   return plugin("magicLink", { version: "0.0.1", config: { method: "magic-link" } })
     .needs("auth")
+    .needs("channel")
+    .channelTemplate(tmpl)
+    .channelCatalog(magicLinkCatalog)
     .binding(bindPublicAuth("/magic-link/request", request, "otp"))
     .binding(bindPublicAuth("/magic-link/verify", verify, "otp"));
 }