okengine 0.4.3 → 0.5.1

package/src/plugins/auth-methods.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Phase 2 Gate auth method plugins — username, anonymous, magic-link, email OTP.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { oke } from "../kernel/app.ts";
+import { resetFlowSeq } from "../kernel/flow.ts";
+import { resetBindings } from "../kernel/on.ts";
+import { anonymous } from "./anonymous.ts";
+import { emailOtp } from "./email-otp.ts";
+import { magicLink } from "./magic-link.ts";
+import { username } from "./username.ts";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+function authApp() {
+  return oke({
+    name: "auth-plugins",
+    env: "test",
+    registry: "ignore",
+    gate: {
+      auth: {
+        secret: "test-secret-at-least-16",
+        emailAndPassword: { enabled: true },
+      },
+    },
+  })
+    .plug(username())
+    .plug(anonymous())
+    .plug(magicLink({ exposeDevToken: true }))
+    .plug(emailOtp({ exposeDevOtp: true }));
+}
+
+describe("auth method plugins", () => {
+  test("bindings appear on router after .plug()", async () => {
+    const app = authApp();
+    expect(app.router.match("POST", "/auth/sign-up/username")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/sign-in/username")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/sign-in/anonymous")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/magic-link/request")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/magic-link/verify")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/email-otp/request")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/email-otp/verify")).toBeTruthy();
+    await app.boot({ env: "test" });
+    await app.stop();
+  });
+
+  test("username sign-up + sign-in", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const signUp = await app.fetch(
+      new Request("http://localhost/auth/sign-up/username", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "alice", password: "CorrectHorse1" }),
+      }),
+    );
+    expect(signUp.status).toBe(200);
+    const created = (await signUp.json()) as {
+      data: { accessToken: string; userId: string };
+    };
+    expect(created.data.accessToken).toBeTruthy();
+    expect(created.data.userId).toBeTruthy();
+
+    const bad = await app.fetch(
+      new Request("http://localhost/auth/sign-in/username", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "alice", password: "wrong-password" }),
+      }),
+    );
+    const badBody = (await bad.json()) as { error: { data?: { reason?: string } } };
+    expect(badBody.error.data?.reason).toBe("invalid_credentials");
+
+    const signIn = await app.fetch(
+      new Request("http://localhost/auth/sign-in/username", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "alice", password: "CorrectHorse1" }),
+      }),
+    );
+    expect(signIn.status).toBe(200);
+    const session = (await signIn.json()) as { data: { accessToken: string } };
+    expect(session.data.accessToken).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("anonymous sign-in issues session", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const res = await app.fetch(
+      new Request("http://localhost/auth/sign-in/anonymous", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: { accessToken: string; userId: string };
+    };
+    expect(body.data.accessToken).toBeTruthy();
+    expect(body.data.userId).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("magic-link request + verify with devToken", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const req = await app.fetch(
+      new Request("http://localhost/auth/magic-link/request", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "ml@example.com" }),
+      }),
+    );
+    expect(req.status).toBe(200);
+    const requested = (await req.json()) as { data: { ok: true; devToken?: string } };
+    expect(requested.data.ok).toBe(true);
+    expect(requested.data.devToken).toBeTruthy();
+
+    const verify = await app.fetch(
+      new Request("http://localhost/auth/magic-link/verify", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: requested.data.devToken }),
+      }),
+    );
+    expect(verify.status).toBe(200);
+    const session = (await verify.json()) as { data: { accessToken: string; userId: string } };
+    expect(session.data.accessToken).toBeTruthy();
+    expect(session.data.userId).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("email OTP request + verify with devOtp", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const req = await app.fetch(
+      new Request("http://localhost/auth/email-otp/request", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "otp@example.com" }),
+      }),
+    );
+    expect(req.status).toBe(200);
+    const requested = (await req.json()) as { data: { ok: true; devOtp?: string } };
+    expect(requested.data.devOtp).toMatch(/^\d{6}$/);
+
+    const verify = await app.fetch(
+      new Request("http://localhost/auth/email-otp/verify", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          email: "otp@example.com",
+          otp: requested.data.devOtp,
+        }),
+      }),
+    );
+    expect(verify.status).toBe(200);
+    const session = (await verify.json()) as { data: { accessToken: string } };
+    expect(session.data.accessToken).toBeTruthy();
+
+    await app.stop();
+  });
+});

package/src/plugins/compression.test.ts

@@ -38,7 +38,7 @@ describe("acceptsGzip", () => {
 describe("compression plugin", () => {
   test("gzips a large JSON body when the client accepts gzip", async () => {
     on(http.get("/big"), flow({ name: "big.get", do: bigPayload }));
-    const app = oke({ name: "zip" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip" }).plug(compression());
 
     const res = await app.fetch(
       new Request("http://localhost/big", { headers: { "accept-encoding": "gzip" } }),
@@ -59,7 +59,7 @@ describe("compression plugin", () => {
 
   test("passes through untouched without Accept-Encoding: gzip", async () => {
     on(http.get("/big"), flow({ name: "big.get", do: bigPayload }));
-    const app = oke({ name: "zip-plain" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip-plain" }).plug(compression());
 
     const res = await app.fetch(new Request("http://localhost/big"));
 
@@ -70,7 +70,7 @@ describe("compression plugin", () => {
 
   test("skips bodies under minSize", async () => {
     on(http.get("/small"), flow({ name: "small.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "zip-small" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip-small" }).plug(compression());
 
     const res = await app.fetch(
       new Request("http://localhost/small", { headers: { "accept-encoding": "gzip" } }),
@@ -81,7 +81,7 @@ describe("compression plugin", () => {
 
   test("minSize: 0 compresses even tiny bodies", async () => {
     on(http.get("/small"), flow({ name: "small.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "zip-zero" }).plug(compression({ minSize: 0 }));
+    const app = oke({ autoBoot: false, name: "zip-zero" }).plug(compression({ minSize: 0 }));
 
     const res = await app.fetch(
       new Request("http://localhost/small", { headers: { "accept-encoding": "gzip" } }),
@@ -112,7 +112,7 @@ describe("compression plugin", () => {
           ),
       }),
     );
-    const app = oke({ name: "zip-skip" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip-skip" }).plug(compression());
 
     const img = await app.fetch(
       new Request("http://localhost/img", { headers: { "accept-encoding": "gzip" } }),

package/src/plugins/compression.ts

@@ -11,7 +11,7 @@ import {
   withConfigTable,
   type ConfigSource,
 } from "./config-source.ts";
-import { appendVary } from "./headers.ts";
+import { appendVary } from "./response-headers.ts";
 
 /** Options for {@link compression}. */
 export interface CompressionOptions {

package/src/plugins/config-source.test.ts

@@ -19,7 +19,7 @@ import { createPluginRegistry } from "../kernel/registry.ts";
 import { http } from "../kernel/triggers.ts";
 import { configSource, resolvePluginOptions } from "./config-source.ts";
 import { maintenanceMode } from "./maintenance-mode.ts";
-import { securityHeaders } from "./security-headers.ts";
+import { headers } from "./headers.ts";
 
 beforeEach(() => {
   resetBindings();
@@ -74,7 +74,7 @@ describe("configSource — box semantics", () => {
     };
     const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
 
-    const table = defineTable("security_headers_config", { key: true, value: true });
+    const table = defineTable("headers_config", { key: true, value: true });
     const sql = fx.store(db) as SqlStoreHandle;
     await sql.ensureTable(table);
     await sql
@@ -83,7 +83,7 @@ describe("configSource — box semantics", () => {
       .execute();
 
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: { hsts: false },
       db: { store: db },
       kv: cfg,
@@ -110,11 +110,11 @@ describe("configSource — box semantics", () => {
 
     const effects = { reads: ["sql:cfgdb" as const], writes: ["sql:cfgdb" as const] };
     const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
-    const table = defineTable("security_headers_config", { key: true, value: true });
+    const table = defineTable("headers_config", { key: true, value: true });
     await (fx.store(db) as SqlStoreHandle).ensureTable(table);
 
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: { frameOptions: "DENY" as const },
       db: { store: db },
     });
@@ -132,13 +132,13 @@ describe("configSource — box semantics", () => {
 
     const effects = { reads: ["sql:cfgdb" as const], writes: ["sql:cfgdb" as const] };
     const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
-    const table = defineTable("security_headers_config", { key: true, value: true });
+    const table = defineTable("headers_config", { key: true, value: true });
     const sql = fx.store(db) as SqlStoreHandle;
     await sql.ensureTable(table);
     await sql.insert(table).values({ key: "config", value: "{not json" }).execute();
 
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: {},
       db: { store: db },
     });
@@ -156,7 +156,7 @@ describe("configSource — plugin wiring", () => {
     });
 
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cfg-live" }).plug(maintenanceMode(source));
+    const app = oke({ autoBoot: false, name: "cfg-live" }).plug(maintenanceMode(source));
 
     expect((await app.fetch(new Request("http://localhost/x"))).status).toBe(200);
 
@@ -171,17 +171,17 @@ describe("configSource — plugin wiring", () => {
   test("DB-backed sources contribute their config table; static options do not", () => {
     const db = store.sql("cfgdb");
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: {},
       db: { store: db },
     });
 
     const registry = createPluginRegistry();
-    const registration = registry.plug(securityHeaders(source), { kind: "app" });
-    expect(registration?.tables.map((t) => t.name)).toEqual(["security_headers_config"]);
+    const registration = registry.plug(headers(source), { kind: "app" });
+    expect(registration?.tables.map((t) => t.name)).toEqual(["headers_config"]);
 
     const staticRegistry = createPluginRegistry();
-    const staticRegistration = staticRegistry.plug(securityHeaders({}), { kind: "app" });
+    const staticRegistration = staticRegistry.plug(headers({}), { kind: "app" });
     expect(staticRegistration?.tables).toEqual([]);
   });
 

package/src/plugins/config-source.ts

@@ -35,8 +35,8 @@ export interface ConfigSourceDb {
 /** Options for {@link configSource}. */
 export interface ConfigSourceOptions<T extends object> {
   /**
-   * Plugin id this config belongs to (e.g. `"security-headers"`) — derives
-   * the DB row key, the KV key, and the default table name.
+   * Plugin id this config belongs to (e.g. `"headers"`) — derives the DB
+   * row key, the KV key, and the default table name.
    */
   readonly plugin: string;
   /**

package/src/plugins/cors.test.ts

@@ -29,7 +29,9 @@ function preflight(path = "/x", headers: Record<string, string> = {}): Request {
 describe("cors plugin — preflight", () => {
   test("answers preflight for a path bound to another method (edge)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-pre" }).plug(cors({ origin: "https://app.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-pre" }).plug(
+      cors({ origin: "https://app.example.com" }),
+    );
 
     const res = await app.fetch(preflight());
 
@@ -41,7 +43,9 @@ describe("cors plugin — preflight", () => {
 
   test("denied origins get a 204 without CORS headers — the browser blocks quietly", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-deny" }).plug(cors({ origin: "https://other.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-deny" }).plug(
+      cors({ origin: "https://other.example.com" }),
+    );
 
     const res = await app.fetch(preflight());
 
@@ -51,7 +55,7 @@ describe("cors plugin — preflight", () => {
 
   test("no origin configured answers nothing — cross-origin closed by default", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-closed" }).plug(cors());
+    const app = oke({ autoBoot: false, name: "cors-closed" }).plug(cors());
 
     const res = await app.fetch(preflight());
     expect(res.headers.get("access-control-allow-origin")).toBeNull();
@@ -59,7 +63,7 @@ describe("cors plugin — preflight", () => {
 
   test("a plain unmatched OPTIONS without preflight headers still 404s", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-404" }).plug(cors({ origin: "*" }));
+    const app = oke({ autoBoot: false, name: "cors-404" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x", { method: "OPTIONS" }));
     expect(res.status).toBe(404);
@@ -67,7 +71,7 @@ describe("cors plugin — preflight", () => {
 
   test("reflects request headers by default, honors configured lists and maxAge", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-hdr" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-hdr" }).plug(
       cors({ origin: "*", maxAge: 600, allowedHeaders: ["x-custom"] }),
     );
 
@@ -88,7 +92,7 @@ describe("cors plugin — preflight", () => {
 
   test("allowlist + credentials reflects only listed origins", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-cred" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-cred" }).plug(
       cors({ origin: ["https://app.example.com", "https://admin.example.com"], credentials: true }),
     );
 
@@ -106,7 +110,7 @@ describe("cors plugin — preflight", () => {
 describe("cors plugin — actual requests", () => {
   test("allowed origins get allow-origin (+ exposed headers) on matched responses", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-actual" }).plug(
       cors({ origin: ["https://app.example.com"], exposedHeaders: ["x-total"] }),
     );
 
@@ -121,7 +125,7 @@ describe("cors plugin — actual requests", () => {
 
   test("allowlist + credentials on matched responses reflects only listed origins", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual-cred" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-actual-cred" }).plug(
       cors({ origin: ["https://app.example.com"], credentials: true }),
     );
 
@@ -142,7 +146,9 @@ describe("cors plugin — actual requests", () => {
 
   test("denied origins get no CORS headers on matched responses", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual-deny" }).plug(cors({ origin: "https://ok.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-actual-deny" }).plug(
+      cors({ origin: "https://ok.example.com" }),
+    );
 
     const res = await app.fetch(
       new Request("http://localhost/x", { headers: { origin: "https://evil.example.com" } }),
@@ -154,7 +160,7 @@ describe("cors plugin — actual requests", () => {
 
   test("requests without an Origin header are untouched", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-no-origin" }).plug(cors({ origin: "*" }));
+    const app = oke({ autoBoot: false, name: "cors-no-origin" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
     expect(res.headers.get("access-control-allow-origin")).toBeNull();

package/src/plugins/cors.ts

@@ -13,7 +13,7 @@ import {
   isConfigSource,
   type ConfigSource,
 } from "./config-source.ts";
-import { appendVary, withHeaders } from "./headers.ts";
+import { appendVary, withHeaders } from "./response-headers.ts";
 
 /** Options for {@link cors}. */
 export interface CorsOptions {

package/src/plugins/csrf.test.ts

@@ -22,7 +22,7 @@ function mutating(headers: Record<string, string> = {}): Request {
 function appWith(options: Parameters<typeof csrf>[0]) {
   on(http.post("/transfer"), flow({ name: "transfer.create", do: () => ({ moved: true }) }));
   on(http.get("/balance"), flow({ name: "balance.get", do: () => ({ balance: 5 }) }));
-  return oke({ name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
+  return oke({ autoBoot: false, name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
 }
 
 describe("csrf plugin", () => {

package/src/plugins/email-otp.ts

@@ -0,0 +1,161 @@
+/**
+ * Email OTP Gate auth method plugin.
+ */
+
+import {
+  createIdentityStore,
+  normalizeEmail,
+  type IdentityStore,
+  type UserIdentityRow,
+} from "../auth/identity.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import {
+  createVerificationStore,
+  findActiveVerification,
+  generateOtp,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+
+/** Options for {@link emailOtp}. */
+export interface EmailOtpOptions extends AuthMethodOptions {
+  /** Challenge TTL (default 10m). */
+  readonly ttlMs?: number;
+  readonly identities?: IdentityStore;
+  readonly verifications?: VerificationStore;
+  /** Return raw OTP in the request response (test / local). */
+  readonly exposeDevOtp?: boolean;
+}
+
+/**
+ * Email OTP request + verify (6-digit, hashed, 5 attempts).
+ *
+ * @param opts - TTL / stores / dev OTP
+ */
+export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const identities = opts.identities ?? createIdentityStore();
+  const verifications = opts.verifications ?? createVerificationStore();
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  const request = flow({
+    name: "auth.requestEmailOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ email: z.string().min(3) }),
+    out: z.object({
+      ok: z.literal(true),
+      devOtp: z.string().optional(),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
+      const otp = generateOtp(6);
+      const now = runtime.now();
+      // Invalidate prior active challenges for this email.
+      for (const row of verifications.rows.values()) {
+        if (row.identifier === `email-otp:${email}` && row.consumedAt === null) {
+          row.consumedAt = now;
+        }
+      }
+      putVerification(verifications, {
+        id: crypto.randomUUID(),
+        identifier: `email-otp:${email}`,
+        value: await hashChallenge(otp),
+        expiresAt: now + ttlMs,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return {
+        ok: true as const,
+        ...(opts.exposeDevOtp ? { devOtp: otp } : {}),
+      };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.verifyEmailOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      email: z.string().min(3),
+      otp: z.string().min(4).max(8),
+    }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      const now = runtime.now();
+      const row = findActiveVerification(verifications, `email-otp:${email}`, now);
+      if (!row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      if (row.attempts >= MAX_ATTEMPTS) {
+        row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      const hash = await hashChallenge(input.otp.trim());
+      if (hash !== row.value) {
+        row.attempts += 1;
+        if (row.attempts >= MAX_ATTEMPTS) row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      row.consumedAt = now;
+      const user = ensureUserByEmail(identities, email, now);
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: user.id,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: user.id,
+      };
+    },
+  });
+
+  return plugin("emailOtp", { version: "0.0.1", config: { method: "email-otp" } })
+    .needs("auth")
+    .binding(bindPublicAuth("/email-otp/request", request, "otp"))
+    .binding(bindPublicAuth("/email-otp/verify", verify, "otp"));
+}
+
+function ensureUserByEmail(store: IdentityStore, email: string, now: number): UserIdentityRow {
+  const existingId = store.byEmail.get(email);
+  if (existingId) {
+    const existing = store.users.get(existingId);
+    if (existing) return existing;
+  }
+  const id = crypto.randomUUID();
+  const user: UserIdentityRow = {
+    id,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: now,
+    updatedAt: now,
+    extra: {},
+  };
+  store.users.set(id, user);
+  store.byEmail.set(email, id);
+  return user;
+}