@podosoft/podokit 1.0.2 → 1.1.4

package/dist/templates/fullstack/apps/api/src/database/sqlite-migrator.ts

@@ -0,0 +1,134 @@
+import { Database as SqliteDatabase } from "bun:sqlite";
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export interface SqliteMigrationDefinition {
+  timestamp: number;
+  migration: MigrationInterface;
+}
+
+interface AppliedMigration {
+  id: number;
+  timestamp: number;
+  name: string;
+}
+
+type MigrationConstructor = new () => MigrationInterface;
+
+function isMigration(value: unknown): value is MigrationConstructor {
+  if (typeof value !== "function") return false;
+  const prototype = (value as { prototype?: unknown }).prototype;
+  if (!prototype || typeof prototype !== "object") return false;
+  const record = prototype as Record<string, unknown>;
+  return typeof record.up === "function" && typeof record.down === "function";
+}
+
+async function discoverMigrations(): Promise<SqliteMigrationDefinition[]> {
+  const compiled = join(process.cwd(), "dist", "migrations");
+  const source = join(process.cwd(), "src", "migrations");
+  const directory = process.env.NODE_ENV === "production" && existsSync(compiled)
+    ? compiled
+    : source;
+  if (!existsSync(directory)) return [];
+  const files = readdirSync(directory)
+    .filter((file) => /^\d+-.+\.(?:js|ts)$/.test(file))
+    .sort();
+  const definitions: SqliteMigrationDefinition[] = [];
+  for (const file of files) {
+    const loaded = await import(pathToFileURL(join(directory, file)).href) as Record<string, unknown>;
+    const constructors = Object.values(loaded).filter(isMigration);
+    if (constructors.length !== 1) {
+      throw new Error(`SQLite migration ${file} must export exactly one migration class`);
+    }
+    const timestamp = Number(file.slice(0, file.indexOf("-")));
+    if (!Number.isSafeInteger(timestamp)) throw new Error(`SQLite migration ${file} has an invalid timestamp`);
+    const Constructor = constructors[0];
+    if (!Constructor) throw new Error(`SQLite migration ${file} has no migration class`);
+    definitions.push({ timestamp, migration: new Constructor() });
+  }
+  return definitions;
+}
+
+function queryRunner(database: SqliteDatabase): QueryRunner {
+  return {
+    connection: { options: { type: "better-sqlite3" } },
+    query: (sql: string): Promise<unknown> => Promise.resolve(database.run(sql)),
+  } as unknown as QueryRunner;
+}
+
+function prepare(database: SqliteDatabase): void {
+  database.run("PRAGMA journal_mode = WAL");
+  database.run("PRAGMA foreign_keys = ON");
+  database.run("PRAGMA busy_timeout = 5000");
+  database.run(`
+    CREATE TABLE IF NOT EXISTS "migrations" (
+      "id" integer PRIMARY KEY AUTOINCREMENT,
+      "timestamp" bigint NOT NULL,
+      "name" text NOT NULL UNIQUE
+    )
+  `);
+}
+
+function migrationName(migration: MigrationInterface): string {
+  if (typeof migration.name !== "string" || migration.name.length === 0) {
+    throw new Error("SQLite migration classes must declare a non-empty name");
+  }
+  return migration.name;
+}
+
+export async function runSqliteMigrations(
+  database: SqliteDatabase,
+  supplied?: readonly SqliteMigrationDefinition[],
+): Promise<void> {
+  prepare(database);
+  const definitions = supplied ? [...supplied] : await discoverMigrations();
+  definitions.sort((left, right) => left.timestamp - right.timestamp);
+  const applied = new Set(
+    database.query<Pick<AppliedMigration, "name">, []>(
+      'SELECT "name" FROM "migrations"',
+    ).all().map((row) => row.name),
+  );
+  const runner = queryRunner(database);
+  for (const definition of definitions) {
+    const name = migrationName(definition.migration);
+    if (applied.has(name)) continue;
+    database.run("BEGIN IMMEDIATE");
+    try {
+      await definition.migration.up(runner);
+      database.query(
+        'INSERT INTO "migrations" ("timestamp", "name") VALUES (?1, ?2)',
+      ).run(definition.timestamp, name);
+      database.run("COMMIT");
+    } catch (error) {
+      database.run("ROLLBACK");
+      throw error;
+    }
+  }
+}
+
+export async function revertLatestSqliteMigration(
+  database: SqliteDatabase,
+  supplied?: readonly SqliteMigrationDefinition[],
+): Promise<boolean> {
+  prepare(database);
+  const latest = database.query<AppliedMigration, []>(
+    'SELECT "id", "timestamp", "name" FROM "migrations" ORDER BY "id" DESC LIMIT 1',
+  ).get();
+  if (!latest) return false;
+  const definitions = supplied ? [...supplied] : await discoverMigrations();
+  const definition = definitions.find((item) => migrationName(item.migration) === latest.name);
+  if (!definition) throw new Error(`Cannot find SQLite migration ${latest.name} to revert`);
+  const runner = queryRunner(database);
+  database.run("BEGIN IMMEDIATE");
+  try {
+    await definition.migration.down(runner);
+    database.query('DELETE FROM "migrations" WHERE "id" = ?1').run(latest.id);
+    database.run("COMMIT");
+    return true;
+  } catch (error) {
+    database.run("ROLLBACK");
+    throw error;
+  }
+}

package/dist/templates/fullstack/compose.dev.yaml

@@ -102,7 +102,7 @@ services:
 
   minio:
     profiles: [storage]
-    image: minio/minio:latest
+    image: pgsty/silo:RELEASE.2026-09-16T00-00-00Z
     command: server /data --console-address ":9001"
     environment:
       MINIO_ROOT_USER: podokit
@@ -113,7 +113,7 @@ services:
 
   minio-init:
     profiles: [storage]
-    image: minio/mc:latest
+    image: pgsty/mc:RELEASE.2026-09-16T00-00-00Z
     depends_on:
       minio: { condition: service_started }
     entrypoint:

package/dist/templates/fullstack/dot-agents/skills/podokit-deploy/references/profile.md

@@ -60,9 +60,14 @@ it at a different host invalidates the profile instead of deploying somewhere el
 The fields that differ from the Kubernetes driver:
 
 - `target`: Docker context, endpoint fingerprint, Compose project name
-- `exposure`: `bindAddress` and `port` published from the web service. It defaults to
-  `127.0.0.1`, because the expected front door is a reverse proxy on the same host —
-  binding every interface publishes the app before TLS exists
+- `exposure`: `bindAddress` and `port`, plus an exact `webSocketPaths` allowlist,
+  `trustedProxyCidrs`, and `gatewayImage`. With an empty allowlist, web owns the
+  published port. With paths, an internal gateway owns it, sends only exact listed
+  paths to API, and sends every other request to web. Forwarding headers are trusted
+  only from the direct proxy CIDRs in `trustedProxyCidrs`; leave it empty without an
+  external proxy. The bind address defaults to `127.0.0.1`, because the expected
+  front door is a trusted reverse proxy — binding every interface publishes the app
+  before TLS exists.
 - `workloads`: replicas plus Compose `cpus` and `memory` limits
 - `dependencies`: `managed`, `external`, or `disabled`, each with a named Docker
   volume and the path of its env file on the target host
@@ -86,3 +91,5 @@ Required keys:
 Data volumes are declared `external`, so `docker compose down -v` cannot delete the
 database. Editing an env file changes the containers' rollout label, so the next
 apply actually restarts them instead of leaving stale environment values running.
+The gateway image is resolved to an immutable digest during planning. The external
+TLS proxy keeps one upstream; do not duplicate the WebSocket path split there.

package/dist/templates/fullstack/dot-env.example

@@ -4,6 +4,8 @@
 NODE_ENV=development
 PORT=5002
 
+# Canonical database connection. Set this for PostgreSQL or SQLite; POSTGRES_* remains a fallback.
+# DATABASE_URL=postgres://podokit:podokit@localhost:5432/podokit
 POSTGRES_HOST=localhost
 POSTGRES_PORT=5432
 POSTGRES_USER=podokit

package/dist/templates/modules/admin-dashboard/files/apps/api/src/admin.module.ts

@@ -3,6 +3,7 @@ import {
   PROFILE_IMAGE_REQUIRED,
   PROFILE_IMAGE_TOO_LARGE,
 } from "@podosoft/podokit-contracts";
+import { OBJECT_STORAGE } from "@podosoft/podokit-runtime";
 import { Elysia, t } from "elysia";
 import { AUTH } from "./auth/auth.module";
 import {
@@ -20,7 +21,6 @@ import {
   SiteSettingsService,
 } from "./site-settings/site-settings.service";
 import { validateSiteSetting } from "./site-settings/site-settings.validation";
-import { STORAGE } from "./storage/storage.module";
 
 export const SITE_SETTINGS = Symbol("site-settings") as ServiceKey<SiteSettingsService>;
 export const PROFILE_IMAGES = Symbol("profile-images") as ServiceKey<ProfileImageService>;
@@ -138,7 +138,7 @@ const adminPlugin: AppPlugin = ({ services }) => {
 export const adminModule: PodokitModule = {
   name: "admin-dashboard",
   configure: (_env, services): void => {
-    const storage = services.resolve(STORAGE);
+    const storage = services.resolve(OBJECT_STORAGE);
     const site = new SiteSettingsService(services.resolve(DATABASE).sql, storage);
     const profileImages = new ProfileImageService(storage, services.resolve(LOGGER));
     services.register(SITE_SETTINGS, site);

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image.service.spec.ts

@@ -1,18 +1,24 @@
 import { afterAll, afterEach, describe, expect, mock, test } from "bun:test";
 import type { Logger } from "pino";
+import type { ObjectStore } from "@podosoft/podokit-runtime";
 import { runUserDeletedHandlers } from "../auth/user-delete-handlers";
-import { StorageService } from "../storage/storage.service";
 import { ProfileImageService } from "./profile-image.service";
 
 describe("ProfileImageService account deletion cleanup", () => {
   const storage = {
     put: mock(async () => undefined),
-    get: mock(async () => Buffer.alloc(0)),
-    presignedGetUrl: mock(async () => "https://example.com/image"),
+    get: mock(async () => ({
+      key: "profile-images/example.webp",
+      size: 0,
+      body: (async function* (): AsyncGenerator<Uint8Array> { yield Buffer.alloc(0); })(),
+    })),
+    exists: mock(async () => true),
+    getDownloadUrl: mock(async () => "https://example.com/image"),
     delete: mock(async () => undefined),
+    close: mock(() => undefined),
   };
   const logger = { warn: mock(() => undefined) } as unknown as Logger;
-  const service = new ProfileImageService(storage as unknown as StorageService, logger);
+  const service = new ProfileImageService(storage as unknown as ObjectStore, logger);
 
   service.connect();
 

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image.service.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { Logger } from "pino";
+import type { ObjectData, ObjectStore } from "@podosoft/podokit-runtime";
 import {
   AppException,
   PROFILE_IMAGE_NOT_FOUND,
@@ -7,7 +8,6 @@ import {
 } from "@podosoft/podokit-contracts";
 import { getAuth } from "../auth/auth-provider";
 import { registerUserDeletedHandler } from "../auth/user-delete-handlers";
-import type { StorageService } from "../storage/storage.service";
 import { validateProfileImage, type ProfileImageUpload } from "./profile-image.validation";
 
 const FILE_NAME = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.(?:jpg|png|webp)$/;
@@ -33,11 +33,17 @@ export type UpdateAuthUser = (
 const updateAuthUser: UpdateAuthUser = (image, headers) =>
   getAuth().api.updateUser({ body: { image }, headers });
 
+async function objectBuffer(object: ObjectData): Promise<Buffer> {
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of object.body) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
 export class ProfileImageService {
   private unregisterUserDeleted?: () => void;
 
   constructor(
-    private readonly storage: StorageService,
+    private readonly storage: ObjectStore,
     private readonly logger: Logger,
     private readonly updateUser: UpdateAuthUser = updateAuthUser,
   ) {}
@@ -63,7 +69,7 @@ export class ProfileImageService {
     const key = STORAGE_PREFIX + fileName;
     const image = PUBLIC_PREFIX + fileName;
 
-    await this.storage.put(key, file.buffer, metadata.contentType);
+    await this.storage.put(key, file.buffer, { contentType: metadata.contentType });
     try {
       await this.updateUser(image, headers);
     } catch (error: unknown) {
@@ -86,7 +92,7 @@ export class ProfileImageService {
     try {
       const extension = fileName.slice(fileName.lastIndexOf(".") + 1);
       return {
-        body: await this.storage.get(key),
+        body: await objectBuffer(await this.storage.get(key)),
         contentType: CONTENT_TYPES[extension] ?? "application/octet-stream",
       };
     } catch {

package/dist/templates/modules/admin-dashboard/files/apps/api/src/site-settings/site-settings.service.ts

@@ -1,5 +1,5 @@
 import type { SQL } from "bun";
-import type { StorageService } from "../storage/storage.service";
+import type { ObjectData, ObjectStore } from "@podosoft/podokit-runtime";
 
 const PREFIX = "site.";
 const FAVICON_KEY = "site/favicon";
@@ -31,10 +31,16 @@ export interface SiteFavicon {
   contentType: string;
 }
 
+async function objectBuffer(object: ObjectData): Promise<Buffer> {
+  const chunks: Uint8Array[] = [];
+  for await (const chunk of object.body) chunks.push(chunk);
+  return Buffer.concat(chunks);
+}
+
 export class SiteSettingsService {
   constructor(
     private readonly sql: SQL,
-    private readonly storage: StorageService,
+    private readonly storage: ObjectStore,
   ) {}
 
   async getAll(): Promise<Record<string, string>> {
@@ -66,7 +72,7 @@ export class SiteSettingsService {
   }
 
   async setFavicon(body: Uint8Array, contentType: string): Promise<void> {
-    await this.storage.put(FAVICON_KEY, body, contentType);
+    await this.storage.put(FAVICON_KEY, body, { contentType });
     await this.setMany({
       faviconContentType: contentType,
       faviconUpdatedAt: String(Date.now()),
@@ -77,7 +83,7 @@ export class SiteSettingsService {
     const contentType = await this.get("faviconContentType");
     if (!contentType) return null;
     try {
-      return { body: await this.storage.get(FAVICON_KEY), contentType };
+      return { body: await objectBuffer(await this.storage.get(FAVICON_KEY)), contentType };
     } catch {
       return null;
     }

package/dist/templates/modules/admin-dashboard/module.manifest.json

@@ -1,11 +1,9 @@
 {
-  "manifestVersion": 2,
+  "manifestVersion": 3,
   "name": "admin-dashboard",
   "description": "Admin console UI (SvelteKit + shadcn-svelte): the `(admin)` route group and `admin-sidebar.svelte` are reserved for `/admin/*`; put protected product pages in `(app)` or their own guarded layout. Requires auth.",
-  "requires": [
-    "auth",
-    "object-storage-s3"
-  ],
+  "requires": ["auth"],
+  "requiresCapabilities": ["object-storage"],
   "targetApp": "web",
   "dependencies": {
     "qrcode": "^1.5.4"

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit-enabled.ts

@@ -1,15 +1,12 @@
-import { pool } from "../auth/db";
-import { createConfigStore } from "@podosoft/podokit-auth";
+import { authConfigStore } from "../auth/auth-config-store";
 
 // Audit logging is an admin-managed, DB-backed server toggle (auth_config `server`
 // row, env fallback AUDIT_LOG_ENABLED), read through the shared config store's
 // short TTL cache — the same mechanism as the other server-enforced toggles.
 // Toggling it on the Settings page takes effect within the cache TTL, no restart.
-const store = createConfigStore(pool);
-
 export async function auditEnabled(): Promise<boolean> {
   try {
-    return (await store.capabilitiesSnapshot()).auditLog;
+    return (await authConfigStore.capabilitiesSnapshot()).auditLog;
   } catch {
     return true; // never let a config read failure silently drop the audit trail
   }

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.migration.spec.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "bun:test";
+import type { QueryRunner } from "typeorm";
+import { InitAuditLogs1720300000000 } from "../migrations/1720300000000-InitAuditLogs";
+
+function runner(type: "postgres" | "better-sqlite3", queries: string[]): QueryRunner {
+  return {
+    connection: { options: { type } },
+    query: (sql: string): Promise<unknown[]> => {
+      queries.push(sql);
+      return Promise.resolve([]);
+    },
+  } as unknown as QueryRunner;
+}
+
+describe("audit log migration", () => {
+  it("retains PostgreSQL UUID and JSONB storage", async () => {
+    const queries: string[] = [];
+    await new InitAuditLogs1720300000000().up(runner("postgres", queries));
+    expect(queries[0]).toContain("CREATE EXTENSION");
+    expect(queries[1]).toContain("uuid NOT NULL DEFAULT gen_random_uuid()");
+    expect(queries[1]).toContain("jsonb");
+  });
+
+  it("uses portable SQLite column types and defaults", async () => {
+    const queries: string[] = [];
+    await new InitAuditLogs1720300000000().up(runner("better-sqlite3", queries));
+    expect(queries).toHaveLength(3);
+    expect(queries[0]).toContain('"id" text NOT NULL');
+    expect(queries[0]).toContain('"metadata" text');
+    expect(queries[0]).toContain("DEFAULT CURRENT_TIMESTAMP");
+    expect(queries.join("\n")).not.toContain("CREATE EXTENSION");
+  });
+});

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.service.spec.ts

@@ -26,6 +26,7 @@ describe("AuditService", () => {
       expect(recorder.values).toHaveLength(1);
       expect(recorder.values[0]).toContain("invoice.paid");
       expect(recorder.values[0]).toContain('{"amount":42}');
+      expect(recorder.values[0]?.[0]).toBeString();
     } finally {
       service.close();
     }
@@ -41,6 +42,18 @@ describe("AuditService", () => {
     expect(entries[0]?.createdAt).toBe("2026-01-02T03:04:05.000Z");
   });
 
+  test("normalizes SQLite timestamps and JSON text", async () => {
+    const recorder = sqlRecorder([{
+      id: "audit-1",
+      action: "auth.login",
+      metadata: '{"method":"password"}',
+      createdAt: "2026-01-02T03:04:05.000Z",
+    }]);
+    const entries = await new AuditService(recorder.sql).recent();
+    expect(entries[0]?.metadata).toEqual({ method: "password" });
+    expect(entries[0]?.createdAt).toBe("2026-01-02T03:04:05.000Z");
+  });
+
   test("does not propagate persistence failures", async () => {
     const sql = mock(() => Promise.reject(new Error("database unavailable"))) as unknown as SQL;
     await expect(new AuditService(sql).record({ action: "auth.login" })).resolves.toBeUndefined();

package/dist/templates/modules/audit-log/files/apps/api/src/audit/audit.service.ts

@@ -8,9 +8,10 @@ export interface AuditLogView extends AuditEntry {
   createdAt: string;
 }
 
-interface AuditLogRow extends Omit<AuditLogView, "createdAt"> {
-  createdAt: Date;
-}
+type AuditLogRow = Omit<AuditLogView, "createdAt" | "metadata"> & {
+  createdAt: Date | string;
+  metadata: unknown;
+};
 
 export interface AuditTarget {
   type?: string;
@@ -40,13 +41,13 @@ export class AuditService {
         : JSON.stringify(entry.metadata);
       await this.sql`
         INSERT INTO "audit_logs" (
-          "action", "actorId", "actorName", "actorEmail",
-          "targetType", "targetId", "targetLabel", "ip", "metadata"
+          "id", "action", "actorId", "actorName", "actorEmail",
+          "targetType", "targetId", "targetLabel", "ip", "metadata", "createdAt"
         ) VALUES (
-          ${entry.action}, ${entry.actorId ?? null}, ${entry.actorName ?? null},
+          ${crypto.randomUUID()}, ${entry.action}, ${entry.actorId ?? null}, ${entry.actorName ?? null},
           ${entry.actorEmail ?? null}, ${entry.targetType ?? null},
           ${entry.targetId ?? null}, ${entry.targetLabel ?? null}, ${entry.ip ?? null},
-          ${metadata}::jsonb
+          CAST(${metadata} AS JSON), ${new Date().toISOString()}
         )
       `;
     } catch {
@@ -62,7 +63,15 @@ export class AuditService {
       ORDER BY "createdAt" DESC
       LIMIT ${limit}
     `;
-    return rows.map((row) => ({ ...row, createdAt: row.createdAt.toISOString() }));
+    return rows.map((row) => ({
+      ...row,
+      metadata: typeof row.metadata === "string"
+        ? JSON.parse(row.metadata) as Record<string, unknown>
+        : row.metadata as Record<string, unknown> | null,
+      createdAt: row.createdAt instanceof Date
+        ? row.createdAt.toISOString()
+        : new Date(row.createdAt).toISOString(),
+    }));
   }
 
   async recordRequest(

package/dist/templates/modules/audit-log/files/apps/api/src/migrations/1720300000000-InitAuditLogs.ts

@@ -4,10 +4,11 @@ export class InitAuditLogs1720300000000 implements MigrationInterface {
   name = "InitAuditLogs1720300000000";
 
   async up(queryRunner: QueryRunner): Promise<void> {
-    await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "pgcrypto"`);
+    const sqlite = queryRunner.connection.options.type === "better-sqlite3";
+    if (!sqlite) await queryRunner.query(`CREATE EXTENSION IF NOT EXISTS "pgcrypto"`);
     await queryRunner.query(`
       CREATE TABLE "audit_logs" (
-        "id" uuid NOT NULL DEFAULT gen_random_uuid(),
+        "id" ${sqlite ? "text" : "uuid"} NOT NULL${sqlite ? "" : " DEFAULT gen_random_uuid()"},
         "action" character varying(128) NOT NULL,
         "actorId" character varying,
         "actorName" character varying,
@@ -16,8 +17,8 @@ export class InitAuditLogs1720300000000 implements MigrationInterface {
         "targetId" character varying,
         "targetLabel" character varying,
         "ip" character varying,
-        "metadata" jsonb,
-        "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+        "metadata" ${sqlite ? "text" : "jsonb"},
+        "createdAt" ${sqlite ? "datetime" : "TIMESTAMP WITH TIME ZONE"} NOT NULL DEFAULT ${sqlite ? "CURRENT_TIMESTAMP" : "now()"},
         CONSTRAINT "PK_audit_logs_id" PRIMARY KEY ("id")
       )
     `);

package/dist/templates/modules/audit-log/module.manifest.json

@@ -36,6 +36,6 @@
     "List recent entries (admin session required): curl -b cookies.txt localhost:5002/audit-logs"
   ],
   "dependencies": {
-    "@podosoft/podokit-auth": "^0.3.0"
+    "@podosoft/podokit-auth": "^0.4.0"
   }
 }

package/dist/templates/modules/auth/files/apps/api/src/auth/account-issuer-migration.spec.ts

@@ -0,0 +1,88 @@
+import { describe, expect, it } from "bun:test";
+import { Database } from "bun:sqlite";
+import {
+  migrateLegacyAccountIssuers,
+  migrateSqliteLegacyAccountIssuers,
+  type AccountIssuerMigrationClient,
+} from "./account-issuer-migration";
+
+class AccountClient implements AccountIssuerMigrationClient {
+  readonly statements: string[] = [];
+  released = false;
+  constructor(private readonly table = true, private readonly issuer = true, private readonly collisions = 0) {}
+  async query<Row extends Record<string, unknown>>(sql: string): Promise<readonly Row[]> {
+    this.statements.push(sql.trim());
+    if (sql.includes("to_regclass")) return [{ exists: this.table }] as unknown as Row[];
+    if (sql.includes("pg_attribute")) return [{ exists: this.issuer }] as unknown as Row[];
+    if (sql.includes("AS collisions")) return [{ count: this.collisions }] as unknown as Row[];
+    return [];
+  }
+  release(): void { this.released = true; }
+}
+
+async function migrate(client: AccountClient): Promise<string> {
+  return migrateLegacyAccountIssuers({ connect: async (): Promise<AccountIssuerMigrationClient> => client });
+}
+
+function legacyDatabase(): Database {
+  const database = new Database(":memory:");
+  database.run('CREATE TABLE account (id text PRIMARY KEY, "providerId" text NOT NULL, "accountId" text NOT NULL, "userId" text NOT NULL, password text, issuer text NOT NULL)');
+  database.run('CREATE UNIQUE INDEX "account_issuer_accountId_uidx" ON account (issuer, "accountId")');
+  database.run('INSERT INTO account VALUES (\'account\', \'credential\', \'user\', \'user\', \'password-hash\', \'local:credential\')');
+  return database;
+}
+
+describe("Better Auth account identity cleanup", () => {
+  it("leaves an absent PostgreSQL table to the auth migrator", async (): Promise<void> => {
+    const client = new AccountClient(false);
+    expect(await migrate(client)).toBe("absent");
+    expect(client.statements.at(-1)).toBe("COMMIT");
+    expect(client.released).toBe(true);
+  });
+  it("relaxes legacy PostgreSQL constraints without rewriting account data", async (): Promise<void> => {
+    const client = new AccountClient();
+    expect(await migrate(client)).toBe("migrated");
+    expect(client.statements.some((sql) => sql.includes('ALTER COLUMN "issuer" DROP NOT NULL'))).toBe(true);
+    expect(client.statements.some((sql) => sql.startsWith("UPDATE") || sql.startsWith("DELETE"))).toBe(false);
+    expect(client.statements.at(-1)).toBe("COMMIT");
+    expect(client.released).toBe(true);
+  });
+  it("does not add issuer to a current PostgreSQL schema", async (): Promise<void> => {
+    const client = new AccountClient(true, false);
+    expect(await migrate(client)).toBe("current");
+    expect(client.statements.some((sql) => sql.includes("ADD COLUMN") || sql.includes("ALTER COLUMN"))).toBe(false);
+  });
+  it("rolls back PostgreSQL identity collisions before changing constraints", async (): Promise<void> => {
+    const client = new AccountClient(true, true, 1);
+    await expect(migrate(client)).rejects.toThrow("duplicate providerId and accountId");
+    expect(client.statements.at(-1)).toBe("ROLLBACK");
+    expect(client.statements.some((sql) => sql.startsWith("ALTER") || sql.startsWith("DROP"))).toBe(false);
+    expect(client.released).toBe(true);
+  });
+  it("leaves an absent SQLite table to the auth migrator", (): void => {
+    const database = new Database(":memory:");
+    try { expect(migrateSqliteLegacyAccountIssuers(database)).toBe("absent"); }
+    finally { database.close(); }
+  });
+  it("preserves SQLite accounts, accepts new rows without issuer, and can rerun", (): void => {
+    const database = legacyDatabase();
+    try {
+      expect(migrateSqliteLegacyAccountIssuers(database)).toBe("migrated");
+      expect(database.query('SELECT "userId", password FROM account').get()).toEqual({ userId: "user", password: "password-hash" });
+      database.run('INSERT INTO account (id, "providerId", "accountId", "userId") VALUES (\'new\', \'github\', \'user\', \'user\')');
+      expect(migrateSqliteLegacyAccountIssuers(database)).toBe("current");
+      expect(database.query('SELECT count(*) AS count FROM account').get()).toEqual({ count: 2 });
+      expect(() => database.run('INSERT INTO account (id, "providerId", "accountId", "userId") VALUES (\'duplicate\', \'github\', \'user\', \'other\')')).toThrow();
+    } finally { database.close(); }
+  });
+  it("rolls back SQLite collisions without losing rows, issuer, or its index", (): void => {
+    const database = legacyDatabase();
+    try {
+      database.run('INSERT INTO account VALUES (\'collision\', \'credential\', \'user\', \'other\', \'other-hash\', \'other-issuer\')');
+      expect(() => migrateSqliteLegacyAccountIssuers(database)).toThrow("duplicate providerId and accountId");
+      expect(database.query('SELECT count(*) AS count FROM account').get()).toEqual({ count: 2 });
+      expect(database.query('SELECT issuer FROM account WHERE id = \'account\'').get()).toEqual({ issuer: "local:credential" });
+      expect(database.query('SELECT name FROM sqlite_master WHERE name = \'account_issuer_accountId_uidx\'').get()).toBeTruthy();
+    } finally { database.close(); }
+  });
+});