@podosoft/podokit 1.1.2 → 1.1.5

package/README.md

@@ -7,11 +7,38 @@ through native `Bun.SQL`, Tailwind CSS v4, shadcn-svelte, Docker, and k3s assets
 The CLI itself remains Node-compatible, so either `npx` or `bunx` can create and
 maintain projects. Generated PodoKit v1 applications are Bun-only.
 
+## Choose infrastructure
+
+`fullstack` is the default template. `todo` adds a working CRUD example; `base`
+is a minimal workspace with placeholder scripts. For a small working app, use
+`fullstack` or `todo` with local providers rather than choosing `base` just to
+avoid external infrastructure.
+
+| Capability | Default | Local alternative |
+| --- | --- | --- |
+| Database | `postgres` — PostgreSQL | `sqlite` — database file |
+| Cache | `redis` | `memory` — in-process cache |
+| Object storage | `s3` — AWS S3 or S3-compatible storage | `local` — local files |
+| Events | `redis` | `memory` — in-process events |
+| Jobs | `bullmq` — Redis queue and separate worker | `local` — database-backed embedded worker |
+
+A simple program, prototype, desktop app, or single-process service can use
+**SQLite, memory cache, and local files** without PostgreSQL, Redis, or S3.
+Providers can be mixed. Local providers require one API process.
+
+Only the database is selected during creation with `--database postgres|sqlite`.
+Other capabilities use `provider set` after creation; there are no `--cache` or
+`--storage` creation flags. Choosing SQLite alone leaves the other defaults
+unchanged. Creation records selections, while applying a provider or adding a
+feature installs the necessary optional implementation modules.
+
 ## Quick start
 
+### Default server setup
+
 ```bash
 npx @podosoft/podokit create my-app
-# or: bunx @podosoft/podokit create my-app
+# or: bunx --bun @podosoft/podokit create my-app
 
 cd my-app
 bun install
@@ -28,6 +55,26 @@ PostgreSQL or SQLite persistence:
 
 ![Generated todo app](https://raw.githubusercontent.com/podosoft-dev/podokit/main/docs/images/todo-app.png)
 
+### Small app with local providers
+
+```bash
+bunx --bun @podosoft/podokit create podokit --template todo --database sqlite --yes
+cd podokit
+bunx --bun @podosoft/podokit provider set cache memory --apply
+bunx --bun @podosoft/podokit provider set object-storage local --apply
+bunx --bun @podosoft/podokit provider set events memory --apply
+bunx --bun @podosoft/podokit provider set jobs local --apply
+bun install
+cp .env.example .env
+bun run --cwd apps/api migration:run
+```
+
+Run `bun run --cwd apps/api dev` and `bun run --cwd apps/web dev` in separate
+terminals and open `http://localhost:5001`. This host-process setup requires no
+Docker. SQLite and local files default to `./data/podokit.sqlite` and
+`./data/files`, relative to the API working directory. Memory state disappears
+on restart; files and the database-backed local jobs persist.
+
 ## Commands
 
 | Command | Purpose |
@@ -85,14 +132,21 @@ and [updating guide](https://github.com/podosoft-dev/podokit/blob/main/docs/upda
 
 ## Runtime providers
 
-Generated projects use stable capability contracts with server defaults
-(`postgres`, `redis`, `s3`, Redis events, and `bullmq`) and local alternatives
-(`sqlite`, memory cache/events, local files/jobs). `podo provider set` is a dry
-run by default and installs the selected implementation module on `--apply`.
-It changes code and configuration only; it never migrates or deletes data.
+Inspect active selections and available alternatives with `podo provider list`.
+`podo provider set` is a dry run by default and installs the selected
+implementation module on `--apply`. Configure providers before adding features:
+`file-upload` uses local storage when selected, and `job-progress` can use local
+jobs and memory events. Changes append settings to `.env.example`; merge them
+into an existing `.env` manually. Switching changes code and configuration only;
+it never migrates or deletes data.
+
+S3's development settings use Silo with `STORAGE_PROVIDER=minio`; use
+`STORAGE_PROVIDER=aws` for AWS S3. Local files use `LOCAL_STORAGE_PATH`.
 
 See the [runtime provider guide](https://github.com/podosoft-dev/podokit/blob/main/docs/providers.md)
 before switching an existing project.
+For the complete creation sequence, see
+[Getting Started](https://github.com/podosoft-dev/podokit/blob/main/docs/getting-started.md).
 
 ## Compatibility boundary
 

package/dist/templates/base/AGENTS.md

@@ -5,19 +5,25 @@ by [PodoKit](https://github.com/podosoft-dev/podokit).
 
 ## Project overview
 
-A minimal Bun 1.4 workspace starter. Build it up from here — add features with the
-`podo` CLI (`podo add <module>`; run `podo add` with no argument to list them).
+A minimal Bun 1.4 workspace starter with placeholder API/web scripts. Build your
+own foundation here. Modules requiring the fullstack service registry, provider
+consumers, or injection points cannot be added directly to this skeleton.
+
+For a simple working full-stack app, create `fullstack` or `todo` with SQLite,
+memory cache/events, local files, and local jobs. Those templates support local
+providers independently of template choice and need one API process. See
+[Getting Started](https://github.com/podosoft-dev/podokit/blob/main/docs/getting-started.md).
 
 ## Commands
 
 ```bash
 {{packageManager}} install
-{{rootRun}} dev      # runs workspace dev scripts
 {{rootRun}} build
 {{rootRun}} lint     # type-check
 {{rootRun}} test
 ```
 
+The generated scripts are placeholders; implement them before running the app.
 ## Code style
 
 - TypeScript `strict`. **No `any`** (use `unknown` + narrowing), no `@ts-ignore`.

package/dist/templates/base/README.md

@@ -2,18 +2,22 @@
 
 Generated with [PodoKit](https://github.com/podosoft-dev/podokit).
 
-A minimal Bun 1.4 TypeScript workspace. Add the `fullstack` template when you
-need an Elysia API and SvelteKit web application.
+A minimal Bun 1.4 TypeScript workspace with placeholder API/web scripts. Choose
+`fullstack` or `todo` when creating a project that needs the working Elysia API,
+SvelteKit web app, database integration, or feature modules.
+
+For a simple working app, those templates support SQLite, memory cache/events,
+local files, and local jobs without external PostgreSQL, Redis, or S3 services.
+`base` is for building your own foundation; it does not include the provider
+consumers or module integration points. See
+[Getting Started](https://github.com/podosoft-dev/podokit/blob/main/docs/getting-started.md).
 
 ## Getting started
 
 ```bash
 {{packageManager}} install
-{{packageManager}} run dev
-```
-
-Copy the example environment file before running:
-
-```bash
 cp .env.example .env
 ```
+
+Implement the workspace scripts before running the application. The generated
+`dev` commands are placeholders and do not start services.

package/dist/templates/fullstack/AGENTS.md

@@ -16,18 +16,36 @@ A Bun 1.4 full-stack TypeScript monorepo ({{packageManager}} workspaces):
 
 ## Setup & commands
 
+Inspect active infrastructure with `podo provider list`. New-project defaults
+are `database=postgres`, `cache=redis`, `object-storage=s3`, `events=redis`, and
+`jobs=bullmq`. A simple single-process app can instead use `sqlite`, `memory`
+cache/events, `local` files, and `local` jobs. Only the database has a creation
+flag (`--database`); apply other choices using
+`podo provider set <capability> <provider> --apply` before adding features.
+Provider selection does not migrate or delete existing data.
+
 ```bash
 {{packageManager}} install
 cp .env.example .env
-docker compose -f infra/docker/docker-compose.yml up -d   # selected external providers only
+{{apiRun}} migration:run
 {{rootRun}} dev        # api on http://localhost:5002, web on http://localhost:5001
 ```
 
+For PostgreSQL, start `docker compose -f infra/docker/docker-compose.yml up -d`
+before migrating. Add `--profile cache` for Redis; Silo uses the overlay from
+`object-storage-s3`. Skip external services entirely for the complete local
+combination. `podo dev watch` is a separate container workflow and requires
+Docker. SQLite and local files default to `./data/podokit.sqlite` and
+`./data/files` relative to the API working directory; migrations and runtime
+must use the same database path. Keep local providers at one API process.
+Merge added module settings from `.env.example` into an existing `.env`.
+
 - **Ports: web = 5001, api = 5002.** The web app reaches the API only through its
   SvelteKit server proxy (`/api/*`), never with a direct browser `fetch`.
 - Build: `{{rootRun}} build`  ·  Type-check/lint: `{{rootRun}} lint`  ·  Unit tests: `{{rootRun}} test`
 - Per workspace: `{{apiRun}} build` / `{{webRun}} build`.
-- DB migrations (TypeORM migration layer only): `{{apiRun}} migration:run`.
+- Application migrations (PostgreSQL or SQLite): `{{apiRun}} migration:run`.
+- When `auth` is installed, run `{{apiRun}} migrate:all` for Better Auth and application tables.
 - e2e (Playwright, ships in `tests/`): `{{rootRun}} test:e2e`.
 - Playwright officially runs on Node, so `bunx playwright` respects its Node
   shebang. Node LTS is a test-tool dependency only; API, web, worker, migrations,

package/dist/templates/fullstack/README.md

@@ -2,9 +2,47 @@
 
 Full-stack TypeScript starter generated with [PodoKit](https://github.com/podosoft-dev/podokit).
 
-- `apps/api` — Bun 1.4 + Elysia API: schema-validated env, `/health` + `/health/ready`, merged OpenAPI at `/api-docs`, a standard error envelope, and Bun.SQL + PostgreSQL. TypeORM is used only to execute migrations.
+- `apps/api` — Bun 1.4 + Elysia API: schema-validated env, `/health` + `/health/ready`, merged OpenAPI at `/api-docs`, a standard error envelope, and Bun.SQL with PostgreSQL or SQLite. TypeORM is used only for PostgreSQL migrations; SQLite has its own migration runner.
 - `apps/web` — SvelteKit app (TailwindCSS v4, shadcn-svelte, typesafe-i18n) that talks to the API through a server-side proxy.
-- `infra/` — Docker Compose (PostgreSQL, Redis) and k3s manifests.
+- `infra/` — Docker Compose references for external services and k3s manifests.
+
+## Infrastructure choices
+
+Inspect the current selections with `{{packageExecutor}} @podosoft/podokit provider list`.
+New projects use these defaults unless configured otherwise:
+
+| Capability | Default | Lightweight alternative |
+| --- | --- | --- |
+| Database | `postgres` | `sqlite` |
+| Cache | `redis` | `memory` |
+| Object storage | `s3` | `local` |
+| Events | `redis` | `memory` |
+| Jobs | `bullmq` | `local` |
+
+For a simple program, prototype, or desktop app, SQLite, memory cache/events,
+local files, and local jobs can run inside one API process without PostgreSQL,
+Redis, or S3 services. `create --database sqlite` selects only the database;
+choose the other providers after creation:
+
+```bash
+{{packageExecutor}} @podosoft/podokit provider set cache memory --apply
+{{packageExecutor}} @podosoft/podokit provider set object-storage local --apply
+{{packageExecutor}} @podosoft/podokit provider set events memory --apply
+{{packageExecutor}} @podosoft/podokit provider set jobs local --apply
+```
+
+Apply providers before adding features, then install dependencies and merge new
+`.env.example` entries into `.env`. These commands install implementation modules
+and configure them; they do not move or delete data. SQLite defaults to
+`./data/podokit.sqlite`, and local files to `LOCAL_STORAGE_PATH=./data/files`,
+relative to the API working directory. Memory cache/events are lost on restart;
+the database, files, and local job records persist. Use absolute paths and back
+up the database and files together for packaged or production apps.
+
+Use the host-process setup below to avoid Docker. The containerized loop still
+requires Docker. See the PodoKit
+[runtime provider guide](https://github.com/podosoft-dev/podokit/blob/main/docs/providers.md)
+for server settings, Silo/AWS S3 configuration, and provider switching.
 
 ## Getting started
 
@@ -57,13 +95,27 @@ through Compose Watch, including Vite HMR on the same portless browser origin.
 
 ### Alternative: host processes
 
-Use this loop when you want only the web and API processes on the host:
+Use this loop for an app with SQLite and local providers, or when you want the
+web and API processes on the host. Prepare the project first:
+
+```bash
+{{packageManager}} install
+cp .env.example .env
+{{apiRun}} migration:run
+```
+
+For PostgreSQL, start `docker compose -f infra/docker/docker-compose.yml up -d`
+before migrating. Redis needs `--profile cache`; Silo needs the storage overlay
+added by `object-storage-s3`. Skip those services for the complete local setup.
+
+Run each service in a separate terminal from the project root:
 
 ```bash
-# start local PostgreSQL + Redis
-docker compose -f infra/docker/docker-compose.yml up -d
+{{apiRun}} dev # terminal 1
+```
 
-{{packageManager}} run dev
+```bash
+{{webRun}} dev # terminal 2
 ```
 
 - API: http://localhost:5002 — health at `/health`, docs at `/api-docs`
@@ -71,13 +123,18 @@ docker compose -f infra/docker/docker-compose.yml up -d
 
 ## Database & migrations
 
-The API uses Bun.SQL for request-time queries and TypeORM only as a migration
-runner. Add a numbered migration under `apps/api/src/migrations`, then run it:
+The API uses Bun.SQL with the selected PostgreSQL or SQLite database. TypeORM
+runs PostgreSQL migrations; SQLite uses the local migration runner. Add a
+numbered migration under `apps/api/src/migrations`, then run it:
 
 ```bash
 {{apiRun}} migration:run
 ```
 
+When `auth` is installed, use `{{apiRun}} migrate:all` to create or update both
+Better Auth and application tables. Set the module's required environment
+values before migrating.
+
 Want a worked example? Generate the `todo` template instead:
 `{{packageExecutor}} @podosoft/podokit create my-app --template todo`.
 

package/dist/templates/fullstack/apps/api/package.json

@@ -6,7 +6,7 @@
     "dev": "bun --watch src/main.ts",
     "build": "bun scripts/build.mjs",
     "start": "bun dist/main.js",
-    "lint": "bunx tsc -p tsconfig.json --noEmit",
+    "lint": "bunx --bun tsc -p tsconfig.json --noEmit",
     "test": "bun test src",
     "contract": "bun scripts/verify-api-contract.ts",
     "migrate:all": "bun dist/database/migrate.js",

package/dist/templates/modules/auth/files/apps/api/src/auth/account-issuer-migration.spec.ts

@@ -1,170 +1,88 @@
 import { describe, expect, it } from "bun:test";
-import { SUPPORTED_SOCIAL_PROVIDERS } from "@podosoft/podokit-auth";
+import { Database } from "bun:sqlite";
 import {
-  legacyAccountIssuer,
-  legacyAccountIssuerTriggerSql,
   migrateLegacyAccountIssuers,
+  migrateSqliteLegacyAccountIssuers,
   type AccountIssuerMigrationClient,
-  type AccountIssuerMigrationDatabase,
 } from "./account-issuer-migration";
 
-type Statement = { sql: string; values?: readonly unknown[] };
-type LegacyAccountOptions = {
-  tableExists?: boolean;
-  column?: { dataType: string; isNullable: "YES" | "NO" };
-  counts?: {
-    blankIssuer?: number;
-    credentialMismatch?: number;
-    unresolvedIssuer?: number;
-    collision?: number;
-  };
-};
-
-class LegacyAccountClient implements AccountIssuerMigrationClient {
-  readonly statements: Statement[] = [];
+class AccountClient implements AccountIssuerMigrationClient {
+  readonly statements: string[] = [];
   released = false;
-
-  constructor(
-    private readonly providers: readonly string[],
-    private readonly options: LegacyAccountOptions = {},
-  ) {}
-
-  async query<Row extends Record<string, unknown>>(
-    sql: string,
-    values?: readonly unknown[],
-  ): Promise<readonly Row[]> {
-    this.statements.push({ sql, ...(values ? { values } : {}) });
-    if (sql.includes("information_schema.tables")) {
-      return [{ exists: this.options.tableExists ?? true }] as unknown as Row[];
-    }
-    if (sql.includes("information_schema.columns")) {
-      return (this.options.column ? [this.options.column] : []) as unknown as Row[];
-    }
-    if (sql.includes('SELECT DISTINCT "providerId"')) {
-      return this.providers.map((providerId) => ({ providerId })) as unknown as Row[];
-    }
-    if (sql.includes('COUNT(*)::int AS "count"')) {
-      const count = sql.includes('"accountId" <> "userId"')
-        ? this.options.counts?.credentialMismatch
-        : sql.includes("AS collisions")
-          ? this.options.counts?.collision
-          : sql.includes('"issuer" IS NULL OR')
-            ? this.options.counts?.unresolvedIssuer
-            : this.options.counts?.blankIssuer;
-      return [{ count: count ?? 0 }] as unknown as Row[];
-    }
+  constructor(private readonly table = true, private readonly issuer = true, private readonly collisions = 0) {}
+  async query<Row extends Record<string, unknown>>(sql: string): Promise<readonly Row[]> {
+    this.statements.push(sql.trim());
+    if (sql.includes("to_regclass")) return [{ exists: this.table }] as unknown as Row[];
+    if (sql.includes("pg_attribute")) return [{ exists: this.issuer }] as unknown as Row[];
+    if (sql.includes("AS collisions")) return [{ count: this.collisions }] as unknown as Row[];
     return [];
   }
-
-  release(): void {
-    this.released = true;
-  }
+  release(): void { this.released = true; }
 }
 
-function database(client: LegacyAccountClient): AccountIssuerMigrationDatabase {
-  return { connect: async (): Promise<AccountIssuerMigrationClient> => client };
+async function migrate(client: AccountClient): Promise<string> {
+  return migrateLegacyAccountIssuers({ connect: async (): Promise<AccountIssuerMigrationClient> => client });
 }
 
-describe("Better Auth account issuer migration", () => {
-  it("maps every safely derivable provider and refuses identities that need trusted external data", () => {
-    expect(legacyAccountIssuer("credential")).toBe("local:credential");
-    expect(legacyAccountIssuer("google")).toBe("https://accounts.google.com");
-    expect(legacyAccountIssuer("apple")).toBe("https://appleid.apple.com");
-    expect(legacyAccountIssuer("facebook")).toBe("https://www.facebook.com");
-    expect(legacyAccountIssuer("line")).toBe("https://access.line.me");
-    expect(legacyAccountIssuer("github")).toBe("local:oauth:github");
-    expect(legacyAccountIssuer("microsoft")).toBeUndefined();
-    expect(legacyAccountIssuer("unknown-provider")).toBeUndefined();
-
-    for (const { id } of SUPPORTED_SOCIAL_PROVIDERS) {
-      if (id !== "microsoft") expect(legacyAccountIssuer(id), id).toBeDefined();
-    }
-  });
+function legacyDatabase(): Database {
+  const database = new Database(":memory:");
+  database.run('CREATE TABLE account (id text PRIMARY KEY, "providerId" text NOT NULL, "accountId" text NOT NULL, "userId" text NOT NULL, password text, issuer text NOT NULL)');
+  database.run('CREATE UNIQUE INDEX "account_issuer_accountId_uidx" ON account (issuer, "accountId")');
+  database.run('INSERT INTO account VALUES (\'account\', \'credential\', \'user\', \'user\', \'password-hash\', \'local:credential\')');
+  return database;
+}
 
-  it("installs a fail-closed compatibility trigger for the release that is still serving", () => {
-    const sql = legacyAccountIssuerTriggerSql();
-    expect(sql).toContain("BEFORE INSERT");
-    expect(sql).toContain('WHEN (NEW."issuer" IS NULL)');
-    expect(sql).toContain("NEW.\"accountId\" := NEW.\"userId\"");
-    expect(sql).toContain("RAISE EXCEPTION");
-    expect(sql).not.toContain("WHEN 'microsoft'");
+describe("Better Auth account identity cleanup", () => {
+  it("leaves an absent PostgreSQL table to the auth migrator", async (): Promise<void> => {
+    const client = new AccountClient(false);
+    expect(await migrate(client)).toBe("absent");
+    expect(client.statements.at(-1)).toBe("COMMIT");
+    expect(client.released).toBe(true);
   });
-
-  it("adds, backfills, validates, constrains, and indexes a legacy account table in one transaction", async () => {
-    const client = new LegacyAccountClient(["credential", "google", "github"]);
-
-    await expect(migrateLegacyAccountIssuers(database(client))).resolves.toBe("migrated");
-
-    const statements = client.statements.map(({ sql }) => sql.trim());
-    expect(statements[0]).toBe("BEGIN");
-    expect(statements.some((sql) => sql.includes('ADD COLUMN "issuer" text'))).toBe(true);
-    expect(
-      client.statements.some(
-        ({ sql, values }) => sql.includes('UPDATE "account"') && values?.[0] === "local:credential",
-      ),
-    ).toBe(true);
-    expect(
-      client.statements.some(
-        ({ sql, values }) => sql.includes('UPDATE "account"') && values?.[0] === "https://accounts.google.com",
-      ),
-    ).toBe(true);
-    expect(statements.some((sql) => sql.includes("CREATE TRIGGER podokit_fill_legacy_account_issuer"))).toBe(
-      true,
-    );
-    expect(statements.some((sql) => sql.includes('ALTER COLUMN "issuer" SET NOT NULL'))).toBe(true);
-    expect(statements.some((sql) => sql.includes('CREATE UNIQUE INDEX IF NOT EXISTS'))).toBe(true);
-    expect(statements.at(-1)).toBe("COMMIT");
+  it("relaxes legacy PostgreSQL constraints without rewriting account data", async (): Promise<void> => {
+    const client = new AccountClient();
+    expect(await migrate(client)).toBe("migrated");
+    expect(client.statements.some((sql) => sql.includes('ALTER COLUMN "issuer" DROP NOT NULL'))).toBe(true);
+    expect(client.statements.some((sql) => sql.startsWith("UPDATE") || sql.startsWith("DELETE"))).toBe(false);
+    expect(client.statements.at(-1)).toBe("COMMIT");
     expect(client.released).toBe(true);
   });
-
-  it("rolls back instead of guessing a Microsoft or unknown issuer", async () => {
-    const client = new LegacyAccountClient(["microsoft"]);
-
-    await expect(migrateLegacyAccountIssuers(database(client))).rejects.toThrow(
-      "Cannot infer a trusted Better Auth issuer for legacy provider microsoft",
-    );
-
-    expect(client.statements.map(({ sql }) => sql.trim())).toContain("ROLLBACK");
-    expect(client.statements.some(({ sql }) => sql.includes('SET NOT NULL'))).toBe(false);
+  it("does not add issuer to a current PostgreSQL schema", async (): Promise<void> => {
+    const client = new AccountClient(true, false);
+    expect(await migrate(client)).toBe("current");
+    expect(client.statements.some((sql) => sql.includes("ADD COLUMN") || sql.includes("ALTER COLUMN"))).toBe(false);
+  });
+  it("rolls back PostgreSQL identity collisions before changing constraints", async (): Promise<void> => {
+    const client = new AccountClient(true, true, 1);
+    await expect(migrate(client)).rejects.toThrow("duplicate providerId and accountId");
+    expect(client.statements.at(-1)).toBe("ROLLBACK");
+    expect(client.statements.some((sql) => sql.startsWith("ALTER") || sql.startsWith("DROP"))).toBe(false);
     expect(client.released).toBe(true);
   });
-
-  it("leaves a fresh database to the normal migrator and protects a current schema", async () => {
-    const absent = new LegacyAccountClient([], { tableExists: false });
-    const current = new LegacyAccountClient([], {
-      column: { dataType: "text", isNullable: "NO" },
-    });
-
-    await expect(migrateLegacyAccountIssuers(database(absent))).resolves.toBe("absent");
-    await expect(migrateLegacyAccountIssuers(database(current))).resolves.toBe("current");
-
-    expect(absent.statements.some(({ sql }) => sql.includes("CREATE TRIGGER"))).toBe(false);
-    expect(current.statements.some(({ sql }) => sql.includes("CREATE TRIGGER"))).toBe(true);
-    for (const client of [absent, current]) {
-      expect(client.statements.at(-1)?.sql.trim()).toBe("COMMIT");
-      expect(client.released).toBe(true);
-    }
+  it("leaves an absent SQLite table to the auth migrator", (): void => {
+    const database = new Database(":memory:");
+    try { expect(migrateSqliteLegacyAccountIssuers(database)).toBe("absent"); }
+    finally { database.close(); }
   });
-
-  it("rolls back before constraints when credentials mismatch or identity keys collide", async () => {
-    const mismatch = new LegacyAccountClient(["credential"], {
-      counts: { credentialMismatch: 1 },
-    });
-    const collision = new LegacyAccountClient(["google"], {
-      counts: { collision: 1 },
-    });
-
-    await expect(migrateLegacyAccountIssuers(database(mismatch))).rejects.toThrow(
-      "accountId differs from the linked userId",
-    );
-    await expect(migrateLegacyAccountIssuers(database(collision))).rejects.toThrow(
-      "collide on the new issuer and accountId identity key",
-    );
-
-    for (const client of [mismatch, collision]) {
-      expect(client.statements.map(({ sql }) => sql.trim())).toContain("ROLLBACK");
-      expect(client.statements.some(({ sql }) => sql.includes('SET NOT NULL'))).toBe(false);
-      expect(client.released).toBe(true);
-    }
+  it("preserves SQLite accounts, accepts new rows without issuer, and can rerun", (): void => {
+    const database = legacyDatabase();
+    try {
+      expect(migrateSqliteLegacyAccountIssuers(database)).toBe("migrated");
+      expect(database.query('SELECT "userId", password FROM account').get()).toEqual({ userId: "user", password: "password-hash" });
+      database.run('INSERT INTO account (id, "providerId", "accountId", "userId") VALUES (\'new\', \'github\', \'user\', \'user\')');
+      expect(migrateSqliteLegacyAccountIssuers(database)).toBe("current");
+      expect(database.query('SELECT count(*) AS count FROM account').get()).toEqual({ count: 2 });
+      expect(() => database.run('INSERT INTO account (id, "providerId", "accountId", "userId") VALUES (\'duplicate\', \'github\', \'user\', \'other\')')).toThrow();
+    } finally { database.close(); }
+  });
+  it("rolls back SQLite collisions without losing rows, issuer, or its index", (): void => {
+    const database = legacyDatabase();
+    try {
+      database.run('INSERT INTO account VALUES (\'collision\', \'credential\', \'user\', \'other\', \'other-hash\', \'other-issuer\')');
+      expect(() => migrateSqliteLegacyAccountIssuers(database)).toThrow("duplicate providerId and accountId");
+      expect(database.query('SELECT count(*) AS count FROM account').get()).toEqual({ count: 2 });
+      expect(database.query('SELECT issuer FROM account WHERE id = \'account\'').get()).toEqual({ issuer: "local:credential" });
+      expect(database.query('SELECT name FROM sqlite_master WHERE name = \'account_issuer_accountId_uidx\'').get()).toBeTruthy();
+    } finally { database.close(); }
   });
 });