emdash 0.21.0 → 0.22.0

package/src/astro/routes/api/comments/[collection]/[contentId]/reactions.ts

@@ -0,0 +1,97 @@
+/**
+ * Public comment reaction endpoints (Tier 1 of the best-in-class comments RFC).
+ *
+ * GET  /_emdash/api/comments/:collection/:contentId/reactions
+ *   - Aggregate reaction counts for the content's approved comments, plus the
+ *     current visitor's active reactions.
+ * POST /_emdash/api/comments/:collection/:contentId/reactions
+ *   - Toggle a reaction on a comment. Public, honeypot- and rate-limit-gated.
+ *
+ * Inherits the `/_emdash/api/comments/` public prefix (no auth); the POST still
+ * requires the `X-EmDash-Request: 1` CSRF header like the comment POST.
+ */
+
+import type { APIRoute } from "astro";
+
+import { apiError, apiSuccess, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReactionCounts, handleReactionToggle } from "#api/handlers/comment-reactions.js";
+import { hashIp } from "#api/handlers/comments.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { createReactionBody } from "#api/schemas.js";
+import { resolveSecretsCached } from "#config/secrets.js";
+import { extractRequestMeta } from "#plugins/request-meta.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash } = locals;
+	const { collection, contentId } = params;
+
+	if (!collection || !contentId) {
+		return apiError("VALIDATION_ERROR", "Collection and content ID required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	try {
+		// Salted voter hash from request IP (same primitive as comment ip_hash).
+		// Behind Cloudflare (CF-Connecting-IP) or a configured trusted proxy this
+		// is per-visitor. Without a trusted IP it collapses to a shared "unknown"
+		// bucket, so reaction dedup degrades for those visitors — a real
+		// per-visitor token is Tier 2 (visitor identity). Operators should set
+		// trustedProxyHeaders; see the comment ingest route for the same note.
+		const meta = extractRequestMeta(request, emdash.config);
+		let voterHash = "unknown";
+		if (meta.ip) {
+			const { ipSalt } = await resolveSecretsCached(emdash.db);
+			voterHash = await hashIp(meta.ip, ipSalt);
+		}
+
+		const result = await handleReactionCounts(emdash.db, collection, contentId, voterHash);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to read reactions", "REACTION_COUNTS_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash } = locals;
+	const { collection, contentId } = params;
+
+	if (!collection || !contentId) {
+		return apiError("VALIDATION_ERROR", "Collection and content ID required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	try {
+		const body = await parseBody(request, createReactionBody);
+		if (isParseError(body)) return body;
+
+		// Anti-spam: honeypot — hidden field filled only by bots. Silently accept.
+		if (body.website_url) {
+			return apiSuccess({ reacted: false, counts: {} });
+		}
+
+		const meta = extractRequestMeta(request, emdash.config);
+		let voterHash = "unknown";
+		if (meta.ip) {
+			const { ipSalt } = await resolveSecretsCached(emdash.db);
+			voterHash = await hashIp(meta.ip, ipSalt);
+		}
+
+		const result = await handleReactionToggle(emdash.db, {
+			collection,
+			contentId,
+			commentId: body.commentId,
+			reaction: body.reaction,
+			voterHash,
+		});
+
+		return unwrapResult(result, 200);
+	} catch (error) {
+		return handleError(error, "Failed to toggle reaction", "REACTION_TOGGLE_ERROR");
+	}
+};

package/src/astro/routes/api/setup/dev-bypass.ts

@@ -23,7 +23,7 @@ import { ulid } from "ulidx";
 
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { escapeHtml } from "#api/escape.js";
-import { handleApiTokenCreate } from "#api/handlers/api-tokens.js";
+import { deleteApiTokensByName, handleApiTokenCreate } from "#api/handlers/api-tokens.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { isSafeRedirect } from "#api/redirect.js";
 import { runMigrations } from "#db/migrations/runner.js";
@@ -134,6 +134,10 @@ async function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Respon
 		// Optionally create a PAT token (?token=1) for headless/CLI testing.
 		let token: string | undefined;
 		if (url.searchParams.has("token")) {
+			// Idempotent by name: a prior reset can leave a stale dev-bypass-token,
+			// and the raw token is only available at creation, so drop any existing
+			// one and mint a fresh, usable PAT rather than accumulating duplicates.
+			await deleteApiTokensByName(emdash.db, user.id, "dev-bypass-token");
 			const result = await handleApiTokenCreate(emdash.db, user.id, {
 				name: "dev-bypass-token",
 				scopes: [

package/src/astro/routes/api/snapshot.ts

@@ -20,6 +20,8 @@ import {
 import { getPublicOrigin } from "#api/public-url.js";
 import { resolveSecretsCached } from "#config/secrets.js";
 
+import { resolveSessionUser } from "../../session-user.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ request, locals, url, session }) => {
@@ -31,7 +33,7 @@ export const GET: APIRoute = async ({ request, locals, url, session }) => {
 	if (!user && session && emdash?.db) {
 		try {
 			const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
-			const sessionUser = await session.get("user");
+			const sessionUser = await resolveSessionUser(session);
 			if (sessionUser?.id) {
 				const adapter = createKyselyAdapter(emdash.db);
 				const resolved = await adapter.getUserById(sessionUser.id);

package/src/astro/session-user.ts

@@ -0,0 +1,57 @@
+import { after } from "../after.js";
+
+/**
+ * Backstop timeout for resolving the session user. A live session-store read
+ * settles in a few ms, so this only ever fires on a genuinely stalled read.
+ */
+export const SESSION_GET_TIMEOUT_MS = 3_000;
+
+/**
+ * Resolve the Astro session user without risking an isolate-wide hang.
+ *
+ * On Cloudflare Workers, a request cancelled mid-`session.get()` (client
+ * disconnect, context teardown) can leave the underlying session-store read as
+ * a promise that never settles — neither resolving nor rejecting. Awaiting it
+ * directly hangs the request, and because the stalled promise is shared at the
+ * isolate level, every later session-bearing request hangs too (observed as
+ * 0-CPU, multi-minute, `canceled` responses; see #1274). A surrounding
+ * try/catch cannot help: the promise never rejects.
+ *
+ * Two layers, mirroring the reclaimable-cache pattern used elsewhere in core:
+ *  1. `after()` anchors the read so a cancelled request still drives it to
+ *     completion — the promise settles and the isolate is not poisoned for
+ *     subsequent requests (prevents the hang rather than merely surviving it).
+ *  2. A timeout is a fail-closed backstop: a still-stalled (or rejecting) read
+ *     resolves to `undefined`, and every caller treats the absence of a session
+ *     user as unauthenticated (anonymous on public routes, 401/redirect on
+ *     protected ones). It can only ever drop privileges for that one request,
+ *     never grant them.
+ *
+ * Used by every session read on the request path: the main middleware (the
+ * first read on a session-bearing request), the auth middleware, and the
+ * preview-snapshot route (which bypasses the auth middleware).
+ */
+export async function resolveSessionUser<T>(
+	session: { get(key: "user"): Promise<T> } | undefined,
+	timeoutMs = SESSION_GET_TIMEOUT_MS,
+): Promise<T | undefined> {
+	if (!session) return undefined;
+	const read: Promise<T | undefined> = Promise.resolve(session.get("user")).catch(() => undefined);
+	// Keep the worker alive past response/cancellation so the read completes and
+	// the shared promise settles — this is what prevents the isolate poisoning.
+	after(() =>
+		read.then(
+			() => undefined,
+			() => undefined,
+		),
+	);
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const timeout = new Promise<undefined>((resolve) => {
+		timer = setTimeout(resolve, timeoutMs, undefined);
+	});
+	try {
+		return await Promise.race([read, timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+}

package/src/astro/types.ts

@@ -265,6 +265,7 @@ export interface EmDashHandlers {
 			slug?: string;
 			status?: string;
 			authorId?: string;
+			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
 			locale?: string;
 			translationOf?: string;
 			createdAt?: string | null;

package/src/comments/query.ts

@@ -7,15 +7,26 @@
 
 import type { Kysely } from "kysely";
 
+import { CommentReactionRepository } from "../database/repositories/comment-reaction.js";
 import { CommentRepository } from "../database/repositories/comment.js";
 import type { PublicComment } from "../database/repositories/comment.js";
 import type { Database } from "../database/types.js";
 import { getDb } from "../loader.js";
+import { cachedQuery, CacheNamespace } from "../object-cache/index.js";
+import { reactionScore } from "./ranking.js";
 
 export interface GetCommentsOptions {
 	collection: string;
 	contentId: string;
 	threaded?: boolean;
+	/** Attach aggregate reaction counts to each comment. */
+	reactions?: boolean;
+	/**
+	 * Order of top-level comments. `oldest` (default) preserves the existing
+	 * chronological display; `best` ranks by Wilson-scored reactions (implies
+	 * `reactions`). Replies always stay chronological.
+	 */
+	sort?: "oldest" | "best";
 }
 
 export interface GetCommentsResult {
@@ -38,8 +49,21 @@ export interface GetCommentsResult {
  * ```
  */
 export async function getComments(options: GetCommentsOptions): Promise<GetCommentsResult> {
-	const db = await getDb();
-	return getCommentsWithDb(db, options);
+	// The result varies by every option getCommentsWithDb branches on, so all of
+	// them belong in the key. `best` implies reactions, so normalize the reaction
+	// flag — `{ sort: "best" }` and `{ sort: "best", reactions: true }` produce
+	// identical output and should share one entry.
+	const sort = options.sort ?? "oldest";
+	const withReactions = options.reactions || sort === "best";
+	const threaded = options.threaded ? "t" : "f";
+	return cachedQuery({
+		namespace: CacheNamespace.COMMENTS,
+		key: `comments:${options.collection}:${options.contentId}:${threaded}:${withReactions ? "r" : "n"}:${sort}`,
+		load: async () => {
+			const db = await getDb();
+			return getCommentsWithDb(db, options);
+		},
+	});
 }
 
 /**
@@ -65,16 +89,63 @@ export async function getCommentsWithDb(
 		limit: MAX_COMMENTS,
 	});
 
-	if (options.threaded) {
-		const threaded = CommentRepository.assembleThreads(result.items);
-		const items = threaded.map((c) => CommentRepository.toPublicComment(c));
-		return { items, total };
+	const items: PublicComment[] = options.threaded
+		? CommentRepository.assembleThreads(result.items).map((c) =>
+				CommentRepository.toPublicComment(c),
+			)
+		: result.items.map((c) => CommentRepository.toPublicComment(c));
+
+	// `best` sort needs reaction data, so it implies reactions.
+	if (options.reactions || options.sort === "best") {
+		await attachReactions(db, items);
+		if (options.sort === "best") {
+			sortByBest(items);
+		}
 	}
 
-	const items = result.items.map((c) => CommentRepository.toPublicComment(c));
 	return { items, total };
 }
 
+/**
+ * Attach aggregate reaction counts to a list of public comments (and their
+ * replies), in a single batched query.
+ */
+async function attachReactions(db: Kysely<Database>, items: PublicComment[]): Promise<void> {
+	const ids: string[] = [];
+	for (const comment of items) {
+		ids.push(comment.id);
+		if (comment.replies) {
+			for (const reply of comment.replies) ids.push(reply.id);
+		}
+	}
+	if (ids.length === 0) return;
+
+	const counts = await new CommentReactionRepository(db).countsForComments(ids);
+
+	const assign = (comment: PublicComment) => {
+		const reactions = counts.get(comment.id);
+		if (reactions) comment.reactions = reactions;
+	};
+	for (const comment of items) {
+		assign(comment);
+		comment.replies?.forEach(assign);
+	}
+}
+
+/**
+ * Sort top-level comments by Wilson-scored reactions (descending), tie-broken
+ * by oldest-first to keep ordering stable.
+ */
+function sortByBest(items: PublicComment[]): void {
+	items.sort((a, b) => {
+		const scoreDelta = reactionScore(b.reactions ?? {}) - reactionScore(a.reactions ?? {});
+		if (scoreDelta !== 0) return scoreDelta;
+		if (a.createdAt < b.createdAt) return -1;
+		if (a.createdAt > b.createdAt) return 1;
+		return 0;
+	});
+}
+
 /**
  * Get the count of approved comments for a content item.
  *

package/src/comments/ranking.ts

@@ -0,0 +1,58 @@
+/**
+ * Comment ranking utilities (Tier 1 of the best-in-class comments RFC).
+ *
+ * Wilson score lower-bound (95% confidence) — the same primitive Reddit uses
+ * for its "Best" comment sort. Ranks by the statistical lower bound of the
+ * positive-reaction proportion rather than the raw count, so a comment with a
+ * couple of reactions can't outrank a heavily-reacted one until it earns
+ * confidence, and a late-but-popular comment still rises (submission time is
+ * irrelevant).
+ *
+ * Positive-only reactions (the recommended default) degrade gracefully: with
+ * `down = 0` the score still increases monotonically with `up` while penalising
+ * low-sample comments — wilson(1,0) ≈ 0.21, wilson(10,0) ≈ 0.73,
+ * wilson(200,0) ≈ 0.98.
+ */
+
+/** z for a 95% two-sided confidence interval. */
+const DEFAULT_Z = 1.96;
+
+/** Reactions that count against a comment when both signals are in use. */
+const NEGATIVE_REACTIONS: ReadonlySet<string> = new Set(["dislike", "down"]);
+
+/**
+ * Wilson score lower bound of the positive proportion.
+ *
+ * @param up   count of positive reactions
+ * @param down count of negative reactions
+ * @returns a score in [0, 1]; 0 when there are no reactions
+ */
+export function wilsonLowerBound(up: number, down: number, z: number = DEFAULT_Z): number {
+	const n = up + down;
+	if (n <= 0) return 0;
+	const phat = up / n;
+	const z2 = z * z;
+	const denom = 1 + z2 / n;
+	const centre = phat + z2 / (2 * n);
+	const margin = z * Math.sqrt((phat * (1 - phat) + z2 / (4 * n)) / n);
+	return (centre - margin) / denom;
+}
+
+/**
+ * Reduce a per-reaction count map to a single rank score via the Wilson
+ * lower bound. Any reaction not in {@link NEGATIVE_REACTIONS} is treated as
+ * positive, so the positive-only default (just `like`) works without special
+ * casing.
+ */
+export function reactionScore(counts: Record<string, number>): number {
+	let up = 0;
+	let down = 0;
+	for (const [reaction, count] of Object.entries(counts)) {
+		if (NEGATIVE_REACTIONS.has(reaction)) {
+			down += count;
+		} else {
+			up += count;
+		}
+	}
+	return wilsonLowerBound(up, down);
+}

package/src/components/Comments.astro

@@ -21,6 +21,10 @@ interface Props {
 	collection: string;
 	contentId: string;
 	threaded?: boolean;
+	/** Show a like/reaction button per comment (opt-in). */
+	reactions?: boolean;
+	/** Order of top-level comments: chronological (default) or Wilson-ranked. */
+	sort?: "oldest" | "best";
 	class?: string;
 }
 
@@ -28,13 +32,15 @@ const {
 	collection,
 	contentId,
 	threaded = false,
+	reactions = false,
+	sort = "oldest",
 	class: className,
 } = Astro.props;
 
 const collectionInfo = await getCollectionInfo(collection);
 const enabled = collectionInfo?.commentsEnabled ?? false;
 const { items, total } = enabled
-	? await getComments({ collection, contentId, threaded })
+	? await getComments({ collection, contentId, threaded, reactions, sort })
 	: { items: [], total: 0 };
 
 const URL_RE = /https?:\/\/[^\s<>"')\]]+/g;
@@ -62,15 +68,72 @@ function escapeHtml(text: string): string {
 function formatBody(text: string): string {
 	return autoLinkUrls(escapeHtml(text));
 }
+
+// Progressive-enhancement script for reactions. Emitted verbatim (is:inline)
+// only when `reactions` is enabled, so non-reaction pages ship zero extra JS.
+// Avoids template literals internally so it survives the outer backticks.
+const REACTION_SCRIPT = `
+(() => {
+  const sections = document.querySelectorAll('[data-ec-comments][data-ec-reactions]');
+  sections.forEach((section) => {
+    const collection = section.getAttribute('data-collection');
+    const contentId = section.getAttribute('data-content-id');
+    if (!collection || !contentId) return;
+    const base = '/_emdash/api/comments/' + encodeURIComponent(collection) + '/' + encodeURIComponent(contentId) + '/reactions';
+    const headers = { 'X-EmDash-Request': '1' };
+
+    fetch(base, { headers: headers })
+      .then((r) => (r.ok ? r.json() : null))
+      .then((payload) => {
+        const viewer = payload && payload.data && payload.data.viewer;
+        if (!viewer) return;
+        Object.keys(viewer).forEach((commentId) => {
+          (viewer[commentId] || []).forEach((reaction) => {
+            const sel = '.ec-reaction[data-comment-id="' + commentId + '"][data-ec-reaction="' + reaction + '"]';
+            const btn = section.querySelector(sel);
+            if (btn) btn.setAttribute('aria-pressed', 'true');
+          });
+        });
+      })
+      .catch(() => {});
+
+    section.addEventListener('click', (event) => {
+      const btn = event.target.closest('.ec-reaction');
+      if (!btn || !section.contains(btn)) return;
+      const commentId = btn.getAttribute('data-comment-id');
+      const reaction = btn.getAttribute('data-ec-reaction');
+      if (!commentId || !reaction) return;
+      btn.disabled = true;
+      fetch(base, {
+        method: 'POST',
+        headers: Object.assign({ 'Content-Type': 'application/json' }, headers),
+        body: JSON.stringify({ commentId: commentId, reaction: reaction }),
+      })
+        .then((r) => (r.ok ? r.json() : null))
+        .then((payload) => {
+          const data = payload && payload.data;
+          if (!data) return;
+          btn.setAttribute('aria-pressed', data.reacted ? 'true' : 'false');
+          const countEl = btn.querySelector('[data-ec-reaction-count]');
+          if (countEl) countEl.textContent = String((data.counts && data.counts[reaction]) || 0);
+        })
+        .catch(() => {})
+        .finally(() => { btn.disabled = false; });
+    });
+  });
+})();
+`;
 ---
 
 {
 	enabled && (
+		<Fragment>
 		<section
 			class:list={["ec-comments", className]}
 			data-ec-comments
 			data-collection={collection}
 			data-content-id={contentId}
+			{...(reactions ? { "data-ec-reactions": "" } : {})}
 		>
 			<h3 class="ec-comments-heading">
 				{total === 0
@@ -112,6 +175,25 @@ function formatBody(text: string): string {
 									class="ec-comment-body"
 									set:html={formatBody(comment.body)}
 								/>
+								{reactions && (
+									<div class="ec-comment-actions">
+										<button
+											type="button"
+											class="ec-reaction"
+											data-ec-reaction="like"
+											data-comment-id={comment.id}
+											aria-pressed="false"
+										>
+											<span class="ec-reaction-icon" aria-hidden="true">
+												&#x2661;
+											</span>
+											<span class="ec-reaction-label">Like</span>
+											<span class="ec-reaction-count" data-ec-reaction-count>
+												{comment.reactions?.like ?? 0}
+											</span>
+										</button>
+									</div>
+								)}
 								{threaded && comment.replies && comment.replies.length > 0 && (
 									<ol class="ec-comment-replies">
 										{comment.replies.map((reply: PublicComment) => (
@@ -153,6 +235,21 @@ function formatBody(text: string): string {
 														class="ec-comment-body"
 														set:html={formatBody(reply.body)}
 													/>
+													{reactions && (
+														<div class="ec-comment-actions">
+															<button
+																type="button"
+																class="ec-reaction"
+																data-ec-reaction="like"
+																data-comment-id={reply.id}
+																aria-pressed="false"
+															>
+																<span class="ec-reaction-icon" aria-hidden="true">&#x2661;</span>
+																<span class="ec-reaction-label">Like</span>
+																<span class="ec-reaction-count" data-ec-reaction-count>{reply.reactions?.like ?? 0}</span>
+															</button>
+														</div>
+													)}
 												</article>
 											</li>
 										))}
@@ -164,6 +261,8 @@ function formatBody(text: string): string {
 				</ol>
 			)}
 		</section>
+		{reactions && <script is:inline set:html={REACTION_SCRIPT} />}
+		</Fragment>
 	)
 }
 
@@ -229,4 +328,40 @@ function formatBody(text: string): string {
 		white-space: pre-wrap;
 		word-break: break-word;
 	}
+
+	.ec-comment-actions {
+		margin-top: 0.5rem;
+	}
+
+	.ec-reaction {
+		display: inline-flex;
+		align-items: center;
+		gap: 0.35rem;
+		font: inherit;
+		font-size: 0.875em;
+		color: inherit;
+		background: none;
+		border: var(--ec-comment-border);
+		border-radius: 999px;
+		padding: 0.15rem 0.6rem;
+		cursor: pointer;
+	}
+
+	.ec-reaction[aria-pressed="true"] {
+		border-color: currentColor;
+		font-weight: 600;
+	}
+
+	.ec-reaction[aria-pressed="true"] .ec-reaction-icon {
+		color: #e0245e;
+	}
+
+	.ec-reaction:disabled {
+		opacity: 0.5;
+		cursor: default;
+	}
+
+	.ec-reaction-count {
+		font-variant-numeric: tabular-nums;
+	}
 </style>

package/src/database/instrumentation.ts

@@ -33,6 +33,19 @@ export interface QueryRecorder {
 	route: string;
 	method: string;
 	phase: string;
+	/**
+	 * Set once the recorder has been emitted, so a flush is idempotent.
+	 * Without this, a fallback flush and the stream-end flush could both
+	 * fire and double-emit the events.
+	 */
+	flushed?: boolean;
+	/**
+	 * Set when the response body is wrapped for stream-end metrics. The
+	 * recorder is then flushed when the body finishes streaming (so it
+	 * captures queries issued by components during streaming) rather than
+	 * when middleware returns (headers ready, body not yet streamed).
+	 */
+	deferredFlush?: boolean;
 }
 
 export function createRecorder(route: string, method: string, phase: string): QueryRecorder {
@@ -60,9 +73,16 @@ export function recordEvent(
  * harness pipes the child's stdout, filters lines beginning with
  * QUERY_LOG_PREFIX, and writes them to its own file. Using stdout means
  * the sink works uniformly in Node and in workerd (which has no fs).
+ *
+ * Idempotent: the first call emits and marks the recorder flushed, later
+ * calls no-op. For streamed responses the flush is deferred to stream end
+ * (see wrapBodyForStreamMetrics) so it captures queries issued while the
+ * body is still rendering; bodyless responses fall back to a flush when
+ * middleware returns.
  */
 export function flushRecorder(rec: QueryRecorder): void {
-	if (rec.events.length === 0) return;
+	if (rec.flushed) return;
+	rec.flushed = true;
 	for (const e of rec.events) {
 		console.log(`${QUERY_LOG_PREFIX} ${JSON.stringify(e)}`);
 	}

package/src/database/migrations/044_comment_reactions.ts

@@ -0,0 +1,56 @@
+import type { Kysely } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+/**
+ * Comment reactions (Tier 1 of the best-in-class comments RFC).
+ *
+ * One row per (comment, voter, reaction). Toggle semantics are enforced by the
+ * unique index — a voter either has a given reaction on a comment or doesn't.
+ * `voter_hash` is a salted SHA-256 of the visitor's IP (same primitive as
+ * `_emdash_comments.ip_hash`), so no cleartext identity is stored.
+ *
+ * Additive and backward-compatible: a new table, no change to existing schema.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createTable("_emdash_comment_reactions")
+		.ifNotExists()
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("comment_id", "text", (col) =>
+			col.notNull().references("_emdash_comments.id").onDelete("cascade"),
+		)
+		.addColumn("reaction", "text", (col) => col.notNull().defaultTo("like"))
+		.addColumn("voter_hash", "text", (col) => col.notNull())
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// One reaction of a given type per voter per comment (toggle semantics).
+	await db.schema
+		.createIndex("idx_comment_reactions_unique")
+		.ifNotExists()
+		.on("_emdash_comment_reactions")
+		.columns(["comment_id", "voter_hash", "reaction"])
+		.unique()
+		.execute();
+
+	// Aggregate counts per comment (GROUP BY comment_id, reaction).
+	await db.schema
+		.createIndex("idx_comment_reactions_comment")
+		.ifNotExists()
+		.on("_emdash_comment_reactions")
+		.column("comment_id")
+		.execute();
+
+	// Per-voter rate limiting (recent reactions by a voter).
+	await db.schema
+		.createIndex("idx_comment_reactions_voter")
+		.ifNotExists()
+		.on("_emdash_comment_reactions")
+		.columns(["voter_hash", "created_at"])
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_comment_reactions").execute();
+}