ework-web 0.2.1 → 0.4.0

package/src/db.ts

@@ -1,19 +1,78 @@
-// SQLite store. One DB file holds the runtime config table AND the ework schema
-// (projects/issues/comments/labels/reactions/attachments/users) so transactions
-// span them. Schema is applied on boot via schema.sql.
+// Storage bootstrap. Owns the AsyncDatabase singleton. Two drivers behind one
+// AsyncDatabase surface: SQLite (bun:sqlite, default) and MySQL (mysql2/promise).
+// Driver picked by WORK_DB_DRIVER (sqlite|mysql). Schema + migrations run in
+// connect(). Callers MUST `await initDB()` once at boot before issuing queries.
+//
+// Table prefix: every table reference in SQL is written as a {{table}} token;
+// applyPrefix() rewrites {{name}} -> <WORK_DB_PREFIX>+name before execution.
+// Default prefix "" leaves SQL identical (backward-compatible with existing
+// ework.db files). WORK_DB_PREFIX is ENV-ONLY (never stored in the config
+// table) — the prefix is needed to locate the config table itself, so it
+// cannot live inside it (chicken-and-egg).
 
-import { Database } from "bun:sqlite";
+import { Database, type SQLQueryBindings } from "bun:sqlite";
+import { createPool, type Pool, type PoolConnection, type ResultSetHeader } from "mysql2/promise";
 import { mkdirSync, readFileSync } from "fs";
 import { dirname, join } from "path";
 
+// ---- public async interface (driver-agnostic) ----
+export interface DbRunResult {
+  /** Rowid of the last inserted row (SQLite lastInsertRowid / MySQL insertId). */
+  insertId: number;
+  /** Number of rows affected by the statement. */
+  changes: number;
+}
+
+export interface AsyncDatabase {
+  /** SELECT → all matching rows. Empty array when none. */
+  all<T = unknown>(sql: string, params?: unknown[]): Promise<T[]>;
+  /** SELECT → first matching row or null. */
+  get<T = unknown>(sql: string, params?: unknown[]): Promise<T | null>;
+  /** INSERT/UPDATE/DELETE → insertId + affected-row count. */
+  run(sql: string, params?: unknown[]): Promise<DbRunResult>;
+  /** Execute DDL / raw statement (no params, no rows back). */
+  exec(sql: string): Promise<void>;
+  /** Run fn inside a transaction: commit on resolve, rollback on throw. */
+  transaction<T>(fn: () => Promise<T>): Promise<T>;
+  /** Release the connection/pool. Idempotent. */
+  close(): Promise<void>;
+  /** Driver dialect — lets callers branch on SQLite vs MySQL specifics. */
+  readonly dialect: "sqlite" | "mysql";
+}
+
 const DB_PATH =
   process.env.WORK_DB_PATH ||
   join(process.env.XDG_DATA_HOME || `${process.env.HOME}/.local/share`, "ework", "ework.db");
 
-let _db: Database | null = null;
+// ---- table prefix (env-only; read once at module load) ----
+// Validated as a safe SQL identifier prefix. Empty = no prefix (default,
+// backward-compatible). A non-empty prefix lets multiple ework instances (or
+// ework + another app) share one database without colliding on table names.
+const DB_PREFIX = (() => {
+  const raw = (process.env.WORK_DB_PREFIX ?? "").trim();
+  if (raw && !/^[A-Za-z_][A-Za-z0-9_]{0,31}$/.test(raw)) {
+    throw new Error(
+      `Invalid WORK_DB_PREFIX "${raw}": must match ^[A-Za-z_][A-Za-z0-9_]{0,31}$`
+    );
+  }
+  return raw;
+})();
+
+/** Rewrite {{table}} tokens -> <prefix>table. No-op when sql contains no tokens. */
+export function applyPrefix(sql: string): string {
+  if (!sql.includes("{{")) return sql;
+  return sql.replace(/\{\{(\w+)\}\}/g, (_m, name: string) => DB_PREFIX + name);
+}
+
+// ---- driver selection (env-only; read once at module load) ----
+const DB_DRIVER = (process.env.WORK_DB_DRIVER ?? "sqlite").trim().toLowerCase();
+const DB_SKIP_CREATE = process.env.WORK_DB_SKIP_CREATE === "1" || process.env.WORK_DB_SKIP_CREATE === "true";
+if (DB_DRIVER !== "sqlite" && DB_DRIVER !== "mysql") {
+  throw new Error(`Unsupported WORK_DB_DRIVER "${DB_DRIVER}": must be "sqlite" or "mysql"`);
+}
 
 function userTableColumns(db: Database): Set<string> {
-  const rows = db.query("PRAGMA table_info(users)").all() as { name: string }[];
+  const rows = db.query(applyPrefix("PRAGMA table_info({{users}})")).all() as { name: string }[];
   return new Set(rows.map((r) => r.name));
 }
 
@@ -23,21 +82,21 @@ function migrateUsersTable(db: Database): void {
   if (userTableColumns(db).size === 0) return; // users doesn't exist yet; schema.sql will create it
   const have = userTableColumns(db);
   const additions: { col: string; ddl: string }[] = [
-    { col: "password_hash", ddl: "ALTER TABLE users ADD COLUMN password_hash TEXT" },
-    { col: "email", ddl: "ALTER TABLE users ADD COLUMN email TEXT" },
-    { col: "is_admin", ddl: "ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0" },
-    { col: "is_active", ddl: "ALTER TABLE users ADD COLUMN is_active INTEGER NOT NULL DEFAULT 1" },
-    { col: "updated_at", ddl: "ALTER TABLE users ADD COLUMN updated_at TEXT NOT NULL DEFAULT ''" },
+    { col: "password_hash", ddl: "ALTER TABLE {{users}} ADD COLUMN password_hash TEXT" },
+    { col: "email", ddl: "ALTER TABLE {{users}} ADD COLUMN email TEXT" },
+    { col: "is_admin", ddl: "ALTER TABLE {{users}} ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0" },
+    { col: "is_active", ddl: "ALTER TABLE {{users}} ADD COLUMN is_active INTEGER NOT NULL DEFAULT 1" },
+    { col: "updated_at", ddl: "ALTER TABLE {{users}} ADD COLUMN updated_at TEXT NOT NULL DEFAULT ''" },
   ];
   for (const m of additions) {
     if (have.has(m.col)) continue;
-    db.exec(m.ddl);
+    db.exec(applyPrefix(m.ddl));
   }
-  db.exec("CREATE INDEX IF NOT EXISTS users_is_admin ON users (is_admin) WHERE is_admin = 1");
+  db.exec(applyPrefix("CREATE INDEX IF NOT EXISTS users_is_admin ON {{users}} (is_admin) WHERE is_admin = 1"));
 }
 
 function tableColumns(db: Database, name: string): Set<string> {
-  const rows = db.query(`PRAGMA table_info(${name})`).all() as { name: string }[];
+  const rows = db.query(applyPrefix(`PRAGMA table_info({{${name}}})`)).all() as { name: string }[];
   return new Set(rows.map((r) => r.name));
 }
 
@@ -45,7 +104,7 @@ function migratePatTable(db: Database): void {
   const have = tableColumns(db, "personal_access_tokens");
   if (have.size === 0) return;
   if (!have.has("ip_allowlist")) {
-    db.exec("ALTER TABLE personal_access_tokens ADD COLUMN ip_allowlist TEXT NOT NULL DEFAULT '[]'");
+    db.exec(applyPrefix("ALTER TABLE {{personal_access_tokens}} ADD COLUMN ip_allowlist TEXT NOT NULL DEFAULT '[]'"));
   }
 }
 
@@ -53,10 +112,10 @@ function migrateProjectsTable(db: Database): void {
   const have = tableColumns(db, "projects");
   if (have.size === 0) return;
   if (!have.has("upstream_urls")) {
-    db.exec("ALTER TABLE projects ADD COLUMN upstream_urls TEXT NOT NULL DEFAULT '[]'");
+    db.exec(applyPrefix("ALTER TABLE {{projects}} ADD COLUMN upstream_urls TEXT NOT NULL DEFAULT '[]'"));
   }
   if (!have.has("model")) {
-    db.exec("ALTER TABLE projects ADD COLUMN model TEXT NOT NULL DEFAULT ''");
+    db.exec(applyPrefix("ALTER TABLE {{projects}} ADD COLUMN model TEXT NOT NULL DEFAULT ''"));
   }
 }
 
@@ -64,37 +123,216 @@ function migrateIssuesTable(db: Database): void {
   const have = tableColumns(db, "issues");
   if (have.size === 0) return;
   if (!have.has("closed_at")) {
-    db.exec("ALTER TABLE issues ADD COLUMN closed_at TEXT");
+    db.exec(applyPrefix("ALTER TABLE {{issues}} ADD COLUMN closed_at TEXT"));
   }
 }
 
-function db(): Database {
-  if (_db) return _db;
-  mkdirSync(dirname(DB_PATH), { recursive: true });
-  _db = new Database(DB_PATH, { create: true, readwrite: true });
-  _db.exec("PRAGMA journal_mode = WAL");
-  _db.exec("PRAGMA foreign_keys = ON");
-  _db.exec(
-    "CREATE TABLE IF NOT EXISTS config (key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL)"
-  );
-  // Migration must run BEFORE schema.sql: schema.sql's CREATE TABLE for fresh
-  // DBs doesn't help legacy DBs, and any index that references a new column
-  // would fail if schema.sql ran first.
-  migrateUsersTable(_db);
-  migratePatTable(_db);
-  migrateProjectsTable(_db);
-  migrateIssuesTable(_db);
-  _db.exec(readFileSync(join(import.meta.dir, "schema.sql"), "utf8"));
-  return _db;
+// ---- SqliteDriver: wraps bun:sqlite behind AsyncDatabase ----
+class SqliteDriver implements AsyncDatabase {
+  readonly dialect = "sqlite" as const;
+  private readonly db: Database;
+  private inTx = false;
+  private constructor(db: Database) { this.db = db; }
+
+  static async create(): Promise<SqliteDriver> {
+    mkdirSync(dirname(DB_PATH), { recursive: true });
+    const db = new Database(DB_PATH, { create: true, readwrite: true });
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA foreign_keys = ON");
+    db.exec(
+      applyPrefix(
+        "CREATE TABLE IF NOT EXISTS {{config}} (key TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at TEXT NOT NULL)"
+      )
+    );
+    // Migration must run BEFORE schema.sql (same ordering as the original file).
+    migrateUsersTable(db);
+    migratePatTable(db);
+    migrateProjectsTable(db);
+    migrateIssuesTable(db);
+    db.exec(applyPrefix(readFileSync(join(import.meta.dir, "schema.sql"), "utf8")));
+    return new SqliteDriver(db);
+  }
+
+  async all<T = unknown>(sql: string, params: unknown[] = []): Promise<T[]> {
+    return this.db.query(applyPrefix(sql)).all(...(params as SQLQueryBindings[])) as T[];
+  }
+  async get<T = unknown>(sql: string, params: unknown[] = []): Promise<T | null> {
+    return (this.db.query(applyPrefix(sql)).get(...(params as SQLQueryBindings[])) as T | null) ?? null;
+  }
+  async run(sql: string, params: unknown[] = []): Promise<DbRunResult> {
+    const info = this.db.query(applyPrefix(sql)).run(...(params as SQLQueryBindings[])) as unknown as {
+      lastInsertRowid: number | bigint;
+      changes: number;
+    };
+    return { insertId: Number(info.lastInsertRowid), changes: info.changes };
+  }
+  async exec(sql: string): Promise<void> {
+    this.db.exec(applyPrefix(sql));
+  }
+  async transaction<T>(fn: () => Promise<T>): Promise<T> {
+    if (this.inTx) {
+      // SQLite can't nest BEGIN without SAVEPOINT; current codebase has no
+      // nesting, so this safety net just runs the body inline.
+      return fn();
+    }
+    this.db.exec("BEGIN");
+    this.inTx = true;
+    try {
+      const r = await fn();
+      this.db.exec("COMMIT");
+      return r;
+    } catch (e) {
+      try { this.db.exec("ROLLBACK"); } catch { /* already rolled back */ }
+      throw e;
+    } finally {
+      this.inTx = false;
+    }
+  }
+  async close(): Promise<void> {
+    try { this.db.close(); } catch { /* already closed */ }
+  }
 }
 
-export function rawDB(): Database {
-  return db();
+// ---- MysqlDriver: wraps mysql2/promise behind AsyncDatabase ----
+// MySQL transactions must run on a single connection, so transaction() checks
+// out a connection, pins it as txConn, and routes all/get/run/exec through it
+// until commit/rollback. Outside a transaction, queries hit the pool. SQLite-
+// specific SQL (INSERT OR IGNORE, ON CONFLICT ... excluded.x) is translated to
+// MySQL equivalents by translateForMysql() so store.ts stays single-dialect.
+interface MysqlOptions {
+  host: string;
+  port: number;
+  user: string;
+  password: string;
+  database: string;
+  skipCreate: boolean;
 }
 
-export function getConfigAll(): Record<string, string> {
+function translateForMysql(sql: string): string {
+  return sql
+    .replace(/INSERT OR IGNORE INTO/g, "INSERT IGNORE INTO")
+    .replace(/ON CONFLICT\((\w+)\) DO UPDATE SET/g, "ON DUPLICATE KEY UPDATE")
+    .replace(/excluded\.(\w+)/g, "VALUES($1)");
+}
+
+class MysqlDriver implements AsyncDatabase {
+  readonly dialect = "mysql" as const;
+  private readonly pool: Pool;
+  private txConn: PoolConnection | null = null;
+  private constructor(pool: Pool) { this.pool = pool; }
+
+  private get conn(): Pool | PoolConnection {
+    return this.txConn ?? this.pool;
+  }
+
+  static async create(opts: MysqlOptions): Promise<MysqlDriver> {
+    const pool = createPool({
+      host: opts.host,
+      port: opts.port,
+      user: opts.user,
+      password: opts.password,
+      database: opts.database,
+      waitForConnections: true,
+      connectionLimit: 10,
+      charset: "utf8mb4",
+    });
+    const probe = await pool.getConnection();
+    try {
+      await probe.ping();
+    } finally {
+      probe.release();
+    }
+    if (!opts.skipCreate) {
+      const raw = applyPrefix(readFileSync(join(import.meta.dir, "schema-mysql.sql"), "utf8"));
+      // MySQL has no CREATE INDEX IF NOT EXISTS, so split into statements and
+      // tolerate ER_DUP_KEYNAME (1061) so re-runs stay idempotent. Comment lines
+      // are stripped first — they may contain ';' which would corrupt the split.
+      const schema = raw.split("\n").filter((l) => !l.trimStart().startsWith("--")).join("\n");
+      for (const stmt of schema.split(";").map((s) => s.trim()).filter((s) => s.length > 0)) {
+        try {
+          await pool.query(stmt);
+        } catch (e) {
+          if (e && typeof e === "object" && "errno" in e && (e as { errno: number }).errno === 1061) continue;
+          throw e;
+        }
+      }
+    }
+    return new MysqlDriver(pool);
+  }
+
+  private prepare(sql: string): string {
+    return translateForMysql(applyPrefix(sql));
+  }
+
+  async all<T = unknown>(sql: string, params: unknown[] = []): Promise<T[]> {
+    const [rows] = await this.conn.query(this.prepare(sql), params);
+    return rows as T[];
+  }
+  async get<T = unknown>(sql: string, params: unknown[] = []): Promise<T | null> {
+    const [rows] = await this.conn.query(this.prepare(sql), params);
+    const arr = rows as T[];
+    return arr[0] ?? null;
+  }
+  async run(sql: string, params: unknown[] = []): Promise<DbRunResult> {
+    const [result] = await this.conn.query(this.prepare(sql), params);
+    const r = result as ResultSetHeader;
+    return { insertId: Number(r.insertId), changes: r.affectedRows };
+  }
+  async exec(sql: string): Promise<void> {
+    await this.conn.query(this.prepare(sql));
+  }
+  async transaction<T>(fn: () => Promise<T>): Promise<T> {
+    if (this.txConn) return fn();
+    const conn = await this.pool.getConnection();
+    this.txConn = conn;
+    await conn.beginTransaction();
+    try {
+      const r = await fn();
+      await conn.commit();
+      return r;
+    } catch (e) {
+      try { await conn.rollback(); } catch { /* already rolled back */ }
+      throw e;
+    } finally {
+      this.txConn = null;
+      conn.release();
+    }
+  }
+  async close(): Promise<void> {
+    try { await this.pool.end(); } catch { /* already closed */ }
+  }
+}
+
+let _driver: AsyncDatabase | null = null;
+
+/** Initialize + connect the database. MUST be awaited once at boot. */
+export async function initDB(): Promise<AsyncDatabase> {
+  if (_driver) return _driver;
+  if (DB_DRIVER === "mysql") {
+    _driver = await MysqlDriver.create({
+      host: process.env.WORK_DB_HOST ?? "127.0.0.1",
+      port: Number(process.env.WORK_DB_PORT ?? 3306),
+      user: process.env.WORK_DB_USER ?? "ework",
+      password: process.env.WORK_DB_PASSWORD ?? "",
+      database: process.env.WORK_DB_NAME ?? "ework",
+      skipCreate: DB_SKIP_CREATE,
+    });
+  } else {
+    _driver = await SqliteDriver.create();
+  }
+  return _driver;
+}
+
+/** Returns the initialized AsyncDatabase. Throws if initDB() wasn't awaited. */
+export function getDB(): AsyncDatabase {
+  if (!_driver) throw new Error("getDB() called before initDB(); await initDB() at boot first");
+  return _driver;
+}
+
+export async function getConfigAll(): Promise<Record<string, string>> {
   try {
-    const rows = db().query("SELECT key, value FROM config").all() as { key: string; value: string }[];
+    const driver = getDB();
+    const rows = await driver.all<{ key: string; value: string }>("SELECT key, value FROM {{config}}");
     const out: Record<string, string> = {};
     for (const r of rows) out[r.key] = r.value;
     return out;
@@ -103,16 +341,15 @@ export function getConfigAll(): Record<string, string> {
   }
 }
 
-export function setConfig(key: string, value: string): void {
+export async function setConfig(key: string, value: string): Promise<void> {
   const now = new Date().toISOString();
-  db()
-    .query(
-      "INSERT INTO config (key, value, updated_at) VALUES (?, ?, ?) " +
-        "ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at"
-    )
-    .run(key, value, now);
+  await getDB().run(
+    "INSERT INTO {{config}} (key, value, updated_at) VALUES (?, ?, ?) " +
+      "ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at",
+    [key, value, now]
+  );
 }
 
-export function deleteConfig(key: string): void {
-  db().query("DELETE FROM config WHERE key = ?").run(key);
+export async function deleteConfig(key: string): Promise<void> {
+  await getDB().run("DELETE FROM {{config}} WHERE key = ?", [key]);
 }

package/src/giteaApi.ts

@@ -12,7 +12,7 @@
 // bg audit) plus a few cheap stubs (/version, /user, /repos/:o/:r) that
 // Gitea clients commonly hit during connection bootstrap.
 
-import { rawDB } from "./db";
+import { getDB } from "./db";
 import {
   StoreError,
   getProject,
@@ -122,18 +122,17 @@ export async function handleGiteaApi(
     const limitRaw = Number(url.searchParams.get("limit") ?? 50);
     const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 200) : 50;
     try {
-      const rows = listAllIssues({ q, state, limit });
-      return {
-        status: 200,
-        body: rows.map((row) => {
-          const project = getProject(row.project_owner, row.project_name);
-          if (!project) return null;
-          return {
-            ...buildIssuePayload(row, project, row.comment_count ?? 0, origin),
-            repository: buildRepository(project, origin),
-          };
-        }).filter((x) => x !== null),
-      };
+      const rows = await listAllIssues({ q, state, limit });
+      const body = [];
+      for (const row of rows) {
+        const project = await getProject(row.project_owner, row.project_name);
+        if (!project) continue;
+        body.push({
+          ...buildIssuePayload(row, project, row.comment_count ?? 0, origin),
+          repository: buildRepository(project, origin),
+        });
+      }
+      return { status: 200, body };
     } catch (e) {
       return giteaError(e instanceof StoreError ? e.status : 500, e instanceof Error ? e.message : "error");
     }
@@ -143,7 +142,7 @@ export async function handleGiteaApi(
   if (m && req.method === "GET") {
     const [, owner, repo] = m;
     if (!(owner && repo)) return giteaError(404, "not found");
-    const project = getProject(owner, repo);
+    const project = await getProject(owner, repo);
     if (!project) return giteaError(404, "repository not found");
     return { status: 200, body: buildRepository(project, origin) };
   }
@@ -153,22 +152,22 @@ export async function handleGiteaApi(
     const [, owner, repo] = m;
     if (!(owner && repo)) return giteaError(404, "not found");
     try {
-      const project = getProject(owner, repo);
+      const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
-      if (!canWriteProject(project.id, user)) return giteaError(403, "requires writer role");
+      if (!(await canWriteProject(project.id, user))) return giteaError(403, "requires writer role");
       const body = await readJson(req);
       const title = asString(body.title);
       if (!title) return giteaError(400, "title required");
       const text = asString(body.body) ?? "";
-      const created = createIssue(project.id, title, text, user.login, {
+      const created = await createIssue(project.id, title, text, user.login, {
         createdAt: asString(body.created_at),
         updatedAt: asString(body.updated_at),
         state: asIssueState(body.state) ?? "open",
         closedAt: asString(body.closed_at) || undefined,
       });
-      emitIssueEvent(project.id, created.id, "opened", origin);
+      void emitIssueEvent(project.id, created.id, "opened", origin);
       if (created.state === "closed") {
-        emitIssueEvent(project.id, created.id, "closed", origin);
+        void emitIssueEvent(project.id, created.id, "closed", origin);
       }
       return { status: 201, body: buildIssuePayload(created, project, 0, origin) };
     } catch (e) {
@@ -182,33 +181,33 @@ export async function handleGiteaApi(
     if (!(owner && repo && numStr)) return giteaError(404, "not found");
     const number = Number(numStr);
     try {
-      const project = getProject(owner, repo);
+      const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
-      const issue = getIssue(project.id, number);
+      const issue = await getIssue(project.id, number);
       if (!issue) return giteaError(404, "issue not found");
 
       if (req.method === "GET") {
-        return { status: 200, body: buildIssuePayload(issue, project, countComments(issue.id), origin) };
+        return { status: 200, body: buildIssuePayload(issue, project, await countComments(issue.id), origin) };
       }
       if (req.method === "PATCH") {
-        if (!canWriteProject(project.id, user)) return giteaError(403, "requires writer role");
+        if (!(await canWriteProject(project.id, user))) return giteaError(403, "requires writer role");
         const body = await readJson(req);
         const before = issue.state;
-        editIssue(issue.id, {
+        await editIssue(issue.id, {
           title: asString(body.title),
           body: asString(body.body),
           state: asIssueState(body.state),
           closedAt: asString(body.closed_at) || undefined,
           updatedAt: asString(body.updated_at),
         });
-        const after = getIssueById(issue.id);
+        const after = await getIssueById(issue.id);
         if (!after) return giteaError(404, "issue vanished mid-edit");
         if (before === "open" && after.state === "closed") {
-          emitIssueEvent(project.id, after.id, "closed", origin);
+          void emitIssueEvent(project.id, after.id, "closed", origin);
         } else if (before === "closed" && after.state === "open") {
-          emitIssueEvent(project.id, after.id, "reopened", origin);
+          void emitIssueEvent(project.id, after.id, "reopened", origin);
         }
-        return { status: 200, body: buildIssuePayload(after, project, countComments(after.id), origin) };
+        return { status: 200, body: buildIssuePayload(after, project, await countComments(after.id), origin) };
       }
       return giteaError(405, `method ${req.method} not allowed`);
     } catch (e) {
@@ -222,28 +221,28 @@ export async function handleGiteaApi(
     if (!(owner && repo && numStr)) return giteaError(404, "not found");
     const number = Number(numStr);
     try {
-      const project = getProject(owner, repo);
+      const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
-      const issue = getIssue(project.id, number);
+      const issue = await getIssue(project.id, number);
       if (!issue) return giteaError(404, "issue not found");
 
       if (req.method === "GET") {
-        const comments = listCommentsForIssue(issue.id);
+        const comments = await listCommentsForIssue(issue.id);
         return {
           status: 200,
           body: comments.map((c) => buildCommentPayload(issue, c, project, origin)),
         };
       }
       if (req.method === "POST") {
-        if (!canWriteProject(project.id, user)) return giteaError(403, "requires writer role");
+        if (!(await canWriteProject(project.id, user))) return giteaError(403, "requires writer role");
         const body = await readJson(req);
         const text = asString(body.body);
         if (text === undefined) return giteaError(400, "body required");
-        const created = postComment(issue.id, text, user.login, {
+        const created = await postComment(issue.id, text, user.login, {
           createdAt: asString(body.created_at),
           updatedAt: asString(body.updated_at),
         });
-        emitCommentEvent(project.id, issue.id, created.id, origin);
+        void emitCommentEvent(project.id, issue.id, created.id, origin);
         return { status: 201, body: buildCommentPayload(issue, created, project, origin) };
       }
       return giteaError(405, `method ${req.method} not allowed`);
@@ -268,29 +267,29 @@ export async function handleGiteaApi(
     if (!(owner && repo && cidStr)) return giteaError(404, "not found");
     const cid = Number(cidStr);
     try {
-      const project = getProject(owner, repo);
+      const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
 
       if (req.method === "GET") {
-        const comment = getComment(cid);
+        const comment = await getComment(cid);
         if (!comment) return giteaError(404, "comment not found");
-        const issue = getIssueById(comment.issue_id);
+        const issue = await getIssueById(comment.issue_id);
         if (!issue) return giteaError(404, "issue not found");
         return { status: 200, body: buildCommentPayload(issue, comment, project, origin) };
       }
       if (req.method === "PATCH") {
-        if (!canWriteProject(project.id, user)) return giteaError(403, "requires writer role");
+        if (!(await canWriteProject(project.id, user))) return giteaError(403, "requires writer role");
         const body = await readJson(req);
         const text = asString(body.body);
         if (text === undefined) return giteaError(400, "body required");
-        const updated = editComment(cid, text);
-        const issue = getIssueById(updated.issue_id);
+        const updated = await editComment(cid, text);
+        const issue = await getIssueById(updated.issue_id);
         if (!issue) return giteaError(404, "issue not found");
         return { status: 200, body: buildCommentPayload(issue, updated, project, origin) };
       }
       if (req.method === "DELETE") {
-        if (!canWriteProject(project.id, user)) return giteaError(403, "requires writer role");
-        deleteComment(cid);
+        if (!(await canWriteProject(project.id, user))) return giteaError(403, "requires writer role");
+        await deleteComment(cid);
         return { status: 204, body: null };
       }
       return giteaError(405, `method ${req.method} not allowed`);
@@ -305,20 +304,20 @@ export async function handleGiteaApi(
     if (!(owner && repo && cidStr)) return giteaError(404, "not found");
     const cid = Number(cidStr);
     try {
-      const project = getProject(owner, repo);
+      const project = await getProject(owner, repo);
       if (!project) return giteaError(404, "repository not found");
 
       if (req.method === "GET") {
-        return { status: 200, body: reactionsList(cid, origin) };
+        return { status: 200, body: await reactionsList(cid, origin) };
       }
       if (req.method === "POST" || req.method === "DELETE") {
-        if (!canWriteProject(project.id, user)) return giteaError(403, "requires writer role");
+        if (!(await canWriteProject(project.id, user))) return giteaError(403, "requires writer role");
         const body = await readJson(req);
         const content = asContent(body.content);
         if (content === undefined) return giteaError(400, "content required");
-        if (req.method === "POST") addReaction(cid, user.login, content);
-        else removeReaction(cid, user.login, content);
-        return { status: 200, body: reactionsList(cid, origin) };
+        if (req.method === "POST") await addReaction(cid, user.login, content);
+        else await removeReaction(cid, user.login, content);
+        return { status: 200, body: await reactionsList(cid, origin) };
       }
       return giteaError(405, `method ${req.method} not allowed`);
     } catch (e) {
@@ -332,12 +331,13 @@ export async function handleGiteaApi(
 // Gitea returns a per-user list, not the aggregated counts ework's store
 // keeps. The "reaction" key is Gitea's wire name; we also emit "content"
 // for self-consistency with ework's schema.
-function reactionsList(commentId: number, origin: string): { user: ReturnType<typeof buildUser>; reaction: string; content: string }[] {
-  const aggs = listReactionsFor([commentId]);
+async function reactionsList(commentId: number, origin: string): Promise<{ user: ReturnType<typeof buildUser>; reaction: string; content: string }[]> {
+  const aggs = await listReactionsFor([commentId]);
   if (aggs.length === 0) return [];
-  const rows = rawDB()
-    .query("SELECT user_login, content FROM reactions WHERE comment_id = ? ORDER BY rowid")
-    .all(commentId) as { user_login: string; content: string }[];
+  const rows = await getDB().all<{ user_login: string; content: string }>(
+    "SELECT user_login, content FROM {{reactions}} WHERE comment_id = ? ORDER BY rowid",
+    [commentId]
+  );
   return rows.map((r) => ({
     user: buildUser(r.user_login, origin),
     reaction: r.content,