@beechcms/api 0.4.0-preview.1

package/src/upload.ts

@@ -0,0 +1,335 @@
+/**
+ * Media Engine: upload e servizio file da Cloudflare R2.
+ *
+ * Usa l'API S3-compatibile (@aws-sdk/client-s3) con chiavi di accesso per
+ * portabilità e configurabilità. Le credenziali vanno in .dev.vars (locale)
+ * o wrangler secret (produzione).
+ *
+ * @see docs/media-engine.md
+ */
+/// <reference types="@cloudflare/workers-types" />
+import { S3Client, PutObjectCommand, GetObjectCommand, DeleteObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3'
+import { Hono } from 'hono'
+import { authMiddleware } from './middleware'
+import { logActivity } from './shared/activity-logger'
+
+/** Variabili d'ambiente per upload e media (R2 via S3 API) */
+type UploadBindings = {
+  JWT_SECRET: string
+  MEDIA_BASE_URL?: string
+  ENV?: string
+  R2_ACCESS_KEY_ID?: string
+  R2_SECRET_ACCESS_KEY?: string
+  R2_ENDPOINT?: string
+  R2_BUCKET_NAME?: string
+  DB: D1Database
+}
+
+type Variables = {
+  jwtPayload: { sub: string; email?: string }
+}
+
+/** Prefissi MIME consentiti (immagini e PDF) */
+const ALLOWED_MIME_PREFIXES = ['image/', 'application/pdf']
+
+/** Dimensione massima file: 5 MB */
+const MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024
+
+type FileLike = {
+  name: string
+  type: string
+  size: number
+  arrayBuffer: () => Promise<ArrayBuffer>
+}
+
+function isFileLike(value: unknown): value is FileLike {
+  if (!value || typeof value === 'string') return false
+  const v = value as Record<string, unknown>
+
+  return (
+    typeof v.name === 'string' &&
+    typeof v.type === 'string' &&
+    typeof v.size === 'number' &&
+    typeof v.arrayBuffer === 'function'
+  )
+}
+
+/** Sanitizza il nome file: rimuove caratteri non sicuri, mantiene estensione */
+function sanitizeFilename(name: string): string {
+  const base = name.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 100)
+  return base || 'file'
+}
+
+/** Genera chiave univoca per R2 (timestamp-sanitized-name) */
+function generateObjectKey(originalName: string): string {
+  const timestamp = Math.floor(Date.now() / 1000)
+  const sanitized = sanitizeFilename(originalName)
+  return `${timestamp}-${sanitized}`
+}
+
+/** Restituisce l'URL base per costruire gli URL pubblici dei media */
+function getMediaBaseUrl(c: { req: { url: string }; env: UploadBindings }): string {
+  const base = c.env.MEDIA_BASE_URL?.trim()
+  if (base) return base.replace(/\/$/, '')
+  return new URL(c.req.url).origin
+}
+
+/** Crea client S3 per R2 */
+export function createR2Client(env: UploadBindings): S3Client {
+  if (!env.R2_ACCESS_KEY_ID || !env.R2_SECRET_ACCESS_KEY || !env.R2_ENDPOINT) {
+    throw new Error('R2 credentials not configured')
+  }
+  return new S3Client({
+    region: 'auto',
+    endpoint: env.R2_ENDPOINT,
+    credentials: {
+      accessKeyId: env.R2_ACCESS_KEY_ID!,
+      secretAccessKey: env.R2_SECRET_ACCESS_KEY!,
+    },
+    forcePathStyle: true,
+  })
+}
+
+/** Env minimale per delete R2 (solo R2_* e ENV) */
+export type R2DeleteEnv = Pick<
+  UploadBindings,
+  'R2_ACCESS_KEY_ID' | 'R2_SECRET_ACCESS_KEY' | 'R2_ENDPOINT' | 'R2_BUCKET_NAME' | 'ENV' | 'DB'
+>
+
+/**
+ * Elimina oggetti da R2 per le chiavi date.
+ * Usato alla cancellazione entry per rimuovere i file associati da R2.
+ */
+export async function deleteR2Objects(
+  env: R2DeleteEnv,
+  objectKeys: string[]
+): Promise<void> {
+  const isR2Configured =
+    env.R2_ACCESS_KEY_ID &&
+    env.R2_SECRET_ACCESS_KEY &&
+    env.R2_ENDPOINT &&
+    env.R2_BUCKET_NAME
+
+  if (!isR2Configured || objectKeys.length === 0) {
+    return
+  }
+
+  const s3Client = createR2Client(env as UploadBindings)
+  for (const objectKey of objectKeys) {
+    try {
+      // Ottieni la dimensione prima della cancellazione per aggiornare il contatore
+      let fileSize = 0
+      try {
+        const head = await s3Client.send(
+          new HeadObjectCommand({
+            Bucket: env.R2_BUCKET_NAME,
+            Key: objectKey,
+          })
+        )
+        fileSize = head.ContentLength ?? 0
+      } catch (headErr) {
+        // Se il file non esiste già su R2, fileSize resta 0
+        if (env.ENV !== 'production') {
+          console.warn('R2 head failed for key (skip size update)', objectKey, headErr)
+        }
+      }
+
+      await s3Client.send(
+        new DeleteObjectCommand({
+          Bucket: env.R2_BUCKET_NAME,
+          Key: objectKey,
+        })
+      )
+
+      // Decrementa contatore storage in D1 se abbiamo trovato la dimensione
+      if (fileSize > 0) {
+        await env.DB.prepare(
+          "UPDATE system_stats SET value = MAX(0, CAST(value AS INTEGER) - ?) WHERE id = 'total_storage_bytes'"
+        ).bind(fileSize).run()
+      }
+
+      // Rimuovi dalla media library
+      await env.DB.prepare('DELETE FROM media_objects WHERE key = ?').bind(objectKey).run()
+    } catch (err) {
+      if (env.ENV !== 'production') {
+        console.warn('R2 delete failed for key', objectKey, err)
+      }
+    }
+  }
+}
+
+export const uploadRoutes = new Hono<{
+  Bindings: UploadBindings
+  Variables: Variables
+}>()
+
+/** POST /upload - Carica file su R2, restituisce URL pubblico */
+uploadRoutes.post('/upload', async (c, next) => {
+  await authMiddleware(c.env.JWT_SECRET)(c, next)
+}, async (c) => {
+  try {
+    const { R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_ENDPOINT, R2_BUCKET_NAME } = c.env
+    if (!R2_ACCESS_KEY_ID || !R2_SECRET_ACCESS_KEY || !R2_ENDPOINT || !R2_BUCKET_NAME) {
+      return c.json({ error: 'R2 not configured. Set R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_ENDPOINT, R2_BUCKET_NAME' }, 500)
+    }
+
+    const contentType = c.req.header('Content-Type') ?? ''
+    if (!contentType.includes('multipart/form-data')) {
+      return c.json({ error: 'Content-Type must be multipart/form-data' }, 400)
+    }
+
+    const formData = await c.req.formData()
+    const fileEntry = formData.get('file')
+    // In Cloudflare/Workers il value può essere `string` o un oggetto (File/Blob-like).
+    // Usiamo un guard sulle proprietà richieste.
+    if (!isFileLike(fileEntry)) {
+      return c.json({ error: 'No file provided. Use field name "file"' }, 400)
+    }
+    const file = fileEntry
+
+    const mimeOk = ALLOWED_MIME_PREFIXES.some((prefix) => file.type.startsWith(prefix))
+    if (!mimeOk) {
+      return c.json(
+        { error: 'File type not allowed. Allowed: images and PDF' },
+        400
+      )
+    }
+
+    if (file.size > MAX_FILE_SIZE_BYTES) {
+      return c.json({ error: 'File too large. Max 5MB' }, 400)
+    }
+
+    const objectKey = generateObjectKey(file.name)
+    const client = createR2Client(c.env)
+
+    const body = await file.arrayBuffer()
+    await client.send(
+      new PutObjectCommand({
+        Bucket: R2_BUCKET_NAME,
+        Key: objectKey,
+        Body: new Uint8Array(body),
+        ContentType: file.type,
+      })
+    )
+
+    // Aggiorna contatore storage in D1
+    let executionCtx: { waitUntil: (p: Promise<any>) => void } | undefined
+    try {
+      executionCtx = c.executionCtx
+    } catch {
+      // In ambiente di test Hono lancia se non presente
+    }
+
+    const uploadedBy = c.var.jwtPayload?.sub ?? ''
+    if (executionCtx) {
+      executionCtx.waitUntil((async () => {
+        try {
+          await c.env.DB.prepare(
+            "UPDATE system_stats SET value = CAST(value AS INTEGER) + ? WHERE id = 'total_storage_bytes'"
+          ).bind(file.size).run()
+        } catch (err) {
+          console.error('Failed to update storage stats on upload:', err)
+        }
+        try {
+          await c.env.DB.prepare(
+            'INSERT INTO media_objects (key, filename, mime_type, size_bytes, uploaded_by) VALUES (?, ?, ?, ?, ?)'
+          ).bind(objectKey, file.name, file.type, file.size, uploadedBy).run()
+        } catch (err) {
+          console.error('Failed to track media_objects on upload:', err)
+        }
+      })())
+    } else {
+      // Fallback sync
+      c.env.DB.prepare(
+        "UPDATE system_stats SET value = CAST(value AS INTEGER) + ? WHERE id = 'total_storage_bytes'"
+      ).bind(file.size).run().catch(err => console.error('Failed to update storage stats on upload (sync fallback):', err))
+      c.env.DB.prepare(
+        'INSERT INTO media_objects (key, filename, mime_type, size_bytes, uploaded_by) VALUES (?, ?, ?, ?, ?)'
+      ).bind(objectKey, file.name, file.type, file.size, uploadedBy).run().catch(err => console.error('Failed to track media_objects (sync fallback):', err))
+    }
+
+    const baseUrl = getMediaBaseUrl(c)
+    const publicUrl = `${baseUrl}/api/media/${encodeURIComponent(objectKey)}`
+
+    logActivity(c, {
+      action: 'upload',
+      entityType: 'media',
+      entityId: objectKey,
+      details: { name: file.name, size: file.size, type: file.type }
+    })
+
+    return c.json({ url: publicUrl }, 200)
+  } catch (err) {
+    if (c.env.ENV !== 'production') {
+      console.error('Upload error:', err)
+    }
+    return c.json({ error: 'Upload failed' }, 500)
+  }
+})
+
+/** DELETE /upload/:key - Elimina un file da R2 */
+uploadRoutes.delete('/:key', async (c, next) => {
+  await authMiddleware(c.env.JWT_SECRET)(c, next)
+}, async (c) => {
+  const key = c.req.param('key')
+  if (!key) return c.json({ error: 'Missing key' }, 400)
+  
+  await deleteR2Objects(c.env, [decodeURIComponent(key)])
+  return c.json({ success: true }, 200)
+})
+
+/**
+ * Serve un file da R2. Route pubblica (senza auth) per permettere
+ * il caricamento delle immagini nei tag <img>.
+ */
+export async function serveMediaHandler(
+  c: { env: UploadBindings; req: { param: (key: string) => string } }
+): Promise<Response> {
+  const key = c.req.param('key')
+  if (!key) {
+    return new Response(JSON.stringify({ error: 'Missing key' }), {
+      status: 400,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  const { R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_ENDPOINT, R2_BUCKET_NAME } = c.env
+  if (!R2_ACCESS_KEY_ID || !R2_SECRET_ACCESS_KEY || !R2_ENDPOINT || !R2_BUCKET_NAME) {
+    return new Response(JSON.stringify({ error: 'R2 not configured' }), {
+      status: 500,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  try {
+    const client = createR2Client(c.env)
+    const response = await client.send(
+      new GetObjectCommand({
+        Bucket: R2_BUCKET_NAME,
+        Key: decodeURIComponent(key),
+      })
+    )
+
+    if (!response.Body) {
+      return new Response(JSON.stringify({ error: 'Not found' }), {
+        status: 404,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+
+    const headers = new Headers()
+    const ct = response.ContentType ?? 'application/octet-stream'
+    headers.set('Content-Type', ct)
+    headers.set('Cache-Control', 'public, max-age=31536000, immutable')
+
+    return new Response(response.Body as ReadableStream, {
+      status: 200,
+      headers,
+    })
+  } catch {
+    return new Response(JSON.stringify({ error: 'Not found' }), {
+      status: 404,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+}

package/src/widget.ts

@@ -0,0 +1,349 @@
+/// <reference types="@cloudflare/workers-types" />
+import { Hono } from 'hono'
+import { deserializeFromDb } from '@beechcms/core'
+import type { Seed } from '@beechcms/core'
+import type { Env, Variables } from './types'
+
+const widgetApp = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+type AggregateFormula =
+  | { op: 'count' }
+  | { op: 'sum'; column: string }
+  | { op: 'avg'; column: string }
+  | { op: 'min'; column: string }
+  | { op: 'max'; column: string }
+  | { op: 'countWhere'; column: string; value: unknown }
+  | { op: 'percentageOf'; numeratorColumn: string; denominatorColumn: string }
+
+type TimeWindow = 'week' | 'month' | 'year' | 'all'
+
+function timeWindowSql(window: TimeWindow): string {
+  switch (window) {
+    case 'week':  return "created_at >= unixepoch('now', '-7 days')"
+    case 'month': return "created_at >= unixepoch('now', '-1 month')"
+    case 'year':  return "created_at >= unixepoch('now', '-1 year')"
+    case 'all':   return '1=1'
+  }
+}
+
+function previousWindowSql(window: TimeWindow): { current: string; previous: string } {
+  switch (window) {
+    case 'week':
+      return {
+        current:  "created_at >= unixepoch('now', '-7 days')",
+        previous: "created_at >= unixepoch('now', '-14 days') AND created_at < unixepoch('now', '-7 days')",
+      }
+    case 'month':
+      return {
+        current:  "created_at >= unixepoch('now', '-1 month')",
+        previous: "created_at >= unixepoch('now', '-2 months') AND created_at < unixepoch('now', '-1 month')",
+      }
+    case 'year':
+      return {
+        current:  "created_at >= unixepoch('now', '-1 year')",
+        previous: "created_at >= unixepoch('now', '-2 years') AND created_at < unixepoch('now', '-1 year')",
+      }
+    case 'all':
+      return { current: '1=1', previous: '1=0' }
+  }
+}
+
+const SYSTEM_COLUMNS = new Set(['created_at', 'updated_at', 'status', 'id', 'slug'])
+
+// In v0.4.0 alias = column name. Validate against seed to prevent injection.
+function resolveColumnExpr(seed: Seed, alias: string): string {
+  if (SYSTEM_COLUMNS.has(alias)) return alias
+  const branch = seed.branches.find(b => b.alias === alias)
+  return branch ? branch.alias : 'id'
+}
+
+function buildAggregateExpr(seed: Seed, formula: AggregateFormula): string {
+  switch (formula.op) {
+    case 'count':
+      return 'COUNT(*)'
+    case 'sum':
+      return `SUM(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
+    case 'avg':
+      return `AVG(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
+    case 'min':
+      return `MIN(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
+    case 'max':
+      return `MAX(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
+    case 'countWhere': {
+      const expr = resolveColumnExpr(seed, formula.column)
+      const val = formula.value
+      if (val === null) return `COUNT(CASE WHEN ${expr} IS NULL THEN 1 END)`
+      if (typeof val === 'boolean') return `COUNT(CASE WHEN ${expr} = ${val ? 1 : 0} THEN 1 END)`
+      if (typeof val === 'number') return `COUNT(CASE WHEN CAST(${expr} AS REAL) = ${val} THEN 1 END)`
+      return `COUNT(CASE WHEN ${expr} = '${String(val).replace(/'/g, "''")}' THEN 1 END)`
+    }
+    case 'percentageOf': {
+      const num = resolveColumnExpr(seed, formula.numeratorColumn)
+      const den = resolveColumnExpr(seed, formula.denominatorColumn)
+      return `CASE WHEN SUM(CAST(${den} AS REAL)) = 0 THEN 0 ELSE (SUM(CAST(${num} AS REAL)) * 100.0 / SUM(CAST(${den} AS REAL))) END`
+    }
+  }
+}
+
+function parseFormula(raw: string | undefined): AggregateFormula | null {
+  if (!raw) return null
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    if (typeof parsed !== 'object' || parsed === null || !('op' in parsed)) return null
+    return parsed as AggregateFormula
+  } catch {
+    return null
+  }
+}
+
+function parseWindow(raw: string | undefined): TimeWindow {
+  if (raw === 'week' || raw === 'month' || raw === 'year' || raw === 'all') return raw
+  return 'all'
+}
+
+function error(status: number, title: string, detail: string) {
+  return { type: 'about:blank', title, status, detail }
+}
+
+// ─── Routes ─────────────────────────────────────────────────────────────────
+
+widgetApp.get('/aggregate/:seed', async (c) => {
+  const seedSlug = c.req.param('seed')
+  const seed = c.get('getSeed')(seedSlug)
+  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+
+  const formula = parseFormula(c.req.query('formula'))
+  if (!formula) return c.json(error(400, 'Bad Request', 'Invalid or missing formula parameter (must be JSON)'), 400)
+
+  const window = parseWindow(c.req.query('window'))
+  const aggExpr = buildAggregateExpr(seed, formula)
+
+  try {
+    const row = await c.env.DB.prepare(
+      `SELECT ${aggExpr} as value FROM content_${seed.slug} WHERE (${timeWindowSql(window)})`
+    ).first<{ value: number | null }>()
+    return c.json({ value: row?.value ?? 0, window })
+  } catch (err) {
+    console.error('[widget/aggregate] DB error:', err)
+    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+  }
+})
+
+widgetApp.get('/growth/:seed', async (c) => {
+  const seedSlug = c.req.param('seed')
+  const seed = c.get('getSeed')(seedSlug)
+  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+
+  const formula = parseFormula(c.req.query('formula'))
+  if (!formula) return c.json(error(400, 'Bad Request', 'Invalid or missing formula parameter (must be JSON)'), 400)
+
+  const window = parseWindow(c.req.query('window'))
+  const { current: currentSql, previous: previousSql } = previousWindowSql(window)
+  const aggExpr = buildAggregateExpr(seed, formula)
+  const table = `content_${seed.slug}`
+
+  try {
+    const [currentRow, previousRow] = await Promise.all([
+      c.env.DB.prepare(`SELECT ${aggExpr} as value FROM ${table} WHERE (${currentSql})`).first<{ value: number | null }>(),
+      c.env.DB.prepare(`SELECT ${aggExpr} as value FROM ${table} WHERE (${previousSql})`).first<{ value: number | null }>(),
+    ])
+
+    const current = currentRow?.value ?? 0
+    const previous = previousRow?.value ?? 0
+
+    let percentageChange = 0
+    let trend: 'up' | 'down' | 'flat' = 'flat'
+
+    if (previous !== 0) {
+      percentageChange = Math.round(((current - previous) / Math.abs(previous)) * 1000) / 10
+    } else if (current > 0) {
+      percentageChange = 100
+    }
+
+    if (percentageChange > 0) trend = 'up'
+    else if (percentageChange < 0) trend = 'down'
+
+    return c.json({ current, previous, percentageChange, trend })
+  } catch (err) {
+    console.error('[widget/growth] DB error:', err)
+    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+  }
+})
+
+widgetApp.get('/leaderboard/:seed', async (c) => {
+  const seedSlug = c.req.param('seed')
+  const seed = c.get('getSeed')(seedSlug)
+  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+
+  const scoreColumn = c.req.query('scoreColumn')
+  if (!scoreColumn) return c.json(error(400, 'Bad Request', 'Missing scoreColumn parameter'), 400)
+
+  const limitRaw = parseInt(c.req.query('limit') ?? '10', 10)
+  const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 100) : 10
+  const orderDir = c.req.query('orderDir') === 'asc' ? 'ASC' : 'DESC'
+  const scoreExpr = resolveColumnExpr(seed, scoreColumn)
+  const labelCol = resolveColumnExpr(seed, seed.displayNameAlias)
+  const table = `content_${seed.slug}`
+
+  try {
+    const rows = await c.env.DB.prepare(
+      `SELECT id, ${labelCol} as label, ${scoreExpr} as score
+       FROM ${table}
+       WHERE ${scoreExpr} IS NOT NULL
+       ORDER BY CAST(${scoreExpr} AS REAL) ${orderDir}
+       LIMIT ?`
+    ).bind(limit).all<{ id: string; label: string | null; score: number | string | null }>()
+
+    const entries = (rows.results ?? []).map(row => ({
+      id: row.id,
+      label: row.label ?? row.id,
+      score: row.score ?? 0,
+    }))
+
+    return c.json(entries)
+  } catch (err) {
+    console.error('[widget/leaderboard] DB error:', err)
+    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+  }
+})
+
+widgetApp.get('/list/:seed', async (c) => {
+  const seedSlug = c.req.param('seed')
+  const seed = c.get('getSeed')(seedSlug)
+  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+
+  const { DB } = c.env
+  const query = c.req.query()
+  const table = `content_${seed.slug}`
+
+  const limitRaw = parseInt(query.limit ?? '25', 10)
+  const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 100) : 25
+  const offsetRaw = parseInt(query.offset ?? '0', 10)
+  const offset = Number.isFinite(offsetRaw) && offsetRaw >= 0 ? offsetRaw : 0
+
+  const search = query.search?.trim() ?? ''
+  const displayCol = resolveColumnExpr(seed, seed.displayNameAlias)
+
+  const conditions: string[] = []
+  const bindings: unknown[] = []
+
+  if (search) {
+    conditions.push(`${displayCol} LIKE ?`)
+    bindings.push(`%${search}%`)
+  }
+
+  if (query.filters) {
+    try {
+      const rawFilters = JSON.parse(query.filters) as Array<{ column: string; op: string; value: unknown }>
+      for (const f of rawFilters) {
+        const expr = resolveColumnExpr(seed, f.column)
+        switch (f.op) {
+          case '=':
+          case 'eq':   conditions.push(`${expr} = ?`);                      bindings.push(f.value); break
+          case '!=':
+          case 'neq':  conditions.push(`${expr} != ?`);                     bindings.push(f.value); break
+          case 'like': conditions.push(`${expr} LIKE ?`);                   bindings.push(f.value); break
+          case '>':
+          case 'gt':   conditions.push(`CAST(${expr} AS REAL) > ?`);        bindings.push(f.value); break
+          case '<':
+          case 'lt':   conditions.push(`CAST(${expr} AS REAL) < ?`);        bindings.push(f.value); break
+        }
+      }
+    } catch {
+      return c.json(error(400, 'Bad Request', 'Invalid filters JSON'), 400)
+    }
+  }
+
+  const orderByAlias = query.orderBy ?? ''
+  const orderDir = query.orderDir === 'desc' ? 'DESC' : 'ASC'
+  const orderExpr = orderByAlias ? resolveColumnExpr(seed, orderByAlias) : 'created_at'
+  const whereSql = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : ''
+
+  try {
+    const [countRow, listRows] = await Promise.all([
+      DB.prepare(`SELECT COUNT(*) as total FROM ${table} ${whereSql}`)
+        .bind(...bindings)
+        .first<{ total: number }>(),
+      DB.prepare(
+        `SELECT id, slug, status, created_at, updated_at, ${seed.branches.map(b => b.alias).join(', ')}
+         FROM ${table} ${whereSql} ORDER BY ${orderExpr} ${orderDir} LIMIT ? OFFSET ?`
+      )
+        .bind(...bindings, limit, offset)
+        .all<Record<string, unknown>>(),
+    ])
+
+    const entries = (listRows.results ?? []).map(row => {
+      const data: Record<string, unknown> = {}
+      for (const branch of seed.branches) {
+        data[branch.alias] = deserializeFromDb(branch, row[branch.alias] ?? null)
+      }
+      return {
+        id: row.id as string,
+        slug: (row.slug as string | null) ?? '',
+        status: row.status as string,
+        createdAt: (row.created_at as number) ?? 0,
+        updatedAt: (row.updated_at as number) ?? 0,
+        ...data,
+      }
+    })
+
+    return c.json({ entries, total: countRow?.total ?? 0 })
+  } catch (err) {
+    console.error('[widget/list] DB error:', err)
+    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+  }
+})
+
+widgetApp.get('/timeseries/:seed', async (c) => {
+  const seedSlug = c.req.param('seed')
+  const seed = c.get('getSeed')(seedSlug)
+  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+
+  const valueColumn = c.req.query('valueColumn')
+  const groupColumn = c.req.query('groupColumn') ?? 'created_at'
+  const formulaOp = c.req.query('formula') ?? 'count'
+  const window = parseWindow(c.req.query('window'))
+  const table = `content_${seed.slug}`
+
+  if (!valueColumn && formulaOp !== 'count') {
+    return c.json(error(400, 'Bad Request', 'valueColumn is required when formula is not count'), 400)
+  }
+
+  const groupExpr = resolveColumnExpr(seed, groupColumn)
+  const dateBucketExpr = `strftime('%Y-%m-%d', ${groupExpr === 'created_at' ? groupExpr : `CAST(${groupExpr} AS INTEGER)`}, 'unixepoch')`
+
+  let aggExpr: string
+  if (formulaOp === 'count') {
+    aggExpr = 'COUNT(*)'
+  } else if (formulaOp === 'sum' && valueColumn) {
+    aggExpr = `SUM(CAST(${resolveColumnExpr(seed, valueColumn)} AS REAL))`
+  } else if (formulaOp === 'avg' && valueColumn) {
+    aggExpr = `AVG(CAST(${resolveColumnExpr(seed, valueColumn)} AS REAL))`
+  } else {
+    return c.json(error(400, 'Bad Request', 'formula must be sum, avg, or count'), 400)
+  }
+
+  try {
+    const rows = await c.env.DB.prepare(
+      `SELECT ${dateBucketExpr} as label, ${aggExpr} as value
+       FROM ${table}
+       WHERE (${timeWindowSql(window)})
+       GROUP BY ${dateBucketExpr}
+       ORDER BY ${dateBucketExpr} ASC`
+    ).bind().all<{ label: string | null; value: number | null }>()
+
+    const points = (rows.results ?? []).map(row => ({
+      label: row.label ?? '',
+      value: row.value ?? 0,
+    }))
+
+    return c.json({ points })
+  } catch (err) {
+    console.error('[widget/timeseries] DB error:', err)
+    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+  }
+})
+
+export { widgetApp }