@beechcms/api 0.4.0-preview.10 → 0.4.0-preview.12

package/src/factory.ts

@@ -2,7 +2,7 @@
 import { Hono } from 'hono'
 import { cors } from 'hono/cors'
 import { getCookie, setCookie, deleteCookie } from 'hono/cookie'
-import type { Seed } from '@beechcms/core'
+import type { Seed, ContentRepository, IdempotencyRepository } from '@beechcms/core'
 import type { Env, Variables } from './types'
 
 // Imports delle rotte e middleware
@@ -22,7 +22,7 @@ import {
   revokeRefreshToken,
 } from './auth/refresh'
 import { authMiddleware } from './middleware'
-import { contentRoutes } from './content'
+import contentFeature from './features/content'
 import { widgetApp } from './widget'
 import { rotateFieldApp } from './features/rotate-field'
 import { passwordResetApp } from './features/password-reset'
@@ -35,9 +35,12 @@ import { statsApp } from './features/stats'
 import { uploadRoutes, serveMediaHandler } from './upload'
 import { publicRoutes, apiKeyMiddleware, publicRateLimitMiddleware } from './public'
 import { searchRouter } from "./search"
+import { repositoryMiddleware } from './middleware/repository.middleware'
 
 export interface BeechConfig {
   seeds: Seed[] | Record<string, Seed>
+  repository?: ContentRepository
+  idempotencyRepository?: IdempotencyRepository
 }
 
 // --- Costanti e helper ---
@@ -71,11 +74,11 @@ function getRefreshTokenDeleteCookieOptions(secure: boolean) {
   }
 }
 
-function handleAuthError(c: any, err: unknown, operationName: string): Response {
-  if (c.env.ENV !== 'production') {
-    console.error(`${operationName} error:`, err)
+function handleAuthError(context: any, error: unknown, operationName: string): Response {
+  if (context.env.ENV !== 'production') {
+    console.error(`${operationName} error:`, error)
   }
-  return c.json({ error: AUTH_ERRORS.GENERIC_ERROR }, 500)
+  return context.json({ error: AUTH_ERRORS.GENERIC_ERROR }, 500)
 }
 
 function extractPublicSeed(path: string): string {
@@ -89,20 +92,28 @@ function extractPublicSeed(path: string): string {
  */
 export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Variables: Variables }> {
   const seedsArray = Array.isArray(config.seeds) ? config.seeds : Object.values(config.seeds)
-  const registry: Record<string, Seed> = Object.fromEntries(seedsArray.map(s => [s.slug, s]))
+  // Filter out any invalid objects that might have leaked into the registry (e.g. module exports)
+  const validSeeds = seedsArray.filter(s => s && typeof s === 'object' && 'slug' in s)
+  const registry: Record<string, Seed> = Object.fromEntries(validSeeds.map(s => [s.slug, s]))
   const getSeedFn = (slug: string): Seed | null => registry[slug] ?? null
 
   const app = new Hono<{ Bindings: Env; Variables: Variables }>()
 
   // 1. Core Middleware (Seeds, CORS, Security)
-  app.use('*', async (c, next) => {
-    c.set('getSeed', getSeedFn)
-    c.set('seedRegistry', registry)
+  app.use('*', async (context, next) => {
+    context.set('getSeed', getSeedFn)
+    context.set('seedRegistry', registry)
     await next()
   })
 
-  app.use('*', async (c, next) => {
-    const origins = (c.env.CORS_ORIGINS ?? 'http://localhost:5173')
+  // 1.1 Repository Injection
+  app.use('*', repositoryMiddleware({
+    repository: config.repository,
+    idempotencyRepository: config.idempotencyRepository,
+  }))
+
+  app.use('*', async (context, next) => {
+    const origins = (context.env.CORS_ORIGINS ?? 'http://localhost:5173')
       .split(',')
       .map((o) => o.trim())
       .filter(Boolean)
@@ -114,7 +125,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
         // Allow same-origin if the host matches
         try {
           const originUrl = new URL(origin)
-          const requestUrl = new URL(c.req.url)
+          const requestUrl = new URL(context.req.url)
           if (originUrl.hostname === requestUrl.hostname && originUrl.port === requestUrl.port) {
             return origin
           }
@@ -125,29 +136,29 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
       allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
       allowHeaders: ['Content-Type', 'Authorization', 'X-API-Key'],
       credentials: true,
-    })(c, next)
+    })(context, next)
   })
 
-  app.use('*', async (c, next) => {
+  app.use('*', async (context, next) => {
     await next()
-    if (c.req.path.startsWith('/admin')) return
-    c.header('X-Frame-Options', 'DENY')
-    c.header('X-Content-Type-Options', 'nosniff')
-    c.header('Referrer-Policy', 'strict-origin-when-cross-origin')
-    c.header('Permissions-Policy', 'geolocation=(), microphone=(), camera=()')
-    c.header('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'")
+    if (context.req.path.startsWith('/admin')) return
+    context.header('X-Frame-Options', 'DENY')
+    context.header('X-Content-Type-Options', 'nosniff')
+    context.header('Referrer-Policy', 'strict-origin-when-cross-origin')
+    context.header('Permissions-Policy', 'geolocation=(), microphone=(), camera=()')
+    context.header('Content-Security-Policy', "default-src 'self'; frame-ancestors 'none'")
   })
 
   // 2. Analytics Middleware
-  app.use('/api/*', async (c, next) => {
+  app.use('/api/*', async (context, next) => {
     await next()
-    if (c.req.method !== 'OPTIONS' && c.res.status >= 200 && c.res.status < 300) {
-      const db = c.env.DB
+    if (context.req.method !== 'OPTIONS' && context.res.status >= 200 && context.res.status < 300) {
+      const db = context.env.DB
       let executionCtx: any
-      try { executionCtx = c.executionCtx } catch {}
+      try { executionCtx = context.executionCtx } catch {}
 
       if (db && executionCtx) {
-        const seed = extractPublicSeed(c.req.path)
+        const seed = extractPublicSeed(context.req.path)
         executionCtx.waitUntil((async () => {
           try {
             const today = Math.floor(new Date().setHours(0, 0, 0, 0) / 1000)
@@ -156,8 +167,8 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
                VALUES (?, 'requests', ?, 1)
                ON CONFLICT(day_ts, metric, seed) DO UPDATE SET value = value + 1`
             ).bind(today, seed).run()
-          } catch (err) {
-            console.error('Analytics middleware error:', err)
+          } catch (error) {
+            console.error('Analytics middleware error:', error)
           }
         })())
       }
@@ -165,88 +176,88 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   })
 
   // 3. Auth Routes
-  app.post('/auth/login', async (c) => {
+  app.post('/auth/login', async (context) => {
     try {
       let body: any
-      try { body = await c.req.json() } catch { return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400) }
+      try { body = await context.req.json() } catch { return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400) }
       const credentials = parseLoginBody(body)
-      if (!credentials) return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
+      if (!credentials) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
       const { email, password } = credentials
-      if (!validateLoginInput(email, password)) return c.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
+      if (!validateLoginInput(email, password)) return context.json({ error: AUTH_ERRORS.INVALID_REQUEST }, 400)
 
-      const loginLimiter = c.env.LOGIN_RATE_LIMITER
+      const loginLimiter = context.env.LOGIN_RATE_LIMITER
       if (loginLimiter) {
-        const clientIp = getClientIp(c.req.raw.headers)
+        const clientIp = getClientIp(context.req.raw.headers)
         const { success } = await loginLimiter.limit({ key: `${clientIp}:${email}` })
-        if (!success) return c.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
+        if (!success) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
       }
 
-      const { DB, JWT_SECRET } = c.env
+      const { DB, JWT_SECRET } = context.env
       const user = await findUserByEmail(DB, email)
       const hashToCompare = user?.password_hash ?? DUMMY_PASSWORD_HASH
       const isValid = await verifyPassword(password, hashToCompare)
 
-      if (!user || !isValid) return c.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
+      if (!user || !isValid) return context.json({ error: AUTH_ERRORS.INVALID_CREDENTIALS }, 401)
 
       const userProfile = await DB.prepare('SELECT name FROM users WHERE id = ? LIMIT 1').bind(user.id).first<{ name: string | null }>()
       const accessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-        issuer: c.env.JWT_ISSUER,
-        audience: c.env.JWT_AUDIENCE,
+        issuer: context.env.JWT_ISSUER,
+        audience: context.env.JWT_AUDIENCE,
       }, userProfile?.name ?? undefined)
       const refreshToken = generateRefreshToken()
 
       await saveRefreshToken(DB, user.id, refreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
-      setCookie(c, 'refresh_token', refreshToken, getRefreshTokenCookieOptions(isRequestSecure(c.req.url)))
-      return c.json({ token: accessToken, expiresIn: '15m' }, 200)
-    } catch (err) {
-      return handleAuthError(c, err, 'Login')
+      setCookie(context, 'refresh_token', refreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
+      return context.json({ token: accessToken, expiresIn: '15m' }, 200)
+    } catch (error) {
+      return handleAuthError(context, error, 'Login')
     }
   })
 
-  app.post('/auth/refresh', async (c) => {
+  app.post('/auth/refresh', async (context) => {
     try {
-      const refreshLimiter = c.env.REFRESH_RATE_LIMITER
+      const refreshLimiter = context.env.REFRESH_RATE_LIMITER
       if (refreshLimiter) {
-        const clientIp = getClientIp(c.req.raw.headers)
+        const clientIp = getClientIp(context.req.raw.headers)
         const { success } = await refreshLimiter.limit({ key: clientIp })
-        if (!success) return c.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
+        if (!success) return context.json({ error: AUTH_ERRORS.RATE_LIMIT_EXCEEDED }, 429)
       }
 
-      const refreshToken = getCookie(c, 'refresh_token')
-      if (!refreshToken) return c.json({ error: 'Refresh token missing' }, 401)
+      const refreshToken = getCookie(context, 'refresh_token')
+      if (!refreshToken) return context.json({ error: 'Refresh token missing' }, 401)
 
-      const { DB, JWT_SECRET } = c.env
+      const { DB, JWT_SECRET } = context.env
       const validation = await validateRefreshToken(DB, refreshToken)
-      if (!validation.valid || !validation.userId) return c.json({ error: 'Invalid refresh token' }, 401)
+      if (!validation.valid || !validation.userId) return context.json({ error: 'Invalid refresh token' }, 401)
 
       const user = await DB.prepare('SELECT id, email, name FROM users WHERE id = ? LIMIT 1').bind(validation.userId).first<{ id: string; email: string; name: string | null }>()
-      if (!user) return c.json({ error: 'User not found' }, 401)
+      if (!user) return context.json({ error: 'User not found' }, 401)
 
       const revoked = await revokeRefreshToken(DB, refreshToken)
-      if (!revoked) return c.json({ error: 'Invalid refresh token' }, 401)
+      if (!revoked) return context.json({ error: 'Invalid refresh token' }, 401)
 
       const newAccessToken = await generateAccessToken(user.id, user.email, JWT_SECRET, {
-        issuer: c.env.JWT_ISSUER,
-        audience: c.env.JWT_AUDIENCE,
+        issuer: context.env.JWT_ISSUER,
+        audience: context.env.JWT_AUDIENCE,
       }, user.name ?? undefined)
       const newRefreshToken = generateRefreshToken()
 
       await saveRefreshToken(DB, user.id, newRefreshToken, REFRESH_TOKEN_EXPIRY_DAYS)
-      setCookie(c, 'refresh_token', newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(c.req.url)))
-      return c.json({ token: newAccessToken, expiresIn: '15m' }, 200)
-    } catch (err) {
-      return handleAuthError(c, err, 'Refresh')
+      setCookie(context, 'refresh_token', newRefreshToken, getRefreshTokenCookieOptions(isRequestSecure(context.req.url)))
+      return context.json({ token: newAccessToken, expiresIn: '15m' }, 200)
+    } catch (error) {
+      return handleAuthError(context, error, 'Refresh')
     }
   })
 
-  app.post('/auth/logout', async (c) => {
+  app.post('/auth/logout', async (context) => {
     try {
-      const refreshToken = getCookie(c, 'refresh_token')
-      if (refreshToken) await revokeRefreshToken(c.env.DB, refreshToken)
-      deleteCookie(c, 'refresh_token', getRefreshTokenDeleteCookieOptions(isRequestSecure(c.req.url)))
-      return c.json({ message: 'Logged out' }, 200)
-    } catch (err) {
-      return handleAuthError(c, err, 'Logout')
+      const refreshToken = getCookie(context, 'refresh_token')
+      if (refreshToken) await revokeRefreshToken(context.env.DB, refreshToken)
+      deleteCookie(context, 'refresh_token', getRefreshTokenDeleteCookieOptions(isRequestSecure(context.req.url)))
+      return context.json({ message: 'Logged out' }, 200)
+    } catch (error) {
+      return handleAuthError(context, error, 'Logout')
     }
   })
 
@@ -256,11 +267,11 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
   // 5. Protected CMS API
   const apiProtected = new Hono<{ Bindings: Env; Variables: Variables }>()
-  apiProtected.use('*', async (c, next) => {
-    await authMiddleware(c.env.JWT_SECRET, {
-      issuer: c.env.JWT_ISSUER,
-      audience: c.env.JWT_AUDIENCE,
-    })(c, next)
+  apiProtected.use('*', async (context, next) => {
+    await authMiddleware(context.env.JWT_SECRET, {
+      issuer: context.env.JWT_ISSUER,
+      audience: context.env.JWT_AUDIENCE,
+    })(context, next)
   })
 
   apiProtected.route('/settings', settingsApp)
@@ -269,35 +280,35 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   apiProtected.route('/content', statsApp)
   apiProtected.route('/content', rotateFieldApp)
   apiProtected.route('/content', draftApp)
-  apiProtected.route('/content', contentRoutes)
+  apiProtected.route('/content', contentFeature)
   apiProtected.route('/widget', widgetApp)
+  apiProtected.route('/', uploadRoutes)
   
-  app.route('/api', apiProtected)
-  app.route('/api/search', searchRouter)
-  app.route('/api', uploadRoutes)
-  app.get('/api/media/:key', (c) => serveMediaHandler(c))
-
-  // 6. Public API
+  // 6. Public API (must be registered before apiProtected to avoid auth middleware interception)
   const apiPublic = new Hono<{ Bindings: Env; Variables: Variables }>()
   apiPublic.use('*', publicRateLimitMiddleware())
   apiPublic.use('*', apiKeyMiddleware())
   apiPublic.route('/', publicRoutes)
   app.route('/api/v1/public', apiPublic)
 
+  app.get('/api/media/:key', (context) => serveMediaHandler(context))
+  app.route('/api', apiProtected)
+  app.route('/api/search', searchRouter)
+
   // 7. Dashboard SPA — serve static assets from Workers Assets binding
-  app.get('/admin', (c) => c.redirect('/admin/', 301))
-  app.get('/admin/*', async (c) => {
-    if (!c.env.ASSETS) {
-      return c.text('Dashboard not configured. Set up the ASSETS binding in wrangler.toml pointing to node_modules/@beechcms/api/assets/dashboard', 503)
+  app.get('/admin', (context) => context.redirect('/admin/', 301))
+  app.get('/admin/*', async (context) => {
+    if (!context.env.ASSETS) {
+      return context.text('Dashboard not configured. Set up the ASSETS binding in wrangler.toml pointing to node_modules/@beechcms/api/assets/dashboard', 503)
     }
-    const url = new URL(c.req.url)
+    const url = new URL(context.req.url)
     const originalPath = url.pathname
     url.pathname = originalPath.replace(/^\/admin/, '') || '/'
     
-    let assetResponse = await c.env.ASSETS.fetch(new Request(url.toString(), c.req.raw))
+    let assetResponse = await context.env.ASSETS.fetch(new Request(url.toString(), context.req.raw))
     if (assetResponse.status === 404) {
       // SPA fallback: any unmatched /admin/* route serves index.html
-      assetResponse = await c.env.ASSETS.fetch(new Request(new URL('/index.html', c.req.url)))
+      assetResponse = await context.env.ASSETS.fetch(new Request(new URL('/index.html', context.req.url)))
     }
     // ASSETS returns an immutable Response — wrap it to inject security headers
     const headers = new Headers(assetResponse.headers)

package/src/features/content/constants.ts

@@ -0,0 +1,10 @@
+export const CONTENT_ERRORS = {
+  INVALID_SLUG: 'Invalid slug',
+  INVALID_SLUG_OR_ID: 'Invalid slug or id',
+  INVALID_JSON_BODY: 'Invalid JSON body',
+  NOT_FOUND: 'Not found',
+  SEED_NOT_FOUND: 'Seed not found',
+  DATABASE_ERROR: 'Database error',
+  SLUG_CONFLICT: 'Slug already exists for this schema',
+  SENSITIVE_FIELD_EDIT: 'Cannot edit sensitive fields',
+} as const

package/src/features/content/handlers/create.ts

@@ -0,0 +1,163 @@
+import { Context } from 'hono'
+import { 
+  slugify, 
+  isValidContentStatus, 
+  validateAndSanitizeSeedPayload,
+  SlugConflictError
+} from '@beechcms/core'
+import { applyPrivacy, PrivacyPolicyError } from '../../../shared/apply-policies'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { logActivity } from '../../../shared/activity-logger'
+import { logContentEvent } from '../../../shared/content-utils'
+import { cleanStr } from '../../../shared/query-utils'
+import { AppEnv } from '../../../types'
+
+function normalizeBody(raw: unknown): Record<string, unknown> {
+  return typeof raw === 'object' && raw !== null ? (raw as Record<string, unknown>) : {}
+}
+
+function contentValidationProblem(
+  context: Context,
+  details: Array<{ field: string; expected: string; received: string; message: string }>
+) {
+  return publicProblem(context, { 
+    type: 'content-validation-failed', 
+    title: 'Bad Request', 
+    status: 400, 
+    detail: 'Validation failed', 
+    errors: details 
+  })
+}
+
+export async function createHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = normalizeBody(await context.req.json<unknown>())
+  } catch {
+    return publicProblem(context, { 
+      type: 'content-invalid-json', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_JSON_BODY 
+    })
+  }
+
+  const entrySlug = body.slug ? slugify(String(body.slug)) : null
+  const status = cleanStr(body.status) ?? 'draft'
+  if (!isValidContentStatus(status)) {
+    return publicProblem(context, { 
+      type: 'content-invalid-status', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: 'Invalid status. Allowed values are: draft, review, published' 
+    })
+  }
+
+  const bodyForData = { ...body }
+  delete bodyForData.slug
+  delete bodyForData.status
+
+  const validation = validateAndSanitizeSeedPayload(seed, bodyForData, {
+    operation: 'create', 
+    allowNull: false, 
+    requireAtLeastOneValidField: true, 
+    enforceRequiredFields: true,
+  })
+
+  if (validation.dangerousFields.length > 0) {
+    return publicProblem(context, { 
+      type: 'content-dangerous-content', 
+      title: 'Unprocessable Entity', 
+      status: 422, 
+      detail: `Content rejected: dangerous markup detected in field '${validation.dangerousFields[0]}'` 
+    })
+  }
+  
+  if (validation.details.length > 0) return contentValidationProblem(context, validation.details)
+
+  let privacyData: Record<string, unknown>
+  try {
+    privacyData = await applyPrivacy(validation.data, seed)
+  } catch (error) {
+    if (error instanceof PrivacyPolicyError) {
+      return publicProblem(context, { 
+        type: 'content-policy-not-implemented', 
+        title: 'Not Implemented', 
+        status: 501, 
+        detail: error.message 
+      })
+    }
+    throw error
+  }
+
+  const id = crypto.randomUUID()
+  let finalSlug = entrySlug
+  if (!finalSlug) {
+    const fallbackSource = privacyData[seed.displayNameAlias ?? 'title'] || privacyData.title || privacyData.name || id
+    finalSlug = slugify(String(fallbackSource))
+  }
+
+  try {
+    const repository = context.get('repository')
+    await repository.create(seed, id, finalSlug, status, privacyData)
+
+    const userId = context.get('jwtPayload')?.sub
+    const title = privacyData.title || privacyData.name || finalSlug
+    
+    // We use the DB from env for legacy logging utils until they are migrated
+    logContentEvent(context.env.DB, { 
+      action: 'create', 
+      schemaSlug: slug, 
+      entryId: id, 
+      userId, 
+      details: { title } 
+    }).catch(() => {})
+
+    logActivity(context, { 
+      action: 'create', 
+      entityType: 'content', 
+      entityId: id, 
+      entitySlug: slug, 
+      details: { title } 
+    })
+
+    return context.json({ id }, 201)
+  } catch (error) {
+    if (error instanceof SlugConflictError) {
+      return publicProblem(context, { 
+        type: 'content-slug-conflict', 
+        title: 'Conflict', 
+        status: 409, 
+        detail: CONTENT_ERRORS.SLUG_CONFLICT 
+      })
+    }
+    console.error('Content create error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/delete.ts

@@ -0,0 +1,85 @@
+import { Context } from 'hono'
+import { EntryNotFoundError } from '@beechcms/core'
+import { deleteR2Objects } from '../../../upload'
+import { extractMediaKeysFromData } from '../../../media-utils'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { logActivity } from '../../../shared/activity-logger'
+import { logContentEvent } from '../../../shared/content-utils'
+import { AppEnv } from '../../../types'
+
+export async function deleteHandler(context: Context<AppEnv>) {
+  const schemaSlug = context.req.param('slug')
+  const entryId = context.req.param('id')
+  if (!schemaSlug || !entryId) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug-or-id', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG_OR_ID 
+    })
+  }
+
+  const seed = context.get('getSeed')(schemaSlug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    // Repository.delete returns the row data for cleanup
+    const { row } = await repository.delete(seed, entryId)
+
+    const userId = context.get('jwtPayload')?.sub
+    const title = row.title || row.name || entryId
+    
+    logContentEvent(context.env.DB, { 
+      action: 'delete', 
+      schemaSlug, 
+      entryId, 
+      userId, 
+      details: { title } 
+    }).catch(() => {})
+
+    logActivity(context, { 
+      action: 'delete', 
+      entityType: 'content', 
+      entityId: entryId, 
+      entitySlug: schemaSlug, 
+      details: { title } 
+    })
+
+    // Task 4.3: Cleanup R2 logic
+    const r2ObjectKeys = extractMediaKeysFromData(seed, row)
+    if (r2ObjectKeys.length > 0) {
+      await deleteR2Objects(context.env, r2ObjectKeys).catch((error) => {
+        if (context.env.ENV !== 'production') {
+          console.warn('R2 cleanup on delete failed (orphaned files):', error)
+        }
+      })
+    }
+
+    return context.json({ success: true })
+  } catch (error) {
+    if (error instanceof EntryNotFoundError) {
+      return publicProblem(context, { 
+        type: 'content-not-found', 
+        title: 'Not Found', 
+        status: 404, 
+        detail: CONTENT_ERRORS.NOT_FOUND 
+      })
+    }
+    console.error('Content delete error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}

package/src/features/content/handlers/facets.ts

@@ -0,0 +1,45 @@
+import { Context } from 'hono'
+import { publicProblem } from '../../../public/problem-details'
+import { CONTENT_ERRORS } from '../constants'
+import { AppEnv } from '../../../types'
+
+export async function facetsHandler(context: Context<AppEnv>) {
+  const slug = context.req.param('slug')
+  if (!slug) {
+    return publicProblem(context, { 
+      type: 'content-invalid-slug', 
+      title: 'Bad Request', 
+      status: 400, 
+      detail: CONTENT_ERRORS.INVALID_SLUG 
+    })
+  }
+
+  const seed = context.get('getSeed')(slug)
+  if (!seed) {
+    return publicProblem(context, { 
+      type: 'content-seed-not-found', 
+      title: 'Not Found', 
+      status: 404, 
+      detail: CONTENT_ERRORS.SEED_NOT_FOUND 
+    })
+  }
+
+  try {
+    const repository = context.get('repository')
+    const { statuses, tagsByColumn } = await repository.getFacets(seed)
+
+    // Legacy format expected by the dashboard
+    return context.json({
+      statuses: Object.keys(statuses).sort((a, b) => a.localeCompare(b, 'it')),
+      tagsByColumnId: tagsByColumn,
+    })
+  } catch (error) {
+    console.error('Content facets error:', error)
+    return publicProblem(context, { 
+      type: 'content-database-error', 
+      title: 'Internal Server Error', 
+      status: 500, 
+      detail: CONTENT_ERRORS.DATABASE_ERROR 
+    })
+  }
+}