@beechcms/api 0.4.0 → 0.4.2

package/src/shared/system-stats.repository.d1.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi } from 'vitest'
+import { D1SystemStatsRepository } from './system-stats.repository.d1'
+
+function makeMockDb(firstResult: unknown = null) {
+  const runMock = vi.fn().mockResolvedValue({ success: true })
+  const firstMock = vi.fn().mockResolvedValue(firstResult)
+  // bind() returns the same statement interface for chained calls.
+  // The statement also exposes first() directly for queries without bind (e.g. getStorageUsage).
+  const bindMock = vi.fn(() => ({ run: runMock, first: firstMock }))
+  const stmt = { bind: bindMock, run: runMock, first: firstMock }
+  const prepareMock = vi.fn(() => stmt)
+  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
+}
+
+describe('D1SystemStatsRepository', () => {
+  describe('incrementStorage', () => {
+    it('calls UPDATE system_stats with the byte count', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SystemStatsRepository(db).incrementStorage(512)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE system_stats'))
+      expect(bindMock).toHaveBeenCalledWith(512)
+    })
+  })
+
+  describe('decrementStorage', () => {
+    it('calls UPDATE system_stats with MAX(0, ...) and the byte count', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SystemStatsRepository(db).decrementStorage(256)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('MAX(0'))
+      expect(bindMock).toHaveBeenCalledWith(256)
+    })
+  })
+
+  describe('setStorage', () => {
+    it('calls UPDATE system_stats with the stringified byte count', async () => {
+      const { db, prepareMock, bindMock } = makeMockDb()
+      await new D1SystemStatsRepository(db).setStorage(1024)
+      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('UPDATE system_stats'))
+      expect(bindMock).toHaveBeenCalledWith('1024')
+    })
+  })
+
+  describe('getStorageUsage', () => {
+    it('parses and returns the integer value from D1', async () => {
+      const { db } = makeMockDb({ value: '2048' })
+      expect(await new D1SystemStatsRepository(db).getStorageUsage()).toBe(2048)
+    })
+
+    it('returns 0 when D1 returns null (stat not initialised)', async () => {
+      const { db } = makeMockDb(null)
+      expect(await new D1SystemStatsRepository(db).getStorageUsage()).toBe(0)
+    })
+  })
+})

package/src/types.ts

@@ -1,5 +1,6 @@
 /// <reference types="@cloudflare/workers-types" />
-import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository } from '@beechcms/core'
+import type { Seed, ContentRepository, IdempotencyRepository, BeechBucket, MediaRepository, SystemStatsRepository, IHashProvider, ITokenService, IUserRepository, ISessionRepository, IPasswordResetTokenRepository, IActivityLogger, IActivityLogRepository, INotificationRepository, INotificationService, IWidgetRepository, ISearchRepository, IAnalyticsRepository, IContentScanRepository, ISeedRegistry, IClock, IIdGenerator, IAutomationRunner, IAutomationRepository, IScheduler } from '@beechcms/core'
+import type { IRateLimiterRegistry } from './middleware/rate-limit.middleware'
 
 export interface Env {
   DB: D1Database
@@ -22,6 +23,7 @@ export interface Env {
   MEDIA_BASE_URL?: string
   MEDIA_CDN_URL?: string
   RESEND_API_KEY?: string
+  EMAIL_API_KEY?: string
   APP_URL?: string
   EMAIL_FROM?: string
   FORGOT_PASSWORD_RATE_LIMITER?: RateLimit
@@ -33,14 +35,33 @@ export interface Env {
 }
 
 export interface Variables {
-  jwtPayload: { sub: string; email?: string }
+  jwtPayload: { sub: string; email?: string; name?: string | null }
   getSeed: (slug: string) => Seed | null
-  seedRegistry: Record<string, Seed>
+  seedRegistry: ISeedRegistry
   repository: ContentRepository
   idempotencyRepository: IdempotencyRepository
   bucket: BeechBucket
   mediaRepository: MediaRepository
   systemStatsRepository: SystemStatsRepository
+  hashProvider: IHashProvider
+  tokenService: ITokenService
+  userRepository: IUserRepository
+  sessionRepository: ISessionRepository
+  passwordResetTokenRepository: IPasswordResetTokenRepository
+  rateLimiters: IRateLimiterRegistry
+  activityLogger: IActivityLogger
+  activityLogRepository: IActivityLogRepository
+  notificationRepository: INotificationRepository
+  notificationService: INotificationService
+  widgetRepository: IWidgetRepository
+  searchRepository: ISearchRepository
+  analyticsRepository: IAnalyticsRepository
+  contentScanRepository: IContentScanRepository
+  clock: IClock
+  idGenerator: IIdGenerator
+  automationRepository: IAutomationRepository
+  automationRunner: IAutomationRunner
+  scheduler: IScheduler
 }
 
 export type AppEnv = { Bindings: Env; Variables: Variables }

package/src/upload.ts

@@ -5,7 +5,6 @@
  * e facilità di sviluppo locale.
  */
 import { Hono } from 'hono'
-import { logActivity } from './shared/activity-logger'
 import { AppEnv } from './types'
 
 /** Prefissi MIME consentiti (immagini e PDF) */
@@ -133,12 +132,20 @@ uploadRoutes.post('/upload', async (c) => {
 
     const publicUrl = bucket.getUrl(objectKey)
 
-    logActivity(c, {
-      action: 'upload',
-      entityType: 'media',
-      entityId: objectKey,
-      details: { name: file.name, size: file.size, type: file.type }
-    })
+    const jwtPayload = c.get('jwtPayload')
+    if (jwtPayload) {
+      c.get('activityLogger').log({
+        action: 'upload',
+        entityType: 'media',
+        entityId: objectKey,
+        details: { name: file.name, size: file.size, type: file.type },
+        actor: {
+          id: jwtPayload.sub,
+          email: jwtPayload.email ?? 'unknown',
+          name: jwtPayload.name ?? null,
+        },
+      })
+    }
 
     return c.json({ url: publicUrl }, 200)
   } catch (err) {
@@ -151,7 +158,7 @@ uploadRoutes.post('/upload', async (c) => {
 uploadRoutes.delete('/upload/:key', async (c) => {
   const key = c.req.param('key')
   if (!key) return c.json({ error: 'Missing key' }, 400)
-  
+
   await deleteR2Objects(c, [decodeURIComponent(key)])
   return c.json({ success: true }, 200)
 })
@@ -171,9 +178,10 @@ export async function serveMediaHandler(c: any): Promise<Response> {
     const headers = new Headers()
     headers.set('Content-Type', object.contentType ?? 'application/octet-stream')
     headers.set('Cache-Control', 'public, max-age=31536000, immutable')
-    
+
     return new Response(object.body, { status: 200, headers })
   } catch (err) {
+    console.error(`[serveMediaHandler] Error serving file ${key}:`, err)
     return new Response('Internal error', { status: 500 })
   }
 }

package/src/widget.ts

@@ -1,91 +1,15 @@
 /// <reference types="@cloudflare/workers-types" />
 import { Hono } from 'hono'
 import { deserializeFromDb } from '@beechcms/core'
-import type { Seed } from '@beechcms/core'
+import type { AggregateFormula, TimeWindow } from '@beechcms/core'
 import type { Env, Variables } from './types'
 
 const widgetApp = new Hono<{ Bindings: Env; Variables: Variables }>()
 
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-type AggregateFormula =
-  | { op: 'count' }
-  | { op: 'sum'; column: string }
-  | { op: 'avg'; column: string }
-  | { op: 'min'; column: string }
-  | { op: 'max'; column: string }
-  | { op: 'countWhere'; column: string; value: unknown }
-  | { op: 'percentageOf'; numeratorColumn: string; denominatorColumn: string }
-
-type TimeWindow = 'week' | 'month' | 'year' | 'all'
-
-function timeWindowSql(window: TimeWindow): string {
-  switch (window) {
-    case 'week':  return "created_at >= unixepoch('now', '-7 days')"
-    case 'month': return "created_at >= unixepoch('now', '-1 month')"
-    case 'year':  return "created_at >= unixepoch('now', '-1 year')"
-    case 'all':   return '1=1'
-  }
-}
-
-function previousWindowSql(window: TimeWindow): { current: string; previous: string } {
-  switch (window) {
-    case 'week':
-      return {
-        current:  "created_at >= unixepoch('now', '-7 days')",
-        previous: "created_at >= unixepoch('now', '-14 days') AND created_at < unixepoch('now', '-7 days')",
-      }
-    case 'month':
-      return {
-        current:  "created_at >= unixepoch('now', '-1 month')",
-        previous: "created_at >= unixepoch('now', '-2 months') AND created_at < unixepoch('now', '-1 month')",
-      }
-    case 'year':
-      return {
-        current:  "created_at >= unixepoch('now', '-1 year')",
-        previous: "created_at >= unixepoch('now', '-2 years') AND created_at < unixepoch('now', '-1 year')",
-      }
-    case 'all':
-      return { current: '1=1', previous: '1=0' }
-  }
-}
-
-const SYSTEM_COLUMNS = new Set(['created_at', 'updated_at', 'status', 'id', 'slug'])
-
-// In v0.4.0 alias = column name. Validate against seed to prevent injection.
-function resolveColumnExpr(seed: Seed, alias: string): string {
-  if (SYSTEM_COLUMNS.has(alias)) return alias
-  const branch = seed.branches.find(b => b.alias === alias)
-  return branch ? branch.alias : 'id'
-}
-
-function buildAggregateExpr(seed: Seed, formula: AggregateFormula): string {
-  switch (formula.op) {
-    case 'count':
-      return 'COUNT(*)'
-    case 'sum':
-      return `SUM(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
-    case 'avg':
-      return `AVG(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
-    case 'min':
-      return `MIN(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
-    case 'max':
-      return `MAX(CAST(${resolveColumnExpr(seed, formula.column)} AS REAL))`
-    case 'countWhere': {
-      const expr = resolveColumnExpr(seed, formula.column)
-      const val = formula.value
-      if (val === null) return `COUNT(CASE WHEN ${expr} IS NULL THEN 1 END)`
-      if (typeof val === 'boolean') return `COUNT(CASE WHEN ${expr} = ${val ? 1 : 0} THEN 1 END)`
-      if (typeof val === 'number') return `COUNT(CASE WHEN CAST(${expr} AS REAL) = ${val} THEN 1 END)`
-      return `COUNT(CASE WHEN ${expr} = '${String(val).replace(/'/g, "''")}' THEN 1 END)`
-    }
-    case 'percentageOf': {
-      const num = resolveColumnExpr(seed, formula.numeratorColumn)
-      const den = resolveColumnExpr(seed, formula.denominatorColumn)
-      return `CASE WHEN SUM(CAST(${den} AS REAL)) = 0 THEN 0 ELSE (SUM(CAST(${num} AS REAL)) * 100.0 / SUM(CAST(${den} AS REAL))) END`
-    }
-  }
-}
+const DEFAULT_LEADERBOARD_LIMIT = 10
+const MAXIMUM_LEADERBOARD_LIMIT = 100
+const DEFAULT_LIST_LIMIT = 25
+const MAXIMUM_LIST_LIMIT = 100
 
 function parseFormula(raw: string | undefined): AggregateFormula | null {
   if (!raw) return null
@@ -103,178 +27,130 @@ function parseWindow(raw: string | undefined): TimeWindow {
   return 'all'
 }
 
-function error(status: number, title: string, detail: string) {
+function parseBoundedInt(raw: string | undefined, fallback: number, maximum: number, minimum = 1): number {
+  const parsed = parseInt(raw ?? String(fallback), 10)
+  if (!Number.isFinite(parsed) || parsed < minimum) return fallback
+  return Math.min(parsed, maximum)
+}
+
+function problem(status: number, title: string, detail: string) {
   return { type: 'about:blank', title, status, detail }
 }
 
-// ─── Routes ─────────────────────────────────────────────────────────────────
+function isUnsafeColumnError(error: unknown): boolean {
+  return error instanceof Error && error.message === 'UNSAFE_COLUMN'
+}
 
-widgetApp.get('/aggregate/:seed', async (c) => {
-  const seedSlug = c.req.param('seed')
-  const seed = c.get('getSeed')(seedSlug)
-  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+widgetApp.get('/aggregate/:seed', async (context) => {
+  const seedSlug = context.req.param('seed')
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) return context.json(problem(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
 
-  const formula = parseFormula(c.req.query('formula'))
-  if (!formula) return c.json(error(400, 'Bad Request', 'Invalid or missing formula parameter (must be JSON)'), 400)
+  const formula = parseFormula(context.req.query('formula'))
+  if (!formula) return context.json(problem(400, 'Bad Request', 'Invalid or missing formula parameter (must be JSON)'), 400)
 
-  const window = parseWindow(c.req.query('window'))
-  const aggExpr = buildAggregateExpr(seed, formula)
+  const window = parseWindow(context.req.query('window'))
 
   try {
-    const row = await c.env.DB.prepare(
-      `SELECT ${aggExpr} as value FROM content_${seed.slug} WHERE (${timeWindowSql(window)})`
-    ).first<{ value: number | null }>()
-    return c.json({ value: row?.value ?? 0, window })
-  } catch (err) {
-    console.error('[widget/aggregate] DB error:', err)
-    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+    const value = await context.get('widgetRepository').aggregate(seed, formula, window)
+    return context.json({ value, window })
+  } catch (error) {
+    if (isUnsafeColumnError(error)) return context.json(problem(400, 'Bad Request', 'Invalid column reference'), 400)
+    console.error('[widget/aggregate] DB error:', error)
+    return context.json(problem(500, 'Internal Server Error', 'Database error'), 500)
   }
 })
 
-widgetApp.get('/growth/:seed', async (c) => {
-  const seedSlug = c.req.param('seed')
-  const seed = c.get('getSeed')(seedSlug)
-  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+widgetApp.get('/growth/:seed', async (context) => {
+  const seedSlug = context.req.param('seed')
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) return context.json(problem(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
 
-  const formula = parseFormula(c.req.query('formula'))
-  if (!formula) return c.json(error(400, 'Bad Request', 'Invalid or missing formula parameter (must be JSON)'), 400)
+  const formula = parseFormula(context.req.query('formula'))
+  if (!formula) return context.json(problem(400, 'Bad Request', 'Invalid or missing formula parameter (must be JSON)'), 400)
 
-  const window = parseWindow(c.req.query('window'))
-  const { current: currentSql, previous: previousSql } = previousWindowSql(window)
-  const aggExpr = buildAggregateExpr(seed, formula)
-  const table = `content_${seed.slug}`
+  const window = parseWindow(context.req.query('window'))
 
   try {
-    const [currentRow, previousRow] = await Promise.all([
-      c.env.DB.prepare(`SELECT ${aggExpr} as value FROM ${table} WHERE (${currentSql})`).first<{ value: number | null }>(),
-      c.env.DB.prepare(`SELECT ${aggExpr} as value FROM ${table} WHERE (${previousSql})`).first<{ value: number | null }>(),
-    ])
-
-    const current = currentRow?.value ?? 0
-    const previous = previousRow?.value ?? 0
+    const { currentValue, previousValue } = await context
+      .get('widgetRepository')
+      .growth(seed, formula, window)
 
     let percentageChange = 0
-    let trend: 'up' | 'down' | 'flat' = 'flat'
-
-    if (previous !== 0) {
-      percentageChange = Math.round(((current - previous) / Math.abs(previous)) * 1000) / 10
-    } else if (current > 0) {
+    if (previousValue !== 0) {
+      percentageChange = Math.round(((currentValue - previousValue) / Math.abs(previousValue)) * 1000) / 10
+    } else if (currentValue > 0) {
       percentageChange = 100
     }
 
+    let trend: 'up' | 'down' | 'flat' = 'flat'
     if (percentageChange > 0) trend = 'up'
     else if (percentageChange < 0) trend = 'down'
 
-    return c.json({ current, previous, percentageChange, trend })
-  } catch (err) {
-    console.error('[widget/growth] DB error:', err)
-    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+    return context.json({ current: currentValue, previous: previousValue, percentageChange, trend })
+  } catch (error) {
+    if (isUnsafeColumnError(error)) return context.json(problem(400, 'Bad Request', 'Invalid column reference'), 400)
+    console.error('[widget/growth] DB error:', error)
+    return context.json(problem(500, 'Internal Server Error', 'Database error'), 500)
   }
 })
 
-widgetApp.get('/leaderboard/:seed', async (c) => {
-  const seedSlug = c.req.param('seed')
-  const seed = c.get('getSeed')(seedSlug)
-  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+widgetApp.get('/leaderboard/:seed', async (context) => {
+  const seedSlug = context.req.param('seed')
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) return context.json(problem(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
 
-  const scoreColumn = c.req.query('scoreColumn')
-  if (!scoreColumn) return c.json(error(400, 'Bad Request', 'Missing scoreColumn parameter'), 400)
+  const scoreColumn = context.req.query('scoreColumn')
+  if (!scoreColumn) return context.json(problem(400, 'Bad Request', 'Missing scoreColumn parameter'), 400)
 
-  const limitRaw = parseInt(c.req.query('limit') ?? '10', 10)
-  const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 100) : 10
-  const orderDir = c.req.query('orderDir') === 'asc' ? 'ASC' : 'DESC'
-  const scoreExpr = resolveColumnExpr(seed, scoreColumn)
-  const labelCol = resolveColumnExpr(seed, seed.displayNameAlias)
-  const table = `content_${seed.slug}`
+  const limit = parseBoundedInt(context.req.query('limit'), DEFAULT_LEADERBOARD_LIMIT, MAXIMUM_LEADERBOARD_LIMIT)
+  const orderDirection: 'ASC' | 'DESC' = context.req.query('orderDir') === 'asc' ? 'ASC' : 'DESC'
 
   try {
-    const rows = await c.env.DB.prepare(
-      `SELECT id, ${labelCol} as label, ${scoreExpr} as score
-       FROM ${table}
-       WHERE ${scoreExpr} IS NOT NULL
-       ORDER BY CAST(${scoreExpr} AS REAL) ${orderDir}
-       LIMIT ?`
-    ).bind(limit).all<{ id: string; label: string | null; score: number | string | null }>()
-
-    const entries = (rows.results ?? []).map(row => ({
-      id: row.id,
-      label: row.label ?? row.id,
-      score: row.score ?? 0,
-    }))
-
-    return c.json(entries)
-  } catch (err) {
-    console.error('[widget/leaderboard] DB error:', err)
-    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+    const entries = await context
+      .get('widgetRepository')
+      .leaderboard(seed, { scoreColumn, limit, orderDirection })
+    return context.json(entries)
+  } catch (error) {
+    if (isUnsafeColumnError(error)) return context.json(problem(400, 'Bad Request', 'Invalid column reference'), 400)
+    console.error('[widget/leaderboard] DB error:', error)
+    return context.json(problem(500, 'Internal Server Error', 'Database error'), 500)
   }
 })
 
-widgetApp.get('/list/:seed', async (c) => {
-  const seedSlug = c.req.param('seed')
-  const seed = c.get('getSeed')(seedSlug)
-  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
-
-  const { DB } = c.env
-  const query = c.req.query()
-  const table = `content_${seed.slug}`
+widgetApp.get('/list/:seed', async (context) => {
+  const seedSlug = context.req.param('seed')
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) return context.json(problem(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
 
-  const limitRaw = parseInt(query.limit ?? '25', 10)
-  const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(limitRaw, 100) : 25
+  const query = context.req.query()
+  const limit = parseBoundedInt(query.limit, DEFAULT_LIST_LIMIT, MAXIMUM_LIST_LIMIT)
   const offsetRaw = parseInt(query.offset ?? '0', 10)
   const offset = Number.isFinite(offsetRaw) && offsetRaw >= 0 ? offsetRaw : 0
+  const search = query.search?.trim() || undefined
+  const orderByColumn = query.orderBy || undefined
+  const orderDirection: 'ASC' | 'DESC' = query.orderDir === 'desc' ? 'DESC' : 'ASC'
 
-  const search = query.search?.trim() ?? ''
-  const displayCol = resolveColumnExpr(seed, seed.displayNameAlias)
-
-  const conditions: string[] = []
-  const bindings: unknown[] = []
-
-  if (search) {
-    conditions.push(`${displayCol} LIKE ?`)
-    bindings.push(`%${search}%`)
-  }
-
+  let filters: Array<{ column: string; op: string; value: unknown }> | undefined
   if (query.filters) {
     try {
-      const rawFilters = JSON.parse(query.filters) as Array<{ column: string; op: string; value: unknown }>
-      for (const f of rawFilters) {
-        const expr = resolveColumnExpr(seed, f.column)
-        switch (f.op) {
-          case '=':
-          case 'eq':   conditions.push(`${expr} = ?`);                      bindings.push(f.value); break
-          case '!=':
-          case 'neq':  conditions.push(`${expr} != ?`);                     bindings.push(f.value); break
-          case 'like': conditions.push(`${expr} LIKE ?`);                   bindings.push(f.value); break
-          case '>':
-          case 'gt':   conditions.push(`CAST(${expr} AS REAL) > ?`);        bindings.push(f.value); break
-          case '<':
-          case 'lt':   conditions.push(`CAST(${expr} AS REAL) < ?`);        bindings.push(f.value); break
-        }
-      }
+      filters = JSON.parse(query.filters) as Array<{ column: string; op: string; value: unknown }>
     } catch {
-      return c.json(error(400, 'Bad Request', 'Invalid filters JSON'), 400)
+      return context.json(problem(400, 'Bad Request', 'Invalid filters JSON'), 400)
     }
   }
 
-  const orderByAlias = query.orderBy ?? ''
-  const orderDir = query.orderDir === 'desc' ? 'DESC' : 'ASC'
-  const orderExpr = orderByAlias ? resolveColumnExpr(seed, orderByAlias) : 'created_at'
-  const whereSql = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : ''
-
   try {
-    const [countRow, listRows] = await Promise.all([
-      DB.prepare(`SELECT COUNT(*) as total FROM ${table} ${whereSql}`)
-        .bind(...bindings)
-        .first<{ total: number }>(),
-      DB.prepare(
-        `SELECT id, slug, status, created_at, updated_at, ${seed.branches.map(b => b.alias).join(', ')}
-         FROM ${table} ${whereSql} ORDER BY ${orderExpr} ${orderDir} LIMIT ? OFFSET ?`
-      )
-        .bind(...bindings, limit, offset)
-        .all<Record<string, unknown>>(),
-    ])
-
-    const entries = (listRows.results ?? []).map(row => {
+    const { entries, totalCount } = await context.get('widgetRepository').list(seed, {
+      limit,
+      offset,
+      search,
+      filters,
+      orderByColumn,
+      orderDirection,
+    })
+
+    const deserializedEntries = entries.map(row => {
       const data: Record<string, unknown> = {}
       for (const branch of seed.branches) {
         data[branch.alias] = deserializeFromDb(branch, row[branch.alias] ?? null)
@@ -289,60 +165,43 @@ widgetApp.get('/list/:seed', async (c) => {
       }
     })
 
-    return c.json({ entries, total: countRow?.total ?? 0 })
-  } catch (err) {
-    console.error('[widget/list] DB error:', err)
-    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+    return context.json({ entries: deserializedEntries, total: totalCount })
+  } catch (error) {
+    if (isUnsafeColumnError(error)) return context.json(problem(400, 'Bad Request', 'Invalid column reference'), 400)
+    console.error('[widget/list] DB error:', error)
+    return context.json(problem(500, 'Internal Server Error', 'Database error'), 500)
   }
 })
 
-widgetApp.get('/timeseries/:seed', async (c) => {
-  const seedSlug = c.req.param('seed')
-  const seed = c.get('getSeed')(seedSlug)
-  if (!seed) return c.json(error(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
+widgetApp.get('/timeseries/:seed', async (context) => {
+  const seedSlug = context.req.param('seed')
+  const seed = context.get('getSeed')(seedSlug)
+  if (!seed) return context.json(problem(404, 'Not Found', `Seed '${seedSlug}' not found`), 404)
 
-  const valueColumn = c.req.query('valueColumn')
-  const groupColumn = c.req.query('groupColumn') ?? 'created_at'
-  const formulaOp = c.req.query('formula') ?? 'count'
-  const window = parseWindow(c.req.query('window'))
-  const table = `content_${seed.slug}`
+  const valueColumn = context.req.query('valueColumn')
+  const groupColumn = context.req.query('groupColumn') ?? 'created_at'
+  const formulaOp = context.req.query('formula') ?? 'count'
+  const window = parseWindow(context.req.query('window'))
 
   if (!valueColumn && formulaOp !== 'count') {
-    return c.json(error(400, 'Bad Request', 'valueColumn is required when formula is not count'), 400)
+    return context.json(problem(400, 'Bad Request', 'valueColumn is required when formula is not count'), 400)
   }
 
-  const groupExpr = resolveColumnExpr(seed, groupColumn)
-  const dateBucketExpr = `strftime('%Y-%m-%d', ${groupExpr === 'created_at' ? groupExpr : `CAST(${groupExpr} AS INTEGER)`}, 'unixepoch')`
-
-  let aggExpr: string
-  if (formulaOp === 'count') {
-    aggExpr = 'COUNT(*)'
-  } else if (formulaOp === 'sum' && valueColumn) {
-    aggExpr = `SUM(CAST(${resolveColumnExpr(seed, valueColumn)} AS REAL))`
-  } else if (formulaOp === 'avg' && valueColumn) {
-    aggExpr = `AVG(CAST(${resolveColumnExpr(seed, valueColumn)} AS REAL))`
-  } else {
-    return c.json(error(400, 'Bad Request', 'formula must be sum, avg, or count'), 400)
-  }
+  let formula: AggregateFormula
+  if (formulaOp === 'count') formula = { op: 'count' }
+  else if (formulaOp === 'sum' && valueColumn) formula = { op: 'sum', column: valueColumn }
+  else if (formulaOp === 'avg' && valueColumn) formula = { op: 'avg', column: valueColumn }
+  else return context.json(problem(400, 'Bad Request', 'formula must be sum, avg, or count'), 400)
 
   try {
-    const rows = await c.env.DB.prepare(
-      `SELECT ${dateBucketExpr} as label, ${aggExpr} as value
-       FROM ${table}
-       WHERE (${timeWindowSql(window)})
-       GROUP BY ${dateBucketExpr}
-       ORDER BY ${dateBucketExpr} ASC`
-    ).bind().all<{ label: string | null; value: number | null }>()
-
-    const points = (rows.results ?? []).map(row => ({
-      label: row.label ?? '',
-      value: row.value ?? 0,
-    }))
-
-    return c.json({ points })
-  } catch (err) {
-    console.error('[widget/timeseries] DB error:', err)
-    return c.json(error(500, 'Internal Server Error', 'Database error'), 500)
+    const points = await context
+      .get('widgetRepository')
+      .timeseries(seed, formula, window, groupColumn)
+    return context.json({ points })
+  } catch (error) {
+    if (isUnsafeColumnError(error)) return context.json(problem(400, 'Bad Request', 'Invalid column reference'), 400)
+    console.error('[widget/timeseries] DB error:', error)
+    return context.json(problem(500, 'Internal Server Error', 'Database error'), 500)
   }
 })