@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.3

package/src/shared/d1-session.repository.ts

@@ -1,102 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { ISessionRepository, NewRefreshToken, RefreshTokenRecord, ActiveSessionSummary, IClock } from '@beechcms/core'
-
-type RefreshTokenRow = {
-  id: string
-  user_id: string
-  token_hash: string
-  expires_at: number
-  created_at: number
-  revoked_at: number | null
-}
-
-type SessionSummaryRow = {
-  id: string
-  created_at: number
-  expires_at: number
-}
-
-function rowToRecord(row: RefreshTokenRow): RefreshTokenRecord {
-  return {
-    id: row.id,
-    userId: row.user_id,
-    tokenHash: row.token_hash,
-    expiresAt: row.expires_at,
-    createdAt: row.created_at,
-    revokedAt: row.revoked_at,
-  }
-}
-
-export class D1SessionRepository implements ISessionRepository {
-  constructor(
-    private readonly db: D1Database,
-    private readonly clock: IClock,
-  ) {}
-
-  async saveRefreshToken(record: NewRefreshToken): Promise<void> {
-    await this.db
-      .prepare('INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?)')
-      .bind(record.id, record.userId, record.tokenHash, record.expiresAt, this.clock.nowSeconds())
-      .run()
-  }
-
-  async findActiveByHash(tokenHash: string, nowTimestamp: number): Promise<RefreshTokenRecord | null> {
-    const row = await this.db
-      .prepare(
-        `SELECT id, user_id, token_hash, expires_at, created_at, revoked_at
-         FROM refresh_tokens
-         WHERE token_hash = ? AND expires_at > ? AND revoked_at IS NULL
-         LIMIT 1`
-      )
-      .bind(tokenHash, nowTimestamp)
-      .first<RefreshTokenRow>()
-    return row ? rowToRecord(row) : null
-  }
-
-  async revokeByHash(tokenHash: string, nowTimestamp: number): Promise<boolean> {
-    const result = await this.db
-      .prepare(
-        `UPDATE refresh_tokens
-         SET revoked_at = ?
-         WHERE token_hash = ? AND revoked_at IS NULL AND expires_at >= ?`
-      )
-      .bind(nowTimestamp, tokenHash, nowTimestamp)
-      .run()
-    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-    return changes > 0
-  }
-
-  async revokeAllForUser(userId: string, nowTimestamp: number): Promise<void> {
-    await this.db
-      .prepare('UPDATE refresh_tokens SET revoked_at = ? WHERE user_id = ? AND revoked_at IS NULL')
-      .bind(nowTimestamp, userId)
-      .run()
-  }
-
-  async listActiveForUser(userId: string, nowTimestamp: number, limit: number): Promise<ActiveSessionSummary[]> {
-    const { results } = await this.db
-      .prepare(
-        `SELECT id, created_at, expires_at FROM refresh_tokens
-         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?
-         ORDER BY created_at DESC LIMIT ?`
-      )
-      .bind(userId, nowTimestamp, limit)
-      .all<SessionSummaryRow>()
-    return (results ?? []).map(row => ({ id: row.id, createdAt: row.created_at, expiresAt: row.expires_at }))
-  }
-
-  async revokeById(sessionId: string, userId: string, nowTimestamp: number): Promise<boolean> {
-    const result = await this.db
-      .prepare(
-        'UPDATE refresh_tokens SET revoked_at = ? WHERE id = ? AND user_id = ? AND revoked_at IS NULL'
-      )
-      .bind(nowTimestamp, sessionId, userId)
-      .run()
-    const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-    return changes > 0
-  }
-}

package/src/shared/d1-setup-checklist.repository.ts

@@ -1,36 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-
-export interface ISetupChecklistRepository {
-  getExistingTableNames(): Promise<Set<string>>
-  countAdmins(): Promise<number>
-  countEntriesInSeed(slug: string): Promise<number>
-}
-
-export class D1SetupChecklistRepository implements ISetupChecklistRepository {
-  constructor(private readonly db: D1Database) {}
-
-  async getExistingTableNames(): Promise<Set<string>> {
-    const result = await this.db
-      .prepare(`SELECT name FROM sqlite_master WHERE type='table'`)
-      .all<{ name: string }>()
-    return new Set((result.results ?? []).map(row => row.name))
-  }
-
-  async countAdmins(): Promise<number> {
-    const result = await this.db
-      .prepare(`SELECT COUNT(*) as count FROM users WHERE role = 'admin'`)
-      .first<{ count: number }>()
-    return result?.count ?? 0
-  }
-
-  async countEntriesInSeed(slug: string): Promise<number> {
-    const result = await this.db
-      .prepare(`SELECT COUNT(*) as count FROM content_${slug}`)
-      .first<{ count: number }>()
-    return result?.count ?? 0
-  }
-}

package/src/shared/d1-user.repository.test.ts

@@ -1,151 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import { D1UserRepository } from './d1-user.repository'
-
-const USER_ROW = {
-  id: 'u1',
-  email: 'test@test.com',
-  name: 'Test User',
-  password_hash: 'hash-abc',
-  role: 'admin',
-  avatar_url: null,
-  notification_prefs: '{}',
-}
-
-function makeMockDb(opts: {
-  firstResult?: unknown
-  runChanges?: number
-  allResults?: unknown[]
-} = {}) {
-  const { firstResult = null, runChanges = 1, allResults = [] } = opts
-  const runMock = vi.fn().mockResolvedValue({ success: true, meta: { changes: runChanges } })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const allMock = vi.fn().mockResolvedValue({ results: allResults })
-  const bindMock = vi.fn(() => ({ first: firstMock, all: allMock, run: runMock }))
-  // prepare() may be called without bind() for countAll (which calls .first() directly)
-  const prepareMock = vi.fn(() => ({ bind: bindMock, first: firstMock, run: runMock }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, runMock, firstMock }
-}
-
-describe('D1UserRepository', () => {
-  describe('countAll', () => {
-    it('returns the count value from the database', async () => {
-      const { db, firstMock } = makeMockDb()
-      firstMock.mockResolvedValue({ count: 5 })
-      expect(await new D1UserRepository(db).countAll()).toBe(5)
-    })
-
-    it('returns 0 when the query returns null', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).countAll()).toBe(0)
-    })
-  })
-
-  describe('findByEmail', () => {
-    it('returns a UserRecord with camelCase keys mapped from the snake_case row', async () => {
-      const { db } = makeMockDb({ firstResult: USER_ROW })
-      const result = await new D1UserRepository(db).findByEmail('test@test.com')
-      expect(result).toEqual({
-        id: 'u1',
-        email: 'test@test.com',
-        name: 'Test User',
-        passwordHash: 'hash-abc',
-        role: 'admin',
-        avatarUrl: null,
-        notificationPreferences: '{}',
-      })
-    })
-
-    it('returns null when no user is found', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).findByEmail('nobody@test.com')).toBeNull()
-    })
-  })
-
-  describe('findById', () => {
-    it('returns a mapped UserRecord when found', async () => {
-      const { db } = makeMockDb({ firstResult: USER_ROW })
-      const result = await new D1UserRepository(db).findById('u1')
-      expect(result?.id).toBe('u1')
-      expect(result?.passwordHash).toBe('hash-abc')
-    })
-
-    it('returns null when the user is not found', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).findById('unknown')).toBeNull()
-    })
-  })
-
-  describe('create', () => {
-    it('calls prepare with an INSERT INTO users statement', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).create({
-        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test', surname: null,
-      })
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('INSERT INTO users'))
-    })
-
-    it('binds id, email, passwordHash, role, name, surname in the correct order', async () => {
-      const { db, bindMock } = makeMockDb()
-      await new D1UserRepository(db).create({
-        id: 'u1', email: 'a@b.com', passwordHash: 'hash', role: 'admin', name: 'Test', surname: null,
-      })
-      expect(bindMock).toHaveBeenCalledWith('u1', 'a@b.com', 'hash', 'admin', 'Test', null)
-    })
-  })
-
-  describe('updateProfile', () => {
-    it('does nothing when no fields are provided', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateProfile('u1', {})
-      expect(prepareMock).not.toHaveBeenCalled()
-    })
-
-    it('generates a SET clause containing only the provided field', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateProfile('u1', { name: 'New Name' })
-      const sql: string = prepareMock.mock.calls[0][0]
-      expect(sql).toContain('name = ?')
-      expect(sql).not.toContain('email = ?')
-    })
-
-    it('includes both fields when both name and email are provided', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateProfile('u1', { name: 'N', email: 'e@e.com' })
-      const sql: string = prepareMock.mock.calls[0][0]
-      expect(sql).toContain('name = ?')
-      expect(sql).toContain('email = ?')
-    })
-  })
-
-  describe('updatePasswordHash', () => {
-    it('calls UPDATE users SET password_hash', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updatePasswordHash('u1', 'new-hash')
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('password_hash'))
-    })
-  })
-
-  describe('updateAvatarUrl', () => {
-    it('calls UPDATE users SET avatar_url', async () => {
-      const { db, prepareMock } = makeMockDb()
-      await new D1UserRepository(db).updateAvatarUrl('u1', 'https://cdn.example.com/avatar.jpg')
-      expect(prepareMock).toHaveBeenCalledWith(expect.stringContaining('avatar_url'))
-    })
-  })
-
-  describe('emailBelongsToAnotherUser', () => {
-    it('returns true when another user row is found with that email', async () => {
-      const { db } = makeMockDb({ firstResult: { id: 'other-user' } })
-      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('taken@test.com', 'current')).toBe(true)
-    })
-
-    it('returns false when no other user owns the email', async () => {
-      const { db } = makeMockDb({ firstResult: null })
-      expect(await new D1UserRepository(db).emailBelongsToAnotherUser('free@test.com', 'current')).toBe(false)
-    })
-  })
-})

package/src/shared/d1-user.repository.ts

@@ -1,119 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { IUserRepository, UserRecord, NewUserInput } from '@beechcms/core'
-
-type UserRow = {
-  id: string
-  email: string
-  name: string | null
-  surname: string | null
-  password_hash: string
-  role: string
-  avatar_url: string | null
-  notification_prefs: string
-}
-
-function rowToRecord(row: UserRow): UserRecord {
-  return {
-    id: row.id,
-    email: row.email,
-    name: row.name,
-    surname: row.surname,
-    passwordHash: row.password_hash,
-    role: row.role,
-    avatarUrl: row.avatar_url,
-    notificationPreferences: row.notification_prefs,
-  }
-}
-
-export class D1UserRepository implements IUserRepository {
-  constructor(private readonly db: D1Database) {}
-
-  async countAll(): Promise<number> {
-    const result = await this.db
-      .prepare('SELECT COUNT(*) as count FROM users')
-      .first<{ count: number }>()
-    return result?.count ?? 0
-  }
-
-  async findById(userId: string): Promise<UserRecord | null> {
-    const row = await this.db
-      .prepare('SELECT id, email, name, surname, password_hash, role, avatar_url, notification_prefs FROM users WHERE id = ? LIMIT 1')
-      .bind(userId)
-      .first<UserRow>()
-    return row ? rowToRecord(row) : null
-  }
-
-  async findByEmail(email: string): Promise<UserRecord | null> {
-    const row = await this.db
-      .prepare('SELECT id, email, name, surname, password_hash, role, avatar_url, notification_prefs FROM users WHERE email = ? LIMIT 1')
-      .bind(email)
-      .first<UserRow>()
-    return row ? rowToRecord(row) : null
-  }
-
-  async create(user: NewUserInput): Promise<void> {
-    await this.db
-      .prepare('INSERT INTO users (id, email, password_hash, role, name, surname) VALUES (?, ?, ?, ?, ?, ?)')
-      .bind(user.id, user.email, user.passwordHash, user.role, user.name, user.surname)
-      .run()
-  }
-
-  async updateProfile(userId: string, fields: { name?: string; surname?: string; email?: string }): Promise<void> {
-    const columnAssignments: string[] = []
-    const boundValues: unknown[] = []
-
-    if (fields.name !== undefined) {
-      columnAssignments.push('name = ?')
-      boundValues.push(fields.name)
-    }
-    if (fields.surname !== undefined) {
-      columnAssignments.push('surname = ?')
-      boundValues.push(fields.surname)
-    }
-    if (fields.email !== undefined) {
-      columnAssignments.push('email = ?')
-      boundValues.push(fields.email)
-    }
-
-    if (columnAssignments.length === 0) return
-
-    boundValues.push(userId)
-    await this.db
-      .prepare(`UPDATE users SET ${columnAssignments.join(', ')} WHERE id = ?`)
-      .bind(...boundValues)
-      .run()
-  }
-
-  async updatePasswordHash(userId: string, newPasswordHash: string): Promise<void> {
-    await this.db
-      .prepare('UPDATE users SET password_hash = ? WHERE id = ?')
-      .bind(newPasswordHash, userId)
-      .run()
-  }
-
-  async updateAvatarUrl(userId: string, avatarUrl: string | null): Promise<void> {
-    await this.db
-      .prepare('UPDATE users SET avatar_url = ? WHERE id = ?')
-      .bind(avatarUrl, userId)
-      .run()
-  }
-
-  async updateNotificationPreferences(userId: string, preferencesJson: string): Promise<void> {
-    await this.db
-      .prepare('UPDATE users SET notification_prefs = ? WHERE id = ?')
-      .bind(preferencesJson, userId)
-      .run()
-  }
-
-  async emailBelongsToAnotherUser(email: string, currentUserId: string): Promise<boolean> {
-    const row = await this.db
-      .prepare('SELECT id FROM users WHERE email = ? AND id != ? LIMIT 1')
-      .bind(email, currentUserId)
-      .first()
-    return row !== null
-  }
-}

package/src/shared/d1-widget.repository.test.ts

@@ -1,221 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect, vi } from 'vitest'
-import type { Seed } from '@beechcms/core'
-import { D1WidgetRepository } from './d1-widget.repository'
-
-function makeMockDb(allResults: unknown[] = [], firstResult: unknown = null) {
-  const allMock = vi.fn().mockResolvedValue({ results: allResults })
-  const firstMock = vi.fn().mockResolvedValue(firstResult)
-  const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
-  const prepareMock = vi.fn(() => ({ all: allMock, first: firstMock, bind: bindMock }))
-  return { db: { prepare: prepareMock } as any, prepareMock, bindMock, allMock, firstMock }
-}
-
-const seed: Seed = {
-  slug: 'posts',
-  label: 'Post',
-  displayNameAlias: 'title',
-  branches: [
-    { id: 'br_01', alias: 'title', type: 'text', label: 'Title' },
-    { id: 'br_02', alias: 'price', type: 'number', label: 'Price' },
-  ],
-}
-
-describe('D1WidgetRepository', () => {
-  describe('aggregate', () => {
-    it('returns 0 when no rows match', async () => {
-      const { db } = makeMockDb([], null)
-      const value = await new D1WidgetRepository(db).aggregate(seed, { op: 'count' }, 'all')
-      expect(value).toBe(0)
-    })
-
-    it('builds COUNT(*) for op=count', async () => {
-      const { db, prepareMock } = makeMockDb([], { computed_value: 7 })
-      const value = await new D1WidgetRepository(db).aggregate(seed, { op: 'count' }, 'week')
-      expect(value).toBe(7)
-      const sql = prepareMock.mock.calls[0]![0] as string
-      expect(sql).toMatch(/COUNT\(\*\)/)
-      expect(sql).toMatch(/FROM content_posts/)
-      expect(sql).toMatch(/created_at > unixepoch\('now', '-7 days'\)/)
-    })
-
-    it('throws UNSAFE_COLUMN when column alias is unknown', async () => {
-      const { db } = makeMockDb()
-      await expect(
-        new D1WidgetRepository(db).aggregate(seed, { op: 'sum', column: 'unknown' }, 'all'),
-      ).rejects.toThrow('UNSAFE_COLUMN')
-    })
-
-    it('builds SUM(CAST(... AS REAL)) for valid column', async () => {
-      const { db, prepareMock } = makeMockDb([], { computed_value: 42 })
-      await new D1WidgetRepository(db).aggregate(seed, { op: 'sum', column: 'price' }, 'all')
-      expect(prepareMock.mock.calls[0]![0] as string).toMatch(/SUM\(CAST\(price AS REAL\)\)/)
-    })
-  })
-
-  describe('growth', () => {
-    it('runs two queries with current and previous filters', async () => {
-      const allMock = vi.fn().mockResolvedValue({ results: [] })
-      const firstMock = vi
-        .fn()
-        .mockResolvedValueOnce({ computed_value: 10 })
-        .mockResolvedValueOnce({ computed_value: 5 })
-      const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
-      const prepareMock = vi.fn(() => ({ all: allMock, first: firstMock, bind: bindMock }))
-      const db = { prepare: prepareMock } as any
-
-      const result = await new D1WidgetRepository(db).growth(seed, { op: 'count' }, 'month')
-      expect(result).toEqual({ currentValue: 10, previousValue: 5 })
-      expect(prepareMock).toHaveBeenCalledTimes(2)
-      const sql0 = prepareMock.mock.calls[0]![0] as string
-      const sql1 = prepareMock.mock.calls[1]![0] as string
-      expect(sql0).toMatch(/-1 month/)
-      expect(sql1).toMatch(/-2 months/)
-    })
-
-    it('returns zeros when both queries are empty', async () => {
-      const { db } = makeMockDb([], null)
-      const result = await new D1WidgetRepository(db).growth(seed, { op: 'count' }, 'all')
-      expect(result).toEqual({ currentValue: 0, previousValue: 0 })
-    })
-  })
-
-  describe('leaderboard', () => {
-    it('uses ORDER BY DESC by default and binds only the limit', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb([
-        { id: 'a', label: 'A', score: 9 },
-      ])
-      const entries = await new D1WidgetRepository(db).leaderboard(seed, {
-        scoreColumn: 'price',
-        limit: 5,
-        orderDirection: 'DESC',
-      })
-      expect(entries).toEqual([{ id: 'a', label: 'A', score: 9 }])
-      const sql = prepareMock.mock.calls[0]![0] as string
-      expect(sql).toMatch(/ORDER BY CAST\(price AS REAL\) DESC/)
-      expect(bindMock).toHaveBeenCalledWith(5)
-    })
-
-    it('uses ORDER BY ASC when requested', async () => {
-      const { db, prepareMock } = makeMockDb([])
-      await new D1WidgetRepository(db).leaderboard(seed, {
-        scoreColumn: 'price',
-        limit: 3,
-        orderDirection: 'ASC',
-      })
-      expect(prepareMock.mock.calls[0]![0] as string).toMatch(/ORDER BY CAST\(price AS REAL\) ASC/)
-    })
-
-    it('falls back to id when label is null', async () => {
-      const { db } = makeMockDb([{ id: 'x', label: null, score: 1 }])
-      const [entry] = await new D1WidgetRepository(db).leaderboard(seed, {
-        scoreColumn: 'price',
-        limit: 1,
-        orderDirection: 'DESC',
-      })
-      expect(entry).toEqual({ id: 'x', label: 'x', score: 1 })
-    })
-  })
-
-  describe('list', () => {
-    it('returns raw rows and totalCount', async () => {
-      const allMock = vi.fn().mockResolvedValue({ results: [{ id: '1', slug: 's', status: 'published', created_at: 1, updated_at: 2, title: 'T', price: 10 }] })
-      const firstMock = vi.fn().mockResolvedValue({ total: 7 })
-      const bindMock = vi.fn(() => ({ all: allMock, first: firstMock }))
-      const prepareMock = vi.fn(() => ({ all: allMock, first: firstMock, bind: bindMock }))
-      const db = { prepare: prepareMock } as any
-
-      const result = await new D1WidgetRepository(db).list(seed, { limit: 10, offset: 0 })
-      expect(result.totalCount).toBe(7)
-      expect(result.entries[0]?.title).toBe('T')
-    })
-
-    it('appends search LIKE filter against displayNameAlias column', async () => {
-      const { db, prepareMock, bindMock } = makeMockDb([], { total: 0 })
-      await new D1WidgetRepository(db).list(seed, { limit: 5, offset: 0, search: 'hello' })
-      const sql = (prepareMock.mock.calls[1]?.[0] ?? prepareMock.mock.calls[0]![0]) as string
-      expect(sql).toMatch(/title LIKE \?/)
-      expect(bindMock).toHaveBeenCalledWith('%hello%', 5, 0)
-    })
-
-    it('skips filters with unknown operator', async () => {
-      const { db, prepareMock } = makeMockDb([], { total: 0 })
-      await new D1WidgetRepository(db).list(seed, {
-        limit: 5,
-        offset: 0,
-        filters: [{ column: 'price', op: 'haxx', value: 1 }],
-      })
-      const dataSql = prepareMock.mock.calls[1]![0] as string
-      expect(dataSql).not.toMatch(/haxx/)
-    })
-
-    it('skips filters with unsafe column', async () => {
-      const { db, prepareMock } = makeMockDb([], { total: 0 })
-      await new D1WidgetRepository(db).list(seed, {
-        limit: 5,
-        offset: 0,
-        filters: [{ column: 'evil', op: 'eq', value: 1 }],
-      })
-      const dataSql = prepareMock.mock.calls[1]![0] as string
-      expect(dataSql).not.toMatch(/evil/)
-    })
-
-    it('uses ORDER BY DESC branch when requested', async () => {
-      const { db, prepareMock } = makeMockDb([], { total: 0 })
-      await new D1WidgetRepository(db).list(seed, {
-        limit: 5,
-        offset: 0,
-        orderByColumn: 'price',
-        orderDirection: 'DESC',
-      })
-      const dataSql = prepareMock.mock.calls[1]![0] as string
-      expect(dataSql).toMatch(/ORDER BY price DESC/)
-    })
-
-    it('falls back to created_at when orderByColumn is unsafe', async () => {
-      const { db, prepareMock } = makeMockDb([], { total: 0 })
-      await new D1WidgetRepository(db).list(seed, {
-        limit: 5,
-        offset: 0,
-        orderByColumn: 'evil',
-      })
-      const dataSql = prepareMock.mock.calls[1]![0] as string
-      expect(dataSql).toMatch(/ORDER BY created_at/)
-    })
-  })
-
-  describe('timeseries', () => {
-    it('groups by date bucket on created_at', async () => {
-      const { db, prepareMock } = makeMockDb([
-        { bucket_label: '2026-01-01', bucket_value: 3 },
-      ])
-      const points = await new D1WidgetRepository(db).timeseries(
-        seed,
-        { op: 'count' },
-        'all',
-        'created_at',
-      )
-      expect(points).toEqual([{ label: '2026-01-01', value: 3 }])
-      const sql = prepareMock.mock.calls[0]![0] as string
-      expect(sql).toMatch(/strftime\('%Y-%m-%d', created_at, 'unixepoch'\)/)
-      expect(sql).toMatch(/GROUP BY bucket_label/)
-    })
-
-    it('CASTs non-system group columns as INTEGER', async () => {
-      const { db, prepareMock } = makeMockDb([])
-      await new D1WidgetRepository(db).timeseries(seed, { op: 'count' }, 'all', 'price')
-      const sql = prepareMock.mock.calls[0]![0] as string
-      expect(sql).toMatch(/CAST\(price AS INTEGER\)/)
-    })
-
-    it('throws UNSAFE_COLUMN for invalid groupColumn', async () => {
-      const { db } = makeMockDb()
-      await expect(
-        new D1WidgetRepository(db).timeseries(seed, { op: 'count' }, 'all', 'evil'),
-      ).rejects.toThrow('UNSAFE_COLUMN')
-    })
-  })
-})