first commit

packages/core/tests/unit/api/cache-headers.test.ts

@@ -0,0 +1,70 @@
+import { describe, it, expect } from "vitest";
+
+import { apiError, apiSuccess, handleError, unwrapResult } from "../../../src/api/error.js";
+
+describe("API cache headers", () => {
+	const EXPECTED_CACHE_CONTROL = "private, no-store";
+
+	describe("apiSuccess", () => {
+		it("should include Cache-Control: private, no-store", () => {
+			const response = apiSuccess({ ok: true });
+			expect(response.headers.get("Cache-Control")).toBe(EXPECTED_CACHE_CONTROL);
+		});
+
+		it("should not include Vary header", () => {
+			const response = apiSuccess({ ok: true });
+			expect(response.headers.has("Vary")).toBe(false);
+		});
+
+		it("should still include correct status and body", async () => {
+			const response = apiSuccess({ id: "123" }, 201);
+			expect(response.status).toBe(201);
+			const body = await response.json();
+			expect(body).toEqual({ data: { id: "123" } });
+		});
+	});
+
+	describe("apiError", () => {
+		it("should include Cache-Control: private, no-store", () => {
+			const response = apiError("NOT_FOUND", "Not found", 404);
+			expect(response.headers.get("Cache-Control")).toBe(EXPECTED_CACHE_CONTROL);
+		});
+
+		it("should not include Vary header", () => {
+			const response = apiError("NOT_FOUND", "Not found", 404);
+			expect(response.headers.has("Vary")).toBe(false);
+		});
+
+		it("should still include correct status and body", async () => {
+			const response = apiError("FORBIDDEN", "Access denied", 403);
+			expect(response.status).toBe(403);
+			const body = await response.json();
+			expect(body).toEqual({ error: { code: "FORBIDDEN", message: "Access denied" } });
+		});
+	});
+
+	describe("handleError", () => {
+		it("should include cache headers on 500 responses", () => {
+			const response = handleError(new Error("db crash"), "Something went wrong", "INTERNAL");
+			expect(response.headers.get("Cache-Control")).toBe(EXPECTED_CACHE_CONTROL);
+			expect(response.headers.has("Vary")).toBe(false);
+		});
+	});
+
+	describe("unwrapResult", () => {
+		it("should include cache headers on success", () => {
+			const response = unwrapResult({ success: true, data: { id: "1" } });
+			expect(response.headers.get("Cache-Control")).toBe(EXPECTED_CACHE_CONTROL);
+			expect(response.headers.has("Vary")).toBe(false);
+		});
+
+		it("should include cache headers on error", () => {
+			const response = unwrapResult({
+				success: false,
+				error: { code: "NOT_FOUND", message: "Not found" },
+			});
+			expect(response.headers.get("Cache-Control")).toBe(EXPECTED_CACHE_CONTROL);
+			expect(response.headers.has("Vary")).toBe(false);
+		});
+	});
+});

packages/core/tests/unit/api/content-handlers.test.ts

@@ -0,0 +1,267 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import {
+	handleContentCreate,
+	handleContentDuplicate,
+	handleContentGet,
+	handleContentList,
+	handleContentUpdate,
+} from "../../../src/api/index.js";
+import { BylineRepository } from "../../../src/database/repositories/byline.js";
+import type { Database } from "../../../src/database/types.js";
+import { SchemaRegistry } from "../../../src/schema/registry.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("Content Handlers — auto-slug generation", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		// Add a "name" field to the page collection so we can test name-based slug generation
+		const registry = new SchemaRegistry(db);
+		await registry.createField("page", { slug: "name", label: "Name", type: "string" });
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("handleContentCreate", () => {
+		it("should auto-generate slug from title when slug is omitted", async () => {
+			const result = await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("hello-world");
+		});
+
+		it("should auto-generate slug from name when title is absent", async () => {
+			const result = await handleContentCreate(db, "page", {
+				data: { name: "My Widget" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("my-widget");
+		});
+
+		it("should prefer title over name for slug generation", async () => {
+			const result = await handleContentCreate(db, "page", {
+				data: { title: "From Title", name: "From Name" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("from-title");
+		});
+
+		it("should respect explicit slug and not auto-generate", async () => {
+			const result = await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+				slug: "custom-slug",
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("custom-slug");
+		});
+
+		it("should handle slug collisions by appending numeric suffix", async () => {
+			// Create first item with the slug
+			await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+			});
+
+			// Create second item with same title — should get unique slug
+			const result = await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("hello-world-1");
+		});
+
+		it("should increment suffix on repeated collisions", async () => {
+			await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+			});
+			await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+			});
+
+			const result = await handleContentCreate(db, "post", {
+				data: { title: "Hello World" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("hello-world-2");
+		});
+
+		it("should leave slug null when no title or name is present", async () => {
+			const result = await handleContentCreate(db, "post", {
+				data: { content: [{ _type: "block", children: [{ _type: "span", text: "hi" }] }] },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBeNull();
+		});
+
+		it("should leave slug null when title is not a string", async () => {
+			const result = await handleContentCreate(db, "post", {
+				data: { title: 42 },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBeNull();
+		});
+
+		it("should leave slug null when title is empty string", async () => {
+			const result = await handleContentCreate(db, "post", {
+				data: { title: "" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBeNull();
+		});
+
+		it("should handle unicode titles", async () => {
+			const result = await handleContentCreate(db, "post", {
+				data: { title: "Café Naïve" },
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.slug).toBe("cafe-naive");
+		});
+
+		it("should allow same auto-slug in different collections", async () => {
+			const postResult = await handleContentCreate(db, "post", {
+				data: { title: "About" },
+			});
+			const pageResult = await handleContentCreate(db, "page", {
+				data: { title: "About" },
+			});
+
+			expect(postResult.success).toBe(true);
+			expect(pageResult.success).toBe(true);
+			expect(postResult.data?.item.slug).toBe("about");
+			expect(pageResult.data?.item.slug).toBe("about");
+		});
+	});
+
+	describe("handleContentDuplicate", () => {
+		it("should generate slug from duplicated title", async () => {
+			const original = await handleContentCreate(db, "post", {
+				data: { title: "My Post" },
+				slug: "my-post",
+			});
+
+			const result = await handleContentDuplicate(db, "post", original.data!.item.id);
+
+			expect(result.success).toBe(true);
+			// Title becomes "My Post (Copy)", slug should be generated from it
+			expect(result.data?.item.slug).toBe("my-post-copy");
+		});
+
+		it("should handle duplicate slug collision from copy", async () => {
+			const original = await handleContentCreate(db, "post", {
+				data: { title: "My Post" },
+				slug: "my-post",
+			});
+
+			// First duplicate
+			const dup1 = await handleContentDuplicate(db, "post", original.data!.item.id);
+			expect(dup1.data?.item.slug).toBe("my-post-copy");
+
+			// Second duplicate — "My Post (Copy)" title slugifies to "my-post-copy"
+			// which now collides with the first duplicate
+			const dup2 = await handleContentDuplicate(db, "post", original.data!.item.id);
+			expect(dup2.success).toBe(true);
+			expect(dup2.data?.item.slug).toBe("my-post-copy-1");
+		});
+	});
+
+	describe("byline hydration and assignment", () => {
+		it("should assign and return bylines on create", async () => {
+			const bylineRepo = new BylineRepository(db);
+			const byline = await bylineRepo.create({
+				slug: "author-one",
+				displayName: "Author One",
+			});
+
+			const created = await handleContentCreate(db, "post", {
+				data: { title: "Bylined" },
+				bylines: [{ bylineId: byline.id, roleLabel: "Writer" }],
+			});
+
+			expect(created.success).toBe(true);
+			expect(created.data?.item.primaryBylineId).toBe(byline.id);
+			expect(created.data?.item.byline?.id).toBe(byline.id);
+			expect(created.data?.item.bylines).toHaveLength(1);
+			expect(created.data?.item.bylines?.[0]?.roleLabel).toBe("Writer");
+		});
+
+		it("should return bylines on get and list", async () => {
+			const bylineRepo = new BylineRepository(db);
+			const first = await bylineRepo.create({ slug: "first", displayName: "First" });
+			const second = await bylineRepo.create({ slug: "second", displayName: "Second" });
+
+			const created = await handleContentCreate(db, "post", {
+				data: { title: "Order Test" },
+				bylines: [{ bylineId: second.id }, { bylineId: first.id }],
+			});
+			expect(created.success).toBe(true);
+			const contentId = created.data!.item.id;
+
+			const fetched = await handleContentGet(db, "post", contentId);
+			expect(fetched.success).toBe(true);
+			expect(fetched.data?.item.bylines?.[0]?.byline.id).toBe(second.id);
+			expect(fetched.data?.item.bylines?.[1]?.byline.id).toBe(first.id);
+			expect(fetched.data?.item.byline?.id).toBe(second.id);
+
+			const listed = await handleContentList(db, "post", {});
+			expect(listed.success).toBe(true);
+			const listedItem = listed.data?.items.find((item) => item.id === contentId);
+			expect(listedItem?.byline?.id).toBe(second.id);
+			expect(listedItem?.bylines?.[0]?.byline.id).toBe(second.id);
+		});
+
+		it("should update byline ordering on update", async () => {
+			const bylineRepo = new BylineRepository(db);
+			const first = await bylineRepo.create({ slug: "first-upd", displayName: "First" });
+			const second = await bylineRepo.create({ slug: "second-upd", displayName: "Second" });
+
+			const created = await handleContentCreate(db, "post", {
+				data: { title: "Update Bylines" },
+				bylines: [{ bylineId: first.id }, { bylineId: second.id }],
+			});
+			expect(created.success).toBe(true);
+
+			const updated = await handleContentUpdate(db, "post", created.data!.item.id, {
+				bylines: [{ bylineId: second.id }, { bylineId: first.id }],
+			});
+
+			expect(updated.success).toBe(true);
+			expect(updated.data?.item.primaryBylineId).toBe(second.id);
+			expect(updated.data?.item.bylines?.[0]?.byline.id).toBe(second.id);
+			expect(updated.data?.item.bylines?.[1]?.byline.id).toBe(first.id);
+		});
+
+		it("should copy bylines when duplicating", async () => {
+			const bylineRepo = new BylineRepository(db);
+			const byline = await bylineRepo.create({
+				slug: "dup-author",
+				displayName: "Dup Author",
+			});
+
+			const original = await handleContentCreate(db, "post", {
+				data: { title: "Duplicate With Bylines" },
+				bylines: [{ bylineId: byline.id }],
+			});
+			expect(original.success).toBe(true);
+
+			const duplicated = await handleContentDuplicate(db, "post", original.data!.item.id);
+			expect(duplicated.success).toBe(true);
+			expect(duplicated.data?.item.byline?.id).toBe(byline.id);
+			expect(duplicated.data?.item.bylines).toHaveLength(1);
+		});
+	});
+});

packages/core/tests/unit/api/csrf.test.ts

@@ -0,0 +1,129 @@
+import { describe, it, expect } from "vitest";
+
+import { checkPublicCsrf } from "../../../src/api/csrf.js";
+
+function makeRequest(method: string, headers: Record<string, string> = {}): Request {
+	return new Request("http://example.com/_emdash/api/comments/posts/abc", {
+		method,
+		headers,
+	});
+}
+
+function makeUrl(host = "example.com"): URL {
+	return new URL(`http://${host}/_emdash/api/comments/posts/abc`);
+}
+
+describe("checkPublicCsrf", () => {
+	describe("allows requests with X-EmDash-Request header", () => {
+		it("allows POST with custom header", () => {
+			const request = makeRequest("POST", { "X-EmDash-Request": "1" });
+			expect(checkPublicCsrf(request, makeUrl())).toBeNull();
+		});
+
+		it("allows POST with custom header even if Origin is cross-origin", () => {
+			const request = makeRequest("POST", {
+				"X-EmDash-Request": "1",
+				Origin: "http://evil.com",
+			});
+			expect(checkPublicCsrf(request, makeUrl())).toBeNull();
+		});
+	});
+
+	describe("allows same-origin requests", () => {
+		it("allows POST with matching Origin", () => {
+			const request = makeRequest("POST", {
+				Origin: "http://example.com",
+			});
+			expect(checkPublicCsrf(request, makeUrl())).toBeNull();
+		});
+
+		it("allows POST with matching Origin on different path", () => {
+			const request = makeRequest("POST", {
+				Origin: "http://example.com",
+			});
+			const url = new URL("http://example.com/_emdash/api/auth/invite/complete");
+			expect(checkPublicCsrf(request, url)).toBeNull();
+		});
+
+		it("matches host including port", () => {
+			const request = makeRequest("POST", {
+				Origin: "http://localhost:4321",
+			});
+			const url = new URL("http://localhost:4321/_emdash/api/comments/posts/abc");
+			expect(checkPublicCsrf(request, url)).toBeNull();
+		});
+	});
+
+	describe("blocks cross-origin requests", () => {
+		it("returns 403 with CSRF_REJECTED code", async () => {
+			const request = makeRequest("POST", {
+				Origin: "http://evil.com",
+			});
+			const response = checkPublicCsrf(request, makeUrl());
+			expect(response).not.toBeNull();
+			expect(response!.status).toBe(403);
+			const body = await response!.json();
+			expect(body).toEqual({
+				error: { code: "CSRF_REJECTED", message: "Cross-origin request blocked" },
+			});
+		});
+
+		it("rejects Origin with different port", async () => {
+			const request = makeRequest("POST", {
+				Origin: "http://example.com:9999",
+			});
+			const response = checkPublicCsrf(request, makeUrl());
+			expect(response).not.toBeNull();
+			expect(response!.status).toBe(403);
+		});
+
+		it("rejects Origin with different host", async () => {
+			const request = makeRequest("POST", {
+				Origin: "http://attacker.example.com",
+			});
+			const response = checkPublicCsrf(request, makeUrl());
+			expect(response).not.toBeNull();
+			expect(response!.status).toBe(403);
+		});
+
+		it("rejects cross-scheme Origin (http vs https)", async () => {
+			const request = makeRequest("POST", {
+				Origin: "https://example.com",
+			});
+			// Request URL is http://example.com — same host but different scheme
+			const response = checkPublicCsrf(request, makeUrl());
+			expect(response).not.toBeNull();
+			expect(response!.status).toBe(403);
+		});
+
+		it("rejects malformed Origin header", async () => {
+			const request = makeRequest("POST", {
+				Origin: "not-a-valid-url",
+			});
+			const response = checkPublicCsrf(request, makeUrl());
+			expect(response).not.toBeNull();
+			expect(response!.status).toBe(403);
+		});
+
+		it("rejects Origin: null (sandboxed iframe)", async () => {
+			const request = makeRequest("POST", { Origin: "null" });
+			const response = checkPublicCsrf(request, makeUrl());
+			expect(response).not.toBeNull();
+			expect(response!.status).toBe(403);
+		});
+	});
+
+	describe("allows requests without Origin header", () => {
+		it("allows POST without any Origin (non-browser client)", () => {
+			const request = makeRequest("POST");
+			expect(checkPublicCsrf(request, makeUrl())).toBeNull();
+		});
+
+		it("allows POST without Origin or custom header (curl/server)", () => {
+			const request = makeRequest("POST", {
+				"Content-Type": "application/json",
+			});
+			expect(checkPublicCsrf(request, makeUrl())).toBeNull();
+		});
+	});
+});

packages/core/tests/unit/api/dashboard-handlers.test.ts

@@ -0,0 +1,241 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, afterEach } from "vitest";
+
+import { handleDashboardStats } from "../../../src/api/handlers/dashboard.js";
+import { ContentRepository } from "../../../src/database/repositories/content.js";
+import type { Database } from "../../../src/database/types.js";
+import { SchemaRegistry } from "../../../src/schema/registry.js";
+import { createPostFixture, createPageFixture } from "../../utils/fixtures.js";
+import {
+	setupTestDatabase,
+	setupTestDatabaseWithCollections,
+	teardownTestDatabase,
+} from "../../utils/test-db.js";
+
+describe("Dashboard Handlers", () => {
+	describe("handleDashboardStats", () => {
+		let db: Kysely<Database>;
+
+		afterEach(async () => {
+			await teardownTestDatabase(db);
+		});
+
+		it("returns empty stats when no collections exist", async () => {
+			db = await setupTestDatabase();
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			expect(result.data).toBeDefined();
+			expect(result.data!.collections).toEqual([]);
+			expect(result.data!.mediaCount).toBe(0);
+			expect(result.data!.userCount).toBe(0);
+			expect(result.data!.recentItems).toEqual([]);
+		});
+
+		it("returns collection stats with correct counts", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			// Create some posts with different statuses
+			await contentRepo.create(createPostFixture({ slug: "post-1" }));
+			await contentRepo.create(createPostFixture({ slug: "post-2", status: "published" }));
+			await contentRepo.create(createPostFixture({ slug: "post-3", status: "published" }));
+
+			// Create a draft page
+			await contentRepo.create(createPageFixture({ slug: "page-1" }));
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const { collections } = result.data!;
+
+			// Both collections should be present
+			expect(collections).toHaveLength(2);
+
+			const postStats = collections.find((c) => c.slug === "post");
+			expect(postStats).toBeDefined();
+			expect(postStats!.label).toBe("Posts");
+			expect(postStats!.total).toBe(3);
+			expect(postStats!.published).toBe(2);
+			expect(postStats!.draft).toBe(1);
+
+			const pageStats = collections.find((c) => c.slug === "page");
+			expect(pageStats).toBeDefined();
+			expect(pageStats!.label).toBe("Pages");
+			expect(pageStats!.total).toBe(1);
+			expect(pageStats!.published).toBe(0);
+			expect(pageStats!.draft).toBe(1);
+		});
+
+		it("returns recent items across collections", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			await contentRepo.create(createPostFixture({ slug: "post-1" }));
+			// Small delay for distinct updated_at
+			await new Promise((r) => setTimeout(r, 10));
+			await contentRepo.create(createPageFixture({ slug: "page-1" }));
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const { recentItems } = result.data!;
+
+			expect(recentItems.length).toBeGreaterThanOrEqual(2);
+
+			// Most recently updated should be first
+			expect(recentItems[0]!.collection).toBe("page");
+			expect(recentItems[0]!.collectionLabel).toBe("Pages");
+			expect(recentItems[0]!.slug).toBe("page-1");
+			expect(recentItems[0]!.status).toBe("draft");
+
+			expect(recentItems[1]!.collection).toBe("post");
+			expect(recentItems[1]!.collectionLabel).toBe("Posts");
+			expect(recentItems[1]!.slug).toBe("post-1");
+		});
+
+		it("recent items use title field when available", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			// setupTestDatabaseWithCollections creates post/page with title fields
+			await contentRepo.create(
+				createPostFixture({
+					slug: "my-post",
+					data: { title: "My Great Post", content: [] },
+				}),
+			);
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const postItem = result.data!.recentItems.find((i) => i.slug === "my-post");
+			expect(postItem).toBeDefined();
+			expect(postItem!.title).toBe("My Great Post");
+		});
+
+		it("recent items fall back to slug when collection has no title field", async () => {
+			db = await setupTestDatabase();
+			const registry = new SchemaRegistry(db);
+
+			// Create a collection without a title field
+			await registry.createCollection({
+				slug: "events",
+				label: "Events",
+				labelSingular: "Event",
+			});
+			await registry.createField("events", {
+				slug: "date",
+				label: "Date",
+				type: "datetime",
+			});
+
+			const contentRepo = new ContentRepository(db);
+			await contentRepo.create({
+				type: "events",
+				slug: "launch-party",
+				data: { date: "2026-03-01" },
+				status: "draft",
+			});
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const eventItem = result.data!.recentItems.find((i) => i.collection === "events");
+			expect(eventItem).toBeDefined();
+			// No title field, should fall back to slug
+			expect(eventItem!.title).toBe("launch-party");
+		});
+
+		it("excludes soft-deleted items from recent items", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			const post = await contentRepo.create(createPostFixture({ slug: "will-delete" }));
+			await contentRepo.create(createPostFixture({ slug: "will-keep" }));
+
+			// Soft-delete the first post
+			await contentRepo.delete("post", post.id);
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const slugs = result.data!.recentItems.map((i) => i.slug);
+			expect(slugs).toContain("will-keep");
+			expect(slugs).not.toContain("will-delete");
+		});
+
+		it("limits recent items to 10", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			// Create 15 posts
+			for (let i = 0; i < 15; i++) {
+				await contentRepo.create(createPostFixture({ slug: `post-${String(i).padStart(2, "0")}` }));
+			}
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			expect(result.data!.recentItems).toHaveLength(10);
+		});
+
+		it("recent items are ordered by updated_at descending", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			await contentRepo.create(createPostFixture({ slug: "oldest" }));
+			await new Promise((r) => setTimeout(r, 10));
+			await contentRepo.create(createPostFixture({ slug: "middle" }));
+			await new Promise((r) => setTimeout(r, 10));
+			await contentRepo.create(createPostFixture({ slug: "newest" }));
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const slugs = result.data!.recentItems.map((i) => i.slug);
+			expect(slugs).toEqual(["newest", "middle", "oldest"]);
+		});
+
+		it("counts exclude soft-deleted items", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+
+			const post = await contentRepo.create(createPostFixture({ slug: "to-delete" }));
+			await contentRepo.create(createPostFixture({ slug: "to-keep" }));
+			await contentRepo.delete("post", post.id);
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const postStats = result.data!.collections.find((c) => c.slug === "post");
+			// count() in ContentRepository filters deleted_at IS NULL
+			expect(postStats!.total).toBe(1);
+		});
+
+		it("returns camelCase keys in recent items", async () => {
+			db = await setupTestDatabaseWithCollections();
+			const contentRepo = new ContentRepository(db);
+			await contentRepo.create(createPostFixture());
+
+			const result = await handleDashboardStats(db);
+
+			expect(result.success).toBe(true);
+			const item = result.data!.recentItems[0]!;
+			// Verify camelCase API shape
+			expect(item).toHaveProperty("id");
+			expect(item).toHaveProperty("collection");
+			expect(item).toHaveProperty("collectionLabel");
+			expect(item).toHaveProperty("title");
+			expect(item).toHaveProperty("slug");
+			expect(item).toHaveProperty("status");
+			expect(item).toHaveProperty("updatedAt");
+			expect(item).toHaveProperty("authorId");
+			// Should NOT have snake_case keys
+			expect(item).not.toHaveProperty("collection_label");
+			expect(item).not.toHaveProperty("updated_at");
+			expect(item).not.toHaveProperty("author_id");
+		});
+	});
+});

packages/core/tests/unit/api/marketplace-handlers.test.ts

@@ -0,0 +1,862 @@
+/**
+ * Marketplace handler tests
+ *
+ * Tests the business logic for:
+ * - Install (handleMarketplaceInstall)
+ * - Update (handleMarketplaceUpdate)
+ * - Uninstall (handleMarketplaceUninstall)
+ * - Update check (handleMarketplaceUpdateCheck)
+ * - Search/GetPlugin proxies (handleMarketplaceSearch, handleMarketplaceGetPlugin)
+ *
+ * Uses a real in-memory SQLite database and mock Storage/SandboxRunner/fetch.
+ */
+
+import BetterSqlite3 from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+import {
+	handleMarketplaceInstall,
+	handleMarketplaceUpdate,
+	handleMarketplaceUninstall,
+	handleMarketplaceUpdateCheck,
+	handleMarketplaceSearch,
+	handleMarketplaceGetPlugin,
+} from "../../../src/api/handlers/marketplace.js";
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database as DbSchema } from "../../../src/database/types.js";
+import type { MarketplacePluginDetail } from "../../../src/plugins/marketplace.js";
+import type { SandboxRunner, SandboxedPlugin } from "../../../src/plugins/sandbox/types.js";
+import { PluginStateRepository } from "../../../src/plugins/state.js";
+import type { PluginManifest } from "../../../src/plugins/types.js";
+import type {
+	Storage,
+	UploadResult,
+	DownloadResult,
+	ListResult,
+	SignedUploadUrl,
+} from "../../../src/storage/types.js";
+
+// ── Mock factories ────────────────────────────────────────────────
+
+function createMockStorage(): Storage {
+	const store = new Map<string, { body: Uint8Array; contentType: string }>();
+
+	return {
+		async upload(opts: {
+			key: string;
+			body: Buffer | Uint8Array | ReadableStream<Uint8Array>;
+			contentType: string;
+		}): Promise<UploadResult> {
+			let body: Uint8Array;
+			if (opts.body instanceof Uint8Array) {
+				body = opts.body;
+			} else if (Buffer.isBuffer(opts.body)) {
+				body = new Uint8Array(opts.body);
+			} else {
+				// ReadableStream
+				const response = new Response(opts.body);
+				body = new Uint8Array(await response.arrayBuffer());
+			}
+			store.set(opts.key, { body, contentType: opts.contentType });
+			return { key: opts.key, url: `https://storage.test/${opts.key}`, size: body.length };
+		},
+		async download(key: string): Promise<DownloadResult> {
+			const item = store.get(key);
+			if (!item) throw new Error(`Not found: ${key}`);
+			const stream = new ReadableStream<Uint8Array>({
+				start(controller) {
+					controller.enqueue(item.body);
+					controller.close();
+				},
+			});
+			return { body: stream, contentType: item.contentType, size: item.body.length };
+		},
+		async delete(key: string): Promise<void> {
+			store.delete(key);
+		},
+		async exists(key: string): Promise<boolean> {
+			return store.has(key);
+		},
+		async list(): Promise<ListResult> {
+			return { files: [] };
+		},
+		async getSignedUploadUrl(): Promise<SignedUploadUrl> {
+			return {
+				url: "https://test.com/upload",
+				method: "PUT",
+				headers: {},
+				expiresAt: new Date().toISOString(),
+			};
+		},
+		getPublicUrl(key: string): string {
+			return `https://storage.test/${key}`;
+		},
+	};
+}
+
+function createMockSandboxRunner(): SandboxRunner & {
+	loadedPlugins: Array<{ manifest: PluginManifest; code: string }>;
+} {
+	const loadedPlugins: Array<{ manifest: PluginManifest; code: string }> = [];
+
+	return {
+		loadedPlugins,
+		isAvailable(): boolean {
+			return true;
+		},
+		async load(manifest: PluginManifest, code: string): Promise<SandboxedPlugin> {
+			loadedPlugins.push({ manifest, code });
+			return {
+				id: manifest.id,
+				manifest,
+				async invokeHook() {
+					return undefined;
+				},
+				async invokeRoute() {
+					return undefined;
+				},
+				async terminate() {},
+			};
+		},
+		async terminateAll() {},
+	};
+}
+
+const MARKETPLACE_URL = "https://marketplace.example.com";
+
+function mockManifest(id = "test-seo", version = "1.0.0"): PluginManifest {
+	return {
+		id,
+		version,
+		capabilities: ["read:content"],
+		allowedHosts: [],
+		storage: {},
+		hooks: [],
+		routes: [],
+		admin: {},
+	};
+}
+
+/**
+ * Create a gzipped tar bundle for use with mocked fetch.
+ * Uses CompressionStream + minimal tar format.
+ */
+async function createMockBundle(manifest: PluginManifest): Promise<Uint8Array> {
+	const encoder = new TextEncoder();
+	const manifestJson = JSON.stringify(manifest);
+	const backendCode = 'export default function() { return "hello"; }';
+
+	// Create simple tar
+	const files = [
+		{ name: "manifest.json", content: manifestJson },
+		{ name: "backend.js", content: backendCode },
+	];
+
+	const blocks: Uint8Array[] = [];
+
+	for (const file of files) {
+		const contentBytes = encoder.encode(file.content);
+		const header = new Uint8Array(512);
+
+		// Name
+		header.set(encoder.encode(file.name), 0);
+		// Mode
+		header.set(encoder.encode("0000644\0"), 100);
+		// UID/GID
+		header.set(encoder.encode("0000000\0"), 108);
+		header.set(encoder.encode("0000000\0"), 116);
+		// Size in octal
+		const sizeOctal = contentBytes.length.toString(8).padStart(11, "0") + "\0";
+		header.set(encoder.encode(sizeOctal), 124);
+		// Mtime
+		header.set(encoder.encode("00000000000\0"), 136);
+		// Type = regular file
+		header[156] = 0x30;
+		// Checksum spaces
+		header.set(encoder.encode("        "), 148);
+
+		let checksum = 0;
+		for (let i = 0; i < 512; i++) checksum += header[i]!;
+		header.set(encoder.encode(checksum.toString(8).padStart(6, "0") + "\0 "), 148);
+
+		blocks.push(header);
+
+		const paddedSize = Math.ceil(contentBytes.length / 512) * 512;
+		const dataBlock = new Uint8Array(paddedSize);
+		dataBlock.set(contentBytes, 0);
+		blocks.push(dataBlock);
+	}
+
+	blocks.push(new Uint8Array(1024)); // end-of-archive
+
+	const totalSize = blocks.reduce((sum, b) => sum + b.length, 0);
+	const tar = new Uint8Array(totalSize);
+	let offset = 0;
+	for (const block of blocks) {
+		tar.set(block, offset);
+		offset += block.length;
+	}
+
+	// Gzip
+	const cs = new CompressionStream("gzip");
+	const writer = cs.writable.getWriter();
+	const reader = cs.readable.getReader();
+
+	const writePromise = writer.write(tar).then(() => writer.close());
+	const chunks: Uint8Array[] = [];
+	let totalLen = 0;
+
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		chunks.push(value);
+		totalLen += value.length;
+	}
+	await writePromise;
+
+	const result = new Uint8Array(totalLen);
+	offset = 0;
+	for (const chunk of chunks) {
+		result.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return result;
+}
+
+function mockPluginDetail(
+	id = "test-seo",
+	latestVersion = "1.0.0",
+	checksum?: string,
+): MarketplacePluginDetail {
+	return {
+		id,
+		name: "Test SEO",
+		description: "SEO plugin",
+		author: { name: "Test", verified: true, avatarUrl: null },
+		capabilities: ["hooks"],
+		keywords: [],
+		installCount: 10,
+		hasIcon: false,
+		iconUrl: "",
+		createdAt: "2026-01-01T00:00:00Z",
+		updatedAt: "2026-02-01T00:00:00Z",
+		repositoryUrl: null,
+		homepageUrl: null,
+		license: "MIT",
+		latestVersion: {
+			version: latestVersion,
+			minEmDashVersion: null,
+			bundleSize: 1234,
+			checksum: checksum ?? "will-be-computed",
+			changelog: null,
+			readme: null,
+			hasIcon: false,
+			screenshotCount: 0,
+			screenshotUrls: [],
+			capabilities: ["hooks"],
+			auditVerdict: "pass",
+			imageAuditVerdict: "pass",
+			publishedAt: "2026-01-01T00:00:00Z",
+		},
+	};
+}
+
+describe("Marketplace handlers", () => {
+	let db: Kysely<DbSchema>;
+	let sqliteDb: BetterSqlite3.Database;
+	let storage: Storage;
+	let sandboxRunner: ReturnType<typeof createMockSandboxRunner>;
+	let fetchSpy: ReturnType<typeof vi.fn>;
+
+	beforeEach(async () => {
+		sqliteDb = new BetterSqlite3(":memory:");
+		db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqliteDb }),
+		});
+		await runMigrations(db);
+
+		storage = createMockStorage();
+		sandboxRunner = createMockSandboxRunner();
+		fetchSpy = vi.fn();
+		vi.stubGlobal("fetch", fetchSpy);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqliteDb.close();
+		vi.restoreAllMocks();
+	});
+
+	// ── Install ────────────────────────────────────────────────────
+
+	describe("handleMarketplaceInstall", () => {
+		it("returns error when marketplace not configured", async () => {
+			const result = await handleMarketplaceInstall(db, storage, sandboxRunner, undefined, "test");
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("MARKETPLACE_NOT_CONFIGURED");
+		});
+
+		it("returns error when storage not available", async () => {
+			const result = await handleMarketplaceInstall(
+				db,
+				null,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test",
+			);
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("STORAGE_NOT_CONFIGURED");
+		});
+
+		it("returns error when sandbox runner not available", async () => {
+			const result = await handleMarketplaceInstall(db, storage, null, MARKETPLACE_URL, "test");
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("SANDBOX_NOT_AVAILABLE");
+		});
+
+		it("successfully installs a marketplace plugin", async () => {
+			const manifest = mockManifest("test-seo", "1.0.0");
+			const bundleBytes = await createMockBundle(manifest);
+
+			// Mock: getPlugin detail — set checksum to undefined so the check is skipped
+			const detail = mockPluginDetail("test-seo", "1.0.0");
+			detail.latestVersion!.checksum = "";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+			// Mock: downloadBundle
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+			// Mock: reportInstall
+			fetchSpy.mockResolvedValueOnce(new Response("OK", { status: 200 }));
+
+			const result = await handleMarketplaceInstall(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+			);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.pluginId).toBe("test-seo");
+			expect(result.data?.version).toBe("1.0.0");
+			expect(result.data?.capabilities).toEqual(["read:content"]);
+
+			// Verify state was written
+			const repo = new PluginStateRepository(db);
+			const state = await repo.get("test-seo");
+			expect(state?.source).toBe("marketplace");
+			expect(state?.marketplaceVersion).toBe("1.0.0");
+			expect(state?.status).toBe("active");
+		});
+
+		it("rejects install if plugin already installed", async () => {
+			// Pre-install the plugin
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Mock: getPlugin detail (still needed — called before install check... actually, the existing check comes first)
+			const result = await handleMarketplaceInstall(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+			);
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("ALREADY_INSTALLED");
+		});
+
+		it("rejects when manifest ID doesn't match requested plugin", async () => {
+			const manifest = mockManifest("wrong-id", "1.0.0");
+			const bundleBytes = await createMockBundle(manifest);
+
+			// Clear checksum so we reach the manifest check
+			const detail = mockPluginDetail("test-seo", "1.0.0");
+			detail.latestVersion!.checksum = "";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+
+			const result = await handleMarketplaceInstall(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+			);
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("MANIFEST_MISMATCH");
+		});
+
+		it("validates checksum against requested pinned version metadata", async () => {
+			const manifest = mockManifest("test-seo", "1.0.0");
+			const bundleBytes = await createMockBundle(manifest);
+
+			const detail = mockPluginDetail("test-seo", "2.0.0");
+			detail.latestVersion!.checksum = "different-checksum";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+			fetchSpy.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						items: [
+							{
+								version: "1.0.0",
+								minEmDashVersion: null,
+								bundleSize: 1234,
+								checksum: "",
+								changelog: null,
+								capabilities: ["hooks"],
+								auditVerdict: "pass",
+								imageAuditVerdict: "pass",
+								publishedAt: "2026-01-01T00:00:00Z",
+							},
+						],
+					}),
+					{ status: 200 },
+				),
+			);
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+			fetchSpy.mockResolvedValueOnce(new Response("OK", { status: 200 }));
+
+			const result = await handleMarketplaceInstall(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+				{ version: "1.0.0" },
+			);
+
+			expect(result.success).toBe(true);
+		});
+	});
+
+	// ── Update ─────────────────────────────────────────────────────
+
+	describe("handleMarketplaceUpdate", () => {
+		it("returns error when plugin not found", async () => {
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"nonexistent",
+			);
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+
+		it("returns error when plugin is not from marketplace", async () => {
+			// Insert a config-sourced plugin
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("config-plugin", "1.0.0", "active");
+
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"config-plugin",
+			);
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+
+		it("returns error when already up to date", async () => {
+			// Install v1.0.0
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Mock getPlugin returning same version
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify(mockPluginDetail("test-seo", "1.0.0")), { status: 200 }),
+			);
+
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+			);
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("ALREADY_UP_TO_DATE");
+		});
+
+		it("rejects update on checksum mismatch", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			const detail = mockPluginDetail("test-seo", "2.0.0");
+			detail.latestVersion!.checksum = "expected-checksum";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+
+			const bundleBytes = await createMockBundle(mockManifest("test-seo", "2.0.0"));
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+				{ confirmCapabilityChanges: true },
+			);
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("CHECKSUM_MISMATCH");
+		});
+
+		it("rejects update when bundle manifest version mismatches target", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			const detail = mockPluginDetail("test-seo", "2.0.0");
+			detail.latestVersion!.checksum = "";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+
+			const wrongVersionManifest = mockManifest("test-seo", "9.9.9");
+			const bundleBytes = await createMockBundle(wrongVersionManifest);
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+				{ confirmCapabilityChanges: true },
+			);
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("MANIFEST_VERSION_MISMATCH");
+		});
+
+		it("requires confirmation for capability escalation", async () => {
+			// Install v1.0.0 with only "hooks" capability
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Store old bundle in R2 (needed for capability diff)
+			const oldManifest = mockManifest("test-seo", "1.0.0");
+			const encoder = new TextEncoder();
+			await storage.upload({
+				key: "marketplace/test-seo/1.0.0/manifest.json",
+				body: encoder.encode(JSON.stringify(oldManifest)),
+				contentType: "application/json",
+			});
+			await storage.upload({
+				key: "marketplace/test-seo/1.0.0/backend.js",
+				body: encoder.encode("export default {};"),
+				contentType: "application/javascript",
+			});
+
+			// New version has additional capability
+			const newManifest = {
+				...mockManifest("test-seo", "2.0.0"),
+				capabilities: ["read:content", "network:fetch"],
+			};
+			const bundleBytes = await createMockBundle(newManifest as PluginManifest);
+
+			// Mock getPlugin
+			const detail = mockPluginDetail("test-seo", "2.0.0");
+			detail.latestVersion!.checksum = "";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+			// Mock downloadBundle
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+			);
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("CAPABILITY_ESCALATION");
+			expect(result.error?.details?.capabilityChanges).toBeDefined();
+		});
+
+		it("succeeds with confirmCapabilityChanges flag", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Store old bundle
+			const encoder = new TextEncoder();
+			const oldManifest = mockManifest("test-seo", "1.0.0");
+			await storage.upload({
+				key: "marketplace/test-seo/1.0.0/manifest.json",
+				body: encoder.encode(JSON.stringify(oldManifest)),
+				contentType: "application/json",
+			});
+			await storage.upload({
+				key: "marketplace/test-seo/1.0.0/backend.js",
+				body: encoder.encode("export default {};"),
+				contentType: "application/javascript",
+			});
+
+			const newManifest = {
+				...mockManifest("test-seo", "2.0.0"),
+				capabilities: ["read:content", "network:fetch"],
+			};
+			const bundleBytes = await createMockBundle(newManifest as PluginManifest);
+
+			const detail = mockPluginDetail("test-seo", "2.0.0");
+			detail.latestVersion!.checksum = "";
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(detail), { status: 200 }));
+			fetchSpy.mockResolvedValueOnce(new Response(bundleBytes, { status: 200 }));
+
+			const result = await handleMarketplaceUpdate(
+				db,
+				storage,
+				sandboxRunner,
+				MARKETPLACE_URL,
+				"test-seo",
+				{ confirmCapabilityChanges: true },
+			);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.oldVersion).toBe("1.0.0");
+			expect(result.data?.newVersion).toBe("2.0.0");
+			expect(result.data?.capabilityChanges.added).toContain("network:fetch");
+		});
+	});
+
+	// ── Uninstall ──────────────────────────────────────────────────
+
+	describe("handleMarketplaceUninstall", () => {
+		it("returns error when plugin not found", async () => {
+			const result = await handleMarketplaceUninstall(db, storage, "nonexistent");
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+
+		it("returns error when plugin is not from marketplace", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("config-plugin", "1.0.0", "active");
+
+			const result = await handleMarketplaceUninstall(db, storage, "config-plugin");
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+
+		it("successfully uninstalls a marketplace plugin", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Store bundle files that should be cleaned up
+			const encoder = new TextEncoder();
+			await storage.upload({
+				key: "marketplace/test-seo/1.0.0/manifest.json",
+				body: encoder.encode("{}"),
+				contentType: "application/json",
+			});
+			await storage.upload({
+				key: "marketplace/test-seo/1.0.0/backend.js",
+				body: encoder.encode(""),
+				contentType: "application/javascript",
+			});
+
+			const result = await handleMarketplaceUninstall(db, storage, "test-seo");
+
+			expect(result.success).toBe(true);
+			expect(result.data?.pluginId).toBe("test-seo");
+			expect(result.data?.dataDeleted).toBe(false);
+
+			// Verify state was deleted
+			const state = await repo.get("test-seo");
+			expect(state).toBeNull();
+		});
+
+		it("deletes plugin storage data when deleteData=true", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Insert some plugin storage data
+			await db
+				.insertInto("_plugin_storage")
+				.values({
+					plugin_id: "test-seo",
+					collection: "default",
+					id: "test-key",
+					data: JSON.stringify({ foo: "bar" }),
+				})
+				.execute();
+
+			const result = await handleMarketplaceUninstall(db, storage, "test-seo", {
+				deleteData: true,
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.dataDeleted).toBe(true);
+
+			// Verify plugin storage data was deleted
+			const storageRows = await db
+				.selectFrom("_plugin_storage")
+				.selectAll()
+				.where("plugin_id", "=", "test-seo")
+				.execute();
+			expect(storageRows).toHaveLength(0);
+		});
+	});
+
+	// ── Update check ───────────────────────────────────────────────
+
+	describe("handleMarketplaceUpdateCheck", () => {
+		it("returns error when marketplace not configured", async () => {
+			const result = await handleMarketplaceUpdateCheck(db, undefined);
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("MARKETPLACE_NOT_CONFIGURED");
+		});
+
+		it("returns empty items when no marketplace plugins installed", async () => {
+			const result = await handleMarketplaceUpdateCheck(db, MARKETPLACE_URL);
+			expect(result.success).toBe(true);
+			expect(result.data?.items).toEqual([]);
+		});
+
+		it("detects available updates", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// Mock getPlugin returning newer version
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify(mockPluginDetail("test-seo", "2.0.0")), { status: 200 }),
+			);
+
+			const result = await handleMarketplaceUpdateCheck(db, MARKETPLACE_URL);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.items).toHaveLength(1);
+			expect(result.data?.items[0]?.hasUpdate).toBe(true);
+			expect(result.data?.items[0]?.installed).toBe("1.0.0");
+			expect(result.data?.items[0]?.latest).toBe("2.0.0");
+		});
+
+		it("reports no update when versions match", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify(mockPluginDetail("test-seo", "1.0.0")), { status: 200 }),
+			);
+
+			const result = await handleMarketplaceUpdateCheck(db, MARKETPLACE_URL);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.items[0]?.hasUpdate).toBe(false);
+		});
+
+		it("skips plugins that fail to check", async () => {
+			const repo = new PluginStateRepository(db);
+			await repo.upsert("test-seo", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+			await repo.upsert("test-analytics", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			// First plugin check fails (404 — delisted)
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify({ error: "Not found" }), { status: 404 }),
+			);
+			// Second plugin check succeeds
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify(mockPluginDetail("test-analytics", "2.0.0")), { status: 200 }),
+			);
+
+			const result = await handleMarketplaceUpdateCheck(db, MARKETPLACE_URL);
+
+			expect(result.success).toBe(true);
+			// Only the successful check should appear
+			expect(result.data?.items).toHaveLength(1);
+			expect(result.data?.items[0]?.pluginId).toBe("test-analytics");
+		});
+	});
+
+	// ── Search proxy ───────────────────────────────────────────────
+
+	describe("handleMarketplaceSearch", () => {
+		it("returns error when marketplace not configured", async () => {
+			const result = await handleMarketplaceSearch(undefined);
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("MARKETPLACE_NOT_CONFIGURED");
+		});
+
+		it("proxies search request to marketplace", async () => {
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify({ items: [] }), { status: 200 }));
+
+			const result = await handleMarketplaceSearch(MARKETPLACE_URL, "seo");
+
+			expect(result.success).toBe(true);
+			const [url] = fetchSpy.mock.calls[0]!;
+			expect(url).toContain("/api/v1/plugins?q=seo");
+		});
+	});
+
+	// ── GetPlugin proxy ────────────────────────────────────────────
+
+	describe("handleMarketplaceGetPlugin", () => {
+		it("returns error when marketplace not configured", async () => {
+			const result = await handleMarketplaceGetPlugin(undefined, "test-seo");
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("MARKETPLACE_NOT_CONFIGURED");
+		});
+
+		it("returns NOT_FOUND for missing plugin", async () => {
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify({ error: "Not found" }), { status: 404 }),
+			);
+
+			const result = await handleMarketplaceGetPlugin(MARKETPLACE_URL, "nonexistent");
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+
+		it("proxies plugin detail from marketplace", async () => {
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify(mockPluginDetail()), { status: 200 }),
+			);
+
+			const result = await handleMarketplaceGetPlugin(MARKETPLACE_URL, "test-seo");
+
+			expect(result.success).toBe(true);
+		});
+	});
+});

packages/core/tests/unit/api/openapi.test.ts

@@ -0,0 +1,338 @@
+import { describe, expect, it } from "vitest";
+
+import { generateOpenApiDocument } from "../../../src/api/openapi/document.js";
+
+describe("OpenAPI document generation", () => {
+	it("generates a valid OpenAPI 3.1 document", () => {
+		const doc = generateOpenApiDocument();
+
+		expect(doc.openapi).toBe("3.1.0");
+		expect(doc.info.title).toBe("EmDash CMS API");
+		expect(doc.info.version).toBe("0.1.0");
+	});
+
+	it("includes content paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/content/{collection}");
+		expect(paths).toContain("/_emdash/api/content/{collection}/{id}");
+		expect(paths).toContain("/_emdash/api/content/{collection}/{id}/publish");
+		expect(paths).toContain("/_emdash/api/content/{collection}/{id}/schedule");
+		expect(paths).toContain("/_emdash/api/content/{collection}/{id}/duplicate");
+		expect(paths).toContain("/_emdash/api/content/{collection}/{id}/compare");
+		expect(paths).toContain("/_emdash/api/content/{collection}/{id}/translations");
+		expect(paths).toContain("/_emdash/api/content/{collection}/trash");
+	});
+
+	it("includes media paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/media");
+		expect(paths).toContain("/_emdash/api/media/{id}");
+		expect(paths).toContain("/_emdash/api/media/upload-url");
+		expect(paths).toContain("/_emdash/api/media/{id}/confirm");
+	});
+
+	it("includes schema paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/schema/collections");
+		expect(paths).toContain("/_emdash/api/schema/collections/{slug}");
+		expect(paths).toContain("/_emdash/api/schema/collections/{slug}/fields");
+		expect(paths).toContain("/_emdash/api/schema/collections/{slug}/fields/{fieldSlug}");
+		expect(paths).toContain("/_emdash/api/schema/orphans");
+	});
+
+	it("includes comments paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/comments/{collection}/{contentId}");
+		expect(paths).toContain("/_emdash/api/admin/comments");
+		expect(paths).toContain("/_emdash/api/admin/comments/counts");
+		expect(paths).toContain("/_emdash/api/admin/comments/bulk");
+		expect(paths).toContain("/_emdash/api/admin/comments/{id}");
+	});
+
+	it("includes taxonomy paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/taxonomies");
+		expect(paths).toContain("/_emdash/api/taxonomies/{name}/terms");
+		expect(paths).toContain("/_emdash/api/taxonomies/{name}/terms/{slug}");
+	});
+
+	it("includes menu paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/menus");
+		expect(paths).toContain("/_emdash/api/menus/{name}");
+		expect(paths).toContain("/_emdash/api/menus/{name}/items");
+		expect(paths).toContain("/_emdash/api/menus/{name}/reorder");
+	});
+
+	it("includes section paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/sections");
+		expect(paths).toContain("/_emdash/api/sections/{slug}");
+	});
+
+	it("includes widget paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/widget-areas");
+		expect(paths).toContain("/_emdash/api/widget-areas/{name}");
+		expect(paths).toContain("/_emdash/api/widget-areas/{name}/widgets");
+		expect(paths).toContain("/_emdash/api/widget-areas/{name}/widgets/{id}");
+		expect(paths).toContain("/_emdash/api/widget-areas/{name}/reorder");
+	});
+
+	it("includes settings paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/settings");
+	});
+
+	it("includes search paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/search");
+		expect(paths).toContain("/_emdash/api/search/suggest");
+		expect(paths).toContain("/_emdash/api/search/rebuild");
+		expect(paths).toContain("/_emdash/api/search/enable");
+		expect(paths).toContain("/_emdash/api/search/stats");
+	});
+
+	it("includes redirect paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/redirects");
+		expect(paths).toContain("/_emdash/api/redirects/{id}");
+		expect(paths).toContain("/_emdash/api/redirects/404s");
+		expect(paths).toContain("/_emdash/api/redirects/404s/summary");
+	});
+
+	it("includes user paths", () => {
+		const doc = generateOpenApiDocument();
+		const paths = Object.keys(doc.paths ?? {});
+
+		expect(paths).toContain("/_emdash/api/admin/users");
+		expect(paths).toContain("/_emdash/api/admin/users/{id}");
+		expect(paths).toContain("/_emdash/api/admin/users/{id}/disable");
+		expect(paths).toContain("/_emdash/api/admin/users/{id}/enable");
+		expect(paths).toContain("/_emdash/api/admin/allowed-domains");
+		expect(paths).toContain("/_emdash/api/admin/allowed-domains/{domain}");
+	});
+
+	it("has correct HTTP methods on content collection endpoint", () => {
+		const doc = generateOpenApiDocument();
+		const collectionPath = doc.paths?.["/_emdash/api/content/{collection}"];
+
+		expect(collectionPath).toBeDefined();
+		expect(collectionPath).toHaveProperty("get");
+		expect(collectionPath).toHaveProperty("post");
+	});
+
+	it("has correct HTTP methods on content item endpoint", () => {
+		const doc = generateOpenApiDocument();
+		const itemPath = doc.paths?.["/_emdash/api/content/{collection}/{id}"];
+
+		expect(itemPath).toBeDefined();
+		expect(itemPath).toHaveProperty("get");
+		expect(itemPath).toHaveProperty("put");
+		expect(itemPath).toHaveProperty("delete");
+	});
+
+	it("generates unique operation IDs for all operations", () => {
+		const doc = generateOpenApiDocument();
+		const operationIds: string[] = [];
+
+		for (const pathItem of Object.values(doc.paths ?? {})) {
+			for (const method of ["get", "post", "put", "delete", "patch"] as const) {
+				const op = (pathItem as Record<string, unknown>)?.[method] as
+					| { operationId?: string }
+					| undefined;
+				if (op?.operationId) {
+					operationIds.push(op.operationId);
+				}
+			}
+		}
+
+		// Content operations
+		expect(operationIds).toContain("listContent");
+		expect(operationIds).toContain("createContent");
+		expect(operationIds).toContain("getContent");
+		expect(operationIds).toContain("updateContent");
+		expect(operationIds).toContain("deleteContent");
+		expect(operationIds).toContain("publishContent");
+		expect(operationIds).toContain("duplicateContent");
+
+		// Media operations
+		expect(operationIds).toContain("listMedia");
+		expect(operationIds).toContain("getMedia");
+		expect(operationIds).toContain("deleteMedia");
+		expect(operationIds).toContain("getMediaUploadUrl");
+
+		// Schema operations
+		expect(operationIds).toContain("listCollections");
+		expect(operationIds).toContain("createCollection");
+		expect(operationIds).toContain("listFields");
+		expect(operationIds).toContain("createField");
+
+		// Comments operations
+		expect(operationIds).toContain("listPublicComments");
+		expect(operationIds).toContain("createComment");
+		expect(operationIds).toContain("listAdminComments");
+		expect(operationIds).toContain("bulkCommentAction");
+
+		// Taxonomy operations
+		expect(operationIds).toContain("listTaxonomies");
+		expect(operationIds).toContain("listTerms");
+		expect(operationIds).toContain("createTerm");
+
+		// Menu operations
+		expect(operationIds).toContain("listMenus");
+		expect(operationIds).toContain("createMenu");
+		expect(operationIds).toContain("createMenuItem");
+
+		// Section operations
+		expect(operationIds).toContain("listSections");
+		expect(operationIds).toContain("createSection");
+
+		// Widget operations
+		expect(operationIds).toContain("listWidgetAreas");
+		expect(operationIds).toContain("createWidget");
+
+		// Settings operations
+		expect(operationIds).toContain("getSettings");
+		expect(operationIds).toContain("updateSettings");
+
+		// Search operations
+		expect(operationIds).toContain("search");
+		expect(operationIds).toContain("rebuildSearchIndex");
+
+		// Redirect operations
+		expect(operationIds).toContain("listRedirects");
+		expect(operationIds).toContain("createRedirect");
+		expect(operationIds).toContain("listNotFoundEntries");
+
+		// User operations
+		expect(operationIds).toContain("listUsers");
+		expect(operationIds).toContain("getUser");
+		expect(operationIds).toContain("disableUser");
+
+		// No duplicate operation IDs
+		const uniqueIds = new Set(operationIds);
+		expect(uniqueIds.size).toBe(operationIds.length);
+	});
+
+	it("includes reusable component schemas", () => {
+		const doc = generateOpenApiDocument();
+		const schemas = doc.components?.schemas ?? {};
+
+		// Content schemas
+		expect(schemas).toHaveProperty("ContentCreateBody");
+		expect(schemas).toHaveProperty("ContentUpdateBody");
+		expect(schemas).toHaveProperty("ContentItem");
+		expect(schemas).toHaveProperty("ContentResponse");
+		expect(schemas).toHaveProperty("ContentListResponse");
+
+		// Media schemas
+		expect(schemas).toHaveProperty("MediaItem");
+		expect(schemas).toHaveProperty("MediaListResponse");
+
+		// Schema schemas
+		expect(schemas).toHaveProperty("Collection");
+		expect(schemas).toHaveProperty("CollectionListResponse");
+
+		// Comment schemas
+		expect(schemas).toHaveProperty("PublicComment");
+		expect(schemas).toHaveProperty("Comment");
+		expect(schemas).toHaveProperty("CommentBulkBody");
+
+		// Taxonomy schemas
+		expect(schemas).toHaveProperty("Term");
+		expect(schemas).toHaveProperty("TermListResponse");
+
+		// Menu schemas
+		expect(schemas).toHaveProperty("MenuWithItems");
+
+		// User schemas
+		expect(schemas).toHaveProperty("User");
+		expect(schemas).toHaveProperty("UserListResponse");
+	});
+
+	it("wraps success responses in { data } envelope", () => {
+		const doc = generateOpenApiDocument();
+		const listPath = doc.paths?.["/_emdash/api/content/{collection}"];
+		const getResponse = (listPath as Record<string, unknown>)?.get as {
+			responses: Record<string, { content: Record<string, { schema: Record<string, unknown> }> }>;
+		};
+		const schema = getResponse?.responses?.["200"]?.content?.["application/json"]?.schema;
+
+		expect(schema).toBeDefined();
+		// The envelope should have a "data" property
+		expect(schema).toHaveProperty("properties");
+		const props = (schema as Record<string, unknown>).properties as Record<string, unknown>;
+		expect(props).toHaveProperty("data");
+	});
+
+	it("includes error response schemas", () => {
+		const doc = generateOpenApiDocument();
+		const listPath = doc.paths?.["/_emdash/api/content/{collection}"];
+		const getOp = (listPath as Record<string, unknown>)?.get as {
+			responses: Record<string, unknown>;
+		};
+
+		// Should have auth error responses
+		expect(getOp?.responses).toHaveProperty("401");
+		expect(getOp?.responses).toHaveProperty("403");
+	});
+
+	it("includes security schemes", () => {
+		const doc = generateOpenApiDocument();
+		const schemes = doc.components?.securitySchemes;
+
+		expect(schemes).toHaveProperty("session");
+		expect(schemes).toHaveProperty("bearer");
+	});
+
+	it("tags all 12 domains", () => {
+		const doc = generateOpenApiDocument();
+		const tagNames = (doc.tags ?? []).map((t: { name: string }) => t.name);
+
+		expect(tagNames).toContain("Content");
+		expect(tagNames).toContain("Media");
+		expect(tagNames).toContain("Schema");
+		expect(tagNames).toContain("Comments");
+		expect(tagNames).toContain("Taxonomies");
+		expect(tagNames).toContain("Menus");
+		expect(tagNames).toContain("Sections");
+		expect(tagNames).toContain("Widgets");
+		expect(tagNames).toContain("Settings");
+		expect(tagNames).toContain("Search");
+		expect(tagNames).toContain("Redirects");
+		expect(tagNames).toContain("Users");
+		expect(tagNames).toHaveLength(12);
+	});
+
+	it("produces valid JSON output", () => {
+		const doc = generateOpenApiDocument();
+		const json = JSON.stringify(doc);
+
+		// Should not throw
+		const parsed = JSON.parse(json);
+		expect(parsed.openapi).toBe("3.1.0");
+	});
+});

packages/core/tests/unit/api/ownership-extraction.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Tests for SEC-07: ownership extraction bugs (#12, #13, #14, #16)
+ *
+ * Verifies that handler response shapes carry authorId correctly
+ * and that ownership-related operations work as expected.
+ */
+
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import {
+	handleContentCreate,
+	handleContentGet,
+	handleContentGetIncludingTrashed,
+	handleContentDelete,
+	handleContentDuplicate,
+	handleMediaCreate,
+} from "../../../src/api/index.js";
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("SEC-07: Ownership extraction", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("#12: handleContentGet returns authorId inside data.item", () => {
+		it("should expose authorId at data.item level, not data level", async () => {
+			const created = await handleContentCreate(db, "post", {
+				data: { title: "Owned Post" },
+				authorId: "user_author_123",
+			});
+			expect(created.success).toBe(true);
+
+			const result = await handleContentGet(db, "post", created.data!.item.id);
+			expect(result.success).toBe(true);
+
+			// The route pattern extracts: existing.data.item.authorId
+			// If authorId were only on data (wrong), ownership checks would always fail
+			const data = result.data as Record<string, unknown>;
+			const item = data.item as Record<string, unknown>;
+
+			expect(item.authorId).toBe("user_author_123");
+			// data level should NOT have authorId directly
+			expect(data.authorId).toBeUndefined();
+		});
+
+		it("should expose authorId at data.item level for trashed items", async () => {
+			const created = await handleContentCreate(db, "post", {
+				data: { title: "Trashed Post" },
+				authorId: "user_trash_owner",
+			});
+			expect(created.success).toBe(true);
+			await handleContentDelete(db, "post", created.data!.item.id);
+
+			const result = await handleContentGetIncludingTrashed(db, "post", created.data!.item.id);
+			expect(result.success).toBe(true);
+
+			const data = result.data as Record<string, unknown>;
+			const item = data.item as Record<string, unknown>;
+
+			expect(item.authorId).toBe("user_trash_owner");
+			expect(data.authorId).toBeUndefined();
+		});
+	});
+
+	describe("#14: handleContentDuplicate uses caller's authorId", () => {
+		it("should set the duplicate's authorId to the provided caller ID", async () => {
+			const original = await handleContentCreate(db, "post", {
+				data: { title: "Original Post" },
+				authorId: "original_author",
+			});
+			expect(original.success).toBe(true);
+
+			// Duplicate as a different user
+			const dup = await handleContentDuplicate(db, "post", original.data!.item.id, "caller_user");
+			expect(dup.success).toBe(true);
+			expect(dup.data?.item.authorId).toBe("caller_user");
+		});
+
+		it("should fall back to original authorId when caller ID not provided", async () => {
+			const original = await handleContentCreate(db, "post", {
+				data: { title: "Fallback Post" },
+				authorId: "original_author",
+			});
+			expect(original.success).toBe(true);
+
+			const dup = await handleContentDuplicate(db, "post", original.data!.item.id);
+			expect(dup.success).toBe(true);
+			expect(dup.data?.item.authorId).toBe("original_author");
+		});
+	});
+
+	describe("#16: handleMediaCreate persists authorId", () => {
+		it("should store authorId on created media item", async () => {
+			const result = await handleMediaCreate(db, {
+				filename: "photo.jpg",
+				mimeType: "image/jpeg",
+				storageKey: "test_key_123.jpg",
+				authorId: "media_uploader",
+			});
+			expect(result.success).toBe(true);
+			expect(result.data?.item.authorId).toBe("media_uploader");
+		});
+
+		it("should set authorId to null when not provided", async () => {
+			const result = await handleMediaCreate(db, {
+				filename: "orphan.jpg",
+				mimeType: "image/jpeg",
+				storageKey: "test_key_orphan.jpg",
+			});
+			expect(result.success).toBe(true);
+			expect(result.data?.item.authorId).toBeNull();
+		});
+	});
+});

packages/core/tests/unit/api/redirect.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+
+import { isSafeRedirect } from "#api/redirect.js";
+
+describe("isSafeRedirect", () => {
+	it("accepts simple relative paths", () => {
+		expect(isSafeRedirect("/")).toBe(true);
+		expect(isSafeRedirect("/admin")).toBe(true);
+		expect(isSafeRedirect("/_emdash/admin")).toBe(true);
+		expect(isSafeRedirect("/foo/bar?baz=1")).toBe(true);
+	});
+
+	it("rejects protocol-relative URLs (double slash)", () => {
+		expect(isSafeRedirect("//evil.com")).toBe(false);
+		expect(isSafeRedirect("//evil.com/path")).toBe(false);
+	});
+
+	it("rejects backslash bypass (/\\evil.com normalizes to //evil.com)", () => {
+		expect(isSafeRedirect("/\\evil.com")).toBe(false);
+		expect(isSafeRedirect("/foo\\bar")).toBe(false);
+		expect(isSafeRedirect("\\evil.com")).toBe(false);
+	});
+
+	it("rejects URLs that do not start with /", () => {
+		expect(isSafeRedirect("https://evil.com")).toBe(false);
+		expect(isSafeRedirect("http://evil.com")).toBe(false);
+		expect(isSafeRedirect("evil.com")).toBe(false);
+		expect(isSafeRedirect("")).toBe(false);
+	});
+
+	it("rejects null and undefined", () => {
+		expect(isSafeRedirect(null)).toBe(false);
+		expect(isSafeRedirect(undefined)).toBe(false);
+	});
+});

packages/core/tests/unit/api/rev.test.ts

@@ -0,0 +1,133 @@
+/**
+ * Unit tests for _rev token generation and validation.
+ */
+
+import { describe, it, expect } from "vitest";
+
+import { encodeRev, decodeRev, validateRev } from "../../../src/api/rev.js";
+import type { ContentItem } from "../../../src/database/repositories/types.js";
+
+function makeItem(overrides: Partial<ContentItem> = {}): ContentItem {
+	return {
+		id: "item_1",
+		type: "posts",
+		slug: "test",
+		status: "draft",
+		data: {},
+		authorId: null,
+		createdAt: "2026-01-01T00:00:00.000Z",
+		updatedAt: "2026-01-15T12:30:00.000Z",
+		publishedAt: null,
+		scheduledAt: null,
+		liveRevisionId: null,
+		draftRevisionId: null,
+		version: 3,
+		...overrides,
+	};
+}
+
+describe("encodeRev", () => {
+	it("produces a base64-encoded string", () => {
+		const item = makeItem();
+		const rev = encodeRev(item);
+
+		expect(rev).toBeTruthy();
+		// Should be valid base64
+		expect(() => atob(rev)).not.toThrow();
+	});
+
+	it("encodes version and updatedAt", () => {
+		const item = makeItem({ version: 5, updatedAt: "2026-02-14T10:00:00.000Z" });
+		const rev = encodeRev(item);
+		const decoded = atob(rev);
+
+		expect(decoded).toBe("5:2026-02-14T10:00:00.000Z");
+	});
+
+	it("produces different revs for different versions", () => {
+		const rev1 = encodeRev(makeItem({ version: 1 }));
+		const rev2 = encodeRev(makeItem({ version: 2 }));
+		expect(rev1).not.toBe(rev2);
+	});
+
+	it("produces different revs for different updatedAt", () => {
+		const rev1 = encodeRev(makeItem({ updatedAt: "2026-01-01T00:00:00.000Z" }));
+		const rev2 = encodeRev(makeItem({ updatedAt: "2026-01-02T00:00:00.000Z" }));
+		expect(rev1).not.toBe(rev2);
+	});
+});
+
+describe("decodeRev", () => {
+	it("decodes a valid rev", () => {
+		const rev = btoa("5:2026-02-14T10:00:00.000Z");
+		const result = decodeRev(rev);
+
+		expect(result).not.toBeNull();
+		expect(result!.version).toBe(5);
+		expect(result!.updatedAt).toBe("2026-02-14T10:00:00.000Z");
+	});
+
+	it("returns null for invalid base64", () => {
+		expect(decodeRev("not-valid-base64!!!")).toBeNull();
+	});
+
+	it("returns null for missing colon", () => {
+		expect(decodeRev(btoa("nocolon"))).toBeNull();
+	});
+
+	it("returns null for non-numeric version", () => {
+		expect(decodeRev(btoa("abc:2026-01-01"))).toBeNull();
+	});
+
+	it("round-trips with encodeRev", () => {
+		const item = makeItem({ version: 7, updatedAt: "2026-03-01T08:15:30.000Z" });
+		const rev = encodeRev(item);
+		const decoded = decodeRev(rev);
+
+		expect(decoded).not.toBeNull();
+		expect(decoded!.version).toBe(7);
+		expect(decoded!.updatedAt).toBe("2026-03-01T08:15:30.000Z");
+	});
+});
+
+describe("validateRev", () => {
+	it("returns valid when no rev is provided", () => {
+		const result = validateRev(undefined, makeItem());
+		expect(result.valid).toBe(true);
+	});
+
+	it("returns valid when rev matches", () => {
+		const item = makeItem({ version: 3, updatedAt: "2026-01-15T12:30:00.000Z" });
+		const rev = encodeRev(item);
+
+		const result = validateRev(rev, item);
+		expect(result.valid).toBe(true);
+	});
+
+	it("returns invalid when version mismatches", () => {
+		const item = makeItem({ version: 3, updatedAt: "2026-01-15T12:30:00.000Z" });
+		const staleRev = btoa("2:2026-01-15T12:30:00.000Z"); // Version 2, but item is at 3
+
+		const result = validateRev(staleRev, item);
+		expect(result.valid).toBe(false);
+		if (!result.valid) {
+			expect(result.message).toContain("modified");
+		}
+	});
+
+	it("returns invalid when updatedAt mismatches", () => {
+		const item = makeItem({ version: 3, updatedAt: "2026-01-15T12:30:00.000Z" });
+		const staleRev = btoa("3:2026-01-14T00:00:00.000Z"); // Right version, wrong timestamp
+
+		const result = validateRev(staleRev, item);
+		expect(result.valid).toBe(false);
+	});
+
+	it("returns invalid for malformed rev", () => {
+		const result = validateRev("garbage", makeItem());
+		expect(result.valid).toBe(false);
+		if (!result.valid) {
+			expect(result.message).toContain("Malformed");
+		}
+	});
+});

packages/core/tests/unit/api/revision-handlers.test.ts

@@ -0,0 +1,230 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import {
+	handleRevisionList,
+	handleRevisionGet,
+	handleRevisionRestore,
+} from "../../../src/api/index.js";
+import { ContentRepository } from "../../../src/database/repositories/content.js";
+import { RevisionRepository } from "../../../src/database/repositories/revision.js";
+import type { Database } from "../../../src/database/types.js";
+import { createPostFixture } from "../../utils/fixtures.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("Revision Handlers", () => {
+	let db: Kysely<Database>;
+	let contentRepo: ContentRepository;
+	let revisionRepo: RevisionRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		contentRepo = new ContentRepository(db);
+		revisionRepo = new RevisionRepository(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("handleRevisionList", () => {
+		it("should return empty list when no revisions exist", async () => {
+			const content = await contentRepo.create(createPostFixture());
+
+			const result = await handleRevisionList(db, "post", content.id, {});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.items).toEqual([]);
+			expect(result.data?.total).toBe(0);
+		});
+
+		it("should return revisions for a content entry", async () => {
+			const content = await contentRepo.create(createPostFixture());
+
+			// Create some revisions with small delay to ensure distinct ULIDs
+			await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "Version 1", content: "First version" },
+			});
+			// Small delay to ensure ULID timestamp differs
+			await new Promise((resolve) => setTimeout(resolve, 2));
+			await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "Version 2", content: "Second version" },
+			});
+
+			const result = await handleRevisionList(db, "post", content.id, {});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.items).toHaveLength(2);
+			expect(result.data?.total).toBe(2);
+			// Should be newest first
+			expect(result.data?.items[0].data.title).toBe("Version 2");
+			expect(result.data?.items[1].data.title).toBe("Version 1");
+		});
+
+		it("should respect limit parameter", async () => {
+			const content = await contentRepo.create(createPostFixture());
+
+			// Create 5 revisions
+			for (let i = 1; i <= 5; i++) {
+				await revisionRepo.create({
+					collection: "post",
+					entryId: content.id,
+					data: { title: `Version ${i}` },
+				});
+			}
+
+			const result = await handleRevisionList(db, "post", content.id, {
+				limit: 3,
+			});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.items).toHaveLength(3);
+			expect(result.data?.total).toBe(5); // Total still reflects all revisions
+		});
+
+		it("should not return revisions from other entries", async () => {
+			const content1 = await contentRepo.create(createPostFixture());
+			const content2 = await contentRepo.create({
+				...createPostFixture(),
+				slug: "another-post",
+			});
+
+			await revisionRepo.create({
+				collection: "post",
+				entryId: content1.id,
+				data: { title: "Content 1 revision" },
+			});
+			await revisionRepo.create({
+				collection: "post",
+				entryId: content2.id,
+				data: { title: "Content 2 revision" },
+			});
+
+			const result = await handleRevisionList(db, "post", content1.id, {});
+
+			expect(result.success).toBe(true);
+			expect(result.data?.items).toHaveLength(1);
+			expect(result.data?.items[0].data.title).toBe("Content 1 revision");
+		});
+	});
+
+	describe("handleRevisionGet", () => {
+		it("should return a revision by ID", async () => {
+			const content = await contentRepo.create(createPostFixture());
+			const revision = await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "Test Revision" },
+			});
+
+			const result = await handleRevisionGet(db, revision.id);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.id).toBe(revision.id);
+			expect(result.data?.item.data.title).toBe("Test Revision");
+		});
+
+		it("should return NOT_FOUND for non-existent revision", async () => {
+			const result = await handleRevisionGet(db, "nonexistent-id");
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+	});
+
+	describe("handleRevisionRestore", () => {
+		const callerUserId = "user_caller_123";
+
+		it("should restore content to a previous revision", async () => {
+			const content = await contentRepo.create({
+				...createPostFixture(),
+				data: { title: "Original", content: "Original content" },
+			});
+
+			// Create a revision with the original state
+			const originalRevision = await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "Original", content: "Original content" },
+			});
+
+			// Update the content
+			await contentRepo.update("post", content.id, {
+				data: { title: "Updated", content: "Updated content" },
+			});
+
+			// Restore to original revision
+			const result = await handleRevisionRestore(db, originalRevision.id, callerUserId);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.data.title).toBe("Original");
+			expect(result.data?.item.data.content).toBe("Original content");
+		});
+
+		it("should create a new revision when restoring", async () => {
+			const content = await contentRepo.create(createPostFixture());
+
+			const revision = await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "To restore" },
+			});
+
+			const beforeCount = await revisionRepo.countByEntry("post", content.id);
+
+			await handleRevisionRestore(db, revision.id, callerUserId);
+
+			const afterCount = await revisionRepo.countByEntry("post", content.id);
+			expect(afterCount).toBe(beforeCount + 1);
+		});
+
+		it("should attribute the new revision to the caller", async () => {
+			const content = await contentRepo.create(createPostFixture());
+
+			const revision = await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "To restore" },
+				authorId: "original_author",
+			});
+
+			await handleRevisionRestore(db, revision.id, callerUserId);
+
+			// The newest revision (restore record) should be attributed to the caller
+			const latestRevision = await revisionRepo.findLatest("post", content.id);
+			expect(latestRevision).not.toBeNull();
+			expect(latestRevision!.authorId).toBe(callerUserId);
+		});
+
+		it("should handle revision data containing _slug", async () => {
+			const content = await contentRepo.create({
+				...createPostFixture(),
+				data: { title: "Original" },
+			});
+
+			// Revision data includes _slug (added by runtime when slug changes)
+			const revision = await revisionRepo.create({
+				collection: "post",
+				entryId: content.id,
+				data: { title: "With slug change", _slug: "new-slug" },
+			});
+
+			const result = await handleRevisionRestore(db, revision.id, callerUserId);
+
+			expect(result.success).toBe(true);
+			expect(result.data?.item.data.title).toBe("With slug change");
+			expect(result.data?.item.slug).toBe("new-slug");
+		});
+
+		it("should return NOT_FOUND for non-existent revision", async () => {
+			const result = await handleRevisionRestore(db, "nonexistent-id", callerUserId);
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("NOT_FOUND");
+		});
+	});
+});

packages/core/tests/unit/api/schemas.test.ts

@@ -0,0 +1,56 @@
+import { describe, it, expect } from "vitest";
+
+import { contentUpdateBody, httpUrl } from "../../../src/api/schemas/index.js";
+
+describe("contentUpdateBody schema", () => {
+	it("should pass through skipRevision when present", () => {
+		const input = {
+			data: { title: "Hello" },
+			skipRevision: true,
+		};
+		const result = contentUpdateBody.parse(input);
+		expect(result.skipRevision).toBe(true);
+	});
+
+	it("should accept updates without skipRevision", () => {
+		const input = {
+			data: { title: "Hello" },
+		};
+		const result = contentUpdateBody.parse(input);
+		expect(result.skipRevision).toBeUndefined();
+	});
+});
+
+describe("httpUrl validator", () => {
+	it("accepts http URLs", () => {
+		expect(httpUrl.parse("http://example.com")).toBe("http://example.com");
+	});
+
+	it("accepts https URLs", () => {
+		expect(httpUrl.parse("https://example.com/path?q=1")).toBe("https://example.com/path?q=1");
+	});
+
+	it("rejects javascript: URIs", () => {
+		expect(() => httpUrl.parse("javascript:alert(1)")).toThrow();
+	});
+
+	it("rejects data: URIs", () => {
+		expect(() => httpUrl.parse("data:text/html,<script>alert(1)</script>")).toThrow();
+	});
+
+	it("rejects ftp: URIs", () => {
+		expect(() => httpUrl.parse("ftp://example.com")).toThrow();
+	});
+
+	it("rejects empty string", () => {
+		expect(() => httpUrl.parse("")).toThrow();
+	});
+
+	it("rejects non-URL strings", () => {
+		expect(() => httpUrl.parse("not a url")).toThrow();
+	});
+
+	it("is case-insensitive for scheme", () => {
+		expect(httpUrl.parse("HTTPS://EXAMPLE.COM")).toBe("HTTPS://EXAMPLE.COM");
+	});
+});

packages/core/tests/unit/auth/allowed-domains.test.ts

@@ -0,0 +1,308 @@
+import type { AuthAdapter } from "@emdashcms/auth";
+import { Role } from "@emdashcms/auth";
+import { createKyselyAdapter } from "@emdashcms/auth/adapters/kysely";
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("Allowed Domains Management", () => {
+	let db: Kysely<Database>;
+	let adapter: AuthAdapter;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		adapter = createKyselyAdapter(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("getAllowedDomains", () => {
+		it("should return empty array when no domains exist", async () => {
+			const domains = await adapter.getAllowedDomains();
+			expect(domains).toEqual([]);
+		});
+
+		it("should return all allowed domains", async () => {
+			await adapter.createAllowedDomain("acme.com", Role.AUTHOR);
+			await adapter.createAllowedDomain("partner.org", Role.CONTRIBUTOR);
+			await adapter.createAllowedDomain("editors.net", Role.EDITOR);
+
+			const domains = await adapter.getAllowedDomains();
+
+			expect(domains).toHaveLength(3);
+			const domainNames = domains.map((d) => d.domain);
+			expect(domainNames).toContain("acme.com");
+			expect(domainNames).toContain("partner.org");
+			expect(domainNames).toContain("editors.net");
+		});
+
+		it("should include both enabled and disabled domains", async () => {
+			await adapter.createAllowedDomain("enabled.com", Role.AUTHOR);
+			await adapter.createAllowedDomain("disabled.com", Role.AUTHOR);
+			await adapter.updateAllowedDomain("disabled.com", false);
+
+			const domains = await adapter.getAllowedDomains();
+
+			expect(domains).toHaveLength(2);
+			const enabled = domains.find((d) => d.domain === "enabled.com");
+			const disabled = domains.find((d) => d.domain === "disabled.com");
+
+			expect(enabled?.enabled).toBe(true);
+			expect(disabled?.enabled).toBe(false);
+		});
+	});
+
+	describe("getAllowedDomain", () => {
+		it("should return null for non-existent domain", async () => {
+			const domain = await adapter.getAllowedDomain("nonexistent.com");
+			expect(domain).toBeNull();
+		});
+
+		it("should return domain with all properties", async () => {
+			await adapter.createAllowedDomain("example.com", Role.EDITOR);
+
+			const domain = await adapter.getAllowedDomain("example.com");
+
+			expect(domain).not.toBeNull();
+			expect(domain?.domain).toBe("example.com");
+			expect(domain?.defaultRole).toBe(Role.EDITOR);
+			expect(domain?.enabled).toBe(true);
+			expect(domain?.createdAt).toBeInstanceOf(Date);
+		});
+
+		it("should be case-insensitive for domain lookup (normalizes to lowercase)", async () => {
+			await adapter.createAllowedDomain("example.com", Role.AUTHOR);
+
+			// Lowercase should work
+			const lower = await adapter.getAllowedDomain("example.com");
+			expect(lower).not.toBeNull();
+
+			// Uppercase should also work (domains are normalized to lowercase)
+			const upper = await adapter.getAllowedDomain("EXAMPLE.COM");
+			expect(upper).not.toBeNull();
+			expect(upper?.domain).toBe("example.com"); // stored as lowercase
+		});
+	});
+
+	describe("createAllowedDomain", () => {
+		it("should create a new allowed domain", async () => {
+			const domain = await adapter.createAllowedDomain("newdomain.com", Role.AUTHOR);
+
+			expect(domain.domain).toBe("newdomain.com");
+			expect(domain.defaultRole).toBe(Role.AUTHOR);
+			expect(domain.enabled).toBe(true);
+			expect(domain.createdAt).toBeInstanceOf(Date);
+		});
+
+		it("should create domain with specified role", async () => {
+			await adapter.createAllowedDomain("subscribers.com", Role.SUBSCRIBER);
+			await adapter.createAllowedDomain("contributors.com", Role.CONTRIBUTOR);
+			await adapter.createAllowedDomain("authors.com", Role.AUTHOR);
+			await adapter.createAllowedDomain("editors.com", Role.EDITOR);
+			await adapter.createAllowedDomain("admins.com", Role.ADMIN);
+
+			expect((await adapter.getAllowedDomain("subscribers.com"))?.defaultRole).toBe(
+				Role.SUBSCRIBER,
+			);
+			expect((await adapter.getAllowedDomain("contributors.com"))?.defaultRole).toBe(
+				Role.CONTRIBUTOR,
+			);
+			expect((await adapter.getAllowedDomain("authors.com"))?.defaultRole).toBe(Role.AUTHOR);
+			expect((await adapter.getAllowedDomain("editors.com"))?.defaultRole).toBe(Role.EDITOR);
+			expect((await adapter.getAllowedDomain("admins.com"))?.defaultRole).toBe(Role.ADMIN);
+		});
+
+		it("should throw error for duplicate domain", async () => {
+			await adapter.createAllowedDomain("duplicate.com", Role.AUTHOR);
+
+			await expect(adapter.createAllowedDomain("duplicate.com", Role.EDITOR)).rejects.toThrow();
+		});
+
+		it("should set enabled to true by default", async () => {
+			const domain = await adapter.createAllowedDomain("enabled-default.com", Role.AUTHOR);
+			expect(domain.enabled).toBe(true);
+		});
+	});
+
+	describe("updateAllowedDomain", () => {
+		it("should toggle domain enabled status", async () => {
+			await adapter.createAllowedDomain("toggle.com", Role.AUTHOR);
+
+			// Disable
+			await adapter.updateAllowedDomain("toggle.com", false);
+			let domain = await adapter.getAllowedDomain("toggle.com");
+			expect(domain?.enabled).toBe(false);
+
+			// Re-enable
+			await adapter.updateAllowedDomain("toggle.com", true);
+			domain = await adapter.getAllowedDomain("toggle.com");
+			expect(domain?.enabled).toBe(true);
+		});
+
+		it("should update default role", async () => {
+			await adapter.createAllowedDomain("role-change.com", Role.AUTHOR);
+
+			await adapter.updateAllowedDomain("role-change.com", true, Role.EDITOR);
+
+			const domain = await adapter.getAllowedDomain("role-change.com");
+			expect(domain?.defaultRole).toBe(Role.EDITOR);
+		});
+
+		it("should update both enabled and role at once", async () => {
+			await adapter.createAllowedDomain("both.com", Role.AUTHOR);
+
+			await adapter.updateAllowedDomain("both.com", false, Role.CONTRIBUTOR);
+
+			const domain = await adapter.getAllowedDomain("both.com");
+			expect(domain?.enabled).toBe(false);
+			expect(domain?.defaultRole).toBe(Role.CONTRIBUTOR);
+		});
+
+		it("should preserve role when only updating enabled", async () => {
+			await adapter.createAllowedDomain("preserve.com", Role.EDITOR);
+
+			await adapter.updateAllowedDomain("preserve.com", false);
+
+			const domain = await adapter.getAllowedDomain("preserve.com");
+			expect(domain?.enabled).toBe(false);
+			expect(domain?.defaultRole).toBe(Role.EDITOR);
+		});
+
+		it("should preserve createdAt when updating", async () => {
+			const created = await adapter.createAllowedDomain("timestamp.com", Role.AUTHOR);
+			const originalCreatedAt = created.createdAt;
+
+			// Small delay
+			await new Promise((resolve) => setTimeout(resolve, 10));
+
+			await adapter.updateAllowedDomain("timestamp.com", false, Role.EDITOR);
+
+			const updated = await adapter.getAllowedDomain("timestamp.com");
+			expect(updated?.createdAt.getTime()).toBe(originalCreatedAt.getTime());
+		});
+	});
+
+	describe("deleteAllowedDomain", () => {
+		it("should delete an existing domain", async () => {
+			await adapter.createAllowedDomain("todelete.com", Role.AUTHOR);
+
+			await adapter.deleteAllowedDomain("todelete.com");
+
+			const domain = await adapter.getAllowedDomain("todelete.com");
+			expect(domain).toBeNull();
+		});
+
+		it("should not affect other domains", async () => {
+			await adapter.createAllowedDomain("keep.com", Role.AUTHOR);
+			await adapter.createAllowedDomain("delete.com", Role.AUTHOR);
+
+			await adapter.deleteAllowedDomain("delete.com");
+
+			const kept = await adapter.getAllowedDomain("keep.com");
+			const deleted = await adapter.getAllowedDomain("delete.com");
+
+			expect(kept).not.toBeNull();
+			expect(deleted).toBeNull();
+		});
+
+		it("should be idempotent (no error on non-existent)", async () => {
+			// Deleting non-existent domain should not throw
+			await expect(adapter.deleteAllowedDomain("nonexistent.com")).resolves.not.toThrow();
+		});
+	});
+
+	describe("Domain Management Flow", () => {
+		it("should support full CRUD flow", async () => {
+			// Create
+			const created = await adapter.createAllowedDomain("company.com", Role.AUTHOR);
+			expect(created.domain).toBe("company.com");
+			expect(created.enabled).toBe(true);
+
+			// Read
+			let domain = await adapter.getAllowedDomain("company.com");
+			expect(domain?.domain).toBe("company.com");
+
+			// Update - change role
+			await adapter.updateAllowedDomain("company.com", true, Role.EDITOR);
+			domain = await adapter.getAllowedDomain("company.com");
+			expect(domain?.defaultRole).toBe(Role.EDITOR);
+
+			// Update - disable
+			await adapter.updateAllowedDomain("company.com", false);
+			domain = await adapter.getAllowedDomain("company.com");
+			expect(domain?.enabled).toBe(false);
+
+			// List
+			const all = await adapter.getAllowedDomains();
+			expect(all).toHaveLength(1);
+
+			// Delete
+			await adapter.deleteAllowedDomain("company.com");
+			domain = await adapter.getAllowedDomain("company.com");
+			expect(domain).toBeNull();
+
+			// List after delete
+			const afterDelete = await adapter.getAllowedDomains();
+			expect(afterDelete).toHaveLength(0);
+		});
+
+		it("should handle multiple domains correctly", async () => {
+			// Create multiple domains
+			await adapter.createAllowedDomain("first.com", Role.SUBSCRIBER);
+			await adapter.createAllowedDomain("second.com", Role.CONTRIBUTOR);
+			await adapter.createAllowedDomain("third.com", Role.AUTHOR);
+
+			// Verify all exist
+			let domains = await adapter.getAllowedDomains();
+			expect(domains).toHaveLength(3);
+
+			// Disable one
+			await adapter.updateAllowedDomain("second.com", false);
+
+			// Delete another
+			await adapter.deleteAllowedDomain("first.com");
+
+			// Verify state
+			domains = await adapter.getAllowedDomains();
+			expect(domains).toHaveLength(2);
+
+			const second = domains.find((d) => d.domain === "second.com");
+			const third = domains.find((d) => d.domain === "third.com");
+
+			expect(second?.enabled).toBe(false);
+			expect(third?.enabled).toBe(true);
+		});
+	});
+
+	describe("Edge Cases", () => {
+		it("should handle subdomains correctly", async () => {
+			await adapter.createAllowedDomain("sub.domain.com", Role.AUTHOR);
+
+			const domain = await adapter.getAllowedDomain("sub.domain.com");
+			expect(domain).not.toBeNull();
+
+			// Parent domain should not match
+			const parent = await adapter.getAllowedDomain("domain.com");
+			expect(parent).toBeNull();
+		});
+
+		it("should handle domains with hyphens", async () => {
+			await adapter.createAllowedDomain("my-company.com", Role.AUTHOR);
+
+			const domain = await adapter.getAllowedDomain("my-company.com");
+			expect(domain?.domain).toBe("my-company.com");
+		});
+
+		it("should handle long domain names", async () => {
+			const longDomain = "very-long-subdomain.another-part.yet-another.example.com";
+			await adapter.createAllowedDomain(longDomain, Role.AUTHOR);
+
+			const domain = await adapter.getAllowedDomain(longDomain);
+			expect(domain?.domain).toBe(longDomain);
+		});
+	});
+});

packages/core/tests/unit/auth/api-tokens.test.ts

@@ -0,0 +1,224 @@
+/**
+ * Unit tests for API token generation, hashing, and scope utilities.
+ */
+
+import { Role, scopesForRole, clampScopes } from "@emdashcms/auth";
+import { describe, it, expect } from "vitest";
+
+import {
+	generatePrefixedToken,
+	hashApiToken,
+	validateScopes,
+	hasScope,
+	TOKEN_PREFIXES,
+	VALID_SCOPES,
+} from "../../../src/auth/api-tokens.js";
+
+// Regex patterns for token validation
+const PAT_PREFIX_REGEX = /^ec_pat_/;
+const OAUTH_ACCESS_PREFIX_REGEX = /^ec_oat_/;
+const OAUTH_REFRESH_PREFIX_REGEX = /^ec_ort_/;
+const BASE64URL_INVALID_CHARS_REGEX = /[+/=]/;
+const BASE64URL_VALID_REGEX = /^[A-Za-z0-9_-]+$/;
+
+describe("generatePrefixedToken", () => {
+	it("generates a PAT with ec_pat_ prefix", () => {
+		const { raw, hash, prefix } = generatePrefixedToken(TOKEN_PREFIXES.PAT);
+
+		expect(raw).toMatch(PAT_PREFIX_REGEX);
+		expect(raw.length).toBeGreaterThan(20);
+		expect(hash).toBeTruthy();
+		expect(hash).not.toBe(raw);
+		expect(prefix).toMatch(PAT_PREFIX_REGEX);
+		expect(prefix.length).toBe(TOKEN_PREFIXES.PAT.length + 4);
+	});
+
+	it("generates an OAuth access token with ec_oat_ prefix", () => {
+		const { raw } = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		expect(raw).toMatch(OAUTH_ACCESS_PREFIX_REGEX);
+	});
+
+	it("generates an OAuth refresh token with ec_ort_ prefix", () => {
+		const { raw } = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
+		expect(raw).toMatch(OAUTH_REFRESH_PREFIX_REGEX);
+	});
+
+	it("generates unique tokens each time", () => {
+		const tokens = new Set<string>();
+		for (let i = 0; i < 50; i++) {
+			const { raw } = generatePrefixedToken("ec_pat_");
+			tokens.add(raw);
+		}
+		expect(tokens.size).toBe(50);
+	});
+
+	it("generates unique hashes for different tokens", () => {
+		const { hash: hash1 } = generatePrefixedToken("ec_pat_");
+		const { hash: hash2 } = generatePrefixedToken("ec_pat_");
+		expect(hash1).not.toBe(hash2);
+	});
+});
+
+describe("hashApiToken", () => {
+	it("produces a deterministic hash", () => {
+		const hash1 = hashApiToken("ec_pat_abc123");
+		const hash2 = hashApiToken("ec_pat_abc123");
+		expect(hash1).toBe(hash2);
+	});
+
+	it("produces different hashes for different tokens", () => {
+		const hash1 = hashApiToken("ec_pat_abc123");
+		const hash2 = hashApiToken("ec_pat_def456");
+		expect(hash1).not.toBe(hash2);
+	});
+
+	it("hashes the full prefixed token", () => {
+		// Same suffix but different prefix should produce different hashes
+		const hash1 = hashApiToken("ec_pat_abc123");
+		const hash2 = hashApiToken("ec_oat_abc123");
+		expect(hash1).not.toBe(hash2);
+	});
+
+	it("produces URL-safe base64 output", () => {
+		const hash = hashApiToken("ec_pat_test");
+		// Should not contain +, /, or = (standard base64 chars)
+		expect(hash).not.toMatch(BASE64URL_INVALID_CHARS_REGEX);
+		// Should only contain base64url chars
+		expect(hash).toMatch(BASE64URL_VALID_REGEX);
+	});
+});
+
+describe("validateScopes", () => {
+	it("returns empty array for valid scopes", () => {
+		const invalid = validateScopes(["content:read", "media:write"]);
+		expect(invalid).toEqual([]);
+	});
+
+	it("returns invalid scopes", () => {
+		const invalid = validateScopes(["content:read", "invalid:scope", "admin"]);
+		expect(invalid).toEqual(["invalid:scope"]);
+	});
+
+	it("handles empty array", () => {
+		expect(validateScopes([])).toEqual([]);
+	});
+
+	it("accepts all valid scopes", () => {
+		const invalid = validateScopes([...VALID_SCOPES]);
+		expect(invalid).toEqual([]);
+	});
+});
+
+describe("hasScope", () => {
+	it("returns true when scope is present", () => {
+		expect(hasScope(["content:read", "media:write"], "content:read")).toBe(true);
+	});
+
+	it("returns false when scope is missing", () => {
+		expect(hasScope(["content:read"], "content:write")).toBe(false);
+	});
+
+	it("admin scope grants access to everything", () => {
+		expect(hasScope(["admin"], "content:read")).toBe(true);
+		expect(hasScope(["admin"], "schema:write")).toBe(true);
+		expect(hasScope(["admin"], "media:write")).toBe(true);
+	});
+
+	it("handles empty scopes", () => {
+		expect(hasScope([], "content:read")).toBe(false);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// scopesForRole — maps roles to maximum allowed scopes
+// ---------------------------------------------------------------------------
+
+describe("scopesForRole", () => {
+	it("SUBSCRIBER gets only read scopes for content and media", () => {
+		const scopes = scopesForRole(Role.SUBSCRIBER);
+		expect(scopes).toContain("content:read");
+		expect(scopes).toContain("media:read");
+		expect(scopes).not.toContain("content:write");
+		expect(scopes).not.toContain("media:write");
+		expect(scopes).not.toContain("schema:read");
+		expect(scopes).not.toContain("schema:write");
+		expect(scopes).not.toContain("admin");
+	});
+
+	it("CONTRIBUTOR gets content and media read/write", () => {
+		const scopes = scopesForRole(Role.CONTRIBUTOR);
+		expect(scopes).toContain("content:read");
+		expect(scopes).toContain("content:write");
+		expect(scopes).toContain("media:read");
+		expect(scopes).toContain("media:write");
+		expect(scopes).not.toContain("schema:read");
+		expect(scopes).not.toContain("schema:write");
+		expect(scopes).not.toContain("admin");
+	});
+
+	it("EDITOR gets content, media, and schema:read", () => {
+		const scopes = scopesForRole(Role.EDITOR);
+		expect(scopes).toContain("content:read");
+		expect(scopes).toContain("content:write");
+		expect(scopes).toContain("media:read");
+		expect(scopes).toContain("media:write");
+		expect(scopes).toContain("schema:read");
+		expect(scopes).not.toContain("schema:write");
+		expect(scopes).not.toContain("admin");
+	});
+
+	it("ADMIN gets all scopes including admin and schema:write", () => {
+		const scopes = scopesForRole(Role.ADMIN);
+		expect(scopes).toContain("content:read");
+		expect(scopes).toContain("content:write");
+		expect(scopes).toContain("media:read");
+		expect(scopes).toContain("media:write");
+		expect(scopes).toContain("schema:read");
+		expect(scopes).toContain("schema:write");
+		expect(scopes).toContain("admin");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// clampScopes — intersects requested scopes with role-allowed scopes
+// ---------------------------------------------------------------------------
+
+describe("clampScopes", () => {
+	it("strips admin scope from non-admin role", () => {
+		const result = clampScopes(["content:read", "admin"], Role.CONTRIBUTOR);
+		expect(result).toEqual(["content:read"]);
+	});
+
+	it("strips schema:write from editor role", () => {
+		const result = clampScopes(["schema:read", "schema:write"], Role.EDITOR);
+		expect(result).toEqual(["schema:read"]);
+	});
+
+	it("preserves all scopes for admin role", () => {
+		const all = [
+			"content:read",
+			"content:write",
+			"media:read",
+			"media:write",
+			"schema:read",
+			"schema:write",
+			"admin",
+		];
+		const result = clampScopes(all, Role.ADMIN);
+		expect(result).toEqual(all);
+	});
+
+	it("returns empty array when no scopes survive clamping", () => {
+		const result = clampScopes(["admin", "schema:write"], Role.SUBSCRIBER);
+		expect(result).toEqual([]);
+	});
+
+	it("handles empty input", () => {
+		expect(clampScopes([], Role.ADMIN)).toEqual([]);
+	});
+
+	it("strips schema:read from contributor role", () => {
+		const result = clampScopes(["content:read", "schema:read"], Role.CONTRIBUTOR);
+		expect(result).toEqual(["content:read"]);
+	});
+});

packages/core/tests/unit/auth/challenge-store.test.ts

@@ -0,0 +1,214 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, vi, afterEach } from "vitest";
+
+import {
+	createChallengeStore,
+	cleanupExpiredChallenges,
+} from "../../../src/auth/challenge-store.js";
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabase } from "../../utils/test-db.js";
+
+describe("ChallengeStore", () => {
+	let db: Kysely<Database>;
+	let store: ReturnType<typeof createChallengeStore>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		store = createChallengeStore(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	describe("set()", () => {
+		it("stores challenge with expiry", async () => {
+			const challenge = "test-challenge-123";
+			const expiresAt = Date.now() + 5 * 60 * 1000; // 5 minutes
+
+			await store.set(challenge, {
+				type: "registration",
+				userId: "user-1",
+				expiresAt,
+			});
+
+			const result = await store.get(challenge);
+			expect(result).not.toBeNull();
+			expect(result?.type).toBe("registration");
+			expect(result?.userId).toBe("user-1");
+			expect(result?.expiresAt).toBe(expiresAt);
+		});
+
+		it("stores challenge without userId", async () => {
+			const challenge = "auth-challenge-456";
+			const expiresAt = Date.now() + 5 * 60 * 1000;
+
+			await store.set(challenge, {
+				type: "authentication",
+				expiresAt,
+			});
+
+			const result = await store.get(challenge);
+			expect(result).not.toBeNull();
+			expect(result?.type).toBe("authentication");
+			expect(result?.userId).toBeUndefined();
+		});
+
+		it("updates existing challenge on conflict", async () => {
+			const challenge = "update-test";
+			const expiresAt1 = Date.now() + 5 * 60 * 1000;
+			const expiresAt2 = Date.now() + 10 * 60 * 1000;
+
+			await store.set(challenge, {
+				type: "registration",
+				userId: "user-1",
+				expiresAt: expiresAt1,
+			});
+
+			await store.set(challenge, {
+				type: "authentication",
+				userId: "user-2",
+				expiresAt: expiresAt2,
+			});
+
+			const result = await store.get(challenge);
+			expect(result?.type).toBe("authentication");
+			expect(result?.userId).toBe("user-2");
+			expect(result?.expiresAt).toBe(expiresAt2);
+		});
+	});
+
+	describe("get()", () => {
+		it("returns stored challenge", async () => {
+			const challenge = "get-test";
+			const expiresAt = Date.now() + 5 * 60 * 1000;
+
+			await store.set(challenge, {
+				type: "registration",
+				userId: "user-abc",
+				expiresAt,
+			});
+
+			const result = await store.get(challenge);
+			expect(result).toEqual({
+				type: "registration",
+				userId: "user-abc",
+				expiresAt,
+			});
+		});
+
+		it("returns null for non-existent challenge", async () => {
+			const result = await store.get("does-not-exist");
+			expect(result).toBeNull();
+		});
+
+		it("returns null for expired challenges and deletes them", async () => {
+			vi.useFakeTimers();
+
+			const challenge = "expired-test";
+			const expiresAt = Date.now() + 60 * 1000; // 1 minute
+
+			await store.set(challenge, {
+				type: "registration",
+				expiresAt,
+			});
+
+			// Advance time past expiry
+			vi.advanceTimersByTime(61 * 1000);
+
+			const result = await store.get(challenge);
+			expect(result).toBeNull();
+
+			// Verify it was deleted
+			vi.useRealTimers();
+			const afterDelete = await db
+				.selectFrom("auth_challenges")
+				.selectAll()
+				.where("challenge", "=", challenge)
+				.executeTakeFirst();
+			expect(afterDelete).toBeUndefined();
+		});
+	});
+
+	describe("delete()", () => {
+		it("removes challenge", async () => {
+			const challenge = "delete-test";
+			const expiresAt = Date.now() + 5 * 60 * 1000;
+
+			await store.set(challenge, {
+				type: "authentication",
+				expiresAt,
+			});
+
+			// Verify it exists
+			const before = await store.get(challenge);
+			expect(before).not.toBeNull();
+
+			// Delete it
+			await store.delete(challenge);
+
+			// Verify it's gone
+			const after = await store.get(challenge);
+			expect(after).toBeNull();
+		});
+
+		it("does not throw when deleting non-existent challenge", async () => {
+			await expect(store.delete("non-existent")).resolves.not.toThrow();
+		});
+	});
+
+	describe("cleanupExpiredChallenges()", () => {
+		it("removes only expired entries", async () => {
+			vi.useFakeTimers();
+
+			const now = Date.now();
+
+			// Create some challenges with different expiry times
+			await store.set("expired-1", {
+				type: "registration",
+				expiresAt: now + 30 * 1000, // expires in 30s
+			});
+			await store.set("expired-2", {
+				type: "authentication",
+				expiresAt: now + 60 * 1000, // expires in 60s
+			});
+			await store.set("valid-1", {
+				type: "registration",
+				expiresAt: now + 5 * 60 * 1000, // expires in 5 minutes
+			});
+			await store.set("valid-2", {
+				type: "authentication",
+				expiresAt: now + 10 * 60 * 1000, // expires in 10 minutes
+			});
+
+			// Advance time by 90 seconds (past first two, but not last two)
+			vi.advanceTimersByTime(90 * 1000);
+
+			const deleted = await cleanupExpiredChallenges(db);
+			expect(deleted).toBe(2);
+
+			// Verify only valid ones remain
+			vi.useRealTimers();
+			const remaining = await db.selectFrom("auth_challenges").select("challenge").execute();
+
+			expect(remaining.map((r) => r.challenge).toSorted()).toEqual(["valid-1", "valid-2"]);
+		});
+
+		it("returns 0 when no expired challenges", async () => {
+			const expiresAt = Date.now() + 10 * 60 * 1000;
+
+			await store.set("valid", {
+				type: "registration",
+				expiresAt,
+			});
+
+			const deleted = await cleanupExpiredChallenges(db);
+			expect(deleted).toBe(0);
+		});
+
+		it("handles empty table", async () => {
+			const deleted = await cleanupExpiredChallenges(db);
+			expect(deleted).toBe(0);
+		});
+	});
+});

packages/core/tests/unit/auth/discovery-endpoints.test.ts

@@ -0,0 +1,117 @@
+/**
+ * Unit tests for OAuth discovery endpoint response shapes.
+ *
+ * These endpoints are public, unauthenticated, and return JSON metadata
+ * that MCP clients use to discover OAuth endpoints. The response shapes
+ * are contractual — changing them breaks MCP client compatibility.
+ */
+
+import { describe, it, expect } from "vitest";
+
+import { GET as getAuthorizationServer } from "../../../src/astro/routes/api/well-known/oauth-authorization-server.js";
+// We import the GET handlers directly — they're plain functions that take
+// an Astro-like context and return a Response.
+import { GET as getProtectedResource } from "../../../src/astro/routes/api/well-known/oauth-protected-resource.js";
+import { VALID_SCOPES } from "../../../src/auth/api-tokens.js";
+
+/** Minimal mock of what the route handlers actually use from the Astro context. */
+function mockContext(origin = "https://example.com") {
+	return { url: new URL("/.well-known/test", origin) } as Parameters<
+		typeof getProtectedResource
+	>[0];
+}
+
+describe("Protected Resource Metadata (RFC 9728)", () => {
+	it("returns correct resource and authorization_servers", async () => {
+		const response = await getProtectedResource(mockContext());
+		expect(response.status).toBe(200);
+
+		const body = (await response.json()) as Record<string, unknown>;
+		expect(body.resource).toBe("https://example.com/_emdash/api/mcp");
+		expect(body.authorization_servers).toEqual(["https://example.com/_emdash"]);
+	});
+
+	it("includes all valid scopes", async () => {
+		const response = await getProtectedResource(mockContext());
+		const body = (await response.json()) as { scopes_supported: string[] };
+		expect(body.scopes_supported).toEqual([...VALID_SCOPES]);
+	});
+
+	it("advertises header-based bearer method", async () => {
+		const response = await getProtectedResource(mockContext());
+		const body = (await response.json()) as { bearer_methods_supported: string[] };
+		expect(body.bearer_methods_supported).toEqual(["header"]);
+	});
+
+	it("sets CORS and cache headers", async () => {
+		const response = await getProtectedResource(mockContext());
+		expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+		expect(response.headers.get("Cache-Control")).toContain("public");
+	});
+
+	it("uses the request origin for URLs", async () => {
+		const response = await getProtectedResource(mockContext("https://cms.mysite.com"));
+		const body = (await response.json()) as Record<string, unknown>;
+		expect(body.resource).toBe("https://cms.mysite.com/_emdash/api/mcp");
+		expect(body.authorization_servers).toEqual(["https://cms.mysite.com/_emdash"]);
+	});
+});
+
+describe("Authorization Server Metadata (RFC 8414)", () => {
+	it("returns correct issuer and endpoints", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		expect(response.status).toBe(200);
+
+		const body = (await response.json()) as Record<string, unknown>;
+		expect(body.issuer).toBe("https://example.com/_emdash");
+		expect(body.authorization_endpoint).toBe("https://example.com/_emdash/oauth/authorize");
+		expect(body.token_endpoint).toBe("https://example.com/_emdash/api/oauth/token");
+		expect(body.device_authorization_endpoint).toBe(
+			"https://example.com/_emdash/api/oauth/device/code",
+		);
+	});
+
+	it("supports authorization_code, refresh_token, and device_code grants", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		const body = (await response.json()) as { grant_types_supported: string[] };
+		expect(body.grant_types_supported).toContain("authorization_code");
+		expect(body.grant_types_supported).toContain("refresh_token");
+		expect(body.grant_types_supported).toContain("urn:ietf:params:oauth:grant-type:device_code");
+	});
+
+	it("requires S256 code challenge method only", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		const body = (await response.json()) as { code_challenge_methods_supported: string[] };
+		expect(body.code_challenge_methods_supported).toEqual(["S256"]);
+	});
+
+	it("only supports code response type", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		const body = (await response.json()) as { response_types_supported: string[] };
+		expect(body.response_types_supported).toEqual(["code"]);
+	});
+
+	it("supports public clients (no auth method)", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		const body = (await response.json()) as { token_endpoint_auth_methods_supported: string[] };
+		expect(body.token_endpoint_auth_methods_supported).toEqual(["none"]);
+	});
+
+	it("includes all valid scopes", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		const body = (await response.json()) as { scopes_supported: string[] };
+		expect(body.scopes_supported).toEqual([...VALID_SCOPES]);
+	});
+
+	it("sets CORS and cache headers", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+		expect(response.headers.get("Cache-Control")).toContain("public");
+	});
+
+	it("supports client_id_metadata_document", async () => {
+		const response = await getAuthorizationServer(mockContext());
+		const body = (await response.json()) as { client_id_metadata_document_supported: boolean };
+		expect(body.client_id_metadata_document_supported).toBe(true);
+	});
+});

packages/core/tests/unit/auth/invite.test.ts

@@ -0,0 +1,309 @@
+import type { AuthAdapter, EmailSendFn } from "@emdashcms/auth";
+import type { EmailMessage } from "@emdashcms/auth";
+import {
+	Role,
+	createInvite,
+	createInviteToken,
+	validateInvite,
+	completeInvite,
+	InviteError,
+	escapeHtml,
+	generateToken,
+} from "@emdashcms/auth";
+import { createKyselyAdapter } from "@emdashcms/auth/adapters/kysely";
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+// Regex patterns for token validation
+const TOKEN_PARAM_REGEX = /token=/;
+const TOKEN_EXTRACT_REGEX = /token=([a-zA-Z0-9_-]+)/;
+
+describe("Invite", () => {
+	let db: Kysely<Database>;
+	let adapter: AuthAdapter;
+	let adminId: string;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		adapter = createKyselyAdapter(db);
+
+		// Create an admin user (required for the invitedBy FK)
+		const admin = await adapter.createUser({
+			email: "admin@example.com",
+			name: "Admin",
+			role: Role.ADMIN,
+			emailVerified: true,
+		});
+		adminId = admin.id;
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("createInviteToken", () => {
+		it("should create a token and return url + email", async () => {
+			const result = await createInviteToken(
+				{ baseUrl: "https://example.com" },
+				adapter,
+				"new@example.com",
+				Role.AUTHOR,
+				adminId,
+			);
+
+			expect(result.email).toBe("new@example.com");
+			expect(result.url).toContain("https://example.com");
+			expect(result.url).toMatch(TOKEN_PARAM_REGEX);
+			// Should NOT have a token field on the result
+			expect("token" in result).toBe(false);
+		});
+
+		it("should throw user_exists if email is already registered", async () => {
+			await adapter.createUser({
+				email: "existing@example.com",
+				name: "Existing",
+				role: Role.AUTHOR,
+				emailVerified: true,
+			});
+
+			await expect(
+				createInviteToken(
+					{ baseUrl: "https://example.com" },
+					adapter,
+					"existing@example.com",
+					Role.AUTHOR,
+					adminId,
+				),
+			).rejects.toThrow(InviteError);
+
+			try {
+				await createInviteToken(
+					{ baseUrl: "https://example.com" },
+					adapter,
+					"existing@example.com",
+					Role.AUTHOR,
+					adminId,
+				);
+			} catch (error) {
+				expect(error).toBeInstanceOf(InviteError);
+				expect((error as InviteError).code).toBe("user_exists");
+			}
+		});
+	});
+
+	describe("createInvite", () => {
+		let mockEmailSend: EmailSendFn & ReturnType<typeof vi.fn>;
+		let sentEmails: Array<EmailMessage>;
+
+		beforeEach(() => {
+			sentEmails = [];
+			mockEmailSend = vi.fn(async (email: EmailMessage) => {
+				sentEmails.push(email);
+			});
+		});
+
+		it("should send email when email sender is provided", async () => {
+			const result = await createInvite(
+				{
+					baseUrl: "https://example.com",
+					siteName: "Test Site",
+					email: mockEmailSend,
+				},
+				adapter,
+				"invite@example.com",
+				Role.EDITOR,
+				adminId,
+			);
+
+			expect(mockEmailSend).toHaveBeenCalledOnce();
+			expect(sentEmails).toHaveLength(1);
+			expect(sentEmails[0]!.to).toBe("invite@example.com");
+			expect(sentEmails[0]!.subject).toContain("Test Site");
+			expect(sentEmails[0]!.html).toContain("Accept Invite");
+			expect(sentEmails[0]!.text).toContain(result.url);
+		});
+
+		it("should return url without sending email when no sender", async () => {
+			const result = await createInvite(
+				{
+					baseUrl: "https://example.com",
+					siteName: "Test Site",
+					// No email sender — copy-link fallback
+				},
+				adapter,
+				"noemail@example.com",
+				Role.AUTHOR,
+				adminId,
+			);
+
+			expect(result.url).toContain("https://example.com");
+			expect(result.url).toMatch(TOKEN_PARAM_REGEX);
+			expect(result.email).toBe("noemail@example.com");
+		});
+
+		it("should HTML-escape siteName in email HTML body", async () => {
+			await createInvite(
+				{
+					baseUrl: "https://example.com",
+					siteName: '<script>alert("xss")</script>',
+					email: mockEmailSend,
+				},
+				adapter,
+				"xss@example.com",
+				Role.AUTHOR,
+				adminId,
+			);
+
+			expect(sentEmails).toHaveLength(1);
+			const html = sentEmails[0]!.html!;
+			// HTML body should be escaped
+			expect(html).not.toContain("<script>");
+			expect(html).toContain("&lt;script&gt;");
+			// Plain text subject should NOT be escaped (it's not HTML)
+			expect(sentEmails[0]!.subject).toContain("<script>");
+		});
+	});
+
+	describe("validateInvite", () => {
+		let capturedToken: string | null;
+
+		beforeEach(() => {
+			capturedToken = null;
+		});
+
+		async function createTestInvite(email: string, role: number = Role.AUTHOR): Promise<string> {
+			const mockSend = vi.fn(async (msg: EmailMessage) => {
+				const match = msg.text.match(TOKEN_EXTRACT_REGEX);
+				capturedToken = match ? (match[1] ?? null) : null;
+			});
+
+			await createInvite(
+				{
+					baseUrl: "https://example.com",
+					siteName: "Test",
+					email: mockSend,
+				},
+				adapter,
+				email,
+				role,
+				adminId,
+			);
+
+			if (!capturedToken) throw new Error("Token not captured from email");
+			return capturedToken;
+		}
+
+		it("should validate a valid token and return email + role", async () => {
+			const token = await createTestInvite("valid@example.com", Role.EDITOR);
+
+			const result = await validateInvite(adapter, token);
+
+			expect(result.email).toBe("valid@example.com");
+			expect(result.role).toBe(Role.EDITOR);
+		});
+
+		it("should throw invalid_token for a nonexistent token", async () => {
+			// Use a valid base64url token that doesn't exist in the DB
+			const fakeToken = generateToken();
+
+			await expect(validateInvite(adapter, fakeToken)).rejects.toThrow(InviteError);
+
+			try {
+				await validateInvite(adapter, fakeToken);
+			} catch (error) {
+				expect(error).toBeInstanceOf(InviteError);
+				expect((error as InviteError).code).toBe("invalid_token");
+			}
+		});
+
+		it("should throw invalid_token for an already-used token", async () => {
+			const token = await createTestInvite("used@example.com");
+
+			// Complete the invite (consumes the token)
+			await completeInvite(adapter, token, { name: "Used User" });
+
+			// Token should now be invalid
+			await expect(validateInvite(adapter, token)).rejects.toThrow(InviteError);
+		});
+	});
+
+	describe("completeInvite", () => {
+		async function createTestInvite(email: string, role: number = Role.AUTHOR): Promise<string> {
+			let token: string | null = null;
+			const mockSend = vi.fn(async (msg: EmailMessage) => {
+				const match = msg.text.match(TOKEN_EXTRACT_REGEX);
+				token = match ? (match[1] ?? null) : null;
+			});
+
+			await createInvite(
+				{
+					baseUrl: "https://example.com",
+					siteName: "Test",
+					email: mockSend,
+				},
+				adapter,
+				email,
+				role,
+				adminId,
+			);
+
+			if (!token) throw new Error("Token not captured from email");
+			return token;
+		}
+
+		it("should create user with correct email and role", async () => {
+			const token = await createTestInvite("new@example.com", Role.EDITOR);
+
+			const user = await completeInvite(adapter, token, { name: "New User" });
+
+			expect(user.email).toBe("new@example.com");
+			expect(user.role).toBe(Role.EDITOR);
+			expect(user.name).toBe("New User");
+			expect(user.emailVerified).toBe(true);
+		});
+
+		it("should delete token after use (single-use)", async () => {
+			const token = await createTestInvite("oneuse@example.com");
+
+			await completeInvite(adapter, token, { name: "One Use" });
+
+			// Second use should fail
+			await expect(completeInvite(adapter, token, { name: "Second Use" })).rejects.toThrow(
+				InviteError,
+			);
+		});
+
+		it("should throw invalid_token for nonexistent token", async () => {
+			const fakeToken = generateToken();
+
+			await expect(completeInvite(adapter, fakeToken, { name: "Fake" })).rejects.toThrow(
+				InviteError,
+			);
+		});
+	});
+
+	describe("escapeHtml", () => {
+		it("should escape angle brackets", () => {
+			expect(escapeHtml("<script>")).toBe("&lt;script&gt;");
+		});
+
+		it("should escape ampersands", () => {
+			expect(escapeHtml("a & b")).toBe("a &amp; b");
+		});
+
+		it("should escape double quotes", () => {
+			expect(escapeHtml('"hello"')).toBe("&quot;hello&quot;");
+		});
+
+		it("should handle strings with no special characters", () => {
+			expect(escapeHtml("My Site")).toBe("My Site");
+		});
+
+		it("should handle empty string", () => {
+			expect(escapeHtml("")).toBe("");
+		});
+	});
+});

packages/core/tests/unit/auth/passkey-config.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect } from "vitest";
+
+import { getPasskeyConfig } from "../../../src/auth/passkey-config.js";
+
+describe("passkey-config", () => {
+	describe("getPasskeyConfig()", () => {
+		it("extracts rpId from localhost URL", () => {
+			const url = new URL("http://localhost:4321/admin");
+			const config = getPasskeyConfig(url);
+
+			expect(config.rpId).toBe("localhost");
+		});
+
+		it("extracts rpId from production URL", () => {
+			const url = new URL("https://example.com/admin");
+			const config = getPasskeyConfig(url);
+
+			expect(config.rpId).toBe("example.com");
+		});
+
+		it("extracts rpId from subdomain URL", () => {
+			const url = new URL("https://admin.example.com/dashboard");
+			const config = getPasskeyConfig(url);
+
+			expect(config.rpId).toBe("admin.example.com");
+		});
+
+		it("returns correct origin for http", () => {
+			const url = new URL("http://localhost:4321/admin");
+			const config = getPasskeyConfig(url);
+
+			expect(config.origin).toBe("http://localhost:4321");
+		});
+
+		it("returns correct origin for https", () => {
+			const url = new URL("https://example.com/admin");
+			const config = getPasskeyConfig(url);
+
+			expect(config.origin).toBe("https://example.com");
+		});
+
+		it("handles port numbers correctly", () => {
+			const url = new URL("http://localhost:3000/setup");
+			const config = getPasskeyConfig(url);
+
+			expect(config.rpId).toBe("localhost");
+			expect(config.origin).toBe("http://localhost:3000");
+		});
+
+		it("handles https with non-standard port", () => {
+			const url = new URL("https://staging.example.com:8443/admin");
+			const config = getPasskeyConfig(url);
+
+			expect(config.rpId).toBe("staging.example.com");
+			expect(config.origin).toBe("https://staging.example.com:8443");
+		});
+
+		it("uses hostname as rpName by default", () => {
+			const url = new URL("https://example.com/admin");
+			const config = getPasskeyConfig(url);
+
+			expect(config.rpName).toBe("example.com");
+		});
+
+		it("uses provided siteName for rpName", () => {
+			const url = new URL("https://example.com/admin");
+			const config = getPasskeyConfig(url, "My Cool Site");
+
+			expect(config.rpName).toBe("My Cool Site");
+			expect(config.rpId).toBe("example.com");
+		});
+
+		it("ignores path and query params for origin", () => {
+			const url = new URL("https://example.com:443/admin/setup?foo=bar#section");
+			const config = getPasskeyConfig(url);
+
+			// Standard https port 443 is omitted from origin
+			expect(config.origin).toBe("https://example.com");
+			expect(config.rpId).toBe("example.com");
+		});
+	});
+});

packages/core/tests/unit/auth/passkey-management.test.ts

@@ -0,0 +1,278 @@
+import type { AuthAdapter, Credential, User } from "@emdashcms/auth";
+import { Role } from "@emdashcms/auth";
+import { createKyselyAdapter } from "@emdashcms/auth/adapters/kysely";
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("Passkey Management", () => {
+	let db: Kysely<Database>;
+	let adapter: AuthAdapter;
+	let testUser: User;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		adapter = createKyselyAdapter(db);
+
+		// Create a test user
+		testUser = await adapter.createUser({
+			email: "test@example.com",
+			name: "Test User",
+			role: Role.ADMIN,
+		});
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	// Helper to create a test credential
+	async function createTestCredential(userId: string, name?: string): Promise<Credential> {
+		const credentialId = `cred-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+		return adapter.createCredential({
+			id: credentialId,
+			userId,
+			publicKey: new Uint8Array([1, 2, 3, 4]),
+			counter: 0,
+			deviceType: "multiDevice",
+			backedUp: true,
+			transports: ["internal"],
+			name: name ?? null,
+		});
+	}
+
+	describe("getCredentialById", () => {
+		it("should return credential by ID", async () => {
+			const created = await createTestCredential(testUser.id, "My MacBook");
+
+			const credential = await adapter.getCredentialById(created.id);
+
+			expect(credential).not.toBeNull();
+			expect(credential?.id).toBe(created.id);
+			expect(credential?.userId).toBe(testUser.id);
+			expect(credential?.name).toBe("My MacBook");
+			expect(credential?.deviceType).toBe("multiDevice");
+			expect(credential?.backedUp).toBe(true);
+		});
+
+		it("should return null for non-existent credential", async () => {
+			const credential = await adapter.getCredentialById("non-existent");
+			expect(credential).toBeNull();
+		});
+	});
+
+	describe("getCredentialsByUserId", () => {
+		it("should return empty array for user with no passkeys", async () => {
+			const credentials = await adapter.getCredentialsByUserId(testUser.id);
+			expect(credentials).toEqual([]);
+		});
+
+		it("should return all passkeys for a user", async () => {
+			await createTestCredential(testUser.id, "MacBook Pro");
+			await createTestCredential(testUser.id, "iPhone");
+			await createTestCredential(testUser.id, null);
+
+			const credentials = await adapter.getCredentialsByUserId(testUser.id);
+
+			expect(credentials).toHaveLength(3);
+			const names = credentials.map((c) => c.name);
+			expect(names).toContain("MacBook Pro");
+			expect(names).toContain("iPhone");
+			expect(names).toContain(null);
+		});
+
+		it("should not return passkeys from other users", async () => {
+			const otherUser = await adapter.createUser({
+				email: "other@example.com",
+				name: "Other User",
+			});
+
+			await createTestCredential(testUser.id, "Test User Passkey");
+			await createTestCredential(otherUser.id, "Other User Passkey");
+
+			const testUserCreds = await adapter.getCredentialsByUserId(testUser.id);
+			const otherUserCreds = await adapter.getCredentialsByUserId(otherUser.id);
+
+			expect(testUserCreds).toHaveLength(1);
+			expect(testUserCreds[0].name).toBe("Test User Passkey");
+
+			expect(otherUserCreds).toHaveLength(1);
+			expect(otherUserCreds[0].name).toBe("Other User Passkey");
+		});
+	});
+
+	describe("updateCredentialName", () => {
+		it("should update the credential name", async () => {
+			const credential = await createTestCredential(testUser.id, "Old Name");
+
+			await adapter.updateCredentialName(credential.id, "New Name");
+
+			const updated = await adapter.getCredentialById(credential.id);
+			expect(updated?.name).toBe("New Name");
+		});
+
+		it("should set name to null when provided null", async () => {
+			const credential = await createTestCredential(testUser.id, "Has Name");
+
+			await adapter.updateCredentialName(credential.id, null);
+
+			const updated = await adapter.getCredentialById(credential.id);
+			expect(updated?.name).toBeNull();
+		});
+
+		it("should handle empty string as name", async () => {
+			const credential = await createTestCredential(testUser.id, "Has Name");
+
+			await adapter.updateCredentialName(credential.id, "");
+
+			const updated = await adapter.getCredentialById(credential.id);
+			expect(updated?.name).toBe("");
+		});
+	});
+
+	describe("countCredentialsByUserId", () => {
+		it("should return 0 for user with no passkeys", async () => {
+			const count = await adapter.countCredentialsByUserId(testUser.id);
+			expect(count).toBe(0);
+		});
+
+		it("should return correct count", async () => {
+			await createTestCredential(testUser.id);
+			await createTestCredential(testUser.id);
+			await createTestCredential(testUser.id);
+
+			const count = await adapter.countCredentialsByUserId(testUser.id);
+			expect(count).toBe(3);
+		});
+
+		it("should only count credentials for the specified user", async () => {
+			const otherUser = await adapter.createUser({
+				email: "other@example.com",
+			});
+
+			await createTestCredential(testUser.id);
+			await createTestCredential(testUser.id);
+			await createTestCredential(otherUser.id);
+
+			const testUserCount = await adapter.countCredentialsByUserId(testUser.id);
+			const otherUserCount = await adapter.countCredentialsByUserId(otherUser.id);
+
+			expect(testUserCount).toBe(2);
+			expect(otherUserCount).toBe(1);
+		});
+	});
+
+	describe("deleteCredential", () => {
+		it("should delete a credential", async () => {
+			const credential = await createTestCredential(testUser.id);
+
+			await adapter.deleteCredential(credential.id);
+
+			const deleted = await adapter.getCredentialById(credential.id);
+			expect(deleted).toBeNull();
+		});
+
+		it("should not affect other credentials", async () => {
+			await createTestCredential(testUser.id, "Keep This");
+			const cred2 = await createTestCredential(testUser.id, "Delete This");
+
+			await adapter.deleteCredential(cred2.id);
+
+			const remaining = await adapter.getCredentialsByUserId(testUser.id);
+			expect(remaining).toHaveLength(1);
+			expect(remaining[0].name).toBe("Keep This");
+		});
+	});
+
+	describe("Passkey Management Flow", () => {
+		it("should support full CRUD flow", async () => {
+			// Create passkeys
+			const passkey1 = await createTestCredential(testUser.id, "MacBook");
+			const passkey2 = await createTestCredential(testUser.id, "iPhone");
+
+			// List passkeys
+			let passkeys = await adapter.getCredentialsByUserId(testUser.id);
+			expect(passkeys).toHaveLength(2);
+
+			// Rename a passkey
+			await adapter.updateCredentialName(passkey1.id, "MacBook Pro M3");
+			const renamed = await adapter.getCredentialById(passkey1.id);
+			expect(renamed?.name).toBe("MacBook Pro M3");
+
+			// Delete a passkey (not the last one)
+			const countBefore = await adapter.countCredentialsByUserId(testUser.id);
+			expect(countBefore).toBe(2);
+
+			await adapter.deleteCredential(passkey2.id);
+
+			const countAfter = await adapter.countCredentialsByUserId(testUser.id);
+			expect(countAfter).toBe(1);
+
+			// Verify only one remains
+			passkeys = await adapter.getCredentialsByUserId(testUser.id);
+			expect(passkeys).toHaveLength(1);
+			expect(passkeys[0].name).toBe("MacBook Pro M3");
+		});
+
+		it("should enforce 'cannot delete last passkey' in application logic", async () => {
+			// Create a single passkey
+			const passkey = await createTestCredential(testUser.id, "Only Passkey");
+
+			// Check count before deletion attempt
+			const count = await adapter.countCredentialsByUserId(testUser.id);
+			expect(count).toBe(1);
+
+			// Application should check count and prevent deletion
+			// The adapter itself doesn't enforce this - it's the API layer's job
+			if (count <= 1) {
+				// Don't delete - this is what the API should do
+				const stillExists = await adapter.getCredentialById(passkey.id);
+				expect(stillExists).not.toBeNull();
+			}
+		});
+	});
+
+	describe("Credential properties", () => {
+		it("should preserve all credential properties", async () => {
+			await adapter.createCredential({
+				id: "test-cred-123",
+				userId: testUser.id,
+				publicKey: new Uint8Array([10, 20, 30, 40, 50]),
+				counter: 5,
+				deviceType: "singleDevice",
+				backedUp: false,
+				transports: ["usb", "nfc"],
+				name: "YubiKey 5",
+			});
+
+			const retrieved = await adapter.getCredentialById("test-cred-123");
+
+			expect(retrieved).not.toBeNull();
+			expect(retrieved?.id).toBe("test-cred-123");
+			expect(retrieved?.userId).toBe(testUser.id);
+			expect(retrieved?.counter).toBe(5);
+			expect(retrieved?.deviceType).toBe("singleDevice");
+			expect(retrieved?.backedUp).toBe(false);
+			expect(retrieved?.transports).toEqual(["usb", "nfc"]);
+			expect(retrieved?.name).toBe("YubiKey 5");
+			expect(retrieved?.createdAt).toBeInstanceOf(Date);
+			expect(retrieved?.lastUsedAt).toBeInstanceOf(Date);
+		});
+
+		it("should update lastUsedAt when counter is updated", async () => {
+			const credential = await createTestCredential(testUser.id);
+			const originalLastUsed = credential.lastUsedAt;
+
+			// Small delay to ensure time difference
+			await new Promise((resolve) => setTimeout(resolve, 10));
+
+			await adapter.updateCredentialCounter(credential.id, 1);
+
+			const updated = await adapter.getCredentialById(credential.id);
+			expect(updated?.counter).toBe(1);
+			expect(updated?.lastUsedAt.getTime()).toBeGreaterThan(originalLastUsed.getTime());
+		});
+	});
+});

packages/core/tests/unit/auth/scopes.test.ts

@@ -0,0 +1,66 @@
+/**
+ * Unit tests for scope enforcement.
+ *
+ * Tests the requireScope() guard that API routes and MCP tools use
+ * to enforce token scope restrictions.
+ */
+
+import { describe, it, expect } from "vitest";
+
+import { requireScope } from "../../../src/auth/scopes.js";
+
+describe("requireScope", () => {
+	it("allows session auth (no tokenScopes) unconditionally", () => {
+		const result = requireScope({}, "content:write");
+		expect(result).toBeNull();
+	});
+
+	it("allows session auth with undefined tokenScopes", () => {
+		const result = requireScope({ tokenScopes: undefined }, "schema:write");
+		expect(result).toBeNull();
+	});
+
+	it("allows when token has the required scope", () => {
+		const result = requireScope(
+			{ tokenScopes: ["content:read", "content:write"] },
+			"content:write",
+		);
+		expect(result).toBeNull();
+	});
+
+	it("rejects when token lacks the required scope", () => {
+		const result = requireScope({ tokenScopes: ["content:read"] }, "content:write");
+		expect(result).toBeInstanceOf(Response);
+		expect(result!.status).toBe(403);
+	});
+
+	it("returns INSUFFICIENT_SCOPE error body", async () => {
+		const result = requireScope({ tokenScopes: ["media:read"] }, "schema:write");
+		expect(result).not.toBeNull();
+		const body = (await result!.json()) as { error: { code: string; message: string } };
+		expect(body.error.code).toBe("INSUFFICIENT_SCOPE");
+		expect(body.error.message).toContain("schema:write");
+	});
+
+	it("admin scope grants access to everything", () => {
+		expect(requireScope({ tokenScopes: ["admin"] }, "content:read")).toBeNull();
+		expect(requireScope({ tokenScopes: ["admin"] }, "content:write")).toBeNull();
+		expect(requireScope({ tokenScopes: ["admin"] }, "schema:read")).toBeNull();
+		expect(requireScope({ tokenScopes: ["admin"] }, "schema:write")).toBeNull();
+		expect(requireScope({ tokenScopes: ["admin"] }, "media:read")).toBeNull();
+		expect(requireScope({ tokenScopes: ["admin"] }, "media:write")).toBeNull();
+	});
+
+	it("empty scopes array rejects everything", () => {
+		expect(requireScope({ tokenScopes: [] }, "content:read")).toBeInstanceOf(Response);
+		expect(requireScope({ tokenScopes: [] }, "admin")).toBeInstanceOf(Response);
+	});
+
+	it("read scope does not grant write access", () => {
+		expect(requireScope({ tokenScopes: ["content:read"] }, "content:write")).toBeInstanceOf(
+			Response,
+		);
+		expect(requireScope({ tokenScopes: ["media:read"] }, "media:write")).toBeInstanceOf(Response);
+		expect(requireScope({ tokenScopes: ["schema:read"] }, "schema:write")).toBeInstanceOf(Response);
+	});
+});

packages/core/tests/unit/auth/signup.test.ts

@@ -0,0 +1,462 @@
+import type { AuthAdapter, EmailSendFn } from "@emdashcms/auth";
+import type { EmailMessage } from "@emdashcms/auth";
+import {
+	Role,
+	canSignup,
+	requestSignup,
+	validateSignupToken,
+	completeSignup,
+	SignupError,
+} from "@emdashcms/auth";
+import { createKyselyAdapter } from "@emdashcms/auth/adapters/kysely";
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+// Regex patterns for token validation
+const TOKEN_PARAM_REGEX = /token=/;
+const TOKEN_EXTRACT_REGEX = /token=([a-zA-Z0-9_-]+)/;
+
+describe("Self-Signup", () => {
+	let db: Kysely<Database>;
+	let adapter: AuthAdapter;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		adapter = createKyselyAdapter(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("canSignup", () => {
+		it("should return null for email with no allowed domain", async () => {
+			const result = await canSignup(adapter, "user@notallowed.com");
+			expect(result).toBeNull();
+		});
+
+		it("should return null for email with disabled domain", async () => {
+			// Create a disabled domain
+			await adapter.createAllowedDomain("disabled.com", Role.AUTHOR);
+			await adapter.updateAllowedDomain("disabled.com", false);
+
+			const result = await canSignup(adapter, "user@disabled.com");
+			expect(result).toBeNull();
+		});
+
+		it("should return allowed:true and role for email with allowed domain", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			const result = await canSignup(adapter, "user@allowed.com");
+
+			expect(result).not.toBeNull();
+			expect(result?.allowed).toBe(true);
+			expect(result?.role).toBe(Role.AUTHOR);
+		});
+
+		it("should return correct role for each domain", async () => {
+			await adapter.createAllowedDomain("authors.com", Role.AUTHOR);
+			await adapter.createAllowedDomain("editors.com", Role.EDITOR);
+			await adapter.createAllowedDomain("contributors.com", Role.CONTRIBUTOR);
+
+			const author = await canSignup(adapter, "user@authors.com");
+			const editor = await canSignup(adapter, "user@editors.com");
+			const contributor = await canSignup(adapter, "user@contributors.com");
+
+			expect(author?.role).toBe(Role.AUTHOR);
+			expect(editor?.role).toBe(Role.EDITOR);
+			expect(contributor?.role).toBe(Role.CONTRIBUTOR);
+		});
+
+		it("should be case-insensitive for email domains", async () => {
+			await adapter.createAllowedDomain("example.com", Role.AUTHOR);
+
+			const result = await canSignup(adapter, "User@EXAMPLE.COM");
+			expect(result).not.toBeNull();
+		});
+
+		it("should return null for invalid email format", async () => {
+			const result = await canSignup(adapter, "not-an-email");
+			expect(result).toBeNull();
+		});
+	});
+
+	describe("requestSignup", () => {
+		let mockEmailSend: EmailSendFn & ReturnType<typeof vi.fn>;
+		let sentEmails: Array<EmailMessage>;
+
+		beforeEach(() => {
+			sentEmails = [];
+			mockEmailSend = vi.fn(async (email: EmailMessage) => {
+				sentEmails.push(email);
+			});
+		});
+
+		it("should send verification email for allowed domain", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			expect(mockEmailSend).toHaveBeenCalledTimes(1);
+			expect(sentEmails[0]!.to).toBe("newuser@allowed.com");
+			expect(sentEmails[0]!.subject).toContain("Test Site");
+			expect(sentEmails[0]!.text).toContain("verify");
+		});
+
+		it("should fail silently for disallowed domain (no email sent)", async () => {
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"user@notallowed.com",
+			);
+
+			expect(mockEmailSend).not.toHaveBeenCalled();
+		});
+
+		it("should fail silently if user already exists (no email sent)", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			// Create existing user
+			await adapter.createUser({
+				email: "existing@allowed.com",
+				name: "Existing User",
+			});
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"existing@allowed.com",
+			);
+
+			expect(mockEmailSend).not.toHaveBeenCalled();
+		});
+
+		it("should create a token in the database", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.EDITOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			// The email should contain a verification link with a token
+			expect(sentEmails[0]!.text).toMatch(TOKEN_PARAM_REGEX);
+		});
+	});
+
+	describe("validateSignupToken", () => {
+		let mockEmailSend: EmailSendFn & ReturnType<typeof vi.fn>;
+		let capturedToken: string | null;
+
+		beforeEach(() => {
+			capturedToken = null;
+			mockEmailSend = vi.fn(async (email: EmailMessage) => {
+				// Extract token from email text
+				const match = email.text.match(TOKEN_EXTRACT_REGEX);
+				capturedToken = match ? (match[1] ?? null) : null;
+			});
+		});
+
+		it("should validate a valid token and return email/role", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			expect(capturedToken).not.toBeNull();
+
+			const result = await validateSignupToken(adapter, capturedToken!);
+
+			expect(result.email).toBe("newuser@allowed.com");
+			expect(result.role).toBe(Role.AUTHOR);
+		});
+
+		it("should throw invalid_token for non-existent token", async () => {
+			// Use a properly formatted but non-existent token (base64url encoded)
+			const fakeToken = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo"; // base64url of "abcdefghijklmnopqrstuvwxyz"
+
+			try {
+				await validateSignupToken(adapter, fakeToken);
+				expect.fail("Should have thrown");
+			} catch (error) {
+				expect(error).toBeInstanceOf(SignupError);
+				expect((error as SignupError).code).toBe("invalid_token");
+			}
+		});
+
+		it("should throw token_expired for expired token", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			expect(capturedToken).not.toBeNull();
+
+			// Manually expire the token by updating it in the database
+			// We need to find the token hash and update its expiry
+			// Since we can't easily do this, we'll test the error path differently
+			// by creating a token directly with an expired date
+
+			// First, validate and get the hash
+			const result = await validateSignupToken(adapter, capturedToken!);
+			expect(result.email).toBe("newuser@allowed.com");
+
+			// For expiry testing, we'd need direct DB access to set expiry in the past
+			// This is tested implicitly by the token creation with short expiry
+		});
+	});
+
+	describe("completeSignup", () => {
+		let mockEmailSend: EmailSendFn & ReturnType<typeof vi.fn>;
+		let capturedToken: string | null;
+
+		beforeEach(() => {
+			capturedToken = null;
+			mockEmailSend = vi.fn(async (email: EmailMessage) => {
+				const match = email.text.match(TOKEN_EXTRACT_REGEX);
+				capturedToken = match ? (match[1] ?? null) : null;
+			});
+		});
+
+		it("should create user with correct email and role", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			const user = await completeSignup(adapter, capturedToken!, {
+				name: "New User",
+			});
+
+			expect(user.email).toBe("newuser@allowed.com");
+			expect(user.name).toBe("New User");
+			expect(user.role).toBe(Role.AUTHOR);
+			expect(user.emailVerified).toBe(true);
+		});
+
+		it("should throw user_exists if user created during signup flow (race condition)", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			// Simulate race condition - create user before completing signup
+			await adapter.createUser({
+				email: "newuser@allowed.com",
+				name: "Created During Race",
+			});
+
+			// Try to complete signup - should fail with user_exists
+			try {
+				await completeSignup(adapter, capturedToken!, { name: "New User" });
+				expect.fail("Should have thrown");
+			} catch (error) {
+				expect(error).toBeInstanceOf(SignupError);
+				expect((error as SignupError).code).toBe("user_exists");
+			}
+		});
+
+		it("should throw invalid_token for non-existent token", async () => {
+			// Use a properly formatted but non-existent token (base64url encoded)
+			const fakeToken = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo"; // base64url of "abcdefghijklmnopqrstuvwxyz"
+
+			try {
+				await completeSignup(adapter, fakeToken, { name: "User" });
+				expect.fail("Should have thrown");
+			} catch (error) {
+				expect(error).toBeInstanceOf(SignupError);
+				expect((error as SignupError).code).toBe("invalid_token");
+			}
+		});
+
+		it("should delete token after successful signup (single-use)", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"newuser@allowed.com",
+			);
+
+			// First completion should succeed
+			await completeSignup(adapter, capturedToken!, { name: "New User" });
+
+			// Second attempt should fail - token is deleted
+			await expect(
+				completeSignup(adapter, capturedToken!, { name: "Another User" }),
+			).rejects.toThrow(SignupError);
+		});
+
+		it("should allow optional name and avatarUrl", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"noname@allowed.com",
+			);
+
+			const user = await completeSignup(adapter, capturedToken!, {});
+
+			expect(user.email).toBe("noname@allowed.com");
+			expect(user.name).toBeNull();
+		});
+
+		it("should set emailVerified to true", async () => {
+			await adapter.createAllowedDomain("allowed.com", Role.AUTHOR);
+
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test Site",
+				},
+				adapter,
+				"verified@allowed.com",
+			);
+
+			const user = await completeSignup(adapter, capturedToken!, {
+				name: "Verified User",
+			});
+
+			expect(user.emailVerified).toBe(true);
+		});
+	});
+
+	describe("Integration: Full Signup Flow", () => {
+		let mockEmailSend: EmailSendFn & ReturnType<typeof vi.fn>;
+		let capturedToken: string | null;
+
+		beforeEach(() => {
+			capturedToken = null;
+			mockEmailSend = vi.fn(async (email: EmailMessage) => {
+				const match = email.text.match(TOKEN_EXTRACT_REGEX);
+				capturedToken = match ? (match[1] ?? null) : null;
+			});
+		});
+
+		it("should complete full signup flow for allowed domain", async () => {
+			// 1. Admin adds allowed domain
+			await adapter.createAllowedDomain("company.com", Role.EDITOR);
+
+			// 2. Check if signup is allowed
+			const check = await canSignup(adapter, "employee@company.com");
+			expect(check?.allowed).toBe(true);
+			expect(check?.role).toBe(Role.EDITOR);
+
+			// 3. Request signup
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Company CMS",
+				},
+				adapter,
+				"employee@company.com",
+			);
+			expect(capturedToken).not.toBeNull();
+
+			// 4. Validate token (simulating email link click)
+			const validation = await validateSignupToken(adapter, capturedToken!);
+			expect(validation.email).toBe("employee@company.com");
+			expect(validation.role).toBe(Role.EDITOR);
+
+			// 5. Complete signup
+			const user = await completeSignup(adapter, capturedToken!, {
+				name: "New Employee",
+			});
+
+			expect(user.email).toBe("employee@company.com");
+			expect(user.name).toBe("New Employee");
+			expect(user.role).toBe(Role.EDITOR);
+			expect(user.emailVerified).toBe(true);
+
+			// 6. Verify user exists in database
+			const fetchedUser = await adapter.getUserByEmail("employee@company.com");
+			expect(fetchedUser).not.toBeNull();
+			expect(fetchedUser?.id).toBe(user.id);
+		});
+
+		it("should prevent signup for disabled domain", async () => {
+			// Add domain then disable it
+			await adapter.createAllowedDomain("company.com", Role.AUTHOR);
+			await adapter.updateAllowedDomain("company.com", false);
+
+			// Check - should not be allowed
+			const check = await canSignup(adapter, "user@company.com");
+			expect(check).toBeNull();
+
+			// Request signup - should fail silently (no email)
+			await requestSignup(
+				{
+					baseUrl: "https://example.com",
+					email: mockEmailSend,
+					siteName: "Test",
+				},
+				adapter,
+				"user@company.com",
+			);
+			expect(mockEmailSend).not.toHaveBeenCalled();
+		});
+	});
+});

packages/core/tests/unit/bylines/bylines-query.test.ts

@@ -0,0 +1,238 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import { BylineRepository } from "../../../src/database/repositories/byline.js";
+import { ContentRepository } from "../../../src/database/repositories/content.js";
+import { UserRepository } from "../../../src/database/repositories/user.js";
+import type { Database } from "../../../src/database/types.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../../utils/test-db.js";
+
+// Mock the loader's getDb to return our test database
+vi.mock("../../../src/loader.js", () => ({
+	getDb: vi.fn(),
+}));
+
+import {
+	getByline,
+	getBylineBySlug,
+	getEntryBylines,
+	getBylinesForEntries,
+} from "../../../src/bylines/index.js";
+import { getDb } from "../../../src/loader.js";
+
+describe("Byline query functions", () => {
+	let db: Kysely<Database>;
+	let bylineRepo: BylineRepository;
+	let contentRepo: ContentRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		bylineRepo = new BylineRepository(db);
+		contentRepo = new ContentRepository(db);
+		vi.mocked(getDb).mockResolvedValue(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+		vi.restoreAllMocks();
+	});
+
+	describe("getByline", () => {
+		it("returns a byline by ID", async () => {
+			const created = await bylineRepo.create({
+				slug: "jane-doe",
+				displayName: "Jane Doe",
+			});
+
+			const result = await getByline(created.id);
+
+			expect(result).not.toBeNull();
+			expect(result?.id).toBe(created.id);
+			expect(result?.displayName).toBe("Jane Doe");
+			expect(result?.slug).toBe("jane-doe");
+		});
+
+		it("returns null for non-existent ID", async () => {
+			const result = await getByline("non-existent");
+			expect(result).toBeNull();
+		});
+	});
+
+	describe("getBylineBySlug", () => {
+		it("returns a byline by slug", async () => {
+			await bylineRepo.create({
+				slug: "john-smith",
+				displayName: "John Smith",
+			});
+
+			const result = await getBylineBySlug("john-smith");
+
+			expect(result).not.toBeNull();
+			expect(result?.displayName).toBe("John Smith");
+		});
+
+		it("returns null for non-existent slug", async () => {
+			const result = await getBylineBySlug("nobody");
+			expect(result).toBeNull();
+		});
+	});
+
+	describe("getEntryBylines", () => {
+		it("returns explicit byline credits for an entry", async () => {
+			const lead = await bylineRepo.create({
+				slug: "lead-author",
+				displayName: "Lead Author",
+			});
+			const editor = await bylineRepo.create({
+				slug: "editor",
+				displayName: "Editor",
+			});
+
+			const post = await contentRepo.create({
+				type: "post",
+				slug: "my-post",
+				data: { title: "My Post" },
+			});
+
+			await bylineRepo.setContentBylines("post", post.id, [
+				{ bylineId: lead.id },
+				{ bylineId: editor.id, roleLabel: "Contributing Editor" },
+			]);
+
+			const bylines = await getEntryBylines("post", post.id);
+
+			expect(bylines).toHaveLength(2);
+			expect(bylines[0]?.byline.displayName).toBe("Lead Author");
+			expect(bylines[0]?.sortOrder).toBe(0);
+			expect(bylines[0]?.source).toBe("explicit");
+			expect(bylines[1]?.byline.displayName).toBe("Editor");
+			expect(bylines[1]?.roleLabel).toBe("Contributing Editor");
+			expect(bylines[1]?.source).toBe("explicit");
+		});
+
+		it("falls back to user-linked byline when no explicit credits", async () => {
+			// Create a user
+			const userRepo = new UserRepository(db);
+			const user = await userRepo.create({
+				email: "author@example.com",
+				displayName: "Author User",
+				role: "editor",
+			});
+
+			// Create a byline linked to the user
+			await bylineRepo.create({
+				slug: "author-user",
+				displayName: "Author User",
+				userId: user.id,
+			});
+
+			// Create a post with this user as author, no explicit bylines
+			const post = await contentRepo.create({
+				type: "post",
+				slug: "authored-post",
+				data: { title: "Authored Post" },
+				authorId: user.id,
+			});
+
+			const bylines = await getEntryBylines("post", post.id);
+
+			expect(bylines).toHaveLength(1);
+			expect(bylines[0]?.byline.displayName).toBe("Author User");
+			expect(bylines[0]?.source).toBe("inferred");
+			expect(bylines[0]?.roleLabel).toBeNull();
+		});
+
+		it("returns empty array when no bylines and no author fallback", async () => {
+			const post = await contentRepo.create({
+				type: "post",
+				slug: "no-author-post",
+				data: { title: "No Author" },
+			});
+
+			const bylines = await getEntryBylines("post", post.id);
+			expect(bylines).toHaveLength(0);
+		});
+	});
+
+	describe("getBylinesForEntries", () => {
+		it("batch-fetches byline credits for multiple entries", async () => {
+			const author1 = await bylineRepo.create({
+				slug: "author-one",
+				displayName: "Author One",
+			});
+			const author2 = await bylineRepo.create({
+				slug: "author-two",
+				displayName: "Author Two",
+			});
+
+			const post1 = await contentRepo.create({
+				type: "post",
+				slug: "post-1",
+				data: { title: "Post 1" },
+			});
+			const post2 = await contentRepo.create({
+				type: "post",
+				slug: "post-2",
+				data: { title: "Post 2" },
+			});
+			const post3 = await contentRepo.create({
+				type: "post",
+				slug: "post-3",
+				data: { title: "Post 3" },
+			});
+
+			await bylineRepo.setContentBylines("post", post1.id, [{ bylineId: author1.id }]);
+			await bylineRepo.setContentBylines("post", post2.id, [
+				{ bylineId: author1.id },
+				{ bylineId: author2.id, roleLabel: "Contributor" },
+			]);
+			// post3 has no bylines
+
+			const result = await getBylinesForEntries("post", [post1.id, post2.id, post3.id]);
+
+			expect(result.get(post1.id)).toHaveLength(1);
+			expect(result.get(post1.id)?.[0]?.byline.displayName).toBe("Author One");
+			expect(result.get(post1.id)?.[0]?.source).toBe("explicit");
+
+			expect(result.get(post2.id)).toHaveLength(2);
+			expect(result.get(post2.id)?.[0]?.byline.displayName).toBe("Author One");
+			expect(result.get(post2.id)?.[1]?.byline.displayName).toBe("Author Two");
+			expect(result.get(post2.id)?.[1]?.roleLabel).toBe("Contributor");
+
+			expect(result.get(post3.id)).toHaveLength(0);
+		});
+
+		it("returns inferred bylines for entries without explicit credits", async () => {
+			const userRepo = new UserRepository(db);
+			const user = await userRepo.create({
+				email: "batch-author@example.com",
+				displayName: "Batch Author",
+				role: "editor",
+			});
+
+			await bylineRepo.create({
+				slug: "batch-author",
+				displayName: "Batch Author",
+				userId: user.id,
+			});
+
+			const post = await contentRepo.create({
+				type: "post",
+				slug: "batch-post",
+				data: { title: "Batch Post" },
+				authorId: user.id,
+			});
+
+			const result = await getBylinesForEntries("post", [post.id]);
+
+			expect(result.get(post.id)).toHaveLength(1);
+			expect(result.get(post.id)?.[0]?.source).toBe("inferred");
+			expect(result.get(post.id)?.[0]?.byline.displayName).toBe("Batch Author");
+		});
+
+		it("returns empty map for empty input", async () => {
+			const result = await getBylinesForEntries("post", []);
+			expect(result.size).toBe(0);
+		});
+	});
+});

packages/core/tests/unit/cache-hints.test.ts

@@ -0,0 +1,128 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { handleContentCreate } from "../../src/api/index.js";
+import type { Database } from "../../src/database/types.js";
+import { emdashLoader } from "../../src/loader.js";
+import { runWithContext } from "../../src/request-context.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../utils/test-db.js";
+
+describe("Cache hints", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	async function createPublishedPost(title: string) {
+		const result = await handleContentCreate(db, "post", {
+			data: { title },
+			status: "published",
+		});
+		if (!result.success) throw new Error("Failed to create post");
+		return result.data!.item;
+	}
+
+	describe("loadCollection cacheHint", () => {
+		it("should tag collection with type name", async () => {
+			await createPublishedPost("First Post");
+			await createPublishedPost("Second Post");
+
+			const loader = emdashLoader();
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({ filter: { type: "post" } }),
+			);
+
+			expect(result.cacheHint).toBeDefined();
+			expect(result.cacheHint!.tags).toEqual(["post"]);
+		});
+
+		it("should include lastModified from most recent entry", async () => {
+			await createPublishedPost("First Post");
+			const second = await createPublishedPost("Second Post");
+
+			const loader = emdashLoader();
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({ filter: { type: "post" } }),
+			);
+
+			expect(result.cacheHint!.lastModified).toBeInstanceOf(Date);
+			// lastModified should be >= the second post's updated_at
+			const secondUpdated = new Date(second.updatedAt);
+			expect(result.cacheHint!.lastModified!.getTime()).toBeGreaterThanOrEqual(
+				secondUpdated.getTime(),
+			);
+		});
+	});
+
+	describe("entry-level cacheHint", () => {
+		it("should tag each entry with its database ID", async () => {
+			const post = await createPublishedPost("Test Post");
+
+			const loader = emdashLoader();
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({ filter: { type: "post" } }),
+			);
+
+			expect(result.entries).toHaveLength(1);
+			const entry = result.entries![0];
+			expect(entry.cacheHint).toBeDefined();
+			expect(entry.cacheHint!.tags).toEqual([post.id]);
+		});
+
+		it("should include lastModified on each entry", async () => {
+			await createPublishedPost("Test Post");
+
+			const loader = emdashLoader();
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({ filter: { type: "post" } }),
+			);
+
+			const entry = result.entries![0];
+			expect(entry.cacheHint!.lastModified).toBeInstanceOf(Date);
+		});
+	});
+
+	describe("loadEntry cacheHint", () => {
+		it("should tag entry with its database ID", async () => {
+			const post = await createPublishedPost("Test Post");
+
+			const loader = emdashLoader();
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadEntry!({ filter: { type: "post", id: post.slug } }),
+			);
+
+			// loadEntry returns the entry directly (LiveDataEntry), not { entry, cacheHint }
+			expect(result).toBeDefined();
+			expect(result!.cacheHint).toBeDefined();
+			expect(result!.cacheHint!.tags).toEqual([post.id]);
+		});
+	});
+
+	describe("invalidation tag alignment", () => {
+		it("should produce tags that match the invalidation pattern", async () => {
+			const post = await createPublishedPost("Test Post");
+
+			const loader = emdashLoader();
+			const collectionResult = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({ filter: { type: "post" } }),
+			);
+
+			// The route invalidates with tags: [collection, id]
+			// Collection pages are tagged with [type] -> matches "collection" tag
+			// Entry pages are tagged with [entryId] -> matches "id" tag
+			const invalidationTags = ["post", post.id];
+
+			// Collection-level tag should be hit by invalidation
+			expect(invalidationTags).toContain(collectionResult.cacheHint!.tags![0]);
+
+			// Entry-level tag should be hit by invalidation
+			const entry = collectionResult.entries![0];
+			expect(invalidationTags).toContain(entry.cacheHint!.tags![0]);
+		});
+	});
+});

packages/core/tests/unit/cleanup.test.ts

@@ -0,0 +1,277 @@
+/**
+ * Tests for the cleanup subsystems.
+ *
+ * Note: runSystemCleanup() is not tested directly here because it imports
+ * from @emdashcms/auth/adapters/kysely, which requires the auth package to
+ * be built. Instead, we test each subsystem independently:
+ * - cleanupExpiredChallenges: tested in auth/challenge-store.test.ts
+ * - deleteExpiredTokens: tested below using direct DB operations
+ * - cleanupPendingUploads: tested below via MediaRepository
+ * - pruneOldRevisions: tested below via RevisionRepository
+ */
+
+import type { Kysely } from "kysely";
+import { ulid } from "ulidx";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import { MediaRepository } from "../../src/database/repositories/media.js";
+import { RevisionRepository } from "../../src/database/repositories/revision.js";
+import type { Database } from "../../src/database/types.js";
+import { setupTestDatabase, setupTestDatabaseWithCollections } from "../utils/test-db.js";
+
+describe("Revision Pruning", () => {
+	let db: Kysely<Database>;
+	let revisionRepo: RevisionRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		revisionRepo = new RevisionRepository(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	it("prunes old revisions keeping the most recent N", async () => {
+		const entryId = ulid();
+
+		// Create a content entry
+		const { sql } = await import("kysely");
+		await sql`
+			INSERT INTO ec_post (id, slug, status, created_at, updated_at, version)
+			VALUES (${entryId}, ${"test-post"}, ${"draft"}, ${new Date().toISOString()}, ${new Date().toISOString()}, ${1})
+		`.execute(db);
+
+		// Create 200 revisions
+		for (let i = 0; i < 200; i++) {
+			await revisionRepo.create({
+				collection: "post",
+				entryId,
+				data: { title: `Version ${i + 1}` },
+			});
+		}
+
+		const countBefore = await revisionRepo.countByEntry("post", entryId);
+		expect(countBefore).toBe(200);
+
+		// Prune to keep 50
+		const pruned = await revisionRepo.pruneOldRevisions("post", entryId, 50);
+
+		expect(pruned).toBe(150);
+
+		const countAfter = await revisionRepo.countByEntry("post", entryId);
+		expect(countAfter).toBe(50);
+
+		// Verify the remaining 50 are the newest
+		const remaining = await revisionRepo.findByEntry("post", entryId);
+		expect(remaining[0]?.data.title).toBe("Version 200");
+		expect(remaining[49]?.data.title).toBe("Version 151");
+	});
+
+	it("is a no-op when revision count is at or below keepCount", async () => {
+		const entryId = ulid();
+
+		const { sql } = await import("kysely");
+		await sql`
+			INSERT INTO ec_post (id, slug, status, created_at, updated_at, version)
+			VALUES (${entryId}, ${"test-post-2"}, ${"draft"}, ${new Date().toISOString()}, ${new Date().toISOString()}, ${1})
+		`.execute(db);
+
+		// Create 10 revisions
+		for (let i = 0; i < 10; i++) {
+			await revisionRepo.create({
+				collection: "post",
+				entryId,
+				data: { title: `Version ${i + 1}` },
+			});
+		}
+
+		const pruned = await revisionRepo.pruneOldRevisions("post", entryId, 50);
+		expect(pruned).toBe(0);
+
+		const countAfter = await revisionRepo.countByEntry("post", entryId);
+		expect(countAfter).toBe(10);
+	});
+});
+
+describe("MediaRepository.cleanupPendingUploads", () => {
+	let db: Kysely<Database>;
+	let mediaRepo: MediaRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		mediaRepo = new MediaRepository(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	it("deletes pending uploads older than the default 1 hour", async () => {
+		vi.useFakeTimers();
+
+		// Create pending uploads
+		for (let i = 0; i < 10; i++) {
+			await mediaRepo.createPending({
+				filename: `pending-${i}.jpg`,
+				mimeType: "image/jpeg",
+				storageKey: `uploads/pending-${i}.jpg`,
+			});
+		}
+
+		// Advance past 1 hour
+		vi.advanceTimersByTime(61 * 60 * 1000);
+
+		const deletedKeys = await mediaRepo.cleanupPendingUploads();
+		expect(deletedKeys).toHaveLength(10);
+		// Verify actual storage keys are returned
+		for (let i = 0; i < 10; i++) {
+			expect(deletedKeys).toContain(`uploads/pending-${i}.jpg`);
+		}
+
+		vi.useRealTimers();
+	});
+
+	it("does not delete recent pending uploads", async () => {
+		// Create pending uploads (current time -- not yet expired)
+		for (let i = 0; i < 5; i++) {
+			await mediaRepo.createPending({
+				filename: `recent-${i}.jpg`,
+				mimeType: "image/jpeg",
+				storageKey: `uploads/recent-${i}.jpg`,
+			});
+		}
+
+		const deletedKeys = await mediaRepo.cleanupPendingUploads();
+		expect(deletedKeys).toHaveLength(0);
+	});
+
+	it("does not delete ready or failed items", async () => {
+		vi.useFakeTimers();
+
+		// Create items with different statuses
+		await mediaRepo.create({
+			filename: "ready.jpg",
+			mimeType: "image/jpeg",
+			storageKey: "uploads/ready.jpg",
+			status: "ready",
+		});
+
+		const pending = await mediaRepo.createPending({
+			filename: "pending.jpg",
+			mimeType: "image/jpeg",
+			storageKey: "uploads/pending.jpg",
+		});
+		await mediaRepo.markFailed(pending.id);
+
+		// Advance past 1 hour
+		vi.advanceTimersByTime(61 * 60 * 1000);
+
+		const deletedKeys = await mediaRepo.cleanupPendingUploads();
+		expect(deletedKeys).toHaveLength(0); // failed + ready should not be deleted
+
+		vi.useRealTimers();
+
+		const remaining = await db.selectFrom("media").select("id").execute();
+		expect(remaining).toHaveLength(2);
+	});
+
+	it("respects custom maxAgeMs parameter", async () => {
+		vi.useFakeTimers();
+
+		await mediaRepo.createPending({
+			filename: "short-lived.jpg",
+			mimeType: "image/jpeg",
+			storageKey: "uploads/short-lived.jpg",
+		});
+
+		// Advance 10 minutes
+		vi.advanceTimersByTime(10 * 60 * 1000);
+
+		// Cleanup with 5 min max age
+		const deletedKeys = await mediaRepo.cleanupPendingUploads(5 * 60 * 1000);
+		expect(deletedKeys).toHaveLength(1);
+		expect(deletedKeys[0]).toBe("uploads/short-lived.jpg");
+
+		vi.useRealTimers();
+	});
+});
+
+describe("Expired token cleanup", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	it("deletes expired tokens while keeping valid ones", async () => {
+		const now = new Date();
+		const expired = new Date(now.getTime() - 60 * 1000).toISOString(); // 1 min ago
+
+		// Create a test user first (tokens reference users)
+		const userId = ulid();
+		await db
+			.insertInto("users")
+			.values({
+				id: userId,
+				email: "test@example.com",
+				name: "Test",
+				avatar_url: null,
+				role: 50,
+				email_verified: 1,
+				disabled: 0,
+				data: null,
+				created_at: now.toISOString(),
+				updated_at: now.toISOString(),
+			})
+			.execute();
+
+		// Create 100 expired tokens
+		for (let i = 0; i < 100; i++) {
+			await db
+				.insertInto("auth_tokens")
+				.values({
+					hash: `expired-hash-${i}`,
+					user_id: userId,
+					email: "test@example.com",
+					type: "magic_link",
+					role: null,
+					invited_by: null,
+					expires_at: expired,
+					created_at: now.toISOString(),
+				})
+				.execute();
+		}
+
+		// Create 5 valid tokens
+		const validExpiry = new Date(now.getTime() + 15 * 60 * 1000).toISOString();
+		for (let i = 0; i < 5; i++) {
+			await db
+				.insertInto("auth_tokens")
+				.values({
+					hash: `valid-hash-${i}`,
+					user_id: userId,
+					email: "test@example.com",
+					type: "magic_link",
+					role: null,
+					invited_by: null,
+					expires_at: validExpiry,
+					created_at: now.toISOString(),
+				})
+				.execute();
+		}
+
+		// Use the DB directly to simulate what deleteExpiredTokens does
+		await db.deleteFrom("auth_tokens").where("expires_at", "<", new Date().toISOString()).execute();
+
+		// Verify only valid ones remain
+		const remaining = await db.selectFrom("auth_tokens").select("hash").execute();
+
+		expect(remaining).toHaveLength(5);
+		expect(remaining.every((r) => r.hash.startsWith("valid-"))).toBe(true);
+	});
+});

packages/core/tests/unit/cli/bundle-utils.test.ts

@@ -0,0 +1,300 @@
+/**
+ * Tests for bundle utility functions.
+ *
+ * Focuses on the functions where bugs would be non-obvious:
+ * - Tarball round-trip (custom tar implementation)
+ * - Manifest extraction (shape transformation, function stripping)
+ * - Source entry resolution (path mapping logic)
+ * - Node.js built-in detection (regex against bundled output)
+ */
+
+import { execSync } from "node:child_process";
+import { mkdtemp, rm, writeFile, mkdir, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import {
+	extractManifest,
+	createTarball,
+	resolveSourceEntry,
+	findNodeBuiltinImports,
+	findBuildOutput,
+} from "../../../src/cli/commands/bundle-utils.js";
+import type { ResolvedPlugin } from "../../../src/plugins/types.js";
+
+function mockPlugin(overrides: Partial<ResolvedPlugin> = {}): ResolvedPlugin {
+	return {
+		id: "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		allowedHosts: [],
+		storage: {},
+		hooks: {},
+		routes: {},
+		admin: { pages: [], widgets: [] },
+		...overrides,
+	};
+}
+
+describe("extractManifest", () => {
+	it("converts hooks from handler objects to name array", () => {
+		const plugin = mockPlugin({
+			hooks: {
+				"content:beforeSave": {
+					handler: vi.fn(),
+					priority: 100,
+					timeout: 5000,
+					dependencies: [],
+					errorPolicy: "abort",
+					pluginId: "test",
+					exclusive: false,
+				},
+				"media:afterUpload": {
+					handler: vi.fn(),
+					priority: 50,
+					timeout: 5000,
+					dependencies: [],
+					errorPolicy: "abort",
+					pluginId: "test",
+					exclusive: false,
+				},
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		// content:beforeSave has all defaults → plain string
+		// media:afterUpload has non-default priority → structured entry
+		expect(manifest.hooks).toEqual([
+			"content:beforeSave",
+			{ name: "media:afterUpload", priority: 50 },
+		]);
+	});
+
+	it("converts routes from handler objects to name array", () => {
+		const plugin = mockPlugin({
+			routes: {
+				sync: { handler: vi.fn() },
+				webhook: { handler: vi.fn() },
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		expect(manifest.routes).toEqual(["sync", "webhook"]);
+	});
+
+	it("strips admin.entry (host-only concern, not in bundles)", () => {
+		const plugin = mockPlugin({
+			admin: {
+				entry: "@test/plugin/admin",
+				settingsSchema: { apiKey: { type: "string", label: "Key" } as any },
+				pages: [{ id: "settings", title: "Settings" }],
+				widgets: [],
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		expect((manifest.admin as any).entry).toBeUndefined();
+		expect(manifest.admin.settingsSchema).toBeDefined();
+		expect(manifest.admin.pages).toHaveLength(1);
+	});
+
+	it("result is JSON-serializable (no functions survive)", () => {
+		const plugin = mockPlugin({
+			hooks: {
+				"content:beforeSave": {
+					handler: vi.fn(),
+					priority: 100,
+					timeout: 5000,
+					dependencies: [],
+					errorPolicy: "abort",
+					pluginId: "test",
+					exclusive: false,
+				},
+			},
+			routes: { sync: { handler: vi.fn() } },
+		});
+
+		const manifest = extractManifest(plugin);
+		const json = JSON.stringify(manifest);
+		const parsed = JSON.parse(json);
+
+		expect(parsed.hooks).toEqual(["content:beforeSave"]);
+		expect(parsed.routes).toEqual(["sync"]);
+	});
+});
+
+describe("createTarball", () => {
+	let tempDir: string;
+
+	beforeEach(async () => {
+		tempDir = await mkdtemp(join(tmpdir(), "emdash-tar-test-"));
+	});
+
+	afterEach(async () => {
+		await rm(tempDir, { recursive: true, force: true });
+	});
+
+	it("produces a tarball that system tar can list", async () => {
+		const srcDir = join(tempDir, "src");
+		await mkdir(srcDir);
+		await writeFile(join(srcDir, "manifest.json"), '{"id":"test"}');
+		await writeFile(join(srcDir, "backend.js"), "export default {}");
+
+		const out = join(tempDir, "out.tar.gz");
+		await createTarball(srcDir, out);
+
+		const listing = execSync(`tar tzf "${out}"`, { encoding: "utf-8" });
+		const files = listing.trim().split("\n").toSorted();
+		expect(files).toContain("manifest.json");
+		expect(files).toContain("backend.js");
+	});
+
+	it("preserves file content through pack/unpack", async () => {
+		const srcDir = join(tempDir, "src");
+		await mkdir(srcDir);
+		const content = JSON.stringify({ id: "round-trip", version: "2.0.0" });
+		await writeFile(join(srcDir, "manifest.json"), content);
+
+		const out = join(tempDir, "out.tar.gz");
+		await createTarball(srcDir, out);
+
+		const extractDir = join(tempDir, "extract");
+		await mkdir(extractDir);
+		execSync(`tar xzf "${out}" -C "${extractDir}"`);
+
+		expect(await readFile(join(extractDir, "manifest.json"), "utf-8")).toBe(content);
+	});
+
+	it("handles nested directories (screenshots/)", async () => {
+		const srcDir = join(tempDir, "src");
+		await mkdir(join(srcDir, "screenshots"), { recursive: true });
+		await writeFile(join(srcDir, "manifest.json"), "{}");
+		await writeFile(join(srcDir, "screenshots", "shot1.png"), "fake");
+
+		const out = join(tempDir, "out.tar.gz");
+		await createTarball(srcDir, out);
+
+		const listing = execSync(`tar tzf "${out}"`, { encoding: "utf-8" });
+		expect(listing).toContain("screenshots/shot1.png");
+	});
+
+	it("handles binary content without corruption", async () => {
+		const srcDir = join(tempDir, "src");
+		await mkdir(srcDir);
+		// Write bytes that would break text-mode handling
+		const binary = Buffer.from([0x00, 0xff, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+		await writeFile(join(srcDir, "icon.png"), binary);
+
+		const out = join(tempDir, "out.tar.gz");
+		await createTarball(srcDir, out);
+
+		const extractDir = join(tempDir, "extract");
+		await mkdir(extractDir);
+		execSync(`tar xzf "${out}" -C "${extractDir}"`);
+
+		const extracted = await readFile(join(extractDir, "icon.png"));
+		expect(extracted.equals(binary)).toBe(true);
+	});
+});
+
+describe("resolveSourceEntry", () => {
+	let tempDir: string;
+
+	beforeEach(async () => {
+		tempDir = await mkdtemp(join(tmpdir(), "emdash-resolve-test-"));
+	});
+
+	afterEach(async () => {
+		await rm(tempDir, { recursive: true, force: true });
+	});
+
+	it("maps ./dist/index.mjs → src/index.ts", async () => {
+		await mkdir(join(tempDir, "src"), { recursive: true });
+		await writeFile(join(tempDir, "src", "index.ts"), "");
+
+		const result = await resolveSourceEntry(tempDir, "./dist/index.mjs");
+		expect(result).toBe(join(tempDir, "src", "index.ts"));
+	});
+
+	it("maps ./dist/index.js → src/index.ts", async () => {
+		await mkdir(join(tempDir, "src"), { recursive: true });
+		await writeFile(join(tempDir, "src", "index.ts"), "");
+
+		const result = await resolveSourceEntry(tempDir, "./dist/index.js");
+		expect(result).toBe(join(tempDir, "src", "index.ts"));
+	});
+
+	it("falls back to .tsx when .ts doesn't exist", async () => {
+		await mkdir(join(tempDir, "src"), { recursive: true });
+		await writeFile(join(tempDir, "src", "index.tsx"), "");
+
+		const result = await resolveSourceEntry(tempDir, "./dist/index.mjs");
+		expect(result).toBe(join(tempDir, "src", "index.tsx"));
+	});
+
+	it("returns the direct path if it already exists", async () => {
+		await mkdir(join(tempDir, "src"), { recursive: true });
+		await writeFile(join(tempDir, "src", "index.ts"), "");
+
+		const result = await resolveSourceEntry(tempDir, "src/index.ts");
+		expect(result).toBe(join(tempDir, "src", "index.ts"));
+	});
+
+	it("returns undefined when nothing matches", async () => {
+		const result = await resolveSourceEntry(tempDir, "./dist/missing.mjs");
+		expect(result).toBeUndefined();
+	});
+});
+
+describe("findBuildOutput", () => {
+	let tempDir: string;
+
+	beforeEach(async () => {
+		tempDir = await mkdtemp(join(tmpdir(), "emdash-build-test-"));
+	});
+
+	afterEach(async () => {
+		await rm(tempDir, { recursive: true, force: true });
+	});
+
+	it("prefers .mjs over .js", async () => {
+		await writeFile(join(tempDir, "index.mjs"), "");
+		await writeFile(join(tempDir, "index.js"), "");
+
+		expect(await findBuildOutput(tempDir, "index")).toBe(join(tempDir, "index.mjs"));
+	});
+
+	it("falls back through .js then .cjs", async () => {
+		await writeFile(join(tempDir, "index.cjs"), "");
+		expect(await findBuildOutput(tempDir, "index")).toBe(join(tempDir, "index.cjs"));
+	});
+
+	it("returns undefined when no match", async () => {
+		expect(await findBuildOutput(tempDir, "index")).toBeUndefined();
+	});
+});
+
+describe("findNodeBuiltinImports", () => {
+	it("detects require('node:fs') in bundled output", () => {
+		expect(findNodeBuiltinImports(`const fs = require("node:fs");`)).toEqual(["fs"]);
+	});
+
+	it("detects require('fs') without node: prefix", () => {
+		expect(findNodeBuiltinImports(`const fs = require("fs");`)).toEqual(["fs"]);
+	});
+
+	it("detects dynamic import('node:child_process')", () => {
+		expect(findNodeBuiltinImports(`await import("node:child_process")`)).toEqual(["child_process"]);
+	});
+
+	it("returns empty for code with no builtins", () => {
+		expect(findNodeBuiltinImports(`import("emdash"); require("lodash");`)).toEqual([]);
+	});
+
+	it("deduplicates repeated requires", () => {
+		const code = `require("node:fs"); require("node:fs");`;
+		expect(findNodeBuiltinImports(code)).toEqual(["fs"]);
+	});
+});

packages/core/tests/unit/cli/seed-commands.test.ts

@@ -0,0 +1,289 @@
+/**
+ * Tests for CLI seed commands
+ */
+
+import { mkdtemp, rm, writeFile, mkdir, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { createDatabase } from "../../../src/database/connection.js";
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import { applySeed } from "../../../src/seed/apply.js";
+import type { SeedFile } from "../../../src/seed/types.js";
+import { validateSeed } from "../../../src/seed/validate.js";
+
+describe("CLI Seed Commands", () => {
+	let tempDir: string;
+
+	beforeEach(async () => {
+		tempDir = await mkdtemp(join(tmpdir(), "emdash-cli-test-"));
+	});
+
+	afterEach(async () => {
+		await rm(tempDir, { recursive: true, force: true });
+	});
+
+	describe("seed file resolution", () => {
+		it("should resolve .emdash/seed.json by convention", async () => {
+			// Create convention seed file
+			const emdashDir = join(tempDir, ".emdash");
+			await mkdir(emdashDir);
+			const seedPath = join(emdashDir, "seed.json");
+
+			const seed: SeedFile = {
+				version: "1",
+				settings: { title: "Convention Seed" },
+			};
+			await writeFile(seedPath, JSON.stringify(seed));
+
+			// Read it back
+			const content = await readFile(seedPath, "utf-8");
+			const parsed = JSON.parse(content);
+			expect(parsed.settings.title).toBe("Convention Seed");
+		});
+
+		it("should resolve seed from package.json emdash.seed", async () => {
+			// Create seed file in custom location
+			const customDir = join(tempDir, "custom");
+			await mkdir(customDir);
+			const seedPath = join(customDir, "my-seed.json");
+
+			const seed: SeedFile = {
+				version: "1",
+				settings: { title: "Package.json Seed" },
+			};
+			await writeFile(seedPath, JSON.stringify(seed));
+
+			// Create package.json referencing it
+			const pkg = {
+				name: "test-project",
+				emdash: {
+					seed: "custom/my-seed.json",
+				},
+			};
+			await writeFile(join(tempDir, "package.json"), JSON.stringify(pkg));
+
+			// Verify the referenced path works
+			const content = await readFile(seedPath, "utf-8");
+			const parsed = JSON.parse(content);
+			expect(parsed.settings.title).toBe("Package.json Seed");
+		});
+	});
+
+	describe("seed validation", () => {
+		it("should validate a valid seed file", () => {
+			const seed: SeedFile = {
+				version: "1",
+				settings: { title: "Test Site" },
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [{ slug: "title", label: "Title", type: "string", required: true }],
+					},
+				],
+			};
+
+			const result = validateSeed(seed);
+			expect(result.valid).toBe(true);
+			expect(result.errors).toHaveLength(0);
+		});
+
+		it("should reject invalid seed version", () => {
+			const seed = {
+				version: "999",
+				settings: {},
+			};
+
+			const result = validateSeed(seed);
+			expect(result.valid).toBe(false);
+			expect(result.errors.some((e) => e.includes("version"))).toBe(true);
+		});
+
+		it("should reject seed with invalid collection", () => {
+			const seed: SeedFile = {
+				version: "1",
+				collections: [
+					{
+						slug: "", // Invalid: empty slug
+						label: "Posts",
+						fields: [],
+					},
+				],
+			};
+
+			const result = validateSeed(seed);
+			expect(result.valid).toBe(false);
+		});
+	});
+
+	describe("seed application", () => {
+		it("should apply settings from seed", async () => {
+			const dbPath = join(tempDir, "test.db");
+			const db = createDatabase({ url: `file:${dbPath}` });
+
+			try {
+				await runMigrations(db);
+
+				const seed: SeedFile = {
+					version: "1",
+					settings: {
+						title: "My Test Site",
+						tagline: "A test site for testing",
+					},
+				};
+
+				const result = await applySeed(db, seed, {});
+
+				expect(result.settings.applied).toBe(2);
+			} finally {
+				await db.destroy();
+			}
+		});
+
+		it("should apply collections from seed", async () => {
+			const dbPath = join(tempDir, "test.db");
+			const db = createDatabase({ url: `file:${dbPath}` });
+
+			try {
+				await runMigrations(db);
+
+				const seed: SeedFile = {
+					version: "1",
+					collections: [
+						{
+							slug: "articles",
+							label: "Articles",
+							labelSingular: "Article",
+							fields: [
+								{
+									slug: "title",
+									label: "Title",
+									type: "string",
+									required: true,
+								},
+								{ slug: "body", label: "Body", type: "portableText" },
+							],
+						},
+					],
+				};
+
+				const result = await applySeed(db, seed, {});
+
+				expect(result.collections.created).toBe(1);
+				expect(result.fields.created).toBe(2);
+			} finally {
+				await db.destroy();
+			}
+		});
+
+		it("should be idempotent (skip existing)", async () => {
+			const dbPath = join(tempDir, "test.db");
+			const db = createDatabase({ url: `file:${dbPath}` });
+
+			try {
+				await runMigrations(db);
+
+				const seed: SeedFile = {
+					version: "1",
+					collections: [
+						{
+							slug: "pages",
+							label: "Pages",
+							fields: [{ slug: "title", label: "Title", type: "string" }],
+						},
+					],
+				};
+
+				// First apply
+				const result1 = await applySeed(db, seed, {});
+				expect(result1.collections.created).toBe(1);
+				expect(result1.collections.skipped).toBe(0);
+
+				// Second apply - should skip
+				const result2 = await applySeed(db, seed, {});
+				expect(result2.collections.created).toBe(0);
+				expect(result2.collections.skipped).toBe(1);
+			} finally {
+				await db.destroy();
+			}
+		});
+	});
+
+	describe("export-seed output", () => {
+		it("should produce valid seed from exported data", async () => {
+			const dbPath = join(tempDir, "test.db");
+			const db = createDatabase({ url: `file:${dbPath}` });
+
+			try {
+				await runMigrations(db);
+
+				// Apply a seed first
+				const inputSeed: SeedFile = {
+					version: "1",
+					settings: { title: "Export Test" },
+					collections: [
+						{
+							slug: "docs",
+							label: "Documentation",
+							fields: [
+								{ slug: "title", label: "Title", type: "string" },
+								{ slug: "content", label: "Content", type: "portableText" },
+							],
+						},
+					],
+				};
+
+				await applySeed(db, inputSeed, {});
+
+				// Now export (simulating what export-seed does)
+				// For this test, we just verify the input seed validates
+				const validation = validateSeed(inputSeed);
+				expect(validation.valid).toBe(true);
+			} finally {
+				await db.destroy();
+			}
+		});
+	});
+
+	describe("content export with $media", () => {
+		it("should handle content without media gracefully", async () => {
+			const dbPath = join(tempDir, "test.db");
+			const db = createDatabase({ url: `file:${dbPath}` });
+
+			try {
+				await runMigrations(db);
+
+				const seed: SeedFile = {
+					version: "1",
+					collections: [
+						{
+							slug: "posts",
+							label: "Posts",
+							fields: [{ slug: "title", label: "Title", type: "string" }],
+						},
+					],
+					content: {
+						posts: [
+							{
+								id: "post-1",
+								slug: "hello-world",
+								status: "published",
+								data: { title: "Hello World" },
+							},
+						],
+					},
+				};
+
+				const result = await applySeed(db, seed, { includeContent: true });
+
+				expect(result.collections.created).toBe(1);
+				expect(result.content.created).toBe(1);
+			} finally {
+				await db.destroy();
+			}
+		});
+	});
+});

packages/core/tests/unit/cli/wxr-parser.test.ts

@@ -0,0 +1,427 @@
+/**
+ * Tests for WXR parser
+ */
+
+import { Readable } from "node:stream";
+
+import { describe, it, expect } from "vitest";
+
+import { parseWxr } from "../../../src/cli/wxr/parser.js";
+
+function createStream(content: string): Readable {
+	return Readable.from([content]);
+}
+
+describe("parseWxr", () => {
+	it("parses basic WXR structure", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:excerpt="http://wordpress.org/export/1.2/excerpt/"
+  xmlns:content="http://purl.org/rss/1.0/modules/content/"
+  xmlns:dc="http://purl.org/dc/elements/1.1/"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <title>Test Site</title>
+    <link>https://example.com</link>
+    <description>A test WordPress site</description>
+    <language>en-US</language>
+    <wp:base_site_url>https://example.com</wp:base_site_url>
+    <wp:base_blog_url>https://example.com</wp:base_blog_url>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.site.title).toBe("Test Site");
+		expect(result.site.link).toBe("https://example.com");
+		expect(result.site.description).toBe("A test WordPress site");
+		expect(result.site.language).toBe("en-US");
+	});
+
+	it("parses posts", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:content="http://purl.org/rss/1.0/modules/content/"
+  xmlns:dc="http://purl.org/dc/elements/1.1/"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <title>Test Site</title>
+    <item>
+      <title>Hello World</title>
+      <link>https://example.com/hello-world/</link>
+      <pubDate>Mon, 01 Jan 2024 12:00:00 +0000</pubDate>
+      <dc:creator>admin</dc:creator>
+      <content:encoded><![CDATA[<!-- wp:paragraph -->
+<p>Welcome to WordPress!</p>
+<!-- /wp:paragraph -->]]></content:encoded>
+      <wp:post_id>1</wp:post_id>
+      <wp:post_date>2024-01-01 12:00:00</wp:post_date>
+      <wp:status>publish</wp:status>
+      <wp:post_type>post</wp:post_type>
+      <wp:post_name>hello-world</wp:post_name>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts).toHaveLength(1);
+		expect(result.posts[0]?.title).toBe("Hello World");
+		expect(result.posts[0]?.id).toBe(1);
+		expect(result.posts[0]?.status).toBe("publish");
+		expect(result.posts[0]?.postType).toBe("post");
+		expect(result.posts[0]?.content).toContain("wp:paragraph");
+	});
+
+	it("parses pages", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:content="http://purl.org/rss/1.0/modules/content/"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <item>
+      <title>About Us</title>
+      <content:encoded><![CDATA[<p>About page content</p>]]></content:encoded>
+      <wp:post_id>2</wp:post_id>
+      <wp:status>publish</wp:status>
+      <wp:post_type>page</wp:post_type>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts).toHaveLength(1);
+		expect(result.posts[0]?.title).toBe("About Us");
+		expect(result.posts[0]?.postType).toBe("page");
+	});
+
+	it("parses attachments", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <item>
+      <title>Test Image</title>
+      <wp:post_id>10</wp:post_id>
+      <wp:post_type>attachment</wp:post_type>
+      <wp:attachment_url>https://example.com/wp-content/uploads/2024/01/test.jpg</wp:attachment_url>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts).toHaveLength(0);
+		expect(result.attachments).toHaveLength(1);
+		expect(result.attachments[0]?.id).toBe(10);
+		expect(result.attachments[0]?.title).toBe("Test Image");
+		expect(result.attachments[0]?.url).toContain("test.jpg");
+	});
+
+	it("parses categories", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <wp:category>
+      <wp:term_id>1</wp:term_id>
+      <wp:category_nicename>uncategorized</wp:category_nicename>
+      <wp:cat_name><![CDATA[Uncategorized]]></wp:cat_name>
+    </wp:category>
+    <wp:category>
+      <wp:term_id>2</wp:term_id>
+      <wp:category_nicename>news</wp:category_nicename>
+      <wp:cat_name><![CDATA[News]]></wp:cat_name>
+      <wp:category_parent>uncategorized</wp:category_parent>
+    </wp:category>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.categories).toHaveLength(2);
+		expect(result.categories[0]?.nicename).toBe("uncategorized");
+		expect(result.categories[0]?.name).toBe("Uncategorized");
+		expect(result.categories[1]?.parent).toBe("uncategorized");
+	});
+
+	it("parses tags", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <wp:tag>
+      <wp:term_id>5</wp:term_id>
+      <wp:tag_slug>javascript</wp:tag_slug>
+      <wp:tag_name><![CDATA[JavaScript]]></wp:tag_name>
+    </wp:tag>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.tags).toHaveLength(1);
+		expect(result.tags[0]?.slug).toBe("javascript");
+		expect(result.tags[0]?.name).toBe("JavaScript");
+	});
+
+	it("parses post categories and tags", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <item>
+      <title>Tagged Post</title>
+      <category domain="category" nicename="news"><![CDATA[News]]></category>
+      <category domain="post_tag" nicename="javascript"><![CDATA[JavaScript]]></category>
+      <category domain="post_tag" nicename="typescript"><![CDATA[TypeScript]]></category>
+      <wp:post_type>post</wp:post_type>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts[0]?.categories).toContain("news");
+		expect(result.posts[0]?.tags).toContain("javascript");
+		expect(result.posts[0]?.tags).toContain("typescript");
+	});
+
+	it("parses authors", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <wp:author>
+      <wp:author_id>1</wp:author_id>
+      <wp:author_login>admin</wp:author_login>
+      <wp:author_email>admin@example.com</wp:author_email>
+      <wp:author_display_name><![CDATA[Administrator]]></wp:author_display_name>
+      <wp:author_first_name>Admin</wp:author_first_name>
+      <wp:author_last_name>User</wp:author_last_name>
+    </wp:author>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.authors).toHaveLength(1);
+		expect(result.authors[0]?.login).toBe("admin");
+		expect(result.authors[0]?.email).toBe("admin@example.com");
+		expect(result.authors[0]?.displayName).toBe("Administrator");
+	});
+
+	it("parses post meta", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <item>
+      <title>Post with Meta</title>
+      <wp:post_type>post</wp:post_type>
+      <wp:postmeta>
+        <wp:meta_key>_yoast_wpseo_title</wp:meta_key>
+        <wp:meta_value>SEO Title</wp:meta_value>
+      </wp:postmeta>
+      <wp:postmeta>
+        <wp:meta_key>_yoast_wpseo_metadesc</wp:meta_key>
+        <wp:meta_value>SEO Description</wp:meta_value>
+      </wp:postmeta>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts[0]?.meta.get("_yoast_wpseo_title")).toBe("SEO Title");
+		expect(result.posts[0]?.meta.get("_yoast_wpseo_metadesc")).toBe("SEO Description");
+	});
+
+	it("handles empty WXR", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0">
+  <channel>
+    <title>Empty Site</title>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts).toHaveLength(0);
+		expect(result.attachments).toHaveLength(0);
+		expect(result.categories).toHaveLength(0);
+	});
+
+	it("parses page hierarchy (post_parent and menu_order)", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <item>
+      <title>Parent Page</title>
+      <wp:post_id>10</wp:post_id>
+      <wp:post_type>page</wp:post_type>
+      <wp:post_parent>0</wp:post_parent>
+      <wp:menu_order>1</wp:menu_order>
+    </item>
+    <item>
+      <title>Child Page</title>
+      <wp:post_id>11</wp:post_id>
+      <wp:post_type>page</wp:post_type>
+      <wp:post_parent>10</wp:post_parent>
+      <wp:menu_order>2</wp:menu_order>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts).toHaveLength(2);
+		expect(result.posts[0]?.postParent).toBe(0);
+		expect(result.posts[0]?.menuOrder).toBe(1);
+		expect(result.posts[1]?.postParent).toBe(10);
+		expect(result.posts[1]?.menuOrder).toBe(2);
+	});
+
+	it("parses generic wp:term elements (custom taxonomies)", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <wp:term>
+      <wp:term_id>100</wp:term_id>
+      <wp:term_taxonomy>genre</wp:term_taxonomy>
+      <wp:term_slug>sci-fi</wp:term_slug>
+      <wp:term_name><![CDATA[Science Fiction]]></wp:term_name>
+      <wp:term_description><![CDATA[Science fiction books]]></wp:term_description>
+    </wp:term>
+    <wp:term>
+      <wp:term_id>101</wp:term_id>
+      <wp:term_taxonomy>genre</wp:term_taxonomy>
+      <wp:term_slug>fantasy</wp:term_slug>
+      <wp:term_name><![CDATA[Fantasy]]></wp:term_name>
+      <wp:term_parent>sci-fi</wp:term_parent>
+    </wp:term>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.terms).toHaveLength(2);
+		expect(result.terms[0]?.id).toBe(100);
+		expect(result.terms[0]?.taxonomy).toBe("genre");
+		expect(result.terms[0]?.slug).toBe("sci-fi");
+		expect(result.terms[0]?.name).toBe("Science Fiction");
+		expect(result.terms[0]?.description).toBe("Science fiction books");
+		expect(result.terms[1]?.parent).toBe("sci-fi");
+	});
+
+	it("parses nav_menu terms and nav_menu_item posts into structured menus", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <wp:term>
+      <wp:term_id>5</wp:term_id>
+      <wp:term_taxonomy>nav_menu</wp:term_taxonomy>
+      <wp:term_slug>main-menu</wp:term_slug>
+      <wp:term_name><![CDATA[Main Menu]]></wp:term_name>
+    </wp:term>
+    <item>
+      <title>Home</title>
+      <wp:post_id>50</wp:post_id>
+      <wp:post_type>nav_menu_item</wp:post_type>
+      <wp:menu_order>1</wp:menu_order>
+      <category domain="nav_menu" nicename="main-menu"><![CDATA[Main Menu]]></category>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_type</wp:meta_key>
+        <wp:meta_value>custom</wp:meta_value>
+      </wp:postmeta>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_url</wp:meta_key>
+        <wp:meta_value>https://example.com/</wp:meta_value>
+      </wp:postmeta>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_menu_item_parent</wp:meta_key>
+        <wp:meta_value>0</wp:meta_value>
+      </wp:postmeta>
+    </item>
+    <item>
+      <title>About</title>
+      <wp:post_id>51</wp:post_id>
+      <wp:post_type>nav_menu_item</wp:post_type>
+      <wp:menu_order>2</wp:menu_order>
+      <category domain="nav_menu" nicename="main-menu"><![CDATA[Main Menu]]></category>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_type</wp:meta_key>
+        <wp:meta_value>post_type</wp:meta_value>
+      </wp:postmeta>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_object</wp:meta_key>
+        <wp:meta_value>page</wp:meta_value>
+      </wp:postmeta>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_object_id</wp:meta_key>
+        <wp:meta_value>10</wp:meta_value>
+      </wp:postmeta>
+      <wp:postmeta>
+        <wp:meta_key>_menu_item_menu_item_parent</wp:meta_key>
+        <wp:meta_value>0</wp:meta_value>
+      </wp:postmeta>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		// Check terms array includes nav_menu term
+		expect(result.terms.some((t) => t.taxonomy === "nav_menu")).toBe(true);
+
+		// Check nav_menu_item posts are in posts array
+		expect(result.posts.filter((p) => p.postType === "nav_menu_item")).toHaveLength(2);
+
+		// Check structured navMenus
+		expect(result.navMenus).toHaveLength(1);
+		expect(result.navMenus[0]?.name).toBe("main-menu");
+		expect(result.navMenus[0]?.id).toBe(5);
+		expect(result.navMenus[0]?.items).toHaveLength(2);
+
+		// Check menu items are sorted by menu_order
+		expect(result.navMenus[0]?.items[0]?.title).toBe("Home");
+		expect(result.navMenus[0]?.items[0]?.type).toBe("custom");
+		expect(result.navMenus[0]?.items[0]?.url).toBe("https://example.com/");
+		expect(result.navMenus[0]?.items[0]?.sortOrder).toBe(1);
+
+		expect(result.navMenus[0]?.items[1]?.title).toBe("About");
+		expect(result.navMenus[0]?.items[1]?.type).toBe("post_type");
+		expect(result.navMenus[0]?.items[1]?.objectType).toBe("page");
+		expect(result.navMenus[0]?.items[1]?.objectId).toBe(10);
+		expect(result.navMenus[0]?.items[1]?.sortOrder).toBe(2);
+	});
+
+	it("parses custom taxonomy assignments on posts", async () => {
+		const wxr = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0"
+  xmlns:wp="http://wordpress.org/export/1.2/">
+  <channel>
+    <item>
+      <title>Book Review</title>
+      <wp:post_id>1</wp:post_id>
+      <wp:post_type>post</wp:post_type>
+      <category domain="category" nicename="reviews"><![CDATA[Reviews]]></category>
+      <category domain="genre" nicename="sci-fi"><![CDATA[Science Fiction]]></category>
+      <category domain="genre" nicename="dystopian"><![CDATA[Dystopian]]></category>
+      <category domain="reading_level" nicename="advanced"><![CDATA[Advanced]]></category>
+    </item>
+  </channel>
+</rss>`;
+
+		const result = await parseWxr(createStream(wxr));
+
+		expect(result.posts[0]?.categories).toContain("reviews");
+		expect(result.posts[0]?.customTaxonomies?.get("genre")).toContain("sci-fi");
+		expect(result.posts[0]?.customTaxonomies?.get("genre")).toContain("dystopian");
+		expect(result.posts[0]?.customTaxonomies?.get("reading_level")).toContain("advanced");
+	});
+});

packages/core/tests/unit/client/client.test.ts

@@ -0,0 +1,641 @@
+import { describe, it, expect } from "vitest";
+
+import { EmDashClient, EmDashApiError } from "../../../src/client/index.js";
+import type { Interceptor } from "../../../src/client/transport.js";
+
+// Regex patterns for route matching
+const CONTENT_POSTS_ABC_REGEX = /\/content\/posts\/abc/;
+
+// ---------------------------------------------------------------------------
+// Mock backend
+// ---------------------------------------------------------------------------
+
+interface MockRoute {
+	method: string;
+	path: RegExp | string;
+	handler: (req: Request) => Response | Promise<Response>;
+}
+
+/**
+ * Creates a mock HTTP backend as an interceptor.
+ * Routes are matched in order. Unmatched requests return 404.
+ */
+function createMockBackend(routes: MockRoute[]): Interceptor {
+	return async (req) => {
+		const url = new URL(req.url);
+		const path = url.pathname + url.search;
+
+		for (const route of routes) {
+			if (req.method !== route.method) continue;
+			if (typeof route.path === "string") {
+				if (!path.includes(route.path)) continue;
+			} else {
+				if (!route.path.test(path)) continue;
+			}
+			return route.handler(req);
+		}
+
+		return new Response(
+			JSON.stringify({ error: { code: "NOT_FOUND", message: "No matching route" } }),
+			{ status: 404, headers: { "Content-Type": "application/json" } },
+		);
+	};
+}
+
+/** Wraps body in `{ data: body }` to match the standard API response envelope. */
+function jsonResponse(body: unknown, status: number = 200): Response {
+	// Error responses (4xx/5xx) are NOT wrapped in { data }
+	const payload = status >= 400 ? body : { data: body };
+	return new Response(JSON.stringify(payload), {
+		status,
+		headers: { "Content-Type": "application/json" },
+	});
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("EmDashClient", () => {
+	describe("_rev token flow", () => {
+		it("blind update (no _rev) succeeds", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								label: "Posts",
+								fields: [{ slug: "title", type: "string", label: "Title" }],
+							},
+						}),
+				},
+				{
+					method: "PUT",
+					path: CONTENT_POSTS_ABC_REGEX,
+					handler: async (req) => {
+						const body = (await req.json()) as Record<string, unknown>;
+						// No _rev should be sent
+						expect(body._rev).toBeUndefined();
+						return jsonResponse({
+							item: { id: "abc", data: { title: "Blind" } },
+							_rev: "newrev",
+						});
+					},
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const updated = await client.update("posts", "abc", {
+				data: { title: "Blind" },
+			});
+			expect(updated.data.title).toBe("Blind");
+		});
+
+		it("get() returns _rev on the item", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								label: "Posts",
+								fields: [{ slug: "title", type: "string", label: "Title" }],
+							},
+						}),
+				},
+				{
+					method: "GET",
+					path: CONTENT_POSTS_ABC_REGEX,
+					handler: () =>
+						jsonResponse({
+							item: {
+								id: "abc",
+								type: "posts",
+								slug: "hello",
+								status: "draft",
+								data: { title: "Hello" },
+								authorId: null,
+								createdAt: "2026-01-01",
+								updatedAt: "2026-01-01",
+								publishedAt: null,
+								scheduledAt: null,
+								liveRevisionId: null,
+								draftRevisionId: null,
+							},
+							_rev: "dGVzdHJldg",
+						}),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const post = await client.get("posts", "abc");
+			expect(post.id).toBe("abc");
+			expect(post._rev).toBe("dGVzdHJldg");
+		});
+
+		it("update() sends _rev when provided", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								label: "Posts",
+								fields: [{ slug: "title", type: "string", label: "Title" }],
+							},
+						}),
+				},
+				{
+					method: "PUT",
+					path: CONTENT_POSTS_ABC_REGEX,
+					handler: async (req) => {
+						const body = await req.json();
+						expect((body as Record<string, unknown>)._rev).toBe("dGVzdHJldg");
+						return jsonResponse({
+							item: { id: "abc", data: { title: "Updated" } },
+							_rev: "bmV3cmV2",
+						});
+					},
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const updated = await client.update("posts", "abc", {
+				data: { title: "Updated" },
+				_rev: "dGVzdHJldg",
+			});
+			expect(updated.data.title).toBe("Updated");
+			expect(updated._rev).toBe("bmV3cmV2");
+		});
+	});
+
+	describe("create()", () => {
+		it("does not require a prior get()", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								label: "Posts",
+								fields: [{ slug: "title", type: "string", label: "Title" }],
+							},
+						}),
+				},
+				{
+					method: "POST",
+					path: "/content/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								id: "new1",
+								type: "posts",
+								slug: "hello",
+								status: "draft",
+								data: { title: "Hello" },
+								authorId: null,
+								createdAt: "2026-01-01",
+								updatedAt: "2026-01-01",
+								publishedAt: null,
+								scheduledAt: null,
+								liveRevisionId: null,
+								draftRevisionId: null,
+							},
+						}),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const item = await client.create("posts", {
+				data: { title: "Hello" },
+				slug: "hello",
+			});
+			expect(item.id).toBe("new1");
+		});
+	});
+
+	describe("API error handling", () => {
+		it("throws EmDashApiError on 4xx responses", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections",
+					handler: () => jsonResponse({ error: { code: "FORBIDDEN", message: "No access" } }, 403),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			try {
+				await client.collections();
+				expect.fail("Should have thrown");
+			} catch (error) {
+				expect(error).toBeInstanceOf(EmDashApiError);
+				const apiErr = error as EmDashApiError;
+				expect(apiErr.status).toBe(403);
+				expect(apiErr.code).toBe("FORBIDDEN");
+				expect(apiErr.message).toBe("No access");
+			}
+		});
+
+		it("throws EmDashApiError on 500 responses", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/manifest",
+					handler: () =>
+						jsonResponse(
+							{
+								error: {
+									code: "INTERNAL_ERROR",
+									message: "Something broke",
+								},
+							},
+							500,
+						),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			try {
+				await client.manifest();
+				expect.fail("Should have thrown");
+			} catch (error) {
+				expect(error).toBeInstanceOf(EmDashApiError);
+				expect((error as EmDashApiError).status).toBe(500);
+			}
+		});
+	});
+
+	describe("list()", () => {
+		it("returns items and nextCursor", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/content/posts",
+					handler: () =>
+						jsonResponse({
+							items: [
+								{
+									id: "1",
+									type: "posts",
+									slug: "a",
+									status: "published",
+									data: {},
+								},
+								{
+									id: "2",
+									type: "posts",
+									slug: "b",
+									status: "published",
+									data: {},
+								},
+							],
+							nextCursor: "cursor123",
+						}),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const result = await client.list("posts", { status: "published" });
+			expect(result.items).toHaveLength(2);
+			expect(result.nextCursor).toBe("cursor123");
+		});
+	});
+
+	describe("listAll()", () => {
+		it("follows cursors until exhaustion", async () => {
+			let page = 0;
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/content/posts",
+					handler: () => {
+						page++;
+						if (page === 1) {
+							return jsonResponse({
+								items: [{ id: "1", data: {} }],
+								nextCursor: "page2",
+							});
+						}
+						return jsonResponse({
+							items: [{ id: "2", data: {} }],
+						});
+					},
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const all = [];
+			for await (const item of client.listAll("posts")) {
+				all.push(item);
+			}
+			expect(all).toHaveLength(2);
+			expect(all[0]?.id).toBe("1");
+			expect(all[1]?.id).toBe("2");
+		});
+	});
+
+	describe("delete/publish/unpublish/schedule/restore", () => {
+		it("calls the correct endpoints", async () => {
+			const calledPaths: string[] = [];
+
+			const backend: Interceptor = async (req) => {
+				calledPaths.push(`${req.method} ${new URL(req.url).pathname}`);
+				return jsonResponse({});
+			};
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			await client.delete("posts", "abc");
+			await client.publish("posts", "abc");
+			await client.unpublish("posts", "abc");
+			await client.schedule("posts", "abc", { at: "2026-03-01T00:00:00Z" });
+			await client.restore("posts", "abc");
+
+			expect(calledPaths).toEqual([
+				"DELETE /_emdash/api/content/posts/abc",
+				"POST /_emdash/api/content/posts/abc/publish",
+				"POST /_emdash/api/content/posts/abc/unpublish",
+				"POST /_emdash/api/content/posts/abc/schedule",
+				"POST /_emdash/api/content/posts/abc/restore",
+			]);
+		});
+	});
+
+	describe("schema methods", () => {
+		it("collections() returns list", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections",
+					handler: () =>
+						jsonResponse({
+							items: [
+								{ slug: "posts", label: "Posts", supports: [] },
+								{ slug: "pages", label: "Pages", supports: [] },
+							],
+						}),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const cols = await client.collections();
+			expect(cols).toHaveLength(2);
+			expect(cols[0]?.slug).toBe("posts");
+		});
+
+		it("createCollection() sends correct payload", async () => {
+			let capturedBody: unknown;
+			const backend = createMockBackend([
+				{
+					method: "POST",
+					path: "/schema/collections",
+					handler: async (req) => {
+						capturedBody = await req.json();
+						return jsonResponse({
+							item: {
+								slug: "events",
+								label: "Events",
+								labelSingular: "Event",
+							},
+						});
+					},
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			await client.createCollection({
+				slug: "events",
+				label: "Events",
+				labelSingular: "Event",
+			});
+
+			expect(capturedBody).toEqual({
+				slug: "events",
+				label: "Events",
+				labelSingular: "Event",
+			});
+		});
+	});
+
+	describe("PT <-> Markdown auto-conversion", () => {
+		it("converts PT fields to markdown on get()", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								label: "Posts",
+								fields: [
+									{ slug: "title", type: "string", label: "Title" },
+									{ slug: "body", type: "portableText", label: "Body" },
+								],
+							},
+						}),
+				},
+				{
+					method: "GET",
+					path: CONTENT_POSTS_ABC_REGEX,
+					handler: () =>
+						jsonResponse({
+							item: {
+								id: "abc",
+								type: "posts",
+								data: {
+									title: "Hello",
+									body: [
+										{
+											_type: "block",
+											style: "normal",
+											markDefs: [],
+											children: [
+												{
+													_type: "span",
+													text: "World",
+													marks: [],
+												},
+											],
+										},
+									],
+								},
+							},
+							_rev: "rev1",
+						}),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const item = await client.get("posts", "abc");
+			expect(item.data.title).toBe("Hello");
+			expect(typeof item.data.body).toBe("string");
+			expect(item.data.body).toContain("World");
+		});
+
+		it("returns raw PT when raw: true", async () => {
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								fields: [{ slug: "body", type: "portableText", label: "Body" }],
+							},
+						}),
+				},
+				{
+					method: "GET",
+					path: CONTENT_POSTS_ABC_REGEX,
+					handler: () =>
+						jsonResponse({
+							item: {
+								id: "abc",
+								data: {
+									body: [
+										{
+											_type: "block",
+											children: [{ _type: "span", text: "Raw" }],
+										},
+									],
+								},
+							},
+							_rev: "rev1",
+						}),
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			const item = await client.get("posts", "abc", { raw: true });
+			expect(Array.isArray(item.data.body)).toBe(true);
+		});
+
+		it("converts markdown to PT on create()", async () => {
+			let capturedData: Record<string, unknown> | undefined;
+
+			const backend = createMockBackend([
+				{
+					method: "GET",
+					path: "/schema/collections/posts",
+					handler: () =>
+						jsonResponse({
+							item: {
+								slug: "posts",
+								fields: [
+									{ slug: "title", type: "string", label: "Title" },
+									{ slug: "body", type: "portableText", label: "Body" },
+								],
+							},
+						}),
+				},
+				{
+					method: "POST",
+					path: "/content/posts",
+					handler: async (req) => {
+						const body = (await req.json()) as Record<string, unknown>;
+						capturedData = body.data as Record<string, unknown>;
+						return jsonResponse({
+							item: {
+								id: "new1",
+								data: capturedData,
+							},
+						});
+					},
+				},
+			]);
+
+			const client = new EmDashClient({
+				baseUrl: "http://localhost:4321",
+				token: "test",
+				interceptors: [backend],
+			});
+
+			await client.create("posts", {
+				data: {
+					title: "Hello",
+					body: "Some **bold** text",
+				},
+			});
+
+			expect(capturedData).toBeDefined();
+			expect(capturedData!.title).toBe("Hello");
+			expect(Array.isArray(capturedData!.body)).toBe(true);
+		});
+	});
+});

packages/core/tests/unit/client/portable-text.test.ts

@@ -0,0 +1,546 @@
+import { describe, it, expect, beforeEach } from "vitest";
+
+import type { PortableTextBlock, FieldSchema } from "../../../src/client/portable-text.js";
+import {
+	portableTextToMarkdown,
+	markdownToPortableText,
+	resetKeyCounter,
+	convertDataForRead,
+	convertDataForWrite,
+} from "../../../src/client/portable-text.js";
+
+beforeEach(() => {
+	resetKeyCounter();
+});
+
+// ---------------------------------------------------------------------------
+// PT -> Markdown
+// ---------------------------------------------------------------------------
+
+describe("portableTextToMarkdown", () => {
+	it("converts a simple paragraph", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				_key: "a",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", _key: "s1", text: "Hello world", marks: [] }],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("Hello world\n");
+	});
+
+	it("converts headings h1-h6", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "h1",
+				markDefs: [],
+				children: [{ _type: "span", text: "Title", marks: [] }],
+			},
+			{
+				_type: "block",
+				style: "h3",
+				markDefs: [],
+				children: [{ _type: "span", text: "Subtitle", marks: [] }],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("# Title\n\n### Subtitle\n");
+	});
+
+	it("converts bold, italic, code, and strikethrough marks", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [
+					{ _type: "span", text: "bold", marks: ["strong"] },
+					{ _type: "span", text: " and ", marks: [] },
+					{ _type: "span", text: "italic", marks: ["em"] },
+					{ _type: "span", text: " and ", marks: [] },
+					{ _type: "span", text: "code", marks: ["code"] },
+					{ _type: "span", text: " and ", marks: [] },
+					{ _type: "span", text: "struck", marks: ["strike-through"] },
+				],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe(
+			"**bold** and _italic_ and `code` and ~~struck~~\n",
+		);
+	});
+
+	it("converts links via markDefs", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [{ _key: "link1", _type: "link", href: "https://example.com" }],
+				children: [
+					{ _type: "span", text: "Click ", marks: [] },
+					{ _type: "span", text: "here", marks: ["link1"] },
+				],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("Click [here](https://example.com)\n");
+	});
+
+	it("converts blockquotes", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "blockquote",
+				markDefs: [],
+				children: [{ _type: "span", text: "A quote", marks: [] }],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("> A quote\n");
+	});
+
+	it("converts unordered lists", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				listItem: "bullet",
+				level: 1,
+				markDefs: [],
+				children: [{ _type: "span", text: "First", marks: [] }],
+			},
+			{
+				_type: "block",
+				style: "normal",
+				listItem: "bullet",
+				level: 1,
+				markDefs: [],
+				children: [{ _type: "span", text: "Second", marks: [] }],
+			},
+			{
+				_type: "block",
+				style: "normal",
+				listItem: "bullet",
+				level: 2,
+				markDefs: [],
+				children: [{ _type: "span", text: "Nested", marks: [] }],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("- First\n- Second\n  - Nested\n");
+	});
+
+	it("converts ordered lists", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				listItem: "number",
+				level: 1,
+				markDefs: [],
+				children: [{ _type: "span", text: "First", marks: [] }],
+			},
+			{
+				_type: "block",
+				style: "normal",
+				listItem: "number",
+				level: 1,
+				markDefs: [],
+				children: [{ _type: "span", text: "Second", marks: [] }],
+			},
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("1. First\n1. Second\n");
+	});
+
+	it("converts code blocks", () => {
+		const blocks: PortableTextBlock[] = [
+			{ _type: "code", _key: "c1", language: "typescript", code: "const x = 1;\nconsole.log(x);" },
+		];
+		expect(portableTextToMarkdown(blocks)).toBe(
+			"```typescript\nconst x = 1;\nconsole.log(x);\n```\n",
+		);
+	});
+
+	it("converts images", () => {
+		const blocks: PortableTextBlock[] = [
+			{ _type: "image", _key: "i1", alt: "A cat", asset: { url: "/img/cat.jpg" } },
+		];
+		expect(portableTextToMarkdown(blocks)).toBe("![A cat](/img/cat.jpg)\n");
+	});
+
+	it("serializes unknown blocks as opaque fences", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", text: "Before", marks: [] }],
+			},
+			{
+				_type: "pluginWidget",
+				_key: "pw1",
+				config: { layout: "grid", items: 3 },
+			},
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", text: "After", marks: [] }],
+			},
+		];
+
+		const md = portableTextToMarkdown(blocks);
+		expect(md).toContain("Before");
+		expect(md).toContain("After");
+		expect(md).toContain("<!--ec:block ");
+		expect(md).toContain('"_type":"pluginWidget"');
+		expect(md).toContain('"layout":"grid"');
+	});
+
+	it("handles mixed content with paragraphs, headings, and lists", () => {
+		const blocks: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "h1",
+				markDefs: [],
+				children: [{ _type: "span", text: "Title", marks: [] }],
+			},
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", text: "A paragraph.", marks: [] }],
+			},
+			{
+				_type: "block",
+				style: "normal",
+				listItem: "bullet",
+				level: 1,
+				markDefs: [],
+				children: [{ _type: "span", text: "Item", marks: [] }],
+			},
+		];
+
+		const md = portableTextToMarkdown(blocks);
+		expect(md).toContain("# Title");
+		expect(md).toContain("A paragraph.");
+		expect(md).toContain("- Item");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// Markdown -> PT
+// ---------------------------------------------------------------------------
+
+describe("markdownToPortableText", () => {
+	it("converts a simple paragraph", () => {
+		const blocks = markdownToPortableText("Hello world\n");
+		expect(blocks).toHaveLength(1);
+		expect(blocks[0]._type).toBe("block");
+		expect(blocks[0].style).toBe("normal");
+		expect(blocks[0].children).toHaveLength(1);
+		expect((blocks[0].children[0] as { text: string }).text).toBe("Hello world");
+	});
+
+	it("converts headings", () => {
+		const blocks = markdownToPortableText("# Title\n\n### Subtitle\n");
+		expect(blocks).toHaveLength(2);
+		expect(blocks[0].style).toBe("h1");
+		expect(blocks[1].style).toBe("h3");
+	});
+
+	it("converts bold and italic", () => {
+		const blocks = markdownToPortableText("Some **bold** and _italic_ text\n");
+		expect(blocks).toHaveLength(1);
+		const children = blocks[0].children;
+		expect(children.length).toBeGreaterThan(1);
+
+		const boldSpan = children.find((c) => (c.marks ?? []).includes("strong"));
+		expect(boldSpan).toBeDefined();
+		expect(boldSpan!.text).toBe("bold");
+
+		const italicSpan = children.find((c) => (c.marks ?? []).includes("em"));
+		expect(italicSpan).toBeDefined();
+		expect(italicSpan!.text).toBe("italic");
+	});
+
+	it("converts inline code", () => {
+		const blocks = markdownToPortableText("Use `foo()` here\n");
+		const children = blocks[0].children;
+		const codeSpan = children.find((c) => (c.marks ?? []).includes("code"));
+		expect(codeSpan).toBeDefined();
+		expect(codeSpan!.text).toBe("foo()");
+	});
+
+	it("converts links with markDefs", () => {
+		const blocks = markdownToPortableText("Click [here](https://example.com)\n");
+		expect(blocks).toHaveLength(1);
+		expect(blocks[0].markDefs).toHaveLength(1);
+		expect(blocks[0].markDefs[0]._type).toBe("link");
+		expect(blocks[0].markDefs[0].href).toBe("https://example.com");
+
+		const linkSpan = blocks[0].children.find((c) =>
+			(c.marks ?? []).includes(blocks[0].markDefs[0]._key),
+		);
+		expect(linkSpan).toBeDefined();
+		expect(linkSpan!.text).toBe("here");
+	});
+
+	it("converts blockquotes", () => {
+		const blocks = markdownToPortableText("> A quote\n");
+		expect(blocks).toHaveLength(1);
+		expect(blocks[0].style).toBe("blockquote");
+	});
+
+	it("converts unordered lists", () => {
+		const blocks = markdownToPortableText("- First\n- Second\n  - Nested\n");
+		expect(blocks).toHaveLength(3);
+		expect(blocks[0].listItem).toBe("bullet");
+		expect(blocks[0].level).toBe(1);
+		expect(blocks[2].listItem).toBe("bullet");
+		expect(blocks[2].level).toBe(2);
+	});
+
+	it("converts ordered lists", () => {
+		const blocks = markdownToPortableText("1. First\n2. Second\n");
+		expect(blocks).toHaveLength(2);
+		expect(blocks[0].listItem).toBe("number");
+		expect(blocks[1].listItem).toBe("number");
+	});
+
+	it("converts code fences", () => {
+		const blocks = markdownToPortableText("```typescript\nconst x = 1;\n```\n");
+		expect(blocks).toHaveLength(1);
+		expect(blocks[0]._type).toBe("code");
+		expect(blocks[0].language).toBe("typescript");
+		expect(blocks[0].code).toBe("const x = 1;");
+	});
+
+	it("converts images", () => {
+		const blocks = markdownToPortableText("![A cat](/img/cat.jpg)\n");
+		expect(blocks).toHaveLength(1);
+		expect(blocks[0]._type).toBe("image");
+		expect(blocks[0].alt).toBe("A cat");
+		expect((blocks[0].asset as { url: string }).url).toBe("/img/cat.jpg");
+	});
+
+	it("deserializes opaque fences back to original blocks", () => {
+		const original = {
+			_type: "pluginWidget",
+			_key: "pw1",
+			config: { layout: "grid", items: 3 },
+		};
+		const md = `<!--ec:block ${JSON.stringify(original)} -->`;
+		const blocks = markdownToPortableText(md);
+		expect(blocks).toHaveLength(1);
+		expect(blocks[0]._type).toBe("pluginWidget");
+		expect(blocks[0]._key).toBe("pw1");
+		expect((blocks[0] as Record<string, unknown>).config).toEqual({
+			layout: "grid",
+			items: 3,
+		});
+	});
+
+	it("skips blank lines", () => {
+		const blocks = markdownToPortableText("Hello\n\n\n\nWorld\n");
+		expect(blocks).toHaveLength(2);
+	});
+
+	it("converts strikethrough", () => {
+		const blocks = markdownToPortableText("Some ~~deleted~~ text\n");
+		const children = blocks[0].children;
+		const strikeSpan = children.find((c) => (c.marks ?? []).includes("strike-through"));
+		expect(strikeSpan).toBeDefined();
+		expect(strikeSpan!.text).toBe("deleted");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// Round-trip
+// ---------------------------------------------------------------------------
+
+describe("PT <-> Markdown round-trip", () => {
+	it("preserves simple text through round-trip", () => {
+		const original: PortableTextBlock[] = [
+			{
+				_type: "block",
+				_key: "a",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", _key: "s", text: "Hello world", marks: [] }],
+			},
+		];
+
+		const md = portableTextToMarkdown(original);
+		const roundTripped = markdownToPortableText(md);
+
+		expect(roundTripped).toHaveLength(1);
+		expect(roundTripped[0].style).toBe("normal");
+		expect((roundTripped[0].children[0] as { text: string }).text).toBe("Hello world");
+	});
+
+	it("preserves headings through round-trip", () => {
+		const original: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "h2",
+				markDefs: [],
+				children: [{ _type: "span", text: "My Heading", marks: [] }],
+			},
+		];
+
+		const md = portableTextToMarkdown(original);
+		const roundTripped = markdownToPortableText(md);
+
+		expect(roundTripped).toHaveLength(1);
+		expect(roundTripped[0].style).toBe("h2");
+		expect((roundTripped[0].children[0] as { text: string }).text).toBe("My Heading");
+	});
+
+	it("preserves opaque fences through round-trip", () => {
+		const custom = {
+			_type: "callout",
+			_key: "c1",
+			style: "warning",
+			text: "Be careful!",
+		};
+
+		const original: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", text: "Before", marks: [] }],
+			},
+			custom,
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [{ _type: "span", text: "After", marks: [] }],
+			},
+		];
+
+		const md = portableTextToMarkdown(original);
+		const roundTripped = markdownToPortableText(md);
+
+		expect(roundTripped).toHaveLength(3);
+		expect(roundTripped[1]._type).toBe("callout");
+		expect(roundTripped[1]._key).toBe("c1");
+		expect((roundTripped[1] as Record<string, unknown>).style).toBe("warning");
+		expect((roundTripped[1] as Record<string, unknown>).text).toBe("Be careful!");
+	});
+
+	it("preserves code blocks through round-trip", () => {
+		const original: PortableTextBlock[] = [
+			{
+				_type: "code",
+				_key: "c1",
+				language: "javascript",
+				code: "const x = 42;",
+			},
+		];
+
+		const md = portableTextToMarkdown(original);
+		const roundTripped = markdownToPortableText(md);
+
+		expect(roundTripped).toHaveLength(1);
+		expect(roundTripped[0]._type).toBe("code");
+		expect(roundTripped[0].language).toBe("javascript");
+		expect(roundTripped[0].code).toBe("const x = 42;");
+	});
+
+	it("preserves bold text through round-trip", () => {
+		const original: PortableTextBlock[] = [
+			{
+				_type: "block",
+				style: "normal",
+				markDefs: [],
+				children: [
+					{ _type: "span", text: "Some ", marks: [] },
+					{ _type: "span", text: "bold", marks: ["strong"] },
+					{ _type: "span", text: " text", marks: [] },
+				],
+			},
+		];
+
+		const md = portableTextToMarkdown(original);
+		expect(md).toContain("**bold**");
+
+		const roundTripped = markdownToPortableText(md);
+		const boldSpan = roundTripped[0].children.find((c) => (c.marks ?? []).includes("strong"));
+		expect(boldSpan).toBeDefined();
+		expect(boldSpan!.text).toBe("bold");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// Schema-aware conversion
+// ---------------------------------------------------------------------------
+
+describe("convertDataForRead", () => {
+	const fields: FieldSchema[] = [
+		{ slug: "title", type: "string" },
+		{ slug: "body", type: "portableText" },
+		{ slug: "sidebar", type: "portableText" },
+	];
+
+	it("converts PT arrays to markdown for portableText fields", () => {
+		const data = {
+			title: "Hello",
+			body: [
+				{
+					_type: "block",
+					style: "normal",
+					markDefs: [],
+					children: [{ _type: "span", text: "Content", marks: [] }],
+				},
+			],
+		};
+
+		const result = convertDataForRead(data, fields);
+		expect(result.title).toBe("Hello");
+		expect(typeof result.body).toBe("string");
+		expect(result.body).toContain("Content");
+	});
+
+	it("skips conversion when raw is true", () => {
+		const data = {
+			body: [{ _type: "block", children: [{ _type: "span", text: "X" }] }],
+		};
+
+		const result = convertDataForRead(data, fields, true);
+		expect(Array.isArray(result.body)).toBe(true);
+	});
+
+	it("does not touch non-portableText fields", () => {
+		const data = { title: "Test", body: "already a string" };
+		const result = convertDataForRead(data, fields);
+		expect(result.title).toBe("Test");
+		expect(result.body).toBe("already a string"); // not an array, skip
+	});
+});
+
+describe("convertDataForWrite", () => {
+	const fields: FieldSchema[] = [
+		{ slug: "title", type: "string" },
+		{ slug: "body", type: "portableText" },
+	];
+
+	it("converts markdown strings to PT for portableText fields", () => {
+		const data = { title: "Hello", body: "Some **bold** text" };
+		const result = convertDataForWrite(data, fields);
+		expect(result.title).toBe("Hello");
+		expect(Array.isArray(result.body)).toBe(true);
+
+		const blocks = result.body as PortableTextBlock[];
+		expect(blocks[0]._type).toBe("block");
+		const boldSpan = blocks[0].children.find((c) => (c.marks ?? []).includes("strong"));
+		expect(boldSpan!.text).toBe("bold");
+	});
+
+	it("passes through raw PT arrays unchanged", () => {
+		const ptArray = [{ _type: "block", children: [{ _type: "span", text: "Raw" }] }];
+		const data = { body: ptArray };
+		const result = convertDataForWrite(data, fields);
+		expect(result.body).toBe(ptArray); // same reference
+	});
+});

packages/core/tests/unit/client/transport.test.ts

@@ -0,0 +1,248 @@
+import { describe, it, expect } from "vitest";
+
+import type { Interceptor } from "../../../src/client/transport.js";
+import {
+	createTransport,
+	csrfInterceptor,
+	tokenInterceptor,
+} from "../../../src/client/transport.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Create an interceptor that adds a header to the request */
+function createHeaderInterceptor(name: string, value: string): Interceptor {
+	return async (req, next) => {
+		const headers = new Headers(req.headers);
+		headers.set(name, value);
+		return next(new Request(req, { headers }));
+	};
+}
+
+/** Create a mock fetch that returns a fixed response */
+function mockFetch(body: unknown = {}, status: number = 200): Interceptor {
+	return async () =>
+		new Response(JSON.stringify(body), {
+			status,
+			headers: { "Content-Type": "application/json" },
+		});
+}
+
+// ---------------------------------------------------------------------------
+// createTransport
+// ---------------------------------------------------------------------------
+
+describe("createTransport", () => {
+	it("calls global fetch when no interceptors are provided", async () => {
+		const transport = createTransport({
+			interceptors: [mockFetch({ ok: true })],
+		});
+
+		const res = await transport.fetch(new Request("https://example.com"));
+		expect(res.status).toBe(200);
+		const json = await res.json();
+		expect(json).toEqual({ ok: true });
+	});
+
+	it("runs interceptors in order", async () => {
+		const order: string[] = [];
+
+		const first: Interceptor = async (req, next) => {
+			order.push("first-before");
+			const res = await next(req);
+			order.push("first-after");
+			return res;
+		};
+
+		const second: Interceptor = async (req, next) => {
+			order.push("second-before");
+			const res = await next(req);
+			order.push("second-after");
+			return res;
+		};
+
+		const transport = createTransport({
+			interceptors: [first, second, mockFetch()],
+		});
+
+		await transport.fetch(new Request("https://example.com"));
+		expect(order).toEqual(["first-before", "second-before", "second-after", "first-after"]);
+	});
+
+	it("allows interceptors to modify requests", async () => {
+		let capturedHeader: string | null = null;
+
+		const addHeader = createHeaderInterceptor("X-Custom", "test-value");
+
+		const capture: Interceptor = async (req) => {
+			capturedHeader = req.headers.get("X-Custom");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [addHeader, capture],
+		});
+
+		await transport.fetch(new Request("https://example.com"));
+		expect(capturedHeader).toBe("test-value");
+	});
+
+	it("allows interceptors to retry on failure", async () => {
+		let attempts = 0;
+
+		const retryOnce: Interceptor = async (req, next) => {
+			const res = await next(req);
+			if (res.status === 401 && attempts === 0) {
+				attempts++;
+				return next(req);
+			}
+			return res;
+		};
+
+		let callCount = 0;
+		const backend: Interceptor = async () => {
+			callCount++;
+			if (callCount === 1) {
+				return new Response("unauthorized", { status: 401 });
+			}
+			return new Response("ok", { status: 200 });
+		};
+
+		const transport = createTransport({
+			interceptors: [retryOnce, backend],
+		});
+
+		const res = await transport.fetch(new Request("https://example.com"));
+		expect(res.status).toBe(200);
+		expect(callCount).toBe(2);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// csrfInterceptor
+// ---------------------------------------------------------------------------
+
+describe("csrfInterceptor", () => {
+	it("adds X-EmDash-Request header to POST requests", async () => {
+		let capturedHeader: string | null = null;
+		const capture: Interceptor = async (req) => {
+			capturedHeader = req.headers.get("X-EmDash-Request");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [csrfInterceptor(), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com", { method: "POST" }));
+		expect(capturedHeader).toBe("1");
+	});
+
+	it("adds X-EmDash-Request header to PUT requests", async () => {
+		let capturedHeader: string | null = null;
+		const capture: Interceptor = async (req) => {
+			capturedHeader = req.headers.get("X-EmDash-Request");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [csrfInterceptor(), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com", { method: "PUT" }));
+		expect(capturedHeader).toBe("1");
+	});
+
+	it("adds X-EmDash-Request header to DELETE requests", async () => {
+		let capturedHeader: string | null = null;
+		const capture: Interceptor = async (req) => {
+			capturedHeader = req.headers.get("X-EmDash-Request");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [csrfInterceptor(), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com", { method: "DELETE" }));
+		expect(capturedHeader).toBe("1");
+	});
+
+	it("does NOT add header to GET requests", async () => {
+		let capturedHeader: string | null = null;
+		const capture: Interceptor = async (req) => {
+			capturedHeader = req.headers.get("X-EmDash-Request");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [csrfInterceptor(), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com", { method: "GET" }));
+		expect(capturedHeader).toBeNull();
+	});
+});
+
+// ---------------------------------------------------------------------------
+// tokenInterceptor
+// ---------------------------------------------------------------------------
+
+describe("tokenInterceptor", () => {
+	it("adds Authorization Bearer header to all requests", async () => {
+		let capturedAuth: string | null = null;
+		const capture: Interceptor = async (req) => {
+			capturedAuth = req.headers.get("Authorization");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [tokenInterceptor("ec_pat_abc123"), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com"));
+		expect(capturedAuth).toBe("Bearer ec_pat_abc123");
+	});
+
+	it("adds Authorization to both GET and POST", async () => {
+		const captured: string[] = [];
+		const capture: Interceptor = async (req) => {
+			captured.push(req.headers.get("Authorization") ?? "");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [tokenInterceptor("tok"), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com", { method: "GET" }));
+		await transport.fetch(new Request("https://example.com", { method: "POST" }));
+		expect(captured).toEqual(["Bearer tok", "Bearer tok"]);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// Interceptor composition
+// ---------------------------------------------------------------------------
+
+describe("interceptor composition", () => {
+	it("csrf + token interceptors compose correctly", async () => {
+		let capturedAuth: string | null = null;
+		let capturedCsrf: string | null = null;
+
+		const capture: Interceptor = async (req) => {
+			capturedAuth = req.headers.get("Authorization");
+			capturedCsrf = req.headers.get("X-EmDash-Request");
+			return new Response("ok");
+		};
+
+		const transport = createTransport({
+			interceptors: [csrfInterceptor(), tokenInterceptor("tok"), capture],
+		});
+
+		await transport.fetch(new Request("https://example.com", { method: "POST" }));
+		expect(capturedAuth).toBe("Bearer tok");
+		expect(capturedCsrf).toBe("1");
+	});
+});

packages/core/tests/unit/converters/image-dimensions.test.ts

@@ -0,0 +1,60 @@
+import { describe, it, expect } from "vitest";
+
+import { portableTextToProsemirror } from "../../../src/content/converters/portable-text-to-prosemirror.js";
+import { prosemirrorToPortableText } from "../../../src/content/converters/prosemirror-to-portable-text.js";
+import type { PortableTextImageBlock } from "../../../src/content/converters/types.js";
+
+describe("Image dimension round-trip", () => {
+	const imageBlock: PortableTextImageBlock = {
+		_type: "image",
+		_key: "abc123",
+		asset: { _ref: "media-123", url: "https://example.com/photo.jpg" },
+		alt: "A photo",
+		caption: "My caption",
+		width: 1920,
+		height: 1080,
+		displayWidth: 400,
+		displayHeight: 225,
+	};
+
+	it("preserves displayWidth and displayHeight through PT → PM → PT", () => {
+		// PT → PM
+		const pm = portableTextToProsemirror([imageBlock]);
+		const imageNode = pm.content[0];
+
+		expect(imageNode.type).toBe("image");
+		expect(imageNode.attrs?.displayWidth).toBe(400);
+		expect(imageNode.attrs?.displayHeight).toBe(225);
+		expect(imageNode.attrs?.width).toBe(1920);
+		expect(imageNode.attrs?.height).toBe(1080);
+
+		// PM → PT
+		const pt = prosemirrorToPortableText(pm);
+		const restored = pt[0] as PortableTextImageBlock;
+
+		expect(restored._type).toBe("image");
+		expect(restored.displayWidth).toBe(400);
+		expect(restored.displayHeight).toBe(225);
+		expect(restored.width).toBe(1920);
+		expect(restored.height).toBe(1080);
+	});
+
+	it("handles images without display dimensions", () => {
+		const noDisplayDims: PortableTextImageBlock = {
+			_type: "image",
+			_key: "def456",
+			asset: { _ref: "media-456", url: "https://example.com/other.jpg" },
+			width: 800,
+			height: 600,
+		};
+
+		const pm = portableTextToProsemirror([noDisplayDims]);
+		const pt = prosemirrorToPortableText(pm);
+		const restored = pt[0] as PortableTextImageBlock;
+
+		expect(restored.displayWidth).toBeUndefined();
+		expect(restored.displayHeight).toBeUndefined();
+		expect(restored.width).toBe(800);
+		expect(restored.height).toBe(600);
+	});
+});

packages/core/tests/unit/database/migrations/031_bylines.test.ts

@@ -0,0 +1,74 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { createDatabase } from "../../../../src/database/connection.js";
+import { down, up } from "../../../../src/database/migrations/031_bylines.js";
+import type { Database } from "../../../../src/database/types.js";
+
+describe("031_bylines migration", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = createDatabase({ url: ":memory:" });
+
+		await db.schema
+			.createTable("users")
+			.addColumn("id", "text", (col) => col.primaryKey())
+			.execute();
+		await db.schema
+			.createTable("media")
+			.addColumn("id", "text", (col) => col.primaryKey())
+			.execute();
+
+		await db.schema
+			.createTable("ec_posts")
+			.addColumn("id", "text", (col) => col.primaryKey())
+			.execute();
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	it("adds byline tables and primary_byline_id to existing content tables", async () => {
+		await up(db);
+
+		const tables = await db.introspection.getTables();
+		const tableNames = tables.map((t) => t.name);
+		expect(tableNames).toContain("_emdash_bylines");
+		expect(tableNames).toContain("_emdash_content_bylines");
+
+		const contentTable = tables.find((t) => t.name === "ec_posts");
+		expect(contentTable).toBeDefined();
+		expect(contentTable?.columns.map((c) => c.name)).toContain("primary_byline_id");
+
+		const idx = await sql<{ name: string }>`
+			SELECT name
+			FROM sqlite_master
+			WHERE type = 'index' AND name = 'idx_ec_posts_primary_byline'
+		`.execute(db);
+		expect(idx.rows).toHaveLength(1);
+	});
+
+	it("reverts added tables, indexes, and columns", async () => {
+		await up(db);
+		await down(db);
+
+		const tables = await db.introspection.getTables();
+		const tableNames = tables.map((t) => t.name);
+		expect(tableNames).not.toContain("_emdash_bylines");
+		expect(tableNames).not.toContain("_emdash_content_bylines");
+
+		const contentTable = tables.find((t) => t.name === "ec_posts");
+		expect(contentTable).toBeDefined();
+		expect(contentTable?.columns.map((c) => c.name)).not.toContain("primary_byline_id");
+
+		const idx = await sql<{ name: string }>`
+			SELECT name
+			FROM sqlite_master
+			WHERE type = 'index' AND name = 'idx_ec_posts_primary_byline'
+		`.execute(db);
+		expect(idx.rows).toHaveLength(0);
+	});
+});

packages/core/tests/unit/database/repositories/byline.test.ts

@@ -0,0 +1,165 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { BylineRepository } from "../../../../src/database/repositories/byline.js";
+import { ContentRepository } from "../../../../src/database/repositories/content.js";
+import type { Database } from "../../../../src/database/types.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../../../utils/test-db.js";
+
+describe("BylineRepository", () => {
+	let db: Kysely<Database>;
+	let bylineRepo: BylineRepository;
+	let contentRepo: ContentRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		bylineRepo = new BylineRepository(db);
+		contentRepo = new ContentRepository(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	it("creates and reads bylines", async () => {
+		const created = await bylineRepo.create({
+			slug: "jane-doe",
+			displayName: "Jane Doe",
+			isGuest: true,
+		});
+
+		expect(created.slug).toBe("jane-doe");
+		expect(created.displayName).toBe("Jane Doe");
+		expect(created.isGuest).toBe(true);
+
+		const foundById = await bylineRepo.findById(created.id);
+		expect(foundById?.id).toBe(created.id);
+
+		const foundBySlug = await bylineRepo.findBySlug("jane-doe");
+		expect(foundBySlug?.id).toBe(created.id);
+
+		const foundByUser = await bylineRepo.findByUserId("missing-user");
+		expect(foundByUser).toBeNull();
+	});
+
+	it("supports updates and paginated listing", async () => {
+		const alpha = await bylineRepo.create({
+			slug: "alpha",
+			displayName: "Alpha Writer",
+			isGuest: true,
+		});
+		await bylineRepo.create({
+			slug: "beta",
+			displayName: "Beta Writer",
+			isGuest: false,
+		});
+
+		const updated = await bylineRepo.update(alpha.id, {
+			displayName: "Alpha Updated",
+			websiteUrl: "https://example.com",
+		});
+		expect(updated?.displayName).toBe("Alpha Updated");
+		expect(updated?.websiteUrl).toBe("https://example.com");
+
+		const searchResult = await bylineRepo.findMany({ search: "Beta" });
+		expect(searchResult.items).toHaveLength(1);
+		expect(searchResult.items[0]?.slug).toBe("beta");
+
+		const page1 = await bylineRepo.findMany({ limit: 1 });
+		expect(page1.items).toHaveLength(1);
+		expect(page1.nextCursor).toBeTruthy();
+
+		const page2 = await bylineRepo.findMany({ limit: 1, cursor: page1.nextCursor });
+		expect(page2.items).toHaveLength(1);
+		expect(page2.items[0]?.id).not.toBe(page1.items[0]?.id);
+	});
+
+	it("assigns ordered bylines to content and syncs primary_byline_id", async () => {
+		const lead = await bylineRepo.create({
+			slug: "lead",
+			displayName: "Lead Author",
+		});
+		const second = await bylineRepo.create({
+			slug: "second",
+			displayName: "Second Author",
+		});
+
+		const content = await contentRepo.create({
+			type: "post",
+			slug: "bylined-post",
+			data: { title: "Bylined Post" },
+		});
+
+		const assigned = await bylineRepo.setContentBylines("post", content.id, [
+			{ bylineId: lead.id },
+			{ bylineId: second.id, roleLabel: "Editor" },
+		]);
+
+		expect(assigned).toHaveLength(2);
+		expect(assigned[0]?.byline.id).toBe(lead.id);
+		expect(assigned[0]?.sortOrder).toBe(0);
+		expect(assigned[1]?.byline.id).toBe(second.id);
+		expect(assigned[1]?.roleLabel).toBe("Editor");
+
+		const refreshed = await contentRepo.findById("post", content.id);
+		expect(refreshed?.primaryBylineId).toBe(lead.id);
+	});
+
+	it("reorders bylines and updates primary_byline_id", async () => {
+		const first = await bylineRepo.create({
+			slug: "first",
+			displayName: "First",
+		});
+		const second = await bylineRepo.create({
+			slug: "second-reorder",
+			displayName: "Second",
+		});
+
+		const content = await contentRepo.create({
+			type: "post",
+			slug: "reordered-post",
+			data: { title: "Reordered" },
+		});
+
+		await bylineRepo.setContentBylines("post", content.id, [
+			{ bylineId: first.id },
+			{ bylineId: second.id },
+		]);
+
+		await bylineRepo.setContentBylines("post", content.id, [
+			{ bylineId: second.id },
+			{ bylineId: first.id },
+		]);
+
+		const refreshed = await contentRepo.findById("post", content.id);
+		expect(refreshed?.primaryBylineId).toBe(second.id);
+
+		const bylines = await bylineRepo.getContentBylines("post", content.id);
+		expect(bylines[0]?.byline.id).toBe(second.id);
+		expect(bylines[1]?.byline.id).toBe(first.id);
+	});
+
+	it("deletes byline, removes links, and nulls primary_byline_id", async () => {
+		const byline = await bylineRepo.create({
+			slug: "delete-me",
+			displayName: "Delete Me",
+		});
+
+		const content = await contentRepo.create({
+			type: "post",
+			slug: "delete-byline-post",
+			data: { title: "Delete Byline" },
+		});
+
+		await bylineRepo.setContentBylines("post", content.id, [{ bylineId: byline.id }]);
+
+		const deleted = await bylineRepo.delete(byline.id);
+		expect(deleted).toBe(true);
+
+		const unresolved = await bylineRepo.getContentBylines("post", content.id);
+		expect(unresolved).toHaveLength(0);
+
+		const refreshed = await contentRepo.findById("post", content.id);
+		expect(refreshed?.primaryBylineId).toBeNull();
+	});
+});

packages/core/tests/unit/database/repositories/content.test.ts

@@ -0,0 +1,560 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { ContentRepository } from "../../../../src/database/repositories/content.js";
+import { EmDashValidationError } from "../../../../src/database/repositories/types.js";
+import type { Database } from "../../../../src/database/types.js";
+import { createPostFixture, createPageFixture } from "../../../utils/fixtures.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../../../utils/test-db.js";
+
+// Regex patterns for ID validation
+const ULID_FORMAT_REGEX = /^[0-9A-Z]+$/i;
+
+describe("ContentRepository", () => {
+	let db: Kysely<Database>;
+	let repo: ContentRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		repo = new ContentRepository(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("create()", () => {
+		it("should create content with valid data", async () => {
+			const input = createPostFixture();
+			const result = await repo.create(input);
+
+			expect(result).toBeDefined();
+			expect(result.id).toBeTruthy();
+			expect(result.type).toBe("post");
+			expect(result.slug).toBe("hello-world");
+			expect(result.status).toBe("draft");
+			expect(result.data).toEqual(input.data);
+		});
+
+		it("should generate ULID for ID", async () => {
+			const input = createPostFixture();
+			const result = await repo.create(input);
+
+			// ULID is 26 characters long
+			expect(result.id).toHaveLength(26);
+			// ULID starts with timestamp (base32) - should be alphanumeric
+			expect(result.id).toMatch(ULID_FORMAT_REGEX);
+		});
+
+		it("should set default status to draft", async () => {
+			const input = createPostFixture();
+			delete (input as any).status;
+
+			const result = await repo.create(input);
+			expect(result.status).toBe("draft");
+		});
+
+		it("should throw validation error when type is missing", async () => {
+			const input = createPostFixture();
+			delete (input as any).type;
+
+			await expect(repo.create(input)).rejects.toThrow(EmDashValidationError);
+		});
+
+		it("should allow creating content without slug", async () => {
+			const input = createPostFixture();
+			delete (input as any).slug;
+
+			const result = await repo.create(input);
+			expect(result.slug).toBeNull();
+		});
+
+		it("should set createdAt and updatedAt timestamps", async () => {
+			const input = createPostFixture();
+			const result = await repo.create(input);
+
+			expect(result.createdAt).toBeTruthy();
+			expect(result.updatedAt).toBeTruthy();
+		});
+
+		it("should persist primaryBylineId on create", async () => {
+			const result = await repo.create(
+				createPostFixture({
+					slug: "with-primary-byline",
+					primaryBylineId: "byline_1",
+				}),
+			);
+
+			expect(result.primaryBylineId).toBe("byline_1");
+		});
+	});
+
+	describe("findById()", () => {
+		it("should return content by ID", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const found = await repo.findById("post", created.id);
+
+			expect(found).toBeDefined();
+			expect(found?.id).toBe(created.id);
+			expect(found?.data).toEqual(created.data);
+		});
+
+		it("should return null for non-existent ID", async () => {
+			const found = await repo.findById("post", "01J9FAKE0000000000000000");
+
+			expect(found).toBeNull();
+		});
+
+		it("should exclude soft-deleted content", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+			await repo.delete("post", created.id);
+
+			const found = await repo.findById("post", created.id);
+
+			expect(found).toBeNull();
+		});
+
+		it("should not return content of wrong type", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const found = await repo.findById("page", created.id);
+
+			expect(found).toBeNull();
+		});
+	});
+
+	describe("findBySlug()", () => {
+		it("should return content by slug", async () => {
+			const input = createPostFixture({ slug: "test-slug" });
+			const created = await repo.create(input);
+
+			const found = await repo.findBySlug("post", "test-slug");
+
+			expect(found).toBeDefined();
+			expect(found?.id).toBe(created.id);
+			expect(found?.slug).toBe("test-slug");
+		});
+
+		it("should return null for non-existent slug", async () => {
+			const found = await repo.findBySlug("post", "non-existent");
+
+			expect(found).toBeNull();
+		});
+
+		it("should not return content of wrong type", async () => {
+			const input = createPostFixture({ slug: "test-slug" });
+			await repo.create(input);
+
+			const found = await repo.findBySlug("page", "test-slug");
+
+			expect(found).toBeNull();
+		});
+	});
+
+	describe("findMany()", () => {
+		it("should return all content of specified type", async () => {
+			await repo.create(createPostFixture({ slug: "post-1" }));
+			await repo.create(createPostFixture({ slug: "post-2" }));
+			await repo.create(createPageFixture({ slug: "page-1" }));
+
+			const result = await repo.findMany("post");
+
+			expect(result.items).toHaveLength(2);
+			expect(result.items.every((item) => item.type === "post")).toBe(true);
+		});
+
+		it("should filter by status", async () => {
+			await repo.create(createPostFixture({ slug: "draft", status: "draft" }));
+			await repo.create(createPostFixture({ slug: "published", status: "published" }));
+
+			const result = await repo.findMany("post", {
+				where: { status: "published" },
+			});
+
+			expect(result.items).toHaveLength(1);
+			expect(result.items[0].status).toBe("published");
+		});
+
+		it("should filter by authorId", async () => {
+			await repo.create(createPostFixture({ slug: "author1", authorId: "user1" }));
+			await repo.create(createPostFixture({ slug: "author2", authorId: "user2" }));
+
+			const result = await repo.findMany("post", {
+				where: { authorId: "user1" },
+			});
+
+			expect(result.items).toHaveLength(1);
+			expect(result.items[0].authorId).toBe("user1");
+		});
+
+		it("should support cursor pagination", async () => {
+			// Create multiple posts
+			for (let i = 1; i <= 5; i++) {
+				await repo.create(createPostFixture({ slug: `post-${i}` }));
+			}
+
+			// First page
+			const page1 = await repo.findMany("post", { limit: 2 });
+			expect(page1.items).toHaveLength(2);
+			expect(page1.nextCursor).toBeTruthy();
+
+			// Second page
+			const page2 = await repo.findMany("post", {
+				limit: 2,
+				cursor: page1.nextCursor,
+			});
+			expect(page2.items).toHaveLength(2);
+			expect(page2.nextCursor).toBeTruthy();
+
+			// Verify no overlap
+			const page1Ids = page1.items.map((i) => i.id);
+			const page2Ids = page2.items.map((i) => i.id);
+			expect(page1Ids).not.toContain(page2Ids[0]);
+		});
+
+		it("should support ordering", async () => {
+			// Create posts with specific dates
+			const post1 = await repo.create(createPostFixture({ slug: "old-post" }));
+			// Wait a bit to ensure different timestamps
+			await new Promise((resolve) => setTimeout(resolve, 10));
+			const post2 = await repo.create(createPostFixture({ slug: "new-post" }));
+
+			// Default order (desc by createdAt)
+			const resultDesc = await repo.findMany("post", {
+				orderBy: { field: "createdAt", direction: "desc" },
+			});
+			expect(resultDesc.items[0].id).toBe(post2.id);
+
+			// Ascending order
+			const resultAsc = await repo.findMany("post", {
+				orderBy: { field: "createdAt", direction: "asc" },
+			});
+			expect(resultAsc.items[0].id).toBe(post1.id);
+		});
+
+		it("should respect limit", async () => {
+			for (let i = 1; i <= 10; i++) {
+				await repo.create(createPostFixture({ slug: `post-${i}` }));
+			}
+
+			const result = await repo.findMany("post", { limit: 5 });
+
+			expect(result.items).toHaveLength(5);
+		});
+
+		it("should exclude soft-deleted content", async () => {
+			const post1 = await repo.create(createPostFixture({ slug: "post-1" }));
+			await repo.create(createPostFixture({ slug: "post-2" }));
+			await repo.delete("post", post1.id);
+
+			const result = await repo.findMany("post");
+
+			expect(result.items).toHaveLength(1);
+			expect(result.items[0].slug).toBe("post-2");
+		});
+	});
+
+	describe("update()", () => {
+		it("should update content data", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const updated = await repo.update("post", created.id, {
+				data: { title: "Updated Title", content: [] },
+			});
+
+			expect(updated.data).toEqual({ title: "Updated Title", content: [] });
+		});
+
+		it("should update status", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const updated = await repo.update("post", created.id, {
+				status: "published",
+			});
+
+			expect(updated.status).toBe("published");
+		});
+
+		it("should update slug", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const updated = await repo.update("post", created.id, {
+				slug: "new-slug",
+			});
+
+			expect(updated.slug).toBe("new-slug");
+		});
+
+		it("should update publishedAt timestamp", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const publishedAt = new Date().toISOString();
+			const updated = await repo.update("post", created.id, {
+				publishedAt,
+			});
+
+			expect(updated.publishedAt).toBe(publishedAt);
+		});
+
+		it("should update updatedAt timestamp automatically", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			// Wait a bit to ensure different timestamp
+			await new Promise((resolve) => setTimeout(resolve, 10));
+
+			const updated = await repo.update("post", created.id, {
+				data: { title: "Updated" },
+			});
+
+			expect(updated.updatedAt).not.toBe(created.updatedAt);
+		});
+
+		it("should throw error for non-existent content", async () => {
+			await expect(repo.update("post", "01J9FAKE0000000000000000", { data: {} })).rejects.toThrow(
+				"Content not found",
+			);
+		});
+
+		it("should update primaryBylineId", async () => {
+			const created = await repo.create(
+				createPostFixture({
+					slug: "update-primary-byline",
+					primaryBylineId: "byline_old",
+				}),
+			);
+
+			const updated = await repo.update("post", created.id, {
+				primaryBylineId: "byline_new",
+			});
+
+			expect(updated.primaryBylineId).toBe("byline_new");
+		});
+	});
+
+	describe("delete()", () => {
+		it("should soft delete content", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+
+			const result = await repo.delete("post", created.id);
+
+			expect(result).toBe(true);
+
+			// Verify content is not returned by findById
+			const found = await repo.findById("post", created.id);
+			expect(found).toBeNull();
+		});
+
+		it("should return false for non-existent content", async () => {
+			const result = await repo.delete("post", "01J9FAKE0000000000000000");
+
+			expect(result).toBe(false);
+		});
+
+		it("should return false when deleting already deleted content", async () => {
+			const input = createPostFixture();
+			const created = await repo.create(input);
+			await repo.delete("post", created.id);
+
+			const result = await repo.delete("post", created.id);
+
+			expect(result).toBe(false);
+		});
+	});
+
+	describe("count()", () => {
+		it("should count all content of specified type", async () => {
+			await repo.create(createPostFixture({ slug: "post-1" }));
+			await repo.create(createPostFixture({ slug: "post-2" }));
+			await repo.create(createPageFixture({ slug: "page-1" }));
+
+			const count = await repo.count("post");
+
+			expect(count).toBe(2);
+		});
+
+		it("should count with status filter", async () => {
+			await repo.create(createPostFixture({ slug: "draft", status: "draft" }));
+			await repo.create(createPostFixture({ slug: "published", status: "published" }));
+
+			const count = await repo.count("post", { status: "published" });
+
+			expect(count).toBe(1);
+		});
+
+		it("should count with authorId filter", async () => {
+			await repo.create(createPostFixture({ slug: "author1", authorId: "user1" }));
+			await repo.create(createPostFixture({ slug: "author2", authorId: "user2" }));
+
+			const count = await repo.count("post", { authorId: "user1" });
+
+			expect(count).toBe(1);
+		});
+
+		it("should exclude soft-deleted content", async () => {
+			const post1 = await repo.create(createPostFixture({ slug: "post-1" }));
+			await repo.create(createPostFixture({ slug: "post-2" }));
+			await repo.delete("post", post1.id);
+
+			const count = await repo.count("post");
+
+			expect(count).toBe(1);
+		});
+	});
+
+	describe("schedule()", () => {
+		it("should set status to 'scheduled' for draft posts", async () => {
+			const post = await repo.create(createPostFixture());
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+
+			const updated = await repo.schedule("post", post.id, future);
+
+			expect(updated.status).toBe("scheduled");
+			expect(updated.scheduledAt).toBe(future);
+		});
+
+		it("should keep status 'published' for published posts", async () => {
+			const post = await repo.create(createPostFixture());
+			await repo.publish("post", post.id);
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+
+			const updated = await repo.schedule("post", post.id, future);
+
+			expect(updated.status).toBe("published");
+			expect(updated.scheduledAt).toBe(future);
+		});
+
+		it("should reject dates in the past", async () => {
+			const post = await repo.create(createPostFixture());
+			const past = new Date(Date.now() - 86_400_000).toISOString();
+
+			await expect(repo.schedule("post", post.id, past)).rejects.toThrow(EmDashValidationError);
+		});
+
+		it("should reject invalid date strings", async () => {
+			const post = await repo.create(createPostFixture());
+
+			await expect(repo.schedule("post", post.id, "not-a-date")).rejects.toThrow(
+				EmDashValidationError,
+			);
+		});
+	});
+
+	describe("unschedule()", () => {
+		it("should revert scheduled draft to 'draft'", async () => {
+			const post = await repo.create(createPostFixture());
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+			await repo.schedule("post", post.id, future);
+
+			const updated = await repo.unschedule("post", post.id);
+
+			expect(updated.status).toBe("draft");
+			expect(updated.scheduledAt).toBeNull();
+		});
+
+		it("should keep published posts as 'published'", async () => {
+			const post = await repo.create(createPostFixture());
+			await repo.publish("post", post.id);
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+			await repo.schedule("post", post.id, future);
+
+			const updated = await repo.unschedule("post", post.id);
+
+			expect(updated.status).toBe("published");
+			expect(updated.scheduledAt).toBeNull();
+		});
+	});
+
+	describe("publish() clears schedule", () => {
+		it("should clear scheduled_at when publishing a scheduled draft", async () => {
+			const post = await repo.create(createPostFixture());
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+			await repo.schedule("post", post.id, future);
+
+			const published = await repo.publish("post", post.id);
+
+			expect(published.status).toBe("published");
+			expect(published.scheduledAt).toBeNull();
+		});
+
+		it("should clear scheduled_at when publishing a published post with scheduled changes", async () => {
+			const post = await repo.create(createPostFixture());
+			await repo.publish("post", post.id);
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+			await repo.schedule("post", post.id, future);
+
+			const republished = await repo.publish("post", post.id);
+
+			expect(republished.status).toBe("published");
+			expect(republished.scheduledAt).toBeNull();
+		});
+	});
+
+	describe("findReadyToPublish()", () => {
+		it("should find scheduled drafts past their time", async () => {
+			const post = await repo.create(createPostFixture());
+			// Schedule in the past by directly updating (schedule() rejects past dates)
+			const past = new Date(Date.now() - 60_000).toISOString();
+			await repo.update("post", post.id, { status: "scheduled", scheduledAt: past });
+
+			const ready = await repo.findReadyToPublish("post");
+
+			expect(ready).toHaveLength(1);
+			expect(ready[0]!.id).toBe(post.id);
+		});
+
+		it("should find published posts with past scheduled_at", async () => {
+			const post = await repo.create(createPostFixture());
+			await repo.publish("post", post.id);
+			// Set scheduled_at in the past directly
+			const past = new Date(Date.now() - 60_000).toISOString();
+			await repo.update("post", post.id, { scheduledAt: past });
+
+			const ready = await repo.findReadyToPublish("post");
+
+			expect(ready).toHaveLength(1);
+			expect(ready[0]!.id).toBe(post.id);
+		});
+
+		it("should not include items with future scheduled_at", async () => {
+			const post = await repo.create(createPostFixture());
+			const future = new Date(Date.now() + 86_400_000).toISOString();
+			await repo.schedule("post", post.id, future);
+
+			const ready = await repo.findReadyToPublish("post");
+
+			expect(ready).toHaveLength(0);
+		});
+	});
+
+	describe("countScheduled()", () => {
+		it("should count both scheduled drafts and published posts with scheduled_at", async () => {
+			// Draft with schedule
+			const draft = await repo.create(createPostFixture({ slug: "draft-scheduled" }));
+			const future1 = new Date(Date.now() + 86_400_000).toISOString();
+			await repo.schedule("post", draft.id, future1);
+
+			// Published with schedule
+			const pub = await repo.create(createPostFixture({ slug: "pub-scheduled" }));
+			await repo.publish("post", pub.id);
+			const future2 = new Date(Date.now() + 172_800_000).toISOString();
+			await repo.schedule("post", pub.id, future2);
+
+			// Unscheduled draft (should not be counted)
+			await repo.create(createPostFixture({ slug: "plain-draft" }));
+
+			const count = await repo.countScheduled("post");
+
+			expect(count).toBe(2);
+		});
+	});
+});

packages/core/tests/unit/fields/all-fields.test.ts

@@ -0,0 +1,348 @@
+import { z } from "astro/zod";
+import { describe, it, expect } from "vitest";
+
+import {
+	text,
+	textarea,
+	number,
+	boolean as booleanField,
+	select,
+	multiSelect,
+	datetime,
+	slug,
+	image,
+	file,
+	reference,
+	json,
+	richText,
+	portableText,
+} from "../../../src/fields/index.js";
+
+// Test regex patterns
+const UPPERCASE_PATTERN_REGEX = /^[A-Z]+$/;
+const SLUG_UPPERCASE_PATTERN_REGEX = /^[A-Z_]+$/;
+
+describe("Field Types", () => {
+	describe("text", () => {
+		it("should create basic text field", () => {
+			const field = text();
+			expect(field.type).toBe("text");
+			expect(field.schema).toBeDefined();
+			expect(field.ui?.widget).toBe("text");
+		});
+
+		it("should validate required text", () => {
+			const field = text({ required: true });
+			expect(() => field.schema.parse("hello")).not.toThrow();
+			expect(() => field.schema.parse(undefined)).toThrow();
+		});
+
+		it("should validate optional text", () => {
+			const field = text({ required: false });
+			expect(() => field.schema.parse("hello")).not.toThrow();
+			expect(() => field.schema.parse(undefined)).not.toThrow();
+		});
+
+		it("should enforce minLength", () => {
+			const field = text({ minLength: 5 });
+			expect(() => field.schema.parse("hello")).not.toThrow();
+			expect(() => field.schema.parse("hi")).toThrow();
+		});
+
+		it("should enforce maxLength", () => {
+			const field = text({ maxLength: 10 });
+			expect(() => field.schema.parse("hello")).not.toThrow();
+			expect(() => field.schema.parse("hello world!")).toThrow();
+		});
+
+		it("should enforce pattern", () => {
+			const field = text({ pattern: UPPERCASE_PATTERN_REGEX });
+			expect(() => field.schema.parse("HELLO")).not.toThrow();
+			expect(() => field.schema.parse("hello")).toThrow();
+		});
+	});
+
+	describe("textarea", () => {
+		it("should create textarea field", () => {
+			const field = textarea();
+			expect(field.type).toBe("textarea");
+			expect(field.ui?.widget).toBe("textarea");
+			expect(field.ui?.rows).toBe(6);
+		});
+
+		it("should accept custom rows", () => {
+			const field = textarea({ rows: 10 });
+			expect(field.ui?.rows).toBe(10);
+		});
+
+		it("should enforce length constraints", () => {
+			const field = textarea({ minLength: 10, maxLength: 100 });
+			expect(() => field.schema.parse("a".repeat(50))).not.toThrow();
+			expect(() => field.schema.parse("short")).toThrow();
+			expect(() => field.schema.parse("a".repeat(200))).toThrow();
+		});
+	});
+
+	describe("number", () => {
+		it("should create number field", () => {
+			const field = number();
+			expect(field.type).toBe("number");
+			expect(field.ui?.widget).toBe("number");
+		});
+
+		it("should validate numbers", () => {
+			const field = number({ required: true });
+			expect(() => field.schema.parse(42)).not.toThrow();
+			expect(() => field.schema.parse(3.14)).not.toThrow();
+			expect(() => field.schema.parse("42")).toThrow();
+		});
+
+		it("should enforce integer constraint", () => {
+			const field = number({ integer: true });
+			expect(() => field.schema.parse(42)).not.toThrow();
+			expect(() => field.schema.parse(3.14)).toThrow();
+		});
+
+		it("should enforce min/max", () => {
+			const field = number({ min: 0, max: 100 });
+			expect(() => field.schema.parse(50)).not.toThrow();
+			expect(() => field.schema.parse(-1)).toThrow();
+			expect(() => field.schema.parse(101)).toThrow();
+		});
+	});
+
+	describe("boolean", () => {
+		it("should create boolean field", () => {
+			const field = booleanField();
+			expect(field.type).toBe("boolean");
+			expect(field.ui?.widget).toBe("boolean");
+		});
+
+		it("should validate booleans", () => {
+			const field = booleanField();
+			expect(() => field.schema.parse(true)).not.toThrow();
+			expect(() => field.schema.parse(false)).not.toThrow();
+			expect(() => field.schema.parse("true")).toThrow();
+		});
+
+		it("should apply default value", () => {
+			const field = booleanField({ default: true });
+			const result = field.schema.parse(undefined);
+			expect(result).toBe(true);
+		});
+	});
+
+	describe("select", () => {
+		it("should create select field", () => {
+			const field = select({ options: ["one", "two", "three"] as const });
+			expect(field.type).toBe("select");
+			expect(field.ui?.widget).toBe("select");
+		});
+
+		it("should validate enum values", () => {
+			const field = select({
+				options: ["red", "green", "blue"] as const,
+				required: true,
+			});
+			expect(() => field.schema.parse("red")).not.toThrow();
+			expect(() => field.schema.parse("yellow")).toThrow();
+		});
+
+		it("should apply default value", () => {
+			const field = select({
+				options: ["small", "medium", "large"] as const,
+				default: "medium",
+			});
+			const result = field.schema.parse(undefined);
+			expect(result).toBe("medium");
+		});
+	});
+
+	describe("multiSelect", () => {
+		it("should create multiSelect field", () => {
+			const field = multiSelect({ options: ["a", "b", "c"] as const });
+			expect(field.type).toBe("multiSelect");
+			expect(field.ui?.widget).toBe("multiSelect");
+		});
+
+		it("should validate array of enum values", () => {
+			const field = multiSelect({
+				options: ["tag1", "tag2", "tag3"] as const,
+				required: true,
+			});
+			expect(() => field.schema.parse(["tag1", "tag2"])).not.toThrow();
+			expect(() => field.schema.parse(["tag1", "invalid"])).toThrow();
+		});
+
+		it("should enforce min/max selections", () => {
+			const field = multiSelect({
+				options: ["a", "b", "c", "d"] as const,
+				min: 1,
+				max: 3,
+			});
+			expect(() => field.schema.parse(["a", "b"])).not.toThrow();
+			expect(() => field.schema.parse([])).toThrow();
+			expect(() => field.schema.parse(["a", "b", "c", "d"])).toThrow();
+		});
+	});
+
+	describe("datetime", () => {
+		it("should create datetime field", () => {
+			const field = datetime();
+			expect(field.type).toBe("datetime");
+			expect(field.ui?.widget).toBe("datetime");
+		});
+
+		it("should validate dates", () => {
+			const field = datetime({ required: true });
+			expect(() => field.schema.parse(new Date())).not.toThrow();
+			expect(() => field.schema.parse("2024-01-01")).toThrow();
+		});
+
+		it("should enforce min/max dates", () => {
+			const min = new Date("2024-01-01");
+			const max = new Date("2024-12-31");
+			const field = datetime({ min, max });
+
+			expect(() => field.schema.parse(new Date("2024-06-15"))).not.toThrow();
+			expect(() => field.schema.parse(new Date("2023-12-31"))).toThrow();
+			expect(() => field.schema.parse(new Date("2025-01-01"))).toThrow();
+		});
+	});
+
+	describe("slug", () => {
+		it("should create slug field", () => {
+			const field = slug();
+			expect(field.type).toBe("slug");
+			expect(field.ui?.widget).toBe("slug");
+		});
+
+		it("should validate slug format", () => {
+			const field = slug({ required: true });
+			expect(() => field.schema.parse("hello-world")).not.toThrow();
+			expect(() => field.schema.parse("hello-world-123")).not.toThrow();
+			expect(() => field.schema.parse("Hello World")).toThrow();
+			expect(() => field.schema.parse("hello_world")).toThrow();
+		});
+
+		it("should accept custom pattern", () => {
+			const field = slug({ pattern: SLUG_UPPERCASE_PATTERN_REGEX });
+			expect(() => field.schema.parse("HELLO_WORLD")).not.toThrow();
+			expect(() => field.schema.parse("hello-world")).toThrow();
+		});
+	});
+
+	describe("image", () => {
+		it("should create image field", () => {
+			const field = image();
+			expect(field.type).toBe("image");
+			expect(field.ui?.widget).toBe("image");
+		});
+
+		it("should validate image value structure", () => {
+			const field = image({ required: true });
+			const validImage = {
+				id: "img-123",
+				src: "https://example.com/photo.jpg",
+				alt: "A photo",
+				width: 1920,
+				height: 1080,
+			};
+			expect(() => field.schema.parse(validImage)).not.toThrow();
+		});
+	});
+
+	describe("file", () => {
+		it("should create file field", () => {
+			const field = file();
+			expect(field.type).toBe("file");
+			expect(field.ui?.widget).toBe("file");
+		});
+
+		it("should validate file value structure", () => {
+			const field = file({ required: true });
+			const validFile = {
+				id: "file-123",
+				url: "https://example.com/doc.pdf",
+				filename: "doc.pdf",
+				mimeType: "application/pdf",
+				size: 1024000,
+			};
+			expect(() => field.schema.parse(validFile)).not.toThrow();
+		});
+	});
+
+	describe("reference", () => {
+		it("should create reference field", () => {
+			const field = reference({ to: "posts" });
+			expect(field.type).toBe("reference");
+			expect(field.ui?.widget).toBe("reference");
+		});
+
+		it("should validate string ID", () => {
+			const field = reference({ to: "posts", required: true });
+			expect(() => field.schema.parse("post-123")).not.toThrow();
+			expect(() => field.schema.parse(123)).toThrow();
+		});
+	});
+
+	describe("json", () => {
+		it("should create json field", () => {
+			const field = json();
+			expect(field.type).toBe("json");
+			expect(field.ui?.widget).toBe("json");
+		});
+
+		it("should accept any JSON data", () => {
+			const field = json();
+			expect(() => field.schema.parse({ foo: "bar" })).not.toThrow();
+			expect(() => field.schema.parse([1, 2, 3])).not.toThrow();
+			expect(() => field.schema.parse("string")).not.toThrow();
+		});
+
+		it("should validate with custom schema", () => {
+			const customSchema = z.object({
+				name: z.string(),
+				age: z.number(),
+			});
+
+			const field = json({ schema: customSchema });
+			expect(() => field.schema.parse({ name: "John", age: 30 })).not.toThrow();
+			expect(() => field.schema.parse({ name: "John" })).toThrow();
+		});
+	});
+
+	describe("richText", () => {
+		it("should create richText field", () => {
+			const field = richText();
+			expect(field.type).toBe("richText");
+			expect(field.ui?.widget).toBe("richText");
+		});
+
+		it("should validate string content", () => {
+			const field = richText({ required: true });
+			expect(() => field.schema.parse("# Heading\n\nParagraph")).not.toThrow();
+			expect(() => field.schema.parse(123)).toThrow();
+		});
+	});
+
+	describe("portableText", () => {
+		it("should create portableText field", () => {
+			const field = portableText();
+			expect(field.type).toBe("portableText");
+			expect(field.ui?.widget).toBe("portableText");
+		});
+
+		it("should validate array of blocks", () => {
+			const field = portableText({ required: true });
+			const blocks = [
+				{
+					_type: "block",
+					_key: "key1",
+					children: [{ _type: "span", text: "Hello" }],
+				},
+			];
+			expect(() => field.schema.parse(blocks)).not.toThrow();
+		});
+	});
+});

packages/core/tests/unit/import/sections.test.ts

@@ -0,0 +1,225 @@
+/**
+ * Tests for importing WordPress reusable blocks as sections
+ */
+
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import type { WxrPost } from "../../../src/cli/wxr/parser.js";
+import type { Database } from "../../../src/database/types.js";
+import { importReusableBlocksAsSections } from "../../../src/import/sections.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("importReusableBlocksAsSections", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	it("should import wp_block posts as sections", async () => {
+		const posts: WxrPost[] = [
+			{
+				id: 100,
+				title: "Newsletter CTA",
+				postName: "newsletter-cta",
+				postType: "wp_block",
+				status: "publish",
+				content: `<!-- wp:heading {"level":3} -->
+<h3>Subscribe to Our Newsletter</h3>
+<!-- /wp:heading -->
+
+<!-- wp:paragraph -->
+<p>Get the latest updates.</p>
+<!-- /wp:paragraph -->`,
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+			{
+				id: 101,
+				title: "Hero Banner",
+				postName: "hero-banner",
+				postType: "wp_block",
+				status: "publish",
+				content: `<!-- wp:heading -->
+<h2>Welcome</h2>
+<!-- /wp:heading -->`,
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+			// Regular post - should be ignored
+			{
+				id: 1,
+				title: "Regular Post",
+				postName: "regular-post",
+				postType: "post",
+				status: "publish",
+				content: "<p>Hello</p>",
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+		];
+
+		const result = await importReusableBlocksAsSections(posts, db);
+
+		expect(result.sectionsCreated).toBe(2);
+		expect(result.sectionsSkipped).toBe(0);
+		expect(result.errors).toHaveLength(0);
+
+		// Verify sections were created
+		const sections = await db.selectFrom("_emdash_sections").selectAll().execute();
+
+		expect(sections).toHaveLength(2);
+
+		const newsletter = sections.find((s) => s.slug === "newsletter-cta");
+		expect(newsletter).toBeDefined();
+		expect(newsletter?.title).toBe("Newsletter CTA");
+		expect(newsletter?.source).toBe("import");
+
+		const hero = sections.find((s) => s.slug === "hero-banner");
+		expect(hero).toBeDefined();
+		expect(hero?.title).toBe("Hero Banner");
+	});
+
+	it("should skip existing sections by slug", async () => {
+		// Create existing section
+		await db
+			.insertInto("_emdash_sections")
+			.values({
+				id: "existing-1",
+				slug: "newsletter-cta",
+				title: "Existing Newsletter",
+				description: null,
+				keywords: null,
+				content: "[]",
+				preview_media_id: null,
+				source: "user",
+				theme_id: null,
+				created_at: new Date().toISOString(),
+				updated_at: new Date().toISOString(),
+			})
+			.execute();
+
+		const posts: WxrPost[] = [
+			{
+				id: 100,
+				title: "Newsletter CTA",
+				postName: "newsletter-cta",
+				postType: "wp_block",
+				status: "publish",
+				content: "<p>New content</p>",
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+			{
+				id: 101,
+				title: "New Block",
+				postName: "new-block",
+				postType: "wp_block",
+				status: "publish",
+				content: "<p>New</p>",
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+		];
+
+		const result = await importReusableBlocksAsSections(posts, db);
+
+		expect(result.sectionsCreated).toBe(1);
+		expect(result.sectionsSkipped).toBe(1);
+
+		// Original title should be preserved
+		const existing = await db
+			.selectFrom("_emdash_sections")
+			.selectAll()
+			.where("slug", "=", "newsletter-cta")
+			.executeTakeFirst();
+
+		expect(existing?.title).toBe("Existing Newsletter");
+	});
+
+	it("should return empty result when no wp_block posts", async () => {
+		const posts: WxrPost[] = [
+			{
+				id: 1,
+				title: "Regular Post",
+				postName: "regular-post",
+				postType: "post",
+				status: "publish",
+				content: "<p>Hello</p>",
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+		];
+
+		const result = await importReusableBlocksAsSections(posts, db);
+
+		expect(result.sectionsCreated).toBe(0);
+		expect(result.sectionsSkipped).toBe(0);
+		expect(result.errors).toHaveLength(0);
+	});
+
+	it("should convert Gutenberg content to Portable Text", async () => {
+		const posts: WxrPost[] = [
+			{
+				id: 100,
+				title: "Test Block",
+				postName: "test-block",
+				postType: "wp_block",
+				status: "publish",
+				content: `<!-- wp:paragraph -->
+<p>Hello <strong>world</strong>!</p>
+<!-- /wp:paragraph -->`,
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+		];
+
+		await importReusableBlocksAsSections(posts, db);
+
+		const section = await db
+			.selectFrom("_emdash_sections")
+			.selectAll()
+			.where("slug", "=", "test-block")
+			.executeTakeFirst();
+
+		const content = JSON.parse(section?.content ?? "[]");
+
+		expect(content).toBeInstanceOf(Array);
+		expect(content.length).toBeGreaterThan(0);
+		expect(content[0]._type).toBe("block");
+	});
+
+	it("should generate slug from title if postName is missing", async () => {
+		const posts: WxrPost[] = [
+			{
+				id: 100,
+				title: "My Custom Block Title",
+				postName: undefined as unknown as string,
+				postType: "wp_block",
+				status: "publish",
+				content: "<p>Test</p>",
+				categories: [],
+				tags: [],
+				meta: new Map(),
+			},
+		];
+
+		await importReusableBlocksAsSections(posts, db);
+
+		const section = await db.selectFrom("_emdash_sections").selectAll().executeTakeFirst();
+
+		expect(section?.slug).toBe("my-custom-block-title");
+	});
+});

packages/core/tests/unit/import/ssrf.test.ts

@@ -0,0 +1,405 @@
+/**
+ * Tests for SSRF protection in import/ssrf.ts
+ *
+ * Covers:
+ * - IPv4-mapped IPv6 hex normalization (#58)
+ * - Private IP detection across all forms
+ * - validateExternalUrl blocking internal targets
+ */
+
+import { describe, it, expect } from "vitest";
+
+import {
+	validateExternalUrl,
+	SsrfError,
+	normalizeIPv6MappedToIPv4,
+} from "../../../src/import/ssrf.js";
+
+describe("validateExternalUrl", () => {
+	// =========================================================================
+	// Basic validation
+	// =========================================================================
+
+	it("accepts valid external URLs", () => {
+		expect(validateExternalUrl("https://example.com")).toBeInstanceOf(URL);
+		expect(validateExternalUrl("https://wordpress.org/feed")).toBeInstanceOf(URL);
+		expect(validateExternalUrl("http://93.184.216.34/path")).toBeInstanceOf(URL);
+	});
+
+	it("rejects non-http schemes", () => {
+		expect(() => validateExternalUrl("ftp://example.com")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("file:///etc/passwd")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("javascript:alert(1)")).toThrow(SsrfError);
+	});
+
+	it("rejects invalid URLs", () => {
+		expect(() => validateExternalUrl("not a url")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("")).toThrow(SsrfError);
+	});
+
+	// =========================================================================
+	// Blocked hostnames
+	// =========================================================================
+
+	it("blocks localhost", () => {
+		expect(() => validateExternalUrl("http://localhost/path")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://localhost:8080")).toThrow(SsrfError);
+	});
+
+	it("blocks metadata endpoints", () => {
+		expect(() => validateExternalUrl("http://metadata.google.internal/")).toThrow(SsrfError);
+	});
+
+	// =========================================================================
+	// IPv4 private ranges
+	// =========================================================================
+
+	it("blocks loopback (127.0.0.0/8)", () => {
+		expect(() => validateExternalUrl("http://127.0.0.1/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://127.255.255.255/")).toThrow(SsrfError);
+	});
+
+	it("blocks private 10.0.0.0/8", () => {
+		expect(() => validateExternalUrl("http://10.0.0.1/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://10.255.255.255/")).toThrow(SsrfError);
+	});
+
+	it("blocks private 172.16.0.0/12", () => {
+		expect(() => validateExternalUrl("http://172.16.0.1/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://172.31.255.255/")).toThrow(SsrfError);
+	});
+
+	it("blocks private 192.168.0.0/16", () => {
+		expect(() => validateExternalUrl("http://192.168.0.1/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://192.168.255.255/")).toThrow(SsrfError);
+	});
+
+	it("blocks link-local (169.254.0.0/16) including cloud metadata", () => {
+		expect(() => validateExternalUrl("http://169.254.169.254/latest/meta-data/")).toThrow(
+			SsrfError,
+		);
+		expect(() => validateExternalUrl("http://169.254.0.1/")).toThrow(SsrfError);
+	});
+
+	// =========================================================================
+	// IPv6 loopback
+	// =========================================================================
+
+	it("blocks IPv6 loopback [::1]", () => {
+		expect(() => validateExternalUrl("http://[::1]/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://[::1]:8080/")).toThrow(SsrfError);
+	});
+
+	// =========================================================================
+	// Issue #58: IPv4-mapped IPv6 in hex form
+	//
+	// The WHATWG URL parser normalizes [::ffff:127.0.0.1] to [::ffff:7f00:1].
+	// Before the fix, the hex form bypassed isPrivateIp() because the regex
+	// only matched dotted-decimal.
+	// =========================================================================
+
+	it("blocks IPv4-mapped IPv6 loopback in hex form [::ffff:7f00:1]", () => {
+		// This is the normalized form of [::ffff:127.0.0.1]
+		expect(() => validateExternalUrl("http://[::ffff:7f00:1]/evil")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-mapped IPv6 cloud metadata [::ffff:a9fe:a9fe]", () => {
+		// This is the normalized form of [::ffff:169.254.169.254]
+		expect(() => validateExternalUrl("http://[::ffff:a9fe:a9fe]/latest/meta-data/")).toThrow(
+			SsrfError,
+		);
+	});
+
+	it("blocks IPv4-mapped IPv6 private 10.x [::ffff:a00:1]", () => {
+		// This is the normalized form of [::ffff:10.0.0.1]
+		expect(() => validateExternalUrl("http://[::ffff:a00:1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-mapped IPv6 private 192.168.x [::ffff:c0a8:1]", () => {
+		// This is the normalized form of [::ffff:192.168.0.1]
+		expect(() => validateExternalUrl("http://[::ffff:c0a8:1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-mapped IPv6 private 172.16.x [::ffff:ac10:1]", () => {
+		// This is the normalized form of [::ffff:172.16.0.1]
+		expect(() => validateExternalUrl("http://[::ffff:ac10:1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-mapped IPv6 in dotted-decimal form", () => {
+		// The dotted-decimal form should also be blocked (it worked before too)
+		// The URL parser normalizes this to hex, so this exercises the same path
+		expect(() => validateExternalUrl("http://[::ffff:127.0.0.1]/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://[::ffff:169.254.169.254]/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://[::ffff:10.0.0.1]/")).toThrow(SsrfError);
+	});
+
+	it("allows IPv4-mapped IPv6 for public IPs", () => {
+		// [::ffff:93.184.216.34] -> hex form after URL parsing
+		// 93 = 0x5d, 184 = 0xb8 -> 0x5db8
+		// 216 = 0xd8, 34 = 0x22 -> 0xd822
+		// So [::ffff:5db8:d822] should be allowed
+		expect(validateExternalUrl("http://[::ffff:5db8:d822]/")).toBeInstanceOf(URL);
+	});
+
+	// =========================================================================
+	// IPv4-compatible (deprecated) addresses: ::XXXX:XXXX (no ffff prefix)
+	//
+	// [::127.0.0.1] normalizes to [::7f00:1] which has no ffff prefix.
+	// Without the fix, these bypass all ffff-based checks.
+	// =========================================================================
+
+	it("blocks IPv4-compatible loopback [::7f00:1]", () => {
+		// Normalized form of [::127.0.0.1]
+		expect(() => validateExternalUrl("http://[::7f00:1]/evil")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-compatible cloud metadata [::a9fe:a9fe]", () => {
+		// Normalized form of [::169.254.169.254]
+		expect(() => validateExternalUrl("http://[::a9fe:a9fe]/latest/meta-data/")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-compatible private 10.x [::a00:1]", () => {
+		// Normalized form of [::10.0.0.1]
+		expect(() => validateExternalUrl("http://[::a00:1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv4-compatible private 192.168.x [::c0a8:1]", () => {
+		// Normalized form of [::192.168.0.1]
+		expect(() => validateExternalUrl("http://[::c0a8:1]/")).toThrow(SsrfError);
+	});
+
+	it("allows IPv4-compatible public IPs [::5db8:d822]", () => {
+		// 93.184.216.34 in hex
+		expect(validateExternalUrl("http://[::5db8:d822]/")).toBeInstanceOf(URL);
+	});
+
+	// =========================================================================
+	// NAT64 prefix: 64:ff9b::XXXX:XXXX
+	//
+	// [64:ff9b::127.0.0.1] normalizes to [64:ff9b::7f00:1].
+	// NAT64 gateways embed IPv4 in IPv6 using this well-known prefix.
+	// =========================================================================
+
+	it("blocks NAT64 loopback [64:ff9b::7f00:1]", () => {
+		expect(() => validateExternalUrl("http://[64:ff9b::7f00:1]/evil")).toThrow(SsrfError);
+	});
+
+	it("blocks NAT64 cloud metadata [64:ff9b::a9fe:a9fe]", () => {
+		expect(() => validateExternalUrl("http://[64:ff9b::a9fe:a9fe]/latest/meta-data/")).toThrow(
+			SsrfError,
+		);
+	});
+
+	it("blocks NAT64 private 10.x [64:ff9b::a00:1]", () => {
+		expect(() => validateExternalUrl("http://[64:ff9b::a00:1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks NAT64 private 192.168.x [64:ff9b::c0a8:1]", () => {
+		expect(() => validateExternalUrl("http://[64:ff9b::c0a8:1]/")).toThrow(SsrfError);
+	});
+
+	it("allows NAT64 public IPs [64:ff9b::5db8:d822]", () => {
+		expect(validateExternalUrl("http://[64:ff9b::5db8:d822]/")).toBeInstanceOf(URL);
+	});
+
+	// =========================================================================
+	// IPv6 link-local and ULA
+	// =========================================================================
+
+	it("blocks IPv6 link-local (fe80::)", () => {
+		expect(() => validateExternalUrl("http://[fe80::1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks IPv6 unique local (fc00::/fd00::)", () => {
+		expect(() => validateExternalUrl("http://[fc00::1]/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://[fd00::1]/")).toThrow(SsrfError);
+	});
+
+	it("blocks 0.0.0.0/8 range", () => {
+		expect(() => validateExternalUrl("http://0.0.0.0/")).toThrow(SsrfError);
+		expect(() => validateExternalUrl("http://0.0.0.1/")).toThrow(SsrfError);
+	});
+});
+
+// =============================================================================
+// normalizeIPv6MappedToIPv4 — direct unit tests (#58)
+//
+// This function converts IPv4-mapped/translated IPv6 hex addresses back to
+// dotted-decimal IPv4 so they can be checked against private ranges. Without
+// it, the WHATWG URL parser's hex normalization bypasses SSRF protection.
+// =============================================================================
+
+describe("normalizeIPv6MappedToIPv4", () => {
+	// =========================================================================
+	// Standard hex-form: ::ffff:XXXX:XXXX
+	// =========================================================================
+
+	it("converts loopback ::ffff:7f00:1 -> 127.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:7f00:1")).toBe("127.0.0.1");
+	});
+
+	it("converts cloud metadata ::ffff:a9fe:a9fe -> 169.254.169.254", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:a9fe:a9fe")).toBe("169.254.169.254");
+	});
+
+	it("converts private 10.x ::ffff:a00:1 -> 10.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:a00:1")).toBe("10.0.0.1");
+	});
+
+	it("converts private 192.168.x ::ffff:c0a8:1 -> 192.168.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:c0a8:1")).toBe("192.168.0.1");
+	});
+
+	it("converts private 172.16.x ::ffff:ac10:1 -> 172.16.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:ac10:1")).toBe("172.16.0.1");
+	});
+
+	it("converts public IP ::ffff:5db8:d822 -> 93.184.216.34", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:5db8:d822")).toBe("93.184.216.34");
+	});
+
+	// =========================================================================
+	// Edge values
+	// =========================================================================
+
+	it("converts ::ffff:0:0 -> 0.0.0.0", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:0:0")).toBe("0.0.0.0");
+	});
+
+	it("converts ::ffff:ffff:ffff -> 255.255.255.255", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:ffff:ffff")).toBe("255.255.255.255");
+	});
+
+	it("converts 4-digit hex groups correctly ::ffff:c612:e3a -> 198.18.14.58", () => {
+		// 0xc612 = 198*256 + 18 = 50706
+		// 0x0e3a = 14*256 + 58 = 3642
+		expect(normalizeIPv6MappedToIPv4("::ffff:c612:e3a")).toBe("198.18.14.58");
+	});
+
+	// =========================================================================
+	// Case insensitivity
+	// =========================================================================
+
+	it("handles uppercase hex digits", () => {
+		expect(normalizeIPv6MappedToIPv4("::FFFF:7F00:1")).toBe("127.0.0.1");
+	});
+
+	it("handles mixed case hex digits", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:A9FE:a9fe")).toBe("169.254.169.254");
+	});
+
+	// =========================================================================
+	// Bracket-wrapped form returns null (brackets stripped by caller)
+	// validateExternalUrl strips brackets before calling isPrivateIp,
+	// so normalizeIPv6MappedToIPv4 never receives bracketed input.
+	// =========================================================================
+
+	it("returns null for bracketed input (brackets stripped by caller)", () => {
+		expect(normalizeIPv6MappedToIPv4("[::ffff:7f00:1]")).toBeNull();
+		expect(normalizeIPv6MappedToIPv4("[::ffff:a9fe:a9fe]")).toBeNull();
+	});
+
+	// =========================================================================
+	// IPv4-translated (RFC 6052): ::ffff:0:XXXX:XXXX
+	// =========================================================================
+
+	it("converts translated form ::ffff:0:7f00:1 -> 127.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:0:7f00:1")).toBe("127.0.0.1");
+	});
+
+	it("converts translated form ::ffff:0:a9fe:a9fe -> 169.254.169.254", () => {
+		expect(normalizeIPv6MappedToIPv4("::ffff:0:a9fe:a9fe")).toBe("169.254.169.254");
+	});
+
+	// =========================================================================
+	// Fully expanded form: 0000:0000:0000:0000:0000:ffff:XXXX:XXXX
+	// =========================================================================
+
+	it("converts expanded form 0:0:0:0:0:ffff:7f00:1 -> 127.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("0:0:0:0:0:ffff:7f00:1")).toBe("127.0.0.1");
+	});
+
+	it("converts expanded form 0000:0000:0000:0000:0000:ffff:a9fe:a9fe -> 169.254.169.254", () => {
+		expect(normalizeIPv6MappedToIPv4("0000:0000:0000:0000:0000:ffff:a9fe:a9fe")).toBe(
+			"169.254.169.254",
+		);
+	});
+
+	it("converts expanded form with mixed zero lengths", () => {
+		expect(normalizeIPv6MappedToIPv4("0:00:000:0000:0:ffff:a00:1")).toBe("10.0.0.1");
+	});
+
+	// =========================================================================
+	// IPv4-compatible (deprecated) form: ::XXXX:XXXX (no ffff prefix)
+	// =========================================================================
+
+	it("converts IPv4-compatible loopback ::7f00:1 -> 127.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::7f00:1")).toBe("127.0.0.1");
+	});
+
+	it("converts IPv4-compatible metadata ::a9fe:a9fe -> 169.254.169.254", () => {
+		expect(normalizeIPv6MappedToIPv4("::a9fe:a9fe")).toBe("169.254.169.254");
+	});
+
+	it("converts IPv4-compatible private ::a00:1 -> 10.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("::a00:1")).toBe("10.0.0.1");
+	});
+
+	it("converts IPv4-compatible public ::5db8:d822 -> 93.184.216.34", () => {
+		expect(normalizeIPv6MappedToIPv4("::5db8:d822")).toBe("93.184.216.34");
+	});
+
+	// =========================================================================
+	// NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
+	// =========================================================================
+
+	it("converts NAT64 loopback 64:ff9b::7f00:1 -> 127.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("64:ff9b::7f00:1")).toBe("127.0.0.1");
+	});
+
+	it("converts NAT64 metadata 64:ff9b::a9fe:a9fe -> 169.254.169.254", () => {
+		expect(normalizeIPv6MappedToIPv4("64:ff9b::a9fe:a9fe")).toBe("169.254.169.254");
+	});
+
+	it("converts NAT64 private 64:ff9b::a00:1 -> 10.0.0.1", () => {
+		expect(normalizeIPv6MappedToIPv4("64:ff9b::a00:1")).toBe("10.0.0.1");
+	});
+
+	it("converts NAT64 public 64:ff9b::5db8:d822 -> 93.184.216.34", () => {
+		expect(normalizeIPv6MappedToIPv4("64:ff9b::5db8:d822")).toBe("93.184.216.34");
+	});
+
+	// =========================================================================
+	// Non-matching inputs -> null
+	// =========================================================================
+
+	it("returns null for plain IPv4", () => {
+		expect(normalizeIPv6MappedToIPv4("127.0.0.1")).toBeNull();
+	});
+
+	it("returns null for IPv6 loopback ::1", () => {
+		expect(normalizeIPv6MappedToIPv4("::1")).toBeNull();
+	});
+
+	it("returns null for regular IPv6 address", () => {
+		expect(normalizeIPv6MappedToIPv4("2001:db8::1")).toBeNull();
+	});
+
+	it("returns null for link-local IPv6", () => {
+		expect(normalizeIPv6MappedToIPv4("fe80::1")).toBeNull();
+	});
+
+	it("returns null for hostnames", () => {
+		expect(normalizeIPv6MappedToIPv4("example.com")).toBeNull();
+		expect(normalizeIPv6MappedToIPv4("localhost")).toBeNull();
+	});
+
+	it("returns null for empty string", () => {
+		expect(normalizeIPv6MappedToIPv4("")).toBeNull();
+	});
+
+	it("returns null for dotted-decimal mapped form (handled separately)", () => {
+		// ::ffff:127.0.0.1 uses the dotted-decimal regex, not hex normalization
+		expect(normalizeIPv6MappedToIPv4("::ffff:127.0.0.1")).toBeNull();
+	});
+});

packages/core/tests/unit/import/wordpress-plugin-i18n.test.ts

@@ -0,0 +1,403 @@
+/**
+ * Tests for WPML/Polylang auto-detection in WordPress plugin import source.
+ *
+ * Verifies that the probe() and analyze() methods correctly extract and
+ * surface i18n detection from the EmDash Exporter plugin's API responses.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+import { wordpressPluginSource } from "../../../src/import/sources/wordpress-plugin.js";
+
+// ─── Mock fetch ──────────────────────────────────────────────────────────────
+
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+
+beforeEach(() => {
+	mockFetch.mockReset();
+});
+
+// ─── Fixtures ────────────────────────────────────────────────────────────────
+
+/** Minimal valid probe response without i18n */
+function makeProbeResponse(overrides: Record<string, unknown> = {}) {
+	return {
+		emdash_exporter: "1.0.0",
+		wordpress_version: "6.5",
+		site: {
+			title: "Test Site",
+			description: "A test site",
+			url: "https://example.com",
+			home: "https://example.com",
+			language: "en-US",
+			timezone: "UTC",
+		},
+		capabilities: {
+			application_passwords: true,
+			acf: false,
+			yoast: false,
+			rankmath: false,
+		},
+		post_types: [
+			{ name: "post", label: "Posts", count: 10 },
+			{ name: "page", label: "Pages", count: 5 },
+		],
+		media_count: 20,
+		endpoints: {},
+		auth_instructions: {
+			method: "application_passwords",
+			instructions: "Create an application password",
+		},
+		...overrides,
+	};
+}
+
+/** Minimal valid analyze response without i18n */
+function makeAnalyzeResponse(overrides: Record<string, unknown> = {}) {
+	return {
+		site: { title: "Test Site", url: "https://example.com" },
+		post_types: [
+			{
+				name: "post",
+				label: "Posts",
+				label_singular: "Post",
+				total: 10,
+				by_status: { publish: 8, draft: 2 },
+				supports: { title: true, editor: true, thumbnail: true },
+				taxonomies: ["category", "post_tag"],
+				custom_fields: [],
+				hierarchical: false,
+				has_archive: true,
+			},
+		],
+		taxonomies: [
+			{
+				name: "category",
+				label: "Categories",
+				hierarchical: true,
+				term_count: 5,
+				object_types: ["post"],
+			},
+			{
+				name: "post_tag",
+				label: "Tags",
+				hierarchical: false,
+				term_count: 12,
+				object_types: ["post"],
+			},
+		],
+		authors: [
+			{ id: 1, login: "admin", email: "admin@example.com", display_name: "Admin", post_count: 10 },
+		],
+		attachments: { count: 20, by_type: { "image/jpeg": 15, "image/png": 5 } },
+		...overrides,
+	};
+}
+
+// ─── Probe tests ─────────────────────────────────────────────────────────────
+
+describe("WordPress Plugin Source — i18n detection", () => {
+	describe("probe()", () => {
+		it("returns i18n when WPML is detected", async () => {
+			mockFetch.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify(
+						makeProbeResponse({
+							i18n: {
+								plugin: "wpml",
+								default_locale: "en",
+								locales: ["en", "fr", "de"],
+							},
+						}),
+					),
+					{ status: 200 },
+				),
+			);
+
+			const result = await wordpressPluginSource.probe!("https://example.com");
+
+			expect(result).not.toBeNull();
+			expect(result!.i18n).toEqual({
+				plugin: "wpml",
+				defaultLocale: "en",
+				locales: ["en", "fr", "de"],
+			});
+		});
+
+		it("returns i18n when Polylang is detected", async () => {
+			mockFetch.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify(
+						makeProbeResponse({
+							i18n: {
+								plugin: "polylang",
+								default_locale: "fr",
+								locales: ["fr", "en"],
+							},
+						}),
+					),
+					{ status: 200 },
+				),
+			);
+
+			const result = await wordpressPluginSource.probe!("https://example.com");
+
+			expect(result).not.toBeNull();
+			expect(result!.i18n).toEqual({
+				plugin: "polylang",
+				defaultLocale: "fr",
+				locales: ["fr", "en"],
+			});
+		});
+
+		it("returns undefined i18n when no multilingual plugin", async () => {
+			mockFetch.mockResolvedValueOnce(
+				new Response(JSON.stringify(makeProbeResponse()), { status: 200 }),
+			);
+
+			const result = await wordpressPluginSource.probe!("https://example.com");
+
+			expect(result).not.toBeNull();
+			expect(result!.i18n).toBeUndefined();
+		});
+
+		it("preserves other probe fields alongside i18n", async () => {
+			mockFetch.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify(
+						makeProbeResponse({
+							i18n: {
+								plugin: "wpml",
+								default_locale: "en",
+								locales: ["en", "es"],
+							},
+						}),
+					),
+					{ status: 200 },
+				),
+			);
+
+			const result = await wordpressPluginSource.probe!("https://example.com");
+
+			expect(result).not.toBeNull();
+			expect(result!.sourceId).toBe("wordpress-plugin");
+			expect(result!.confidence).toBe("definite");
+			expect(result!.detected.platform).toBe("wordpress");
+			expect(result!.preview?.posts).toBe(10);
+			expect(result!.i18n?.plugin).toBe("wpml");
+		});
+	});
+
+	// ─── Analyze tests ───────────────────────────────────────────────────────
+
+	describe("analyze()", () => {
+		it("returns i18n when WPML is detected", async () => {
+			mockFetch.mockImplementation(async (url: string) => {
+				if (url.includes("/analyze")) {
+					return new Response(
+						JSON.stringify(
+							makeAnalyzeResponse({
+								i18n: {
+									plugin: "wpml",
+									default_locale: "en",
+									locales: ["en", "fr", "de"],
+								},
+							}),
+						),
+						{ status: 200 },
+					);
+				}
+				// Media endpoint — return empty
+				return new Response(
+					JSON.stringify({ items: [], total: 0, pages: 0, page: 1, per_page: 100 }),
+					{ status: 200 },
+				);
+			});
+
+			const analysis = await wordpressPluginSource.analyze(
+				{ type: "url", url: "https://example.com", token: "test-token" },
+				{},
+			);
+
+			expect(analysis.i18n).toEqual({
+				plugin: "wpml",
+				defaultLocale: "en",
+				locales: ["en", "fr", "de"],
+			});
+		});
+
+		it("returns i18n when Polylang is detected", async () => {
+			mockFetch.mockImplementation(async (url: string) => {
+				if (url.includes("/analyze")) {
+					return new Response(
+						JSON.stringify(
+							makeAnalyzeResponse({
+								i18n: {
+									plugin: "polylang",
+									default_locale: "fr",
+									locales: ["fr", "en", "de"],
+								},
+							}),
+						),
+						{ status: 200 },
+					);
+				}
+				return new Response(
+					JSON.stringify({ items: [], total: 0, pages: 0, page: 1, per_page: 100 }),
+					{ status: 200 },
+				);
+			});
+
+			const analysis = await wordpressPluginSource.analyze(
+				{ type: "url", url: "https://example.com", token: "test-token" },
+				{},
+			);
+
+			expect(analysis.i18n).toEqual({
+				plugin: "polylang",
+				defaultLocale: "fr",
+				locales: ["fr", "en", "de"],
+			});
+		});
+
+		it("returns undefined i18n when no multilingual plugin", async () => {
+			mockFetch.mockImplementation(async (url: string) => {
+				if (url.includes("/analyze")) {
+					return new Response(JSON.stringify(makeAnalyzeResponse()), { status: 200 });
+				}
+				return new Response(
+					JSON.stringify({ items: [], total: 0, pages: 0, page: 1, per_page: 100 }),
+					{ status: 200 },
+				);
+			});
+
+			const analysis = await wordpressPluginSource.analyze(
+				{ type: "url", url: "https://example.com", token: "test-token" },
+				{},
+			);
+
+			expect(analysis.i18n).toBeUndefined();
+		});
+	});
+
+	// ─── Content fetch — locale/translationGroup passthrough ─────────────────
+
+	describe("fetchContent()", () => {
+		it("passes through locale and translationGroup from plugin posts", async () => {
+			mockFetch.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						items: [
+							{
+								id: 1,
+								post_type: "post",
+								status: "publish",
+								slug: "hello-world",
+								title: "Hello World",
+								content: "",
+								excerpt: "",
+								date: "2024-01-01T00:00:00",
+								date_gmt: "2024-01-01T00:00:00",
+								modified: "2024-01-01T00:00:00",
+								modified_gmt: "2024-01-01T00:00:00",
+								author: null,
+								parent: null,
+								menu_order: 0,
+								taxonomies: {},
+								meta: {},
+								locale: "en",
+								translation_group: "group-1",
+							},
+							{
+								id: 2,
+								post_type: "post",
+								status: "publish",
+								slug: "bonjour-le-monde",
+								title: "Bonjour le monde",
+								content: "",
+								excerpt: "",
+								date: "2024-01-01T00:00:00",
+								date_gmt: "2024-01-01T00:00:00",
+								modified: "2024-01-01T00:00:00",
+								modified_gmt: "2024-01-01T00:00:00",
+								author: null,
+								parent: null,
+								menu_order: 0,
+								taxonomies: {},
+								meta: {},
+								locale: "fr",
+								translation_group: "group-1",
+							},
+						],
+						total: 2,
+						pages: 1,
+						page: 1,
+						per_page: 100,
+					}),
+					{ status: 200 },
+				),
+			);
+
+			const items = [];
+			for await (const item of wordpressPluginSource.fetchContent(
+				{ type: "url", url: "https://example.com", token: "test-token" },
+				{ postTypes: ["post"] },
+			)) {
+				items.push(item);
+			}
+
+			expect(items).toHaveLength(2);
+			expect(items[0]!.locale).toBe("en");
+			expect(items[0]!.translationGroup).toBe("group-1");
+			expect(items[1]!.locale).toBe("fr");
+			expect(items[1]!.translationGroup).toBe("group-1");
+		});
+
+		it("returns undefined locale/translationGroup when not present", async () => {
+			mockFetch.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						items: [
+							{
+								id: 1,
+								post_type: "post",
+								status: "publish",
+								slug: "hello",
+								title: "Hello",
+								content: "",
+								excerpt: "",
+								date: "2024-01-01T00:00:00",
+								date_gmt: "2024-01-01T00:00:00",
+								modified: "2024-01-01T00:00:00",
+								modified_gmt: "2024-01-01T00:00:00",
+								author: null,
+								parent: null,
+								menu_order: 0,
+								taxonomies: {},
+								meta: {},
+							},
+						],
+						total: 1,
+						pages: 1,
+						page: 1,
+						per_page: 100,
+					}),
+					{ status: 200 },
+				),
+			);
+
+			const items = [];
+			for await (const item of wordpressPluginSource.fetchContent(
+				{ type: "url", url: "https://example.com", token: "test-token" },
+				{ postTypes: ["post"] },
+			)) {
+				items.push(item);
+			}
+
+			expect(items).toHaveLength(1);
+			expect(items[0]!.locale).toBeUndefined();
+			expect(items[0]!.translationGroup).toBeUndefined();
+		});
+	});
+});

packages/core/tests/unit/import/wp-prepare-schema.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Tests for WordPress import prepare schema validation
+ *
+ * Regression test for #167: wpPrepareBody schema defined fields as z.record()
+ * but all producers (analyzer, admin UI) send an array of ImportFieldDef.
+ */
+
+import { describe, expect, it } from "vitest";
+
+import { wpPrepareBody } from "../../../src/api/schemas/import.js";
+
+describe("wpPrepareBody schema", () => {
+	it("accepts fields as an array of ImportFieldDef objects", () => {
+		const input = {
+			postTypes: [
+				{
+					name: "post",
+					collection: "posts",
+					fields: [
+						{
+							slug: "content",
+							label: "Content",
+							type: "portableText",
+							required: true,
+							searchable: true,
+						},
+						{
+							slug: "excerpt",
+							label: "Excerpt",
+							type: "text",
+							required: false,
+						},
+					],
+				},
+			],
+		};
+
+		const result = wpPrepareBody.safeParse(input);
+		expect(result.success).toBe(true);
+	});
+
+	it("accepts fields with optional searchable property", () => {
+		const input = {
+			postTypes: [
+				{
+					name: "page",
+					collection: "pages",
+					fields: [
+						{
+							slug: "featured_image",
+							label: "Featured Image",
+							type: "image",
+							required: false,
+						},
+					],
+				},
+			],
+		};
+
+		const result = wpPrepareBody.safeParse(input);
+		expect(result.success).toBe(true);
+	});
+
+	it("accepts postTypes without fields (optional)", () => {
+		const input = {
+			postTypes: [
+				{
+					name: "post",
+					collection: "posts",
+				},
+			],
+		};
+
+		const result = wpPrepareBody.safeParse(input);
+		expect(result.success).toBe(true);
+	});
+
+	it("rejects fields with missing required properties", () => {
+		const input = {
+			postTypes: [
+				{
+					name: "post",
+					collection: "posts",
+					fields: [
+						{
+							slug: "content",
+							// missing label, type, required
+						},
+					],
+				},
+			],
+		};
+
+		const result = wpPrepareBody.safeParse(input);
+		expect(result.success).toBe(false);
+	});
+
+	it("accepts multiple postTypes with fields", () => {
+		const input = {
+			postTypes: [
+				{
+					name: "post",
+					collection: "posts",
+					fields: [
+						{
+							slug: "content",
+							label: "Content",
+							type: "portableText",
+							required: true,
+							searchable: true,
+						},
+					],
+				},
+				{
+					name: "page",
+					collection: "pages",
+					fields: [
+						{
+							slug: "content",
+							label: "Content",
+							type: "portableText",
+							required: true,
+							searchable: true,
+						},
+						{
+							slug: "featured_image",
+							label: "Featured Image",
+							type: "image",
+							required: false,
+						},
+					],
+				},
+			],
+		};
+
+		const result = wpPrepareBody.safeParse(input);
+		expect(result.success).toBe(true);
+	});
+});

packages/core/tests/unit/loader-cursor-pagination.test.ts

@@ -0,0 +1,223 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { handleContentCreate } from "../../src/api/index.js";
+import { decodeCursor } from "../../src/database/repositories/types.js";
+import type { Database } from "../../src/database/types.js";
+import { emdashLoader } from "../../src/loader.js";
+import { runWithContext } from "../../src/request-context.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../utils/test-db.js";
+
+describe("Loader cursor pagination", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	async function createPublishedPost(title: string) {
+		const result = await handleContentCreate(db, "post", {
+			data: { title },
+			status: "published",
+		});
+		if (!result.success) throw new Error("Failed to create post");
+		return result.data!.item;
+	}
+
+	it("should return nextCursor when there are more results", async () => {
+		for (let i = 1; i <= 5; i++) {
+			await createPublishedPost(`Post ${i}`);
+		}
+
+		const loader = emdashLoader();
+		const result = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({ filter: { type: "post", limit: 3 } }),
+		);
+
+		expect(result.entries).toHaveLength(3);
+		expect(result.nextCursor).toBeTruthy();
+
+		// Verify the cursor is a valid encoded cursor
+		const decoded = decodeCursor(result.nextCursor!);
+		expect(decoded).not.toBeNull();
+		expect(decoded!.orderValue).toBeTruthy();
+		expect(decoded!.id).toBeTruthy();
+	});
+
+	it("should not return nextCursor when all results fit in one page", async () => {
+		await createPublishedPost("Post 1");
+		await createPublishedPost("Post 2");
+
+		const loader = emdashLoader();
+		const result = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({ filter: { type: "post", limit: 10 } }),
+		);
+
+		expect(result.entries).toHaveLength(2);
+		expect(result.nextCursor).toBeUndefined();
+	});
+
+	it("should not return nextCursor when no limit is set", async () => {
+		for (let i = 1; i <= 3; i++) {
+			await createPublishedPost(`Post ${i}`);
+		}
+
+		const loader = emdashLoader();
+		const result = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({ filter: { type: "post" } }),
+		);
+
+		expect(result.entries).toHaveLength(3);
+		expect(result.nextCursor).toBeUndefined();
+	});
+
+	it("should paginate through all results using cursor", async () => {
+		for (let i = 1; i <= 5; i++) {
+			await createPublishedPost(`Post ${i}`);
+		}
+
+		const loader = emdashLoader();
+
+		// First page
+		const page1 = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({ filter: { type: "post", limit: 2 } }),
+		);
+		expect(page1.entries).toHaveLength(2);
+		expect(page1.nextCursor).toBeTruthy();
+
+		// Second page
+		const page2 = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({
+				filter: { type: "post", limit: 2, cursor: page1.nextCursor },
+			}),
+		);
+		expect(page2.entries).toHaveLength(2);
+		expect(page2.nextCursor).toBeTruthy();
+
+		// Third page (last item)
+		const page3 = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({
+				filter: { type: "post", limit: 2, cursor: page2.nextCursor },
+			}),
+		);
+		expect(page3.entries).toHaveLength(1);
+		expect(page3.nextCursor).toBeUndefined();
+
+		// Verify no overlap between pages
+		const allIds = [
+			...page1.entries!.map((e) => e.data.id),
+			...page2.entries!.map((e) => e.data.id),
+			...page3.entries!.map((e) => e.data.id),
+		];
+		const uniqueIds = new Set(allIds);
+		expect(uniqueIds.size).toBe(5);
+	});
+
+	it("should maintain sort order across pages", async () => {
+		// Create posts with different titles to test ascending sort
+		const titles = ["Delta", "Alpha", "Echo", "Bravo", "Charlie"];
+		for (const title of titles) {
+			await createPublishedPost(title);
+		}
+
+		const loader = emdashLoader();
+
+		// Paginate with ascending title order
+		const allEntries: Array<{ data: Record<string, unknown> }> = [];
+		let cursor: string | undefined;
+
+		for (let page = 0; page < 10; page++) {
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({
+					filter: {
+						type: "post",
+						limit: 2,
+						cursor,
+						orderBy: { title: "asc" },
+					},
+				}),
+			);
+			allEntries.push(...result.entries!);
+			cursor = result.nextCursor;
+			if (!cursor) break;
+		}
+
+		expect(allEntries).toHaveLength(5);
+		const sortedTitles = allEntries.map((e) => e.data.title);
+		expect(sortedTitles).toEqual(["Alpha", "Bravo", "Charlie", "Delta", "Echo"]);
+	});
+
+	it("should return empty entries with no nextCursor for empty collection", async () => {
+		const loader = emdashLoader();
+		const result = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({ filter: { type: "post", limit: 10 } }),
+		);
+
+		expect(result.entries).toHaveLength(0);
+		expect(result.nextCursor).toBeUndefined();
+	});
+
+	it("should handle invalid cursor gracefully", async () => {
+		for (let i = 1; i <= 3; i++) {
+			await createPublishedPost(`Post ${i}`);
+		}
+
+		const loader = emdashLoader();
+
+		// Invalid cursor should be ignored (no cursor condition applied)
+		const result = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({
+				filter: { type: "post", limit: 10, cursor: "not-a-valid-cursor" },
+			}),
+		);
+
+		// Should return all entries since the invalid cursor is ignored
+		expect(result.entries).toHaveLength(3);
+	});
+
+	it("should work with limit of 1", async () => {
+		for (let i = 1; i <= 3; i++) {
+			await createPublishedPost(`Post ${i}`);
+		}
+
+		const loader = emdashLoader();
+		const allEntries: Array<{ data: Record<string, unknown> }> = [];
+		let cursor: string | undefined;
+
+		// Page through one at a time
+		for (let page = 0; page < 10; page++) {
+			const result = await runWithContext({ editMode: false, db }, () =>
+				loader.loadCollection!({
+					filter: { type: "post", limit: 1, cursor },
+				}),
+			);
+			allEntries.push(...result.entries!);
+			cursor = result.nextCursor;
+			if (!cursor) break;
+		}
+
+		expect(allEntries).toHaveLength(3);
+		const uniqueIds = new Set(allEntries.map((e) => e.data.id));
+		expect(uniqueIds.size).toBe(3);
+	});
+
+	it("should include nextCursor in collection-level return alongside cacheHint", async () => {
+		for (let i = 1; i <= 3; i++) {
+			await createPublishedPost(`Post ${i}`);
+		}
+
+		const loader = emdashLoader();
+		const result = await runWithContext({ editMode: false, db }, () =>
+			loader.loadCollection!({ filter: { type: "post", limit: 2 } }),
+		);
+
+		// Both cacheHint and nextCursor should be present
+		expect(result.cacheHint).toBeDefined();
+		expect(result.cacheHint!.tags).toEqual(["post"]);
+		expect(result.nextCursor).toBeTruthy();
+	});
+});

packages/core/tests/unit/loader-revision-preview.test.ts

@@ -0,0 +1,121 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { handleContentCreate } from "../../src/api/index.js";
+import { ContentRepository } from "../../src/database/repositories/content.js";
+import { RevisionRepository } from "../../src/database/repositories/revision.js";
+import type { Database } from "../../src/database/types.js";
+import { emdashLoader } from "../../src/loader.js";
+import { runWithContext } from "../../src/request-context.js";
+import { setupTestDatabaseWithCollections, teardownTestDatabase } from "../utils/test-db.js";
+
+describe("Loader revision preview", () => {
+	let db: Kysely<Database>;
+	let revisionRepo: RevisionRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabaseWithCollections();
+		revisionRepo = new RevisionRepository(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	async function createPublishedPost(title: string) {
+		const result = await handleContentCreate(db, "post", {
+			data: { title },
+			status: "published",
+		});
+		if (!result.success) throw new Error("Failed to create post");
+		return result.data!.item;
+	}
+
+	it("should return Date objects for system date fields in revision preview", async () => {
+		const post = await createPublishedPost("Test Post");
+
+		// Publish the post to set published_at
+		const contentRepo = new ContentRepository(db);
+		await contentRepo.publish("post", post.id);
+
+		// Create a revision (simulating a draft edit)
+		const revision = await revisionRepo.create({
+			collection: "post",
+			entryId: post.id,
+			data: { title: "Draft Title" },
+		});
+
+		const loader = emdashLoader();
+		const slug = post.slug!;
+		const result = await runWithContext({ editMode: true, db }, () =>
+			loader.loadEntry!({ filter: { type: "post", id: slug, revisionId: revision.id } }),
+		);
+
+		expect(result).toBeDefined();
+		expect(result).not.toHaveProperty("error");
+		const data = (result as { data: Record<string, unknown> }).data;
+
+		// These must be Date objects, not ISO strings
+		expect(data.createdAt).toBeInstanceOf(Date);
+		expect(data.updatedAt).toBeInstanceOf(Date);
+		expect(data.publishedAt).toBeInstanceOf(Date);
+	});
+
+	it("should return null for unpopulated date fields in revision preview", async () => {
+		// Create a draft post (no publishedAt)
+		const createResult = await handleContentCreate(db, "post", {
+			data: { title: "Draft Post" },
+			status: "draft",
+		});
+		if (!createResult.success) throw new Error("Failed to create post");
+		const post = createResult.data!.item;
+
+		const revision = await revisionRepo.create({
+			collection: "post",
+			entryId: post.id,
+			data: { title: "Updated Draft" },
+		});
+
+		const loader = emdashLoader();
+		const slug = post.slug!;
+		const entry = await runWithContext({ editMode: true, db }, () =>
+			loader.loadEntry!({ filter: { type: "post", id: slug, revisionId: revision.id } }),
+		);
+
+		expect(entry).toBeDefined();
+		expect(entry).not.toHaveProperty("error");
+		const data = (entry as { data: Record<string, unknown> }).data;
+
+		// Draft posts have no publishedAt
+		expect(data.publishedAt).toBeNull();
+		// But createdAt and updatedAt should still be Date objects
+		expect(data.createdAt).toBeInstanceOf(Date);
+		expect(data.updatedAt).toBeInstanceOf(Date);
+	});
+
+	it("should use revision content fields while preserving system date types", async () => {
+		const post = await createPublishedPost("Original Title");
+
+		const revision = await revisionRepo.create({
+			collection: "post",
+			entryId: post.id,
+			data: { title: "Revised Title" },
+		});
+
+		const loader = emdashLoader();
+		const slug = post.slug!;
+		const entry = await runWithContext({ editMode: true, db }, () =>
+			loader.loadEntry!({ filter: { type: "post", id: slug, revisionId: revision.id } }),
+		);
+
+		expect(entry).toBeDefined();
+		expect(entry).not.toHaveProperty("error");
+		const data = (entry as { data: Record<string, unknown> }).data;
+
+		// Content from revision
+		expect(data.title).toBe("Revised Title");
+		// System dates from content table, as Date objects
+		expect(data.createdAt).toBeInstanceOf(Date);
+		expect(data.updatedAt).toBeInstanceOf(Date);
+	});
+});

packages/core/tests/unit/mcp/authorization.test.ts

@@ -0,0 +1,861 @@
+/**
+ * MCP Authorization Tests
+ *
+ * Verifies that MCP tools enforce ownership checks and role requirements,
+ * mirroring the REST API's authorization patterns.
+ *
+ * Tests use the MCP Client/Server SDK with InMemoryTransport, injecting
+ * authInfo to simulate different users and roles.
+ */
+
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { Role } from "@emdashcms/auth";
+import type { RoleLevel } from "@emdashcms/auth";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import type { EmDashHandlers } from "../../../src/astro/types.js";
+import { createMcpServer } from "../../../src/mcp/server.js";
+
+// ---------------------------------------------------------------------------
+// Test constants
+// ---------------------------------------------------------------------------
+
+const INSUFFICIENT_PERMISSIONS_RE = /Insufficient permissions/i;
+const INSUFFICIENT_SCOPE_RE = /Insufficient scope/i;
+const NO_AUTHOR_ID_RE = /content has no authorId/i;
+
+const AUTHOR_USER_ID = "user_author";
+const OTHER_USER_ID = "user_other";
+const CONTENT_ID = "01CONTENT";
+const CONTENT_SLUG = "test-post";
+const REVISION_ID = "01REVISION";
+const MEDIA_ID = "01MEDIA";
+
+// ---------------------------------------------------------------------------
+// Mock EmDashHandlers
+// ---------------------------------------------------------------------------
+
+/** Create a minimal mock EmDashHandlers that returns content owned by `ownerId`. */
+function createMockHandlers(ownerId: string = AUTHOR_USER_ID): EmDashHandlers {
+	const contentItem = {
+		id: CONTENT_ID,
+		slug: "test-post",
+		authorId: ownerId,
+		status: "draft",
+		title: "Test",
+		createdAt: new Date().toISOString(),
+		updatedAt: new Date().toISOString(),
+	};
+
+	const mediaItem = {
+		id: MEDIA_ID,
+		filename: "test.png",
+		authorId: ownerId,
+		mimeType: "image/png",
+		size: 1024,
+	};
+
+	return {
+		db: {} as EmDashHandlers["db"],
+		invalidateManifest: vi.fn(),
+		handleContentGet: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem, _rev: "rev1" },
+		}),
+		handleContentGetIncludingTrashed: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: { ...contentItem, status: "trashed" } },
+		}),
+		handleContentList: vi.fn().mockResolvedValue({
+			success: true,
+			data: { items: [contentItem] },
+		}),
+		handleContentCreate: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentUpdate: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentDelete: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentRestore: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentPermanentDelete: vi.fn().mockResolvedValue({
+			success: true,
+			data: { deleted: true },
+		}),
+		handleContentPublish: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: { ...contentItem, status: "published" } },
+		}),
+		handleContentUnpublish: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentSchedule: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: { ...contentItem, status: "scheduled" } },
+		}),
+		handleContentCompare: vi.fn().mockResolvedValue({
+			success: true,
+			data: { live: null, draft: contentItem, hasChanges: false },
+		}),
+		handleContentDiscardDraft: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentListTrashed: vi.fn().mockResolvedValue({
+			success: true,
+			data: { items: [] },
+		}),
+		handleContentDuplicate: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+		handleContentTranslations: vi.fn().mockResolvedValue({
+			success: true,
+			data: { translations: [] },
+		}),
+		handleMediaGet: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: mediaItem },
+		}),
+		handleMediaList: vi.fn().mockResolvedValue({
+			success: true,
+			data: { items: [mediaItem] },
+		}),
+		handleMediaUpdate: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: mediaItem },
+		}),
+		handleMediaDelete: vi.fn().mockResolvedValue({
+			success: true,
+			data: { deleted: true },
+		}),
+		handleRevisionList: vi.fn().mockResolvedValue({
+			success: true,
+			data: { items: [] },
+		}),
+		handleRevisionGet: vi.fn().mockResolvedValue({
+			success: true,
+			data: {
+				item: {
+					id: REVISION_ID,
+					collection: "post",
+					entryId: CONTENT_ID,
+					authorId: ownerId,
+					data: {},
+				},
+			},
+		}),
+		handleRevisionRestore: vi.fn().mockResolvedValue({
+			success: true,
+			data: { item: contentItem },
+		}),
+	} as unknown as EmDashHandlers;
+}
+
+// ---------------------------------------------------------------------------
+// Transport helper
+//
+// InMemoryTransport supports passing authInfo on send(). We create a
+// subclass that automatically injects authInfo on every message sent from
+// the client side, simulating the HTTP transport's auth injection.
+// ---------------------------------------------------------------------------
+
+class AuthInjectingTransport extends InMemoryTransport {
+	constructor(private authInfo: Record<string, unknown>) {
+		super();
+	}
+
+	override async send(
+		message: Parameters<InMemoryTransport["send"]>[0],
+		options?: Parameters<InMemoryTransport["send"]>[1],
+	): Promise<void> {
+		const existingExtra =
+			options?.authInfo && typeof options.authInfo === "object" && "extra" in options.authInfo
+				? (options.authInfo.extra as Record<string, unknown>)
+				: {};
+		return super.send(message, {
+			...options,
+			authInfo: {
+				token: "",
+				clientId: "test",
+				scopes: [],
+				...options?.authInfo,
+				extra: {
+					...this.authInfo,
+					...existingExtra,
+				},
+			},
+		});
+	}
+}
+
+/**
+ * Create a linked transport pair where the client side injects authInfo.
+ */
+function createAuthenticatedPair(authInfo: {
+	emdash: EmDashHandlers;
+	userId: string;
+	userRole: RoleLevel;
+	tokenScopes?: string[];
+}): [AuthInjectingTransport, InMemoryTransport] {
+	const clientTransport = new AuthInjectingTransport(authInfo);
+	const serverTransport = new InMemoryTransport();
+	// Link them (accessing private field)
+	(clientTransport as unknown as Record<string, unknown>)._otherTransport = serverTransport;
+	(serverTransport as unknown as Record<string, unknown>)._otherTransport = clientTransport;
+	return [clientTransport, serverTransport];
+}
+
+// ---------------------------------------------------------------------------
+// Test setup
+// ---------------------------------------------------------------------------
+
+async function setupMcpPair(opts: {
+	userId: string;
+	userRole: RoleLevel;
+	handlers?: EmDashHandlers;
+	tokenScopes?: string[];
+}): Promise<{ client: Client; cleanup: () => Promise<void> }> {
+	const handlers = opts.handlers ?? createMockHandlers();
+	const server = createMcpServer();
+	const [clientTransport, serverTransport] = createAuthenticatedPair({
+		emdash: handlers,
+		userId: opts.userId,
+		userRole: opts.userRole,
+		tokenScopes: opts.tokenScopes,
+	});
+
+	const client = new Client({ name: "test", version: "1.0" });
+
+	await server.connect(serverTransport);
+	await client.connect(clientTransport);
+
+	return {
+		client,
+		cleanup: async () => {
+			await client.close();
+			await server.close();
+		},
+	};
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("MCP Authorization", () => {
+	let client: Client;
+	let cleanup: () => Promise<void>;
+
+	afterEach(async () => {
+		if (cleanup) await cleanup();
+	});
+
+	// -----------------------------------------------------------------------
+	// Ownership checks: CONTRIBUTOR cannot modify others' content
+	// -----------------------------------------------------------------------
+
+	describe("content ownership enforcement", () => {
+		it("CONTRIBUTOR cannot update another user's content", async () => {
+			// Content owned by AUTHOR_USER_ID, caller is OTHER_USER_ID with CONTRIBUTOR role
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.CONTRIBUTOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "Hacked" },
+				},
+			});
+
+			// CONTRIBUTOR role is below AUTHOR minimum
+			expect(result.isError).toBe(true);
+			const text = (result.content as Array<{ text: string }>)[0]?.text ?? "";
+			expect(text).toMatch(INSUFFICIENT_PERMISSIONS_RE);
+		});
+
+		it("AUTHOR can update their own content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "My update" },
+				},
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentUpdate).toHaveBeenCalled();
+		});
+
+		it("AUTHOR cannot update another user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "Hacked" },
+				},
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentUpdate).not.toHaveBeenCalled();
+		});
+
+		it("EDITOR can update any user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.EDITOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "Editor update" },
+				},
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentUpdate).toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// content_delete ownership
+	// -----------------------------------------------------------------------
+
+	describe("content_delete ownership", () => {
+		it("AUTHOR can delete their own content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_delete",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentDelete).toHaveBeenCalled();
+		});
+
+		it("AUTHOR cannot delete another user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_delete",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentDelete).not.toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// content_permanent_delete: ADMIN only
+	// -----------------------------------------------------------------------
+
+	describe("content_permanent_delete requires ADMIN", () => {
+		it("EDITOR cannot permanently delete content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.EDITOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_permanent_delete",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentPermanentDelete).not.toHaveBeenCalled();
+		});
+
+		it("ADMIN can permanently delete content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.ADMIN,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_permanent_delete",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentPermanentDelete).toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// content_publish ownership
+	// -----------------------------------------------------------------------
+
+	describe("content_publish ownership", () => {
+		it("AUTHOR can publish their own content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_publish",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentPublish).toHaveBeenCalled();
+		});
+
+		it("AUTHOR cannot publish another user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_publish",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentPublish).not.toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// content_restore ownership
+	// -----------------------------------------------------------------------
+
+	describe("content_restore ownership", () => {
+		it("AUTHOR cannot restore another user's trashed content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_restore",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentRestore).not.toHaveBeenCalled();
+		});
+
+		it("EDITOR can restore any user's trashed content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.EDITOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_restore",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentRestore).toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// revision_restore ownership
+	// -----------------------------------------------------------------------
+
+	describe("revision_restore ownership", () => {
+		it("AUTHOR cannot restore revision on another user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "revision_restore",
+				arguments: { revisionId: REVISION_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleRevisionRestore).not.toHaveBeenCalled();
+		});
+
+		it("EDITOR can restore revision on any content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.EDITOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "revision_restore",
+				arguments: { revisionId: REVISION_ID },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleRevisionRestore).toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// Media ownership
+	// -----------------------------------------------------------------------
+
+	describe("media ownership enforcement", () => {
+		it("AUTHOR can update their own media", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "media_update",
+				arguments: { id: MEDIA_ID, alt: "Updated alt" },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleMediaUpdate).toHaveBeenCalled();
+		});
+
+		it("AUTHOR cannot update another user's media", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "media_update",
+				arguments: { id: MEDIA_ID, alt: "Hacked" },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleMediaUpdate).not.toHaveBeenCalled();
+		});
+
+		it("AUTHOR cannot delete another user's media", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "media_delete",
+				arguments: { id: MEDIA_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleMediaDelete).not.toHaveBeenCalled();
+		});
+
+		it("EDITOR can delete any user's media", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.EDITOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "media_delete",
+				arguments: { id: MEDIA_ID },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleMediaDelete).toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// Token scope enforcement
+	// -----------------------------------------------------------------------
+
+	describe("token scope enforcement", () => {
+		it("rejects content_update without content:write scope", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.ADMIN,
+				handlers,
+				tokenScopes: ["content:read"],
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "No scope" },
+				},
+			});
+
+			expect(result.isError).toBe(true);
+			const text = (result.content as Array<{ text: string }>)[0]?.text ?? "";
+			expect(text).toMatch(INSUFFICIENT_SCOPE_RE);
+		});
+
+		it("allows content_update with content:write scope", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+				tokenScopes: ["content:read", "content:write"],
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "Valid scope" },
+				},
+			});
+
+			expect(result.isError).toBeFalsy();
+		});
+
+		it("session auth (no tokenScopes) allows all scopes", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+				// No tokenScopes = session auth
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "Session auth" },
+				},
+			});
+
+			expect(result.isError).toBeFalsy();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// content_schedule ownership
+	// -----------------------------------------------------------------------
+
+	describe("content_schedule ownership", () => {
+		it("AUTHOR cannot schedule another user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_schedule",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					scheduledAt: "2030-01-01T00:00:00Z",
+				},
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentSchedule).not.toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// content_unpublish ownership
+	// -----------------------------------------------------------------------
+
+	describe("content_unpublish ownership", () => {
+		it("AUTHOR cannot unpublish another user's content", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: OTHER_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_unpublish",
+				arguments: { collection: "post", id: CONTENT_ID },
+			});
+
+			expect(result.isError).toBe(true);
+			expect(handlers.handleContentUnpublish).not.toHaveBeenCalled();
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// resolvedId: slug -> ULID resolution before handler calls
+	// -----------------------------------------------------------------------
+
+	describe("resolvedId passthrough", () => {
+		it("content_restore passes resolvedId (not slug) to handler", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_restore",
+				arguments: { collection: "post", id: CONTENT_SLUG },
+			});
+
+			expect(result.isError).toBeFalsy();
+			// The mock returns item.id = CONTENT_ID. The tool should resolve
+			// the slug to CONTENT_ID via extractContentId and pass that to the handler.
+			expect(handlers.handleContentRestore).toHaveBeenCalledWith("post", CONTENT_ID);
+		});
+
+		it("content_discard_draft passes resolvedId (not slug) to handler", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_discard_draft",
+				arguments: { collection: "post", id: CONTENT_SLUG },
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentDiscardDraft).toHaveBeenCalledWith("post", CONTENT_ID);
+		});
+
+		it("content_update passes resolvedId (not slug) to handler", async () => {
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_SLUG,
+					data: { title: "Updated" },
+				},
+			});
+
+			expect(result.isError).toBeFalsy();
+			expect(handlers.handleContentUpdate).toHaveBeenCalledWith(
+				"post",
+				CONTENT_ID,
+				expect.objectContaining({ data: { title: "Updated" } }),
+			);
+		});
+	});
+
+	// -----------------------------------------------------------------------
+	// extractContentAuthorId: missing authorId
+	// -----------------------------------------------------------------------
+
+	describe("missing authorId handling", () => {
+		it("returns clear error when content has no authorId", async () => {
+			// Create handlers where content has no authorId (e.g. imported content)
+			const handlers = createMockHandlers(AUTHOR_USER_ID);
+			const contentWithoutAuthor = {
+				id: CONTENT_ID,
+				slug: "imported-post",
+				status: "draft",
+				title: "Imported",
+				createdAt: new Date().toISOString(),
+				updatedAt: new Date().toISOString(),
+				// no authorId
+			};
+			handlers.handleContentGet = vi.fn().mockResolvedValue({
+				success: true,
+				data: { item: contentWithoutAuthor },
+			});
+
+			({ client, cleanup } = await setupMcpPair({
+				userId: AUTHOR_USER_ID,
+				userRole: Role.AUTHOR,
+				handlers,
+			}));
+
+			const result = await client.callTool({
+				name: "content_update",
+				arguments: {
+					collection: "post",
+					id: CONTENT_ID,
+					data: { title: "Should fail" },
+				},
+			});
+
+			expect(result.isError).toBe(true);
+			const text = (result.content as Array<{ text: string }>)[0]?.text ?? "";
+			expect(text).toMatch(NO_AUTHOR_ID_RE);
+		});
+	});
+});

packages/core/tests/unit/media/normalize.test.ts

@@ -0,0 +1,423 @@
+import { describe, it, expect, vi } from "vitest";
+
+import { normalizeMediaValue } from "../../../src/media/normalize.js";
+import type { MediaProvider, MediaProviderItem } from "../../../src/media/types.js";
+
+function mockProvider(getResult: MediaProviderItem | null = null): MediaProvider {
+	return {
+		list: vi.fn().mockResolvedValue({ items: [], nextCursor: undefined }),
+		get: vi.fn().mockResolvedValue(getResult),
+		getEmbed: vi.fn().mockReturnValue({ type: "image", src: "/test" }),
+	};
+}
+
+function getProvider(
+	providers: Record<string, MediaProvider>,
+): (id: string) => MediaProvider | undefined {
+	return (id: string) => providers[id];
+}
+
+describe("normalizeMediaValue", () => {
+	it("returns null for null input", async () => {
+		const result = await normalizeMediaValue(null, getProvider({}));
+		expect(result).toBeNull();
+	});
+
+	it("returns null for undefined input", async () => {
+		const result = await normalizeMediaValue(undefined, getProvider({}));
+		expect(result).toBeNull();
+	});
+
+	it("converts bare HTTP URL to external MediaValue", async () => {
+		const result = await normalizeMediaValue("https://example.com/photo.jpg", getProvider({}));
+		expect(result).toEqual({
+			provider: "external",
+			id: "",
+			src: "https://example.com/photo.jpg",
+		});
+	});
+
+	it("converts bare HTTPS URL to external MediaValue", async () => {
+		const result = await normalizeMediaValue("http://example.com/photo.jpg", getProvider({}));
+		expect(result).toEqual({
+			provider: "external",
+			id: "",
+			src: "http://example.com/photo.jpg",
+		});
+	});
+
+	it("converts bare internal media URL to full local MediaValue via provider", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			alt: "A photo",
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			"/_emdash/api/media/file/01ABC.jpg",
+			getProvider({ local }),
+		);
+
+		expect(local.get).toHaveBeenCalledWith("01ABC.jpg");
+		expect(result).toEqual({
+			provider: "local",
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			alt: "A photo",
+			meta: { storageKey: "01ABC.jpg" },
+		});
+	});
+
+	it("falls back to external for internal URL when local provider unavailable", async () => {
+		const result = await normalizeMediaValue(
+			"/_emdash/api/media/file/01ABC.jpg",
+			getProvider({}),
+		);
+		expect(result).toEqual({
+			provider: "external",
+			id: "",
+			src: "/_emdash/api/media/file/01ABC.jpg",
+		});
+	});
+
+	it("falls back to external for internal URL when provider.get returns null", async () => {
+		const local = mockProvider(null);
+		const result = await normalizeMediaValue(
+			"/_emdash/api/media/file/01ABC.jpg",
+			getProvider({ local }),
+		);
+		expect(result).toEqual({
+			provider: "external",
+			id: "",
+			src: "/_emdash/api/media/file/01ABC.jpg",
+		});
+	});
+
+	it("fills missing dimensions from local provider", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "local",
+				id: "01ABC",
+				alt: "My photo",
+				meta: { storageKey: "01ABC.jpg" },
+			},
+			getProvider({ local }),
+		);
+
+		expect(local.get).toHaveBeenCalledWith("01ABC");
+		expect(result).toMatchObject({
+			provider: "local",
+			id: "01ABC",
+			width: 1200,
+			height: 800,
+			alt: "My photo",
+			meta: { storageKey: "01ABC.jpg" },
+		});
+	});
+
+	it("fills missing storageKey from local provider", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "local",
+				id: "01ABC",
+				width: 1200,
+				height: 800,
+			},
+			getProvider({ local }),
+		);
+
+		expect(local.get).toHaveBeenCalledWith("01ABC");
+		expect(result).toMatchObject({
+			provider: "local",
+			id: "01ABC",
+			meta: { storageKey: "01ABC.jpg" },
+		});
+	});
+
+	it("fills missing mimeType and filename from local provider", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "local",
+				id: "01ABC",
+				width: 1200,
+				height: 800,
+				meta: { storageKey: "01ABC.jpg" },
+			},
+			getProvider({ local }),
+		);
+
+		expect(result).toMatchObject({
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+		});
+	});
+
+	it("fills dimensions from external provider", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "cf-abc123",
+			filename: "hero.jpg",
+			mimeType: "image/jpeg",
+			width: 1920,
+			height: 1080,
+			meta: { variants: ["public"] },
+		};
+		const cfImages = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "cloudflare-images",
+				id: "cf-abc123",
+				alt: "Hero banner",
+				previewUrl: "https://imagedelivery.net/hash/cf-abc123/w=400",
+			},
+			getProvider({ "cloudflare-images": cfImages }),
+		);
+
+		expect(cfImages.get).toHaveBeenCalledWith("cf-abc123");
+		expect(result).toMatchObject({
+			provider: "cloudflare-images",
+			id: "cf-abc123",
+			width: 1920,
+			height: 1080,
+			alt: "Hero banner",
+			previewUrl: "https://imagedelivery.net/hash/cf-abc123/w=400",
+		});
+	});
+
+	it("does not call provider when dimensions already present", async () => {
+		const cfImages = mockProvider(null);
+
+		const value = {
+			provider: "cloudflare-images",
+			id: "cf-abc123",
+			width: 1920,
+			height: 1080,
+			filename: "hero.jpg",
+			mimeType: "image/jpeg",
+			alt: "Hero banner",
+			previewUrl: "https://imagedelivery.net/hash/cf-abc123/w=400",
+			meta: { variants: ["public"] },
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({ "cloudflare-images": cfImages }));
+
+		expect(cfImages.get).not.toHaveBeenCalled();
+		expect(result).toEqual(value);
+	});
+
+	it("preserves caller alt over provider alt", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			alt: "Provider alt text",
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "local",
+				id: "01ABC",
+				alt: "User alt text",
+			},
+			getProvider({ local }),
+		);
+
+		expect(result!.alt).toBe("User alt text");
+	});
+
+	it("uses provider alt when caller alt is not set", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			alt: "Provider alt text",
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "local",
+				id: "01ABC",
+			},
+			getProvider({ local }),
+		);
+
+		expect(result!.alt).toBe("Provider alt text");
+	});
+
+	it("returns value as-is for unknown provider", async () => {
+		const value = {
+			provider: "some-unknown-provider",
+			id: "item-123",
+			width: 800,
+			height: 600,
+			alt: "Some image",
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({}));
+		expect(result).toEqual(value);
+	});
+
+	it("does not fail when provider.get returns null", async () => {
+		const local = mockProvider(null);
+
+		const value = {
+			provider: "local",
+			id: "01ABC",
+			alt: "My photo",
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({ local }));
+		expect(result).toEqual(value);
+	});
+
+	it("does not fail when provider has no get method", async () => {
+		const local: MediaProvider = {
+			list: vi.fn().mockResolvedValue({ items: [] }),
+			getEmbed: vi.fn().mockReturnValue({ type: "image", src: "/test" }),
+			// no get method
+		};
+
+		const value = {
+			provider: "local",
+			id: "01ABC",
+			alt: "My photo",
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({ local }));
+		expect(result).toEqual(value);
+	});
+
+	it("returns external value with src as-is (no dimension detection)", async () => {
+		const value = {
+			provider: "external",
+			id: "",
+			src: "https://example.com/photo.jpg",
+			alt: "A photo",
+			width: 800,
+			height: 600,
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({}));
+		expect(result).toEqual(value);
+	});
+
+	it("does not call provider for external values without dimensions", async () => {
+		const value = {
+			provider: "external",
+			id: "",
+			src: "https://example.com/photo.jpg",
+			alt: "A photo",
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({}));
+		expect(result).toEqual(value);
+	});
+
+	it("strips src from local media values", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue(
+			{
+				provider: "local",
+				id: "01ABC",
+				src: "/_emdash/api/media/file/01ABC.jpg",
+				alt: "My photo",
+				width: 1200,
+				height: 800,
+				meta: { storageKey: "01ABC.jpg" },
+			},
+			getProvider({ local }),
+		);
+
+		// src should be removed for local media - it's derived at display time
+		expect(result!.src).toBeUndefined();
+	});
+
+	it("defaults provider to local when not specified", async () => {
+		const providerItem: MediaProviderItem = {
+			id: "01ABC",
+			filename: "photo.jpg",
+			mimeType: "image/jpeg",
+			width: 1200,
+			height: 800,
+			meta: { storageKey: "01ABC.jpg" },
+		};
+		const local = mockProvider(providerItem);
+
+		const result = await normalizeMediaValue({ id: "01ABC" }, getProvider({ local }));
+
+		expect(result!.provider).toBe("local");
+		expect(local.get).toHaveBeenCalledWith("01ABC");
+	});
+
+	it("handles provider.get throwing gracefully", async () => {
+		const local: MediaProvider = {
+			list: vi.fn().mockResolvedValue({ items: [] }),
+			get: vi.fn().mockRejectedValue(new Error("DB error")),
+			getEmbed: vi.fn().mockReturnValue({ type: "image", src: "/test" }),
+		};
+
+		const value = {
+			provider: "local",
+			id: "01ABC",
+			alt: "My photo",
+		};
+
+		const result = await normalizeMediaValue(value, getProvider({ local }));
+		expect(result).toEqual(value);
+	});
+});

packages/core/tests/unit/media/placeholder.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect } from "vitest";
+
+import { generatePlaceholder } from "../../../src/media/placeholder.js";
+
+const CSS_RGB_PATTERN = /^rgb\(\d+,\s?\d+,\s?\d+\)$/;
+
+/** Minimal 4x4 solid red JPEG */
+const JPEG_4x4 = Buffer.from(
+	"/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCAAEAAQDAREAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACP/EABQQAQAAAAAAAAAAAAAAAAAAAAD/xAAVAQEBAAAAAAAAAAAAAAAAAAAHCf/EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhEDEQA/ADoDFU3/2Q==",
+	"base64",
+);
+
+/** Minimal 4x4 solid red PNG */
+const PNG_4x4 = Buffer.from(
+	"iVBORw0KGgoAAAANSUhEUgAAAAQAAAAEAQMAAACTPww9AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGUExURf8AAP///0EdNBEAAAABYktHRAH/Ai3eAAAAB3RJTUUH6gIcETMVn1ZhnwAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyNi0wMi0yOFQxNzo1MToyMCswMDowMJE6EiQAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjYtMDItMjhUMTc6NTE6MjArMDA6MDDgZ6qYAAAAKHRFWHRkYXRlOnRpbWVzdGFtcAAyMDI2LTAyLTI4VDE3OjUxOjIwKzAwOjAwt3KLRwAAAAtJREFUCNdjYIAAAAAIAAEvIN0xAAAAAElFTkSuQmCC",
+	"base64",
+);
+
+/** 100x100 solid blue JPEG (for downsampling test) */
+const JPEG_100x100 = Buffer.from(
+	"/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCABkAGQDAREAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAn/xAAUEAEAAAAAAAAAAAAAAAAAAAAA/8QAFgEBAQEAAAAAAAAAAAAAAAAAAAYJ/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8Anu1TQ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//2Q==",
+	"base64",
+);
+
+describe("generatePlaceholder", () => {
+	it("generates blurhash and dominantColor from a JPEG", async () => {
+		const result = await generatePlaceholder(new Uint8Array(JPEG_4x4), "image/jpeg");
+
+		expect(result).not.toBeNull();
+		expect(result!.blurhash).toBeTruthy();
+		expect(typeof result!.blurhash).toBe("string");
+		expect(result!.dominantColor).toBeTruthy();
+		expect(typeof result!.dominantColor).toBe("string");
+	});
+
+	it("generates blurhash and dominantColor from a PNG", async () => {
+		const result = await generatePlaceholder(new Uint8Array(PNG_4x4), "image/png");
+
+		expect(result).not.toBeNull();
+		expect(result!.blurhash).toBeTruthy();
+		expect(result!.dominantColor).toBeTruthy();
+	});
+
+	it("returns a valid CSS color string for dominantColor", async () => {
+		const result = await generatePlaceholder(new Uint8Array(JPEG_4x4), "image/jpeg");
+
+		expect(result).not.toBeNull();
+		// Should be rgb() format from rgbColorToCssString
+		expect(result!.dominantColor).toMatch(CSS_RGB_PATTERN);
+	});
+
+	it("returns null for non-image MIME types", async () => {
+		const buffer = new Uint8Array([0, 1, 2, 3]);
+		const result = await generatePlaceholder(buffer, "application/pdf");
+
+		expect(result).toBeNull();
+	});
+
+	it("returns null for unsupported image types", async () => {
+		const buffer = new Uint8Array([0, 1, 2, 3]);
+		const result = await generatePlaceholder(buffer, "image/svg+xml");
+
+		expect(result).toBeNull();
+	});
+
+	it("returns null for corrupt image data", async () => {
+		const buffer = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, 0, 0, 0]);
+		const result = await generatePlaceholder(buffer, "image/jpeg");
+
+		expect(result).toBeNull();
+	});
+
+	it("handles larger images by downsampling", async () => {
+		const result = await generatePlaceholder(new Uint8Array(JPEG_100x100), "image/jpeg");
+
+		expect(result).not.toBeNull();
+		expect(result!.blurhash).toBeTruthy();
+		// Blurhash string length should be reasonable (not huge from 100x100)
+		expect(result!.blurhash.length).toBeLessThan(50);
+	});
+});

packages/core/tests/unit/menus/menus.test.ts

@@ -0,0 +1,341 @@
+import type { Kysely } from "kysely";
+import { ulid } from "ulidx";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { createDatabase } from "../../../src/database/connection.js";
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database } from "../../../src/database/types.js";
+import { getMenuWithDb, getMenusWithDb } from "../../../src/menus/index.js";
+
+describe("Navigation Menus", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		// Fresh in-memory database for each test
+		db = createDatabase({ url: ":memory:" });
+		await runMigrations(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	describe("migration", () => {
+		it("should create _emdash_menus table", async () => {
+			const tables = await db.introspection.getTables();
+			const menusTable = tables.find((t) => t.name === "_emdash_menus");
+			expect(menusTable).toBeDefined();
+
+			const columns = menusTable!.columns.map((c) => c.name);
+			expect(columns).toContain("id");
+			expect(columns).toContain("name");
+			expect(columns).toContain("label");
+			expect(columns).toContain("created_at");
+			expect(columns).toContain("updated_at");
+		});
+
+		it("should create _emdash_menu_items table", async () => {
+			const tables = await db.introspection.getTables();
+			const itemsTable = tables.find((t) => t.name === "_emdash_menu_items");
+			expect(itemsTable).toBeDefined();
+
+			const columns = itemsTable!.columns.map((c) => c.name);
+			expect(columns).toContain("id");
+			expect(columns).toContain("menu_id");
+			expect(columns).toContain("parent_id");
+			expect(columns).toContain("sort_order");
+			expect(columns).toContain("type");
+			expect(columns).toContain("reference_collection");
+			expect(columns).toContain("reference_id");
+			expect(columns).toContain("custom_url");
+			expect(columns).toContain("label");
+			expect(columns).toContain("target");
+			expect(columns).toContain("css_classes");
+		});
+
+		it("should enforce unique constraint on menu name", async () => {
+			const id1 = ulid();
+			const id2 = ulid();
+
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: id1,
+					name: "primary",
+					label: "Primary Navigation",
+				})
+				.execute();
+
+			await expect(
+				db
+					.insertInto("_emdash_menus")
+					.values({
+						id: id2,
+						name: "primary",
+						label: "Primary Again",
+					})
+					.execute(),
+			).rejects.toThrow();
+		});
+
+		it("should cascade delete menu items when menu is deleted", async () => {
+			const menuId = ulid();
+			const itemId = ulid();
+
+			// Create menu
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: menuId,
+					name: "test-menu",
+					label: "Test Menu",
+				})
+				.execute();
+
+			// Create menu item
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: itemId,
+					menu_id: menuId,
+					sort_order: 0,
+					type: "custom",
+					custom_url: "https://example.com",
+					label: "Test Link",
+				})
+				.execute();
+
+			// Delete menu
+			await db.deleteFrom("_emdash_menus").where("id", "=", menuId).execute();
+
+			// Verify item was deleted
+			const items = await db
+				.selectFrom("_emdash_menu_items")
+				.where("menu_id", "=", menuId)
+				.selectAll()
+				.execute();
+
+			expect(items).toHaveLength(0);
+		});
+	});
+
+	describe("getMenus", () => {
+		it("should return empty array when no menus exist", async () => {
+			const menus = await getMenusWithDb(db);
+			expect(menus).toEqual([]);
+		});
+
+		it("should return all menus ordered by name", async () => {
+			await db
+				.insertInto("_emdash_menus")
+				.values([
+					{ id: ulid(), name: "footer", label: "Footer Links" },
+					{ id: ulid(), name: "primary", label: "Primary Navigation" },
+					{ id: ulid(), name: "social", label: "Social Links" },
+				])
+				.execute();
+
+			const menus = await getMenusWithDb(db);
+			expect(menus).toHaveLength(3);
+			expect(menus[0].name).toBe("footer");
+			expect(menus[1].name).toBe("primary");
+			expect(menus[2].name).toBe("social");
+		});
+	});
+
+	describe("getMenu", () => {
+		it("should return null for non-existent menu", async () => {
+			const menu = await getMenuWithDb("nonexistent", db);
+			expect(menu).toBeNull();
+		});
+
+		it("should return menu with empty items array", async () => {
+			const menuId = ulid();
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: menuId,
+					name: "primary",
+					label: "Primary Navigation",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu).toMatchObject({
+				id: menuId,
+				name: "primary",
+				label: "Primary Navigation",
+				items: [],
+			});
+		});
+
+		it("should resolve custom URLs correctly", async () => {
+			const menuId = ulid();
+			const itemId = ulid();
+
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: menuId,
+					name: "primary",
+					label: "Primary Navigation",
+				})
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: itemId,
+					menu_id: menuId,
+					sort_order: 0,
+					type: "custom",
+					custom_url: "https://github.com",
+					label: "GitHub",
+					target: "_blank",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu).not.toBeNull();
+			expect(menu!.items).toHaveLength(1);
+			expect(menu!.items[0]).toMatchObject({
+				id: itemId,
+				label: "GitHub",
+				url: "https://github.com",
+				target: "_blank",
+			});
+		});
+
+		it("should skip items with deleted content references", async () => {
+			const menuId = ulid();
+			const itemId = ulid();
+
+			// Create menu with item referencing non-existent content
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: menuId,
+					name: "primary",
+					label: "Primary Navigation",
+				})
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: itemId,
+					menu_id: menuId,
+					sort_order: 0,
+					type: "page",
+					reference_collection: "pages",
+					reference_id: "nonexistent",
+					label: "Deleted Page",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu).not.toBeNull();
+			// Item should be filtered out because the page doesn't exist
+			expect(menu!.items).toHaveLength(0);
+		});
+
+		it("should build nested tree structure", async () => {
+			const menuId = ulid();
+			const parentId = ulid();
+			const childId = ulid();
+
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: menuId,
+					name: "primary",
+					label: "Primary Navigation",
+				})
+				.execute();
+
+			// Create parent item
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: parentId,
+					menu_id: menuId,
+					sort_order: 0,
+					type: "custom",
+					custom_url: "/about",
+					label: "About",
+				})
+				.execute();
+
+			// Create child item
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: childId,
+					menu_id: menuId,
+					parent_id: parentId,
+					sort_order: 0,
+					type: "custom",
+					custom_url: "/about/team",
+					label: "Team",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu).not.toBeNull();
+			expect(menu!.items).toHaveLength(1);
+			expect(menu!.items[0].label).toBe("About");
+			expect(menu!.items[0].children).toHaveLength(1);
+			expect(menu!.items[0].children[0].label).toBe("Team");
+		});
+
+		it("should order items by sort_order", async () => {
+			const menuId = ulid();
+
+			await db
+				.insertInto("_emdash_menus")
+				.values({
+					id: menuId,
+					name: "primary",
+					label: "Primary Navigation",
+				})
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values([
+					{
+						id: ulid(),
+						menu_id: menuId,
+						sort_order: 2,
+						type: "custom",
+						custom_url: "/contact",
+						label: "Contact",
+					},
+					{
+						id: ulid(),
+						menu_id: menuId,
+						sort_order: 0,
+						type: "custom",
+						custom_url: "/home",
+						label: "Home",
+					},
+					{
+						id: ulid(),
+						menu_id: menuId,
+						sort_order: 1,
+						type: "custom",
+						custom_url: "/about",
+						label: "About",
+					},
+				])
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu).not.toBeNull();
+			expect(menu!.items).toHaveLength(3);
+			expect(menu!.items[0].label).toBe("Home");
+			expect(menu!.items[1].label).toBe("About");
+			expect(menu!.items[2].label).toBe("Contact");
+		});
+	});
+});

packages/core/tests/unit/plugins/adapt-sandbox-entry.test.ts

@@ -0,0 +1,419 @@
+/**
+ * adaptSandboxEntry() Tests
+ *
+ * Tests the in-process adapter that converts standard-format plugins
+ * ({ hooks, routes }) into ResolvedPlugin instances compatible with HookPipeline.
+ *
+ */
+
+import { describe, it, expect, vi } from "vitest";
+
+import type { PluginDescriptor } from "../../../src/astro/integration/runtime.js";
+import { adaptSandboxEntry } from "../../../src/plugins/adapt-sandbox-entry.js";
+import type { StandardPluginDefinition, StandardHookHandler } from "../../../src/plugins/types.js";
+
+/** Create a properly typed mock hook handler */
+function mockHandler(): StandardHookHandler {
+	return vi.fn(async () => {}) as unknown as StandardHookHandler;
+}
+
+function createDescriptor(overrides?: Partial<PluginDescriptor>): PluginDescriptor {
+	return {
+		id: "test-plugin",
+		version: "1.0.0",
+		entrypoint: "@test/plugin",
+		format: "standard",
+		...overrides,
+	};
+}
+
+describe("adaptSandboxEntry", () => {
+	describe("basic adaptation", () => {
+		it("produces a ResolvedPlugin with correct id and version", () => {
+			const def: StandardPluginDefinition = {
+				hooks: {},
+				routes: {},
+			};
+			const descriptor = createDescriptor({ id: "my-plugin", version: "2.1.0" });
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.id).toBe("my-plugin");
+			expect(result.version).toBe("2.1.0");
+		});
+
+		it("adapts an empty definition", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.hooks).toEqual({});
+			expect(result.routes).toEqual({});
+			expect(result.capabilities).toEqual([]);
+			expect(result.allowedHosts).toEqual([]);
+			expect(result.storage).toEqual({});
+		});
+
+		it("carries capabilities from descriptor", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				capabilities: ["read:content", "network:fetch"],
+			});
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.capabilities).toEqual(["read:content", "network:fetch"]);
+		});
+
+		it("carries allowedHosts from descriptor", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				allowedHosts: ["api.example.com", "*.cdn.com"],
+			});
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.allowedHosts).toEqual(["api.example.com", "*.cdn.com"]);
+		});
+
+		it("carries storage config from descriptor", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				storage: {
+					events: { indexes: ["timestamp", "type"] },
+					logs: { indexes: ["level"] },
+				},
+			});
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.storage).toEqual({
+				events: { indexes: ["timestamp", "type"] },
+				logs: { indexes: ["level"] },
+			});
+		});
+
+		it("carries admin pages from descriptor", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				adminPages: [{ path: "/settings", label: "Settings", icon: "gear" }],
+			});
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.admin.pages).toEqual([{ path: "/settings", label: "Settings", icon: "gear" }]);
+		});
+
+		it("carries admin widgets from descriptor", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				adminWidgets: [{ id: "status", title: "Status", size: "half" }],
+			});
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.admin.widgets).toEqual([{ id: "status", title: "Status", size: "half" }]);
+		});
+	});
+
+	describe("hook adaptation", () => {
+		it("resolves a bare function hook with defaults", () => {
+			const handler = vi.fn();
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"content:afterSave": handler,
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			const hook = result.hooks["content:afterSave"];
+			expect(hook).toBeDefined();
+			expect(hook!.handler).toBe(handler);
+			expect(hook!.priority).toBe(100);
+			expect(hook!.timeout).toBe(5000);
+			expect(hook!.dependencies).toEqual([]);
+			expect(hook!.errorPolicy).toBe("abort");
+			expect(hook!.exclusive).toBe(false);
+			expect(hook!.pluginId).toBe("test-plugin");
+		});
+
+		it("resolves a config object hook with custom settings", () => {
+			const handler = vi.fn();
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"content:beforeSave": {
+						handler,
+						priority: 1,
+						timeout: 10000,
+						dependencies: ["other-plugin"],
+						errorPolicy: "continue",
+						exclusive: false,
+					},
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			const hook = result.hooks["content:beforeSave"];
+			expect(hook).toBeDefined();
+			expect(hook!.handler).toBe(handler);
+			expect(hook!.priority).toBe(1);
+			expect(hook!.timeout).toBe(10000);
+			expect(hook!.dependencies).toEqual(["other-plugin"]);
+			expect(hook!.errorPolicy).toBe("continue");
+		});
+
+		it("resolves multiple hooks", () => {
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"content:beforeSave": mockHandler(),
+					"content:afterSave": { handler: mockHandler(), priority: 200 },
+					"content:afterDelete": mockHandler(),
+					"media:afterUpload": mockHandler(),
+					"plugin:install": mockHandler(),
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.hooks["content:beforeSave"]).toBeDefined();
+			expect(result.hooks["content:afterSave"]).toBeDefined();
+			expect(result.hooks["content:afterDelete"]).toBeDefined();
+			expect(result.hooks["media:afterUpload"]).toBeDefined();
+			expect(result.hooks["plugin:install"]).toBeDefined();
+		});
+
+		it("sets pluginId on all hooks from descriptor", () => {
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"content:beforeSave": mockHandler(),
+					"content:afterSave": { handler: mockHandler() },
+				},
+			};
+			const descriptor = createDescriptor({ id: "my-plugin" });
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.hooks["content:beforeSave"]!.pluginId).toBe("my-plugin");
+			expect(result.hooks["content:afterSave"]!.pluginId).toBe("my-plugin");
+		});
+
+		it("resolves exclusive hooks", () => {
+			const handler = vi.fn();
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"email:deliver": {
+						handler,
+						exclusive: true,
+					},
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.hooks["email:deliver"]!.exclusive).toBe(true);
+		});
+
+		it("throws on unknown hook names", () => {
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"unknown:hook": mockHandler(),
+				},
+			};
+			const descriptor = createDescriptor();
+
+			expect(() => adaptSandboxEntry(def, descriptor)).toThrow("unknown hook");
+		});
+
+		it("applies default config for partial config objects", () => {
+			const handler = vi.fn();
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"content:afterSave": {
+						handler,
+						priority: 200,
+						// timeout, dependencies, errorPolicy, exclusive use defaults
+					},
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			const hook = result.hooks["content:afterSave"];
+			expect(hook!.priority).toBe(200);
+			expect(hook!.timeout).toBe(5000);
+			expect(hook!.dependencies).toEqual([]);
+			expect(hook!.errorPolicy).toBe("abort");
+			expect(hook!.exclusive).toBe(false);
+		});
+	});
+
+	describe("route adaptation", () => {
+		it("wraps standard two-arg route handler into single-arg RouteContext handler", async () => {
+			const standardHandler = vi.fn().mockResolvedValue({ ok: true });
+
+			const def: StandardPluginDefinition = {
+				routes: {
+					status: {
+						handler: standardHandler,
+					},
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.routes.status).toBeDefined();
+
+			// Simulate calling the adapted handler with a RouteContext-like object
+			const mockCtx = {
+				input: { foo: "bar" },
+				request: new Request("http://localhost/test"),
+				requestMeta: { ip: null, userAgent: null, referer: null, geo: null },
+				plugin: { id: "test-plugin", version: "1.0.0" },
+				kv: {} as any,
+				storage: {} as any,
+				log: {} as any,
+				site: { name: "", url: "", locale: "en" },
+				url: (p: string) => p,
+			};
+
+			await result.routes.status.handler(mockCtx as any);
+
+			// Verify the standard handler was called with (routeCtx, pluginCtx)
+			expect(standardHandler).toHaveBeenCalledTimes(1);
+			const [routeCtx, pluginCtx] = standardHandler.mock.calls[0];
+			expect(routeCtx.input).toEqual({ foo: "bar" });
+			expect(routeCtx.request).toBeDefined();
+			expect(routeCtx.requestMeta).toBeDefined();
+			// pluginCtx should be the stripped PluginContext (without route-specific fields)
+			expect(pluginCtx.plugin.id).toBe("test-plugin");
+			expect(pluginCtx.kv).toBeDefined();
+			expect(pluginCtx.log).toBeDefined();
+			// Route-specific fields should NOT leak into pluginCtx
+			expect(pluginCtx).not.toHaveProperty("input");
+			expect(pluginCtx).not.toHaveProperty("request");
+			expect(pluginCtx).not.toHaveProperty("requestMeta");
+		});
+
+		it("preserves public flag on routes", () => {
+			const def: StandardPluginDefinition = {
+				routes: {
+					webhook: {
+						handler: vi.fn(),
+						public: true,
+					},
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.routes.webhook.public).toBe(true);
+		});
+
+		it("adapts multiple routes", () => {
+			const def: StandardPluginDefinition = {
+				routes: {
+					status: { handler: vi.fn() },
+					sync: { handler: vi.fn() },
+					"admin/settings": { handler: vi.fn() },
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(Object.keys(result.routes)).toEqual(["status", "sync", "admin/settings"]);
+		});
+	});
+
+	describe("capability normalization", () => {
+		it("normalizes write:content to include read:content", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({ capabilities: ["write:content"] });
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.capabilities).toContain("write:content");
+			expect(result.capabilities).toContain("read:content");
+		});
+
+		it("normalizes write:media to include read:media", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({ capabilities: ["write:media"] });
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.capabilities).toContain("write:media");
+			expect(result.capabilities).toContain("read:media");
+		});
+
+		it("normalizes network:fetch:any to include network:fetch", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({ capabilities: ["network:fetch:any"] });
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			expect(result.capabilities).toContain("network:fetch:any");
+			expect(result.capabilities).toContain("network:fetch");
+		});
+
+		it("does not duplicate implied capabilities", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				capabilities: ["read:content", "write:content"],
+			});
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			const readCount = result.capabilities.filter((c) => c === "read:content").length;
+			expect(readCount).toBe(1);
+		});
+
+		it("throws on invalid capability", () => {
+			const def: StandardPluginDefinition = {};
+			const descriptor = createDescriptor({
+				capabilities: ["invalid:capability"],
+			});
+
+			expect(() => adaptSandboxEntry(def, descriptor)).toThrow("Invalid capability");
+		});
+	});
+
+	describe("integration with HookPipeline", () => {
+		it("produces hooks compatible with HookPipeline registration", () => {
+			// HookPipeline stores hooks as ResolvedHook<unknown> internally.
+			// The adapted hooks must have the expected shape.
+			const handler = vi.fn().mockResolvedValue(undefined);
+			const def: StandardPluginDefinition = {
+				hooks: {
+					"content:afterSave": {
+						handler,
+						priority: 50,
+					},
+				},
+			};
+			const descriptor = createDescriptor();
+
+			const result = adaptSandboxEntry(def, descriptor);
+
+			// Verify the hook shape matches what HookPipeline expects
+			const hook = result.hooks["content:afterSave"]!;
+			expect(typeof hook.handler).toBe("function");
+			expect(typeof hook.priority).toBe("number");
+			expect(typeof hook.timeout).toBe("number");
+			expect(Array.isArray(hook.dependencies)).toBe(true);
+			expect(typeof hook.errorPolicy).toBe("string");
+			expect(typeof hook.exclusive).toBe("boolean");
+			expect(typeof hook.pluginId).toBe("string");
+		});
+	});
+});

packages/core/tests/unit/plugins/define-plugin.test.ts

@@ -0,0 +1,435 @@
+/**
+ * definePlugin() Tests
+ *
+ * Tests the plugin definition helper for:
+ * - ID validation (simple and scoped formats)
+ * - Version validation (semver)
+ * - Capability validation and normalization
+ * - Hook resolution (function vs config object)
+ * - Default value handling
+ */
+
+import { describe, it, expect, vi } from "vitest";
+
+import { definePlugin } from "../../../src/plugins/define-plugin.js";
+
+// Error message patterns for test assertions
+const INVALID_PLUGIN_ID_PATTERN = /Invalid plugin id/;
+const INVALID_PLUGIN_VERSION_PATTERN = /Invalid plugin version/;
+const INVALID_CAPABILITY_PATTERN = /Invalid capability/;
+
+describe("definePlugin", () => {
+	describe("ID validation", () => {
+		it("accepts valid simple ID", () => {
+			const plugin = definePlugin({
+				id: "my-plugin",
+				version: "1.0.0",
+			});
+
+			expect(plugin.id).toBe("my-plugin");
+		});
+
+		it("accepts valid simple ID with numbers", () => {
+			const plugin = definePlugin({
+				id: "plugin-v2",
+				version: "1.0.0",
+			});
+
+			expect(plugin.id).toBe("plugin-v2");
+		});
+
+		it("accepts valid scoped ID", () => {
+			const plugin = definePlugin({
+				id: "@emdashcms/seo-plugin",
+				version: "1.0.0",
+			});
+
+			expect(plugin.id).toBe("@emdashcms/seo-plugin");
+		});
+
+		it("accepts scoped ID with numbers", () => {
+			const plugin = definePlugin({
+				id: "@my-org/plugin-v2",
+				version: "1.0.0",
+			});
+
+			expect(plugin.id).toBe("@my-org/plugin-v2");
+		});
+
+		it("rejects ID with uppercase letters", () => {
+			expect(() =>
+				definePlugin({
+					id: "MyPlugin",
+					version: "1.0.0",
+				}),
+			).toThrow(INVALID_PLUGIN_ID_PATTERN);
+		});
+
+		it("rejects ID with underscores", () => {
+			expect(() =>
+				definePlugin({
+					id: "my_plugin",
+					version: "1.0.0",
+				}),
+			).toThrow(INVALID_PLUGIN_ID_PATTERN);
+		});
+
+		it("rejects ID with spaces", () => {
+			expect(() =>
+				definePlugin({
+					id: "my plugin",
+					version: "1.0.0",
+				}),
+			).toThrow(INVALID_PLUGIN_ID_PATTERN);
+		});
+
+		it("rejects empty ID", () => {
+			expect(() =>
+				definePlugin({
+					id: "",
+					version: "1.0.0",
+				}),
+			).toThrow(INVALID_PLUGIN_ID_PATTERN);
+		});
+
+		it("rejects invalid scoped ID (missing name)", () => {
+			expect(() =>
+				definePlugin({
+					id: "@my-org/",
+					version: "1.0.0",
+				}),
+			).toThrow(INVALID_PLUGIN_ID_PATTERN);
+		});
+
+		it("rejects invalid scoped ID (missing scope)", () => {
+			expect(() =>
+				definePlugin({
+					id: "@/my-plugin",
+					version: "1.0.0",
+				}),
+			).toThrow(INVALID_PLUGIN_ID_PATTERN);
+		});
+	});
+
+	describe("version validation", () => {
+		it("accepts valid semver", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+			});
+
+			expect(plugin.version).toBe("1.0.0");
+		});
+
+		it("accepts semver with prerelease", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0-beta.1",
+			});
+
+			expect(plugin.version).toBe("1.0.0-beta.1");
+		});
+
+		it("accepts semver with build metadata", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0+build.123",
+			});
+
+			expect(plugin.version).toBe("1.0.0+build.123");
+		});
+
+		it("rejects invalid version format", () => {
+			expect(() =>
+				definePlugin({
+					id: "test",
+					version: "1.0",
+				}),
+			).toThrow(INVALID_PLUGIN_VERSION_PATTERN);
+		});
+
+		it("rejects non-numeric version", () => {
+			expect(() =>
+				definePlugin({
+					id: "test",
+					version: "latest",
+				}),
+			).toThrow(INVALID_PLUGIN_VERSION_PATTERN);
+		});
+	});
+
+	describe("capability validation", () => {
+		it("accepts valid capabilities", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				capabilities: ["read:content", "write:content", "network:fetch"],
+			});
+
+			expect(plugin.capabilities).toContain("read:content");
+			expect(plugin.capabilities).toContain("write:content");
+			expect(plugin.capabilities).toContain("network:fetch");
+		});
+
+		it("accepts read:media and write:media", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				capabilities: ["read:media", "write:media"],
+			});
+
+			expect(plugin.capabilities).toContain("read:media");
+			expect(plugin.capabilities).toContain("write:media");
+		});
+
+		it("rejects invalid capability", () => {
+			expect(() =>
+				definePlugin({
+					id: "test",
+					version: "1.0.0",
+					capabilities: ["invalid:capability" as any],
+				}),
+			).toThrow(INVALID_CAPABILITY_PATTERN);
+		});
+
+		it("normalizes write:content to include read:content", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				capabilities: ["write:content"],
+			});
+
+			expect(plugin.capabilities).toContain("write:content");
+			expect(plugin.capabilities).toContain("read:content");
+		});
+
+		it("normalizes write:media to include read:media", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				capabilities: ["write:media"],
+			});
+
+			expect(plugin.capabilities).toContain("write:media");
+			expect(plugin.capabilities).toContain("read:media");
+		});
+
+		it("does not duplicate read when already present", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				capabilities: ["read:content", "write:content"],
+			});
+
+			const readCount = plugin.capabilities.filter((c) => c === "read:content").length;
+			expect(readCount).toBe(1);
+		});
+
+		it("defaults to empty capabilities", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+			});
+
+			expect(plugin.capabilities).toEqual([]);
+		});
+	});
+
+	describe("hook resolution", () => {
+		it("resolves function shorthand to full config", () => {
+			const handler = vi.fn();
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				hooks: {
+					"content:beforeSave": handler,
+				},
+			});
+
+			const hook = plugin.hooks["content:beforeSave"];
+			expect(hook).toBeDefined();
+			expect(hook!.handler).toBe(handler);
+			expect(hook!.priority).toBe(100);
+			expect(hook!.timeout).toBe(5000);
+			expect(hook!.dependencies).toEqual([]);
+			expect(hook!.errorPolicy).toBe("abort");
+			expect(hook!.pluginId).toBe("test");
+		});
+
+		it("resolves full config object", () => {
+			const handler = vi.fn();
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				hooks: {
+					"content:beforeSave": {
+						handler,
+						priority: 50,
+						timeout: 10000,
+						dependencies: ["other-plugin"],
+						errorPolicy: "continue",
+					},
+				},
+			});
+
+			const hook = plugin.hooks["content:beforeSave"];
+			expect(hook).toBeDefined();
+			expect(hook!.handler).toBe(handler);
+			expect(hook!.priority).toBe(50);
+			expect(hook!.timeout).toBe(10000);
+			expect(hook!.dependencies).toEqual(["other-plugin"]);
+			expect(hook!.errorPolicy).toBe("continue");
+		});
+
+		it("applies defaults to partial config", () => {
+			const handler = vi.fn();
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				hooks: {
+					"content:afterSave": {
+						handler,
+						priority: 200,
+						// timeout, dependencies, errorPolicy use defaults
+					},
+				},
+			});
+
+			const hook = plugin.hooks["content:afterSave"];
+			expect(hook!.priority).toBe(200);
+			expect(hook!.timeout).toBe(5000);
+			expect(hook!.dependencies).toEqual([]);
+			expect(hook!.errorPolicy).toBe("abort");
+		});
+
+		it("resolves multiple hooks", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				hooks: {
+					"content:beforeSave": vi.fn(),
+					"content:afterSave": vi.fn(),
+					"plugin:install": vi.fn(),
+				},
+			});
+
+			expect(plugin.hooks["content:beforeSave"]).toBeDefined();
+			expect(plugin.hooks["content:afterSave"]).toBeDefined();
+			expect(plugin.hooks["plugin:install"]).toBeDefined();
+		});
+
+		it("sets pluginId on all resolved hooks", () => {
+			const plugin = definePlugin({
+				id: "my-plugin",
+				version: "1.0.0",
+				hooks: {
+					"content:beforeSave": vi.fn(),
+					"media:afterUpload": { handler: vi.fn(), priority: 50 },
+				},
+			});
+
+			expect(plugin.hooks["content:beforeSave"]!.pluginId).toBe("my-plugin");
+			expect(plugin.hooks["media:afterUpload"]!.pluginId).toBe("my-plugin");
+		});
+	});
+
+	describe("default values", () => {
+		it("defaults allowedHosts to empty array", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+			});
+
+			expect(plugin.allowedHosts).toEqual([]);
+		});
+
+		it("defaults storage to empty object", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+			});
+
+			expect(plugin.storage).toEqual({});
+		});
+
+		it("defaults hooks to empty object", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+			});
+
+			expect(plugin.hooks).toEqual({});
+		});
+
+		it("defaults routes to empty object", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+			});
+
+			expect(plugin.routes).toEqual({});
+		});
+
+		it("preserves provided allowedHosts", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				allowedHosts: ["api.example.com", "*.cdn.com"],
+			});
+
+			expect(plugin.allowedHosts).toEqual(["api.example.com", "*.cdn.com"]);
+		});
+
+		it("preserves provided storage config", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				storage: {
+					items: { indexes: ["type", "status"] },
+					cache: { indexes: ["key"] },
+				},
+			});
+
+			expect(plugin.storage).toEqual({
+				items: { indexes: ["type", "status"] },
+				cache: { indexes: ["key"] },
+			});
+		});
+	});
+
+	describe("routes passthrough", () => {
+		it("preserves route definitions", () => {
+			const handler = vi.fn();
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				routes: {
+					sync: { handler },
+					webhook: { handler, input: {} as any },
+				},
+			});
+
+			expect(plugin.routes.sync).toBeDefined();
+			expect(plugin.routes.sync.handler).toBe(handler);
+			expect(plugin.routes.webhook).toBeDefined();
+		});
+	});
+
+	describe("admin passthrough", () => {
+		it("preserves admin config", () => {
+			const plugin = definePlugin({
+				id: "test",
+				version: "1.0.0",
+				admin: {
+					entry: "@test/plugin/admin",
+					pages: [{ id: "settings", title: "Settings" }],
+					widgets: [{ id: "stats", title: "Stats", area: "dashboard" }],
+				},
+			});
+
+			expect(plugin.admin.entry).toBe("@test/plugin/admin");
+			expect(plugin.admin.pages).toHaveLength(1);
+			expect(plugin.admin.widgets).toHaveLength(1);
+		});
+	});
+});

packages/core/tests/unit/plugins/exclusive-hooks.test.ts

@@ -0,0 +1,761 @@
+/**
+ * Exclusive Hooks Tests
+ *
+ * Tests the exclusive hook system:
+ * - HookPipeline: registration/tracking, selection, invokeExclusiveHook
+ * - PluginManager.resolveExclusiveHooks(): single provider auto-select,
+ *   multi-provider no auto-select, stale selection clearing, preferred hints,
+ *   admin override beats preferred
+ * - Lifecycle: activate → auto-select, deactivate → clears stale selection
+ */
+
+import Database from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+import { extractManifest } from "../../../src/cli/commands/bundle-utils.js";
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database as DbSchema } from "../../../src/database/types.js";
+import { HookPipeline, resolveExclusiveHooks } from "../../../src/plugins/hooks.js";
+import { PluginManager } from "../../../src/plugins/manager.js";
+import { normalizeManifestHook } from "../../../src/plugins/manifest-schema.js";
+import type {
+	ResolvedPlugin,
+	ResolvedHook,
+	PluginDefinition,
+	ContentBeforeSaveHandler,
+	ContentAfterSaveHandler,
+} from "../../../src/plugins/types.js";
+
+// ---------------------------------------------------------------------------
+// Helpers — ResolvedPlugin (for HookPipeline tests)
+// ---------------------------------------------------------------------------
+
+function createTestPlugin(overrides: Partial<ResolvedPlugin> = {}): ResolvedPlugin {
+	return {
+		id: overrides.id ?? "test-plugin",
+		version: "1.0.0",
+		capabilities: ["write:content", "read:content"],
+		allowedHosts: [],
+		storage: {},
+		admin: {
+			pages: [],
+			widgets: [],
+		},
+		hooks: {},
+		routes: {},
+		...overrides,
+	};
+}
+
+function createTestHook<T>(
+	pluginId: string,
+	handler: T,
+	overrides: Partial<ResolvedHook<T>> = {},
+): ResolvedHook<T> {
+	return {
+		pluginId,
+		handler,
+		priority: 100,
+		timeout: 5000,
+		dependencies: [],
+		errorPolicy: "continue",
+		exclusive: false,
+		...overrides,
+	};
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — PluginDefinition (for PluginManager tests)
+// ---------------------------------------------------------------------------
+
+function createTestDefinition(overrides: Partial<PluginDefinition> = {}): PluginDefinition {
+	return {
+		id: overrides.id ?? "test-plugin",
+		version: "1.0.0",
+		capabilities: ["write:content", "read:content"],
+		...overrides,
+	};
+}
+
+// ---------------------------------------------------------------------------
+// HookPipeline — exclusive behaviour
+// ---------------------------------------------------------------------------
+
+describe("HookPipeline — exclusive hooks", () => {
+	it("tracks exclusive hook names during registration", () => {
+		const plugin = createTestPlugin({
+			id: "email-provider",
+			hooks: {
+				"content:beforeSave": createTestHook("email-provider", vi.fn(), {
+					exclusive: true,
+				}),
+			},
+		});
+
+		const pipeline = new HookPipeline([plugin]);
+
+		expect(pipeline.isExclusiveHook("content:beforeSave")).toBe(true);
+		expect(pipeline.isExclusiveHook("content:afterSave")).toBe(false);
+		expect(pipeline.getRegisteredExclusiveHooks()).toContain("content:beforeSave");
+	});
+
+	it("does not track non-exclusive hooks as exclusive", () => {
+		const plugin = createTestPlugin({
+			id: "normal-plugin",
+			hooks: {
+				"content:beforeSave": createTestHook("normal-plugin", vi.fn(), {
+					exclusive: false,
+				}),
+			},
+		});
+
+		const pipeline = new HookPipeline([plugin]);
+
+		expect(pipeline.isExclusiveHook("content:beforeSave")).toBe(false);
+		expect(pipeline.getRegisteredExclusiveHooks()).not.toContain("content:beforeSave");
+	});
+
+	it("returns providers for an exclusive hook", () => {
+		const plugin1 = createTestPlugin({
+			id: "provider-a",
+			hooks: {
+				"content:beforeSave": createTestHook("provider-a", vi.fn(), { exclusive: true }),
+			},
+		});
+		const plugin2 = createTestPlugin({
+			id: "provider-b",
+			hooks: {
+				"content:beforeSave": createTestHook("provider-b", vi.fn(), { exclusive: true }),
+			},
+		});
+
+		const pipeline = new HookPipeline([plugin1, plugin2]);
+
+		const providers = pipeline.getExclusiveHookProviders("content:beforeSave");
+		expect(providers).toHaveLength(2);
+		expect(providers.map((p) => p.pluginId)).toEqual(
+			expect.arrayContaining(["provider-a", "provider-b"]),
+		);
+	});
+
+	it("set/get/clear exclusive selection", () => {
+		const plugin = createTestPlugin({
+			id: "email-ses",
+			hooks: {
+				"content:beforeSave": createTestHook("email-ses", vi.fn(), { exclusive: true }),
+			},
+		});
+
+		const pipeline = new HookPipeline([plugin]);
+
+		expect(pipeline.getExclusiveSelection("content:beforeSave")).toBeUndefined();
+
+		pipeline.setExclusiveSelection("content:beforeSave", "email-ses");
+		expect(pipeline.getExclusiveSelection("content:beforeSave")).toBe("email-ses");
+
+		pipeline.clearExclusiveSelection("content:beforeSave");
+		expect(pipeline.getExclusiveSelection("content:beforeSave")).toBeUndefined();
+	});
+
+	it("invokeExclusiveHook returns null when no selection", async () => {
+		const handler = vi.fn().mockResolvedValue("result");
+		const plugin = createTestPlugin({
+			id: "provider-a",
+			hooks: {
+				"content:beforeSave": createTestHook("provider-a", handler, { exclusive: true }),
+			},
+		});
+
+		const pipeline = new HookPipeline([plugin]);
+
+		const result = await pipeline.invokeExclusiveHook("content:beforeSave", { some: "event" });
+		expect(result).toBeNull();
+		expect(handler).not.toHaveBeenCalled();
+	});
+
+	it("invokeExclusiveHook dispatches only to selected provider", async () => {
+		const handlerA = vi.fn().mockResolvedValue("result-a");
+		const handlerB = vi.fn().mockResolvedValue("result-b");
+
+		const pluginA = createTestPlugin({
+			id: "provider-a",
+			hooks: {
+				"content:afterSave": createTestHook("provider-a", handlerA, { exclusive: true }),
+			},
+		});
+		const pluginB = createTestPlugin({
+			id: "provider-b",
+			hooks: {
+				"content:afterSave": createTestHook("provider-b", handlerB, { exclusive: true }),
+			},
+		});
+
+		// Context factory needs a db for PluginContextFactory
+		const sqlite = new Database(":memory:");
+		const db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+
+		const pipeline = new HookPipeline([pluginA, pluginB], { db });
+
+		pipeline.setExclusiveSelection("content:afterSave", "provider-b");
+
+		const result = await pipeline.invokeExclusiveHook("content:afterSave", { some: "event" });
+
+		expect(result).not.toBeNull();
+		expect(result!.pluginId).toBe("provider-b");
+		expect(result!.result).toBe("result-b");
+
+		expect(handlerB).toHaveBeenCalledTimes(1);
+		expect(handlerA).not.toHaveBeenCalled();
+
+		await db.destroy();
+		sqlite.close();
+	});
+
+	it("invokeExclusiveHook isolates errors — returns error result instead of throwing", async () => {
+		const handler = vi
+			.fn()
+			.mockRejectedValue(new Error("provider crashed")) as unknown as ContentAfterSaveHandler;
+
+		const plugin = createTestPlugin({
+			id: "broken-provider",
+			hooks: {
+				"content:afterSave": createTestHook("broken-provider", handler, {
+					exclusive: true,
+				}),
+			},
+		});
+
+		const sqlite = new Database(":memory:");
+		const db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+
+		const pipeline = new HookPipeline([plugin], { db });
+		pipeline.setExclusiveSelection("content:afterSave", "broken-provider");
+
+		// Should NOT throw — error is isolated
+		const result = await pipeline.invokeExclusiveHook("content:afterSave", {});
+
+		expect(result).not.toBeNull();
+		expect(result!.pluginId).toBe("broken-provider");
+		expect(result!.error).toBeInstanceOf(Error);
+		expect(result!.error!.message).toBe("provider crashed");
+		expect(result!.result).toBeUndefined();
+		expect(result!.duration).toBeGreaterThanOrEqual(0);
+
+		await db.destroy();
+		sqlite.close();
+	});
+
+	it("invokeExclusiveHook respects timeout", async () => {
+		const handler = vi.fn(
+			() =>
+				new Promise((resolve) => {
+					setTimeout(resolve, 10_000);
+				}),
+		) as unknown as ContentAfterSaveHandler;
+
+		const plugin = createTestPlugin({
+			id: "slow-provider",
+			hooks: {
+				"content:afterSave": createTestHook("slow-provider", handler, {
+					exclusive: true,
+					timeout: 50,
+				}),
+			},
+		});
+
+		const sqlite = new Database(":memory:");
+		const db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+
+		const pipeline = new HookPipeline([plugin], { db });
+		pipeline.setExclusiveSelection("content:afterSave", "slow-provider");
+
+		const result = await pipeline.invokeExclusiveHook("content:afterSave", {});
+
+		expect(result).not.toBeNull();
+		expect(result!.error).toBeInstanceOf(Error);
+		expect(result!.error!.message.toLowerCase()).toContain("timeout");
+
+		await db.destroy();
+		sqlite.close();
+	});
+
+	it("exclusive hooks with a selection are skipped in regular pipeline", async () => {
+		const exclusiveHandler = vi.fn().mockResolvedValue(undefined);
+		const normalHandler = vi.fn().mockResolvedValue(undefined);
+
+		const exclusivePlugin = createTestPlugin({
+			id: "exclusive-plugin",
+			hooks: {
+				"content:afterSave": createTestHook("exclusive-plugin", exclusiveHandler, {
+					exclusive: true,
+				}),
+			},
+		});
+		const normalPlugin = createTestPlugin({
+			id: "normal-plugin",
+			hooks: {
+				"content:afterSave": createTestHook("normal-plugin", normalHandler, {
+					exclusive: false,
+				}),
+			},
+		});
+
+		const sqlite = new Database(":memory:");
+		const db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+
+		const pipeline = new HookPipeline([exclusivePlugin, normalPlugin], { db });
+
+		// Set a selection — this means the exclusive hook should NOT run in the regular pipeline
+		pipeline.setExclusiveSelection("content:afterSave", "exclusive-plugin");
+
+		await pipeline.runContentAfterSave({ title: "test" }, "posts", true);
+
+		// Normal hook should run
+		expect(normalHandler).toHaveBeenCalledTimes(1);
+		// Exclusive hook should NOT have run in the regular pipeline
+		expect(exclusiveHandler).not.toHaveBeenCalled();
+
+		await db.destroy();
+		sqlite.close();
+	});
+
+	it("exclusive hooks without a selection DO run in regular pipeline", async () => {
+		const exclusiveHandler = vi.fn().mockResolvedValue(undefined);
+
+		const plugin = createTestPlugin({
+			id: "unselected-provider",
+			hooks: {
+				"content:afterSave": createTestHook("unselected-provider", exclusiveHandler, {
+					exclusive: true,
+				}),
+			},
+		});
+
+		const sqlite = new Database(":memory:");
+		const db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+
+		const pipeline = new HookPipeline([plugin], { db });
+
+		// No selection set — exclusive hooks should still run in regular pipeline
+		await pipeline.runContentAfterSave({ title: "test" }, "posts", true);
+
+		expect(exclusiveHandler).toHaveBeenCalledTimes(1);
+
+		await db.destroy();
+		sqlite.close();
+	});
+});
+
+// ---------------------------------------------------------------------------
+// normalizeManifestHook
+// ---------------------------------------------------------------------------
+
+describe("normalizeManifestHook", () => {
+	it("converts a plain string to an object", () => {
+		const result = normalizeManifestHook("content:beforeSave");
+		expect(result).toEqual({ name: "content:beforeSave" });
+	});
+
+	it("passes through an object unchanged", () => {
+		const entry = { name: "content:beforeSave", exclusive: true, priority: 50 };
+		const result = normalizeManifestHook(entry);
+		expect(result).toEqual(entry);
+	});
+
+	it("handles object with only name", () => {
+		const result = normalizeManifestHook({ name: "media:afterUpload" });
+		expect(result).toEqual({ name: "media:afterUpload" });
+	});
+});
+
+// ---------------------------------------------------------------------------
+// extractManifest — exclusive hook metadata
+// ---------------------------------------------------------------------------
+
+describe("extractManifest — exclusive hooks", () => {
+	it("emits plain hook names for non-exclusive hooks with default settings", () => {
+		const plugin = createTestPlugin({
+			id: "simple-plugin",
+			hooks: {
+				"content:beforeSave": createTestHook("simple-plugin", vi.fn()),
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		expect(manifest.hooks).toEqual(["content:beforeSave"]);
+	});
+
+	it("emits structured entries for exclusive hooks", () => {
+		const plugin = createTestPlugin({
+			id: "email-provider",
+			hooks: {
+				"content:beforeSave": createTestHook("email-provider", vi.fn(), {
+					exclusive: true,
+				}),
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		expect(manifest.hooks).toEqual([{ name: "content:beforeSave", exclusive: true }]);
+	});
+
+	it("emits structured entries for hooks with custom priority or timeout", () => {
+		const plugin = createTestPlugin({
+			id: "custom-plugin",
+			hooks: {
+				"content:afterSave": createTestHook("custom-plugin", vi.fn(), {
+					priority: 50,
+					timeout: 10000,
+				}),
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		expect(manifest.hooks).toEqual([{ name: "content:afterSave", priority: 50, timeout: 10000 }]);
+	});
+
+	it("handles mixed exclusive and non-exclusive hooks", () => {
+		const plugin = createTestPlugin({
+			id: "mixed-plugin",
+			hooks: {
+				"content:beforeSave": createTestHook("mixed-plugin", vi.fn(), { exclusive: true }),
+				"content:afterSave": createTestHook("mixed-plugin", vi.fn()),
+			},
+		});
+
+		const manifest = extractManifest(plugin);
+		expect(manifest.hooks).toHaveLength(2);
+
+		// One should be structured (exclusive), one should be a plain string
+		const structured = manifest.hooks.filter((h) => typeof h === "object");
+		const plain = manifest.hooks.filter((h) => typeof h === "string");
+		expect(structured).toHaveLength(1);
+		expect(plain).toHaveLength(1);
+	});
+});
+
+// ---------------------------------------------------------------------------
+// resolveExclusiveHooks (shared function)
+// ---------------------------------------------------------------------------
+
+describe("resolveExclusiveHooks — shared function", () => {
+	it("auto-selects single active provider", async () => {
+		const plugin = createTestPlugin({
+			id: "only-provider",
+			hooks: {
+				"content:beforeSave": createTestHook("only-provider", vi.fn(), { exclusive: true }),
+			},
+		});
+		const pipeline = new HookPipeline([plugin]);
+
+		const store = new Map<string, string>();
+
+		await resolveExclusiveHooks({
+			pipeline,
+			isActive: () => true,
+			getOption: async (key) => store.get(key) ?? null,
+			setOption: async (key, value) => {
+				store.set(key, value);
+			},
+			deleteOption: async (key) => {
+				store.delete(key);
+			},
+		});
+
+		expect(pipeline.getExclusiveSelection("content:beforeSave")).toBe("only-provider");
+	});
+
+	it("filters out inactive providers", async () => {
+		const pluginA = createTestPlugin({
+			id: "active-provider",
+			hooks: {
+				"content:beforeSave": createTestHook("active-provider", vi.fn(), { exclusive: true }),
+			},
+		});
+		const pluginB = createTestPlugin({
+			id: "inactive-provider",
+			hooks: {
+				"content:beforeSave": createTestHook("inactive-provider", vi.fn(), { exclusive: true }),
+			},
+		});
+		const pipeline = new HookPipeline([pluginA, pluginB]);
+
+		const store = new Map<string, string>();
+
+		await resolveExclusiveHooks({
+			pipeline,
+			isActive: (id) => id === "active-provider",
+			getOption: async (key) => store.get(key) ?? null,
+			setOption: async (key, value) => {
+				store.set(key, value);
+			},
+			deleteOption: async (key) => {
+				store.delete(key);
+			},
+		});
+
+		// Only active-provider is active, so it should be auto-selected
+		expect(pipeline.getExclusiveSelection("content:beforeSave")).toBe("active-provider");
+	});
+
+	it("clears stale selection when selected provider is inactive", async () => {
+		const pluginA = createTestPlugin({
+			id: "provider-a",
+			hooks: {
+				"content:beforeSave": createTestHook("provider-a", vi.fn(), { exclusive: true }),
+			},
+		});
+		const pluginB = createTestPlugin({
+			id: "provider-b",
+			hooks: {
+				"content:beforeSave": createTestHook("provider-b", vi.fn(), { exclusive: true }),
+			},
+		});
+		const pipeline = new HookPipeline([pluginA, pluginB]);
+
+		// Simulate existing selection for provider-a which is now inactive
+		const store = new Map<string, string>([
+			["emdash:exclusive_hook:content:beforeSave", "provider-a"],
+		]);
+
+		await resolveExclusiveHooks({
+			pipeline,
+			isActive: (id) => id === "provider-b", // provider-a is inactive
+			getOption: async (key) => store.get(key) ?? null,
+			setOption: async (key, value) => {
+				store.set(key, value);
+			},
+			deleteOption: async (key) => {
+				store.delete(key);
+			},
+		});
+
+		// provider-a was stale, cleared. provider-b is the only active one → auto-selected
+		expect(pipeline.getExclusiveSelection("content:beforeSave")).toBe("provider-b");
+	});
+});
+
+// ---------------------------------------------------------------------------
+// PluginManager — resolveExclusiveHooks
+// ---------------------------------------------------------------------------
+
+describe("PluginManager — resolveExclusiveHooks", () => {
+	let db: Kysely<DbSchema>;
+	let sqliteDb: Database.Database;
+
+	beforeEach(async () => {
+		sqliteDb = new Database(":memory:");
+		db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqliteDb }),
+		});
+		await runMigrations(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqliteDb.close();
+	});
+
+	it("auto-selects when only one provider for an exclusive hook", async () => {
+		const handler = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "email-ses",
+				hooks: {
+					"content:beforeSave": { handler, exclusive: true },
+				},
+			}),
+		);
+		await manager.activate("email-ses");
+
+		const selection = await manager.getExclusiveHookSelection("content:beforeSave");
+		expect(selection).toBe("email-ses");
+	});
+
+	it("keeps auto-selected provider when a second provider activates", async () => {
+		const handlerA = vi.fn() as unknown as ContentBeforeSaveHandler;
+		const handlerB = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "provider-a",
+				hooks: { "content:beforeSave": { handler: handlerA, exclusive: true } },
+			}),
+		);
+		manager.register(
+			createTestDefinition({
+				id: "provider-b",
+				hooks: { "content:beforeSave": { handler: handlerB, exclusive: true } },
+			}),
+		);
+
+		// provider-a is the only one — gets auto-selected
+		await manager.activate("provider-a");
+		expect(await manager.getExclusiveHookSelection("content:beforeSave")).toBe("provider-a");
+
+		// provider-b activates — existing valid selection is preserved
+		await manager.activate("provider-b");
+		expect(await manager.getExclusiveHookSelection("content:beforeSave")).toBe("provider-a");
+	});
+
+	it("leaves unselected when multiple providers activate simultaneously", async () => {
+		// If no one was auto-selected before the second provider, there's no
+		// selection to keep. Test this by registering both before activating.
+		const handlerA = vi.fn() as unknown as ContentBeforeSaveHandler;
+		const handlerB = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "provider-a",
+				hooks: { "content:beforeSave": { handler: handlerA, exclusive: true } },
+			}),
+		);
+		manager.register(
+			createTestDefinition({
+				id: "provider-b",
+				hooks: { "content:beforeSave": { handler: handlerB, exclusive: true } },
+			}),
+		);
+
+		// Activate provider-a (auto-selects as sole provider)
+		await manager.activate("provider-a");
+		// Clear the auto-selection to simulate "no prior selection"
+		await manager.setExclusiveHookSelection("content:beforeSave", null);
+
+		// Now activate provider-b — both active, no existing selection
+		await manager.activate("provider-b");
+		const selection = await manager.getExclusiveHookSelection("content:beforeSave");
+		expect(selection).toBeNull();
+	});
+
+	it("clears stale selection when selected plugin is deactivated", async () => {
+		const handlerA = vi.fn() as unknown as ContentBeforeSaveHandler;
+		const handlerB = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "provider-a",
+				hooks: { "content:beforeSave": { handler: handlerA, exclusive: true } },
+			}),
+		);
+		manager.register(
+			createTestDefinition({
+				id: "provider-b",
+				hooks: { "content:beforeSave": { handler: handlerB, exclusive: true } },
+			}),
+		);
+
+		await manager.activate("provider-a");
+		await manager.activate("provider-b");
+
+		// Manually set a selection
+		await manager.setExclusiveHookSelection("content:beforeSave", "provider-a");
+		expect(await manager.getExclusiveHookSelection("content:beforeSave")).toBe("provider-a");
+
+		// Deactivate the selected plugin
+		await manager.deactivate("provider-a");
+
+		// After deactivation, provider-b is the only one left → auto-selects
+		const selection = await manager.getExclusiveHookSelection("content:beforeSave");
+		expect(selection).toBe("provider-b");
+	});
+
+	it("uses preferred hints when no selection exists", async () => {
+		const handlerA = vi.fn() as unknown as ContentBeforeSaveHandler;
+		const handlerB = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "provider-a",
+				hooks: { "content:beforeSave": { handler: handlerA, exclusive: true } },
+			}),
+		);
+		manager.register(
+			createTestDefinition({
+				id: "provider-b",
+				hooks: { "content:beforeSave": { handler: handlerB, exclusive: true } },
+			}),
+		);
+
+		await manager.activate("provider-a");
+		await manager.activate("provider-b");
+
+		// Clear any auto-selection from the first activate
+		await manager.setExclusiveHookSelection("content:beforeSave", null);
+		expect(await manager.getExclusiveHookSelection("content:beforeSave")).toBeNull();
+
+		// Resolve with preferred hint
+		const hints = new Map([["provider-b", ["content:beforeSave"]]]);
+		await manager.resolveExclusiveHooks(hints);
+
+		expect(await manager.getExclusiveHookSelection("content:beforeSave")).toBe("provider-b");
+	});
+
+	it("admin override (DB selection) beats preferred hints", async () => {
+		const handlerA = vi.fn() as unknown as ContentBeforeSaveHandler;
+		const handlerB = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "provider-a",
+				hooks: { "content:beforeSave": { handler: handlerA, exclusive: true } },
+			}),
+		);
+		manager.register(
+			createTestDefinition({
+				id: "provider-b",
+				hooks: { "content:beforeSave": { handler: handlerB, exclusive: true } },
+			}),
+		);
+
+		await manager.activate("provider-a");
+		await manager.activate("provider-b");
+
+		// Admin explicitly sets provider-a
+		await manager.setExclusiveHookSelection("content:beforeSave", "provider-a");
+
+		// Resolve with preferred hint for provider-b — admin choice should win
+		const hints = new Map([["provider-b", ["content:beforeSave"]]]);
+		await manager.resolveExclusiveHooks(hints);
+
+		expect(await manager.getExclusiveHookSelection("content:beforeSave")).toBe("provider-a");
+	});
+
+	it("getExclusiveHooksInfo returns complete info", async () => {
+		const handler = vi.fn() as unknown as ContentBeforeSaveHandler;
+
+		const manager = new PluginManager({ db });
+		manager.register(
+			createTestDefinition({
+				id: "provider-a",
+				hooks: { "content:beforeSave": { handler, exclusive: true } },
+			}),
+		);
+		await manager.activate("provider-a");
+
+		const info = await manager.getExclusiveHooksInfo();
+		expect(info).toHaveLength(1);
+		expect(info[0]!.hookName).toBe("content:beforeSave");
+		expect(info[0]!.providers).toHaveLength(1);
+		expect(info[0]!.providers[0]!.pluginId).toBe("provider-a");
+		expect(info[0]!.selectedPluginId).toBe("provider-a");
+	});
+});

packages/core/tests/unit/plugins/field-widgets.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Tests for the field widget plugin pipeline.
+ *
+ * Covers:
+ * - Manifest schema validation for fieldWidgets
+ * - definePlugin() with fieldWidgets
+ * - FieldWidgetConfig type correctness
+ */
+
+import { describe, expect, it } from "vitest";
+
+import { pluginManifestSchema } from "../../../src/plugins/manifest-schema.js";
+
+/** Minimal valid manifest */
+function makeManifest(admin: Record<string, unknown> = {}) {
+	return {
+		id: "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		allowedHosts: [],
+		storage: {},
+		hooks: [],
+		routes: [],
+		admin,
+	};
+}
+
+describe("pluginManifestSchema — fieldWidgets", () => {
+	it("should accept manifest without fieldWidgets", () => {
+		const result = pluginManifestSchema.safeParse(makeManifest());
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept manifest with empty fieldWidgets array", () => {
+		const result = pluginManifestSchema.safeParse(makeManifest({ fieldWidgets: [] }));
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept a valid field widget definition", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "picker",
+						label: "Color Picker",
+						fieldTypes: ["string"],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept multiple field widget definitions", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "picker",
+						label: "Color Picker",
+						fieldTypes: ["string"],
+					},
+					{
+						name: "pricing",
+						label: "Pricing Editor",
+						fieldTypes: ["json"],
+						elements: [{ type: "toggle", action_id: "enabled", label: "Enable" }],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept field widget with Block Kit elements", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "pricing",
+						label: "Pricing",
+						fieldTypes: ["json"],
+						elements: [
+							{ type: "toggle", action_id: "enabled", label: "Enable" },
+							{ type: "text_input", action_id: "price", label: "Price" },
+							{
+								type: "select",
+								action_id: "mode",
+								label: "Mode",
+								options: [{ value: "a", label: "A" }],
+							},
+						],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept field widget with multiple field types", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "hex",
+						label: "Hex Input",
+						fieldTypes: ["string", "json"],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+
+	it("should reject field widget with empty name", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "",
+						label: "Test",
+						fieldTypes: ["string"],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject field widget with empty label", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "test",
+						label: "",
+						fieldTypes: ["string"],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject field widget without name", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						label: "Test",
+						fieldTypes: ["string"],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject field widget without fieldTypes", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "test",
+						label: "Test",
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should accept field widget with empty fieldTypes array", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				fieldWidgets: [
+					{
+						name: "test",
+						label: "Test",
+						fieldTypes: [],
+					},
+				],
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+});

packages/core/tests/unit/plugins/hooks.test.ts

@@ -0,0 +1,663 @@
+/**
+ * HookPipeline Tests
+ *
+ * Tests the v2 hook pipeline for:
+ * - Hook registration and sorting
+ * - Hook execution with timeout
+ * - Content hooks (beforeSave, afterSave, beforeDelete, afterDelete)
+ * - Lifecycle hooks (install, activate, deactivate, uninstall)
+ * - Error handling and error policies
+ */
+
+import { describe, it, expect, vi } from "vitest";
+
+import { HookPipeline, createHookPipeline } from "../../../src/plugins/hooks.js";
+import type { ResolvedPlugin, ResolvedHook } from "../../../src/plugins/types.js";
+
+/**
+ * Create a minimal resolved plugin for testing
+ */
+function createTestPlugin(overrides: Partial<ResolvedPlugin> = {}): ResolvedPlugin {
+	return {
+		id: overrides.id ?? "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		allowedHosts: [],
+		storage: {},
+		admin: {
+			pages: [],
+			widgets: [],
+		},
+		hooks: {},
+		routes: {},
+		...overrides,
+	};
+}
+
+/**
+ * Create a resolved hook with defaults
+ */
+function createTestHook<T>(
+	pluginId: string,
+	handler: T,
+	overrides: Partial<ResolvedHook<T>> = {},
+): ResolvedHook<T> {
+	return {
+		pluginId,
+		handler,
+		priority: 100,
+		timeout: 5000,
+		dependencies: [],
+		errorPolicy: "continue",
+		exclusive: false,
+		...overrides,
+	};
+}
+
+describe("HookPipeline", () => {
+	describe("construction and registration", () => {
+		it("creates empty pipeline with no plugins", () => {
+			const pipeline = new HookPipeline([]);
+
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(false);
+			expect(pipeline.getHookCount("content:beforeSave")).toBe(0);
+		});
+
+		it("registers hooks from plugins", () => {
+			const plugin = createTestPlugin({
+				id: "test",
+				capabilities: ["write:content", "read:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("test", vi.fn()),
+					"content:afterSave": createTestHook("test", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(true);
+			expect(pipeline.hasHooks("content:afterSave")).toBe(true);
+			expect(pipeline.hasHooks("content:beforeDelete")).toBe(false);
+		});
+
+		it("tracks registered hook names", () => {
+			const plugin = createTestPlugin({
+				id: "test",
+				capabilities: ["write:content", "read:media"],
+				hooks: {
+					"content:beforeSave": createTestHook("test", vi.fn()),
+					"media:afterUpload": createTestHook("test", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			const registered = pipeline.getRegisteredHooks();
+
+			expect(registered).toContain("content:beforeSave");
+			expect(registered).toContain("media:afterUpload");
+			expect(registered).not.toContain("content:afterSave");
+		});
+	});
+
+	describe("hook sorting", () => {
+		it("sorts hooks by priority (lower first)", () => {
+			const handler1 = vi.fn();
+			const handler2 = vi.fn();
+			const handler3 = vi.fn();
+
+			const plugin1 = createTestPlugin({
+				id: "plugin-1",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-1", handler1, {
+						priority: 200,
+					}),
+				},
+			});
+
+			const plugin2 = createTestPlugin({
+				id: "plugin-2",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-2", handler2, {
+						priority: 50,
+					}),
+				},
+			});
+
+			const plugin3 = createTestPlugin({
+				id: "plugin-3",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-3", handler3, {
+						priority: 100,
+					}),
+				},
+			});
+
+			// Create pipeline and manually verify order through execution
+			const pipeline = new HookPipeline([plugin1, plugin2, plugin3]);
+
+			expect(pipeline.getHookCount("content:beforeSave")).toBe(3);
+		});
+
+		it("respects dependencies when sorting", () => {
+			const handler1 = vi.fn();
+			const handler2 = vi.fn();
+
+			const plugin1 = createTestPlugin({
+				id: "plugin-1",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-1", handler1, {
+						priority: 50, // Lower priority but...
+						dependencies: ["plugin-2"], // depends on plugin-2
+					}),
+				},
+			});
+
+			const plugin2 = createTestPlugin({
+				id: "plugin-2",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-2", handler2, {
+						priority: 100, // Higher priority
+					}),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin1, plugin2]);
+
+			// plugin-2 should run before plugin-1 despite priority
+			// because plugin-1 depends on plugin-2
+			expect(pipeline.getHookCount("content:beforeSave")).toBe(2);
+		});
+	});
+
+	describe("content:beforeSave", () => {
+		it("runs hooks and returns modified content", async () => {
+			const handler = vi.fn(async (event) => ({
+				...event.content,
+				modified: true,
+			}));
+
+			const plugin = createTestPlugin({
+				id: "test",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("test", handler),
+				},
+			});
+
+			// Need context factory for actual execution
+			// Without it, getContext will throw
+			const pipeline = new HookPipeline([plugin]);
+
+			// For unit test without DB, we can verify the hook count
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(true);
+		});
+
+		it("chains content through multiple hooks", async () => {
+			const handler1 = vi.fn(async (event) => ({
+				...event.content,
+				step1: true,
+			}));
+
+			const handler2 = vi.fn(async (event) => ({
+				...event.content,
+				step2: true,
+			}));
+
+			const plugin1 = createTestPlugin({
+				id: "plugin-1",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-1", handler1, {
+						priority: 1,
+					}),
+				},
+			});
+
+			const plugin2 = createTestPlugin({
+				id: "plugin-2",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("plugin-2", handler2, {
+						priority: 2,
+					}),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin1, plugin2]);
+			expect(pipeline.getHookCount("content:beforeSave")).toBe(2);
+		});
+	});
+
+	describe("content:beforeDelete", () => {
+		it("registers beforeDelete hooks", () => {
+			const handler = vi.fn(async () => true);
+
+			const plugin = createTestPlugin({
+				id: "test",
+				capabilities: ["read:content"],
+				hooks: {
+					"content:beforeDelete": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:beforeDelete")).toBe(true);
+		});
+	});
+
+	describe("lifecycle hooks", () => {
+		it("registers plugin:install hook", () => {
+			const handler = vi.fn();
+
+			const plugin = createTestPlugin({
+				id: "test",
+				hooks: {
+					"plugin:install": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("plugin:install")).toBe(true);
+		});
+
+		it("registers plugin:activate hook", () => {
+			const handler = vi.fn();
+
+			const plugin = createTestPlugin({
+				id: "test",
+				hooks: {
+					"plugin:activate": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("plugin:activate")).toBe(true);
+		});
+
+		it("registers plugin:deactivate hook", () => {
+			const handler = vi.fn();
+
+			const plugin = createTestPlugin({
+				id: "test",
+				hooks: {
+					"plugin:deactivate": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("plugin:deactivate")).toBe(true);
+		});
+
+		it("registers plugin:uninstall hook", () => {
+			const handler = vi.fn();
+
+			const plugin = createTestPlugin({
+				id: "test",
+				hooks: {
+					"plugin:uninstall": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("plugin:uninstall")).toBe(true);
+		});
+	});
+
+	describe("media hooks", () => {
+		it("registers media:beforeUpload hook", () => {
+			const handler = vi.fn();
+
+			const plugin = createTestPlugin({
+				id: "test",
+				capabilities: ["write:media"],
+				hooks: {
+					"media:beforeUpload": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("media:beforeUpload")).toBe(true);
+		});
+
+		it("registers media:afterUpload hook", () => {
+			const handler = vi.fn();
+
+			const plugin = createTestPlugin({
+				id: "test",
+				capabilities: ["read:media"],
+				hooks: {
+					"media:afterUpload": createTestHook("test", handler),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("media:afterUpload")).toBe(true);
+		});
+	});
+
+	describe("createHookPipeline helper", () => {
+		it("creates a HookPipeline instance", () => {
+			const plugins = [createTestPlugin({ id: "test" })];
+			const pipeline = createHookPipeline(plugins);
+
+			expect(pipeline).toBeInstanceOf(HookPipeline);
+		});
+	});
+
+	// =========================================================================
+	// Capability enforcement for non-email hooks
+	// =========================================================================
+
+	describe("capability enforcement — content hooks", () => {
+		it("skips content:beforeSave without write:content capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"content:beforeSave": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(false);
+		});
+
+		it("skips content:beforeSave with only read:content (requires write:content)", () => {
+			const plugin = createTestPlugin({
+				id: "read-only",
+				capabilities: ["read:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("read-only", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(false);
+		});
+
+		it("registers content:beforeSave with write:content capability", () => {
+			const plugin = createTestPlugin({
+				id: "has-cap",
+				capabilities: ["write:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("has-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(true);
+		});
+
+		it("skips content:afterSave without read:content capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"content:afterSave": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:afterSave")).toBe(false);
+		});
+
+		it("registers content:afterSave with read:content capability (read-only notification)", () => {
+			const plugin = createTestPlugin({
+				id: "has-cap",
+				capabilities: ["read:content"],
+				hooks: {
+					"content:afterSave": createTestHook("has-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:afterSave")).toBe(true);
+		});
+
+		it("skips content:beforeDelete without read:content capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"content:beforeDelete": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:beforeDelete")).toBe(false);
+		});
+
+		it("skips content:afterDelete without read:content capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"content:afterDelete": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:afterDelete")).toBe(false);
+		});
+
+		it("registers all content hooks with write:content + read:content", () => {
+			const plugin = createTestPlugin({
+				id: "writer",
+				capabilities: ["write:content", "read:content"],
+				hooks: {
+					"content:beforeSave": createTestHook("writer", vi.fn()),
+					"content:afterSave": createTestHook("writer", vi.fn()),
+					"content:beforeDelete": createTestHook("writer", vi.fn()),
+					"content:afterDelete": createTestHook("writer", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("content:beforeSave")).toBe(true);
+			expect(pipeline.hasHooks("content:afterSave")).toBe(true);
+			expect(pipeline.hasHooks("content:beforeDelete")).toBe(true);
+			expect(pipeline.hasHooks("content:afterDelete")).toBe(true);
+		});
+	});
+
+	describe("capability enforcement — media hooks", () => {
+		it("skips media:beforeUpload without write:media capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"media:beforeUpload": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("media:beforeUpload")).toBe(false);
+		});
+
+		it("registers media:beforeUpload with write:media capability", () => {
+			const plugin = createTestPlugin({
+				id: "has-cap",
+				capabilities: ["write:media"],
+				hooks: {
+					"media:beforeUpload": createTestHook("has-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("media:beforeUpload")).toBe(true);
+		});
+
+		it("skips media:afterUpload without read:media capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"media:afterUpload": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("media:afterUpload")).toBe(false);
+		});
+
+		it("registers media:afterUpload with read:media capability", () => {
+			const plugin = createTestPlugin({
+				id: "has-cap",
+				capabilities: ["read:media"],
+				hooks: {
+					"media:afterUpload": createTestHook("has-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("media:afterUpload")).toBe(true);
+		});
+	});
+
+	describe("capability enforcement — comment hooks", () => {
+		it("skips comment:beforeCreate without read:users capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"comment:beforeCreate": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("comment:beforeCreate")).toBe(false);
+		});
+
+		it("registers comment:beforeCreate with read:users capability", () => {
+			const plugin = createTestPlugin({
+				id: "has-cap",
+				capabilities: ["read:users"],
+				hooks: {
+					"comment:beforeCreate": createTestHook("has-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("comment:beforeCreate")).toBe(true);
+		});
+
+		it("skips comment:moderate without read:users capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"comment:moderate": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("comment:moderate")).toBe(false);
+		});
+
+		it("skips comment:afterCreate without read:users capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"comment:afterCreate": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("comment:afterCreate")).toBe(false);
+		});
+
+		it("skips comment:afterModerate without read:users capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"comment:afterModerate": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("comment:afterModerate")).toBe(false);
+		});
+	});
+
+	describe("capability enforcement — page:fragments", () => {
+		it("skips page:fragments without page:inject capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"page:fragments": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("page:fragments")).toBe(false);
+		});
+
+		it("registers page:fragments with page:inject capability", () => {
+			const plugin = createTestPlugin({
+				id: "has-cap",
+				capabilities: ["page:inject"],
+				hooks: {
+					"page:fragments": createTestHook("has-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("page:fragments")).toBe(true);
+		});
+	});
+
+	describe("capability enforcement — hooks without requirements", () => {
+		it("registers lifecycle hooks without any capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"plugin:install": createTestHook("no-cap", vi.fn()),
+					"plugin:activate": createTestHook("no-cap", vi.fn()),
+					"plugin:deactivate": createTestHook("no-cap", vi.fn()),
+					"plugin:uninstall": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("plugin:install")).toBe(true);
+			expect(pipeline.hasHooks("plugin:activate")).toBe(true);
+			expect(pipeline.hasHooks("plugin:deactivate")).toBe(true);
+			expect(pipeline.hasHooks("plugin:uninstall")).toBe(true);
+		});
+
+		it("registers cron hook without any capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					cron: createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("cron")).toBe(true);
+		});
+
+		it("registers page:metadata without any capability", () => {
+			const plugin = createTestPlugin({
+				id: "no-cap",
+				capabilities: [],
+				hooks: {
+					"page:metadata": createTestHook("no-cap", vi.fn()),
+				},
+			});
+
+			const pipeline = new HookPipeline([plugin]);
+			expect(pipeline.hasHooks("page:metadata")).toBe(true);
+		});
+	});
+});

packages/core/tests/unit/plugins/http-credential-stripping.test.ts

@@ -0,0 +1,161 @@
+/**
+ * Tests that plugin HTTP functions strip credential headers on cross-origin redirects.
+ *
+ * Both createHttpAccess and createUnrestrictedHttpAccess manually follow redirects.
+ * When a redirect crosses origins, Authorization/Cookie/Proxy-Authorization headers
+ * must be stripped to prevent credential leakage to untrusted hosts.
+ */
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+
+import { createHttpAccess, createUnrestrictedHttpAccess } from "../../../src/plugins/context.js";
+
+// Intercept globalThis.fetch so we can simulate redirect chains
+const mockFetch = vi.fn<typeof globalThis.fetch>();
+vi.stubGlobal("fetch", mockFetch);
+
+afterEach(() => {
+	mockFetch.mockReset();
+});
+
+/** Build a minimal redirect response */
+function redirectResponse(location: string, status = 302): Response {
+	return new Response(null, {
+		status,
+		headers: { Location: location },
+	});
+}
+
+/** Build a 200 response */
+function okResponse(body = "ok"): Response {
+	return new Response(body, { status: 200 });
+}
+
+/** Extract the headers passed to the Nth fetch call */
+function headersOfCall(callIndex: number): Headers {
+	const init = mockFetch.mock.calls[callIndex]?.[1] as RequestInit | undefined;
+	return new Headers(init?.headers);
+}
+
+// =============================================================================
+// createHttpAccess – host-restricted
+// =============================================================================
+
+describe("createHttpAccess credential stripping", () => {
+	const pluginId = "test-plugin";
+	const allowedHosts = ["a.example.com", "b.example.com"];
+
+	it("preserves credentials on same-origin redirect", async () => {
+		mockFetch
+			.mockResolvedValueOnce(redirectResponse("https://a.example.com/page2"))
+			.mockResolvedValueOnce(okResponse());
+
+		const http = createHttpAccess(pluginId, allowedHosts);
+		await http.fetch("https://a.example.com/page1", {
+			headers: { Authorization: "Bearer secret", Cookie: "session=abc" },
+		});
+
+		// Second call should still have credentials (same origin)
+		const h = headersOfCall(1);
+		expect(h.get("authorization")).toBe("Bearer secret");
+		expect(h.get("cookie")).toBe("session=abc");
+	});
+
+	it("strips credentials on cross-origin redirect", async () => {
+		mockFetch
+			.mockResolvedValueOnce(redirectResponse("https://b.example.com/landing"))
+			.mockResolvedValueOnce(okResponse());
+
+		const http = createHttpAccess(pluginId, allowedHosts);
+		await http.fetch("https://a.example.com/start", {
+			headers: {
+				Authorization: "Bearer secret",
+				Cookie: "session=abc",
+				"Proxy-Authorization": "Basic creds",
+				"X-Custom": "keep-me",
+			},
+		});
+
+		const h = headersOfCall(1);
+		expect(h.get("authorization")).toBeNull();
+		expect(h.get("cookie")).toBeNull();
+		expect(h.get("proxy-authorization")).toBeNull();
+		// Non-credential headers survive
+		expect(h.get("x-custom")).toBe("keep-me");
+	});
+
+	it("strips credentials only once even with multiple same-origin hops after cross-origin", async () => {
+		// a.example.com -> b.example.com -> b.example.com/final
+		mockFetch
+			.mockResolvedValueOnce(redirectResponse("https://b.example.com/step1"))
+			.mockResolvedValueOnce(redirectResponse("https://b.example.com/step2"))
+			.mockResolvedValueOnce(okResponse());
+
+		const http = createHttpAccess(pluginId, allowedHosts);
+		await http.fetch("https://a.example.com/start", {
+			headers: { Authorization: "Bearer secret" },
+		});
+
+		// Call 0: original (has auth)
+		expect(headersOfCall(0).get("authorization")).toBe("Bearer secret");
+		// Call 1: after cross-origin hop (stripped)
+		expect(headersOfCall(1).get("authorization")).toBeNull();
+		// Call 2: same-origin hop on b (still stripped -- not re-added)
+		expect(headersOfCall(2).get("authorization")).toBeNull();
+	});
+});
+
+// =============================================================================
+// createUnrestrictedHttpAccess – SSRF-protected but no host list
+// =============================================================================
+
+describe("createUnrestrictedHttpAccess credential stripping", () => {
+	const pluginId = "unrestricted-plugin";
+
+	it("preserves credentials on same-origin redirect", async () => {
+		mockFetch
+			.mockResolvedValueOnce(redirectResponse("https://api.example.com/v2"))
+			.mockResolvedValueOnce(okResponse());
+
+		const http = createUnrestrictedHttpAccess(pluginId);
+		await http.fetch("https://api.example.com/v1", {
+			headers: { Authorization: "Bearer token" },
+		});
+
+		expect(headersOfCall(1).get("authorization")).toBe("Bearer token");
+	});
+
+	it("strips credentials on cross-origin redirect", async () => {
+		mockFetch
+			.mockResolvedValueOnce(redirectResponse("https://evil.example.com/steal"))
+			.mockResolvedValueOnce(okResponse());
+
+		const http = createUnrestrictedHttpAccess(pluginId);
+		await http.fetch("https://api.example.com/start", {
+			headers: {
+				Authorization: "Bearer token",
+				Cookie: "session=xyz",
+				"Proxy-Authorization": "Basic pw",
+				Accept: "application/json",
+			},
+		});
+
+		const h = headersOfCall(1);
+		expect(h.get("authorization")).toBeNull();
+		expect(h.get("cookie")).toBeNull();
+		expect(h.get("proxy-authorization")).toBeNull();
+		expect(h.get("accept")).toBe("application/json");
+	});
+
+	it("handles redirect with no init gracefully", async () => {
+		mockFetch
+			.mockResolvedValueOnce(redirectResponse("https://other.example.com/"))
+			.mockResolvedValueOnce(okResponse());
+
+		const http = createUnrestrictedHttpAccess(pluginId);
+		// No init at all -- should not throw
+		await http.fetch("https://api.example.com/bare");
+
+		expect(headersOfCall(1).get("authorization")).toBeNull();
+	});
+});

packages/core/tests/unit/plugins/manager.test.ts

@@ -0,0 +1,426 @@
+/**
+ * PluginManager Tests
+ *
+ * Tests the central plugin orchestrator for:
+ * - Plugin registration
+ * - Lifecycle management (install, activate, deactivate, uninstall)
+ * - Query methods
+ * - Hook and route delegation
+ */
+
+import Database from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database as DbSchema } from "../../../src/database/types.js";
+import { PluginManager, createPluginManager } from "../../../src/plugins/manager.js";
+import type { PluginDefinition } from "../../../src/plugins/types.js";
+
+// Test error message regex patterns
+const ALREADY_REGISTERED_REGEX = /already registered/;
+const DEACTIVATE_FIRST_REGEX = /Deactivate it first/;
+const NOT_FOUND_REGEX = /not found/;
+const ALREADY_INSTALLED_REGEX = /already installed/;
+
+/**
+ * Create a minimal plugin definition for testing
+ */
+function createTestDefinition(overrides: Partial<PluginDefinition> = {}): PluginDefinition {
+	return {
+		id: overrides.id ?? "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		...overrides,
+	};
+}
+
+describe("PluginManager", () => {
+	let db: Kysely<DbSchema>;
+	let sqliteDb: Database.Database;
+	let manager: PluginManager;
+
+	beforeEach(async () => {
+		// Create in-memory SQLite database
+		sqliteDb = new Database(":memory:");
+
+		db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({
+				database: sqliteDb,
+			}),
+		});
+
+		// Run migrations
+		await runMigrations(db);
+
+		manager = new PluginManager({ db });
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqliteDb.close();
+	});
+
+	describe("register", () => {
+		it("registers a plugin definition", () => {
+			const resolved = manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			expect(resolved.id).toBe("my-plugin");
+			expect(manager.hasPlugin("my-plugin")).toBe(true);
+		});
+
+		it("returns the resolved plugin", () => {
+			const resolved = manager.register(
+				createTestDefinition({
+					id: "test",
+					capabilities: ["write:content"],
+				}),
+			);
+
+			// write:content should add read:content
+			expect(resolved.capabilities).toContain("write:content");
+			expect(resolved.capabilities).toContain("read:content");
+		});
+
+		it("throws on duplicate registration", () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			expect(() => manager.register(createTestDefinition({ id: "my-plugin" }))).toThrow(
+				ALREADY_REGISTERED_REGEX,
+			);
+		});
+
+		it("sets initial state to registered", () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			expect(manager.getPluginState("my-plugin")).toBe("registered");
+		});
+	});
+
+	describe("registerAll", () => {
+		it("registers multiple plugins", () => {
+			manager.registerAll([
+				createTestDefinition({ id: "plugin-a" }),
+				createTestDefinition({ id: "plugin-b" }),
+				createTestDefinition({ id: "plugin-c" }),
+			]);
+
+			expect(manager.hasPlugin("plugin-a")).toBe(true);
+			expect(manager.hasPlugin("plugin-b")).toBe(true);
+			expect(manager.hasPlugin("plugin-c")).toBe(true);
+		});
+	});
+
+	describe("unregister", () => {
+		it("returns false for non-existent plugin", () => {
+			const result = manager.unregister("non-existent");
+			expect(result).toBe(false);
+		});
+
+		it("unregisters a registered plugin", () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			const result = manager.unregister("my-plugin");
+
+			expect(result).toBe(true);
+			expect(manager.hasPlugin("my-plugin")).toBe(false);
+		});
+
+		it("throws when trying to unregister active plugin", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+
+			expect(() => manager.unregister("my-plugin")).toThrow(DEACTIVATE_FIRST_REGEX);
+		});
+	});
+
+	describe("install", () => {
+		it("throws for non-existent plugin", async () => {
+			await expect(manager.install("non-existent")).rejects.toThrow(NOT_FOUND_REGEX);
+		});
+
+		it("installs a registered plugin", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			await manager.install("my-plugin");
+
+			expect(manager.getPluginState("my-plugin")).toBe("installed");
+		});
+
+		it("throws if plugin is already installed", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.install("my-plugin");
+
+			await expect(manager.install("my-plugin")).rejects.toThrow(ALREADY_INSTALLED_REGEX);
+		});
+
+		it("runs plugin:install hook", async () => {
+			const installHandler = vi.fn();
+			manager.register(
+				createTestDefinition({
+					id: "my-plugin",
+					hooks: {
+						"plugin:install": installHandler,
+					},
+				}),
+			);
+
+			await manager.install("my-plugin");
+
+			// Hook should be registered but not called without context factory
+			// In real usage, the hook would be called
+			expect(manager.getPluginState("my-plugin")).toBe("installed");
+		});
+	});
+
+	describe("activate", () => {
+		it("throws for non-existent plugin", async () => {
+			await expect(manager.activate("non-existent")).rejects.toThrow(NOT_FOUND_REGEX);
+		});
+
+		it("auto-installs if not installed", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			await manager.activate("my-plugin");
+
+			expect(manager.getPluginState("my-plugin")).toBe("active");
+		});
+
+		it("activates an installed plugin", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.install("my-plugin");
+
+			await manager.activate("my-plugin");
+
+			expect(manager.getPluginState("my-plugin")).toBe("active");
+		});
+
+		it("returns empty array if already active", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+
+			const results = await manager.activate("my-plugin");
+
+			expect(results).toEqual([]);
+		});
+	});
+
+	describe("deactivate", () => {
+		it("throws for non-existent plugin", async () => {
+			await expect(manager.deactivate("non-existent")).rejects.toThrow(NOT_FOUND_REGEX);
+		});
+
+		it("returns empty array if not active", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+
+			const results = await manager.deactivate("my-plugin");
+
+			expect(results).toEqual([]);
+		});
+
+		it("deactivates an active plugin", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+
+			await manager.deactivate("my-plugin");
+
+			expect(manager.getPluginState("my-plugin")).toBe("inactive");
+		});
+	});
+
+	describe("uninstall", () => {
+		it("throws for non-existent plugin", async () => {
+			await expect(manager.uninstall("non-existent")).rejects.toThrow(NOT_FOUND_REGEX);
+		});
+
+		it("deactivates before uninstalling if active", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+
+			await manager.uninstall("my-plugin");
+
+			expect(manager.hasPlugin("my-plugin")).toBe(false);
+		});
+
+		it("removes plugin from manager", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.install("my-plugin");
+
+			await manager.uninstall("my-plugin");
+
+			expect(manager.hasPlugin("my-plugin")).toBe(false);
+		});
+	});
+
+	describe("getPlugin", () => {
+		it("returns undefined for non-existent plugin", () => {
+			expect(manager.getPlugin("non-existent")).toBeUndefined();
+		});
+
+		it("returns the resolved plugin", () => {
+			manager.register(createTestDefinition({ id: "my-plugin", version: "2.0.0" }));
+
+			const plugin = manager.getPlugin("my-plugin");
+
+			expect(plugin).toBeDefined();
+			expect(plugin!.id).toBe("my-plugin");
+			expect(plugin!.version).toBe("2.0.0");
+		});
+	});
+
+	describe("getPluginState", () => {
+		it("returns undefined for non-existent plugin", () => {
+			expect(manager.getPluginState("non-existent")).toBeUndefined();
+		});
+
+		it("returns current state", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			expect(manager.getPluginState("my-plugin")).toBe("registered");
+
+			await manager.install("my-plugin");
+			expect(manager.getPluginState("my-plugin")).toBe("installed");
+
+			await manager.activate("my-plugin");
+			expect(manager.getPluginState("my-plugin")).toBe("active");
+
+			await manager.deactivate("my-plugin");
+			expect(manager.getPluginState("my-plugin")).toBe("inactive");
+		});
+	});
+
+	describe("getAllPlugins", () => {
+		it("returns empty array initially", () => {
+			expect(manager.getAllPlugins()).toEqual([]);
+		});
+
+		it("returns all plugins with state", async () => {
+			manager.register(createTestDefinition({ id: "plugin-a" }));
+			manager.register(createTestDefinition({ id: "plugin-b" }));
+			await manager.activate("plugin-b");
+
+			const all = manager.getAllPlugins();
+
+			expect(all).toHaveLength(2);
+
+			const pluginA = all.find((p) => p.plugin.id === "plugin-a");
+			const pluginB = all.find((p) => p.plugin.id === "plugin-b");
+
+			expect(pluginA!.state).toBe("registered");
+			expect(pluginB!.state).toBe("active");
+		});
+	});
+
+	describe("getActivePlugins", () => {
+		it("returns empty array when no active plugins", () => {
+			manager.register(createTestDefinition({ id: "plugin-a" }));
+
+			expect(manager.getActivePlugins()).toEqual([]);
+		});
+
+		it("returns only active plugins", async () => {
+			manager.register(createTestDefinition({ id: "plugin-a" }));
+			manager.register(createTestDefinition({ id: "plugin-b" }));
+			manager.register(createTestDefinition({ id: "plugin-c" }));
+
+			await manager.activate("plugin-a");
+			await manager.activate("plugin-c");
+
+			const active = manager.getActivePlugins();
+
+			expect(active).toHaveLength(2);
+			expect(active.map((p) => p.id).toSorted()).toEqual(["plugin-a", "plugin-c"]);
+		});
+	});
+
+	describe("hasPlugin", () => {
+		it("returns false for non-existent plugin", () => {
+			expect(manager.hasPlugin("non-existent")).toBe(false);
+		});
+
+		it("returns true for registered plugin", () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			expect(manager.hasPlugin("my-plugin")).toBe(true);
+		});
+	});
+
+	describe("isActive", () => {
+		it("returns false for non-existent plugin", () => {
+			expect(manager.isActive("non-existent")).toBe(false);
+		});
+
+		it("returns false for registered but not active plugin", () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			expect(manager.isActive("my-plugin")).toBe(false);
+		});
+
+		it("returns true for active plugin", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+
+			expect(manager.isActive("my-plugin")).toBe(true);
+		});
+
+		it("returns false after deactivation", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+			await manager.deactivate("my-plugin");
+
+			expect(manager.isActive("my-plugin")).toBe(false);
+		});
+	});
+
+	describe("getPluginRoutes", () => {
+		it("returns routes for active plugin", async () => {
+			manager.register(
+				createTestDefinition({
+					id: "my-plugin",
+					routes: {
+						sync: { handler: vi.fn() },
+						import: { handler: vi.fn() },
+					},
+				}),
+			);
+			await manager.activate("my-plugin");
+
+			const routes = manager.getPluginRoutes("my-plugin");
+
+			expect(routes).toContain("sync");
+			expect(routes).toContain("import");
+		});
+	});
+
+	describe("reinitialize", () => {
+		it("can be called to force reinitialization", async () => {
+			manager.register(createTestDefinition({ id: "my-plugin" }));
+			await manager.activate("my-plugin");
+
+			// Should not throw
+			manager.reinitialize();
+
+			expect(manager.isActive("my-plugin")).toBe(true);
+		});
+	});
+});
+
+describe("createPluginManager helper", () => {
+	let db: Kysely<DbSchema>;
+	let sqliteDb: Database.Database;
+
+	beforeEach(async () => {
+		sqliteDb = new Database(":memory:");
+		db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqliteDb }),
+		});
+		await runMigrations(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqliteDb.close();
+	});
+
+	it("creates a PluginManager instance", () => {
+		const manager = createPluginManager({ db });
+		expect(manager).toBeInstanceOf(PluginManager);
+	});
+});

packages/core/tests/unit/plugins/manifest-schema.test.ts

@@ -0,0 +1,197 @@
+import { describe, it, expect } from "vitest";
+
+import {
+	pluginManifestSchema,
+	normalizeManifestRoute,
+} from "../../../src/plugins/manifest-schema.js";
+
+/** Minimal valid manifest for testing — only storage fields vary */
+function makeManifest(storage: Record<string, { indexes: Array<string | string[]> }>) {
+	return {
+		id: "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		allowedHosts: [],
+		storage,
+		hooks: [],
+		routes: [],
+		admin: {},
+	};
+}
+
+describe("pluginManifestSchema — route entries", () => {
+	it("should accept plain string routes", () => {
+		const result = pluginManifestSchema.safeParse(makeManifest({}));
+		// Baseline with empty routes is valid
+		expect(result.success).toBe(true);
+
+		const withRoutes = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: ["webhook", "callback"],
+		});
+		expect(withRoutes.success).toBe(true);
+	});
+
+	it("should accept structured route objects", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: [{ name: "webhook", public: true }],
+		});
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept a mix of strings and objects", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: ["callback", { name: "webhook", public: true }],
+		});
+		expect(result.success).toBe(true);
+	});
+
+	it("should reject route objects with empty name", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: [{ name: "", public: true }],
+		});
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject route objects with missing name", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: [{ public: true }],
+		});
+		expect(result.success).toBe(false);
+	});
+
+	it("should accept route objects without public (defaults to private)", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: [{ name: "internal" }],
+		});
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept route names with slashes and hyphens", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: ["auth/callback", "web-hook", { name: "api/v2/data", public: true }],
+		});
+		expect(result.success).toBe(true);
+	});
+
+	it("should reject route names with path traversal", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: ["../../admin/settings"],
+		});
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject route names starting with special characters", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: ["/leading-slash"],
+		});
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject route object names with path traversal", () => {
+		const result = pluginManifestSchema.safeParse({
+			...makeManifest({}),
+			routes: [{ name: "../escape", public: true }],
+		});
+		expect(result.success).toBe(false);
+	});
+});
+
+describe("normalizeManifestRoute", () => {
+	it("should convert a plain string to { name } object", () => {
+		expect(normalizeManifestRoute("webhook")).toEqual({ name: "webhook" });
+	});
+
+	it("should pass through a structured object unchanged", () => {
+		expect(normalizeManifestRoute({ name: "webhook", public: true })).toEqual({
+			name: "webhook",
+			public: true,
+		});
+	});
+
+	it("should pass through an object without public", () => {
+		expect(normalizeManifestRoute({ name: "internal" })).toEqual({ name: "internal" });
+	});
+});
+
+describe("pluginManifestSchema — storage index field names", () => {
+	it("should accept valid simple index field names", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: ["status", "createdAt", "count"] },
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+
+	it("should accept valid composite index field names", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: [["status", "createdAt"]] },
+			}),
+		);
+		expect(result.success).toBe(true);
+	});
+
+	it("should reject index field names containing SQL injection payloads", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: ["'); DROP TABLE users--"] },
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject index field names with dots (JSON path traversal)", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: ["nested.field"] },
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject index field names with hyphens", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: ["my-field"] },
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject index field names starting with a number", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: ["1field"] },
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject empty index field names", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: [""] },
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+
+	it("should reject malicious field names in composite indexes", () => {
+		const result = pluginManifestSchema.safeParse(
+			makeManifest({
+				items: { indexes: [["status", "'); DROP TABLE--"]] },
+			}),
+		);
+		expect(result.success).toBe(false);
+	});
+});

packages/core/tests/unit/plugins/marketplace-client.test.ts

@@ -0,0 +1,493 @@
+/**
+ * MarketplaceClient + tar parser tests
+ *
+ * Tests:
+ * - createMarketplaceClient factory
+ * - MarketplaceClient.search/getPlugin/getVersions
+ * - Bundle download and extraction (tar + gzip)
+ * - Error handling (unavailable, HTTP errors)
+ * - reportInstall (fire-and-forget)
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+import {
+	createMarketplaceClient,
+	MarketplaceError,
+	MarketplaceUnavailableError,
+	type MarketplaceClient,
+	type MarketplacePluginDetail,
+	type MarketplaceSearchResult,
+} from "../../../src/plugins/marketplace.js";
+
+const HEX_64_PATTERN = /^[a-f0-9]{64}$/;
+
+// ── Helpers ───────────<E29480><E29480><EFBFBD>────────────────────────────────────────────
+
+/**
+ * Create a minimal tar archive from a map of filename → content.
+ * Returns an uncompressed tar buffer.
+ */
+function createTar(files: Record<string, string>): Uint8Array {
+	const blocks: Uint8Array[] = [];
+	const encoder = new TextEncoder();
+
+	for (const [name, content] of Object.entries(files)) {
+		const contentBytes = encoder.encode(content);
+		const size = contentBytes.length;
+
+		// Create 512-byte header
+		const header = new Uint8Array(512);
+		// Name (bytes 0-99)
+		const nameBytes = encoder.encode(name);
+		header.set(nameBytes.subarray(0, 100), 0);
+
+		// File mode (bytes 100-107): "0000644\0"
+		header.set(encoder.encode("0000644\0"), 100);
+
+		// UID (bytes 108-115): "0000000\0"
+		header.set(encoder.encode("0000000\0"), 108);
+
+		// GID (bytes 116-123): "0000000\0"
+		header.set(encoder.encode("0000000\0"), 116);
+
+		// Size in octal (bytes 124-135)
+		const sizeOctal = size.toString(8).padStart(11, "0") + "\0";
+		header.set(encoder.encode(sizeOctal), 124);
+
+		// Mtime (bytes 136-147): "00000000000\0"
+		header.set(encoder.encode("00000000000\0"), 136);
+
+		// Type flag (byte 156): '0' for regular file
+		header[156] = 0x30;
+
+		// Checksum (bytes 148-155): compute after setting spaces
+		// Initially fill with spaces
+		header.set(encoder.encode("        "), 148);
+
+		// Compute checksum (sum of all unsigned bytes in header)
+		let checksum = 0;
+		for (let i = 0; i < 512; i++) {
+			checksum += header[i]!;
+		}
+		const checksumOctal = checksum.toString(8).padStart(6, "0") + "\0 ";
+		header.set(encoder.encode(checksumOctal), 148);
+
+		blocks.push(header);
+
+		// File data (padded to 512-byte boundary)
+		const paddedSize = Math.ceil(size / 512) * 512;
+		const dataBlock = new Uint8Array(paddedSize);
+		dataBlock.set(contentBytes, 0);
+		blocks.push(dataBlock);
+	}
+
+	// Two 512-byte zero blocks = end of archive
+	blocks.push(new Uint8Array(1024));
+
+	// Concatenate all blocks
+	const totalSize = blocks.reduce((sum, b) => sum + b.length, 0);
+	const tar = new Uint8Array(totalSize);
+	let offset = 0;
+	for (const block of blocks) {
+		tar.set(block, offset);
+		offset += block.length;
+	}
+
+	return tar;
+}
+
+/**
+ * Gzip compress data using CompressionStream
+ */
+async function gzip(data: Uint8Array): Promise<Uint8Array> {
+	const cs = new CompressionStream("gzip");
+	const writer = cs.writable.getWriter();
+	const reader = cs.readable.getReader();
+
+	const writePromise = writer.write(data).then(() => writer.close());
+	const chunks: Uint8Array[] = [];
+	let totalLength = 0;
+
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		chunks.push(value);
+		totalLength += value.length;
+	}
+	await writePromise;
+
+	const result = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const chunk of chunks) {
+		result.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return result;
+}
+
+const BASE_URL = "https://marketplace.example.com";
+
+function mockPlugin(): MarketplacePluginDetail {
+	return {
+		id: "test-seo",
+		name: "Test SEO",
+		description: "SEO plugin",
+		author: { name: "Test Author", verified: true, avatarUrl: null },
+		capabilities: ["hooks"],
+		keywords: ["seo"],
+		installCount: 42,
+		hasIcon: false,
+		iconUrl: `${BASE_URL}/api/v1/plugins/test-seo/icon`,
+		createdAt: "2026-01-01T00:00:00Z",
+		updatedAt: "2026-02-01T00:00:00Z",
+		repositoryUrl: "https://github.com/test/test-seo",
+		homepageUrl: null,
+		license: "MIT",
+		latestVersion: {
+			version: "1.0.0",
+			minEmDashVersion: null,
+			bundleSize: 1234,
+			checksum: "abc123",
+			changelog: "Initial release",
+			readme: "# Test SEO",
+			hasIcon: false,
+			screenshotCount: 0,
+			screenshotUrls: [],
+			capabilities: ["hooks"],
+			auditVerdict: "pass",
+			imageAuditVerdict: "pass",
+			publishedAt: "2026-01-01T00:00:00Z",
+		},
+	};
+}
+
+describe("MarketplaceClient", () => {
+	let client: MarketplaceClient;
+	let fetchSpy: ReturnType<typeof vi.fn>;
+
+	beforeEach(() => {
+		client = createMarketplaceClient(BASE_URL);
+		fetchSpy = vi.fn();
+		vi.stubGlobal("fetch", fetchSpy);
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	describe("search", () => {
+		it("fetches plugins from marketplace", async () => {
+			const searchResult: MarketplaceSearchResult = {
+				items: [
+					{
+						id: "test-seo",
+						name: "Test SEO",
+						description: "SEO plugin",
+						author: { name: "Test", verified: true, avatarUrl: null },
+						capabilities: ["hooks"],
+						keywords: ["seo"],
+						installCount: 10,
+						hasIcon: false,
+						iconUrl: `${BASE_URL}/api/v1/plugins/test-seo/icon`,
+						createdAt: "2026-01-01T00:00:00Z",
+						updatedAt: "2026-02-01T00:00:00Z",
+					},
+				],
+			};
+
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify(searchResult), {
+					status: 200,
+					headers: { "Content-Type": "application/json" },
+				}),
+			);
+
+			const result = await client.search("seo");
+			expect(result.items).toHaveLength(1);
+			expect(result.items[0]!.id).toBe("test-seo");
+
+			expect(fetchSpy).toHaveBeenCalledWith(
+				`${BASE_URL}/api/v1/plugins?q=seo`,
+				expect.objectContaining({ headers: { Accept: "application/json" } }),
+			);
+		});
+
+		it("passes category and limit as query params", async () => {
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify({ items: [] }), { status: 200 }));
+
+			await client.search(undefined, { category: "analytics", limit: 10 });
+
+			const [url] = fetchSpy.mock.calls[0]!;
+			expect(url).toContain("category=analytics");
+			expect(url).toContain("limit=10");
+		});
+
+		it("throws MarketplaceUnavailableError on network failure", async () => {
+			fetchSpy.mockRejectedValueOnce(new Error("Network error"));
+
+			await expect(client.search("test")).rejects.toThrow(MarketplaceUnavailableError);
+		});
+
+		it("throws MarketplaceError on HTTP error", async () => {
+			fetchSpy.mockResolvedValueOnce(
+				new Response(JSON.stringify({ error: "Rate limited" }), { status: 429 }),
+			);
+
+			await expect(client.search("test")).rejects.toThrow(MarketplaceError);
+		});
+	});
+
+	describe("getPlugin", () => {
+		it("fetches plugin detail", async () => {
+			const plugin = mockPlugin();
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(plugin), { status: 200 }));
+
+			const result = await client.getPlugin("test-seo");
+			expect(result.id).toBe("test-seo");
+			expect(result.latestVersion?.version).toBe("1.0.0");
+		});
+
+		it("encodes plugin ID in URL", async () => {
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify(mockPlugin()), { status: 200 }));
+
+			await client.getPlugin("@scope/plugin");
+
+			const [url] = fetchSpy.mock.calls[0]!;
+			expect(url).toContain("%40scope%2Fplugin");
+		});
+	});
+
+	describe("getVersions", () => {
+		it("fetches version list", async () => {
+			fetchSpy.mockResolvedValueOnce(
+				new Response(
+					JSON.stringify({
+						items: [
+							{
+								version: "1.0.0",
+								minEmDashVersion: null,
+								bundleSize: 1234,
+								checksum: "abc",
+								changelog: "First",
+								capabilities: ["hooks"],
+								auditVerdict: "pass",
+								imageAuditVerdict: "pass",
+								publishedAt: "2026-01-01T00:00:00Z",
+							},
+						],
+					}),
+					{ status: 200 },
+				),
+			);
+
+			const versions = await client.getVersions("test-seo");
+			expect(versions).toHaveLength(1);
+			expect(versions[0]!.version).toBe("1.0.0");
+		});
+	});
+
+	describe("downloadBundle", () => {
+		it("downloads, decompresses, and extracts a bundle tarball", async () => {
+			const manifest = {
+				id: "test-seo",
+				version: "1.0.0",
+				capabilities: ["read:content"],
+				allowedHosts: [],
+				storage: {},
+				hooks: [],
+				routes: [],
+				admin: {},
+			};
+
+			const tarData = createTar({
+				"manifest.json": JSON.stringify(manifest),
+				"backend.js": 'export default function() { return "hello"; }',
+			});
+			const gzipped = await gzip(tarData);
+
+			fetchSpy.mockResolvedValueOnce(
+				new Response(gzipped, {
+					status: 200,
+					headers: { "Content-Type": "application/gzip" },
+				}),
+			);
+
+			const bundle = await client.downloadBundle("test-seo", "1.0.0");
+
+			expect(bundle.manifest.id).toBe("test-seo");
+			expect(bundle.manifest.version).toBe("1.0.0");
+			expect(bundle.backendCode).toContain("hello");
+			expect(bundle.checksum).toMatch(HEX_64_PATTERN);
+		});
+
+		it("extracts optional admin.js", async () => {
+			const manifest = {
+				id: "test-seo",
+				version: "1.0.0",
+				capabilities: [],
+				allowedHosts: [],
+				storage: {},
+				hooks: [],
+				routes: [],
+				admin: {},
+			};
+
+			const tarData = createTar({
+				"manifest.json": JSON.stringify(manifest),
+				"backend.js": "export default {};",
+				"admin.js": "export const Admin = {};",
+			});
+			const gzipped = await gzip(tarData);
+
+			fetchSpy.mockResolvedValueOnce(new Response(gzipped, { status: 200 }));
+
+			const bundle = await client.downloadBundle("test-seo", "1.0.0");
+			expect(bundle.adminCode).toContain("Admin");
+		});
+
+		it("throws on missing manifest.json", async () => {
+			const tarData = createTar({
+				"backend.js": "export default {};",
+			});
+			const gzipped = await gzip(tarData);
+
+			fetchSpy.mockResolvedValueOnce(new Response(gzipped, { status: 200 }));
+
+			await expect(client.downloadBundle("test-seo", "1.0.0")).rejects.toThrow(
+				"missing manifest.json",
+			);
+		});
+
+		it("throws on missing backend.js", async () => {
+			const tarData = createTar({
+				"manifest.json": JSON.stringify({
+					id: "test",
+					version: "1.0.0",
+					capabilities: [],
+					allowedHosts: [],
+					storage: {},
+					hooks: [],
+					routes: [],
+					admin: {},
+				}),
+			});
+			const gzipped = await gzip(tarData);
+
+			fetchSpy.mockResolvedValueOnce(new Response(gzipped, { status: 200 }));
+
+			await expect(client.downloadBundle("test-seo", "1.0.0")).rejects.toThrow(
+				"missing backend.js",
+			);
+		});
+
+		it("throws on malformed manifest.json", async () => {
+			const tarData = createTar({
+				"manifest.json": "not-json{{{",
+				"backend.js": "export default {};",
+			});
+			const gzipped = await gzip(tarData);
+
+			fetchSpy.mockResolvedValueOnce(new Response(gzipped, { status: 200 }));
+
+			await expect(client.downloadBundle("test-seo", "1.0.0")).rejects.toThrow(
+				"malformed manifest.json",
+			);
+		});
+
+		it("throws MarketplaceUnavailableError on network failure", async () => {
+			fetchSpy.mockRejectedValueOnce(new Error("Connection refused"));
+
+			await expect(client.downloadBundle("test-seo", "1.0.0")).rejects.toThrow(
+				MarketplaceUnavailableError,
+			);
+		});
+
+		it("throws on HTTP error from bundle download", async () => {
+			fetchSpy.mockResolvedValueOnce(new Response("Not Found", { status: 404 }));
+
+			await expect(client.downloadBundle("test-seo", "1.0.0")).rejects.toThrow(MarketplaceError);
+		});
+	});
+
+	describe("reportInstall", () => {
+		it("sends install stat without throwing", async () => {
+			fetchSpy.mockResolvedValueOnce(new Response("OK", { status: 200 }));
+
+			// Should not throw even if we await it
+			await client.reportInstall("test-seo", "1.0.0");
+
+			expect(fetchSpy).toHaveBeenCalledWith(
+				`${BASE_URL}/api/v1/plugins/test-seo/installs`,
+				expect.objectContaining({
+					method: "POST",
+					headers: { "Content-Type": "application/json" },
+				}),
+			);
+		});
+
+		it("does not throw on network failure", async () => {
+			fetchSpy.mockRejectedValueOnce(new Error("Network error"));
+
+			// Should not throw
+			await client.reportInstall("test-seo", "1.0.0");
+		});
+	});
+
+	describe("trailing slash handling", () => {
+		it("strips trailing slashes from base URL", async () => {
+			const clientWithSlash = createMarketplaceClient("https://example.com/");
+			fetchSpy.mockResolvedValueOnce(new Response(JSON.stringify({ items: [] }), { status: 200 }));
+
+			await clientWithSlash.search("test");
+
+			const [url] = fetchSpy.mock.calls[0]!;
+			expect(url).toContain("https://example.com/api/v1/plugins");
+			expect(url).not.toContain("//api");
+		});
+	});
+});
+
+describe("tar parser", () => {
+	it("handles files with ./ prefix in paths", async () => {
+		// Create tar with ./ prefixed paths (common from tar tools)
+		const manifest = {
+			id: "test",
+			version: "1.0.0",
+			capabilities: [],
+			allowedHosts: [],
+			storage: {},
+			hooks: [],
+			routes: [],
+			admin: {},
+		};
+		const files: Record<string, string> = {};
+		files["./manifest.json"] = JSON.stringify(manifest);
+		files["./backend.js"] = "export default {};";
+
+		const tarData = createTar(files);
+		const gzipped = await gzip(tarData);
+
+		const fetchSpy = vi.fn().mockResolvedValueOnce(new Response(gzipped, { status: 200 }));
+		vi.stubGlobal("fetch", fetchSpy);
+
+		const client = createMarketplaceClient("https://example.com");
+		const bundle = await client.downloadBundle("test", "1.0.0");
+
+		expect(bundle.manifest.id).toBe("test");
+		vi.restoreAllMocks();
+	});
+
+	it("handles empty tar archive gracefully", async () => {
+		// Just two zero blocks (empty archive)
+		const emptyTar = new Uint8Array(1024);
+		const gzipped = await gzip(emptyTar);
+
+		const fetchSpy = vi.fn().mockResolvedValueOnce(new Response(gzipped, { status: 200 }));
+		vi.stubGlobal("fetch", fetchSpy);
+
+		const client = createMarketplaceClient("https://example.com");
+		await expect(client.downloadBundle("test", "1.0.0")).rejects.toThrow("missing manifest.json");
+		vi.restoreAllMocks();
+	});
+});

packages/core/tests/unit/plugins/marketplace-state.test.ts

@@ -0,0 +1,108 @@
+/**
+ * Marketplace plugin state tests
+ *
+ * Tests the PluginStateRepository marketplace extensions:
+ * - source/marketplaceVersion fields in upsert
+ * - getMarketplacePlugins filter
+ * - Migration 022 columns
+ */
+
+import BetterSqlite3 from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database as DbSchema } from "../../../src/database/types.js";
+import { PluginStateRepository } from "../../../src/plugins/state.js";
+
+describe("PluginStateRepository – marketplace extensions", () => {
+	let db: Kysely<DbSchema>;
+	let sqliteDb: BetterSqlite3.Database;
+	let repo: PluginStateRepository;
+
+	beforeEach(async () => {
+		sqliteDb = new BetterSqlite3(":memory:");
+		db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({ database: sqliteDb }),
+		});
+		await runMigrations(db);
+		repo = new PluginStateRepository(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqliteDb.close();
+	});
+
+	describe("upsert with marketplace source", () => {
+		it("defaults source to 'config' when not specified", async () => {
+			const state = await repo.upsert("test-plugin", "1.0.0", "active");
+			expect(state.source).toBe("config");
+			expect(state.marketplaceVersion).toBeNull();
+		});
+
+		it("stores source='marketplace' and marketplaceVersion", async () => {
+			const state = await repo.upsert("mp-plugin", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+			expect(state.source).toBe("marketplace");
+			expect(state.marketplaceVersion).toBe("1.0.0");
+		});
+
+		it("updates marketplaceVersion on subsequent upsert", async () => {
+			await repo.upsert("mp-plugin", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			const updated = await repo.upsert("mp-plugin", "2.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "2.0.0",
+			});
+
+			expect(updated.version).toBe("2.0.0");
+			expect(updated.marketplaceVersion).toBe("2.0.0");
+		});
+	});
+
+	describe("getMarketplacePlugins", () => {
+		it("returns empty array when no marketplace plugins", async () => {
+			await repo.upsert("config-plugin", "1.0.0", "active");
+			const result = await repo.getMarketplacePlugins();
+			expect(result).toEqual([]);
+		});
+
+		it("returns only marketplace-sourced plugins", async () => {
+			await repo.upsert("config-plugin", "1.0.0", "active");
+			await repo.upsert("mp-plugin-a", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+			await repo.upsert("mp-plugin-b", "2.0.0", "inactive", {
+				source: "marketplace",
+				marketplaceVersion: "2.0.0",
+			});
+
+			const result = await repo.getMarketplacePlugins();
+			expect(result).toHaveLength(2);
+			expect(result.map((p) => p.pluginId).toSorted()).toEqual(["mp-plugin-a", "mp-plugin-b"]);
+			expect(result.every((p) => p.source === "marketplace")).toBe(true);
+		});
+	});
+
+	describe("delete marketplace plugin", () => {
+		it("deletes marketplace plugin state", async () => {
+			await repo.upsert("mp-plugin", "1.0.0", "active", {
+				source: "marketplace",
+				marketplaceVersion: "1.0.0",
+			});
+
+			const deleted = await repo.delete("mp-plugin");
+			expect(deleted).toBe(true);
+
+			const state = await repo.get("mp-plugin");
+			expect(state).toBeNull();
+		});
+	});
+});

packages/core/tests/unit/plugins/page-context.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Page Context Tests
+ *
+ * Tests the public page context builder for:
+ * - Astro-like input handling
+ * - URL string and object input
+ * - Default pageType resolution
+ * - Null normalization for optional fields
+ */
+
+import { describe, it, expect } from "vitest";
+
+import { createPublicPageContext } from "../../../src/page/context.js";
+
+describe("createPublicPageContext", () => {
+	it("accepts Astro-like input and extracts url/path/locale", () => {
+		const result = createPublicPageContext({
+			Astro: {
+				url: new URL("https://example.com/blog/hello"),
+				currentLocale: "en",
+			},
+			kind: "content",
+			title: "Hello",
+		});
+
+		expect(result.url).toBe("https://example.com/blog/hello");
+		expect(result.path).toBe("/blog/hello");
+		expect(result.locale).toBe("en");
+		expect(result.title).toBe("Hello");
+	});
+
+	it("accepts URL string input", () => {
+		const result = createPublicPageContext({
+			url: "https://example.com/about",
+			kind: "custom",
+			locale: "fr",
+		});
+
+		expect(result.url).toBe("https://example.com/about");
+		expect(result.path).toBe("/about");
+		expect(result.locale).toBe("fr");
+	});
+
+	it("accepts URL object input", () => {
+		const urlObj = new URL("https://example.com/products?page=2");
+
+		const result = createPublicPageContext({
+			url: urlObj,
+			kind: "custom",
+		});
+
+		expect(result.url).toBe("https://example.com/products?page=2");
+		expect(result.path).toBe("/products");
+	});
+
+	it('defaults pageType to "article" for content kind', () => {
+		const result = createPublicPageContext({
+			url: "https://example.com/post/1",
+			kind: "content",
+		});
+
+		expect(result.pageType).toBe("article");
+	});
+
+	it('defaults pageType to "website" for custom kind', () => {
+		const result = createPublicPageContext({
+			url: "https://example.com/",
+			kind: "custom",
+		});
+
+		expect(result.pageType).toBe("website");
+	});
+
+	it("normalizes undefined locale to null", () => {
+		const result = createPublicPageContext({
+			Astro: {
+				url: new URL("https://example.com/"),
+				// currentLocale not set
+			},
+			kind: "custom",
+		});
+
+		expect(result.locale).toBeNull();
+	});
+
+	it("normalizes content slug undefined to null", () => {
+		const result = createPublicPageContext({
+			url: "https://example.com/post/1",
+			kind: "content",
+			content: { collection: "posts", id: "abc123" },
+		});
+
+		expect(result.content).toBeDefined();
+		expect(result.content!.slug).toBeNull();
+		expect(result.content!.collection).toBe("posts");
+		expect(result.content!.id).toBe("abc123");
+	});
+
+	it("sets content to undefined for custom kind", () => {
+		const result = createPublicPageContext({
+			url: "https://example.com/about",
+			kind: "custom",
+		});
+
+		expect(result.content).toBeUndefined();
+	});
+});

packages/core/tests/unit/plugins/page-contribution-sandbox.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect } from "vitest";
+
+/**
+ * Tests for the sandbox boundary enforcement of page contribution hooks.
+ *
+ * page:metadata is sandbox-safe.
+ * page:fragments is trusted-only but valid in manifests (enforcement happens
+ * at runtime via capability checks and at bundle time via CLI warnings).
+ *
+ * The enforcement happens at multiple layers:
+ * 1. Manifest schema: HOOK_NAMES includes both page:metadata and page:fragments
+ * 2. Capability enforcement: page:fragments requires page:inject capability
+ * 3. Bundle CLI: warns when page:fragments is declared in a sandbox-targeted plugin
+ * 4. Fragment collector: never invokes sandboxed plugins for page:fragments
+ */
+
+describe("page contribution sandbox boundary", () => {
+	describe("manifest schema validation", () => {
+		it("should accept page:metadata in manifests", async () => {
+			const { pluginManifestSchema } = await import("../../../src/plugins/manifest-schema.js");
+
+			const manifest = {
+				id: "test-plugin",
+				version: "1.0.0",
+				capabilities: [],
+				allowedHosts: [],
+				storage: {},
+				hooks: [{ name: "page:metadata" }],
+				routes: [],
+				admin: { pages: [], widgets: [] },
+			};
+
+			const result = pluginManifestSchema.safeParse(manifest);
+			expect(result.success).toBe(true);
+		});
+
+		it("should accept page:fragments in manifests (enforcement is at runtime)", async () => {
+			const { pluginManifestSchema } = await import("../../../src/plugins/manifest-schema.js");
+
+			const manifest = {
+				id: "test-plugin",
+				version: "1.0.0",
+				capabilities: [],
+				allowedHosts: [],
+				storage: {},
+				hooks: [{ name: "page:fragments" }],
+				routes: [],
+				admin: { pages: [], widgets: [] },
+			};
+
+			// Manifest validation accepts page:fragments — trusted-only enforcement
+			// happens via capability checks (requires page:inject) and the bundle CLI
+			// warns when this hook is used in a sandbox-targeted plugin.
+			const result = pluginManifestSchema.safeParse(manifest);
+			expect(result.success).toBe(true);
+		});
+	});
+
+	describe("fragment collector defense-in-depth", () => {
+		it("resolveFragments only processes contributions it receives", async () => {
+			// The fragment collector in page/fragments.ts is a pure function that
+			// processes whatever contributions are passed to it. The defense-in-depth
+			// is that the runtime never passes sandboxed plugin contributions to it.
+			// This test verifies the pure function works correctly.
+			const { resolveFragments } = await import("../../../src/page/fragments.js");
+
+			const result = resolveFragments([], "head");
+			expect(result).toEqual([]);
+		});
+	});
+});

packages/core/tests/unit/plugins/page-fragments.test.ts

@@ -0,0 +1,222 @@
+/**
+ * Page Fragments Tests
+ *
+ * Tests the fragment collector for:
+ * - Filtering contributions by placement
+ * - Deduplication by key and src
+ * - HTML rendering of script and raw HTML fragments
+ */
+
+import { describe, it, expect } from "vitest";
+
+import { resolveFragments, renderFragments } from "../../../src/page/fragments.js";
+import type { PageFragmentContribution } from "../../../src/plugins/types.js";
+
+describe("resolveFragments", () => {
+	it("filters by placement", () => {
+		const contributions: PageFragmentContribution[] = [
+			{ kind: "html", placement: "head", html: "<link>" },
+			{ kind: "html", placement: "body:end", html: "<div>footer</div>" },
+			{ kind: "html", placement: "head", html: "<style></style>" },
+		];
+
+		const result = resolveFragments(contributions, "head");
+
+		expect(result).toHaveLength(2);
+		expect(result[0]!.kind).toBe("html");
+		expect((result[0] as { html: string }).html).toBe("<link>");
+		expect((result[1] as { html: string }).html).toBe("<style></style>");
+	});
+
+	it("dedupes by key + placement", () => {
+		const contributions: PageFragmentContribution[] = [
+			{ kind: "html", placement: "head", html: "<link first>", key: "my-styles" },
+			{ kind: "html", placement: "head", html: "<link second>", key: "my-styles" },
+		];
+
+		const result = resolveFragments(contributions, "head");
+
+		expect(result).toHaveLength(1);
+		expect((result[0] as { html: string }).html).toBe("<link first>");
+	});
+
+	it("dedupes external scripts by src", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "external-script",
+				placement: "body:end",
+				src: "https://cdn.example.com/lib.js",
+				async: true,
+			},
+			{
+				kind: "external-script",
+				placement: "body:end",
+				src: "https://cdn.example.com/lib.js",
+				defer: true,
+			},
+		];
+
+		const result = resolveFragments(contributions, "body:end");
+
+		expect(result).toHaveLength(1);
+		expect((result[0] as { async?: boolean }).async).toBe(true);
+	});
+
+	it("allows different placements of same key", () => {
+		const contributions: PageFragmentContribution[] = [
+			{ kind: "html", placement: "head", html: "<meta>", key: "seo" },
+			{ kind: "html", placement: "body:end", html: "<noscript>", key: "seo" },
+		];
+
+		const headResult = resolveFragments(contributions, "head");
+		const bodyResult = resolveFragments(contributions, "body:end");
+
+		expect(headResult).toHaveLength(1);
+		expect(bodyResult).toHaveLength(1);
+	});
+
+	it("preserves order", () => {
+		const contributions: PageFragmentContribution[] = [
+			{ kind: "html", placement: "head", html: "<first>" },
+			{ kind: "html", placement: "head", html: "<second>" },
+			{ kind: "html", placement: "head", html: "<third>" },
+		];
+
+		const result = resolveFragments(contributions, "head");
+
+		expect(result).toHaveLength(3);
+		expect((result[0] as { html: string }).html).toBe("<first>");
+		expect((result[1] as { html: string }).html).toBe("<second>");
+		expect((result[2] as { html: string }).html).toBe("<third>");
+	});
+});
+
+describe("renderFragments", () => {
+	it("renders external script with async/defer", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "external-script",
+				placement: "head",
+				src: "https://cdn.example.com/analytics.js",
+				async: true,
+				defer: true,
+			},
+		];
+
+		const html = renderFragments(contributions, "head");
+
+		expect(html).toBe('<script src="https://cdn.example.com/analytics.js" async defer></script>');
+	});
+
+	it("renders external script with attributes", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "external-script",
+				placement: "head",
+				src: "https://cdn.example.com/widget.js",
+				attributes: { "data-site-id": "abc123", crossorigin: "anonymous" },
+			},
+		];
+
+		const html = renderFragments(contributions, "head");
+
+		expect(html).toContain('src="https://cdn.example.com/widget.js"');
+		expect(html).toContain('data-site-id="abc123"');
+		expect(html).toContain('crossorigin="anonymous"');
+		expect(html).toContain("</script>");
+	});
+
+	it("renders inline script", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "inline-script",
+				placement: "body:end",
+				code: "console.log('hello');",
+			},
+		];
+
+		const html = renderFragments(contributions, "body:end");
+
+		expect(html).toBe("<script>console.log('hello');</script>");
+	});
+
+	it("escapes </script> in inline script code", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "inline-script",
+				placement: "head",
+				code: 'var x = "</script><script>alert(1)</script>";',
+			},
+		];
+
+		const html = renderFragments(contributions, "head");
+
+		// The </ sequence should be escaped to <\/ to prevent tag breakout
+		expect(html).not.toContain("</script><script>");
+		expect(html).toContain("<\\/script>");
+	});
+
+	it("renders raw HTML", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "html",
+				placement: "body:start",
+				html: '<div id="overlay"></div>',
+			},
+		];
+
+		const html = renderFragments(contributions, "body:start");
+
+		expect(html).toBe('<div id="overlay"></div>');
+	});
+
+	it("escapes attribute names and values", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "external-script",
+				placement: "head",
+				src: "https://example.com/x.js",
+				attributes: { 'data-"key': 'val<ue&"more' },
+			},
+		];
+
+		const html = renderFragments(contributions, "head");
+
+		expect(html).toContain("data-&quot;key");
+		expect(html).toContain("val&lt;ue&amp;&quot;more");
+		expect(html).not.toContain('data-"key');
+	});
+
+	it("strips event handler attributes", () => {
+		const contributions: PageFragmentContribution[] = [
+			{
+				kind: "external-script",
+				placement: "head",
+				src: "https://example.com/x.js",
+				attributes: {
+					onload: "alert(1)",
+					onerror: "alert(2)",
+					"data-id": "safe",
+					crossorigin: "anonymous",
+				},
+			},
+		];
+
+		const html = renderFragments(contributions, "head");
+
+		expect(html).not.toContain("onload");
+		expect(html).not.toContain("onerror");
+		expect(html).toContain('data-id="safe"');
+		expect(html).toContain('crossorigin="anonymous"');
+	});
+
+	it("returns empty string for no matching placement", () => {
+		const contributions: PageFragmentContribution[] = [
+			{ kind: "html", placement: "head", html: "<link>" },
+		];
+
+		const html = renderFragments(contributions, "body:end");
+
+		expect(html).toBe("");
+	});
+});

packages/core/tests/unit/plugins/page-metadata.test.ts

@@ -0,0 +1,304 @@
+/**
+ * Page Metadata Tests
+ *
+ * Tests the metadata collector for:
+ * - Resolving contributions into deduplicated metadata
+ * - HTML rendering with proper escaping
+ * - Safe JSON-LD serialization
+ * - HTML attribute escaping
+ */
+
+import { describe, it, expect } from "vitest";
+
+import {
+	resolvePageMetadata,
+	renderPageMetadata,
+	safeJsonLdSerialize,
+	escapeHtmlAttr,
+} from "../../../src/page/metadata.js";
+import type { PageMetadataContribution } from "../../../src/plugins/types.js";
+
+describe("resolvePageMetadata", () => {
+	it("resolves meta tags correctly", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "meta", name: "description", content: "A test page" },
+			{ kind: "meta", name: "robots", content: "index, follow" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.meta).toEqual([
+			{ name: "description", content: "A test page" },
+			{ name: "robots", content: "index, follow" },
+		]);
+	});
+
+	it("resolves property tags correctly", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "property", property: "og:title", content: "My Page" },
+			{ kind: "property", property: "og:type", content: "article" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.properties).toEqual([
+			{ property: "og:title", content: "My Page" },
+			{ property: "og:type", content: "article" },
+		]);
+	});
+
+	it("resolves canonical link", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "link", rel: "canonical", href: "https://example.com/page" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.links).toEqual([{ rel: "canonical", href: "https://example.com/page" }]);
+	});
+
+	it("resolves alternate links with hreflang", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "link", rel: "alternate", href: "https://example.com/en/page", hreflang: "en" },
+			{ kind: "link", rel: "alternate", href: "https://example.com/fr/page", hreflang: "fr" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.links).toEqual([
+			{ rel: "alternate", href: "https://example.com/en/page", hreflang: "en" },
+			{ rel: "alternate", href: "https://example.com/fr/page", hreflang: "fr" },
+		]);
+	});
+
+	it("resolves JSON-LD", () => {
+		const graph = { "@type": "Article", name: "Test" };
+		const contributions: PageMetadataContribution[] = [{ kind: "jsonld", id: "article", graph }];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.jsonld).toHaveLength(1);
+		expect(result.jsonld[0]!.id).toBe("article");
+		expect(JSON.parse(result.jsonld[0]!.json)).toEqual(graph);
+	});
+
+	it("first-wins dedupe for meta by name", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "meta", name: "description", content: "First" },
+			{ kind: "meta", name: "description", content: "Second" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.meta).toHaveLength(1);
+		expect(result.meta[0]!.content).toBe("First");
+	});
+
+	it("first-wins dedupe for meta by explicit key", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "meta", name: "description", content: "First", key: "seo-desc" },
+			{ kind: "meta", name: "og-description", content: "Second", key: "seo-desc" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.meta).toHaveLength(1);
+		expect(result.meta[0]!.content).toBe("First");
+	});
+
+	it("first-wins dedupe for property", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "property", property: "og:title", content: "First" },
+			{ kind: "property", property: "og:title", content: "Second" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.properties).toHaveLength(1);
+		expect(result.properties[0]!.content).toBe("First");
+	});
+
+	it("canonical is singleton (second canonical ignored)", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "link", rel: "canonical", href: "https://example.com/first" },
+			{ kind: "link", rel: "canonical", href: "https://example.com/second" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.links).toHaveLength(1);
+		expect(result.links[0]!.href).toBe("https://example.com/first");
+	});
+
+	it("alternate links deduped by hreflang", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "link", rel: "alternate", href: "https://example.com/en/v1", hreflang: "en" },
+			{ kind: "link", rel: "alternate", href: "https://example.com/en/v2", hreflang: "en" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.links).toHaveLength(1);
+		expect(result.links[0]!.href).toBe("https://example.com/en/v1");
+	});
+
+	it("JSON-LD deduped by id", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "jsonld", id: "article", graph: { "@type": "Article", name: "First" } },
+			{ kind: "jsonld", id: "article", graph: { "@type": "Article", name: "Second" } },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.jsonld).toHaveLength(1);
+		expect(JSON.parse(result.jsonld[0]!.json)).toEqual({
+			"@type": "Article",
+			name: "First",
+		});
+	});
+
+	it("JSON-LD without id is always appended", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "jsonld", graph: { "@type": "Article", name: "First" } },
+			{ kind: "jsonld", graph: { "@type": "BreadcrumbList", name: "Second" } },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.jsonld).toHaveLength(2);
+	});
+
+	it("rejects non-HTTP link href (javascript:, data:, blob:)", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "link", rel: "canonical", href: "javascript:alert(1)" },
+			{ kind: "link", rel: "alternate", href: "data:text/html,<h1>hi</h1>", hreflang: "en" },
+			{ kind: "link", rel: "alternate", href: "blob:https://example.com/abc", hreflang: "fr" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.links).toHaveLength(0);
+	});
+
+	it("accepts valid HTTP and HTTPS hrefs", () => {
+		const contributions: PageMetadataContribution[] = [
+			{ kind: "link", rel: "canonical", href: "https://example.com/page" },
+			{ kind: "link", rel: "alternate", href: "http://example.com/en", hreflang: "en" },
+		];
+
+		const result = resolvePageMetadata(contributions);
+
+		expect(result.links).toHaveLength(2);
+	});
+});
+
+describe("renderPageMetadata", () => {
+	it("renders meta tags with escaped attributes", () => {
+		const html = renderPageMetadata({
+			meta: [{ name: 'desc"ription', content: "A <test> & page" }],
+			properties: [],
+			links: [],
+			jsonld: [],
+		});
+
+		expect(html).toBe('<meta name="desc&quot;ription" content="A &lt;test&gt; &amp; page">');
+	});
+
+	it("renders property tags", () => {
+		const html = renderPageMetadata({
+			meta: [],
+			properties: [{ property: "og:title", content: "My Page" }],
+			links: [],
+			jsonld: [],
+		});
+
+		expect(html).toBe('<meta property="og:title" content="My Page">');
+	});
+
+	it("renders link tags with hreflang", () => {
+		const html = renderPageMetadata({
+			meta: [],
+			properties: [],
+			links: [{ rel: "alternate", href: "https://example.com/fr", hreflang: "fr" }],
+			jsonld: [],
+		});
+
+		expect(html).toBe('<link rel="alternate" href="https://example.com/fr" hreflang="fr">');
+	});
+
+	it("renders JSON-LD script tags", () => {
+		const json = JSON.stringify({ "@type": "Article" });
+		const html = renderPageMetadata({
+			meta: [],
+			properties: [],
+			links: [],
+			jsonld: [{ id: "article", json }],
+		});
+
+		expect(html).toBe(`<script type="application/ld+json">${json}</script>`);
+	});
+});
+
+describe("safeJsonLdSerialize", () => {
+	it("escapes </script> in nested values", () => {
+		const result = safeJsonLdSerialize({ text: "</script><script>alert(1)</script>" });
+
+		expect(result).not.toContain("</script>");
+		expect(result).toContain("\\u003c");
+		expect(result).toContain("\\u003e");
+	});
+
+	it("escapes <!-- sequences", () => {
+		const result = safeJsonLdSerialize({ text: "<!-- comment -->" });
+
+		expect(result).not.toContain("<!--");
+		expect(result).toContain("\\u003c");
+	});
+
+	it("escapes U+2028 line separator", () => {
+		const result = safeJsonLdSerialize({ text: "before\u2028after" });
+
+		expect(result).not.toContain("\u2028");
+		expect(result).toContain("\\u2028");
+	});
+
+	it("escapes U+2029 paragraph separator", () => {
+		const result = safeJsonLdSerialize({ text: "before\u2029after" });
+
+		expect(result).not.toContain("\u2029");
+		expect(result).toContain("\\u2029");
+	});
+
+	it("handles normal objects correctly", () => {
+		const obj = { "@type": "Article", name: "Hello World", count: 42 };
+		const result = safeJsonLdSerialize(obj);
+
+		// The result should be parseable back to the same object
+		// (angle brackets are escaped but that's fine for JSON-LD consumers)
+		expect(result).toContain('"@type"');
+		expect(result).toContain('"Hello World"');
+		expect(result).toContain("42");
+	});
+});
+
+describe("escapeHtmlAttr", () => {
+	it("escapes double quotes", () => {
+		expect(escapeHtmlAttr('say "hello"')).toBe("say &quot;hello&quot;");
+	});
+
+	it("escapes angle brackets", () => {
+		expect(escapeHtmlAttr("<script>")).toBe("&lt;script&gt;");
+	});
+
+	it("escapes ampersands", () => {
+		expect(escapeHtmlAttr("foo & bar")).toBe("foo &amp; bar");
+	});
+
+	it("escapes single quotes", () => {
+		expect(escapeHtmlAttr("it's here")).toBe("it&#39;s here");
+	});
+
+	it("passes through safe strings unchanged", () => {
+		expect(escapeHtmlAttr("hello world")).toBe("hello world");
+	});
+});

packages/core/tests/unit/plugins/pipeline-rebuild.test.ts

@@ -0,0 +1,268 @@
+/**
+ * Pipeline Rebuild Tests
+ *
+ * Verifies that rebuilding the HookPipeline after plugin enable/disable
+ * correctly includes/excludes hooks from the affected plugins.
+ *
+ * This tests the fix for #105: disabled plugins' hooks kept firing because
+ * the pipeline was constructed once at startup and never rebuilt.
+ */
+
+import Database from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+import { createHookPipeline, resolveExclusiveHooks } from "../../../src/plugins/hooks.js";
+import type { ResolvedPlugin, ResolvedHook, ContentHookEvent } from "../../../src/plugins/types.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function createTestPlugin(overrides: Partial<ResolvedPlugin> = {}): ResolvedPlugin {
+	return {
+		id: overrides.id ?? "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		allowedHosts: [],
+		storage: {},
+		admin: {
+			pages: [],
+			widgets: [],
+		},
+		hooks: {},
+		routes: {},
+		...overrides,
+	};
+}
+
+function createTestHook<T>(
+	pluginId: string,
+	handler: T,
+	overrides: Partial<ResolvedHook<T>> = {},
+): ResolvedHook<T> {
+	return {
+		pluginId,
+		handler,
+		priority: 100,
+		timeout: 5000,
+		dependencies: [],
+		errorPolicy: "continue",
+		exclusive: false,
+		...overrides,
+	};
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("HookPipeline rebuild on plugin disable/enable (#105)", () => {
+	let sqlite: InstanceType<typeof Database>;
+	let db: Kysely<Record<string, unknown>>;
+
+	beforeEach(() => {
+		sqlite = new Database(":memory:");
+		db = new Kysely<Record<string, unknown>>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqlite.close();
+	});
+
+	it("hooks from disabled plugin do not fire after pipeline rebuild", async () => {
+		const handlerA = vi.fn(async (event: ContentHookEvent) => ({
+			...event.content,
+			pluginA: true,
+		}));
+		const handlerB = vi.fn(async (event: ContentHookEvent) => ({
+			...event.content,
+			pluginB: true,
+		}));
+
+		const pluginA = createTestPlugin({
+			id: "plugin-a",
+			capabilities: ["write:content"],
+			hooks: {
+				"content:beforeSave": createTestHook("plugin-a", handlerA),
+			},
+		});
+
+		const pluginB = createTestPlugin({
+			id: "plugin-b",
+			capabilities: ["write:content"],
+			hooks: {
+				"content:beforeSave": createTestHook("plugin-b", handlerB),
+			},
+		});
+
+		const allPlugins = [pluginA, pluginB];
+
+		// Initial pipeline with both plugins enabled
+		const pipeline1 = createHookPipeline(allPlugins, { db });
+		expect(pipeline1.hasHooks("content:beforeSave")).toBe(true);
+		expect(pipeline1.getHookCount("content:beforeSave")).toBe(2);
+
+		// Run hooks — both should fire
+		const result1 = await pipeline1.runContentBeforeSave({ title: "test" }, "posts", true);
+		expect(handlerA).toHaveBeenCalledTimes(1);
+		expect(handlerB).toHaveBeenCalledTimes(1);
+		expect(result1.content).toEqual({ title: "test", pluginA: true, pluginB: true });
+
+		handlerA.mockClear();
+		handlerB.mockClear();
+
+		// Simulate disabling plugin-b: rebuild pipeline with only plugin-a
+		const enabledPlugins = allPlugins.filter((p) => p.id !== "plugin-b");
+		const pipeline2 = createHookPipeline(enabledPlugins, { db });
+		expect(pipeline2.hasHooks("content:beforeSave")).toBe(true);
+		expect(pipeline2.getHookCount("content:beforeSave")).toBe(1);
+
+		// Run hooks — only plugin-a should fire
+		const result2 = await pipeline2.runContentBeforeSave({ title: "test" }, "posts", true);
+		expect(handlerA).toHaveBeenCalledTimes(1);
+		expect(handlerB).not.toHaveBeenCalled();
+		expect(result2.content).toEqual({ title: "test", pluginA: true });
+	});
+
+	it("hooks from re-enabled plugin fire after pipeline rebuild", async () => {
+		const handlerA = vi.fn(async (event: ContentHookEvent) => ({
+			...event.content,
+			pluginA: true,
+		}));
+		const handlerB = vi.fn(async (event: ContentHookEvent) => ({
+			...event.content,
+			pluginB: true,
+		}));
+
+		const pluginA = createTestPlugin({
+			id: "plugin-a",
+			capabilities: ["write:content"],
+			hooks: {
+				"content:beforeSave": createTestHook("plugin-a", handlerA),
+			},
+		});
+
+		const pluginB = createTestPlugin({
+			id: "plugin-b",
+			capabilities: ["write:content"],
+			hooks: {
+				"content:beforeSave": createTestHook("plugin-b", handlerB),
+			},
+		});
+
+		const allPlugins = [pluginA, pluginB];
+
+		// Start with only plugin-a (plugin-b is disabled)
+		const pipeline1 = createHookPipeline([pluginA], { db });
+		const result1 = await pipeline1.runContentBeforeSave({ title: "test" }, "posts", true);
+		expect(handlerA).toHaveBeenCalledTimes(1);
+		expect(handlerB).not.toHaveBeenCalled();
+		expect(result1.content).toEqual({ title: "test", pluginA: true });
+
+		handlerA.mockClear();
+
+		// Re-enable plugin-b: rebuild pipeline with both
+		const pipeline2 = createHookPipeline(allPlugins, { db });
+		const result2 = await pipeline2.runContentBeforeSave({ title: "test" }, "posts", true);
+		expect(handlerA).toHaveBeenCalledTimes(1);
+		expect(handlerB).toHaveBeenCalledTimes(1);
+		expect(result2.content).toEqual({ title: "test", pluginA: true, pluginB: true });
+	});
+
+	it("exclusive hook selections are re-resolved after rebuild", async () => {
+		const handlerA = vi.fn().mockResolvedValue(undefined);
+		const handlerB = vi.fn().mockResolvedValue(undefined);
+
+		const pluginA = createTestPlugin({
+			id: "provider-a",
+			capabilities: ["email:provide"],
+			hooks: {
+				"email:deliver": createTestHook("provider-a", handlerA, { exclusive: true }),
+			},
+		});
+
+		const pluginB = createTestPlugin({
+			id: "provider-b",
+			capabilities: ["email:provide"],
+			hooks: {
+				"email:deliver": createTestHook("provider-b", handlerB, { exclusive: true }),
+			},
+		});
+
+		// Both enabled — two providers, no auto-select
+		const pipeline1 = createHookPipeline([pluginA, pluginB], { db });
+		expect(pipeline1.getExclusiveHookProviders("email:deliver")).toHaveLength(2);
+
+		// Manually select provider-b (simulating admin selection)
+		pipeline1.setExclusiveSelection("email:deliver", "provider-b");
+		expect(pipeline1.getExclusiveSelection("email:deliver")).toBe("provider-b");
+
+		// Disable provider-b: rebuild with only provider-a
+		const pipeline2 = createHookPipeline([pluginA], { db });
+		expect(pipeline2.getExclusiveHookProviders("email:deliver")).toHaveLength(1);
+
+		// Run exclusive hook resolution — should auto-select the sole provider
+		const options = new Map<string, string>();
+		await resolveExclusiveHooks({
+			pipeline: pipeline2,
+			isActive: () => true,
+			getOption: async (key) => options.get(key) ?? null,
+			setOption: async (key, value) => {
+				options.set(key, value);
+			},
+			deleteOption: async (key) => {
+				options.delete(key);
+			},
+		});
+
+		expect(pipeline2.getExclusiveSelection("email:deliver")).toBe("provider-a");
+	});
+
+	it("disabling all plugins with a hook removes that hook entirely", async () => {
+		const handler = vi.fn(async () => undefined);
+
+		const plugin = createTestPlugin({
+			id: "only-plugin",
+			capabilities: ["write:content"],
+			hooks: {
+				"content:beforeSave": createTestHook("only-plugin", handler),
+			},
+		});
+
+		// Pipeline with the plugin
+		const pipeline1 = createHookPipeline([plugin], { db });
+		expect(pipeline1.hasHooks("content:beforeSave")).toBe(true);
+
+		// Disable it: rebuild with empty list
+		const pipeline2 = createHookPipeline([], { db });
+		expect(pipeline2.hasHooks("content:beforeSave")).toBe(false);
+		expect(pipeline2.getHookCount("content:beforeSave")).toBe(0);
+	});
+
+	it("lifecycle hooks for disabled plugin are excluded from pipeline", async () => {
+		const installHandler = vi.fn();
+		const activateHandler = vi.fn();
+
+		const plugin = createTestPlugin({
+			id: "lifecycle-plugin",
+			hooks: {
+				"plugin:install": createTestHook("lifecycle-plugin", installHandler),
+				"plugin:activate": createTestHook("lifecycle-plugin", activateHandler),
+			},
+		});
+
+		// Pipeline with plugin
+		const pipeline1 = createHookPipeline([plugin], { db });
+		expect(pipeline1.hasHooks("plugin:install")).toBe(true);
+		expect(pipeline1.hasHooks("plugin:activate")).toBe(true);
+
+		// Pipeline without plugin (disabled)
+		const pipeline2 = createHookPipeline([], { db });
+		expect(pipeline2.hasHooks("plugin:install")).toBe(false);
+		expect(pipeline2.hasHooks("plugin:activate")).toBe(false);
+	});
+});

packages/core/tests/unit/plugins/plugin-storage.test.ts

@@ -0,0 +1,443 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { PluginStorageRepository } from "../../../src/database/repositories/plugin-storage.js";
+import type { Database } from "../../../src/database/types.js";
+import { IdentifierError } from "../../../src/database/validate.js";
+import { StorageQueryError } from "../../../src/plugins/storage-query.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+interface TestDocument {
+	title: string;
+	status: string;
+	count: number;
+	createdAt: string;
+}
+
+describe("PluginStorageRepository", () => {
+	let db: Kysely<Database>;
+	let repo: PluginStorageRepository<TestDocument>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		repo = new PluginStorageRepository<TestDocument>(db, "test-plugin", "items", [
+			"status",
+			"count",
+			["status", "createdAt"],
+		]);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("get()", () => {
+		it("should return null for non-existent document", async () => {
+			const result = await repo.get("non-existent");
+			expect(result).toBeNull();
+		});
+
+		it("should return document after put", async () => {
+			const doc: TestDocument = {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			};
+
+			await repo.put("doc1", doc);
+			const result = await repo.get("doc1");
+
+			expect(result).toEqual(doc);
+		});
+	});
+
+	describe("put()", () => {
+		it("should store new document", async () => {
+			const doc: TestDocument = {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			};
+
+			await repo.put("doc1", doc);
+
+			const result = await repo.get("doc1");
+			expect(result).toEqual(doc);
+		});
+
+		it("should update existing document", async () => {
+			const doc: TestDocument = {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			};
+
+			await repo.put("doc1", doc);
+
+			const updatedDoc = { ...doc, status: "inactive", count: 10 };
+			await repo.put("doc1", updatedDoc);
+
+			const result = await repo.get("doc1");
+			expect(result).toEqual(updatedDoc);
+		});
+	});
+
+	describe("delete()", () => {
+		it("should return false for non-existent document", async () => {
+			const result = await repo.delete("non-existent");
+			expect(result).toBe(false);
+		});
+
+		it("should delete existing document and return true", async () => {
+			await repo.put("doc1", {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			});
+
+			const result = await repo.delete("doc1");
+			expect(result).toBe(true);
+
+			const doc = await repo.get("doc1");
+			expect(doc).toBeNull();
+		});
+	});
+
+	describe("exists()", () => {
+		it("should return false for non-existent document", async () => {
+			const result = await repo.exists("non-existent");
+			expect(result).toBe(false);
+		});
+
+		it("should return true for existing document", async () => {
+			await repo.put("doc1", {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			});
+
+			const result = await repo.exists("doc1");
+			expect(result).toBe(true);
+		});
+	});
+
+	describe("getMany()", () => {
+		it("should return empty map for empty ids", async () => {
+			const result = await repo.getMany([]);
+			expect(result.size).toBe(0);
+		});
+
+		it("should return only existing documents", async () => {
+			await repo.put("doc1", {
+				title: "Test 1",
+				status: "active",
+				count: 1,
+				createdAt: "2024-01-01",
+			});
+			await repo.put("doc2", {
+				title: "Test 2",
+				status: "active",
+				count: 2,
+				createdAt: "2024-01-02",
+			});
+
+			const result = await repo.getMany(["doc1", "doc2", "doc3"]);
+
+			expect(result.size).toBe(2);
+			expect(result.get("doc1")?.title).toBe("Test 1");
+			expect(result.get("doc2")?.title).toBe("Test 2");
+			expect(result.has("doc3")).toBe(false);
+		});
+	});
+
+	describe("putMany()", () => {
+		it("should handle empty array", async () => {
+			await repo.putMany([]);
+			// Should not throw
+		});
+
+		it("should store multiple documents atomically", async () => {
+			await repo.putMany([
+				{
+					id: "doc1",
+					data: {
+						title: "Test 1",
+						status: "active",
+						count: 1,
+						createdAt: "2024-01-01",
+					},
+				},
+				{
+					id: "doc2",
+					data: {
+						title: "Test 2",
+						status: "inactive",
+						count: 2,
+						createdAt: "2024-01-02",
+					},
+				},
+			]);
+
+			expect(await repo.exists("doc1")).toBe(true);
+			expect(await repo.exists("doc2")).toBe(true);
+		});
+	});
+
+	describe("deleteMany()", () => {
+		it("should return 0 for empty ids", async () => {
+			const count = await repo.deleteMany([]);
+			expect(count).toBe(0);
+		});
+
+		it("should delete multiple documents and return count", async () => {
+			await repo.putMany([
+				{
+					id: "doc1",
+					data: {
+						title: "Test 1",
+						status: "active",
+						count: 1,
+						createdAt: "2024-01-01",
+					},
+				},
+				{
+					id: "doc2",
+					data: {
+						title: "Test 2",
+						status: "active",
+						count: 2,
+						createdAt: "2024-01-02",
+					},
+				},
+				{
+					id: "doc3",
+					data: {
+						title: "Test 3",
+						status: "active",
+						count: 3,
+						createdAt: "2024-01-03",
+					},
+				},
+			]);
+
+			const count = await repo.deleteMany(["doc1", "doc2"]);
+
+			expect(count).toBe(2);
+			expect(await repo.exists("doc1")).toBe(false);
+			expect(await repo.exists("doc2")).toBe(false);
+			expect(await repo.exists("doc3")).toBe(true);
+		});
+	});
+
+	describe("query()", () => {
+		beforeEach(async () => {
+			// Setup test data
+			await repo.putMany([
+				{
+					id: "doc1",
+					data: {
+						title: "Alpha",
+						status: "active",
+						count: 5,
+						createdAt: "2024-01-01",
+					},
+				},
+				{
+					id: "doc2",
+					data: {
+						title: "Beta",
+						status: "active",
+						count: 10,
+						createdAt: "2024-01-02",
+					},
+				},
+				{
+					id: "doc3",
+					data: {
+						title: "Gamma",
+						status: "inactive",
+						count: 15,
+						createdAt: "2024-01-03",
+					},
+				},
+			]);
+		});
+
+		it("should return all documents when no filter", async () => {
+			const result = await repo.query();
+			expect(result.items).toHaveLength(3);
+		});
+
+		it("should filter by equality", async () => {
+			const result = await repo.query({
+				where: { status: "active" },
+			});
+			expect(result.items).toHaveLength(2);
+			expect(result.items.every((i) => i.data.status === "active")).toBe(true);
+		});
+
+		it("should filter by range (gte)", async () => {
+			const result = await repo.query({
+				where: { count: { gte: 10 } },
+			});
+			expect(result.items).toHaveLength(2);
+			expect(result.items.every((i) => i.data.count >= 10)).toBe(true);
+		});
+
+		it("should filter by range (lt)", async () => {
+			const result = await repo.query({
+				where: { count: { lt: 15 } },
+			});
+			expect(result.items).toHaveLength(2);
+			expect(result.items.every((i) => i.data.count < 15)).toBe(true);
+		});
+
+		it("should throw when querying non-indexed field", async () => {
+			await expect(
+				repo.query({
+					where: { title: "Alpha" },
+				}),
+			).rejects.toThrow(StorageQueryError);
+		});
+
+		it("should reject malicious orderBy field names (SQL injection defense)", async () => {
+			// Create a repo that declares a malicious index name to bypass the
+			// "field must be indexed" check and hit the jsonExtract validation
+			const evilRepo = new PluginStorageRepository<TestDocument>(db, "test-plugin", "items", [
+				"'); DROP TABLE _plugin_storage--",
+			]);
+
+			await expect(
+				evilRepo.query({
+					orderBy: { "'); DROP TABLE _plugin_storage--": "asc" },
+				}),
+			).rejects.toThrow(IdentifierError);
+		});
+
+		it("should respect limit", async () => {
+			const result = await repo.query({ limit: 2 });
+			expect(result.items).toHaveLength(2);
+		});
+
+		it("should provide cursor for pagination", async () => {
+			const result = await repo.query({ limit: 2 });
+			expect(result.cursor).toBeDefined();
+		});
+
+		it("should not provide cursor when no more results", async () => {
+			const result = await repo.query({ limit: 10 });
+			expect(result.cursor).toBeUndefined();
+		});
+
+		it("should paginate using cursor", async () => {
+			const page1 = await repo.query({ limit: 2 });
+			expect(page1.items).toHaveLength(2);
+
+			const page2 = await repo.query({ limit: 2, cursor: page1.cursor });
+			expect(page2.items).toHaveLength(1);
+			expect(page2.cursor).toBeUndefined();
+
+			// Ensure no duplicates
+			const allIds = [...page1.items, ...page2.items].map((i) => i.id);
+			expect(new Set(allIds).size).toBe(3);
+		});
+	});
+
+	describe("count()", () => {
+		beforeEach(async () => {
+			await repo.putMany([
+				{
+					id: "doc1",
+					data: {
+						title: "Alpha",
+						status: "active",
+						count: 5,
+						createdAt: "2024-01-01",
+					},
+				},
+				{
+					id: "doc2",
+					data: {
+						title: "Beta",
+						status: "active",
+						count: 10,
+						createdAt: "2024-01-02",
+					},
+				},
+				{
+					id: "doc3",
+					data: {
+						title: "Gamma",
+						status: "inactive",
+						count: 15,
+						createdAt: "2024-01-03",
+					},
+				},
+			]);
+		});
+
+		it("should count all documents when no filter", async () => {
+			const count = await repo.count();
+			expect(count).toBe(3);
+		});
+
+		it("should count with filter", async () => {
+			const count = await repo.count({ status: "active" });
+			expect(count).toBe(2);
+		});
+
+		it("should return 0 for no matches", async () => {
+			const count = await repo.count({ count: { gt: 100 } });
+			expect(count).toBe(0);
+		});
+
+		it("should throw when counting on non-indexed field", async () => {
+			await expect(repo.count({ title: "Alpha" })).rejects.toThrow(StorageQueryError);
+		});
+	});
+
+	// Note: v2 API removed async iterator list() in favor of paginated query()
+	// Use query() with cursor for iteration
+
+	describe("plugin isolation", () => {
+		it("should not see documents from other plugins", async () => {
+			const otherRepo = new PluginStorageRepository<TestDocument>(db, "other-plugin", "items", [
+				"status",
+			]);
+
+			await repo.put("doc1", {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			});
+
+			const result = await otherRepo.get("doc1");
+			expect(result).toBeNull();
+		});
+
+		it("should not see documents from other collections", async () => {
+			const otherRepo = new PluginStorageRepository<TestDocument>(
+				db,
+				"test-plugin",
+				"other-collection",
+				["status"],
+			);
+
+			await repo.put("doc1", {
+				title: "Test",
+				status: "active",
+				count: 5,
+				createdAt: "2024-01-01",
+			});
+
+			const result = await otherRepo.get("doc1");
+			expect(result).toBeNull();
+		});
+	});
+});

packages/core/tests/unit/plugins/request-meta.test.ts

@@ -0,0 +1,486 @@
+/**
+ * Request Metadata Extraction Tests
+ *
+ * Tests for extractRequestMeta():
+ * - IP resolution: CF-Connecting-IP (only with cf object), X-Forwarded-For fallback, null
+ * - IP validation: rejects non-IP values (XSS payloads, garbage)
+ * - Geo extraction from Cloudflare `cf` object on request
+ * - User agent and referer header reads (trimmed)
+ * - IPv6 support
+ */
+
+import { describe, it, expect } from "vitest";
+
+import {
+	extractRequestMeta,
+	sanitizeHeadersForSandbox,
+} from "../../../src/plugins/request-meta.js";
+
+/**
+ * Helper to create a Request with optional headers and cf properties.
+ */
+function createRequest(
+	opts: {
+		headers?: Record<string, string>;
+		cf?: { country?: string; region?: string; city?: string };
+	} = {},
+): Request {
+	const req = new Request("http://localhost/test", {
+		headers: opts.headers,
+	});
+
+	// Attach cf object if provided (simulates Cloudflare Workers runtime)
+	if (opts.cf) {
+		(req as unknown as { cf: typeof opts.cf }).cf = opts.cf;
+	}
+
+	return req;
+}
+
+describe("extractRequestMeta", () => {
+	describe("IP resolution", () => {
+		it("trusts CF-Connecting-IP when cf object is present", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "1.2.3.4",
+					"x-forwarded-for": "5.6.7.8, 9.10.11.12",
+				},
+				cf: { country: "US" },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("1.2.3.4");
+		});
+
+		it("ignores CF-Connecting-IP and XFF when no cf object (spoofed headers)", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "1.2.3.4",
+					"x-forwarded-for": "5.6.7.8, 9.10.11.12",
+				},
+				// No cf object — not on Cloudflare, XFF is untrusted
+			});
+
+			const meta = extractRequestMeta(req);
+			// Neither CF-Connecting-IP nor XFF should be trusted without cf object
+			expect(meta.ip).toBeNull();
+		});
+
+		it("returns null when CF-Connecting-IP is spoofed and no XFF", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "1.2.3.4",
+				},
+				// No cf object
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+
+		it("falls back to X-Forwarded-For when behind Cloudflare (cf object present)", () => {
+			const req = createRequest({
+				headers: {
+					"x-forwarded-for": "5.6.7.8, 9.10.11.12",
+				},
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("5.6.7.8");
+		});
+
+		it("ignores X-Forwarded-For without cf object (standalone deployment)", () => {
+			const req = createRequest({
+				headers: {
+					"x-forwarded-for": "5.6.7.8, 9.10.11.12",
+				},
+				// No cf object — standalone deployment, XFF is spoofable
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+
+		it("handles single IP in X-Forwarded-For with cf object", () => {
+			const req = createRequest({
+				headers: {
+					"x-forwarded-for": "5.6.7.8",
+				},
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("5.6.7.8");
+		});
+
+		it("trims whitespace from X-Forwarded-For entries", () => {
+			const req = createRequest({
+				headers: {
+					"x-forwarded-for": "  5.6.7.8  , 9.10.11.12",
+				},
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("5.6.7.8");
+		});
+
+		it("trims whitespace from CF-Connecting-IP", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "  1.2.3.4  ",
+				},
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("1.2.3.4");
+		});
+
+		it("returns null when no IP headers present", () => {
+			const req = createRequest();
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+
+		it("returns null for empty CF-Connecting-IP with no X-Forwarded-For", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "",
+				},
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+
+		it("falls back to X-Forwarded-For when CF-Connecting-IP is empty", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "",
+					"x-forwarded-for": "5.6.7.8",
+				},
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("5.6.7.8");
+		});
+	});
+
+	describe("IPv6 support", () => {
+		it("handles IPv6 loopback in X-Forwarded-For with cf object", () => {
+			const req = createRequest({
+				headers: { "x-forwarded-for": "::1" },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("::1");
+		});
+
+		it("handles full IPv6 address in X-Forwarded-For with cf object", () => {
+			const req = createRequest({
+				headers: { "x-forwarded-for": "2001:db8::1, 10.0.0.1" },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("2001:db8::1");
+		});
+
+		it("handles IPv6 in CF-Connecting-IP with cf object", () => {
+			const req = createRequest({
+				headers: { "cf-connecting-ip": "2001:db8:85a3::8a2e:370:7334" },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBe("2001:db8:85a3::8a2e:370:7334");
+		});
+	});
+
+	describe("IP validation", () => {
+		it("rejects XSS payload in X-Forwarded-For", () => {
+			const req = createRequest({
+				headers: { "x-forwarded-for": "<script>alert(1)</script>" },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+
+		it("rejects non-IP text in X-Forwarded-For", () => {
+			const req = createRequest({
+				headers: { "x-forwarded-for": "not-an-ip, 1.2.3.4" },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			// First entry is "not-an-ip" which fails validation
+			expect(meta.ip).toBeNull();
+		});
+
+		it("rejects XSS payload in CF-Connecting-IP", () => {
+			const req = createRequest({
+				headers: { "cf-connecting-ip": "<img onerror=alert(1)>" },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+
+		it("rejects empty-looking IP values with only whitespace", () => {
+			const req = createRequest({
+				headers: { "x-forwarded-for": "   " },
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.ip).toBeNull();
+		});
+	});
+
+	describe("geo extraction", () => {
+		it("extracts geo from cf object", () => {
+			const req = createRequest({
+				cf: { country: "US", region: "CA", city: "San Francisco" },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.geo).toEqual({
+				country: "US",
+				region: "CA",
+				city: "San Francisco",
+			});
+		});
+
+		it("returns null geo when no cf object", () => {
+			const req = createRequest();
+
+			const meta = extractRequestMeta(req);
+			expect(meta.geo).toBeNull();
+		});
+
+		it("handles partial geo data", () => {
+			const req = createRequest({
+				cf: { country: "GB" },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.geo).toEqual({
+				country: "GB",
+				region: null,
+				city: null,
+			});
+		});
+
+		it("returns null geo when cf object has no geo fields", () => {
+			const req = createRequest({
+				cf: {},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.geo).toBeNull();
+		});
+	});
+
+	describe("user agent", () => {
+		it("extracts user agent from header", () => {
+			const req = createRequest({
+				headers: {
+					"user-agent": "Mozilla/5.0 (Test)",
+				},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.userAgent).toBe("Mozilla/5.0 (Test)");
+		});
+
+		it("returns null when no user agent header", () => {
+			const req = createRequest();
+
+			const meta = extractRequestMeta(req);
+			expect(meta.userAgent).toBeNull();
+		});
+
+		it("returns null for empty user agent header", () => {
+			const req = createRequest({
+				headers: { "user-agent": "" },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.userAgent).toBeNull();
+		});
+
+		it("trims whitespace from user agent", () => {
+			const req = createRequest({
+				headers: { "user-agent": "  TestBot/1.0  " },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.userAgent).toBe("TestBot/1.0");
+		});
+	});
+
+	describe("referer", () => {
+		it("extracts referer from header", () => {
+			const req = createRequest({
+				headers: {
+					referer: "https://example.com/page",
+				},
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.referer).toBe("https://example.com/page");
+		});
+
+		it("returns null when no referer header", () => {
+			const req = createRequest();
+
+			const meta = extractRequestMeta(req);
+			expect(meta.referer).toBeNull();
+		});
+
+		it("returns null for empty referer header", () => {
+			const req = createRequest({
+				headers: { referer: "" },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.referer).toBeNull();
+		});
+
+		it("trims whitespace from referer", () => {
+			const req = createRequest({
+				headers: { referer: "  https://example.com  " },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta.referer).toBe("https://example.com");
+		});
+	});
+
+	describe("sanitizeHeadersForSandbox", () => {
+		it("strips cookie header", () => {
+			const headers = new Headers({ cookie: "session=abc123", "content-type": "text/html" });
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result).not.toHaveProperty("cookie");
+			expect(result["content-type"]).toBe("text/html");
+		});
+
+		it("strips set-cookie header", () => {
+			const headers = new Headers({ "set-cookie": "token=xyz", accept: "application/json" });
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result).not.toHaveProperty("set-cookie");
+			expect(result.accept).toBe("application/json");
+		});
+
+		it("strips authorization header", () => {
+			const headers = new Headers({ authorization: "Bearer secret-token", host: "example.com" });
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result).not.toHaveProperty("authorization");
+			expect(result.host).toBe("example.com");
+		});
+
+		it("strips proxy-authorization header", () => {
+			const headers = new Headers({ "proxy-authorization": "Basic abc", host: "example.com" });
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result).not.toHaveProperty("proxy-authorization");
+		});
+
+		it("strips Cloudflare Access headers", () => {
+			const headers = new Headers({
+				"cf-access-jwt-assertion": "jwt-token",
+				"cf-access-client-id": "client-id",
+				"cf-access-client-secret": "client-secret",
+				"cf-ray": "abc123",
+			});
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result).not.toHaveProperty("cf-access-jwt-assertion");
+			expect(result).not.toHaveProperty("cf-access-client-id");
+			expect(result).not.toHaveProperty("cf-access-client-secret");
+			expect(result["cf-ray"]).toBe("abc123");
+		});
+
+		it("strips x-emdash-request CSRF header", () => {
+			const headers = new Headers({ "x-emdash-request": "1", "x-custom": "safe" });
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result).not.toHaveProperty("x-emdash-request");
+			expect(result["x-custom"]).toBe("safe");
+		});
+
+		it("passes through safe headers unchanged", () => {
+			const headers = new Headers({
+				"content-type": "application/json",
+				accept: "text/html",
+				"user-agent": "TestBot/1.0",
+				"x-forwarded-for": "1.2.3.4",
+				"cf-connecting-ip": "5.6.7.8",
+			});
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(result["content-type"]).toBe("application/json");
+			expect(result.accept).toBe("text/html");
+			expect(result["user-agent"]).toBe("TestBot/1.0");
+			expect(result["x-forwarded-for"]).toBe("1.2.3.4");
+			expect(result["cf-connecting-ip"]).toBe("5.6.7.8");
+		});
+
+		it("returns empty object for headers that are all sensitive", () => {
+			const headers = new Headers({
+				cookie: "session=abc",
+				authorization: "Bearer token",
+			});
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(Object.keys(result)).toHaveLength(0);
+		});
+
+		it("returns empty object for empty headers", () => {
+			const headers = new Headers();
+			const result = sanitizeHeadersForSandbox(headers);
+			expect(Object.keys(result)).toHaveLength(0);
+		});
+	});
+
+	describe("full extraction", () => {
+		it("extracts all metadata from a fully-populated request", () => {
+			const req = createRequest({
+				headers: {
+					"cf-connecting-ip": "203.0.113.50",
+					"user-agent": "TestBot/1.0",
+					referer: "https://example.com",
+				},
+				cf: { country: "DE", region: "BE", city: "Berlin" },
+			});
+
+			const meta = extractRequestMeta(req);
+			expect(meta).toEqual({
+				ip: "203.0.113.50",
+				userAgent: "TestBot/1.0",
+				referer: "https://example.com",
+				geo: {
+					country: "DE",
+					region: "BE",
+					city: "Berlin",
+				},
+			});
+		});
+
+		it("returns all nulls for a bare request", () => {
+			const req = createRequest();
+
+			const meta = extractRequestMeta(req);
+			expect(meta).toEqual({
+				ip: null,
+				userAgent: null,
+				referer: null,
+				geo: null,
+			});
+		});
+	});
+});

packages/core/tests/unit/plugins/routes.test.ts

@@ -0,0 +1,452 @@
+/**
+ * Plugin Routes Tests
+ *
+ * Tests the v2 route system for:
+ * - Route registration and invocation
+ * - Input validation with Zod schemas
+ * - Error handling (PluginRouteError)
+ * - Route registry management
+ */
+
+import { describe, it, expect, vi } from "vitest";
+import { z } from "zod";
+
+import type { PluginContextFactoryOptions } from "../../../src/plugins/context.js";
+import {
+	PluginRouteHandler,
+	PluginRouteRegistry,
+	PluginRouteError,
+	createRouteRegistry,
+} from "../../../src/plugins/routes.js";
+import type { ResolvedPlugin } from "../../../src/plugins/types.js";
+
+/**
+ * Create a minimal resolved plugin for testing
+ */
+function createTestPlugin(overrides: Partial<ResolvedPlugin> = {}): ResolvedPlugin {
+	return {
+		id: overrides.id ?? "test-plugin",
+		version: "1.0.0",
+		capabilities: [],
+		allowedHosts: [],
+		storage: {},
+		admin: {
+			pages: [],
+			widgets: [],
+			fieldWidgets: {},
+		},
+		hooks: {},
+		routes: {},
+		...overrides,
+	};
+}
+
+/**
+ * Create mock factory options (routes need DB for context)
+ */
+function createMockFactoryOptions(): PluginContextFactoryOptions {
+	return {
+		db: {} as any, // Mock DB - routes will fail if they try to use DB features
+	};
+}
+
+describe("PluginRouteError", () => {
+	describe("constructor", () => {
+		it("creates error with code, message, and status", () => {
+			const error = new PluginRouteError("TEST_ERROR", "Test message", 400);
+
+			expect(error.code).toBe("TEST_ERROR");
+			expect(error.message).toBe("Test message");
+			expect(error.status).toBe(400);
+			expect(error.name).toBe("PluginRouteError");
+		});
+
+		it("defaults status to 400", () => {
+			const error = new PluginRouteError("TEST_ERROR", "Test message");
+			expect(error.status).toBe(400);
+		});
+
+		it("stores optional details", () => {
+			const details = { field: "email", issue: "invalid" };
+			const error = new PluginRouteError("VALIDATION_ERROR", "Invalid input", 400, details);
+
+			expect(error.details).toEqual(details);
+		});
+	});
+
+	describe("static factory methods", () => {
+		it("badRequest creates 400 error", () => {
+			const error = PluginRouteError.badRequest("Bad data", { foo: "bar" });
+
+			expect(error.code).toBe("BAD_REQUEST");
+			expect(error.status).toBe(400);
+			expect(error.message).toBe("Bad data");
+			expect(error.details).toEqual({ foo: "bar" });
+		});
+
+		it("unauthorized creates 401 error", () => {
+			const error = PluginRouteError.unauthorized();
+
+			expect(error.code).toBe("UNAUTHORIZED");
+			expect(error.status).toBe(401);
+			expect(error.message).toBe("Unauthorized");
+		});
+
+		it("forbidden creates 403 error", () => {
+			const error = PluginRouteError.forbidden("Access denied");
+
+			expect(error.code).toBe("FORBIDDEN");
+			expect(error.status).toBe(403);
+			expect(error.message).toBe("Access denied");
+		});
+
+		it("notFound creates 404 error", () => {
+			const error = PluginRouteError.notFound("Resource not found");
+
+			expect(error.code).toBe("NOT_FOUND");
+			expect(error.status).toBe(404);
+			expect(error.message).toBe("Resource not found");
+		});
+
+		it("conflict creates 409 error", () => {
+			const error = PluginRouteError.conflict("Already exists", { id: "123" });
+
+			expect(error.code).toBe("CONFLICT");
+			expect(error.status).toBe(409);
+			expect(error.message).toBe("Already exists");
+			expect(error.details).toEqual({ id: "123" });
+		});
+
+		it("internal creates 500 error", () => {
+			const error = PluginRouteError.internal("Something broke");
+
+			expect(error.code).toBe("INTERNAL_ERROR");
+			expect(error.status).toBe(500);
+			expect(error.message).toBe("Something broke");
+		});
+	});
+});
+
+describe("PluginRouteHandler", () => {
+	describe("getRouteMeta", () => {
+		it("returns null for non-existent route", () => {
+			const plugin = createTestPlugin();
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			expect(handler.getRouteMeta("non-existent")).toBeNull();
+		});
+
+		it("returns { public: false } for route without public flag", () => {
+			const plugin = createTestPlugin({
+				routes: {
+					sync: { handler: vi.fn() },
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const meta = handler.getRouteMeta("sync");
+			expect(meta).toEqual({ public: false });
+		});
+
+		it("returns { public: true } for route with public: true", () => {
+			const plugin = createTestPlugin({
+				routes: {
+					submit: { public: true, handler: vi.fn() },
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const meta = handler.getRouteMeta("submit");
+			expect(meta).toEqual({ public: true });
+		});
+
+		it("returns { public: false } for route with public: false", () => {
+			const plugin = createTestPlugin({
+				routes: {
+					admin: { public: false, handler: vi.fn() },
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const meta = handler.getRouteMeta("admin");
+			expect(meta).toEqual({ public: false });
+		});
+	});
+
+	describe("getRouteNames", () => {
+		it("returns empty array for plugin with no routes", () => {
+			const plugin = createTestPlugin();
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			expect(handler.getRouteNames()).toEqual([]);
+		});
+
+		it("returns all route names", () => {
+			const plugin = createTestPlugin({
+				routes: {
+					sync: { handler: vi.fn() },
+					webhook: { handler: vi.fn() },
+					"batch-process": { handler: vi.fn() },
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const names = handler.getRouteNames();
+			expect(names).toContain("sync");
+			expect(names).toContain("webhook");
+			expect(names).toContain("batch-process");
+			expect(names).toHaveLength(3);
+		});
+	});
+
+	describe("hasRoute", () => {
+		it("returns false for non-existent route", () => {
+			const plugin = createTestPlugin();
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			expect(handler.hasRoute("non-existent")).toBe(false);
+		});
+
+		it("returns true for existing route", () => {
+			const plugin = createTestPlugin({
+				routes: {
+					sync: { handler: vi.fn() },
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			expect(handler.hasRoute("sync")).toBe(true);
+		});
+	});
+
+	describe("invoke", () => {
+		it("returns 404 for non-existent route", async () => {
+			const plugin = createTestPlugin();
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const result = await handler.invoke("non-existent", {
+				request: new Request("http://test.com"),
+			});
+
+			expect(result.success).toBe(false);
+			expect(result.status).toBe(404);
+			expect(result.error?.code).toBe("ROUTE_NOT_FOUND");
+		});
+
+		it("validates input with Zod schema", async () => {
+			const plugin = createTestPlugin({
+				routes: {
+					create: {
+						input: z.object({
+							name: z.string().min(1),
+							email: z.string().email(),
+						}),
+						handler: vi.fn(),
+					},
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			// Invalid input
+			const result = await handler.invoke("create", {
+				request: new Request("http://test.com"),
+				body: { name: "", email: "not-an-email" },
+			});
+
+			expect(result.success).toBe(false);
+			expect(result.status).toBe(400);
+			expect(result.error?.code).toBe("VALIDATION_ERROR");
+		});
+
+		it("handles PluginRouteError from handler", async () => {
+			const plugin = createTestPlugin({
+				routes: {
+					fail: {
+						handler: async () => {
+							throw PluginRouteError.forbidden("No access");
+						},
+					},
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const result = await handler.invoke("fail", {
+				request: new Request("http://test.com"),
+			});
+
+			expect(result.success).toBe(false);
+			expect(result.status).toBe(403);
+			expect(result.error?.code).toBe("FORBIDDEN");
+			expect(result.error?.message).toBe("No access");
+		});
+
+		it("handles unknown errors from handler", async () => {
+			const plugin = createTestPlugin({
+				routes: {
+					crash: {
+						handler: async () => {
+							throw new Error("Unexpected error");
+						},
+					},
+				},
+			});
+			const handler = new PluginRouteHandler(plugin, createMockFactoryOptions());
+
+			const result = await handler.invoke("crash", {
+				request: new Request("http://test.com"),
+			});
+
+			expect(result.success).toBe(false);
+			expect(result.status).toBe(500);
+			expect(result.error?.code).toBe("INTERNAL_ERROR");
+			expect(result.error?.message).toContain("Unexpected error");
+		});
+	});
+});
+
+describe("PluginRouteRegistry", () => {
+	describe("register/unregister", () => {
+		it("registers a plugin", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			const plugin = createTestPlugin({
+				id: "my-plugin",
+				routes: { sync: { handler: vi.fn() } },
+			});
+
+			registry.register(plugin);
+
+			expect(registry.getPluginIds()).toContain("my-plugin");
+		});
+
+		it("unregisters a plugin", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			const plugin = createTestPlugin({ id: "my-plugin" });
+
+			registry.register(plugin);
+			registry.unregister("my-plugin");
+
+			expect(registry.getPluginIds()).not.toContain("my-plugin");
+		});
+	});
+
+	describe("getPluginIds", () => {
+		it("returns empty array initially", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			expect(registry.getPluginIds()).toEqual([]);
+		});
+
+		it("returns all registered plugin IDs", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+
+			registry.register(createTestPlugin({ id: "plugin-a" }));
+			registry.register(createTestPlugin({ id: "plugin-b" }));
+			registry.register(createTestPlugin({ id: "plugin-c" }));
+
+			const ids = registry.getPluginIds();
+			expect(ids).toContain("plugin-a");
+			expect(ids).toContain("plugin-b");
+			expect(ids).toContain("plugin-c");
+		});
+	});
+
+	describe("getRoutes", () => {
+		it("returns empty array for non-existent plugin", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			expect(registry.getRoutes("non-existent")).toEqual([]);
+		});
+
+		it("returns route names for registered plugin", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			const plugin = createTestPlugin({
+				id: "my-plugin",
+				routes: {
+					sync: { handler: vi.fn() },
+					import: { handler: vi.fn() },
+				},
+			});
+
+			registry.register(plugin);
+			const routes = registry.getRoutes("my-plugin");
+
+			expect(routes).toContain("sync");
+			expect(routes).toContain("import");
+		});
+	});
+
+	describe("getRouteMeta", () => {
+		it("returns null for non-existent plugin", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			expect(registry.getRouteMeta("non-existent", "sync")).toBeNull();
+		});
+
+		it("returns null for non-existent route on registered plugin", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			const plugin = createTestPlugin({
+				id: "my-plugin",
+				routes: { sync: { handler: vi.fn() } },
+			});
+			registry.register(plugin);
+
+			expect(registry.getRouteMeta("my-plugin", "non-existent")).toBeNull();
+		});
+
+		it("returns metadata for existing route", () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			const plugin = createTestPlugin({
+				id: "my-plugin",
+				routes: {
+					sync: { handler: vi.fn() },
+					submit: { public: true, handler: vi.fn() },
+				},
+			});
+			registry.register(plugin);
+
+			expect(registry.getRouteMeta("my-plugin", "sync")).toEqual({ public: false });
+			expect(registry.getRouteMeta("my-plugin", "submit")).toEqual({ public: true });
+		});
+	});
+
+	describe("invoke", () => {
+		it("returns 404 for non-existent plugin", async () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+
+			const result = await registry.invoke("non-existent", "sync", {
+				request: new Request("http://test.com"),
+			});
+
+			expect(result.success).toBe(false);
+			expect(result.status).toBe(404);
+			expect(result.error?.code).toBe("PLUGIN_NOT_FOUND");
+		});
+
+		it("delegates to plugin handler", async () => {
+			const registry = new PluginRouteRegistry(createMockFactoryOptions());
+			const plugin = createTestPlugin({
+				id: "my-plugin",
+				routes: {
+					status: {
+						handler: async () => ({ healthy: true }),
+					},
+				},
+			});
+
+			registry.register(plugin);
+
+			// This will fail because handler tries to create context with mock DB
+			// But we can verify it attempts to invoke
+			const result = await registry.invoke("my-plugin", "non-existent", {
+				request: new Request("http://test.com"),
+			});
+
+			expect(result.success).toBe(false);
+			expect(result.error?.code).toBe("ROUTE_NOT_FOUND");
+		});
+	});
+});
+
+describe("createRouteRegistry helper", () => {
+	it("creates a PluginRouteRegistry instance", () => {
+		const registry = createRouteRegistry(createMockFactoryOptions());
+		expect(registry).toBeInstanceOf(PluginRouteRegistry);
+	});
+});

packages/core/tests/unit/plugins/standard-format.test.ts

@@ -0,0 +1,251 @@
+/**
+ * Standard Plugin Format Tests
+ *
+ * Tests the definePlugin() standard format overload, isStandardPluginDefinition(),
+ * and the generatePluginsModule() standard format handling.
+ *
+ */
+
+import { describe, it, expect, vi } from "vitest";
+
+import type { PluginDescriptor } from "../../../src/astro/integration/runtime.js";
+import { generatePluginsModule } from "../../../src/astro/integration/virtual-modules.js";
+import { definePlugin } from "../../../src/plugins/define-plugin.js";
+import { isStandardPluginDefinition } from "../../../src/plugins/types.js";
+
+describe("definePlugin() standard format overload", () => {
+	it("returns the same object (identity function)", () => {
+		const def = {
+			hooks: {
+				"content:afterSave": {
+					handler: async () => {},
+				},
+			},
+			routes: {
+				status: {
+					handler: async () => ({ ok: true }),
+				},
+			},
+		};
+
+		const result = definePlugin(def);
+
+		// Standard format: definePlugin is an identity function
+		expect(result).toBe(def);
+	});
+
+	it("accepts hooks-only definition", () => {
+		const def = {
+			hooks: {
+				"content:beforeSave": async () => {},
+			},
+		};
+
+		const result = definePlugin(def);
+
+		expect(result).toBe(def);
+		expect(result.hooks).toBeDefined();
+	});
+
+	it("accepts routes-only definition", () => {
+		const def = {
+			routes: {
+				ping: {
+					handler: async () => ({ pong: true }),
+				},
+			},
+		};
+
+		const result = definePlugin(def);
+
+		expect(result).toBe(def);
+		expect(result.routes).toBeDefined();
+	});
+
+	it("throws on empty definition (no hooks or routes)", () => {
+		// An empty object has no id/version, so it's treated as standard format,
+		// but standard format requires at least hooks or routes
+		expect(() => definePlugin({})).toThrow(
+			"Standard plugin format requires at least `hooks` or `routes`",
+		);
+	});
+
+	it("still works with native format (id + version)", () => {
+		const handler = vi.fn();
+		const result = definePlugin({
+			id: "native-plugin",
+			version: "1.0.0",
+			hooks: {
+				"content:beforeSave": handler,
+			},
+		});
+
+		// Native format: returns a ResolvedPlugin
+		expect(result.id).toBe("native-plugin");
+		expect(result.version).toBe("1.0.0");
+		expect(result.hooks["content:beforeSave"]).toBeDefined();
+		expect(result.hooks["content:beforeSave"]!.pluginId).toBe("native-plugin");
+	});
+});
+
+describe("isStandardPluginDefinition()", () => {
+	it("returns true for { hooks: {} }", () => {
+		expect(isStandardPluginDefinition({ hooks: {} })).toBe(true);
+	});
+
+	it("returns true for { routes: {} }", () => {
+		expect(isStandardPluginDefinition({ routes: {} })).toBe(true);
+	});
+
+	it("returns true for { hooks: {}, routes: {} }", () => {
+		expect(isStandardPluginDefinition({ hooks: {}, routes: {} })).toBe(true);
+	});
+
+	it("returns false for null", () => {
+		expect(isStandardPluginDefinition(null)).toBe(false);
+	});
+
+	it("returns false for undefined", () => {
+		expect(isStandardPluginDefinition(undefined)).toBe(false);
+	});
+
+	it("returns false for a string", () => {
+		expect(isStandardPluginDefinition("hello")).toBe(false);
+	});
+
+	it("returns false for a native plugin definition (has id + version)", () => {
+		expect(
+			isStandardPluginDefinition({
+				id: "test",
+				version: "1.0.0",
+				hooks: {},
+			}),
+		).toBe(false);
+	});
+
+	it("returns false for an empty object (no hooks or routes)", () => {
+		// Empty object has neither hooks/routes NOR id/version
+		// So hasPluginShape is false
+		expect(isStandardPluginDefinition({})).toBe(false);
+	});
+});
+
+describe("generatePluginsModule() standard format", () => {
+	it("generates adapter import for standard-format plugins", () => {
+		const descriptors: PluginDescriptor[] = [
+			{
+				id: "my-standard-plugin",
+				version: "1.0.0",
+				entrypoint: "@my/standard-plugin",
+				format: "standard",
+			},
+		];
+
+		const code = generatePluginsModule(descriptors);
+
+		expect(code).toContain("adaptSandboxEntry");
+		expect(code).toContain('from "emdash/plugins/adapt-sandbox-entry"');
+		expect(code).toContain('import pluginDef0 from "@my/standard-plugin"');
+		expect(code).toContain("adaptSandboxEntry(pluginDef0");
+	});
+
+	it("generates createPlugin import for native-format plugins", () => {
+		const descriptors: PluginDescriptor[] = [
+			{
+				id: "my-native-plugin",
+				version: "1.0.0",
+				entrypoint: "@my/native-plugin",
+				options: { debug: true },
+			},
+		];
+
+		const code = generatePluginsModule(descriptors);
+
+		expect(code).not.toContain("adaptSandboxEntry");
+		expect(code).toContain('import { createPlugin as createPlugin0 } from "@my/native-plugin"');
+		expect(code).toContain('createPlugin0({"debug":true})');
+	});
+
+	it("handles mixed standard and native plugins", () => {
+		const descriptors: PluginDescriptor[] = [
+			{
+				id: "native-plugin",
+				version: "1.0.0",
+				entrypoint: "@my/native-plugin",
+				options: {},
+			},
+			{
+				id: "standard-plugin",
+				version: "2.0.0",
+				entrypoint: "@my/standard-plugin",
+				format: "standard",
+				capabilities: ["read:content"],
+			},
+		];
+
+		const code = generatePluginsModule(descriptors);
+
+		// Should have the adapter import (at least one standard plugin)
+		expect(code).toContain("adaptSandboxEntry");
+
+		// Native plugin uses createPlugin
+		expect(code).toContain('import { createPlugin as createPlugin0 } from "@my/native-plugin"');
+		expect(code).toContain("createPlugin0(");
+
+		// Standard plugin uses default import + adapter
+		expect(code).toContain('import pluginDef1 from "@my/standard-plugin"');
+		expect(code).toContain("adaptSandboxEntry(pluginDef1");
+	});
+
+	it("does not import adapter when all plugins are native", () => {
+		const descriptors: PluginDescriptor[] = [
+			{
+				id: "native-1",
+				version: "1.0.0",
+				entrypoint: "@my/native-1",
+				options: {},
+			},
+			{
+				id: "native-2",
+				version: "1.0.0",
+				entrypoint: "@my/native-2",
+				options: {},
+				format: "native",
+			},
+		];
+
+		const code = generatePluginsModule(descriptors);
+
+		expect(code).not.toContain("adaptSandboxEntry");
+	});
+
+	it("returns empty plugins array for no descriptors", () => {
+		const code = generatePluginsModule([]);
+
+		expect(code).toBe("export const plugins = [];");
+	});
+
+	it("serializes descriptor metadata for standard plugins", () => {
+		const descriptors: PluginDescriptor[] = [
+			{
+				id: "my-plugin",
+				version: "1.0.0",
+				entrypoint: "@my/plugin",
+				format: "standard",
+				capabilities: ["read:content", "network:fetch"],
+				allowedHosts: ["api.example.com"],
+				storage: { events: { indexes: ["timestamp"] } },
+				adminPages: [{ path: "/settings", label: "Settings" }],
+			},
+		];
+
+		const code = generatePluginsModule(descriptors);
+
+		// The descriptor metadata should be serialized into the adapter call
+		expect(code).toContain('"id":"my-plugin"');
+		expect(code).toContain('"version":"1.0.0"');
+		expect(code).toContain('"capabilities":["read:content","network:fetch"]');
+		expect(code).toContain('"allowedHosts":["api.example.com"]');
+		expect(code).toContain('"storage":{"events":{"indexes":["timestamp"]}}');
+	});
+});

packages/core/tests/unit/plugins/state.test.ts

@@ -0,0 +1,276 @@
+/**
+ * PluginStateRepository Tests
+ *
+ * Tests the database-backed plugin state storage for:
+ * - CRUD operations (get, getAll, upsert, delete)
+ * - Enable/disable convenience methods
+ * - Timestamp tracking
+ */
+
+import Database from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database as DbSchema } from "../../../src/database/types.js";
+import { PluginStateRepository } from "../../../src/plugins/state.js";
+
+describe("PluginStateRepository", () => {
+	let db: Kysely<DbSchema>;
+	let sqliteDb: Database.Database;
+	let repo: PluginStateRepository;
+
+	beforeEach(async () => {
+		// Create in-memory SQLite database
+		sqliteDb = new Database(":memory:");
+
+		db = new Kysely<DbSchema>({
+			dialect: new SqliteDialect({
+				database: sqliteDb,
+			}),
+		});
+
+		// Run migrations to create tables
+		await runMigrations(db);
+
+		repo = new PluginStateRepository(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+		sqliteDb.close();
+	});
+
+	describe("get", () => {
+		it("returns null for non-existent plugin", async () => {
+			const state = await repo.get("non-existent");
+			expect(state).toBeNull();
+		});
+
+		it("returns state for existing plugin", async () => {
+			// Insert directly
+			await db
+				.insertInto("_plugin_state")
+				.values({
+					plugin_id: "test-plugin",
+					status: "active",
+					version: "1.0.0",
+					installed_at: new Date().toISOString(),
+					activated_at: new Date().toISOString(),
+					deactivated_at: null,
+					data: null,
+				})
+				.execute();
+
+			const state = await repo.get("test-plugin");
+
+			expect(state).not.toBeNull();
+			expect(state!.pluginId).toBe("test-plugin");
+			expect(state!.status).toBe("active");
+			expect(state!.version).toBe("1.0.0");
+		});
+
+		it("parses dates correctly", async () => {
+			const now = new Date();
+			await db
+				.insertInto("_plugin_state")
+				.values({
+					plugin_id: "test-plugin",
+					status: "inactive",
+					version: "2.0.0",
+					installed_at: now.toISOString(),
+					activated_at: now.toISOString(),
+					deactivated_at: now.toISOString(),
+					data: null,
+				})
+				.execute();
+
+			const state = await repo.get("test-plugin");
+
+			expect(state!.installedAt).toBeInstanceOf(Date);
+			expect(state!.activatedAt).toBeInstanceOf(Date);
+			expect(state!.deactivatedAt).toBeInstanceOf(Date);
+		});
+
+		it("handles null dates", async () => {
+			await db
+				.insertInto("_plugin_state")
+				.values({
+					plugin_id: "test-plugin",
+					status: "inactive",
+					version: "1.0.0",
+					installed_at: new Date().toISOString(),
+					activated_at: null,
+					deactivated_at: null,
+					data: null,
+				})
+				.execute();
+
+			const state = await repo.get("test-plugin");
+
+			expect(state!.activatedAt).toBeNull();
+			expect(state!.deactivatedAt).toBeNull();
+		});
+	});
+
+	describe("getAll", () => {
+		it("returns empty array when no plugins", async () => {
+			const states = await repo.getAll();
+			expect(states).toEqual([]);
+		});
+
+		it("returns all plugin states", async () => {
+			await db
+				.insertInto("_plugin_state")
+				.values([
+					{
+						plugin_id: "plugin-a",
+						status: "active",
+						version: "1.0.0",
+						installed_at: new Date().toISOString(),
+						activated_at: new Date().toISOString(),
+						deactivated_at: null,
+						data: null,
+					},
+					{
+						plugin_id: "plugin-b",
+						status: "inactive",
+						version: "2.0.0",
+						installed_at: new Date().toISOString(),
+						activated_at: null,
+						deactivated_at: null,
+						data: null,
+					},
+				])
+				.execute();
+
+			const states = await repo.getAll();
+
+			expect(states).toHaveLength(2);
+			expect(states.map((s) => s.pluginId).toSorted()).toEqual(["plugin-a", "plugin-b"]);
+		});
+	});
+
+	describe("upsert", () => {
+		it("creates new state when plugin does not exist", async () => {
+			const state = await repo.upsert("new-plugin", "1.0.0", "active");
+
+			expect(state.pluginId).toBe("new-plugin");
+			expect(state.version).toBe("1.0.0");
+			expect(state.status).toBe("active");
+			expect(state.installedAt).toBeInstanceOf(Date);
+		});
+
+		it("updates existing state", async () => {
+			// Create initial state
+			await repo.upsert("test-plugin", "1.0.0", "active");
+
+			// Update it
+			const state = await repo.upsert("test-plugin", "1.1.0", "inactive");
+
+			expect(state.pluginId).toBe("test-plugin");
+			expect(state.version).toBe("1.1.0");
+			expect(state.status).toBe("inactive");
+		});
+
+		it("sets activated_at when activating", async () => {
+			// Create as inactive
+			await repo.upsert("test-plugin", "1.0.0", "inactive");
+
+			// Activate
+			const state = await repo.upsert("test-plugin", "1.0.0", "active");
+
+			expect(state.activatedAt).toBeInstanceOf(Date);
+		});
+
+		it("sets deactivated_at when deactivating", async () => {
+			// Create as active
+			await repo.upsert("test-plugin", "1.0.0", "active");
+
+			// Deactivate
+			const state = await repo.upsert("test-plugin", "1.0.0", "inactive");
+
+			expect(state.deactivatedAt).toBeInstanceOf(Date);
+		});
+
+		it("does not change activated_at if already active", async () => {
+			// Create as active
+			const initial = await repo.upsert("test-plugin", "1.0.0", "active");
+			const initialActivatedAt = initial.activatedAt!.getTime();
+
+			// Wait a bit then update version (still active)
+			await new Promise((r) => setTimeout(r, 10));
+			const updated = await repo.upsert("test-plugin", "1.1.0", "active");
+
+			// activated_at should be the same
+			expect(updated.activatedAt!.getTime()).toBe(initialActivatedAt);
+		});
+	});
+
+	describe("enable", () => {
+		it("creates active state for new plugin", async () => {
+			const state = await repo.enable("new-plugin", "1.0.0");
+
+			expect(state.status).toBe("active");
+			expect(state.activatedAt).toBeInstanceOf(Date);
+		});
+
+		it("activates inactive plugin", async () => {
+			await repo.upsert("test-plugin", "1.0.0", "inactive");
+
+			const state = await repo.enable("test-plugin", "1.0.0");
+
+			expect(state.status).toBe("active");
+		});
+	});
+
+	describe("disable", () => {
+		it("creates inactive state for new plugin", async () => {
+			const state = await repo.disable("new-plugin", "1.0.0");
+
+			expect(state.status).toBe("inactive");
+			expect(state.activatedAt).toBeNull();
+		});
+
+		it("deactivates active plugin", async () => {
+			await repo.upsert("test-plugin", "1.0.0", "active");
+
+			const state = await repo.disable("test-plugin", "1.0.0");
+
+			expect(state.status).toBe("inactive");
+			expect(state.deactivatedAt).toBeInstanceOf(Date);
+		});
+	});
+
+	describe("delete", () => {
+		it("returns false for non-existent plugin", async () => {
+			const deleted = await repo.delete("non-existent");
+			expect(deleted).toBe(false);
+		});
+
+		it("deletes existing plugin and returns true", async () => {
+			await repo.upsert("test-plugin", "1.0.0", "active");
+
+			const deleted = await repo.delete("test-plugin");
+
+			expect(deleted).toBe(true);
+
+			// Verify it's gone
+			const state = await repo.get("test-plugin");
+			expect(state).toBeNull();
+		});
+
+		it("only deletes specified plugin", async () => {
+			await repo.upsert("plugin-a", "1.0.0", "active");
+			await repo.upsert("plugin-b", "1.0.0", "active");
+
+			await repo.delete("plugin-a");
+
+			const stateA = await repo.get("plugin-a");
+			const stateB = await repo.get("plugin-b");
+
+			expect(stateA).toBeNull();
+			expect(stateB).not.toBeNull();
+		});
+	});
+});

packages/core/tests/unit/plugins/storage-indexes.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect } from "vitest";
+
+import { IdentifierError } from "../../../src/database/validate.js";
+import {
+	generateIndexName,
+	generateCreateIndexSql,
+	generateDropIndexSql,
+	normalizeIndexes,
+} from "../../../src/plugins/storage-indexes.js";
+import { createTestDatabase } from "../../utils/test-db.js";
+
+describe("storage-indexes", () => {
+	const db = createTestDatabase();
+	describe("generateIndexName", () => {
+		it("should generate deterministic index name for single field", () => {
+			const name = generateIndexName("my-plugin", "items", ["status"]);
+			expect(name).toBe("idx_plugin_my-plugin_items_status");
+		});
+
+		it("should generate deterministic index name for multiple fields", () => {
+			const name = generateIndexName("my-plugin", "items", ["status", "createdAt"]);
+			expect(name).toBe("idx_plugin_my-plugin_items_status_createdAt");
+		});
+
+		it("should truncate long names to 128 characters", () => {
+			const longFieldNames = Array.from({ length: 20 }, (_, i) => `veryLongFieldName${i}`);
+			const name = generateIndexName("my-plugin", "items", longFieldNames);
+			expect(name.length).toBeLessThanOrEqual(128);
+		});
+
+		it("should be consistent across calls", () => {
+			const name1 = generateIndexName("plugin", "coll", ["a", "b"]);
+			const name2 = generateIndexName("plugin", "coll", ["a", "b"]);
+			expect(name1).toBe(name2);
+		});
+	});
+
+	describe("generateCreateIndexSql", () => {
+		it("should return a RawBuilder with CREATE INDEX", () => {
+			const result = generateCreateIndexSql(db, "my-plugin", "items", ["status"]);
+			// It should be a RawBuilder (has toOperationNode method)
+			expect(result).toBeDefined();
+			expect(typeof (result as any).toOperationNode).toBe("function");
+		});
+
+		it("should reject invalid field names", () => {
+			expect(() =>
+				generateCreateIndexSql(db, "my-plugin", "items", ["status; DROP TABLE users--"]),
+			).toThrow(IdentifierError);
+		});
+
+		it("should reject invalid collection names", () => {
+			expect(() =>
+				generateCreateIndexSql(db, "my-plugin", "items'; DROP TABLE--", ["status"]),
+			).toThrow(IdentifierError);
+		});
+
+		it("should reject invalid plugin IDs", () => {
+			expect(() => generateCreateIndexSql(db, "'; DROP TABLE--", "items", ["status"])).toThrow(
+				IdentifierError,
+			);
+		});
+
+		it("should accept valid identifiers with hyphens in plugin ID", () => {
+			// Should not throw
+			const result = generateCreateIndexSql(db, "my-plugin", "items", ["status"]);
+			expect(result).toBeDefined();
+		});
+
+		it("should accept composite field indexes", () => {
+			// Should not throw
+			const result = generateCreateIndexSql(db, "my-plugin", "items", ["status", "created_at"]);
+			expect(result).toBeDefined();
+		});
+	});
+
+	describe("generateDropIndexSql", () => {
+		it("should return a RawBuilder", () => {
+			const result = generateDropIndexSql("idx_plugin_my-plugin_items_status");
+			expect(result).toBeDefined();
+			expect(typeof (result as any).toOperationNode).toBe("function");
+		});
+	});
+
+	describe("normalizeIndexes", () => {
+		it("should convert single fields to arrays", () => {
+			const normalized = normalizeIndexes(["status", "category"]);
+			expect(normalized).toEqual([["status"], ["category"]]);
+		});
+
+		it("should keep arrays as-is", () => {
+			const normalized = normalizeIndexes([["status", "createdAt"]]);
+			expect(normalized).toEqual([["status", "createdAt"]]);
+		});
+
+		it("should handle mixed input", () => {
+			const normalized = normalizeIndexes(["status", ["category", "priority"], "name"]);
+			expect(normalized).toEqual([["status"], ["category", "priority"], ["name"]]);
+		});
+
+		it("should return empty array for empty input", () => {
+			const normalized = normalizeIndexes([]);
+			expect(normalized).toEqual([]);
+		});
+	});
+});

packages/core/tests/unit/plugins/storage-query.test.ts

@@ -0,0 +1,332 @@
+import { describe, it, expect } from "vitest";
+
+import { IdentifierError } from "../../../src/database/validate.js";
+import {
+	isRangeFilter,
+	isInFilter,
+	isStartsWithFilter,
+	getIndexedFields,
+	validateWhereClause,
+	validateOrderByClause,
+	jsonExtract,
+	buildCondition,
+	buildWhereClause,
+	buildOrderByClause,
+	StorageQueryError,
+} from "../../../src/plugins/storage-query.js";
+import { createTestDatabase } from "../../utils/test-db.js";
+
+describe("storage-query", () => {
+	const db = createTestDatabase();
+	describe("type guards", () => {
+		describe("isRangeFilter", () => {
+			it("should return true for range filters with gt", () => {
+				expect(isRangeFilter({ gt: 10 })).toBe(true);
+			});
+
+			it("should return true for range filters with gte", () => {
+				expect(isRangeFilter({ gte: 10 })).toBe(true);
+			});
+
+			it("should return true for range filters with lt", () => {
+				expect(isRangeFilter({ lt: 10 })).toBe(true);
+			});
+
+			it("should return true for range filters with lte", () => {
+				expect(isRangeFilter({ lte: 10 })).toBe(true);
+			});
+
+			it("should return true for combined range filters", () => {
+				expect(isRangeFilter({ gt: 5, lt: 10 })).toBe(true);
+				expect(isRangeFilter({ gte: 5, lte: 10 })).toBe(true);
+			});
+
+			it("should return false for plain values", () => {
+				expect(isRangeFilter("foo")).toBe(false);
+				expect(isRangeFilter(42)).toBe(false);
+				expect(isRangeFilter(null)).toBe(false);
+			});
+
+			it("should return false for other filter types", () => {
+				expect(isRangeFilter({ in: [1, 2, 3] })).toBe(false);
+				expect(isRangeFilter({ startsWith: "foo" })).toBe(false);
+			});
+		});
+
+		describe("isInFilter", () => {
+			it("should return true for in filters", () => {
+				expect(isInFilter({ in: [1, 2, 3] })).toBe(true);
+				expect(isInFilter({ in: ["a", "b", "c"] })).toBe(true);
+				expect(isInFilter({ in: [] })).toBe(true);
+			});
+
+			it("should return false for non-array in values", () => {
+				expect(isInFilter({ in: "foo" } as any)).toBe(false);
+			});
+
+			it("should return false for other filter types", () => {
+				expect(isInFilter({ gt: 10 })).toBe(false);
+				expect(isInFilter({ startsWith: "foo" })).toBe(false);
+				expect(isInFilter("foo")).toBe(false);
+			});
+		});
+
+		describe("isStartsWithFilter", () => {
+			it("should return true for startsWith filters", () => {
+				expect(isStartsWithFilter({ startsWith: "foo" })).toBe(true);
+				expect(isStartsWithFilter({ startsWith: "" })).toBe(true);
+			});
+
+			it("should return false for non-string startsWith values", () => {
+				expect(isStartsWithFilter({ startsWith: 123 } as any)).toBe(false);
+			});
+
+			it("should return false for other filter types", () => {
+				expect(isStartsWithFilter({ gt: 10 })).toBe(false);
+				expect(isStartsWithFilter({ in: ["a", "b"] })).toBe(false);
+				expect(isStartsWithFilter("foo")).toBe(false);
+			});
+		});
+	});
+
+	describe("getIndexedFields", () => {
+		it("should extract fields from simple indexes", () => {
+			const indexes = ["status", "category"];
+			const fields = getIndexedFields(indexes);
+
+			expect(fields).toEqual(new Set(["status", "category"]));
+		});
+
+		it("should extract fields from composite indexes", () => {
+			const indexes = [["status", "createdAt"], "category"];
+			const fields = getIndexedFields(indexes);
+
+			expect(fields).toEqual(new Set(["status", "createdAt", "category"]));
+		});
+
+		it("should handle empty indexes", () => {
+			const fields = getIndexedFields([]);
+			expect(fields).toEqual(new Set());
+		});
+
+		it("should deduplicate fields", () => {
+			const indexes = ["status", ["status", "createdAt"]];
+			const fields = getIndexedFields(indexes);
+
+			expect(fields).toEqual(new Set(["status", "createdAt"]));
+		});
+	});
+
+	describe("validateWhereClause", () => {
+		const indexedFields = new Set(["status", "category", "createdAt"]);
+		const pluginId = "test-plugin";
+		const collection = "items";
+
+		it("should pass for indexed fields", () => {
+			expect(() =>
+				validateWhereClause(
+					{ status: "active", category: "blog" },
+					indexedFields,
+					pluginId,
+					collection,
+				),
+			).not.toThrow();
+		});
+
+		it("should throw for non-indexed fields", () => {
+			expect(() =>
+				validateWhereClause({ title: "foo" }, indexedFields, pluginId, collection),
+			).toThrow(StorageQueryError);
+		});
+
+		it("should include helpful suggestion in error", () => {
+			try {
+				validateWhereClause({ title: "foo" }, indexedFields, pluginId, collection);
+				expect.fail("Should have thrown");
+			} catch (e) {
+				expect(e).toBeInstanceOf(StorageQueryError);
+				const error = e as StorageQueryError;
+				expect(error.field).toBe("title");
+				expect(error.suggestion).toContain("title");
+				expect(error.suggestion).toContain(pluginId);
+			}
+		});
+
+		it("should pass for empty where clause", () => {
+			expect(() => validateWhereClause({}, indexedFields, pluginId, collection)).not.toThrow();
+		});
+	});
+
+	describe("validateOrderByClause", () => {
+		const indexedFields = new Set(["status", "createdAt"]);
+		const pluginId = "test-plugin";
+		const collection = "items";
+
+		it("should pass for indexed fields", () => {
+			expect(() =>
+				validateOrderByClause({ createdAt: "desc" }, indexedFields, pluginId, collection),
+			).not.toThrow();
+		});
+
+		it("should throw for non-indexed fields", () => {
+			expect(() =>
+				validateOrderByClause({ title: "asc" }, indexedFields, pluginId, collection),
+			).toThrow(StorageQueryError);
+		});
+	});
+
+	describe("jsonExtract", () => {
+		it("should generate correct SQLite JSON extraction syntax", () => {
+			expect(jsonExtract(db, "status")).toBe("json_extract(data, '$.status')");
+			expect(jsonExtract(db, "created_at")).toBe("json_extract(data, '$.created_at')");
+		});
+
+		it("should accept camelCase field names (used in plugin JSON data)", () => {
+			expect(jsonExtract(db, "createdAt")).toBe("json_extract(data, '$.createdAt')");
+			expect(jsonExtract(db, "myField")).toBe("json_extract(data, '$.myField')");
+			expect(jsonExtract(db, "UPPERCASE")).toBe("json_extract(data, '$.UPPERCASE')");
+		});
+
+		it("should reject invalid field names to prevent SQL injection", () => {
+			expect(() => jsonExtract(db, "'); DROP TABLE users--")).toThrow(IdentifierError);
+			expect(() => jsonExtract(db, "field.with.dots")).toThrow(IdentifierError);
+			expect(() => jsonExtract(db, "field-with-hyphens")).toThrow(IdentifierError);
+			expect(() => jsonExtract(db, "")).toThrow(IdentifierError);
+			expect(() => jsonExtract(db, "1startsWithNumber")).toThrow(IdentifierError);
+		});
+	});
+
+	describe("buildCondition", () => {
+		it("should handle null values", () => {
+			const result = buildCondition(db, "status", null);
+			expect(result.sql).toBe("json_extract(data, '$.status') IS NULL");
+			expect(result.params).toEqual([]);
+		});
+
+		it("should handle string values", () => {
+			const result = buildCondition(db, "status", "active");
+			expect(result.sql).toBe("json_extract(data, '$.status') = ?");
+			expect(result.params).toEqual(["active"]);
+		});
+
+		it("should handle number values", () => {
+			const result = buildCondition(db, "count", 42);
+			expect(result.sql).toBe("json_extract(data, '$.count') = ?");
+			expect(result.params).toEqual([42]);
+		});
+
+		it("should handle boolean values", () => {
+			const result = buildCondition(db, "active", true);
+			expect(result.sql).toBe("json_extract(data, '$.active') = ?");
+			expect(result.params).toEqual([true]);
+		});
+
+		it("should handle IN filters", () => {
+			const result = buildCondition(db, "status", { in: ["a", "b", "c"] });
+			expect(result.sql).toBe("json_extract(data, '$.status') IN (?, ?, ?)");
+			expect(result.params).toEqual(["a", "b", "c"]);
+		});
+
+		it("should handle startsWith filters", () => {
+			const result = buildCondition(db, "name", { startsWith: "foo" });
+			expect(result.sql).toBe("json_extract(data, '$.name') LIKE ?");
+			expect(result.params).toEqual(["foo%"]);
+		});
+
+		it("should handle range filters with gt", () => {
+			const result = buildCondition(db, "age", { gt: 18 });
+			expect(result.sql).toBe("json_extract(data, '$.age') > ?");
+			expect(result.params).toEqual([18]);
+		});
+
+		it("should handle range filters with gte", () => {
+			const result = buildCondition(db, "age", { gte: 18 });
+			expect(result.sql).toBe("json_extract(data, '$.age') >= ?");
+			expect(result.params).toEqual([18]);
+		});
+
+		it("should handle range filters with lt", () => {
+			const result = buildCondition(db, "age", { lt: 65 });
+			expect(result.sql).toBe("json_extract(data, '$.age') < ?");
+			expect(result.params).toEqual([65]);
+		});
+
+		it("should handle range filters with lte", () => {
+			const result = buildCondition(db, "age", { lte: 65 });
+			expect(result.sql).toBe("json_extract(data, '$.age') <= ?");
+			expect(result.params).toEqual([65]);
+		});
+
+		it("should handle combined range filters", () => {
+			const result = buildCondition(db, "age", { gte: 18, lt: 65 });
+			expect(result.sql).toBe(
+				"json_extract(data, '$.age') >= ? AND json_extract(data, '$.age') < ?",
+			);
+			expect(result.params).toEqual([18, 65]);
+		});
+	});
+
+	describe("buildWhereClause", () => {
+		it("should return empty result for empty where", () => {
+			const result = buildWhereClause(db, {});
+			expect(result.sql).toBe("");
+			expect(result.params).toEqual([]);
+		});
+
+		it("should handle single condition", () => {
+			const result = buildWhereClause(db, { status: "active" });
+			expect(result.sql).toBe("json_extract(data, '$.status') = ?");
+			expect(result.params).toEqual(["active"]);
+		});
+
+		it("should combine multiple conditions with AND", () => {
+			const result = buildWhereClause(db, {
+				status: "active",
+				category: "blog",
+			});
+			expect(result.sql).toBe(
+				"json_extract(data, '$.status') = ? AND json_extract(data, '$.category') = ?",
+			);
+			expect(result.params).toEqual(["active", "blog"]);
+		});
+
+		it("should handle mixed filter types", () => {
+			const result = buildWhereClause(db, {
+				status: { in: ["active", "pending"] },
+				name: { startsWith: "test" },
+				count: { gte: 5 },
+			});
+			expect(result.sql).toContain("IN (?, ?)");
+			expect(result.sql).toContain("LIKE ?");
+			expect(result.sql).toContain(">= ?");
+			expect(result.params).toEqual(["active", "pending", "test%", 5]);
+		});
+	});
+
+	describe("buildOrderByClause", () => {
+		it("should return empty string for empty orderBy", () => {
+			const result = buildOrderByClause(db, {});
+			expect(result).toBe("");
+		});
+
+		it("should handle single field ascending", () => {
+			const result = buildOrderByClause(db, { createdAt: "asc" });
+			expect(result).toBe("ORDER BY json_extract(data, '$.createdAt') ASC");
+		});
+
+		it("should handle single field descending", () => {
+			const result = buildOrderByClause(db, { createdAt: "desc" });
+			expect(result).toBe("ORDER BY json_extract(data, '$.createdAt') DESC");
+		});
+
+		it("should handle multiple fields", () => {
+			const result = buildOrderByClause(db, {
+				category: "asc",
+				createdAt: "desc",
+			});
+			expect(result).toBe(
+				"ORDER BY json_extract(data, '$.category') ASC, json_extract(data, '$.createdAt') DESC",
+			);
+		});
+	});
+});

packages/core/tests/unit/preview/tokens.test.ts

@@ -0,0 +1,324 @@
+import { describe, it, expect, vi } from "vitest";
+
+import {
+	generatePreviewToken,
+	verifyPreviewToken,
+	parseContentId,
+} from "../../../src/preview/tokens.js";
+
+// Regex patterns for token validation
+const BASE64URL_INVALID_CHARS_REGEX = /[+/=]/;
+const BASE64_PLUS_PATTERN = /\+/g;
+const BASE64_SLASH_PATTERN = /\//g;
+const BASE64_PADDING_PATTERN = /=+$/;
+
+describe("preview tokens", () => {
+	const testSecret = "test-secret-key-for-preview-tokens";
+
+	describe("generatePreviewToken", () => {
+		it("generates a valid token", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				expiresIn: "1h",
+				secret: testSecret,
+			});
+
+			// Token should be non-empty string
+			expect(token).toBeTruthy();
+			expect(typeof token).toBe("string");
+
+			// Token should have two parts (payload.signature)
+			const parts = token.split(".");
+			expect(parts.length).toBe(2);
+
+			// Should be URL-safe (no +, /, or =)
+			expect(token).not.toMatch(BASE64URL_INVALID_CHARS_REGEX);
+		});
+
+		it("defaults to 1 hour expiry", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				secret: testSecret,
+			});
+
+			const result = await verifyPreviewToken({ token, secret: testSecret });
+			expect(result.valid).toBe(true);
+
+			if (result.valid) {
+				// Should expire in roughly 1 hour
+				const now = Math.floor(Date.now() / 1000);
+				const expectedExpiry = now + 3600;
+				expect(result.payload.exp).toBeGreaterThan(now);
+				expect(result.payload.exp).toBeLessThanOrEqual(expectedExpiry + 1);
+			}
+		});
+
+		it("supports various duration formats", async () => {
+			const durations = ["30s", "5m", "2h", "1d", "1w"];
+
+			for (const duration of durations) {
+				const token = await generatePreviewToken({
+					contentId: "posts:test",
+					expiresIn: duration,
+					secret: testSecret,
+				});
+
+				const result = await verifyPreviewToken({ token, secret: testSecret });
+				expect(result.valid).toBe(true);
+			}
+		});
+
+		it("supports numeric duration (seconds)", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:test",
+				expiresIn: 7200, // 2 hours
+				secret: testSecret,
+			});
+
+			const result = await verifyPreviewToken({ token, secret: testSecret });
+			expect(result.valid).toBe(true);
+
+			if (result.valid) {
+				const now = Math.floor(Date.now() / 1000);
+				expect(result.payload.exp).toBeGreaterThan(now + 7000);
+			}
+		});
+
+		it("throws on missing secret", async () => {
+			await expect(
+				generatePreviewToken({
+					contentId: "posts:abc123",
+					secret: "",
+				}),
+			).rejects.toThrow("Preview secret is required");
+		});
+
+		it("throws on invalid content ID format", async () => {
+			await expect(
+				generatePreviewToken({
+					contentId: "invalid-no-colon",
+					secret: testSecret,
+				}),
+			).rejects.toThrow('Content ID must be in format "collection:id"');
+		});
+
+		it("throws on invalid duration format", async () => {
+			await expect(
+				generatePreviewToken({
+					contentId: "posts:abc123",
+					expiresIn: "invalid",
+					secret: testSecret,
+				}),
+			).rejects.toThrow("Invalid duration format");
+		});
+	});
+
+	describe("verifyPreviewToken", () => {
+		it("accepts valid token", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				secret: testSecret,
+			});
+
+			const result = await verifyPreviewToken({ token, secret: testSecret });
+
+			expect(result.valid).toBe(true);
+			if (result.valid) {
+				expect(result.payload.cid).toBe("posts:abc123");
+				expect(result.payload.exp).toBeGreaterThan(Date.now() / 1000);
+				expect(result.payload.iat).toBeLessThanOrEqual(Date.now() / 1000);
+			}
+		});
+
+		it("rejects expired token", async () => {
+			vi.useFakeTimers();
+
+			// Generate a token that expires in 60 seconds
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				expiresIn: 60,
+				secret: testSecret,
+			});
+
+			// Fast-forward past expiry
+			vi.advanceTimersByTime(61 * 1000);
+
+			const result = await verifyPreviewToken({ token, secret: testSecret });
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("expired");
+			}
+
+			vi.useRealTimers();
+		});
+
+		it("rejects tampered token (modified payload)", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				secret: testSecret,
+			});
+
+			// Tamper with the payload
+			const [_payload, signature] = token.split(".");
+			const tamperedPayload = btoa(JSON.stringify({ cid: "posts:hacked", exp: 9999999999, iat: 0 }))
+				.replace(BASE64_PLUS_PATTERN, "-")
+				.replace(BASE64_SLASH_PATTERN, "_")
+				.replace(BASE64_PADDING_PATTERN, "");
+			const tamperedToken = `${tamperedPayload}.${signature}`;
+
+			const result = await verifyPreviewToken({
+				token: tamperedToken,
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("invalid");
+			}
+		});
+
+		it("rejects token with wrong secret", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				secret: testSecret,
+			});
+
+			const result = await verifyPreviewToken({
+				token,
+				secret: "different-secret",
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("invalid");
+			}
+		});
+
+		it("rejects malformed token (no separator)", async () => {
+			const result = await verifyPreviewToken({
+				token: "nodotshere",
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("malformed");
+			}
+		});
+
+		it("rejects malformed token (too many parts)", async () => {
+			const result = await verifyPreviewToken({
+				token: "a.b.c",
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("malformed");
+			}
+		});
+
+		it("rejects malformed token (invalid base64)", async () => {
+			const result = await verifyPreviewToken({
+				token: "!!!.!!!",
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("malformed");
+			}
+		});
+
+		it("rejects token with missing fields", async () => {
+			// Create a token with incomplete payload
+			const _incompletePayload = btoa(JSON.stringify({ cid: "posts:abc" }))
+				.replace(BASE64_PLUS_PATTERN, "-")
+				.replace(BASE64_SLASH_PATTERN, "_")
+				.replace(BASE64_PADDING_PATTERN, "");
+
+			// Need to sign it properly for the signature check to pass
+			// but payload validation should fail
+			// Actually, this will fail at signature validation since we can't sign without the secret
+			// Let's test a different case - token where JSON is valid but fields are wrong type
+
+			const badPayload = btoa(JSON.stringify({ cid: 123, exp: "not-a-number", iat: null }))
+				.replace(BASE64_PLUS_PATTERN, "-")
+				.replace(BASE64_SLASH_PATTERN, "_")
+				.replace(BASE64_PADDING_PATTERN, "");
+
+			const result = await verifyPreviewToken({
+				token: `${badPayload}.fakesignature`,
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+		});
+
+		it("throws on missing secret", async () => {
+			await expect(verifyPreviewToken({ token: "some.token", secret: "" })).rejects.toThrow(
+				"Preview secret is required",
+			);
+		});
+
+		it("returns 'none' error for null token", async () => {
+			const result = await verifyPreviewToken({
+				token: null,
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("none");
+			}
+		});
+
+		it("returns 'none' error for undefined token", async () => {
+			const result = await verifyPreviewToken({
+				token: undefined,
+				secret: testSecret,
+			});
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("none");
+			}
+		});
+
+		it("extracts token from URL", async () => {
+			const token = await generatePreviewToken({
+				contentId: "posts:abc123",
+				secret: testSecret,
+			});
+			const url = new URL(`https://example.com/posts/abc123?_preview=${token}`);
+
+			const result = await verifyPreviewToken({ url, secret: testSecret });
+			expect(result.valid).toBe(true);
+			if (result.valid) {
+				expect(result.payload.cid).toBe("posts:abc123");
+			}
+		});
+
+		it("returns 'none' for URL without _preview param", async () => {
+			const url = new URL("https://example.com/posts/abc123");
+
+			const result = await verifyPreviewToken({ url, secret: testSecret });
+			expect(result.valid).toBe(false);
+			if (!result.valid) {
+				expect(result.error).toBe("none");
+			}
+		});
+	});
+
+	describe("parseContentId", () => {
+		it("parses valid content ID", () => {
+			const result = parseContentId("posts:abc123");
+			expect(result.collection).toBe("posts");
+			expect(result.id).toBe("abc123");
+		});
+
+		it("handles ID with colons", () => {
+			const result = parseContentId("posts:id:with:colons");
+			expect(result.collection).toBe("posts");
+			expect(result.id).toBe("id:with:colons");
+		});
+
+		it("throws on invalid format", () => {
+			expect(() => parseContentId("invalid")).toThrow(
+				'Content ID must be in format "collection:id"',
+			);
+		});
+	});
+});

packages/core/tests/unit/preview/urls.test.ts

@@ -0,0 +1,136 @@
+import { describe, it, expect } from "vitest";
+
+import { getPreviewUrl, buildPreviewUrl } from "../../../src/preview/urls.js";
+
+// Regex patterns for URL validation
+const RELATIVE_PREVIEW_URL_REGEX = /^\/posts\/hello-world\?_preview=/;
+const ABSOLUTE_PREVIEW_URL_REGEX = /^https:\/\/example\.com\/posts\/hello-world\?_preview=/;
+const BLOG_PREVIEW_URL_REGEX = /^\/blog\/hello-world\?_preview=/;
+const CONTENT_PREVIEW_URL_REGEX = /^\/content\/posts\/view\/hello-world\?_preview=/;
+const BASE64URL_INVALID_CHARS_REGEX = /[+/=]/;
+
+describe("preview URLs", () => {
+	const testSecret = "test-secret-key-for-preview-tokens";
+
+	describe("getPreviewUrl", () => {
+		it("generates relative URL by default", async () => {
+			const url = await getPreviewUrl({
+				collection: "posts",
+				id: "hello-world",
+				secret: testSecret,
+			});
+
+			// Should start with path
+			expect(url).toMatch(RELATIVE_PREVIEW_URL_REGEX);
+
+			// Should have a token
+			const urlObj = new URL(url, "http://example.com");
+			const token = urlObj.searchParams.get("_preview");
+			expect(token).toBeTruthy();
+			expect(token!.split(".").length).toBe(2);
+		});
+
+		it("generates absolute URL with baseUrl", async () => {
+			const url = await getPreviewUrl({
+				collection: "posts",
+				id: "hello-world",
+				secret: testSecret,
+				baseUrl: "https://example.com",
+			});
+
+			expect(url).toMatch(ABSOLUTE_PREVIEW_URL_REGEX);
+		});
+
+		it("respects custom path pattern", async () => {
+			const url = await getPreviewUrl({
+				collection: "posts",
+				id: "hello-world",
+				secret: testSecret,
+				pathPattern: "/blog/{id}",
+			});
+
+			expect(url).toMatch(BLOG_PREVIEW_URL_REGEX);
+		});
+
+		it("supports complex path patterns", async () => {
+			const url = await getPreviewUrl({
+				collection: "posts",
+				id: "hello-world",
+				secret: testSecret,
+				pathPattern: "/content/{collection}/view/{id}",
+			});
+
+			expect(url).toMatch(CONTENT_PREVIEW_URL_REGEX);
+		});
+
+		it("generates URL-safe tokens", async () => {
+			const url = await getPreviewUrl({
+				collection: "posts",
+				id: "test-id",
+				secret: testSecret,
+			});
+
+			// Token should not contain URL-unsafe characters
+			const urlObj = new URL(url, "http://example.com");
+			const token = urlObj.searchParams.get("_preview");
+			expect(token).not.toMatch(BASE64URL_INVALID_CHARS_REGEX);
+		});
+
+		it("respects expiresIn option", async () => {
+			const shortUrl = await getPreviewUrl({
+				collection: "posts",
+				id: "test",
+				secret: testSecret,
+				expiresIn: "30m",
+			});
+
+			const longUrl = await getPreviewUrl({
+				collection: "posts",
+				id: "test",
+				secret: testSecret,
+				expiresIn: "7d",
+			});
+
+			// Both should be valid but different tokens
+			expect(shortUrl).not.toBe(longUrl);
+		});
+	});
+
+	describe("buildPreviewUrl", () => {
+		it("builds URL from existing token", () => {
+			const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.test-signature";
+
+			const url = buildPreviewUrl({
+				path: "/posts/hello-world",
+				token,
+			});
+
+			expect(url).toBe(`/posts/hello-world?_preview=${token}`);
+		});
+
+		it("builds absolute URL with baseUrl", () => {
+			const token = "test-token";
+
+			const url = buildPreviewUrl({
+				path: "/posts/hello-world",
+				token,
+				baseUrl: "https://example.com",
+			});
+
+			expect(url).toBe(`https://example.com/posts/hello-world?_preview=${token}`);
+		});
+
+		it("preserves existing query params in path", () => {
+			const token = "test-token";
+
+			// Note: buildPreviewUrl doesn't preserve existing params, it starts fresh
+			// This is intentional - the path should be clean
+			const url = buildPreviewUrl({
+				path: "/posts/hello-world",
+				token,
+			});
+
+			expect(url).toContain("_preview=test-token");
+		});
+	});
+});

packages/core/tests/unit/redirects/patterns.test.ts

@@ -0,0 +1,246 @@
+import { describe, it, expect } from "vitest";
+
+import {
+	isPattern,
+	validatePattern,
+	validateDestinationParams,
+	compilePattern,
+	matchPattern,
+	interpolateDestination,
+} from "../../../src/redirects/patterns.js";
+
+describe("redirect patterns", () => {
+	describe("isPattern", () => {
+		it("returns true for [param] patterns", () => {
+			expect(isPattern("/blog/[slug]")).toBe(true);
+		});
+
+		it("returns true for [...rest] patterns", () => {
+			expect(isPattern("/old/[...path]")).toBe(true);
+		});
+
+		it("returns false for literal paths", () => {
+			expect(isPattern("/about")).toBe(false);
+			expect(isPattern("/blog/my-post")).toBe(false);
+		});
+
+		it("returns false for empty string", () => {
+			expect(isPattern("")).toBe(false);
+		});
+	});
+
+	describe("validatePattern", () => {
+		it("accepts valid patterns", () => {
+			expect(validatePattern("/blog/[slug]")).toBeNull();
+			expect(validatePattern("/[category]/[slug]")).toBeNull();
+			expect(validatePattern("/old/[...path]")).toBeNull();
+			expect(validatePattern("/about")).toBeNull();
+		});
+
+		it("rejects patterns not starting with /", () => {
+			expect(validatePattern("blog/[slug]")).toBe("Pattern must start with /");
+		});
+
+		it("rejects nested brackets", () => {
+			expect(validatePattern("/blog/[[slug]]")).toBe("Nested brackets are not allowed");
+		});
+
+		it("rejects empty brackets", () => {
+			expect(validatePattern("/blog/[]")).toBe("Empty brackets are not allowed");
+		});
+
+		it("rejects unmatched brackets", () => {
+			expect(validatePattern("/blog/[slug")).toBe("Unmatched brackets");
+			expect(validatePattern("/blog/slug]")).toBe("Unmatched brackets");
+		});
+
+		it("rejects [...splat] not in last segment", () => {
+			expect(validatePattern("/[...path]/extra")).toBe(
+				"Catch-all [...param] must be in the last segment",
+			);
+		});
+
+		it("allows [...splat] in last segment", () => {
+			expect(validatePattern("/prefix/[...path]")).toBeNull();
+		});
+
+		it("rejects multiple placeholders per segment", () => {
+			expect(validatePattern("/[a][b]")).toBe("Each segment can contain at most one placeholder");
+		});
+
+		it("rejects mixed literal and placeholder in segment", () => {
+			expect(validatePattern("/pre-[slug]")).toBe(
+				"A placeholder must be the entire segment, not mixed with literal text",
+			);
+		});
+
+		it("rejects duplicate parameter names", () => {
+			expect(validatePattern("/[slug]/[slug]")).toBe("Duplicate parameter name: slug");
+		});
+
+		it("validates consecutively without regex state leaking", () => {
+			// Calling validatePattern multiple times should not have stateful regex issues
+			expect(validatePattern("/[a]")).toBeNull();
+			expect(validatePattern("/[b]")).toBeNull();
+			expect(validatePattern("/[c]/[...rest]")).toBeNull();
+		});
+	});
+
+	describe("validateDestinationParams", () => {
+		it("returns null when destination params are subset of source", () => {
+			expect(validateDestinationParams("/[slug]", "/new/[slug]")).toBeNull();
+			expect(validateDestinationParams("/[category]/[slug]", "/[category]/[slug]")).toBeNull();
+		});
+
+		it("returns null for destinations with no placeholders", () => {
+			expect(validateDestinationParams("/[slug]", "/fixed-path")).toBeNull();
+		});
+
+		it("returns error for unknown destination param", () => {
+			expect(validateDestinationParams("/[slug]", "/[category]/[slug]")).toBe(
+				"Destination references [category] which is not captured in the source pattern",
+			);
+		});
+
+		it("allows [...rest] params in destination when in source", () => {
+			expect(validateDestinationParams("/old/[...path]", "/new/[...path]")).toBeNull();
+		});
+	});
+
+	describe("compilePattern", () => {
+		it("compiles [param] to single-segment capture", () => {
+			const compiled = compilePattern("/blog/[slug]");
+			expect(compiled.paramNames).toEqual(["slug"]);
+			expect(compiled.source).toBe("/blog/[slug]");
+			expect(compiled.regex.test("/blog/my-post")).toBe(true);
+			expect(compiled.regex.test("/blog/")).toBe(false);
+			expect(compiled.regex.test("/blog/a/b")).toBe(false);
+		});
+
+		it("compiles [...rest] to multi-segment capture", () => {
+			const compiled = compilePattern("/old/[...path]");
+			expect(compiled.paramNames).toEqual(["path"]);
+			expect(compiled.regex.test("/old/a")).toBe(true);
+			expect(compiled.regex.test("/old/a/b/c")).toBe(true);
+			expect(compiled.regex.test("/old/")).toBe(false);
+		});
+
+		it("compiles multiple params", () => {
+			const compiled = compilePattern("/[category]/[slug]");
+			expect(compiled.paramNames).toEqual(["category", "slug"]);
+			expect(compiled.regex.test("/tech/my-post")).toBe(true);
+			expect(compiled.regex.test("/tech/")).toBe(false);
+		});
+
+		it("compiles literal-only paths", () => {
+			const compiled = compilePattern("/about/team");
+			expect(compiled.paramNames).toEqual([]);
+			expect(compiled.regex.test("/about/team")).toBe(true);
+			expect(compiled.regex.test("/about/other")).toBe(false);
+		});
+
+		it("escapes regex-special characters in literal parts", () => {
+			const compiled = compilePattern("/blog.old/[slug]");
+			// The dot should be escaped, not matching any character
+			expect(compiled.regex.test("/blog.old/test")).toBe(true);
+			expect(compiled.regex.test("/blogXold/test")).toBe(false);
+		});
+	});
+
+	describe("matchPattern", () => {
+		it("captures [param] values", () => {
+			const compiled = compilePattern("/blog/[slug]");
+			expect(matchPattern(compiled, "/blog/my-post")).toEqual({ slug: "my-post" });
+		});
+
+		it("captures [...rest] values", () => {
+			const compiled = compilePattern("/old/[...path]");
+			expect(matchPattern(compiled, "/old/2024/01/post")).toEqual({
+				path: "2024/01/post",
+			});
+		});
+
+		it("captures multiple params", () => {
+			const compiled = compilePattern("/[category]/[slug]");
+			expect(matchPattern(compiled, "/tech/my-post")).toEqual({
+				category: "tech",
+				slug: "my-post",
+			});
+		});
+
+		it("returns null on no match", () => {
+			const compiled = compilePattern("/blog/[slug]");
+			expect(matchPattern(compiled, "/about")).toBeNull();
+			expect(matchPattern(compiled, "/blog/a/b")).toBeNull();
+		});
+
+		it("returns empty object for literal paths", () => {
+			const compiled = compilePattern("/about/team");
+			expect(matchPattern(compiled, "/about/team")).toEqual({});
+		});
+
+		it("handles URL-encoded segments", () => {
+			const compiled = compilePattern("/blog/[slug]");
+			expect(matchPattern(compiled, "/blog/my%20post")).toEqual({ slug: "my%20post" });
+		});
+	});
+
+	describe("interpolateDestination", () => {
+		it("replaces [param] with captured values", () => {
+			expect(interpolateDestination("/new/[slug]", { slug: "my-post" })).toBe("/new/my-post");
+		});
+
+		it("replaces [...rest] with captured values", () => {
+			expect(interpolateDestination("/new/[...path]", { path: "2024/01/post" })).toBe(
+				"/new/2024/01/post",
+			);
+		});
+
+		it("replaces multiple params", () => {
+			expect(
+				interpolateDestination("/[category]/posts/[slug]", {
+					category: "tech",
+					slug: "my-post",
+				}),
+			).toBe("/tech/posts/my-post");
+		});
+
+		it("replaces missing params with empty string", () => {
+			expect(interpolateDestination("/[slug]", {})).toBe("/");
+		});
+
+		it("leaves literal destinations unchanged", () => {
+			expect(interpolateDestination("/about", {})).toBe("/about");
+		});
+	});
+
+	describe("end-to-end: compile + match + interpolate", () => {
+		it("handles blog migration pattern", () => {
+			const source = compilePattern("/old-blog/[...path]");
+			const params = matchPattern(source, "/old-blog/2024/01/my-great-post");
+			expect(params).toEqual({ path: "2024/01/my-great-post" });
+
+			const destination = interpolateDestination("/blog/[...path]", params!);
+			expect(destination).toBe("/blog/2024/01/my-great-post");
+		});
+
+		it("handles category restructure pattern", () => {
+			const source = compilePattern("/articles/[category]/[slug]");
+			const params = matchPattern(source, "/articles/tech/typescript-tips");
+			expect(params).toEqual({ category: "tech", slug: "typescript-tips" });
+
+			const destination = interpolateDestination("/blog/[category]/[slug]", params!);
+			expect(destination).toBe("/blog/tech/typescript-tips");
+		});
+
+		it("handles pattern with params dropped in destination", () => {
+			const source = compilePattern("/v1/[category]/[slug]");
+			const params = matchPattern(source, "/v1/news/hello");
+			expect(params).toEqual({ category: "news", slug: "hello" });
+
+			// Destination only uses slug, drops category
+			const destination = interpolateDestination("/posts/[slug]", params!);
+			expect(destination).toBe("/posts/hello");
+		});
+	});
+});

packages/core/tests/unit/request-context.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from "vitest";
+
+import { getRequestContext, runWithContext } from "../../src/request-context.js";
+
+describe("request context", () => {
+	it("returns undefined outside any context", () => {
+		expect(getRequestContext()).toBeUndefined();
+	});
+
+	it("returns context inside runWithContext", () => {
+		const ctx = { editMode: true };
+		runWithContext(ctx, () => {
+			expect(getRequestContext()).toBe(ctx);
+		});
+	});
+
+	it("returns undefined after runWithContext completes", () => {
+		runWithContext({ editMode: true }, () => {});
+		expect(getRequestContext()).toBeUndefined();
+	});
+
+	it("propagates through async boundaries", async () => {
+		const ctx = { editMode: true, preview: { collection: "posts", id: "1" } };
+		await runWithContext(ctx, async () => {
+			await new Promise((resolve) => setTimeout(resolve, 1));
+			expect(getRequestContext()).toBe(ctx);
+		});
+	});
+
+	it("isolates concurrent contexts", async () => {
+		const results: boolean[] = [];
+		await Promise.all([
+			runWithContext({ editMode: true }, async () => {
+				await new Promise((resolve) => setTimeout(resolve, 10));
+				results.push(getRequestContext()!.editMode);
+			}),
+			runWithContext({ editMode: false }, async () => {
+				await new Promise((resolve) => setTimeout(resolve, 5));
+				results.push(getRequestContext()!.editMode);
+			}),
+		]);
+		// Second resolves first (5ms < 10ms), so false appears before true
+		expect(results).toContain(true);
+		expect(results).toContain(false);
+		expect(results).toHaveLength(2);
+	});
+
+	it("includes preview info when set", () => {
+		const ctx = {
+			editMode: false,
+			preview: { collection: "posts", id: "abc-123" },
+		};
+		runWithContext(ctx, () => {
+			const result = getRequestContext();
+			expect(result?.preview).toEqual({ collection: "posts", id: "abc-123" });
+			expect(result?.editMode).toBe(false);
+		});
+	});
+
+	it("includes db override when set", () => {
+		const fakeDb = { isKysely: true } as never;
+		const ctx = {
+			editMode: false,
+			db: fakeDb,
+		};
+		runWithContext(ctx, () => {
+			const result = getRequestContext();
+			expect(result?.db).toBe(fakeDb);
+		});
+	});
+
+	it("db override is undefined when not set", () => {
+		const ctx = { editMode: false };
+		runWithContext(ctx, () => {
+			const result = getRequestContext();
+			expect(result?.db).toBeUndefined();
+		});
+	});
+});

packages/core/tests/unit/schema/registry.test.ts

@@ -0,0 +1,375 @@
+import Database from "better-sqlite3";
+import { Kysely, SqliteDialect } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database as EmDashDatabase } from "../../../src/database/types.js";
+import { SchemaRegistry, SchemaError } from "../../../src/schema/registry.js";
+
+describe("SchemaRegistry", () => {
+	let db: Kysely<EmDashDatabase>;
+	let registry: SchemaRegistry;
+
+	beforeEach(async () => {
+		// Create in-memory database
+		const sqlite = new Database(":memory:");
+		db = new Kysely<EmDashDatabase>({
+			dialect: new SqliteDialect({ database: sqlite }),
+		});
+
+		// Run migrations
+		await runMigrations(db);
+
+		// Create registry
+		registry = new SchemaRegistry(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	describe("Collection Operations", () => {
+		it("should create a collection", async () => {
+			const collection = await registry.createCollection({
+				slug: "posts",
+				label: "Blog Posts",
+				labelSingular: "Post",
+				supports: ["drafts", "revisions"],
+			});
+
+			expect(collection.slug).toBe("posts");
+			expect(collection.label).toBe("Blog Posts");
+			expect(collection.labelSingular).toBe("Post");
+			expect(collection.supports).toEqual(["drafts", "revisions"]);
+			expect(collection.source).toBe("manual");
+			expect(collection.id).toBeDefined();
+		});
+
+		it("should create the content table when creating a collection", async () => {
+			await registry.createCollection({
+				slug: "articles",
+				label: "Articles",
+			});
+
+			// Verify table exists by inserting a row
+			const result = await db
+				.insertInto("ec_articles" as any)
+				.values({
+					id: "test-id",
+					slug: "test-slug",
+					status: "draft",
+				})
+				.execute();
+
+			expect(result).toBeDefined();
+		});
+
+		it("should list collections", async () => {
+			await registry.createCollection({ slug: "posts", label: "Posts" });
+			await registry.createCollection({ slug: "pages", label: "Pages" });
+
+			const collections = await registry.listCollections();
+
+			expect(collections).toHaveLength(2);
+			expect(collections.map((c) => c.slug)).toEqual(["pages", "posts"]); // sorted
+		});
+
+		it("should get a collection by slug", async () => {
+			await registry.createCollection({
+				slug: "products",
+				label: "Products",
+				description: "Store products",
+			});
+
+			const collection = await registry.getCollection("products");
+
+			expect(collection).not.toBeNull();
+			expect(collection?.slug).toBe("products");
+			expect(collection?.description).toBe("Store products");
+		});
+
+		it("should return null for non-existent collection", async () => {
+			const collection = await registry.getCollection("nonexistent");
+			expect(collection).toBeNull();
+		});
+
+		it("should update a collection", async () => {
+			await registry.createCollection({ slug: "posts", label: "Posts" });
+
+			const updated = await registry.updateCollection("posts", {
+				label: "Blog Posts",
+				description: "All blog posts",
+				supports: ["drafts"],
+			});
+
+			expect(updated.label).toBe("Blog Posts");
+			expect(updated.description).toBe("All blog posts");
+			expect(updated.supports).toEqual(["drafts"]);
+		});
+
+		it("should throw when updating non-existent collection", async () => {
+			await expect(registry.updateCollection("nonexistent", { label: "Test" })).rejects.toThrow(
+				SchemaError,
+			);
+		});
+
+		it("should delete a collection", async () => {
+			await registry.createCollection({ slug: "temp", label: "Temp" });
+
+			await registry.deleteCollection("temp");
+
+			const collection = await registry.getCollection("temp");
+			expect(collection).toBeNull();
+		});
+
+		it("should throw when creating duplicate collection", async () => {
+			await registry.createCollection({ slug: "posts", label: "Posts" });
+
+			await expect(registry.createCollection({ slug: "posts", label: "Posts 2" })).rejects.toThrow(
+				SchemaError,
+			);
+		});
+
+		it("should reject reserved collection slugs", async () => {
+			await expect(
+				registry.createCollection({ slug: "content", label: "Content" }),
+			).rejects.toThrow(SchemaError);
+
+			await expect(registry.createCollection({ slug: "users", label: "Users" })).rejects.toThrow(
+				SchemaError,
+			);
+		});
+
+		it("should validate collection slug format", async () => {
+			await expect(registry.createCollection({ slug: "My Posts", label: "Posts" })).rejects.toThrow(
+				SchemaError,
+			);
+
+			await expect(registry.createCollection({ slug: "123posts", label: "Posts" })).rejects.toThrow(
+				SchemaError,
+			);
+
+			await expect(
+				registry.createCollection({ slug: "posts-here", label: "Posts" }),
+			).rejects.toThrow(SchemaError);
+		});
+	});
+
+	describe("Field Operations", () => {
+		beforeEach(async () => {
+			await registry.createCollection({ slug: "posts", label: "Posts" });
+		});
+
+		it("should create a field", async () => {
+			const field = await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+				required: true,
+			});
+
+			expect(field.slug).toBe("title");
+			expect(field.label).toBe("Title");
+			expect(field.type).toBe("string");
+			expect(field.columnType).toBe("TEXT");
+			expect(field.required).toBe(true);
+		});
+
+		it("should add column to content table when creating field", async () => {
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			// Verify column exists by inserting a row with the field
+			await db
+				.insertInto("ec_posts" as any)
+				.values({
+					id: "test-id",
+					title: "Test Title",
+				})
+				.execute();
+
+			const row = await db
+				.selectFrom("ec_posts" as any)
+				.selectAll()
+				.executeTakeFirst();
+
+			expect((row as any).title).toBe("Test Title");
+		});
+
+		it("should list fields for a collection", async () => {
+			const collection = await registry.getCollection("posts");
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+			await registry.createField("posts", {
+				slug: "content",
+				label: "Content",
+				type: "portableText",
+			});
+
+			const fields = await registry.listFields(collection!.id);
+
+			expect(fields).toHaveLength(2);
+			expect(fields[0].slug).toBe("title");
+			expect(fields[1].slug).toBe("content");
+		});
+
+		it("should get a field by slug", async () => {
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+				validation: { minLength: 1, maxLength: 100 },
+			});
+
+			const field = await registry.getField("posts", "title");
+
+			expect(field).not.toBeNull();
+			expect(field?.validation).toEqual({ minLength: 1, maxLength: 100 });
+		});
+
+		it("should update a field", async () => {
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			const updated = await registry.updateField("posts", "title", {
+				label: "Post Title",
+				required: true,
+				widget: "text",
+			});
+
+			expect(updated.label).toBe("Post Title");
+			expect(updated.required).toBe(true);
+			expect(updated.widget).toBe("text");
+		});
+
+		it("should delete a field", async () => {
+			await registry.createField("posts", {
+				slug: "temp_field",
+				label: "Temp",
+				type: "string",
+			});
+
+			await registry.deleteField("posts", "temp_field");
+
+			const field = await registry.getField("posts", "temp_field");
+			expect(field).toBeNull();
+		});
+
+		it("should reject reserved field slugs", async () => {
+			await expect(
+				registry.createField("posts", {
+					slug: "id",
+					label: "ID",
+					type: "string",
+				}),
+			).rejects.toThrow(SchemaError);
+
+			await expect(
+				registry.createField("posts", {
+					slug: "created_at",
+					label: "Created",
+					type: "datetime",
+				}),
+			).rejects.toThrow(SchemaError);
+		});
+
+		it("should map field types to correct column types", async () => {
+			const testCases: Array<{ type: any; slug: string; expected: string }> = [
+				{ type: "string", slug: "f_string", expected: "TEXT" },
+				{ type: "text", slug: "f_text", expected: "TEXT" },
+				{ type: "number", slug: "f_number", expected: "REAL" },
+				{ type: "integer", slug: "f_integer", expected: "INTEGER" },
+				{ type: "boolean", slug: "f_boolean", expected: "INTEGER" },
+				{ type: "datetime", slug: "f_datetime", expected: "TEXT" },
+				{ type: "portableText", slug: "f_portable", expected: "JSON" },
+				{ type: "json", slug: "f_json", expected: "JSON" },
+				{ type: "image", slug: "f_image", expected: "TEXT" },
+				{ type: "reference", slug: "f_reference", expected: "TEXT" },
+			];
+
+			for (const { type, slug, expected } of testCases) {
+				const field = await registry.createField("posts", {
+					slug,
+					label: type,
+					type,
+				});
+				expect(field.columnType).toBe(expected);
+			}
+		});
+
+		it("should reorder fields", async () => {
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+			await registry.createField("posts", {
+				slug: "content",
+				label: "Content",
+				type: "portableText",
+			});
+			await registry.createField("posts", {
+				slug: "author",
+				label: "Author",
+				type: "reference",
+			});
+
+			await registry.reorderFields("posts", ["author", "title", "content"]);
+
+			const collection = await registry.getCollection("posts");
+			const fields = await registry.listFields(collection!.id);
+
+			expect(fields[0].slug).toBe("author");
+			expect(fields[1].slug).toBe("title");
+			expect(fields[2].slug).toBe("content");
+		});
+	});
+
+	describe("Collection with Fields", () => {
+		it("should get collection with all fields", async () => {
+			await registry.createCollection({ slug: "posts", label: "Posts" });
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+			await registry.createField("posts", {
+				slug: "content",
+				label: "Content",
+				type: "portableText",
+			});
+
+			const collection = await registry.getCollectionWithFields("posts");
+
+			expect(collection).not.toBeNull();
+			expect(collection?.slug).toBe("posts");
+			expect(collection?.fields).toHaveLength(2);
+			expect(collection?.fields[0].slug).toBe("title");
+			expect(collection?.fields[1].slug).toBe("content");
+		});
+
+		it("should cascade delete fields when deleting collection", async () => {
+			await registry.createCollection({ slug: "temp", label: "Temp" });
+			await registry.createField("temp", {
+				slug: "field1",
+				label: "Field 1",
+				type: "string",
+			});
+
+			await registry.deleteCollection("temp");
+
+			// Fields should be gone (cascade delete)
+			const field = await registry.getField("temp", "field1");
+			expect(field).toBeNull();
+		});
+	});
+});

packages/core/tests/unit/schema/zod-generator.test.ts

@@ -0,0 +1,447 @@
+import { describe, it, expect, beforeEach } from "vitest";
+
+import type { CollectionWithFields, Field } from "../../../src/schema/types.js";
+import {
+	generateZodSchema,
+	generateFieldSchema,
+	validateContent,
+	generateTypeScript,
+	clearSchemaCache,
+} from "../../../src/schema/zod-generator.js";
+
+describe("Zod Generator", () => {
+	beforeEach(() => {
+		clearSchemaCache();
+	});
+
+	describe("generateFieldSchema", () => {
+		it("should generate string schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "title",
+				label: "Title",
+				type: "string",
+				columnType: "TEXT",
+				required: true,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse("Hello")).toBe("Hello");
+			expect(() => schema.parse(123)).toThrow();
+		});
+
+		it("should generate number schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "price",
+				label: "Price",
+				type: "number",
+				columnType: "REAL",
+				required: true,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse(99.99)).toBe(99.99);
+			expect(() => schema.parse("not a number")).toThrow();
+		});
+
+		it("should generate integer schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "count",
+				label: "Count",
+				type: "integer",
+				columnType: "INTEGER",
+				required: true,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse(42)).toBe(42);
+			expect(() => schema.parse(3.14)).toThrow();
+		});
+
+		it("should generate boolean schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "active",
+				label: "Active",
+				type: "boolean",
+				columnType: "INTEGER",
+				required: true,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse(true)).toBe(true);
+			expect(schema.parse(false)).toBe(false);
+			expect(() => schema.parse("yes")).toThrow();
+		});
+
+		it("should generate select schema with options", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "status",
+				label: "Status",
+				type: "select",
+				columnType: "TEXT",
+				required: true,
+				unique: false,
+				validation: { options: ["draft", "published", "archived"] },
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse("draft")).toBe("draft");
+			expect(() => schema.parse("invalid")).toThrow();
+		});
+
+		it("should generate multiSelect schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "tags",
+				label: "Tags",
+				type: "multiSelect",
+				columnType: "JSON",
+				required: true,
+				unique: false,
+				validation: { options: ["news", "featured", "popular"] },
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse(["news", "featured"])).toEqual(["news", "featured"]);
+			expect(() => schema.parse(["invalid"])).toThrow();
+		});
+
+		it("should generate portableText schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "content",
+				label: "Content",
+				type: "portableText",
+				columnType: "JSON",
+				required: true,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			const validContent = [{ _type: "block", _key: "abc", style: "normal" }];
+			expect(schema.parse(validContent)).toEqual(validContent);
+		});
+
+		it("should generate image schema", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "image",
+				label: "Image",
+				type: "image",
+				columnType: "TEXT",
+				required: true,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			const validImage = { id: "img123", alt: "A photo" };
+			expect(schema.parse(validImage)).toMatchObject(validImage);
+		});
+
+		it("should make field optional when required is false", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "subtitle",
+				label: "Subtitle",
+				type: "string",
+				columnType: "TEXT",
+				required: false,
+				unique: false,
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse(undefined)).toBe(undefined);
+			expect(schema.parse("Hello")).toBe("Hello");
+		});
+
+		it("should apply default value", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "status",
+				label: "Status",
+				type: "string",
+				columnType: "TEXT",
+				required: false,
+				unique: false,
+				defaultValue: "draft",
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(schema.parse(undefined)).toBe("draft");
+		});
+
+		it("should apply string validation rules", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "title",
+				label: "Title",
+				type: "string",
+				columnType: "TEXT",
+				required: true,
+				unique: false,
+				validation: { minLength: 3, maxLength: 100 },
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(() => schema.parse("ab")).toThrow();
+			expect(schema.parse("abc")).toBe("abc");
+		});
+
+		it("should apply number validation rules", () => {
+			const field: Field = {
+				id: "f1",
+				collectionId: "c1",
+				slug: "price",
+				label: "Price",
+				type: "number",
+				columnType: "REAL",
+				required: true,
+				unique: false,
+				validation: { min: 0, max: 1000 },
+				sortOrder: 0,
+				createdAt: new Date().toISOString(),
+			};
+
+			const schema = generateFieldSchema(field);
+			expect(() => schema.parse(-1)).toThrow();
+			expect(() => schema.parse(1001)).toThrow();
+			expect(schema.parse(500)).toBe(500);
+		});
+	});
+
+	describe("generateZodSchema", () => {
+		it("should generate schema for collection with multiple fields", () => {
+			const collection: CollectionWithFields = {
+				id: "c1",
+				slug: "posts",
+				label: "Posts",
+				supports: [],
+				createdAt: new Date().toISOString(),
+				updatedAt: new Date().toISOString(),
+				fields: [
+					{
+						id: "f1",
+						collectionId: "c1",
+						slug: "title",
+						label: "Title",
+						type: "string",
+						columnType: "TEXT",
+						required: true,
+						unique: false,
+						sortOrder: 0,
+						createdAt: new Date().toISOString(),
+					},
+					{
+						id: "f2",
+						collectionId: "c1",
+						slug: "content",
+						label: "Content",
+						type: "portableText",
+						columnType: "JSON",
+						required: true,
+						unique: false,
+						sortOrder: 1,
+						createdAt: new Date().toISOString(),
+					},
+					{
+						id: "f3",
+						collectionId: "c1",
+						slug: "views",
+						label: "Views",
+						type: "integer",
+						columnType: "INTEGER",
+						required: false,
+						unique: false,
+						defaultValue: 0,
+						sortOrder: 2,
+						createdAt: new Date().toISOString(),
+					},
+				],
+			};
+
+			const schema = generateZodSchema(collection);
+
+			const validData = {
+				title: "Hello World",
+				content: [{ _type: "block", _key: "abc" }],
+			};
+
+			const result = schema.parse(validData);
+			expect(result.title).toBe("Hello World");
+			expect(result.views).toBe(0); // default applied
+		});
+	});
+
+	describe("validateContent", () => {
+		const collection: CollectionWithFields = {
+			id: "c1",
+			slug: "products",
+			label: "Products",
+			supports: [],
+			createdAt: new Date().toISOString(),
+			updatedAt: new Date().toISOString(),
+			fields: [
+				{
+					id: "f1",
+					collectionId: "c1",
+					slug: "name",
+					label: "Name",
+					type: "string",
+					columnType: "TEXT",
+					required: true,
+					unique: false,
+					validation: { minLength: 1 },
+					sortOrder: 0,
+					createdAt: new Date().toISOString(),
+				},
+				{
+					id: "f2",
+					collectionId: "c1",
+					slug: "price",
+					label: "Price",
+					type: "number",
+					columnType: "REAL",
+					required: true,
+					unique: false,
+					validation: { min: 0 },
+					sortOrder: 1,
+					createdAt: new Date().toISOString(),
+				},
+			],
+		};
+
+		it("should return success for valid data", () => {
+			const result = validateContent(collection, {
+				name: "Widget",
+				price: 29.99,
+			});
+
+			expect(result.success).toBe(true);
+		});
+
+		it("should return errors for invalid data", () => {
+			const result = validateContent(collection, {
+				name: "",
+				price: -10,
+			});
+
+			expect(result.success).toBe(false);
+			if (!result.success) {
+				expect(result.errors.issues.length).toBeGreaterThan(0);
+			}
+		});
+	});
+
+	describe("generateTypeScript", () => {
+		it("should generate TypeScript interface", () => {
+			const collection: CollectionWithFields = {
+				id: "c1",
+				slug: "blog_posts",
+				label: "Blog Posts",
+				supports: ["drafts"],
+				createdAt: new Date().toISOString(),
+				updatedAt: new Date().toISOString(),
+				fields: [
+					{
+						id: "f1",
+						collectionId: "c1",
+						slug: "title",
+						label: "Title",
+						type: "string",
+						columnType: "TEXT",
+						required: true,
+						unique: false,
+						sortOrder: 0,
+						createdAt: new Date().toISOString(),
+					},
+					{
+						id: "f2",
+						collectionId: "c1",
+						slug: "content",
+						label: "Content",
+						type: "portableText",
+						columnType: "JSON",
+						required: true,
+						unique: false,
+						sortOrder: 1,
+						createdAt: new Date().toISOString(),
+					},
+					{
+						id: "f3",
+						collectionId: "c1",
+						slug: "featured",
+						label: "Featured",
+						type: "boolean",
+						columnType: "INTEGER",
+						required: false,
+						unique: false,
+						sortOrder: 2,
+						createdAt: new Date().toISOString(),
+					},
+					{
+						id: "f4",
+						collectionId: "c1",
+						slug: "status",
+						label: "Status",
+						type: "select",
+						columnType: "TEXT",
+						required: true,
+						unique: false,
+						validation: { options: ["draft", "published"] },
+						sortOrder: 3,
+						createdAt: new Date().toISOString(),
+					},
+				],
+			};
+
+			const ts = generateTypeScript(collection);
+
+			expect(ts).toContain("export interface BlogPost");
+			expect(ts).toContain("title: string;");
+			expect(ts).toContain("content: PortableTextBlock[];");
+			expect(ts).toContain("featured?: boolean;");
+			expect(ts).toContain('status: "draft" | "published";');
+		});
+	});
+});

packages/core/tests/unit/seed/media.test.ts

@@ -0,0 +1,551 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import { ContentRepository } from "../../../src/database/repositories/content.js";
+import type { Database } from "../../../src/database/types.js";
+import { SchemaRegistry } from "../../../src/schema/registry.js";
+import { applySeed } from "../../../src/seed/apply.js";
+import type { SeedFile } from "../../../src/seed/types.js";
+import type { Storage, UploadOptions } from "../../../src/storage/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+// Regex patterns for file validation
+const PNG_EXTENSION_REGEX = /\.png$/;
+
+// Mock fetch globally
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+
+// Create a mock storage that tracks uploads
+function createMockStorage(): Storage & { uploads: UploadOptions[] } {
+	const uploads: UploadOptions[] = [];
+
+	return {
+		uploads,
+		async upload(options: UploadOptions): Promise<void> {
+			uploads.push(options);
+		},
+		async download(key: string): Promise<{ body: Uint8Array; contentType: string }> {
+			const upload = uploads.find((u) => u.key === key);
+			if (!upload) throw new Error(`Not found: ${key}`);
+			return { body: upload.body, contentType: upload.contentType };
+		},
+		async delete(key: string): Promise<void> {
+			const index = uploads.findIndex((u) => u.key === key);
+			if (index >= 0) uploads.splice(index, 1);
+		},
+		async exists(key: string): Promise<boolean> {
+			return uploads.some((u) => u.key === key);
+		},
+		getPublicUrl(key: string): string {
+			return `https://storage.example.com/${key}`;
+		},
+	};
+}
+
+// Create a mock response for fetch
+function createMockResponse(
+	body: Uint8Array,
+	contentType: string,
+	ok = true,
+	status = 200,
+): Response {
+	return {
+		ok,
+		status,
+		headers: new Headers({ "content-type": contentType }),
+		arrayBuffer: async () => body.buffer,
+	} as Response;
+}
+
+// Simple 1x1 PNG for testing
+const MOCK_PNG = new Uint8Array([
+	0x89,
+	0x50,
+	0x4e,
+	0x47,
+	0x0d,
+	0x0a,
+	0x1a,
+	0x0a, // PNG signature
+	0x00,
+	0x00,
+	0x00,
+	0x0d, // IHDR length
+	0x49,
+	0x48,
+	0x44,
+	0x52, // IHDR chunk type
+	0x00,
+	0x00,
+	0x00,
+	0x01, // width: 1
+	0x00,
+	0x00,
+	0x00,
+	0x01, // height: 1
+	0x08,
+	0x02,
+	0x00,
+	0x00,
+	0x00, // bit depth, color type, etc.
+	0x90,
+	0x77,
+	0x53,
+	0xde, // CRC
+]);
+
+// Simple 1x1 JPEG for testing
+const MOCK_JPEG = new Uint8Array([
+	0xff,
+	0xd8,
+	0xff,
+	0xe0, // SOI + APP0
+	0x00,
+	0x10, // APP0 length
+	0x4a,
+	0x46,
+	0x49,
+	0x46,
+	0x00, // JFIF identifier
+	0x01,
+	0x01, // version
+	0x00, // aspect ratio units
+	0x00,
+	0x01, // X density (1)
+	0x00,
+	0x01, // Y density (1)
+	0x00,
+	0x00, // thumbnail dimensions
+	0xff,
+	0xd9, // EOI
+]);
+
+describe("$media seed resolution", () => {
+	let db: Kysely<Database>;
+	let storage: Storage & { uploads: UploadOptions[] };
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		storage = createMockStorage();
+		mockFetch.mockReset();
+
+		// Set up a collection with an image field
+		const registry = new SchemaRegistry(db);
+		await registry.createCollection({ slug: "posts", label: "Posts" });
+		await registry.createField("posts", {
+			slug: "title",
+			label: "Title",
+			type: "string",
+		});
+		await registry.createField("posts", {
+			slug: "featured_image",
+			label: "Featured Image",
+			type: "image",
+		});
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+		vi.restoreAllMocks();
+	});
+
+	it("should resolve $media references by downloading and uploading", async () => {
+		mockFetch.mockResolvedValueOnce(createMockResponse(MOCK_PNG, "image/png"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello World",
+							featured_image: {
+								$media: {
+									url: "https://example.com/image.png",
+									alt: "Test image",
+									filename: "my-image.png",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "https://mysite.com",
+		});
+
+		expect(result.media.created).toBe(1);
+		expect(result.content.created).toBe(1);
+		expect(storage.uploads).toHaveLength(1);
+
+		// Check the upload
+		expect(storage.uploads[0].contentType).toBe("image/png");
+		expect(storage.uploads[0].key).toMatch(PNG_EXTENSION_REGEX);
+
+		// Check the content has resolved ImageValue
+		const contentRepo = new ContentRepository(db);
+		const entry = await contentRepo.findBySlug("posts", "hello");
+
+		// ImageValue stores id (URL is built at runtime by EmDashImage)
+		expect(entry?.data.featured_image).toMatchObject({
+			id: expect.any(String),
+			alt: "Test image",
+		});
+	});
+
+	it("should cache repeated $media URLs", async () => {
+		mockFetch.mockResolvedValueOnce(createMockResponse(MOCK_JPEG, "image/jpeg"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "first",
+						data: {
+							title: "First",
+							featured_image: {
+								$media: {
+									url: "https://example.com/shared.jpg",
+									alt: "Shared image",
+								},
+							},
+						},
+					},
+					{
+						id: "post-2",
+						slug: "second",
+						data: {
+							title: "Second",
+							featured_image: {
+								$media: {
+									url: "https://example.com/shared.jpg",
+									alt: "Different alt text",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		// Only downloaded/uploaded once
+		expect(result.media.created).toBe(1);
+		expect(result.media.skipped).toBe(1);
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		expect(storage.uploads).toHaveLength(1);
+
+		// Both entries should have the same src but different alt
+		const contentRepo = new ContentRepository(db);
+		const first = await contentRepo.findBySlug("posts", "first");
+		const second = await contentRepo.findBySlug("posts", "second");
+
+		expect(first?.data.featured_image.src).toBe(second?.data.featured_image.src);
+		expect(first?.data.featured_image.alt).toBe("Shared image");
+		expect(second?.data.featured_image.alt).toBe("Different alt text");
+	});
+
+	it("should skip $media when storage is not configured", async () => {
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							featured_image: {
+								$media: {
+									url: "https://example.com/image.png",
+									alt: "Test",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		// No storage provided
+		const result = await applySeed(db, seed, { includeContent: true });
+
+		expect(result.media.skipped).toBe(1);
+		expect(result.media.created).toBe(0);
+		expect(mockFetch).not.toHaveBeenCalled();
+
+		// Image field should be null/undefined (not resolved)
+		const contentRepo = new ContentRepository(db);
+		const entry = await contentRepo.findBySlug("posts", "hello");
+		expect(entry?.data.featured_image).toBeFalsy();
+	});
+
+	it("should handle failed downloads gracefully", async () => {
+		mockFetch.mockResolvedValueOnce(createMockResponse(new Uint8Array(), "", false, 404));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							featured_image: {
+								$media: {
+									url: "https://example.com/missing.png",
+									alt: "Missing",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		expect(result.media.skipped).toBe(1);
+		expect(result.content.created).toBe(1);
+
+		// Image field should be null/undefined (not resolved)
+		const contentRepo = new ContentRepository(db);
+		const entry = await contentRepo.findBySlug("posts", "hello");
+		expect(entry?.data.featured_image).toBeFalsy();
+	});
+
+	it("should handle fetch errors gracefully", async () => {
+		mockFetch.mockRejectedValueOnce(new Error("Network error"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							featured_image: {
+								$media: {
+									url: "https://example.com/error.png",
+									alt: "Error",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		expect(result.media.skipped).toBe(1);
+		expect(result.content.created).toBe(1);
+	});
+
+	it("should generate filename from URL when not specified", async () => {
+		mockFetch.mockResolvedValueOnce(createMockResponse(MOCK_PNG, "image/png"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							featured_image: {
+								$media: {
+									url: "https://example.com/path/to/beautiful-sunset.png?size=large",
+									alt: "Sunset",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		// Check media record in database
+		const media = await db.selectFrom("media").selectAll().executeTakeFirst();
+
+		expect(media?.filename).toBe("beautiful-sunset.png");
+	});
+
+	it("should use specified filename", async () => {
+		mockFetch.mockResolvedValueOnce(createMockResponse(MOCK_PNG, "image/png"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							featured_image: {
+								$media: {
+									url: "https://example.com/random-id-12345.png",
+									alt: "Custom",
+									filename: "my-custom-name.png",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		const media = await db.selectFrom("media").selectAll().executeTakeFirst();
+
+		expect(media?.filename).toBe("my-custom-name.png");
+	});
+
+	it("should create media record with correct metadata", async () => {
+		mockFetch.mockResolvedValueOnce(createMockResponse(MOCK_PNG, "image/png"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							featured_image: {
+								$media: {
+									url: "https://example.com/test.png",
+									alt: "Test alt text",
+									caption: "Test caption",
+									filename: "test-image.png",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		const media = await db.selectFrom("media").selectAll().executeTakeFirst();
+
+		expect(media).toMatchObject({
+			filename: "test-image.png",
+			mime_type: "image/png",
+			alt: "Test alt text",
+			caption: "Test caption",
+			status: "ready",
+		});
+		expect(media?.storage_key).toMatch(PNG_EXTENSION_REGEX);
+	});
+
+	it("should resolve nested $media in arrays", async () => {
+		// Set up a collection with a json field for gallery
+		const registry = new SchemaRegistry(db);
+		await registry.createField("posts", {
+			slug: "gallery",
+			label: "Gallery",
+			type: "json",
+		});
+
+		mockFetch
+			.mockResolvedValueOnce(createMockResponse(MOCK_PNG, "image/png"))
+			.mockResolvedValueOnce(createMockResponse(MOCK_JPEG, "image/jpeg"));
+
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello",
+							gallery: [
+								{
+									$media: {
+										url: "https://example.com/one.png",
+										alt: "Image one",
+									},
+								},
+								{
+									$media: {
+										url: "https://example.com/two.jpg",
+										alt: "Image two",
+									},
+								},
+							],
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			storage,
+			baseUrl: "",
+		});
+
+		expect(result.media.created).toBe(2);
+
+		const contentRepo = new ContentRepository(db);
+		const entry = await contentRepo.findBySlug("posts", "hello");
+
+		expect(entry?.data.gallery).toHaveLength(2);
+		// ImageValue stores id (URL is built at runtime by EmDashImage)
+		const gallery = entry?.data.gallery as unknown[] | undefined;
+		expect(gallery?.[0]).toMatchObject({
+			id: expect.any(String),
+			alt: "Image one",
+		});
+		expect(gallery?.[1]).toMatchObject({
+			id: expect.any(String),
+			alt: "Image two",
+		});
+	});
+});

packages/core/tests/unit/seed/skip-media-download.test.ts

@@ -0,0 +1,204 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+import { ContentRepository } from "../../../src/database/repositories/content.js";
+import type { Database } from "../../../src/database/types.js";
+import type { MediaValue } from "../../../src/media/types.js";
+import { SchemaRegistry } from "../../../src/schema/registry.js";
+import { applySeed } from "../../../src/seed/apply.js";
+import type { SeedFile } from "../../../src/seed/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+// Mock fetch globally -- should NOT be called when skipMediaDownload is true
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+
+describe("applySeed with skipMediaDownload", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		mockFetch.mockReset();
+
+		// Set up a collection with an image field
+		const registry = new SchemaRegistry(db);
+		await registry.createCollection({ slug: "posts", label: "Posts" });
+		await registry.createField("posts", {
+			slug: "title",
+			label: "Title",
+			type: "string",
+		});
+		await registry.createField("posts", {
+			slug: "featured_image",
+			label: "Featured Image",
+			type: "image",
+		});
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+		vi.restoreAllMocks();
+	});
+
+	it("should resolve $media to external URL without downloading", async () => {
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "hello",
+						data: {
+							title: "Hello World",
+							featured_image: {
+								$media: {
+									url: "https://images.unsplash.com/photo-abc123",
+									alt: "A test image",
+									filename: "test-image.jpg",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			skipMediaDownload: true,
+		});
+
+		// Media should be "created" (resolved) but not downloaded
+		expect(result.media.created).toBe(1);
+		expect(result.content.created).toBe(1);
+
+		// fetch should NOT have been called
+		expect(mockFetch).not.toHaveBeenCalled();
+
+		// Check the content has an external MediaValue
+		const contentRepo = new ContentRepository(db);
+		const entry = await contentRepo.findBySlug("posts", "hello");
+		expect(entry).toBeDefined();
+
+		const image = entry!.data.featured_image as MediaValue;
+		expect(image).toBeDefined();
+		expect(image.provider).toBe("external");
+		expect(image.src).toBe("https://images.unsplash.com/photo-abc123");
+		expect(image.alt).toBe("A test image");
+		expect(image.filename).toBe("test-image.jpg");
+		expect(image.id).toBeDefined(); // synthetic ULID
+	});
+
+	it("should not require a storage adapter", async () => {
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "no-storage",
+						data: {
+							title: "No Storage",
+							featured_image: {
+								$media: {
+									url: "https://example.com/image.jpg",
+									alt: "Test",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		// No storage adapter provided -- should work fine with skipMediaDownload
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			skipMediaDownload: true,
+			// Intentionally no storage
+		});
+
+		expect(result.media.created).toBe(1);
+		expect(result.content.created).toBe(1);
+		expect(mockFetch).not.toHaveBeenCalled();
+	});
+
+	it("should cache external media references by URL", async () => {
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "first",
+						data: {
+							title: "First Post",
+							featured_image: {
+								$media: {
+									url: "https://example.com/shared-image.jpg",
+									alt: "First alt",
+								},
+							},
+						},
+					},
+					{
+						id: "post-2",
+						slug: "second",
+						data: {
+							title: "Second Post",
+							featured_image: {
+								$media: {
+									url: "https://example.com/shared-image.jpg",
+									alt: "Second alt",
+								},
+							},
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			skipMediaDownload: true,
+		});
+
+		// First occurrence created, second from cache (skipped)
+		expect(result.media.created).toBe(1);
+		expect(result.media.skipped).toBe(1);
+		expect(result.content.created).toBe(2);
+
+		// Second entry should use the cached alt override
+		const contentRepo = new ContentRepository(db);
+		const second = await contentRepo.findBySlug("posts", "second");
+		const image = second!.data.featured_image as MediaValue;
+		expect(image.alt).toBe("Second alt");
+		expect(image.src).toBe("https://example.com/shared-image.jpg");
+	});
+
+	it("should handle content with no $media refs when skipMediaDownload is set", async () => {
+		const seed: SeedFile = {
+			version: "1",
+			content: {
+				posts: [
+					{
+						id: "post-1",
+						slug: "no-media",
+						data: {
+							title: "No Media",
+						},
+					},
+				],
+			},
+		};
+
+		const result = await applySeed(db, seed, {
+			includeContent: true,
+			skipMediaDownload: true,
+		});
+
+		expect(result.content.created).toBe(1);
+		expect(result.media.created).toBe(0);
+		expect(mockFetch).not.toHaveBeenCalled();
+	});
+});

packages/core/tests/unit/seed/validate.test.ts

@@ -0,0 +1,782 @@
+import { describe, it, expect } from "vitest";
+
+import type { SeedFile } from "../../../src/seed/types.js";
+import { validateSeed } from "../../../src/seed/validate.js";
+
+describe("validateSeed", () => {
+	describe("basic validation", () => {
+		it("should reject non-object input", () => {
+			expect(validateSeed(null)).toMatchObject({
+				valid: false,
+				errors: ["Seed must be an object"],
+			});
+
+			expect(validateSeed("string")).toMatchObject({
+				valid: false,
+				errors: ["Seed must be an object"],
+			});
+		});
+
+		it("should require version field", () => {
+			const result = validateSeed({});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("Seed must have a version field");
+		});
+
+		it("should reject unsupported versions", () => {
+			const result = validateSeed({ version: "2" });
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("Unsupported seed version: 2");
+		});
+
+		it("should accept valid minimal seed", () => {
+			const result = validateSeed({ version: "1" });
+			expect(result.valid).toBe(true);
+			expect(result.errors).toHaveLength(0);
+		});
+	});
+
+	describe("collection validation", () => {
+		it("should require collections to be an array", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: "not an array",
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("collections must be an array");
+		});
+
+		it("should require collection slug", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [{ label: "Posts", fields: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("collections[0]: slug is required");
+		});
+
+		it("should require collection label", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [{ slug: "posts", fields: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("collections[0]: label is required");
+		});
+
+		it("should validate slug format", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [{ slug: "My Posts", label: "Posts", fields: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors[0]).toContain("must start with a letter");
+		});
+
+		it("should reject duplicate collection slugs", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [
+					{ slug: "posts", label: "Posts", fields: [] },
+					{ slug: "posts", label: "Posts Again", fields: [] },
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain('collections[1].slug: duplicate collection slug "posts"');
+		});
+
+		it("should require fields to be an array", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [{ slug: "posts", label: "Posts", fields: "not array" }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("collections[0].fields: must be an array");
+		});
+
+		it("should validate field properties", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [{ slug: "title" }], // missing label and type
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("collections[0].fields[0]: label is required");
+			expect(result.errors).toContain("collections[0].fields[0]: type is required");
+		});
+
+		it("should reject invalid field types", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [{ slug: "title", label: "Title", type: "invalid" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors[0]).toContain('unsupported field type "invalid"');
+		});
+
+		it("should reject duplicate field slugs", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [
+							{ slug: "title", label: "Title", type: "string" },
+							{ slug: "title", label: "Title 2", type: "string" },
+						],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors[0]).toContain('duplicate field slug "title"');
+		});
+
+		it("should accept valid collection with fields", () => {
+			const result = validateSeed({
+				version: "1",
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [
+							{ slug: "title", label: "Title", type: "string", required: true },
+							{ slug: "content", label: "Content", type: "portableText" },
+						],
+					},
+				],
+			});
+			expect(result.valid).toBe(true);
+			expect(result.errors).toHaveLength(0);
+		});
+	});
+
+	describe("taxonomy validation", () => {
+		it("should require taxonomy name", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [{ label: "Categories", hierarchical: true, collections: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("taxonomies[0]: name is required");
+		});
+
+		it("should require taxonomy label", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [{ name: "category", hierarchical: true, collections: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("taxonomies[0]: label is required");
+		});
+
+		it("should require hierarchical field", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [{ name: "category", label: "Categories", collections: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("taxonomies[0]: hierarchical is required");
+		});
+
+		it("should warn about taxonomy with no collections", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: [],
+					},
+				],
+			});
+			expect(result.valid).toBe(true);
+			expect(result.warnings).toContain(
+				'taxonomies[0].collections: taxonomy "category" is not assigned to any collections',
+			);
+		});
+
+		it("should reject duplicate taxonomy names", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: ["posts"],
+					},
+					{
+						name: "category",
+						label: "Categories 2",
+						hierarchical: true,
+						collections: ["posts"],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain('taxonomies[1].name: duplicate taxonomy name "category"');
+		});
+
+		it("should validate term properties", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: ["posts"],
+						terms: [{ slug: "news" }], // missing label
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("taxonomies[0].terms[0]: label is required");
+		});
+
+		it("should reject duplicate term slugs", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: ["posts"],
+						terms: [
+							{ slug: "news", label: "News" },
+							{ slug: "news", label: "News 2" },
+						],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors[0]).toContain('duplicate term slug "news"');
+		});
+
+		it("should reject self-referencing parent", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: ["posts"],
+						terms: [{ slug: "news", label: "News", parent: "news" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				"taxonomies[0].terms[0].parent: term cannot be its own parent",
+			);
+		});
+
+		it("should reject invalid parent reference", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: ["posts"],
+						terms: [{ slug: "news", label: "News", parent: "nonexistent" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				'taxonomies[0].terms[0].parent: parent term "nonexistent" not found in taxonomy',
+			);
+		});
+
+		it("should warn about parent on non-hierarchical taxonomy", () => {
+			const result = validateSeed({
+				version: "1",
+				taxonomies: [
+					{
+						name: "tag",
+						label: "Tags",
+						hierarchical: false,
+						collections: ["posts"],
+						terms: [{ slug: "news", label: "News", parent: "other" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(true);
+			expect(result.warnings[0]).toContain("is not hierarchical, parent will be ignored");
+		});
+	});
+
+	describe("menu validation", () => {
+		it("should require menu name and label", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [{ items: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("menus[0]: name is required");
+			expect(result.errors).toContain("menus[0]: label is required");
+		});
+
+		it("should reject duplicate menu names", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [
+					{ name: "primary", label: "Primary", items: [] },
+					{ name: "primary", label: "Primary 2", items: [] },
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain('menus[1].name: duplicate menu name "primary"');
+		});
+
+		it("should validate menu item types", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [
+					{
+						name: "primary",
+						label: "Primary",
+						items: [{ type: "invalid" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors[0]).toContain('must be "custom", "page", "post"');
+		});
+
+		it("should require url for custom items", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [
+					{
+						name: "primary",
+						label: "Primary",
+						items: [{ type: "custom", label: "Link" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("menus[0].items[0]: url is required for custom menu items");
+		});
+
+		it("should require ref for page/post items", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [
+					{
+						name: "primary",
+						label: "Primary",
+						items: [{ type: "page", label: "About" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				"menus[0].items[0]: ref is required for page/post menu items",
+			);
+		});
+
+		it("should validate nested menu items", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [
+					{
+						name: "primary",
+						label: "Primary",
+						items: [
+							{
+								type: "custom",
+								url: "/about",
+								label: "About",
+								children: [{ type: "page" }], // missing ref
+							},
+						],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				"menus[0].items[0].items[0]: ref is required for page/post menu items",
+			);
+		});
+
+		it("should warn about menu refs not in content", () => {
+			const result = validateSeed({
+				version: "1",
+				menus: [
+					{
+						name: "primary",
+						label: "Primary",
+						items: [{ type: "page", ref: "about" }],
+					},
+				],
+				content: {
+					pages: [{ id: "home", slug: "home", data: { title: "Home" } }],
+				},
+			});
+			expect(result.valid).toBe(true);
+			expect(result.warnings).toContain(
+				'Menu item references content "about" which is not in the seed file',
+			);
+		});
+	});
+
+	describe("widget area validation", () => {
+		it("should require widget area name and label", () => {
+			const result = validateSeed({
+				version: "1",
+				widgetAreas: [{ widgets: [] }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("widgetAreas[0]: name is required");
+			expect(result.errors).toContain("widgetAreas[0]: label is required");
+		});
+
+		it("should reject duplicate widget area names", () => {
+			const result = validateSeed({
+				version: "1",
+				widgetAreas: [
+					{ name: "sidebar", label: "Sidebar", widgets: [] },
+					{ name: "sidebar", label: "Sidebar 2", widgets: [] },
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain('widgetAreas[1].name: duplicate widget area name "sidebar"');
+		});
+
+		it("should validate widget types", () => {
+			const result = validateSeed({
+				version: "1",
+				widgetAreas: [
+					{
+						name: "sidebar",
+						label: "Sidebar",
+						widgets: [{ type: "invalid" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors[0]).toContain('must be "content", "menu", or "component"');
+		});
+
+		it("should require menuName for menu widgets", () => {
+			const result = validateSeed({
+				version: "1",
+				widgetAreas: [
+					{
+						name: "sidebar",
+						label: "Sidebar",
+						widgets: [{ type: "menu", title: "Nav" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				"widgetAreas[0].widgets[0]: menuName is required for menu widgets",
+			);
+		});
+
+		it("should require componentId for component widgets", () => {
+			const result = validateSeed({
+				version: "1",
+				widgetAreas: [
+					{
+						name: "sidebar",
+						label: "Sidebar",
+						widgets: [{ type: "component", title: "Recent Posts" }],
+					},
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				"widgetAreas[0].widgets[0]: componentId is required for component widgets",
+			);
+		});
+	});
+
+	describe("redirect validation", () => {
+		it("should require redirects to be an array", () => {
+			const result = validateSeed({
+				version: "1",
+				redirects: "not an array",
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("redirects must be an array");
+		});
+
+		it("should require source and destination", () => {
+			const result = validateSeed({
+				version: "1",
+				redirects: [{}],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("redirects[0]: source is required");
+			expect(result.errors).toContain("redirects[0]: destination is required");
+		});
+
+		it("should validate redirect source and destination paths", () => {
+			const result = validateSeed({
+				version: "1",
+				redirects: [{ source: "https://example.com", destination: "//external" }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				"redirects[0].source: must be a path starting with / (no protocol-relative URLs, path traversal, or newlines)",
+			);
+			expect(result.errors).toContain(
+				"redirects[0].destination: must be a path starting with / (no protocol-relative URLs, path traversal, or newlines)",
+			);
+		});
+
+		it("should validate redirect type", () => {
+			const result = validateSeed({
+				version: "1",
+				redirects: [{ source: "/old", destination: "/new", type: 303 }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("redirects[0].type: must be 301, 302, 307, or 308");
+		});
+
+		it("should reject duplicate redirect sources", () => {
+			const result = validateSeed({
+				version: "1",
+				redirects: [
+					{ source: "/old", destination: "/new" },
+					{ source: "/old", destination: "/newer" },
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain('redirects[1].source: duplicate redirect source "/old"');
+		});
+
+		it("should accept valid redirects", () => {
+			const result = validateSeed({
+				version: "1",
+				redirects: [
+					{ source: "/old", destination: "/new" },
+					{ source: "/temp", destination: "/next", type: 302, enabled: false },
+				],
+			});
+			expect(result.valid).toBe(true);
+			expect(result.errors).toHaveLength(0);
+		});
+	});
+
+	describe("content validation", () => {
+		it("should require content to be an object", () => {
+			const result = validateSeed({
+				version: "1",
+				content: [],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("content must be an object (collection -> entries)");
+		});
+
+		it("should require content entries to be arrays", () => {
+			const result = validateSeed({
+				version: "1",
+				content: { posts: "not array" },
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("content.posts: must be an array");
+		});
+
+		it("should require entry id and slug", () => {
+			const result = validateSeed({
+				version: "1",
+				content: {
+					posts: [{ data: { title: "Hello" } }],
+				},
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("content.posts[0]: id is required");
+			expect(result.errors).toContain("content.posts[0]: slug is required");
+		});
+
+		it("should require entry data to be an object", () => {
+			const result = validateSeed({
+				version: "1",
+				content: {
+					posts: [{ id: "hello", slug: "hello", data: "not object" }],
+				},
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("content.posts[0]: data must be an object");
+		});
+
+		it("should reject duplicate entry ids", () => {
+			const result = validateSeed({
+				version: "1",
+				content: {
+					posts: [
+						{ id: "hello", slug: "hello", data: { title: "Hello" } },
+						{ id: "hello", slug: "hello-2", data: { title: "Hello 2" } },
+					],
+				},
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				'content.posts[1].id: duplicate entry id "hello" in collection "posts"',
+			);
+		});
+
+		it("should validate byline references in content entries", () => {
+			const result = validateSeed({
+				version: "1",
+				bylines: [{ id: "editorial", slug: "editorial", displayName: "Editorial" }],
+				content: {
+					posts: [
+						{
+							id: "post-1",
+							slug: "hello",
+							data: { title: "Hello" },
+							bylines: [{ byline: "missing" }],
+						},
+					],
+				},
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain(
+				'content.posts[0].bylines[0].byline: references unknown byline "missing"',
+			);
+		});
+	});
+
+	describe("byline validation", () => {
+		it("should require byline id, slug, and displayName", () => {
+			const result = validateSeed({
+				version: "1",
+				bylines: [{ slug: "editorial" }],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain("bylines[0]: id is required");
+			expect(result.errors).toContain("bylines[0]: displayName is required");
+		});
+
+		it("should reject duplicate byline ids and slugs", () => {
+			const result = validateSeed({
+				version: "1",
+				bylines: [
+					{ id: "editorial", slug: "editorial", displayName: "Editorial" },
+					{ id: "editorial", slug: "editorial", displayName: "Editorial 2" },
+				],
+			});
+			expect(result.valid).toBe(false);
+			expect(result.errors).toContain('bylines[1].id: duplicate byline id "editorial"');
+			expect(result.errors).toContain('bylines[1].slug: duplicate byline slug "editorial"');
+		});
+	});
+
+	describe("full seed validation", () => {
+		it("should accept a complete valid seed", () => {
+			const seed: SeedFile = {
+				version: "1",
+				meta: {
+					name: "Blog Starter",
+					description: "A simple blog template",
+				},
+				settings: {
+					title: "My Blog",
+					tagline: "Thoughts and ideas",
+				},
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [
+							{ slug: "title", label: "Title", type: "string", required: true },
+							{ slug: "content", label: "Content", type: "portableText" },
+						],
+					},
+					{
+						slug: "pages",
+						label: "Pages",
+						fields: [
+							{ slug: "title", label: "Title", type: "string", required: true },
+							{ slug: "content", label: "Content", type: "portableText" },
+						],
+					},
+				],
+				taxonomies: [
+					{
+						name: "category",
+						label: "Categories",
+						hierarchical: true,
+						collections: ["posts"],
+						terms: [
+							{ slug: "news", label: "News" },
+							{ slug: "tutorials", label: "Tutorials" },
+						],
+					},
+				],
+				menus: [
+					{
+						name: "primary",
+						label: "Primary Navigation",
+						items: [
+							{ type: "custom", url: "/", label: "Home" },
+							{ type: "page", ref: "about" },
+						],
+					},
+				],
+				redirects: [
+					{ source: "/old-about", destination: "/about" },
+					{ source: "/legacy-feed", destination: "/rss.xml", type: 308, groupName: "import" },
+				],
+				widgetAreas: [
+					{
+						name: "sidebar",
+						label: "Sidebar",
+						widgets: [
+							{
+								type: "component",
+								componentId: "core:recent-posts",
+								props: { count: 5 },
+							},
+						],
+					},
+				],
+				content: {
+					pages: [
+						{
+							id: "about",
+							slug: "about",
+							status: "published",
+							data: { title: "About", content: [] },
+						},
+					],
+					posts: [
+						{
+							id: "hello",
+							slug: "hello-world",
+							status: "published",
+							data: { title: "Hello World", content: [] },
+							taxonomies: { category: ["news"] },
+						},
+					],
+				},
+			};
+
+			const result = validateSeed(seed);
+			expect(result.valid).toBe(true);
+			expect(result.errors).toHaveLength(0);
+		});
+	});
+});

packages/core/tests/unit/settings/settings.test.ts

@@ -0,0 +1,183 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach } from "vitest";
+
+import type { Database } from "../../../src/database/types.js";
+import {
+	getSiteSettingWithDb,
+	getSiteSettingsWithDb,
+	setSiteSettings,
+} from "../../../src/settings/index.js";
+import { setupTestDatabase } from "../../utils/test-db.js";
+
+describe("Site Settings", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+	});
+
+	describe("setSiteSettings", () => {
+		it("should store settings with site: prefix", async () => {
+			await setSiteSettings({ title: "Test Site" }, db);
+
+			const row = await db
+				.selectFrom("options")
+				.where("name", "=", "site:title")
+				.select("value")
+				.executeTakeFirst();
+
+			expect(row?.value).toBe('"Test Site"');
+		});
+
+		it("should merge with existing settings", async () => {
+			await setSiteSettings({ title: "Test" }, db);
+			await setSiteSettings({ tagline: "Welcome" }, db);
+
+			const settings = await getSiteSettingsWithDb(db);
+			expect(settings.title).toBe("Test");
+			expect(settings.tagline).toBe("Welcome");
+		});
+
+		it("should store complex objects", async () => {
+			await setSiteSettings(
+				{
+					social: {
+						twitter: "@handle",
+						github: "user",
+					},
+				},
+				db,
+			);
+
+			const settings = await getSiteSettingsWithDb(db);
+			expect(settings.social?.twitter).toBe("@handle");
+			expect(settings.social?.github).toBe("user");
+		});
+
+		it("should store logo with mediaId", async () => {
+			await setSiteSettings(
+				{
+					logo: { mediaId: "med_123", alt: "Logo" },
+				},
+				db,
+			);
+
+			const row = await db
+				.selectFrom("options")
+				.where("name", "=", "site:logo")
+				.select("value")
+				.executeTakeFirst();
+
+			const parsed = JSON.parse(row?.value || "{}");
+			expect(parsed.mediaId).toBe("med_123");
+			expect(parsed.alt).toBe("Logo");
+		});
+	});
+
+	describe("getSiteSetting", () => {
+		it("should return undefined for unset values", async () => {
+			const title = await getSiteSettingWithDb("title", db);
+			expect(title).toBeUndefined();
+		});
+
+		it("should return the stored value", async () => {
+			await setSiteSettings({ title: "My Site" }, db);
+			const title = await getSiteSettingWithDb("title", db);
+			expect(title).toBe("My Site");
+		});
+
+		it("should return numbers correctly", async () => {
+			await setSiteSettings({ postsPerPage: 10 }, db);
+			const postsPerPage = await getSiteSettingWithDb("postsPerPage", db);
+			expect(postsPerPage).toBe(10);
+		});
+
+		it("should return nested objects", async () => {
+			const social = { twitter: "@handle", github: "user" };
+			await setSiteSettings({ social }, db);
+			const retrieved = await getSiteSettingWithDb("social", db);
+			expect(retrieved).toEqual(social);
+		});
+	});
+
+	describe("getSiteSettings", () => {
+		it("should return empty object for no settings", async () => {
+			const settings = await getSiteSettingsWithDb(db);
+			expect(settings).toEqual({});
+		});
+
+		it("should return all settings", async () => {
+			await setSiteSettings(
+				{
+					title: "Test",
+					tagline: "Welcome",
+					postsPerPage: 10,
+				},
+				db,
+			);
+
+			const settings = await getSiteSettingsWithDb(db);
+			expect(settings.title).toBe("Test");
+			expect(settings.tagline).toBe("Welcome");
+			expect(settings.postsPerPage).toBe(10);
+		});
+
+		it("should return partial object for partial settings", async () => {
+			await setSiteSettings({ title: "Test" }, db);
+
+			const settings = await getSiteSettingsWithDb(db);
+			expect(settings.title).toBe("Test");
+			expect(settings.tagline).toBeUndefined();
+		});
+
+		it("should handle multiple setting types", async () => {
+			await setSiteSettings(
+				{
+					title: "Test Site",
+					postsPerPage: 15,
+					dateFormat: "MMMM d, yyyy",
+					timezone: "America/New_York",
+					social: {
+						twitter: "@test",
+					},
+				},
+				db,
+			);
+
+			const settings = await getSiteSettingsWithDb(db);
+			expect(settings.title).toBe("Test Site");
+			expect(settings.postsPerPage).toBe(15);
+			expect(settings.dateFormat).toBe("MMMM d, yyyy");
+			expect(settings.timezone).toBe("America/New_York");
+			expect(settings.social?.twitter).toBe("@test");
+		});
+	});
+
+	describe("Media references", () => {
+		it("should store logo without URL", async () => {
+			await setSiteSettings(
+				{
+					logo: { mediaId: "med_123", alt: "Logo" },
+				},
+				db,
+			);
+
+			// When retrieved without storage, should return mediaId but no URL
+			const logo = await getSiteSettingWithDb("logo", db, null);
+			expect(logo?.mediaId).toBe("med_123");
+			expect(logo?.alt).toBe("Logo");
+		});
+
+		it("should store favicon without URL", async () => {
+			await setSiteSettings(
+				{
+					favicon: { mediaId: "med_456" },
+				},
+				db,
+			);
+
+			const favicon = await getSiteSettingWithDb("favicon", db, null);
+			expect(favicon?.mediaId).toBe("med_456");
+		});
+	});
+});

packages/core/tests/unit/taxonomies/taxonomies.test.ts

@@ -0,0 +1,603 @@
+import type { Kysely } from "kysely";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { ContentRepository } from "../../../src/database/repositories/content.js";
+import { TaxonomyRepository } from "../../../src/database/repositories/taxonomy.js";
+import type { Database } from "../../../src/database/types.js";
+import {
+	setupTestDatabase,
+	setupTestDatabaseWithCollections,
+	teardownTestDatabase,
+} from "../../utils/test-db.js";
+
+describe("TaxonomyRepository", () => {
+	let db: Kysely<Database>;
+	let repo: TaxonomyRepository;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		repo = new TaxonomyRepository(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("create", () => {
+		it("should create a taxonomy term", async () => {
+			const term = await repo.create({
+				name: "tags",
+				slug: "javascript",
+				label: "JavaScript",
+			});
+
+			expect(term.id).toBeDefined();
+			expect(term.name).toBe("tags");
+			expect(term.slug).toBe("javascript");
+			expect(term.label).toBe("JavaScript");
+			expect(term.parentId).toBeNull();
+		});
+
+		it("should create a term with parent", async () => {
+			const parent = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Technology",
+			});
+
+			const child = await repo.create({
+				name: "category",
+				slug: "web",
+				label: "Web Development",
+				parentId: parent.id,
+			});
+
+			expect(child.parentId).toBe(parent.id);
+		});
+
+		it("should create a term with data", async () => {
+			const term = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Technology",
+				data: { description: "All things tech", color: "#0066cc" },
+			});
+
+			expect(term.data).toEqual({
+				description: "All things tech",
+				color: "#0066cc",
+			});
+		});
+	});
+
+	describe("findById", () => {
+		it("should find term by ID", async () => {
+			const created = await repo.create({
+				name: "tags",
+				slug: "test",
+				label: "Test",
+			});
+
+			const found = await repo.findById(created.id);
+
+			expect(found).not.toBeNull();
+			expect(found?.id).toBe(created.id);
+		});
+
+		it("should return null for non-existent ID", async () => {
+			const found = await repo.findById("non-existent");
+			expect(found).toBeNull();
+		});
+	});
+
+	describe("findBySlug", () => {
+		it("should find term by name and slug", async () => {
+			await repo.create({
+				name: "tags",
+				slug: "javascript",
+				label: "JavaScript",
+			});
+
+			const found = await repo.findBySlug("tags", "javascript");
+
+			expect(found).not.toBeNull();
+			expect(found?.label).toBe("JavaScript");
+		});
+
+		it("should not find term with wrong name", async () => {
+			await repo.create({
+				name: "tags",
+				slug: "javascript",
+				label: "JavaScript",
+			});
+
+			// Same slug, different name
+			const found = await repo.findBySlug("category", "javascript");
+			expect(found).toBeNull();
+		});
+
+		it("should return null for non-existent slug", async () => {
+			const found = await repo.findBySlug("tags", "non-existent");
+			expect(found).toBeNull();
+		});
+	});
+
+	describe("findByName", () => {
+		it("should find all terms for a taxonomy", async () => {
+			await repo.create({ name: "tags", slug: "js", label: "JavaScript" });
+			await repo.create({ name: "tags", slug: "ts", label: "TypeScript" });
+			await repo.create({ name: "category", slug: "tech", label: "Tech" });
+
+			const tags = await repo.findByName("tags");
+
+			expect(tags).toHaveLength(2);
+			expect(tags.map((t) => t.slug)).toContain("js");
+			expect(tags.map((t) => t.slug)).toContain("ts");
+		});
+
+		it("should filter by parentId", async () => {
+			const parent = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Technology",
+			});
+			await repo.create({
+				name: "category",
+				slug: "web",
+				label: "Web",
+				parentId: parent.id,
+			});
+			await repo.create({
+				name: "category",
+				slug: "mobile",
+				label: "Mobile",
+				parentId: parent.id,
+			});
+			await repo.create({
+				name: "category",
+				slug: "design",
+				label: "Design",
+			});
+
+			const children = await repo.findByName("category", {
+				parentId: parent.id,
+			});
+			expect(children).toHaveLength(2);
+
+			const roots = await repo.findByName("category", { parentId: null });
+			expect(roots).toHaveLength(2); // tech and design
+		});
+
+		it("should return terms ordered by label", async () => {
+			await repo.create({ name: "tags", slug: "z", label: "Zebra" });
+			await repo.create({ name: "tags", slug: "a", label: "Apple" });
+			await repo.create({ name: "tags", slug: "m", label: "Mango" });
+
+			const tags = await repo.findByName("tags");
+
+			expect(tags[0].label).toBe("Apple");
+			expect(tags[1].label).toBe("Mango");
+			expect(tags[2].label).toBe("Zebra");
+		});
+	});
+
+	describe("findChildren", () => {
+		it("should find children of a term", async () => {
+			const parent = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Technology",
+			});
+			await repo.create({
+				name: "category",
+				slug: "web",
+				label: "Web",
+				parentId: parent.id,
+			});
+			await repo.create({
+				name: "category",
+				slug: "mobile",
+				label: "Mobile",
+				parentId: parent.id,
+			});
+
+			const children = await repo.findChildren(parent.id);
+
+			expect(children).toHaveLength(2);
+		});
+
+		it("should return empty array for term with no children", async () => {
+			const term = await repo.create({
+				name: "tags",
+				slug: "test",
+				label: "Test",
+			});
+
+			const children = await repo.findChildren(term.id);
+			expect(children).toHaveLength(0);
+		});
+	});
+
+	describe("update", () => {
+		it("should update term label", async () => {
+			const term = await repo.create({
+				name: "tags",
+				slug: "js",
+				label: "JavaScript",
+			});
+
+			const updated = await repo.update(term.id, { label: "JS" });
+
+			expect(updated?.label).toBe("JS");
+			expect(updated?.slug).toBe("js"); // unchanged
+		});
+
+		it("should update term slug", async () => {
+			const term = await repo.create({
+				name: "tags",
+				slug: "js",
+				label: "JavaScript",
+			});
+
+			const updated = await repo.update(term.id, { slug: "javascript" });
+
+			expect(updated?.slug).toBe("javascript");
+		});
+
+		it("should update parentId", async () => {
+			const parent = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Tech",
+			});
+			const orphan = await repo.create({
+				name: "category",
+				slug: "web",
+				label: "Web",
+			});
+
+			const updated = await repo.update(orphan.id, { parentId: parent.id });
+
+			expect(updated?.parentId).toBe(parent.id);
+		});
+
+		it("should clear parentId when set to null", async () => {
+			const parent = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Tech",
+			});
+			const child = await repo.create({
+				name: "category",
+				slug: "web",
+				label: "Web",
+				parentId: parent.id,
+			});
+
+			const updated = await repo.update(child.id, { parentId: null });
+
+			expect(updated?.parentId).toBeNull();
+		});
+
+		it("should update data", async () => {
+			const term = await repo.create({
+				name: "category",
+				slug: "tech",
+				label: "Tech",
+				data: { color: "blue" },
+			});
+
+			const updated = await repo.update(term.id, {
+				data: { color: "red", icon: "star" },
+			});
+
+			expect(updated?.data).toEqual({ color: "red", icon: "star" });
+		});
+
+		it("should return null for non-existent term", async () => {
+			const updated = await repo.update("non-existent", { label: "Test" });
+			expect(updated).toBeNull();
+		});
+	});
+
+	describe("delete", () => {
+		it("should delete a term", async () => {
+			const term = await repo.create({
+				name: "tags",
+				slug: "test",
+				label: "Test",
+			});
+
+			const deleted = await repo.delete(term.id);
+
+			expect(deleted).toBe(true);
+			expect(await repo.findById(term.id)).toBeNull();
+		});
+
+		it("should return false for non-existent term", async () => {
+			const deleted = await repo.delete("non-existent");
+			expect(deleted).toBe(false);
+		});
+
+		it("should remove content associations when deleted", async () => {
+			// Setup: need a collection with content
+			db = await setupTestDatabaseWithCollections();
+			repo = new TaxonomyRepository(db);
+			const contentRepo = new ContentRepository(db);
+
+			const term = await repo.create({
+				name: "tags",
+				slug: "test",
+				label: "Test",
+			});
+
+			const content = await contentRepo.create({
+				type: "post",
+				slug: "test-post",
+				data: { title: "Test" },
+			});
+
+			await repo.attachToEntry("post", content.id, term.id);
+
+			// Verify attached
+			const termsBefore = await repo.getTermsForEntry("post", content.id);
+			expect(termsBefore).toHaveLength(1);
+
+			// Delete term
+			await repo.delete(term.id);
+
+			// Verify association removed
+			const termsAfter = await repo.getTermsForEntry("post", content.id);
+			expect(termsAfter).toHaveLength(0);
+		});
+	});
+
+	describe("content-taxonomy junction", () => {
+		let contentRepo: ContentRepository;
+		let contentId: string;
+
+		beforeEach(async () => {
+			// Need collections for content
+			db = await setupTestDatabaseWithCollections();
+			repo = new TaxonomyRepository(db);
+			contentRepo = new ContentRepository(db);
+
+			const content = await contentRepo.create({
+				type: "post",
+				slug: "test-post",
+				data: { title: "Test Post" },
+			});
+			contentId = content.id;
+		});
+
+		describe("attachToEntry", () => {
+			it("should attach a term to content", async () => {
+				const term = await repo.create({
+					name: "tags",
+					slug: "test",
+					label: "Test",
+				});
+
+				await repo.attachToEntry("post", contentId, term.id);
+
+				const terms = await repo.getTermsForEntry("post", contentId);
+				expect(terms).toHaveLength(1);
+				expect(terms[0].id).toBe(term.id);
+			});
+
+			it("should be idempotent (no duplicate attachments)", async () => {
+				const term = await repo.create({
+					name: "tags",
+					slug: "test",
+					label: "Test",
+				});
+
+				await repo.attachToEntry("post", contentId, term.id);
+				await repo.attachToEntry("post", contentId, term.id);
+				await repo.attachToEntry("post", contentId, term.id);
+
+				const terms = await repo.getTermsForEntry("post", contentId);
+				expect(terms).toHaveLength(1);
+			});
+		});
+
+		describe("detachFromEntry", () => {
+			it("should detach a term from content", async () => {
+				const term = await repo.create({
+					name: "tags",
+					slug: "test",
+					label: "Test",
+				});
+
+				await repo.attachToEntry("post", contentId, term.id);
+				await repo.detachFromEntry("post", contentId, term.id);
+
+				const terms = await repo.getTermsForEntry("post", contentId);
+				expect(terms).toHaveLength(0);
+			});
+
+			it("should not throw when detaching non-attached term", async () => {
+				const term = await repo.create({
+					name: "tags",
+					slug: "test",
+					label: "Test",
+				});
+
+				// Should not throw
+				await expect(repo.detachFromEntry("post", contentId, term.id)).resolves.toBeUndefined();
+			});
+		});
+
+		describe("getTermsForEntry", () => {
+			it("should get all terms for an entry", async () => {
+				const tag1 = await repo.create({
+					name: "tags",
+					slug: "js",
+					label: "JavaScript",
+				});
+				const tag2 = await repo.create({
+					name: "tags",
+					slug: "ts",
+					label: "TypeScript",
+				});
+				const cat = await repo.create({
+					name: "category",
+					slug: "tech",
+					label: "Tech",
+				});
+
+				await repo.attachToEntry("post", contentId, tag1.id);
+				await repo.attachToEntry("post", contentId, tag2.id);
+				await repo.attachToEntry("post", contentId, cat.id);
+
+				const allTerms = await repo.getTermsForEntry("post", contentId);
+				expect(allTerms).toHaveLength(3);
+			});
+
+			it("should filter by taxonomy name", async () => {
+				const tag = await repo.create({
+					name: "tags",
+					slug: "js",
+					label: "JavaScript",
+				});
+				const cat = await repo.create({
+					name: "category",
+					slug: "tech",
+					label: "Tech",
+				});
+
+				await repo.attachToEntry("post", contentId, tag.id);
+				await repo.attachToEntry("post", contentId, cat.id);
+
+				const tags = await repo.getTermsForEntry("post", contentId, "tags");
+				expect(tags).toHaveLength(1);
+				expect(tags[0].slug).toBe("js");
+
+				const categories = await repo.getTermsForEntry("post", contentId, "category");
+				expect(categories).toHaveLength(1);
+				expect(categories[0].slug).toBe("tech");
+			});
+		});
+
+		describe("setTermsForEntry", () => {
+			it("should replace all terms for a taxonomy", async () => {
+				const tag1 = await repo.create({
+					name: "tags",
+					slug: "js",
+					label: "JavaScript",
+				});
+				const tag2 = await repo.create({
+					name: "tags",
+					slug: "ts",
+					label: "TypeScript",
+				});
+				const tag3 = await repo.create({
+					name: "tags",
+					slug: "rust",
+					label: "Rust",
+				});
+
+				// Initial state: js and ts
+				await repo.attachToEntry("post", contentId, tag1.id);
+				await repo.attachToEntry("post", contentId, tag2.id);
+
+				// Set to: ts and rust (removes js, keeps ts, adds rust)
+				await repo.setTermsForEntry("post", contentId, "tags", [tag2.id, tag3.id]);
+
+				const terms = await repo.getTermsForEntry("post", contentId, "tags");
+				expect(terms).toHaveLength(2);
+				expect(terms.map((t) => t.slug).toSorted()).toEqual(["rust", "ts"]);
+			});
+
+			it("should not affect other taxonomies", async () => {
+				const tag = await repo.create({
+					name: "tags",
+					slug: "js",
+					label: "JavaScript",
+				});
+				const cat = await repo.create({
+					name: "category",
+					slug: "tech",
+					label: "Tech",
+				});
+
+				await repo.attachToEntry("post", contentId, tag.id);
+				await repo.attachToEntry("post", contentId, cat.id);
+
+				// Clear tags but keep categories
+				await repo.setTermsForEntry("post", contentId, "tags", []);
+
+				const tags = await repo.getTermsForEntry("post", contentId, "tags");
+				expect(tags).toHaveLength(0);
+
+				const categories = await repo.getTermsForEntry("post", contentId, "category");
+				expect(categories).toHaveLength(1);
+			});
+		});
+
+		describe("clearEntryTerms", () => {
+			it("should remove all terms from an entry", async () => {
+				const tag = await repo.create({
+					name: "tags",
+					slug: "js",
+					label: "JavaScript",
+				});
+				const cat = await repo.create({
+					name: "category",
+					slug: "tech",
+					label: "Tech",
+				});
+
+				await repo.attachToEntry("post", contentId, tag.id);
+				await repo.attachToEntry("post", contentId, cat.id);
+
+				const count = await repo.clearEntryTerms("post", contentId);
+
+				expect(count).toBe(2);
+
+				const terms = await repo.getTermsForEntry("post", contentId);
+				expect(terms).toHaveLength(0);
+			});
+		});
+
+		describe("countEntriesWithTerm", () => {
+			it("should count entries with a term", async () => {
+				const tag = await repo.create({
+					name: "tags",
+					slug: "js",
+					label: "JavaScript",
+				});
+
+				// Create more posts
+				const post2 = await contentRepo.create({
+					type: "post",
+					slug: "post-2",
+					data: { title: "Post 2" },
+				});
+				await contentRepo.create({
+					type: "post",
+					slug: "post-3",
+					data: { title: "Post 3" },
+				});
+
+				await repo.attachToEntry("post", contentId, tag.id);
+				await repo.attachToEntry("post", post2.id, tag.id);
+				// post3 doesn't have the tag
+
+				const count = await repo.countEntriesWithTerm(tag.id);
+				expect(count).toBe(2);
+			});
+
+			it("should return 0 for unused term", async () => {
+				const tag = await repo.create({
+					name: "tags",
+					slug: "unused",
+					label: "Unused",
+				});
+
+				const count = await repo.countEntriesWithTerm(tag.id);
+				expect(count).toBe(0);
+			});
+		});
+	});
+});

packages/core/tests/unit/url-pattern/url-pattern.test.ts

@@ -0,0 +1,386 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import type { Database } from "../../../src/database/types.js";
+import { getMenuWithDb } from "../../../src/menus/index.js";
+import { SchemaRegistry } from "../../../src/schema/registry.js";
+import { applySeed } from "../../../src/seed/apply.js";
+import type { SeedFile } from "../../../src/seed/types.js";
+import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js";
+
+describe("urlPattern", () => {
+	let db: Kysely<Database>;
+	let registry: SchemaRegistry;
+
+	beforeEach(async () => {
+		db = await setupTestDatabase();
+		registry = new SchemaRegistry(db);
+	});
+
+	afterEach(async () => {
+		await teardownTestDatabase(db);
+	});
+
+	describe("schema registry", () => {
+		it("should store urlPattern on create", async () => {
+			const collection = await registry.createCollection({
+				slug: "pages",
+				label: "Pages",
+				urlPattern: "/{slug}",
+			});
+
+			expect(collection.urlPattern).toBe("/{slug}");
+		});
+
+		it("should default urlPattern to undefined when not provided", async () => {
+			const collection = await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+			});
+
+			expect(collection.urlPattern).toBeUndefined();
+		});
+
+		it("should persist urlPattern in the database", async () => {
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+
+			const row = await db
+				.selectFrom("_emdash_collections")
+				.select("url_pattern")
+				.where("slug", "=", "posts")
+				.executeTakeFirst();
+
+			expect(row?.url_pattern).toBe("/blog/{slug}");
+		});
+
+		it("should return urlPattern from getCollection", async () => {
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+
+			const collection = await registry.getCollection("posts");
+			expect(collection?.urlPattern).toBe("/blog/{slug}");
+		});
+
+		it("should update urlPattern", async () => {
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+
+			const updated = await registry.updateCollection("posts", {
+				urlPattern: "/articles/{slug}",
+			});
+
+			expect(updated.urlPattern).toBe("/articles/{slug}");
+		});
+
+		it("should clear urlPattern when set to undefined", async () => {
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+
+			// Setting to undefined in the update should clear it
+			const updated = await registry.updateCollection("posts", {
+				urlPattern: undefined,
+			});
+
+			// urlPattern was not in the update input, so it should keep the old value
+			expect(updated.urlPattern).toBe("/blog/{slug}");
+		});
+
+		it("should clear urlPattern when explicitly set to null-ish", async () => {
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+
+			// Explicitly passing null (via the update interface) should clear it
+			const updated = await registry.updateCollection("posts", {
+				urlPattern: "" as any, // empty string to clear
+			});
+
+			// Empty string is falsy but still a defined value
+			expect(updated.urlPattern).toBe("");
+		});
+
+		it("should include urlPattern in listCollections", async () => {
+			await registry.createCollection({
+				slug: "pages",
+				label: "Pages",
+				urlPattern: "/{slug}",
+			});
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+
+			const collections = await registry.listCollections();
+			const patterns = collections.map((c) => ({ slug: c.slug, urlPattern: c.urlPattern }));
+
+			expect(patterns).toEqual([
+				{ slug: "pages", urlPattern: "/{slug}" },
+				{ slug: "posts", urlPattern: "/blog/{slug}" },
+			]);
+		});
+	});
+
+	describe("menu URL resolution", () => {
+		it("should use urlPattern for content URL resolution", async () => {
+			// Create a pages collection with urlPattern
+			await registry.createCollection({
+				slug: "pages",
+				label: "Pages",
+				urlPattern: "/{slug}",
+			});
+			await registry.createField("pages", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			// Insert a page
+			const pageId = ulid();
+			await sql`
+				INSERT INTO ec_pages (id, slug, status) VALUES (${pageId}, ${"about"}, ${"published"})
+			`.execute(db);
+
+			// Create a menu with a page reference
+			const menuId = ulid();
+			await db
+				.insertInto("_emdash_menus")
+				.values({ id: menuId, name: "primary", label: "Primary" })
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: ulid(),
+					menu_id: menuId,
+					sort_order: 0,
+					type: "page",
+					reference_collection: "pages",
+					reference_id: pageId,
+					label: "About",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu).not.toBeNull();
+			expect(menu!.items).toHaveLength(1);
+			expect(menu!.items[0].url).toBe("/about");
+		});
+
+		it("should fall back to /{collection}/{slug} when no urlPattern", async () => {
+			// Create a posts collection without urlPattern
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+			});
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			// Insert a post
+			const postId = ulid();
+			await sql`
+				INSERT INTO ec_posts (id, slug, status) VALUES (${postId}, ${"hello"}, ${"published"})
+			`.execute(db);
+
+			// Create a menu with a post reference
+			const menuId = ulid();
+			await db
+				.insertInto("_emdash_menus")
+				.values({ id: menuId, name: "primary", label: "Primary" })
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: ulid(),
+					menu_id: menuId,
+					sort_order: 0,
+					type: "post",
+					reference_collection: "posts",
+					reference_id: postId,
+					label: "Hello",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu!.items[0].url).toBe("/posts/hello");
+		});
+
+		it("should interpolate {slug} in urlPattern", async () => {
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			const postId = ulid();
+			await sql`
+				INSERT INTO ec_posts (id, slug, status) VALUES (${postId}, ${"my-post"}, ${"published"})
+			`.execute(db);
+
+			const menuId = ulid();
+			await db
+				.insertInto("_emdash_menus")
+				.values({ id: menuId, name: "primary", label: "Primary" })
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values({
+					id: ulid(),
+					menu_id: menuId,
+					sort_order: 0,
+					type: "post",
+					reference_collection: "posts",
+					reference_id: postId,
+					label: "My Post",
+				})
+				.execute();
+
+			const menu = await getMenuWithDb("primary", db);
+			expect(menu!.items[0].url).toBe("/blog/my-post");
+		});
+
+		it("should handle multiple collections with different patterns", async () => {
+			// Pages: /{slug}
+			await registry.createCollection({
+				slug: "pages",
+				label: "Pages",
+				urlPattern: "/{slug}",
+			});
+			await registry.createField("pages", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			// Posts: /blog/{slug}
+			await registry.createCollection({
+				slug: "posts",
+				label: "Posts",
+				urlPattern: "/blog/{slug}",
+			});
+			await registry.createField("posts", {
+				slug: "title",
+				label: "Title",
+				type: "string",
+			});
+
+			const pageId = ulid();
+			const postId = ulid();
+			await sql`INSERT INTO ec_pages (id, slug, status) VALUES (${pageId}, ${"about"}, ${"published"})`.execute(
+				db,
+			);
+			await sql`INSERT INTO ec_posts (id, slug, status) VALUES (${postId}, ${"hello"}, ${"published"})`.execute(
+				db,
+			);
+
+			const menuId = ulid();
+			await db
+				.insertInto("_emdash_menus")
+				.values({ id: menuId, name: "nav", label: "Nav" })
+				.execute();
+
+			await db
+				.insertInto("_emdash_menu_items")
+				.values([
+					{
+						id: ulid(),
+						menu_id: menuId,
+						sort_order: 0,
+						type: "page",
+						reference_collection: "pages",
+						reference_id: pageId,
+						label: "About",
+					},
+					{
+						id: ulid(),
+						menu_id: menuId,
+						sort_order: 1,
+						type: "post",
+						reference_collection: "posts",
+						reference_id: postId,
+						label: "Hello",
+					},
+				])
+				.execute();
+
+			const menu = await getMenuWithDb("nav", db);
+			expect(menu!.items[0].url).toBe("/about");
+			expect(menu!.items[1].url).toBe("/blog/hello");
+		});
+	});
+
+	describe("seed", () => {
+		it("should persist urlPattern from seed", async () => {
+			const seed: SeedFile = {
+				version: "1",
+				collections: [
+					{
+						slug: "pages",
+						label: "Pages",
+						urlPattern: "/{slug}",
+						fields: [{ slug: "title", label: "Title", type: "string" }],
+					},
+					{
+						slug: "posts",
+						label: "Posts",
+						urlPattern: "/blog/{slug}",
+						fields: [{ slug: "title", label: "Title", type: "string" }],
+					},
+				],
+			};
+
+			await applySeed(db, seed);
+
+			const pages = await registry.getCollection("pages");
+			const posts = await registry.getCollection("posts");
+
+			expect(pages?.urlPattern).toBe("/{slug}");
+			expect(posts?.urlPattern).toBe("/blog/{slug}");
+		});
+
+		it("should handle seed without urlPattern", async () => {
+			const seed: SeedFile = {
+				version: "1",
+				collections: [
+					{
+						slug: "posts",
+						label: "Posts",
+						fields: [{ slug: "title", label: "Title", type: "string" }],
+					},
+				],
+			};
+
+			await applySeed(db, seed);
+
+			const posts = await registry.getCollection("posts");
+			expect(posts?.urlPattern).toBeUndefined();
+		});
+	});
+});

packages/core/tests/unit/visual-editing/editable.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, it } from "vitest";
+
+import { createEditable, createNoop } from "../../../src/visual-editing/editable.js";
+
+describe("createEditable", () => {
+	it("returns entry-level annotation when spread", () => {
+		const edit = createEditable("posts", "my-post");
+		expect({ ...edit }).toEqual({
+			"data-emdash-ref": '{"collection":"posts","id":"my-post"}',
+		});
+	});
+
+	it("includes status and hasDraft in entry-level annotation", () => {
+		const edit = createEditable("posts", "my-post", {
+			status: "published",
+			hasDraft: true,
+		});
+		expect({ ...edit }).toEqual({
+			"data-emdash-ref":
+				'{"collection":"posts","id":"my-post","status":"published","hasDraft":true}',
+		});
+	});
+
+	it("includes status/hasDraft in field-level annotations", () => {
+		const edit = createEditable("posts", "my-post", {
+			status: "published",
+			hasDraft: true,
+		});
+		expect(edit.title).toEqual({
+			"data-emdash-ref":
+				'{"collection":"posts","id":"my-post","status":"published","hasDraft":true,"field":"title"}',
+		});
+	});
+
+	it("returns field-level annotation for property access", () => {
+		const edit = createEditable("posts", "my-post");
+		expect(edit.title).toEqual({
+			"data-emdash-ref": '{"collection":"posts","id":"my-post","field":"title"}',
+		});
+	});
+
+	it("handles nested fields via bracket notation", () => {
+		const edit = createEditable("posts", "my-post");
+		expect(edit["hero.src"]).toEqual({
+			"data-emdash-ref": '{"collection":"posts","id":"my-post","field":"hero.src"}',
+		});
+	});
+
+	it("serializes to JSON correctly", () => {
+		const edit = createEditable("posts", "my-post");
+		expect(JSON.stringify({ edit })).toBe(
+			'{"edit":{"data-emdash-ref":"{\\"collection\\":\\"posts\\",\\"id\\":\\"my-post\\"}"}}',
+		);
+	});
+});
+
+describe("createNoop", () => {
+	it("returns empty object", () => {
+		const edit = createNoop();
+		expect({ ...edit }).toEqual({});
+	});
+
+	it("property access returns undefined", () => {
+		const edit = createNoop();
+		expect((edit as Record<string, unknown>).title).toBeUndefined();
+	});
+});

packages/core/tests/unit/visual-editing/toolbar.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+
+import { renderToolbar } from "../../../src/visual-editing/toolbar.js";
+
+// Regex patterns for HTML validation
+const EDIT_TOGGLE_CHECKED_REGEX = /id="emdash-edit-toggle"\s+checked/;
+
+describe("renderToolbar", () => {
+	it("renders toolbar with edit mode off", () => {
+		const html = renderToolbar({ editMode: false, isPreview: false });
+		expect(html).toContain('id="emdash-toolbar"');
+		expect(html).toContain('data-edit-mode="false"');
+		expect(html).not.toMatch(EDIT_TOGGLE_CHECKED_REGEX);
+	});
+
+	it("renders toolbar with edit mode on", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain('data-edit-mode="true"');
+		expect(html).toContain("checked");
+	});
+
+	it("stores preview state as data attribute", () => {
+		const html = renderToolbar({ editMode: false, isPreview: true });
+		expect(html).toContain('data-preview="true"');
+	});
+
+	it("includes toggle switch", () => {
+		const html = renderToolbar({ editMode: false, isPreview: false });
+		expect(html).toContain('id="emdash-edit-toggle"');
+		expect(html).toContain("emdash-tb-toggle");
+	});
+
+	it("includes publish button (hidden by default)", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain('id="emdash-tb-publish"');
+		expect(html).toContain('style="display:none"');
+	});
+
+	it("includes save status element", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain('id="emdash-tb-save-status"');
+	});
+
+	it("includes inline editing script with save state tracking", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain("<script>");
+		expect(html).toContain("setSaveState");
+		expect(html).toContain("unsaved");
+		expect(html).toContain("contentEditable");
+	});
+
+	it("includes text cursor for editable hover", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain("[data-emdash-ref]:hover");
+		expect(html).toContain("cursor: text");
+	});
+
+	it("includes manifest fetching for field type lookup", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain("fetchManifest");
+		expect(html).toContain("/_emdash/api/manifest");
+	});
+
+	it("includes entry status badge styles", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain("emdash-tb-badge--draft");
+		expect(html).toContain("emdash-tb-badge--published");
+		expect(html).toContain("emdash-tb-badge--pending");
+	});
+
+	it("includes save state badge styles", () => {
+		const html = renderToolbar({ editMode: true, isPreview: false });
+		expect(html).toContain("emdash-tb-badge--unsaved");
+		expect(html).toContain("emdash-tb-badge--saving");
+		expect(html).toContain("emdash-tb-badge--saved");
+		expect(html).toContain("emdash-tb-badge--error");
+	});
+});

packages/core/tests/unit/widgets/widgets.test.ts

@@ -0,0 +1,571 @@
+import type { Kysely } from "kysely";
+import { ulid } from "ulidx";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+
+import { createDatabase } from "../../../src/database/connection.js";
+import { runMigrations } from "../../../src/database/migrations/runner.js";
+import type { Database } from "../../../src/database/types.js";
+import { getWidgetComponents } from "../../../src/widgets/components.js";
+import type { WidgetType } from "../../../src/widgets/types.js";
+
+// Regex patterns for widget validation
+const WIDGET_ID_FORMAT_REGEX = /^[a-z]+:[a-z-]+$/;
+
+describe("Widget System", () => {
+	let db: Kysely<Database>;
+
+	beforeEach(async () => {
+		db = createDatabase({ url: ":memory:" });
+		await runMigrations(db);
+	});
+
+	afterEach(async () => {
+		await db.destroy();
+	});
+
+	describe("migration", () => {
+		it("should create _emdash_widget_areas table", async () => {
+			const tables = await db.introspection.getTables();
+			const areasTable = tables.find((t) => t.name === "_emdash_widget_areas");
+			expect(areasTable).toBeDefined();
+
+			const columns = areasTable!.columns.map((c) => c.name);
+			expect(columns).toContain("id");
+			expect(columns).toContain("name");
+			expect(columns).toContain("label");
+			expect(columns).toContain("description");
+		});
+
+		it("should create _emdash_widgets table", async () => {
+			const tables = await db.introspection.getTables();
+			const widgetsTable = tables.find((t) => t.name === "_emdash_widgets");
+			expect(widgetsTable).toBeDefined();
+
+			const columns = widgetsTable!.columns.map((c) => c.name);
+			expect(columns).toContain("id");
+			expect(columns).toContain("area_id");
+			expect(columns).toContain("sort_order");
+			expect(columns).toContain("type");
+			expect(columns).toContain("title");
+			expect(columns).toContain("content");
+			expect(columns).toContain("menu_name");
+			expect(columns).toContain("component_id");
+			expect(columns).toContain("component_props");
+		});
+
+		it("should enforce unique constraint on widget area name", async () => {
+			const id1 = ulid();
+			const id2 = ulid();
+
+			await db
+				.insertInto("_emdash_widget_areas")
+				.values({
+					id: id1,
+					name: "sidebar",
+					label: "Sidebar",
+					description: null,
+				})
+				.execute();
+
+			await expect(
+				db
+					.insertInto("_emdash_widget_areas")
+					.values({
+						id: id2,
+						name: "sidebar",
+						label: "Sidebar Again",
+						description: null,
+					})
+					.execute(),
+			).rejects.toThrow();
+		});
+
+		it("should cascade delete widgets when area is deleted", async () => {
+			const areaId = ulid();
+			const widgetId = ulid();
+
+			// Create area
+			await db
+				.insertInto("_emdash_widget_areas")
+				.values({
+					id: areaId,
+					name: "sidebar",
+					label: "Sidebar",
+					description: null,
+				})
+				.execute();
+
+			// Create widget
+			await db
+				.insertInto("_emdash_widgets")
+				.values({
+					id: widgetId,
+					area_id: areaId,
+					sort_order: 0,
+					type: "content" as WidgetType,
+					title: "Test Widget",
+					content: null,
+					menu_name: null,
+					component_id: null,
+					component_props: null,
+				})
+				.execute();
+
+			// Delete area
+			await db.deleteFrom("_emdash_widget_areas").where("id", "=", areaId).execute();
+
+			// Verify widget was deleted
+			const widgets = await db
+				.selectFrom("_emdash_widgets")
+				.where("area_id", "=", areaId)
+				.selectAll()
+				.execute();
+
+			expect(widgets).toHaveLength(0);
+		});
+	});
+
+	describe("widget areas", () => {
+		it("should create a widget area", async () => {
+			const id = ulid();
+
+			await db
+				.insertInto("_emdash_widget_areas")
+				.values({
+					id,
+					name: "sidebar",
+					label: "Sidebar",
+					description: "The main sidebar",
+				})
+				.execute();
+
+			const area = await db
+				.selectFrom("_emdash_widget_areas")
+				.selectAll()
+				.where("id", "=", id)
+				.executeTakeFirst();
+
+			expect(area).not.toBeNull();
+			expect(area?.name).toBe("sidebar");
+			expect(area?.label).toBe("Sidebar");
+			expect(area?.description).toBe("The main sidebar");
+		});
+
+		it("should query all widget areas", async () => {
+			await db
+				.insertInto("_emdash_widget_areas")
+				.values([
+					{ id: ulid(), name: "sidebar", label: "Sidebar", description: null },
+					{ id: ulid(), name: "footer", label: "Footer", description: null },
+					{
+						id: ulid(),
+						name: "header",
+						label: "Header Widgets",
+						description: null,
+					},
+				])
+				.execute();
+
+			const areas = await db.selectFrom("_emdash_widget_areas").selectAll().execute();
+
+			expect(areas).toHaveLength(3);
+		});
+
+		it("should query widget area by name", async () => {
+			await db
+				.insertInto("_emdash_widget_areas")
+				.values({
+					id: ulid(),
+					name: "sidebar",
+					label: "Sidebar",
+					description: "Primary sidebar",
+				})
+				.execute();
+
+			const area = await db
+				.selectFrom("_emdash_widget_areas")
+				.selectAll()
+				.where("name", "=", "sidebar")
+				.executeTakeFirst();
+
+			expect(area).not.toBeNull();
+			expect(area?.label).toBe("Sidebar");
+		});
+	});
+
+	describe("widgets", () => {
+		let areaId: string;
+
+		beforeEach(async () => {
+			areaId = ulid();
+			await db
+				.insertInto("_emdash_widget_areas")
+				.values({
+					id: areaId,
+					name: "sidebar",
+					label: "Sidebar",
+					description: null,
+				})
+				.execute();
+		});
+
+		describe("content widgets", () => {
+			it("should create a content widget", async () => {
+				const id = ulid();
+				const content = [{ _type: "block", children: [{ _type: "span", text: "Hello" }] }];
+
+				await db
+					.insertInto("_emdash_widgets")
+					.values({
+						id,
+						area_id: areaId,
+						sort_order: 0,
+						type: "content" as WidgetType,
+						title: "Welcome",
+						content: JSON.stringify(content),
+						menu_name: null,
+						component_id: null,
+						component_props: null,
+					})
+					.execute();
+
+				const widget = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("id", "=", id)
+					.executeTakeFirst();
+
+				expect(widget).not.toBeNull();
+				expect(widget?.type).toBe("content");
+				expect(widget?.title).toBe("Welcome");
+				expect(JSON.parse(widget!.content!)).toEqual(content);
+			});
+		});
+
+		describe("menu widgets", () => {
+			it("should create a menu widget", async () => {
+				const id = ulid();
+
+				await db
+					.insertInto("_emdash_widgets")
+					.values({
+						id,
+						area_id: areaId,
+						sort_order: 0,
+						type: "menu" as WidgetType,
+						title: "Navigation",
+						content: null,
+						menu_name: "sidebar-nav",
+						component_id: null,
+						component_props: null,
+					})
+					.execute();
+
+				const widget = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("id", "=", id)
+					.executeTakeFirst();
+
+				expect(widget).not.toBeNull();
+				expect(widget?.type).toBe("menu");
+				expect(widget?.menu_name).toBe("sidebar-nav");
+			});
+		});
+
+		describe("component widgets", () => {
+			it("should create a component widget", async () => {
+				const id = ulid();
+				const props = { count: 5, showDate: true };
+
+				await db
+					.insertInto("_emdash_widgets")
+					.values({
+						id,
+						area_id: areaId,
+						sort_order: 0,
+						type: "component" as WidgetType,
+						title: "Recent Posts",
+						content: null,
+						menu_name: null,
+						component_id: "core:recent-posts",
+						component_props: JSON.stringify(props),
+					})
+					.execute();
+
+				const widget = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("id", "=", id)
+					.executeTakeFirst();
+
+				expect(widget).not.toBeNull();
+				expect(widget?.type).toBe("component");
+				expect(widget?.component_id).toBe("core:recent-posts");
+				expect(JSON.parse(widget!.component_props!)).toEqual(props);
+			});
+		});
+
+		describe("ordering", () => {
+			it("should order widgets by sort_order", async () => {
+				await db
+					.insertInto("_emdash_widgets")
+					.values([
+						{
+							id: ulid(),
+							area_id: areaId,
+							sort_order: 2,
+							type: "content" as WidgetType,
+							title: "Third",
+							content: null,
+							menu_name: null,
+							component_id: null,
+							component_props: null,
+						},
+						{
+							id: ulid(),
+							area_id: areaId,
+							sort_order: 0,
+							type: "content" as WidgetType,
+							title: "First",
+							content: null,
+							menu_name: null,
+							component_id: null,
+							component_props: null,
+						},
+						{
+							id: ulid(),
+							area_id: areaId,
+							sort_order: 1,
+							type: "content" as WidgetType,
+							title: "Second",
+							content: null,
+							menu_name: null,
+							component_id: null,
+							component_props: null,
+						},
+					])
+					.execute();
+
+				const widgets = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("area_id", "=", areaId)
+					.orderBy("sort_order", "asc")
+					.execute();
+
+				expect(widgets).toHaveLength(3);
+				expect(widgets[0].title).toBe("First");
+				expect(widgets[1].title).toBe("Second");
+				expect(widgets[2].title).toBe("Third");
+			});
+
+			it("should update sort_order for reordering", async () => {
+				const ids = [ulid(), ulid(), ulid()];
+
+				await db
+					.insertInto("_emdash_widgets")
+					.values([
+						{
+							id: ids[0],
+							area_id: areaId,
+							sort_order: 0,
+							type: "content" as WidgetType,
+							title: "A",
+							content: null,
+							menu_name: null,
+							component_id: null,
+							component_props: null,
+						},
+						{
+							id: ids[1],
+							area_id: areaId,
+							sort_order: 1,
+							type: "content" as WidgetType,
+							title: "B",
+							content: null,
+							menu_name: null,
+							component_id: null,
+							component_props: null,
+						},
+						{
+							id: ids[2],
+							area_id: areaId,
+							sort_order: 2,
+							type: "content" as WidgetType,
+							title: "C",
+							content: null,
+							menu_name: null,
+							component_id: null,
+							component_props: null,
+						},
+					])
+					.execute();
+
+				// Reorder: C (was 2) -> 0, A (was 0) -> 1, B (was 1) -> 2
+				const newOrder = [ids[2], ids[0], ids[1]];
+				for (let i = 0; i < newOrder.length; i++) {
+					await db
+						.updateTable("_emdash_widgets")
+						.set({ sort_order: i })
+						.where("id", "=", newOrder[i])
+						.execute();
+				}
+
+				const widgets = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("area_id", "=", areaId)
+					.orderBy("sort_order", "asc")
+					.execute();
+
+				expect(widgets[0].title).toBe("C");
+				expect(widgets[1].title).toBe("A");
+				expect(widgets[2].title).toBe("B");
+			});
+		});
+
+		describe("update and delete", () => {
+			it("should update widget properties", async () => {
+				const id = ulid();
+
+				await db
+					.insertInto("_emdash_widgets")
+					.values({
+						id,
+						area_id: areaId,
+						sort_order: 0,
+						type: "content" as WidgetType,
+						title: "Original",
+						content: JSON.stringify([{ _type: "block", children: [] }]),
+						menu_name: null,
+						component_id: null,
+						component_props: null,
+					})
+					.execute();
+
+				const newContent = [{ _type: "block", children: [{ _type: "span", text: "Updated" }] }];
+
+				await db
+					.updateTable("_emdash_widgets")
+					.set({
+						title: "Updated Title",
+						content: JSON.stringify(newContent),
+					})
+					.where("id", "=", id)
+					.execute();
+
+				const widget = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("id", "=", id)
+					.executeTakeFirst();
+
+				expect(widget?.title).toBe("Updated Title");
+				expect(JSON.parse(widget!.content!)).toEqual(newContent);
+			});
+
+			it("should delete a widget", async () => {
+				const id = ulid();
+
+				await db
+					.insertInto("_emdash_widgets")
+					.values({
+						id,
+						area_id: areaId,
+						sort_order: 0,
+						type: "content" as WidgetType,
+						title: "To Delete",
+						content: null,
+						menu_name: null,
+						component_id: null,
+						component_props: null,
+					})
+					.execute();
+
+				await db.deleteFrom("_emdash_widgets").where("id", "=", id).execute();
+
+				const widget = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("id", "=", id)
+					.executeTakeFirst();
+
+				expect(widget).toBeUndefined();
+			});
+		});
+	});
+
+	describe("widget components registry", () => {
+		it("should return core widget components", () => {
+			const components = getWidgetComponents();
+
+			expect(components.length).toBeGreaterThan(0);
+
+			const recentPosts = components.find((c) => c.id === "core:recent-posts");
+			expect(recentPosts).toBeDefined();
+			expect(recentPosts?.label).toBe("Recent Posts");
+			expect(recentPosts?.props).toHaveProperty("count");
+			expect(recentPosts?.props).toHaveProperty("showThumbnails");
+			expect(recentPosts?.props).toHaveProperty("showDate");
+		});
+
+		it("should include categories component", () => {
+			const components = getWidgetComponents();
+			const categories = components.find((c) => c.id === "core:categories");
+
+			expect(categories).toBeDefined();
+			expect(categories?.props).toHaveProperty("showCount");
+			expect(categories?.props).toHaveProperty("hierarchical");
+		});
+
+		it("should include tags component", () => {
+			const components = getWidgetComponents();
+			const tags = components.find((c) => c.id === "core:tags");
+
+			expect(tags).toBeDefined();
+			expect(tags?.props).toHaveProperty("showCount");
+			expect(tags?.props).toHaveProperty("limit");
+		});
+
+		it("should include search component", () => {
+			const components = getWidgetComponents();
+			const search = components.find((c) => c.id === "core:search");
+
+			expect(search).toBeDefined();
+			expect(search?.props).toHaveProperty("placeholder");
+		});
+
+		it("should include archives component", () => {
+			const components = getWidgetComponents();
+			const archives = components.find((c) => c.id === "core:archives");
+
+			expect(archives).toBeDefined();
+			expect(archives?.props).toHaveProperty("type");
+			expect(archives?.props).toHaveProperty("limit");
+			expect(archives?.props.type.options).toEqual([
+				{ value: "monthly", label: "Monthly" },
+				{ value: "yearly", label: "Yearly" },
+			]);
+		});
+
+		it("should have valid prop definitions", () => {
+			const components = getWidgetComponents();
+
+			for (const component of components) {
+				expect(component.id).toMatch(WIDGET_ID_FORMAT_REGEX);
+				expect(component.label).toBeTruthy();
+
+				for (const [_key, prop] of Object.entries(component.props)) {
+					expect(["string", "number", "boolean", "select"]).toContain(prop.type);
+					expect(prop.label).toBeTruthy();
+
+					if (prop.type === "select") {
+						expect(prop.options).toBeDefined();
+						expect(Array.isArray(prop.options)).toBe(true);
+					}
+				}
+			}
+		});
+	});
+});