@jgardner04/ghost-mcp-server 1.13.1 → 1.13.3

package/src/schemas/postSchemas.js

@@ -35,7 +35,7 @@ import {
  */
 export const createPostSchema = z.object({
   title: titleSchema,
-  html: htmlContentSchema.describe('HTML content of the post'),
+  html: htmlContentSchema.meta({ description: 'HTML content of the post' }),
   slug: slugSchema.optional(),
   status: postStatusSchema.default('draft'),
   visibility: visibilitySchema.default('public'),
@@ -57,15 +57,21 @@ export const createPostSchema = z.object({
     .max(500, 'Twitter description cannot exceed 500 characters')
     .optional(),
   canonical_url: canonicalUrlSchema,
-  tags: tagsSchema.describe('Array of tag names or IDs to associate with the post'),
-  authors: authorsSchema.describe('Array of author IDs or emails'),
-  published_at: isoDateSchema.optional().describe('Scheduled publish time (ISO 8601 format)'),
-  updated_at: isoDateSchema.optional(),
-  created_at: isoDateSchema.optional(),
+  tags: tagsSchema.meta({
+    description:
+      'Array of tag names or IDs to associate with the post. On update, this fully replaces the existing tags array (not merged).',
+  }),
+  authors: authorsSchema.meta({
+    description:
+      'Array of author IDs or emails. On update, this fully replaces the existing authors array (not merged).',
+  }),
+  published_at: isoDateSchema
+    .optional()
+    .meta({ description: 'Scheduled publish time (ISO 8601 format)' }),
   codeinjection_head: z.string().optional(),
   codeinjection_foot: z.string().optional(),
-  custom_template: z.string().optional().describe('Custom template filename'),
-  email_only: z.boolean().default(false).describe('Whether post is email-only'),
+  custom_template: z.string().optional().meta({ description: 'Custom template filename' }),
+  email_only: z.boolean().default(false).meta({ description: 'Whether post is email-only' }),
 });
 
 /**
@@ -84,17 +90,20 @@ export const postQuerySchema = z.object({
     .string()
     .regex(/^[a-zA-Z0-9_\-:.'"\s,[\]<>=!+]+$/, 'Invalid filter: contains disallowed characters')
     .optional()
-    .describe('NQL filter string (e.g., "status:published+featured:true")'),
+    .meta({ description: 'NQL filter string (e.g., "status:published+featured:true")' }),
   include: z
     .string()
     .optional()
-    .describe('Comma-separated list of relations (e.g., "tags,authors")'),
-  fields: z.string().optional().describe('Comma-separated list of fields to return'),
+    .meta({ description: 'Comma-separated list of relations (e.g., "tags,authors")' }),
+  fields: z.string().optional().meta({ description: 'Comma-separated list of fields to return' }),
   formats: z
     .string()
     .optional()
-    .describe('Comma-separated list of formats (html, plaintext, mobiledoc)'),
-  order: z.string().optional().describe('Order results (e.g., "published_at DESC", "title ASC")'),
+    .meta({ description: 'Comma-separated list of formats (html, plaintext, mobiledoc)' }),
+  order: z
+    .string()
+    .optional()
+    .meta({ description: 'Order results (e.g., "published_at DESC", "title ASC")' }),
 });
 
 /**

package/src/schemas/tagSchemas.js

@@ -68,9 +68,11 @@ export const tagQueryBaseSchema = z.object({
       'Tag name contains invalid characters. Only letters, numbers, spaces, hyphens, underscores, and apostrophes are allowed'
     )
     .optional()
-    .describe('Filter by exact tag name (legacy parameter, converted to filter internally)'),
-  slug: z.string().optional().describe('Filter by tag slug'),
-  visibility: visibilitySchema.optional().describe('Filter by visibility'),
+    .meta({
+      description: 'Filter by exact tag name (legacy parameter, converted to filter internally)',
+    }),
+  slug: z.string().optional().meta({ description: 'Filter by tag slug' }),
+  visibility: visibilitySchema.optional().meta({ description: 'Filter by visibility' }),
   limit: z
     .union([
       z.number().int().min(1).max(100),
@@ -79,7 +81,7 @@ export const tagQueryBaseSchema = z.object({
     ])
     .default(15)
     .optional()
-    .describe('Number of tags to return (1-100) or "all" for all tags'),
+    .meta({ description: 'Number of tags to return (1-100) or "all" for all tags' }),
   page: z
     .union([z.number().int().min(1), z.string().regex(/^\d+$/).transform(Number)])
     .default(1)
@@ -88,12 +90,15 @@ export const tagQueryBaseSchema = z.object({
     .string()
     .regex(/^[a-zA-Z0-9_\-:.'"\s,[\]<>=!+]+$/, 'Invalid filter: contains disallowed characters')
     .optional()
-    .describe('NQL filter string'),
+    .meta({ description: 'NQL filter string' }),
   include: z
     .string()
     .optional()
-    .describe('Comma-separated list of relations to include (e.g., "count.posts")'),
-  order: z.string().optional().describe('Order results (e.g., "name ASC", "created_at DESC")'),
+    .meta({ description: 'Comma-separated list of relations to include (e.g., "count.posts")' }),
+  order: z
+    .string()
+    .optional()
+    .meta({ description: 'Order results (e.g., "name ASC", "created_at DESC")' }),
 });
 
 /**

package/src/schemas/tierSchemas.js

@@ -47,16 +47,19 @@ export const createTierSchema = z.object({
   name: z.string().min(1, 'Name cannot be empty').max(191, 'Name cannot exceed 191 characters'),
   description: z.string().max(2000, 'Description cannot exceed 2000 characters').optional(),
   slug: slugSchema.optional(),
-  active: z.boolean().default(true).describe('Whether tier is currently active/available'),
+  active: z
+    .boolean()
+    .default(true)
+    .meta({ description: 'Whether tier is currently active/available' }),
   type: z
     .enum(['free', 'paid'], {
-      errorMap: () => ({ message: 'Type must be free or paid' }),
+      error: () => ({ message: 'Type must be free or paid' }),
     })
     .default('paid'),
   welcome_page_url: z.string().url('Invalid welcome page URL').optional(),
   visibility: z
     .enum(['public', 'none'], {
-      errorMap: () => ({ message: 'Visibility must be public or none' }),
+      error: () => ({ message: 'Visibility must be public or none' }),
     })
     .default('public'),
   trial_days: z
@@ -64,7 +67,7 @@ export const createTierSchema = z.object({
     .int()
     .min(0, 'Trial days must be non-negative')
     .default(0)
-    .describe('Number of trial days for paid tiers'),
+    .meta({ description: 'Number of trial days for paid tiers' }),
   currency: z
     .string()
     .length(3, 'Currency must be 3-letter ISO code')
@@ -72,7 +75,10 @@ export const createTierSchema = z.object({
     .optional(),
   monthly_price: z.number().int().min(0, 'Monthly price must be non-negative').optional(),
   yearly_price: z.number().int().min(0, 'Yearly price must be non-negative').optional(),
-  benefits: z.array(z.string()).optional().describe('Array of benefit names/descriptions'),
+  benefits: z
+    .array(z.string())
+    .optional()
+    .meta({ description: 'Array of benefit names/descriptions' }),
 });
 
 /**
@@ -91,12 +97,15 @@ export const tierQuerySchema = z.object({
     .string()
     .regex(/^[a-zA-Z0-9_\-:.'"\s,[\]<>=!+]+$/, 'Invalid filter: contains disallowed characters')
     .optional()
-    .describe('NQL filter string (e.g., "type:paid+active:true")'),
-  include: z.string().optional().describe('Comma-separated list of relations to include'),
+    .meta({ description: 'NQL filter string (e.g., "type:paid+active:true")' }),
+  include: z
+    .string()
+    .optional()
+    .meta({ description: 'Comma-separated list of relations to include' }),
   order: z
     .string()
     .optional()
-    .describe('Order results (e.g., "monthly_price ASC", "created_at DESC")'),
+    .meta({ description: 'Order results (e.g., "monthly_price ASC", "created_at DESC")' }),
 });
 
 /**

package/src/services/__tests__/ghostServiceImproved.members.test.js

@@ -144,7 +144,7 @@ describe('ghostServiceImproved - Members', () => {
   });
 
   describe('updateMember', () => {
-    it('should update a member with valid ID and data', async () => {
+    it('should send only update fields and updated_at, not the full existing member', async () => {
       const memberId = 'member-1';
       const updateData = {
         name: 'Jane Doe',
@@ -153,8 +153,10 @@ describe('ghostServiceImproved - Members', () => {
 
       const mockExistingMember = {
         id: memberId,
+        uuid: 'abc-def-123',
         email: 'test@example.com',
         name: 'John Doe',
+        status: 'free',
         updated_at: '2023-01-01T00:00:00.000Z',
       };
 
@@ -169,13 +171,20 @@ describe('ghostServiceImproved - Members', () => {
       const result = await updateMember(memberId, updateData);
 
       expect(api.members.read).toHaveBeenCalledWith(expect.any(Object), { id: memberId });
+      // Should send ONLY updateData + updated_at, NOT the full existing member
       expect(api.members.edit).toHaveBeenCalledWith(
-        expect.objectContaining({
-          ...mockExistingMember,
-          ...updateData,
-        }),
-        expect.objectContaining({ id: memberId })
+        {
+          id: memberId,
+          name: 'Jane Doe',
+          note: 'Updated note',
+          updated_at: '2023-01-01T00:00:00.000Z',
+        },
+        {}
       );
+      // Verify read-only fields are NOT sent
+      const editCallData = api.members.edit.mock.calls[0][0];
+      expect(editCallData).not.toHaveProperty('uuid');
+      expect(editCallData).not.toHaveProperty('status');
       expect(result).toEqual(mockUpdatedMember);
     });
 

package/src/services/__tests__/ghostServiceImproved.newsletters.test.js

@@ -194,10 +194,12 @@ describe('ghostServiceImproved - Newsletter Operations', () => {
   });
 
   describe('updateNewsletter', () => {
-    it('should update a newsletter successfully', async () => {
+    it('should send only update fields and updated_at, not the full existing newsletter', async () => {
       const existingNewsletter = {
         id: 'newsletter-123',
+        uuid: 'abc-def-123',
         name: 'Old Name',
+        slug: 'old-name',
         updated_at: '2024-01-01T00:00:00.000Z',
       };
       const updateData = { name: 'New Name' };
@@ -210,13 +212,15 @@ describe('ghostServiceImproved - Newsletter Operations', () => {
 
       expect(result).toEqual(updatedNewsletter);
       expect(mockNewslettersApi.read).toHaveBeenCalledWith({}, { id: 'newsletter-123' });
+      // Should send ONLY updateData + updated_at, NOT the full existing newsletter
       expect(mockNewslettersApi.edit).toHaveBeenCalledWith(
-        {
-          ...existingNewsletter,
-          ...updateData,
-        },
-        { id: 'newsletter-123' }
+        { id: 'newsletter-123', name: 'New Name', updated_at: '2024-01-01T00:00:00.000Z' },
+        {}
       );
+      // Verify read-only fields are NOT sent
+      const editCallData = mockNewslettersApi.edit.mock.calls[0][0];
+      expect(editCallData).not.toHaveProperty('uuid');
+      expect(editCallData).not.toHaveProperty('slug');
     });
 
     it('should update newsletter with email settings', async () => {
@@ -236,9 +240,11 @@ describe('ghostServiceImproved - Newsletter Operations', () => {
 
       await updateNewsletter('newsletter-123', updateData);
 
-      expect(mockNewslettersApi.edit).toHaveBeenCalledWith(expect.objectContaining(updateData), {
-        id: 'newsletter-123',
-      });
+      // Should send ONLY updateData + updated_at
+      expect(mockNewslettersApi.edit).toHaveBeenCalledWith(
+        { id: 'newsletter-123', ...updateData, updated_at: '2024-01-01T00:00:00.000Z' },
+        {}
+      );
     });
 
     it('should throw ValidationError if ID is missing', async () => {
@@ -270,11 +276,14 @@ describe('ghostServiceImproved - Newsletter Operations', () => {
 
       await updateNewsletter('newsletter-123', updateData);
 
+      // Should send ONLY updateData + updated_at
       expect(mockNewslettersApi.edit).toHaveBeenCalledWith(
-        expect.objectContaining({
+        {
+          id: 'newsletter-123',
+          description: 'Updated description',
           updated_at: '2024-01-01T00:00:00.000Z',
-        }),
-        { id: 'newsletter-123' }
+        },
+        {}
       );
     });
   });

package/src/services/__tests__/ghostServiceImproved.pages.test.js

@@ -63,6 +63,7 @@ import {
   api,
   validators,
 } from '../ghostServiceImproved.js';
+import { createPageSchema, updatePageSchema } from '../../schemas/pageSchemas.js';
 
 describe('ghostServiceImproved - Pages', () => {
   beforeEach(() => {
@@ -219,7 +220,7 @@ describe('ghostServiceImproved - Pages', () => {
       expect(api.pages.add).toHaveBeenCalledWith(pageData, { source: 'html' });
     });
 
-    it('should sanitize HTML content', async () => {
+    it('should pass HTML through without service-layer sanitization (schema layer handles it)', async () => {
       const pageData = {
         title: 'Test Page',
         html: '<p>Safe content</p><script>alert("xss")</script>',
@@ -228,10 +229,10 @@ describe('ghostServiceImproved - Pages', () => {
 
       await createPage(pageData);
 
-      // Verify that the HTML was sanitized (script tags removed)
+      // HTML sanitization is enforced at the schema layer via htmlContentSchema,
+      // not at the service layer
       const calledWith = api.pages.add.mock.calls[0][0];
-      expect(calledWith.html).not.toContain('<script>');
-      expect(calledWith.html).toContain('<p>Safe content</p>');
+      expect(calledWith.html).toBeDefined();
     });
 
     it('should handle Ghost API validation errors (422)', async () => {
@@ -266,12 +267,16 @@ describe('ghostServiceImproved - Pages', () => {
       await expect(updatePage('', { title: 'Updated' })).rejects.toThrow('Page ID is required');
     });
 
-    it('should update page with valid data', async () => {
+    it('should send only update fields and updated_at, not the full existing page', async () => {
       const pageId = 'page-123';
       const existingPage = {
         id: pageId,
+        uuid: 'abc-def-123',
         title: 'Original Title',
+        slug: 'original-title',
         html: '<p>Original content</p>',
+        url: 'https://example.com/original-title',
+        reading_time: 2,
         updated_at: '2024-01-01T00:00:00.000Z',
       };
       const updateData = { title: 'Updated Title' };
@@ -285,10 +290,16 @@ describe('ghostServiceImproved - Pages', () => {
       expect(result).toEqual(expectedPage);
       // handleApiRequest calls read with (options, data), where options={} and data={id}
       expect(api.pages.read).toHaveBeenCalledWith({}, { id: pageId });
+      // Should send ONLY updateData + updated_at, NOT the full existing page
       expect(api.pages.edit).toHaveBeenCalledWith(
-        { ...existingPage, ...updateData },
-        { id: pageId }
+        { id: pageId, title: 'Updated Title', updated_at: '2024-01-01T00:00:00.000Z' },
+        {}
       );
+      // Verify read-only fields are NOT sent
+      const editCallData = api.pages.edit.mock.calls[0][0];
+      expect(editCallData).not.toHaveProperty('uuid');
+      expect(editCallData).not.toHaveProperty('url');
+      expect(editCallData).not.toHaveProperty('reading_time');
     });
 
     it('should handle page not found (404)', async () => {
@@ -317,23 +328,25 @@ describe('ghostServiceImproved - Pages', () => {
       expect(editCall.updated_at).toBe('2024-01-01T00:00:00.000Z');
     });
 
-    it('should sanitize HTML content in updates', async () => {
+    it('should throw ValidationError when updating to scheduled without published_at', async () => {
       const pageId = 'page-123';
-      const existingPage = { id: pageId, title: 'Test', updated_at: '2024-01-01T00:00:00.000Z' };
+      const existingPage = {
+        id: pageId,
+        title: 'Test Page',
+        updated_at: '2024-01-01T00:00:00.000Z',
+      };
       api.pages.read.mockResolvedValue(existingPage);
-      api.pages.edit.mockResolvedValue({ ...existingPage });
 
-      await updatePage(pageId, { html: '<p>Safe</p><script>alert("xss")</script>' });
-
-      const editCall = api.pages.edit.mock.calls[0][0];
-      expect(editCall.html).not.toContain('<script>');
+      await expect(updatePage(pageId, { status: 'scheduled' })).rejects.toThrow(
+        'Page validation failed'
+      );
     });
   });
 
   describe('deletePage', () => {
     it('should throw error when page ID is missing', async () => {
-      await expect(deletePage(null)).rejects.toThrow('Page ID is required');
-      await expect(deletePage('')).rejects.toThrow('Page ID is required');
+      await expect(deletePage(null)).rejects.toThrow('Page ID is required for deletion');
+      await expect(deletePage('')).rejects.toThrow('Page ID is required for deletion');
     });
 
     it('should delete page successfully', async () => {
@@ -558,4 +571,34 @@ describe('ghostServiceImproved - Pages', () => {
       expect(browseCall.filter).toContain('+');
     });
   });
+
+  describe('HTML sanitization (schema + service integration)', () => {
+    it('should strip XSS from page HTML when input flows through schema validation (production path)', async () => {
+      const rawInput = { title: 'Test Page', html: '<p>Safe</p><script>alert("xss")</script>' };
+      const validated = createPageSchema.parse(rawInput);
+
+      api.pages.add.mockResolvedValue({ id: '1', ...validated });
+      await createPage(validated);
+
+      const sentToApi = api.pages.add.mock.calls[0][0];
+      expect(sentToApi.html).not.toContain('<script>');
+      expect(sentToApi.html).not.toContain('alert');
+      expect(sentToApi.html).toContain('<p>Safe</p>');
+    });
+
+    it('should strip XSS from page HTML on update when input flows through schema validation', async () => {
+      const rawUpdate = { html: '<p>Updated</p><img src=x onerror="alert(1)">' };
+      const validated = updatePageSchema.parse(rawUpdate);
+
+      const existingPage = { id: 'page-1', updated_at: '2024-01-01T00:00:00.000Z' };
+      api.pages.read.mockResolvedValue(existingPage);
+      api.pages.edit.mockResolvedValue({ ...existingPage, ...validated });
+
+      await updatePage('page-1', validated);
+
+      const sentToApi = api.pages.edit.mock.calls[0][0];
+      expect(sentToApi.html).not.toContain('onerror');
+      expect(sentToApi.html).toContain('<img src="x"');
+    });
+  });
 });

package/src/services/__tests__/ghostServiceImproved.posts.test.js

@@ -0,0 +1,233 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createMockContextLogger } from '../../__tests__/helpers/mockLogger.js';
+import { mockDotenv } from '../../__tests__/helpers/testUtils.js';
+
+// Mock the Ghost Admin API with posts support
+vi.mock('@tryghost/admin-api', () => ({
+  default: vi.fn(function () {
+    return {
+      posts: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      pages: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      tags: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      members: {
+        add: vi.fn(),
+        browse: vi.fn(),
+        read: vi.fn(),
+        edit: vi.fn(),
+        delete: vi.fn(),
+      },
+      site: {
+        read: vi.fn(),
+      },
+      images: {
+        upload: vi.fn(),
+      },
+    };
+  }),
+}));
+
+// Mock dotenv
+vi.mock('dotenv', () => mockDotenv());
+
+// Mock logger
+vi.mock('../../utils/logger.js', () => ({
+  createContextLogger: createMockContextLogger(),
+}));
+
+// Mock fs for validateImagePath
+vi.mock('fs/promises', () => ({
+  default: {
+    access: vi.fn(),
+  },
+}));
+
+// Import after setting up mocks
+import { updatePost, api, validators } from '../ghostServiceImproved.js';
+import { updatePostSchema } from '../../schemas/postSchemas.js';
+
+describe('ghostServiceImproved - Posts (updatePost)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('updatePost', () => {
+    it('should send only update fields and updated_at, not the full existing post', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        uuid: 'abc-def-123',
+        title: 'Original Title',
+        slug: 'original-title',
+        html: '<p>Original content</p>',
+        status: 'published',
+        url: 'https://example.com/original-title',
+        comment_id: 'comment-123',
+        reading_time: 3,
+        updated_at: '2024-01-01T00:00:00.000Z',
+        created_at: '2023-12-01T00:00:00.000Z',
+      };
+      const updateData = { title: 'Updated Title' };
+      const expectedResult = { ...existingPost, title: 'Updated Title' };
+
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue(expectedResult);
+
+      const result = await updatePost(postId, updateData);
+
+      expect(result).toEqual(expectedResult);
+      // Should send ONLY updateData + updated_at, NOT the full existing post
+      expect(api.posts.edit).toHaveBeenCalledWith(
+        { id: postId, title: 'Updated Title', updated_at: '2024-01-01T00:00:00.000Z' },
+        {}
+      );
+      // Verify read-only fields are NOT sent
+      const editCallData = api.posts.edit.mock.calls[0][0];
+      expect(editCallData).not.toHaveProperty('uuid');
+      expect(editCallData).not.toHaveProperty('url');
+      expect(editCallData).not.toHaveProperty('comment_id');
+      expect(editCallData).not.toHaveProperty('reading_time');
+      expect(editCallData).not.toHaveProperty('created_at');
+    });
+
+    it('should preserve updated_at from existing post for OCC', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        title: 'Original',
+        updated_at: '2024-06-15T12:30:00.000Z',
+      };
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue({ ...existingPost, title: 'Updated' });
+
+      await updatePost(postId, { title: 'Updated' });
+
+      const editCall = api.posts.edit.mock.calls[0][0];
+      expect(editCall.updated_at).toBe('2024-06-15T12:30:00.000Z');
+    });
+
+    it('should throw error when post ID is missing', async () => {
+      await expect(updatePost(null, { title: 'Updated' })).rejects.toThrow(
+        'Post ID is required for update'
+      );
+      await expect(updatePost('', { title: 'Updated' })).rejects.toThrow(
+        'Post ID is required for update'
+      );
+    });
+
+    it('should handle post not found (404)', async () => {
+      const error404 = new Error('Post not found');
+      error404.response = { status: 404 };
+      api.posts.read.mockRejectedValue(error404);
+
+      await expect(updatePost('nonexistent-id', { title: 'Updated' })).rejects.toThrow(
+        'Post not found'
+      );
+    });
+
+    it('should throw ValidationError when updating to scheduled without published_at', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        title: 'Test Post',
+        updated_at: '2024-01-01T00:00:00.000Z',
+      };
+      api.posts.read.mockResolvedValue(existingPost);
+
+      await expect(updatePost(postId, { status: 'scheduled' })).rejects.toThrow(
+        'Post validation failed'
+      );
+    });
+
+    it('should allow updating to scheduled with valid future published_at', async () => {
+      const postId = 'post-123';
+      const existingPost = {
+        id: postId,
+        title: 'Test Post',
+        updated_at: '2024-01-01T00:00:00.000Z',
+      };
+      const futureDate = new Date(Date.now() + 86400000).toISOString();
+      const updateData = { status: 'scheduled', published_at: futureDate };
+
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue({ ...existingPost, ...updateData });
+
+      const result = await updatePost(postId, updateData);
+
+      expect(result).toBeDefined();
+      expect(api.posts.edit).toHaveBeenCalledWith(
+        { id: postId, ...updateData, updated_at: existingPost.updated_at },
+        {}
+      );
+    });
+  });
+
+  describe('validators.validateScheduledStatus', () => {
+    it('should throw when status is scheduled without published_at', () => {
+      expect(() => validators.validateScheduledStatus({ status: 'scheduled' })).toThrow(
+        'validation failed'
+      );
+    });
+
+    it('should throw when published_at has invalid date format', () => {
+      expect(() => validators.validateScheduledStatus({ published_at: 'not-a-date' })).toThrow(
+        'validation failed'
+      );
+    });
+
+    it('should throw when scheduled date is in the past', () => {
+      const pastDate = new Date(Date.now() - 86400000).toISOString();
+      expect(() =>
+        validators.validateScheduledStatus({ status: 'scheduled', published_at: pastDate })
+      ).toThrow('validation failed');
+    });
+
+    it('should not throw for valid scheduled status with future date', () => {
+      const futureDate = new Date(Date.now() + 86400000).toISOString();
+      expect(() =>
+        validators.validateScheduledStatus({ status: 'scheduled', published_at: futureDate })
+      ).not.toThrow();
+    });
+
+    it('should not throw when status is not scheduled', () => {
+      expect(() => validators.validateScheduledStatus({ status: 'draft' })).not.toThrow();
+      expect(() => validators.validateScheduledStatus({ status: 'published' })).not.toThrow();
+      expect(() => validators.validateScheduledStatus({})).not.toThrow();
+    });
+  });
+
+  describe('HTML sanitization (schema + service integration)', () => {
+    it('should strip XSS from post HTML on update when input flows through schema validation (production path)', async () => {
+      const rawUpdate = { html: '<p>Safe</p><script>alert("xss")</script>' };
+      const validated = updatePostSchema.parse(rawUpdate);
+
+      const existingPost = { id: 'post-1', updated_at: '2024-01-01T00:00:00.000Z' };
+      api.posts.read.mockResolvedValue(existingPost);
+      api.posts.edit.mockResolvedValue({ ...existingPost, ...validated });
+
+      await updatePost('post-1', validated);
+
+      const sentToApi = api.posts.edit.mock.calls[0][0];
+      expect(sentToApi.html).not.toContain('<script>');
+      expect(sentToApi.html).not.toContain('alert');
+      expect(sentToApi.html).toContain('<p>Safe</p>');
+    });
+  });
+});