From 4b3faea1e2efe96f5f204680181ce5766f18e96b Mon Sep 17 00:00:00 2001
From: Brayan Bedritchuk <brayan.bedritchuk@gmail.com>
Date: Tue, 9 Jun 2026 15:37:16 -0300
Subject: [PATCH] feat(web): Add source ingestion workspace

Add account-scoped pasted source contracts, API routes, server service and repository code, and a minimal source composer/list UI.

Store pasted text as the initial account-scoped source chunk while list responses expose source metadata only.

Update synthetic tests and evidence docs for validation, unauthenticated access, and cross-account behavior.

Validation:

- pnpm web:test

- pnpm web:typecheck

- pnpm web:lint

- pnpm repo:test:fast
---
 apps/web/app/api/sources/[sourceId]/route.ts  |  10 +
 apps/web/app/api/sources/route.ts             |  12 +
 apps/web/app/globals.css                      | 180 +++++++++++++
 apps/web/app/page.tsx                         |  11 +-
 .../features/home/components/HomeShell.tsx    |   7 +-
 .../sources/components/SourcesWorkspace.tsx   | 148 +++++++++++
 apps/web/features/sources/constants.ts        |  15 ++
 apps/web/server/accounts/current.ts           |   8 +-
 apps/web/server/sources/errors.ts             |  22 ++
 apps/web/server/sources/http.ts               | 108 ++++++++
 apps/web/server/sources/repository.ts         | 164 ++++++++++++
 apps/web/server/sources/service.ts            |  97 +++++++
 apps/web/server/sources/validation.ts         |  60 +++++
 apps/web/tests/sources.test.ts                | 240 ++++++++++++++++++
 docs/architecture/diagrams.md                 |  10 +-
 docs/architecture/system-overview.md          |   8 +-
 docs/ops/cost-model.md                        |   4 +-
 docs/ops/failure-cases.md                     |   5 +-
 docs/roadmap/next-improvements.md             |   6 +-
 docs/testing/testing-strategy.md              |  10 +-
 packages/schemas/src/index.ts                 |  57 +++++
 packages/shared-types/src/index.ts            |  52 ++++
 22 files changed, 1210 insertions(+), 24 deletions(-)
 create mode 100644 apps/web/app/api/sources/[sourceId]/route.ts
 create mode 100644 apps/web/app/api/sources/route.ts
 create mode 100644 apps/web/features/sources/components/SourcesWorkspace.tsx
 create mode 100644 apps/web/features/sources/constants.ts
 create mode 100644 apps/web/server/sources/errors.ts
 create mode 100644 apps/web/server/sources/http.ts
 create mode 100644 apps/web/server/sources/repository.ts
 create mode 100644 apps/web/server/sources/service.ts
 create mode 100644 apps/web/server/sources/validation.ts
 create mode 100644 apps/web/tests/sources.test.ts

diff --git a/apps/web/app/api/sources/[sourceId]/route.ts b/apps/web/app/api/sources/[sourceId]/route.ts
new file mode 100644
index 0000000..35ab4fe
--- /dev/null
+++ b/apps/web/app/api/sources/[sourceId]/route.ts
@@ -0,0 +1,10 @@
+import { requireCurrentAccountScope } from "@/server/accounts/current";
+import { createSourceDetailRouteHandlers } from "@/server/sources/http";
+import { readPastedSource } from "@/server/sources/service";
+
+const handlers = createSourceDetailRouteHandlers({
+  requireAccountScope: requireCurrentAccountScope,
+  readPastedSource,
+});
+
+export const GET = handlers.GET;
diff --git a/apps/web/app/api/sources/route.ts b/apps/web/app/api/sources/route.ts
new file mode 100644
index 0000000..3d26296
--- /dev/null
+++ b/apps/web/app/api/sources/route.ts
@@ -0,0 +1,12 @@
+import { requireCurrentAccountScope } from "@/server/accounts/current";
+import { createSourcesRouteHandlers } from "@/server/sources/http";
+import { createPastedSource, listPastedSources } from "@/server/sources/service";
+
+const handlers = createSourcesRouteHandlers({
+  requireAccountScope: requireCurrentAccountScope,
+  createPastedSource,
+  listPastedSources,
+});
+
+export const GET = handlers.GET;
+export const POST = handlers.POST;
diff --git a/apps/web/app/globals.css b/apps/web/app/globals.css
index 0eae0a5..d52a85d 100644
--- a/apps/web/app/globals.css
+++ b/apps/web/app/globals.css
@@ -211,6 +211,164 @@ h1 {
   padding: 10px 12px;
 }
 
+.sourceWorkspace {
+  display: grid;
+  gap: 16px;
+  grid-template-columns: minmax(0, 1.05fr) minmax(280px, 0.95fr);
+  margin: 0 auto 24px;
+  max-width: 1120px;
+}
+
+.sourceComposer,
+.sourceListPanel {
+  background: var(--panel);
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  padding: 18px;
+}
+
+.sourceComposer {
+  display: grid;
+  gap: 14px;
+}
+
+.sourceComposer h2,
+.sourceListHeader h2 {
+  font-size: 1.25rem;
+  line-height: 1.25;
+  margin-bottom: 0;
+}
+
+.sourceComposer label {
+  display: grid;
+  font-size: 0.9rem;
+  font-weight: 700;
+  gap: 6px;
+}
+
+.sourceComposer input,
+.sourceComposer textarea {
+  border: 1px solid var(--line);
+  border-radius: 6px;
+  color: var(--ink);
+  font: inherit;
+  padding: 10px 12px;
+  width: 100%;
+}
+
+.sourceComposer input {
+  min-height: 42px;
+}
+
+.sourceComposer textarea {
+  line-height: 1.5;
+  min-height: 220px;
+  resize: vertical;
+}
+
+.sourceComposer input:disabled,
+.sourceComposer textarea:disabled {
+  background: #f2f4f1;
+  cursor: not-allowed;
+}
+
+.sourceComposerFooter,
+.sourceListHeader {
+  align-items: center;
+  display: flex;
+  gap: 12px;
+  justify-content: space-between;
+}
+
+.sourceComposerFooter span {
+  color: var(--muted);
+  font-size: 0.82rem;
+}
+
+.sourceListPanel {
+  align-content: start;
+  display: grid;
+  gap: 14px;
+  min-height: 320px;
+}
+
+.sourceListHeader strong {
+  align-items: center;
+  background: #eaf7f4;
+  border: 1px solid #b7dcd3;
+  border-radius: 999px;
+  color: var(--teal);
+  display: inline-flex;
+  font-size: 0.9rem;
+  justify-content: center;
+  min-height: 34px;
+  min-width: 40px;
+  padding: 0 12px;
+}
+
+.sourceState {
+  align-self: start;
+  color: var(--muted);
+  font-size: 0.92rem;
+  line-height: 1.5;
+  margin: 0;
+}
+
+.sourceList {
+  display: grid;
+  gap: 0;
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.sourceList li {
+  align-items: start;
+  border-top: 1px solid var(--line);
+  display: grid;
+  gap: 12px;
+  grid-template-columns: minmax(0, 1fr) auto;
+  padding: 14px 0;
+}
+
+.sourceList li:first-child {
+  border-top: 0;
+  padding-top: 0;
+}
+
+.sourceList h3 {
+  font-size: 0.98rem;
+  line-height: 1.3;
+  margin: 0 0 4px;
+  overflow-wrap: anywhere;
+}
+
+.sourceList p {
+  color: var(--muted);
+  font-size: 0.82rem;
+  margin: 0;
+}
+
+.sourceList dl {
+  display: grid;
+  gap: 8px;
+  margin: 0;
+  min-width: 112px;
+}
+
+.sourceList dt {
+  color: var(--muted);
+  font-size: 0.7rem;
+  font-weight: 700;
+  text-transform: uppercase;
+}
+
+.sourceList dd {
+  font-size: 0.9rem;
+  font-weight: 700;
+  margin: 2px 0 0;
+}
+
 .authSwitch {
   color: var(--muted);
   font-size: 0.9rem;
@@ -291,6 +449,10 @@ h1 {
   .workspaceGrid {
     grid-template-columns: repeat(2, minmax(0, 1fr));
   }
+
+  .sourceWorkspace {
+    grid-template-columns: 1fr;
+  }
 }
 
 @media (max-width: 560px) {
@@ -305,4 +467,22 @@ h1 {
   .workspaceGrid {
     grid-template-columns: 1fr;
   }
+
+  .sourceComposerFooter,
+  .sourceList li {
+    align-items: stretch;
+    grid-template-columns: 1fr;
+  }
+
+  .sourceComposerFooter {
+    flex-direction: column;
+  }
+
+  .sourceComposerFooter .buttonLink {
+    width: 100%;
+  }
+
+  .sourceList dl {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
 }
diff --git a/apps/web/app/page.tsx b/apps/web/app/page.tsx
index 7eb0bf7..0b4f1f9 100644
--- a/apps/web/app/page.tsx
+++ b/apps/web/app/page.tsx
@@ -1,16 +1,21 @@
 import { HomeShell } from "@/features/home/components/HomeShell";
 import { auth } from "@/server/auth";
+import { getAccountScopeFromSessionValue } from "@/server/accounts/current";
+import { listPastedSources } from "@/server/sources/service";
 
 export default async function Page() {
   const session = await auth();
+  const scope = await getAccountScopeFromSessionValue(session);
+  const sources = scope ? await listPastedSources(scope) : [];
 
   return (
     <HomeShell
+      initialSources={sources}
       user={
-        session?.user?.accountId
+        scope
           ? {
-              accountId: session.user.accountId,
-              email: session.user.email,
+              accountId: scope.accountId,
+              email: session?.user?.email,
             }
           : null
       }
diff --git a/apps/web/features/home/components/HomeShell.tsx b/apps/web/features/home/components/HomeShell.tsx
index 7f623f2..ed25644 100644
--- a/apps/web/features/home/components/HomeShell.tsx
+++ b/apps/web/features/home/components/HomeShell.tsx
@@ -3,15 +3,18 @@ import { SiteShell } from "@/components/layout/SiteShell";
 import { LaneCard } from "@/components/ui/LaneCard";
 import { AuthStatus } from "@/features/auth/components/AuthStatus";
 import { homeLanes } from "@/features/home/constants";
+import { SourcesWorkspace } from "@/features/sources/components/SourcesWorkspace";
+import type { SourceSummary } from "@ancora/shared-types";
 
 type HomeShellProps = Readonly<{
   user: {
     email: string | null | undefined;
     accountId: string;
   } | null;
+  initialSources: readonly SourceSummary[];
 }>;
 
-export function HomeShell({ user }: HomeShellProps) {
+export function HomeShell({ user, initialSources }: HomeShellProps) {
   return (
     <main className="page">
       <header className="workspaceHeader">
@@ -30,6 +33,8 @@ export function HomeShell({ user }: HomeShellProps) {
         </div>
       </header>
 
+      <SourcesWorkspace initialSources={initialSources} isAuthenticated={Boolean(user)} />
+
       <SiteShell>
         {homeLanes.map((lane) => (
           <LaneCard key={lane.title} {...lane} />
diff --git a/apps/web/features/sources/components/SourcesWorkspace.tsx b/apps/web/features/sources/components/SourcesWorkspace.tsx
new file mode 100644
index 0000000..56fa93e
--- /dev/null
+++ b/apps/web/features/sources/components/SourcesWorkspace.tsx
@@ -0,0 +1,148 @@
+"use client";
+
+import type {
+  CreatePastedSourceResponse,
+  SourceSummary,
+} from "@ancora/shared-types";
+import { FormEvent, useState, useTransition } from "react";
+import {
+  sourceErrorMessages,
+  sourcesEndpoint,
+  sourceTextMaxLength,
+} from "@/features/sources/constants";
+
+type SourcesWorkspaceProps = Readonly<{
+  initialSources: readonly SourceSummary[];
+  isAuthenticated: boolean;
+}>;
+
+export function SourcesWorkspace({ initialSources, isAuthenticated }: SourcesWorkspaceProps) {
+  const [sources, setSources] = useState<readonly SourceSummary[]>(initialSources);
+  const [error, setError] = useState<string | null>(null);
+  const [isPending, startTransition] = useTransition();
+
+  function onSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+
+    if (!isAuthenticated) {
+      setError(sourceErrorMessages.unauthorized);
+      return;
+    }
+
+    const form = event.currentTarget;
+    const formData = new FormData(form);
+    setError(null);
+
+    startTransition(async () => {
+      const response = await fetch(sourcesEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          title: formData.get("title"),
+          text: formData.get("text"),
+        }),
+      });
+
+      if (!response.ok) {
+        const payload = (await response.json().catch(() => null)) as { error?: string } | null;
+        setError(sourceErrorMessages[payload?.error ?? ""] ?? "Unable to create source.");
+        return;
+      }
+
+      const payload = (await response.json()) as CreatePastedSourceResponse;
+
+      setSources((currentSources) => [payload.source, ...currentSources]);
+      form.reset();
+    });
+  }
+
+  return (
+    <section className="sourceWorkspace" aria-labelledby="sources-heading">
+      <form className="sourceComposer" onSubmit={onSubmit}>
+        <div>
+          <p className="eyebrow">Sources</p>
+          <h2 id="sources-heading">Paste learning material</h2>
+        </div>
+        <label>
+          Title
+          <input
+            disabled={!isAuthenticated || isPending}
+            maxLength={120}
+            name="title"
+            placeholder="Pasted source"
+            type="text"
+          />
+        </label>
+        <label>
+          Text
+          <textarea
+            disabled={!isAuthenticated || isPending}
+            maxLength={sourceTextMaxLength}
+            name="text"
+            required
+            rows={9}
+          />
+        </label>
+        <div className="sourceComposerFooter">
+          <span>{sourceTextMaxLength.toLocaleString()} character limit</span>
+          <button
+            className="buttonLink primary"
+            disabled={!isAuthenticated || isPending}
+            type="submit"
+          >
+            {isPending ? "Saving source" : "Create source"}
+          </button>
+        </div>
+        {error ? (
+          <p className="formError" role="alert">
+            {error}
+          </p>
+        ) : null}
+      </form>
+
+      <section className="sourceListPanel" aria-busy={isPending} aria-live="polite">
+        <div className="sourceListHeader">
+          <div>
+            <p className="eyebrow">Library</p>
+            <h2>Created sources</h2>
+          </div>
+          <strong>{sources.length}</strong>
+        </div>
+
+        {isPending ? <p className="sourceState">Saving pasted source...</p> : null}
+        {sources.length === 0 ? (
+          <p className="sourceState">No sources yet.</p>
+        ) : (
+          <ol className="sourceList">
+            {sources.map((source) => (
+              <li key={source.id}>
+                <div>
+                  <h3>{source.title}</h3>
+                  <p>Source {source.id.slice(0, 8)}</p>
+                </div>
+                <dl>
+                  <div>
+                    <dt>Characters</dt>
+                    <dd>{source.textCharacterCount.toLocaleString()}</dd>
+                  </div>
+                  <div>
+                    <dt>Created</dt>
+                    <dd>{formatDate(source.createdAt)}</dd>
+                  </div>
+                </dl>
+              </li>
+            ))}
+          </ol>
+        )}
+      </section>
+    </section>
+  );
+}
+
+function formatDate(date: string) {
+  return new Intl.DateTimeFormat(undefined, {
+    day: "2-digit",
+    month: "short",
+    year: "numeric",
+  }).format(new Date(date));
+}
diff --git a/apps/web/features/sources/constants.ts b/apps/web/features/sources/constants.ts
new file mode 100644
index 0000000..4efebd3
--- /dev/null
+++ b/apps/web/features/sources/constants.ts
@@ -0,0 +1,15 @@
+import { pastedSourceTextLimits } from "@ancora/shared-types";
+
+export const sourcesEndpoint = "/api/sources";
+
+export const sourceTextMaxLength = pastedSourceTextLimits.maxCharacters;
+
+export const sourceErrorMessages: Record<string, string> = {
+  duplicate_source: "That pasted source already exists in this account.",
+  empty_text: "Paste source text before creating a source.",
+  forbidden: "This account cannot access that source.",
+  invalid_request: "Unable to read the pasted source.",
+  malformed_text: "Pasted text contains unsupported control characters.",
+  text_too_long: `Pasted text must be ${sourceTextMaxLength.toLocaleString()} characters or fewer.`,
+  unauthorized: "Sign in before creating sources.",
+};
diff --git a/apps/web/server/accounts/current.ts b/apps/web/server/accounts/current.ts
index 143254b..f8821c7 100644
--- a/apps/web/server/accounts/current.ts
+++ b/apps/web/server/accounts/current.ts
@@ -9,7 +9,13 @@ import {
 import { userBelongsToAccount } from "@/server/auth/repository";
 
 export async function getCurrentAccountScope(): Promise<AccountScope | null> {
-  const scope = getAccountScopeFromSession(await auth());
+  return getAccountScopeFromSessionValue(await auth());
+}
+
+export async function getAccountScopeFromSessionValue(
+  session: unknown,
+): Promise<AccountScope | null> {
+  const scope = getAccountScopeFromSession(session);
 
   if (!scope) {
     return null;
diff --git a/apps/web/server/sources/errors.ts b/apps/web/server/sources/errors.ts
new file mode 100644
index 0000000..b3718c7
--- /dev/null
+++ b/apps/web/server/sources/errors.ts
@@ -0,0 +1,22 @@
+import type { SourceErrorCode } from "@ancora/shared-types";
+
+export type SourceInputErrorCode = "empty_text" | "malformed_text" | "text_too_long";
+
+export class SourceInputError extends Error {
+  readonly code: SourceInputErrorCode;
+
+  constructor(code: SourceInputErrorCode, message: string) {
+    super(message);
+    this.name = "SourceInputError";
+    this.code = code;
+  }
+}
+
+export class DuplicateSourceError extends Error {
+  readonly code = "duplicate_source" satisfies SourceErrorCode;
+
+  constructor() {
+    super("This pasted source already exists for the account.");
+    this.name = "DuplicateSourceError";
+  }
+}
diff --git a/apps/web/server/sources/http.ts b/apps/web/server/sources/http.ts
new file mode 100644
index 0000000..e4ef198
--- /dev/null
+++ b/apps/web/server/sources/http.ts
@@ -0,0 +1,108 @@
+import type { SourceErrorCode, SourceDetail, SourceSummary } from "@ancora/shared-types";
+import { NextResponse } from "next/server";
+import { AccountAuthorizationError, type AccountScope } from "@/server/accounts/access";
+import { DuplicateSourceError, SourceInputError } from "@/server/sources/errors";
+
+export type SourcesRouteDependencies = Readonly<{
+  requireAccountScope(): Promise<AccountScope>;
+  createPastedSource(
+    scope: AccountScope,
+    input: { title?: unknown; text?: unknown },
+  ): Promise<SourceSummary>;
+  listPastedSources(scope: AccountScope): Promise<readonly SourceSummary[]>;
+}>;
+
+export type SourceDetailRouteDependencies = Readonly<{
+  requireAccountScope(): Promise<AccountScope>;
+  readPastedSource(scope: AccountScope, sourceId: string): Promise<SourceDetail | null>;
+}>;
+
+export type SourceRouteContext = Readonly<{
+  params: Promise<{
+    sourceId: string;
+  }>;
+}>;
+
+export function createSourcesRouteHandlers(dependencies: SourcesRouteDependencies) {
+  return {
+    async GET() {
+      try {
+        const scope = await dependencies.requireAccountScope();
+        const sources = await dependencies.listPastedSources(scope);
+
+        return NextResponse.json({ sources });
+      } catch (error) {
+        return sourceErrorResponse(error);
+      }
+    },
+
+    async POST(request: Request) {
+      try {
+        const scope = await dependencies.requireAccountScope();
+        const body = await request.json().catch(() => null);
+
+        if (!body || typeof body !== "object") {
+          return sourceError("invalid_request", 400);
+        }
+
+        const source = await dependencies.createPastedSource(scope, {
+          title: "title" in body ? body.title : undefined,
+          text: "text" in body ? body.text : undefined,
+        });
+
+        return NextResponse.json({ source }, { status: 201 });
+      } catch (error) {
+        return sourceErrorResponse(error);
+      }
+    },
+  };
+}
+
+export function createSourceDetailRouteHandlers(
+  dependencies: SourceDetailRouteDependencies,
+) {
+  return {
+    async GET(_request: Request, context: SourceRouteContext) {
+      try {
+        const scope = await dependencies.requireAccountScope();
+        const { sourceId } = await context.params;
+        const source = await dependencies.readPastedSource(scope, sourceId);
+
+        if (!source) {
+          return sourceError("not_found", 404);
+        }
+
+        return NextResponse.json({ source });
+      } catch (error) {
+        if (error instanceof AccountAuthorizationError) {
+          return sourceError(
+            error.status === 401 ? "unauthorized" : "forbidden",
+            error.status,
+          );
+        }
+
+        throw error;
+      }
+    },
+  };
+}
+
+function sourceErrorResponse(error: unknown) {
+  if (error instanceof AccountAuthorizationError) {
+    return sourceError(error.status === 401 ? "unauthorized" : "forbidden", error.status);
+  }
+
+  if (error instanceof SourceInputError) {
+    return sourceError(error.code, 400);
+  }
+
+  if (error instanceof DuplicateSourceError) {
+    return sourceError(error.code, 409);
+  }
+
+  throw error;
+}
+
+function sourceError(error: SourceErrorCode, status: number) {
+  return NextResponse.json({ error }, { status });
+}
diff --git a/apps/web/server/sources/repository.ts b/apps/web/server/sources/repository.ts
new file mode 100644
index 0000000..5ee79e7
--- /dev/null
+++ b/apps/web/server/sources/repository.ts
@@ -0,0 +1,164 @@
+import "server-only";
+
+import { and, desc, eq } from "drizzle-orm";
+import { db } from "@/server/db/client";
+import { sourceChunks, sources } from "@/server/db/schema";
+import { DuplicateSourceError } from "@/server/sources/errors";
+import {
+  toSourceSummary,
+  type PersistPastedSourceInput,
+  type SourceStore,
+} from "@/server/sources/service";
+
+const PASTED_TEXT_CHUNK_INDEX = 0;
+
+export const databaseSourceStore: SourceStore = {
+  async createPastedSource(input) {
+    try {
+      return await db.transaction(async (tx) => {
+        const [source] = await tx
+          .insert(sources)
+          .values({
+            accountId: input.accountId,
+            createdByUserId: input.createdByUserId,
+            title: input.title,
+            sourceType: "pasted_text",
+            contentSha256: input.contentSha256,
+            status: "stored",
+            metadata: sourceMetadata(input),
+          })
+          .returning({
+            id: sources.id,
+            accountId: sources.accountId,
+            createdByUserId: sources.createdByUserId,
+            title: sources.title,
+            createdAt: sources.createdAt,
+            updatedAt: sources.updatedAt,
+          });
+
+        const storedSource = requireStoredSource(source);
+
+        await tx.insert(sourceChunks).values({
+          accountId: input.accountId,
+          sourceId: storedSource.id,
+          chunkIndex: PASTED_TEXT_CHUNK_INDEX,
+          content: input.text,
+          contentSha256: input.contentSha256,
+          metadata: {
+            sourceType: "pasted_text",
+            textCharacterCount: input.textCharacterCount,
+          },
+        });
+
+        return toSourceSummary({
+          ...storedSource,
+          textCharacterCount: input.textCharacterCount,
+        });
+      });
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new DuplicateSourceError();
+      }
+
+      throw error;
+    }
+  },
+
+  async listSources(scope) {
+    const records = await db
+      .select({
+        id: sources.id,
+        accountId: sources.accountId,
+        createdByUserId: sources.createdByUserId,
+        title: sources.title,
+        metadata: sources.metadata,
+        createdAt: sources.createdAt,
+        updatedAt: sources.updatedAt,
+      })
+      .from(sources)
+      .where(and(eq(sources.accountId, scope.accountId), eq(sources.sourceType, "pasted_text")))
+      .orderBy(desc(sources.createdAt));
+
+    return records.map((record) =>
+      toSourceSummary({
+        ...record,
+        textCharacterCount: readTextCharacterCount(record.metadata),
+      }),
+    );
+  },
+
+  async readSource(scope, sourceId) {
+    const [record] = await db
+      .select({
+        id: sources.id,
+        accountId: sources.accountId,
+        createdByUserId: sources.createdByUserId,
+        title: sources.title,
+        metadata: sources.metadata,
+        createdAt: sources.createdAt,
+        updatedAt: sources.updatedAt,
+        text: sourceChunks.content,
+      })
+      .from(sources)
+      .innerJoin(
+        sourceChunks,
+        and(
+          eq(sourceChunks.accountId, sources.accountId),
+          eq(sourceChunks.sourceId, sources.id),
+          eq(sourceChunks.chunkIndex, PASTED_TEXT_CHUNK_INDEX),
+        ),
+      )
+      .where(
+        and(
+          eq(sources.accountId, scope.accountId),
+          eq(sources.id, sourceId),
+          eq(sources.sourceType, "pasted_text"),
+        ),
+      )
+      .limit(1);
+
+    if (!record) {
+      return null;
+    }
+
+    return {
+      ...toSourceSummary({
+        ...record,
+        textCharacterCount: readTextCharacterCount(record.metadata),
+      }),
+      text: record.text,
+    };
+  },
+};
+
+function sourceMetadata(input: PersistPastedSourceInput) {
+  return {
+    sourceType: "pasted_text",
+    textCharacterCount: input.textCharacterCount,
+  };
+}
+
+function readTextCharacterCount(metadata: Record<string, unknown>) {
+  return typeof metadata.textCharacterCount === "number" &&
+    Number.isInteger(metadata.textCharacterCount) &&
+    metadata.textCharacterCount >= 0
+    ? metadata.textCharacterCount
+    : 0;
+}
+
+function requireStoredSource<T>(source: T | undefined) {
+  if (!source) {
+    throw new Error("Failed to store source metadata.");
+  }
+
+  return source;
+}
+
+function isUniqueViolation(error: unknown) {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    error.code === "23505"
+  );
+}
diff --git a/apps/web/server/sources/service.ts b/apps/web/server/sources/service.ts
new file mode 100644
index 0000000..dce43f4
--- /dev/null
+++ b/apps/web/server/sources/service.ts
@@ -0,0 +1,97 @@
+import { createHash } from "node:crypto";
+import type {
+  AccountId,
+  SourceDetail,
+  SourceId,
+  SourceSummary,
+  UserId,
+} from "@ancora/shared-types";
+import type { AccountScope } from "@/server/accounts/access";
+import { parsePastedSourceInput } from "@/server/sources/validation";
+
+export type PersistPastedSourceInput = Readonly<{
+  accountId: string;
+  createdByUserId: string;
+  title: string;
+  text: string;
+  textCharacterCount: number;
+  contentSha256: string;
+}>;
+
+export type SourceStore = Readonly<{
+  createPastedSource(input: PersistPastedSourceInput): Promise<SourceSummary>;
+  listSources(scope: AccountScope): Promise<readonly SourceSummary[]>;
+  readSource(scope: AccountScope, sourceId: string): Promise<SourceDetail | null>;
+}>;
+
+export async function createPastedSource(
+  scope: AccountScope,
+  input: { title?: unknown; text?: unknown },
+  store?: SourceStore,
+) {
+  const parsed = parsePastedSourceInput(input);
+  const sourceStore = store ?? (await loadDatabaseSourceStore());
+
+  return sourceStore.createPastedSource({
+    accountId: scope.accountId,
+    createdByUserId: scope.userId,
+    title: parsed.title,
+    text: parsed.text,
+    textCharacterCount: parsed.textCharacterCount,
+    contentSha256: sha256(parsed.text),
+  });
+}
+
+export async function listPastedSources(scope: AccountScope, store?: SourceStore) {
+  const sourceStore = store ?? (await loadDatabaseSourceStore());
+
+  return sourceStore.listSources(scope);
+}
+
+export async function readPastedSource(
+  scope: AccountScope,
+  sourceId: string,
+  store?: SourceStore,
+) {
+  const normalizedSourceId = sourceId.trim();
+
+  if (!normalizedSourceId) {
+    return null;
+  }
+
+  const sourceStore = store ?? (await loadDatabaseSourceStore());
+
+  return sourceStore.readSource(scope, normalizedSourceId);
+}
+
+export function toSourceSummary(input: {
+  id: string;
+  accountId: string;
+  createdByUserId: string | null;
+  title: string;
+  textCharacterCount: number;
+  createdAt: Date;
+  updatedAt: Date;
+}): SourceSummary {
+  return {
+    id: input.id as SourceId,
+    accountId: input.accountId as AccountId,
+    createdByUserId: input.createdByUserId as UserId | null,
+    title: input.title,
+    sourceType: "pasted_text",
+    status: "stored",
+    textCharacterCount: input.textCharacterCount,
+    createdAt: input.createdAt.toISOString(),
+    updatedAt: input.updatedAt.toISOString(),
+  };
+}
+
+function sha256(text: string) {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+async function loadDatabaseSourceStore() {
+  const { databaseSourceStore } = await import("@/server/sources/repository");
+
+  return databaseSourceStore;
+}
diff --git a/apps/web/server/sources/validation.ts b/apps/web/server/sources/validation.ts
new file mode 100644
index 0000000..d887ebb
--- /dev/null
+++ b/apps/web/server/sources/validation.ts
@@ -0,0 +1,60 @@
+import { pastedSourceTextLimits } from "@ancora/shared-types";
+import { SourceInputError } from "@/server/sources/errors";
+
+export const MAX_PASTED_SOURCE_TEXT_CHARACTERS = pastedSourceTextLimits.maxCharacters;
+const MAX_SOURCE_TITLE_CHARACTERS = 120;
+const DEFAULT_SOURCE_TITLE = "Pasted source";
+
+export type ParsedPastedSourceInput = Readonly<{
+  title: string;
+  text: string;
+  textCharacterCount: number;
+}>;
+
+export function parsePastedSourceInput(input: { title?: unknown; text?: unknown }) {
+  if (typeof input.text !== "string") {
+    throw new SourceInputError("malformed_text", "Pasted source text must be a string.");
+  }
+
+  if (hasUnsupportedControlCharacter(input.text)) {
+    throw new SourceInputError(
+      "malformed_text",
+      "Pasted source text contains unsupported control characters.",
+    );
+  }
+
+  if (!input.text.trim()) {
+    throw new SourceInputError("empty_text", "Paste source text before creating a source.");
+  }
+
+  if (input.text.length > MAX_PASTED_SOURCE_TEXT_CHARACTERS) {
+    throw new SourceInputError(
+      "text_too_long",
+      `Pasted source text must be ${MAX_PASTED_SOURCE_TEXT_CHARACTERS} characters or fewer.`,
+    );
+  }
+
+  return {
+    title: normalizeSourceTitle(input.title),
+    text: input.text,
+    textCharacterCount: input.text.length,
+  } satisfies ParsedPastedSourceInput;
+}
+
+function normalizeSourceTitle(title: unknown) {
+  if (typeof title !== "string") {
+    return DEFAULT_SOURCE_TITLE;
+  }
+
+  const normalized = title.replace(/\s+/g, " ").trim();
+
+  if (!normalized) {
+    return DEFAULT_SOURCE_TITLE;
+  }
+
+  return normalized.slice(0, MAX_SOURCE_TITLE_CHARACTERS);
+}
+
+function hasUnsupportedControlCharacter(text: string) {
+  return /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/.test(text);
+}
diff --git a/apps/web/tests/sources.test.ts b/apps/web/tests/sources.test.ts
new file mode 100644
index 0000000..947bde4
--- /dev/null
+++ b/apps/web/tests/sources.test.ts
@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { AccountAuthorizationError } from "../server/accounts/access";
+import { SourceInputError } from "../server/sources/errors";
+import {
+  createSourceDetailRouteHandlers,
+  createSourcesRouteHandlers,
+} from "../server/sources/http";
+import {
+  createPastedSource,
+  listPastedSources,
+  readPastedSource,
+  toSourceSummary,
+  type PersistPastedSourceInput,
+  type SourceStore,
+} from "../server/sources/service";
+import { MAX_PASTED_SOURCE_TEXT_CHARACTERS } from "../server/sources/validation";
+
+test("should reject invalid pasted source text before storage", async () => {
+  const scope = { accountId: "account_1", userId: "user_1" };
+  const store = createInMemorySourceStore();
+
+  await assert.rejects(
+    () => createPastedSource(scope, { text: "   " }, store),
+    (error) => error instanceof SourceInputError && error.code === "empty_text",
+  );
+  await assert.rejects(
+    () =>
+      createPastedSource(
+        scope,
+        { text: "a".repeat(MAX_PASTED_SOURCE_TEXT_CHARACTERS + 1) },
+        store,
+      ),
+    (error) => error instanceof SourceInputError && error.code === "text_too_long",
+  );
+  await assert.rejects(
+    () => createPastedSource(scope, { text: "synthetic\u0000source" }, store),
+    (error) => error instanceof SourceInputError && error.code === "malformed_text",
+  );
+
+  assert.equal(store.writes.length, 0);
+});
+
+test("should create and list pasted sources for the current account", async () => {
+  const scope = { accountId: "account_1", userId: "user_1" };
+  const store = createInMemorySourceStore();
+
+  const source = await createPastedSource(
+    scope,
+    {
+      title: "Synthetic study notes",
+      text: "Synthetic source content for account-owned study material.",
+    },
+    store,
+  );
+  const listedSources = await listPastedSources(scope, store);
+
+  assert.equal(source.accountId, scope.accountId);
+  assert.equal(source.createdByUserId, scope.userId);
+  assert.equal(source.sourceType, "pasted_text");
+  assert.equal(source.status, "stored");
+  assert.equal(source.textCharacterCount, 58);
+  assert.equal(store.writes[0]?.contentSha256.length, 64);
+  assert.notEqual(store.writes[0]?.contentSha256, store.writes[0]?.text);
+  assert.equal(listedSources.length, 1);
+  assert.equal(listedSources[0]?.id, source.id);
+  assert.equal("text" in listedSources[0]!, false);
+});
+
+test("should preserve pasted source text exactly after validation", async () => {
+  const scope = { accountId: "account_1", userId: "user_1" };
+  const store = createInMemorySourceStore();
+  const text = "\n  Synthetic source content with intentional whitespace.  \n";
+
+  await createPastedSource(
+    scope,
+    {
+      title: "Synthetic whitespace notes",
+      text,
+    },
+    store,
+  );
+
+  assert.equal(store.writes[0]?.text, text);
+  assert.equal(store.writes[0]?.textCharacterCount, text.length);
+});
+
+test("should fail closed when source routes are unauthenticated", async () => {
+  let createWasCalled = false;
+  let listWasCalled = false;
+  const routes = createSourcesRouteHandlers({
+    async requireAccountScope() {
+      throw new AccountAuthorizationError("Authentication with an account is required.");
+    },
+    async createPastedSource() {
+      createWasCalled = true;
+      throw new Error("create should not be called");
+    },
+    async listPastedSources() {
+      listWasCalled = true;
+      throw new Error("list should not be called");
+    },
+  });
+
+  const getResponse = await routes.GET();
+  const postResponse = await routes.POST(
+    new Request("http://ancora.test/api/sources", {
+      method: "POST",
+      body: JSON.stringify({ text: "Synthetic route text." }),
+    }),
+  );
+  const malformedPostResponse = await routes.POST(
+    new Request("http://ancora.test/api/sources", {
+      method: "POST",
+      body: "{",
+    }),
+  );
+
+  assert.equal(getResponse.status, 401);
+  assert.deepEqual(await getResponse.json(), { error: "unauthorized" });
+  assert.equal(postResponse.status, 401);
+  assert.deepEqual(await postResponse.json(), { error: "unauthorized" });
+  assert.equal(malformedPostResponse.status, 401);
+  assert.deepEqual(await malformedPostResponse.json(), { error: "unauthorized" });
+  assert.equal(createWasCalled, false);
+  assert.equal(listWasCalled, false);
+});
+
+test("should pass current account scope through source routes", async () => {
+  const scope = { accountId: "account_1", userId: "user_1" };
+  let listedAccountId: string | null = null;
+  let readAccountId: string | null = null;
+  let readSourceId: string | null = null;
+
+  const routes = createSourcesRouteHandlers({
+    async requireAccountScope() {
+      return scope;
+    },
+    async createPastedSource() {
+      throw new Error("create should not be called");
+    },
+    async listPastedSources(routeScope) {
+      listedAccountId = routeScope.accountId;
+      return [];
+    },
+  });
+  const detailRoutes = createSourceDetailRouteHandlers({
+    async requireAccountScope() {
+      return scope;
+    },
+    async readPastedSource(routeScope, sourceId) {
+      readAccountId = routeScope.accountId;
+      readSourceId = sourceId;
+      return null;
+    },
+  });
+
+  const listResponse = await routes.GET();
+  const readResponse = await detailRoutes.GET(new Request("http://ancora.test/api/sources/source_2"), {
+    params: Promise.resolve({ sourceId: "source_2" }),
+  });
+
+  assert.equal(listResponse.status, 200);
+  assert.deepEqual(await listResponse.json(), { sources: [] });
+  assert.equal(readResponse.status, 404);
+  assert.deepEqual(await readResponse.json(), { error: "not_found" });
+  assert.equal(listedAccountId, "account_1");
+  assert.equal(readAccountId, "account_1");
+  assert.equal(readSourceId, "source_2");
+});
+
+test("should not read or list sources from another account in the source service", async () => {
+  const ownerScope = { accountId: "account_1", userId: "user_1" };
+  const otherScope = { accountId: "account_2", userId: "user_2" };
+  const store = createInMemorySourceStore();
+
+  const source = await createPastedSource(
+    ownerScope,
+    {
+      title: "Synthetic account boundary notes",
+      text: "Synthetic account boundary content.",
+    },
+    store,
+  );
+
+  assert.equal(await readPastedSource(otherScope, source.id, store), null);
+  assert.deepEqual(await listPastedSources(otherScope, store), []);
+});
+
+function createInMemorySourceStore() {
+  const records: Array<{
+    summary: Awaited<ReturnType<typeof createPastedSource>>;
+    text: string;
+  }> = [];
+  const writes: PersistPastedSourceInput[] = [];
+  let sourceSequence = 0;
+
+  const store: SourceStore & { writes: PersistPastedSourceInput[] } = {
+    writes,
+
+    async createPastedSource(input) {
+      sourceSequence += 1;
+      writes.push(input);
+
+      const summary = toSourceSummary({
+        id: `source_${sourceSequence}`,
+        accountId: input.accountId,
+        createdByUserId: input.createdByUserId,
+        title: input.title,
+        textCharacterCount: input.textCharacterCount,
+        createdAt: new Date("2026-01-01T00:00:00.000Z"),
+        updatedAt: new Date("2026-01-01T00:00:00.000Z"),
+      });
+
+      records.unshift({
+        summary,
+        text: input.text,
+      });
+
+      return summary;
+    },
+
+    async listSources(scope) {
+      return records
+        .filter((record) => record.summary.accountId === scope.accountId)
+        .map((record) => record.summary);
+    },
+
+    async readSource(scope, sourceId) {
+      const record = records.find(
+        (candidate) =>
+          candidate.summary.accountId === scope.accountId && candidate.summary.id === sourceId,
+      );
+
+      return record ? { ...record.summary, text: record.text } : null;
+    },
+  };
+
+  return store;
+}
diff --git a/docs/architecture/diagrams.md b/docs/architecture/diagrams.md
index d46bfc9..4b19d95 100644
--- a/docs/architecture/diagrams.md
+++ b/docs/architecture/diagrams.md
@@ -63,15 +63,15 @@ flowchart LR
   Scope --> SourceTables
 ```
 
-## Planned RAG Flow
+## RAG Flow
 
 ```mermaid
 flowchart TD
-  Source["Pasted source text<br/>Planned"]
-  Guard["Account and privacy checks<br/>Planned"]
-  Chunk["Chunk source with metadata<br/>Planned"]
+  Source["Pasted source text<br/>Implemented"]
+  Guard["Account and privacy checks<br/>Implemented for source ingestion"]
+  Chunk["Initial pasted source chunk<br/>Implemented"]
   Embed["Generate embeddings<br/>Planned"]
-  Store["Store chunks and vectors<br/>Planned"]
+  Store["Store chunks and vectors<br/>Initial storage implemented, vectors planned"]
   Query["Tutor or generation query<br/>Planned"]
   Retrieve["Retrieve account-scoped chunks<br/>Planned"]
   BuildPrompt["Build prompt with chunk IDs<br/>Planned"]
diff --git a/docs/architecture/system-overview.md b/docs/architecture/system-overview.md
index 7410d39..ceece04 100644
--- a/docs/architecture/system-overview.md
+++ b/docs/architecture/system-overview.md
@@ -4,9 +4,9 @@
 
 | Status | Scope |
 |---|---|
-| Implemented | TypeScript-first monorepo scaffold, ADRs, command surface, docs governance, project routing metadata, Auth.js credentials auth, account ownership, and Drizzle migrations for the base data model. |
+| Implemented | TypeScript-first monorepo scaffold, ADRs, command surface, docs governance, project routing metadata, Auth.js credentials auth, account ownership, Drizzle migrations for the base data model, and pasted source creation/listing. |
 | In progress | Next.js product boundary, account-scoped server helpers, and public architecture evidence docs. |
-| Planned | Pasted source ingestion, pgvector retrieval behavior, AI runtime orchestration, OpenAI calls, eval hooks, and Langfuse trace references. |
+| Planned | Source chunking beyond the initial pasted text record, pgvector retrieval behavior, AI runtime orchestration, OpenAI calls, eval hooks, and Langfuse trace references. |
 | Deferred | Separate backend microservices, Python runtime services, Redis queues, Kubernetes, Terraform, PyTorch, and uploaded file ingestion. |
 
 ## Runtime Ownership
@@ -39,6 +39,7 @@ This decision also keeps shared schemas, prompt artifacts, evals, and trace refe
 | `apps/web` | In progress | Next.js UI, product API, auth, and server-side AI runtime boundary. |
 | `apps/web/server/auth` | Implemented | Auth.js route integration, local credentials registration/login, password hashing, and session callbacks. |
 | `apps/web/server/accounts` | Implemented | Current account scope helpers and fail-closed account authorization helpers. |
+| `apps/web/server/sources` | Implemented | Pasted text source validation, account-scoped create/list/read service behavior, and Drizzle-backed source persistence. |
 | `apps/web/server/db` | Implemented | Drizzle schema for accounts, users, Auth.js tables, sources, source chunks, and LLM trace references. |
 | `apps/web/server` | In progress | Account-aware product logic now exists; retrieval, prompt execution, provider calls, trace references, and workflow orchestration remain planned. |
 | `tools/eval-runner` | In progress | Internal TypeScript CLI for synthetic smoke evals and future report-only quality evals. |
@@ -61,8 +62,9 @@ The current implementation establishes the v1 privacy boundary before RAG or gen
 - Auth.js provider/session tables are still migrated for future provider-backed flows.
 - Drizzle migrations create `sources`, `source_chunks`, and `llm_trace_refs` with account IDs as required ownership columns.
 - `source_chunks.embedding` is a nullable `vector(1536)` column; retrieval behavior and vector indexes remain planned.
+- Pasted source creation validates empty, over-limit, and malformed text server-side before storing source metadata and the bounded pasted body under the current account.
 
-## Planned Product Data Flow
+## Product Data Flow
 
 1. A signed-in user works inside an account boundary.
 2. The user creates a source from pasted text.
diff --git a/docs/ops/cost-model.md b/docs/ops/cost-model.md
index 86e2eba..dd34ef8 100644
--- a/docs/ops/cost-model.md
+++ b/docs/ops/cost-model.md
@@ -37,14 +37,14 @@ The implemented auth/database foundation adds non-LLM baseline costs before AI w
 
 - A PostgreSQL database with pgvector is required for accounts, users, source/chunk foundations, and trace references.
 - Auth.js credentials auth itself does not add provider cost, but production needs secret management and database-backed user/account records.
-- Source text and chunk storage costs depend on future ingestion limits; no real or private source data is committed for demos or tests.
+- Source text and chunk storage costs depend on source size limits and future chunking/embedding behavior; no real or private source data is committed for demos or tests.
 - Vector index tuning and storage growth remain planned because retrieval behavior is not implemented yet.
 
 ## Workflow Cost Drivers
 
 | Workflow | Status | Primary Cost Drivers | Guardrails |
 |---|---|---|---|
-| Source ingestion | Planned | Source length, chunk count, embedding model, duplicate detection. | Source size limits, chunk caps, deduplication, and batch controls. |
+| Source ingestion | In progress | Source length and duplicate detection are bounded for pasted text; chunk count and embedding model costs remain planned. | Implemented pasted-text size limits and account-level duplicate detection; future chunk caps and batch controls remain planned. |
 | Tutor question | Planned | Retrieved chunk count, prompt length, model, answer length, retries. | Top-k limits, answer length caps, insufficient-evidence fallback. |
 | Flashcard generation | Planned | Number of cards, retrieved context, structured output retries. | Card count limits, schema validation, review-needed state. |
 | Study session | Planned | Number of explanations, grading calls, hints, and adaptive prompts. | Per-session budget, cached card content, bounded hints. |
diff --git a/docs/ops/failure-cases.md b/docs/ops/failure-cases.md
index ee7e886..ec0eabb 100644
--- a/docs/ops/failure-cases.md
+++ b/docs/ops/failure-cases.md
@@ -4,7 +4,7 @@
 
 | Status | Scope |
 |---|---|
-| Implemented | Privacy rules, deferred infrastructure constraints, credentials auth negative tests, account-scope fail-closed helpers, and migration foundations are documented. |
+| Implemented | Privacy rules, deferred infrastructure constraints, credentials auth negative tests, account-scope fail-closed helpers, source validation/account-scope tests, and migration foundations are documented. |
 | In progress | Failure catalog defines what later product slices need to handle and test. |
 | Planned | Product error states, retries, eval coverage, privacy-safe tracing, and operational dashboards. |
 | Deferred | Multi-region failover, production incident automation, and enterprise compliance workflows. |
@@ -18,8 +18,9 @@
 | Prompt injection in source text | Planned | Treat source chunks as untrusted input and prevent them from overriding system or developer instructions. |
 | Provider outage | Planned | Return a clear product error, preserve user work, and record privacy-safe failure metadata. |
 | Rate limits | Planned | Use bounded retries, user-visible backoff, and cost/rate telemetry without logging source text. |
+| Pasted source validation | Implemented | Reject empty, over-limit, and malformed pasted text before storage. |
 | Auth leakage | In progress | Implemented session-scope parsing fails closed when user or account context is missing; route-level product enforcement remains planned for each workflow. |
-| Cross-account access | In progress | Implemented account-scoped helper rejects mismatched records; source, chunk, deck, card, review, eval, and trace repository tests remain planned as workflows are added. |
+| Cross-account access | In progress | Implemented account-scoped helper rejects mismatched records and source service tests return no data for another account; chunk, deck, card, review, eval, and trace repository tests remain planned as workflows are added. |
 | Malformed model output | Planned | Validate structured output with schemas and retry or fail safely when parsing fails. |
 | Cost spikes | Planned | Track estimated token/cost per workflow, enforce budget guardrails, and report abnormal increases. |
 | Trace privacy failure | Planned | Redact or omit raw source material from traces; store trace references in product data. |
diff --git a/docs/roadmap/next-improvements.md b/docs/roadmap/next-improvements.md
index 758b99e..9c0e48a 100644
--- a/docs/roadmap/next-improvements.md
+++ b/docs/roadmap/next-improvements.md
@@ -4,9 +4,9 @@
 
 | Status | Scope |
 |---|---|
-| Implemented | TypeScript-first scaffold, governance, ADRs, command surface, portfolio evidence baseline, Auth.js credentials auth, account ownership, and Drizzle data foundation. |
+| Implemented | TypeScript-first scaffold, governance, ADRs, command surface, portfolio evidence baseline, Auth.js credentials auth, account ownership, Drizzle data foundation, and pasted text source creation/listing. |
 | In progress | First product and eval boundaries are being prepared for vertical slices. |
-| Planned | Source ingestion, chunking, embeddings, grounded tutor, flashcards, review loops, evals, tracing, monitoring, and deployment readiness. |
+| Planned | Source chunking, embeddings, grounded tutor, flashcards, review loops, evals, tracing, monitoring, and deployment readiness. |
 | Deferred | Uploaded file ingestion, separate services, Python runtime, Kubernetes, Terraform, Redis, PyTorch, mobile apps, and enterprise controls. |
 
 ## Near-Term Product Slices
@@ -14,7 +14,7 @@
 | Priority | Status | Improvement | Evidence to Update |
 |---|---|---|---|
 | 1 | Implemented | Auth.js session and account ownership baseline. | Architecture, testing, failure cases, deployment. |
-| 2 | Planned | Pasted text source creation with account-scoped storage. | Business problem, testing, monitoring, cost model. |
+| 2 | Implemented | Pasted text source creation with account-scoped storage. | Architecture, testing, failure cases. |
 | 3 | Planned | Source chunking and PostgreSQL/pgvector embeddings. | Architecture diagrams, eval strategy, tradeoffs, cost model. |
 | 4 | Planned | Grounded tutor question flow with citations. | Evals, failure cases, monitoring, README status. |
 | 5 | Planned | Flashcard generation with card versions and citations. | Testing, eval strategy, cost model, product narrative. |
diff --git a/docs/testing/testing-strategy.md b/docs/testing/testing-strategy.md
index efbbb8c..23cf49b 100644
--- a/docs/testing/testing-strategy.md
+++ b/docs/testing/testing-strategy.md
@@ -4,9 +4,9 @@
 
 | Status | Scope |
 |---|---|
-| Implemented | Change-based test policy, command surface, repository guard scripts, focused credentials auth tests, account-scope helper tests, and migration shape checks. |
+| Implemented | Change-based test policy, command surface, repository guard scripts, focused credentials auth tests, account-scope helper tests, migration shape checks, and pasted source validation/account-scope service tests. |
 | In progress | Portfolio baseline and account-aware server tests are expanding as product behavior deepens. |
-| Planned | Source ingestion, RAG, API/server, UI, Playwright, privacy artifact, eval, and AI failure-path tests. |
+| Planned | RAG, route-handler contract, broader UI, Playwright, privacy artifact, eval, and AI failure-path tests. |
 | Deferred | Large-scale load testing, multi-tenant enterprise test matrices, and production chaos testing. |
 
 ## Principles
@@ -21,9 +21,9 @@
 
 | Layer | Status | Expected Coverage |
 |---|---|---|
-| Unit tests | In progress | Implemented credentials registration/login, duplicate email, invalid credentials, session scope parsing, and account isolation helpers. Planned coverage includes chunking, citation parsing, prompt metadata, cost calculations, and schema validation. |
+| Unit tests | In progress | Implemented credentials registration/login, duplicate email, invalid credentials, session scope parsing, account isolation helpers, and pasted source validation. Planned coverage includes chunking, citation parsing, prompt metadata, cost calculations, and broader schema validation. |
 | Integration tests | Planned | Drizzle repositories, pgvector retrieval, account-scoped joins, prompt assembly, and trace reference persistence against PostgreSQL. |
-| API/server tests | In progress | Auth service behavior is covered through focused server tests; route-handler contract tests remain planned. |
+| API/server tests | In progress | Auth service behavior and source service account filtering are covered through focused server tests; route-handler contract tests remain planned. |
 | UI tests | Planned | Source, deck, card, review, quiz, tutor, empty, loading, and error states. |
 | Playwright tests | Planned | Critical browser workflows with synthetic content and no private screenshots. |
 | Eval smoke tests | In progress | Internal TypeScript eval runner boundary and future deterministic smoke suites. |
@@ -46,6 +46,8 @@ Current focused coverage:
 - Duplicate emails are rejected after normalization.
 - Missing account scope throws a 401-style authorization error.
 - Cross-account records throw a 403-style authorization error.
+- Pasted source validation rejects empty, over-limit, and malformed text before storage.
+- Source list/read service behavior returns no data for another account.
 - The initial Drizzle migration includes Auth.js, account, source, chunk, trace-reference, and pgvector foundations.
 
 ## Privacy Tests
diff --git a/packages/schemas/src/index.ts b/packages/schemas/src/index.ts
index 5992c63..0b60215 100644
--- a/packages/schemas/src/index.ts
+++ b/packages/schemas/src/index.ts
@@ -7,3 +7,60 @@ export const healthResponseSchema = {
     service: { const: "web-runtime" },
   },
 } as const;
+
+export const pastedSourceTextLimits = {
+  maxCharacters: 20_000,
+} as const;
+
+export const createPastedSourceRequestSchema = {
+  type: "object",
+  additionalProperties: false,
+  required: ["text"],
+  properties: {
+    title: {
+      type: "string",
+      maxLength: 120,
+    },
+    text: {
+      type: "string",
+      minLength: 1,
+      maxLength: pastedSourceTextLimits.maxCharacters,
+    },
+  },
+} as const;
+
+export const sourceSummarySchema = {
+  type: "object",
+  additionalProperties: false,
+  required: [
+    "id",
+    "accountId",
+    "createdByUserId",
+    "title",
+    "sourceType",
+    "status",
+    "textCharacterCount",
+    "createdAt",
+    "updatedAt",
+  ],
+  properties: {
+    id: { type: "string", minLength: 1 },
+    accountId: { type: "string", minLength: 1 },
+    createdByUserId: { anyOf: [{ type: "string", minLength: 1 }, { type: "null" }] },
+    title: { type: "string", minLength: 1 },
+    sourceType: { const: "pasted_text" },
+    status: { const: "stored" },
+    textCharacterCount: { type: "integer", minimum: 0 },
+    createdAt: { type: "string", minLength: 1 },
+    updatedAt: { type: "string", minLength: 1 },
+  },
+} as const;
+
+export const sourceDetailSchema = {
+  ...sourceSummarySchema,
+  required: [...sourceSummarySchema.required, "text"],
+  properties: {
+    ...sourceSummarySchema.properties,
+    text: { type: "string" },
+  },
+} as const;
diff --git a/packages/shared-types/src/index.ts b/packages/shared-types/src/index.ts
index ec602d4..9e4b500 100644
--- a/packages/shared-types/src/index.ts
+++ b/packages/shared-types/src/index.ts
@@ -14,3 +14,55 @@ export type HealthResponse = Readonly<{
   status: "ok";
   service: "web-runtime";
 }>;
+
+export const pastedSourceTextLimits = {
+  maxCharacters: 20_000,
+} as const;
+
+export type SourceType = "pasted_text";
+
+export type SourceStatus = "stored";
+
+export type SourceSummary = Readonly<{
+  id: SourceId;
+  accountId: AccountId;
+  createdByUserId: UserId | null;
+  title: string;
+  sourceType: SourceType;
+  status: SourceStatus;
+  textCharacterCount: number;
+  createdAt: string;
+  updatedAt: string;
+}>;
+
+export type SourceDetail = SourceSummary &
+  Readonly<{
+    text: string;
+  }>;
+
+export type CreatePastedSourceRequest = Readonly<{
+  title?: string;
+  text: string;
+}>;
+
+export type CreatePastedSourceResponse = Readonly<{
+  source: SourceSummary;
+}>;
+
+export type ListSourcesResponse = Readonly<{
+  sources: readonly SourceSummary[];
+}>;
+
+export type ReadSourceResponse = Readonly<{
+  source: SourceDetail;
+}>;
+
+export type SourceErrorCode =
+  | "duplicate_source"
+  | "empty_text"
+  | "forbidden"
+  | "invalid_request"
+  | "malformed_text"
+  | "not_found"
+  | "text_too_long"
+  | "unauthorized";