feat: enhance testing capabilities and introduce new components for question management. Add testing section in AGENTS.md with instructions for running tests and configuring the test environment. Update package.json files to include test scripts and integrate @electric-sql/pglite for in-memory database testing. Introduce CalloutCard and update FilterBar and SoalBrowser components to support visibility filters for private and public questions. Implement new test cases for various functionalities across the application.

AGENTS.md

@@ -75,6 +75,10 @@ bun run db:generate      # Generate migration files
 bun run db:start         # Start local DB (if configured)
 bun run db:stop          # Stop local DB
 
+# Testing
+bun test                 # Run all tests
+bun run turbo test       # Run via turbo pipeline
+
 # Build
 bun run build            # Build all packages
 ```
@@ -192,4 +196,38 @@ bun run build            # Build all packages
 
 ---
 
-_Last updated: 2026-05-06_
+## 12. Testing
+
+### Test Runner
+- **Bun test** (`bun test`) — built-in, Jest/Vitest compatible API (`describe`, `it`, `expect`).
+- Turbo task `test` sudah dikonfigurasi.
+
+### Test Location
+- Unit tests: `src/__tests__/*.test.ts` di masing-masing package.
+- Integration tests: `packages/api/src/__tests__/*.integration.test.ts` (pakai PGlite in-memory DB).
+
+### Integration DB (PGlite)
+- **PGlite** (`@electric-sql/pglite`) — PostgreSQL WASM in-memory.
+- Strategy: `mock.module("@labas/db")` intercept DB saat dynamic import untuk inject PGlite-based drizzle instance.
+- Setup helper: `packages/api/src/__tests__/test-setup.ts` — skema 14 tabel via raw SQL + seed data.
+- Schema diimport dari `../../../db/src/schema` (langsung, bukan via `@labas/db`) untuk hindari env validation side-effect.
+- Env vars di-mock via `mock.module("@labas/env/server")` sebelum dynamic import.
+
+### tRPC Router Testing
+- Gunakan `router.createCaller({ session, auth })` untuk memanggil procedure.
+- Protected procedure: `session: { user: { id }, expiresAt: new Date() }`.
+- Public procedure: `session: null`.
+
+### Known Limitations
+- **Rate limiter** (`checkRateLimit` di `attempt.ts`) pakai in-memory `Map`. Gunakan user ID berbeda per test atau `Bun.sleep()` untuk menghindari rate limit blocker.
+- **Timer validation** (`finish`) butuh ≥5 detik elapsed sejak `start` — pakai `Bun.sleep()` + `{ timeout: 30000 }` pada `it()`.
+- **Env vars Wajib** untuk di-mock saat integration test: `DATABASE_URL`, `BETTER_AUTH_SECRET` (≥32 chars), `BETTER_AUTH_URL`, `CORS_ORIGIN`, `API_KEY_ENCRYPTION_KEY` (≥32 chars), `REDIS_URL`, `SMTP_HOST`, `SMTP_USER`, `SMTP_PASS`, `SMTP_FROM`.
+
+### TDD Convention
+- TDD: tulis test dulu, lihat fail, baru implementasi.
+- Untuk existing code yang belum ada test: tulis test yang verifikasi behavior saat ini.
+- Fungsi internal yang perlu di-test secara unit harus di-`export`.
+
+---
+
+_Last updated: 2026-05-14_

apps/web/package.json

@@ -9,6 +9,7 @@
     "build": "vite build",
     "serve": "vite preview",
     "start": "vite",
+    "test": "bun test",
     "check-types": "vite build && tsc --noEmit",
     "generate-pwa-assets": "pwa-assets-generator"
   },

apps/web/src/components/bank/CalloutCard.tsx

@@ -0,0 +1,48 @@
+import { Button } from "@labas/ui/components/button";
+import { MaterialIcon } from "@/components/ui/MaterialIcon";
+
+interface CalloutCardProps {
+  privateCount: number;
+  onPublishAll: () => void;
+  onDismiss: () => void;
+}
+
+export function CalloutCard({ privateCount, onPublishAll, onDismiss }: CalloutCardProps) {
+  if (privateCount <= 0) return null;
+
+  return (
+    <div className="md:col-span-2 mb-4">
+      <div className="flex items-start gap-3 p-4 rounded-[var(--radius-xl)] bg-[var(--slushie-500)]/10 border-l-4 border-[var(--slushie-500)] border-2 border-[var(--slushie-500)]/20">
+        <div className="shrink-0 mt-0.5">
+          <div className="w-8 h-8 rounded-full bg-[var(--slushie-500)]/20 flex items-center justify-center">
+            <MaterialIcon name="info" className="text-sm text-[var(--slushie-800)]" />
+          </div>
+        </div>
+        <div className="flex-1 min-w-0">
+          <p className="text-sm font-semibold text-[var(--clay-black)]">
+            Kamu punya <span className="text-[var(--slushie-800)]">{privateCount} soal privat</span>
+          </p>
+          <p className="text-xs text-[var(--warm-charcoal)] mt-1 leading-relaxed">
+            Soal privat hanya bisa kamu lihat. Jadikan publik agar soal bisa muncul di daftar paket soal dan diakses pengguna lain.
+          </p>
+          <div className="flex items-center gap-2 mt-3">
+            <Button
+              size="sm"
+              onClick={onPublishAll}
+              className="rounded-[var(--radius-lg)] bg-[var(--clay-black)] text-[var(--pure-white)] hover:bg-[var(--warm-charcoal)] text-xs cursor-pointer"
+            >
+              <MaterialIcon name="public" className="text-xs mr-1" />
+              Jadikan Semua Publik
+            </Button>
+            <button
+              onClick={onDismiss}
+              className="text-xs text-[var(--warm-charcoal)] hover:text-[var(--clay-black)] transition-colors cursor-pointer font-medium"
+            >
+              Tutup
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}

apps/web/src/components/bank/FilterBar.tsx

@@ -16,6 +16,7 @@ interface FilterBarProps {
   tab: "mine" | "public";
   searchText: string;
   examType: string;
+  visibility?: "all" | "private" | "public";
   activeChips: FilterChip[];
   hasFilters: boolean;
   isAdvancedOpen: boolean;
@@ -26,6 +27,7 @@ interface FilterBarProps {
   onSetTab: (tab: "mine" | "public") => void;
   onSetSearch: (value: string) => void;
   onSetExamType: (value: string) => void;
+  onSetVisibility?: (value: "all" | "private" | "public") => void;
   onClearFilters: () => void;
   onOpenMobileSheet: () => void;
   advancedFilters: React.ReactNode;
@@ -36,6 +38,7 @@ export function FilterBar({
   tab,
   searchText,
   examType,
+  visibility = "all",
   activeChips,
   hasFilters,
   isAdvancedOpen,
@@ -46,6 +49,7 @@ export function FilterBar({
   onSetTab,
   onSetSearch,
   onSetExamType,
+  onSetVisibility,
   onClearFilters,
   onOpenMobileSheet,
   advancedFilters,
@@ -104,6 +108,33 @@ export function FilterBar({
           })}
         </div>
 
+        {/* ── Visibility sub-filter (only in "mine" tab) ── */}
+        {mode === "soal" && tab === "mine" && onSetVisibility && (
+          <div className="flex gap-2 overflow-x-auto pb-1 scrollbar-hide">
+            <VisChipButton
+              active={visibility === "all"}
+              onClick={() => onSetVisibility("all")}
+            >
+              <MaterialIcon name="visibility" className="text-xs" />
+              Semua
+            </VisChipButton>
+            <VisChipButton
+              active={visibility === "private"}
+              onClick={() => onSetVisibility("private")}
+            >
+              <MaterialIcon name="lock" className="text-xs" />
+              Privat
+            </VisChipButton>
+            <VisChipButton
+              active={visibility === "public"}
+              onClick={() => onSetVisibility("public")}
+            >
+              <MaterialIcon name="public" className="text-xs" />
+              Publik
+            </VisChipButton>
+          </div>
+        )}
+
         {/* ── Tier 3: Search + Advanced filter toggle ── */}
         <div className="flex flex-col md:flex-row gap-3">
           <div className="relative flex-1">
@@ -241,6 +272,21 @@ function TabButton({ active, onClick, children }: { active: boolean; onClick: ()
   );
 }
 
+function VisChipButton({ active, onClick, children }: { active: boolean; onClick: () => void; children: React.ReactNode }) {
+  return (
+    <button
+      onClick={onClick}
+      className={`px-3 py-1.5 rounded-full text-xs font-semibold whitespace-nowrap transition-all flex items-center gap-1 cursor-pointer ${
+        active
+          ? "bg-[var(--clay-black)] text-[var(--pure-white)] clay-shadow"
+          : "bg-[var(--pure-white)] text-[var(--warm-charcoal)] border-2 border-[var(--oat-border)] hover:bg-[var(--oat-light)]"
+      }`}
+    >
+      {children}
+    </button>
+  );
+}
+
 function ChipButton({ active, onClick, children, disabled }: { active: boolean; onClick: () => void; children: React.ReactNode; disabled?: boolean }) {
   return (
     <button

apps/web/src/components/bank/QuestionCard.tsx

@@ -29,6 +29,8 @@ export function QuestionCard({
   onTogglePublic,
   onDelete,
 }: QuestionCardProps) {
+  const isPrivate = isOwner && !q.isPublic;
+
   return (
     <div
       onClick={() => { if (!disabled) onOpenDetail(); }}
@@ -39,7 +41,9 @@ export function QuestionCard({
             ? "bg-[var(--matcha-100)] border-[var(--matcha-600)] clay-hover cursor-pointer ring-2 ring-[var(--matcha-400)]"
             : isInBundle
               ? "bg-[var(--matcha-100)] border-[var(--clay-black)] clay-shadow clay-hover cursor-pointer"
-              : "bg-[var(--pure-white)] border-[var(--oat-border)] clay-shadow clay-hover cursor-pointer"
+              : isPrivate
+                ? "bg-[var(--pure-white)] border-[var(--oat-border)] border-l-[var(--warm-charcoal)] border-l-4 clay-shadow clay-hover cursor-pointer"
+                : "bg-[var(--pure-white)] border-[var(--oat-border)] clay-shadow clay-hover cursor-pointer"
       }`}
     >
       <div className="p-5 flex flex-col h-full">
@@ -112,12 +116,14 @@ export function QuestionCard({
             <div className="flex items-center gap-2" onClick={(e) => e.stopPropagation()}>
               <button
                 onClick={onTogglePublic}
-                className={`text-xs font-semibold px-3 py-1.5 rounded-full transition-colors cursor-pointer ${
+                title={q.isPublic ? "Klik untuk jadikan privat" : "Klik untuk jadikan publik"}
+                className={`text-xs font-semibold px-3 py-1.5 rounded-full transition-colors cursor-pointer flex items-center gap-1 ${
                   q.isPublic
                     ? "bg-[var(--matcha-300)] text-[var(--matcha-800)]"
-                    : "bg-[var(--oat-light)] text-[var(--warm-charcoal)]"
+                    : "bg-[var(--slushie-500)]/15 text-[var(--slushie-800)]"
                 }`}
               >
+                {!q.isPublic && <MaterialIcon name="lock" className="text-xs" />}
                 {q.isPublic ? "Publik" : "Privat"}
               </button>
               <button

apps/web/src/components/bank/SoalBrowser.tsx

@@ -3,6 +3,7 @@ import { Card } from "@labas/ui/components/card";
 import { Button } from "@labas/ui/components/button";
 import { MaterialIcon } from "@/components/ui/MaterialIcon";
 import { QuestionCard } from "./QuestionCard";
+import { CalloutCard } from "./CalloutCard";
 
 interface SoalBrowserProps {
   isLoading: boolean;
@@ -22,6 +23,7 @@ interface SoalBrowserProps {
   onLoadMore: () => void;
   onClearFilters: () => void;
   onBulkPublish?: (ids: string[]) => void;
+  onPublishAllPrivate?: (ids: string[]) => void;
 }
 
 export function SoalBrowser({
@@ -42,6 +44,7 @@ export function SoalBrowser({
   onLoadMore,
   onClearFilters,
   onBulkPublish,
+  onPublishAllPrivate,
 }: SoalBrowserProps) {
   const sentinelRef = useRef<HTMLDivElement>(null);
   const isLocked = (q: any) => !!lockedExamType && q.examTypeId !== lockedExamType;
@@ -55,6 +58,27 @@ export function SoalBrowser({
     setSelectedIds(new Set());
   }, [filterKey]);
 
+  // ── Private callout dismiss ──
+  const calloutDismissed = typeof window !== "undefined"
+    ? localStorage.getItem("labas-bank-private-callout-dismissed") === "true"
+    : false;
+
+  const privateQuestions = questions.filter(
+    (q: any) => !q.isPublic && q.creatorUserId === userId,
+  );
+
+  const handleDismissCallout = () => {
+    localStorage.setItem("labas-bank-private-callout-dismissed", "true");
+    // Force re-render by toggling a state
+    setBulkMode((prev) => prev);
+  };
+
+  const handlePublishAllPrivate = () => {
+    if (onPublishAllPrivate && privateQuestions.length > 0) {
+      onPublishAllPrivate(privateQuestions.map((q: any) => q.id));
+    }
+  };
+
   useEffect(() => {
     const el = sentinelRef.current;
     if (!el || !hasMore || isFetchingNextPage) return;
@@ -183,6 +207,14 @@ export function SoalBrowser({
         {renderBulkToolbar()}
         <div className="md:col-span-2" />
 
+        {tab === "mine" && privateQuestions.length > 0 && !calloutDismissed && (
+          <CalloutCard
+            privateCount={privateQuestions.length}
+            onPublishAll={handlePublishAllPrivate}
+            onDismiss={handleDismissCallout}
+          />
+        )}
+
         {questions[0] && (
           <div className="md:col-span-2">
             <QuestionCard

apps/web/src/lib/__tests__/avatar-url.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from "bun:test";
+import {
+  buildDiceBearLoreleiUrl,
+  BACKGROUND_COLORS,
+  SKIN_COLORS,
+  HAIR_COLORS,
+} from "../avatar-url";
+
+describe("buildDiceBearLoreleiUrl", () => {
+  it("builds URL with required seed", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "test123" });
+    expect(url).toContain("seed=test123");
+    expect(url).toContain("backgroundType=solid");
+  });
+
+  it("includes optional backgroundColor", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", backgroundColor: "84e7a5" });
+    expect(url).toContain("backgroundColor=84e7a5");
+  });
+
+  it("includes optional hairColor", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", hairColor: "000000" });
+    expect(url).toContain("hairColor=000000");
+  });
+
+  it("includes optional skinColor", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", skinColor: "ffe4c4" });
+    expect(url).toContain("skinColor=ffe4c4");
+  });
+
+  it("sets glassesProbability when glasses is true", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", glasses: true });
+    expect(url).toContain("glassesProbability=100");
+  });
+
+  it("sets frecklesProbability when freckles is true", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", freckles: true });
+    expect(url).toContain("frecklesProbability=100");
+  });
+
+  it("sets beardProbability when beard is true", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", beard: true });
+    expect(url).toContain("beardProbability=100");
+  });
+
+  it("sets earringsProbability when earrings is true", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "abc", earrings: true });
+    expect(url).toContain("earringsProbability=100");
+  });
+
+  it("uses DiceBear API base URL", () => {
+    const url = buildDiceBearLoreleiUrl({ seed: "x" });
+    expect(url).toStartWith("https://api.dicebear.com/9.x/lorelei/svg?");
+  });
+
+  it("combines multiple options", () => {
+    const url = buildDiceBearLoreleiUrl({
+      seed: "multi",
+      backgroundColor: "3bd3fd",
+      hairColor: "8b5e3c",
+      skinColor: "c6866b",
+      glasses: true,
+    });
+    expect(url).toContain("seed=multi");
+    expect(url).toContain("backgroundColor=3bd3fd");
+    expect(url).toContain("hairColor=8b5e3c");
+    expect(url).toContain("skinColor=c6866b");
+    expect(url).toContain("glassesProbability=100");
+  });
+});
+
+describe("BACKGROUND_COLORS", () => {
+  it("has 8 color options", () => {
+    expect(BACKGROUND_COLORS).toHaveLength(8);
+  });
+
+  it("each option has label and value", () => {
+    for (const c of BACKGROUND_COLORS) {
+      expect(c).toHaveProperty("label");
+      expect(c).toHaveProperty("value");
+    }
+  });
+});
+
+describe("SKIN_COLORS", () => {
+  it("has 5 skin tone options", () => {
+    expect(SKIN_COLORS).toHaveLength(5);
+  });
+});
+
+describe("HAIR_COLORS", () => {
+  it("has 7 hair color options", () => {
+    expect(HAIR_COLORS).toHaveLength(7);
+  });
+});

apps/web/src/lib/__tests__/difficulty-mapping.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "bun:test";
+import { DIFFICULTY_LABELS, getDifficultyLabel } from "../difficulty-mapping";
+
+describe("DIFFICULTY_LABELS", () => {
+  it("has entries for all 8 exam types", () => {
+    const expected = ["IELTS", "TOEFL", "JLPT", "HSK", "GOETHE", "TOPIK", "TOAFL", "DELE"];
+    expect(Object.keys(DIFFICULTY_LABELS)).toEqual(expected);
+  });
+
+  it("each exam has exactly 5 difficulty levels", () => {
+    for (const [exam, labels] of Object.entries(DIFFICULTY_LABELS)) {
+      expect(labels).toHaveLength(5);
+    }
+  });
+});
+
+describe("getDifficultyLabel", () => {
+  it("returns correct label for IELTS level 1", () => {
+    expect(getDifficultyLabel("IELTS", 1)).toBe("Band 4.0");
+  });
+
+  it("returns correct label for IELTS level 5", () => {
+    expect(getDifficultyLabel("IELTS", 5)).toBe("Band 8.0+");
+  });
+
+  it("returns correct label for JLPT level 3", () => {
+    expect(getDifficultyLabel("JLPT", 3)).toBe("N3");
+  });
+
+  it("clamps level below 1", () => {
+    expect(getDifficultyLabel("IELTS", 0)).toBe("Band 4.0");
+  });
+
+  it("clamps level above 5", () => {
+    expect(getDifficultyLabel("IELTS", 99)).toBe("Band 8.0+");
+  });
+
+  it("returns fallback for unknown exam types", () => {
+    expect(getDifficultyLabel("UNKNOWN", 3)).toBe("Level 3");
+    expect(getDifficultyLabel("GRE", 1)).toBe("Level 1");
+  });
+});

apps/web/src/lib/__tests__/exam-constants.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it } from "bun:test";
+import { EXAM_TYPES, SECTIONS, FORMATS, DIFFICULTIES } from "../exam-constants";
+
+describe("EXAM_TYPES", () => {
+  it("has 8 exam types", () => {
+    expect(EXAM_TYPES).toHaveLength(8);
+  });
+
+  it("each entry has id and name", () => {
+    for (const exam of EXAM_TYPES) {
+      expect(exam).toHaveProperty("id");
+      expect(exam).toHaveProperty("name");
+      expect(typeof exam.id).toBe("string");
+      expect(typeof exam.name).toBe("string");
+    }
+  });
+
+  it("includes all expected exams", () => {
+    const ids = EXAM_TYPES.map((e) => e.id);
+    expect(ids).toContain("IELTS");
+    expect(ids).toContain("TOEFL");
+    expect(ids).toContain("JLPT");
+    expect(ids).toContain("HSK");
+    expect(ids).toContain("GOETHE");
+    expect(ids).toContain("TOPIK");
+    expect(ids).toContain("TOAFL");
+    expect(ids).toContain("DELE");
+  });
+
+  it("has no duplicate IDs", () => {
+    const ids = EXAM_TYPES.map((e) => e.id);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+});
+
+describe("SECTIONS", () => {
+  it("has 2 sections", () => {
+    expect(SECTIONS).toHaveLength(2);
+  });
+
+  it("includes READING and WRITING", () => {
+    const ids = SECTIONS.map((s) => s.id);
+    expect(ids).toContain("READING");
+    expect(ids).toContain("WRITING");
+  });
+});
+
+describe("FORMATS", () => {
+  it("has 20 question formats", () => {
+    expect(FORMATS).toHaveLength(20);
+  });
+
+  it("has no duplicates", () => {
+    expect(new Set(FORMATS).size).toBe(FORMATS.length);
+  });
+});
+
+describe("DIFFICULTIES", () => {
+  it("has 5 levels", () => {
+    expect(DIFFICULTIES).toHaveLength(5);
+  });
+
+  it("has values 1-5", () => {
+    DIFFICULTIES.forEach((d, i) => {
+      expect(d.value).toBe(i + 1);
+    });
+  });
+});

apps/web/src/lib/__tests__/format.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "bun:test";
+import { formatLabel } from "../format";
+
+describe("formatLabel", () => {
+  it("converts snake_case to Title Case", () => {
+    expect(formatLabel("multiple_choice")).toBe("Multiple Choice");
+    expect(formatLabel("true_false_not_given")).toBe("True False Not Given");
+  });
+
+  it("handles single word", () => {
+    expect(formatLabel("cloze")).toBe("Cloze");
+  });
+
+  it("handles empty string", () => {
+    expect(formatLabel("")).toBe("");
+  });
+
+  it("handles already spaced string", () => {
+    expect(formatLabel("multiple choice")).toBe("Multiple Choice");
+  });
+});

apps/web/src/lib/__tests__/generate-constants.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, it } from "bun:test";
+import {
+  EXAM_TYPES,
+  SECTIONS,
+  FORMATS,
+  TOPICS,
+  DIFFICULTIES,
+  QUESTION_COUNT_PRESETS,
+} from "../generate-constants";
+
+describe("EXAM_TYPES", () => {
+  it("has 8 exam types", () => {
+    expect(EXAM_TYPES).toHaveLength(8);
+  });
+
+  it("each entry has id, name, and code", () => {
+    for (const exam of EXAM_TYPES) {
+      expect(exam).toHaveProperty("id");
+      expect(exam).toHaveProperty("name");
+      expect(exam).toHaveProperty("code");
+    }
+  });
+
+  it("has no duplicate IDs", () => {
+    const ids = EXAM_TYPES.map((e) => e.id);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+});
+
+describe("SECTIONS", () => {
+  it("has 2 sections with id, name, and icon", () => {
+    expect(SECTIONS).toHaveLength(2);
+    for (const s of SECTIONS) {
+      expect(s).toHaveProperty("id");
+      expect(s).toHaveProperty("name");
+      expect(s).toHaveProperty("icon");
+    }
+  });
+});
+
+describe("FORMATS", () => {
+  it("has 20 question formats", () => {
+    expect(FORMATS).toHaveLength(20);
+  });
+
+  it("each format has id, name, and allowedExams", () => {
+    for (const f of FORMATS) {
+      expect(f).toHaveProperty("id");
+      expect(f).toHaveProperty("name");
+      expect(f).toHaveProperty("allowedExams");
+      expect(Array.isArray(f.allowedExams)).toBe(true);
+    }
+  });
+
+  it("no duplicate format IDs", () => {
+    const ids = FORMATS.map((f) => f.id);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+});
+
+describe("TOPICS", () => {
+  it("has at least one topic", () => {
+    expect(TOPICS.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("all topics are strings", () => {
+    for (const t of TOPICS) {
+      expect(typeof t).toBe("string");
+    }
+  });
+});
+
+describe("DIFFICULTIES", () => {
+  it("has 5 difficulty strings", () => {
+    expect(DIFFICULTIES).toHaveLength(5);
+  });
+});
+
+describe("QUESTION_COUNT_PRESETS", () => {
+  it("has 4 presets", () => {
+    expect(QUESTION_COUNT_PRESETS).toHaveLength(4);
+  });
+
+  it("each preset has value, label, and desc", () => {
+    for (const p of QUESTION_COUNT_PRESETS) {
+      expect(p).toHaveProperty("value");
+      expect(p).toHaveProperty("label");
+      expect(p).toHaveProperty("desc");
+    }
+  });
+});

apps/web/src/lib/__tests__/time.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "bun:test";
+import { formatTime } from "../time";
+
+describe("formatTime", () => {
+  it("formats zero seconds", () => {
+    expect(formatTime(0)).toBe("00:00");
+  });
+
+  it("formats seconds only (< 60)", () => {
+    expect(formatTime(5)).toBe("00:05");
+    expect(formatTime(45)).toBe("00:45");
+    expect(formatTime(59)).toBe("00:59");
+  });
+
+  it("formats exactly one minute", () => {
+    expect(formatTime(60)).toBe("01:00");
+  });
+
+  it("formats minutes and seconds", () => {
+    expect(formatTime(90)).toBe("01:30");
+    expect(formatTime(125)).toBe("02:05");
+    expect(formatTime(3661)).toBe("61:01");
+  });
+
+  it("pads single-digit minutes and seconds", () => {
+    expect(formatTime(7)).toBe("00:07");
+    expect(formatTime(67)).toBe("01:07");
+  });
+
+  it("handles large values", () => {
+    expect(formatTime(3600)).toBe("60:00");
+    expect(formatTime(10000)).toBe("166:40");
+  });
+});

apps/web/src/routes/bank.tsx

@@ -33,6 +33,7 @@ export const Route = createFileRoute("/bank")({
     section: z.string().optional(),
     format: z.string().optional(),
     difficulty: z.coerce.number().optional(),
+    visibility: z.enum(["all", "private", "public"]).optional(),
   }).parse,
   beforeLoad: async () => {
     const session = await authClient.getSession();
@@ -59,12 +60,13 @@ function BankComponent() {
   const section = search.section ?? "";
   const format = search.format ?? "";
   const difficulty = search.difficulty;
+  const visibilityFilter = search.visibility ?? "all";
 
   // ── Infinite scroll state ──
   const [allQuestions, setAllQuestions] = useState<any[]>([]);
   const [offset, setOffset] = useState(0);
   const limit = 12;
-  const filterKey = JSON.stringify({ searchText, examType, section, format, difficulty, tab, mode });
+  const filterKey = JSON.stringify({ searchText, examType, section, format, difficulty, tab, mode, visibility: visibilityFilter });
 
   // ── Sidebar / Bundle State ──
   const [bundleQuestions, setBundleQuestions] = useState<any[]>([]);
@@ -82,6 +84,10 @@ function BankComponent() {
   const [isMobileSheetOpen, setIsMobileSheetOpen] = useState(false);
 
   // ── Data Queries ──
+  const visibilityFilterParam = tab === "mine" && visibilityFilter !== "all"
+    ? { isPublic: visibilityFilter === "public" }
+    : {};
+
   const questionQuery = useQuery(
     trpc.question.list.queryOptions(
       {
@@ -91,7 +97,7 @@ function BankComponent() {
         format: format || undefined,
         difficulty,
         ...(tab === "mine" && userId
-          ? { creatorUserId: userId }
+          ? { creatorUserId: userId, ...visibilityFilterParam }
           : { isPublic: true }),
         limit,
         offset,
@@ -155,11 +161,20 @@ function BankComponent() {
 
   const bulkPublish = useMutation({
     ...trpc.question.bulkPublish.mutationOptions(),
-    onSuccess: () => {
+    onSuccess: (data) => {
       questionQuery.refetch();
-      toast.success("Soal berhasil dipublikasikan");
+      if (data.skipped > 0) {
+        toast.success(
+          `${data.updated} soal dipublikasikan, ${data.skipped} dilewati`,
+          { description: "Beberapa soal bukan milikmu atau sudah tidak tersedia." },
+        );
+      } else {
+        toast.success(`${data.updated} soal berhasil dipublikasikan`);
+      }
+    },
+    onError: (err: any) => {
+      toast.error("Gagal mempublikasikan. Coba refresh dan pilih ulang soal.", { description: err.message });
     },
-    onError: (err: any) => toast.error("Gagal mempublikasikan", { description: err.message }),
   });
 
   // ── Navigation helpers ──
@@ -194,6 +209,9 @@ function BankComponent() {
   const setDifficulty = (value: number | undefined) =>
     navigate({ search: (prev) => ({ ...prev, difficulty: value }) });
 
+  const setVisibility = (value: "all" | "private" | "public") =>
+    navigate({ search: (prev) => ({ ...prev, visibility: value === "all" ? undefined : value }) });
+
   const setTab = (newTab: QuestionTab) =>
     navigate({
       search: {
@@ -204,6 +222,7 @@ function BankComponent() {
         section: "",
         format: "",
         difficulty: undefined,
+        visibility: undefined,
       },
     });
 
@@ -216,6 +235,7 @@ function BankComponent() {
         section: "",
         format: "",
         difficulty: undefined,
+        visibility: undefined,
       }),
     });
 
@@ -389,6 +409,7 @@ function BankComponent() {
         tab={tab}
         searchText={searchText}
         examType={examType}
+        visibility={visibilityFilter}
         activeChips={activeChips}
         hasFilters={hasFilters}
         isAdvancedOpen={isAdvancedOpen}
@@ -399,6 +420,7 @@ function BankComponent() {
         onSetTab={setTab}
         onSetSearch={setSearch}
         onSetExamType={setExamType}
+        onSetVisibility={setVisibility}
         onClearFilters={clearFilters}
         onOpenMobileSheet={() => setIsMobileSheetOpen(true)}
         advancedFilters={
@@ -456,6 +478,7 @@ function BankComponent() {
                 }}
                 onClearFilters={clearFilters}
                 onBulkPublish={(ids) => bulkPublish.mutate({ ids })}
+                onPublishAllPrivate={(ids) => bulkPublish.mutate({ ids })}
               />
             ) : (
               <SectionBrowser

apps/web/src/routes/history.tsx

@@ -1,3 +1,4 @@
+import { useCallback, useRef, useState, useEffect } from "react";
 import { useQuery } from "@tanstack/react-query";
 import { createFileRoute, redirect, Link } from "@tanstack/react-router";
 import { z } from "zod";
@@ -5,12 +6,24 @@ import { authClient } from "@/lib/auth-client";
 import { trpc } from "@/utils/trpc";
 import { Button } from "@labas/ui/components/button";
 import { Card, CardContent } from "@labas/ui/components/card";
+import { Input } from "@labas/ui/components/input";
+import {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@labas/ui/components/select";
 import { MaterialIcon } from "@/components/ui/MaterialIcon";
+import { EXAM_TYPES } from "@/lib/exam-constants";
 
 export const Route = createFileRoute("/history")({
   component: HistoryComponent,
   validateSearch: z.object({
     page: z.coerce.number().optional(),
+    examTypeId: z.string().optional(),
+    search: z.string().optional(),
   }).parse,
   beforeLoad: async () => {
     const session = await authClient.getSession();
@@ -63,10 +76,38 @@ export function HistoryComponent() {
   const search = Route.useSearch();
   const navigate = Route.useNavigate();
   const page = search.page ?? 1;
+  const examTypeId = search.examTypeId ?? "";
+  const searchQuery = search.search ?? "";
   const limit = 12;
 
+  const [localSearch, setLocalSearch] = useState(searchQuery);
+  const debounceRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  useEffect(() => {
+    setLocalSearch(searchQuery);
+  }, [searchQuery]);
+
+  useEffect(() => {
+    if (debounceRef.current) clearTimeout(debounceRef.current);
+    debounceRef.current = setTimeout(() => {
+      if (localSearch !== searchQuery) {
+        navigate({ search: (prev) => ({ ...prev, search: localSearch || undefined, page: 1 }) });
+      }
+    }, 300);
+    return () => { if (debounceRef.current) clearTimeout(debounceRef.current); };
+  }, [localSearch]);
+
+  const setExamTypeFilter = useCallback((value: string) => {
+    navigate({ search: (prev) => ({ ...prev, examTypeId: value || undefined, page: 1 }) });
+  }, [navigate]);
+
   const query = useQuery(
-    trpc.attempt.myAttempts.queryOptions({ limit, offset: (page - 1) * limit }),
+    trpc.attempt.myAttempts.queryOptions({
+      limit,
+      offset: (page - 1) * limit,
+      examTypeId: examTypeId || undefined,
+      search: searchQuery || undefined,
+    }),
   );
 
   const attempts = query.data?.attempts ?? [];
@@ -95,6 +136,32 @@ export function HistoryComponent() {
             </p>
           </div>
         </div>
+
+        {/* Filters */}
+        <div className="flex flex-col md:flex-row gap-3 mt-6">
+          <div className="relative flex-1 max-w-md">
+            <MaterialIcon name="search" className="absolute left-3 top-1/2 -translate-y-1/2 text-[var(--warm-charcoal)]" />
+            <Input
+              placeholder="Cari paket..."
+              value={localSearch}
+              onChange={(e) => setLocalSearch(e.target.value)}
+              className="pl-10 rounded-[var(--radius-lg)] border-2 border-[var(--oat-border)] bg-[var(--pure-white)] h-11"
+            />
+          </div>
+          <Select value={examTypeId} onValueChange={(v) => setExamTypeFilter(v ?? "")}>
+            <SelectTrigger className="w-36">
+              <SelectValue placeholder="Semua Ujian" />
+            </SelectTrigger>
+            <SelectContent>
+              <SelectGroup>
+                <SelectItem value="">Semua Ujian</SelectItem>
+                {EXAM_TYPES.map((t) => (
+                  <SelectItem key={t.id} value={t.id}>{t.name}</SelectItem>
+                ))}
+              </SelectGroup>
+            </SelectContent>
+          </Select>
+        </div>
       </div>
 
       {/* Results */}

bun.lock

@@ -116,6 +116,7 @@
         "zod": "catalog:",
       },
       "devDependencies": {
+        "@electric-sql/pglite": "^0.4.5",
         "@labas/config": "workspace:*",
         "@types/bcryptjs": "^3.0.0",
         "@types/nodemailer": "^8.0.0",
@@ -435,6 +436,8 @@
 
     "@ecies/ciphers": ["@ecies/ciphers@0.2.6", "", { "peerDependencies": { "@noble/ciphers": "^1.0.0" } }, "sha512-patgsRPKGkhhoBjETV4XxD0En4ui5fbX0hzayqI3M8tvNMGUoUvmyYAIWwlxBc1KX5cturfqByYdj5bYGRpN9g=="],
 
+    "@electric-sql/pglite": ["@electric-sql/pglite@0.4.5", "", {}, "sha512-aGG2zGEyZzGWKy8P+9ZoNUV0jxt1+hgbeTf+bVAYyxVZZLXg3/9aFlfLxb08AYZVAfAkQlQIysmWjhc5hwDG8g=="],
+
     "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="],
 
     "@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="],

package.json

@@ -23,6 +23,7 @@
   "scripts": {
     "dev": "turbo dev",
     "build": "turbo build",
+    "test": "turbo test",
     "check-types": "turbo check-types",
     "dev:web": "turbo -F web dev",
     "dev:server": "turbo -F server dev",

packages/ai/package.json

@@ -14,6 +14,9 @@
     "zod": "catalog:",
     "zod-to-json-schema": "^3.25.2"
   },
+  "scripts": {
+    "test": "bun test"
+  },
   "devDependencies": {
     "@labas/config": "workspace:*",
     "typescript": "catalog:"

packages/ai/src/__tests__/client.test.ts

@@ -0,0 +1,212 @@
+import { describe, expect, it, beforeAll, afterAll } from "bun:test";
+import { OpenAICompatibleClient } from "../client";
+
+const BASE_URL = "https://api.openai.com/v1";
+const API_KEY = "sk-test-key-12345";
+const MODEL = "gpt-4";
+
+function makeMockStream(chunks: string[]): ReadableStream {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    async start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(encoder.encode(chunk));
+      }
+      controller.close();
+    },
+  });
+}
+
+function makeFetchMock(streamChunks: string[], status = 200) {
+  return async () =>
+    new Response(makeMockStream(streamChunks), {
+      status,
+      headers: { "content-type": "text/event-stream" },
+    });
+}
+
+describe("OpenAICompatibleClient", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeAll(() => {
+    originalFetch = globalThis.fetch;
+  });
+
+  afterAll(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it("sends correct request and parses SSE response", async () => {
+    globalThis.fetch = makeFetchMock([
+      `data: ${JSON.stringify({ choices: [{ delta: { content: "Hello" } }] })}\n`,
+      `data: ${JSON.stringify({ choices: [{ delta: { content: " World" } }] })}\n`,
+      `data: ${JSON.stringify({ choices: [{ delta: {} }], usage: { total_tokens: 10 } })}\n`,
+      "data: [DONE]\n",
+    ]);
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    const result = await client.chatCompletion({
+      model: MODEL,
+      messages: [{ role: "user", content: "Test" }],
+    });
+
+    expect(result.content).toBe("Hello World");
+  });
+
+  it("calls onToken callback for each token", async () => {
+    globalThis.fetch = makeFetchMock([
+      `data: ${JSON.stringify({ choices: [{ delta: { content: "A" } }] })}\n`,
+      `data: ${JSON.stringify({ choices: [{ delta: { content: "B" } }] })}\n`,
+      "data: [DONE]\n",
+    ]);
+
+    const tokens: string[] = [];
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    await client.chatCompletion(
+      { model: MODEL, messages: [{ role: "user", content: "Test" }] },
+      { onToken: (t) => tokens.push(t) },
+    );
+
+    expect(tokens).toEqual(["A", "B"]);
+  });
+
+  it("returns usage from the last chunk", async () => {
+    globalThis.fetch = makeFetchMock([
+      `data: ${JSON.stringify({ choices: [{ delta: { content: "Hi" } }] })}\n`,
+      `data: ${JSON.stringify({ choices: [{ delta: {} }], usage: { total_tokens: 5 } })}\n`,
+      "data: [DONE]\n",
+    ]);
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    const result = await client.chatCompletion({
+      model: MODEL,
+      messages: [{ role: "user", content: "Test" }],
+    });
+
+    expect(result.usage?.total_tokens).toBe(5);
+  });
+
+  it("throws on non-OK response", async () => {
+    globalThis.fetch = async () =>
+      new Response("Bad Request", { status: 400, headers: { "content-type": "text/plain" } });
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    expect(
+      client.chatCompletion({
+        model: MODEL,
+        messages: [{ role: "user", content: "Test" }],
+      }),
+    ).rejects.toThrow("400");
+  });
+
+  it("throws on empty response body", async () => {
+    globalThis.fetch = async () =>
+      new Response(null, { status: 200 });
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    expect(
+      client.chatCompletion({
+        model: MODEL,
+        messages: [{ role: "user", content: "Test" }],
+      }),
+    ).rejects.toThrow("Empty response body");
+  });
+
+  it("throws on invalid base URL", async () => {
+    const client = new OpenAICompatibleClient("not-a-url", API_KEY);
+    expect(
+      client.chatCompletion({
+        model: MODEL,
+        messages: [{ role: "user", content: "Test" }],
+      }),
+    ).rejects.toThrow("Invalid base URL");
+  });
+
+  it("throws on metadata host (169.254.169.254)", async () => {
+    const client = new OpenAICompatibleClient("https://169.254.169.254/v1", API_KEY);
+    expect(
+      client.chatCompletion({
+        model: MODEL,
+        messages: [{ role: "user", content: "Test" }],
+      }),
+    ).rejects.toThrow("metadata/private network");
+  });
+
+  it("retries without response_format on 400 with response_format error", async () => {
+    let callCount = 0;
+    globalThis.fetch = async (_url: string, opts: any) => {
+      callCount++;
+      if (callCount === 1) {
+        const body = JSON.parse(opts.body);
+        expect(body.response_format).toBeDefined();
+        return new Response("response_format is not supported", {
+          status: 400,
+          headers: { "content-type": "text/plain" },
+        });
+      }
+      const body = JSON.parse(opts.body);
+      expect(body.response_format).toBeUndefined();
+      return new Response(makeMockStream([
+        `data: ${JSON.stringify({ choices: [{ delta: { content: "retried" } }] })}\n`,
+        "data: [DONE]\n",
+      ]), {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      });
+    };
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    const result = await client.chatCompletion({
+      model: MODEL,
+      messages: [{ role: "user", content: "Test" }],
+      response_format: { type: "json_object" },
+    });
+
+    expect(callCount).toBe(2);
+    expect(result.content).toBe("retried");
+  });
+
+  it("retries with more tokens on truncated response", async () => {
+    let callCount = 0;
+    globalThis.fetch = async (_url: string, opts: any) => {
+      callCount++;
+      const responseContent = callCount === 1
+        ? `data: ${JSON.stringify({ choices: [{ delta: { content: '{"incomplete":' } }] })}\n` + "data: [DONE]\n"
+        : `data: ${JSON.stringify({ choices: [{ delta: { content: '{"complete": true}' } }] })}\n` + "data: [DONE]\n";
+
+      return new Response(makeMockStream([responseContent]), {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      });
+    };
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    const result = await client.chatCompletion({
+      model: MODEL,
+      messages: [{ role: "user", content: "Test" }],
+      max_tokens: 100,
+    });
+
+    expect(callCount).toBe(2);
+    expect(result.content).toBe('{"complete": true}');
+  });
+
+  it("throws on HTML response in stream", async () => {
+    globalThis.fetch = async () =>
+      new Response(makeMockStream([
+        `data: ${JSON.stringify({ choices: [{ delta: { content: "<html>Not JSON</html>" } }] })}\n`,
+        "data: [DONE]\n",
+      ]), {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      });
+
+    const client = new OpenAICompatibleClient(BASE_URL, API_KEY);
+    expect(
+      client.chatCompletion({
+        model: MODEL,
+        messages: [{ role: "user", content: "Test" }],
+      }),
+    ).rejects.toThrow("HTML");
+  });
+});

packages/ai/src/__tests__/errors.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "bun:test";
+import { GenerationError } from "../errors";
+
+describe("GenerationError", () => {
+  it("creates error with just a message", () => {
+    const err = new GenerationError("Something went wrong");
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe("GenerationError");
+    expect(err.message).toBe("Something went wrong");
+    expect(err.tokensUsed).toBeUndefined();
+    expect(err.partialResult).toBeUndefined();
+  });
+
+  it("creates error with tokensUsed", () => {
+    const err = new GenerationError("Failed", { tokensUsed: 150 });
+    expect(err.tokensUsed).toBe(150);
+  });
+
+  it("creates error with partialResult", () => {
+    const partial = { questions: [{ format: "multiple_choice" }] };
+    const err = new GenerationError("Partial", { partialResult: partial });
+    expect(err.partialResult).toEqual(partial);
+  });
+});

packages/ai/src/__tests__/prompts.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, it } from "bun:test";
+import { buildQuickModePrompt } from "../prompts";
+import type { GenerationInput } from "../schemas";
+
+const baseInput = {
+  examType: "IELTS" as const,
+  section: "READING" as const,
+  formats: ["multiple_choice", "true_false_not_given"],
+  difficulty: 3,
+  topics: ["education", "technology"],
+  questionCount: 10,
+  mode: "quick" as const,
+  apiKeyConfig: {
+    baseUrl: "https://api.openai.com/v1",
+    apiKey: "sk-test",
+    model: "gpt-4",
+    maxTokens: 16384,
+  },
+} satisfies GenerationInput;
+
+describe("buildQuickModePrompt", () => {
+  it("returns a string", () => {
+    const prompt = buildQuickModePrompt(baseInput);
+    expect(typeof prompt).toBe("string");
+    expect(prompt.length).toBeGreaterThan(0);
+  });
+
+  it("contains exam type, section, difficulty, topics, formats", () => {
+    const prompt = buildQuickModePrompt(baseInput);
+    expect(prompt).toContain("IELTS");
+    expect(prompt).toContain("READING");
+    expect(prompt).toContain("3/5");
+    expect(prompt).toContain("education, technology");
+    expect(prompt).toContain("multiple_choice, true_false_not_given");
+  });
+
+  it("includes question count", () => {
+    const prompt = buildQuickModePrompt(baseInput);
+    expect(prompt).toContain("Generate 10");
+  });
+
+  it("sets language to English for IELTS", () => {
+    const prompt = buildQuickModePrompt(baseInput);
+    expect(prompt).toContain("English");
+  });
+
+  it("sets language to Japanese for JLPT", () => {
+    const prompt = buildQuickModePrompt({
+      ...baseInput,
+      examType: "JLPT",
+    });
+    expect(prompt).toContain("Japanese");
+  });
+
+  it("sets language to Chinese for HSK", () => {
+    const prompt = buildQuickModePrompt({
+      ...baseInput,
+      examType: "HSK",
+    });
+    expect(prompt).toContain("Chinese");
+  });
+
+  it("sets language to German for GOETHE", () => {
+    const prompt = buildQuickModePrompt({
+      ...baseInput,
+      examType: "GOETHE",
+    });
+    expect(prompt).toContain("German");
+  });
+
+  it("sets language to Korean for TOPIK", () => {
+    const prompt = buildQuickModePrompt({
+      ...baseInput,
+      examType: "TOPIK",
+    });
+    expect(prompt).toContain("Korean");
+  });
+
+  it("sets language to Arabic for TOAFL", () => {
+    const prompt = buildQuickModePrompt({
+      ...baseInput,
+      examType: "TOAFL",
+    });
+    expect(prompt).toContain("Arabic");
+  });
+
+  it("sets language to Spanish for DELE", () => {
+    const prompt = buildQuickModePrompt({
+      ...baseInput,
+      examType: "DELE",
+    });
+    expect(prompt).toContain("Spanish");
+  });
+
+  it("includes instruction about explanation language (Bahasa Indonesia)", () => {
+    const prompt = buildQuickModePrompt(baseInput);
+    expect(prompt).toContain("Bahasa Indonesia");
+  });
+
+  it("includes JSON schema in output", () => {
+    const prompt = buildQuickModePrompt(baseInput);
+    expect(prompt).toContain("JSON");
+    expect(prompt).toContain("questions");
+  });
+
+  it("includes TOPIK-specific instructions for Korean", () => {
+    const prompt = buildQuickModePrompt({ ...baseInput, examType: "TOPIK" });
+    expect(prompt).toContain("particles");
+    expect(prompt).toContain("honorifics");
+  });
+
+  it("includes TOAFL-specific instructions for Arabic", () => {
+    const prompt = buildQuickModePrompt({ ...baseInput, examType: "TOAFL" });
+    expect(prompt).toContain("I'rab");
+    expect(prompt).toContain("RTL");
+  });
+
+  it("includes DELE-specific instructions for Spanish", () => {
+    const prompt = buildQuickModePrompt({ ...baseInput, examType: "DELE" });
+    expect(prompt).toContain("verb conjugation");
+  });
+});

packages/ai/src/__tests__/repair.test.ts

@@ -0,0 +1,218 @@
+import { describe, expect, it } from "bun:test";
+import {
+  repairQuestion,
+  repairAndParseQuestions,
+  tryParseQuestion,
+} from "../repair";
+
+const fullPassage = "A".repeat(200);
+
+const baseRaw = {
+  format: "multiple_choice",
+  passageText: fullPassage,
+  questionText: "What is the main idea of the passage?",
+  options: [
+    { key: "A", text: "First option" },
+    { key: "B", text: "Second option" },
+    { key: "C", text: "Third option" },
+    { key: "D", text: "Fourth option" },
+  ],
+  correctAnswer: "A",
+  explanation: "This is the correct answer because...",
+  difficulty: 3,
+  skillTags: ["comprehension"],
+};
+
+describe("repairQuestion", () => {
+  it("passes through a valid question unchanged", () => {
+    const { question, wasRepaired } = repairQuestion(baseRaw, fullPassage);
+    expect(question.format).toBe("multiple_choice");
+    expect(question.correctAnswer).toBe("A");
+    expect(wasRepaired).toBe(false);
+  });
+
+  it("replaces missing passageText with fullPassage", () => {
+    const raw = { ...baseRaw, passageText: "" };
+    const { question, wasRepaired, repairNotes } = repairQuestion(raw, fullPassage);
+    expect(question.passageText).toBe(fullPassage);
+    expect(wasRepaired).toBe(true);
+    expect(repairNotes).toContainEqual(expect.stringContaining("passageText"));
+  });
+
+  it("replaces too-short questionText with fallback", () => {
+    const raw = { ...baseRaw, questionText: "" };
+    const { question, wasRepaired } = repairQuestion(raw, fullPassage);
+    expect(question.questionText).toBeTruthy();
+    expect(wasRepaired).toBe(true);
+  });
+
+  it("adds fallback explanation when missing", () => {
+    const raw = { ...baseRaw, explanation: "" };
+    const { question, wasRepaired } = repairQuestion(raw, fullPassage);
+    expect(question.explanation).toBe("Penjelasan tidak tersedia.");
+    expect(wasRepaired).toBe(true);
+  });
+
+  it("adds fallback skillTags when missing", () => {
+    const raw = { ...baseRaw, skillTags: [] };
+    const { question, wasRepaired } = repairQuestion(raw, fullPassage);
+    expect(question.skillTags).toEqual(["comprehension"]);
+    expect(wasRepaired).toBe(true);
+  });
+
+  it("clamps invalid difficulty to 3", () => {
+    const raw = { ...baseRaw, difficulty: 99 };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.difficulty).toBe(3);
+  });
+
+  it("throws when raw is not an object", () => {
+    expect(() => repairQuestion(null, fullPassage)).toThrow("Question is not an object");
+    expect(() => repairQuestion("string", fullPassage)).toThrow("Question is not an object");
+    expect(() => repairQuestion(42, fullPassage)).toThrow("Question is not an object");
+  });
+});
+
+describe("coerceCorrectAnswer — true_false_not_given", () => {
+  it("coerces T to TRUE", () => {
+    const raw = { ...baseRaw, format: "true_false_not_given", correctAnswer: "T" };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("TRUE");
+  });
+
+  it("coerces F to FALSE", () => {
+    const raw = { ...baseRaw, format: "true_false_not_given", correctAnswer: "F" };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("FALSE");
+  });
+
+  it("coerces NG to NOT_GIVEN", () => {
+    const raw = { ...baseRaw, format: "true_false_not_given", correctAnswer: "NG" };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("NOT_GIVEN");
+  });
+
+  it("coerces lowercase true to TRUE", () => {
+    const raw = { ...baseRaw, format: "true_false_not_given", correctAnswer: "true" };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("TRUE");
+  });
+});
+
+describe("coerceCorrectAnswer — author_view", () => {
+  it("coerces Y to YES", () => {
+    const raw = { ...baseRaw, format: "author_view", correctAnswer: "Y" };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("YES");
+  });
+
+  it("coerces N to NO", () => {
+    const raw = { ...baseRaw, format: "author_view", correctAnswer: "N" };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("NO");
+  });
+});
+
+describe("coerceCorrectAnswer — multiple_choice with invalid key", () => {
+  it("falls back to first option key when answer key does not match", () => {
+    const raw = {
+      ...baseRaw,
+      format: "multiple_choice",
+      correctAnswer: "Z",
+      options: [
+        { key: "A", text: "First" },
+        { key: "B", text: "Second" },
+      ],
+    };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("A");
+  });
+
+  it("normalizes answer key case", () => {
+    const raw = {
+      ...baseRaw,
+      format: "multiple_choice",
+      correctAnswer: "a",
+      options: [
+        { key: "A", text: "First" },
+        { key: "B", text: "Second" },
+      ],
+    };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.correctAnswer).toBe("A");
+  });
+});
+
+describe("ensureOptions", () => {
+  it("injects placeholder options when missing for multiple_choice", () => {
+    const raw = {
+      ...baseRaw,
+      format: "multiple_choice",
+      options: [],
+    };
+    const { question, wasRepaired } = repairQuestion(raw, fullPassage);
+    expect(question.options).toHaveLength(4);
+    expect(wasRepaired).toBe(true);
+  });
+
+  it("deduplicates options by key", () => {
+    const raw = {
+      ...baseRaw,
+      format: "multiple_choice",
+      options: [
+        { key: "A", text: "First" },
+        { key: "A", text: "Duplicate A" },
+        { key: "B", text: "Second" },
+      ],
+    };
+    const { question } = repairQuestion(raw, fullPassage);
+    expect(question.options).toHaveLength(2);
+  });
+});
+
+describe("repairAndParseQuestions", () => {
+  it("returns valid questions from well-formed input", () => {
+    const result = repairAndParseQuestions([baseRaw], fullPassage);
+    expect(result.valid).toHaveLength(1);
+    expect(result.invalid).toHaveLength(0);
+  });
+
+  it("repairs and processes mixed valid/invalid questions", () => {
+    const raw = [
+      baseRaw,
+      { format: "multiple_choice", passageText: "", questionText: "", correctAnswer: "", explanation: "", difficulty: 99, skillTags: [] },
+    ];
+    const result = repairAndParseQuestions(raw, fullPassage);
+    expect(result.valid).toHaveLength(2);
+    expect(result.invalid).toHaveLength(0);
+    expect(result.repairLog.length).toBeGreaterThan(0);
+  });
+
+  it("captures invalid questions that remain unparseable after repair", () => {
+    const raw = [
+      { format: "unknown_format", passageText: "", questionText: "" },  // Will fail repair entirely
+    ];
+    // First entry will fail during repairQuestion because format might cause issues
+    // Actually it won't crash but unknown format won't match discriminated union
+    const result = repairAndParseQuestions(raw, fullPassage);
+    expect(result.invalid).toHaveLength(1);
+    expect(result.valid).toHaveLength(0);
+  });
+});
+
+describe("tryParseQuestion", () => {
+  it("parses a valid generic question", () => {
+    const generic = {
+      ...baseRaw,
+      passageText: fullPassage,
+    };
+    const result = tryParseQuestion(generic as any);
+    expect(result).not.toBeNull();
+    expect(result!.format).toBe("multiple_choice");
+  });
+
+  it("returns null for invalid question", () => {
+    const result = tryParseQuestion({ format: "unknown_format" } as any);
+    expect(result).toBeNull();
+  });
+});

packages/ai/src/__tests__/schema-to-prompt.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, it } from "bun:test";
+import {
+  getQuestionJsonSchemaDescription,
+  getPassageJsonSchemaDescription,
+  getValidationJsonSchemaDescription,
+  getQuestionsArrayJsonSchemaDescription,
+  getSelfValidationJsonSchemaDescription,
+} from "../schema-to-prompt";
+
+describe("getQuestionJsonSchemaDescription", () => {
+  it("returns valid JSON string", () => {
+    const result = getQuestionJsonSchemaDescription();
+    expect(typeof result).toBe("string");
+    expect(() => JSON.parse(result)).not.toThrow();
+  });
+
+  it("contains oneOf with all question format variants", () => {
+    const result = JSON.parse(getQuestionJsonSchemaDescription());
+    expect(Array.isArray(result.oneOf)).toBe(true);
+    expect(result.oneOf.length).toBeGreaterThanOrEqual(20);
+  });
+
+  it("first variant has question properties", () => {
+    const result = JSON.parse(getQuestionJsonSchemaDescription());
+    const firstProps = result.oneOf[0].properties;
+    expect(firstProps.format).toBeDefined();
+    expect(firstProps.passageText).toBeDefined();
+    expect(firstProps.questionText).toBeDefined();
+    expect(firstProps.correctAnswer).toBeDefined();
+    expect(firstProps.explanation).toBeDefined();
+  });
+});
+
+describe("getPassageJsonSchemaDescription", () => {
+  it("returns valid JSON with passage schema", () => {
+    const result = JSON.parse(getPassageJsonSchemaDescription());
+    expect(result.required).toEqual(["title", "passage"]);
+    expect(result.properties.title).toBeDefined();
+    expect(result.properties.passage).toBeDefined();
+  });
+});
+
+describe("getValidationJsonSchemaDescription", () => {
+  it("returns valid JSON with validation schema", () => {
+    const result = JSON.parse(getValidationJsonSchemaDescription());
+    expect(result.required).toEqual(["isValid", "feedback", "score"]);
+    expect(result.properties.score.minimum).toBe(1);
+    expect(result.properties.score.maximum).toBe(10);
+  });
+});
+
+describe("getQuestionsArrayJsonSchemaDescription", () => {
+  it("returns valid JSON with questions array", () => {
+    const result = JSON.parse(getQuestionsArrayJsonSchemaDescription());
+    expect(result.required).toEqual(["questions"]);
+    expect(result.properties.questions.type).toBe("array");
+  });
+});
+
+describe("getSelfValidationJsonSchemaDescription", () => {
+  it("returns valid JSON with self-validation schema", () => {
+    const result = JSON.parse(getSelfValidationJsonSchemaDescription());
+    expect(result.required).toEqual(["overallConfidence", "issues", "needsRevision"]);
+    expect(result.properties.overallConfidence.minimum).toBe(0);
+    expect(result.properties.overallConfidence.maximum).toBe(100);
+  });
+});

packages/ai/src/__tests__/schemas.test.ts

@@ -0,0 +1,265 @@
+import { describe, expect, it } from "bun:test";
+import {
+  examTypeSchema,
+  sectionTypeSchema,
+  questionFormatSchema,
+  difficultySchema,
+  questionSchema,
+  generationInputSchema,
+  generationResultSchema,
+  multipleChoiceQuestionSchema,
+  trueFalseQuestionSchema,
+} from "../schemas";
+
+const base = {
+  passageText: "A".repeat(50),
+  questionText: "B".repeat(10),
+  correctAnswer: "A",
+  explanation: "Explanation text",
+  difficulty: 3,
+  skillTags: ["reading"],
+};
+
+describe("examTypeSchema", () => {
+  it("accepts valid exam types", () => {
+    expect(examTypeSchema.parse("IELTS")).toBe("IELTS");
+    expect(examTypeSchema.parse("TOEFL")).toBe("TOEFL");
+    expect(examTypeSchema.parse("JLPT")).toBe("JLPT");
+  });
+
+  it("rejects invalid exam type", () => {
+    expect(() => examTypeSchema.parse("GRE")).toThrow();
+  });
+});
+
+describe("sectionTypeSchema", () => {
+  it("accepts valid sections", () => {
+    expect(sectionTypeSchema.parse("READING")).toBe("READING");
+    expect(sectionTypeSchema.parse("LISTENING")).toBe("LISTENING");
+  });
+
+  it("rejects invalid section", () => {
+    expect(() => sectionTypeSchema.parse("MATH")).toThrow();
+  });
+});
+
+describe("questionFormatSchema", () => {
+  it("accepts all 20 format variants", () => {
+    const formats = [
+      "multiple_choice", "true_false_not_given", "matching_headings",
+      "matching_information", "matching_pairs", "fill_blank",
+      "synonym", "grammar_in_context", "sentence_completion",
+      "summary_completion", "cloze", "reference", "author_view",
+      "error_recognition", "text_insertion", "kanji_reading",
+      "particle_choice", "article_case", "character_reading",
+      "sentence_arrangement",
+    ];
+    for (const f of formats) {
+      expect(questionFormatSchema.parse(f)).toBe(f);
+    }
+  });
+});
+
+describe("difficultySchema", () => {
+  it("accepts values 1-5", () => {
+    for (let i = 1; i <= 5; i++) {
+      expect(difficultySchema.parse(i)).toBe(i);
+    }
+  });
+
+  it("rejects values outside 1-5", () => {
+    expect(() => difficultySchema.parse(0)).toThrow();
+    expect(() => difficultySchema.parse(6)).toThrow();
+  });
+
+  it("rejects non-integer", () => {
+    expect(() => difficultySchema.parse(2.5)).toThrow();
+  });
+});
+
+describe("multipleChoiceQuestionSchema", () => {
+  it("accepts valid multiple choice", () => {
+    const data = {
+      ...base,
+      format: "multiple_choice",
+      options: [
+        { key: "A", text: "Option A" },
+        { key: "B", text: "Option B" },
+      ],
+    };
+    const parsed = multipleChoiceQuestionSchema.parse(data);
+    expect(parsed.format).toBe("multiple_choice");
+    expect(parsed.options).toHaveLength(2);
+  });
+
+  it("rejects fewer than 2 options", () => {
+    expect(() =>
+      multipleChoiceQuestionSchema.parse({
+        ...base,
+        format: "multiple_choice",
+        options: [{ key: "A", text: "Only option" }],
+      })
+    ).toThrow();
+  });
+
+  it("rejects more than 6 options", () => {
+    expect(() =>
+      multipleChoiceQuestionSchema.parse({
+        ...base,
+        format: "multiple_choice",
+        options: "ABCDEFG".split("").map((k) => ({ key: k, text: `Option ${k}` })),
+      })
+    ).toThrow();
+  });
+});
+
+describe("trueFalseQuestionSchema", () => {
+  it("accepts TRUE answer", () => {
+    const data = { ...base, format: "true_false_not_given", correctAnswer: "TRUE" };
+    expect(trueFalseQuestionSchema.parse(data).correctAnswer).toBe("TRUE");
+  });
+
+  it("accepts FALSE answer", () => {
+    const data = { ...base, format: "true_false_not_given", correctAnswer: "FALSE" };
+    expect(trueFalseQuestionSchema.parse(data).correctAnswer).toBe("FALSE");
+  });
+
+  it("accepts NOT_GIVEN answer", () => {
+    const data = { ...base, format: "true_false_not_given", correctAnswer: "NOT_GIVEN" };
+    expect(trueFalseQuestionSchema.parse(data).correctAnswer).toBe("NOT_GIVEN");
+  });
+
+  it("rejects invalid answer", () => {
+    expect(() =>
+      trueFalseQuestionSchema.parse({ ...base, format: "true_false_not_given", correctAnswer: "MAYBE" })
+    ).toThrow();
+  });
+});
+
+describe("questionSchema (discriminated union)", () => {
+  it("parses a valid multiple_choice question", () => {
+    const data = {
+      ...base,
+      format: "multiple_choice",
+      options: [
+        { key: "A", text: "Option A" },
+        { key: "B", text: "Option B" },
+        { key: "C", text: "Option C" },
+        { key: "D", text: "Option D" },
+      ],
+    };
+    expect(() => questionSchema.parse(data)).not.toThrow();
+  });
+
+  it("parses a valid true_false_not_given question", () => {
+    const data = { ...base, format: "true_false_not_given", correctAnswer: "TRUE" };
+    expect(() => questionSchema.parse(data)).not.toThrow();
+  });
+
+  it("parses a valid fill_blank question (no options needed)", () => {
+    const data = { ...base, format: "fill_blank", correctAnswer: "the answer" };
+    expect(() => questionSchema.parse(data)).not.toThrow();
+  });
+
+  it("rejects mismatched format — correctAnswer 'TRUE' on non-TFNG format", () => {
+    // A fill_blank with answer "TRUE" should still parse (it's just a string)
+    const data = { ...base, format: "fill_blank", correctAnswer: "TRUE" };
+    expect(() => questionSchema.parse(data)).not.toThrow();
+  });
+
+  it("rejects missing required options for multiple_choice", () => {
+    expect(() =>
+      questionSchema.parse({ ...base, format: "multiple_choice" })
+    ).toThrow();
+  });
+
+  it("rejects unknown format", () => {
+    expect(() =>
+      questionSchema.parse({ ...base, format: "unknown_format" as any })
+    ).toThrow();
+  });
+
+  it("rejects passageText shorter than 50 chars", () => {
+    expect(() =>
+      questionSchema.parse({
+        ...base,
+        format: "fill_blank",
+        passageText: "too short",
+        correctAnswer: "ans",
+      })
+    ).toThrow();
+  });
+
+  it("rejects skillTags with empty array", () => {
+    expect(() =>
+      questionSchema.parse({
+        ...base,
+        format: "fill_blank",
+        skillTags: [],
+        correctAnswer: "ans",
+      })
+    ).toThrow();
+  });
+});
+
+describe("generationInputSchema", () => {
+  it("accepts valid generation input", () => {
+    const data = {
+      examType: "IELTS",
+      section: "READING",
+      formats: ["multiple_choice", "true_false_not_given"],
+      difficulty: 3,
+      topics: ["education", "technology"],
+      questionCount: 10,
+      mode: "quick",
+      apiKeyConfig: {
+        baseUrl: "https://api.openai.com/v1",
+        apiKey: "sk-test",
+        model: "gpt-4",
+      },
+    };
+    expect(() => generationInputSchema.parse(data)).not.toThrow();
+  });
+
+  it("rejects questionCount over 40", () => {
+    expect(() =>
+      generationInputSchema.parse({
+        examType: "IELTS",
+        section: "READING",
+        formats: ["multiple_choice"],
+        difficulty: 3,
+        topics: ["education"],
+        questionCount: 100,
+        apiKeyConfig: {
+          baseUrl: "https://api.openai.com/v1",
+          apiKey: "sk-test",
+          model: "gpt-4",
+        },
+      })
+    ).toThrow();
+  });
+});
+
+describe("generationResultSchema", () => {
+  it("accepts valid generation result", () => {
+    const data = {
+      questions: [
+        {
+          ...base,
+          format: "multiple_choice",
+          options: [
+            { key: "A", text: "Op A" },
+            { key: "B", text: "Op B" },
+          ],
+        },
+      ],
+      meta: {
+        model: "gpt-4",
+        tokensUsed: 500,
+        durationMs: 1234,
+        mode: "quick",
+      },
+    };
+    expect(() => generationResultSchema.parse(data)).not.toThrow();
+  });
+});

packages/ai/src/client.ts

@@ -104,7 +104,7 @@ function looksTruncated(content: string): boolean {
   const lastChar = trimmed[trimmed.length - 1];
   if (lastChar === "}" || lastChar === "]") return false;
   // Check for common truncation signatures
-  const unterminated = /Unterminated string|Unexpected end of JSON|Unexpected token/i;
+  const unterminated = /Unterminated string|Unexpected end of JSON|Unexpected (token|EOF)|Expected ('.*'|".*")/i;
   try {
     JSON.parse(trimmed);
     return false;

packages/ai/src/schema-to-prompt.ts

@@ -1,4 +1,4 @@
-import { zodToJsonSchema } from "zod-to-json-schema";
+import { toJSONSchema } from "zod";
 import { questionSchema } from "./schemas";
 
 /**
@@ -6,15 +6,8 @@ import { questionSchema } from "./schemas";
  * suitable for embedding into an LLM prompt.
  */
 export function getQuestionJsonSchemaDescription(): string {
-  const jsonSchema = zodToJsonSchema(questionSchema as any, {
-    name: "Question",
-    $refStrategy: "none",
-  });
-
-  // Strip the top-level wrapper so the AI sees just the object shape
-  const defs = (jsonSchema as any).definitions?.Question ?? jsonSchema;
-
-  return JSON.stringify(defs, null, 2);
+  const jsonSchema = toJSONSchema(questionSchema);
+  return JSON.stringify(jsonSchema, null, 2);
 }
 
 /**

packages/api/package.json

@@ -10,7 +10,9 @@
       "default": "./src/*.ts"
     }
   },
-  "scripts": {},
+  "scripts": {
+    "test": "bun test"
+  },
   "dependencies": {
     "@labas/ai": "workspace:*",
     "@labas/auth": "workspace:*",
@@ -28,6 +30,7 @@
     "zod": "catalog:"
   },
   "devDependencies": {
+    "@electric-sql/pglite": "^0.4.5",
     "@labas/config": "workspace:*",
     "@types/bcryptjs": "^3.0.0",
     "@types/nodemailer": "^8.0.0",

packages/api/src/__tests__/attempt.integration.test.ts

@@ -0,0 +1,207 @@
+import { describe, expect, it, beforeAll, afterAll, mock } from "bun:test";
+import { drizzle } from "drizzle-orm/pglite";
+import * as schema from "../../../db/src/schema";
+import { closeTestPGlite, getTestPGlite } from "./test-setup";
+
+mock.module("@labas/env/server", () => ({
+  env: {
+    DATABASE_URL: "postgres://localhost:5432/test",
+    BETTER_AUTH_SECRET: "a".repeat(32),
+    BETTER_AUTH_URL: "http://localhost:3000",
+    CORS_ORIGIN: "http://localhost:5173",
+    API_KEY_ENCRYPTION_KEY: "z".repeat(32),
+    REDIS_URL: "redis://localhost:6379",
+    SMTP_HOST: "localhost",
+    SMTP_USER: "test",
+    SMTP_PASS: "test",
+    SMTP_FROM: "test@test.com",
+  },
+}));
+
+describe("attempt router", () => {
+  let attemptRouter: any;
+  let packageId: string;
+  let questionIds: string[];
+  let testDb: any;
+
+  function makeCaller(userId: string) {
+    return attemptRouter.createCaller({
+      session: { user: { id: userId }, expiresAt: new Date() },
+      auth: null,
+    });
+  }
+
+  async function createUserAndCaller(label: string) {
+    const id = `user-${label}-${Date.now()}`;
+    await testDb.insert(schema.user).values({ id, name: `User ${label}`, email: `${label}@test.com` });
+    return { id, caller: makeCaller(id) };
+  }
+
+  beforeAll(async () => {
+    const pg = await getTestPGlite();
+    testDb = drizzle(pg, { schema });
+
+    mock.module("@labas/db", () => ({
+      __esModule: true,
+      ...schema,
+      db: testDb,
+    }));
+
+    const mod = await import("../routers/attempt");
+    attemptRouter = mod.attemptRouter;
+
+    await testDb.insert(schema.examType).values([
+      { id: "IELTS", name: "IELTS", language: "English" },
+    ]);
+
+    await testDb.insert(schema.sectionType).values([
+      { id: "READING", name: "Reading" },
+    ]);
+
+    const ownerId = "owner-id";
+    await testDb.insert(schema.user).values({ id: ownerId, name: "Owner", email: "owner@test.com" });
+    const [pkg] = await testDb.insert(schema.testPackage).values({
+      title: "IELTS Reading Test",
+      examTypeId: "IELTS",
+      creatorUserId: ownerId,
+      isPublic: true,
+    }).returning();
+    packageId = pkg.id;
+
+    const [sec] = await testDb.insert(schema.packageSection).values({
+      packageId: pkg.id,
+      sectionTypeId: "READING",
+      title: "Reading Section",
+      orderIndex: 0,
+    }).returning();
+
+    const qs = await testDb.insert(schema.question).values([
+      {
+        examTypeId: "IELTS", sectionTypeId: "READING", format: "multiple_choice",
+        passageText: "P".repeat(60), questionText: "What is the main idea?",
+        options: [{ key: "A", text: "Option A" }, { key: "B", text: "Option B" }, { key: "C", text: "Option C" }, { key: "D", text: "Option D" }],
+        correctAnswer: "A", explanation: "Because A is correct", difficulty: 2,
+        skillTags: ["main_idea"], creatorUserId: ownerId, isPublic: true,
+      },
+      {
+        examTypeId: "IELTS", sectionTypeId: "READING", format: "true_false_not_given",
+        passageText: "P".repeat(60), questionText: "The author states that...",
+        correctAnswer: "TRUE", explanation: "It says so", difficulty: 2,
+        skillTags: ["detail"], creatorUserId: ownerId, isPublic: true,
+      },
+      {
+        examTypeId: "IELTS", sectionTypeId: "READING", format: "fill_blank",
+        passageText: "P".repeat(60), questionText: "The answer is ___",
+        correctAnswer: "paradigm", explanation: "Context clue", difficulty: 3,
+        skillTags: ["vocabulary"], creatorUserId: ownerId, isPublic: true,
+      },
+    ]).returning();
+    questionIds = qs.map((q: any) => q.id);
+
+    await testDb.insert(schema.sectionQuestion).values([
+      { sectionId: sec.id, questionId: qs[0]!.id, orderIndex: 0 },
+      { sectionId: sec.id, questionId: qs[1]!.id, orderIndex: 1 },
+      { sectionId: sec.id, questionId: qs[2]!.id, orderIndex: 2 },
+    ]);
+  });
+
+  afterAll(async () => {
+    await closeTestPGlite();
+  });
+
+  it("start creates a new attempt", async () => {
+    const { caller } = await createUserAndCaller("start");
+    const result = await caller.start({ packageId });
+    expect(result).toHaveProperty("attemptId");
+  });
+
+  it("start rejects duplicate in-progress attempt", { timeout: 15000 }, async () => {
+    const { caller } = await createUserAndCaller("dup");
+    await caller.start({ packageId });
+    await Bun.sleep(3100); // wait for rate limit window (3000ms)
+    expect(caller.start({ packageId })).rejects.toThrow("sedang berjalan");
+  });
+
+  it("getById returns attempt with sections and questions", async () => {
+    const { caller } = await createUserAndCaller("getid");
+    const { attemptId } = await caller.start({ packageId });
+    const result = await caller.getById({ id: attemptId });
+    expect(result.status).toBe("in_progress");
+    expect(result.sections).toHaveLength(1);
+    expect(result.sections[0].questions).toHaveLength(3);
+  });
+
+  it("getById strips correctAnswer during in_progress", async () => {
+    const { caller } = await createUserAndCaller("strip");
+    const { attemptId } = await caller.start({ packageId });
+    const result = await caller.getById({ id: attemptId });
+    for (const s of result.sections) {
+      for (const q of s.questions) {
+        expect(q.correctAnswer).toBeUndefined();
+        expect(q.explanation).toBeUndefined();
+      }
+    }
+  });
+
+  it("submitAnswer stores user answer", async () => {
+    const { caller } = await createUserAndCaller("submit");
+    const { attemptId } = await caller.start({ packageId });
+    const attempt = await caller.getById({ id: attemptId });
+    const sectionResultId = attempt.sections[0].sectionResultId;
+
+    const result = await caller.submitAnswer({
+      attemptId, sectionResultId,
+      questionId: questionIds[0]!, userAnswer: "A",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("finish scores correct answers", { timeout: 30000 }, async () => {
+    const { caller } = await createUserAndCaller("score");
+    const { attemptId } = await caller.start({ packageId });
+    await Bun.sleep(4500);
+    const attempt = await caller.getById({ id: attemptId });
+    const sectionResultId = attempt.sections[0].sectionResultId;
+
+    await caller.submitAnswer({ attemptId, sectionResultId, questionId: questionIds[0]!, userAnswer: "A" });
+    await Bun.sleep(600);
+    await caller.submitAnswer({ attemptId, sectionResultId, questionId: questionIds[1]!, userAnswer: "FALSE" });
+    await Bun.sleep(600);
+    await caller.submitAnswer({ attemptId, sectionResultId, questionId: questionIds[2]!, userAnswer: "wrong" });
+
+    const result = await caller.finish({ attemptId });
+    expect(result.totalScore).toBe(1);
+    expect(result.maxScore).toBe(3);
+    expect(result.percentage).toBe(33);
+  });
+
+  it("finish rejects attempts under 5 seconds", async () => {
+    const { caller } = await createUserAndCaller("fastfinish");
+    const { attemptId } = await caller.start({ packageId });
+    expect(caller.finish({ attemptId })).rejects.toThrow("terlalu cepat");
+  });
+
+  it("getActiveAttempt returns in-progress attempt", async () => {
+    const { caller } = await createUserAndCaller("active");
+    const { attemptId } = await caller.start({ packageId });
+    const result = await caller.getActiveAttempt({ packageId });
+    expect(result).not.toBeNull();
+    expect(result.id).toBe(attemptId);
+    expect(result.status).toBe("in_progress");
+  });
+
+  it("abandon marks attempt as abandoned", async () => {
+    const { caller } = await createUserAndCaller("abandon");
+    const { attemptId } = await caller.start({ packageId });
+    const result = await caller.abandon({ attemptId });
+    expect(result.success).toBe(true);
+  });
+
+  it("myAttempts returns paginated list", async () => {
+    const { caller } = await createUserAndCaller("mylist");
+    await caller.start({ packageId });
+    const result = await caller.myAttempts();
+    expect(result.attempts.length).toBeGreaterThan(0);
+    expect(result.total).toBeGreaterThan(0);
+  });
+});

packages/api/src/__tests__/package.integration.test.ts

@@ -0,0 +1,229 @@
+import { describe, expect, it, beforeAll, afterAll, mock } from "bun:test";
+import { eq } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/pglite";
+import * as schema from "../../../db/src/schema";
+import { closeTestPGlite, getTestPGlite } from "./test-setup";
+
+mock.module("@labas/env/server", () => ({
+  env: {
+    DATABASE_URL: "postgres://localhost:5432/test",
+    BETTER_AUTH_SECRET: "a".repeat(32),
+    BETTER_AUTH_URL: "http://localhost:3000",
+    CORS_ORIGIN: "http://localhost:5173",
+    API_KEY_ENCRYPTION_KEY: "z".repeat(32),
+    REDIS_URL: "redis://localhost:6379",
+    SMTP_HOST: "localhost",
+    SMTP_USER: "test",
+    SMTP_PASS: "test",
+    SMTP_FROM: "test@test.com",
+  },
+}));
+
+describe("package router", () => {
+  let packageRouter: any;
+  let caller: any;
+  let protectedCaller: any;
+  let testDb: any;
+  let ownerId: string;
+  let pkgId: string;
+  let sectionId: string;
+  let questionId: string;
+
+  beforeAll(async () => {
+    const pg = await getTestPGlite();
+    testDb = drizzle(pg, { schema });
+
+    mock.module("@labas/db", () => ({
+      __esModule: true,
+      ...schema,
+      db: testDb,
+    }));
+
+    await testDb.insert(schema.examType).values([
+      { id: "IELTS", name: "IELTS", language: "English" },
+    ]);
+    await testDb.insert(schema.sectionType).values([
+      { id: "READING", name: "Reading" },
+      { id: "WRITING", name: "Writing" },
+    ]);
+
+    ownerId = "pkg-owner";
+    await testDb.insert(schema.user).values({ id: ownerId, name: "Owner", email: "owner@test.com" });
+
+    const mod = await import("../routers/package");
+    packageRouter = mod.packageRouter;
+
+    caller = packageRouter.createCaller({ session: null, auth: null });
+    protectedCaller = packageRouter.createCaller({
+      session: { user: { id: ownerId }, expiresAt: new Date() },
+      auth: null,
+    });
+  });
+
+  afterAll(async () => {
+    await closeTestPGlite();
+  });
+
+  it("create makes a new package", async () => {
+    const result = await protectedCaller.create({
+      title: "My IELTS Pack",
+      examTypeId: "IELTS",
+      isPublic: false,
+    });
+    expect(result).toHaveProperty("id");
+    expect(result.title).toBe("My IELTS Pack");
+    pkgId = result.id;
+  });
+
+  it("getById returns package with sections", async () => {
+    const result = await protectedCaller.getById({ id: pkgId });
+    expect(result).not.toBeNull();
+    expect(result.title).toBe("My IELTS Pack");
+    expect(result.sections).toEqual([]);
+  });
+
+  it("getById returns null for non-existent", async () => {
+    const { randomUUID } = await import("node:crypto");
+    const result = await caller.getById({ id: randomUUID() });
+    expect(result).toBeNull();
+  });
+
+  it("list returns public packages", async () => {
+    // Make it public first
+    await testDb.update(schema.testPackage).set({ isPublic: true }).where(eq(schema.testPackage.id, pkgId));
+
+    const result = await caller.list();
+    expect(result.packages.length).toBeGreaterThan(0);
+    expect(result.packages[0].id).toBe(pkgId);
+
+    // Set back to private for upcoming tests
+    await testDb.update(schema.testPackage).set({ isPublic: false }).where(eq(schema.testPackage.id, pkgId));
+  });
+
+  it("list hides private packages from anonymous users", async () => {
+    const result = await caller.list();
+    const ids = result.packages.map((p: any) => p.id);
+    expect(ids).not.toContain(pkgId);
+  });
+
+  it("list shows private packages to owner via auth", async () => {
+    const result = await protectedCaller.list();
+    const ids = result.packages.map((p: any) => p.id);
+    expect(ids).toContain(pkgId);
+  });
+
+  it("list filters by examTypeId", async () => {
+    await testDb.update(schema.testPackage).set({ isPublic: true }).where(eq(schema.testPackage.id, pkgId));
+    const result = await caller.list({ examTypeId: "TOEFL" });
+    expect(result.packages).toHaveLength(0);
+  });
+
+  it("update changes package fields", async () => {
+    const result = await protectedCaller.update({
+      id: pkgId,
+      title: "Updated Pack",
+    });
+    expect(result.title).toBe("Updated Pack");
+  });
+
+  it("update rejects non-owner", async () => {
+    const otherCaller = packageRouter.createCaller({
+      session: { user: { id: "other-user" }, expiresAt: new Date() },
+      auth: null,
+    });
+    expect(otherCaller.update({ id: pkgId, title: "Hacked" })).rejects.toThrow("Forbidden");
+  });
+
+  it("addSection creates a section", async () => {
+    const result = await protectedCaller.addSection({
+      packageId: pkgId,
+      sectionTypeId: "READING",
+      title: "Reading Section",
+      orderIndex: 0,
+    });
+    expect(result).toHaveProperty("id");
+    sectionId = result.id;
+  });
+
+  it("addSection rejects non-owner", async () => {
+    const otherCaller = packageRouter.createCaller({
+      session: { user: { id: "other-user" }, expiresAt: new Date() },
+      auth: null,
+    });
+    expect(otherCaller.addSection({ packageId: pkgId, sectionTypeId: "READING", title: "X" })).rejects.toThrow("Forbidden");
+  });
+
+  it("getById includes sections after adding", async () => {
+    const result = await caller.getById({ id: pkgId });
+    expect(result.sections).toHaveLength(1);
+    expect(result.sections[0].sectionTypeId).toBe("READING");
+  });
+
+  it("addQuestion adds question to section", async () => {
+    const [q] = await testDb.insert(schema.question).values({
+      examTypeId: "IELTS", sectionTypeId: "READING", format: "multiple_choice",
+      passageText: "Q".repeat(60), questionText: "Test?",
+      options: [{ key: "A", text: "A" }, { key: "B", text: "B" }],
+      correctAnswer: "A", explanation: "Exp", difficulty: 1,
+      skillTags: ["test"], creatorUserId: ownerId, isPublic: true,
+    }).returning();
+    questionId = q.id;
+
+    const result = await protectedCaller.addQuestion({
+      sectionId,
+      questionId: q.id,
+      orderIndex: 0,
+    });
+    expect(result).toHaveProperty("id");
+  });
+
+  it("getById shows questions for owner, strips answers for guests", async () => {
+    const ownerResult = await protectedCaller.getById({ id: pkgId });
+    const section = ownerResult.sections.find((s: any) => s.id === sectionId);
+    expect(section.questions).toHaveLength(1);
+    expect(section.questions[0].correctAnswer).toBe("A");
+
+    const guestResult = await caller.getById({ id: pkgId });
+    const guestSection = guestResult.sections.find((s: any) => s.id === sectionId);
+    expect(guestSection.questions[0].correctAnswer).toBeUndefined();
+  });
+
+  it("myPackages returns owned packages", async () => {
+    const result = await protectedCaller.myPackages();
+    expect(result.packages.length).toBeGreaterThan(0);
+    const ids = result.packages.map((p: any) => p.id);
+    expect(ids).toContain(pkgId);
+  });
+
+  it("featured returns empty when no featured packages", async () => {
+    const result = await caller.featured();
+    expect(result).toEqual([]);
+  });
+
+  it("trending returns public packages sorted by usage", async () => {
+    await testDb.update(schema.testPackage).set({ isPublic: true }).where(eq(schema.testPackage.id, pkgId));
+    const result = await caller.trending();
+    expect(result.length).toBeGreaterThan(0);
+  });
+
+  it("removeQuestion removes question from section", async () => {
+    const sq = await protectedCaller.addQuestion({
+      sectionId, questionId, orderIndex: 0,
+    });
+    const result = await protectedCaller.removeQuestion({ sectionQuestionId: sq.id });
+    expect(result.success).toBe(true);
+  });
+
+  it("removeSection removes section", async () => {
+    const result = await protectedCaller.removeSection({ sectionId });
+    expect(result.success).toBe(true);
+  });
+
+  it("delete removes package", async () => {
+    const result = await protectedCaller.delete({ id: pkgId });
+    expect(result.success).toBe(true);
+
+    const fetched = await caller.getById({ id: pkgId });
+    expect(fetched).toBeNull();
+  });
+});

packages/api/src/__tests__/question.integration.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it, beforeAll, afterAll, mock } from "bun:test";
+import { drizzle } from "drizzle-orm/pglite";
+import * as schema from "../../../db/src/schema";
+import { closeTestPGlite, getTestPGlite, createTestUserData } from "./test-setup";
+
+mock.module("@labas/env/server", () => ({
+  env: {
+    DATABASE_URL: "postgres://localhost:5432/test",
+    BETTER_AUTH_SECRET: "a".repeat(32),
+    BETTER_AUTH_URL: "http://localhost:3000",
+    CORS_ORIGIN: "http://localhost:5173",
+    API_KEY_ENCRYPTION_KEY: "z".repeat(32),
+    REDIS_URL: "redis://localhost:6379",
+    SMTP_HOST: "localhost",
+    SMTP_USER: "test",
+    SMTP_PASS: "test",
+    SMTP_FROM: "test@test.com",
+  },
+}));
+
+describe("question router", () => {
+  let questionRouter: any;
+  let user1: any;
+
+  beforeAll(async () => {
+    const pg = await getTestPGlite();
+    const testDb = drizzle(pg, { schema });
+
+    mock.module("@labas/db", () => ({
+      __esModule: true,
+      ...schema,
+      db: testDb,
+    }));
+
+    const data = await createTestUserData();
+    user1 = data.user1;
+
+    const mod = await import("../routers/question");
+    questionRouter = mod.questionRouter;
+  });
+
+  afterAll(async () => {
+    await closeTestPGlite();
+  });
+
+  let caller: any;
+  let protectedCaller: any;
+
+  beforeAll(async () => {
+    caller = questionRouter.createCaller({ session: null, auth: null });
+    protectedCaller = questionRouter.createCaller({
+      session: { user: { id: user1.id }, expiresAt: new Date() },
+      auth: null,
+    });
+  });
+
+  it("list returns public questions", async () => {
+    const result = await caller.list();
+    expect(result.questions).toHaveLength(1);
+    expect(result.questions[0]).not.toHaveProperty("correctAnswer");
+    expect(result.total).toBe(1);
+  });
+
+  it("list filters by examTypeId", async () => {
+    const result = await caller.list({ examTypeId: "IELTS" });
+    expect(result.questions).toHaveLength(1);
+  });
+
+  it("list returns empty when no match", async () => {
+    const result = await caller.list({ examTypeId: "TOEFL" });
+    expect(result.questions).toHaveLength(0);
+  });
+
+  it("getById returns null for non-existent question", async () => {
+    const { randomUUID } = await import("node:crypto");
+    const result = await caller.getById({ id: randomUUID() });
+    expect(result).toBeNull();
+  });
+
+  it("create inserts a new question", async () => {
+    const result = await protectedCaller.create({
+      examTypeId: "IELTS",
+      sectionTypeId: "READING",
+      format: "fill_blank",
+      passageText: "B".repeat(60),
+      questionText: "What is the answer?",
+      correctAnswer: "test answer",
+      difficulty: 2,
+      isCaseSensitive: false,
+      skillTags: ["vocabulary"],
+      isPublic: false,
+    });
+    expect(result).toHaveProperty("id");
+    expect(result.format).toBe("fill_blank");
+  });
+});

packages/api/src/__tests__/queue.test.ts

@@ -0,0 +1,228 @@
+import { describe, expect, it, beforeAll } from "bun:test";
+
+let GenerationJobCancelledError: any,
+    computeSectionSplit: any,
+    splitIntoShards: any,
+    normalizeQuestions: any,
+    runWithConcurrency: any,
+    decryptInputFromDb: any;
+
+beforeAll(async () => {
+  process.env.DATABASE_URL = "postgres://localhost:5432/test";
+  process.env.BETTER_AUTH_SECRET = "a".repeat(32);
+  process.env.BETTER_AUTH_URL = "http://localhost:3000";
+  process.env.CORS_ORIGIN = "http://localhost:5173";
+  process.env.API_KEY_ENCRYPTION_KEY = "z".repeat(32);
+  process.env.REDIS_URL = "redis://localhost:6379";
+  process.env.SMTP_HOST = "localhost";
+  process.env.SMTP_USER = "test";
+  process.env.SMTP_PASS = "test";
+  process.env.SMTP_FROM = "test@test.com";
+
+  const mod = await import("../queue");
+  GenerationJobCancelledError = mod.GenerationJobCancelledError;
+  computeSectionSplit = mod.computeSectionSplit;
+  splitIntoShards = mod.splitIntoShards;
+  normalizeQuestions = mod.normalizeQuestions;
+  runWithConcurrency = mod.runWithConcurrency;
+  decryptInputFromDb = mod.decryptInputFromDb;
+});
+
+describe("GenerationJobCancelledError", () => {
+  it("creates error with correct name", () => {
+    const err = new GenerationJobCancelledError();
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe("GenerationJobCancelledError");
+    expect(err.message).toBe("JOB_CANCELLED");
+  });
+});
+
+describe("computeSectionSplit", () => {
+  it("returns single section when no sections selected", () => {
+    const result = computeSectionSplit([], 10);
+    expect(result).toEqual([{ section: "READING", count: 10 }]);
+  });
+
+  it("returns single section when count < 20 even with multiple sections", () => {
+    const result = computeSectionSplit(["READING", "LISTENING"], 15);
+    expect(result).toEqual([{ section: "READING", count: 15 }]);
+  });
+
+  it("distributes evenly when count >= 20 and multiple sections", () => {
+    const result = computeSectionSplit(["READING", "LISTENING"], 20);
+    expect(result).toHaveLength(2);
+    expect(result[0]!).toEqual({ section: "READING", count: 10 });
+    expect(result[1]!).toEqual({ section: "LISTENING", count: 10 });
+  });
+
+  it("distributes remainder (first section gets extra)", () => {
+    const result = computeSectionSplit(["READING", "LISTENING", "WRITING"], 22);
+    expect(result).toHaveLength(3);
+    expect(result[0]!).toEqual({ section: "READING", count: 8 });  // 7 + 1
+    expect(result[1]!).toEqual({ section: "LISTENING", count: 7 }); // 7 + 1
+    expect(result[2]!).toEqual({ section: "WRITING", count: 7 });   // 7
+  });
+
+  it("handles single section with high count", () => {
+    const result = computeSectionSplit(["READING"], 40);
+    expect(result).toEqual([{ section: "READING", count: 40 }]);
+  });
+});
+
+describe("splitIntoShards", () => {
+  it("creates one shard when count <= max per shard", () => {
+    const result = splitIntoShards([{ section: "READING", count: 5 }]);
+    expect(result).toHaveLength(1);
+    expect(result[0]!).toMatchObject({
+      section: "READING", count: 5, sectionIndex: 0, shardIndex: 0, shardCount: 1,
+    });
+  });
+
+  it("splits into multiple shards when count exceeds max", () => {
+    const result = splitIntoShards([{ section: "READING", count: 20 }]);
+    expect(result).toHaveLength(4); // ceil(20/6) = 4
+    expect(result[0]!.count).toBe(6);
+    expect(result[3]!.count).toBe(2); // last shard has remainder
+    result.forEach((shard) => {
+      expect(shard.section).toBe("READING");
+      expect(shard.shardCount).toBe(4);
+    });
+  });
+
+  it("handles multiple sections with sharding", () => {
+    const result = splitIntoShards([
+      { section: "READING", count: 10 },
+      { section: "LISTENING", count: 10 },
+    ]);
+    expect(result).toHaveLength(4); // ceil(10/6) + ceil(10/6) = 2 + 2
+    expect(result[0]!.section).toBe("READING");
+    expect(result[0]!.sectionIndex).toBe(0);
+    expect(result[2]!.section).toBe("LISTENING");
+    expect(result[2]!.sectionIndex).toBe(1);
+  });
+});
+
+describe("normalizeQuestions", () => {
+  const model = "gpt-4";
+
+  it("transforms GenerationResult questions to PersistableQuestion", () => {
+    const result = {
+      questions: [{
+        format: "multiple_choice",
+        passageText: "A".repeat(50),
+        questionText: "Question?",
+        options: [{ key: "A", text: "Opt" }],
+        correctAnswer: "A",
+        explanation: "Because",
+        difficulty: 3,
+        skillTags: ["reading"],
+      }],
+      meta: { model, tokensUsed: 100, durationMs: 1000, mode: "quick" as const },
+    };
+
+    const normalized = normalizeQuestions("READING", model, result as any);
+    expect(normalized).toHaveLength(1);
+    expect(normalized[0]!).toMatchObject({
+      section: "READING",
+      format: "multiple_choice",
+      correctAnswer: "A",
+      difficulty: 3,
+      aiModel: model,
+    });
+  });
+
+  it("sets options to null when not present", () => {
+    const result = {
+      questions: [{
+        format: "fill_blank",
+        passageText: "A".repeat(50),
+        questionText: "Fill ___",
+        correctAnswer: "answer",
+        explanation: "explain",
+        difficulty: 2,
+        skillTags: ["grammar"],
+      }],
+      meta: { model, tokensUsed: 50, durationMs: 500, mode: "quick" as const },
+    };
+
+    const normalized = normalizeQuestions("READING", model, result as any);
+    expect(normalized[0]!.options).toBeNull();
+  });
+
+  it("turns off isCaseSensitive on correctAnswer when caseSensitive is false", () => {
+    const result = {
+      questions: [{
+        isCaseSensitive: false,
+        format: "fill_blank",
+        passageText: "A".repeat(50),
+        questionText: "Fill ___",
+        correctAnswer: "Answer",
+        explanation: "explain",
+        difficulty: 2,
+        skillTags: ["grammar"],
+      }],
+      meta: { model, tokensUsed: 50, durationMs: 500, mode: "quick" as const },
+    };
+
+    const normalized = normalizeQuestions("READING", model, result as any);
+    expect(normalized[0]!.correctAnswer).toBe("Answer");
+  });
+});
+
+describe("runWithConcurrency", () => {
+  it("processes all items with concurrency", async () => {
+    const items = [1, 2, 3, 4, 5];
+    const results = await runWithConcurrency(items, 3, async (item) => item * 2);
+    expect(results).toEqual([2, 4, 6, 8, 10]);
+  });
+
+  it("maintains order of results", async () => {
+    const items = ["a", "b", "c"];
+    const results = await runWithConcurrency(items, 2, async (item, idx) => `${item}-${idx}`);
+    expect(results).toEqual(["a-0", "b-1", "c-2"]);
+  });
+
+  it("handles empty array", async () => {
+    const results = await runWithConcurrency([], 3, async (item) => item);
+    expect(results).toEqual([]);
+  });
+
+  it("propagates errors from worker", async () => {
+    const items = [1, 2, 3];
+    expect(
+      runWithConcurrency(items, 2, async (item) => {
+        if (item === 2) throw new Error("Item 2 failed");
+        return item;
+      }),
+    ).rejects.toThrow("Item 2 failed");
+  });
+});
+
+describe("decryptInputFromDb", () => {
+  it("passes through unencrypted apiKey (legacy data)", () => {
+    const input = {
+      examType: "IELTS",
+      section: "READING",
+      apiKeyConfig: {
+        baseUrl: "https://api.openai.com/v1",
+        apiKey: "sk-legacy-key",
+        model: "gpt-4",
+      },
+    };
+    const result = decryptInputFromDb(input as any);
+    expect(result.apiKeyConfig.apiKey).toBe("sk-legacy-key");
+  });
+
+  it("handles missing apiKey in config", () => {
+    const input = {
+      examType: "IELTS",
+      section: "READING",
+      apiKeyConfig: {
+        baseUrl: "https://api.openai.com/v1",
+        model: "gpt-4",
+      },
+    };
+    const result = decryptInputFromDb(input as any);
+    expect(result.apiKeyConfig.apiKey).toBeUndefined();
+  });
+});

packages/api/src/__tests__/test-db.ts

@@ -0,0 +1,65 @@
+import { PGlite } from "@electric-sql/pglite";
+import { drizzle } from "drizzle-orm/pglite";
+import * as schema from "@labas/db";
+
+let _client: PGlite | null = null;
+
+export async function createTestDb() {
+  if (_client) {
+    await _client.close();
+  }
+  _client = new PGlite();
+  const db = drizzle(_client, { schema });
+
+  // Enable pgcrypto for gen_random_uuid()
+  await _client.exec("CREATE EXTENSION IF NOT EXISTS pgcrypto");
+
+  // Create tables from Drizzle schema
+  // We use raw SQL since drizzle push needs drizzle-kit
+  const tables = [
+    `CREATE TABLE IF NOT EXISTS "user" (id text PRIMARY KEY, name text NOT NULL, email text NOT NULL UNIQUE, email_verified boolean DEFAULT false NOT NULL, image text, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "session" (id text PRIMARY KEY, expires_at timestamp NOT NULL, token text NOT NULL UNIQUE, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL, ip_address text, user_agent text, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE)`,
+    `CREATE TABLE IF NOT EXISTS "account" (id text PRIMARY KEY, account_id text NOT NULL, provider_id text NOT NULL, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, access_token text, refresh_token text, id_token text, access_token_expires_at timestamp, refresh_token_expires_at timestamp, scope text, password text, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "verification" (id text PRIMARY KEY, identifier text NOT NULL, value text NOT NULL, expires_at timestamp NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "exam_type" (id text PRIMARY KEY, name text NOT NULL, language text NOT NULL, description text)`,
+    `CREATE TABLE IF NOT EXISTS "section_type" (id text PRIMARY KEY, name text NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "question" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, exam_type_id text NOT NULL REFERENCES exam_type(id) ON DELETE CASCADE, section_type_id text NOT NULL REFERENCES section_type(id) ON DELETE CASCADE, format text NOT NULL, passage_text text NOT NULL, question_text text NOT NULL, options jsonb, correct_answer text NOT NULL, explanation text, difficulty integer DEFAULT 3 NOT NULL, skill_tags text[] DEFAULT '{}', is_case_sensitive boolean DEFAULT false NOT NULL, source text DEFAULT 'manual' NOT NULL, ai_model text, ai_prompt_used text, creator_user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, is_public boolean DEFAULT false NOT NULL, usage_count integer DEFAULT 0 NOT NULL, avg_rating integer, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "test_package" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, title text NOT NULL, description text, exam_type_id text NOT NULL REFERENCES exam_type(id) ON DELETE CASCADE, creator_user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, is_public boolean DEFAULT false NOT NULL, total_questions integer DEFAULT 0 NOT NULL, total_sections integer DEFAULT 0 NOT NULL, estimated_duration_min integer, usage_count integer DEFAULT 0 NOT NULL, avg_rating integer, is_featured boolean DEFAULT false NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "package_section" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, package_id uuid NOT NULL REFERENCES test_package(id) ON DELETE CASCADE, section_type_id text NOT NULL REFERENCES section_type(id) ON DELETE CASCADE, title text NOT NULL, order_index integer DEFAULT 0 NOT NULL, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "section_question" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, section_id uuid NOT NULL REFERENCES package_section(id) ON DELETE CASCADE, question_id uuid NOT NULL REFERENCES question(id) ON DELETE CASCADE, order_index integer DEFAULT 0 NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "test_attempt" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, package_id uuid REFERENCES test_package(id) ON DELETE SET NULL, combo_id uuid, started_at timestamp DEFAULT now() NOT NULL, finished_at timestamp, total_score integer, max_score integer, status text DEFAULT 'in_progress' NOT NULL, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "section_result" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, attempt_id uuid NOT NULL REFERENCES test_attempt(id) ON DELETE CASCADE, section_type_id text NOT NULL REFERENCES section_type(id) ON DELETE CASCADE, score integer, max_score integer, time_spent_sec integer, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "answer" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, section_result_id uuid NOT NULL REFERENCES section_result(id) ON DELETE CASCADE, question_id uuid NOT NULL REFERENCES question(id) ON DELETE CASCADE, user_answer text, is_correct boolean, partial_score integer, time_spent_sec integer, created_at timestamp DEFAULT now() NOT NULL)`,
+  ];
+
+  for (const sql of tables) {
+    await _client.exec(sql);
+  }
+
+  return db;
+}
+
+export async function seedTestData(db: ReturnType<typeof drizzle>) {
+  await db.insert(schema.examType).values([
+    { id: "IELTS", name: "IELTS", language: "English" },
+    { id: "TOEFL", name: "TOEFL", language: "English" },
+  ]);
+
+  await db.insert(schema.sectionType).values([
+    { id: "READING", name: "Reading" },
+    { id: "WRITING", name: "Writing" },
+    { id: "LISTENING", name: "Listening" },
+  ]);
+
+  const [testUser] = await db
+    .insert(schema.user)
+    .values({ id: "user-1", name: "Test User", email: "test@test.com" })
+    .returning();
+
+  const [otherUser] = await db
+    .insert(schema.user)
+    .values({ id: "user-2", name: "Other User", email: "other@test.com" })
+    .returning();
+
+  return { testUser, otherUser };
+}

packages/api/src/__tests__/test-setup.ts

@@ -0,0 +1,84 @@
+import { PGlite } from "@electric-sql/pglite";
+import { drizzle } from "drizzle-orm/pglite";
+import * as schema from "../../../db/src/schema";
+
+let _pg: PGlite | null = null;
+
+export async function getTestPGlite() {
+  if (!_pg) {
+    _pg = new PGlite();
+    await initSchema(_pg);
+  }
+  return _pg;
+}
+
+export async function closeTestPGlite() {
+  if (_pg) {
+    await _pg.close();
+    _pg = null;
+  }
+}
+
+async function initSchema(pg: PGlite) {
+  const tables = [
+    `CREATE TABLE IF NOT EXISTS "user" (id text PRIMARY KEY, name text NOT NULL, email text NOT NULL UNIQUE, email_verified boolean DEFAULT false NOT NULL, image text, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "session" (id text PRIMARY KEY, expires_at timestamp NOT NULL, token text NOT NULL UNIQUE, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL, ip_address text, user_agent text, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE)`,
+    `CREATE TABLE IF NOT EXISTS "account" (id text PRIMARY KEY, account_id text NOT NULL, provider_id text NOT NULL, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, access_token text, refresh_token text, id_token text, access_token_expires_at timestamp, refresh_token_expires_at timestamp, scope text, password text, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "verification" (id text PRIMARY KEY, identifier text NOT NULL, value text NOT NULL, expires_at timestamp NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "exam_type" (id text PRIMARY KEY, name text NOT NULL, language text NOT NULL, description text)`,
+    `CREATE TABLE IF NOT EXISTS "section_type" (id text PRIMARY KEY, name text NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "question" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, exam_type_id text NOT NULL REFERENCES exam_type(id) ON DELETE CASCADE, section_type_id text NOT NULL REFERENCES section_type(id) ON DELETE CASCADE, format text NOT NULL, passage_text text NOT NULL, question_text text NOT NULL, options jsonb, correct_answer text NOT NULL, explanation text, difficulty integer DEFAULT 3 NOT NULL, skill_tags text[] DEFAULT '{}', is_case_sensitive boolean DEFAULT false NOT NULL, source text DEFAULT 'manual' NOT NULL, ai_model text, ai_prompt_used text, creator_user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, is_public boolean DEFAULT false NOT NULL, usage_count integer DEFAULT 0 NOT NULL, avg_rating integer, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "test_package" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, title text NOT NULL, description text, exam_type_id text NOT NULL REFERENCES exam_type(id) ON DELETE CASCADE, creator_user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, is_public boolean DEFAULT false NOT NULL, total_questions integer DEFAULT 0 NOT NULL, total_sections integer DEFAULT 0 NOT NULL, estimated_duration_min integer, usage_count integer DEFAULT 0 NOT NULL, avg_rating integer, is_featured boolean DEFAULT false NOT NULL, created_at timestamp DEFAULT now() NOT NULL, updated_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "package_section" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, package_id uuid NOT NULL REFERENCES test_package(id) ON DELETE CASCADE, section_type_id text NOT NULL REFERENCES section_type(id) ON DELETE CASCADE, title text NOT NULL, order_index integer DEFAULT 0 NOT NULL, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "section_question" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, section_id uuid NOT NULL REFERENCES package_section(id) ON DELETE CASCADE, question_id uuid NOT NULL REFERENCES question(id) ON DELETE CASCADE, order_index integer DEFAULT 0 NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "test_attempt" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, user_id text NOT NULL REFERENCES "user"(id) ON DELETE CASCADE, package_id uuid REFERENCES test_package(id) ON DELETE SET NULL, combo_id uuid, started_at timestamp DEFAULT now() NOT NULL, finished_at timestamp, total_score integer, max_score integer, status text DEFAULT 'in_progress' NOT NULL, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "section_result" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, attempt_id uuid NOT NULL REFERENCES test_attempt(id) ON DELETE CASCADE, section_type_id text NOT NULL REFERENCES section_type(id) ON DELETE CASCADE, score integer, max_score integer, time_spent_sec integer, created_at timestamp DEFAULT now() NOT NULL)`,
+    `CREATE TABLE IF NOT EXISTS "answer" (id uuid DEFAULT gen_random_uuid() PRIMARY KEY, section_result_id uuid NOT NULL REFERENCES section_result(id) ON DELETE CASCADE, question_id uuid NOT NULL REFERENCES question(id) ON DELETE CASCADE, user_answer text, is_correct boolean, partial_score integer, time_spent_sec integer, created_at timestamp DEFAULT now() NOT NULL)`,
+  ];
+
+  for (const sql of tables) {
+    await pg.exec(sql);
+  }
+}
+
+export async function createTestUserData() {
+  const pg = await getTestPGlite();
+  const db = drizzle(pg, { schema });
+
+  const [user1] = await db.insert(schema.user).values({
+    id: "user-1", name: "Test User", email: "test@test.com",
+  }).returning();
+
+  const [user2] = await db.insert(schema.user).values({
+    id: "user-2", name: "Other User", email: "other@test.com",
+  }).returning();
+
+  await db.insert(schema.examType).values([
+    { id: "IELTS", name: "IELTS", language: "English" },
+    { id: "TOEFL", name: "TOEFL", language: "English" },
+  ]);
+
+  await db.insert(schema.sectionType).values([
+    { id: "READING", name: "Reading" },
+    { id: "WRITING", name: "Writing" },
+    { id: "LISTENING", name: "Listening" },
+  ]);
+
+  await db.insert(schema.question).values([
+    {
+      examTypeId: "IELTS", sectionTypeId: "READING", format: "multiple_choice",
+      passageText: "A".repeat(100), questionText: "What is X?",
+      options: [{ key: "A", text: "Opt A" }, { key: "B", text: "Opt B" }],
+      correctAnswer: "A", explanation: "Test", difficulty: 3,
+      skillTags: ["comprehension"], creatorUserId: user1.id, isPublic: true,
+    },
+  ]);
+
+  await db.insert(schema.testPackage).values({
+    id: "00000000-0000-0000-0000-000000000001",
+    title: "Test Package", examTypeId: "IELTS",
+    creatorUserId: user1.id, isPublic: true,
+  });
+
+  return { user1, user2 };
+}

packages/api/src/lib/__tests__/encryption.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it, beforeAll } from "bun:test";
+import { encryptApiKey, decryptApiKey } from "../encryption";
+
+const TEST_KEY = "test-encryption-key-1234567890abcd"; // 32+ chars
+const TEST_PLAINTEXT = "sk-my-secret-api-key-abc123";
+
+beforeAll(() => {
+  process.env.API_KEY_ENCRYPTION_KEY = TEST_KEY;
+});
+
+describe("encryptApiKey / decryptApiKey", () => {
+  it("round-trips a plaintext successfully", () => {
+    const encrypted = encryptApiKey(TEST_PLAINTEXT);
+    expect(encrypted).toBeTruthy();
+    expect(typeof encrypted).toBe("string");
+
+    const decrypted = decryptApiKey(encrypted);
+    expect(decrypted).toBe(TEST_PLAINTEXT);
+  });
+
+  it("produces different ciphertext each call (uses random salt/iv)", () => {
+    const result1 = encryptApiKey(TEST_PLAINTEXT);
+    const result2 = encryptApiKey(TEST_PLAINTEXT);
+    expect(result1).not.toBe(result2);
+  });
+
+  it("handles empty string", () => {
+    const encrypted = encryptApiKey("");
+    const decrypted = decryptApiKey(encrypted);
+    expect(decrypted).toBe("");
+  });
+
+  it("handles special characters", () => {
+    const special = "abc123!@#$%^&*()_+-=[]{}|;':\",./<>?`~你好日本語";
+    const encrypted = encryptApiKey(special);
+    const decrypted = decryptApiKey(encrypted);
+    expect(decrypted).toBe(special);
+  });
+});
+
+describe("decryptApiKey — error handling", () => {
+  it("throws on invalid format (not 4 parts)", () => {
+    expect(() => decryptApiKey("invalid-format")).toThrow("Invalid encrypted API key format");
+  });
+
+  it("throws on tampered ciphertext", () => {
+    const encrypted = encryptApiKey(TEST_PLAINTEXT);
+    const parts = encrypted.split(":");
+    // Tamper the ciphertext part
+    parts[3] = "tampered-data";
+    const tampered = parts.join(":");
+    expect(() => decryptApiKey(tampered)).toThrow();
+  });
+});

packages/api/src/lib/__tests__/errors.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it } from "bun:test";
+import { TRPCError } from "@trpc/server";
+import {
+  throwUnauthorized,
+  throwForbidden,
+  throwNotFound,
+  throwBadRequest,
+  throwInternal,
+} from "../errors";
+
+function expectThrowsTRPCError(fn: () => never, code: string, message: string) {
+  try {
+    fn();
+    expect.unreachable("Should have thrown");
+  } catch (err) {
+    expect(err).toBeInstanceOf(TRPCError);
+    const trpcErr = err as TRPCError;
+    expect(trpcErr.code).toBe(code);
+    expect(trpcErr.message).toBe(message);
+  }
+}
+
+describe("throwUnauthorized", () => {
+  it("throws UNAUTHORIZED with default message", () => {
+    expectThrowsTRPCError(throwUnauthorized, "UNAUTHORIZED", "Unauthorized");
+  });
+
+  it("throws UNAUTHORIZED with custom message", () => {
+    expectThrowsTRPCError(() => throwUnauthorized("Custom message"), "UNAUTHORIZED", "Custom message");
+  });
+});
+
+describe("throwForbidden", () => {
+  it("throws FORBIDDEN with default message", () => {
+    expectThrowsTRPCError(throwForbidden, "FORBIDDEN", "Forbidden");
+  });
+
+  it("throws FORBIDDEN with custom message", () => {
+    expectThrowsTRPCError(() => throwForbidden("Access denied"), "FORBIDDEN", "Access denied");
+  });
+});
+
+describe("throwNotFound", () => {
+  it("throws NOT_FOUND with default resource message", () => {
+    expectThrowsTRPCError(throwNotFound, "NOT_FOUND", "Resource not found");
+  });
+
+  it("throws NOT_FOUND with custom resource name", () => {
+    expectThrowsTRPCError(() => throwNotFound("Question"), "NOT_FOUND", "Question not found");
+  });
+});
+
+describe("throwBadRequest", () => {
+  it("throws BAD_REQUEST with default message", () => {
+    expectThrowsTRPCError(throwBadRequest, "BAD_REQUEST", "Bad request");
+  });
+
+  it("throws BAD_REQUEST with custom message", () => {
+    expectThrowsTRPCError(() => throwBadRequest("Invalid input"), "BAD_REQUEST", "Invalid input");
+  });
+});
+
+describe("throwInternal", () => {
+  it("throws INTERNAL_SERVER_ERROR with default message", () => {
+    expectThrowsTRPCError(throwInternal, "INTERNAL_SERVER_ERROR", "Internal server error");
+  });
+
+  it("throws INTERNAL_SERVER_ERROR with custom message", () => {
+    expectThrowsTRPCError(() => throwInternal("DB connection failed"), "INTERNAL_SERVER_ERROR", "DB connection failed");
+  });
+});

packages/api/src/lib/__tests__/ownership.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "bun:test";
+import { TRPCError } from "@trpc/server";
+import { assertOwnership } from "../ownership";
+
+describe("assertOwnership", () => {
+  const userId = "user-123";
+
+  it("throws NOT_FOUND when row is null", () => {
+    try {
+      assertOwnership(null, userId);
+      expect.unreachable("Should have thrown");
+    } catch (err) {
+      expect(err).toBeInstanceOf(TRPCError);
+      expect((err as TRPCError).code).toBe("NOT_FOUND");
+      expect((err as TRPCError).message).toBe("Resource not found");
+    }
+  });
+
+  it("throws NOT_FOUND when row is undefined", () => {
+    try {
+      assertOwnership(undefined, userId);
+      expect.unreachable("Should have thrown");
+    } catch (err) {
+      expect(err).toBeInstanceOf(TRPCError);
+      expect((err as TRPCError).code).toBe("NOT_FOUND");
+    }
+  });
+
+  it("throws NOT_FOUND with custom resource name", () => {
+    try {
+      assertOwnership(null, userId, "Question");
+      expect.unreachable("Should have thrown");
+    } catch (err) {
+      expect(err).toBeInstanceOf(TRPCError);
+      expect((err as TRPCError).code).toBe("NOT_FOUND");
+      expect((err as TRPCError).message).toBe("Question not found");
+    }
+  });
+
+  it("throws FORBIDDEN when creatorUserId does not match", () => {
+    try {
+      assertOwnership({ creatorUserId: "other-user" }, userId);
+      expect.unreachable("Should have thrown");
+    } catch (err) {
+      expect(err).toBeInstanceOf(TRPCError);
+      expect((err as TRPCError).code).toBe("FORBIDDEN");
+    }
+  });
+
+  it("throws FORBIDDEN when creatorUserId is null and userId is provided", () => {
+    try {
+      assertOwnership({ creatorUserId: null }, userId);
+      expect.unreachable("Should have thrown");
+    } catch (err) {
+      expect(err).toBeInstanceOf(TRPCError);
+      expect((err as TRPCError).code).toBe("FORBIDDEN");
+    }
+  });
+
+  it("does not throw when creatorUserId matches userId", () => {
+    expect(() => assertOwnership({ creatorUserId: userId }, userId)).not.toThrow();
+  });
+});

packages/api/src/lib/__tests__/pagination.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "bun:test";
+import { SQL } from "drizzle-orm";
+import { paginationSchema, paginateDefaults, countSql } from "../pagination";
+
+describe("paginationSchema", () => {
+  it("parses valid input with defaults", () => {
+    const result = paginationSchema.parse({});
+    expect(result).toEqual({ limit: 20, offset: 0 });
+  });
+
+  it("parses with custom limit and offset", () => {
+    const result = paginationSchema.parse({ limit: 10, offset: 5 });
+    expect(result).toEqual({ limit: 10, offset: 5 });
+  });
+
+  it("rejects limit below minimum", () => {
+    expect(() => paginationSchema.parse({ limit: 0 })).toThrow();
+  });
+
+  it("rejects limit above maximum", () => {
+    expect(() => paginationSchema.parse({ limit: 100 })).toThrow();
+  });
+
+  it("rejects negative offset", () => {
+    expect(() => paginationSchema.parse({ offset: -1 })).toThrow();
+  });
+});
+
+describe("paginateDefaults", () => {
+  it("returns defaults when input is undefined", () => {
+    expect(paginateDefaults()).toEqual({ limit: 20, offset: 0 });
+  });
+
+  it("returns defaults when input is empty", () => {
+    expect(paginateDefaults({})).toEqual({ limit: 20, offset: 0 });
+  });
+
+  it("uses provided limit", () => {
+    expect(paginateDefaults({ limit: 5 })).toEqual({ limit: 5, offset: 0 });
+  });
+
+  it("uses provided offset", () => {
+    expect(paginateDefaults({ offset: 10 })).toEqual({ limit: 20, offset: 10 });
+  });
+});
+
+describe("countSql", () => {
+  it("returns a SQL instance", () => {
+    const result = countSql("*");
+    expect(result).toBeInstanceOf(SQL);
+  });
+});

packages/api/src/lib/__tests__/visibility.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "bun:test";
+import { SQL } from "drizzle-orm";
+import { buildVisibilityCondition } from "../visibility";
+
+const mockTable = {
+  isPublic: { name: "isPublic" } as any,
+  creatorUserId: { name: "creatorUserId" } as any,
+};
+
+describe("buildVisibilityCondition", () => {
+  it("returns SQL condition when no userId (public only)", () => {
+    const result = buildVisibilityCondition(mockTable);
+    expect(result).toBeInstanceOf(SQL);
+  });
+
+  it("returns SQL condition when userId provided (public or own)", () => {
+    const result = buildVisibilityCondition(mockTable, "user-123");
+    expect(result).toBeInstanceOf(SQL);
+  });
+});

packages/api/src/queue.ts

@@ -27,7 +27,7 @@ const HEARTBEAT_MS = 10_000;
 const MAX_QUESTIONS_PER_SHARD = 6;
 const FAST_SHARD_CONCURRENCY = 3;
 const QUALITY_SECTION_CONCURRENCY = 2;
-const MAX_SHARD_RETRIES = 2;
+export const MAX_SHARD_RETRIES = 2;
 
 interface SectionSplit {
   section: string;
@@ -78,7 +78,7 @@ export class GenerationJobCancelledError extends Error {
   }
 }
 
-function computeSectionSplit(
+export function computeSectionSplit(
   selectedSections: string[],
   count: number,
 ): SectionSplit[] {
@@ -94,7 +94,7 @@ function computeSectionSplit(
   }));
 }
 
-function splitIntoShards(sectionSplits: SectionSplit[]): ShardPlan[] {
+export function splitIntoShards(sectionSplits: SectionSplit[]): ShardPlan[] {
   const shards: ShardPlan[] = [];
   for (let sectionIndex = 0; sectionIndex < sectionSplits.length; sectionIndex++) {
     const split = sectionSplits[sectionIndex]!;
@@ -136,7 +136,7 @@ function createCancellationPoller(jobId: string) {
   };
 }
 
-async function runWithConcurrency<T, R>(
+export async function runWithConcurrency<T, R>(
   items: T[],
   concurrency: number,
   worker: (item: T, index: number) => Promise<R>,
@@ -156,7 +156,7 @@ async function runWithConcurrency<T, R>(
   return results;
 }
 
-function normalizeQuestions(
+export function normalizeQuestions(
   section: string,
   model: string,
   result: GenerationResult,

packages/api/src/routers/attempt.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { eq, and, desc, sql, inArray } from "drizzle-orm";
+import { eq, and, desc, sql, inArray, ilike } from "drizzle-orm";
 import { router, protectedProcedure } from "../index";
 import { db } from "@labas/db";
 import {
@@ -627,6 +627,8 @@ export const attemptRouter = router({
       z
         .object({
           packageId: z.string().uuid().optional(),
+          examTypeId: z.string().optional(),
+          search: z.string().optional(),
           ...paginationSchema.shape,
         })
         .optional(),
@@ -639,6 +641,12 @@ export const attemptRouter = router({
       if (input?.packageId) {
         conditions.push(eq(testAttempt.packageId, input.packageId));
       }
+      if (input?.examTypeId) {
+        conditions.push(eq(testPackage.examTypeId, input.examTypeId));
+      }
+      if (input?.search) {
+        conditions.push(ilike(testPackage.title, `%${input.search}%`));
+      }
 
       const where = and(...conditions);
 
@@ -668,6 +676,7 @@ export const attemptRouter = router({
       const [countResult] = await db
         .select({ count: sql<number>`count(*)` })
         .from(testAttempt)
+        .leftJoin(testPackage, eq(testAttempt.packageId, testPackage.id))
         .where(where);
       const totalCount = Number(countResult?.count ?? 0);
 

packages/api/src/routers/question.ts

@@ -82,9 +82,11 @@ export const questionRouter = router({
 
       if (input?.creatorUserId) {
         conditions.push(eq(question.creatorUserId, input.creatorUserId));
-      } else if (input?.isPublic !== undefined) {
+      }
+
+      if (input?.isPublic !== undefined) {
         conditions.push(eq(question.isPublic, input.isPublic));
-      } else {
+      } else if (!input?.creatorUserId) {
         const vis = buildVisibilityCondition(question, userId);
         if (vis) conditions.push(vis);
       }
@@ -296,15 +298,19 @@ export const questionRouter = router({
         .from(question)
         .where(inArray(question.id, input.ids));
 
-      for (const row of rows) {
-        assertOwnership(row, ctx.session.user.id, "Question");
+      const ownRows = rows.filter((r) => r.creatorUserId === ctx.session.user.id);
+      const skipped = rows.length - ownRows.length;
+
+      if (ownRows.length === 0) {
+        throwNotFound("Question");
       }
 
+      const ownIds = ownRows.map((r) => r.id);
       await db
         .update(question)
         .set({ isPublic: true })
-        .where(inArray(question.id, input.ids));
+        .where(inArray(question.id, ownIds));
 
-      return { success: true, updated: rows.length };
+      return { success: true, updated: ownRows.length, skipped };
     }),
 });