diff --git a/apps/api/prisma/migrations/20260808120000_add_quest_story_lore_types/migration.sql b/apps/api/prisma/migrations/20260808120000_add_quest_story_lore_types/migration.sql
new file mode 100644
index 0000000..65812f7
--- /dev/null
+++ b/apps/api/prisma/migrations/20260808120000_add_quest_story_lore_types/migration.sql
@@ -0,0 +1,2 @@
+ALTER TYPE "LoreType" ADD VALUE IF NOT EXISTS 'QUEST';
+ALTER TYPE "LoreType" ADD VALUE IF NOT EXISTS 'STORY';
diff --git a/apps/api/prisma/schema.prisma b/apps/api/prisma/schema.prisma
index 07028b0..5d66a15 100644
--- a/apps/api/prisma/schema.prisma
+++ b/apps/api/prisma/schema.prisma
@@ -12,7 +12,9 @@ enum LoreType {
   CHARACTER
   LOCATION
   FACTION
+  QUEST
   EVENT
+  STORY
   ARTIFACT
   HISTORY
   RULE
diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index 944811f..59583cd 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -5,6 +5,7 @@ import { env } from './config/env.js';
 import { registerAuthRoutes } from './routes/auth.js';
 import { registerContributionRoutes } from './routes/contributions.js';
 import { registerHealthRoute } from './routes/health.js';
+import { registerLoreRoutes } from './routes/lore.js';
 import { registerWorldRoutes } from './routes/worlds.js';
 
 export async function buildApp() {
@@ -35,6 +36,7 @@ export async function buildApp() {
   await registerHealthRoute(app);
   await registerAuthRoutes(app);
   await registerWorldRoutes(app);
+  await registerLoreRoutes(app);
   await registerContributionRoutes(app);
 
   return app;
diff --git a/apps/api/src/routes/lore.test.ts b/apps/api/src/routes/lore.test.ts
new file mode 100644
index 0000000..7a8e203
--- /dev/null
+++ b/apps/api/src/routes/lore.test.ts
@@ -0,0 +1,483 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+
+import Fastify from 'fastify';
+
+import { env } from '../config/env.js';
+import { LoreStatus, LoreType, PlatformRole, WorldRole } from '../generated/prisma/enums.js';
+import { signAccessToken } from '../lib/auth-crypto.js';
+import { registerLoreRoutes } from './lore.js';
+
+const author = {
+  hiveUsername: 'mira-vale.dev',
+  id: 'user-author',
+  normalizedHiveUsername: 'mira-vale.dev',
+};
+
+const otherUser = {
+  hiveUsername: 'emberquill.dev',
+  id: 'user-other',
+  normalizedHiveUsername: 'emberquill.dev',
+};
+
+const curator = {
+  hiveUsername: 'curator.dev',
+  id: 'user-curator',
+  normalizedHiveUsername: 'curator.dev',
+};
+
+function authHeader(user = author) {
+  const token = signAccessToken(
+    {
+      hiveUsername: user.hiveUsername,
+      normalizedHiveUsername: user.normalizedHiveUsername,
+      platformRole: PlatformRole.USER,
+      sid: `session-${user.id}`,
+      sub: user.id,
+    },
+    {
+      audience: env.AUTH_JWT_AUDIENCE,
+      issuer: env.AUTH_JWT_ISSUER,
+      secret: env.AUTH_JWT_SECRET,
+      ttlSeconds: 900,
+    },
+  );
+
+  return {
+    authorization: `Bearer ${token}`,
+  };
+}
+
+function now() {
+  return new Date('2026-08-08T12:00:00.000Z');
+}
+
+type StoredLoreEntry = {
+  id: string;
+  worldId: string;
+  authorId: string;
+  title: string;
+  slug: string;
+  loreType: LoreType;
+  content: unknown;
+  status: LoreStatus;
+  publishedAt: Date | null;
+  hiveReferenceId: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+function createLoreRecord(input: Partial<StoredLoreEntry> = {}): StoredLoreEntry {
+  return {
+    authorId: author.id,
+    content: {
+      body: 'A safe body.',
+      summary: 'A short summary.',
+    },
+    createdAt: now(),
+    hiveReferenceId: null,
+    id: `lore-${Math.random().toString(36).slice(2)}`,
+    loreType: LoreType.CHARACTER,
+    publishedAt: null,
+    slug: 'safe-body',
+    status: LoreStatus.DRAFT,
+    title: 'Safe Body',
+    updatedAt: now(),
+    worldId: 'world-1',
+    ...input,
+  };
+}
+
+function createDatabase() {
+  const worlds = [{ id: 'world-1' }, { id: 'world-2' }];
+  const users = [author, otherUser, curator];
+  const loreEntries: StoredLoreEntry[] = [];
+  const memberships = [
+    {
+      id: 'membership-author',
+      revokedAt: null,
+      role: WorldRole.CONTRIBUTOR,
+      userId: author.id,
+      worldId: 'world-1',
+    },
+    {
+      id: 'membership-other',
+      revokedAt: null,
+      role: WorldRole.READER,
+      userId: otherUser.id,
+      worldId: 'world-1',
+    },
+    {
+      id: 'membership-curator',
+      revokedAt: null,
+      role: WorldRole.CURATOR,
+      userId: curator.id,
+      worldId: 'world-1',
+    },
+  ];
+
+  function includeLore(entry: StoredLoreEntry) {
+    const user = users.find((candidate) => candidate.id === entry.authorId) ?? author;
+
+    return {
+      ...entry,
+      author: {
+        avatarUrl: null,
+        displayName: null,
+        hiveUsername: user.hiveUsername,
+        id: user.id,
+      },
+      incomingRelations: [],
+      outgoingRelations: [],
+    };
+  }
+
+  function matchesWhere(entry: StoredLoreEntry, where: Record<string, unknown>): boolean {
+    return Object.entries(where).every(([key, value]) => {
+      if (key === 'OR' && Array.isArray(value)) {
+        return value.some((condition): boolean =>
+          matchesWhere(entry, condition as Record<string, unknown>),
+        );
+      }
+
+      if (key === 'title' && value && typeof value === 'object' && 'contains' in value) {
+        return entry.title
+          .toLowerCase()
+          .includes(String((value as { contains: string }).contains).toLowerCase());
+      }
+
+      return entry[key as keyof StoredLoreEntry] === value;
+    });
+  }
+
+  const database = {
+    async $transaction<T>(callback: (transaction: unknown) => Promise<T>) {
+      return callback(database);
+    },
+    loreEntry: {
+      async count(args: { where: Record<string, unknown> }) {
+        return loreEntries.filter((entry) => matchesWhere(entry, args.where)).length;
+      },
+      async create(args: { data: Partial<StoredLoreEntry> }) {
+        const entry = createLoreRecord({
+          id: `lore-${loreEntries.length + 1}`,
+          ...args.data,
+        });
+        loreEntries.push(entry);
+        return includeLore(entry);
+      },
+      async delete(args: { where: { id: string } }) {
+        const index = loreEntries.findIndex((entry) => entry.id === args.where.id);
+        const [deleted] = loreEntries.splice(index, 1);
+        return deleted;
+      },
+      async findFirst(args: { where: Record<string, unknown> }) {
+        const entry = loreEntries.find((candidate) => matchesWhere(candidate, args.where)) ?? null;
+        return entry ? includeLore(entry) : null;
+      },
+      async findMany(args: { skip: number; take: number; where: Record<string, unknown> }) {
+        return loreEntries
+          .filter((entry) => matchesWhere(entry, args.where))
+          .sort((left, right) => right.updatedAt.getTime() - left.updatedAt.getTime())
+          .slice(args.skip, args.skip + args.take)
+          .map(includeLore);
+      },
+      async update(args: { data: Partial<StoredLoreEntry>; where: { id: string } }) {
+        const entry = loreEntries.find((candidate) => candidate.id === args.where.id);
+
+        if (!entry) {
+          throw new Error('Lore entry missing.');
+        }
+
+        Object.assign(entry, args.data, {
+          updatedAt: now(),
+        });
+
+        return includeLore(entry);
+      },
+    },
+    world: {
+      async findUnique(args: { where: { id: string } }) {
+        return worlds.find((world) => world.id === args.where.id) ?? null;
+      },
+    },
+    worldMembership: {
+      async findUnique(args: {
+        where: { worldId_userId: { worldId: string; userId: string }; revokedAt: null };
+      }) {
+        return (
+          memberships.find(
+            (membership) =>
+              membership.worldId === args.where.worldId_userId.worldId &&
+              membership.userId === args.where.worldId_userId.userId &&
+              !membership.revokedAt,
+          ) ?? null
+        );
+      },
+    },
+  };
+
+  return {
+    database,
+    loreEntries,
+    memberships,
+  };
+}
+
+async function createApp(database: ReturnType<typeof createDatabase>['database']) {
+  const app = Fastify();
+  await registerLoreRoutes(app, {
+    database: database as never,
+  });
+  return app;
+}
+
+describe('lore routes', () => {
+  test('public list and read expose only published canon by default', async () => {
+    const state = createDatabase();
+    state.loreEntries.push(
+      createLoreRecord({
+        id: 'published-1',
+        publishedAt: now(),
+        status: LoreStatus.PUBLISHED_CANON,
+        title: 'Published Canon',
+      }),
+    );
+    state.loreEntries.push(createLoreRecord({ id: 'draft-1', title: 'Private Draft' }));
+    const app = await createApp(state.database);
+
+    const listResponse = await app.inject({
+      method: 'GET',
+      url: '/worlds/world-1/lore',
+    });
+    const draftReadResponse = await app.inject({
+      method: 'GET',
+      url: '/worlds/world-1/lore/draft-1',
+    });
+
+    assert.equal(listResponse.statusCode, 200);
+    assert.deepEqual(
+      listResponse.json().entries.map((entry: { id: string }) => entry.id),
+      ['published-1'],
+    );
+    assert.equal(draftReadResponse.statusCode, 404);
+    await app.close();
+  });
+
+  test('draft lists require auth and scope contributors to their own drafts', async () => {
+    const state = createDatabase();
+    state.memberships.find((membership) => membership.userId === otherUser.id)!.role =
+      WorldRole.CONTRIBUTOR;
+    state.loreEntries.push(createLoreRecord({ id: 'own-draft' }));
+    state.loreEntries.push(createLoreRecord({ authorId: otherUser.id, id: 'other-draft' }));
+    const app = await createApp(state.database);
+
+    const anonymousResponse = await app.inject({
+      method: 'GET',
+      url: '/worlds/world-1/lore?status=DRAFT',
+    });
+    const authorResponse = await app.inject({
+      headers: authHeader(),
+      method: 'GET',
+      url: '/worlds/world-1/lore?status=DRAFT',
+    });
+    const curatorResponse = await app.inject({
+      headers: authHeader(curator),
+      method: 'GET',
+      url: '/worlds/world-1/lore?status=DRAFT',
+    });
+
+    assert.equal(anonymousResponse.statusCode, 401);
+    assert.deepEqual(
+      authorResponse.json().entries.map((entry: { id: string }) => entry.id),
+      ['own-draft'],
+    );
+    assert.deepEqual(
+      curatorResponse
+        .json()
+        .entries.map((entry: { id: string }) => entry.id)
+        .sort(),
+      ['other-draft', 'own-draft'],
+    );
+    await app.close();
+  });
+
+  test('create is draft-only, permission gated, validates caps, and sanitizes stored strings', async () => {
+    const state = createDatabase();
+    const app = await createApp(state.database);
+
+    const unauthenticated = await app.inject({
+      method: 'POST',
+      payload: {
+        content: { body: 'A body.', summary: 'A summary.' },
+        loreType: LoreType.QUEST,
+        title: 'Quest',
+      },
+      url: '/worlds/world-1/lore',
+    });
+    const forbidden = await app.inject({
+      headers: authHeader(otherUser),
+      method: 'POST',
+      payload: {
+        content: { body: 'A body.', summary: 'A summary.' },
+        loreType: LoreType.QUEST,
+        title: 'Quest',
+      },
+      url: '/worlds/world-1/lore',
+    });
+    const selfPublish = await app.inject({
+      headers: authHeader(),
+      method: 'POST',
+      payload: {
+        content: { body: 'A body.', summary: 'A summary.' },
+        loreType: LoreType.QUEST,
+        status: LoreStatus.PUBLISHED_CANON,
+        title: 'Quest',
+      },
+      url: '/worlds/world-1/lore',
+    });
+    const oversizedSummary = await app.inject({
+      headers: authHeader(),
+      method: 'POST',
+      payload: {
+        content: { body: 'A body.', summary: 'x'.repeat(1_001) },
+        loreType: LoreType.QUEST,
+        title: 'Quest',
+      },
+      url: '/worlds/world-1/lore',
+    });
+    const created = await app.inject({
+      headers: authHeader(),
+      method: 'POST',
+      payload: {
+        content: {
+          body: '<script>alert("owned")</script>',
+          fields: {
+            hook: '<img src=x onerror=alert(1)>',
+          },
+          summary: 'A summary.',
+        },
+        loreType: LoreType.QUEST,
+        title: '  The First Quest  ',
+      },
+      url: '/worlds/world-1/lore',
+    });
+
+    assert.equal(unauthenticated.statusCode, 401);
+    assert.equal(forbidden.statusCode, 403);
+    assert.equal(selfPublish.statusCode, 400);
+    assert.equal(oversizedSummary.statusCode, 400);
+    assert.equal(created.statusCode, 201);
+    assert.equal(created.json().entry.status, LoreStatus.DRAFT);
+    assert.equal(created.json().entry.loreType, LoreType.QUEST);
+    assert.equal(created.json().entry.title, 'The First Quest');
+    assert.equal(created.json().entry.content.body.includes('<script>'), false);
+    assert.equal(created.json().entry.content.body.includes('&lt;script&gt;'), true);
+    await app.close();
+  });
+
+  test('update and delete are limited to editable drafts and never mutate canon', async () => {
+    const state = createDatabase();
+    state.memberships.find((membership) => membership.userId === otherUser.id)!.role =
+      WorldRole.CONTRIBUTOR;
+    state.loreEntries.push(createLoreRecord({ id: 'draft-1' }));
+    state.loreEntries.push(
+      createLoreRecord({
+        id: 'canon-1',
+        publishedAt: now(),
+        status: LoreStatus.PUBLISHED_CANON,
+      }),
+    );
+    const app = await createApp(state.database);
+
+    const otherUpdate = await app.inject({
+      headers: authHeader(otherUser),
+      method: 'PATCH',
+      payload: { title: 'Nope' },
+      url: '/worlds/world-1/lore/draft-1',
+    });
+    const selfPublishUpdate = await app.inject({
+      headers: authHeader(),
+      method: 'PATCH',
+      payload: { status: LoreStatus.PUBLISHED_CANON },
+      url: '/worlds/world-1/lore/draft-1',
+    });
+    const update = await app.inject({
+      headers: authHeader(),
+      method: 'PATCH',
+      payload: {
+        content: { body: 'Updated.', summary: 'Updated summary.' },
+        loreType: LoreType.STORY,
+        title: 'Updated Draft',
+      },
+      url: '/worlds/world-1/lore/draft-1',
+    });
+    const canonDelete = await app.inject({
+      headers: authHeader(curator),
+      method: 'DELETE',
+      url: '/worlds/world-1/lore/canon-1',
+    });
+    const deleteResponse = await app.inject({
+      headers: authHeader(),
+      method: 'DELETE',
+      url: '/worlds/world-1/lore/draft-1',
+    });
+
+    assert.equal(otherUpdate.statusCode, 403);
+    assert.equal(selfPublishUpdate.statusCode, 400);
+    assert.equal(update.statusCode, 200);
+    assert.equal(update.json().entry.loreType, LoreType.STORY);
+    assert.equal(canonDelete.statusCode, 409);
+    assert.equal(deleteResponse.statusCode, 200);
+    assert.equal(deleteResponse.json().ok, true);
+    assert.equal(
+      state.loreEntries.some((entry) => entry.id === 'draft-1'),
+      false,
+    );
+    assert.equal(
+      state.loreEntries.some((entry) => entry.id === 'canon-1'),
+      true,
+    );
+    await app.close();
+  });
+
+  test('quest and story are distinct filterable lore types', async () => {
+    const state = createDatabase();
+    state.loreEntries.push(
+      createLoreRecord({
+        id: 'quest-1',
+        loreType: LoreType.QUEST,
+        publishedAt: now(),
+        status: LoreStatus.PUBLISHED_CANON,
+      }),
+    );
+    state.loreEntries.push(
+      createLoreRecord({
+        id: 'story-1',
+        loreType: LoreType.STORY,
+        publishedAt: now(),
+        status: LoreStatus.PUBLISHED_CANON,
+      }),
+    );
+    const app = await createApp(state.database);
+
+    const questResponse = await app.inject({
+      method: 'GET',
+      url: '/worlds/world-1/lore?loreType=QUEST',
+    });
+    const storyResponse = await app.inject({
+      method: 'GET',
+      url: '/worlds/world-1/lore?loreType=STORY',
+    });
+
+    assert.deepEqual(
+      questResponse.json().entries.map((entry: { id: string }) => entry.id),
+      ['quest-1'],
+    );
+    assert.deepEqual(
+      storyResponse.json().entries.map((entry: { id: string }) => entry.id),
+      ['story-1'],
+    );
+    await app.close();
+  });
+});
diff --git a/apps/api/src/routes/lore.ts b/apps/api/src/routes/lore.ts
new file mode 100644
index 0000000..fc3b01d
--- /dev/null
+++ b/apps/api/src/routes/lore.ts
@@ -0,0 +1,788 @@
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import { z } from 'zod';
+
+import { env } from '../config/env.js';
+import type { Prisma, PrismaClient } from '../generated/prisma/client.js';
+import { LoreStatus, LoreType } from '../generated/prisma/enums.js';
+import { authenticateRequest, requireSession } from '../lib/auth-middleware.js';
+import { prisma } from '../lib/prisma.js';
+import {
+  authorizeWorldPermission,
+  resolveWorldMembership,
+  type WorldMembershipLookup,
+} from '../lib/world-authorization.js';
+import { roleHasWorldPermission, WORLD_PERMISSIONS } from '../lib/world-permissions.js';
+
+const STRUCTURED_CONTENT_MAX_BYTES = 100 * 1024;
+
+type LoreDatabase = Pick<PrismaClient, '$transaction' | 'loreEntry' | 'world' | 'worldMembership'>;
+
+type RegisterLoreRoutesOptions = {
+  database?: LoreDatabase & WorldMembershipLookup;
+};
+
+const routeParamsSchema = z.object({
+  entryId: z.string().min(1).optional(),
+  worldId: z.string().min(1),
+});
+
+const loreTypeSchema = z.enum([
+  LoreType.CHARACTER,
+  LoreType.LOCATION,
+  LoreType.FACTION,
+  LoreType.QUEST,
+  LoreType.EVENT,
+  LoreType.STORY,
+  LoreType.ARTIFACT,
+  LoreType.HISTORY,
+  LoreType.RULE,
+  LoreType.OTHER,
+]);
+
+const loreStatusSchema = z.enum([
+  LoreStatus.DRAFT,
+  LoreStatus.SUBMITTED,
+  LoreStatus.APPROVED_FOR_PUBLICATION,
+  LoreStatus.PUBLISHED_CANON,
+  LoreStatus.ARCHIVED,
+]);
+
+const listLoreQuerySchema = z.object({
+  loreType: loreTypeSchema.optional(),
+  page: z.coerce.number().int().positive().default(1),
+  pageSize: z.coerce.number().int().positive().max(100).default(20),
+  q: z.string().trim().max(200).optional(),
+  status: loreStatusSchema.optional(),
+});
+
+const createLoreBodySchema = z
+  .object({
+    content: z.unknown(),
+    loreType: loreTypeSchema,
+    status: z.literal(LoreStatus.DRAFT).optional(),
+    title: z.string().trim().min(1).max(200),
+  })
+  .strict();
+
+const updateLoreBodySchema = z
+  .object({
+    content: z.unknown().optional(),
+    loreType: loreTypeSchema.optional(),
+    status: z.literal(LoreStatus.DRAFT).optional(),
+    title: z.string().trim().min(1).max(200).optional(),
+  })
+  .strict()
+  .refine((value) => Object.keys(value).length > 0, {
+    message: 'At least one editable lore field is required.',
+  });
+
+const loreEntryInclude = {
+  author: {
+    select: {
+      avatarUrl: true,
+      displayName: true,
+      hiveUsername: true,
+      id: true,
+    },
+  },
+  incomingRelations: {
+    select: {
+      id: true,
+      relationType: true,
+      source: {
+        select: {
+          id: true,
+          loreType: true,
+          slug: true,
+          status: true,
+          title: true,
+        },
+      },
+    },
+  },
+  outgoingRelations: {
+    select: {
+      id: true,
+      relationType: true,
+      target: {
+        select: {
+          id: true,
+          loreType: true,
+          slug: true,
+          status: true,
+          title: true,
+        },
+      },
+    },
+  },
+} as const;
+
+type LoreEntryWithRelations = Prisma.LoreEntryGetPayload<{
+  include: typeof loreEntryInclude;
+}>;
+
+class LoreRouteError extends Error {
+  constructor(
+    public readonly statusCode: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+function authOptions() {
+  return {
+    audience: env.AUTH_JWT_AUDIENCE,
+    issuer: env.AUTH_JWT_ISSUER,
+    jwtSecret: env.AUTH_JWT_SECRET,
+  };
+}
+
+function serializeDate(value: Date | null) {
+  return value?.toISOString() ?? null;
+}
+
+function serializeLoreEntry(entry: LoreEntryWithRelations) {
+  return {
+    author: entry.author,
+    authorId: entry.authorId,
+    content: entry.content,
+    createdAt: entry.createdAt.toISOString(),
+    hiveReferenceId: entry.hiveReferenceId,
+    id: entry.id,
+    incomingRelations: entry.incomingRelations,
+    loreType: entry.loreType,
+    outgoingRelations: entry.outgoingRelations,
+    publishedAt: serializeDate(entry.publishedAt),
+    slug: entry.slug,
+    status: entry.status,
+    title: entry.title,
+    updatedAt: entry.updatedAt.toISOString(),
+    worldId: entry.worldId,
+  };
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)
+  );
+}
+
+function escapeHtml(value: string) {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function sanitizeStructuredContent(value: unknown): Prisma.InputJsonValue {
+  if (typeof value === 'string') {
+    return escapeHtml(value);
+  }
+
+  if (Array.isArray(value)) {
+    return value.map(sanitizeStructuredContent) as Prisma.InputJsonArray;
+  }
+
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, nestedValue]) => [
+        key,
+        sanitizeStructuredContent(nestedValue),
+      ]),
+    ) as Prisma.InputJsonObject;
+  }
+
+  if (value === null) {
+    return value as unknown as Prisma.InputJsonValue;
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return value;
+  }
+
+  throw new LoreRouteError(400, 'Lore content must be JSON-serializable.');
+}
+
+function validateLoreContent(value: unknown) {
+  if (!isPlainObject(value)) {
+    throw new LoreRouteError(400, 'Lore content must be a JSON object.');
+  }
+
+  const serialized = JSON.stringify(value);
+
+  if (!serialized || Buffer.byteLength(serialized, 'utf8') > STRUCTURED_CONTENT_MAX_BYTES) {
+    throw new LoreRouteError(400, 'Lore content exceeds the 100 KB limit.');
+  }
+
+  const summary = value.summary;
+
+  if (summary !== undefined && (typeof summary !== 'string' || summary.trim().length > 1_000)) {
+    throw new LoreRouteError(400, 'Lore summary must be at most 1000 characters.');
+  }
+
+  const body = value.body;
+
+  if (body !== undefined && typeof body !== 'string') {
+    throw new LoreRouteError(400, 'Lore body must be a string.');
+  }
+
+  return sanitizeStructuredContent(value);
+}
+
+function normalizeTitle(title: string) {
+  const normalized = title.trim();
+
+  if (!normalized) {
+    throw new LoreRouteError(400, 'Lore title is required.');
+  }
+
+  if (normalized.length > 200) {
+    throw new LoreRouteError(400, 'Lore title must be at most 200 characters.');
+  }
+
+  return normalized;
+}
+
+function slugify(title: string) {
+  const slug = title
+    .toLowerCase()
+    .normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 80);
+
+  return slug || 'lore-entry';
+}
+
+async function createUniqueSlug(
+  database: Pick<LoreDatabase, 'loreEntry'>,
+  worldId: string,
+  title: string,
+  excludeEntryId?: string,
+) {
+  const baseSlug = slugify(title);
+
+  for (let suffix = 0; suffix < 100; suffix += 1) {
+    const slug = suffix === 0 ? baseSlug : `${baseSlug}-${suffix + 1}`;
+    const existing = await database.loreEntry.findFirst({
+      select: {
+        id: true,
+      },
+      where: {
+        slug,
+        worldId,
+      },
+    });
+
+    if (!existing || existing.id === excludeEntryId) {
+      return slug;
+    }
+  }
+
+  throw new LoreRouteError(409, 'Unable to generate a unique lore slug.');
+}
+
+async function ensureWorldExists(
+  database: Pick<LoreDatabase, 'world'>,
+  worldId: string,
+  reply: FastifyReply,
+) {
+  const world = await database.world.findUnique({
+    select: {
+      id: true,
+    },
+    where: {
+      id: worldId,
+    },
+  });
+
+  if (!world) {
+    await reply.code(404).send({
+      error: 'World not found.',
+    });
+
+    return false;
+  }
+
+  return true;
+}
+
+function sendLoreError(error: unknown, reply: FastifyReply) {
+  if (error instanceof LoreRouteError) {
+    return reply.code(error.statusCode).send({
+      error: error.message,
+    });
+  }
+
+  throw error;
+}
+
+async function authenticateOptional(request: FastifyRequest) {
+  return authenticateRequest(request, authOptions());
+}
+
+async function canReadNonPublicLore(
+  request: FastifyRequest,
+  database: LoreDatabase & WorldMembershipLookup,
+  worldId: string,
+  authorId?: string,
+) {
+  const user = request.user;
+
+  if (!user) {
+    return false;
+  }
+
+  const membership = await resolveWorldMembership(request, worldId, database);
+
+  if (!membership) {
+    return false;
+  }
+
+  if (roleHasWorldPermission(membership.role, WORLD_PERMISSIONS.EDIT_ANY_DRAFT)) {
+    return true;
+  }
+
+  return (
+    authorId === user.id &&
+    roleHasWorldPermission(membership.role, WORLD_PERMISSIONS.EDIT_OWN_DRAFT)
+  );
+}
+
+async function scopeNonPublicLoreList(
+  request: FastifyRequest,
+  database: LoreDatabase & WorldMembershipLookup,
+  worldId: string,
+) {
+  const user = request.user;
+
+  if (!user) {
+    return {
+      allowed: false as const,
+      statusCode: 401 as const,
+      where: {},
+    };
+  }
+
+  const membership = await resolveWorldMembership(request, worldId, database);
+
+  if (!membership) {
+    return {
+      allowed: false as const,
+      statusCode: 403 as const,
+      where: {},
+    };
+  }
+
+  if (roleHasWorldPermission(membership.role, WORLD_PERMISSIONS.EDIT_ANY_DRAFT)) {
+    return {
+      allowed: true as const,
+      where: {},
+    };
+  }
+
+  if (roleHasWorldPermission(membership.role, WORLD_PERMISSIONS.EDIT_OWN_DRAFT)) {
+    return {
+      allowed: true as const,
+      where: {
+        authorId: user.id,
+      },
+    };
+  }
+
+  return {
+    allowed: false as const,
+    statusCode: 403 as const,
+    where: {},
+  };
+}
+
+async function canMutateDraft(
+  request: FastifyRequest,
+  database: LoreDatabase & WorldMembershipLookup,
+  worldId: string,
+  authorId: string,
+) {
+  const user = request.user;
+
+  if (!user) {
+    return false;
+  }
+
+  const membership = await resolveWorldMembership(request, worldId, database);
+
+  if (!membership) {
+    return false;
+  }
+
+  if (roleHasWorldPermission(membership.role, WORLD_PERMISSIONS.EDIT_ANY_DRAFT)) {
+    return true;
+  }
+
+  return (
+    authorId === user.id &&
+    roleHasWorldPermission(membership.role, WORLD_PERMISSIONS.EDIT_OWN_DRAFT)
+  );
+}
+
+export async function registerLoreRoutes(
+  app: FastifyInstance,
+  options: RegisterLoreRoutesOptions = {},
+) {
+  const database = options.database ?? prisma;
+
+  app.get('/worlds/:worldId/lore', async (request, reply) => {
+    const params = routeParamsSchema.safeParse(request.params);
+    const query = listLoreQuerySchema.safeParse(request.query);
+
+    if (!params.success || !query.success) {
+      return reply.code(400).send({
+        error: 'Invalid lore query.',
+      });
+    }
+
+    const worldExists = await ensureWorldExists(database, params.data.worldId, reply);
+
+    if (!worldExists) {
+      return;
+    }
+
+    await authenticateOptional(request);
+
+    const requestedStatus = query.data.status ?? LoreStatus.PUBLISHED_CANON;
+    const page = query.data.page;
+    const pageSize = query.data.pageSize;
+    const where: Prisma.LoreEntryWhereInput = {
+      ...(query.data.loreType ? { loreType: query.data.loreType } : {}),
+      ...(query.data.q
+        ? {
+            OR: [
+              {
+                title: {
+                  contains: query.data.q,
+                  mode: 'insensitive',
+                },
+              },
+            ],
+          }
+        : {}),
+      status: requestedStatus,
+      worldId: params.data.worldId,
+    };
+
+    if (requestedStatus !== LoreStatus.PUBLISHED_CANON) {
+      const scope = await scopeNonPublicLoreList(request, database, params.data.worldId);
+
+      if (!scope.allowed) {
+        return reply.code(scope.statusCode).send({
+          error:
+            scope.statusCode === 401
+              ? 'Authentication required.'
+              : 'Insufficient world permissions.',
+        });
+      }
+
+      Object.assign(where, scope.where);
+    }
+
+    const [entries, total] = await Promise.all([
+      database.loreEntry.findMany({
+        include: loreEntryInclude,
+        orderBy: [
+          {
+            updatedAt: 'desc',
+          },
+          {
+            id: 'desc',
+          },
+        ],
+        skip: (page - 1) * pageSize,
+        take: pageSize,
+        where,
+      }),
+      database.loreEntry.count({
+        where,
+      }),
+    ]);
+
+    return {
+      entries: entries.map(serializeLoreEntry),
+      pagination: {
+        page,
+        pageSize,
+        total,
+      },
+    };
+  });
+
+  app.get('/worlds/:worldId/lore/:entryId', async (request, reply) => {
+    const params = routeParamsSchema.required().safeParse(request.params);
+
+    if (!params.success) {
+      return reply.code(400).send({
+        error: 'Invalid lore route.',
+      });
+    }
+
+    const worldExists = await ensureWorldExists(database, params.data.worldId, reply);
+
+    if (!worldExists) {
+      return;
+    }
+
+    await authenticateOptional(request);
+
+    const entry = await database.loreEntry.findFirst({
+      include: loreEntryInclude,
+      where: {
+        id: params.data.entryId,
+        worldId: params.data.worldId,
+      },
+    });
+
+    if (!entry) {
+      return reply.code(404).send({
+        error: 'Lore entry not found.',
+      });
+    }
+
+    if (entry.status !== LoreStatus.PUBLISHED_CANON) {
+      const permitted = await canReadNonPublicLore(
+        request,
+        database,
+        params.data.worldId,
+        entry.authorId,
+      );
+
+      if (!permitted) {
+        return reply.code(404).send({
+          error: 'Lore entry not found.',
+        });
+      }
+    }
+
+    return {
+      entry: serializeLoreEntry(entry),
+    };
+  });
+
+  app.post(
+    '/worlds/:worldId/lore',
+    {
+      preHandler: requireSession(authOptions()),
+    },
+    async (request, reply) => {
+      const params = routeParamsSchema.safeParse(request.params);
+      const body = createLoreBodySchema.safeParse(request.body);
+
+      if (!params.success || !body.success) {
+        return reply.code(400).send({
+          error: 'Invalid lore payload.',
+        });
+      }
+
+      const worldExists = await ensureWorldExists(database, params.data.worldId, reply);
+
+      if (!worldExists) {
+        return;
+      }
+
+      const authorized = await authorizeWorldPermission(
+        request,
+        reply,
+        params.data.worldId,
+        WORLD_PERMISSIONS.CREATE_LORE_DRAFT,
+        database,
+      );
+
+      if (!authorized || !request.user) {
+        return;
+      }
+
+      try {
+        const title = normalizeTitle(body.data.title);
+        const content = validateLoreContent(body.data.content);
+        const slug = await createUniqueSlug(database, params.data.worldId, title);
+        const entry = await database.loreEntry.create({
+          data: {
+            authorId: request.user.id,
+            content,
+            loreType: body.data.loreType,
+            publishedAt: null,
+            slug,
+            status: LoreStatus.DRAFT,
+            title,
+            worldId: params.data.worldId,
+          },
+          include: loreEntryInclude,
+        });
+
+        return reply.code(201).send({
+          entry: serializeLoreEntry(entry),
+        });
+      } catch (error) {
+        return sendLoreError(error, reply);
+      }
+    },
+  );
+
+  app.patch(
+    '/worlds/:worldId/lore/:entryId',
+    {
+      preHandler: requireSession(authOptions()),
+    },
+    async (request, reply) => {
+      const params = routeParamsSchema.required().safeParse(request.params);
+      const body = updateLoreBodySchema.safeParse(request.body);
+
+      if (!params.success || !body.success) {
+        return reply.code(400).send({
+          error: 'Invalid lore payload.',
+        });
+      }
+
+      const worldExists = await ensureWorldExists(database, params.data.worldId, reply);
+
+      if (!worldExists || !request.user) {
+        return;
+      }
+
+      const existing = await database.loreEntry.findFirst({
+        include: loreEntryInclude,
+        where: {
+          id: params.data.entryId,
+          worldId: params.data.worldId,
+        },
+      });
+
+      if (!existing) {
+        return reply.code(404).send({
+          error: 'Lore entry not found.',
+        });
+      }
+
+      if (existing.status !== LoreStatus.DRAFT) {
+        return reply.code(409).send({
+          error: 'Only draft lore entries can be edited here.',
+        });
+      }
+
+      const permitted = await canMutateDraft(
+        request,
+        database,
+        params.data.worldId,
+        existing.authorId,
+      );
+
+      if (!permitted) {
+        return reply.code(403).send({
+          error: 'Insufficient world permissions.',
+        });
+      }
+
+      try {
+        const data: Prisma.LoreEntryUpdateInput = {};
+
+        if (body.data.title !== undefined) {
+          const title = normalizeTitle(body.data.title);
+          data.title = title;
+          data.slug = await createUniqueSlug(database, params.data.worldId, title, existing.id);
+        }
+
+        if (body.data.loreType !== undefined) {
+          data.loreType = body.data.loreType;
+        }
+
+        if (body.data.content !== undefined) {
+          data.content = validateLoreContent(body.data.content);
+        }
+
+        const entry = await database.loreEntry.update({
+          data,
+          include: loreEntryInclude,
+          where: {
+            id: existing.id,
+          },
+        });
+
+        return {
+          entry: serializeLoreEntry(entry),
+        };
+      } catch (error) {
+        return sendLoreError(error, reply);
+      }
+    },
+  );
+
+  app.delete(
+    '/worlds/:worldId/lore/:entryId',
+    {
+      preHandler: requireSession(authOptions()),
+    },
+    async (request, reply) => {
+      const params = routeParamsSchema.required().safeParse(request.params);
+
+      if (!params.success) {
+        return reply.code(400).send({
+          error: 'Invalid lore route.',
+        });
+      }
+
+      const worldExists = await ensureWorldExists(database, params.data.worldId, reply);
+
+      if (!worldExists || !request.user) {
+        return;
+      }
+
+      const existing = await database.loreEntry.findFirst({
+        include: loreEntryInclude,
+        where: {
+          id: params.data.entryId,
+          worldId: params.data.worldId,
+        },
+      });
+
+      if (!existing) {
+        return reply.code(404).send({
+          error: 'Lore entry not found.',
+        });
+      }
+
+      if (existing.status !== LoreStatus.DRAFT) {
+        return reply.code(409).send({
+          error: 'Only draft lore entries can be deleted here.',
+        });
+      }
+
+      const permitted = await canMutateDraft(
+        request,
+        database,
+        params.data.worldId,
+        existing.authorId,
+      );
+
+      if (!permitted) {
+        return reply.code(403).send({
+          error: 'Insufficient world permissions.',
+        });
+      }
+
+      await database.loreEntry.delete({
+        where: {
+          id: existing.id,
+        },
+      });
+
+      return {
+        ok: true,
+      };
+    },
+  );
+}