emdash 0.40.1 → 0.42.0

package/src/database/repositories/revision.ts

@@ -110,6 +110,22 @@ export class RevisionRepository {
 		return row ? this.normalizeRow(row) : null;
 	}
 
+	/** Shallow-merge `patch` into a stored revision's data. */
+	async mergeData(id: string, patch: Record<string, unknown>): Promise<void> {
+		const row = await this.db
+			.selectFrom("revisions")
+			.select("data")
+			.where("id", "=", id)
+			.executeTakeFirst();
+		if (!row) return;
+		const data: Record<string, unknown> = { ...JSON.parse(row.data), ...patch };
+		await this.db
+			.updateTable("revisions")
+			.set({ data: JSON.stringify(data) })
+			.where("id", "=", id)
+			.execute();
+	}
+
 	/**
 	 * Get all revisions for an entry (newest first)
 	 *

package/src/database/repositories/types.ts

@@ -236,6 +236,18 @@ export interface FindManyResult<T> {
 	total?: number;
 }
 
+/**
+ * Order value stamped into a cursor over a *staged* reference selection, whose
+ * anchor is a translation group rather than a row in the link table.
+ *
+ * A preview and a public render page the same field from different places, so a
+ * cursor can cross that boundary in either direction — the draft publishes, or
+ * the preview session ends, mid-pagination. Both sides recognise this marker so
+ * they can tell a foreign cursor from a malformed one and restart the field's
+ * page rather than failing or silently emptying it.
+ */
+export const STAGED_CURSOR_MARKER = "staged";
+
 /** Encode a cursor from order value + id */
 export function encodeCursor(orderValue: string, id: string): string {
 	return encodeBase64(JSON.stringify({ orderValue, id }));
@@ -314,6 +326,32 @@ export interface ContentItem {
 	 * revision history.
 	 */
 	liveData?: Record<string, unknown>;
+	/**
+	 * First page of each reference field's resolved selection, keyed by field
+	 * slug. Only populated when the caller opts in via `handleContentGet`'s
+	 * `referenceOptions` param (see content.ts) — hydration is never
+	 * unconditional because it can leak draft ids/slugs to callers without
+	 * `content:read_drafts`.
+	 *
+	 * Shape mirrors `EntryRef` from `api/handlers/relations.ts`, duplicated
+	 * here (rather than imported) so the database layer doesn't depend on
+	 * the api/handlers layer.
+	 */
+	references?: Record<
+		string,
+		{
+			children: Array<{
+				id: string;
+				slug: string | null;
+				collection: string;
+				title: string | null;
+				locale: string | null;
+				translationGroup: string | null;
+				sortOrder?: number;
+			}>;
+			nextCursor?: string;
+		}
+	>;
 }
 
 export class EmDashValidationError extends Error {

package/src/database/transaction.ts

@@ -29,7 +29,18 @@ export async function withTransaction<DB, T>(
 	db: Kysely<DB>,
 	fn: (trx: Kysely<DB> | Transaction<DB>) => Promise<T>,
 ): Promise<T> {
-	if (db.isTransaction) return fn(db);
+	// Nested call: `db` is already a transaction. Kysely rejects calling
+	// `.transaction()` on a `Transaction` outright (a hard error, not the
+	// "transactions are not supported" message the probe below expects), so a
+	// naive nested `withTransaction(trx, ...)` call would always throw on any
+	// dialect that supports real transactions. Running `fn` directly against
+	// the existing transaction makes the nested work part of the enclosing
+	// one — exactly what nested callers (e.g. a handler composing two
+	// repositories that each self-wrap in `withTransaction`) want: the whole
+	// chain commits or rolls back together.
+	if (db.isTransaction) {
+		return fn(db);
+	}
 	// Fast path: we already know transactions work
 	if (transactionsSupported === true) {
 		return db.transaction().execute(fn);

package/src/database/types.ts

@@ -439,7 +439,7 @@ export interface CollectionTable {
 	label_singular: string | null;
 	description: string | null;
 	icon: string | null;
-	admin_config: Generated<string | null>; // JSON: { listColumns?: string[] }
+	admin_config: Generated<string | null>; // JSON: { listColumns?: string[]; quickCreate?: boolean }
 	supports: string | null; // JSON array
 	source: string | null;
 	search_config: string | null; // JSON: SearchConfig
@@ -976,23 +976,32 @@ export interface BylineFieldGroupValueTable {
 // between content entries, linked by `translation_group` so they are
 // locale-agnostic — no foreign keys, mirroring `content_taxonomies`.
 
+/**
+ * A relation definition. Not localized — a relation joins the same two
+ * collections whatever language you read it in, and its role labels are
+ * single-valued like a collection's. See migration 086.
+ */
 export interface RelationTable {
 	id: string;
-	name: string;
+	slug: string;
 	parent_collection: string;
 	child_collection: string;
 	parent_label: string;
 	child_label: string;
-	locale: Generated<string>;
-	translation_group: string;
+	parent_label_singular: string | null;
+	child_label_singular: string | null;
+	/** How many children one parent may hold. NULL means unlimited. */
+	max_children_per_parent: number | null;
+	/** How many parents one child may hold. NULL means unlimited. */
+	max_parents_per_child: number | null;
 	created_at: Generated<string>;
 	updated_at: Generated<string>;
 }
 
 export interface ContentReferenceTable {
 	id: string;
-	/** Stores `_emdash_relations.translation_group` (locale-agnostic). No FK. */
-	relation_group: string;
+	/** Stores `_emdash_relations.id`. No FK. */
+	relation_id: string;
 	/** Parent entry's `translation_group`. */
 	parent_group: string;
 	/** Child entry's `translation_group`. */

package/src/db/node-sqlite-compat.ts

@@ -1,18 +1,21 @@
 import { DatabaseSync } from "node:sqlite";
 
-export interface NodeSqliteCompatDatabase {
-	close(): void;
-	prepare(sql: string): NodeSqliteCompatStatement;
-}
-
 export interface NodeSqliteCompatStatement {
 	readonly reader: boolean;
 	all(parameters: ReadonlyArray<unknown>): unknown[];
+	all(...parameters: unknown[]): unknown[];
+	get(parameters: ReadonlyArray<unknown>): unknown;
+	get(...parameters: unknown[]): unknown;
 	run(parameters: ReadonlyArray<unknown>): {
 		changes: number | bigint;
 		lastInsertRowid: number | bigint;
 	};
+	run(...parameters: unknown[]): {
+		changes: number | bigint;
+		lastInsertRowid: number | bigint;
+	};
 	iterate(parameters: ReadonlyArray<unknown>): IterableIterator<unknown>;
+	iterate(...parameters: unknown[]): IterableIterator<unknown>;
 }
 
 export interface NodeSqliteOpenOptions {
@@ -26,43 +29,66 @@ export function openNodeSqliteDatabase(
 	path: string,
 	options: NodeSqliteOpenOptions = {},
 ): NodeSqliteCompatDatabase {
-	const database = new DatabaseSync(path, { readOnly: options.readOnly });
+	return new NodeSqliteCompatDatabase(path, options);
+}
+
+export class NodeSqliteCompatDatabase {
+	readonly #database: DatabaseSync;
+
+	constructor(path: string, options: NodeSqliteOpenOptions = {}) {
+		const database = new DatabaseSync(path, { readOnly: options.readOnly });
+		this.#database = database;
 
-	try {
-		database.exec("PRAGMA busy_timeout = 5000");
-		database.exec("PRAGMA foreign_keys = ON");
-		// Negative cache_size values are kibibytes.
-		database.exec("PRAGMA cache_size = -16000");
-		if (options.journalMode === "wal" && !options.readOnly) {
-			database.exec("PRAGMA journal_mode = WAL");
-		}
-		const journalMode = database.prepare("PRAGMA journal_mode").get()?.["journal_mode"];
-		if (journalMode === "wal") {
-			database.exec("PRAGMA synchronous = NORMAL");
-		}
-	} catch (error) {
 		try {
-			database.close();
-		} catch {
-			throw new Error("SQLite setup failed and the connection could not be closed", {
-				cause: error,
-			});
+			database.exec("PRAGMA busy_timeout = 5000");
+			database.exec("PRAGMA foreign_keys = ON");
+			// Negative cache_size values are kibibytes.
+			database.exec("PRAGMA cache_size = -16000");
+			if (options.journalMode === "wal" && !options.readOnly) {
+				database.exec("PRAGMA journal_mode = WAL");
+			}
+			const journalMode = database.prepare("PRAGMA journal_mode").get()?.["journal_mode"];
+			if (journalMode === "wal") {
+				database.exec("PRAGMA synchronous = NORMAL");
+			}
+		} catch (error) {
+			try {
+				database.close();
+			} catch {
+				throw new Error("SQLite setup failed and the connection could not be closed", {
+					cause: error,
+				});
+			}
+			throw error;
 		}
-		throw error;
 	}
 
-	return {
-		close: () => database.close(),
-		prepare(sql) {
-			const statement = database.prepare(sql);
-			return {
-				reader: statement.columns().length > 0,
-				all: (parameters) => statement.all(...toBindings(parameters)),
-				run: (parameters) => statement.run(...toBindings(parameters)),
-				iterate: (parameters) => statement.iterate(...toBindings(parameters)),
-			};
-		},
-	};
+	get open(): boolean {
+		return this.#database.isOpen;
+	}
+
+	close(): void {
+		if (this.#database.isOpen) this.#database.close();
+	}
+
+	exec(sql: string): void {
+		this.#database.exec(sql);
+	}
+
+	prepare(sql: string): NodeSqliteCompatStatement {
+		const statement = this.#database.prepare(sql);
+		return {
+			reader: statement.columns().length > 0,
+			all: (...parameters) => statement.all(...toBindings(normalizeParameters(parameters))),
+			get: (...parameters) => statement.get(...toBindings(normalizeParameters(parameters))),
+			run: (...parameters) => statement.run(...toBindings(normalizeParameters(parameters))),
+			iterate: (...parameters) => statement.iterate(...toBindings(normalizeParameters(parameters))),
+		};
+	}
+}
+
+function normalizeParameters(parameters: unknown[]): ReadonlyArray<unknown> {
+	return parameters.length === 1 && Array.isArray(parameters[0]) ? parameters[0] : parameters;
 }
 
 function toBindings(parameters: ReadonlyArray<unknown>): SqliteBinding[] {

package/src/emdash-runtime.ts

@@ -28,6 +28,16 @@ import {
 	handleMediaUpload as uploadMedia,
 	type MediaUploadInput,
 } from "./api/handlers/media-upload.js";
+import { resolveReferenceSelection } from "./api/handlers/relations.js";
+import {
+	liveReferenceSelection,
+	mergeStagedReferenceBaselines,
+	mergeStagedReferences,
+	STAGED_REFERENCES_BASELINE_KEY,
+	STAGED_REFERENCES_KEY,
+	type StagedReferenceBaselines,
+	type StagedReferences,
+} from "./api/handlers/staged-references.js";
 import { validateRev } from "./api/rev.js";
 import { getSiteBaseUrl } from "./api/site-url.js";
 import type {
@@ -126,7 +136,9 @@ import type {
 import { normalizePluginCapabilities } from "./plugins/types.js";
 import { recordSchedulerHeartbeatSafely } from "./scheduler-health.js";
 import { primeRegisteredCollections } from "./schema/collection-slugs-cache.js";
+import { isStoragelessField, isStoragelessFieldRow } from "./schema/types.js";
 import type { CollectionWithFields } from "./schema/types.js";
+import { AUTO_SEED_COMPLETE_OPTION } from "./seed/ownership.js";
 import { isMissingTableError } from "./utils/db-errors.js";
 import { hashString } from "./utils/hash.js";
 import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
@@ -135,6 +147,7 @@ import { COMMIT, VERSION } from "./version.js";
 
 const LEADING_SLASH_PATTERN = /^\//;
 const LOCALE_CASING_REPAIR_OPTION = "emdash:repair_locale_casing";
+const SETUP_COMPLETE_OPTION = "emdash:setup_complete";
 
 const PLUGIN_COMMENT_STATUSES = new Set<string>(["approved", "pending", "spam"]);
 
@@ -184,6 +197,7 @@ interface PageContributions {
 
 import { after } from "./after.js";
 import { maybeRunScheduledBackup } from "./api/handlers/backup.js";
+import { changedStoragelessDataKeys, storagelessDataKeyError } from "./api/handlers/content.js";
 import { loadBundleFromR2 } from "./api/handlers/marketplace.js";
 import { runSystemCleanup } from "./cleanup.js";
 import {
@@ -286,6 +300,7 @@ const DRAFT_ONLY_UPDATE_KEYS = new Set([
 	"slug",
 	"locale",
 	"skipRevision",
+	"references",
 	"actor",
 	"migrateBlocks",
 	"replaceBlocks",
@@ -1443,6 +1458,7 @@ export class EmDashRuntime {
 						settingsSchema: bundle.manifest.admin?.settingsSchema,
 						editorPanels: bundle.manifest.admin?.editorPanels,
 						editorActions: bundle.manifest.admin?.editorActions,
+						mcp: bundle.manifest.mcp,
 					});
 					newPlugins.push(adapted);
 					this.allPipelinePlugins.push(adapted);
@@ -1533,9 +1549,11 @@ export class EmDashRuntime {
 					trailingSlash?: "always" | "never" | "ignore";
 			  }
 			| undefined;
-		// "Already set up" by default so a read failure (e.g. tables absent on a
+		// "Already complete" by default so a read failure (e.g. tables absent on a
 		// pre-migration db) skips seeding rather than seeding a half-built db.
-		let seedGate = { collectionCount: 1, setupDone: true };
+		let seedComplete = true;
+		let setupDone = true;
+		let seedCollectionsReadable = false;
 
 		// Seeding must only touch the configured singleton, never a borrowed
 		// per-request db (playground / DO preview) or the loader-fallback db.
@@ -1582,17 +1600,26 @@ export class EmDashRuntime {
 		};
 
 		const readSiteInfo = async () => {
-			const siteOpts = await optionsRepo.getMany<string>([
+			const siteOpts = await optionsRepo.getMany([
 				"emdash:site_title",
 				"emdash:site_url",
 				"emdash:locale",
 				LOCALE_CASING_REPAIR_OPTION,
+				AUTO_SEED_COMPLETE_OPTION,
+				SETUP_COMPLETE_OPTION,
 			]);
-			storedLocaleCasingRepairVersion = siteOpts.get(LOCALE_CASING_REPAIR_OPTION);
+			const siteTitle = siteOpts.get("emdash:site_title");
+			const siteUrl = siteOpts.get("emdash:site_url");
+			const locale = siteOpts.get("emdash:locale");
+			const repairVersion = siteOpts.get(LOCALE_CASING_REPAIR_OPTION);
+			storedLocaleCasingRepairVersion =
+				typeof repairVersion === "string" ? repairVersion : undefined;
+			seedComplete = siteOpts.get(AUTO_SEED_COMPLETE_OPTION) === true;
+			setupDone = siteOpts.get(SETUP_COMPLETE_OPTION) === true;
 			return {
-				siteName: deps.siteInfo?.name ?? siteOpts.get("emdash:site_title") ?? undefined,
-				siteUrl: deps.siteInfo?.url ?? siteOpts.get("emdash:site_url") ?? undefined,
-				locale: deps.siteInfo?.locale ?? siteOpts.get("emdash:locale") ?? undefined,
+				siteName: deps.siteInfo?.name ?? (typeof siteTitle === "string" ? siteTitle : undefined),
+				siteUrl: deps.siteInfo?.url ?? (typeof siteUrl === "string" ? siteUrl : undefined),
+				locale: deps.siteInfo?.locale ?? (typeof locale === "string" ? locale : undefined),
 				// trailingSlash is a build-time Astro routing decision, not a
 				// user-editable setting, so it comes from the Astro config
 				// (virtual:emdash/config), not the options table.
@@ -1630,27 +1657,16 @@ export class EmDashRuntime {
 						// Selecting the slugs instead of COUNT(*) costs the same
 						// round trip and primes the registered-collections cache,
 						// so the first render on this isolate skips its own lookup.
-						const [collectionRows, setupOption] = await Promise.all([
-							readDb.selectFrom("_emdash_collections").select("slug").execute(),
-							readDb
-								.selectFrom("options")
-								.select("value")
-								.where("name", "=", "emdash:setup_complete")
-								.executeTakeFirst(),
-						]);
+						const collectionRows = await readDb
+							.selectFrom("_emdash_collections")
+							.select("slug")
+							.execute();
 						primeRegisteredCollections(collectionRows.map((row) => row.slug));
-						const setupDone = (() => {
-							try {
-								return !!setupOption && JSON.parse(setupOption.value) === true;
-							} catch {
-								return false;
-							}
-						})();
-						seedGate = { collectionCount: collectionRows.length, setupDone };
+						seedCollectionsReadable = true;
 					} catch (error) {
 						captureMissingManualSchema(error);
-						// Leave the "already set up" default so a read failure never
-						// triggers a seed onto a half-built db.
+						// Leave collections unreadable so a read failure never triggers
+						// a seed onto a half-built db.
 					}
 				}),
 			);
@@ -1680,7 +1696,7 @@ export class EmDashRuntime {
 		// wizard (the wizard and dev-bypass apply seeds explicitly). Run under a
 		// per-isolate lock keyed by the configured db so a reclaimed-and-rerun
 		// create() can't apply the seed a second time concurrently.
-		if (seedGate.collectionCount === 0 && !seedGate.setupDone) {
+		if (seedCollectionsReadable && !seedComplete && !setupDone) {
 			try {
 				const activation = await activateMediaUsageCapture(db, { writersDrained: true });
 				if (activation.outcome !== "active") {
@@ -1703,14 +1719,15 @@ export class EmDashRuntime {
 
 						const seed = await loadSeed();
 						const validation = validateSeed(seed);
-						if (validation.valid) {
-							const seedResult = await applySeed(db, seed, { onConflict: "skip" });
-							console.log("Auto-seeded default collections");
-							if (seedResult.taxonomies.skipped > 0) {
-								console.warn(
-									`[auto-seed] Kept ${seedResult.taxonomies.skipped} existing taxonomy definition(s) instead of the seed's. Edit them in the admin, or run \`emdash seed <file> --on-conflict update\` to replace them (this also overwrites other seeded records).`,
-								);
-							}
+						if (!validation.valid) return false;
+
+						const seedResult = await applySeed(db, seed, { onConflict: "skip" });
+						await new OptionsRepository(db).set(AUTO_SEED_COMPLETE_OPTION, true);
+						console.log("Auto-seeded default collections");
+						if (seedResult.taxonomies.skipped > 0) {
+							console.warn(
+								`[auto-seed] Kept ${seedResult.taxonomies.skipped} existing taxonomy definition(s) instead of the seed's. Edit them in the admin, or run \`emdash seed <file> --on-conflict update\` to replace them (this also overwrites other seeded records).`,
+							);
 						}
 						seedHolder.done.add(seedKey);
 						return true;
@@ -2436,6 +2453,7 @@ export class EmDashRuntime {
 					fieldWidgets: entry.fieldWidgets,
 					editorPanels: entry.editorPanels,
 					editorActions: entry.editorActions,
+					mcp: entry.mcp,
 				});
 				plugins.push(resolved);
 				console.log(
@@ -2813,6 +2831,7 @@ export class EmDashRuntime {
 						settingsSchema: bundle.manifest.admin?.settingsSchema,
 						editorPanels: bundle.manifest.admin?.editorPanels,
 						editorActions: bundle.manifest.admin?.editorActions,
+						mcp: bundle.manifest.mcp,
 					});
 					resolved.push(adapted);
 					console.log(
@@ -3129,6 +3148,7 @@ export class EmDashRuntime {
 				implicit: i18nConfig === null,
 			},
 			marketplace: !!this.config.marketplace,
+			sandboxEnabled: this.runtimeDeps.sandboxEnabled && this.runtimeDeps.sandboxBypassed !== true,
 			registry,
 			registryConfigurationError,
 		};
@@ -3219,8 +3239,13 @@ export class EmDashRuntime {
 		return handleContentAuthors(this.db, collection);
 	}
 
-	async handleContentGet(collection: string, id: string, locale?: string) {
-		const result = await handleContentGet(this.db, collection, id, locale);
+	async handleContentGet(
+		collection: string,
+		id: string,
+		locale?: string,
+		referenceOptions?: { includeDrafts: boolean },
+	) {
+		const result = await handleContentGet(this.db, collection, id, locale, referenceOptions);
 		return this.hydrateDraftData(result);
 	}
 
@@ -3317,6 +3342,7 @@ export class EmDashRuntime {
 			locale?: string;
 			translationOf?: string;
 			taxonomies?: Record<string, string[]>;
+			references?: Record<string, string[]>;
 			actor?: ActorInfo;
 			migrateBlocks?: boolean;
 			replaceBlocks?: boolean;
@@ -3353,11 +3379,18 @@ export class EmDashRuntime {
 				await this.db
 					.selectFrom("_emdash_fields as field")
 					.innerJoin("_emdash_collections as collection", "collection.id", "field.collection_id")
-					.select("field.slug")
+					.select(["field.slug", "field.type", "field.validation"])
 					.where("collection.slug", "=", collection)
 					.where("field.translatable", "=", 0)
 					.execute()
-			).map((field) => field.slug);
+			)
+				// A storage-less field has nothing in `data` worth sharing: its
+				// selection is keyed by translation group, so every translation
+				// already reads the same edges. What the source row does carry under
+				// that slug is the frozen column a field bound after the fact left
+				// behind, and copying it would send a key `data` no longer accepts.
+				.filter((field) => !isStoragelessFieldRow(field))
+				.map((field) => field.slug);
 			const siblings = await repo.findTranslations(
 				collection,
 				source.translationGroup ?? source.id,
@@ -3501,6 +3534,7 @@ export class EmDashRuntime {
 				noIndex?: boolean;
 			};
 			taxonomies?: Record<string, string[]>;
+			references?: Record<string, string[]>;
 			publishedAt?: string | null;
 			locale?: string;
 			/** Replace the previous autosave revision after staging this save. */
@@ -3551,11 +3585,30 @@ export class EmDashRuntime {
 
 		// Loaded once and threaded through normalization, the stale-key drop and the draft
 		// merge below: each of those needs the field list and the registry does not cache.
-		const collectionInfo = bodyWithoutRev.data
-			? await this.schemaRegistry.getCollectionWithFields(collection).catch(() => null)
-			: null;
+		// A save carrying only a reference selection reaches the draft merge without any
+		// data, so it needs the collection loaded just the same.
+		const collectionInfo =
+			bodyWithoutRev.data || bodyWithoutRev.references
+				? await this.schemaRegistry.getCollectionWithFields(collection).catch(() => null)
+				: null;
 		const knownFieldSlugs = new Set((collectionInfo?.fields ?? []).map((f) => f.slug));
 
+		// A collection that keeps drafts merges `data` into a revision instead of
+		// writing columns, so a reference field's slug would land in the revision
+		// JSON and never reach the check the column writer's own path makes. Both
+		// operands are already in hand here, so the check costs nothing.
+		if (bodyWithoutRev.data && collectionInfo) {
+			const storageless = new Set(
+				collectionInfo.fields.filter(isStoragelessField).map((field) => field.slug),
+			);
+			const changed = changedStoragelessDataKeys(
+				storageless,
+				bodyWithoutRev.data,
+				resolvedItem?.data ?? {},
+			);
+			if (changed.length > 0) return storagelessDataKeyError(changed);
+		}
+
 		// Run beforeSave hooks if data is provided
 		let processedData = bodyWithoutRev.data;
 		let resolvedBlockTypes: Awaited<ReturnType<typeof resolveBlockTypes>> | undefined;
@@ -3647,9 +3700,42 @@ export class EmDashRuntime {
 		// Draft data lives only in the revisions table.
 		let usesDraftRevisions = false;
 		let draftStorageChanged = false;
-		if (processedData) {
+		if (processedData || bodyWithoutRev.references) {
 			if (collectionInfo?.supports?.includes("revisions")) {
 				usesDraftRevisions = true;
+
+				// Resolve a pending selection to translation groups before it is
+				// staged, so a bad id or an over-long selection fails this save the
+				// way a direct link write would, and publication has nothing left to
+				// resolve.
+				let stagedReferences: StagedReferences | undefined;
+				let stagedReferenceBaselines: StagedReferenceBaselines | undefined;
+				if (bodyWithoutRev.references) {
+					stagedReferences = {};
+					let entryGroup: string | undefined;
+					for (const [fieldSlug, selectedIds] of Object.entries(bodyWithoutRev.references)) {
+						const resolved = await resolveReferenceSelection(
+							this.db,
+							collection,
+							resolvedId,
+							fieldSlug,
+							selectedIds,
+						);
+						if (!resolved.success) {
+							return { success: false as const, error: resolved.error };
+						}
+						stagedReferences[fieldSlug] = resolved.data.groups;
+						entryGroup = resolved.data.entryGroup;
+					}
+					if (entryGroup) {
+						const liveSelection = await liveReferenceSelection(this.db, collection, entryGroup);
+						stagedReferenceBaselines = {};
+						for (const fieldSlug of Object.keys(stagedReferences)) {
+							stagedReferenceBaselines[fieldSlug] = liveSelection[fieldSlug] ?? [];
+						}
+					}
+				}
+
 				const revisionRepo = new RevisionRepository(this.db);
 				let existing = await repo.findById(collection, resolvedId);
 
@@ -3661,12 +3747,12 @@ export class EmDashRuntime {
 					} else {
 						baseData = existing.data;
 					}
-					let attemptData = processedData;
+					let attemptData = processedData ?? {};
 					try {
 						attemptData = await normalizeBlocksData(
 							this.db,
 							collectionInfo,
-							processedData,
+							attemptData,
 							baseData,
 							blockWriteOptions,
 							true,
@@ -3704,6 +3790,15 @@ export class EmDashRuntime {
 					if (bodyWithoutRev.slug !== undefined) {
 						mergedData._slug = bodyWithoutRev.slug;
 					}
+					if (stagedReferences) {
+						mergedData[STAGED_REFERENCES_KEY] = mergeStagedReferences(baseData, stagedReferences);
+					}
+					if (stagedReferenceBaselines) {
+						mergedData[STAGED_REFERENCES_BASELINE_KEY] = mergeStagedReferenceBaselines(
+							baseData,
+							stagedReferenceBaselines,
+						);
+					}
 
 					const revision = await revisionRepo.create({
 						collection,
@@ -3795,13 +3890,19 @@ export class EmDashRuntime {
 						...bodyWithoutRev,
 						data: usesDraftRevisions ? undefined : processedData,
 						slug: usesDraftRevisions ? undefined : bodyWithoutRev.slug,
+						references: usesDraftRevisions ? undefined : bodyWithoutRev.references,
 						authorId: bodyWithoutRev.authorId,
 						bylines: bodyWithoutRev.bylines,
 					});
 
 		const liveContentChanged = usesDraftRevisions
 			? liveMetaTouched
-			: Boolean(processedData || bodyWithoutRev.slug !== undefined || liveMetaTouched);
+			: Boolean(
+					processedData ||
+					bodyWithoutRev.slug !== undefined ||
+					bodyWithoutRev.references ||
+					liveMetaTouched,
+				);
 
 		// Hydrate draft data BEFORE firing afterSave hooks so the hook sees
 		// the same effective data the response surfaces — for revision-
@@ -4912,10 +5013,12 @@ export class EmDashRuntime {
 		// live, matching the documented tool contract.
 		try {
 			const contentRepo = new ContentRepository(this.db);
+			const restoredData = { ...revision.data };
+			delete restoredData[STAGED_REFERENCES_BASELINE_KEY];
 			const newDraftId = await contentRepo.restoreDraftRevision(
 				revision.collection,
 				revision.entryId,
-				revision.data,
+				restoredData,
 				callerUserId,
 			);
 			if (!newDraftId) {