emdash 0.7.0 → 0.9.0

package/src/emdash-runtime.ts

@@ -39,13 +39,26 @@ import type {
 	PageMetadataContribution,
 	PageFragmentContribution,
 } from "./plugins/types.js";
-import { invalidateUrlPatternCache } from "./query.js";
 import type { FieldType } from "./schema/types.js";
 import { hashString } from "./utils/hash.js";
 import { COMMIT, VERSION } from "./version.js";
 
 const LEADING_SLASH_PATTERN = /^\//;
 
+/**
+ * Parse a JSON column expected to contain an array of strings.
+ *
+ * Throws on malformed JSON rather than returning []; callers are responsible
+ * for deciding how to handle/log the error. Empty string / null inputs return
+ * [] (they represent "no value"). Non-string array entries are filtered out.
+ */
+function parseStringArray(raw: string | null | undefined): string[] {
+	if (!raw) return [];
+	const parsed: unknown = JSON.parse(raw);
+	if (!Array.isArray(parsed)) return [];
+	return parsed.filter((v): v is string => typeof v === "string");
+}
+
 /** Combined result from a single-pass page contribution collection */
 interface PageContributions {
 	metadata: PageMetadataContribution[];
@@ -97,6 +110,7 @@ import {
 	DEFAULT_COMMENT_MODERATOR_PLUGIN_ID,
 	defaultCommentModerate,
 } from "./comments/moderator.js";
+import { validateEncryptionKeyAtStartup } from "./config/secrets.js";
 import { OptionsRepository } from "./database/repositories/options.js";
 import {
 	handleContentList,
@@ -147,6 +161,7 @@ import { NodeCronScheduler } from "./plugins/scheduler/node.js";
 import { PiggybackScheduler } from "./plugins/scheduler/piggyback.js";
 import type { CronScheduler } from "./plugins/scheduler/types.js";
 import { PluginStateRepository } from "./plugins/state.js";
+import { requestCached } from "./request-cache.js";
 import { getRequestContext } from "./request-context.js";
 import { FTSManager } from "./search/fts-manager.js";
 
@@ -237,6 +252,44 @@ export interface RuntimeDependencies {
 	createSandboxRunner: ((opts: { db: Kysely<Database> }) => SandboxRunner) | null;
 }
 
+/**
+ * Constructor parameters for `EmDashRuntime`.
+ *
+ * Production code should use `EmDashRuntime.create()` which discovers and
+ * loads all parts (database, plugins, hooks, cron, etc.) and then calls the
+ * constructor. Direct construction is supported for callers that already
+ * have all the dependencies in hand — for example, integration tests that
+ * supply a pre-migrated database and an empty plugin set.
+ *
+ * Every field corresponds 1:1 to internal state set on the runtime — none of
+ * these are derived. If you don't have a value for one, see what `create()`
+ * passes for that field as the canonical default.
+ */
+export interface EmDashRuntimeParts {
+	db: Kysely<Database>;
+	storage: Storage | null;
+	configuredPlugins: ResolvedPlugin[];
+	sandboxedPlugins: Map<string, SandboxedPlugin>;
+	sandboxedPluginEntries: SandboxedPluginEntry[];
+	hooks: HookPipeline;
+	enabledPlugins: Set<string>;
+	pluginStates: Map<string, string>;
+	config: EmDashConfig;
+	mediaProviders: Map<string, MediaProvider>;
+	mediaProviderEntries: MediaProviderEntry[];
+	cronExecutor: CronExecutor | null;
+	cronScheduler: CronScheduler | null;
+	emailPipeline: EmailPipeline | null;
+	allPipelinePlugins: ResolvedPlugin[];
+	pipelineFactoryOptions: {
+		db: Kysely<Database>;
+		storage?: Storage;
+		siteInfo?: { siteName?: string; siteUrl?: string; locale?: string };
+	};
+	runtimeDeps: RuntimeDependencies;
+	pipelineRef: { current: HookPipeline };
+}
+
 /**
  * Convert a ContentItem to Record<string, unknown> for hook consumption.
  * Hooks receive the full item as a flat record.
@@ -290,10 +343,6 @@ export class EmDashRuntime {
 	private enabledPlugins: Set<string>;
 	private pluginStates: Map<string, string>;
 
-	private _cachedManifest: EmDashManifest | null = null;
-	private _manifestPromise: Promise<EmDashManifest> | null = null;
-	private readonly _manifestCacheKey: string;
-
 	/**
 	 * Set to true after FTS indexes have been verified for this worker
 	 * lifetime so we don't re-scan on every admin request. See
@@ -337,51 +386,26 @@ export class EmDashRuntime {
 		return this._db;
 	}
 
-	private constructor(
-		db: Kysely<Database>,
-		storage: Storage | null,
-		configuredPlugins: ResolvedPlugin[],
-		sandboxedPlugins: Map<string, SandboxedPlugin>,
-		sandboxedPluginEntries: SandboxedPluginEntry[],
-		hooks: HookPipeline,
-		enabledPlugins: Set<string>,
-		pluginStates: Map<string, string>,
-		config: EmDashConfig,
-		mediaProviders: Map<string, MediaProvider>,
-		mediaProviderEntries: MediaProviderEntry[],
-		cronExecutor: CronExecutor | null,
-		cronScheduler: CronScheduler | null,
-		emailPipeline: EmailPipeline | null,
-		allPipelinePlugins: ResolvedPlugin[],
-		pipelineFactoryOptions: {
-			db: Kysely<Database>;
-			storage?: Storage;
-			siteInfo?: { siteName?: string; siteUrl?: string; locale?: string };
-		},
-		runtimeDeps: RuntimeDependencies,
-		pipelineRef: { current: HookPipeline },
-		manifestCacheKey: string,
-	) {
-		this._db = db;
-		this.storage = storage;
-		this.configuredPlugins = configuredPlugins;
-		this.sandboxedPlugins = sandboxedPlugins;
-		this.sandboxedPluginEntries = sandboxedPluginEntries;
-		this.schemaRegistry = new SchemaRegistry(db);
-		this._hooks = hooks;
-		this.enabledPlugins = enabledPlugins;
-		this.pluginStates = pluginStates;
-		this.config = config;
-		this.mediaProviders = mediaProviders;
-		this.mediaProviderEntries = mediaProviderEntries;
-		this.cronExecutor = cronExecutor;
-		this.cronScheduler = cronScheduler;
-		this.email = emailPipeline;
-		this.allPipelinePlugins = allPipelinePlugins;
-		this.pipelineFactoryOptions = pipelineFactoryOptions;
-		this.runtimeDeps = runtimeDeps;
-		this.pipelineRef = pipelineRef;
-		this._manifestCacheKey = manifestCacheKey;
+	constructor(parts: EmDashRuntimeParts) {
+		this._db = parts.db;
+		this.storage = parts.storage;
+		this.configuredPlugins = parts.configuredPlugins;
+		this.sandboxedPlugins = parts.sandboxedPlugins;
+		this.sandboxedPluginEntries = parts.sandboxedPluginEntries;
+		this.schemaRegistry = new SchemaRegistry(parts.db);
+		this._hooks = parts.hooks;
+		this.enabledPlugins = parts.enabledPlugins;
+		this.pluginStates = parts.pluginStates;
+		this.config = parts.config;
+		this.mediaProviders = parts.mediaProviders;
+		this.mediaProviderEntries = parts.mediaProviderEntries;
+		this.cronExecutor = parts.cronExecutor;
+		this.cronScheduler = parts.cronScheduler;
+		this.email = parts.emailPipeline;
+		this.allPipelinePlugins = parts.allPipelinePlugins;
+		this.pipelineFactoryOptions = parts.pipelineFactoryOptions;
+		this.runtimeDeps = parts.runtimeDeps;
+		this.pipelineRef = parts.pipelineRef;
 	}
 
 	/**
@@ -431,7 +455,6 @@ export class EmDashRuntime {
 			this.enabledPlugins.delete(pluginId);
 			await this.rebuildHookPipeline();
 		}
-		this.invalidateManifest();
 	}
 
 	/**
@@ -605,6 +628,13 @@ export class EmDashRuntime {
 		// Initialize database (connects, runs migrations if needed)
 		const db = await phase("rt.db", "DB init + migrations", () => EmDashRuntime.getDatabase(deps));
 
+		// Validate EMDASH_ENCRYPTION_KEY once here so a malformed value
+		// surfaces in startup logs instead of as request-time 500s. The key
+		// itself is not yet consumed (a follow-up PR adds plugin-secret
+		// encryption); validating early just guards against silent
+		// misconfiguration.
+		await phase("rt.secrets", "Validate encryption key", () => validateEncryptionKeyAtStartup());
+
 		// FTS verify/repair is deferred off the cold-start hot path.
 		// See EmDashRuntime.ensureSearchHealthy().
 
@@ -668,7 +698,7 @@ export class EmDashRuntime {
 				const devConsolePlugin = definePlugin({
 					id: DEV_CONSOLE_EMAIL_PLUGIN_ID,
 					version: "0.0.0",
-					capabilities: ["email:provide"],
+					capabilities: ["hooks.email-transport:register"],
 					hooks: {
 						"email:deliver": {
 							exclusive: true,
@@ -691,7 +721,7 @@ export class EmDashRuntime {
 			const defaultModeratorPlugin = definePlugin({
 				id: DEFAULT_COMMENT_MODERATOR_PLUGIN_ID,
 				version: "0.0.0",
-				capabilities: ["read:users"],
+				capabilities: ["users:read"],
 				hooks: {
 					"comment:moderate": {
 						exclusive: true,
@@ -842,32 +872,16 @@ export class EmDashRuntime {
 			}
 		});
 
-		// SHA of emdash commit + user config that affects the manifest.
-		// COMMIT captures emdash code changes; plugin IDs/versions and i18n
-		// capture user astro.config changes (e.g. upgrading a plugin package).
-		// DB-driven changes (collections, fields, plugin toggle) go through
-		// invalidateManifest(). Sorted for stability across nondeterministic
-		// plugin ordering.
-		const manifestCacheKey = await hashString(
-			[
-				COMMIT,
-				...deps.plugins.map((p) => `${p.id}@${p.version ?? ""}`).toSorted(),
-				...deps.sandboxedPluginEntries.map((e) => `${e.id}@${e.version}`).toSorted(),
-				virtualConfig?.i18n?.defaultLocale ?? "",
-				(virtualConfig?.i18n?.locales ?? []).toSorted().join(","),
-			].join("|"),
-		);
-
-		return new EmDashRuntime(
+		return new EmDashRuntime({
 			db,
 			storage,
-			deps.plugins,
+			configuredPlugins: deps.plugins,
 			sandboxedPlugins,
-			deps.sandboxedPluginEntries,
-			pipeline,
+			sandboxedPluginEntries: deps.sandboxedPluginEntries,
+			hooks: pipeline,
 			enabledPlugins,
 			pluginStates,
-			deps.config,
+			config: deps.config,
 			mediaProviders,
 			mediaProviderEntries,
 			cronExecutor,
@@ -875,10 +889,9 @@ export class EmDashRuntime {
 			emailPipeline,
 			allPipelinePlugins,
 			pipelineFactoryOptions,
-			deps,
+			runtimeDeps: deps,
 			pipelineRef,
-			manifestCacheKey,
-		);
+		});
 	}
 
 	/**
@@ -954,18 +967,15 @@ export class EmDashRuntime {
 			const dialect = deps.createDialect(dbConfig.config);
 			const db = new Kysely<Database>({ dialect, log: kyselyLogOption() });
 
-			const { applied } = await runMigrations(db);
+			await runMigrations(db);
 
-			// If migrations were applied, the schema changed — clear the
-			// DB-persisted manifest cache so getManifest() rebuilds it.
-			if (applied.length > 0) {
-				try {
-					const options = new OptionsRepository(db);
-					await options.delete("emdash:manifest_cache");
-				} catch {
-					// Non-fatal
-				}
-			}
+			// Note: legacy installs may carry a stray `emdash:manifest_cache`
+			// row in the options table from versions that persisted a JSON
+			// manifest. The runtime no longer reads or writes it. We do not
+			// proactively delete it: the row is a few hundred bytes of dead
+			// weight and is never on the read path, whereas a one-shot
+			// cleanup-flag check costs an extra `options.get()` on every
+			// isolate cold boot forever. Cheaper to leave it.
 
 			// Auto-seed schema if no collections exist and setup hasn't run.
 			// This covers first-load on sites that skip the setup wizard.
@@ -1227,80 +1237,35 @@ export class EmDashRuntime {
 	// =========================================================================
 
 	/**
-	 * Get the manifest, using an in-memory cache with a DB-persisted
-	 * fallback for cold starts. Avoids N+1 schema registry queries
-	 * on every request.
+	 * Build the admin manifest from the live database.
+	 *
+	 * Used by the admin UI (sidebar collections, content editor field
+	 * dispatch, manifest endpoint) and by WordPress import — it's never
+	 * read on a public request, so this isn't on any anonymous hot path.
 	 *
-	 * Cache is invalidated by invalidateManifest(), called from schema
-	 * API routes, MCP server, plugin toggle, and taxonomy def changes.
+	 * No cross-request cache. The previous worker-isolate cache produced
+	 * a class of cross-isolate staleness bugs (#776, #873, #876, #877)
+	 * because Cloudflare Workers keeps multiple warm isolates per region
+	 * and there's no fan-out primitive to invalidate them in step. The
+	 * cache existed to amortize an N+1 schema query pattern; now that
+	 * `listCollectionsWithFields()` does the same work in two queries,
+	 * the rebuild is fast enough to pay on every admin request.
+	 *
+	 * Within a single request, `requestCached` deduplicates concurrent
+	 * callers (the manifest endpoint and an admin SSR template, say).
 	 */
-	async getManifest(): Promise<EmDashManifest> {
-		// When the DB is overridden by an isolated instance (playground /
-		// DO-preview sessions), bypass the module-scoped manifest cache —
-		// its schema may diverge from the configured DB. Plain D1 Sessions
-		// routing does NOT set `dbIsIsolated`, so the cache still applies.
-		if (getRequestContext()?.dbIsIsolated) {
-			return this._buildManifest();
-		}
-
-		if (this._cachedManifest) return this._cachedManifest;
-
-		// DB-persisted cache (1 query instead of N+1 rebuild on cold start).
-		// Keyed by SHA of commit + config to bust on deploys. DB-driven
-		// changes (collections, fields, plugins, taxonomies) go through
-		// invalidateManifest().
-		try {
-			const options = new OptionsRepository(this.db);
-			const cached = await options.get<{ key: string; manifest: EmDashManifest }>(
-				"emdash:manifest_cache",
-			);
-			if (cached && cached.key === this._manifestCacheKey && cached.manifest) {
-				this._cachedManifest = cached.manifest;
-				return cached.manifest;
-			}
-		} catch {
-			// Options table may not exist yet
-		}
-
-		// Full rebuild, then persist. Track which promise is current so
-		// an invalidation during the build can't be overwritten.
-		if (!this._manifestPromise) {
-			let manifestPromise: Promise<EmDashManifest>;
-			const isCurrentLoad = () => this._manifestPromise === manifestPromise;
-			manifestPromise = this._loadManifest(isCurrentLoad);
-			this._manifestPromise = manifestPromise;
-		}
-		return this._manifestPromise;
-	}
-
-	private async _loadManifest(isCurrentLoad: () => boolean): Promise<EmDashManifest> {
-		try {
-			const manifest = await this._buildManifest();
-
-			if (isCurrentLoad()) {
-				this._cachedManifest = manifest;
-
-				try {
-					const options = new OptionsRepository(this.db);
-					await options.set("emdash:manifest_cache", {
-						key: this._manifestCacheKey,
-						manifest,
-					});
-				} catch {
-					// Non-fatal — will just rebuild next time
-				}
-			}
-
-			return manifest;
-		} finally {
-			if (isCurrentLoad()) {
-				this._manifestPromise = null;
-			}
-		}
+	getManifest(): Promise<EmDashManifest> {
+		return requestCached("emdash:manifest", () => this._buildManifest());
 	}
 
 	/**
-	 * Build the manifest from database (N+1 collection queries).
+	 * Build the manifest from the database.
+	 *
+	 * Constant query shapes via `listCollectionsWithFields()` — one query
+	 * for collections, one batched query for fields (chunked at
+	 * `SQL_BATCH_SIZE` collection IDs to stay under D1's bound-parameter
+	 * limit). Typical sites stay well under the chunk threshold, so this
+	 * is two queries in practice; never N+1.
 	 */
 	private async _buildManifest(): Promise<EmDashManifest> {
 		// Build collections from database.
@@ -1309,9 +1274,8 @@ export class EmDashRuntime {
 		const manifestCollections: Record<string, ManifestCollection> = {};
 		try {
 			const registry = new SchemaRegistry(this.db);
-			const dbCollections = await registry.listCollections();
+			const dbCollections = await registry.listCollectionsWithFields();
 			for (const collection of dbCollections) {
-				const collectionWithFields = await registry.getCollectionWithFields(collection.slug);
 				const fields: Record<
 					string,
 					{
@@ -1326,34 +1290,32 @@ export class EmDashRuntime {
 					}
 				> = {};
 
-				if (collectionWithFields?.fields) {
-					for (const field of collectionWithFields.fields) {
-						const entry: (typeof fields)[string] = {
-							kind: FIELD_TYPE_TO_KIND[field.type] ?? "string",
-							label: field.label,
-							required: field.required,
-						};
-						if (field.widget) entry.widget = field.widget;
-						// Plugin field widgets read their per-field config from `field.options`,
-						// which the seed schema types as `Record<string, unknown>`. Pass it
-						// through to the manifest so plugin widgets in the admin SPA receive it.
-						if (field.options) {
-							entry.options = field.options;
-						}
-						// Legacy: select/multiSelect enum options live on `field.validation.options`.
-						// Wins over `field.options` to preserve existing behavior for enum widgets.
-						if (field.validation?.options) {
-							entry.options = field.validation.options.map((v) => ({
-								value: v,
-								label: v.charAt(0).toUpperCase() + v.slice(1),
-							}));
-						}
-						// Include full validation for repeater fields (subFields, minItems, maxItems)
-						if (field.type === "repeater" && field.validation) {
-							(entry as Record<string, unknown>).validation = field.validation;
-						}
-						fields[field.slug] = entry;
+				for (const field of collection.fields) {
+					const entry: (typeof fields)[string] = {
+						kind: FIELD_TYPE_TO_KIND[field.type] ?? "string",
+						label: field.label,
+						required: field.required,
+					};
+					if (field.widget) entry.widget = field.widget;
+					// Plugin field widgets read their per-field config from `field.options`,
+					// which the seed schema types as `Record<string, unknown>`. Pass it
+					// through to the manifest so plugin widgets in the admin SPA receive it.
+					if (field.options) {
+						entry.options = field.options;
+					}
+					// Legacy: select/multiSelect enum options live on `field.validation.options`.
+					// Wins over `field.options` to preserve existing behavior for enum widgets.
+					if (field.validation?.options) {
+						entry.options = field.validation.options.map((v) => ({
+							value: v,
+							label: v.charAt(0).toUpperCase() + v.slice(1),
+						}));
+					}
+					// Include full validation for repeater fields (subFields, minItems, maxItems)
+					if (field.type === "repeater" && field.validation) {
+						(entry as Record<string, unknown>).validation = field.validation;
 					}
+					fields[field.slug] = entry;
 				}
 
 				manifestCollections[collection.slug] = {
@@ -1390,6 +1352,7 @@ export class EmDashRuntime {
 					description?: string;
 					placeholder?: string;
 					fields?: Element[];
+					category?: string;
 				}>;
 				fieldWidgets?: Array<{
 					name: string;
@@ -1489,7 +1452,7 @@ export class EmDashRuntime {
 				label: row.label,
 				labelSingular: row.label_singular ?? undefined,
 				hierarchical: row.hierarchical === 1,
-				collections: row.collections ? (JSON.parse(row.collections) as string[]).toSorted() : [],
+				collections: parseStringArray(row.collections).toSorted(),
 			}));
 		} catch (error) {
 			console.debug("EmDash: Could not load taxonomy definitions:", error);
@@ -1526,27 +1489,6 @@ export class EmDashRuntime {
 		};
 	}
 
-	/**
-	 * Invalidate cached data derived from the manifest/schema.
-	 * Called when collections, fields, plugins, or taxonomy defs change.
-	 */
-	invalidateManifest(): void {
-		this._cachedManifest = null;
-		this._manifestPromise = null;
-		invalidateUrlPatternCache();
-		// Delete DB-persisted cache so the next cold start rebuilds.
-		// Fire-and-forget: in-memory is already cleared for this worker,
-		// DB delete is best-effort for the next cold start.
-		try {
-			const options = new OptionsRepository(this.db);
-			options.delete("emdash:manifest_cache").catch((error) => {
-				console.error("Failed to delete persisted manifest cache", error);
-			});
-		} catch (error) {
-			console.error("Failed to initialize manifest cache invalidation", error);
-		}
-	}
-
 	/**
 	 * Verify and repair FTS indexes on demand. Runs at most once per worker
 	 * lifetime.
@@ -1615,11 +1557,75 @@ export class EmDashRuntime {
 	}
 
 	async handleContentGet(collection: string, id: string, locale?: string) {
-		return handleContentGet(this.db, collection, id, locale);
+		const result = await handleContentGet(this.db, collection, id, locale);
+		return this.hydrateDraftData(result);
 	}
 
 	async handleContentGetIncludingTrashed(collection: string, id: string, locale?: string) {
-		return handleContentGetIncludingTrashed(this.db, collection, id, locale);
+		const result = await handleContentGetIncludingTrashed(this.db, collection, id, locale);
+		return this.hydrateDraftData(result);
+	}
+
+	/**
+	 * If the response item has a `draftRevisionId`, replace `item.data` with
+	 * the draft revision's data and expose the original published values as
+	 * `liveData`. This makes the content_get / content_update round-trip
+	 * intuitive — read returns the latest content the caller has saved
+	 * (their pending draft), with the previously-published values still
+	 * accessible for compare-style flows.
+	 *
+	 * No-op when no draft exists or the response is an error.
+	 */
+	private async hydrateDraftData<T>(result: T): Promise<T> {
+		if (!result || typeof result !== "object") return result;
+		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- shape probed below
+		const r = result as {
+			success?: boolean;
+			data?: { item?: Record<string, unknown> };
+		};
+		if (!r.success || !r.data?.item) return result;
+		const item = r.data.item;
+		const draftRevisionId = typeof item.draftRevisionId === "string" ? item.draftRevisionId : null;
+		if (!draftRevisionId) return result;
+		try {
+			const revision = await new RevisionRepository(this.db).findById(draftRevisionId);
+			if (!revision) return result;
+			const liveData =
+				item.data && typeof item.data === "object"
+					? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed to object above
+						(item.data as Record<string, unknown>)
+					: {};
+			// Strip leading-underscore keys (`_slug`, `_rev`, etc.) from the
+			// revision data — those are handler-internal markers and don't
+			// belong in the surfaced `data` field. Match syncDataColumns at
+			// content.ts:~1119.
+			const revisionData: Record<string, unknown> = {};
+			for (const [key, value] of Object.entries(revision.data)) {
+				if (!key.startsWith("_")) revisionData[key] = value;
+			}
+			const mergedData = { ...liveData, ...revisionData };
+			// Return a clone rather than mutating in place. The response
+			// object isn't retained by the runtime today, but a future
+			// request-cache layer would observe stale-after-mutation bugs;
+			// cloning closes that footgun.
+			// `r.data` was narrowed to `{ item?: ... }` at the top of this
+			// method; spread its other keys (e.g. `_rev`) alongside the
+			// hydrated item without going back through `unknown`.
+			return {
+				...result,
+				// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- shape preserved; result has been narrowed to the {success,data:{item}} envelope
+				data: {
+					...r.data,
+					item: { ...item, data: mergedData, liveData },
+				},
+			} as T;
+		} catch (error) {
+			// Non-fatal — fall back to the unhydrated response. Log so the
+			// failure isn't completely silent (the response will look stale
+			// to the caller but no error is raised).
+			console.error("[emdash] draft hydration failed:", error);
+			return result;
+		}
 	}
 
 	async handleContentCreate(
@@ -1647,6 +1653,20 @@ export class EmDashRuntime {
 		// Normalize media fields (fill dimensions, storageKey, etc.)
 		processedData = await this.normalizeMediaFields(collection, processedData);
 
+		// Validate against the collection schema. Hook output is validated
+		// rather than `body.data` so plugins that mutate field values can't
+		// sneak invalid data past.
+		const { validateContentData } = await import("./api/handlers/validation.js");
+		const validation = await validateContentData(this.db, collection, processedData, {
+			partial: false,
+		});
+		if (!validation.ok) {
+			return {
+				success: false as const,
+				error: validation.error,
+			};
+		}
+
 		// Create the content
 		const result = await handleContentCreate(this.db, collection, {
 			...body,
@@ -1672,6 +1692,14 @@ export class EmDashRuntime {
 			status?: string;
 			authorId?: string | null;
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
+			seo?: {
+				title?: string | null;
+				description?: string | null;
+				image?: string | null;
+				canonical?: string | null;
+				noIndex?: boolean;
+			};
+			publishedAt?: string | null;
 			/** Skip revision creation (used by autosave) */
 			skipRevision?: boolean;
 			_rev?: string;
@@ -1720,6 +1748,19 @@ export class EmDashRuntime {
 
 			// Normalize media fields (fill dimensions, storageKey, etc.)
 			processedData = await this.normalizeMediaFields(collection, processedData);
+
+			// Validate field-level shape BEFORE the draft-revision write so
+			// invalid updates can't silently land in revision history.
+			const { validateContentData } = await import("./api/handlers/validation.js");
+			const validation = await validateContentData(this.db, collection, processedData, {
+				partial: true,
+			});
+			if (!validation.ok) {
+				return {
+					success: false as const,
+					error: validation.error,
+				};
+			}
 		}
 
 		// Draft-aware revision handling (if collection supports revisions)
@@ -1795,12 +1836,18 @@ export class EmDashRuntime {
 			bylines: bodyWithoutRev.bylines,
 		});
 
+		// Hydrate draft data BEFORE firing afterSave hooks so the hook sees
+		// the same effective data the response surfaces — for revision-
+		// supporting collections, that's the just-saved draft, not the live
+		// columns.
+		const hydrated = await this.hydrateDraftData(result);
+
 		// Run afterSave hooks (fire-and-forget)
-		if (result.success && result.data) {
-			this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, false);
+		if (hydrated.success && hydrated.data) {
+			this.runAfterSaveHooks(contentItemToRecord(hydrated.data.item), collection, false);
 		}
 
-		return result;
+		return hydrated;
 	}
 
 	async handleContentDelete(collection: string, id: string) {
@@ -1879,8 +1926,12 @@ export class EmDashRuntime {
 	// Publishing & Scheduling Handlers
 	// =========================================================================
 
-	async handleContentPublish(collection: string, id: string) {
-		const result = await handleContentPublish(this.db, collection, id);
+	async handleContentPublish(
+		collection: string,
+		id: string,
+		options: { publishedAt?: string } = {},
+	) {
+		const result = await handleContentPublish(this.db, collection, id, options);
 
 		// Run afterPublish hooks (fire-and-forget)
 		if (result.success && result.data) {
@@ -1947,6 +1998,7 @@ export class EmDashRuntime {
 		contentHash?: string;
 		blurhash?: string;
 		dominantColor?: string;
+		authorId?: string;
 	}) {
 		// Run beforeUpload hooks
 		let processedInput = input;
@@ -2010,7 +2062,74 @@ export class EmDashRuntime {
 	}
 
 	async handleRevisionRestore(revisionId: string, callerUserId: string) {
-		return handleRevisionRestore(this.db, revisionId, callerUserId);
+		// Discover the parent entry up front so we can branch on whether
+		// the collection uses draft revisions.
+		const revisionRepo = new RevisionRepository(this.db);
+		const revision = await revisionRepo.findById(revisionId);
+		if (!revision) {
+			return {
+				success: false as const,
+				error: {
+					code: "NOT_FOUND",
+					message: `Revision not found: ${revisionId}`,
+				},
+			};
+		}
+
+		const collectionInfo = await this.schemaRegistry.getCollectionWithFields(revision.collection);
+		const usesDraftRevisions = collectionInfo?.supports?.includes("revisions") ?? false;
+
+		// Non-revision collections: keep the legacy behavior of writing the
+		// revision's data straight onto the live row. This preserves
+		// behavior for collections that opt out of the draft model.
+		if (!usesDraftRevisions) {
+			const result = await handleRevisionRestore(this.db, revisionId, callerUserId);
+			return this.hydrateDraftData(result);
+		}
+
+		// Revision-capable collections: restore is "make this revision the
+		// current draft". The live row's data columns are left untouched
+		// (only `draft_revision_id` and `updated_at` change). The caller
+		// must then `content_publish` to promote the restored draft to
+		// live, matching the documented tool contract.
+		try {
+			const newDraft = await revisionRepo.create({
+				collection: revision.collection,
+				entryId: revision.entryId,
+				data: revision.data,
+				authorId: callerUserId,
+			});
+
+			validateIdentifier(revision.collection, "collection");
+			const tableName = `ec_${revision.collection}`;
+			await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET draft_revision_id = ${newDraft.id},
+					updated_at = ${new Date().toISOString()}
+				WHERE id = ${revision.entryId}
+			`.execute(this.db);
+
+			// Fire-and-forget: prune old revisions to prevent unbounded growth
+			void revisionRepo
+				.pruneOldRevisions(revision.collection, revision.entryId, 50)
+				.catch(() => {});
+
+			// Return the freshly-fetched item with the new draft hydrated
+			// onto `data`. Without this the response would echo the live
+			// columns and the next `content_get` would surface different
+			// values (the bug that motivated this rewrite).
+			const refetched = await handleContentGet(this.db, revision.collection, revision.entryId);
+			return this.hydrateDraftData(refetched);
+		} catch (error) {
+			console.error("[emdash] revision restore failed:", error);
+			return {
+				success: false as const,
+				error: {
+					code: "REVISION_RESTORE_ERROR",
+					message: "Failed to restore revision",
+				},
+			};
+		}
 	}
 
 	// =========================================================================
@@ -2222,22 +2341,34 @@ export class EmDashRuntime {
 		collection: string,
 		isNew: boolean,
 	): void {
-		// Trusted plugins
-		if (this.hooks.hasHooks("content:afterSave")) {
-			this.hooks
-				.runContentAfterSave(content, collection, isNew)
-				.catch((err) => console.error("EmDash afterSave hook error:", err));
-		}
-
-		// Sandboxed plugins
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [id] = pluginKey.split(":");
-			if (!id || !this.isPluginEnabled(id)) continue;
+		after(async () => {
+			// Trusted plugins
+			if (this.hooks.hasHooks("content:afterSave")) {
+				try {
+					await this.hooks.runContentAfterSave(content, collection, isNew);
+				} catch (err) {
+					console.error("EmDash afterSave hook error:", err);
+				}
+			}
 
-			plugin
-				.invokeHook("content:afterSave", { content, collection, isNew })
-				.catch((err) => console.error(`EmDash: Sandboxed plugin ${id} afterSave error:`, err));
-		}
+			// Sandboxed plugins
+			const tasks: Promise<void>[] = [];
+			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
+				const [id] = pluginKey.split(":");
+				if (!id || !this.isPluginEnabled(id)) continue;
+
+				tasks.push(
+					(async () => {
+						try {
+							await plugin.invokeHook("content:afterSave", { content, collection, isNew });
+						} catch (err) {
+							console.error(`EmDash: Sandboxed plugin ${id} afterSave error:`, err);
+						}
+					})(),
+				);
+			}
+			await Promise.allSettled(tasks);
+		});
 	}
 
 	private runAfterDeleteHooks(id: string, collection: string, permanent: boolean): void {
@@ -2262,24 +2393,34 @@ export class EmDashRuntime {
 	}
 
 	private runAfterPublishHooks(content: Record<string, unknown>, collection: string): void {
-		// Trusted plugins
-		if (this.hooks.hasHooks("content:afterPublish")) {
-			this.hooks
-				.runContentAfterPublish(content, collection)
-				.catch((err) => console.error("EmDash afterPublish hook error:", err));
-		}
-
-		// Sandboxed plugins
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [pluginId] = pluginKey.split(":");
-			if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
+		after(async () => {
+			// Trusted plugins
+			if (this.hooks.hasHooks("content:afterPublish")) {
+				try {
+					await this.hooks.runContentAfterPublish(content, collection);
+				} catch (err) {
+					console.error("EmDash afterPublish hook error:", err);
+				}
+			}
 
-			plugin
-				.invokeHook("content:afterPublish", { content, collection })
-				.catch((err) =>
-					console.error(`EmDash: Sandboxed plugin ${pluginId} afterPublish error:`, err),
+			// Sandboxed plugins
+			const tasks: Promise<void>[] = [];
+			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
+				const [pluginId] = pluginKey.split(":");
+				if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
+
+				tasks.push(
+					(async () => {
+						try {
+							await plugin.invokeHook("content:afterPublish", { content, collection });
+						} catch (err) {
+							console.error(`EmDash: Sandboxed plugin ${pluginId} afterPublish error:`, err);
+						}
+					})(),
 				);
-		}
+			}
+			await Promise.allSettled(tasks);
+		});
 	}
 
 	private runAfterUnpublishHooks(content: Record<string, unknown>, collection: string): void {