@sanity/client 7.22.0 → 7.23.0

package/dist/stega.browser.d.cts

@@ -1134,9 +1134,9 @@ declare interface ContentSourceMapValueMapping_2 {
 
 /** @public */
 export declare class CorsOriginError extends Error {
-  projectId: string
+  projectId?: string
   addOriginUrl?: URL
-  constructor({projectId}: {projectId: string})
+  constructor({projectId, credentials}?: {projectId?: string; credentials?: boolean})
 }
 
 /**
@@ -3363,6 +3363,20 @@ export declare class ObservableSanityClient {
       tag?: string
     },
   ): Observable<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Observable<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns an observable that resolves to the created document.
@@ -5286,6 +5300,20 @@ export declare class SanityClient {
       tag?: string
     },
   ): Promise<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Promise<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns a promise that resolves to the created document.

package/dist/stega.browser.d.ts

@@ -1134,9 +1134,9 @@ declare interface ContentSourceMapValueMapping_2 {
 
 /** @public */
 export declare class CorsOriginError extends Error {
-  projectId: string
+  projectId?: string
   addOriginUrl?: URL
-  constructor({projectId}: {projectId: string})
+  constructor({projectId, credentials}?: {projectId?: string; credentials?: boolean})
 }
 
 /**
@@ -3363,6 +3363,20 @@ export declare class ObservableSanityClient {
       tag?: string
     },
   ): Observable<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Observable<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns an observable that resolves to the created document.
@@ -5286,6 +5300,20 @@ export declare class SanityClient {
       tag?: string
     },
   ): Promise<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Promise<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns a promise that resolves to the created document.

package/dist/stega.d.cts

@@ -1134,9 +1134,9 @@ declare interface ContentSourceMapValueMapping_2 {
 
 /** @public */
 export declare class CorsOriginError extends Error {
-  projectId: string
+  projectId?: string
   addOriginUrl?: URL
-  constructor({projectId}: {projectId: string})
+  constructor({projectId, credentials}?: {projectId?: string; credentials?: boolean})
 }
 
 /**
@@ -3363,6 +3363,20 @@ export declare class ObservableSanityClient {
       tag?: string
     },
   ): Observable<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Observable<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns an observable that resolves to the created document.
@@ -5286,6 +5300,20 @@ export declare class SanityClient {
       tag?: string
     },
   ): Promise<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Promise<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns a promise that resolves to the created document.

package/dist/stega.d.ts

@@ -1134,9 +1134,9 @@ declare interface ContentSourceMapValueMapping_2 {
 
 /** @public */
 export declare class CorsOriginError extends Error {
-  projectId: string
+  projectId?: string
   addOriginUrl?: URL
-  constructor({projectId}: {projectId: string})
+  constructor({projectId, credentials}?: {projectId?: string; credentials?: boolean})
 }
 
 /**
@@ -3363,6 +3363,20 @@ export declare class ObservableSanityClient {
       tag?: string
     },
   ): Observable<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Observable<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns an observable that resolves to the created document.
@@ -5286,6 +5300,20 @@ export declare class SanityClient {
       tag?: string
     },
   ): Promise<(SanityDocument<R> | null)[]>
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {
+      signal?: AbortSignal
+      tag?: string
+    },
+  ): Promise<Set<string>>
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns a promise that resolves to the created document.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/client",
-  "version": "7.22.0",
+  "version": "7.23.0",
   "description": "Client for retrieving, creating and patching data from Sanity.io",
   "keywords": [
     "sanity",
@@ -130,7 +130,7 @@
   },
   "dependencies": {
     "@sanity/eventsource": "^5.0.2",
-    "get-it": "^8.7.2",
+    "get-it": "^8.8.0",
     "nanoid": "^3.3.11",
     "rxjs": "^7.0.0"
   },

package/src/SanityClient.ts

@@ -324,6 +324,20 @@ export class ObservableSanityClient {
     return dataMethods._getDocuments<R>(this, this.#httpRequest, ids, options)
   }
 
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {signal?: AbortSignal; tag?: string},
+  ): Observable<Set<string>> {
+    return dataMethods._documentsExists(this, this.#httpRequest, ids, options)
+  }
+
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns an observable that resolves to the created document.
@@ -1390,6 +1404,20 @@ export class SanityClient {
     return lastValueFrom(dataMethods._getDocuments<R>(this, this.#httpRequest, ids, options))
   }
 
+  /**
+   * Convenient and bandwidth efficient method of checking wether a set of document IDs exists.
+   * Returns a set of the IDs that exist.
+   *
+   * @param ids - Document IDs to check
+   * @param options - Request options
+   */
+  documentsExists(
+    ids: string[],
+    options?: {signal?: AbortSignal; tag?: string},
+  ): Promise<Set<string>> {
+    return lastValueFrom(dataMethods._documentsExists(this, this.#httpRequest, ids, options))
+  }
+
   /**
    * Create a document. Requires a `_type` property. If no `_id` is provided, it will be generated by the database.
    * Returns a promise that resolves to the created document.

package/src/data/dataMethods.ts

@@ -1,6 +1,6 @@
 import {getDraftId, getVersionFromId, getVersionId, isDraftId} from '@sanity/client/csm'
-import {from, type MonoTypeOperatorFunction, Observable} from 'rxjs'
-import {combineLatestWith, filter, map} from 'rxjs/operators'
+import {from, type MonoTypeOperatorFunction, Observable, of} from 'rxjs'
+import {combineLatestWith, concatMap, filter, map, reduce} from 'rxjs/operators'
 
 import {validateApiPerspective} from '../config'
 import {requestOptions} from '../http/requestOptions'
@@ -231,6 +231,51 @@ export function _getDocuments<R extends Record<string, Any>>(
   )
 }
 
+const DOCUMENTS_EXISTS_BATCH_SIZE = 100
+
+/** @internal */
+export function _documentsExists(
+  client: Client,
+  httpRequest: HttpRequest,
+  ids: string[],
+  opts: {signal?: AbortSignal; tag?: string} = {},
+): Observable<Set<string>> {
+  if (ids.length === 0) {
+    return of(new Set<string>())
+  }
+
+  const batches: string[][] = []
+  for (let i = 0; i < ids.length; i += DOCUMENTS_EXISTS_BATCH_SIZE) {
+    batches.push(ids.slice(i, i + DOCUMENTS_EXISTS_BATCH_SIZE))
+  }
+
+  const fetchBatch = (batchIds: string[]) =>
+    _requestObservable<Any>(client, httpRequest, {
+      uri: _getDataUrl(client, 'doc', batchIds.map(encodeURIComponent).join(',')),
+      tag: opts.tag,
+      signal: opts.signal,
+      query: {excludeContent: true},
+    }).pipe(
+      filter(isResponse),
+      map((event: Any) => {
+        const missing = new Set<string>()
+        for (const omitted of event.body.omitted || []) {
+          if (omitted.reason !== 'existence') continue
+          missing.add(omitted.id)
+        }
+        return new Set(batchIds.filter((id) => !missing.has(id)))
+      }),
+    )
+
+  return from(batches).pipe(
+    concatMap(fetchBatch),
+    reduce((acc, set) => {
+      for (const id of set) acc.add(id)
+      return acc
+    }, new Set<string>()),
+  )
+}
+
 /** @internal */
 export function _getReleaseDocuments<R extends Record<string, Any>>(
   client: ObservableSanityClient | SanityClient,
@@ -598,6 +643,11 @@ export function _requestObservable<R>(
   httpRequest: HttpRequest,
   options: RequestObservableOptions,
 ): Observable<HttpRequestEvent<R>> {
+  // Capture the call-site error here, where the caller's code is still
+  // on the synchronous call stack, and pass it through to get-it so errors
+  // include the originating call site rather than just internal plumbing.
+  const callSiteStack = new Error()
+
   const uri = options.url || (options.uri as string)
   const config = client.config()
 
@@ -667,6 +717,7 @@ export function _requestObservable<R>(
     config,
     Object.assign({}, options, {
       url: _getUrl(client, uri, useCdn),
+      callSiteStack,
     }),
   ) as RequestOptions
 

package/src/data/live.ts

@@ -1,4 +1,4 @@
-import {catchError, mergeMap, Observable, of} from 'rxjs'
+import {catchError, mergeMap, Observable, of, throwError} from 'rxjs'
 import {finalize, map} from 'rxjs/operators'
 
 import {CorsOriginError} from '../http/errors'
@@ -122,16 +122,10 @@ export class LiveClient {
       'goaway',
     ])
 
-    const checkCors = fetchObservable(url, {
-      method: 'OPTIONS',
-      mode: 'cors',
-      credentials: esOptions.withCredentials ? 'include' : 'omit',
-      headers: esOptions.headers,
-    }).pipe(
-      catchError(() => {
-        // If the request fails, then we assume it was due to CORS, and we rethrow a special error that allows special handling in userland
-        throw new CorsOriginError({projectId: projectId!})
-      }),
+    const checkCors = checkCorsObservable(
+      new URL(this.#client.getUrl('/check/cors', false)),
+      projectId,
+      esOptions.withCredentials === true,
     )
 
     const observable = events
@@ -145,6 +139,12 @@ export class LiveClient {
           return of(event)
         }),
         catchError((err) => {
+          // If a prior `reconnect` already ran the CORS probe and produced a
+          // `CorsOriginError`, just rethrow it instead of calling `/check/cors`
+          // a second time only to get the same answer.
+          if (err instanceof CorsOriginError) {
+            return throwError(() => err)
+          }
           return checkCors.pipe(
             mergeMap(() => {
               // rethrow the original error if checkCors passed
@@ -172,21 +172,92 @@ export class LiveClient {
   }
 }
 
-function fetchObservable(url: URL, init: RequestInit) {
-  return new Observable((observer) => {
+/**
+ * Probes the `/check/cors` endpoint to confirm whether the current origin is
+ * allowed by the project's CORS configuration. EventSource failures are opaque,
+ * so we use this side-channel purely to tell "the server actively rejected our
+ * origin" apart from every other class of failure.
+ *
+ * Errors with `CorsOriginError` when either:
+ *
+ * - `requireCredentials` is `true` (the EventSource was about to send
+ *   credentials) and `/check/cors` reports `result.withCredentials === false`.
+ *   The credentialed request would fail due to a missing
+ *   `access-control-allow-credentials` header. The resulting error carries
+ *   `credentials: true` so its `addOriginUrl` deep-link pre-selects the
+ *   "Allow credentials" toggle in the Sanity management form.
+ * - `/check/cors` reports `result.allowed === false` (origin is not on the
+ *   project's CORS allow-list). The error carries `credentials: requireCredentials`
+ *   so the deep-link still pre-selects credentials when the caller needed them.
+ *
+ * Every other outcome is intentionally treated as "we don't know": the
+ * observable emits a single `void` value and then completes, so downstream
+ * `mergeMap(() => ...)` consumers can continue. No error is surfaced for any
+ * of these cases:
+ *
+ * - `allowed: true` (with credentials satisfied if required) or an
+ *   unrecognised body shape: the server did not confirm a CORS rejection.
+ * - Non-2xx HTTP response from `/check/cors`: same - no signal either way, and
+ *   a 5xx on the probe shouldn't poison the EventSource's original error.
+ * - `fetch` / network / JSON parse failures: indistinguishable from ordinary
+ *   connectivity hiccups (offline, DNS, certs, transient outages). Reporting
+ *   those as CORS errors is exactly the false-positive class this helper
+ *   exists to prevent.
+ * - The subscription was aborted: nothing to emit and nothing to complete.
+ *
+ * In all of those cases the caller's original underlying error from the
+ * EventSource is allowed to propagate unchanged.
+ */
+function checkCorsObservable(
+  url: URL,
+  projectId: string | undefined,
+  requireCredentials: boolean,
+): Observable<void> {
+  return new Observable<void>((observer) => {
     const controller = new AbortController()
-    const signal = controller.signal
-    fetch(url, {...init, signal: controller.signal}).then(
-      (response) => {
-        observer.next(response)
-        observer.complete()
-      },
-      (err) => {
-        if (!signal.aborted) {
-          observer.error(err)
+    const {signal} = controller
+    fetch(url, {method: 'GET', mode: 'cors', credentials: 'omit', signal})
+      .then((response) => {
+        // Aborted or non-2xx: not a confirmed CORS rejection. Fall through with
+        // an undefined body so the next step takes the silent-completion path.
+        if (signal.aborted || !response.ok) return
+        return response.json() as Promise<{
+          result?: {allowed?: boolean; withCredentials?: boolean}
+        }>
+      })
+      .then((body) => {
+        if (signal.aborted) return
+        // Check the credentialed case first: if the EventSource was about to
+        // send credentials but the project's CORS config doesn't permit them,
+        // the credentialed request would fail with a missing
+        // `access-control-allow-credentials` header. Surface this as a CORS
+        // rejection with `credentials: true` so the deep-link pre-selects the
+        // "Allow credentials" toggle.
+        if (requireCredentials && body?.result?.withCredentials === false) {
+          observer.error(new CorsOriginError({projectId, credentials: true}))
+          return
         }
-      },
-    )
+        // Generic case: the server actively rejected this origin. Propagate
+        // `credentials: requireCredentials` so the deep-link still pre-selects
+        // credentials when the caller needed them.
+        if (body?.result?.allowed === false) {
+          observer.error(new CorsOriginError({projectId, credentials: requireCredentials}))
+          return
+        }
+        // Anything else (allowed + credentials satisfied, unrecognised body)
+        // is treated as "not a confirmed CORS rejection" - let the caller's
+        // original error surface instead.
+        observer.next()
+        observer.complete()
+      })
+      // Fetch/network/JSON parse errors are intentionally ignored - see the
+      // helper's docblock for the rationale. We still need to settle the
+      // observer so downstream `mergeMap(checkCors, ...)` consumers can proceed.
+      .catch(() => {
+        if (signal.aborted || observer.closed) return
+        observer.next()
+        observer.complete()
+      })
     return () => controller.abort()
   })
 }

package/src/http/errors.ts

@@ -256,23 +256,33 @@ function sliceWithEllipsis(str: string, max: number) {
 
 /** @public */
 export class CorsOriginError extends Error {
-  projectId: string
+  projectId?: string
   addOriginUrl?: URL
 
-  constructor({projectId}: {projectId: string}) {
+  constructor({projectId, credentials}: {projectId?: string; credentials?: boolean} = {}) {
     super('CorsOriginError')
     this.name = 'CorsOriginError'
     this.projectId = projectId
 
-    const url = new URL(`https://sanity.io/manage/project/${projectId}/api`)
-    if (typeof location !== 'undefined') {
+    // Only build a deep-link when we know which project the user needs to
+    // configure - without `projectId` the management URL can't actually route
+    // them anywhere useful.
+    if (projectId && typeof location !== 'undefined') {
+      const url = new URL(`https://sanity.io/manage/project/${projectId}/api`)
       const {origin} = location
       url.searchParams.set('cors', 'add')
       url.searchParams.set('origin', origin)
+      if (credentials) {
+        // Pre-selects the "Allow credentials (token-based auth)" toggle in
+        // the Sanity management CORS form.
+        url.searchParams.set('credentials', '')
+      }
       this.addOriginUrl = url
       this.message = `The current origin is not allowed to connect to the Live Content API. Add it here: ${url}`
+    } else if (projectId) {
+      this.message = `The current origin is not allowed to connect to the Live Content API. Change your configuration here: https://sanity.io/manage/project/${projectId}/api`
     } else {
-      this.message = `The current origin is not allowed to connect to the Live Content API. Change your configuration here: ${url}`
+      this.message = `The current origin is not allowed to connect to the Live Content API.`
     }
   }
 }