@sanity/sdk 2.11.1 → 2.12.0

package/src/releases/releasesStore.ts

@@ -1,4 +1,4 @@
-import {type SanityDocument} from '@sanity/types'
+import {type ReleaseDocument} from '@sanity/client'
 import {map} from 'rxjs'
 
 import {type DocumentResource} from '../config/sanityConfig'
@@ -21,23 +21,23 @@ const ARCHIVED_RELEASE_STATES = ['archived', 'published']
 const STABLE_EMPTY_RELEASES: ReleaseDocument[] = []
 
 /**
- * Represents a document in a Sanity dataset that represents release options.
- * @internal
+ * Lifecycle states a release document can be in. Mirrors the server's
+ * `ReleaseState`.
+ * @beta
  */
-export type ReleaseDocument = SanityDocument & {
-  name: string
-  publishAt?: string
-  state: 'active' | 'scheduled'
-  metadata: {
-    title: string
-    releaseType: 'asap' | 'scheduled' | 'undecided'
-    intendedPublishAt?: string
-    description?: string
-  }
-}
+export type ReleaseState =
+  | 'active'
+  | 'archiving'
+  | 'unarchiving'
+  | 'archived'
+  | 'published'
+  | 'publishing'
+  | 'scheduled'
+  | 'scheduling'
 
 export interface ReleasesStoreState {
   activeReleases?: ReleaseDocument[]
+  allReleases?: ReleaseDocument[]
   error?: unknown
 }
 
@@ -45,6 +45,7 @@ export const releasesStore = defineStore<ReleasesStoreState, BoundResourceKey>({
   name: 'Releases',
   getInitialState: (): ReleasesStoreState => ({
     activeReleases: undefined,
+    allReleases: undefined,
   }),
   initialize: (context) => {
     const subscription = subscribeToReleases(context)
@@ -74,6 +75,26 @@ export const getActiveReleasesState = (
   // bindActionByResource keyFn destructures { resource } from the first param, so pass {} when no options
   _getActiveReleasesState(instance, options ?? {})
 
+/**
+ * Get every release in the store, including archived and published.
+ * @internal
+ */
+const _getAllReleasesState = bindActionByResource(
+  releasesStore,
+  createStateSourceAction({
+    selector: ({state}, _?) => state.allReleases,
+  }),
+)
+
+/**
+ * Get every release in the store, including archived and published.
+ * @internal
+ */
+export const getAllReleasesState = (
+  instance: SanityInstance,
+  options?: {resource?: DocumentResource},
+): StateSource<ReleaseDocument[] | undefined> => _getAllReleasesState(instance, options ?? {})
+
 const RELEASES_QUERY = 'releases::all()'
 
 const subscribeToReleases = ({
@@ -92,10 +113,12 @@ const subscribeToReleases = ({
       map((releases) => {
         // logic here mirrors that of studio:
         // https://github.com/sanity-io/sanity/blob/156e8fa482703d99219f08da7bacb384517f1513/packages/sanity/src/core/releases/store/useActiveReleases.ts#L29
-        state.set('setActiveReleases', {
-          activeReleases: sortReleases(releases ?? STABLE_EMPTY_RELEASES)
-            .filter((release) => !ARCHIVED_RELEASE_STATES.includes(release.state))
-            .reverse(),
+        const sorted = sortReleases(releases ?? STABLE_EMPTY_RELEASES).reverse()
+        state.set('setReleases', {
+          allReleases: sorted,
+          activeReleases: sorted.filter(
+            (release) => !ARCHIVED_RELEASE_STATES.includes(release.state),
+          ),
         })
       }),
     )

package/src/releases/utils/sortReleases.test.ts

@@ -1,6 +1,6 @@
+import {type ReleaseDocument} from '@sanity/client'
 import {describe, expect, it} from 'vitest'
 
-import {type ReleaseDocument} from '../releasesStore'
 import {sortReleases} from './sortReleases'
 
 // Mock function to create a release document
@@ -15,7 +15,7 @@ function createReleaseMock(
   return {
     _id: id,
     _rev: 'rev',
-    _type: 'release',
+    _type: 'system.release',
     _createdAt: new Date().toISOString(),
     _updatedAt: new Date().toISOString(),
     state: 'active',

package/src/releases/utils/sortReleases.ts

@@ -1,4 +1,4 @@
-import {type ReleaseDocument} from '../releasesStore'
+import {type ReleaseDocument} from '@sanity/client'
 
 // mirrors the order of the releases in the releases list in Studio
 // https://github.com/sanity-io/sanity/blob/main/packages/sanity/src/core/releases/hooks/utils.ts

package/src/telemetry/environment.test.ts

@@ -0,0 +1,119 @@
+import {afterEach, describe, expect, it, vi} from 'vitest'
+
+import {getTelemetryEnvironment, isTelemetryEnabled} from './environment'
+
+describe('getTelemetryEnvironment', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.unstubAllGlobals()
+  })
+
+  describe('browser', () => {
+    it('returns "development" on localhost', () => {
+      vi.stubGlobal('window', {location: {hostname: 'localhost'}})
+      expect(getTelemetryEnvironment()).toBe('development')
+    })
+
+    it('returns "development" on 127.0.0.1', () => {
+      vi.stubGlobal('window', {location: {hostname: '127.0.0.1'}})
+      expect(getTelemetryEnvironment()).toBe('development')
+    })
+
+    it('returns "production" on *.sanity.studio', () => {
+      vi.stubGlobal('window', {location: {hostname: 'myapp.sanity.studio'}})
+      expect(getTelemetryEnvironment()).toBe('production')
+    })
+
+    it('returns "production" on www.sanity.io (dashboard)', () => {
+      vi.stubGlobal('window', {location: {hostname: 'www.sanity.io'}})
+      expect(getTelemetryEnvironment()).toBe('production')
+    })
+
+    it('returns null on *.sanity.work (staging is intentionally not allowlisted)', () => {
+      vi.stubGlobal('window', {location: {hostname: 'www.sanity.work'}})
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('returns null on *.sanity.dev (preview hosts are intentionally not allowlisted)', () => {
+      vi.stubGlobal('window', {location: {hostname: 'preview-123.sanity.dev'}})
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('is case-insensitive on hostname', () => {
+      vi.stubGlobal('window', {location: {hostname: 'MyApp.Sanity.Studio'}})
+      expect(getTelemetryEnvironment()).toBe('production')
+    })
+
+    it('returns null on a customer-controlled domain', () => {
+      vi.stubGlobal('window', {location: {hostname: 'myapp.customer.com'}})
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('returns null on a lookalike subdomain (suffix match requires a leading dot)', () => {
+      // `evilsanity.studio` ends in `sanity.studio` but not `.sanity.studio`,
+      // so the suffix check rejects it.
+      vi.stubGlobal('window', {location: {hostname: 'evilsanity.studio'}})
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('returns null on the bare apex hostname (sanity.studio with no subdomain)', () => {
+      // The allowlist intentionally only matches subdomains (the leading
+      // `.` in `.sanity.studio` means the apex `sanity.studio` is excluded).
+      vi.stubGlobal('window', {location: {hostname: 'sanity.studio'}})
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('returns null when hostname is missing', () => {
+      vi.stubGlobal('window', {location: {}})
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('returns "development" on localhost even when NODE_ENV is production', () => {
+      vi.stubEnv('NODE_ENV', 'production')
+      vi.stubGlobal('window', {location: {hostname: 'localhost'}})
+      expect(getTelemetryEnvironment()).toBe('development')
+    })
+  })
+
+  describe('node', () => {
+    it('returns "development" when NODE_ENV=development and no window', () => {
+      vi.stubEnv('NODE_ENV', 'development')
+      vi.stubGlobal('window', undefined)
+      expect(getTelemetryEnvironment()).toBe('development')
+    })
+
+    it('returns null when NODE_ENV=production and no window', () => {
+      vi.stubEnv('NODE_ENV', 'production')
+      vi.stubGlobal('window', undefined)
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+
+    it('returns null when NODE_ENV=test and no window', () => {
+      vi.stubEnv('NODE_ENV', 'test')
+      vi.stubGlobal('window', undefined)
+      expect(getTelemetryEnvironment()).toBeNull()
+    })
+  })
+})
+
+describe('isTelemetryEnabled', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.unstubAllGlobals()
+  })
+
+  it('returns true on a Sanity-controlled domain', () => {
+    vi.stubGlobal('window', {location: {hostname: 'app.sanity.studio'}})
+    expect(isTelemetryEnabled()).toBe(true)
+  })
+
+  it('returns true on localhost', () => {
+    vi.stubGlobal('window', {location: {hostname: 'localhost'}})
+    expect(isTelemetryEnabled()).toBe(true)
+  })
+
+  it('returns false on a customer domain', () => {
+    vi.stubGlobal('window', {location: {hostname: 'myapp.example.com'}})
+    expect(isTelemetryEnabled()).toBe(false)
+  })
+})

package/src/telemetry/environment.ts

@@ -0,0 +1,92 @@
+/**
+ * Telemetry environment classification.
+ *
+ * - `'development'` — the SDK is running on the local developer's machine
+ *   (`localhost` / `127.0.0.1` in the browser, or `NODE_ENV=development`
+ *   in Node). These are the original dev-only telemetry sessions.
+ *
+ * - `'production'` — the SDK is running on a production Sanity-controlled
+ *   domain (Studio deployments on `*.sanity.studio`, the dashboard on
+ *   `*.sanity.io`) where end users are authenticated Sanity users with
+ *   Populus consent records. Production telemetry is gated to this
+ *   allowlist; SDK apps deployed to customer-controlled domains do not
+ *   emit telemetry. Staging (`*.sanity.work`) and preview
+ *   (`*.sanity.dev`) hosts are deliberately excluded.
+ *
+ * @internal
+ */
+export type TelemetryEnvironment = 'development' | 'production'
+
+/**
+ * Hostname suffixes that count as Sanity-controlled for the purposes of
+ * production telemetry. A user reaching one of these hosts in the
+ * browser is authenticated against Sanity and has a Populus consent
+ * record, so we apply the same telemetry rules as the Studio's
+ * `telemetry-sink`.
+ *
+ * The leading `.` is required: it ensures suffix matches hit a real
+ * subdomain boundary, so apex matches (`sanity.io`, `sanity.studio`)
+ * and lookalikes (`evilsanity.studio`) are excluded. Only production
+ * hosts are listed; staging (`*.sanity.work`) and preview
+ * (`*.sanity.dev`) hosts are excluded by omission.
+ *
+ * @internal
+ */
+const SANITY_CONTROLLED_HOST_SUFFIXES = ['.sanity.studio', '.sanity.io'] as const
+
+function getBrowserHostname(win: Window): string | null {
+  const hostname = win.location?.hostname
+  return typeof hostname === 'string' && hostname.length > 0 ? hostname.toLowerCase() : null
+}
+
+function isLocalHostname(hostname: string): boolean {
+  return hostname === 'localhost' || hostname === '127.0.0.1'
+}
+
+function isSanityControlledHostname(hostname: string): boolean {
+  return SANITY_CONTROLLED_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix))
+}
+
+/**
+ * Returns the telemetry environment for the current runtime, or `null`
+ * when telemetry should not run at all.
+ *
+ * Browser:
+ * - `localhost` / `127.0.0.1` → `'development'`
+ * - host matches the Sanity-controlled allowlist → `'production'`
+ * - anything else (customer domains, unknown contexts) → `null`
+ *
+ * Node (scripts, SSR, tests):
+ * - `NODE_ENV=development` → `'development'`
+ * - otherwise → `null`. Production-side server runtimes don't carry the
+ *   browser-authenticated user/consent assumption, so we don't enable
+ *   them under the production gate.
+ *
+ * Bracket-notation `process.env['NODE_ENV']` is used to avoid bundler
+ * dead-code replacement.
+ *
+ * @internal
+ */
+export function getTelemetryEnvironment(): TelemetryEnvironment | null {
+  if (typeof window !== 'undefined') {
+    const hostname = getBrowserHostname(window)
+    if (!hostname) return null
+    if (isLocalHostname(hostname)) return 'development'
+    if (isSanityControlledHostname(hostname)) return 'production'
+    return null
+  }
+
+  if (typeof process !== 'undefined' && process.env?.['NODE_ENV'] === 'development') {
+    return 'development'
+  }
+  return null
+}
+
+/**
+ * Convenience predicate for "telemetry can run in this environment".
+ *
+ * @internal
+ */
+export function isTelemetryEnabled(): boolean {
+  return getTelemetryEnvironment() !== null
+}

package/src/telemetry/{__telemetry__/sdk.telemetry.ts → events.ts}

@@ -1,15 +1,15 @@
 import {defineEvent} from '@sanity/telemetry'
 
 /** @internal */
-export const SDKDevSessionStarted = defineEvent<{
+export const SDKSessionStarted = defineEvent<{
   version: string
   projectId: string
   perspective: string
   authMethod: string
 }>({
-  name: 'SDK Dev Session Started',
+  name: 'SDK Session Started',
   version: 1,
-  description: 'SDK instance created in development mode',
+  description: 'SDK instance created (environment is recorded in the event context)',
 })
 
 /** @internal */
@@ -22,21 +22,21 @@ export const SDKHookMounted = defineEvent<{
 })
 
 /** @internal */
-export const SDKDevSessionEnded = defineEvent<{
+export const SDKSessionEnded = defineEvent<{
   durationSeconds: number
   hooksUsed: string[]
 }>({
-  name: 'SDK Dev Session Ended',
+  name: 'SDK Session Ended',
   version: 1,
-  description: 'SDK instance disposed in development mode',
+  description: 'SDK instance disposed (environment is recorded in the event context)',
 })
 
 /** @internal */
-export const SDKDevError = defineEvent<{
+export const SDKError = defineEvent<{
   errorType: string
   hookName: string
 }>({
-  name: 'SDK Dev Error',
+  name: 'SDK Error',
   version: 1,
-  description: 'Runtime error caught during SDK development',
+  description: 'Runtime error caught in the SDK',
 })