@sanity/sdk 3.0.0-rc.0 → 3.0.0-rc.1

package/src/document/patchOperations.test.ts

@@ -274,10 +274,51 @@ describe('set', () => {
     expect(output).toEqual({a: 1, nonexistent: {path: 999}})
   })
 
-  it('creates an item from a key constraint if the key is not present', () => {
+  // Content Lake never creates array items when setting: a keyed or indexed
+  // segment that does not resolve is a silent no-op server-side. The applier
+  // used to append a degenerate item (without the key, even), which
+  // fabricated array items locally that would never exist on the server.
+  it('does not create an item from a key constraint if the key is not present', () => {
     const input = {items: [{_key: 'item1'}]}
     const output = set(input, {'items[_key=="item2"]': {_key: 'item2'}})
-    expect(output).toEqual({items: [{_key: 'item1'}, {_key: 'item2'}]})
+    expect(output).toEqual({items: [{_key: 'item1'}]})
+  })
+
+  it('does not create an item when setting a property under an unresolvable key constraint', () => {
+    const input = {
+      blocks: [
+        {
+          _key: 'b1',
+          children: [{_key: 's1', _type: 'span', text: 'hello', marks: []}],
+        },
+      ],
+    }
+    const output = set(input, {'blocks[_key=="b1"].children[_key=="missing"].marks': ['mark1']})
+    expect(output).toEqual(input)
+  })
+
+  it('does not create an item when setting through an out-of-bounds index', () => {
+    const input = {items: [{_key: 'item1', value: 1}]}
+    const output = set(input, {'items[3].value': 99})
+    expect(output).toEqual(input)
+  })
+
+  it('still sets a missing property on an existing keyed item', () => {
+    const input = {items: [{_key: 'item1'}]}
+    const output = set(input, {'items[_key=="item1"].value': 42})
+    expect(output).toEqual({items: [{_key: 'item1', value: 42}]})
+  })
+
+  it('does not create anything when an array-addressing segment targets a non-array', () => {
+    const input = {items: {nested: true}}
+    const output = set(input, {'items[_key=="item1"].value': 42})
+    expect(output).toEqual(input)
+  })
+
+  it('does not create an item when setting through a negative out-of-bounds index', () => {
+    const input = {items: [{_key: 'item1', value: 1}]}
+    const output = set(input, {'items[-5].value': 99})
+    expect(output).toEqual(input)
   })
 })
 
@@ -299,6 +340,12 @@ describe('setIfMissing', () => {
     const output = setIfMissing(input, {'a.b': 42})
     expect(output).toEqual({a: {b: 1}})
   })
+
+  it('does not create an item under an unresolvable key constraint', () => {
+    const input = {items: [{_key: 'item1'}]}
+    const output = setIfMissing(input, {'items[_key=="missing"].value': 1})
+    expect(output).toEqual(input)
+  })
 })
 
 describe('unset', () => {

package/src/document/patchOperations.ts

@@ -175,6 +175,54 @@ export const ensureArrayKeysDeep = memoize(<R>(input: R): R => {
   return Object.fromEntries(entries) as R
 })
 
+/**
+ * Whether every array-addressing segment (keyed `[_key=="…"]` or numeric
+ * index) in the given match path resolves to an existing array item.
+ *
+ * This mirrors Content Lake, which auto-creates missing *object* properties
+ * when setting but never creates *array items*:
+ *
+ * ```js
+ * // object properties are created, even nested ones:
+ * set({}, {'meta.author.name': 'Ada'})
+ * // -> {meta: {author: {name: 'Ada'}}}                    (applies)
+ *
+ * // array items are not:
+ * set({items: [{_key: 'a'}]}, {'items[_key=="b"].title': 'x'})
+ * // -> {items: [{_key: 'a'}]}                             (no-op)
+ * ```
+ *
+ * Without this filter, the second example fabricated a degenerate item
+ * (`{title: 'x'}`, no `_key`) that would never exist on the server, which
+ * is how concurrent Portable Text edits grew phantom span-less children.
+ */
+function resolvesArraySegments(input: unknown, path: SingleValuePath): boolean {
+  let current: unknown = input
+  for (const segment of path) {
+    if (typeof segment === 'string') {
+      // missing object properties (nested ones included) are created
+      // server-side, so a string segment may descend into undefined
+      current =
+        typeof current === 'object' && current !== null && !Array.isArray(current)
+          ? (current as Record<string, unknown>)[segment]
+          : undefined
+      continue
+    }
+    // keyed and numeric segments address array items, which are never created
+    if (!Array.isArray(current)) return false
+    if (isKeySegment(segment)) {
+      const index = getIndexForKey(current, segment._key)
+      if (index === undefined) return false
+      current = current[index]
+    } else {
+      const index = segment < 0 ? current.length + segment : segment
+      if (!(index in current)) return false
+      current = current[index]
+    }
+  }
+  return true
+}
+
 /**
  * Given an input object and a record of path expressions to values, this
  * function will set each match with the given value.
@@ -198,6 +246,7 @@ export function set(input: unknown, pathExpressionValues: Record<string, unknown
         replacementValue,
       })),
     )
+    .filter(({path}) => resolvesArraySegments(input, path))
     .reduce((acc, {path, replacementValue}) => setDeep(acc, path, replacementValue), input)
 
   return ensureArrayKeysDeep(result)
@@ -231,6 +280,7 @@ export function setIfMissing(
       }))
     })
     .filter((matchEntry) => matchEntry.value === null || matchEntry.value === undefined)
+    .filter(({path}) => resolvesArraySegments(input, path))
     .reduce((acc, {path, replacementValue}) => setDeep(acc, path, replacementValue), input)
 
   return ensureArrayKeysDeep(result)

package/src/document/permissions.test.ts

@@ -1,14 +1,14 @@
+import {DocumentId, getDraftId, getPublishedId} from '@sanity/id-utils'
 import {type SanityDocument} from '@sanity/types'
 import {evaluateSync, type ExprNode, parse} from 'groq-js'
 import {describe, expect, it} from 'vitest'
 
 import {createSanityInstance} from '../store/createSanityInstance'
-import {getDraftId, getPublishedId} from '../utils/ids'
 import {type DocumentAction} from './actions'
 import {calculatePermissions, createGrantsLookup, type DatasetAcl, type Grant} from './permissions'
 import {type SyncTransactionState} from './reducers'
 
-const instance = createSanityInstance()
+const instance = createSanityInstance({projectId: 'p', dataset: 'd'})
 
 afterAll(() => {
   instance.dispose()
@@ -32,9 +32,11 @@ const alwaysDeny = parse('false')
 const createState = (
   docStates: Record<string, {local: unknown}>,
   grants?: Record<Grant, ExprNode>,
+  identity?: string,
 ): SyncTransactionState => ({
   documentStates: docStates as SyncTransactionState['documentStates'],
   grants,
+  identity,
   queued: [],
   applied: [],
 })
@@ -52,6 +54,18 @@ describe('createGrantsLookup', () => {
       expect(evaluateSync(grants[key], {params: {document: dummyDoc}}).data).toBe(true)
     })
   })
+
+  it('should ignore unknown permissions like "manage"', () => {
+    const datasetAcl = [
+      {filter: '_id != null', permissions: ['history', 'read', 'update', 'create', 'manage']},
+    ] as DatasetAcl
+    const grants = createGrantsLookup(datasetAcl)
+    const dummyDoc = {_id: 'doc1'}
+    ;(['read', 'update', 'create', 'history'] as Grant[]).forEach((key) => {
+      expect(grants[key]).toBeDefined()
+      expect(evaluateSync(grants[key], {params: {document: dummyDoc}}).data).toBe(true)
+    })
+  })
 })
 
 describe('calculatePermissions', () => {
@@ -66,19 +80,16 @@ describe('calculatePermissions', () => {
     // For a document.create action, the selector expects both published and draft keys.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Original Title')},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {
+          local: createDoc(DocumentId('doc1'), 'Original Title'),
+        },
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
 
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toEqual({allowed: true})
@@ -88,18 +99,13 @@ describe('calculatePermissions', () => {
     // Missing the draft key will cause documentsSelector to return undefined.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
         // Missing getDraftId('doc1')
       },
       defaultGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     expect(calculatePermissions({instance, state}, {actions})).toBeUndefined()
   })
@@ -109,18 +115,13 @@ describe('calculatePermissions', () => {
     const deniedGrants = {...defaultGrants, create: alwaysDeny}
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       deniedGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -142,18 +143,13 @@ describe('calculatePermissions', () => {
     // Both published and draft documents are present as null.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: null},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: null},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        documentType: 'book',
-        type: 'document.edit',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', documentType: 'book', type: 'document.edit'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -173,18 +169,13 @@ describe('calculatePermissions', () => {
     const deniedGrants = {...defaultGrants, update: alwaysDeny}
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-        [getDraftId('doc1')]: {local: createDoc(getDraftId('doc1'), 'Draft Title')},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+        [getDraftId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Draft Title')},
       },
       deniedGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        documentType: 'book',
-        type: 'document.edit',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', documentType: 'book', type: 'document.edit'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -204,16 +195,11 @@ describe('calculatePermissions', () => {
 
   it('should return undefined if grants are not provided', () => {
     const state = createState({
-      [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-      [getDraftId('doc1')]: {local: null},
+      [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+      [getDraftId(DocumentId('doc1'))]: {local: null},
     })
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        type: 'document.create',
-        documentType: 'article',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', type: 'document.create', documentType: 'article'},
     ]
     expect(calculatePermissions({instance, state}, {actions})).toBeUndefined()
   })
@@ -222,18 +208,13 @@ describe('calculatePermissions', () => {
     // For document.delete, if the published document is missing, processActions throws an ActionError.
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: null},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: null},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
     const actions: DocumentAction[] = [
-      {
-        documentId: 'doc1',
-        documentType: 'book',
-        type: 'document.delete',
-        resource: {projectId: 'p', dataset: 'd'},
-      },
+      {documentId: 'doc1', documentType: 'book', type: 'document.delete'},
     ]
     const result = calculatePermissions({instance, state}, {actions})
     expect(result).toBeDefined()
@@ -252,8 +233,8 @@ describe('calculatePermissions', () => {
   it('should memoize the result for identical state and actions inputs', () => {
     const state = createState(
       {
-        [getPublishedId('doc1')]: {local: createDoc('doc1', 'Title')},
-        [getDraftId('doc1')]: {local: null},
+        [getPublishedId(DocumentId('doc1'))]: {local: createDoc(DocumentId('doc1'), 'Title')},
+        [getDraftId(DocumentId('doc1'))]: {local: null},
       },
       defaultGrants,
     )
@@ -261,11 +242,75 @@ describe('calculatePermissions', () => {
       documentId: 'doc1',
       type: 'document.create',
       documentType: 'article',
-      resource: {projectId: 'p', dataset: 'd'},
     }
     // notice how the action is a copy
     const result1 = calculatePermissions({instance, state}, {actions: [{...action}]})
     const result2 = calculatePermissions({instance, state}, {actions: [{...action}]})
     expect(result1).toBe(result2)
   })
+
+  describe('identity-aware grants', () => {
+    // Mirrors the canvas ACL filter shape: only the document's creator may
+    // update it. Without an identity passed to groq, `identity()` is null and
+    // the expression collapses to null — which used to read as "denied".
+    const canvasUpdateAcl: DatasetAcl = [
+      {
+        filter: '_type == "sanity.canvas.document" && _system.createdBy == identity()',
+        permissions: ['read', 'update'],
+      },
+    ]
+
+    const canvasDoc = (createdBy: string): SanityDocument => ({
+      _id: 'canvas-1',
+      _type: 'sanity.canvas.document',
+      _createdAt: '2025-01-01T00:00:00.000Z',
+      _updatedAt: '2025-01-01T00:00:00.000Z',
+      _rev: 'rev-1',
+      _system: {createdBy},
+    })
+
+    const editAction: DocumentAction = {
+      documentId: 'canvas-1',
+      documentType: 'sanity.canvas.document',
+      type: 'document.edit',
+      liveEdit: true,
+    }
+
+    it('allows edits when identity matches the document creator', () => {
+      const state = createState(
+        {'canvas-1': {local: canvasDoc('user-A')}},
+        createGrantsLookup(canvasUpdateAcl),
+        'user-A',
+      )
+      expect(calculatePermissions({instance, state}, {actions: [editAction]})).toEqual({
+        allowed: true,
+      })
+    })
+
+    it('denies edits when identity does not match the document creator', () => {
+      const state = createState(
+        {'canvas-1': {local: canvasDoc('user-A')}},
+        createGrantsLookup(canvasUpdateAcl),
+        'user-B',
+      )
+      const result = calculatePermissions({instance, state}, {actions: [editAction]})
+      expect(result?.allowed).toBe(false)
+      expect(result?.reasons).toEqual(
+        expect.arrayContaining([expect.objectContaining({type: 'access', documentId: 'canvas-1'})]),
+      )
+    })
+
+    it('denies edits when identity is not yet loaded', () => {
+      const state = createState(
+        {'canvas-1': {local: canvasDoc('user-A')}},
+        createGrantsLookup(canvasUpdateAcl),
+        undefined,
+      )
+      const result = calculatePermissions({instance, state}, {actions: [editAction]})
+      expect(result?.allowed).toBe(false)
+      expect(result?.reasons).toEqual(
+        expect.arrayContaining([expect.objectContaining({type: 'access', documentId: 'canvas-1'})]),
+      )
+    })
+  })
 })

package/src/document/permissions.ts

@@ -1,12 +1,14 @@
+import {DocumentId, getDraftId, getPublishedId, getVersionId} from '@sanity/id-utils'
 import {type SanityDocument} from '@sanity/types'
-import {evaluateSync, type ExprNode, parse} from 'groq-js'
+import {type ExprNode, parse} from 'groq-js'
 import {createSelector} from 'reselect'
 
+import {isReleasePerspective} from '../releases/utils/isReleasePerspective'
 import {type SelectorContext} from '../store/createStateSourceAction'
-import {getDraftId, getPublishedId} from '../utils/ids'
 import {MultiKeyWeakMap} from '../utils/MultiKeyWeakMap'
 import {type DocumentAction} from './actions'
-import {ActionError, PermissionActionError, processActions} from './processActions'
+import {ActionError, PermissionActionError, processActions} from './processActions/processActions'
+import {checkGrant} from './processActions/shared'
 import {type DocumentSet} from './processMutations'
 import {type SyncTransactionState} from './reducers'
 
@@ -28,6 +30,8 @@ export function createGrantsLookup(datasetAcl: DatasetAcl): Record<Grant, ExprNo
   for (const entry of datasetAcl) {
     for (const grant of entry.permissions) {
       const set = filtersByGrant[grant]
+      // Ignore permissions we don't model (e.g. "manage")
+      if (!set) continue
       set.add(entry.filter)
       filtersByGrant[grant] = set
     }
@@ -71,7 +75,14 @@ const documentsSelector = createSelector(
           // For liveEdit documents, only fetch the single document
           if (action.liveEdit) return [action.documentId]
           // For standard documents, fetch both draft and published
-          return [getPublishedId(action.documentId), getDraftId(action.documentId)]
+          const ids: string[] = [
+            getPublishedId(DocumentId(action.documentId)),
+            getDraftId(DocumentId(action.documentId)),
+          ]
+          if (isReleasePerspective(action.perspective)) {
+            ids.push(getVersionId(DocumentId(action.documentId), action.perspective.releaseName))
+          }
+          return ids
         })
         .flat(),
     )
@@ -132,11 +143,6 @@ const memoizedActionsSelector = createSelector(
   },
 )
 
-function checkGrant(grantExpr: ExprNode, document: SanityDocument): boolean {
-  const value = evaluateSync(grantExpr, {params: {document}})
-  return value.type === 'boolean' && value.data
-}
-
 /** @beta */
 export interface PermissionDeniedReason {
   type: 'precondition' | 'access'
@@ -164,11 +170,13 @@ export function calculatePermissions(
 const _calculatePermissions = createSelector(
   [
     ({state: {grants}}: SelectorContext<SyncTransactionState>) => grants,
+    ({state: {identity}}: SelectorContext<SyncTransactionState>) => identity,
     documentsSelector,
     memoizedActionsSelector,
   ],
   (
     grants: Record<Grant, ExprNode> | undefined,
+    identity: string | undefined,
     documents: DocumentSet | undefined,
     actions: DocumentAction[] | undefined,
   ): DocumentPermissionsResult | undefined => {
@@ -187,6 +195,7 @@ const _calculatePermissions = createSelector(
         base: documents,
         timestamp,
         grants,
+        identity,
       })
     } catch (error) {
       if (error instanceof PermissionActionError) {
@@ -210,17 +219,33 @@ const _calculatePermissions = createSelector(
       // Check edit actions with no patches
       if (action.type === 'document.edit' && !action.patches?.length) {
         const docId = action.documentId
-        // For liveEdit documents, only check the single document
-        const doc = action.liveEdit
-          ? documents[docId]
-          : (documents[getDraftId(docId)] ?? documents[getPublishedId(docId)])
+        let doc: SanityDocument | null | undefined
+        if (action.liveEdit) {
+          doc = documents[docId]
+        }
+        // don't allow users to edit version documents that don't exist
+        // they should be explicitly created first, as in studio
+        else if (isReleasePerspective(action.perspective)) {
+          doc = documents[getVersionId(DocumentId(docId), action.perspective.releaseName)]
+        } else {
+          doc =
+            documents[getDraftId(DocumentId(docId))] ?? documents[getPublishedId(DocumentId(docId))]
+        }
         if (!doc) {
-          reasons.push({
-            type: 'precondition',
-            message: `The document with ID "${docId}" could not be found. Please check that it exists before editing.`,
-            documentId: docId,
-          })
-        } else if (!checkGrant(grants.update, doc)) {
+          if (isReleasePerspective(action.perspective)) {
+            reasons.push({
+              type: 'precondition',
+              message: `The version document with ID "${docId}" could not be found. Please create it or add it to the release first.`,
+              documentId: docId,
+            })
+          } else {
+            reasons.push({
+              type: 'precondition',
+              message: `The document with ID "${docId}" could not be found. Please check that it exists before editing.`,
+              documentId: docId,
+            })
+          }
+        } else if (!checkGrant(grants.update, doc, identity)) {
           reasons.push({
             type: 'access',
             message: `You are not allowed to edit the document with ID "${docId}".`,

package/src/document/processActions/create.ts

@@ -0,0 +1,138 @@
+import {DocumentId, getDraftId, getPublishedId, getVersionId} from '@sanity/id-utils'
+import {type Mutation, type SanityDocument} from '@sanity/types'
+
+import {isReleasePerspective} from '../../releases/utils/isReleasePerspective'
+import {type CreateDocumentAction} from '../actions'
+import {getId, processMutations} from '../processMutations'
+import {
+  ActionError,
+  type ActionHandlerContext,
+  type ActionHandlerResult,
+  checkGrant,
+  PermissionActionError,
+} from './shared'
+
+export function handleCreate(
+  action: CreateDocumentAction,
+  ctx: ActionHandlerContext,
+): ActionHandlerResult {
+  const {transactionId, timestamp, grants, identity, outgoingActions, outgoingMutations} = ctx
+  let {base, working} = ctx
+
+  const documentId = getId(action.documentId)
+
+  if (action.liveEdit) {
+    if (working[documentId]) {
+      throw new ActionError({
+        documentId,
+        transactionId,
+        message: `This document already exists.`,
+      })
+    }
+
+    const newDocBase = {_type: action.documentType, _id: documentId, ...action.initialValue}
+    const newDocWorking = {
+      _type: action.documentType,
+      _id: documentId,
+      ...action.initialValue,
+    }
+    const mutations: Mutation[] = [{create: newDocWorking}]
+
+    base = processMutations({
+      documents: base,
+      transactionId,
+      mutations: [{create: newDocBase}],
+      timestamp,
+    })
+    working = processMutations({
+      documents: working,
+      transactionId,
+      mutations,
+      timestamp,
+    })
+
+    if (!checkGrant(grants.create, working[documentId] as SanityDocument, identity)) {
+      throw new PermissionActionError({
+        documentId,
+        transactionId,
+        message: `You do not have permission to create document "${documentId}".`,
+      })
+    }
+
+    // liveEdit documents use the mutation endpoint directly -- we don't send actions
+    outgoingMutations.push(...mutations)
+    return {base, working}
+  }
+
+  // Standard draft/published/version logic
+  const versionId = isReleasePerspective(action.perspective)
+    ? getVersionId(DocumentId(documentId), action.perspective.releaseName)
+    : undefined
+  const draftId = getDraftId(DocumentId(documentId))
+  const publishedId = getPublishedId(DocumentId(documentId))
+
+  const alreadyHasVersion = versionId ? working[versionId] : working[draftId]
+
+  if (alreadyHasVersion) {
+    const errorDocType = versionId ? 'release version' : 'draft'
+    throw new ActionError({
+      documentId,
+      transactionId,
+      message: `A ${errorDocType} of this document already exists. Please use or discard the existing ${errorDocType} before creating a new one.`,
+    })
+  }
+
+  // Spread the (possibly undefined) draft or published version directly.
+  // (studio uses the draft version as a base if you are in a release perspective)
+  const newDocBase = {
+    ...(base[draftId] ?? base[publishedId]),
+    _type: action.documentType,
+    _id: versionId ?? draftId,
+    ...action.initialValue,
+  }
+  const newDocWorking = {
+    ...(working[draftId] ?? working[publishedId]),
+    _type: action.documentType,
+    _id: versionId ?? draftId,
+    ...action.initialValue,
+  }
+  const mutations: Mutation[] = [{create: newDocWorking}]
+
+  base = processMutations({
+    documents: base,
+    transactionId,
+    mutations: [{create: newDocBase}],
+    timestamp,
+  })
+  working = processMutations({
+    documents: working,
+    transactionId,
+    mutations,
+    timestamp,
+  })
+
+  if (versionId && !checkGrant(grants.create, working[versionId] as SanityDocument, identity)) {
+    throw new PermissionActionError({
+      documentId,
+      transactionId,
+      message: `You do not have permission to create a release version for document "${documentId}".`,
+    })
+  } else if (
+    !versionId &&
+    !checkGrant(grants.create, working[draftId] as SanityDocument, identity)
+  ) {
+    throw new PermissionActionError({
+      documentId,
+      transactionId,
+      message: `You do not have permission to create a draft for document "${documentId}".`,
+    })
+  }
+
+  outgoingMutations.push(...mutations)
+  outgoingActions.push({
+    actionType: 'sanity.action.document.version.create',
+    publishedId,
+    attributes: newDocWorking,
+  })
+  return {base, working}
+}