@sanity/sdk 3.0.0-rc.1 → 3.0.0

package/src/config/sanityConfig.ts

@@ -73,14 +73,11 @@ export interface DatasetHandle<TDataset extends string = string, TProjectId exte
   dataset?: TDataset
   /**
    * @beta
-   * Explicit resource object to use for this operation.
+   * Explicit resource to use. On an individual operation this overrides any default;
+   * on a `SanityConfig` it becomes the instance's default resource. Unlike
+   * `projectId`/`dataset`, this can also be a media library or canvas resource.
    */
   resource?: DocumentResource
-  /**
-   * @deprecated Use `resource` instead.
-   * @beta
-   */
-  source?: DocumentResource
 }
 
 /**
@@ -148,27 +145,6 @@ export interface SanityConfig extends DatasetHandle, PerspectiveHandle {
    * `SDKStudioContext` provider. Can also be set explicitly for programmatic use.
    */
   studio?: StudioConfig
-
-  /**
-   * Studio mode configuration for use of the SDK in a Sanity Studio.
-   * @remarks Controls whether studio mode features are enabled.
-   * @deprecated Use `studio` instead, which provides richer integration
-   * with the Studio's workspace (auth token sync, etc.).
-   */
-  studioMode?: {
-    enabled: boolean
-  }
-
-  /**
-   * @beta
-   * A list of named resources to use for this instance.
-   */
-  resources?: Record<string, DocumentResource>
-  /**
-   * @deprecated Use `resources` instead.
-   * @beta
-   */
-  sources?: Record<string, DocumentResource>
 }
 
 /**
@@ -216,51 +192,3 @@ export function isMediaLibraryResource(
 export function isCanvasResource(resource: DocumentResource): resource is CanvasResource {
   return 'canvasId' in resource
 }
-
-/**
- * @deprecated Use `DocumentResource` instead.
- * @beta
- */
-export type DocumentSource = DocumentResource
-
-/**
- * @deprecated Use `DatasetResource` instead.
- * @beta
- */
-export type DatasetSource = DatasetResource
-
-/**
- * @deprecated Use `MediaLibraryResource` instead.
- * @beta
- */
-export type MediaLibrarySource = MediaLibraryResource
-
-/**
- * @deprecated Use `CanvasResource` instead.
- * @beta
- */
-export type CanvasSource = CanvasResource
-
-/**
- * @deprecated Use `isDatasetResource` instead.
- * @beta
- */
-export function isDatasetSource(source: DocumentSource): source is DatasetSource {
-  return isDatasetResource(source)
-}
-
-/**
- * @deprecated Use `isMediaLibraryResource` instead.
- * @beta
- */
-export function isMediaLibrarySource(source: DocumentSource): source is MediaLibrarySource {
-  return isMediaLibraryResource(source)
-}
-
-/**
- * @deprecated Use `isCanvasResource` instead.
- * @beta
- */
-export function isCanvasSource(source: DocumentSource): source is CanvasSource {
-  return isCanvasResource(source)
-}

package/src/datasets/datasets.test.ts

@@ -1,20 +1,26 @@
 import {type SanityClient} from '@sanity/client'
 import {of} from 'rxjs'
-import {describe, it} from 'vitest'
+import {afterEach, beforeEach, describe, it} from 'vitest'
 
 import {getClientState} from '../client/clientStore'
-import {createSanityInstance} from '../store/createSanityInstance'
+import {createSanityInstance, type SanityInstance} from '../store/createSanityInstance'
 import {type StateSource} from '../store/createStateSourceAction'
-import {resolveDatasets} from './datasets'
+import {datasets} from './datasets'
 
 vi.mock('../client/clientStore')
 
 describe('datasets', () => {
-  it('calls the `client.observable.datasets.list` method on the client and returns the result', async () => {
-    const instance = createSanityInstance({projectId: 'p', dataset: 'd'})
-    const datasets = [{id: 'a'}, {id: 'b'}]
-    const list = vi.fn().mockReturnValue(of(datasets))
+  let instance: SanityInstance
+
+  beforeEach(() => {
+    instance = createSanityInstance({projectId: 'p', dataset: 'd'})
+  })
 
+  afterEach(() => {
+    instance.dispose()
+  })
+
+  const mockClientWithList = (list: ReturnType<typeof vi.fn>) => {
     const mockClient = {
       observable: {
         datasets: {list} as unknown as SanityClient['observable']['datasets'],
@@ -24,9 +30,38 @@ describe('datasets', () => {
     vi.mocked(getClientState).mockReturnValue({
       observable: of(mockClient),
     } as StateSource<SanityClient>)
+  }
+
+  it('calls the `client.observable.datasets.list` method on the client and returns the result', async () => {
+    const list = vi.fn().mockReturnValue(of([{id: 'a'}, {id: 'b'}]))
+    mockClientWithList(list)
 
-    const result = await resolveDatasets(instance)
-    expect(result).toEqual(datasets)
+    const result = await datasets.resolveState(instance)
+    expect(result).toEqual([{id: 'a'}, {id: 'b'}])
     expect(list).toHaveBeenCalled()
+    expect(getClientState).toHaveBeenCalledWith(
+      instance,
+      expect.objectContaining({projectId: 'p', useProjectHostname: true}),
+    )
+  })
+
+  it('reads datasets for an explicit projectId over the instance config', async () => {
+    const list = vi.fn().mockReturnValue(of([]))
+    mockClientWithList(list)
+
+    await datasets.resolveState(instance, {projectId: 'other'})
+    expect(getClientState).toHaveBeenCalledWith(
+      instance,
+      expect.objectContaining({projectId: 'other'}),
+    )
+  })
+
+  it('rejects when no projectId can be resolved', async () => {
+    const bare = createSanityInstance({})
+    // async wrapper: the missing-projectId error is thrown synchronously from getKey
+    await expect(async () => datasets.resolveState(bare)).rejects.toThrow(
+      'A projectId is required to use the datasets API.',
+    )
+    bare.dispose()
   })
 })

package/src/datasets/datasets.ts

@@ -1,33 +1,34 @@
+import {type DatasetsResponse} from '@sanity/client'
 import {switchMap} from 'rxjs'
 
 import {getClientState} from '../client/clientStore'
 import {type ProjectHandle} from '../config/sanityConfig'
-import {createFetcherStore} from '../utils/createFetcherStore'
+import {type SanityInstance} from '../store/createSanityInstance'
+import {defineFetcher} from '../store/fetcherStore'
 
 const API_VERSION = 'v2025-02-19'
 
-/** @public */
-export const datasets = createFetcherStore({
-  name: 'Datasets',
-  getKey: (instance, options?: ProjectHandle) => {
-    const projectId = options?.projectId ?? instance.config.projectId
-    if (!projectId) {
-      throw new Error('A projectId is required to use the project API.')
-    }
-    return projectId
-  },
-  fetcher: (instance) => (options?: ProjectHandle) => {
-    return getClientState(instance, {
+function resolveProjectId(instance: SanityInstance, options?: ProjectHandle): string {
+  const projectId = options?.projectId ?? instance.config.projectId
+  if (!projectId) {
+    throw new Error('A projectId is required to use the datasets API.')
+  }
+  return projectId
+}
+
+/**
+ * Fetcher for a project's datasets (`GET /datasets`), on the shared fetcher
+ * cache.
+ *
+ * @internal
+ */
+export const datasets = defineFetcher<[options?: ProjectHandle], DatasetsResponse>({
+  name: 'datasets',
+  getKey: resolveProjectId,
+  fetch: (instance) => (options) =>
+    getClientState(instance, {
       apiVersion: API_VERSION,
-      // non-null assertion is fine because we check above
-      projectId: (options?.projectId ?? instance.config.projectId)!,
+      projectId: resolveProjectId(instance, options),
       useProjectHostname: true,
-    }).observable.pipe(switchMap((client) => client.observable.datasets.list()))
-  },
+    }).observable.pipe(switchMap((client) => client.observable.datasets.list())),
 })
-
-/** @public */
-export const getDatasetsState = datasets.getState
-
-/** @public */
-export const resolveDatasets = datasets.resolveState

package/src/document/applyDocumentActions.test.ts

@@ -146,13 +146,10 @@ describe('applyDocumentActions', () => {
     await expect(applyPromise).rejects.toThrow('Simulated error')
   })
 
-  it('matches parent instance via child when action projectId and dataset do not match child config', async () => {
-    // Create a parent instance
-    const parentInstance = createSanityInstance({projectId: 'p', dataset: 'd'})
-    // Create a child instance with different config
-    const childInstance = parentInstance.createChild({projectId: 'child-p', dataset: 'child-d'})
-    // Use the child instance in context
-    // Create an action that refers to the parent's configuration
+  it('uses the explicit resource when it does not match the instance config', async () => {
+    // The instance is configured for one resource...
+    const scopedInstance = createSanityInstance({projectId: 'child-p', dataset: 'child-d'})
+    // ...while the action refers to a different one
     const action: DocumentAction = {
       type: 'document.edit',
       documentId: 'doc1',
@@ -161,14 +158,14 @@ describe('applyDocumentActions', () => {
       projectId: 'p',
       dataset: 'd',
     }
-    // Call applyDocumentActions with the context using childInstance, but with action requiring parent's config
-    const applyPromise = applyDocumentActions(childInstance, {
+    // The explicit `resource` option should win over the instance's own config
+    const applyPromise = applyDocumentActions(scopedInstance, {
       actions: [action],
       transactionId: 'txn-child-match',
       resource: {projectId: 'p', dataset: 'd'},
     })
 
-    // Simulate an applied transaction on the parent's instance
+    // Simulate an applied transaction for the explicitly-passed resource
     const appliedTx: AppliedTransaction = {
       transactionId: 'txn-child-match',
       actions: [action],
@@ -199,8 +196,7 @@ describe('applyDocumentActions', () => {
     const submittedResult = await result.submitted()
     expect(submittedResult).toEqual(acceptedResult)
 
-    childInstance.dispose()
-    parentInstance.dispose()
+    scopedInstance.dispose()
   })
 
   it('normalizes actions for the bound resource before queueing', async () => {

package/src/document/documentConstants.ts

@@ -9,9 +9,26 @@ export const DOCUMENT_STATE_CLEAR_DELAY = 1000
 export const INITIAL_OUTGOING_THROTTLE_TIME = 1000
 export const API_VERSION = 'v2025-05-06'
 
+/**
+ * How long a submitted transaction's revision is kept around waiting to be
+ * verified by its listener echo. After this, the transaction is no longer
+ * treated as in flight and a document held onto only for that verification can
+ * be evicted. Sized to match the listener's own chaining deadline, after which
+ * an echo that has not arrived is not going to.
+ */
+export const UNVERIFIED_REVISION_RETENTION_TIME = 30_000
+
 /**
  * Base delay (ms) before retrying a document listener after an `OutOfSyncError`.
  * Backoff doubles on each successive retry, capped at {@link OUT_OF_SYNC_RETRY_MAX_DELAY}.
  */
 export const OUT_OF_SYNC_RETRY_BASE_DELAY = 500
 export const OUT_OF_SYNC_RETRY_MAX_DELAY = 10_000
+
+/**
+ * Base delay (ms) before retrying the dataset ACL fetch after a transient
+ * failure (a network error or 5xx response). Backoff doubles on each
+ * successive retry, capped at {@link ACL_RETRY_MAX_DELAY}.
+ */
+export const ACL_RETRY_BASE_DELAY = 500
+export const ACL_RETRY_MAX_DELAY = 10_000

package/src/document/documentStore.test.ts

@@ -1,6 +1,7 @@
 import {
   type BaseActionOptions,
   type BaseMutationOptions,
+  ClientError,
   type FilteredResponseQueryOptions,
   type ListenEvent,
   type MultipleActionResult,
@@ -17,7 +18,18 @@ import {diffValue} from '@sanity/diff-patch'
 import {DocumentId, getDraftId, getPublishedId} from '@sanity/id-utils'
 import {type Mutation, type SanityDocument} from '@sanity/types'
 import {evaluate, parse} from 'groq-js'
-import {delay, first, firstValueFrom, from, Observable, of, ReplaySubject, Subject} from 'rxjs'
+import {
+  defer,
+  delay,
+  first,
+  firstValueFrom,
+  from,
+  Observable,
+  of,
+  ReplaySubject,
+  Subject,
+  throwError,
+} from 'rxjs'
 import {afterEach, beforeEach, expect, it, vi} from 'vitest'
 
 import {getClientState} from '../client/clientStore'
@@ -345,6 +357,75 @@ it('emits remote-patches events distinguishing own and foreign transactions', as
   state2Unsubscribe()
 })
 
+it('labels an echo that arrives after the last subscriber left as its own', async () => {
+  const doc = createDocumentHandle({documentId: 'existing-doc', documentType: 'article'})
+  const draftId = getDraftId(DocumentId(doc.documentId))
+  const state = getDocumentState(instance, doc)
+  const unsubscribe = state.subscribe()
+  await vi.waitUntil(() => state.getCurrent() !== undefined)
+  const previousRev = state.getCurrent()?._rev
+
+  // ack without emitting the listener echo, so the echo can be delivered later
+  // and out of band, which is the ordering the real API produces
+  const clientActionMockImplementation = vi.mocked(client.action).getMockImplementation()!
+  vi.mocked(client.action).mockImplementation(
+    async (_input, {transactionId = crypto.randomUUID()} = {}) => ({transactionId}),
+  )
+
+  const patchEvents: DocumentRemotePatchesEvent[] = []
+  const unsubscribeEvents = subscribeDocumentEvents(instance, {
+    resource,
+    eventHandler: (e) => {
+      if (e.type === 'remote-patches') patchEvents.push(e)
+    },
+  })
+
+  const edited = await applyDocumentActions(instance, {
+    actions: [editDocument(doc, {set: {title: 'edited while leaving'}})],
+    resource,
+  })
+
+  // the last subscriber leaves before the ack comes back, which used to delete
+  // the document state (and with it the memory of our own transaction) as soon
+  // as the ack released the transaction's subscription
+  unsubscribe()
+  await new Promise((resolve) => setTimeout(resolve, 50))
+  await edited.submitted()
+
+  const {events: listenerEvents} = (
+    createSharedListener as () => {
+      dispose: () => void
+      events: Subject<ListenEvent<SanityDocument>>
+    }
+  )()
+  listenerEvents.next({
+    type: 'mutation',
+    documentId: draftId,
+    eventId: `${edited.transactionId}#${draftId}`,
+    identity: 'example-user',
+    mutations: [{patch: {id: draftId, set: {title: 'edited while leaving'}}}],
+    timestamp: new Date().toISOString(),
+    transactionId: edited.transactionId,
+    transactionCurrentEvent: 1,
+    transactionTotalEvents: 1,
+    transition: 'update',
+    visibility: 'query',
+    previousRev,
+    resultRev: edited.transactionId,
+  } satisfies MutationEvent)
+  await vi.waitUntil(() => patchEvents.length > 0)
+
+  expect(patchEvents).toHaveLength(1)
+  expect(patchEvents[0]).toMatchObject({
+    documentId: draftId,
+    transactionId: edited.transactionId,
+    origin: 'local',
+  })
+
+  unsubscribeEvents()
+  vi.mocked(client.action).mockImplementation(clientActionMockImplementation)
+})
+
 it('handles concurrent edits and resolves conflicts', async () => {
   const doc = createDocumentHandle({documentId: 'doc-concurrent', documentType: 'article'})
   const state1 = getDocumentState(instance1, doc)
@@ -917,24 +998,101 @@ it('does not send credentials with the dataset ACL request', async () => {
   expect(aclCall![0]).not.toHaveProperty('withCredentials')
 })
 
-it('fetches ACL for MediaLibraryResource', async () => {
-  const mediaLibraryInstance = createSanityInstance({
-    projectId: 'p',
-    dataset: 'd',
-    resources: {
-      'media-library': {mediaLibraryId: 'test-media-library'},
-    },
+it('retries transient dataset ACL fetch failures instead of failing fatally', async () => {
+  const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
+
+  // the first attempt fails like a dropped connection; subsequent attempts succeed
+  let aclAttempts = 0
+  client.observable.request = vi.fn().mockReturnValue(
+    defer(() => {
+      aclAttempts++
+      if (aclAttempts === 1) return throwError(() => new Error('socket hang up'))
+      return of(datasetAcl)
+    }),
+  )
+
+  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const result = await resolvePermissions(instance, {actions: [createDocument(doc)]})
+
+  expect(result).toEqual({allowed: true})
+  expect(aclAttempts).toBe(2)
+
+  // the store never entered the fatal error state
+  const documentState = getDocumentState(instance, doc)
+  expect(() => documentState.getCurrent()).not.toThrow()
+})
+
+it('does not retry dataset ACL fetch failures caused by 4xx client errors', async () => {
+  const forbidden = new ClientError({
+    statusCode: 403,
+    headers: {},
+    body: {error: 'Forbidden', message: 'Session does not have access to this dataset'},
   })
 
+  let aclAttempts = 0
+  client.observable.request = vi.fn().mockReturnValue(
+    defer(() => {
+      aclAttempts++
+      return throwError(() => forbidden)
+    }),
+  )
+
+  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const documentState = getDocumentState(instance, doc)
+  const unsubscribe = documentState.subscribe()
+
+  // the error is fatal: it surfaces through the store instead of being retried
+  await vi.waitFor(() => {
+    expect(() => documentState.getCurrent()).toThrow(
+      'Forbidden - Session does not have access to this dataset',
+    )
+  })
+  expect(aclAttempts).toBe(1)
+
+  unsubscribe()
+})
+
+it('retries dataset ACL fetch failures caused by 429 rate-limit errors', async () => {
+  const rateLimited = new ClientError({
+    statusCode: 429,
+    headers: {},
+    body: {error: 'Too Many Requests', message: 'Rate limit exceeded'},
+  })
+  const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
+
+  // the first attempt is rate limited; subsequent attempts succeed
+  let aclAttempts = 0
+  client.observable.request = vi.fn().mockReturnValue(
+    defer(() => {
+      aclAttempts++
+      if (aclAttempts === 1) return throwError(() => rateLimited)
+      return of(datasetAcl)
+    }),
+  )
+
+  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const result = await resolvePermissions(instance, {actions: [createDocument(doc)]})
+
+  expect(result).toEqual({allowed: true})
+  expect(aclAttempts).toBe(2)
+
+  // the store never entered the fatal error state
+  const documentState = getDocumentState(instance, doc)
+  expect(() => documentState.getCurrent()).not.toThrow()
+})
+
+it('fetches ACL for MediaLibraryResource', async () => {
+  const mediaLibraryInstance = createSanityInstance()
+
   const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
   vi.mocked(client.request).mockResolvedValue(datasetAcl)
 
   const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
-  const mediaLibrarySource = {mediaLibraryId: 'test-media-library'}
+  const mediaLibraryResource = {mediaLibraryId: 'test-media-library'}
 
   const result = await resolvePermissions(mediaLibraryInstance, {
     actions: [createDocument(doc)],
-    resource: mediaLibrarySource,
+    resource: mediaLibraryResource,
   })
 
   expect(result).toEqual({allowed: true})
@@ -942,23 +1100,17 @@ it('fetches ACL for MediaLibraryResource', async () => {
 })
 
 it('fetches ACL for CanvasResource', async () => {
-  const canvasInstance = createSanityInstance({
-    projectId: 'p',
-    dataset: 'd',
-    resources: {
-      canvas: {canvasId: 'test-canvas'},
-    },
-  })
+  const canvasInstance = createSanityInstance()
 
   const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
   vi.mocked(client.request).mockResolvedValue(datasetAcl)
 
   const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
-  const canvasSource = {canvasId: 'test-canvas'}
+  const canvasResource = {canvasId: 'test-canvas'}
 
   const result = await resolvePermissions(canvasInstance, {
     actions: [createDocument(doc)],
-    resource: canvasSource,
+    resource: canvasResource,
   })
 
   expect(result).toEqual({allowed: true})
@@ -1250,6 +1402,8 @@ vi.mock('./documentConstants.ts', async (importOriginal) => {
     DOCUMENT_STATE_CLEAR_DELAY: 25,
     OUT_OF_SYNC_RETRY_BASE_DELAY: 0,
     OUT_OF_SYNC_RETRY_MAX_DELAY: 0,
+    ACL_RETRY_BASE_DELAY: 0,
+    ACL_RETRY_MAX_DELAY: 0,
   }
 })
 

package/src/document/documentStore.ts

@@ -1,4 +1,4 @@
-import {type Action, type Mutation} from '@sanity/client'
+import {type Action, ClientError, CorsOriginError, type Mutation} from '@sanity/client'
 import {DocumentId, getDraftId, getPublishedId, getVersionId} from '@sanity/id-utils'
 import {jsonMatch} from '@sanity/json-match'
 import {type SanityDocument} from 'groq'
@@ -48,6 +48,8 @@ import {createStateSourceAction, type StateSource} from '../store/createStateSou
 import {defineStore, type StoreContext} from '../store/defineStore'
 import {type DocumentAction} from './actions'
 import {
+  ACL_RETRY_BASE_DELAY,
+  ACL_RETRY_MAX_DELAY,
   API_VERSION,
   INITIAL_OUTGOING_THROTTLE_TIME,
   OUT_OF_SYNC_RETRY_BASE_DELAY,
@@ -562,10 +564,39 @@ const subscribeToClientAndFetchDatasetAcl = ({
   return getClientState(instance, clientOptions)
     .observable.pipe(
       switchMap((client) =>
-        client.observable.request<DatasetAcl>({
-          uri,
-          tag: 'acl.get',
-        }),
+        client.observable
+          .request<DatasetAcl>({
+            uri,
+            tag: 'acl.get',
+          })
+          .pipe(
+            retry({
+              delay: (error, retryCount) => {
+                // 4xx responses and CORS misconfigurations are not transient —
+                // the server will keep rejecting the request, so rethrow to
+                // surface them as a fatal store error. 408 (request timeout)
+                // and 429 (rate limit) are the exceptions: they resolve on
+                // their own, so they are retried like network errors
+                const isTransientClientError =
+                  error instanceof ClientError &&
+                  (error.statusCode === 408 || error.statusCode === 429)
+                if (
+                  (error instanceof ClientError && !isTransientClientError) ||
+                  error instanceof CorsOriginError
+                ) {
+                  return throwError(() => error)
+                }
+                // network errors (no status code), 408/429 responses, and 5xx
+                // responses are retried with exponential backoff so a transient
+                // failure during startup doesn't permanently brick the store
+                const backoff = Math.min(
+                  ACL_RETRY_BASE_DELAY * 2 ** (retryCount - 1),
+                  ACL_RETRY_MAX_DELAY,
+                )
+                return timer(backoff)
+              },
+            }),
+          ),
       ),
       tap((datasetAcl) => state.set('setGrants', {grants: createGrantsLookup(datasetAcl)})),
     )

package/src/document/patchOperations.test.ts

@@ -565,6 +565,33 @@ describe('diffMatchPatch', () => {
     expect(output).toEqual(input)
   })
 
+  it('applies the patch when its offsets miss a multi-byte boundary', () => {
+    // `\u00f8` is two bytes, so this patch's offsets land inside it and the byte
+    // walk overshoots. The default is to throw, which escapes the rebase loop in
+    // `reducers.ts` and kills the whole outgoing-actions pipeline: the instance
+    // then silently stops writing every document. The patch itself is fine and
+    // still applies.
+    const input = {foo: 'abcdefg\u00f8'}
+    const patch = '@@ -9,1 +9,2 @@\n \u00f8\n+!\n'
+
+    expect(() => diffMatchPatch(input, {foo: patch})).not.toThrow()
+    expect(diffMatchPatch(input, {foo: patch})).toEqual({foo: 'abcdefg\u00f8!'})
+  })
+
+  it('still patches the other properties in the same mutation', () => {
+    const input = {multibyte: 'abcdefg\u00f8', ascii: 'the quick brown fox'}
+
+    const output = diffMatchPatch(input, {
+      multibyte: '@@ -9,1 +9,2 @@\n \u00f8\n+!\n',
+      ascii: '@@ -13,7 +13,7 @@\n own \n-fox\n+cat\n',
+    })
+
+    expect(output).toEqual({
+      multibyte: 'abcdefg\u00f8!',
+      ascii: 'the quick brown cat',
+    })
+  })
+
   it('applies a diff-match-patch that makes no changes', () => {
     const input = {foo: 'unchanged'}
     const patch = '@@ -1,9 +1,9 @@\n unchanged\n'

package/src/document/patchOperations.ts

@@ -617,7 +617,16 @@ export function diffMatchPatch(
         )
       }
 
-      const [nextValue] = applyPatches(parsePatch(dmp), value)
+      // Offsets arrive as UTF-8 byte positions and can overshoot when they
+      // land inside a multi-byte character, which happens once the string a
+      // patch was computed against has diverged. The default is to throw, and
+      // that throw escapes the rebase loop in `reducers.ts`, kills the
+      // outgoing-actions pipeline, and leaves the instance silently dropping
+      // every write. Clamping to the nearest index applies the patch instead,
+      // which is what the Studio and the Portable Text editor already do.
+      const [nextValue] = applyPatches(parsePatch(dmp), value, {
+        allowExceedingIndices: true,
+      })
       return {path, value: nextValue}
     })
     .reduce((acc, {path, value}) => setDeep(acc, path, value), input)

package/src/document/permissions.test.ts

@@ -266,7 +266,9 @@ describe('calculatePermissions', () => {
       _createdAt: '2025-01-01T00:00:00.000Z',
       _updatedAt: '2025-01-01T00:00:00.000Z',
       _rev: 'rev-1',
-      _system: {createdBy},
+      // Content Lake sets `_system.createdBy` on canvas documents; the public
+      // `DocumentSystem` type doesn't declare it, so the literal needs a cast.
+      _system: {createdBy} as SanityDocument['_system'],
     })
 
     const editAction: DocumentAction = {