@sanity/sdk 3.0.0-rc.2 → 3.1.0

package/src/auth/studioModeAuth.test.ts

@@ -35,7 +35,7 @@ describe('checkForCookieAuth', () => {
 
     expect(result).toBe(true)
     expect(mockClient.request).toHaveBeenCalledWith({
-      uri: '/users/me',
+      url: '/users/me',
       withCredentials: true,
       tag: 'users.get-current',
     })

package/src/auth/studioModeAuth.ts

@@ -30,7 +30,7 @@ export async function checkForCookieAuth(
       timeout: COOKIE_AUTH_TIMEOUT_MS,
     })
     const user = await client.request({
-      uri: '/users/me',
+      url: '/users/me',
       withCredentials: true,
       tag: 'users.get-current',
     })

package/src/auth/subscribeToStateAndFetchCurrentUser.test.ts

@@ -57,7 +57,7 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
     })
     expect(mockRequest).toHaveBeenCalledWith({
       method: 'GET',
-      uri: '/users/me',
+      url: '/users/me',
       tag: 'users.get-current',
     })
 
@@ -97,7 +97,7 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
     })
     expect(mockRequest).toHaveBeenCalledWith({
       method: 'GET',
-      uri: '/users/me',
+      url: '/users/me',
       tag: 'users.get-current',
     })
 

package/src/auth/subscribeToStateAndFetchCurrentUser.ts

@@ -73,7 +73,7 @@ export const subscribeToStateAndFetchCurrentUser = (
       switchMap((client) =>
         client.observable
           .request<CurrentUser>({
-            uri: '/users/me',
+            url: '/users/me',
             method: 'GET',
             tag: 'users.get-current',
           })

package/src/comments/addonDatasetStore.test.ts

@@ -59,7 +59,7 @@ describe('getAddonDatasetState', () => {
     )
 
     expect(observableRequest).toHaveBeenCalledWith({
-      uri: '/projects/p/datasets?datasetProfile=comments&addonFor=d',
+      url: '/projects/p/datasets?datasetProfile=comments&addonFor=d',
       tag: 'comments.addon-dataset.list',
     })
   })
@@ -139,7 +139,7 @@ describe('provisionAddonDataset', () => {
 
     await expect(provisionAddonDataset(instance, {})).resolves.toBe('d-comments')
     expect(request).toHaveBeenCalledWith({
-      uri: '/comments/d/setup',
+      url: '/comments/d/setup',
       method: 'POST',
       tag: 'comments.addon-dataset.setup',
     })

package/src/comments/addonDatasetStore.ts

@@ -67,7 +67,7 @@ function requestAddonDataset(
 ): Observable<string | undefined> {
   return client.observable
     .request<{name: string}[] | undefined>({
-      uri: `/projects/${projectId}/datasets?datasetProfile=${ADDON_DATASET_PROFILE}&addonFor=${dataset}`,
+      url: `/projects/${projectId}/datasets?datasetProfile=${ADDON_DATASET_PROFILE}&addonFor=${dataset}`,
       tag: 'comments.addon-dataset.list',
     })
     .pipe(map((datasets) => datasets?.[0]?.name))
@@ -182,7 +182,7 @@ export const provisionAddonDataset: (
       })
 
       const response = await client.request<{datasetName?: string} | undefined>({
-        uri: `/comments/${resource.dataset}/setup`,
+        url: `/comments/${resource.dataset}/setup`,
         method: 'POST',
         tag: 'comments.addon-dataset.setup',
       })

package/src/comments/commentActions.ts

@@ -16,6 +16,7 @@ import {bindActionByResource, type BoundResourceKey} from '../store/createAction
 import {type SanityInstance} from '../store/createSanityInstance'
 import {type StoreState} from '../store/createStoreState'
 import {type StoreContext} from '../store/defineStore'
+import {randomUuid} from '../utils/ids'
 import {
   assertDatasetResource,
   getAddonDatasetState,
@@ -326,7 +327,7 @@ export const createComment: (
       options,
       buildCommentPayload({
         authorId: requireCurrentUserId(instance),
-        commentId: options.commentId ?? crypto.randomUUID(),
+        commentId: options.commentId ?? randomUuid(),
         contentSnapshot: options.contentSnapshot,
         context: options.context,
         documentRevisionId: options.documentRevisionId,
@@ -336,7 +337,7 @@ export const createComment: (
         fieldPath,
         selection: options.selection,
         status: options.status ?? 'open',
-        threadId: options.threadId ?? crypto.randomUUID(),
+        threadId: options.threadId ?? randomUuid(),
         ...(isReleasePerspective(perspective) ? {documentVersionId: perspective.releaseName} : {}),
       }),
     )
@@ -386,7 +387,7 @@ export const replyToComment: (
       options,
       buildCommentPayload({
         authorId: requireCurrentUserId(instance),
-        commentId: options.commentId ?? crypto.randomUUID(),
+        commentId: options.commentId ?? randomUuid(),
         handle: options,
         message: options.message,
         // Replies to a reply belong to the thread's first comment, matching how
@@ -420,7 +421,7 @@ export const updateComment: (
     {commentId, message}: UpdateCommentOptions,
   ) => {
     const lastEditedAt = new Date().toISOString()
-    const transactionId = crypto.randomUUID()
+    const transactionId = randomUuid()
     const previous = findCommentById(state, commentId)
 
     if (previous) {
@@ -468,7 +469,7 @@ export const setCommentStatus: (
     {state, instance, key}: StoreContext<CommentsStoreState, BoundResourceKey>,
     {commentId, status}: SetCommentStatusOptions,
   ) => {
-    const transactionId = crypto.randomUUID()
+    const transactionId = randomUuid()
     const previousComments: StoredComment[] = []
 
     for (const entry of Object.values(state.get().entries)) {

package/src/comments/commentsStore.ts

@@ -29,7 +29,7 @@ import {
 } from '../store/createStateSourceAction'
 import {type StoreState} from '../store/createStoreState'
 import {defineStore, type StoreContext} from '../store/defineStore'
-import {insecureRandomId} from '../utils/ids'
+import {randomId} from '../utils/ids'
 import {setCleanupTimeout} from '../utils/setCleanupTimeout'
 import {observeAddonDatasetClient} from './addonDatasetStore'
 import {buildCommentThreads} from './buildCommentThreads'
@@ -360,7 +360,7 @@ export const getCommentsState: (
     selector: selectComments,
     onSubscribe: ({state, instance}, options: CommentsOptions) => {
       const key = getCommentsKey(toCommentsKeyParts(instance, options))
-      const subscriptionId = insecureRandomId()
+      const subscriptionId = randomId(16)
       state.set('addSubscriber', addSubscriber(key, subscriptionId))
 
       return () => {
@@ -390,7 +390,7 @@ export const getCommentThreadsState: (
     selector: selectCommentThreads,
     onSubscribe: ({state, instance}, options: CommentsOptions) => {
       const key = getCommentsKey(toCommentsKeyParts(instance, options))
-      const subscriptionId = insecureRandomId()
+      const subscriptionId = randomId(16)
       state.set('addSubscriber', addSubscriber(key, subscriptionId))
 
       return () => {
@@ -452,7 +452,7 @@ function resolveList<T>(
   // fetch and this promise would never settle. Holding it only for the duration
   // of the resolve also means a component that suspends and then errors before
   // mounting does not leave a subscriber-less entry behind holding its error.
-  const subscriptionId = insecureRandomId()
+  const subscriptionId = randomId(16)
   state.set('addSubscriber', addSubscriber(key, subscriptionId))
 
   const release = () => state.set('removeSubscriber', removeSubscriber(key, subscriptionId))

package/src/datasets/datasets.test.ts

@@ -1,20 +1,26 @@
 import {type SanityClient} from '@sanity/client'
 import {of} from 'rxjs'
-import {describe, it} from 'vitest'
+import {afterEach, beforeEach, describe, it} from 'vitest'
 
 import {getClientState} from '../client/clientStore'
-import {createSanityInstance} from '../store/createSanityInstance'
+import {createSanityInstance, type SanityInstance} from '../store/createSanityInstance'
 import {type StateSource} from '../store/createStateSourceAction'
-import {resolveDatasets} from './datasets'
+import {datasets} from './datasets'
 
 vi.mock('../client/clientStore')
 
 describe('datasets', () => {
-  it('calls the `client.observable.datasets.list` method on the client and returns the result', async () => {
-    const instance = createSanityInstance({projectId: 'p', dataset: 'd'})
-    const datasets = [{id: 'a'}, {id: 'b'}]
-    const list = vi.fn().mockReturnValue(of(datasets))
+  let instance: SanityInstance
+
+  beforeEach(() => {
+    instance = createSanityInstance({projectId: 'p', dataset: 'd'})
+  })
 
+  afterEach(() => {
+    instance.dispose()
+  })
+
+  const mockClientWithList = (list: ReturnType<typeof vi.fn>) => {
     const mockClient = {
       observable: {
         datasets: {list} as unknown as SanityClient['observable']['datasets'],
@@ -24,9 +30,38 @@ describe('datasets', () => {
     vi.mocked(getClientState).mockReturnValue({
       observable: of(mockClient),
     } as StateSource<SanityClient>)
+  }
+
+  it('calls the `client.observable.datasets.list` method on the client and returns the result', async () => {
+    const list = vi.fn().mockReturnValue(of([{id: 'a'}, {id: 'b'}]))
+    mockClientWithList(list)
 
-    const result = await resolveDatasets(instance)
-    expect(result).toEqual(datasets)
+    const result = await datasets.resolveState(instance)
+    expect(result).toEqual([{id: 'a'}, {id: 'b'}])
     expect(list).toHaveBeenCalled()
+    expect(getClientState).toHaveBeenCalledWith(
+      instance,
+      expect.objectContaining({projectId: 'p', useProjectHostname: true}),
+    )
+  })
+
+  it('reads datasets for an explicit projectId over the instance config', async () => {
+    const list = vi.fn().mockReturnValue(of([]))
+    mockClientWithList(list)
+
+    await datasets.resolveState(instance, {projectId: 'other'})
+    expect(getClientState).toHaveBeenCalledWith(
+      instance,
+      expect.objectContaining({projectId: 'other'}),
+    )
+  })
+
+  it('rejects when no projectId can be resolved', async () => {
+    const bare = createSanityInstance({})
+    // async wrapper: the missing-projectId error is thrown synchronously from getKey
+    await expect(async () => datasets.resolveState(bare)).rejects.toThrow(
+      'A projectId is required to use the datasets API.',
+    )
+    bare.dispose()
   })
 })

package/src/datasets/datasets.ts

@@ -1,33 +1,34 @@
+import {type DatasetsResponse} from '@sanity/client'
 import {switchMap} from 'rxjs'
 
 import {getClientState} from '../client/clientStore'
 import {type ProjectHandle} from '../config/sanityConfig'
-import {createFetcherStore} from '../utils/createFetcherStore'
+import {type SanityInstance} from '../store/createSanityInstance'
+import {defineFetcher} from '../store/fetcherStore'
 
 const API_VERSION = 'v2025-02-19'
 
-/** @public */
-export const datasets = createFetcherStore({
-  name: 'Datasets',
-  getKey: (instance, options?: ProjectHandle) => {
-    const projectId = options?.projectId ?? instance.config.projectId
-    if (!projectId) {
-      throw new Error('A projectId is required to use the project API.')
-    }
-    return projectId
-  },
-  fetcher: (instance) => (options?: ProjectHandle) => {
-    return getClientState(instance, {
+function resolveProjectId(instance: SanityInstance, options?: ProjectHandle): string {
+  const projectId = options?.projectId ?? instance.config.projectId
+  if (!projectId) {
+    throw new Error('A projectId is required to use the datasets API.')
+  }
+  return projectId
+}
+
+/**
+ * Fetcher for a project's datasets (`GET /datasets`), on the shared fetcher
+ * cache.
+ *
+ * @internal
+ */
+export const datasets = defineFetcher<[options?: ProjectHandle], DatasetsResponse>({
+  name: 'datasets',
+  getKey: resolveProjectId,
+  fetch: (instance) => (options) =>
+    getClientState(instance, {
       apiVersion: API_VERSION,
-      // non-null assertion is fine because we check above
-      projectId: (options?.projectId ?? instance.config.projectId)!,
+      projectId: resolveProjectId(instance, options),
       useProjectHostname: true,
-    }).observable.pipe(switchMap((client) => client.observable.datasets.list()))
-  },
+    }).observable.pipe(switchMap((client) => client.observable.datasets.list())),
 })
-
-/** @public */
-export const getDatasetsState = datasets.getState
-
-/** @public */
-export const resolveDatasets = datasets.resolveState

package/src/document/applyDocumentActions.ts

@@ -5,6 +5,7 @@ import {type DocumentResource} from '../config/sanityConfig'
 import {bindActionByResource} from '../store/createActionBinder'
 import {type SanityInstance} from '../store/createSanityInstance'
 import {type StoreContext} from '../store/defineStore'
+import {randomUuid} from '../utils/ids'
 import {type Action} from './actions'
 import {documentStore, type DocumentStoreState} from './documentStore'
 import {type DocumentTransactionSubmissionResult} from './events'
@@ -74,12 +75,7 @@ const boundApplyDocumentActions = bindActionByResource(documentStore, _applyDocu
 /** @internal */
 async function _applyDocumentActions(
   {state}: StoreContext<DocumentStoreState>,
-  {
-    actions,
-    resource,
-    transactionId = crypto.randomUUID(),
-    disableBatching,
-  }: ApplyDocumentActionsOptions,
+  {actions, resource, transactionId = randomUuid(), disableBatching}: ApplyDocumentActionsOptions,
 ): Promise<ActionsResult> {
   const {events} = state.get()
 

package/src/document/documentConstants.ts

@@ -9,6 +9,15 @@ export const DOCUMENT_STATE_CLEAR_DELAY = 1000
 export const INITIAL_OUTGOING_THROTTLE_TIME = 1000
 export const API_VERSION = 'v2025-05-06'
 
+/**
+ * How long a submitted transaction's revision is kept around waiting to be
+ * verified by its listener echo. After this, the transaction is no longer
+ * treated as in flight and a document held onto only for that verification can
+ * be evicted. Sized to match the listener's own chaining deadline, after which
+ * an echo that has not arrived is not going to.
+ */
+export const UNVERIFIED_REVISION_RETENTION_TIME = 30_000
+
 /**
  * Base delay (ms) before retrying a document listener after an `OutOfSyncError`.
  * Backoff doubles on each successive retry, capped at {@link OUT_OF_SYNC_RETRY_MAX_DELAY}.

package/src/document/documentStore.concurrency.test.ts

@@ -44,6 +44,7 @@ import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest'
 import {getClientState} from '../client/clientStore'
 import {createSanityInstance, type SanityInstance} from '../store/createSanityInstance'
 import {type StateSource} from '../store/createStateSourceAction'
+import {randomUuid} from '../utils/ids'
 import {editDocument, publishDocument} from './actions'
 import {applyDocumentActions} from './applyDocumentActions'
 import {getDocumentState, getDocumentSyncStatus} from './documentStore'
@@ -273,7 +274,7 @@ function createMockClient(server: MockContentLake): SanityClient {
 
   const action = vi.fn(async (input: HttpAction | HttpAction[], options?: BaseActionOptions) => {
     const actions = Array.isArray(input) ? input : [input]
-    return server.submitActions(actions, options?.transactionId ?? crypto.randomUUID())
+    return server.submitActions(actions, options?.transactionId ?? randomUuid())
   })
 
   const request = vi.fn(async () => {

package/src/document/documentStore.test.ts

@@ -36,6 +36,7 @@ import {getClientState} from '../client/clientStore'
 import {createDocumentHandle} from '../config/handles'
 import {createSanityInstance, type SanityInstance} from '../store/createSanityInstance'
 import {type StateSource} from '../store/createStateSourceAction'
+import {randomUuid} from '../utils/ids'
 import {
   createDocument,
   deleteDocument,
@@ -357,6 +358,75 @@ it('emits remote-patches events distinguishing own and foreign transactions', as
   state2Unsubscribe()
 })
 
+it('labels an echo that arrives after the last subscriber left as its own', async () => {
+  const doc = createDocumentHandle({documentId: 'existing-doc', documentType: 'article'})
+  const draftId = getDraftId(DocumentId(doc.documentId))
+  const state = getDocumentState(instance, doc)
+  const unsubscribe = state.subscribe()
+  await vi.waitUntil(() => state.getCurrent() !== undefined)
+  const previousRev = state.getCurrent()?._rev
+
+  // ack without emitting the listener echo, so the echo can be delivered later
+  // and out of band, which is the ordering the real API produces
+  const clientActionMockImplementation = vi.mocked(client.action).getMockImplementation()!
+  vi.mocked(client.action).mockImplementation(
+    async (_input, {transactionId = randomUuid()} = {}) => ({transactionId}),
+  )
+
+  const patchEvents: DocumentRemotePatchesEvent[] = []
+  const unsubscribeEvents = subscribeDocumentEvents(instance, {
+    resource,
+    eventHandler: (e) => {
+      if (e.type === 'remote-patches') patchEvents.push(e)
+    },
+  })
+
+  const edited = await applyDocumentActions(instance, {
+    actions: [editDocument(doc, {set: {title: 'edited while leaving'}})],
+    resource,
+  })
+
+  // the last subscriber leaves before the ack comes back, which used to delete
+  // the document state (and with it the memory of our own transaction) as soon
+  // as the ack released the transaction's subscription
+  unsubscribe()
+  await new Promise((resolve) => setTimeout(resolve, 50))
+  await edited.submitted()
+
+  const {events: listenerEvents} = (
+    createSharedListener as () => {
+      dispose: () => void
+      events: Subject<ListenEvent<SanityDocument>>
+    }
+  )()
+  listenerEvents.next({
+    type: 'mutation',
+    documentId: draftId,
+    eventId: `${edited.transactionId}#${draftId}`,
+    identity: 'example-user',
+    mutations: [{patch: {id: draftId, set: {title: 'edited while leaving'}}}],
+    timestamp: new Date().toISOString(),
+    transactionId: edited.transactionId,
+    transactionCurrentEvent: 1,
+    transactionTotalEvents: 1,
+    transition: 'update',
+    visibility: 'query',
+    previousRev,
+    resultRev: edited.transactionId,
+  } satisfies MutationEvent)
+  await vi.waitUntil(() => patchEvents.length > 0)
+
+  expect(patchEvents).toHaveLength(1)
+  expect(patchEvents[0]).toMatchObject({
+    documentId: draftId,
+    transactionId: edited.transactionId,
+    origin: 'local',
+  })
+
+  unsubscribeEvents()
+  vi.mocked(client.action).mockImplementation(clientActionMockImplementation)
+})
+
 it('handles concurrent edits and resolves conflicts', async () => {
   const doc = createDocumentHandle({documentId: 'doc-concurrent', documentType: 'article'})
   const state1 = getDocumentState(instance1, doc)
@@ -602,7 +672,7 @@ it('fetches documents if there are no active subscriptions for the actions appli
 })
 
 it('batches edit transaction into one outgoing transaction', async () => {
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
 
   const unsubscribe = getDocumentState(instance, doc).subscribe()
 
@@ -678,7 +748,7 @@ it('submits liveEdit document edits through observable.mutate', async () => {
 })
 
 it('provides the consistency status via `getDocumentSyncStatus`', async () => {
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
 
   const syncStatus = getDocumentSyncStatus(instance, doc)
   expect(syncStatus.getCurrent()).toBeUndefined()
@@ -733,7 +803,7 @@ it('reverts failed outgoing transaction locally', async () => {
     })
   })
 
-  const documentId = DocumentId(crypto.randomUUID())
+  const documentId = DocumentId(randomUuid())
   const doc = createDocumentHandle({documentId, documentType: 'article'})
 
   const {getCurrent, subscribe} = getDocumentState(instance, doc)
@@ -801,7 +871,7 @@ it('removes a queued transaction if it fails to apply', async () => {
     })
   })
 
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   const state = getDocumentState(instance, doc)
   const unsubscribe = state.subscribe()
 
@@ -906,8 +976,8 @@ it('fetches dataset ACL and updates grants in the document store state', async (
   ]
   vi.mocked(client.request).mockResolvedValue(datasetAcl)
 
-  const book = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'book'})
-  const author = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'author'})
+  const book = createDocumentHandle({documentId: randomUuid(), documentType: 'book'})
+  const author = createDocumentHandle({documentId: randomUuid(), documentType: 'author'})
 
   expect(await resolvePermissions(instance, {actions: [createDocument(book)]})).toEqual({
     allowed: true,
@@ -919,12 +989,12 @@ it('fetches dataset ACL and updates grants in the document store state', async (
 })
 
 it('does not send credentials with the dataset ACL request', async () => {
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   await resolvePermissions(instance, {actions: [createDocument(doc)]})
 
   const aclCall = vi
     .mocked(client.request)
-    .mock.calls.find(([options]) => options.uri?.endsWith('/acl'))
+    .mock.calls.find(([options]) => options.url?.endsWith('/acl'))
   expect(aclCall).toBeDefined()
   expect(aclCall![0]).not.toHaveProperty('withCredentials')
 })
@@ -942,7 +1012,7 @@ it('retries transient dataset ACL fetch failures instead of failing fatally', as
     }),
   )
 
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   const result = await resolvePermissions(instance, {actions: [createDocument(doc)]})
 
   expect(result).toEqual({allowed: true})
@@ -968,7 +1038,7 @@ it('does not retry dataset ACL fetch failures caused by 4xx client errors', asyn
     }),
   )
 
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   const documentState = getDocumentState(instance, doc)
   const unsubscribe = documentState.subscribe()
 
@@ -1001,7 +1071,7 @@ it('retries dataset ACL fetch failures caused by 429 rate-limit errors', async (
     }),
   )
 
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   const result = await resolvePermissions(instance, {actions: [createDocument(doc)]})
 
   expect(result).toEqual({allowed: true})
@@ -1018,7 +1088,7 @@ it('fetches ACL for MediaLibraryResource', async () => {
   const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
   vi.mocked(client.request).mockResolvedValue(datasetAcl)
 
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   const mediaLibraryResource = {mediaLibraryId: 'test-media-library'}
 
   const result = await resolvePermissions(mediaLibraryInstance, {
@@ -1036,7 +1106,7 @@ it('fetches ACL for CanvasResource', async () => {
   const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
   vi.mocked(client.request).mockResolvedValue(datasetAcl)
 
-  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const doc = createDocumentHandle({documentId: randomUuid(), documentType: 'article'})
   const canvasResource = {canvasId: 'test-canvas'}
 
   const result = await resolvePermissions(canvasInstance, {
@@ -1049,7 +1119,7 @@ it('fetches ACL for CanvasResource', async () => {
 })
 
 it('returns a promise that resolves when a document has been loaded in the store (useful for suspense)', async () => {
-  const documentId = DocumentId(crypto.randomUUID())
+  const documentId = DocumentId(randomUuid())
   const doc = createDocumentHandle({documentId, documentType: 'article'})
 
   expect(await resolveDocument(instance, doc)).toBe(null)
@@ -1074,7 +1144,7 @@ it('emits an event for each action after an outgoing transaction has been accept
   const handler = vi.fn()
   const unsubscribe = subscribeDocumentEvents(instance, {resource, eventHandler: handler})
 
-  const documentId = DocumentId(crypto.randomUUID())
+  const documentId = DocumentId(randomUuid())
   const doc = createDocumentHandle({documentId, documentType: 'article'})
   expect(handler).toHaveBeenCalledTimes(0)
 
@@ -1505,7 +1575,7 @@ beforeEach(() => {
       mutations: Mutation[],
       options: BaseMutationOptions = {},
     ): Promise<MultipleMutationResult> => {
-      const transactionId = options.transactionId ?? crypto.randomUUID()
+      const transactionId = options.transactionId ?? randomUuid()
       const timestamp = new Date().toISOString()
       const prior = {...documents}
       let next = {...documents}
@@ -1578,7 +1648,7 @@ beforeEach(() => {
   const action = vi.fn(
     async (
       input: HttpAction | HttpAction[],
-      {transactionId = crypto.randomUUID(), dryRun}: BaseActionOptions,
+      {transactionId = randomUuid(), dryRun}: BaseActionOptions,
     ): Promise<SingleActionResult | MultipleActionResult> => {
       const actions = Array.isArray(input) ? input : [input]
       let next: DocumentSet = {...documents}

package/src/document/documentStore.ts

@@ -550,13 +550,13 @@ const subscribeToClientAndFetchDatasetAcl = ({
 }: StoreContext<DocumentStoreState, BoundResourceKey>) => {
   const clientOptions: ClientOptions = {apiVersion: API_VERSION, resource}
 
-  let uri: string
+  let url: string
   if (resource && isDatasetResource(resource)) {
-    uri = `/projects/${resource.projectId}/datasets/${resource.dataset}/acl`
+    url = `/projects/${resource.projectId}/datasets/${resource.dataset}/acl`
   } else if (resource && isMediaLibraryResource(resource)) {
-    uri = `/media-libraries/${resource.mediaLibraryId}/acl`
+    url = `/media-libraries/${resource.mediaLibraryId}/acl`
   } else if (resource && isCanvasResource(resource)) {
-    uri = `/canvases/${resource.canvasId}/acl`
+    url = `/canvases/${resource.canvasId}/acl`
   } else {
     throw new Error(`Received invalid resource: ${JSON.stringify(resource)}`)
   }
@@ -566,7 +566,7 @@ const subscribeToClientAndFetchDatasetAcl = ({
       switchMap((client) =>
         client.observable
           .request<DatasetAcl>({
-            uri,
+            url,
             tag: 'acl.get',
           })
           .pipe(

package/src/document/permissions.ts

@@ -5,6 +5,7 @@ import {createSelector} from 'reselect'
 
 import {isReleasePerspective} from '../releases/utils/isReleasePerspective'
 import {type SelectorContext} from '../store/createStateSourceAction'
+import {randomId} from '../utils/ids'
 import {MultiKeyWeakMap} from '../utils/MultiKeyWeakMap'
 import {type DocumentAction} from './actions'
 import {ActionError, PermissionActionError, processActions} from './processActions/processActions'
@@ -190,7 +191,7 @@ const _calculatePermissions = createSelector(
     try {
       processActions({
         actions,
-        transactionId: crypto.randomUUID(),
+        transactionId: randomId(16),
         working: documents,
         base: documents,
         timestamp,

package/src/document/processActions.test.ts

@@ -2,6 +2,7 @@ import {type CreateMutation, type Reference, type SanityDocument} from '@sanity/
 import {parse} from 'groq-js'
 import {describe, expect, it} from 'vitest'
 
+import {randomUuid} from '../utils/ids'
 import {type Action, type DocumentAction} from './actions'
 import {ActionError, processActions} from './processActions/processActions'
 import {type DocumentSet, processMutations} from './processMutations'
@@ -973,7 +974,7 @@ describe('processActions', () => {
     })
 
     it('should strengthen `_strengthenOnPublish` references', () => {
-      const _ref = crypto.randomUUID()
+      const _ref = randomUuid()
       const referenceToStrength: Reference = {
         _ref,
         _type: 'reference',