Craig Macomber (Microsoft)

feat(tree): Support blob handles in sandbox demo (#28299) ## Description Add Fluid handle support to the SharedTree sandbox demo so initialization and live edits can contain handles, and Guest code can resolve blob content without blocking tree synchronization. - Transport handles as session-local tokens. Restore Guest proxies on receipt and original Host handles on return, preserving identity for equivalent handles. - Resolve Guest `get()` calls through asynchronous blob requests and responses. Cache each proxy’s promise, propagate failures, and reject pending requests on disposal. Handles resolving to non-`ArrayBuffer` values are unsupported. - Use dedicated transport codecs with collision-safe escaping, preserving ordinary marker-shaped data and keys such as `__proto__`. - Restrict and normalize transport data before validation. Records use null prototypes; buffers become identity-checked placeholders during validation and are unwrapped only in validated blob responses. - Validate handle and blob messages with TypeBox, distinct branded identifiers, and runtime authorization and request-matching checks. - Document terminology, data flow, lifetime assumptions, and remaining production work. This change is limited to the sandbox example and tests; it does not change public APIs. ## Testing All 53 sandbox tests pass, including coverage for: - Initialization and bidirectional edits containing handles. - Proxy identity, concurrent resolution, failures, disposal, and deletion/undo/redo. - Marker-shaped user data, prototype-related keys, malformed messages, unauthorized tokens, and misplaced buffers. - Real `MessagePort` delivery and existing synchronization permutations. TypeScript compilation, ESLint, and formatting checks pass. ## Reviewer Guidance The review process is outlined in [the pull request guidelines](https://github.com/microsoft/FluidFramework/blob/main/docs/content/Contributing/PR-Guidelines.md#guidelines). Please focus on conversion/validation ordering, collision-safe escaping, and handle authorization and binding. Handles and proxies are retained for the owning session; per-handle reclamation is intentionally out of scope. This does **not** make the example a complete security boundary: full protocol and codec-position validation, resource limits, ID-compressor sharding, and isolated-iframe testing remain follow-up work. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Introduce Unified ServiceClient API for Fluid Client (#27693) ## Description This add a simple API as a cleaner alternative to fluid-static and aquaduct. The implementation details are well encapsulated, making this a viable alternative to the `fluid-static` public API and a viable successor to the existing much larger legacy API surface we do not want to stabilize. This addresses several issues with our existing APIs: 1. non-legacy (fluid-static declarative model) API: 1. No stable way to use local service for testing (Internally or for customers). Forces tests to use alternative patterns (like test-utils, mocks etc. or a separate azure local service process). 2. No way to avoid bundling in SharedDirectory. 3. Defining and using DataStores is not well supported, especially for the root. 4. Dependency layering is such that its disallowed for DDS packages to use the public API surfaces to do collab tests. 5. No abstraction for Services / ServiceClient makes logic portable over services harder to write. 6. Doesn't support lazy loading DDS and DataStore code (at least not clearly/cleanly). 7. No migration path from legacy APIs to this 3. legacy (encapsulated model, including aquaduct): 1. Leak way too many details with too many non-sealed interfaces presenting tons of theoretical extension points we don't want to stabilize. 2. Encourages use of DataObject and its subclassing based extension approach which is limiting (Like how it makes switching to root trees) hard, and makes changing the implementation without introducing breaking changes very difficult. Because this new "unified" API offers value for our own internal testing (for example in tree), it is useful, even as alpha (or internal). Exposing this new API as alpha should be low risk, as it makes no long-term commitments. Since we have first party in-repo use cases, it should be practical to refine and iterate on this API with use in test and examples before we consider promoting it to beta. Requirements for this new API: 1. Testing: 2. Can easily be used for tests including collab and reopening documents. 3. Can be used by DDS (like shared-tree) tests replacing the need for many of our mocks and test utils 4. Can be used by customers (apps and libraries requiring stable APIs when promoted past alpha). When adopted, customers should not have need of any of our legacy test-utils and mocks (so we can migrate our legacy apps off of our test utils and eventually make them internal only). 5. Will be possible to stabilize to public (or at least beta) without depending on or stabilizing legacy APIs. 6. Is easy to use for tests, including collab. 7. Is easy to use for real production apps (should work the same as with tests). 8. Provides a clear and practical incremental migration path from both existing APIs: there can be gaps we need to close for some use-cases but those gaps need to be practical to close.

Implement SharedTree "full-duplex" sync for SandBox demo (#28330) ## Description Implement "full-duplex" sync with history for SandBox demo. This should keep the history in the guest aligned with the history in the host, and relying on guest side merge resolution with host changes. This prevents starvation (its always legal to update the guest at any time with new changes), and should allow guest history operation like undo and timline to work correctly.

Add ServiceClient session and tinylicious support, as well as example utils, and use for inventory-app (#27902) ## Description Adds the foundations for examples to use the `ServiceClient` API without the legacy loader host: - Adds an alpha session-storage-backed local service. - Adds an alpha Tinylicious service client, including forwarded HTTPS endpoint support. - Adds loader-free shared webpack and example startup/rendering helpers. - Migrates the inventory app to the shared helpers with ephemeral, session, and Tinylicious modes. - Adds focused tests, generated API reports, and changesets for the new driver APIs. These additions are non-breaking and retain the browser `process` polyfill required by existing dependencies.

feat(tree): add alpha Component utilities for open-polymorphic schema (#27628) ## Description Promotes the `Component` composition namespace out of the `openPolymorphism.integration.ts` test file and into `@fluidframework/tree` as a new `@alpha` API (also re-exported from `fluid-framework`). This pattern was previously validated only by the open-polymorphism examples; it's now a supported (alpha) part of the package because an app depends on it. `Component` provides utilities for composing independently authored application "components" that contribute to a shared configuration — useful for "open polymorphism" schema patterns where the set of allowed types for a field or collection can be extended by separate libraries. Each component is a `Component.Factory` that receives a lazy reference to the composed configuration and returns the content it contributes; `Component.composeComponents` combines them into a `Component.ComposedComponents`. Changes: - New `packages/dds/tree/src/simple-tree/api/componentApi.ts` with the `@alpha`-tagged, fully documented `Component` namespace, exporting only what's needed (`Factory`, `LazyArray`, `Configurable`, `composeComponents`, `ComposedComponents`); the `Config` implementation class stays internal. - Exported from `@fluidframework/tree` and (via the alpha entrypoint) `fluid-framework`; API reports updated. - The integration test now imports `Component` instead of defining it locally. - New focused unit tests in `componentApi.spec.ts` supplementing the existing example/integration tests. - Fixed a latent caching bug in `getConfigured` (it previously ran `configure` on every call; now cached via `getOrCreate`). - Changeset added.

fix(tree): validate tree index key selection (#28233) ## Description Clarifies and validates `createTreeIndex` key selection so selectors use Simple Tree property keys, which are translated to stored keys internally. Selected fields are validated eagerly as required, single-valued leaf fields before the index subscribes to forest updates. Index construction or update failures now break the forest and preserve the original error, preventing continued use of an apparently valid checkout. This also adds explicit key-finder dependency scopes, uses immutable invalidation for identifier indexes, skips schemas with ambiguous identifier fields, and expands executable examples and regression coverage. ## Breaking Changes `createTreeIndex` when indexing over a field which had an explicit stored key now will interpret the provided keys as property keys, consistent with out other APIs. Code which worked around this bug by specifying the stored key will need to be updated. `createTreeIndex` when indexing nodes with multiple identifier fields will no longer index them, instead of picking whatever identifier field comes first. `createTreeIndex` in cases where valid in schema data could cause it to crash later when updating the index now give proper usages errors when constructing the index, so in the edge cases where such invalid indexes simply happened to not error (for example due to the tree always having none of the type being indexes), the code making them may need to be updated.

Refactor tree sandbox code (#28323) ## Description Better isolate the guest vs host code. Better isolate the branch syncronozation code, so full-duplex work will have less conflicts.

fix(tree): Better asserts, and fix latent optimized forest array corruption bug (#27920) ## Description Improves validation and diagnostics for the optimized SharedTree forest. Internal attach, detach, create, and destroy operations are now validated before mutating forest state, preventing a failed operation from partially modifying the forest or consuming detached content. Additional assertions fail closer to the source of inconsistent operations, making failures such as later out-of-bounds chunk indexes easier to triage. This PR also corrects chunk indexing when a shared multi-node `SequenceChunk` is normalized for editing. The previous implementation could clone the selected child into the wrong slot and replace a sibling. This issue is currently unreachable through `ForestTypeOptimized`: its current chunk policy does not create sequence chunks, decoded fields are deaggregated, and delta builds split sequence content into individual node cursors. The fix and targeted tests preserve correctness if sequence chunks are used by this forest in the future or through internal/custom chunk configurations. Other changes ensure replaced chunk references are released correctly (improving our ability to edit in place) and add focused coverage for chunk lookup, copy-on-write normalization, operation atomicity, reference ownership, and field splitting.

Refactor sandbox demo/test code (#28286) ## Description Organize the sandbox code more like how it will be when its a real feature, though still all in test. Also added two failing tests for handles to document the status of that work, and fixes a error in the docs.

Include final retain in tree deltas (#27809) ## Description Previously our array node deltas were not required to include the final retain. This is now always included. Additionally handling of the extra new line required to make quill more robust, fixing a bug where remote collaborators could end up with extra new lines.