@fluidframework/tree-agent-ses 2.63.0-359962

package/.eslintrc.cjs

@@ -0,0 +1,54 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+module.exports = {
+	extends: [require.resolve("@fluidframework/eslint-config-fluid/strict"), "prettier"],
+	parserOptions: {
+		project: ["./tsconfig.json"],
+	},
+	rules: {
+		// Allow reaching into FluidFramework package paths that end with alpha, beta, legacy, or internal
+		"import/no-internal-modules": [
+			"error",
+			{
+				allow: [
+					"@fluidframework/*/alpha",
+					"@fluidframework/*/beta",
+					"@fluidframework/*/legacy",
+					"@fluidframework/*/internal",
+				],
+			},
+		],
+	},
+	overrides: [
+		{
+			files: ["src/test/**/*"],
+			parserOptions: {
+				project: ["./src/test/tsconfig.json"],
+			},
+			rules: {
+				"import/no-internal-modules": [
+					"error",
+					{
+						allow: [
+							"*/index.js",
+							"@fluidframework/*/alpha",
+							"@fluidframework/*/beta",
+							"@fluidframework/*/legacy",
+							"@fluidframework/*/internal",
+						],
+					},
+				],
+				"import/no-unresolved": "off",
+				"@typescript-eslint/no-unsafe-assignment": "off",
+				"@typescript-eslint/no-unsafe-call": "off",
+				"@typescript-eslint/no-unsafe-member-access": "off",
+				"@typescript-eslint/no-unsafe-return": "off",
+				"@typescript-eslint/no-unsafe-argument": "off",
+				"@typescript-eslint/strict-boolean-expressions": "off",
+			},
+		},
+	],
+};

package/.mocharc.cjs

@@ -0,0 +1,12 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+"use strict";
+
+const getFluidTestMochaConfig = require("@fluid-internal/mocha-test-setup/mocharc-common");
+
+// Reuse shared Fluid test mocha config for this package
+const config = getFluidTestMochaConfig(__dirname);
+module.exports = config;

package/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+	"recommendations": ["hbenl.vscode-mocha-test-adapter"],
+}

package/.vscode/settings.json

@@ -0,0 +1,21 @@
+{
+	"search.exclude": {
+		"**/node_modules": true,
+		"**/dist": true,
+		"**/lib": true,
+	},
+	"mochaExplorer.files": ["dist/test/**/*.*js"],
+	"mochaExplorer.require": [
+		"node_modules/@fluid-internal/mocha-test-setup",
+		"source-map-support/register",
+	],
+	"mochaExplorer.configFile": ".mocharc.cjs",
+	"mochaExplorer.timeout": 999999,
+	"mochaExplorer.nodeArgv": ["--conditions", "allow-ff-test-exports"],
+	"cSpell.words": ["fluidframework"],
+	"editor.defaultFormatter": "biomejs.biome",
+	"editor.insertSpaces": false,
+	"[json]": { "editor.defaultFormatter": "biomejs.biome" },
+	"[javascript]": { "editor.defaultFormatter": "biomejs.biome" },
+	"[typescript]": { "editor.defaultFormatter": "biomejs.biome" },
+}

package/.vscode/tree-agent-ses.code-workspace

@@ -0,0 +1,22 @@
+{
+	"folders": [
+		{
+			"name": "FluidFramework",
+			"path": "../../../../"
+		},
+		{
+			"name": "@fluidframework/tree-agent-ses",
+			"path": ".."
+		}
+	],
+	"settings": {
+		"search.followSymlinks": false,
+		"typescript.preferences.autoImportFileExcludePatterns": [
+			"**/node_modules/**/@fluid*/*-previous",
+			"**/node_modules/**/@fluid*/*-previous/*"
+		],
+		"typescript.preferences.importModuleSpecifier": "project-relative",
+		"typescript.preferences.preferTypeOnlyAutoImports": true,
+		"typescript.tsdk": "FluidFramework\\node_modules\\typescript\\lib"
+	}
+}

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# @fluidframework/tree-agent-ses
+
+## 2.63.0
+
+Initial release.

package/LICENSE

@@ -0,0 +1,21 @@
+Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,23 @@
+# @fluidframework/tree-agent-ses
+
+Secure edit execution helpers for the `@fluidframework/tree-agent` package backed by the SES runtime.
+
+## Installation
+
+```bash
+npm install @fluidframework/tree-agent-ses
+```
+
+## Usage
+
+```typescript
+import { createSesEditExecutor } from "@fluidframework/tree-agent-ses";
+
+const executeEdit = createSesEditExecutor();
+```
+
+The returned callback can be provided as the `executeEdit` option when constructing a `SharedTreeSemanticAgent` from `@fluidframework/tree-agent`.
+
+## Licensing
+
+This project is licensed under the [MIT License](./LICENSE).

package/alpha.d.ts

@@ -0,0 +1,11 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/*
+ * THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+ * Generated by "flub generate entrypoints" in @fluid-tools/build-cli.
+ */
+
+export * from "./lib/alpha.js";

package/api-extractor/api-extractor-lint-alpha.cjs.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.entrypoint.json",
+	"mainEntryPointFilePath": "<projectFolder>/dist/alpha.d.ts"
+}

package/api-extractor/api-extractor-lint-alpha.esm.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.entrypoint.json",
+	"mainEntryPointFilePath": "<projectFolder>/lib/alpha.d.ts"
+}

package/api-extractor/api-extractor-lint-bundle.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.json",
+	"mainEntryPointFilePath": "<projectFolder>/lib/index.d.ts"
+}

package/api-extractor/api-extractor-lint-index.cjs.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.entrypoint.json",
+	"mainEntryPointFilePath": "<projectFolder>/dist/index.d.ts"
+}

package/api-extractor/api-extractor-lint-index.esm.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.entrypoint.json",
+	"mainEntryPointFilePath": "<projectFolder>/lib/index.d.ts"
+}

package/api-extractor/api-extractor-lint-public.cjs.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.entrypoint.json",
+	"mainEntryPointFilePath": "<projectFolder>/dist/public.d.ts"
+}

package/api-extractor/api-extractor-lint-public.esm.json

@@ -0,0 +1,5 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "<projectFolder>/../../../common/build/build-common/api-extractor-lint.entrypoint.json",
+	"mainEntryPointFilePath": "<projectFolder>/lib/public.d.ts"
+}

package/api-extractor-lint.json

@@ -0,0 +1,4 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "../../../common/build/build-common/api-extractor-lint.json"
+}

package/api-extractor.json

@@ -0,0 +1,4 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+	"extends": "../../../common/build/build-common/api-extractor-model.esm.json"
+}

package/biome.jsonc

@@ -0,0 +1,4 @@
+{
+	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
+	"extends": ["../../../biome.jsonc"]
+}

package/dist/alpha.d.ts

@@ -0,0 +1,21 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/*
+ * THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+ * Generated by "flub generate entrypoints" in @fluid-tools/build-cli.
+ */
+
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+
+export {
+	// #region @alpha APIs
+	createSesEditExecutor
+	// #endregion
+} from "./index.js";

package/dist/executor.d.ts

@@ -0,0 +1,22 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import "ses";
+import type { SemanticAgentOptions } from "@fluidframework/tree-agent/alpha";
+/**
+ * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library
+ * to run the provided code in a secure environment.
+ * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.
+ * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.
+ * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.
+ * @alpha
+ */
+export declare function createSesEditExecutor(options?: {
+    compartmentOptions?: {
+        globals?: Map<string, unknown>;
+        [key: string]: unknown;
+    };
+    lockdownOptions?: Record<string, unknown>;
+}): SemanticAgentOptions["executeEdit"];
+//# sourceMappingURL=executor.d.ts.map

package/dist/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,CAAC;AAEb,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAO7E;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IAC/C,kBAAkB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C,GAAG,oBAAoB,CAAC,aAAa,CAAC,CA6CtC"}

package/dist/executor.js

@@ -0,0 +1,78 @@
+"use strict";
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSesEditExecutor = void 0;
+// eslint-disable-next-line import/no-unassigned-import
+require("ses");
+/**
+ * Used to track whether the SES `lockdown` function has already been called by this module.
+ */
+const lockdownSymbol = Symbol.for("tree-agent.ses.locked");
+/**
+ * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library
+ * to run the provided code in a secure environment.
+ * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.
+ * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.
+ * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.
+ * @alpha
+ */
+function createSesEditExecutor(options) {
+    const optionsGlobals = options?.compartmentOptions?.globals ?? new Map();
+    if (optionsGlobals.has("context") === true) {
+        throw new Error("The 'context' global is reserved and cannot be overridden in the compartment options.");
+    }
+    if (!(lockdownSymbol in globalThis)) {
+        try {
+            lockdown(options?.lockdownOptions);
+            Object.defineProperty(globalThis, lockdownSymbol, {
+                value: true,
+                writable: false,
+                configurable: false,
+                enumerable: false,
+            });
+        }
+        catch (error) {
+            if (toErrorString(error).includes("SES_ALREADY_LOCKED_DOWN")) {
+                Object.defineProperty(globalThis, lockdownSymbol, {
+                    value: true,
+                    writable: false,
+                    configurable: false,
+                    enumerable: false,
+                });
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+    return async (context, code) => {
+        const compartmentOptions = {
+            ...options?.compartmentOptions,
+            globals: {
+                ...Object.fromEntries(optionsGlobals),
+                context,
+            },
+        };
+        const compartment = new Compartment({ ...compartmentOptions, __options__: true });
+        await compartment.evaluate(code);
+    };
+}
+exports.createSesEditExecutor = createSesEditExecutor;
+/**
+ * Stringify an unknown error value.
+ */
+function toErrorString(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,uDAAuD;AACvD,eAAa;AAIb;;GAEG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,OAGrC;IACA,MAAM,cAAc,GACnB,OAAO,EAAE,kBAAkB,EAAE,OAAO,IAAI,IAAI,GAAG,EAAmB,CAAC;IAEpE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACd,uFAAuF,CACvF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,cAAc,IAAI,UAAU,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACJ,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACnC,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE;gBACjD,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,KAAK;aACjB,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE;oBACjD,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,KAAK;iBACjB,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,EAAE,OAAgC,EAAE,IAAY,EAAE,EAAE;QAC/D,MAAM,kBAAkB,GAAG;YAC1B,GAAG,OAAO,EAAE,kBAAkB;YAC9B,OAAO,EAAE;gBACR,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;gBACrC,OAAO;aACP;SACD,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,GAAG,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACH,CAAC;AAhDD,sDAgDC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACF,CAAC","sourcesContent":["/*!\n * Copyright (c) Microsoft Corporation and contributors. All rights reserved.\n * Licensed under the MIT License.\n */\n\n// eslint-disable-next-line import/no-unassigned-import\nimport \"ses\";\n\nimport type { SemanticAgentOptions } from \"@fluidframework/tree-agent/alpha\";\n\n/**\n * Used to track whether the SES `lockdown` function has already been called by this module.\n */\nconst lockdownSymbol = Symbol.for(\"tree-agent.ses.locked\");\n\n/**\n * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library\n * to run the provided code in a secure environment.\n * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.\n * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.\n * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.\n * @alpha\n */\nexport function createSesEditExecutor(options?: {\n\tcompartmentOptions?: { globals?: Map<string, unknown>; [key: string]: unknown };\n\tlockdownOptions?: Record<string, unknown>;\n}): SemanticAgentOptions[\"executeEdit\"] {\n\tconst optionsGlobals: Map<string, unknown> =\n\t\toptions?.compartmentOptions?.globals ?? new Map<string, unknown>();\n\n\tif (optionsGlobals.has(\"context\") === true) {\n\t\tthrow new Error(\n\t\t\t\"The 'context' global is reserved and cannot be overridden in the compartment options.\",\n\t\t);\n\t}\n\n\tif (!(lockdownSymbol in globalThis)) {\n\t\ttry {\n\t\t\tlockdown(options?.lockdownOptions);\n\t\t\tObject.defineProperty(globalThis, lockdownSymbol, {\n\t\t\t\tvalue: true,\n\t\t\t\twritable: false,\n\t\t\t\tconfigurable: false,\n\t\t\t\tenumerable: false,\n\t\t\t});\n\t\t} catch (error: unknown) {\n\t\t\tif (toErrorString(error).includes(\"SES_ALREADY_LOCKED_DOWN\")) {\n\t\t\t\tObject.defineProperty(globalThis, lockdownSymbol, {\n\t\t\t\t\tvalue: true,\n\t\t\t\t\twritable: false,\n\t\t\t\t\tconfigurable: false,\n\t\t\t\t\tenumerable: false,\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn async (context: Record<string, unknown>, code: string) => {\n\t\tconst compartmentOptions = {\n\t\t\t...options?.compartmentOptions,\n\t\t\tglobals: {\n\t\t\t\t...Object.fromEntries(optionsGlobals),\n\t\t\t\tcontext,\n\t\t\t},\n\t\t};\n\n\t\tconst compartment = new Compartment({ ...compartmentOptions, __options__: true });\n\t\tawait compartment.evaluate(code);\n\t};\n}\n\n/**\n * Stringify an unknown error value.\n */\nfunction toErrorString(error: unknown): string {\n\tif (error instanceof Error) {\n\t\treturn error.message;\n\t}\n\ttry {\n\t\treturn JSON.stringify(error);\n\t} catch {\n\t\treturn String(error);\n\t}\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+export { createSesEditExecutor } from "./executor.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+"use strict";
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSesEditExecutor = void 0;
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+var executor_js_1 = require("./executor.js");
+Object.defineProperty(exports, "createSesEditExecutor", { enumerable: true, get: function () { return executor_js_1.createSesEditExecutor; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH;;;;GAIG;AAEH,6CAAsD;AAA7C,oHAAA,qBAAqB,OAAA","sourcesContent":["/*!\n * Copyright (c) Microsoft Corporation and contributors. All rights reserved.\n * Licensed under the MIT License.\n */\n\n/**\n * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.\n *\n * @packageDocumentation\n */\n\nexport { createSesEditExecutor } from \"./executor.js\";\n"]}

package/dist/package.json

@@ -0,0 +1,4 @@
+{
+	"type": "commonjs",
+	"sideEffects": false
+}

package/dist/public.d.ts

@@ -0,0 +1,16 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/*
+ * THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+ * Generated by "flub generate entrypoints" in @fluid-tools/build-cli.
+ */
+
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */export {}
+

package/internal.d.ts

@@ -0,0 +1,11 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/*
+ * THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+ * Generated by "flub generate entrypoints" in @fluid-tools/build-cli.
+ */
+
+export * from "./lib/index.js";

package/lib/alpha.d.ts

@@ -0,0 +1,21 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/*
+ * THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+ * Generated by "flub generate entrypoints" in @fluid-tools/build-cli.
+ */
+
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+
+export {
+	// #region @alpha APIs
+	createSesEditExecutor
+	// #endregion
+} from "./index.js";

package/lib/executor.d.ts

@@ -0,0 +1,22 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+import "ses";
+import type { SemanticAgentOptions } from "@fluidframework/tree-agent/alpha";
+/**
+ * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library
+ * to run the provided code in a secure environment.
+ * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.
+ * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.
+ * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.
+ * @alpha
+ */
+export declare function createSesEditExecutor(options?: {
+    compartmentOptions?: {
+        globals?: Map<string, unknown>;
+        [key: string]: unknown;
+    };
+    lockdownOptions?: Record<string, unknown>;
+}): SemanticAgentOptions["executeEdit"];
+//# sourceMappingURL=executor.d.ts.map

package/lib/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,CAAC;AAEb,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAO7E;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IAC/C,kBAAkB,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C,GAAG,oBAAoB,CAAC,aAAa,CAAC,CA6CtC"}

package/lib/executor.js

@@ -0,0 +1,74 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+// eslint-disable-next-line import/no-unassigned-import
+import "ses";
+/**
+ * Used to track whether the SES `lockdown` function has already been called by this module.
+ */
+const lockdownSymbol = Symbol.for("tree-agent.ses.locked");
+/**
+ * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library
+ * to run the provided code in a secure environment.
+ * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.
+ * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.
+ * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.
+ * @alpha
+ */
+export function createSesEditExecutor(options) {
+    const optionsGlobals = options?.compartmentOptions?.globals ?? new Map();
+    if (optionsGlobals.has("context") === true) {
+        throw new Error("The 'context' global is reserved and cannot be overridden in the compartment options.");
+    }
+    if (!(lockdownSymbol in globalThis)) {
+        try {
+            lockdown(options?.lockdownOptions);
+            Object.defineProperty(globalThis, lockdownSymbol, {
+                value: true,
+                writable: false,
+                configurable: false,
+                enumerable: false,
+            });
+        }
+        catch (error) {
+            if (toErrorString(error).includes("SES_ALREADY_LOCKED_DOWN")) {
+                Object.defineProperty(globalThis, lockdownSymbol, {
+                    value: true,
+                    writable: false,
+                    configurable: false,
+                    enumerable: false,
+                });
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+    return async (context, code) => {
+        const compartmentOptions = {
+            ...options?.compartmentOptions,
+            globals: {
+                ...Object.fromEntries(optionsGlobals),
+                context,
+            },
+        };
+        const compartment = new Compartment({ ...compartmentOptions, __options__: true });
+        await compartment.evaluate(code);
+    };
+}
+/**
+ * Stringify an unknown error value.
+ */
+function toErrorString(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+//# sourceMappingURL=executor.js.map

package/lib/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,uDAAuD;AACvD,OAAO,KAAK,CAAC;AAIb;;GAEG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACA,MAAM,cAAc,GACnB,OAAO,EAAE,kBAAkB,EAAE,OAAO,IAAI,IAAI,GAAG,EAAmB,CAAC;IAEpE,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACd,uFAAuF,CACvF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,cAAc,IAAI,UAAU,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACJ,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACnC,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE;gBACjD,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,KAAK;aACjB,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACzB,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE;oBACjD,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,KAAK;iBACjB,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,EAAE,OAAgC,EAAE,IAAY,EAAE,EAAE;QAC/D,MAAM,kBAAkB,GAAG;YAC1B,GAAG,OAAO,EAAE,kBAAkB;YAC9B,OAAO,EAAE;gBACR,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;gBACrC,OAAO;aACP;SACD,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,GAAG,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACF,CAAC","sourcesContent":["/*!\n * Copyright (c) Microsoft Corporation and contributors. All rights reserved.\n * Licensed under the MIT License.\n */\n\n// eslint-disable-next-line import/no-unassigned-import\nimport \"ses\";\n\nimport type { SemanticAgentOptions } from \"@fluidframework/tree-agent/alpha\";\n\n/**\n * Used to track whether the SES `lockdown` function has already been called by this module.\n */\nconst lockdownSymbol = Symbol.for(\"tree-agent.ses.locked\");\n\n/**\n * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library\n * to run the provided code in a secure environment.\n * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.\n * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.\n * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.\n * @alpha\n */\nexport function createSesEditExecutor(options?: {\n\tcompartmentOptions?: { globals?: Map<string, unknown>; [key: string]: unknown };\n\tlockdownOptions?: Record<string, unknown>;\n}): SemanticAgentOptions[\"executeEdit\"] {\n\tconst optionsGlobals: Map<string, unknown> =\n\t\toptions?.compartmentOptions?.globals ?? new Map<string, unknown>();\n\n\tif (optionsGlobals.has(\"context\") === true) {\n\t\tthrow new Error(\n\t\t\t\"The 'context' global is reserved and cannot be overridden in the compartment options.\",\n\t\t);\n\t}\n\n\tif (!(lockdownSymbol in globalThis)) {\n\t\ttry {\n\t\t\tlockdown(options?.lockdownOptions);\n\t\t\tObject.defineProperty(globalThis, lockdownSymbol, {\n\t\t\t\tvalue: true,\n\t\t\t\twritable: false,\n\t\t\t\tconfigurable: false,\n\t\t\t\tenumerable: false,\n\t\t\t});\n\t\t} catch (error: unknown) {\n\t\t\tif (toErrorString(error).includes(\"SES_ALREADY_LOCKED_DOWN\")) {\n\t\t\t\tObject.defineProperty(globalThis, lockdownSymbol, {\n\t\t\t\t\tvalue: true,\n\t\t\t\t\twritable: false,\n\t\t\t\t\tconfigurable: false,\n\t\t\t\t\tenumerable: false,\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\t}\n\n\treturn async (context: Record<string, unknown>, code: string) => {\n\t\tconst compartmentOptions = {\n\t\t\t...options?.compartmentOptions,\n\t\t\tglobals: {\n\t\t\t\t...Object.fromEntries(optionsGlobals),\n\t\t\t\tcontext,\n\t\t\t},\n\t\t};\n\n\t\tconst compartment = new Compartment({ ...compartmentOptions, __options__: true });\n\t\tawait compartment.evaluate(code);\n\t};\n}\n\n/**\n * Stringify an unknown error value.\n */\nfunction toErrorString(error: unknown): string {\n\tif (error instanceof Error) {\n\t\treturn error.message;\n\t}\n\ttry {\n\t\treturn JSON.stringify(error);\n\t} catch {\n\t\treturn String(error);\n\t}\n}\n"]}

package/lib/index.d.ts

@@ -0,0 +1,11 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+export { createSesEditExecutor } from "./executor.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/lib/index.js

@@ -0,0 +1,11 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+export { createSesEditExecutor } from "./executor.js";
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC","sourcesContent":["/*!\n * Copyright (c) Microsoft Corporation and contributors. All rights reserved.\n * Licensed under the MIT License.\n */\n\n/**\n * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.\n *\n * @packageDocumentation\n */\n\nexport { createSesEditExecutor } from \"./executor.js\";\n"]}

package/lib/public.d.ts

@@ -0,0 +1,16 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/*
+ * THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+ * Generated by "flub generate entrypoints" in @fluid-tools/build-cli.
+ */
+
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */export {}
+

package/package.json

@@ -0,0 +1,157 @@
+{
+  "name": "@fluidframework/tree-agent-ses",
+  "version": "2.63.0-359962",
+  "description": "SES integration helpers for @fluidframework/tree-agent",
+  "homepage": "https://fluidframework.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/microsoft/FluidFramework.git",
+    "directory": "packages/framework/tree-agent-ses"
+  },
+  "license": "MIT",
+  "author": "Microsoft and contributors",
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./lib/public.d.ts",
+        "default": "./lib/index.js"
+      },
+      "require": {
+        "types": "./dist/public.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./alpha": {
+      "import": {
+        "types": "./lib/alpha.d.ts",
+        "default": "./lib/index.js"
+      },
+      "require": {
+        "types": "./dist/alpha.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./internal": {
+      "import": {
+        "types": "./lib/index.d.ts",
+        "default": "./lib/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "main": "lib/index.js",
+  "types": "lib/public.d.ts",
+  "c8": {
+    "all": true,
+    "cache-dir": "nyc/.cache",
+    "exclude": [
+      "src/test/**/*.*ts",
+      "dist/test/**/*.*js",
+      "lib/test/**/*.*js"
+    ],
+    "exclude-after-remap": false,
+    "include": [
+      "src/**/*.*ts",
+      "dist/**/*.*js",
+      "lib/**/*.*js"
+    ],
+    "report-dir": "nyc/report",
+    "reporter": [
+      "cobertura",
+      "html",
+      "text"
+    ],
+    "temp-directory": "nyc/.nyc_output"
+  },
+  "dependencies": {
+    "@fluidframework/tree-agent": "2.63.0-359962",
+    "ses": "^1.14.0"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.17.1",
+    "@biomejs/biome": "~1.9.3",
+    "@fluid-internal/mocha-test-setup": "2.63.0-359962",
+    "@fluid-tools/build-cli": "^0.58.3",
+    "@fluidframework/build-common": "^2.0.3",
+    "@fluidframework/build-tools": "^0.58.3",
+    "@fluidframework/eslint-config-fluid": "^6.0.0",
+    "@fluidframework/tree": "2.63.0-359962",
+    "@microsoft/api-extractor": "7.52.11",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^18.19.0",
+    "c8": "^10.1.3",
+    "concurrently": "^8.2.1",
+    "copyfiles": "^2.4.1",
+    "cross-env": "^7.0.3",
+    "eslint": "~8.55.0",
+    "eslint-config-prettier": "~9.0.0",
+    "mocha": "^10.8.2",
+    "mocha-multi-reporters": "^1.5.1",
+    "prettier": "~3.0.3",
+    "rimraf": "^4.4.0",
+    "typescript": "~5.4.5"
+  },
+  "fluidBuild": {
+    "tasks": {
+      "build:esnext": [
+        "...",
+        "typetests:gen"
+      ],
+      "tsc": [
+        "...",
+        "typetests:gen"
+      ]
+    }
+  },
+  "typeValidation": {
+    "disabled": true,
+    "broken": {},
+    "entrypoint": "internal"
+  },
+  "scripts": {
+    "api": "fluid-build . --task api",
+    "api-extractor:commonjs": "flub generate entrypoints --outFileLegacyBeta legacy --outDir ./dist",
+    "api-extractor:esnext": "flub generate entrypoints --outFileLegacyBeta legacy --outDir ./lib --node10TypeCompat",
+    "build": "fluid-build . --task build",
+    "build:commonjs": "fluid-build . --task commonjs",
+    "build:compile": "fluid-build . --task compile",
+    "build:docs": "api-extractor run --local",
+    "build:esnext": "tsc --project ./tsconfig.json",
+    "build:test": "npm run build:test:esm && npm run build:test:cjs",
+    "build:test:cjs": "fluid-tsc commonjs --project ./src/test/tsconfig.cjs.json",
+    "build:test:esm": "tsc --project ./src/test/tsconfig.json",
+    "check:are-the-types-wrong": "attw --pack . --profile node16",
+    "check:biome": "biome check .",
+    "check:exports": "concurrently \"npm:check:exports:*\"",
+    "check:exports:bundle-release-tags": "api-extractor run --config api-extractor/api-extractor-lint-bundle.json",
+    "check:exports:cjs:alpha": "api-extractor run --config api-extractor/api-extractor-lint-alpha.cjs.json",
+    "check:exports:cjs:index": "api-extractor run --config api-extractor/api-extractor-lint-index.cjs.json",
+    "check:exports:cjs:public": "api-extractor run --config api-extractor/api-extractor-lint-public.cjs.json",
+    "check:exports:esm:alpha": "api-extractor run --config api-extractor/api-extractor-lint-alpha.esm.json",
+    "check:exports:esm:index": "api-extractor run --config api-extractor/api-extractor-lint-index.esm.json",
+    "check:exports:esm:public": "api-extractor run --config api-extractor/api-extractor-lint-public.esm.json",
+    "check:format": "npm run check:biome",
+    "ci:build:docs": "api-extractor run",
+    "clean": "rimraf --glob dist lib {alpha,beta,internal,legacy}.d.ts \"**/*.tsbuildinfo\" \"**/*.build.log\" _api-extractor-temp nyc",
+    "eslint": "eslint --format stylish src",
+    "eslint:fix": "eslint --format stylish src --fix --fix-type problem,suggestion,layout",
+    "format": "npm run format:biome",
+    "format:biome": "biome check . --write",
+    "lint": "fluid-build . --task lint",
+    "lint:fix": "fluid-build . --task eslint:fix --task format",
+    "test": "npm run test:mocha",
+    "test:coverage": "c8 npm test",
+    "test:mocha": "npm run test:mocha:esm && echo skipping cjs to avoid overhead - npm run test:mocha:cjs",
+    "test:mocha:cjs": "cross-env FLUID_TEST_MODULE_SYSTEM=CJS mocha",
+    "test:mocha:esm": "mocha",
+    "test:mocha:verbose": "cross-env FLUID_TEST_VERBOSE=1 npm run test:mocha",
+    "tsc": "fluid-tsc commonjs --project ./tsconfig.cjs.json && copyfiles -f ../../../common/build/build-common/src/cjs/package.json ./dist",
+    "typetests:gen": "flub generate typetests --dir . -v",
+    "typetests:prepare": "flub typetests --dir . --reset --previous --normalize"
+  }
+}

package/src/executor.ts

@@ -0,0 +1,86 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+// eslint-disable-next-line import/no-unassigned-import
+import "ses";
+
+import type { SemanticAgentOptions } from "@fluidframework/tree-agent/alpha";
+
+/**
+ * Used to track whether the SES `lockdown` function has already been called by this module.
+ */
+const lockdownSymbol = Symbol.for("tree-agent.ses.locked");
+
+/**
+ * Create an implementation of {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit} that uses the SES library
+ * to run the provided code in a secure environment.
+ * @param options - Optional configuration for the underlying SES compartment and lockdown invocation.
+ * @returns A function that can be used as the {@link @fluidframework/tree-agent#SemanticAgentOptions.executeEdit | executeEdit} callback.
+ * @remarks This function will call the SES `lockdown` API the first time it is invoked. For best performance, create the executor once during application initialization.
+ * @alpha
+ */
+export function createSesEditExecutor(options?: {
+	compartmentOptions?: { globals?: Map<string, unknown>; [key: string]: unknown };
+	lockdownOptions?: Record<string, unknown>;
+}): SemanticAgentOptions["executeEdit"] {
+	const optionsGlobals: Map<string, unknown> =
+		options?.compartmentOptions?.globals ?? new Map<string, unknown>();
+
+	if (optionsGlobals.has("context") === true) {
+		throw new Error(
+			"The 'context' global is reserved and cannot be overridden in the compartment options.",
+		);
+	}
+
+	if (!(lockdownSymbol in globalThis)) {
+		try {
+			lockdown(options?.lockdownOptions);
+			Object.defineProperty(globalThis, lockdownSymbol, {
+				value: true,
+				writable: false,
+				configurable: false,
+				enumerable: false,
+			});
+		} catch (error: unknown) {
+			if (toErrorString(error).includes("SES_ALREADY_LOCKED_DOWN")) {
+				Object.defineProperty(globalThis, lockdownSymbol, {
+					value: true,
+					writable: false,
+					configurable: false,
+					enumerable: false,
+				});
+			} else {
+				throw error;
+			}
+		}
+	}
+
+	return async (context: Record<string, unknown>, code: string) => {
+		const compartmentOptions = {
+			...options?.compartmentOptions,
+			globals: {
+				...Object.fromEntries(optionsGlobals),
+				context,
+			},
+		};
+
+		const compartment = new Compartment({ ...compartmentOptions, __options__: true });
+		await compartment.evaluate(code);
+	};
+}
+
+/**
+ * Stringify an unknown error value.
+ */
+function toErrorString(error: unknown): string {
+	if (error instanceof Error) {
+		return error.message;
+	}
+	try {
+		return JSON.stringify(error);
+	} catch {
+		return String(error);
+	}
+}

package/src/index.ts

@@ -0,0 +1,12 @@
+/*!
+ * Copyright (c) Microsoft Corporation and contributors. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+/**
+ * SES helpers for the {@link @fluidframework/tree-agent#SharedTreeSemanticAgent | SharedTreeSemanticAgent}.
+ *
+ * @packageDocumentation
+ */
+
+export { createSesEditExecutor } from "./executor.js";

package/tsconfig.cjs.json

@@ -0,0 +1,7 @@
+{
+	// This config must be used in a "type": "commonjs" environment. (Use `fluid-tsc commonjs`.)
+	"extends": "./tsconfig.json",
+	"compilerOptions": {
+		"outDir": "./dist",
+	},
+}

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+	"extends": "../../../common/build/build-common/tsconfig.node16.json",
+	"include": ["src/**/*"],
+	"exclude": ["src/test/**/*"],
+	"compilerOptions": {
+		"rootDir": "./src",
+		"outDir": "./lib",
+		"noImplicitAny": true,
+		"preserveConstEnums": true,
+		"exactOptionalPropertyTypes": false,
+		"lib": ["ES2020", "DOM", "DOM.Iterable"],
+		"skipLibCheck": true,
+	},
+}

package/tsdoc.json

@@ -0,0 +1,4 @@
+{
+	"$schema": "https://developer.microsoft.com/json-schemas/tsdoc/v0/tsdoc.schema.json",
+	"extends": ["../../../common/build/build-common/tsdoc-base.json"]
+}