@adeu/core 1.21.0 → 1.23.0

package/src/engine.ts

@@ -27,6 +27,7 @@ import {
   REPORT_ECHO_CAP,
   truncate_middle,
 } from "./utils/text.js";
+import { RegexTimeoutError } from "./utils/safe-regex.js";
 
 // Width of the surrounding-document window shown in redline previews.
 const PREVIEW_CONTEXT_CHARS = 30;
@@ -178,6 +179,20 @@ const TRANSACTIONAL_NOT_APPLIED_ERROR =
   "Not applied: the batch is transactional and other edits failed " +
   "validation (see their errors). Fix or remove those edits and re-run.";
 
+// Characters XML 1.0 cannot represent: C0 controls except tab/newline/CR.
+// Word refuses to open a package carrying them, and @xmldom serializes them
+// silently, so they must be rejected before they reach the DOM
+// (QA 2026-07-17 F11; mirrors Python's clean per-edit error).
+const XML_ILLEGAL_CHARS_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f]/g;
+
+export function describe_illegal_control_chars(text: string): string | null {
+  if (!text) return null;
+  const found = text.match(XML_ILLEGAL_CHARS_RE);
+  if (!found) return null;
+  const codes = Array.from(new Set(found.map((c) => `0x${c.charCodeAt(0).toString(16).padStart(2, "0")}`))).sort();
+  return codes.join(", ");
+}
+
 export function validate_edit_strings(
   edits: any[],
   index_offset: number = 0,
@@ -189,6 +204,25 @@ export function validate_edit_strings(
     const t_text = edit.target_text || "";
     const n_text = edit.new_text || "";
 
+    // VAL-CRIT-8: XML-illegal control characters (QA 2026-07-17 F11).
+    const checked_fields: Array<[string, string]> = [
+      ["target_text", t_text],
+      ["new_text", n_text],
+    ];
+    if (edit.comment) checked_fields.push(["comment", edit.comment]);
+    (edit.cells || []).forEach((cell: string, cell_idx: number) => {
+      checked_fields.push([`cells[${cell_idx}]`, cell || ""]);
+    });
+    for (const [field_name, field_value] of checked_fields) {
+      const described = describe_illegal_control_chars(field_value);
+      if (described) {
+        errors.push(
+          `- Edit ${i + 1 + index_offset} Failed: \`${field_name}\` contains control character(s) ` +
+            `(${described}) that cannot be stored in a DOCX. Remove them and re-submit.`,
+        );
+      }
+    }
+
     if (
       n_text.includes("{++") ||
       n_text.includes("{--") ||
@@ -269,6 +303,21 @@ export function validate_edit_strings(
       }
     }
 
+    // QA 2026-07-18 M5: image markers are read-only projections of
+    // w:drawing elements. They cannot be fabricated, duplicated or removed
+    // through text replacement.
+    if (t_text.includes("docx-image:") || n_text.includes("docx-image:")) {
+      const t_imgs = (t_text.match(/!\[[^\]]*\]\(docx-image:[^)]*\)/g) || []).sort();
+      const n_imgs = (n_text.match(/!\[[^\]]*\]\(docx-image:[^)]*\)/g) || []).sort();
+      if (JSON.stringify(t_imgs) !== JSON.stringify(n_imgs)) {
+        errors.push(
+          `- Edit ${i + 1 + index_offset} Failed: image markers (![alt](docx-image:N)) are read-only ` +
+            "projections of embedded images. They cannot be inserted, altered, or removed " +
+            "via text replacement — edit the text around the image instead.",
+        );
+      }
+    }
+
     if (t_text.includes("{#") || n_text.includes("{#")) {
       const t_anchors = t_text.match(/\{#[^\}]+\}/g) || [];
       const n_anchors = n_text.match(/\{#[^\}]+\}/g) || [];
@@ -571,8 +620,8 @@ export class RedlineEngine {
    * Snapshots the document text around a resolved edit BEFORE anything is
    * applied. Previews rendered after the batch mutates the DOM cannot slice
    * full_text at the stored offsets: applied edits shift offsets and inject
-   * tracked-change markup, which produced garbled previews mixing unrelated
-   * edits and internal scaffolding (QA H1).
+   * tracked-change markup, garbling previews with unrelated edits and
+   * internal scaffolding (QA H1).
    */
   private _capture_preview_context(edit: any): void {
     if (edit.type !== "modify") return;
@@ -690,8 +739,8 @@ export class RedlineEngine {
 
   /**
    * The "new text" a batch report should show for an edit. InsertTableRow has
-   * no new_text field — surface its cell contents instead of the misleading
-   * empty string the report used to print (QA M4).
+   * no new_text field — surface its cell contents rather than a misleading
+   * empty string (QA M4).
    */
   private static _report_new_text(edit: any): string {
     if (edit && edit.type === "insert_row" && Array.isArray(edit.cells)) {
@@ -1149,6 +1198,54 @@ export class RedlineEngine {
     }
   }
 
+  /**
+   * Walks `element` to its XML root element. Word (and LibreOffice, which
+   * refuses to LOAD such files) only supports comment ranges in the main
+   * document story ("w:document") — never in headers, footers, footnotes or
+   * endnotes (QA 2026-07-18 H4/C1).
+   */
+  private _comment_anchor_in_main_story(element: Element): boolean {
+    let root: Element = element;
+    while (root.parentNode && root.parentNode.nodeType === 1) {
+      root = root.parentNode as Element;
+    }
+    return root.tagName === "w:document";
+  }
+
+  /**
+   * When the anchor lives outside the main document story, records a
+   * user-visible warning and returns true (caller must skip the comment).
+   * The tracked change itself still applies — only the bubble is dropped.
+   */
+  private _skip_comment_outside_main_story(
+    element: Element,
+    text: string,
+  ): boolean {
+    if (this._comment_anchor_in_main_story(element)) return false;
+    let root: Element = element;
+    while (root.parentNode && root.parentNode.nodeType === 1) {
+      root = root.parentNode as Element;
+    }
+    const story =
+      (
+        {
+          "w:ftr": "footer",
+          "w:hdr": "header",
+          "w:footnotes": "footnote",
+          "w:endnotes": "endnote",
+        } as Record<string, string>
+      )[root.tagName] || "non-body";
+    const msg =
+      `- Warning: the comment "${text.substring(0, 60)}" was NOT attached: Word does not support ` +
+      `comments inside a ${story} part, and writing one produces a document other ` +
+      "applications cannot open. The tracked change itself was applied.";
+    this.skipped_details.push(msg);
+    console.error(
+      `Comment anchor outside main story; comment dropped (story=${story})`,
+    );
+    return true;
+  }
+
   /**
    * Attaches a comment that wraps a contiguous range within a single paragraph.
    * start_element and end_element must both be direct children of parent_element
@@ -1162,6 +1259,8 @@ export class RedlineEngine {
     text: string,
   ) {
     if (!text) return;
+    if (!parent_element || !start_element || !end_element) return;
+    if (this._skip_comment_outside_main_story(parent_element, text)) return;
 
     const comment_id = this.comments_manager.addComment(this.author, text);
     const xmlDoc = parent_element.ownerDocument!;
@@ -1213,6 +1312,12 @@ export class RedlineEngine {
     text: string,
   ) {
     if (!text) return;
+    if (!start_p || !end_p) return;
+    if (
+      this._skip_comment_outside_main_story(start_p, text) ||
+      this._skip_comment_outside_main_story(end_p, text)
+    )
+      return;
 
     const comment_id = this.comments_manager.addComment(this.author, text);
     const xmlDocStart = start_p.ownerDocument!;
@@ -1996,6 +2101,99 @@ export class RedlineEngine {
           pfx,
           (edit.new_text || "").length - sfx,
         );
+
+        // QA 2026-07-18 C1: the projection flattens headers, body, footers
+        // and notes into one string, but a text edit whose matched span
+        // covers real text from two different OPC parts cannot be applied
+        // without putting content in the wrong part — including the
+        // insertion shape, whose anchor point at the part gap is inherently
+        // ambiguous. Refuse the RAW match range outright and ask for a
+        // single-part anchor. (Single-part documents skip the scan.)
+        const multi_part_doc =
+          target_mapper.part_ranges.filter((r) => r[1] > r[0]).length > 1;
+        const raw_span_parts = multi_part_doc
+          ? Array.from(
+              new Set(
+                target_mapper.spans
+                  .filter(
+                    (s) =>
+                      s.run !== null &&
+                      s.end > m_start &&
+                      s.start < m_start + m_len,
+                  )
+                  .map((s) => s.part_index),
+              ),
+            ).sort((a, b) => a - b)
+          : [];
+        if (raw_span_parts.length > 1) {
+          const kinds = raw_span_parts
+            .map((pi) => target_mapper.part_kind_of(pi) || "?")
+            .join(" → ");
+          errors.push(
+            `- Edit ${i + 1 + index_offset} Failed: target_text spans a structural document-part ` +
+              `boundary (${kinds}). Headers, body, footers and footnotes are separate ` +
+              "Word parts — an edit cannot cross between them. Anchor the edit on text " +
+              "within a single part (split it into one edit per part if both sides " +
+              "must change).",
+          );
+        }
+
+        // QA 2026-07-18 M5: image markers are read-only projections. Only
+        // the CHANGED span matters — markers sitting untouched in the
+        // shared context are fine.
+        const eff_start = m_start + pfx;
+        const eff_end = m_start + m_len - sfx;
+        if (eff_end > eff_start) {
+          const overlapping = target_mapper.spans.filter(
+            (s) =>
+              s.end > eff_start &&
+              s.start < eff_end &&
+              (s.run !== null || s.text.trim() !== ""),
+          );
+          if (overlapping.some((s) => (s as any).is_image_marker)) {
+            errors.push(
+              `- Edit ${i + 1 + index_offset} Failed: the target overlaps a read-only image marker ` +
+                "(![alt](docx-image:N)). Images cannot be edited or removed via text " +
+                "replacement — target the text around the image instead.",
+            );
+          }
+        }
+
+        // QA 2026-07-18 H4: comments can only be anchored in the main
+        // document story. A comment-only edit (target == new) whose match
+        // lives in a header/footer/footnote has no effect Word or
+        // LibreOffice could render — refuse it clearly.
+        if (edit.comment && (edit.new_text || "") === (edit.target_text || "")) {
+          const kind_here = target_mapper.part_kind_at(m_start);
+          if (kind_here !== null && kind_here !== "body") {
+            errors.push(
+              `- Edit ${i + 1 + index_offset} Failed: comments cannot be anchored inside a ${kind_here} ` +
+                "part — Word only supports comments in the main document body. Comment on " +
+                "the related body text instead.",
+            );
+          }
+        }
+
+        // QA 2026-07-18 C2: a replacement may not smuggle new pipe-delimited
+        // row lines into a table cell. Rows are structural; adding one
+        // requires the insert_row operation.
+        if (
+          RedlineEngine._introduces_table_row_text(
+            target_mapper,
+            m_start,
+            m_len,
+            final_target,
+            final_new,
+          )
+        ) {
+          errors.push(
+            `- Edit ${i + 1 + index_offset} Failed: new_text introduces a pipe-delimited row line inside ` +
+              "a table. Text replacement cannot create table rows — use the structured " +
+              `'insert_row' operation instead (e.g. {"type": "insert_row", ` +
+              `"target_text": "<anchor row text>", "cells": ["...", "..."]}).`,
+          );
+        }
+
         if (final_target.includes("\n\n")) {
           // A *balanced* multi-paragraph modification (target and replacement
           // carry the same number of paragraph breaks) is safe: it is split
@@ -2114,7 +2312,7 @@ export class RedlineEngine {
 
       // Structural table edits: verify the anchor really is a table row, and
       // that insert_row does not provide more cells than the row has columns —
-      // extra cells used to produce a structurally inconsistent row (QA M3).
+      // extra cells must never produce a structurally inconsistent row (QA M3).
       if (
         (edit.type === "insert_row" || edit.type === "delete_row") &&
         matches.length > 0
@@ -2148,6 +2346,33 @@ export class RedlineEngine {
    * [start, start+length) in `mapper`, or null if that text is not inside a
    * table row.
    */
+  /**
+   * True when a replacement anchored in a table would ADD line-separated
+   * pipe-delimited content — the text shape of a table row. Writing that
+   * into a cell renders a fake row inside one cell while the real grid
+   * stays unchanged (QA 2026-07-18 C2); such edits must use insert_row.
+   */
+  private static _introduces_table_row_text(
+    mapper: DocumentMapper,
+    start: number,
+    length: number,
+    final_target: string,
+    final_new: string,
+  ): boolean {
+    if (!final_new.includes("\n") || !final_new.includes(" | ")) return false;
+    const new_pipe_lines = final_new
+      .split("\n")
+      .filter((line) => line.includes(" | ")).length;
+    const old_pipe_lines = final_target
+      .split("\n")
+      .filter((line) => line.includes(" | ")).length;
+    if (new_pipe_lines <= old_pipe_lines) return false;
+    return (
+      RedlineEngine._column_count_at(mapper, start, Math.max(length, 1)) !==
+      null
+    );
+  }
+
   private static _column_count_at(
     mapper: DocumentMapper,
     start: number,
@@ -2297,16 +2522,14 @@ export class RedlineEngine {
         !["accept", "reject", "reply"].includes(c.type),
     );
 
-    // NOTE: a previous "edits_for_merge" pre-pass here silently UNWRAPPED a
-    // foreign author's <w:ins> when a strict/first edit only partially straddled
-    // its boundary — turning that author's tracked-inserted text into untracked
-    // committed body text before the edit applied, destroying their provenance.
-    // That is the same provenance-laundering failure mode the canonical engine
-    // refuses, so it has been removed: a partial straddle now surfaces the
-    // standard validation error ("Modification targets an active insertion from
-    // another author …") via validate_edits, matching the Python engine. An edit
-    // fully CONTAINED inside a foreign <w:ins> stays allowed and is handled by
-    // nesting the <w:del> inside that <w:ins> (see _apply_single_edit_indexed /
+    // Never pre-unwrap a foreign author's <w:ins> to make a partially
+    // straddling edit fit: that turns their tracked-inserted text into
+    // untracked committed body text before the edit applies, destroying
+    // their provenance. A partial straddle surfaces the standard validation
+    // error ("Modification targets an active insertion from another author
+    // …") via validate_edits, matching the Python engine. An edit fully
+    // CONTAINED inside a foreign <w:ins> is allowed and handled by nesting
+    // the <w:del> inside that <w:ins> (see _apply_single_edit_indexed /
     // _insert_and_split_ins).
 
     // BUG-7: Unified single-pass validation in wet-run / standard mode.
@@ -2391,7 +2614,15 @@ export class RedlineEngine {
         // not claim any edit "applied" (transactional parity with Python).
         const validation_failed_idx = new Set<number>();
         for (const { edit, i } of ordered_edits) {
-          let single_errors = this.validate_edits([edit], i);
+          let single_errors: string[];
+          try {
+            single_errors = this.validate_edits([edit], i);
+          } catch (e) {
+            // A pathological user pattern must fail as a clean per-edit
+            // validation error, never a hang or crash (QA 2026-07-17 F5).
+            if (!(e instanceof RegexTimeoutError)) throw e;
+            single_errors = [`- Edit ${i + 1} Failed: ${e.message}`];
+          }
           if (single_errors.length > 0) {
             if (applied_edits > 0) {
               const hint = sequential_context_hint(applied_edits);
@@ -2489,7 +2720,14 @@ export class RedlineEngine {
           const sequential_errors: string[] = [];
           let applied_so_far = 0;
           for (const { edit, i } of ordered_edits) {
-            let single_errors = this.validate_edits([edit], i);
+            let single_errors: string[];
+            try {
+              single_errors = this.validate_edits([edit], i);
+            } catch (e) {
+              // Clean per-edit failure for time-budget violations (QA F5).
+              if (!(e instanceof RegexTimeoutError)) throw e;
+              single_errors = [`- Edit ${i + 1} Failed: ${e.message}`];
+            }
             if (single_errors.length > 0) {
               if (applied_so_far > 0) {
                 const hint = sequential_context_hint(applied_so_far);
@@ -2624,7 +2862,20 @@ export class RedlineEngine {
           edit._error_msg = msg;
         }
       } else {
-        const resolved = this._pre_resolve_heuristic_edit(edit);
+        let resolved: any;
+        try {
+          resolved = this._pre_resolve_heuristic_edit(edit);
+        } catch (e) {
+          // Direct apply_edits callers bypass validate_edits; the time
+          // budget must still fail cleanly here (QA F5).
+          if (!(e instanceof RegexTimeoutError)) throw e;
+          skipped++;
+          edit._applied_status = false;
+          const msg = `- Failed to apply edit targeting: '${(edit.target_text || "").substring(0, 40)}...' (${e.message})`;
+          this.skipped_details.push(msg);
+          edit._error_msg = msg;
+          continue;
+        }
         if (resolved) {
           if (Array.isArray(resolved)) {
             for (const r of resolved) {
@@ -2667,8 +2918,8 @@ export class RedlineEngine {
 
     // Snapshot preview context now, while every resolved offset still refers
     // to the untouched document. The sweep below mutates the DOM and rebuilds
-    // the map, which shifts offsets and injects tracked-change markup —
-    // slicing full_text at report time garbled previews (QA H1).
+    // the map, shifting offsets and injecting tracked-change markup —
+    // slicing full_text at report time garbles previews (QA H1).
     for (const [res_edit] of resolved_edits) {
       this._capture_preview_context(res_edit);
       if (res_edit._parent_edit_ref) {
@@ -2684,7 +2935,13 @@ export class RedlineEngine {
 
     for (const [edit, orig_new] of resolved_edits) {
       const start = edit._resolved_start_idx || 0;
-      const end = start + (edit.target_text ? edit.target_text.length : 0);
+      // An insert_row does not consume its anchor text — it adds an adjacent
+      // row. Give it a zero-width range so several inserts sharing one
+      // anchor (consecutive new rows) never flag each other as overlapping.
+      const end =
+        edit.type === "insert_row"
+          ? start
+          : start + (edit.target_text ? edit.target_text.length : 0);
 
       const overlaps = occupied_ranges.some(
         ([occ_start, occ_end]) => start < occ_end && end > occ_start,
@@ -2814,6 +3071,29 @@ export class RedlineEngine {
         continue;
       }
 
+      // Refuse accept/reject on a w:id shared by revisions from DIFFERENT
+      // authors. Uniqueness of w:id is assumed but not guaranteed for
+      // externally produced documents (merges, cross-document copy-paste),
+      // where one action would silently resolve several unrelated changes
+      // (QA 2026-07-17 F9). Same-author reuse is legitimate — this engine
+      // itself mints one id across every element of a single logical edit —
+      // so authorship is the discriminator.
+      const dup_authors = Array.from(
+        new Set(all_nodes.map((n) => n.getAttribute("w:author") || "Unknown")),
+      ).sort();
+      if (dup_authors.length > 1) {
+        skipped++;
+        this.skipped_details.push(
+          `- Failed to apply action: ${type} on Chg:${target_id} is ambiguous. The document ` +
+            `contains ${all_nodes.length} tracked-change elements sharing w:id=${target_id} from ` +
+            `different authors (${dup_authors.join(", ")}) — duplicate revision IDs produced ` +
+            `outside this engine (e.g. by a document merge or copy-paste). Acting on this ID ` +
+            `would resolve all of them at once. Resolve these changes individually in Word, or ` +
+            `apply the intended outcome as an explicit text edit instead.`,
+        );
+        continue;
+      }
+
       for (const node of all_nodes) {
         const is_ins = node.tagName === "w:ins";
         const parent_tag = node.parentNode
@@ -3522,20 +3802,80 @@ export class RedlineEngine {
       return true;
     }
     if (op === "INSERTION") {
-      const [anchor_run, anchor_para] = active_mapper.get_insertion_anchor(
-        start_idx,
-        rebuild_map,
-      );
+      let final_new_text = edit.new_text || "";
+
+      // QA 2026-07-18 C1: a MACHINE-PINNED pure insertion (diff/text
+      // round-trip output: authored with an empty target and no parent
+      // edit) positioned in the separator gap between the body and a
+      // following part used to anchor on the NEXT part's first paragraph,
+      // writing the new final body paragraph into word/footer1.xml.
+      // Re-anchor it to the end of the body and force new-paragraph
+      // semantics. Insertions DERIVED from a target-anchored edit (parent
+      // ref set — e.g. prepending "DRAFT " to "FOOTER MARKER") keep the
+      // user's chosen anchor: their context names the part they meant.
+      let boundary_anchor: TextSpan | null = null;
+      const boundary =
+        typeof (active_mapper as any).part_boundary_at === "function"
+          ? active_mapper.part_boundary_at(start_idx)
+          : null;
+      const is_machine_pure_insertion =
+        !edit.target_text &&
+        (edit._parent_edit_ref === undefined || edit._parent_edit_ref === null);
+      if (boundary !== null && is_machine_pure_insertion) {
+        const [prev_i, next_i] = boundary;
+        const prev_kind = active_mapper.part_kind_of(prev_i);
+        const next_kind = active_mapper.part_kind_of(next_i);
+        if (prev_kind === "body" && next_kind !== "body") {
+          const real_before = active_mapper.spans.filter(
+            (s: TextSpan) => s.run !== null && s.part_index === prev_i,
+          );
+          if (real_before.length > 0) {
+            boundary_anchor = real_before[real_before.length - 1];
+          }
+        }
+      }
+
+      let anchor_run: Run | null;
+      let anchor_para: Paragraph | null;
+      if (boundary_anchor !== null) {
+        anchor_run = boundary_anchor.run;
+        anchor_para = boundary_anchor.paragraph;
+        if (!final_new_text.startsWith("\n")) {
+          final_new_text = "\n\n" + final_new_text;
+        }
+      } else {
+        [anchor_run, anchor_para] = active_mapper.get_insertion_anchor(
+          start_idx,
+          rebuild_map,
+        );
+      }
       if (!anchor_run && !anchor_para) return false;
 
+      // QA 2026-07-18 C2 (apply-level backstop, pinned edits bypass
+      // validate_edits): refuse insertions that would write row-shaped pipe
+      // text into a table cell.
+      if (
+        RedlineEngine._introduces_table_row_text(
+          active_mapper,
+          start_idx,
+          1,
+          "",
+          final_new_text,
+        )
+      ) {
+        return false;
+      }
+
       // BUG-23-3: a prefix insertion whose new_text ends in a paragraph break
       // (e.g. "Summary\n\n" inserted before "Conclusion") must become a NEW
       // paragraph placed BEFORE the anchor paragraph, not inline text merged
       // into a neighbouring paragraph. _track_insert_multiline drops the
       // trailing break and inlines the remainder, which both loses the
       // paragraph boundary and mis-orders the content. Handle this case here.
-      const _bug233_new = edit.new_text || "";
-      const _bug233_trailing_break = /\n\s*$/.test(_bug233_new);
+      // (Skipped when the C1 boundary re-anchor above took over the anchor.)
+      const _bug233_new = final_new_text;
+      const _bug233_trailing_break =
+        boundary_anchor === null && /\n\s*$/.test(_bug233_new);
       let _bug233_target_para: Element | null = null;
       {
         const startingSpans = active_mapper.spans.filter(
@@ -3613,7 +3953,7 @@ export class RedlineEngine {
       }
 
       const result = this._track_insert_multiline(
-        edit.new_text || "",
+        final_new_text,
         anchor_run,
         anchor_para,
         ins_id!,
@@ -3740,6 +4080,29 @@ export class RedlineEngine {
       return true;
     }
 
+    // QA 2026-07-18 C1 (apply-level backstop, pinned edits bypass
+    // validate_edits): a modification/deletion may never mutate real text
+    // from two different OPC parts in one span. Single-part documents skip
+    // the scan.
+    if (
+      (op === "DELETION" || op === "MODIFICATION") &&
+      length &&
+      active_mapper.part_ranges.filter((r: [number, number, string]) => r[1] > r[0]).length > 1
+    ) {
+      const crossed_parts = new Set<number>();
+      for (const s of active_mapper.spans) {
+        if (s.run !== null && s.end > start_idx && s.start < start_idx + length) {
+          crossed_parts.add(s.part_index);
+        }
+      }
+      if (crossed_parts.size > 1) {
+        console.error(
+          `Refusing edit that spans OPC part boundary (start=${start_idx}, parts=${Array.from(crossed_parts).sort().join(",")})`,
+        );
+        return false;
+      }
+    }
+
     // DELETION / MODIFICATION
     const target_runs = active_mapper.find_target_runs_by_index(
       start_idx,

package/src/index.ts

@@ -4,10 +4,11 @@ export function identifyEngine() {
 
 export { DocumentObject } from './docx/bridge.js';
 export { DocumentMapper, TextSpan } from './mapper.js';
-export { RedlineEngine, BatchValidationError } from './engine.js';
-export { generate_edits_from_text, trim_common_context, create_unified_diff, create_word_patch_diff } from './diff.js';
-export { apply_edits_to_markdown } from './markup.js';
+export { RedlineEngine, BatchValidationError, validate_edit_strings, describe_illegal_control_chars } from './engine.js';
+export { generate_edits_from_text, generate_structured_edits, trim_common_context, create_unified_diff, create_word_patch_diff, DiffEdit } from './diff.js';
+export { apply_edits_to_markdown, MarkupEditReport } from './markup.js';
 export { paginate, split_structural_appendix, PaginationResult, PageInfo } from './pagination.js';
 export { extract_outline, OutlineNode } from './outline.js';
-export { extractTextFromBuffer, _extractTextFromDoc } from './ingest.js';
-export { finalize_document, FinalizeOptions, FinalizeResult } from './sanitize/core.js';
+export { extractTextFromBuffer, _extractTextFromDoc, ExtractStructure, TableGeometry, RowGeometry } from './ingest.js';
+export { finalize_document, FinalizeOptions, FinalizeResult } from './sanitize/core.js';
+export { RegexTimeoutError, userFindAllMatches, userSearch, USER_PATTERN_TIMEOUT_MS } from './utils/safe-regex.js';