@arbidocs/blocks 0.4.100 → 0.4.102

package/node_modules/@docx-editor.dev/core/dist/failure-NS2lsya4.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Lifecycle state of one collaboration replica.
+ *
+ * One axis, because the only question a host has to answer is whether to tell the reader to
+ * wait or to reload:
+ *
+ * - `initializing` — joining. Edits are refused. Recovers on its own.
+ * - `ready` — replicating. Accepts edits.
+ * - `disconnected` — the transport dropped. The replica is intact and recovers on its own,
+ *   so wait rather than reload. Edits continue by default, and the buffered updates merge on
+ *   reconnect. A session created with `offlineEditing: false` refuses them until reconnect.
+ * - `error` — this replica does not agree with the room. Edits are refused.
+ *   {@link CollaborationStatusSnapshot.reason} says why. A remote update the replica could
+ *   not apply yet heals when a later update completes shared state
+ *   ({@link CollaborationStatusSnapshot.recovering}). A format or version mismatch needs an
+ *   upgrade of this client or the room; every other cause needs a rejoin.
+ * - `destroyed` — torn down. Terminal.
+ *
+ * @public
+ */
+type CollaborationStatus = 'initializing' | 'ready' | 'disconnected' | 'error' | 'destroyed';
+/**
+ * Why a replica refused work, left `ready`, or failed a schema check.
+ *
+ * Free-form extras (a transport phrase, a blob key, a store refusal) travel in
+ * {@link CollaborationFailure.detail}, not here. Branch on the code; log the detail.
+ *
+ * Codes are grouped by cause, and each group comment names the host action. In `error`, only
+ * a remote update that is not applied yet, or one refused local edit, heals on its own. The
+ * failure codes table in the collaboration reference lists every code.
+ * `transport-disconnected` and `authentication-failed` need opposite answers: wait for the
+ * first; refresh the credential and rejoin for the second. `room-generation-changed` means
+ * the server compacted the room while this replica was away: save a copy if it holds unsent
+ * changes, then rejoin.
+ *
+ * @public
+ */
+type CollaborationFailureCode = 
+/** Edit refused by the session gate. The status does not change. Wait for `ready`. */
+'collaboration-session-destroyed' | 'collaboration-session-not-attached' | 'collaboration-session-not-ready' | 'collaboration-text-limit' | 'experimental-collaboration-body-text-only'
+/** Factory input rejected before joining. Fix the value the host passed. */
+ | 'invalid-document-id' | 'invalid-identity' | 'invalid-identity-color' | 'invalid-session-id'
+/** Join or seed did not complete. Connect the provider, check the room id, and retry. */
+ | 'already-initialized' | 'document-id-mismatch' | 'initialization-aborted' | 'initialization-timeout' | 'not-initialized'
+/** The seed document cannot seed a room. Fix the file. */
+ | 'baseline-too-large' | 'blob-read' | 'invalid-baseline' | 'missing-local-blob' | 'no-main-document-part'
+/** This client and the room have different formats. Terminal. Save local work. */
+ | 'collaboration-format-mismatch' | 'protocol-version-mismatch' | 'schema-version-mismatch'
+/** The room is unusable. Terminal. Create a new room from saved bytes. */
+ | 'blob-digest-mismatch' | 'concurrent-seed' | 'port-already-attached'
+/** A remote update is not applied yet. Heals when a later update arrives. Wait. */
+ | 'duplicate-paragraph-id' | 'invalid-relationships' | 'materialize-dropped-content' | 'missing-blob' | 'missing-root' | 'remote-apply-failed' | 'unknown-paragraph-id'
+/** Over a resource limit. A local edit realigns; shared state over a limit is terminal. */
+ | 'blob-store-full' | 'blob-too-large' | 'invalid-blob-descriptor' | 'invalid-bound' | 'invalid-logical-id' | 'invalid-string' | 'prototype-key' | 'text-too-long' | 'too-many-attributes' | 'too-many-children' | 'too-many-nodes' | 'too-many-parts' | 'too-many-relationships' | 'tree-too-deep' | 'unknown-logical-id' | 'unsafe-part-name'
+/** Transport state. Only `transport-disconnected` recovers on its own. */
+ | 'authentication-failed' | 'room-generation-changed' | 'transport' | 'transport-disconnected'
+/** Reserved for a room server that refuses a saved room. Passed through, never emitted. */
+ | 'invalid-saved-room' | 'saved-room-unavailable'
+/** @deprecated Emitted by nothing. Kept for compatibility; do not branch on these. */
+ | 'baseline-digest-mismatch' | 'experimental-collaboration-existing-paragraphs-only' | 'experimental-collaboration-text-only' | 'experimental-collaboration-untracked-text-only' | 'immutable-baseline-changed' | 'immutable-metadata-changed' | 'invalid-shared-metadata' | 'local-mirror-failed' | 'paragraph-set-mismatch' | 'shared-schema-invalid' | 'unsupported-root-key';
+/** True when `value` is a {@link CollaborationFailureCode} member. @public */
+declare function isCollaborationFailureCode(value: string): value is CollaborationFailureCode;
+/** One collaboration failure: a typed code plus optional free-form detail. @public */
+interface CollaborationFailure {
+    /** Stable code for application logic. */
+    readonly code: CollaborationFailureCode;
+    /** Bounded diagnostic text for logs. Not a parsing contract. */
+    readonly detail?: string;
+}
+/**
+ * Cached status read. Same reference until one of its fields changes.
+ *
+ * @public
+ */
+interface CollaborationStatusSnapshot {
+    /** Current lifecycle state. */
+    readonly status: CollaborationStatus;
+    /** Why the replica holds `status`, or `undefined` when nothing is wrong. */
+    readonly reason: CollaborationFailure | undefined;
+    /** The most recent `error` reason. Kept after the replica recovers. */
+    readonly lastFailure: CollaborationFailure | undefined;
+    /**
+     * How many failures this session has recorded. It changes with each new failure, also when
+     * its code and detail repeat the last one, as a refused edit refused again does. Absent
+     * from a session that does not count.
+     */
+    readonly failureCount?: number;
+    /**
+     * The session is in `error` but heals by itself: it realigns on the next clean update and
+     * returns to its previous status. A host shows a passing notice, not a rejoin action.
+     * Absent means false.
+     */
+    readonly recovering?: boolean;
+    /**
+     * Edits wait: the room sent an update that depends on one still on its way, and an edit
+     * made now could touch the text it changes. The editor refuses edits meanwhile, with
+     * `collaboration-session-not-ready`, and accepts them again when the update arrives or the
+     * wait times out. Absent means false.
+     */
+    readonly waiting?: boolean;
+}
+/** @internal */
+interface CollaborationStatusTracker {
+    status(): CollaborationStatus;
+    snapshot(): CollaborationStatusSnapshot;
+    /** `recovering` marks an `error` the session heals by itself. */
+    set(status: CollaborationStatus, code?: CollaborationFailureCode, detail?: string, recovering?: boolean): boolean;
+    /** Whether edits wait for the room; returns whether the snapshot changed. */
+    setWaiting(waiting: boolean): boolean;
+}
+/** @internal */
+declare function createCollaborationStatusTracker(initial?: CollaborationStatus): CollaborationStatusTracker;
+
+export { createCollaborationStatusTracker as d, isCollaborationFailureCode as i };
+export type { CollaborationStatus as C, CollaborationStatusSnapshot as a, CollaborationFailureCode as b, CollaborationFailure as c };

package/node_modules/@docx-editor.dev/core/dist/font-resolver-BVQB14qT.d.ts

@@ -0,0 +1,256 @@
+import { F as FontFaceRequest, a as FontConfiguration, b as FontSource, c as FontSourceSubstitution } from './editor-Ci7IZGmG.js';
+
+/**
+ * A partial font configuration one origin contributes: sources, substitutions, or both.
+ * `loadDefaultFonts()` (the substitute package) and `loadFonts()` (the fetch helper) both
+ * return this shape, so every origin composes through `composeFontConfiguration` the
+ * same way.
+ */
+interface FontConfigurationFragment {
+    /** Selectable provider families, independent of loaded bytes. Listing them performs no fetch. */
+    readonly supportedFamilies?: readonly string[];
+    readonly sources?: readonly FontSource[];
+    readonly substitutions?: readonly FontSourceSubstitution[];
+}
+/**
+ * The base of a composition: everything a `FontConfiguration` carries, all optional.
+ * Omitted fields take the documented defaults (`epoch` 0, `maxFontBytes` at the engine
+ * hard maximum, `defaultFont` Calibri at 11pt — Word's own default face and size).
+ */
+interface FontConfigurationBase extends FontConfigurationFragment {
+    /**
+     * Identity of this configuration's byte set. The engine uses it to tell one resolved
+     * font set from another; leave it unset and the editor supplies the load sequence.
+     */
+    readonly epoch?: number;
+    /** Per-face byte ceiling. Defaults to the engine hard maximum; lower it to tighten intake. */
+    readonly maxFontBytes?: number;
+    /** The face used when a run names no font. Defaults to Word's own: Calibri at 11pt. */
+    readonly defaultFont?: FontConfiguration['defaultFont'];
+    /** BCP-47 tag passed to the shaper for language-sensitive shaping. */
+    readonly language?: string;
+}
+/**
+ * What the document turned out to need, handed to an on-demand resolver.
+ *
+ * The families are the ones the file actually names — already name-validated and capped,
+ * so a resolver may treat them as a list to look up, never as URLs or paths to build.
+ */
+interface FontResolutionRequest {
+    /**
+     * Families needed by the document, deduped and capped at {@link MAX_RESOLVER_FAMILIES}.
+     * Order is deterministic but may express host priority; do not sort it before resolving.
+     */
+    readonly families: readonly string[];
+    /** The face a run naming no font resolves to, so a resolver can cover it too. */
+    readonly defaultFamily: string;
+    /** Cancels document-scoped resolution; network-backed resolvers should pass it to fetch. */
+    readonly signal?: AbortSignal;
+    /**
+     * Faces an EARLIER origin in the same composition can already PAINT — either because it
+     * supplied the bytes, or because it mapped that face onto one it did supply.
+     *
+     * Absent, not empty, when there is nothing to report: the engine calling a resolver
+     * directly, and the first origin of a composition.
+     *
+     * FACES, not families, and only faces backed by bytes. Both narrowings are load-bearing.
+     * A family-grained list would let an origin holding only regular Arial suppress the bold
+     * and italic a later origin would have supplied, and a list built from substitutions
+     * alone would let an origin whose fetches all failed suppress the failover behind it,
+     * because both shipped resolvers emit their substitution map before fetching. Together
+     * they are what makes honouring this an OPTIMIZATION rather than a correctness
+     * requirement: skipping a reported face cannot lose one, so a resolver that ignores this
+     * list only spends bytes on a face first-wins composition would drop anyway.
+     *
+     * Match it case-insensitively. Word matches font names that way and both shipped
+     * resolvers do.
+     */
+    readonly resolvedFaces?: readonly FontFaceRequest[];
+}
+/**
+ * Resolve fonts once the document's needs are known, instead of ahead of them.
+ *
+ * Called after the file is mounted and again when editing requests a new family.
+ * Results compose with previously supplied faces; resolvedFaces identifies that coverage.
+ * Returning nothing is a valid answer — it means "I cover none of this", and the
+ * document stays on the fixed measurer.
+ *
+ * A resolver that fetches makes opening a document perform network requests. That is a
+ * real change in posture and it must stay the APP's decision: the engine never supplies
+ * one, and the families here are file-derived, so a resolver must look them up in a set
+ * it shipped rather than interpolate them into a URL.
+ */
+type FontResolver = (request: FontResolutionRequest) => FontConfiguration | FontConfigurationFragment | undefined | Promise<FontConfiguration | FontConfigurationFragment | undefined>;
+/**
+ * Ceiling on the families one document can put in front of a resolver.
+ *
+ * A resolver typically turns each family into up to four faces, and the resource snapshot
+ * refuses more than `HARD_MAX_FONT_SOURCES` (256) sources — so 64 families is the point
+ * past which a document could no longer be served anyway. Capping here means a file
+ * declaring thousands of distinct `w:rFonts` cannot fan a resolver out across thousands
+ * of lookups (or fetches) before that limit is ever reached.
+ */
+declare const MAX_RESOLVER_FAMILIES = 64;
+/** The document default font when nothing else says otherwise: Calibri at 11pt. */
+declare const DEFAULT_FONT: FontConfiguration['defaultFont'];
+/** @deprecated Use {@link DEFAULT_FONT}. */
+declare const WORD_DEFAULT_FONT: FontConfiguration['defaultFont'];
+/**
+ * Merge a base and any number of fragments into one frozen `FontConfiguration`.
+ *
+ * A bare fragment IS a valid base, so the single-origin case is one argument:
+ * `composeFontConfiguration(await loadDefaultFonts())`. Pass extra fragments to layer
+ * origins, and set `epoch`/`maxFontBytes`/`defaultFont` on the base only when you need
+ * something other than the documented defaults.
+ *
+ * - Sources dedupe first-wins by (family, weight, style), in argument order — base
+ *   before fragments, earlier fragments before later ones.
+ * - Substitutions dedupe first-wins by their `from` face, in the same order, and every
+ *   substitution whose `from` face has a direct source anywhere in the composition is
+ *   dropped: a real face always beats a stand-in.
+ * - The result is frozen (arrays included); the byte arrays themselves are the callers'
+ *   and are not copied here — the resource snapshot takes its own defensive copy.
+ */
+declare function composeFontConfiguration(base: FontConfigurationBase, ...fragments: readonly FontConfigurationFragment[]): FontConfiguration;
+
+/**
+ * The namespaced key carrying the type-level half of the mark, and the runtime property
+ * name that backs it.
+ *
+ * A plain string rather than a symbol on purpose: `@docx-editor.dev/fonts` has no runtime
+ * or type dependency on the engine, so it declares the same mark itself, and two
+ * `unique symbol`s in two packages would not unify. Two identical string keys do.
+ *
+ * @public
+ */
+declare const FONT_RESOLVER_MARK_KEY = "docx-editor.dev/font-resolver";
+/**
+ * The runtime marker `defineFontResolver` sets and {@link isFontResolver} reads.
+ *
+ * Exported because a package mirroring the font contract structurally still has to mark
+ * the resolvers it builds. A package in that position sets
+ * `Symbol.for('docx-editor.dev/font-resolver')` itself; this constant is the same symbol,
+ * named, for everyone who can import it.
+ *
+ * @public
+ */
+declare const FONT_RESOLVER_BRAND: unique symbol;
+/**
+ * The type-level half of the mark: what {@link defineFontResolver} adds to a function's
+ * type so a `FontOrigin` list can REQUIRE it.
+ *
+ * Declared with a string key so `@docx-editor.dev/fonts` can declare an identical
+ * interface and have the two unify without importing anything from the engine. Set at
+ * runtime as well as in the type — non-enumerable, so it stays out of `Object.keys` and
+ * out of a host's own spread.
+ *
+ * @public
+ */
+interface FontResolverMark {
+    /** Always `true`. Set non-enumerably by {@link defineFontResolver}. */
+    readonly 'docx-editor.dev/font-resolver': true;
+}
+/**
+ * A {@link FontResolver} that has been through {@link defineFontResolver}.
+ *
+ * This, not bare `FontResolver`, is what a `FontOrigin` list accepts. The mark is the only
+ * thing separating a resolver from a zero-argument loader, and getting that wrong loses
+ * every font silently, so the type asks for it up front.
+ *
+ * @public
+ */
+type MarkedFontResolver<T extends FontResolver = FontResolver> = T & FontResolverMark;
+/**
+ * Mark a function as an on-demand {@link FontResolver}.
+ *
+ * Wrap every resolver you put in a `fonts` list — `useFonts(...)`, `useDocxSource`'s
+ * `fonts` option, `composeFontOrigins`. The `fonts` PROP needs no marking, because a
+ * function there is always a resolver; a list also accepts the older zero-argument loader
+ * form (`{ fonts: defaultFonts }`), and this is what keeps the two apart.
+ *
+ * Returns the same function object, mutated, so the mark survives being passed around and
+ * a marked resolver stays `===` to itself. It does NOT survive `.bind()` or being wrapped:
+ * both make a new function object. Re-mark the result.
+ *
+ * ```ts
+ * const brandFonts = defineFontResolver(async ({ families }) => ({
+ *   sources: await loadMine(families),
+ * }));
+ * ```
+ *
+ * Throws a `TypeError` on a frozen or sealed function, which cannot take the mark. That is
+ * deliberate: returning it unmarked would compile — the return TYPE says marked — and then
+ * lose every font at runtime.
+ *
+ * @public
+ */
+declare function defineFontResolver<T extends FontResolver>(resolve: T): MarkedFontResolver<T>;
+/**
+ * Whether a value is a function marked by {@link defineFontResolver}.
+ *
+ * False for an unmarked function, which callers read as a zero-argument loader. Calling a
+ * resolver that way reads `request.defaultFamily` off `undefined` and throws, so the
+ * callers that make this choice say so rather than swallowing it — and the type-level mark
+ * on {@link MarkedFontResolver} is there to stop it reaching runtime at all.
+ *
+ * @public
+ */
+declare function isFontResolver(value: unknown): value is MarkedFontResolver;
+/**
+ * ONE font origin, in the one shape every origin takes: a finished configuration, a
+ * fragment, a promise for either, or a marked resolver that answers per document.
+ *
+ * The point of the union is that `packagedFonts()`, `googleFonts()`, `await defaultFonts()`
+ * and a hand-built `{ sources }` are all the same kind of thing, so a list of them needs no
+ * ordering rule beyond "first wins".
+ *
+ * The resolver arm is {@link MarkedFontResolver}, not bare `FontResolver`: a list may also
+ * hold a zero-argument loader, and only the mark separates the two.
+ *
+ * @public
+ */
+type FontOrigin = FontConfiguration | FontConfigurationFragment | MarkedFontResolver | Promise<FontConfiguration | FontConfigurationFragment | undefined> | undefined;
+/** A failed font origin or a partial failure in an otherwise usable fragment. @public */
+interface FontOriginFailure {
+    /** Zero-based position in the first-wins origin list. */
+    readonly originIndex: number;
+    /** Resolver function name when one is safely available. */
+    readonly originName?: string;
+    readonly cause: unknown;
+}
+/** Diagnostics hook for ordered font-origin composition. @public */
+interface ComposeFontOriginsOptions {
+    /** Fire-and-forget diagnostics; returned promises are observed but do not delay resolution. */
+    readonly onOriginFailure?: (failure: FontOriginFailure) => void;
+}
+/**
+ * Resolve a list of {@link FontOrigin}s against one document's needs and merge them,
+ * first-wins in list order.
+ *
+ * Origins resolve IN ORDER, one after another, and each is told which faces the ones
+ * before it can already paint ({@link FontResolutionRequest.resolvedFaces}). Sequential
+ * rather than a `Promise.all`, and that is a real cost — one extra origin's latency on the
+ * critical path — bought deliberately: composition is first-wins, so a later origin's copy
+ * of a face an earlier one supplied can never be used, and fetching it anyway spends the
+ * bytes twice and tells a font host which families the document uses for a result that
+ * gets thrown away. Order origins cheapest-first.
+ *
+ * A resolver that ignores `resolvedFaces` still composes correctly; it just spends more.
+ *
+ * ONE ORIGIN CANNOT SINK THE REST. An origin that throws, answers `null`, or answers
+ * something malformed is reported and skipped whole, and the origins around it still
+ * compose — an app that listed a flaky network origin behind a bundled one keeps the
+ * bundled faces. Skipped WHOLE: an answer is read completely before any of it is
+ * committed, so a half-ingested origin can never reach composition.
+ *
+ * The result carries NO `epoch`: it is a fragment for the engine to stamp with the load
+ * sequence. A fixed epoch from here would label every document's byte set as the same one.
+ * `undefined` means no origin contributed anything, which is a normal answer — the document
+ * stays on the fixed measurer.
+ *
+ * @public
+ */
+declare function composeFontOrigins(origins: readonly FontOrigin[], request: FontResolutionRequest, options?: ComposeFontOriginsOptions): Promise<FontConfigurationFragment | undefined>;
+
+export { DEFAULT_FONT as D, MAX_RESOLVER_FAMILIES as M, WORD_DEFAULT_FONT as W, FONT_RESOLVER_BRAND as b, FONT_RESOLVER_MARK_KEY as c, composeFontConfiguration as j, composeFontOrigins as k, defineFontResolver as l, isFontResolver as m };
+export type { ComposeFontOriginsOptions as C, FontOriginFailure as F, FontOrigin as a, FontConfigurationBase as d, FontConfigurationFragment as e, FontResolutionRequest as f, FontResolver as g, FontResolverMark as h, MarkedFontResolver as i };

package/node_modules/@docx-editor.dev/core/dist/headless-document-view-qH331moE.d.ts

@@ -0,0 +1,143 @@
+import { H as HeaderFooterParts, b as HeaderFooterSectionResolution, T as TreePackageStore } from './tree-package-fragment-BeeKxDw8.js';
+import { Q as OoxmlPackage, O as OoxmlPart, Z as OoxmlElement, Y as OoxmlPackageRejection } from './types-barrel-D3xCgQX6.js';
+
+/** The package with a hyperlink relationship guaranteed present, and that relationship's id. */
+interface EnsuredHyperlinkRelationship {
+    readonly pkg: OoxmlPackage;
+    readonly relationshipId: string;
+}
+/**
+ * The target this engine would write for `url`, or null when it would write none.
+ *
+ * The VALIDATION half of {@link ensureHyperlinkRelationship}, exported so a caller that must decide
+ * "would this be authored?" before it is allowed to change the package can ask without changing it.
+ * A relationship outlives a refusal — it lives beside the trees, outside the undo stack — so a
+ * caller planning a batch that may yet be refused has to ask this and mint later.
+ *
+ * Same rules, one implementation: `sanitizeHref`'s allowlist, a bound on the length, XML-writable
+ * text, and the absolute-URI gate the READ side applies. There is no legitimate reason for this
+ * engine to author a scheme it would refuse to open.
+ */
+declare function authorableHyperlinkTarget(url: string): string | null;
+/**
+ * The external hyperlink relationship for `url` on `ownerPart` (default: main document),
+ * reusing an existing one with the same target, or `null` when the URL is not something to
+ * write.
+ *
+ * REUSE IS BY EXACT TARGET, matching Word: linking twice to the same address produces one
+ * relationship. It is safe because a hyperlink relationship carries nothing but its target —
+ * two links sharing one are indistinguishable from two links with identical targets, and
+ * retargeting one always mints rather than rewriting (see the edit op).
+ *
+ * Ownership follows the story that holds the `w:hyperlink`: a header/footer or notes part
+ * mints into that part's `.rels`, never into `document.xml.rels`. Passing an owner the
+ * package does not declare fails closed (`null`) so a scoped insert cannot leave a stray
+ * body relationship behind.
+ *
+ * The URL is refused unless `sanitizeHref` admits it. Storing a `javascript:` target that a
+ * FILE authored is required — round-tripping never rewrites a document — but AUTHORING one
+ * here is not: there is no legitimate reason for this engine to write a scheme it would then
+ * refuse to open, and writing it would hand the next reader a live target this reader made.
+ */
+declare function ensureHyperlinkRelationship(pkg: OoxmlPackage, url: string, ownerPart?: string): EnsuredHyperlinkRelationship | null;
+/**
+ * What a part's relationships answer for one `r:id`, over both maps.
+ *
+ * `relationships` holds the internal records and `externalTargets` the external ones, so a
+ * resolver reading only the first sees every hyperlink as dangling.
+ */
+declare function relationshipTargetIn(pkg: OoxmlPackage, ownerPart: string, relationshipId: string): {
+    readonly target: string;
+    readonly external: boolean;
+    readonly sinkSafe?: boolean;
+} | null;
+
+/**
+ * The document metadata Word's document-property fields render.
+ *
+ * Every member is optional: an absent part, an absent element, or an empty value all read as
+ * `undefined`, and a field over a missing property paints nothing. Keys are engine-internal
+ * names; the field → property mapping (`TITLE` → `title`, `AUTHOR` → `creator`, …) lives in
+ * `layout/field-doc-property.ts`.
+ */
+interface DocumentProperties {
+    /** `dc:title` — TITLE. */
+    readonly title?: string;
+    /** `dc:creator` — AUTHOR. */
+    readonly creator?: string;
+    /** `dc:subject` — SUBJECT. */
+    readonly subject?: string;
+    /** `cp:keywords` — KEYWORDS. */
+    readonly keywords?: string;
+    /** `cp:lastModifiedBy` — LASTSAVEDBY. */
+    readonly lastModifiedBy?: string;
+    /** `dc:description` — COMMENTS. */
+    readonly description?: string;
+    /** `Company` from `docProps/app.xml`. No field maps to it yet; carried for completeness. */
+    readonly company?: string;
+    /** `Manager` from `docProps/app.xml`. No field maps to it yet; carried for completeness. */
+    readonly manager?: string;
+}
+
+/** Theme typefaces already validated for use by layout. @public */
+interface HeadlessThemeFonts {
+    readonly major: string | null;
+    readonly minor: string | null;
+    /** East Asian heading face; optional for backwards-compatible custom views. */
+    readonly majorEastAsia?: string | null;
+    /** East Asian body face; optional for backwards-compatible custom views. */
+    readonly minorEastAsia?: string | null;
+    /** Complex-script heading and body theme faces. */
+    readonly majorBidi?: string | null;
+    readonly minorBidi?: string | null;
+    /** Language-specific theme faces, keyed by ISO 15924 script. */
+    readonly majorSupplemental?: Readonly<Record<string, string>>;
+    readonly minorSupplemental?: Readonly<Record<string, string>>;
+}
+/**
+ * The read capabilities shared by browser layout, server export, and future renderers.
+ *
+ * It deliberately exposes resolved package facts rather than a binding or editor session.
+ * An exporter can therefore consume the live document without importing ProseMirror or a DOM.
+ * @public
+ */
+interface HeadlessDocumentView {
+    part(): OoxmlPart;
+    currentPackage(): OoxmlPackage;
+    packageRevision(): number;
+    stylesRoot(): OoxmlElement | null;
+    numberingRoot(): OoxmlElement | null;
+    settingsRoot(): OoxmlElement | null;
+    documentThemeFonts(): HeadlessThemeFonts;
+    documentProperties(): DocumentProperties;
+    headerFooterPartsBySection(): readonly HeaderFooterParts[];
+    /**
+     * Occurrence-specific relationship metadata for header/footer stories.
+     *
+     * Optional for backwards-compatible host views; core derives it from `currentPackage()` when
+     * absent. Hosts with a working-tree overlay should expose their canonical resolution directly.
+     */
+    headerFooterResolutionBySection?(): readonly HeaderFooterSectionResolution[];
+    relationshipTarget(relationshipId: string): ReturnType<typeof relationshipTargetIn>;
+}
+/** A bad package is data, not an exceptional control path. @public */
+type HeadlessDocumentRejection = OoxmlPackageRejection | 'no-main-document-tree';
+/** Result of opening untrusted DOCX bytes for neutral layout. @public */
+type OpenHeadlessDocumentResult = {
+    readonly ok: true;
+    readonly view: HeadlessDocumentView;
+} | {
+    readonly ok: false;
+    readonly reason: HeadlessDocumentRejection;
+    readonly detail?: string;
+};
+/**
+ * Open DOCX bytes through the bounded store reader and expose only neutral layout reads.
+ * @public
+ */
+declare function openHeadlessDocument(bytes: Uint8Array): OpenHeadlessDocumentResult;
+/** Internal live read view over the canonical store, preserving node identities for field pagination. */
+declare function headlessViewOfStore(store: TreePackageStore): HeadlessDocumentView;
+
+export { authorableHyperlinkTarget as c, ensureHyperlinkRelationship as e, headlessViewOfStore as h, openHeadlessDocument as o, relationshipTargetIn as r };
+export type { DocumentProperties as D, EnsuredHyperlinkRelationship as E, HeadlessDocumentView as H, OpenHeadlessDocumentResult as O, HeadlessDocumentRejection as a, HeadlessThemeFonts as b };