@docx-editor.dev/core 2.20.0 → 2.21.0

package/dist/{types-barrel-CEOy-Jv0.d.ts → types-barrel-DLB11iSY.d.ts}

@@ -1,225 +1,4 @@
-/**
- * Why a part or relationship name was refused.
- *
- * Path traversal is the reason this exists: a name with `..` or a leading `/` is refused rather
- * than normalized, because normalizing is how a crafted package reaches outside itself.
- */
-type NameRejection = 'empty' | 'control-char' | 'backslash' | 'drive-or-unc' | 'encoded-separator' | 'encoded-dot' | 'bad-encoding' | 'empty-segment' | 'dot-segment' | 'unsafe-key' | 'segment-trailing-dot' | 'traversal-escape' | 'not-absolute-uri' | 'unsafe-scheme';
-/** A validated OPC name, or the typed reason it was refused. */
-type NameResult = {
-    readonly ok: true;
-    readonly partName: string;
-} | {
-    readonly ok: false;
-    readonly reason: NameRejection;
-};
-/**
- * Normalize a ZIP entry name or OPC part name into a canonical part name
- * (`/word/document.xml`). Accepts leading-slash and no-leading-slash inputs;
- * rejects traversal, dot segments, and the attack surface. Duplicate detection
- * folds ASCII case (OPC part-name equivalence).
- */
-declare function normalizePartName(raw: string): NameResult;
-/**
- * ASCII-only lowercase fold. OPC part-name/extension equivalence is US-ASCII
- * case-insensitive; a locale `toLowerCase()` mis-folds e.g. Turkish `I`/`İ` and
- * could let two "equivalent" part names evade duplicate detection.
- */
-declare function asciiFold(s: string): string;
-/** Case-folded key for OPC part-name equivalence / duplicate detection. */
-declare function partNameKey(partName: string): string;
-/**
- * Detect archive entries that collide after normalization (before inflation).
- * Returns the case-folded keys that more than one raw name maps to.
- */
-declare function detectDuplicateNames(rawNames: readonly string[]): {
-    readonly duplicates: readonly string[];
-    readonly rejected: readonly {
-        raw: string;
-        reason: NameRejection;
-    }[];
-};
-/**
- * Resolve an internal relationship target against its owner part, without
- * escaping the package root. `ownerPartName` is a canonical part name; the base
- * is its containing folder. A leading "/" target is package-absolute. `.`/`..`
- * segments resolve on a stack; popping above root is `traversal-escape`.
- */
-declare function resolveInternalTarget(ownerPartName: string, rawTarget: string): NameResult;
-/**
- * Validate an external-mode relationship target. It MUST be an absolute URI, is
- * retained verbatim by the caller, and is NEVER owner-resolved or fetched here.
- * Unsafe schemes (javascript/vbscript/data/file) are rejected for runtime sinks;
- * the raw lexical form is still preserved separately by the authored record.
- */
-declare function validateExternalTarget(raw: string): NameResult;
-
-/** One `<Default>`: a file extension mapped to a content type. */
-interface DefaultRecord {
-    readonly extension: string;
-    readonly contentType: string;
-    readonly order: number;
-}
-/** One `<Override>`: a specific part name mapped to a content type. Beats any Default. */
-interface OverrideRecord {
-    readonly partName: string;
-    readonly contentType: string;
-    readonly order: number;
-}
-/**
- * The authored `[Content_Types].xml` records, in significant order.
- *
- * Retained rather than collapsed into a lookup, because the file's lexical form and ordering are
- * part of what a lossless save re-emits.
- */
-interface ContentTypeRecords {
-    readonly defaults: readonly DefaultRecord[];
-    readonly overrides: readonly OverrideRecord[];
-}
-/**
- * Why content-type records could not be indexed.
- *
- * All fail CLOSED: conflicting Defaults on one extension, duplicate normalized Override names, or
- * invalid MIME syntax are refused rather than resolved by picking one.
- */
-type ContentTypeError = {
-    readonly code: 'invalid-mime';
-    readonly value: string;
-} | {
-    readonly code: 'conflicting-default';
-    readonly extension: string;
-} | {
-    readonly code: 'duplicate-override';
-    readonly partName: string;
-} | {
-    readonly code: 'invalid-override-name';
-    readonly partName: string;
-} | {
-    readonly code: 'too-many-records';
-    readonly limit: number;
-};
-/** Whether a string is syntactically a MIME type. Syntax only — no registry lookup. */
-declare function isValidMime(value: string): boolean;
-/** ASCII-case-insensitive extension key (leading dot removed; ASCII-only fold). */
-declare function extensionKey(extension: string): string;
-/** The resolved lookup: Override by case-folded part name, Default by case-insensitive extension. */
-interface ContentTypeIndex {
-    /** ext key -> single MIME (identical duplicates collapsed). */
-    readonly defaults: ReadonlyMap<string, string>;
-    /** case-folded part name -> MIME. */
-    readonly overrides: ReadonlyMap<string, string>;
-}
-/** The built index, or the conflict that made it impossible. */
-type IndexResult = {
-    readonly ok: true;
-    readonly index: ContentTypeIndex;
-} | {
-    readonly ok: false;
-    readonly error: ContentTypeError;
-};
-/**
- * Build a resolved content-type index, failing closed on conflict/duplicate/MIME
- * errors. `maxRecords` bounds the combined record count (N/N+1 gate).
- */
-declare function buildContentTypeIndex(records: ContentTypeRecords, maxRecords?: number): IndexResult;
-/**
- * A part's content type, or why it has none.
- *
- * An orphan record never determines a part's type — a Default with no matching part is preserved
- * inertly rather than applied.
- */
-type ResolveResult = {
-    readonly ok: true;
-    readonly contentType: string;
-    readonly source: 'override' | 'default';
-} | {
-    readonly ok: false;
-    readonly reason: 'unknown';
-};
-/** Resolve a part's content type: Override wins over Default; else unknown. */
-declare function resolveContentType(index: ContentTypeIndex, partName: string): ResolveResult;
-
-/** OOXML image relationship type for embedded or linked media parts. */
-declare const IMAGE_RELATIONSHIP_TYPE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image";
-/**
- * Whether a relationship points inside the package or out of it.
- *
- * The security-relevant distinction: an `External` target is retained VERBATIM and never
- * owner-resolved or fetched, because auto-loading a file-supplied remote target is a zero-click
- * external fetch.
- */
-type TargetMode = 'Internal' | 'External';
-/**
- * One authored relationship, with nothing materialized away: owner part, id, type, raw target
- * lexical form, mode, and position.
- */
-interface RelationshipRecord {
-    readonly ownerPart: string;
-    readonly id: string;
-    readonly type: string;
-    readonly rawTarget: string;
-    readonly targetMode: TargetMode;
-    readonly order: number;
-}
-/** Why a relationship set is invalid. Duplicate ids within one owner fail closed. */
-type RelationshipError = {
-    readonly code: 'duplicate-id';
-    readonly ownerPart: string;
-    readonly id: string;
-};
-/** The validated relationship set, or the conflict that rejected it. */
-type RelationshipSetResult = {
-    readonly ok: true;
-    readonly byOwner: ReadonlyMap<string, readonly RelationshipRecord[]>;
-} | {
-    readonly ok: false;
-    readonly error: RelationshipError;
-};
-/** Group relationships by owner in authored order; reject duplicate ids per owner. */
-declare function buildRelationshipSet(records: readonly RelationshipRecord[]): RelationshipSetResult;
-/**
- * A relationship resolved to a part, or the reason it could not be.
- *
- * External targets resolve to a refusal by design: they are never followed from a file.
- */
-type ResolvedRelationship = {
-    readonly mode: 'Internal';
-    readonly target: NameResult;
-    readonly raw: string;
-} | {
-    readonly mode: 'External';
-    readonly sinkSafe: NameResult;
-    readonly raw: string;
-};
-/**
- * Resolve a relationship to a runtime projection while the raw target stays
- * authored. Internal -> owner-relative part name; External -> sink-safe
- * validation only (never owner-resolved, never fetched). `raw` is always the
- * verbatim authored target.
- */
-declare function resolveRelationship(rec: RelationshipRecord): ResolvedRelationship;
-/**
- * An image relationship resolved to package bytes, or why it was refused.
- *
- * External-mode image rels are refused rather than fetched — the no-zero-click-external-fetch
- * rule applies to images exactly as it does to links.
- */
-type ImageRelationshipResolution = {
-    readonly mode: 'internal';
-    readonly partName: string;
-    readonly raw: string;
-} | {
-    readonly mode: 'external';
-    readonly sinkSafe: boolean;
-    readonly raw: string;
-} | {
-    readonly mode: 'missing';
-};
-/**
- * Resolve an image relationship id from an owner part. Internal targets resolve
- * owner-relative; external targets are never fetched; a missing id is `missing`.
- */
-declare function resolveImageRelationship(records: readonly RelationshipRecord[] | undefined, ownerPart: string, relationshipId: string): ImageRelationshipResolution;
+import { c as HistoryGroupOutcome } from './editor-scope-OHPwVQ5l.js';
 
 /**
  * One parsed XML node, preserving significant order, whitespace and raw lexical values.
@@ -1092,38 +871,433 @@ type OoxmlInvariantResult = {
  */
 declare function readOoxmlPart(xml: string, metadata: OoxmlPartMetadata, limits?: XmlLimits): OoxmlReadResult;
 
-/**
- * Why a zip was refused at the trust boundary.
- *
- * `too-large` and `too-many-entries` are the zip-bomb guards; `bad-name` catches path traversal —
- * an entry with `..` or a leading `/` is rejected rather than normalized.
- */
-type ZipRejection = 'too-many-entries' | 'too-large' | 'bad-name' | 'inflate-error';
-/** Archive caps: entry count, total decompressed bytes, and the decompression ratio. */
-interface ZipLimits {
-    readonly maxEntries: number;
-    /** Max total UNCOMPRESSED bytes across the archive. */
-    readonly maxTotalBytes: number;
-    /** Max per-entry uncompressed:compressed ratio (zip-bomb guard). */
-    readonly maxRatio?: number;
-}
-/** The archive caps in force when a host configures none. Conservative and finite. */
-declare const DEFAULT_ZIP_LIMITS: ZipLimits;
-/** The read entries, or the typed refusal. Never throws — the bytes are untrusted. */
-type ZipReadResult = {
-    readonly ok: true;
-    readonly entries: ReadonlyMap<string, Uint8Array>;
+type AutomationTableMutation = {
+    readonly kind: 'values';
+    readonly values: readonly (readonly string[])[];
 } | {
-    readonly ok: false;
-    readonly reason: ZipRejection;
-    readonly detail?: string;
-    readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
-};
-/**
- * Inflate a ZIP archive with bounds + OPC name normalization. Entry name, count,
- * compression-ratio, and total-uncompressed-size limits are enforced BEFORE each
- * entry is decompressed (via fflate's pre-inflation filter), so a zip bomb or a
- * traversal name is rejected without ever being inflated. Keys are canonical part
+    readonly kind: 'addRows' | 'addColumns';
+    readonly location: 'start' | 'end';
+    readonly count: number;
+    readonly values?: readonly (readonly string[])[];
+} | {
+    readonly kind: 'deleteRows' | 'deleteColumns';
+    readonly index: number;
+    readonly count: number;
+} | {
+    readonly kind: 'delete';
+} | {
+    readonly kind: 'properties';
+    readonly styleId?: string;
+    readonly headerRowCount?: number;
+} | {
+    readonly kind: 'cell';
+    readonly cellId: string;
+    readonly value?: string;
+    readonly columnWidth?: number;
+    readonly shadingColor?: string;
+    readonly verticalAlignment?: 'Top' | 'Center' | 'Bottom';
+};
+
+/** Select one declared entry of a legacy Word dropdown form field. */
+interface SetLegacyDropdownOp {
+    readonly op: 'setLegacyDropdown';
+    readonly paragraphId: string;
+    readonly fieldNodeId: string;
+    readonly selectedIndex: number;
+}
+
+interface SetFieldCodeOp {
+    readonly op: 'setFieldCode';
+    readonly paragraphId: string;
+    readonly fieldNodeId: string;
+    readonly code: string;
+}
+
+type InsertTextOp = {
+    readonly op: 'insertText';
+    readonly paragraphId: string;
+    /** Legacy text form identity for protected filling; never an inline wrapper owner. */
+    readonly textFormFieldId?: string;
+    readonly offset: number;
+    readonly text: string;
+    /**
+     * Write this as a TRACKED insertion, attributed here.
+     *
+     * On the op rather than on the store, so suggesting stays a decision the surface makes
+     * per edit and the write vocabulary stays explicit — a global "everything is tracked
+     * now" flag is exactly what `DocEdits` refuses, because it makes the meaning of an op
+     * depend on state the op does not carry.
+     */
+    readonly revision?: RevisionAttributionInput;
+    /**
+     * When set, the text belongs INSIDE this content control, whatever sits at the offset.
+     *
+     * A boundary offset is owned by the run that starts there, which at a control's trailing
+     * edge is the run after the control — so an offset alone cannot say "append to this field",
+     * the way it cannot say which run of a field result to format (see `targetRunIds`). A
+     * caller that names the control gets the text in the control; one that does not gets the
+     * plain offset rule, which is what a keystroke beside a field means.
+     */
+    readonly inside?: string;
+    /**
+     * Which side of a run BOUNDARY the text joins. Default `'left'` — Word's typing rule:
+     * the next character takes the formatting of the character before the caret.
+     *
+     * `'right'` is for a caller that is not typing but placing text inside the run that
+     * STARTS at the offset — the hyperlink editor rewriting a link's display text, where
+     * landing left of the boundary would put the new text outside the link. Ignored when
+     * the offset falls strictly inside a run, which has no boundary to choose.
+     */
+    readonly bias?: 'left' | 'right';
+};
+type DeleteTextOp = {
+    readonly op: 'deleteText';
+    readonly paragraphId: string;
+    /** Legacy text form identity for protected filling; never an inline wrapper owner. */
+    readonly textFormFieldId?: string;
+    readonly start: number;
+    readonly end: number;
+    /** Write this as a TRACKED deletion — the characters stay, wrapped in `w:del`. */
+    readonly revision?: RevisionAttributionInput;
+};
+
+/** Editable legacy text input types. Other authored types remain inert. */
+type TextFormFieldType = 'regular' | 'number' | 'date';
+/** Options stored in the legacy field definition. Zero means unlimited length. */
+interface TextFormFieldOptions {
+    readonly type: TextFormFieldType;
+    readonly maxLength: number;
+    readonly format: string;
+    readonly enabled: boolean;
+}
+/** Supported format choices for legacy text input fields. @public */
+declare const TEXT_FORM_FORMATS: {
+    readonly regular: readonly ["", "Uppercase", "Lowercase", "First capital", "Title case"];
+    readonly number: readonly ["", "0", "0.00", "#,##0", "#,##0.00", "0%", "0.00%"];
+    readonly date: readonly ["", "M/d/yyyy", "MM/dd/yyyy", "d/M/yyyy", "dd/MM/yyyy", "yyyy-MM-dd", "d MMMM yyyy", "MMMM d, yyyy"];
+};
+
+/** A legacy text input in the shared paragraph offset space. */
+interface TextFormFieldRange {
+    readonly fieldNodeId: string;
+    readonly start: number;
+    readonly end: number;
+    readonly enabled: boolean;
+    readonly defaultText: string;
+    readonly type: string;
+    readonly maxLength: number;
+    readonly format: string;
+    readonly chromeIds: readonly string[];
+}
+/** Uses the field parser and offset index; never introduces another inline walk. */
+declare function textFormFieldsOf(paragraph: OoxmlParagraphNode): readonly TextFormFieldRange[];
+/** Options edit for an existing legacy text form. */
+interface SetTextFormFieldDefaultOp {
+    readonly op: 'setTextFormFieldDefault';
+    /** Regional conventions for new date input; defaults to en-US. */
+    readonly locale?: string;
+    readonly paragraphId: string;
+    readonly fieldNodeId: string;
+    readonly text: string;
+    readonly options?: TextFormFieldOptions;
+}
+/** Validate and format the existing result when a user finishes filling a field. */
+interface CommitTextFormFieldOp {
+    readonly op: 'commitTextFormField';
+    /** Regional conventions for new date input; defaults to en-US. */
+    readonly locale?: string;
+    readonly paragraphId: string;
+    readonly fieldNodeId: string;
+}
+
+/** One FORMCHECKBOX in the shared paragraph offset space. */
+interface LegacyCheckboxFieldRange {
+    /** The begin `w:fldChar` node: what the op addresses. */
+    readonly fieldNodeId: string;
+    readonly start: number;
+    readonly end: number;
+    readonly checked: boolean;
+    /** `w:enabled` under `w:ffData`; a disabled field renders but refuses the toggle. */
+    readonly enabled: boolean;
+}
+/** Flip a FORMCHECKBOX's state; the only write into `w:ffData` a checkbox permits. */
+interface SetLegacyCheckboxOp {
+    readonly op: 'setLegacyCheckbox';
+    readonly paragraphId: string;
+    readonly fieldNodeId: string;
+    readonly checked: boolean;
+}
+/** Every FORMCHECKBOX in a paragraph, in document order; uses the shared field parser. */
+declare function legacyCheckboxFieldsOf(paragraph: OoxmlParagraphNode): readonly LegacyCheckboxFieldRange[];
+
+/** Replace a building block gallery control's content with one block's body. */
+interface InsertBuildingBlockOp {
+    readonly op: 'insertBuildingBlock';
+    readonly controlId: string;
+    /** `w:docPartPr/w:name` of the picked block, for the journal and the host. */
+    readonly name: string;
+    /**
+     * Self-contained `w:docPartBody` children, cloned with fresh ids at apply.
+     * Resource, style, field, bookmark, note and revision references return `unsupported`.
+     */
+    readonly blocks: readonly OoxmlNode[];
+}
+
+/**
+ * Why a part or relationship name was refused.
+ *
+ * Path traversal is the reason this exists: a name with `..` or a leading `/` is refused rather
+ * than normalized, because normalizing is how a crafted package reaches outside itself.
+ */
+type NameRejection = 'empty' | 'control-char' | 'backslash' | 'drive-or-unc' | 'encoded-separator' | 'encoded-dot' | 'bad-encoding' | 'empty-segment' | 'dot-segment' | 'unsafe-key' | 'segment-trailing-dot' | 'traversal-escape' | 'not-absolute-uri' | 'unsafe-scheme';
+/** A validated OPC name, or the typed reason it was refused. */
+type NameResult = {
+    readonly ok: true;
+    readonly partName: string;
+} | {
+    readonly ok: false;
+    readonly reason: NameRejection;
+};
+/**
+ * Normalize a ZIP entry name or OPC part name into a canonical part name
+ * (`/word/document.xml`). Accepts leading-slash and no-leading-slash inputs;
+ * rejects traversal, dot segments, and the attack surface. Duplicate detection
+ * folds ASCII case (OPC part-name equivalence).
+ */
+declare function normalizePartName(raw: string): NameResult;
+/**
+ * ASCII-only lowercase fold. OPC part-name/extension equivalence is US-ASCII
+ * case-insensitive; a locale `toLowerCase()` mis-folds e.g. Turkish `I`/`İ` and
+ * could let two "equivalent" part names evade duplicate detection.
+ */
+declare function asciiFold(s: string): string;
+/** Case-folded key for OPC part-name equivalence / duplicate detection. */
+declare function partNameKey(partName: string): string;
+/**
+ * Detect archive entries that collide after normalization (before inflation).
+ * Returns the case-folded keys that more than one raw name maps to.
+ */
+declare function detectDuplicateNames(rawNames: readonly string[]): {
+    readonly duplicates: readonly string[];
+    readonly rejected: readonly {
+        raw: string;
+        reason: NameRejection;
+    }[];
+};
+/**
+ * Resolve an internal relationship target against its owner part, without
+ * escaping the package root. `ownerPartName` is a canonical part name; the base
+ * is its containing folder. A leading "/" target is package-absolute. `.`/`..`
+ * segments resolve on a stack; popping above root is `traversal-escape`.
+ */
+declare function resolveInternalTarget(ownerPartName: string, rawTarget: string): NameResult;
+/**
+ * Validate an external-mode relationship target. It MUST be an absolute URI, is
+ * retained verbatim by the caller, and is NEVER owner-resolved or fetched here.
+ * Unsafe schemes (javascript/vbscript/data/file) are rejected for runtime sinks;
+ * the raw lexical form is still preserved separately by the authored record.
+ */
+declare function validateExternalTarget(raw: string): NameResult;
+
+/** One `<Default>`: a file extension mapped to a content type. */
+interface DefaultRecord {
+    readonly extension: string;
+    readonly contentType: string;
+    readonly order: number;
+}
+/** One `<Override>`: a specific part name mapped to a content type. Beats any Default. */
+interface OverrideRecord {
+    readonly partName: string;
+    readonly contentType: string;
+    readonly order: number;
+}
+/**
+ * The authored `[Content_Types].xml` records, in significant order.
+ *
+ * Retained rather than collapsed into a lookup, because the file's lexical form and ordering are
+ * part of what a lossless save re-emits.
+ */
+interface ContentTypeRecords {
+    readonly defaults: readonly DefaultRecord[];
+    readonly overrides: readonly OverrideRecord[];
+}
+/**
+ * Why content-type records could not be indexed.
+ *
+ * All fail CLOSED: conflicting Defaults on one extension, duplicate normalized Override names, or
+ * invalid MIME syntax are refused rather than resolved by picking one.
+ */
+type ContentTypeError = {
+    readonly code: 'invalid-mime';
+    readonly value: string;
+} | {
+    readonly code: 'conflicting-default';
+    readonly extension: string;
+} | {
+    readonly code: 'duplicate-override';
+    readonly partName: string;
+} | {
+    readonly code: 'invalid-override-name';
+    readonly partName: string;
+} | {
+    readonly code: 'too-many-records';
+    readonly limit: number;
+};
+/** Whether a string is syntactically a MIME type. Syntax only — no registry lookup. */
+declare function isValidMime(value: string): boolean;
+/** ASCII-case-insensitive extension key (leading dot removed; ASCII-only fold). */
+declare function extensionKey(extension: string): string;
+/** The resolved lookup: Override by case-folded part name, Default by case-insensitive extension. */
+interface ContentTypeIndex {
+    /** ext key -> single MIME (identical duplicates collapsed). */
+    readonly defaults: ReadonlyMap<string, string>;
+    /** case-folded part name -> MIME. */
+    readonly overrides: ReadonlyMap<string, string>;
+}
+/** The built index, or the conflict that made it impossible. */
+type IndexResult = {
+    readonly ok: true;
+    readonly index: ContentTypeIndex;
+} | {
+    readonly ok: false;
+    readonly error: ContentTypeError;
+};
+/**
+ * Build a resolved content-type index, failing closed on conflict/duplicate/MIME
+ * errors. `maxRecords` bounds the combined record count (N/N+1 gate).
+ */
+declare function buildContentTypeIndex(records: ContentTypeRecords, maxRecords?: number): IndexResult;
+/**
+ * A part's content type, or why it has none.
+ *
+ * An orphan record never determines a part's type — a Default with no matching part is preserved
+ * inertly rather than applied.
+ */
+type ResolveResult = {
+    readonly ok: true;
+    readonly contentType: string;
+    readonly source: 'override' | 'default';
+} | {
+    readonly ok: false;
+    readonly reason: 'unknown';
+};
+/** Resolve a part's content type: Override wins over Default; else unknown. */
+declare function resolveContentType(index: ContentTypeIndex, partName: string): ResolveResult;
+
+/** OOXML image relationship type for embedded or linked media parts. */
+declare const IMAGE_RELATIONSHIP_TYPE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image";
+/**
+ * Whether a relationship points inside the package or out of it.
+ *
+ * The security-relevant distinction: an `External` target is retained VERBATIM and never
+ * owner-resolved or fetched, because auto-loading a file-supplied remote target is a zero-click
+ * external fetch.
+ */
+type TargetMode = 'Internal' | 'External';
+/**
+ * One authored relationship, with nothing materialized away: owner part, id, type, raw target
+ * lexical form, mode, and position.
+ */
+interface RelationshipRecord {
+    readonly ownerPart: string;
+    readonly id: string;
+    readonly type: string;
+    readonly rawTarget: string;
+    readonly targetMode: TargetMode;
+    readonly order: number;
+}
+/** Why a relationship set is invalid. Duplicate ids within one owner fail closed. */
+type RelationshipError = {
+    readonly code: 'duplicate-id';
+    readonly ownerPart: string;
+    readonly id: string;
+};
+/** The validated relationship set, or the conflict that rejected it. */
+type RelationshipSetResult = {
+    readonly ok: true;
+    readonly byOwner: ReadonlyMap<string, readonly RelationshipRecord[]>;
+} | {
+    readonly ok: false;
+    readonly error: RelationshipError;
+};
+/** Group relationships by owner in authored order; reject duplicate ids per owner. */
+declare function buildRelationshipSet(records: readonly RelationshipRecord[]): RelationshipSetResult;
+/**
+ * A relationship resolved to a part, or the reason it could not be.
+ *
+ * External targets resolve to a refusal by design: they are never followed from a file.
+ */
+type ResolvedRelationship = {
+    readonly mode: 'Internal';
+    readonly target: NameResult;
+    readonly raw: string;
+} | {
+    readonly mode: 'External';
+    readonly sinkSafe: NameResult;
+    readonly raw: string;
+};
+/**
+ * Resolve a relationship to a runtime projection while the raw target stays
+ * authored. Internal -> owner-relative part name; External -> sink-safe
+ * validation only (never owner-resolved, never fetched). `raw` is always the
+ * verbatim authored target.
+ */
+declare function resolveRelationship(rec: RelationshipRecord): ResolvedRelationship;
+/**
+ * An image relationship resolved to package bytes, or why it was refused.
+ *
+ * External-mode image rels are refused rather than fetched — the no-zero-click-external-fetch
+ * rule applies to images exactly as it does to links.
+ */
+type ImageRelationshipResolution = {
+    readonly mode: 'internal';
+    readonly partName: string;
+    readonly raw: string;
+} | {
+    readonly mode: 'external';
+    readonly sinkSafe: boolean;
+    readonly raw: string;
+} | {
+    readonly mode: 'missing';
+};
+/**
+ * Resolve an image relationship id from an owner part. Internal targets resolve
+ * owner-relative; external targets are never fetched; a missing id is `missing`.
+ */
+declare function resolveImageRelationship(records: readonly RelationshipRecord[] | undefined, ownerPart: string, relationshipId: string): ImageRelationshipResolution;
+
+/**
+ * Why a zip was refused at the trust boundary.
+ *
+ * `too-large` and `too-many-entries` are the zip-bomb guards; `bad-name` catches path traversal —
+ * an entry with `..` or a leading `/` is rejected rather than normalized.
+ */
+type ZipRejection = 'too-many-entries' | 'too-large' | 'bad-name' | 'inflate-error';
+/** Archive caps: entry count, total decompressed bytes, and the decompression ratio. */
+interface ZipLimits {
+    readonly maxEntries: number;
+    /** Max total UNCOMPRESSED bytes across the archive. */
+    readonly maxTotalBytes: number;
+    /** Max per-entry uncompressed:compressed ratio (zip-bomb guard). */
+    readonly maxRatio?: number;
+}
+/** The archive caps in force when a host configures none. Conservative and finite. */
+declare const DEFAULT_ZIP_LIMITS: ZipLimits;
+/** The read entries, or the typed refusal. Never throws — the bytes are untrusted. */
+type ZipReadResult = {
+    readonly ok: true;
+    readonly entries: ReadonlyMap<string, Uint8Array>;
+} | {
+    readonly ok: false;
+    readonly reason: ZipRejection;
+    readonly detail?: string;
+    readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
+};
+/**
+ * Inflate a ZIP archive with bounds + OPC name normalization. Entry name, count,
+ * compression-ratio, and total-uncompressed-size limits are enforced BEFORE each
+ * entry is decompressed (via fflate's pre-inflation filter), so a zip bomb or a
+ * traversal name is rejected without ever being inflated. Keys are canonical part
  * names.
  */
 declare function readZip(bytes: Uint8Array, limits?: ZipLimits): ZipReadResult;
@@ -1515,212 +1689,81 @@ declare function projectDrawing(drawing: OoxmlDrawingNode, context: Readonly<{
     resolveRelationship?: RelationshipTargetResolver;
     resolveSchemeColor?: ShapeSchemeColorResolver;
     resolveStyleMatrixReference?: ShapeStyleMatrixResolver;
-}>): DrawingProjection | null;
-
-/** Caps applied while loading a package: zip, XML, part count and relationship count. */
-interface OoxmlPackageLimits {
-    readonly zip?: ZipLimits;
-    readonly xml?: XmlLimits;
-    /** Cap on parts converted into canonical trees (N/N+1 gate, not a soft target). */
-    readonly maxXmlParts?: number;
-    /** Cap on relationship records across every rels part. */
-    readonly maxRelationships?: number;
-}
-/** The limits in force when a host configures none. Conservative and finite. */
-declare const DEFAULT_OOXML_PACKAGE_LIMITS: Required<Pick<OoxmlPackageLimits, 'maxXmlParts' | 'maxRelationships'>>;
-/**
- * An external relationship target. Retained verbatim as authored evidence, with the
- * sink-safety verdict alongside it. Never resolved against the package, never fetched.
- */
-interface OoxmlExternalTarget {
-    readonly ownerPart: string;
-    readonly id: string;
-    readonly type: string;
-    readonly rawTarget: string;
-    /** False when the target is not a safe sink (javascript:, file:, ...). Still not fetched. */
-    readonly sinkSafe: boolean;
-}
-/**
- * A loaded package: every XML part as a canonical tree, plus the non-XML parts kept verbatim.
- *
- * The preservation model in one value. Modelled parts re-emit normalized; everything else is
- * byte-identical, which is why an unrecognized part never costs a document anything.
- */
-interface OoxmlPackage {
-    /** Canonical trees, keyed by canonical part name. Non-XML parts are absent by design. */
-    readonly parts: ReadonlyMap<string, OoxmlPart>;
-    /** Raw bytes of every entry, including the non-XML parts that have no tree. */
-    readonly partBytes: ReadonlyMap<string, Uint8Array>;
-    /** Internal relationships by owner part, in authored order. */
-    readonly relationships: ReadonlyMap<string, readonly RelationshipRecord[]>;
-    readonly externalTargets: readonly OoxmlExternalTarget[];
-    readonly contentTypes: ContentTypeIndex;
-    /** Canonical name of the part the root `officeDocument` relationship points at. */
-    readonly mainDocumentPart: string;
-}
-/** Why a package could not be loaded. Every code describes the FILE, not the caller. */
-type OoxmlPackageRejection = ZipRejection | OoxmlReadRejection | 'no-content-types' | 'bad-content-types' | 'no-main-document' | 'bad-relationship-target' | 'duplicate-relationship-id' | 'too-many-relationships' | 'too-many-xml-parts';
-/** A loaded package, or a typed refusal. Never throws. */
-type OoxmlPackageResult = {
-    readonly ok: true;
-    readonly package: OoxmlPackage;
-} | {
-    readonly ok: false;
-    readonly reason: OoxmlPackageRejection;
-    readonly detail?: string;
-    readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
-};
-declare function readOoxmlPackage(bytes: Uint8Array, limits?: OoxmlPackageLimits): OoxmlPackageResult;
-/**
- * Serialize a canonical package back to DOCX bytes.
- *
- * Starts from the ORIGINAL entry bytes and overwrites only the parts held as trees. A part
- * the loader did not model — media, fonts, an XML part outside the modeled set — passes
- * through untouched, so round-tripping a document cannot lose a part the engine never
- * claimed to understand.
- *
- * The modeled parts are re-emitted NORMALIZED from the tree rather than patched as text.
- * That is the whole point of the canonical tree: correctness is judged by the two D9
- * oracles (the namespace-aware fingerprint and the save/reopen semantic digest), not by
- * byte equality, so a different-but-equivalent spelling is not a defect.
- *
- * `writeZip` re-validates every part name, so a name that became unsafe between load and
- * save cannot be smuggled into the archive.
- */
-declare function writeOoxmlPackage(pkg: OoxmlPackage): Uint8Array;
-/** Replace one part's tree, returning a new package. Pure, like the tree edits themselves. */
-declare function withPart(pkg: OoxmlPackage, part: OoxmlPart): OoxmlPackage;
-
-type AutomationTableMutation = {
-    readonly kind: 'values';
-    readonly values: readonly (readonly string[])[];
-} | {
-    readonly kind: 'addRows' | 'addColumns';
-    readonly location: 'start' | 'end';
-    readonly count: number;
-    readonly values?: readonly (readonly string[])[];
-} | {
-    readonly kind: 'deleteRows' | 'deleteColumns';
-    readonly index: number;
-    readonly count: number;
-} | {
-    readonly kind: 'delete';
-} | {
-    readonly kind: 'properties';
-    readonly styleId?: string;
-    readonly headerRowCount?: number;
-} | {
-    readonly kind: 'cell';
-    readonly cellId: string;
-    readonly value?: string;
-    readonly columnWidth?: number;
-    readonly shadingColor?: string;
-    readonly verticalAlignment?: 'Top' | 'Center' | 'Bottom';
-};
-
-interface SetFieldCodeOp {
-    readonly op: 'setFieldCode';
-    readonly paragraphId: string;
-    readonly fieldNodeId: string;
-    readonly code: string;
-}
-
-type InsertTextOp = {
-    readonly op: 'insertText';
-    readonly paragraphId: string;
-    /** Legacy text form identity for protected filling; never an inline wrapper owner. */
-    readonly textFormFieldId?: string;
-    readonly offset: number;
-    readonly text: string;
-    /**
-     * Write this as a TRACKED insertion, attributed here.
-     *
-     * On the op rather than on the store, so suggesting stays a decision the surface makes
-     * per edit and the write vocabulary stays explicit — a global "everything is tracked
-     * now" flag is exactly what `DocEdits` refuses, because it makes the meaning of an op
-     * depend on state the op does not carry.
-     */
-    readonly revision?: RevisionAttributionInput;
-    /**
-     * When set, the text belongs INSIDE this content control, whatever sits at the offset.
-     *
-     * A boundary offset is owned by the run that starts there, which at a control's trailing
-     * edge is the run after the control — so an offset alone cannot say "append to this field",
-     * the way it cannot say which run of a field result to format (see `targetRunIds`). A
-     * caller that names the control gets the text in the control; one that does not gets the
-     * plain offset rule, which is what a keystroke beside a field means.
-     */
-    readonly inside?: string;
-    /**
-     * Which side of a run BOUNDARY the text joins. Default `'left'` — Word's typing rule:
-     * the next character takes the formatting of the character before the caret.
-     *
-     * `'right'` is for a caller that is not typing but placing text inside the run that
-     * STARTS at the offset — the hyperlink editor rewriting a link's display text, where
-     * landing left of the boundary would put the new text outside the link. Ignored when
-     * the offset falls strictly inside a run, which has no boundary to choose.
-     */
-    readonly bias?: 'left' | 'right';
-};
-type DeleteTextOp = {
-    readonly op: 'deleteText';
-    readonly paragraphId: string;
-    /** Legacy text form identity for protected filling; never an inline wrapper owner. */
-    readonly textFormFieldId?: string;
-    readonly start: number;
-    readonly end: number;
-    /** Write this as a TRACKED deletion — the characters stay, wrapped in `w:del`. */
-    readonly revision?: RevisionAttributionInput;
-};
+}>): DrawingProjection | null;
 
-/** Editable legacy text input types. Other authored types remain inert. */
-type TextFormFieldType = 'regular' | 'number' | 'date';
-/** Options stored in the legacy field definition. Zero means unlimited length. */
-interface TextFormFieldOptions {
-    readonly type: TextFormFieldType;
-    readonly maxLength: number;
-    readonly format: string;
-    readonly enabled: boolean;
+/** Caps applied while loading a package: zip, XML, part count and relationship count. */
+interface OoxmlPackageLimits {
+    readonly zip?: ZipLimits;
+    readonly xml?: XmlLimits;
+    /** Cap on parts converted into canonical trees (N/N+1 gate, not a soft target). */
+    readonly maxXmlParts?: number;
+    /** Cap on relationship records across every rels part. */
+    readonly maxRelationships?: number;
 }
-/** Supported format choices for legacy text input fields. @public */
-declare const TEXT_FORM_FORMATS: {
-    readonly regular: readonly ["", "Uppercase", "Lowercase", "First capital", "Title case"];
-    readonly number: readonly ["", "0", "0.00", "#,##0", "#,##0.00", "0%", "0.00%"];
-    readonly date: readonly ["", "M/d/yyyy", "MM/dd/yyyy", "d/M/yyyy", "dd/MM/yyyy", "yyyy-MM-dd", "d MMMM yyyy", "MMMM d, yyyy"];
-};
-
-/** A legacy text input in the shared paragraph offset space. */
-interface TextFormFieldRange {
-    readonly fieldNodeId: string;
-    readonly start: number;
-    readonly end: number;
-    readonly enabled: boolean;
-    readonly defaultText: string;
+/** The limits in force when a host configures none. Conservative and finite. */
+declare const DEFAULT_OOXML_PACKAGE_LIMITS: Required<Pick<OoxmlPackageLimits, 'maxXmlParts' | 'maxRelationships'>>;
+/**
+ * An external relationship target. Retained verbatim as authored evidence, with the
+ * sink-safety verdict alongside it. Never resolved against the package, never fetched.
+ */
+interface OoxmlExternalTarget {
+    readonly ownerPart: string;
+    readonly id: string;
     readonly type: string;
-    readonly maxLength: number;
-    readonly format: string;
-    readonly chromeIds: readonly string[];
-}
-/** Uses the field parser and offset index; never introduces another inline walk. */
-declare function textFormFieldsOf(paragraph: OoxmlParagraphNode): readonly TextFormFieldRange[];
-/** Options edit for an existing legacy text form. */
-interface SetTextFormFieldDefaultOp {
-    readonly op: 'setTextFormFieldDefault';
-    /** Regional conventions for new date input; defaults to en-US. */
-    readonly locale?: string;
-    readonly paragraphId: string;
-    readonly fieldNodeId: string;
-    readonly text: string;
-    readonly options?: TextFormFieldOptions;
+    readonly rawTarget: string;
+    /** False when the target is not a safe sink (javascript:, file:, ...). Still not fetched. */
+    readonly sinkSafe: boolean;
 }
-/** Validate and format the existing result when a user finishes filling a field. */
-interface CommitTextFormFieldOp {
-    readonly op: 'commitTextFormField';
-    /** Regional conventions for new date input; defaults to en-US. */
-    readonly locale?: string;
-    readonly paragraphId: string;
-    readonly fieldNodeId: string;
+/**
+ * A loaded package: every XML part as a canonical tree, plus the non-XML parts kept verbatim.
+ *
+ * The preservation model in one value. Modelled parts re-emit normalized; everything else is
+ * byte-identical, which is why an unrecognized part never costs a document anything.
+ */
+interface OoxmlPackage {
+    /** Canonical trees, keyed by canonical part name. Non-XML parts are absent by design. */
+    readonly parts: ReadonlyMap<string, OoxmlPart>;
+    /** Raw bytes of every entry, including the non-XML parts that have no tree. */
+    readonly partBytes: ReadonlyMap<string, Uint8Array>;
+    /** Internal relationships by owner part, in authored order. */
+    readonly relationships: ReadonlyMap<string, readonly RelationshipRecord[]>;
+    readonly externalTargets: readonly OoxmlExternalTarget[];
+    readonly contentTypes: ContentTypeIndex;
+    /** Canonical name of the part the root `officeDocument` relationship points at. */
+    readonly mainDocumentPart: string;
 }
+/** Why a package could not be loaded. Every code describes the FILE, not the caller. */
+type OoxmlPackageRejection = ZipRejection | OoxmlReadRejection | 'no-content-types' | 'bad-content-types' | 'no-main-document' | 'bad-relationship-target' | 'duplicate-relationship-id' | 'too-many-relationships' | 'too-many-xml-parts';
+/** A loaded package, or a typed refusal. Never throws. */
+type OoxmlPackageResult = {
+    readonly ok: true;
+    readonly package: OoxmlPackage;
+} | {
+    readonly ok: false;
+    readonly reason: OoxmlPackageRejection;
+    readonly detail?: string;
+    readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
+};
+declare function readOoxmlPackage(bytes: Uint8Array, limits?: OoxmlPackageLimits): OoxmlPackageResult;
+/**
+ * Serialize a canonical package back to DOCX bytes.
+ *
+ * Starts from the ORIGINAL entry bytes and overwrites only the parts held as trees. A part
+ * the loader did not model — media, fonts, an XML part outside the modeled set — passes
+ * through untouched, so round-tripping a document cannot lose a part the engine never
+ * claimed to understand.
+ *
+ * The modeled parts are re-emitted NORMALIZED from the tree rather than patched as text.
+ * That is the whole point of the canonical tree: correctness is judged by the two D9
+ * oracles (the namespace-aware fingerprint and the save/reopen semantic digest), not by
+ * byte equality, so a different-but-equivalent spelling is not a defect.
+ *
+ * `writeZip` re-validates every part name, so a name that became unsafe between load and
+ * save cannot be smuggled into the archive.
+ */
+declare function writeOoxmlPackage(pkg: OoxmlPackage): Uint8Array;
+/** Replace one part's tree, returning a new package. Pure, like the tree edits themselves. */
+declare function withPart(pkg: OoxmlPackage, part: OoxmlPart): OoxmlPackage;
 
 /** The `w15` namespace: `commentsExtended.xml` — thread parent and resolved state. */
 declare const W15_NAMESPACE_URI = "http://schemas.microsoft.com/office/word/2012/wordml";
@@ -1799,1146 +1842,1147 @@ declare function threadStateOfPart(part: OoxmlPart): Map<string, CommentThreadSt
  */
 declare function hasAnyComment(pkg: OoxmlPackage): boolean;
 
-/** A position in the model offset space of one story. */
-interface ReviewPosition {
-    readonly paragraphId: string;
-    readonly offset: number;
-}
-/** Where an item is anchored: a range in one story. */
-interface ReviewRange {
-    readonly partName: string;
-    readonly start: ReviewPosition;
-    readonly end: ReviewPosition;
-}
-/**
- * What kind of decision a revision card represents.
- *
- * Wider than the four content wrappers, because a reviewer has to be shown every pending
- * decision, including the ones that decorate no characters. A card the surface cannot show is
- * a change the reviewer never learns about — and `acceptAllRevisions` refuses if ANY revision
- * in the document is one the engine cannot resolve, so an invisible one makes Accept All fail
- * for a reason nothing on screen explains.
- */
-type ReviewRevisionKind = 'insert' | 'delete'
+/** How deep controls may nest before a walk stops descending. Shared by every lane. */
+declare const MAX_CONTENT_CONTROL_NESTING = 32;
+/** Cap on controls one walk reports, so a hostile file cannot make a read unbounded. */
+declare const MAX_CONTENT_CONTROLS_PER_PART = 10000;
+/** `CT_SdtPr/w:id` is `ST_DecimalNumber`; Word treats it as a signed 32-bit integer. */
+declare const CONTENT_CONTROL_ID_MAX = 2147483647;
+/** `ST_Lock` (§17.5.2.24). An absent `w:lock` is `unlocked`. */
 /**
- * A deletion and an insertion that are one edit: text typed over a selection.
+ * `w:lock` — what a control refuses.
  *
- * Word shows these as a single `Replaced "x" with "y"` card, and resolving one half
- * without the other is never what the reviewer meant — accepting the deletion alone
- * leaves the replacement text unproposed, rejecting it alone leaves both.
+ * `sdtLocked` protects the wrapper, `contentLocked` the text inside it, and `sdtContentLocked`
+ * both. A control inside a locked one is locked in effect regardless of its own value.
  */
- | 'replace' | 'moveFrom' | 'moveTo'
-/** `w:rPrChange` / `w:pPrChange` — the words are unchanged, their formatting is not. */
- | 'format'
-/** `w:pPr/w:rPr/w:ins|w:del` — a paragraph split or merge. */
- | 'paragraphMark'
-/** A row, cell, section or grid revision. Supported row revisions are resolvable. */
- | 'structural';
+type ContentControlLock = 'unlocked' | 'sdtLocked' | 'contentLocked' | 'sdtContentLocked';
 /**
- * One tracked change as a review card.
+ * What kind of control this is.
  *
- * Keyed per DECISION rather than per site: a revision spanning three ranges is one card, because
- * accepting it accepts all three.
+ * `checkbox` is the Microsoft `w14:checkbox` extension rather than an ECMA-376 type
+ * element, and the two are not mutually exclusive with "declares no type": four controls
+ * in the comprehensive fixture declare the extension and no `w:`-prefixed type, so a scan
+ * that read only the ECMA-376 choice reported them untyped. `untyped` means the control
+ * declares neither — a rich-text container, which is what Word treats it as.
  */
-interface ReviewRevisionItem {
-    readonly kind: 'revision';
-    /** Stable across renders and unique per DECISION, not per site. */
-    readonly id: string;
-    /** The payload `acceptRevision` / `rejectRevision` take. */
-    readonly address: RevisionAddress;
-    /**
-     * EVERY address this decision covers, `address` first.
-     *
-     * More than one only for a replacement, whose halves a foreign editor may have written
-     * as two independent revisions. Accept and reject walk all of them in one transaction:
-     * resolving one half and leaving the other is a state no reviewer asked for.
-     */
-    readonly addresses: readonly RevisionAddress[];
-    /** The words a replacement removes. Empty for every other kind. */
-    readonly replacedText: string;
-    readonly revisionKind: ReviewRevisionKind;
-    /** OOXML property-change element, used to resolve independently numbered formatting kinds. */
-    readonly formattingKind?: string;
-    /** Changed direct formatting values, ready for localized review summaries. */
-    readonly formattingChanges?: readonly {
-        readonly property: 'bold' | 'italic' | 'underline' | 'strike' | 'fontFamily' | 'fontSize' | 'color' | 'alignment' | 'leftIndent' | 'rightIndent' | 'firstLineIndent' | 'hangingIndent' | 'spaceBefore' | 'spaceAfter';
-        /** New direct value; null means inherit. Sizes and distances are in points. */
-        readonly value: string | null;
-    }[];
-    /** Newly applied proofing language codes in a tracked formatting change. */
-    readonly formattingLanguages?: readonly string[];
-    /**
-     * WHICH decision a `paragraphMark` records, absent for every other kind.
-     *
-     * `EG_ParaRPrTrackChanges` is `ins? del? moveFrom? moveTo?`, and the four say opposite
-     * things about one break. Without this a card called a deleted break an inserted one, which
-     * is the reverse of what Accept on that card does.
-     */
-    readonly markDirection?: 'insert' | 'delete' | 'moveFrom' | 'moveTo';
-    readonly author: string;
-    readonly date?: string;
-    /** Text the revision covers, for the card summary. Empty for changes with no characters. */
-    readonly text: string;
-    /** Every site this decision touches, in document order. */
-    readonly ranges: readonly ReviewRange[];
-    /**
-     * How deeply this change is NESTED inside other changes, 0 for an unenclosed one.
-     *
-     * `w:ins` wrapping `w:del` is content one reviewer added and another struck. Both stay
-     * pending, so both are cards, over one identical range — and a range then cannot say which
-     * change a caret is in. Word treats the innermost as the operative one, so it wins the caret
-     * and the change enclosing it stays listed and reachable.
-     */
-    readonly nesting: number;
-    /**
-     * How many leading `ranges` are the STRUCK half of a replacement.
-     *
-     * A replacement's card is one decision but its ranges are two colours — red over what is
-     * going, green over what takes its place. ABSENT when the halves do not split at a single
-     * point, which is what a file recording both under one revision id can produce; a surface
-     * then has no basis for two colours and should paint one neutral band rather than guess.
-     */
-    readonly replacedRangeCount?: number;
-    /**
-     * True when the engine cannot resolve this kind, so accept and reject must not be offered.
-     *
-     * Derived by the DERIVATION rather than from a caller-supplied predicate: the refusal list
-     * is internal, and a surface asked to compute it would have to guess. A card that offers a
-     * button the engine will refuse is worse than one that explains why it cannot.
-     */
-    readonly readOnly: boolean;
-    /** The other half of a move, or the other side of a delete/insert replacement. */
-    readonly pairedWith?: string;
-    /**
-     * Comments answering this change, in document order.
-     *
-     * A reply to a tracked change IS a comment: `w:ins` and `w:del` carry no body, so the text
-     * is written as a comment over the revision's own range and the range is what links them.
-     */
-    readonly replyIds: readonly string[];
+/** Which kind of control a `w:sdt` is, and therefore what a written value must look like. */
+type ContentControlKind = 'richText' | 'plainText' | 'checkbox' | 'dropDownList' | 'comboBox' | 'date' | 'picture' | 'docPartObj' | 'docPartList' | 'group' | 'citation' | 'bibliography' | 'equation' | 'untyped';
+/** One declared option of a dropdown or combo box: its display text and its stored value. */
+interface ContentControlListItem {
+    readonly displayText: string;
+    readonly value: string;
+}
+/** A date picker's authored format and locale, for rendering and for parsing what it stores. */
+interface ContentControlDateFormat {
+    readonly fullDate?: string;
+    readonly dateFormat?: string;
+    readonly lid?: string;
+    readonly storeMappedDataAs?: string;
+    readonly calendar?: string;
 }
-/**
- * One comment as a review card. A reply carries `parentId`; OOXML gives replies no separate
- * element, so threads are reconstructed from that link.
- */
-interface ReviewCommentItem {
-    readonly kind: 'comment';
-    readonly id: string;
-    readonly comment: CommentRecord;
-    readonly range: ReviewRange | null;
-    readonly resolved: boolean;
-    /** The comment this replies to, absent for a top-level comment. */
-    readonly parentId?: string;
-    /** The REVISION this comment answers, when it covers exactly that change's characters. */
-    readonly parentRevisionId?: string;
-    /** Replies to this comment, in document order. Empty for a reply or a childless comment. */
-    readonly replyIds: readonly string[];
-    /** True when the file gave this comment no usable range. */
-    readonly orphaned: boolean;
+/** One of a checkbox's two glyphs: the font and code point it is drawn with. */
+interface ContentControlCheckboxState {
+    /** The `w14:val` hex code point of the glyph, exactly as the control declares it. */
+    readonly value: string;
+    readonly font?: string;
 }
 /**
- * A card contributed by a recognized custom node (`defineCustomNode` with a `reviewCard`
- * hook), anchored at the node's range.
+ * A checkbox's state and the two glyphs it chooses between.
  *
- * Informational, never resolvable: there is nothing to accept or reject, so the engine
- * refuses those verbs on it. `title` and `detail` are HOST-authored (the definition's hook
- * produced them), but `attrs` and `text` originate in a file an attacker controls — a
- * surface renders every one of these as text, never markup.
+ * Both glyphs matter on a write: setting the value has to update `w14:checked` AND the run's
+ * character, or the document's glyph and its recorded state disagree.
  */
-interface ReviewCustomItem {
-    readonly kind: 'custom';
-    /** The SDT node's stable id in the canonical tree. */
-    readonly id: string;
-    /** The definition's `name`. */
-    readonly name: string;
-    /** The raw `w:tag` the node was recognized from. Untrusted input. */
-    readonly tag: string;
-    /** Attrs decoded from the tag, after the definition's recognition hook. Untrusted input. */
-    readonly attrs: Readonly<Record<string, string>>;
-    /** The SDT's literal content text. Untrusted input. */
-    readonly text: string;
-    /**
-     * The payload the node's control binds to, after the definition validated it.
-     *
-     * Undefined when the node carries none or the payload did not match — see the pro package's
-     * `RecognizedCustomNode.data`, which this is carried from.
-     */
-    readonly data?: unknown;
-    /**
-     * Whether this node asked for a sidebar card.
-     *
-     * False for a definition with no `reviewCard`: the item exists so the chip's own surfaces can
-     * read `attrs`, `text` and `data` off it, and the rail leaves it out. A surface listing cards
-     * filters on this rather than on an empty `title`.
-     */
-    readonly carded: boolean;
-    /** Card title, from the definition's `reviewCard` hook. Empty when `carded` is false. */
-    readonly title: string;
-    /** Card body, from the definition's `reviewCard` hook. */
-    readonly detail?: string;
-    /**
-     * Glyph for this node in the collapsed rail, as an SVG path in a `0 -960 960 960` viewBox.
-     *
-     * A PATH rather than a rendered node because this item crosses core, which is DOM-free and
-     * React-free — the same reason `title` and `detail` are strings. A host that wants arbitrary
-     * markup overrides the `Markers` part's `icon` instead, which lives in the adapter where JSX
-     * belongs. Absent falls back to the generic custom-node glyph.
-     *
-     * HOST-AUTHORED, never file data: it is interpolated into an SVG `d` attribute, and a path
-     * taken from a document would be attacker-controlled markup.
-     */
-    readonly icon?: string;
-    readonly range: ReviewRange | null;
+interface ContentControlCheckbox {
+    readonly checked: boolean;
+    readonly checkedState?: ContentControlCheckboxState;
+    readonly uncheckedState?: ContentControlCheckboxState;
+}
+/** `CT_DataBinding` — preserved metadata. Never resolved, never fetched. */
+/** `w:dataBinding` — the custom-XML part and XPath a control's value is bound to. */
+interface ContentControlDataBinding {
+    readonly xpath?: string;
+    readonly storeItemID?: string;
+    readonly prefixMappings?: string;
 }
 /**
- * One pending decision in the review queue: a tracked change, a comment thread, or a pro
- * custom-node card. Discriminate on `kind`.
+ * A control's whole `w:sdtPr`, projected into one typed shape.
  *
- * The store's own derivation (`collectReviewItems`) only ever produces the first two; the
- * `kind: 'custom'` card is contributed by the pro review module, which recognizes the node.
+ * What every other lane reads instead of walking `localName` strings — which also means a Word
+ * re-save that demotes the properties node to generic does not break the projection.
  */
-type ReviewItem = ReviewRevisionItem | ReviewCommentItem | ReviewCustomItem;
-/** What the review queue derivation reads: one story part plus its comment parts. */
-interface ReviewModelInput {
-    /** The story the ranges live in — the main document, a header, a note. */
-    readonly storyPart: OoxmlPart;
-    /**
-     * Header/footer story parts, in section order. Their revisions and comment anchors join
-     * the queue: a tracked change in a header is a pending decision like any other, and a
-     * queue that only walked the body silently hid it from the rail AND from Accept All.
-     */
-    readonly furnitureParts?: readonly OoxmlPart[] | undefined;
-    /** `word/comments.xml`, absent when the package has none. */
-    readonly commentsPart?: OoxmlPart | undefined;
-    /** `word/commentsExtended.xml`, absent when the package has none. */
-    readonly commentsExtendedPart?: OoxmlPart | undefined;
-    /**
-     * Custom node definitions from the module registry, forwarded OPAQUELY.
-     *
-     * Core carries them the way the registry does — as unknowns — so the definition shape
-     * stays a capability-package concern. The pro derivation narrows them and contributes
-     * `kind: 'custom'` cards for definitions that opted in.
-     */
-    readonly customNodes?: readonly unknown[] | undefined;
-    /**
-     * Where a capability package reports a node it could not read. Supplied per editor, so a page
-     * with two of them keeps their diagnostics apart.
-     */
-    readonly reportCustomNodeDiagnostic?: ((diagnostic: unknown) => void) | undefined;
-    /**
-     * The payload each of the story's controls binds to, keyed by the control's node id.
-     *
-     * Resolved by the ENGINE and handed over, because a payload lives in a customXml data part
-     * and a derivation that only receives story parts has no way to reach one. Untrusted file
-     * input on both members; a capability package validates it against whatever shape it
-     * declared before handing it to a host.
-     */
-    readonly customNodePayloads?: ReadonlyMap<string, {
-        readonly nodeId: string;
-        readonly label: string;
-        readonly data: string;
-    }> | undefined;
+interface ContentControlProperties {
+    readonly type: ContentControlKind;
+    readonly alias?: string;
+    readonly tag?: string;
+    /** `@w:val` of `w:id` when the file declares a parseable one. Never fabricated. */
+    readonly id?: number;
+    readonly lock: ContentControlLock;
+    /** The glossary entry named by `w:placeholder/w:docPart`. Preserved, never loaded. */
+    readonly placeholderDocPart?: string;
+    readonly temporary: boolean;
+    readonly showingPlaceholder: boolean;
+    readonly dataBinding?: ContentControlDataBinding;
+    readonly label?: string;
+    readonly tabIndex?: number;
+    /** Items a dropdown or combo box offers. Empty for every other type. */
+    readonly listItems: readonly ContentControlListItem[];
+    readonly lastValue?: string;
+    readonly date?: ContentControlDateFormat;
+    readonly multiLine?: boolean;
+    readonly checkbox?: ContentControlCheckbox;
 }
-/** The stable key a surface uses for the active item and for a React list. */
-declare function reviewItemKey(item: ReviewItem): string;
-/** Every range a decision touches. One card can cover several, in different paragraphs. */
-declare function reviewItemRanges(item: ReviewItem): readonly ReviewRange[];
-/** The first range of an item, in authored order, or null when it has none. */
-declare function firstReviewRange(item: ReviewItem): ReviewRange | null;
+/** Whether a node is a `w:sdt` wrapper. */
+declare function isContentControlNode(node: OoxmlNode): node is OoxmlContentControlNode;
+/** Whether a node is a `w:sdtContent` — the container holding a control's actual content. */
+declare function isContentControlContentNode(node: OoxmlNode): node is OoxmlContentControlContentNode;
 /**
- * A single comparable number for document order.
+ * A `w:sdt` wrapper, TYPED or DEMOTED.
  *
- * Paragraph index dominates offset, so a revision spanning paragraphs still sorts by where it
- * STARTS. An item with no resolvable range sorts last rather than to position zero, which is
- * where an orphan used to land — tearing an orphaned reply out of its own thread.
+ * Flattening predates typing and must not stop at a control the reader refused to type: a
+ * demoted wrapper still renders its content in place in Word, so a walk that only saw the
+ * typed kind would drop every paragraph inside a malformed control out of the story.
  */
-declare function reviewItemPositionRank(item: ReviewItem, order: ReadonlyMap<string, number>): number;
+declare function isContentControlWrapper(node: OoxmlNode): boolean;
 /**
- * Every item covering a position, innermost first.
+ * The children of a wrapper's `w:sdtContent`, typed or demoted, in order.
  *
- * Returning the whole stack rather than one winner is what lets a surface offer cycling, a
- * stacked card, or a "1 of 3" affordance. A comment wrapping a revision used to be unreachable
- * because only the tightest range was ever returned.
+ * The one place that knows a control's content is reached through an intermediate element,
+ * so the four flattening walks (story blocks, layout, header/footer references, list
+ * resolution) ask the same question rather than each re-deriving it.
  */
-declare function reviewItemsAt(items: readonly ReviewItem[], position: ReviewPosition, order: ReadonlyMap<string, number>): ReviewItem[];
+declare function contentControlContentChildren(wrapper: OoxmlNode): readonly OoxmlNode[];
 /**
- * The item the caret is in, or null.
+ * A container's children with every content-control wrapper flattened away, bounded in depth.
  *
- * A resolved comment never activates: a settled thread must not reopen itself as the reviewer
- * types near it.
+ * ONE unwrap rule, for the places where a control sits between a container and the children that
+ * container is defined in terms of. `CT_SdtRow` puts it between `w:tbl` and `w:tr`, `CT_SdtCell`
+ * between `w:tr` and `w:tc`, and a walk that filtered on the child's kind dropped the row or cell
+ * entirely: not measured, not painted, not addressable. Flattening at the point of the filter
+ * means a controlled row is the same row to the grid pass, the pagination pass and the story walk.
  *
- * A REPLY resolves to the thread it belongs to. A reply is anchored over its parent's range,
- * so both cover the caret — and the reply, being newer, wins the innermost test. It is not a
- * card of its own (it renders inside its parent's), so the thread would have gone active with
- * nothing on screen showing it: the reply box vanished from a comment the moment somebody
- * replied to it.
+ * Returns the SAME array identity when there is nothing to unwrap, so the tables that carry no
+ * controls — nearly all of them — allocate nothing and the incremental layout cache still sees
+ * its own inputs.
  */
-declare function activeReviewItem(items: readonly ReviewItem[], position: ReviewPosition, order: ReadonlyMap<string, number>): ReviewItem | null;
+declare function flattenContentControls(children: readonly OoxmlNode[], maxDepth?: number): readonly OoxmlNode[];
+/** A control's `w:sdtPr`, or null. Matches structurally, so a Word-demoted node still resolves. */
+declare function contentControlPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlPropertiesNode | undefined;
+/** A control's `w:sdtEndPr` — the run properties applied to its closing marker. */
+declare function contentControlEndPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlEndPropertiesNode | undefined;
+/** A control's `w:sdtContent`, or null when the wrapper has none. */
+declare function contentControlContentNodeOf(control: OoxmlNode): OoxmlContentControlContentNode | undefined;
+/** A signed 32-bit `ST_DecimalNumber`, or undefined when the file wrote something else. */
+declare function parseContentControlId(raw: string | undefined): number | undefined;
 /**
- * Walk a reply up to the card that heads its thread. Guarded against a cyclic file.
- *
- * The head is not always a comment. A reply to a tracked change renders inside the REVISION's
- * card, so resolving it to itself opened an item nothing on screen was drawing — the reply box
- * vanished the moment somebody answered a change.
+ * Read a control's properties.
  *
- * EXPORTED because the paginated surface answers "which card is open" itself, against its own
- * dismissed-key state, rather than through {@link activeReviewItem}. Two copies of the
- * innermost-wins rule was survivable while a reply could only be a comment — the parent came
- * first in `comments.xml` order and won the tie by accident. It stopped being survivable the
- * moment a reply could answer a revision, which outranks it outright.
+ * Total: a control with no `w:sdtPr` at all answers the same shape with the defaults an
+ * absent property means, so no caller has to branch on the container's existence.
  */
-declare function reviewThreadRootOf(items: readonly ReviewItem[], comment: ReviewCommentItem): ReviewItem;
-
-/** A canonical review decision. Keys are valid only in the open document. @public */
-interface RevisionBatchEntry {
-    readonly key: string;
-    readonly author: string;
-    readonly partName: string;
-    readonly revisionKind: ReviewRevisionItem['revisionKind'];
-}
-/** Why a requested decision remains pending. @public */
-type RevisionBatchSkipReason = 'unsupported-revision' | 'incomplete-group' | 'unknown-revision';
-/** Outcome of one selected-set decision. Counts refer to review decisions, not XML markers. @public */
-interface RevisionBatchResult {
-    readonly resolved: readonly RevisionBatchEntry[];
-    readonly skipped: readonly {
-        readonly key: string;
-        readonly reason: RevisionBatchSkipReason;
-        readonly revision?: RevisionBatchEntry;
-    }[];
-    /** All pending decisions in the addressed scope, including excluded and unsupported changes. */
-    readonly remaining: number;
-}
-/** @internal Pure preflight; callers commit its operations through their normal write guards. */
-declare function planRevisionBatch(part: OoxmlPart, action: 'accept' | 'reject', keys?: readonly string[], scopeRoot?: OoxmlNode): {
-    ops: readonly TreeDocOp[];
-    result: RevisionBatchResult;
-};
-
+declare function contentControlPropertiesOf(control: OoxmlNode): ContentControlProperties;
+/** Where a control sits, read off what its content holds. */
+type ContentControlLevel = 'block' | 'inline' | 'row' | 'cell' | 'empty';
 /**
- * Shared types for the `@docx-editor.dev/core` contract. Type-only, zero runtime.
+ * How deeply a control is nested inside other controls.
  *
- * `@docx-editor.dev/core/contracts/types` re-exports this module verbatim, through
- * `types-barrel.ts`. There is no `@docx-editor.dev/core/types` subpath.
+ * Bounded by {@link MAX_CONTENT_CONTROL_NESTING}: nesting depth comes from a file and is a
+ * recursion bound.
  */
-/** Which paragraph-level reads the selection disagrees about. @public */
-interface ParagraphDisagreements {
-    readonly alignment: boolean;
-    readonly spaceBeforePt: boolean;
-    readonly spaceAfterPt: boolean;
-    readonly lineSpacing: boolean;
-    readonly tabStops: boolean;
+declare function contentControlLevelOf(control: OoxmlNode): ContentControlLevel;
+/** One control, plus how deeply it is nested and the controls that enclose it. */
+interface ContentControlEntry {
+    readonly node: OoxmlContentControlNode;
+    /** 0 for a top-level control; the nesting depth otherwise. */
+    readonly depth: number;
+    /** Enclosing controls, outermost first. Empty at depth 0. */
+    readonly ancestors: readonly OoxmlContentControlNode[];
 }
 /**
- * The five paragraph flags a Paragraph dialog shows as checkboxes.
- *
- * `contextualSpacing` is Word's "Don't add space between paragraphs of the same style";
- * the rest are its Pagination block. `null` means the selection disagrees.
+ * Every control under a node, in document order, bounded in depth and in count.
  *
- * @public
+ * ONE walk, shared. The nesting bound is the same one layout flattens with, so a control
+ * a lane can address is a control every lane can address — and a file that nests past it
+ * keeps its content in the tree (the serializer never stops) while no walk recurses
+ * further.
  */
-interface ParagraphFlags {
-    readonly contextualSpacing: boolean | null;
-    readonly keepNext: boolean | null;
-    readonly keepLines: boolean | null;
-    readonly widowControl: boolean | null;
-    readonly pageBreakBefore: boolean | null;
-}
+declare function contentControlsIn(root: OoxmlNode, options?: {
+    readonly maxDepth?: number;
+    readonly limit?: number;
+}): readonly ContentControlEntry[];
+/** Find one control by canonical node id, with the same bounded walk. */
+declare function findContentControl(root: OoxmlNode, nodeId: string): ContentControlEntry | null;
 /**
- * Every field of the Paragraph dialog, as `setParagraphFormat` takes it.
- *
- * An omitted field is left as authored. `null` REMOVES a setting so the style supplies it
- * again — not the same as a zero, which blocks the cascade.
+ * The plain text a control's content holds, in reading order.
  *
- * @public
+ * `w:delText` is excluded: struck text is not the control's value, and a dropdown whose
+ * old item is still present as a tracked deletion would otherwise report both.
  */
-interface ParagraphFormatCommand {
-    alignment?: 'left' | 'center' | 'right' | 'justify';
-    spaceBeforePt?: number | null;
-    spaceAfterPt?: number | null;
-    lineSpacing?: {
-        rule: 'multiple' | 'exact' | 'atLeast';
-        value: number;
-    } | null;
-    indentLeftTwips?: number | null;
-    indentRightTwips?: number | null;
-    /** ONE signed first-line offset: negative is a hanging indent. */
-    indentFirstLineTwips?: number | null;
-    contextualSpacing?: boolean;
-    keepNext?: boolean;
-    keepLines?: boolean;
-    widowControl?: boolean;
-    pageBreakBefore?: boolean;
-    /**
-     * Replace the paragraph's custom tab stops. An empty list CLEARS them, which is what
-     * "Clear All" does; omit the field to leave them as authored.
-     */
-    tabStops?: readonly ParagraphTabStop[];
-}
-/** One custom tab stop, as a command states it. @public */
-interface ParagraphTabStop {
-    readonly positionTwips: number;
-    readonly alignment: 'left' | 'center' | 'right' | 'decimal' | 'bar';
-    readonly leader?: 'none' | 'dot' | 'hyphen' | 'underscore' | 'heavy' | 'middleDot';
-}
-/** Ownership token for one retained selection highlight. @public */
-type SelectionPin = symbol;
+declare function contentControlTextOf(control: OoxmlNode): string;
 /**
- * The LLM- and JSON-facing address for a piece of a document.
+ * Resolve the lock a position inherits from the controls enclosing it.
  *
- * `paraId` is the 8-hex `w14:paraId`, matched case-insensitively. `search` is a
- * phrase that must match EXACTLY ONCE inside that paragraph; ambiguous or
- * missing matches fail with `'ambiguous'` / `'notFound'` rather than falling
- * back to first-match.
+ * CONSERVATIVE, because a template that says a field cannot be edited and sits inside a
+ * section that says it cannot be removed means both. Each half of `ST_Lock` is taken
+ * independently and the strongest wins, so an unlocked control inside a `contentLocked`
+ * one is still content-locked — a nested control cannot grant a permission its parent
+ * withheld, which is the only reading under which a lock is a lock.
+ */
+declare function resolveContentControlLock(chain: readonly ContentControlLock[]): ContentControlLock;
+/** Whether a resolved lock forbids editing the content it covers. */
+declare function lockForbidsEdit(lock: ContentControlLock): boolean;
+/** Whether a resolved lock forbids removing the control itself. */
+declare function lockForbidsRemoval(lock: ContentControlLock): boolean;
+/**
+ * `CT_SdtPr`'s declared child order (§17.5.2.38), followed by the type choice.
  *
- * Offset-based addressing was tried and abandoned: an agent cannot compute a
- * character offset it has not seen, and offsets do not survive concurrent
- * edits. Do not reintroduce `{ blockId, offset }`.
+ * Serialization re-emits children in tree order, so the ONLY way a write keeps the
+ * sequence valid is to place the child it authors at its schema position — which is what
+ * {@link orderedContentControlProperties} does.
  */
-interface DocAnchor {
-    paraId: string;
-    search?: string;
-    /** Opt-in disambiguation. Omit to require uniqueness. */
-    occurrence?: number;
-}
-/** Structural addressing for content the paraId map cannot reach. */
-interface DocLocation {
-    container: ContainerRef;
-    /** Block indices, descending into tables and content controls. */
-    path: number[];
-    offset?: number;
-}
+declare const CONTENT_CONTROL_PROPERTY_ORDER: readonly string[];
 /**
- * Which STORY a location belongs to.
+ * Rebuild a `w:sdtPr`'s children in schema order.
  *
- * The body is one container; every header, footer and note is another. A path alone is
- * ambiguous without it, because block index 0 exists in every story a document has.
+ * Modelled children sort to their declared position and the type element follows them,
+ * as the sequence requires. Everything else — a `w15:repeatingSection`, a vendor
+ * extension, the `w14:checkbox` that is not part of the ECMA-376 choice — keeps the order
+ * it was authored in and follows the modelled block, so a write that touches one property
+ * neither drops nor reorders anything it does not name.
  */
-type ContainerRef = {
-    part: 'body';
-} | {
-    part: 'header' | 'footer';
-    rId: string;
-} | {
-    part: 'footnote' | 'endnote';
-    noteId: number;
-};
+declare function orderedContentControlProperties(children: readonly OoxmlNode[]): readonly OoxmlNode[];
 /**
- * Anything an operation can be pointed at: a paragraph-relative {@link DocAnchor}, a structural
- * {@link DocLocation}, or a {@link DocRange} spanning two of them.
+ * The next `w:id` to write.
+ *
+ * Solo: one past the document's own maximum. Never a clock, a timestamp, a random source
+ * or a hash: those collide with ids already in the file and produce values Word rejects.
+ * Null when the document already reaches the signed 32-bit bound, so the caller refuses
+ * rather than wrapping into a negative id. Hostile or out-of-range existing values are
+ * ignored for seeding rather than counted past.
+ *
+ * When a collaboration actor is bound (explicit argument or the open store transaction),
+ * the next id is the next unused value in that actor's stripe. Two peers inserting a
+ * generic content control — including a custom node authored as `w:sdt` — from the same
+ * snapshot then cannot share a `w:id`.
  */
-type DocTarget = DocAnchor | DocLocation | DocRange;
-/** A span between two positions. The endpoints may be addressed either way, independently. */
-interface DocRange {
-    from: DocAnchor | DocLocation;
-    to: DocAnchor | DocLocation;
+declare function allocateContentControlId(root: OoxmlNode, actorId?: string): number | null;
+
+/** A position in the model offset space of one story. */
+interface ReviewPosition {
+    readonly paragraphId: string;
+    readonly offset: number;
+}
+/** Where an item is anchored: a range in one story. */
+interface ReviewRange {
+    readonly partName: string;
+    readonly start: ReviewPosition;
+    readonly end: ReviewPosition;
 }
 /**
- * Every write returns this rather than `boolean`.
+ * What kind of decision a revision card represents.
  *
- * A bare boolean cannot distinguish "no-op" from "target not found" from
- * "content control is locked", and the editor layer already throws eight
- * distinct ContentControl error classes that a boolean would flatten.
+ * Wider than the four content wrappers, because a reviewer has to be shown every pending
+ * decision, including the ones that decorate no characters. A card the surface cannot show is
+ * a change the reviewer never learns about — and `acceptAllRevisions` refuses if ANY revision
+ * in the document is one the engine cannot resolve, so an invisible one makes Accept All fail
+ * for a reason nothing on screen explains.
  */
-type ExecResult = {
-    ok: true;
-    changed: boolean;
-    revisions?: RevisionBatchResult;
-} | {
-    ok: false;
-    code: ExecErrorCode;
-    reason: string;
-    target?: DocTarget;
-    revisions?: RevisionBatchResult;
-};
+type ReviewRevisionKind = 'insert' | 'delete'
 /**
- * Why a write was refused, as a value to branch on.
+ * A deletion and an insertion that are one edit: text typed over a selection.
  *
- * Deliberately finer-grained than a boolean: "no-op", "target not found" and "content control is
- * locked" are different outcomes, and a caller retrying the first should not retry the third.
+ * Word shows these as a single `Replaced "x" with "y"` card, and resolving one half
+ * without the other is never what the reviewer meant — accepting the deletion alone
+ * leaves the replacement text unproposed, rejecting it alone leaves both.
  */
-type ExecErrorCode = 'notFound' | 'ambiguous' | 'locked' | 'bound' | 'typeMismatch' | 'kindMismatch' | 'outOfBounds' | 'unsupported' | 'invalidArgs';
+ | 'replace' | 'moveFrom' | 'moveTo'
+/** `w:rPrChange` / `w:pPrChange` — the words are unchanged, their formatting is not. */
+ | 'format'
+/** `w:pPr/w:rPr/w:ins|w:del` — a paragraph split or merge. */
+ | 'paragraphMark'
+/** A row, cell, section or grid revision. Supported row revisions are resolvable. */
+ | 'structural';
 /**
- * A parsed .docx.
+ * One tracked change as a review card.
  *
- * NOT JSON-round-trippable: it holds `Map`s and `Date`s, plus an internal
- * side-table of verbatim XML used for lossless round-tripping. Use `toJSON` /
- * `fromJSON` before sending it over JSON-RPC or handing it to a model.
+ * Keyed per DECISION rather than per site: a revision spanning three ranges is one card, because
+ * accepting it accepts all three.
  */
-interface DocxDocument {
-    readonly body: DocumentBody;
-    readonly styles: StyleDefinitions;
-    readonly theme?: Theme;
-    readonly comments: readonly DocComment[];
-    readonly revisions: readonly Revision[];
-}
-/** The main story: its blocks in reading order, plus the sections derived from them. */
-interface DocumentBody {
-    readonly content: readonly Block[];
+interface ReviewRevisionItem {
+    readonly kind: 'revision';
+    /** Stable across renders and unique per DECISION, not per site. */
+    readonly id: string;
+    /** The payload `acceptRevision` / `rejectRevision` take. */
+    readonly address: RevisionAddress;
+    /**
+     * EVERY address this decision covers, `address` first.
+     *
+     * More than one only for a replacement, whose halves a foreign editor may have written
+     * as two independent revisions. Accept and reject walk all of them in one transaction:
+     * resolving one half and leaving the other is a state no reviewer asked for.
+     */
+    readonly addresses: readonly RevisionAddress[];
+    /** The words a replacement removes. Empty for every other kind. */
+    readonly replacedText: string;
+    readonly revisionKind: ReviewRevisionKind;
+    /** OOXML property-change element, used to resolve independently numbered formatting kinds. */
+    readonly formattingKind?: string;
+    /** Changed direct formatting values, ready for localized review summaries. */
+    readonly formattingChanges?: readonly {
+        readonly property: 'bold' | 'italic' | 'underline' | 'strike' | 'fontFamily' | 'fontSize' | 'color' | 'alignment' | 'leftIndent' | 'rightIndent' | 'firstLineIndent' | 'hangingIndent' | 'spaceBefore' | 'spaceAfter';
+        /** New direct value; null means inherit. Sizes and distances are in points. */
+        readonly value: string | null;
+    }[];
+    /** Newly applied proofing language codes in a tracked formatting change. */
+    readonly formattingLanguages?: readonly string[];
+    /**
+     * WHICH decision a `paragraphMark` records, absent for every other kind.
+     *
+     * `EG_ParaRPrTrackChanges` is `ins? del? moveFrom? moveTo?`, and the four say opposite
+     * things about one break. Without this a card called a deleted break an inserted one, which
+     * is the reverse of what Accept on that card does.
+     */
+    readonly markDirection?: 'insert' | 'delete' | 'moveFrom' | 'moveTo';
+    readonly author: string;
+    readonly date?: string;
+    /** Text the revision covers, for the card summary. Empty for changes with no characters. */
+    readonly text: string;
+    /** Every site this decision touches, in document order. */
+    readonly ranges: readonly ReviewRange[];
     /**
-     * Derived, not stored: recomputed on read from section-break markers and
-     * section inheritance. Never treat it as a spreadable field.
+     * How deeply this change is NESTED inside other changes, 0 for an unenclosed one.
+     *
+     * `w:ins` wrapping `w:del` is content one reviewer added and another struck. Both stay
+     * pending, so both are cards, over one identical range — and a range then cannot say which
+     * change a caret is in. Word treats the innermost as the operative one, so it wins the caret
+     * and the change enclosing it stays listed and reachable.
      */
-    readonly sections: readonly Section[];
-}
-/** The JSON-safe projection of a document. */
-interface DocxDocumentJSON {
-    readonly [key: string]: unknown;
-}
-/** One section: the page it lays out on, and the header/footer stories it declares. */
-interface Section {
-    readonly properties: SectionProperties;
-    readonly headers: HeaderFooterSet;
-    readonly footers: HeaderFooterSet;
+    readonly nesting: number;
+    /**
+     * How many leading `ranges` are the STRUCK half of a replacement.
+     *
+     * A replacement's card is one decision but its ranges are two colours — red over what is
+     * going, green over what takes its place. ABSENT when the halves do not split at a single
+     * point, which is what a file recording both under one revision id can produce; a surface
+     * then has no basis for two colours and should paint one neutral band rather than guess.
+     */
+    readonly replacedRangeCount?: number;
+    /**
+     * True when the engine cannot resolve this kind, so accept and reject must not be offered.
+     *
+     * Derived by the DERIVATION rather than from a caller-supplied predicate: the refusal list
+     * is internal, and a surface asked to compute it would have to guess. A card that offers a
+     * button the engine will refuse is worse than one that explains why it cannot.
+     */
+    readonly readOnly: boolean;
+    /** The other half of a move, or the other side of a delete/insert replacement. */
+    readonly pairedWith?: string;
+    /**
+     * Comments answering this change, in document order.
+     *
+     * A reply to a tracked change IS a comment: `w:ins` and `w:del` carry no body, so the text
+     * is written as a comment over the revision's own range and the range is what links them.
+     */
+    readonly replyIds: readonly string[];
 }
 /**
- * A section's three header (or footer) variants, each a relationship id.
- *
- * All optional: a variant a section does not declare inherits the previous section's, and one
- * absent everywhere means the document simply has none.
+ * One comment as a review card. A reply carries `parentId`; OOXML gives replies no separate
+ * element, so threads are reconstructed from that link.
  */
-interface HeaderFooterSet {
-    readonly default?: string;
-    readonly first?: string;
-    readonly even?: string;
-}
-/** Anything that can sit at block level in a story. Discriminate on `kind`. */
-type Block = Paragraph | Table | ContentControl;
-/** One paragraph: its runs, the style it names, and its list membership. */
-interface Paragraph {
-    readonly kind: 'paragraph';
-    /** `w14:paraId`. The stable handle `DocAnchor` addresses. */
-    readonly paraId?: string;
-    readonly runs: readonly Run[];
-    readonly styleId?: string;
-    readonly numbering?: NumberingRef;
-}
-/** A stretch of text sharing one set of character properties. */
-interface Run {
-    readonly text: string;
-    readonly formatting?: RunFormatting;
-    /** Set when the run carries a tracked change. Unique only within its part. */
-    readonly revisionId?: number;
+interface ReviewCommentItem {
+    readonly kind: 'comment';
+    readonly id: string;
+    readonly comment: CommentRecord;
+    readonly range: ReviewRange | null;
+    readonly resolved: boolean;
+    /** The comment this replies to, absent for a top-level comment. */
+    readonly parentId?: string;
+    /** The REVISION this comment answers, when it covers exactly that change's characters. */
+    readonly parentRevisionId?: string;
+    /** Replies to this comment, in document order. Empty for a reply or a childless comment. */
+    readonly replyIds: readonly string[];
+    /** True when the file gave this comment no usable range. */
+    readonly orphaned: boolean;
 }
 /**
- * Character formatting, and — at selection level — the paragraph properties a toolbar reads
- * alongside it.
+ * A card contributed by a recognized custom node (`defineCustomNode` with a `reviewCard`
+ * hook), anchored at the node's range.
  *
- * One type serves both roles so a toolbar reads alignment, style and script state from the same
- * object as bold and italic. On a {@link Run} the selection-level fields stay absent: a run has
- * no alignment or paragraph style of its own.
+ * Informational, never resolvable: there is nothing to accept or reject, so the engine
+ * refuses those verbs on it. `title` and `detail` are HOST-authored (the definition's hook
+ * produced them), but `attrs` and `text` originate in a file an attacker controls — a
+ * surface renders every one of these as text, never markup.
  */
-interface RunFormatting {
-    readonly bold?: boolean;
-    readonly italic?: boolean;
-    readonly underline?: boolean;
-    readonly strike?: boolean;
-    readonly color?: ColorValue;
-    readonly highlight?: string;
-    readonly fontFamily?: string;
-    readonly fontSizePt?: number;
-    readonly superscript?: boolean;
-    readonly subscript?: boolean;
-    /** Paragraph alignment at the selection. `both` is OOXML's spelling of justify. */
-    readonly alignment?: 'left' | 'center' | 'right' | 'both';
-    /** Paragraph style id (`w:pStyle`) at the selection. */
-    readonly styleId?: string;
+interface ReviewCustomItem {
+    readonly kind: 'custom';
+    /** The SDT node's stable id in the canonical tree. */
+    readonly id: string;
+    /** The definition's `name`. */
+    readonly name: string;
+    /** The raw `w:tag` the node was recognized from. Untrusted input. */
+    readonly tag: string;
+    /** Attrs decoded from the tag, after the definition's recognition hook. Untrusted input. */
+    readonly attrs: Readonly<Record<string, string>>;
+    /** The SDT's literal content text. Untrusted input. */
+    readonly text: string;
     /**
-     * Line spacing at the selection, in the unit its rule implies — LINES for `multiple`,
-     * points for `exact` and `atLeast`. The same vocabulary `setLineSpacing` takes, so a
-     * control can show what it reads and send back what it shows. Absent when the
-     * selection's paragraphs disagree or state no line spacing.
+     * The payload the node's control binds to, after the definition validated it.
+     *
+     * Undefined when the node carries none or the payload did not match — see the pro package's
+     * `RecognizedCustomNode.data`, which this is carried from.
      */
-    readonly lineSpacing?: {
-        readonly rule: 'multiple' | 'exact' | 'atLeast';
-        readonly value: number;
-    };
+    readonly data?: unknown;
     /**
-     * Space above and below the paragraph at the selection, in points.
+     * Whether this node asked for a sidebar card.
      *
-     * The measurement the cascade STATES — `w:docDefaults`, the style chain and direct
-     * formatting resolved together — not the gap the page finally draws. The two differ for a
-     * paragraph carrying `w:beforeAutospacing`, where Word substitutes its own value and
-     * ignores the measurement, and again where two paragraphs collapse their adjacent spacing.
-     * Absent when the selection's paragraphs disagree or no level states it.
+     * False for a definition with no `reviewCard`: the item exists so the chip's own surfaces can
+     * read `attrs`, `text` and `data` off it, and the rail leaves it out. A surface listing cards
+     * filters on this rather than on an empty `title`.
      */
-    readonly spaceBeforePt?: number;
-    readonly spaceAfterPt?: number;
+    readonly carded: boolean;
+    /** Card title, from the definition's `reviewCard` hook. Empty when `carded` is false. */
+    readonly title: string;
+    /** Card body, from the definition's `reviewCard` hook. */
+    readonly detail?: string;
     /**
-     * The paragraph flags the Paragraph dialog shows as checkboxes.
+     * Glyph for this node in the collapsed rail, as an SVG path in a `0 -960 960 960` viewBox.
      *
-     * Each is `true`, `false`, or `null` when the selection's paragraphs disagree — a
-     * checkbox needs all three. Read through the cascade, so a flag a STYLE sets reads as on,
-     * which is what the box has to show over a paragraph the page is visibly keeping with the
-     * next. Absent on a `Run`, like every other selection-level field here.
+     * A PATH rather than a rendered node because this item crosses core, which is DOM-free and
+     * React-free — the same reason `title` and `detail` are strings. A host that wants arbitrary
+     * markup overrides the `Markers` part's `icon` instead, which lives in the adapter where JSX
+     * belongs. Absent falls back to the generic custom-node glyph.
+     *
+     * HOST-AUTHORED, never file data: it is interpolated into an SVG `d` attribute, and a path
+     * taken from a document would be attacker-controlled markup.
      */
-    readonly paragraphFlags?: ParagraphFlags;
+    readonly icon?: string;
+    readonly range: ReviewRange | null;
+}
+/**
+ * One pending decision in the review queue: a tracked change, a comment thread, or a pro
+ * custom-node card. Discriminate on `kind`.
+ *
+ * The store's own derivation (`collectReviewItems`) only ever produces the first two; the
+ * `kind: 'custom'` card is contributed by the pro review module, which recognizes the node.
+ */
+type ReviewItem = ReviewRevisionItem | ReviewCommentItem | ReviewCustomItem;
+/** What the review queue derivation reads: one story part plus its comment parts. */
+interface ReviewModelInput {
+    /** The story the ranges live in — the main document, a header, a note. */
+    readonly storyPart: OoxmlPart;
     /**
-     * Which paragraph-level fields above are absent because the selection DISAGREES, as
-     * opposed to because nothing states them.
+     * Header/footer story parts, in section order. Their revisions and comment anchors join
+     * the queue: a tracked change in a header is a pending decision like any other, and a
+     * queue that only walked the body silently hid it from the rail AND from Accept All.
+     */
+    readonly furnitureParts?: readonly OoxmlPart[] | undefined;
+    /** `word/comments.xml`, absent when the package has none. */
+    readonly commentsPart?: OoxmlPart | undefined;
+    /** `word/commentsExtended.xml`, absent when the package has none. */
+    readonly commentsExtendedPart?: OoxmlPart | undefined;
+    /**
+     * Custom node definitions from the module registry, forwarded OPAQUELY.
      *
-     * A `null`/absent value alone cannot tell those apart, and both readings have shipped as
-     * bugs: a disagreement rendered as a concrete value is uncorrectable, because the value
-     * that would fix it is the one already on screen; an absent value rendered as "mixed"
-     * tells a single paragraph it disagrees with itself.
+     * Core carries them the way the registry does — as unknowns — so the definition shape
+     * stays a capability-package concern. The pro derivation narrows them and contributes
+     * `kind: 'custom'` cards for definitions that opted in.
      */
-    readonly disagrees?: ParagraphDisagreements;
+    readonly customNodes?: readonly unknown[] | undefined;
     /**
-     * The paragraph's custom tab stops at the selection, cascade included. Absent when the
-     * selection disagrees or the paragraphs have none.
+     * Where a capability package reports a node it could not read. Supplied per editor, so a page
+     * with two of them keeps their diagnostics apart.
      */
-    readonly tabStops?: readonly ParagraphTabStop[];
+    readonly reportCustomNodeDiagnostic?: ((diagnostic: unknown) => void) | undefined;
     /**
-     * The EFFECTIVE paragraph indent at the selection — cascade and numbering merge
-     * included, so a numbered item that authors no `w:ind` reports the indent its list
-     * definition gives it. Absent when nothing is loaded, or when the selection is inside a
-     * table (see {@link IndentFormatting}).
+     * The payload each of the story's controls binds to, keyed by the control's node id.
+     *
+     * Resolved by the ENGINE and handed over, because a payload lives in a customXml data part
+     * and a derivation that only receives story parts has no way to reach one. Untrusted file
+     * input on both members; a capability package validates it against whatever shape it
+     * declared before handing it to a host.
      */
-    readonly indent?: IndentFormatting;
+    readonly customNodePayloads?: ReadonlyMap<string, {
+        readonly nodeId: string;
+        readonly label: string;
+        readonly data: string;
+    }> | undefined;
 }
+/** The stable key a surface uses for the active item and for a React list. */
+declare function reviewItemKey(item: ReviewItem): string;
+/** Every range a decision touches. One card can cover several, in different paragraphs. */
+declare function reviewItemRanges(item: ReviewItem): readonly ReviewRange[];
+/** The first range of an item, in authored order, or null when it has none. */
+declare function firstReviewRange(item: ReviewItem): ReviewRange | null;
+/**
+ * A single comparable number for document order.
+ *
+ * Paragraph index dominates offset, so a revision spanning paragraphs still sorts by where it
+ * STARTS. An item with no resolvable range sorts last rather than to position zero, which is
+ * where an orphan used to land — tearing an orphaned reply out of its own thread.
+ */
+declare function reviewItemPositionRank(item: ReviewItem, order: ReadonlyMap<string, number>): number;
+/**
+ * Every item covering a position, innermost first.
+ *
+ * Returning the whole stack rather than one winner is what lets a surface offer cycling, a
+ * stacked card, or a "1 of 3" affordance. A comment wrapping a revision used to be unreachable
+ * because only the tightest range was ever returned.
+ */
+declare function reviewItemsAt(items: readonly ReviewItem[], position: ReviewPosition, order: ReadonlyMap<string, number>): ReviewItem[];
 /**
- * Indent at the selection, in twips.
+ * The item the caret is in, or null.
  *
- * Unlike every other field here, this does NOT go absent when the selection's paragraphs
- * disagree. A ruler has to draw its handles somewhere, and Word draws them at the FIRST
- * selected paragraph's values — Select All is the commonest indent gesture, and hiding the
- * handles for it would be worse than showing one paragraph's truth. The values are
- * therefore always the first touched paragraph's, and {@link mixed} records per field
- * whether the rest agree.
+ * A resolved comment never activates: a settled thread must not reopen itself as the reviewer
+ * types near it.
  *
- * `firstLine` is ONE SIGNED offset: negative is a hanging indent. OOXML spells it as two
- * mutually exclusive attributes and this collapses them hanging-wins (§17.3.1.12), which
- * is the model Word itself keeps.
+ * A REPLY resolves to the thread it belongs to. A reply is anchored over its parent's range,
+ * so both cover the caret — and the reply, being newer, wins the innermost test. It is not a
+ * card of its own (it renders inside its parent's), so the thread would have gone active with
+ * nothing on screen showing it: the reply box vanished from a comment the moment somebody
+ * replied to it.
+ */
+declare function activeReviewItem(items: readonly ReviewItem[], position: ReviewPosition, order: ReadonlyMap<string, number>): ReviewItem | null;
+/**
+ * Walk a reply up to the card that heads its thread. Guarded against a cyclic file.
  *
- * Absent inside a table. The value would be correct there, but it is measured from the
- * cell's content edge while a ruler is drawn against the page's margin, and the ruler does
- * not know the cell.
+ * The head is not always a comment. A reply to a tracked change renders inside the REVISION's
+ * card, so resolving it to itself opened an item nothing on screen was drawing — the reply box
+ * vanished the moment somebody answered a change.
+ *
+ * EXPORTED because the paginated surface answers "which card is open" itself, against its own
+ * dismissed-key state, rather than through {@link activeReviewItem}. Two copies of the
+ * innermost-wins rule was survivable while a reply could only be a comment — the parent came
+ * first in `comments.xml` order and won the tie by accident. It stopped being survivable the
+ * moment a reply could answer a revision, which outranks it outright.
  */
-interface IndentFormatting {
-    /** Left indent, signed. Negative pulls text into the margin, as Word allows. */
-    readonly left: number;
-    /** Right indent, signed. */
-    readonly right: number;
-    /** First-line offset from {@link left}, signed. Negative is a hanging indent. */
-    readonly firstLine: number;
-    /** Per field, whether the selection's paragraphs disagree about it. */
-    readonly mixed: {
-        readonly left: boolean;
-        readonly right: boolean;
-        readonly firstLine: boolean;
-    };
+declare function reviewThreadRootOf(items: readonly ReviewItem[], comment: ReviewCommentItem): ReviewItem;
+
+/** The value a control accepts, by what kind of control it is. */
+type ContentControlValueInput = {
+    readonly kind: 'text';
+    readonly text: string;
+} | {
+    readonly kind: 'listItem';
+    readonly value: string;
+} | {
+    readonly kind: 'checkbox';
+    readonly checked: boolean;
 }
-/** A table: its rows, and the table style they resolve through. */
-interface Table {
-    readonly kind: 'table';
-    readonly rows: readonly TableRow[];
-    readonly styleId?: string;
+/** A calendar date, `YYYY-MM-DD` or a full ISO-8601 instant. */
+ | {
+    readonly kind: 'date';
+    readonly iso: string;
+};
+/** The control types an insertion may author. Picture and repeating section are deferred. */
+declare const INSERTABLE_CONTENT_CONTROL_TYPES: readonly ["richText", "plainText", "dropDownList", "comboBox", "date"];
+/**
+ * The OOXML spellings the store writes.
+ *
+ * NOT the contract's `InsertableContentControlType`, which is the same set of kinds in the
+ * READ vocabulary (`dropdown`) plus this lane's spelling of it (`dropDownList`). The editor
+ * maps between the two; the names differ so a reader can tell which vocabulary a value is in.
+ */
+type InsertableContentControlKind = (typeof INSERTABLE_CONTENT_CONTROL_TYPES)[number];
+
+/** A canonical review decision. Keys are valid only in the open document. @public */
+interface RevisionBatchEntry {
+    readonly key: string;
+    readonly author: string;
+    readonly partName: string;
+    readonly revisionKind: ReviewRevisionItem['revisionKind'];
 }
-/** One table row. Cell count may vary between rows: `colSpan` and vertical merges reshape it. */
-interface TableRow {
-    readonly cells: readonly TableCell[];
+/** Why a requested decision remains pending. @public */
+type RevisionBatchSkipReason = 'unsupported-revision' | 'incomplete-group' | 'unknown-revision';
+/** Outcome of one selected-set decision. Counts refer to review decisions, not XML markers. @public */
+interface RevisionBatchResult {
+    readonly resolved: readonly RevisionBatchEntry[];
+    readonly skipped: readonly {
+        readonly key: string;
+        readonly reason: RevisionBatchSkipReason;
+        readonly revision?: RevisionBatchEntry;
+    }[];
+    /** All pending decisions in the addressed scope, including excluded and unsupported changes. */
+    readonly remaining: number;
 }
+/** @internal Pure preflight; callers commit its operations through their normal write guards. */
+declare function planRevisionBatch(part: OoxmlPart, action: 'accept' | 'reject', keys?: readonly string[], scopeRoot?: OoxmlNode): {
+    ops: readonly TreeDocOp[];
+    result: RevisionBatchResult;
+};
+
+/** Allowlisted OOXML table border line styles — store/layout authority. */
+declare const TABLE_BORDER_STYLES: readonly ["single", "dashed", "dotted", "double", "triple", "thick"];
 /**
- * One cell. Its `content` is ordinary blocks, so a cell may hold paragraphs, nested tables and
- * content controls alike.
+ * One of the border line styles this engine draws.
+ *
+ * An ALLOWLIST, not the full `ST_Border` enumeration: a file may name any of the seventy-odd
+ * OOXML border styles, and anything outside this set falls back rather than being passed through
+ * to paint.
  */
-interface TableCell {
-    readonly content: readonly Block[];
-    /** Vertical merge span. Absent means 1. */
-    readonly rowSpan?: number;
-    /** `w:gridSpan`. Absent means 1. */
-    readonly colSpan?: number;
+type TableBorderStyle = (typeof TABLE_BORDER_STYLES)[number];
+
+/**
+ * Shared types for the `@docx-editor.dev/core` contract. Type-only, zero runtime.
+ *
+ * `@docx-editor.dev/core/contracts/types` re-exports this module verbatim, through
+ * `types-barrel.ts`. There is no `@docx-editor.dev/core/types` subpath.
+ */
+/** Which paragraph-level reads the selection disagrees about. @public */
+interface ParagraphDisagreements {
+    readonly alignment: boolean;
+    readonly spaceBeforePt: boolean;
+    readonly spaceAfterPt: boolean;
+    readonly lineSpacing: boolean;
+    readonly tabStops: boolean;
 }
-/** Structured document tag (`w:sdt`). */
-interface ContentControl {
-    readonly kind: 'contentControl';
-    readonly id: string;
-    readonly tag?: string;
-    readonly alias?: string;
-    readonly controlType: ContentControlType;
-    readonly locked?: boolean;
-    readonly content: readonly Block[];
+/**
+ * The five paragraph flags a Paragraph dialog shows as checkboxes.
+ *
+ * `contextualSpacing` is Word's "Don't add space between paragraphs of the same style";
+ * the rest are its Pagination block. `null` means the selection disagrees.
+ *
+ * @public
+ */
+interface ParagraphFlags {
+    readonly contextualSpacing: boolean | null;
+    readonly keepNext: boolean | null;
+    readonly keepLines: boolean | null;
+    readonly widowControl: boolean | null;
+    readonly pageBreakBefore: boolean | null;
 }
-/** Which kind of control a `w:sdt` is, and therefore what a value written into it must be. */
-type ContentControlType = 'richText' | 'plainText' | 'checkbox' | 'dropdown' | 'comboBox' | 'date' | 'picture' | 'repeatingSection';
 /**
- * The control kinds an insertion can author.
+ * Every field of the Paragraph dialog, as `setParagraphFormat` takes it.
  *
- * A NARROWING of {@link ContentControlType}, not a separate vocabulary: a kind read off an
- * existing control can be handed straight back to `insertContentControl`. Three kinds are
- * absent because an insertion would have to invent what they carry — a checkbox needs its two
- * declared glyph states, a picture needs an image part, and a repeating section is a container
- * whose items have their own verbs. Reading still answers the wider type; a document may hold
- * kinds this cannot create.
+ * An omitted field is left as authored. `null` REMOVES a setting so the style supplies it
+ * again — not the same as a zero, which blocks the cascade.
  *
- * `dropDownList` is the same kind as `dropdown`, spelt as OOXML spells it. Both are accepted,
- * so a type read off a control can be handed back without translating it — and the OOXML
- * spelling is the one the automation protocol takes, so a caller who uses both surfaces can
- * write that one everywhere.
+ * @public
  */
-type InsertableContentControlType = Extract<ContentControlType, 'richText' | 'plainText' | 'dropdown' | 'comboBox' | 'date'> | 'dropDownList';
+interface ParagraphFormatCommand {
+    alignment?: 'left' | 'center' | 'right' | 'justify';
+    spaceBeforePt?: number | null;
+    spaceAfterPt?: number | null;
+    lineSpacing?: {
+        rule: 'multiple' | 'exact' | 'atLeast';
+        value: number;
+    } | null;
+    indentLeftTwips?: number | null;
+    indentRightTwips?: number | null;
+    /** ONE signed first-line offset: negative is a hanging indent. */
+    indentFirstLineTwips?: number | null;
+    contextualSpacing?: boolean;
+    keepNext?: boolean;
+    keepLines?: boolean;
+    widowControl?: boolean;
+    pageBreakBefore?: boolean;
+    /**
+     * Replace the paragraph's custom tab stops. An empty list CLEARS them, which is what
+     * "Clear All" does; omit the field to leave them as authored.
+     */
+    tabStops?: readonly ParagraphTabStop[];
+}
+/** One custom tab stop, as a command states it. @public */
+interface ParagraphTabStop {
+    readonly positionTwips: number;
+    readonly alignment: 'left' | 'center' | 'right' | 'decimal' | 'bar';
+    readonly leader?: 'none' | 'dot' | 'hyphen' | 'underscore' | 'heavy' | 'middleDot';
+}
+/** Ownership token for one retained selection highlight. @public */
+type SelectionPin = symbol;
 /**
- * Narrows a content-control query. Fields combine with AND; an empty filter matches every
- * control.
+ * The LLM- and JSON-facing address for a piece of a document.
+ *
+ * `paraId` is the 8-hex `w14:paraId`, matched case-insensitively. `search` is a
+ * phrase that must match EXACTLY ONCE inside that paragraph; ambiguous or
+ * missing matches fail with `'ambiguous'` / `'notFound'` rather than falling
+ * back to first-match.
+ *
+ * Offset-based addressing was tried and abandoned: an agent cannot compute a
+ * character offset it has not seen, and offsets do not survive concurrent
+ * edits. Do not reintroduce `{ blockId, offset }`.
  */
-interface ContentControlFilter {
-    readonly tag?: string;
-    readonly alias?: string;
-    readonly controlType?: ContentControlType;
+interface DocAnchor {
+    paraId: string;
+    search?: string;
+    /** Opt-in disambiguation. Omit to require uniqueness. */
+    occurrence?: number;
+}
+/** Structural addressing for content the paraId map cannot reach. */
+interface DocLocation {
+    container: ContainerRef;
+    /** Block indices, descending into tables and content controls. */
+    path: number[];
+    offset?: number;
 }
 /**
- * A position in one story: a paragraph and a UTF-16 offset inside it.
+ * Which STORY a location belongs to.
  *
- * The same offset space the ops and the caret use, so an anchor read here can be handed
- * straight back to a selection without re-deriving anything.
+ * The body is one container; every header, footer and note is another. A path alone is
+ * ambiguous without it, because block index 0 exists in every story a document has.
+ */
+type ContainerRef = {
+    part: 'body';
+} | {
+    part: 'header' | 'footer';
+    rId: string;
+} | {
+    part: 'footnote' | 'endnote';
+    noteId: number;
+};
+/**
+ * Anything an operation can be pointed at: a paragraph-relative {@link DocAnchor}, a structural
+ * {@link DocLocation}, or a {@link DocRange} spanning two of them.
  */
-interface DocAnchorRange {
-    /** Canonical part name of the story the range lives in, e.g. `/word/document.xml`. */
-    readonly part: string;
-    readonly startParagraphId: string;
-    readonly startOffset: number;
-    /** May sit in a later paragraph: the range markers are independent elements. */
-    readonly endParagraphId: string;
-    readonly endOffset: number;
+type DocTarget = DocAnchor | DocLocation | DocRange;
+/** A span between two positions. The endpoints may be addressed either way, independently. */
+interface DocRange {
+    from: DocAnchor | DocLocation;
+    to: DocAnchor | DocLocation;
 }
 /**
- * One comment or reply, as `comments.xml` records it.
+ * Every write returns this rather than `boolean`.
  *
- * A reply is a comment with a `parentId`; OOXML gives replies no separate element, so the thread
- * is reconstructed from that link rather than from nesting.
+ * A bare boolean cannot distinguish "no-op" from "target not found" from
+ * "content control is locked", and the editor layer already throws eight
+ * distinct ContentControl error classes that a boolean would flatten.
  */
-interface DocComment {
-    readonly id: string;
-    readonly author: string;
-    /**
-     * OPTIONAL, because `CT_Comment` makes `@w:date` optional and files omit it. A comment
-     * with no date is a comment, not a defect, and fabricating one is a content change.
-     */
-    readonly date?: string;
-    readonly text: string;
-    readonly parentId?: string;
-    readonly resolved?: boolean;
-    /**
-     * Where the comment is anchored, absent when the file gave it no usable range.
-     *
-     * A comment lives in `comments.xml` and is placed by markers in a STORY, so the story is
-     * part of the address: a comment anchored in a header belongs to a part the body never saw.
-     */
-    readonly anchor?: DocAnchorRange;
-    /**
-     * True when the file gave this comment no usable range — a reference with no markers, or a
-     * start with no end. Reported rather than dropped: a reviewer's remark vanishing silently
-     * is worse than one that says it lost its text.
-     */
-    readonly orphaned?: boolean;
-}
+type ExecResult = {
+    ok: true;
+    changed: boolean;
+    revisions?: RevisionBatchResult;
+    history?: HistoryGroupOutcome;
+} | {
+    ok: false;
+    code: ExecErrorCode;
+    reason: string;
+    target?: DocTarget;
+    revisions?: RevisionBatchResult;
+};
 /**
- * What kind of decision a revision represents.
+ * Why a write was refused, as a value to branch on.
  *
- * Wider than insert/delete/format, and it has to be. `w:moveFrom`/`w:moveTo` are not a
- * deletion and an insertion — resolving one half alone duplicates or loses the content;
- * `w:pPr/w:rPr/w:ins|w:del` decorates no characters at all and merges paragraphs when
- * resolved; a row or cell revision is structural. A reviewer shown only three kinds is a
- * reviewer who never learns about the rest.
+ * Deliberately finer-grained than a boolean: "no-op", "target not found" and "content control is
+ * locked" are different outcomes, and a caller retrying the first should not retry the third.
  */
-type RevisionType = 'insert' | 'delete'
-/** A deletion and an insertion that are one edit: text typed over a selection. */
- | 'replace' | 'moveFrom' | 'moveTo'
-/** `w:rPrChange` / `w:pPrChange` — the words are unchanged, their formatting is not. */
- | 'format'
-/** `w:pPr/w:rPr/w:ins|w:del` — a paragraph split or merge. */
- | 'paragraphMark'
-/** A row, cell, section or grid revision. */
- | 'structural';
+type ExecErrorCode = 'notFound' | 'ambiguous' | 'locked' | 'bound' | 'typeMismatch' | 'kindMismatch' | 'outOfBounds' | 'unsupported' | 'invalidArgs';
 /**
- * One tracked change.
+ * A parsed .docx.
  *
- * Addressing needs BOTH `id` and `part`: `@w:id` is unique only within a part, so an id alone
- * names two revisions in any package that has a header or a comments part.
+ * NOT JSON-round-trippable: it holds `Map`s and `Date`s, plus an internal
+ * side-table of verbatim XML used for lossless round-tripping. Use `toJSON` /
+ * `fromJSON` before sending it over JSON-RPC or handing it to a model.
  */
-interface Revision {
-    /** Numeric, and unique only WITHIN a part. Pair with `part` to address one. */
-    readonly id: number;
-    readonly type: RevisionType;
-    readonly author: string;
-    /**
-     * OPTIONAL. `CT_TrackChange` requires `@w:id` and `@w:author` and makes `@w:date`
-     * optional, and producers that omit it are ordinary. Requiring it here forced either a
-     * fabricated date — a content change — or dropping the revision from the list.
-     */
-    readonly date?: string;
+interface DocxDocument {
+    readonly body: DocumentBody;
+    readonly styles: StyleDefinitions;
+    readonly theme?: Theme;
+    readonly comments: readonly DocComment[];
+    readonly revisions: readonly Revision[];
+}
+/** The main story: its blocks in reading order, plus the sections derived from them. */
+interface DocumentBody {
+    readonly content: readonly Block[];
     /**
-     * REQUIRED, and a canonical PART NAME rather than a three-value enum.
-     *
-     * `@w:id` is unique only within a part, so an address without one names two revisions in a
-     * package that has both. The enum could not express the parts revisions actually occur in:
-     * `header3.xml`, `footer1.xml`, `comments.xml`, and `styles.xml`, which carries
-     * `w:pPrChange` inside style definitions with ids that collide with `document.xml`.
+     * Derived, not stored: recomputed on read from section-break markers and
+     * section inheritance. Never treat it as a spreadable field.
      */
-    readonly part: string;
+    readonly sections: readonly Section[];
 }
-/** `w:sectPr`: the page a section lays out on. Twips throughout, as the file stores them. */
-interface SectionProperties {
-    readonly pageSize: {
-        widthTwips: number;
-        heightTwips: number;
-    };
-    readonly margins: PageMargins;
-    readonly columns?: {
-        count: number;
-        gapTwips: number;
-    };
-    /** `w:titlePg` — whether the section's first page takes the `first` header/footer variant. */
-    readonly titlePage?: boolean;
+/** The JSON-safe projection of a document. */
+interface DocxDocumentJSON {
+    readonly [key: string]: unknown;
 }
-/** Page margins in twips. */
-interface PageMargins {
-    readonly topTwips: number;
-    readonly rightTwips: number;
-    readonly bottomTwips: number;
-    readonly leftTwips: number;
+/** One section: the page it lays out on, and the header/footer stories it declares. */
+interface Section {
+    readonly properties: SectionProperties;
+    readonly headers: HeaderFooterSet;
+    readonly footers: HeaderFooterSet;
 }
 /**
- * `styles.xml`, split by the three style families that address separately.
+ * A section's three header (or footer) variants, each a relationship id.
  *
- * Keyed by style ID rather than by the name a reader sees, because the ID is what a paragraph or
- * run actually references.
+ * All optional: a variant a section does not declare inherits the previous section's, and one
+ * absent everywhere means the document simply has none.
  */
-interface StyleDefinitions {
-    readonly paragraph: ReadonlyMap<string, StyleDefinition>;
-    readonly character: ReadonlyMap<string, StyleDefinition>;
-    readonly table: ReadonlyMap<string, StyleDefinition>;
+interface HeaderFooterSet {
+    readonly default?: string;
+    readonly first?: string;
+    readonly even?: string;
 }
-/** One style: the ID content references, the name a reader sees, and its inheritance link. */
-interface StyleDefinition {
-    readonly id: string;
-    readonly name: string;
-    /** `w:basedOn` — the style this one inherits from. Absent at the root of a chain. */
-    readonly basedOn?: string;
+/** Anything that can sit at block level in a story. Discriminate on `kind`. */
+type Block = Paragraph | Table | ContentControl;
+/** One paragraph: its runs, the style it names, and its list membership. */
+interface Paragraph {
+    readonly kind: 'paragraph';
+    /** `w14:paraId`. The stable handle `DocAnchor` addresses. */
+    readonly paraId?: string;
+    readonly runs: readonly Run[];
+    readonly styleId?: string;
+    readonly numbering?: NumberingRef;
 }
-/** A paragraph's list membership: which `numbering.xml` definition, and at which level. */
-interface NumberingRef {
-    readonly numId: string;
-    /** Zero-based. OOXML numbering has nine levels, 0 through 8. */
-    readonly level: number;
+/** A stretch of text sharing one set of character properties. */
+interface Run {
+    readonly text: string;
+    readonly formatting?: RunFormatting;
+    /** Set when the run carries a tracked change. Unique only within its part. */
+    readonly revisionId?: number;
 }
 /**
- * A colour as the FILE expresses it, not as a resolved RGB string.
+ * Character formatting, and — at selection level — the paragraph properties a toolbar reads
+ * alongside it.
  *
- * A theme colour stays a theme reference — slot plus tint or shade — so that changing the theme
- * repaints the document the way Word does. Flattening to hex at read time would freeze the
- * resolved value and break that link. `auto` is Word's "let the renderer decide", usually black
- * on white.
+ * One type serves both roles so a toolbar reads alignment, style and script state from the same
+ * object as bold and italic. On a {@link Run} the selection-level fields stay absent: a run has
+ * no alignment or paragraph style of its own.
  */
-type ColorValue = {
-    readonly kind: 'hex';
-    readonly value: string;
-} | {
-    readonly kind: 'theme';
-    readonly slot: string;
-    readonly tint?: number;
-    readonly shade?: number;
-} | {
-    readonly kind: 'auto';
-};
-/** `theme1.xml` — what a {@link ColorValue} of kind `theme` resolves against. */
-interface Theme {
-    readonly colorScheme: ThemeColorScheme;
-    readonly fontScheme?: Record<string, string>;
-}
-/** Theme colour slots (`accent1`, `dk1`, `lt2`, …) to hex. */
-type ThemeColorScheme = Readonly<Record<string, string>>;
-/** A watermark, which OOXML expresses as either text or an image — never both meaningfully. */
-interface Watermark {
-    readonly text?: string;
-    readonly imageData?: Uint8Array;
-}
-/** A size in EMUs, the unit DrawingML stores extents in. 914400 EMU = 1 inch. */
-interface Extent {
-    readonly widthEmu: number;
-    readonly heightEmu: number;
-}
-/** A font the document names, and whether its bytes travel inside the package. */
-interface FontDefinition {
-    readonly family: string;
-    readonly embedded: boolean;
-}
-/** An axis-aligned rectangle in points, the unit layout works in throughout. */
-interface Rect {
-    readonly x: number;
-    readonly y: number;
-    readonly width: number;
-    readonly height: number;
-}
-/** A position in points. */
-interface Point {
-    readonly x: number;
-    readonly y: number;
+interface RunFormatting {
+    readonly bold?: boolean;
+    readonly italic?: boolean;
+    readonly underline?: boolean;
+    readonly strike?: boolean;
+    readonly color?: ColorValue;
+    readonly highlight?: string;
+    readonly fontFamily?: string;
+    readonly fontSizePt?: number;
+    readonly superscript?: boolean;
+    readonly subscript?: boolean;
+    /** Paragraph alignment at the selection. `both` is OOXML's spelling of justify. */
+    readonly alignment?: 'left' | 'center' | 'right' | 'both';
+    /** Paragraph style id (`w:pStyle`) at the selection. */
+    readonly styleId?: string;
+    /**
+     * Line spacing at the selection, in the unit its rule implies — LINES for `multiple`,
+     * points for `exact` and `atLeast`. The same vocabulary `setLineSpacing` takes, so a
+     * control can show what it reads and send back what it shows. Absent when the
+     * selection's paragraphs disagree or state no line spacing.
+     */
+    readonly lineSpacing?: {
+        readonly rule: 'multiple' | 'exact' | 'atLeast';
+        readonly value: number;
+    };
+    /**
+     * Space above and below the paragraph at the selection, in points.
+     *
+     * The measurement the cascade STATES — `w:docDefaults`, the style chain and direct
+     * formatting resolved together — not the gap the page finally draws. The two differ for a
+     * paragraph carrying `w:beforeAutospacing`, where Word substitutes its own value and
+     * ignores the measurement, and again where two paragraphs collapse their adjacent spacing.
+     * Absent when the selection's paragraphs disagree or no level states it.
+     */
+    readonly spaceBeforePt?: number;
+    readonly spaceAfterPt?: number;
+    /**
+     * The paragraph flags the Paragraph dialog shows as checkboxes.
+     *
+     * Each is `true`, `false`, or `null` when the selection's paragraphs disagree — a
+     * checkbox needs all three. Read through the cascade, so a flag a STYLE sets reads as on,
+     * which is what the box has to show over a paragraph the page is visibly keeping with the
+     * next. Absent on a `Run`, like every other selection-level field here.
+     */
+    readonly paragraphFlags?: ParagraphFlags;
+    /**
+     * Which paragraph-level fields above are absent because the selection DISAGREES, as
+     * opposed to because nothing states them.
+     *
+     * A `null`/absent value alone cannot tell those apart, and both readings have shipped as
+     * bugs: a disagreement rendered as a concrete value is uncorrectable, because the value
+     * that would fix it is the one already on screen; an absent value rendered as "mixed"
+     * tells a single paragraph it disagrees with itself.
+     */
+    readonly disagrees?: ParagraphDisagreements;
+    /**
+     * The paragraph's custom tab stops at the selection, cascade included. Absent when the
+     * selection disagrees or the paragraphs have none.
+     */
+    readonly tabStops?: readonly ParagraphTabStop[];
+    /**
+     * The EFFECTIVE paragraph indent at the selection — cascade and numbering merge
+     * included, so a numbered item that authors no `w:ind` reports the indent its list
+     * definition gives it. Absent when nothing is loaded, or when the selection is inside a
+     * table (see {@link IndentFormatting}).
+     */
+    readonly indent?: IndentFormatting;
 }
-/** What every subscription returns. Calling it twice is safe. */
-type Unsubscribe = () => void;
-
-/** How deep controls may nest before a walk stops descending. Shared by every lane. */
-declare const MAX_CONTENT_CONTROL_NESTING = 32;
-/** Cap on controls one walk reports, so a hostile file cannot make a read unbounded. */
-declare const MAX_CONTENT_CONTROLS_PER_PART = 10000;
-/** `CT_SdtPr/w:id` is `ST_DecimalNumber`; Word treats it as a signed 32-bit integer. */
-declare const CONTENT_CONTROL_ID_MAX = 2147483647;
-/** `ST_Lock` (§17.5.2.24). An absent `w:lock` is `unlocked`. */
 /**
- * `w:lock` — what a control refuses.
+ * Indent at the selection, in twips.
  *
- * `sdtLocked` protects the wrapper, `contentLocked` the text inside it, and `sdtContentLocked`
- * both. A control inside a locked one is locked in effect regardless of its own value.
- */
-type ContentControlLock = 'unlocked' | 'sdtLocked' | 'contentLocked' | 'sdtContentLocked';
-/**
- * What kind of control this is.
+ * Unlike every other field here, this does NOT go absent when the selection's paragraphs
+ * disagree. A ruler has to draw its handles somewhere, and Word draws them at the FIRST
+ * selected paragraph's values — Select All is the commonest indent gesture, and hiding the
+ * handles for it would be worse than showing one paragraph's truth. The values are
+ * therefore always the first touched paragraph's, and {@link mixed} records per field
+ * whether the rest agree.
  *
- * `checkbox` is the Microsoft `w14:checkbox` extension rather than an ECMA-376 type
- * element, and the two are not mutually exclusive with "declares no type": four controls
- * in the comprehensive fixture declare the extension and no `w:`-prefixed type, so a scan
- * that read only the ECMA-376 choice reported them untyped. `untyped` means the control
- * declares neither — a rich-text container, which is what Word treats it as.
+ * `firstLine` is ONE SIGNED offset: negative is a hanging indent. OOXML spells it as two
+ * mutually exclusive attributes and this collapses them hanging-wins (§17.3.1.12), which
+ * is the model Word itself keeps.
+ *
+ * Absent inside a table. The value would be correct there, but it is measured from the
+ * cell's content edge while a ruler is drawn against the page's margin, and the ruler does
+ * not know the cell.
  */
-/** Which kind of control a `w:sdt` is, and therefore what a written value must look like. */
-type ContentControlKind = 'richText' | 'plainText' | 'checkbox' | 'dropDownList' | 'comboBox' | 'date' | 'picture' | 'docPartObj' | 'docPartList' | 'group' | 'citation' | 'bibliography' | 'equation' | 'untyped';
-/** One declared option of a dropdown or combo box: its display text and its stored value. */
-interface ContentControlListItem {
-    readonly displayText: string;
-    readonly value: string;
+interface IndentFormatting {
+    /** Left indent, signed. Negative pulls text into the margin, as Word allows. */
+    readonly left: number;
+    /** Right indent, signed. */
+    readonly right: number;
+    /** First-line offset from {@link left}, signed. Negative is a hanging indent. */
+    readonly firstLine: number;
+    /** Per field, whether the selection's paragraphs disagree about it. */
+    readonly mixed: {
+        readonly left: boolean;
+        readonly right: boolean;
+        readonly firstLine: boolean;
+    };
 }
-/** A date picker's authored format and locale, for rendering and for parsing what it stores. */
-interface ContentControlDateFormat {
-    readonly fullDate?: string;
-    readonly dateFormat?: string;
-    readonly lid?: string;
-    readonly storeMappedDataAs?: string;
-    readonly calendar?: string;
+/** A table: its rows, and the table style they resolve through. */
+interface Table {
+    readonly kind: 'table';
+    readonly rows: readonly TableRow[];
+    readonly styleId?: string;
 }
-/** One of a checkbox's two glyphs: the font and code point it is drawn with. */
-interface ContentControlCheckboxState {
-    /** The `w14:val` hex code point of the glyph, exactly as the control declares it. */
-    readonly value: string;
-    readonly font?: string;
+/** One table row. Cell count may vary between rows: `colSpan` and vertical merges reshape it. */
+interface TableRow {
+    readonly cells: readonly TableCell[];
 }
 /**
- * A checkbox's state and the two glyphs it chooses between.
- *
- * Both glyphs matter on a write: setting the value has to update `w14:checked` AND the run's
- * character, or the document's glyph and its recorded state disagree.
+ * One cell. Its `content` is ordinary blocks, so a cell may hold paragraphs, nested tables and
+ * content controls alike.
  */
-interface ContentControlCheckbox {
-    readonly checked: boolean;
-    readonly checkedState?: ContentControlCheckboxState;
-    readonly uncheckedState?: ContentControlCheckboxState;
-}
-/** `CT_DataBinding` — preserved metadata. Never resolved, never fetched. */
-/** `w:dataBinding` — the custom-XML part and XPath a control's value is bound to. */
-interface ContentControlDataBinding {
-    readonly xpath?: string;
-    readonly storeItemID?: string;
-    readonly prefixMappings?: string;
+interface TableCell {
+    readonly content: readonly Block[];
+    /** Vertical merge span. Absent means 1. */
+    readonly rowSpan?: number;
+    /** `w:gridSpan`. Absent means 1. */
+    readonly colSpan?: number;
 }
-/**
- * A control's whole `w:sdtPr`, projected into one typed shape.
- *
- * What every other lane reads instead of walking `localName` strings — which also means a Word
- * re-save that demotes the properties node to generic does not break the projection.
- */
-interface ContentControlProperties {
-    readonly type: ContentControlKind;
-    readonly alias?: string;
+/** Structured document tag (`w:sdt`). */
+interface ContentControl {
+    readonly kind: 'contentControl';
+    readonly id: string;
     readonly tag?: string;
-    /** `@w:val` of `w:id` when the file declares a parseable one. Never fabricated. */
-    readonly id?: number;
-    readonly lock: ContentControlLock;
-    /** The glossary entry named by `w:placeholder/w:docPart`. Preserved, never loaded. */
-    readonly placeholderDocPart?: string;
-    readonly temporary: boolean;
-    readonly showingPlaceholder: boolean;
-    readonly dataBinding?: ContentControlDataBinding;
-    readonly label?: string;
-    readonly tabIndex?: number;
-    /** Items a dropdown or combo box offers. Empty for every other type. */
-    readonly listItems: readonly ContentControlListItem[];
-    readonly lastValue?: string;
-    readonly date?: ContentControlDateFormat;
-    readonly multiLine?: boolean;
-    readonly checkbox?: ContentControlCheckbox;
+    readonly alias?: string;
+    readonly controlType: ContentControlType;
+    readonly locked?: boolean;
+    readonly content: readonly Block[];
 }
-/** Whether a node is a `w:sdt` wrapper. */
-declare function isContentControlNode(node: OoxmlNode): node is OoxmlContentControlNode;
-/** Whether a node is a `w:sdtContent` — the container holding a control's actual content. */
-declare function isContentControlContentNode(node: OoxmlNode): node is OoxmlContentControlContentNode;
-/**
- * A `w:sdt` wrapper, TYPED or DEMOTED.
- *
- * Flattening predates typing and must not stop at a control the reader refused to type: a
- * demoted wrapper still renders its content in place in Word, so a walk that only saw the
- * typed kind would drop every paragraph inside a malformed control out of the story.
- */
-declare function isContentControlWrapper(node: OoxmlNode): boolean;
-/**
- * The children of a wrapper's `w:sdtContent`, typed or demoted, in order.
- *
- * The one place that knows a control's content is reached through an intermediate element,
- * so the four flattening walks (story blocks, layout, header/footer references, list
- * resolution) ask the same question rather than each re-deriving it.
- */
-declare function contentControlContentChildren(wrapper: OoxmlNode): readonly OoxmlNode[];
+/** Which kind of control a `w:sdt` is, and therefore what a value written into it must be. */
+type ContentControlType = 'richText' | 'plainText' | 'checkbox' | 'dropdown' | 'comboBox' | 'date' | 'picture' | 'buildingBlockGallery' | 'repeatingSection';
 /**
- * A container's children with every content-control wrapper flattened away, bounded in depth.
- *
- * ONE unwrap rule, for the places where a control sits between a container and the children that
- * container is defined in terms of. `CT_SdtRow` puts it between `w:tbl` and `w:tr`, `CT_SdtCell`
- * between `w:tr` and `w:tc`, and a walk that filtered on the child's kind dropped the row or cell
- * entirely: not measured, not painted, not addressable. Flattening at the point of the filter
- * means a controlled row is the same row to the grid pass, the pagination pass and the story walk.
+ * The control kinds an insertion can author.
  *
- * Returns the SAME array identity when there is nothing to unwrap, so the tables that carry no
- * controls — nearly all of them — allocate nothing and the incremental layout cache still sees
- * its own inputs.
- */
-declare function flattenContentControls(children: readonly OoxmlNode[], maxDepth?: number): readonly OoxmlNode[];
-/** A control's `w:sdtPr`, or null. Matches structurally, so a Word-demoted node still resolves. */
-declare function contentControlPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlPropertiesNode | undefined;
-/** A control's `w:sdtEndPr` — the run properties applied to its closing marker. */
-declare function contentControlEndPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlEndPropertiesNode | undefined;
-/** A control's `w:sdtContent`, or null when the wrapper has none. */
-declare function contentControlContentNodeOf(control: OoxmlNode): OoxmlContentControlContentNode | undefined;
-/** A signed 32-bit `ST_DecimalNumber`, or undefined when the file wrote something else. */
-declare function parseContentControlId(raw: string | undefined): number | undefined;
-/**
- * Read a control's properties.
+ * A NARROWING of {@link ContentControlType}, not a separate vocabulary: a kind read off an
+ * existing control can be handed straight back to `insertContentControl`. Three kinds are
+ * absent because an insertion would have to invent what they carry — a checkbox needs its two
+ * declared glyph states, a picture needs an image part, a building block gallery needs a
+ * glossary to list, and a repeating section is a container whose items have their own verbs. Reading still answers the wider type; a document may hold
+ * kinds this cannot create.
  *
- * Total: a control with no `w:sdtPr` at all answers the same shape with the defaults an
- * absent property means, so no caller has to branch on the container's existence.
+ * `dropDownList` is the same kind as `dropdown`, spelt as OOXML spells it. Both are accepted,
+ * so a type read off a control can be handed back without translating it — and the OOXML
+ * spelling is the one the automation protocol takes, so a caller who uses both surfaces can
+ * write that one everywhere.
  */
-declare function contentControlPropertiesOf(control: OoxmlNode): ContentControlProperties;
-/** Where a control sits, read off what its content holds. */
-type ContentControlLevel = 'block' | 'inline' | 'row' | 'cell' | 'empty';
+type InsertableContentControlType = Extract<ContentControlType, 'richText' | 'plainText' | 'dropdown' | 'comboBox' | 'date'> | 'dropDownList';
 /**
- * How deeply a control is nested inside other controls.
- *
- * Bounded by {@link MAX_CONTENT_CONTROL_NESTING}: nesting depth comes from a file and is a
- * recursion bound.
+ * Narrows a content-control query. Fields combine with AND; an empty filter matches every
+ * control.
  */
-declare function contentControlLevelOf(control: OoxmlNode): ContentControlLevel;
-/** One control, plus how deeply it is nested and the controls that enclose it. */
-interface ContentControlEntry {
-    readonly node: OoxmlContentControlNode;
-    /** 0 for a top-level control; the nesting depth otherwise. */
-    readonly depth: number;
-    /** Enclosing controls, outermost first. Empty at depth 0. */
-    readonly ancestors: readonly OoxmlContentControlNode[];
+interface ContentControlFilter {
+    readonly tag?: string;
+    readonly alias?: string;
+    readonly controlType?: ContentControlType;
 }
 /**
- * Every control under a node, in document order, bounded in depth and in count.
+ * A position in one story: a paragraph and a UTF-16 offset inside it.
  *
- * ONE walk, shared. The nesting bound is the same one layout flattens with, so a control
- * a lane can address is a control every lane can address — and a file that nests past it
- * keeps its content in the tree (the serializer never stops) while no walk recurses
- * further.
+ * The same offset space the ops and the caret use, so an anchor read here can be handed
+ * straight back to a selection without re-deriving anything.
  */
-declare function contentControlsIn(root: OoxmlNode, options?: {
-    readonly maxDepth?: number;
-    readonly limit?: number;
-}): readonly ContentControlEntry[];
-/** Find one control by canonical node id, with the same bounded walk. */
-declare function findContentControl(root: OoxmlNode, nodeId: string): ContentControlEntry | null;
+interface DocAnchorRange {
+    /** Canonical part name of the story the range lives in, e.g. `/word/document.xml`. */
+    readonly part: string;
+    readonly startParagraphId: string;
+    readonly startOffset: number;
+    /** May sit in a later paragraph: the range markers are independent elements. */
+    readonly endParagraphId: string;
+    readonly endOffset: number;
+}
 /**
- * The plain text a control's content holds, in reading order.
+ * One comment or reply, as `comments.xml` records it.
  *
- * `w:delText` is excluded: struck text is not the control's value, and a dropdown whose
- * old item is still present as a tracked deletion would otherwise report both.
+ * A reply is a comment with a `parentId`; OOXML gives replies no separate element, so the thread
+ * is reconstructed from that link rather than from nesting.
  */
-declare function contentControlTextOf(control: OoxmlNode): string;
+interface DocComment {
+    readonly id: string;
+    readonly author: string;
+    /**
+     * OPTIONAL, because `CT_Comment` makes `@w:date` optional and files omit it. A comment
+     * with no date is a comment, not a defect, and fabricating one is a content change.
+     */
+    readonly date?: string;
+    readonly text: string;
+    readonly parentId?: string;
+    readonly resolved?: boolean;
+    /**
+     * Where the comment is anchored, absent when the file gave it no usable range.
+     *
+     * A comment lives in `comments.xml` and is placed by markers in a STORY, so the story is
+     * part of the address: a comment anchored in a header belongs to a part the body never saw.
+     */
+    readonly anchor?: DocAnchorRange;
+    /**
+     * True when the file gave this comment no usable range — a reference with no markers, or a
+     * start with no end. Reported rather than dropped: a reviewer's remark vanishing silently
+     * is worse than one that says it lost its text.
+     */
+    readonly orphaned?: boolean;
+}
 /**
- * Resolve the lock a position inherits from the controls enclosing it.
+ * What kind of decision a revision represents.
  *
- * CONSERVATIVE, because a template that says a field cannot be edited and sits inside a
- * section that says it cannot be removed means both. Each half of `ST_Lock` is taken
- * independently and the strongest wins, so an unlocked control inside a `contentLocked`
- * one is still content-locked — a nested control cannot grant a permission its parent
- * withheld, which is the only reading under which a lock is a lock.
+ * Wider than insert/delete/format, and it has to be. `w:moveFrom`/`w:moveTo` are not a
+ * deletion and an insertion — resolving one half alone duplicates or loses the content;
+ * `w:pPr/w:rPr/w:ins|w:del` decorates no characters at all and merges paragraphs when
+ * resolved; a row or cell revision is structural. A reviewer shown only three kinds is a
+ * reviewer who never learns about the rest.
  */
-declare function resolveContentControlLock(chain: readonly ContentControlLock[]): ContentControlLock;
-/** Whether a resolved lock forbids editing the content it covers. */
-declare function lockForbidsEdit(lock: ContentControlLock): boolean;
-/** Whether a resolved lock forbids removing the control itself. */
-declare function lockForbidsRemoval(lock: ContentControlLock): boolean;
+type RevisionType = 'insert' | 'delete'
+/** A deletion and an insertion that are one edit: text typed over a selection. */
+ | 'replace' | 'moveFrom' | 'moveTo'
+/** `w:rPrChange` / `w:pPrChange` — the words are unchanged, their formatting is not. */
+ | 'format'
+/** `w:pPr/w:rPr/w:ins|w:del` — a paragraph split or merge. */
+ | 'paragraphMark'
+/** A row, cell, section or grid revision. */
+ | 'structural';
 /**
- * `CT_SdtPr`'s declared child order (§17.5.2.38), followed by the type choice.
+ * One tracked change.
  *
- * Serialization re-emits children in tree order, so the ONLY way a write keeps the
- * sequence valid is to place the child it authors at its schema position — which is what
- * {@link orderedContentControlProperties} does.
+ * Addressing needs BOTH `id` and `part`: `@w:id` is unique only within a part, so an id alone
+ * names two revisions in any package that has a header or a comments part.
  */
-declare const CONTENT_CONTROL_PROPERTY_ORDER: readonly string[];
+interface Revision {
+    /** Numeric, and unique only WITHIN a part. Pair with `part` to address one. */
+    readonly id: number;
+    readonly type: RevisionType;
+    readonly author: string;
+    /**
+     * OPTIONAL. `CT_TrackChange` requires `@w:id` and `@w:author` and makes `@w:date`
+     * optional, and producers that omit it are ordinary. Requiring it here forced either a
+     * fabricated date — a content change — or dropping the revision from the list.
+     */
+    readonly date?: string;
+    /**
+     * REQUIRED, and a canonical PART NAME rather than a three-value enum.
+     *
+     * `@w:id` is unique only within a part, so an address without one names two revisions in a
+     * package that has both. The enum could not express the parts revisions actually occur in:
+     * `header3.xml`, `footer1.xml`, `comments.xml`, and `styles.xml`, which carries
+     * `w:pPrChange` inside style definitions with ids that collide with `document.xml`.
+     */
+    readonly part: string;
+}
+/** `w:sectPr`: the page a section lays out on. Twips throughout, as the file stores them. */
+interface SectionProperties {
+    readonly pageSize: {
+        widthTwips: number;
+        heightTwips: number;
+    };
+    readonly margins: PageMargins;
+    readonly columns?: {
+        count: number;
+        gapTwips: number;
+    };
+    /** `w:titlePg` — whether the section's first page takes the `first` header/footer variant. */
+    readonly titlePage?: boolean;
+}
+/** Page margins in twips. */
+interface PageMargins {
+    readonly topTwips: number;
+    readonly rightTwips: number;
+    readonly bottomTwips: number;
+    readonly leftTwips: number;
+}
 /**
- * Rebuild a `w:sdtPr`'s children in schema order.
+ * `styles.xml`, split by the three style families that address separately.
  *
- * Modelled children sort to their declared position and the type element follows them,
- * as the sequence requires. Everything else — a `w15:repeatingSection`, a vendor
- * extension, the `w14:checkbox` that is not part of the ECMA-376 choice — keeps the order
- * it was authored in and follows the modelled block, so a write that touches one property
- * neither drops nor reorders anything it does not name.
+ * Keyed by style ID rather than by the name a reader sees, because the ID is what a paragraph or
+ * run actually references.
  */
-declare function orderedContentControlProperties(children: readonly OoxmlNode[]): readonly OoxmlNode[];
+interface StyleDefinitions {
+    readonly paragraph: ReadonlyMap<string, StyleDefinition>;
+    readonly character: ReadonlyMap<string, StyleDefinition>;
+    readonly table: ReadonlyMap<string, StyleDefinition>;
+}
+/** One style: the ID content references, the name a reader sees, and its inheritance link. */
+interface StyleDefinition {
+    readonly id: string;
+    readonly name: string;
+    /** `w:basedOn` — the style this one inherits from. Absent at the root of a chain. */
+    readonly basedOn?: string;
+}
+/** A paragraph's list membership: which `numbering.xml` definition, and at which level. */
+interface NumberingRef {
+    readonly numId: string;
+    /** Zero-based. OOXML numbering has nine levels, 0 through 8. */
+    readonly level: number;
+}
 /**
- * The next `w:id` to write.
- *
- * Solo: one past the document's own maximum. Never a clock, a timestamp, a random source
- * or a hash: those collide with ids already in the file and produce values Word rejects.
- * Null when the document already reaches the signed 32-bit bound, so the caller refuses
- * rather than wrapping into a negative id. Hostile or out-of-range existing values are
- * ignored for seeding rather than counted past.
+ * A colour as the FILE expresses it, not as a resolved RGB string.
  *
- * When a collaboration actor is bound (explicit argument or the open store transaction),
- * the next id is the next unused value in that actor's stripe. Two peers inserting a
- * generic content control — including a custom node authored as `w:sdt` — from the same
- * snapshot then cannot share a `w:id`.
+ * A theme colour stays a theme reference — slot plus tint or shade — so that changing the theme
+ * repaints the document the way Word does. Flattening to hex at read time would freeze the
+ * resolved value and break that link. `auto` is Word's "let the renderer decide", usually black
+ * on white.
  */
-declare function allocateContentControlId(root: OoxmlNode, actorId?: string): number | null;
-
-/** The value a control accepts, by what kind of control it is. */
-type ContentControlValueInput = {
-    readonly kind: 'text';
-    readonly text: string;
-} | {
-    readonly kind: 'listItem';
+type ColorValue = {
+    readonly kind: 'hex';
     readonly value: string;
 } | {
-    readonly kind: 'checkbox';
-    readonly checked: boolean;
-}
-/** A calendar date, `YYYY-MM-DD` or a full ISO-8601 instant. */
- | {
-    readonly kind: 'date';
-    readonly iso: string;
+    readonly kind: 'theme';
+    readonly slot: string;
+    readonly tint?: number;
+    readonly shade?: number;
+} | {
+    readonly kind: 'auto';
 };
-/** The control types an insertion may author. Picture and repeating section are deferred. */
-declare const INSERTABLE_CONTENT_CONTROL_TYPES: readonly ["richText", "plainText", "dropDownList", "comboBox", "date"];
-/**
- * The OOXML spellings the store writes.
- *
- * NOT the contract's `InsertableContentControlType`, which is the same set of kinds in the
- * READ vocabulary (`dropdown`) plus this lane's spelling of it (`dropDownList`). The editor
- * maps between the two; the names differ so a reader can tell which vocabulary a value is in.
- */
-type InsertableContentControlKind = (typeof INSERTABLE_CONTENT_CONTROL_TYPES)[number];
-
-/** Allowlisted OOXML table border line styles — store/layout authority. */
-declare const TABLE_BORDER_STYLES: readonly ["single", "dashed", "dotted", "double", "triple", "thick"];
-/**
- * One of the border line styles this engine draws.
- *
- * An ALLOWLIST, not the full `ST_Border` enumeration: a file may name any of the seventy-odd
- * OOXML border styles, and anything outside this set falls back rather than being passed through
- * to paint.
- */
-type TableBorderStyle = (typeof TABLE_BORDER_STYLES)[number];
+/** `theme1.xml` — what a {@link ColorValue} of kind `theme` resolves against. */
+interface Theme {
+    readonly colorScheme: ThemeColorScheme;
+    readonly fontScheme?: Record<string, string>;
+}
+/** Theme colour slots (`accent1`, `dk1`, `lt2`, …) to hex. */
+type ThemeColorScheme = Readonly<Record<string, string>>;
+/** A watermark, which OOXML expresses as either text or an image — never both meaningfully. */
+interface Watermark {
+    readonly text?: string;
+    readonly imageData?: Uint8Array;
+}
+/** A size in EMUs, the unit DrawingML stores extents in. 914400 EMU = 1 inch. */
+interface Extent {
+    readonly widthEmu: number;
+    readonly heightEmu: number;
+}
+/** A font the document names, and whether its bytes travel inside the package. */
+interface FontDefinition {
+    readonly family: string;
+    readonly embedded: boolean;
+}
+/** An axis-aligned rectangle in points, the unit layout works in throughout. */
+interface Rect {
+    readonly x: number;
+    readonly y: number;
+    readonly width: number;
+    readonly height: number;
+}
+/** A position in points. */
+interface Point {
+    readonly x: number;
+    readonly y: number;
+}
+/** What every subscription returns. Calling it twice is safe. */
+type Unsubscribe = () => void;
 
 /**
  * How a tracked change is addressed: `@w:id`, `@w:author` and `@w:date` together, within a
@@ -3849,7 +3893,7 @@ type TreeDocOp = SetFieldCodeOp | {
         readonly paragraphId: string;
         readonly pageNumberText: string;
     }[];
-} | SetTextFormFieldDefaultOp | CommitTextFormFieldOp | {
+} | SetTextFormFieldDefaultOp | CommitTextFormFieldOp | SetLegacyCheckboxOp | SetLegacyDropdownOp | InsertBuildingBlockOp | {
     /**
      * Rewrite recognized fields' cached RESULT runs in place — between the `separate` and
      * `end` fldChars, or a `w:fldSimple`'s content. The instruction is never modified; a
@@ -4013,4 +4057,4 @@ type TreeOpResult = {
     readonly detail?: string;
 };
 
-export { type RevisionBatchSkipReason as $, type IndentFormatting as A, type Block as B, type CommentRecord as C, type DocxDocument as D, type ExecResult as E, type ParagraphFlags as F, type ParagraphTabStop as G, type HeaderFooterSet as H, type InsertableContentControlType as I, type RevisionType as J, type Section as K, type SectionProperties as L, type StyleDefinition as M, type Theme as N, type OoxmlPart as O, type Paragraph as P, type ThemeColorScheme as Q, type ReviewModelInput as R, type StyleDefinitions as S, type Table as T, type OoxmlNodeId as U, type OoxmlGenericElementNode as V, type TreeDocOp as W, type OoxmlPackageLimits as X, type OoxmlPackageRejection as Y, type RevisionBatchEntry as Z, type RevisionBatchResult as _, type ReviewItem as a, type CommentPosition as a$, type OoxmlProperty as a0, type OoxmlElement as a1, type OoxmlContentControlNode as a2, type OoxmlContentControlContentNode as a3, type DrawingProjection as a4, type TreeOpRejection as a5, type AutomationTableMutation as a6, type SourceCrop as a7, type DrawingKind as a8, type ImageWrapTarget as a9, type OoxmlSeparatorNode as aA, type DrawingTreeDocOp as aB, type ImpactClass as aC, type TreeDocColorValue as aD, IMAGE_WRAP_TARGETS as aE, TEXT_FORM_FORMATS as aF, type TableBorderStyle as aG, type DrawingAccessibility as aH, type DrawingImageEffects as aI, type DrawingTransform as aJ, type VectorShapeProjection as aK, type OoxmlDrawingNode as aL, type OoxmlInvariantResult as aM, type RelationshipRecord as aN, type OoxmlInvariantIssue as aO, type OoxmlHardBreakNode as aP, type OoxmlFldCharNode as aQ, type OoxmlFldSimpleNode as aR, type OoxmlInstrTextNode as aS, type OoxmlAttribute as aT, type TreeOpResult as aU, type CommentThreadState as aV, ACCEPTED_PARAGRAPH_PROPERTIES as aW, ACCEPTED_RUN_PROPERTIES as aX, CONTENT_CONTROL_ID_MAX as aY, CONTENT_CONTROL_PROPERTY_ORDER as aZ, type CommentAnchor as a_, type DrawingPositionInput as aa, type DrawingLocks as ab, type ParagraphFormatCommand as ac, type Watermark as ad, type Rect as ae, type SelectionPin as af, type Unsubscribe as ag, type DocxDocumentJSON as ah, type DrawingHorizontalReferenceFrame as ai, type DrawingVerticalReferenceFrame as aj, type FontDefinition as ak, type NumberingRef as al, type PageMargins as am, type ParagraphDisagreements as an, type Point as ao, type Run as ap, type TableCell as aq, type TableRow as ar, type RevisionAttributionInput as as, type OoxmlParagraphNode as at, type OoxmlNoteNode as au, type OoxmlContinuationSeparatorNode as av, type OoxmlEndnotesNode as aw, type OoxmlFootnotesNode as ax, type OoxmlNoteRefNode as ay, type OoxmlNoteReferenceNode as az, type ReviewRevisionItem as b, type OoxmlRunNode as b$, type CommitTextFormFieldOp as b0, type ContentControlCheckbox as b1, type ContentControlCheckboxState as b2, type ContentControlDataBinding as b3, type ContentControlDateFormat as b4, type ContentControlEntry as b5, type ContentControlKind as b6, type ContentControlLevel as b7, type ContentControlListItem as b8, type ContentControlLock as b9, type OoxmlContentControlCheckedNode as bA, type OoxmlContentControlCheckedStateNode as bB, type OoxmlContentControlComboBoxNode as bC, type OoxmlContentControlDataBindingNode as bD, type OoxmlContentControlDateFormatNode as bE, type OoxmlContentControlDateNode as bF, type OoxmlContentControlDropDownListNode as bG, type OoxmlContentControlEndPropertiesNode as bH, type OoxmlContentControlLidNode as bI, type OoxmlContentControlListItemNode as bJ, type OoxmlContentControlPropertiesNode as bK, type OoxmlContentControlStoreMappedDataAsNode as bL, type OoxmlContentControlTextNode as bM, type OoxmlContentControlUncheckedStateNode as bN, type OoxmlDocumentNode as bO, type OoxmlExternalTarget as bP, type OoxmlGenericExtensionAttribute as bQ, type OoxmlHyperlinkNode as bR, type OoxmlInvariantIssueCode as bS, type OoxmlKnownNodeAttribute as bT, type OoxmlNamespaceBinding as bU, type OoxmlNodeIdentityRules as bV, type OoxmlPackageResult as bW, type OoxmlParagraphPropertiesNode as bX, type OoxmlPartMetadata as bY, type OoxmlReadRejection as bZ, type OoxmlReadResult as b_, type ContentControlProperties as ba, type ContentTypeError as bb, type ContentTypeIndex as bc, type ContentTypeRecords as bd, DEFAULT_OOXML_PACKAGE_LIMITS as be, DEFAULT_ZIP_LIMITS as bf, type DefaultRecord as bg, type DeleteTextOp as bh, HYPERLINK_RELATIONSHIP_TYPE as bi, type HyperlinkKind as bj, type HyperlinkTarget as bk, IMAGE_RELATIONSHIP_TYPE as bl, type ImageRelationshipResolution as bm, type IndexResult as bn, type InsertTextOp as bo, MAX_CONTENT_CONTROLS_PER_PART as bp, MAX_CONTENT_CONTROL_NESTING as bq, type NameRejection as br, type NameResult as bs, OFFICE_RELATIONSHIP_NAMESPACE_URI as bt, OOXML_NODE_IDENTITY_RULES as bu, type OoxmlBodyNode as bv, type OoxmlBookmarkEndNode as bw, type OoxmlBookmarkStartNode as bx, type OoxmlContentControlCalendarNode as by, type OoxmlContentControlCheckboxNode as bz, type ReviewCommentItem as c, isValidMime as c$, type OoxmlRunPropertiesNode as c0, type OoxmlTabNode as c1, type OoxmlTextElementNode as c2, type OoxmlTextNode as c3, type OoxmlWmlValAttribute as c4, type OoxmlXmlSpaceAttribute as c5, type OverrideRecord as c6, type RelationshipError as c7, type RelationshipSetResult as c8, type RelationshipTargetResolver as c9, childElements as cA, commentAnchorsOfStory as cB, commentsOfPart as cC, contentControlContentChildren as cD, contentControlContentNodeOf as cE, contentControlEndPropertiesNodeOf as cF, contentControlLevelOf as cG, contentControlPropertiesNodeOf as cH, contentControlPropertiesOf as cI, contentControlTextOf as cJ, contentControlsIn as cK, detectDuplicateNames as cL, extensionKey as cM, findContentControl as cN, findElement as cO, firstReviewRange as cP, flattenContentControls as cQ, hasAnyComment as cR, hyperlinkAnchorOf as cS, hyperlinkRelationshipIdOf as cT, hyperlinkTargetOf as cU, isContentControlContentNode as cV, isContentControlNode as cW, isContentControlWrapper as cX, isContentRevisionKind as cY, isHyperlinkNode as cZ, isRangeMarkerKind as c_, type ResolveResult as ca, type ResolvedRelationship as cb, type SetTextFormFieldDefaultOp as cc, TABLE_BORDER_STYLES as cd, type TabStopWrite as ce, type TargetMode as cf, type TextFormFieldOptions as cg, type TextFormFieldRange as ch, type TextFormFieldType as ci, type TreeDocOpKind as cj, type TreeOpEffect as ck, W15_NAMESPACE_URI as cl, WML_NAMESPACE_URI as cm, XMLNS_NAMESPACE_URI as cn, XML_NAMESPACE_URI as co, type XmlLimits as cp, type XmlNode as cq, type XmlRejection as cr, type XmlResult as cs, type ZipLimits as ct, type ZipReadResult as cu, type ZipRejection as cv, allocateContentControlId as cw, asciiFold as cx, buildContentTypeIndex as cy, buildRelationshipSet as cz, type ReviewCustomItem as d, lockForbidsEdit as d0, lockForbidsRemoval as d1, normalizePartName as d2, orderedContentControlProperties as d3, parseContentControlId as d4, partNameKey as d5, planRevisionBatch as d6, projectDrawing as d7, readOnOffChild as d8, readOoxmlPackage as d9, readOoxmlPart as da, readXml as db, readZip as dc, resolveContentControlLock as dd, resolveContentType as de, resolveImageRelationship as df, resolveInternalTarget as dg, resolveRelationship as dh, reviewItemKey as di, reviewItemRanges as dj, textContent as dk, textFormFieldsOf as dl, threadStateOfPart as dm, validateExternalTarget as dn, withPart as dp, writeOoxmlPackage as dq, writeZip as dr, type VectorShapeComponent as ds, activeReviewItem as dt, reviewItemPositionRank as du, reviewItemsAt as dv, reviewThreadRootOf as dw, type ReviewPosition as e, type ReviewRange as f, type ReviewRevisionKind as g, type RevisionAddress as h, type OoxmlNode as i, type OoxmlPackage as j, type ContentControlType as k, type DocTarget as l, type RunFormatting as m, type Extent as n, type ContainerRef as o, type ContentControlFilter as p, type DocRange as q, type Revision as r, type DocComment as s, type ColorValue as t, type ContentControl as u, type DocAnchor as v, type DocAnchorRange as w, type DocLocation as x, type DocumentBody as y, type ExecErrorCode as z };
+export { type RevisionBatchSkipReason as $, type IndentFormatting as A, type Block as B, type CommentRecord as C, type DocxDocument as D, type ExecResult as E, type ParagraphFlags as F, type ParagraphTabStop as G, type HeaderFooterSet as H, type InsertableContentControlType as I, type RevisionType as J, type Section as K, type SectionProperties as L, type StyleDefinition as M, type Theme as N, type OoxmlPart as O, type Paragraph as P, type ThemeColorScheme as Q, type ReviewModelInput as R, type StyleDefinitions as S, type Table as T, type OoxmlNodeId as U, type OoxmlGenericElementNode as V, type TreeDocOp as W, type OoxmlPackageLimits as X, type OoxmlPackageRejection as Y, type RevisionBatchEntry as Z, type RevisionBatchResult as _, type ReviewItem as a, type CommentPosition as a$, type OoxmlProperty as a0, type OoxmlElement as a1, type OoxmlContentControlNode as a2, type OoxmlContentControlContentNode as a3, type DrawingProjection as a4, type TreeOpRejection as a5, type AutomationTableMutation as a6, type SourceCrop as a7, type DrawingKind as a8, type ImageWrapTarget as a9, type OoxmlSeparatorNode as aA, type DrawingTreeDocOp as aB, type ImpactClass as aC, type TreeDocColorValue as aD, IMAGE_WRAP_TARGETS as aE, TEXT_FORM_FORMATS as aF, type TableBorderStyle as aG, type DrawingAccessibility as aH, type DrawingImageEffects as aI, type DrawingTransform as aJ, type VectorShapeProjection as aK, type OoxmlDrawingNode as aL, type OoxmlInvariantResult as aM, type OoxmlFldCharNode as aN, type OoxmlFldSimpleNode as aO, type OoxmlInstrTextNode as aP, type OoxmlInvariantIssue as aQ, type TreeOpResult as aR, type RelationshipRecord as aS, type OoxmlHardBreakNode as aT, type OoxmlAttribute as aU, type CommentThreadState as aV, ACCEPTED_PARAGRAPH_PROPERTIES as aW, ACCEPTED_RUN_PROPERTIES as aX, CONTENT_CONTROL_ID_MAX as aY, CONTENT_CONTROL_PROPERTY_ORDER as aZ, type CommentAnchor as a_, type DrawingPositionInput as aa, type DrawingLocks as ab, type ParagraphFormatCommand as ac, type Watermark as ad, type Rect as ae, type SelectionPin as af, type Unsubscribe as ag, type DocxDocumentJSON as ah, type DrawingHorizontalReferenceFrame as ai, type DrawingVerticalReferenceFrame as aj, type FontDefinition as ak, type NumberingRef as al, type PageMargins as am, type ParagraphDisagreements as an, type Point as ao, type Run as ap, type TableCell as aq, type TableRow as ar, type RevisionAttributionInput as as, type OoxmlParagraphNode as at, type OoxmlNoteNode as au, type OoxmlContinuationSeparatorNode as av, type OoxmlEndnotesNode as aw, type OoxmlFootnotesNode as ax, type OoxmlNoteRefNode as ay, type OoxmlNoteReferenceNode as az, type ReviewRevisionItem as b, type OoxmlReadRejection as b$, type CommitTextFormFieldOp as b0, type ContentControlCheckbox as b1, type ContentControlCheckboxState as b2, type ContentControlDataBinding as b3, type ContentControlDateFormat as b4, type ContentControlEntry as b5, type ContentControlKind as b6, type ContentControlLevel as b7, type ContentControlListItem as b8, type ContentControlLock as b9, type OoxmlContentControlCalendarNode as bA, type OoxmlContentControlCheckboxNode as bB, type OoxmlContentControlCheckedNode as bC, type OoxmlContentControlCheckedStateNode as bD, type OoxmlContentControlComboBoxNode as bE, type OoxmlContentControlDataBindingNode as bF, type OoxmlContentControlDateFormatNode as bG, type OoxmlContentControlDateNode as bH, type OoxmlContentControlDropDownListNode as bI, type OoxmlContentControlEndPropertiesNode as bJ, type OoxmlContentControlLidNode as bK, type OoxmlContentControlListItemNode as bL, type OoxmlContentControlPropertiesNode as bM, type OoxmlContentControlStoreMappedDataAsNode as bN, type OoxmlContentControlTextNode as bO, type OoxmlContentControlUncheckedStateNode as bP, type OoxmlDocumentNode as bQ, type OoxmlExternalTarget as bR, type OoxmlGenericExtensionAttribute as bS, type OoxmlHyperlinkNode as bT, type OoxmlInvariantIssueCode as bU, type OoxmlKnownNodeAttribute as bV, type OoxmlNamespaceBinding as bW, type OoxmlNodeIdentityRules as bX, type OoxmlPackageResult as bY, type OoxmlParagraphPropertiesNode as bZ, type OoxmlPartMetadata as b_, type ContentControlProperties as ba, type ContentTypeError as bb, type ContentTypeIndex as bc, type ContentTypeRecords as bd, DEFAULT_OOXML_PACKAGE_LIMITS as be, DEFAULT_ZIP_LIMITS as bf, type DefaultRecord as bg, type DeleteTextOp as bh, HYPERLINK_RELATIONSHIP_TYPE as bi, type HyperlinkKind as bj, type HyperlinkTarget as bk, IMAGE_RELATIONSHIP_TYPE as bl, type ImageRelationshipResolution as bm, type IndexResult as bn, type InsertBuildingBlockOp as bo, type InsertTextOp as bp, type LegacyCheckboxFieldRange as bq, MAX_CONTENT_CONTROLS_PER_PART as br, MAX_CONTENT_CONTROL_NESTING as bs, type NameRejection as bt, type NameResult as bu, OFFICE_RELATIONSHIP_NAMESPACE_URI as bv, OOXML_NODE_IDENTITY_RULES as bw, type OoxmlBodyNode as bx, type OoxmlBookmarkEndNode as by, type OoxmlBookmarkStartNode as bz, type ReviewCommentItem as c, isContentControlWrapper as c$, type OoxmlReadResult as c0, type OoxmlRunNode as c1, type OoxmlRunPropertiesNode as c2, type OoxmlTabNode as c3, type OoxmlTextElementNode as c4, type OoxmlTextNode as c5, type OoxmlWmlValAttribute as c6, type OoxmlXmlSpaceAttribute as c7, type OverrideRecord as c8, type RelationshipError as c9, allocateContentControlId as cA, asciiFold as cB, buildContentTypeIndex as cC, buildRelationshipSet as cD, childElements as cE, commentAnchorsOfStory as cF, commentsOfPart as cG, contentControlContentChildren as cH, contentControlContentNodeOf as cI, contentControlEndPropertiesNodeOf as cJ, contentControlLevelOf as cK, contentControlPropertiesNodeOf as cL, contentControlPropertiesOf as cM, contentControlTextOf as cN, contentControlsIn as cO, detectDuplicateNames as cP, extensionKey as cQ, findContentControl as cR, findElement as cS, firstReviewRange as cT, flattenContentControls as cU, hasAnyComment as cV, hyperlinkAnchorOf as cW, hyperlinkRelationshipIdOf as cX, hyperlinkTargetOf as cY, isContentControlContentNode as cZ, isContentControlNode as c_, type RelationshipSetResult as ca, type RelationshipTargetResolver as cb, type ResolveResult as cc, type ResolvedRelationship as cd, type SetLegacyCheckboxOp as ce, type SetLegacyDropdownOp as cf, type SetTextFormFieldDefaultOp as cg, TABLE_BORDER_STYLES as ch, type TabStopWrite as ci, type TargetMode as cj, type TextFormFieldOptions as ck, type TextFormFieldRange as cl, type TextFormFieldType as cm, type TreeDocOpKind as cn, type TreeOpEffect as co, W15_NAMESPACE_URI as cp, WML_NAMESPACE_URI as cq, XMLNS_NAMESPACE_URI as cr, XML_NAMESPACE_URI as cs, type XmlLimits as ct, type XmlNode as cu, type XmlRejection as cv, type XmlResult as cw, type ZipLimits as cx, type ZipReadResult as cy, type ZipRejection as cz, type ReviewCustomItem as d, isContentRevisionKind as d0, isHyperlinkNode as d1, isRangeMarkerKind as d2, isValidMime as d3, legacyCheckboxFieldsOf as d4, lockForbidsEdit as d5, lockForbidsRemoval as d6, normalizePartName as d7, orderedContentControlProperties as d8, parseContentControlId as d9, reviewItemsAt as dA, reviewThreadRootOf as dB, partNameKey as da, planRevisionBatch as db, projectDrawing as dc, readOnOffChild as dd, readOoxmlPackage as de, readOoxmlPart as df, readXml as dg, readZip as dh, resolveContentControlLock as di, resolveContentType as dj, resolveImageRelationship as dk, resolveInternalTarget as dl, resolveRelationship as dm, reviewItemKey as dn, reviewItemRanges as dp, textContent as dq, textFormFieldsOf as dr, threadStateOfPart as ds, validateExternalTarget as dt, withPart as du, writeOoxmlPackage as dv, writeZip as dw, type VectorShapeComponent as dx, activeReviewItem as dy, reviewItemPositionRank as dz, type ReviewPosition as e, type ReviewRange as f, type ReviewRevisionKind as g, type RevisionAddress as h, type OoxmlNode as i, type OoxmlPackage as j, type ContentControlType as k, type DocTarget as l, type RunFormatting as m, type Extent as n, type ContainerRef as o, type ContentControlFilter as p, type DocRange as q, type Revision as r, type DocComment as s, type ColorValue as t, type ContentControl as u, type DocAnchor as v, type DocAnchorRange as w, type DocLocation as x, type DocumentBody as y, type ExecErrorCode as z };