@docx-editor.dev/core 2.26.0 → 2.28.0

package/dist/{types-barrel-BO73JqHG.d.ts → types-barrel-D3xCgQX6.d.ts}

@@ -1072,6 +1072,56 @@ interface InsertBuildingBlockOp {
     readonly blocks: readonly OoxmlNode[];
 }
 
+/**
+ * Why a zip was refused at the trust boundary.
+ *
+ * `too-large` and `too-many-entries` are the zip-bomb guards; `bad-name` catches path traversal —
+ * an entry with `..` or a leading `/` is rejected rather than normalized.
+ */
+type ZipRejection = 'too-many-entries' | 'too-large' | 'bad-name' | 'inflate-error';
+/** Archive caps: entry count, total decompressed bytes, and the decompression ratio. */
+interface ZipLimits {
+    readonly maxEntries: number;
+    /** Max total UNCOMPRESSED bytes across the archive. */
+    readonly maxTotalBytes: number;
+    /**
+     * Max ratio of the archive's total declared uncompressed bytes to the archive's own byte
+     * length (zip-bomb guard). Applies once that total exceeds 8 MiB, so a small archive is
+     * never refused for compressing well.
+     */
+    readonly maxRatio?: number;
+}
+/** The archive caps in force when a host configures none. Conservative and finite. */
+declare const DEFAULT_ZIP_LIMITS: ZipLimits;
+/** The read entries, or the typed refusal. Never throws — the bytes are untrusted. */
+type ZipReadResult = {
+    readonly ok: true;
+    readonly entries: ReadonlyMap<string, Uint8Array>;
+} | {
+    readonly ok: false;
+    readonly reason: ZipRejection;
+    readonly detail?: string;
+    readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
+};
+/**
+ * Inflate a ZIP archive with bounds + OPC name normalization. Entry name, count, archive
+ * ratio, and total-uncompressed-size limits are enforced BEFORE each entry is decompressed
+ * (via fflate's pre-inflation filter), so a zip bomb or a traversal name is rejected without
+ * ever being inflated. Keys are canonical part names.
+ *
+ * The budgets count each entry's DECLARED sizes, and the declared size is also a hard cap on
+ * what the entry may produce: fflate inflates into a buffer of exactly `originalSize` bytes
+ * and never grows it, so an entry whose stream holds more than it declares is truncated (or
+ * refused as `inflate-error`), never expanded past its budget. A stored entry is copied at
+ * its compressed size, so the larger of its two declared sizes is what counts.
+ */
+declare function readZip(bytes: Uint8Array, limits?: ZipLimits): ZipReadResult;
+/** Deflate a set of canonical-part-name -> bytes into a ZIP archive. Every part name
+ *  is re-validated through the OPC normalization profile before writing, so a
+ *  traversal/encoded/normalized-alias name from an untrusted serialized model can
+ *  never be smuggled into a ZIP entry (write-side path-traversal guard). */
+declare function writeZip(entries: ReadonlyMap<string, Uint8Array>): Uint8Array;
+
 /**
  * Why a part or relationship name was refused.
  *
@@ -1128,91 +1178,6 @@ declare function resolveInternalTarget(ownerPartName: string, rawTarget: string)
  */
 declare function validateExternalTarget(raw: string): NameResult;
 
-/** One `<Default>`: a file extension mapped to a content type. */
-interface DefaultRecord {
-    readonly extension: string;
-    readonly contentType: string;
-    readonly order: number;
-}
-/** One `<Override>`: a specific part name mapped to a content type. Beats any Default. */
-interface OverrideRecord {
-    readonly partName: string;
-    readonly contentType: string;
-    readonly order: number;
-}
-/**
- * The authored `[Content_Types].xml` records, in significant order.
- *
- * Retained rather than collapsed into a lookup, because the file's lexical form and ordering are
- * part of what a lossless save re-emits.
- */
-interface ContentTypeRecords {
-    readonly defaults: readonly DefaultRecord[];
-    readonly overrides: readonly OverrideRecord[];
-}
-/**
- * Why content-type records could not be indexed.
- *
- * All fail CLOSED: conflicting Defaults on one extension, duplicate normalized Override names, or
- * invalid MIME syntax are refused rather than resolved by picking one.
- */
-type ContentTypeError = {
-    readonly code: 'invalid-mime';
-    readonly value: string;
-} | {
-    readonly code: 'conflicting-default';
-    readonly extension: string;
-} | {
-    readonly code: 'duplicate-override';
-    readonly partName: string;
-} | {
-    readonly code: 'invalid-override-name';
-    readonly partName: string;
-} | {
-    readonly code: 'too-many-records';
-    readonly limit: number;
-};
-/** Whether a string is syntactically a MIME type. Syntax only — no registry lookup. */
-declare function isValidMime(value: string): boolean;
-/** ASCII-case-insensitive extension key (leading dot removed; ASCII-only fold). */
-declare function extensionKey(extension: string): string;
-/** The resolved lookup: Override by case-folded part name, Default by case-insensitive extension. */
-interface ContentTypeIndex {
-    /** ext key -> single MIME (identical duplicates collapsed). */
-    readonly defaults: ReadonlyMap<string, string>;
-    /** case-folded part name -> MIME. */
-    readonly overrides: ReadonlyMap<string, string>;
-}
-/** The built index, or the conflict that made it impossible. */
-type IndexResult = {
-    readonly ok: true;
-    readonly index: ContentTypeIndex;
-} | {
-    readonly ok: false;
-    readonly error: ContentTypeError;
-};
-/**
- * Build a resolved content-type index, failing closed on conflict/duplicate/MIME
- * errors. `maxRecords` bounds the combined record count (N/N+1 gate).
- */
-declare function buildContentTypeIndex(records: ContentTypeRecords, maxRecords?: number): IndexResult;
-/**
- * A part's content type, or why it has none.
- *
- * An orphan record never determines a part's type — a Default with no matching part is preserved
- * inertly rather than applied.
- */
-type ResolveResult = {
-    readonly ok: true;
-    readonly contentType: string;
-    readonly source: 'override' | 'default';
-} | {
-    readonly ok: false;
-    readonly reason: 'unknown';
-};
-/** Resolve a part's content type: Override wins over Default; else unknown. */
-declare function resolveContentType(index: ContentTypeIndex, partName: string): ResolveResult;
-
 /** OOXML image relationship type for embedded or linked media parts. */
 declare const IMAGE_RELATIONSHIP_TYPE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/image";
 /**
@@ -1295,165 +1260,90 @@ type ImageRelationshipResolution = {
  */
 declare function resolveImageRelationship(records: readonly RelationshipRecord[] | undefined, ownerPart: string, relationshipId: string): ImageRelationshipResolution;
 
+/** One `<Default>`: a file extension mapped to a content type. */
+interface DefaultRecord {
+    readonly extension: string;
+    readonly contentType: string;
+    readonly order: number;
+}
+/** One `<Override>`: a specific part name mapped to a content type. Beats any Default. */
+interface OverrideRecord {
+    readonly partName: string;
+    readonly contentType: string;
+    readonly order: number;
+}
 /**
- * Why a zip was refused at the trust boundary.
+ * The authored `[Content_Types].xml` records, in significant order.
  *
- * `too-large` and `too-many-entries` are the zip-bomb guards; `bad-name` catches path traversal —
- * an entry with `..` or a leading `/` is rejected rather than normalized.
+ * Retained rather than collapsed into a lookup, because the file's lexical form and ordering are
+ * part of what a lossless save re-emits.
  */
-type ZipRejection = 'too-many-entries' | 'too-large' | 'bad-name' | 'inflate-error';
-/** Archive caps: entry count, total decompressed bytes, and the decompression ratio. */
-interface ZipLimits {
-    readonly maxEntries: number;
-    /** Max total UNCOMPRESSED bytes across the archive. */
-    readonly maxTotalBytes: number;
-    /** Max per-entry uncompressed:compressed ratio (zip-bomb guard). */
-    readonly maxRatio?: number;
+interface ContentTypeRecords {
+    readonly defaults: readonly DefaultRecord[];
+    readonly overrides: readonly OverrideRecord[];
 }
-/** The archive caps in force when a host configures none. Conservative and finite. */
-declare const DEFAULT_ZIP_LIMITS: ZipLimits;
-/** The read entries, or the typed refusal. Never throws — the bytes are untrusted. */
-type ZipReadResult = {
+/**
+ * Why content-type records could not be indexed.
+ *
+ * All fail CLOSED: conflicting Defaults on one extension, duplicate normalized Override names, or
+ * invalid MIME syntax are refused rather than resolved by picking one.
+ */
+type ContentTypeError = {
+    readonly code: 'invalid-mime';
+    readonly value: string;
+} | {
+    readonly code: 'conflicting-default';
+    readonly extension: string;
+} | {
+    readonly code: 'duplicate-override';
+    readonly partName: string;
+} | {
+    readonly code: 'invalid-override-name';
+    readonly partName: string;
+} | {
+    readonly code: 'too-many-records';
+    readonly limit: number;
+};
+/** Whether a string is syntactically a MIME type. Syntax only — no registry lookup. */
+declare function isValidMime(value: string): boolean;
+/** ASCII-case-insensitive extension key (leading dot removed; ASCII-only fold). */
+declare function extensionKey(extension: string): string;
+/** The resolved lookup: Override by case-folded part name, Default by case-insensitive extension. */
+interface ContentTypeIndex {
+    /** ext key -> single MIME (identical duplicates collapsed). */
+    readonly defaults: ReadonlyMap<string, string>;
+    /** case-folded part name -> MIME. */
+    readonly overrides: ReadonlyMap<string, string>;
+}
+/** The built index, or the conflict that made it impossible. */
+type IndexResult = {
     readonly ok: true;
-    readonly entries: ReadonlyMap<string, Uint8Array>;
+    readonly index: ContentTypeIndex;
 } | {
     readonly ok: false;
-    readonly reason: ZipRejection;
-    readonly detail?: string;
-    readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
+    readonly error: ContentTypeError;
 };
 /**
- * Inflate a ZIP archive with bounds + OPC name normalization. Entry name, count,
- * compression-ratio, and total-uncompressed-size limits are enforced BEFORE each
- * entry is decompressed (via fflate's pre-inflation filter), so a zip bomb or a
- * traversal name is rejected without ever being inflated. Keys are canonical part
- * names.
- */
-declare function readZip(bytes: Uint8Array, limits?: ZipLimits): ZipReadResult;
-/** Deflate a set of canonical-part-name -> bytes into a ZIP archive. Every part name
- *  is re-validated through the OPC normalization profile before writing, so a
- *  traversal/encoded/normalized-alias name from an untrusted serialized model can
- *  never be smuggled into a ZIP entry (write-side path-traversal guard). */
-declare function writeZip(entries: ReadonlyMap<string, Uint8Array>): Uint8Array;
-
-/** Only generated, escaped SVG and relationship slots; never authored markup. */
-type LegacyGraphicFragment = string | Readonly<{
-    relationshipId: string;
-    before: string;
-    after: string;
-    nativeCrop?: SourceCrop;
-}>;
-interface LegacyGraphicProjection {
-    readonly width: number;
-    readonly height: number;
-    readonly fragments: readonly LegacyGraphicFragment[];
-}
-
-/** Picture color adjustments shared by projection, layout, and paint.
- * @public
- */
-interface DrawingImageEffects {
-    /** Fixed alpha multiplier for raster painting; omitted means opaque. */
-    readonly opacity?: number;
-    readonly grayscale: boolean;
-    readonly brightness: number;
-    readonly contrast: number;
-    readonly bilevel?: number;
-}
-
-/** The relationship namespace `r:id` lives in. */
-declare const OFFICE_RELATIONSHIP_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
-/** The `Type` a hyperlink relationship declares. */
-declare const HYPERLINK_RELATIONSHIP_TYPE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink";
-/**
- * What a part's relationships answer for one `r:id`: the authored target and whether the
- * package declared it external. `null` for an id the part does not declare — a DANGLING
- * relationship, which is a real thing in real documents.
- */
-type RelationshipTargetResolver = (relationshipId: string) => {
-    readonly target: string;
-    readonly external: boolean;
-    /**
-     * The PACKAGE's own verdict on this target (`validateExternalTarget`): whether it is an
-     * absolute URI with a safe scheme.
-     *
-     * Carried separately because `sanitizeHref` cannot answer it. That function is a SCHEME
-     * allowlist and deliberately admits relative URLs — the right rule for a value the host
-     * authored, and the wrong one for a value a `.docx` did. A file-supplied
-     * `Target="/admin/delete-account"` has no scheme to refuse, so it would pass the
-     * allowlist and resolve against the EMBEDDING APPLICATION'S origin: a link reading
-     * "Company policy" that issues an authenticated same-origin request to whatever host
-     * app the editor is mounted in. Absent, a target is treated as unverified.
-     */
-    readonly sinkSafe?: boolean;
-} | null;
-/**
- * What a hyperlink points at, which decides what activating it may do.
- *
- * The security-relevant split: an `external` link goes through `sanitizeHref` and opens only on
- * explicit user action, while an anchor merely scrolls and never navigates.
- */
-type HyperlinkKind = 
-/** `r:id` → a relationship with `TargetMode="External"`. Opens somewhere else. */
-'external'
-/** `w:anchor` → a bookmark in this document. Scrolls, never navigates. */
- | 'internal'
-/**
- * `r:id` naming a relationship the part does not declare, or one that is not external.
- *
- * The link keeps its runs — the text is never lost twice — but there is nothing to
- * activate, so it paints inert exactly like a refused scheme.
+ * Build a resolved content-type index, failing closed on conflict/duplicate/MIME
+ * errors. `maxRecords` bounds the combined record count (N/N+1 gate).
  */
- | 'unresolved';
-/** A resolved hyperlink: its kind, its target, and the tooltip Word shows on hover. */
-interface HyperlinkTarget {
-    readonly kind: HyperlinkKind;
-    /**
-     * The authored target, verbatim: the relationship's `Target` for an `r:id` link, the
-     * anchor name for an internal one. Save re-emits from the tree, never from this — it is
-     * here so a UI can show what the document actually says.
-     */
-    readonly authored: string;
-    /**
-     * The sanitized runtime projection, or `null` when there is nothing safe to navigate to.
-     * The ONLY value permitted in a DOM `href`, `window.open`, or a copied link.
-     */
-    readonly href: string | null;
-    /** `w:anchor`, for an internal link. */
-    readonly anchor?: string;
-    /** `w:tooltip` — Word's hover text; paint puts it on the anchor's `title`. */
-    readonly tooltip?: string;
-    /** The authored `r:id`, so an edit can rewrite the relationship it names. */
-    readonly relationshipId?: string;
-}
-/** Whether a node is a typed `w:hyperlink`. */
-declare function isHyperlinkNode(node: OoxmlNode): boolean;
-/** A typed hyperlink's `w:anchor`, or undefined. */
-declare function hyperlinkAnchorOf(link: OoxmlNode): string | undefined;
-/** A typed hyperlink's `r:id`, or undefined. */
-declare function hyperlinkRelationshipIdOf(link: OoxmlNode): string | undefined;
+declare function buildContentTypeIndex(records: ContentTypeRecords, maxRecords?: number): IndexResult;
 /**
- * Read a typed `w:hyperlink` into its target record.
- *
- * `r:id` wins over `w:anchor` when a link carries both, matching Word: the relationship
- * names the document and the anchor names a place inside it, so the pair is a link to a
- * bookmark in ANOTHER file — which this engine will not follow, but whose external half is
- * the part that decides where it points.
+ * A part's content type, or why it has none.
  *
- * A link with neither is `unresolved`: it paints its runs and does nothing.
+ * An orphan record never determines a part's type — a Default with no matching part is preserved
+ * inertly rather than applied.
  */
-declare function hyperlinkTargetOf(link: OoxmlNode, resolve: RelationshipTargetResolver): HyperlinkTarget;
-
-interface DrawingProjectionLimits {
-    readonly maxCompatibilityBranches: number;
-    readonly maxVisitedElements: number;
-    readonly maxDrawingDepth: number;
-}
-interface DrawingDiagnostic {
-    readonly code: 'malformed-drawing' | 'unsupported-graphic' | 'unresolvable-frame' | 'invalid-geometry' | 'resource-refused' | 'wrap-polygon-over-limit' | 'wrap-polygon-malformed';
-    readonly nodeId: string;
-    readonly detail: string | null;
-}
+type ResolveResult = {
+    readonly ok: true;
+    readonly contentType: string;
+    readonly source: 'override' | 'default';
+} | {
+    readonly ok: false;
+    readonly reason: 'unknown';
+};
+/** Resolve a part's content type: Override wins over Default; else unknown. */
+declare function resolveContentType(index: ContentTypeIndex, partName: string): ResolveResult;
 
 type ShapeSchemeColorResolver = (scheme: string) => string | null;
 type ShapeStyleMatrixResolver = (kind: 'fill' | 'line', index: number) => OoxmlElement | null;
@@ -1542,6 +1432,11 @@ interface TextboxStoryProjection {
     readonly verticalAnchor: 'top' | 'center' | 'bottom';
     /** Autofit child of `wps:bodyPr`; extent stays authoritative either way (diagnostic only). */
     readonly autofit: 'none' | 'shape' | 'normal';
+    /**
+     * `wps:bodyPr/@wrap="none"` (VML `mso-wrap-style:none`): lines never wrap at the box edge,
+     * and the box takes the width of its widest line plus the insets. Absent for wrapped text.
+     */
+    readonly noWrap?: true;
     /** Solid fill of the hosting shape, painted behind the story; null for no fill. */
     readonly fillHex: string | null;
     /** Solid outline of the hosting shape; null for no outline. */
@@ -1550,6 +1445,145 @@ interface TextboxStoryProjection {
     readonly strokeWidthEmu: number;
 }
 
+/** Only generated, escaped SVG and relationship slots; never authored markup. */
+type LegacyGraphicFragment = string | Readonly<{
+    relationshipId: string;
+    before: string;
+    after: string;
+    nativeCrop?: SourceCrop;
+}>;
+interface LegacyGraphicProjection {
+    readonly width: number;
+    readonly height: number;
+    readonly fragments: readonly LegacyGraphicFragment[];
+}
+
+/** Picture color adjustments shared by projection, layout, and paint.
+ * @public
+ */
+interface DrawingImageEffects {
+    /** Fixed alpha multiplier for raster painting; omitted means opaque. */
+    readonly opacity?: number;
+    readonly grayscale: boolean;
+    readonly brightness: number;
+    readonly contrast: number;
+    readonly bilevel?: number;
+}
+
+/** One text box member of a drawing group. */
+interface GroupTextboxProjection {
+    /** Canonical node id of the member `wps:wsp`; namespaces the story's line ids. */
+    readonly memberNodeId: string;
+    /** The member box in the group's extent space, in EMU (origin at the extent's top-left). */
+    readonly frameEmu: Readonly<{
+        x: number;
+        y: number;
+        cx: number;
+        cy: number;
+    }>;
+    /** The member's story, projected at the scaled member size. */
+    readonly story: TextboxStoryProjection;
+    /**
+     * Clockwise turn of the member's text about the member box center, in degrees [0, 360):
+     * the member's `rot`, plus 180 for `flipV`. `flipH` never mirrors the text.
+     */
+    readonly rotationDegrees: number;
+}
+
+/** The relationship namespace `r:id` lives in. */
+declare const OFFICE_RELATIONSHIP_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
+/** The `Type` a hyperlink relationship declares. */
+declare const HYPERLINK_RELATIONSHIP_TYPE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink";
+/**
+ * What a part's relationships answer for one `r:id`: the authored target and whether the
+ * package declared it external. `null` for an id the part does not declare — a DANGLING
+ * relationship, which is a real thing in real documents.
+ */
+type RelationshipTargetResolver = (relationshipId: string) => {
+    readonly target: string;
+    readonly external: boolean;
+    /**
+     * The PACKAGE's own verdict on this target (`validateExternalTarget`): whether it is an
+     * absolute URI with a safe scheme.
+     *
+     * Carried separately because `sanitizeHref` cannot answer it. That function is a SCHEME
+     * allowlist and deliberately admits relative URLs — the right rule for a value the host
+     * authored, and the wrong one for a value a `.docx` did. A file-supplied
+     * `Target="/admin/delete-account"` has no scheme to refuse, so it would pass the
+     * allowlist and resolve against the EMBEDDING APPLICATION'S origin: a link reading
+     * "Company policy" that issues an authenticated same-origin request to whatever host
+     * app the editor is mounted in. Absent, a target is treated as unverified.
+     */
+    readonly sinkSafe?: boolean;
+} | null;
+/**
+ * What a hyperlink points at, which decides what activating it may do.
+ *
+ * The security-relevant split: an `external` link goes through `sanitizeHref` and opens only on
+ * explicit user action, while an anchor merely scrolls and never navigates.
+ */
+type HyperlinkKind = 
+/** `r:id` → a relationship with `TargetMode="External"`. Opens somewhere else. */
+'external'
+/** `w:anchor` → a bookmark in this document. Scrolls, never navigates. */
+ | 'internal'
+/**
+ * `r:id` naming a relationship the part does not declare, or one that is not external.
+ *
+ * The link keeps its runs — the text is never lost twice — but there is nothing to
+ * activate, so it paints inert exactly like a refused scheme.
+ */
+ | 'unresolved';
+/** A resolved hyperlink: its kind, its target, and the tooltip Word shows on hover. */
+interface HyperlinkTarget {
+    readonly kind: HyperlinkKind;
+    /**
+     * The authored target, verbatim: the relationship's `Target` for an `r:id` link, the
+     * anchor name for an internal one. Save re-emits from the tree, never from this — it is
+     * here so a UI can show what the document actually says.
+     */
+    readonly authored: string;
+    /**
+     * The sanitized runtime projection, or `null` when there is nothing safe to navigate to.
+     * The ONLY value permitted in a DOM `href`, `window.open`, or a copied link.
+     */
+    readonly href: string | null;
+    /** `w:anchor`, for an internal link. */
+    readonly anchor?: string;
+    /** `w:tooltip` — Word's hover text; paint puts it on the anchor's `title`. */
+    readonly tooltip?: string;
+    /** The authored `r:id`, so an edit can rewrite the relationship it names. */
+    readonly relationshipId?: string;
+}
+/** Whether a node is a typed `w:hyperlink`. */
+declare function isHyperlinkNode(node: OoxmlNode): boolean;
+/** A typed hyperlink's `w:anchor`, or undefined. */
+declare function hyperlinkAnchorOf(link: OoxmlNode): string | undefined;
+/** A typed hyperlink's `r:id`, or undefined. */
+declare function hyperlinkRelationshipIdOf(link: OoxmlNode): string | undefined;
+/**
+ * Read a typed `w:hyperlink` into its target record.
+ *
+ * `r:id` wins over `w:anchor` when a link carries both, matching Word: the relationship
+ * names the document and the anchor names a place inside it, so the pair is a link to a
+ * bookmark in ANOTHER file — which this engine will not follow, but whose external half is
+ * the part that decides where it points.
+ *
+ * A link with neither is `unresolved`: it paints its runs and does nothing.
+ */
+declare function hyperlinkTargetOf(link: OoxmlNode, resolve: RelationshipTargetResolver): HyperlinkTarget;
+
+interface DrawingProjectionLimits {
+    readonly maxCompatibilityBranches: number;
+    readonly maxVisitedElements: number;
+    readonly maxDrawingDepth: number;
+}
+interface DrawingDiagnostic {
+    readonly code: 'malformed-drawing' | 'unsupported-graphic' | 'unresolvable-frame' | 'invalid-geometry' | 'resource-refused' | 'wrap-polygon-over-limit' | 'wrap-polygon-malformed';
+    readonly nodeId: string;
+    readonly detail: string | null;
+}
+
 /** One picture painted as a member of a drawing group. */
 interface GroupPictureProjection {
     readonly embeddedRelationshipId: string | null;
@@ -1690,6 +1724,8 @@ interface DrawingProjection {
     /** The picture member of a `wpg:wgp` group; `picture` stays null for a group. */
     readonly groupPicture: GroupPictureProjection | null;
     readonly textboxStory: TextboxStoryProjection | null;
+    /** Text box members of a `wpg:wgp` group, laid out read-only; absent when none has text. */
+    readonly groupTextboxes?: readonly GroupTextboxProjection[];
     /** Read-only preview of the supported native VML subset; the canonical XML is untouched. */
     readonly legacyGraphic?: LegacyGraphicProjection;
     readonly locks: DrawingLocks;
@@ -1816,6 +1852,20 @@ type OoxmlPackageResult = {
     readonly detail?: string;
     readonly limit?: 'zip.maxTotalBytes' | 'zip.maxRatio';
 };
+/**
+ * Load DOCX bytes into canonical typed/generic OOXML trees, bounded at every step.
+ *
+ * THE trust boundary for a document. Composes the hardened primitives — zip limits and OPC name
+ * normalization, content-type indexing, relationship validation, entity-free XML — into one
+ * loader, and returns a typed rejection rather than throwing from inside a decoder.
+ *
+ * Fails closed on every limit, malformed name, unresolvable internal target, duplicate
+ * relationship id, and XML rejection. An external relationship never causes a failure and
+ * never causes a fetch: it is recorded with its sink-safety verdict for a later, explicitly
+ * user-gated lane. A content-type record with an invalid MIME type is treated as absent,
+ * unless it decides the type of the main document part, a relationships part, or a
+ * non-payload part that the package root or the main document relates to.
+ */
 declare function readOoxmlPackage(bytes: Uint8Array, limits?: OoxmlPackageLimits): OoxmlPackageResult;
 /**
  * Serialize a canonical package back to DOCX bytes.
@@ -1909,234 +1959,10 @@ declare function threadStateOfPart(part: OoxmlPart): Map<string, CommentThreadSt
 /**
  * Whether the package holds any `w:comment` record — the cheap gate before a reap.
  *
- * Overflow cannot prove the package is comment-free, so it returns true and the reap still
- * runs rather than skipping cleanup.
- */
-declare function hasAnyComment(pkg: OoxmlPackage): boolean;
-
-/** How deep controls may nest before a walk stops descending. Shared by every lane. */
-declare const MAX_CONTENT_CONTROL_NESTING = 32;
-/** Cap on controls one walk reports, so a hostile file cannot make a read unbounded. */
-declare const MAX_CONTENT_CONTROLS_PER_PART = 10000;
-/** `CT_SdtPr/w:id` is `ST_DecimalNumber`; Word treats it as a signed 32-bit integer. */
-declare const CONTENT_CONTROL_ID_MAX = 2147483647;
-/** `ST_Lock` (§17.5.2.24). An absent `w:lock` is `unlocked`. */
-/**
- * `w:lock` — what a control refuses.
- *
- * `sdtLocked` protects the wrapper, `contentLocked` the text inside it, and `sdtContentLocked`
- * both. A control inside a locked one is locked in effect regardless of its own value.
- */
-type ContentControlLock = 'unlocked' | 'sdtLocked' | 'contentLocked' | 'sdtContentLocked';
-/**
- * What kind of control this is.
- *
- * `checkbox` is the Microsoft `w14:checkbox` extension rather than an ECMA-376 type
- * element, and the two are not mutually exclusive with "declares no type": four controls
- * in the comprehensive fixture declare the extension and no `w:`-prefixed type, so a scan
- * that read only the ECMA-376 choice reported them untyped. `untyped` means the control
- * declares neither — a rich-text container, which is what Word treats it as.
- */
-/** Which kind of control a `w:sdt` is, and therefore what a written value must look like. */
-type ContentControlKind = 'richText' | 'plainText' | 'checkbox' | 'dropDownList' | 'comboBox' | 'date' | 'picture' | 'docPartObj' | 'docPartList' | 'group' | 'citation' | 'bibliography' | 'equation' | 'untyped';
-/** One declared option of a dropdown or combo box: its display text and its stored value. */
-interface ContentControlListItem {
-    readonly displayText: string;
-    readonly value: string;
-}
-/** A date picker's authored format and locale, for rendering and for parsing what it stores. */
-interface ContentControlDateFormat {
-    readonly fullDate?: string;
-    readonly dateFormat?: string;
-    readonly lid?: string;
-    readonly storeMappedDataAs?: string;
-    readonly calendar?: string;
-}
-/** One of a checkbox's two glyphs: the font and code point it is drawn with. */
-interface ContentControlCheckboxState {
-    /** The `w14:val` hex code point of the glyph, exactly as the control declares it. */
-    readonly value: string;
-    readonly font?: string;
-}
-/**
- * A checkbox's state and the two glyphs it chooses between.
- *
- * Both glyphs matter on a write: setting the value has to update `w14:checked` AND the run's
- * character, or the document's glyph and its recorded state disagree.
- */
-interface ContentControlCheckbox {
-    readonly checked: boolean;
-    readonly checkedState?: ContentControlCheckboxState;
-    readonly uncheckedState?: ContentControlCheckboxState;
-}
-/** `CT_DataBinding` — preserved metadata. Never resolved, never fetched. */
-/** `w:dataBinding` — the custom-XML part and XPath a control's value is bound to. */
-interface ContentControlDataBinding {
-    readonly xpath?: string;
-    readonly storeItemID?: string;
-    readonly prefixMappings?: string;
-}
-/**
- * A control's whole `w:sdtPr`, projected into one typed shape.
- *
- * What every other lane reads instead of walking `localName` strings — which also means a Word
- * re-save that demotes the properties node to generic does not break the projection.
- */
-interface ContentControlProperties {
-    readonly type: ContentControlKind;
-    readonly alias?: string;
-    readonly tag?: string;
-    /** `@w:val` of `w:id` when the file declares a parseable one. Never fabricated. */
-    readonly id?: number;
-    readonly lock: ContentControlLock;
-    /** The glossary entry named by `w:placeholder/w:docPart`. Preserved, never loaded. */
-    readonly placeholderDocPart?: string;
-    readonly temporary: boolean;
-    readonly showingPlaceholder: boolean;
-    readonly dataBinding?: ContentControlDataBinding;
-    readonly label?: string;
-    readonly tabIndex?: number;
-    /** Items a dropdown or combo box offers. Empty for every other type. */
-    readonly listItems: readonly ContentControlListItem[];
-    readonly lastValue?: string;
-    readonly date?: ContentControlDateFormat;
-    readonly multiLine?: boolean;
-    readonly checkbox?: ContentControlCheckbox;
-}
-/** Whether a node is a `w:sdt` wrapper. */
-declare function isContentControlNode(node: OoxmlNode): node is OoxmlContentControlNode;
-/** Whether a node is a `w:sdtContent` — the container holding a control's actual content. */
-declare function isContentControlContentNode(node: OoxmlNode): node is OoxmlContentControlContentNode;
-/**
- * A `w:sdt` wrapper, TYPED or DEMOTED.
- *
- * Flattening predates typing and must not stop at a control the reader refused to type: a
- * demoted wrapper still renders its content in place in Word, so a walk that only saw the
- * typed kind would drop every paragraph inside a malformed control out of the story.
- */
-declare function isContentControlWrapper(node: OoxmlNode): boolean;
-/**
- * The children of a wrapper's `w:sdtContent`, typed or demoted, in order.
- *
- * The one place that knows a control's content is reached through an intermediate element,
- * so the four flattening walks (story blocks, layout, header/footer references, list
- * resolution) ask the same question rather than each re-deriving it.
- */
-declare function contentControlContentChildren(wrapper: OoxmlNode): readonly OoxmlNode[];
-/**
- * A container's children with every content-control wrapper flattened away, bounded in depth.
- *
- * ONE unwrap rule, for the places where a control sits between a container and the children that
- * container is defined in terms of. `CT_SdtRow` puts it between `w:tbl` and `w:tr`, `CT_SdtCell`
- * between `w:tr` and `w:tc`, and a walk that filtered on the child's kind dropped the row or cell
- * entirely: not measured, not painted, not addressable. Flattening at the point of the filter
- * means a controlled row is the same row to the grid pass, the pagination pass and the story walk.
- *
- * Returns the SAME array identity when there is nothing to unwrap, so the tables that carry no
- * controls — nearly all of them — allocate nothing and the incremental layout cache still sees
- * its own inputs.
- */
-declare function flattenContentControls(children: readonly OoxmlNode[], maxDepth?: number): readonly OoxmlNode[];
-/** A control's `w:sdtPr`, or null. Matches structurally, so a Word-demoted node still resolves. */
-declare function contentControlPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlPropertiesNode | undefined;
-/** A control's `w:sdtEndPr` — the run properties applied to its closing marker. */
-declare function contentControlEndPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlEndPropertiesNode | undefined;
-/** A control's `w:sdtContent`, or null when the wrapper has none. */
-declare function contentControlContentNodeOf(control: OoxmlNode): OoxmlContentControlContentNode | undefined;
-/** A signed 32-bit `ST_DecimalNumber`, or undefined when the file wrote something else. */
-declare function parseContentControlId(raw: string | undefined): number | undefined;
-/**
- * Read a control's properties.
- *
- * Total: a control with no `w:sdtPr` at all answers the same shape with the defaults an
- * absent property means, so no caller has to branch on the container's existence.
- */
-declare function contentControlPropertiesOf(control: OoxmlNode): ContentControlProperties;
-/** Where a control sits, read off what its content holds. */
-type ContentControlLevel = 'block' | 'inline' | 'row' | 'cell' | 'empty';
-/**
- * How deeply a control is nested inside other controls.
- *
- * Bounded by {@link MAX_CONTENT_CONTROL_NESTING}: nesting depth comes from a file and is a
- * recursion bound.
- */
-declare function contentControlLevelOf(control: OoxmlNode): ContentControlLevel;
-/** One control, plus how deeply it is nested and the controls that enclose it. */
-interface ContentControlEntry {
-    readonly node: OoxmlContentControlNode;
-    /** 0 for a top-level control; the nesting depth otherwise. */
-    readonly depth: number;
-    /** Enclosing controls, outermost first. Empty at depth 0. */
-    readonly ancestors: readonly OoxmlContentControlNode[];
-}
-/**
- * Every control under a node, in document order, bounded in depth and in count.
- *
- * ONE walk, shared. The nesting bound is the same one layout flattens with, so a control
- * a lane can address is a control every lane can address — and a file that nests past it
- * keeps its content in the tree (the serializer never stops) while no walk recurses
- * further.
- */
-declare function contentControlsIn(root: OoxmlNode, options?: {
-    readonly maxDepth?: number;
-    readonly limit?: number;
-}): readonly ContentControlEntry[];
-/** Find one control by canonical node id, with the same bounded walk. */
-declare function findContentControl(root: OoxmlNode, nodeId: string): ContentControlEntry | null;
-/**
- * The plain text a control's content holds, in reading order.
- *
- * `w:delText` is excluded: struck text is not the control's value, and a dropdown whose
- * old item is still present as a tracked deletion would otherwise report both.
- */
-declare function contentControlTextOf(control: OoxmlNode): string;
-/**
- * Resolve the lock a position inherits from the controls enclosing it.
- *
- * CONSERVATIVE, because a template that says a field cannot be edited and sits inside a
- * section that says it cannot be removed means both. Each half of `ST_Lock` is taken
- * independently and the strongest wins, so an unlocked control inside a `contentLocked`
- * one is still content-locked — a nested control cannot grant a permission its parent
- * withheld, which is the only reading under which a lock is a lock.
- */
-declare function resolveContentControlLock(chain: readonly ContentControlLock[]): ContentControlLock;
-/** Whether a resolved lock forbids editing the content it covers. */
-declare function lockForbidsEdit(lock: ContentControlLock): boolean;
-/** Whether a resolved lock forbids removing the control itself. */
-declare function lockForbidsRemoval(lock: ContentControlLock): boolean;
-/**
- * `CT_SdtPr`'s declared child order (§17.5.2.38), followed by the type choice.
- *
- * Serialization re-emits children in tree order, so the ONLY way a write keeps the
- * sequence valid is to place the child it authors at its schema position — which is what
- * {@link orderedContentControlProperties} does.
- */
-declare const CONTENT_CONTROL_PROPERTY_ORDER: readonly string[];
-/**
- * Rebuild a `w:sdtPr`'s children in schema order.
- *
- * Modelled children sort to their declared position and the type element follows them,
- * as the sequence requires. Everything else — a `w15:repeatingSection`, a vendor
- * extension, the `w14:checkbox` that is not part of the ECMA-376 choice — keeps the order
- * it was authored in and follows the modelled block, so a write that touches one property
- * neither drops nor reorders anything it does not name.
- */
-declare function orderedContentControlProperties(children: readonly OoxmlNode[]): readonly OoxmlNode[];
-/**
- * The next `w:id` to write.
- *
- * Solo: one past the document's own maximum. Never a clock, a timestamp, a random source
- * or a hash: those collide with ids already in the file and produce values Word rejects.
- * Null when the document already reaches the signed 32-bit bound, so the caller refuses
- * rather than wrapping into a negative id. Hostile or out-of-range existing values are
- * ignored for seeding rather than counted past.
- *
- * When a collaboration actor is bound (explicit argument or the open store transaction),
- * the next id is the next unused value in that actor's stripe. Two peers inserting a
- * generic content control — including a custom node authored as `w:sdt` — from the same
- * snapshot then cannot share a `w:id`.
+ * Overflow cannot prove the package is comment-free, so it returns true and the reap still
+ * runs rather than skipping cleanup.
  */
-declare function allocateContentControlId(root: OoxmlNode, actorId?: string): number | null;
+declare function hasAnyComment(pkg: OoxmlPackage): boolean;
 
 /** A position in the model offset space of one story. */
 interface ReviewPosition {
@@ -2160,11 +1986,8 @@ interface ReviewRange {
  */
 type ReviewRevisionKind = 'insert' | 'delete'
 /**
- * A deletion and an insertion that are one edit: text typed over a selection.
- *
- * Word shows these as a single `Replaced "x" with "y"` card, and resolving one half
- * without the other is never what the reviewer meant — accepting the deletion alone
- * leaves the replacement text unproposed, rejecting it alone leaves both.
+ * A combined deletion and insertion decision. The built-in reader lists them separately,
+ * unless a review query asks to pair replacements or a custom review provider combines them.
  */
  | 'replace' | 'moveFrom' | 'moveTo'
 /** `w:rPrChange` / `w:pPrChange` — the words are unchanged, their formatting is not. */
@@ -2181,14 +2004,14 @@ type ReviewRevisionKind = 'insert' | 'delete'
  */
 interface ReviewRevisionItem {
     readonly kind: 'revision';
-    /** Stable across renders and unique per DECISION, not per site. */
+    /** Stable across renders and unique per decision within this editor instance. */
     readonly id: string;
     /** The payload `acceptRevision` / `rejectRevision` take. */
     readonly address: RevisionAddress;
     /**
      * EVERY address this decision covers, `address` first.
      *
-     * Replacements, table fragments, and adjacent formatting changes can combine multiple
+     * Adjacent text fragments, table fragments, and formatting changes can combine multiple
      * original revisions into one decision. Review commands resolve the complete decision
      * in one transaction while preserving independent changes outside the group.
      */
@@ -2202,8 +2025,11 @@ interface ReviewRevisionItem {
     readonly structuralChanges?: readonly ('rowInsert' | 'rowDelete' | 'cellInsert' | 'cellDelete' | 'cellMerge' | 'numberingInsert')[];
     /** Changed direct formatting values, ready for localized review summaries. */
     readonly formattingChanges?: readonly {
-        readonly property: 'bold' | 'italic' | 'underline' | 'strike' | 'fontFamily' | 'fontSize' | 'color' | 'alignment' | 'leftIndent' | 'rightIndent' | 'firstLineIndent' | 'hangingIndent' | 'spaceBefore' | 'spaceAfter';
-        /** New direct value; null means inherit. Sizes and distances are in points. */
+        readonly property: 'bold' | 'italic' | 'underline' | 'strike' | 'fontFamily' | 'fontSize' | 'color' | 'alignment' | 'leftIndent' | 'rightIndent' | 'firstLineIndent' | 'hangingIndent' | 'spaceBefore' | 'spaceAfter' | 'direction';
+        /**
+         * New direct value; null means inherit. Sizes and distances are in points. A direction is
+         * `rtl` or `ltr`.
+         */
         readonly value: string | null;
     }[];
     /** Newly applied proofing language codes in a tracked formatting change. */
@@ -2310,7 +2136,8 @@ interface ReviewCustomItem {
      *
      * False for a definition with no `reviewCard`: the item exists so the chip's own surfaces can
      * read `attrs`, `text` and `data` off it, and the rail leaves it out. A surface listing cards
-     * filters on this rather than on an empty `title`.
+     * filters on this rather than on an empty `title`. An uncarded node never becomes the active
+     * review item, so it never shows the active highlight.
      */
     readonly carded: boolean;
     /** Card title, from the definition's `reviewCard` hook. Empty when `carded` is false. */
@@ -2432,6 +2259,233 @@ declare function activeReviewItem(items: readonly ReviewItem[], position: Review
  */
 declare function reviewThreadRootOf(items: readonly ReviewItem[], comment: ReviewCommentItem): ReviewItem;
 
+/** How deep controls may nest before a walk stops descending. Shared by every lane. */
+declare const MAX_CONTENT_CONTROL_NESTING = 32;
+/** Cap on controls one walk reports, so a hostile file cannot make a read unbounded. */
+declare const MAX_CONTENT_CONTROLS_PER_PART = 10000;
+/** `CT_SdtPr/w:id` is `ST_DecimalNumber`; Word treats it as a signed 32-bit integer. */
+declare const CONTENT_CONTROL_ID_MAX = 2147483647;
+/** `ST_Lock` (§17.5.2.24). An absent `w:lock` is `unlocked`. */
+/**
+ * `w:lock` — what a control refuses.
+ *
+ * `sdtLocked` protects the wrapper, `contentLocked` the text inside it, and `sdtContentLocked`
+ * both. A control inside a locked one is locked in effect regardless of its own value.
+ */
+type ContentControlLock = 'unlocked' | 'sdtLocked' | 'contentLocked' | 'sdtContentLocked';
+/**
+ * What kind of control this is.
+ *
+ * `checkbox` is the Microsoft `w14:checkbox` extension rather than an ECMA-376 type
+ * element, and the two are not mutually exclusive with "declares no type": four controls
+ * in the comprehensive fixture declare the extension and no `w:`-prefixed type, so a scan
+ * that read only the ECMA-376 choice reported them untyped. `untyped` means the control
+ * declares neither — a rich-text container, which is what Word treats it as.
+ */
+/** Which kind of control a `w:sdt` is, and therefore what a written value must look like. */
+type ContentControlKind = 'richText' | 'plainText' | 'checkbox' | 'dropDownList' | 'comboBox' | 'date' | 'picture' | 'docPartObj' | 'docPartList' | 'group' | 'citation' | 'bibliography' | 'equation' | 'untyped';
+/** One declared option of a dropdown or combo box: its display text and its stored value. */
+interface ContentControlListItem {
+    readonly displayText: string;
+    readonly value: string;
+}
+/** A date picker's authored format and locale, for rendering and for parsing what it stores. */
+interface ContentControlDateFormat {
+    readonly fullDate?: string;
+    readonly dateFormat?: string;
+    readonly lid?: string;
+    readonly storeMappedDataAs?: string;
+    readonly calendar?: string;
+}
+/** One of a checkbox's two glyphs: the font and code point it is drawn with. */
+interface ContentControlCheckboxState {
+    /** The `w14:val` hex code point of the glyph, exactly as the control declares it. */
+    readonly value: string;
+    readonly font?: string;
+}
+/**
+ * A checkbox's state and the two glyphs it chooses between.
+ *
+ * Both glyphs matter on a write: setting the value has to update `w14:checked` AND the run's
+ * character, or the document's glyph and its recorded state disagree.
+ */
+interface ContentControlCheckbox {
+    readonly checked: boolean;
+    readonly checkedState?: ContentControlCheckboxState;
+    readonly uncheckedState?: ContentControlCheckboxState;
+}
+/** `CT_DataBinding` — preserved metadata. Never resolved, never fetched. */
+/** `w:dataBinding` — the custom-XML part and XPath a control's value is bound to. */
+interface ContentControlDataBinding {
+    readonly xpath?: string;
+    readonly storeItemID?: string;
+    readonly prefixMappings?: string;
+}
+/**
+ * A control's whole `w:sdtPr`, projected into one typed shape.
+ *
+ * What every other lane reads instead of walking `localName` strings — which also means a Word
+ * re-save that demotes the properties node to generic does not break the projection.
+ */
+interface ContentControlProperties {
+    readonly type: ContentControlKind;
+    readonly alias?: string;
+    readonly tag?: string;
+    /** `@w:val` of `w:id` when the file declares a parseable one. Never fabricated. */
+    readonly id?: number;
+    readonly lock: ContentControlLock;
+    /** The glossary entry named by `w:placeholder/w:docPart`. Preserved, never loaded. */
+    readonly placeholderDocPart?: string;
+    readonly temporary: boolean;
+    readonly showingPlaceholder: boolean;
+    readonly dataBinding?: ContentControlDataBinding;
+    readonly label?: string;
+    readonly tabIndex?: number;
+    /** Items a dropdown or combo box offers. Empty for every other type. */
+    readonly listItems: readonly ContentControlListItem[];
+    readonly lastValue?: string;
+    readonly date?: ContentControlDateFormat;
+    readonly multiLine?: boolean;
+    readonly checkbox?: ContentControlCheckbox;
+}
+/** Whether a node is a `w:sdt` wrapper. */
+declare function isContentControlNode(node: OoxmlNode): node is OoxmlContentControlNode;
+/** Whether a node is a `w:sdtContent` — the container holding a control's actual content. */
+declare function isContentControlContentNode(node: OoxmlNode): node is OoxmlContentControlContentNode;
+/**
+ * A `w:sdt` wrapper, TYPED or DEMOTED.
+ *
+ * Flattening predates typing and must not stop at a control the reader refused to type: a
+ * demoted wrapper still renders its content in place in Word, so a walk that only saw the
+ * typed kind would drop every paragraph inside a malformed control out of the story.
+ */
+declare function isContentControlWrapper(node: OoxmlNode): boolean;
+/**
+ * The children of a wrapper's `w:sdtContent`, typed or demoted, in order.
+ *
+ * The one place that knows a control's content is reached through an intermediate element,
+ * so the four flattening walks (story blocks, layout, header/footer references, list
+ * resolution) ask the same question rather than each re-deriving it.
+ */
+declare function contentControlContentChildren(wrapper: OoxmlNode): readonly OoxmlNode[];
+/**
+ * A container's children with every content-control wrapper flattened away, bounded in depth.
+ *
+ * ONE unwrap rule, for the places where a control sits between a container and the children that
+ * container is defined in terms of. `CT_SdtRow` puts it between `w:tbl` and `w:tr`, `CT_SdtCell`
+ * between `w:tr` and `w:tc`, and a walk that filtered on the child's kind dropped the row or cell
+ * entirely: not measured, not painted, not addressable. Flattening at the point of the filter
+ * means a controlled row is the same row to the grid pass, the pagination pass and the story walk.
+ *
+ * Returns the SAME array identity when there is nothing to unwrap, so the tables that carry no
+ * controls — nearly all of them — allocate nothing and the incremental layout cache still sees
+ * its own inputs.
+ */
+declare function flattenContentControls(children: readonly OoxmlNode[], maxDepth?: number): readonly OoxmlNode[];
+/** A control's `w:sdtPr`, or null. Matches structurally, so a Word-demoted node still resolves. */
+declare function contentControlPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlPropertiesNode | undefined;
+/** A control's `w:sdtEndPr` — the run properties applied to its closing marker. */
+declare function contentControlEndPropertiesNodeOf(control: OoxmlNode): OoxmlContentControlEndPropertiesNode | undefined;
+/** A control's `w:sdtContent`, or null when the wrapper has none. */
+declare function contentControlContentNodeOf(control: OoxmlNode): OoxmlContentControlContentNode | undefined;
+/** A signed 32-bit `ST_DecimalNumber`, or undefined when the file wrote something else. */
+declare function parseContentControlId(raw: string | undefined): number | undefined;
+/**
+ * Read a control's properties.
+ *
+ * Total: a control with no `w:sdtPr` at all answers the same shape with the defaults an
+ * absent property means, so no caller has to branch on the container's existence.
+ */
+declare function contentControlPropertiesOf(control: OoxmlNode): ContentControlProperties;
+/** Where a control sits, read off what its content holds. */
+type ContentControlLevel = 'block' | 'inline' | 'row' | 'cell' | 'empty';
+/**
+ * How deeply a control is nested inside other controls.
+ *
+ * Bounded by {@link MAX_CONTENT_CONTROL_NESTING}: nesting depth comes from a file and is a
+ * recursion bound.
+ */
+declare function contentControlLevelOf(control: OoxmlNode): ContentControlLevel;
+/** One control, plus how deeply it is nested and the controls that enclose it. */
+interface ContentControlEntry {
+    readonly node: OoxmlContentControlNode;
+    /** 0 for a top-level control; the nesting depth otherwise. */
+    readonly depth: number;
+    /** Enclosing controls, outermost first. Empty at depth 0. */
+    readonly ancestors: readonly OoxmlContentControlNode[];
+}
+/**
+ * Every control under a node, in document order, bounded in depth and in count.
+ *
+ * ONE walk, shared. The nesting bound is the same one layout flattens with, so a control
+ * a lane can address is a control every lane can address — and a file that nests past it
+ * keeps its content in the tree (the serializer never stops) while no walk recurses
+ * further.
+ */
+declare function contentControlsIn(root: OoxmlNode, options?: {
+    readonly maxDepth?: number;
+    readonly limit?: number;
+}): readonly ContentControlEntry[];
+/** Find one control by canonical node id, with the same bounded walk. */
+declare function findContentControl(root: OoxmlNode, nodeId: string): ContentControlEntry | null;
+/**
+ * The plain text a control's content holds, in reading order.
+ *
+ * `w:delText` is excluded: struck text is not the control's value, and a dropdown whose
+ * old item is still present as a tracked deletion would otherwise report both.
+ *
+ * A manual line break is left out unless `lineBreak` names the text to report it as.
+ * With that option, column breaks report U+000E so callers cannot silently discard them.
+ */
+declare function contentControlTextOf(control: OoxmlNode, lineBreak?: string): string;
+/**
+ * Resolve the lock a position inherits from the controls enclosing it.
+ *
+ * CONSERVATIVE, because a template that says a field cannot be edited and sits inside a
+ * section that says it cannot be removed means both. Each half of `ST_Lock` is taken
+ * independently and the strongest wins, so an unlocked control inside a `contentLocked`
+ * one is still content-locked — a nested control cannot grant a permission its parent
+ * withheld, which is the only reading under which a lock is a lock.
+ */
+declare function resolveContentControlLock(chain: readonly ContentControlLock[]): ContentControlLock;
+/** Whether a resolved lock forbids editing the content it covers. */
+declare function lockForbidsEdit(lock: ContentControlLock): boolean;
+/** Whether a resolved lock forbids removing the control itself. */
+declare function lockForbidsRemoval(lock: ContentControlLock): boolean;
+/**
+ * `CT_SdtPr`'s declared child order (§17.5.2.38), followed by the type choice.
+ *
+ * Serialization re-emits children in tree order, so the ONLY way a write keeps the
+ * sequence valid is to place the child it authors at its schema position — which is what
+ * {@link orderedContentControlProperties} does.
+ */
+declare const CONTENT_CONTROL_PROPERTY_ORDER: readonly string[];
+/**
+ * Rebuild a `w:sdtPr`'s children in schema order.
+ *
+ * Modelled children sort to their declared position and the type element follows them,
+ * as the sequence requires. Everything else — a `w15:repeatingSection`, a vendor
+ * extension, the `w14:checkbox` that is not part of the ECMA-376 choice — keeps the order
+ * it was authored in and follows the modelled block, so a write that touches one property
+ * neither drops nor reorders anything it does not name.
+ */
+declare function orderedContentControlProperties(children: readonly OoxmlNode[]): readonly OoxmlNode[];
+/**
+ * The next `w:id` to write.
+ *
+ * Solo: one past the document's own maximum. Never a clock, a timestamp, a random source
+ * or a hash: those collide with ids already in the file and produce values Word rejects.
+ * Null when the document already reaches the signed 32-bit bound, so the caller refuses
+ * rather than wrapping into a negative id. Hostile or out-of-range existing values are
+ * ignored for seeding rather than counted past.
+ *
+ * When a collaboration actor is bound (explicit argument or the open store transaction),
+ * the next id is the next unused value in that actor's stripe. Two peers inserting a
+ * generic content control — including a custom node authored as `w:sdt` — from the same
+ * snapshot then cannot share a `w:id`.
+ */
+declare function allocateContentControlId(root: OoxmlNode, actorId?: string): number | null;
+
 /** The value a control accepts, by what kind of control it is. */
 type ContentControlValueInput = {
     readonly kind: 'text';
@@ -2485,6 +2539,48 @@ declare function planRevisionBatch(part: OoxmlPart, action: 'accept' | 'reject',
     result: RevisionBatchResult;
 };
 
+/** Why a requested change keeps its attribution. @public */
+type RevisionAuthorSkipReason = 'unknown-revision' | 'unsupported-revision';
+/**
+ * One reattributed change. `key` and `author` describe the change after the update, because
+ * review keys include the author. @public
+ */
+interface RevisionAuthorEntry extends RevisionBatchEntry {
+    /**
+     * The key the caller selected the change by. It differs from `key` when the attribution
+     * changed, because review keys include the author and date.
+     */
+    readonly previousKey: string;
+    /** The author the change had before the update. */
+    readonly previousAuthor: string;
+}
+/** Outcome of one attribution change. Counts refer to review decisions, not XML markers. @public */
+interface RevisionAuthorResult {
+    /** Changes that now carry the requested attribution, in selection order. */
+    readonly updated: readonly RevisionAuthorEntry[];
+    /** Requested changes that kept their attribution. */
+    readonly skipped: readonly {
+        readonly key: string;
+        readonly reason: RevisionAuthorSkipReason;
+        readonly revision?: RevisionBatchEntry;
+    }[];
+}
+/** A planned attribution change: its ops, and how to name the result once they commit. */
+interface RevisionAuthorPlan {
+    readonly ops: readonly TreeDocOp[];
+    /** The outcome before commit. Updated entries still carry their previous keys. */
+    readonly result: RevisionAuthorResult;
+    /** The outcome against the committed part, with each updated change under its new key. */
+    finish(after: OoxmlPart): RevisionAuthorResult;
+}
+/**
+ * Plan an attribution change for selected review keys. Omitted keys select every change.
+ * `authors` keeps only the changes those authors made.
+ * Callers validate `revision` with `invalidRevisionAuthorInput` first.
+ * @internal
+ */
+declare function planRevisionAuthorChange(part: OoxmlPart, revision: RevisionAttributionInput, keys?: readonly string[], scopeRoot?: OoxmlNode, authors?: readonly string[]): RevisionAuthorPlan;
+
 /** Allowlisted OOXML table border line styles — store/layout authority. */
 declare const TABLE_BORDER_STYLES: readonly ['single', 'dashed', 'dotted', 'double', 'triple', 'thick'];
 /**
@@ -2630,8 +2726,11 @@ interface DocRange {
  */
 type ExecResult = {
     ok: true;
+    /** Whether the DOCUMENT changed; view-only calls (pane, activation, mode) always report `false`. */
     changed: boolean;
     revisions?: RevisionBatchResult;
+    /** Present on `setReviewChangesAuthor`: the changes it updated and the ones it skipped. */
+    revisionAuthors?: RevisionAuthorResult;
     history?: HistoryGroupOutcome;
 } | {
     ok: false;
@@ -2639,6 +2738,7 @@ type ExecResult = {
     reason: string;
     target?: DocTarget;
     revisions?: RevisionBatchResult;
+    revisionAuthors?: RevisionAuthorResult;
 };
 /**
  * Why a write was refused, as a value to branch on.
@@ -3244,6 +3344,18 @@ type TreeDocOp = SetFieldCodeOp | {
     readonly siteNodeIds?: readonly string[];
     /** Internal shared-notes scope. When present, this must be the canonical id of a note root. */
     readonly scopeRootId?: string;
+} | {
+    /**
+     * Attribute pending revisions to another author, and optionally another date, without
+     * deciding them. `sites` name revision elements and move range starts. Sites sharing a
+     * `renumber` label take one fresh `w:id`, so the change cannot merge with another one.
+     */
+    readonly op: 'setRevisionAttribution';
+    readonly revision: RevisionAttributionInput;
+    readonly sites: readonly {
+        readonly nodeId: string;
+        readonly renumber?: string;
+    }[];
 } | {
     readonly op: 'rejectAllRevisions';
     /** Exact canonical sites selected by bulk preflight. */
@@ -4057,7 +4169,19 @@ type TreeOpRejection = 'unknown-op' | 'unknown-paragraph' | 'not-a-paragraph' |
  * a real offset that is not a PLACE — refused rather than resolved to the nearest one, so a
  * caller learns the node would not have landed where they asked.
  */
- | 'indivisible-content' | 'unknown-block' | 'not-a-block' | 'block-required' | 'carries-section-mark'
+ | 'indivisible-content'
+/**
+ * The range has one end inside a field's editable saved result and the other outside it.
+ * Deleting it would leave the field's begin, separate, and end markers unbalanced, so it is
+ * refused. A range that covers the whole field removes the field.
+ */
+ | 'field-structure'
+/**
+ * In the editable field-result mode, an op other than typing, deletion, or run formatting
+ * addresses a position inside a field's saved result. Splits, tabs, links, notes, and
+ * fragments there are not supported yet.
+ */
+ | 'field-result-unsupported' | 'unknown-block' | 'not-a-block' | 'block-required' | 'carries-section-mark'
 /** The transaction named a part the package does not hold. */
  | 'unknown-part'
 /**
@@ -4141,5 +4265,5 @@ type TreeOpResult = {
     readonly detail?: string;
 };
 
-export { IMAGE_WRAP_TARGETS as aE, TEXT_FORM_FORMATS as aF, ACCEPTED_PARAGRAPH_PROPERTIES as aW, ACCEPTED_RUN_PROPERTIES as aX, CONTENT_CONTROL_ID_MAX as aY, CONTENT_CONTROL_PROPERTY_ORDER as aZ, DEFAULT_OOXML_PACKAGE_LIMITS as be, DEFAULT_ZIP_LIMITS as bf, HYPERLINK_RELATIONSHIP_TYPE as bi, IMAGE_RELATIONSHIP_TYPE as bl, MAX_CONTENT_CONTROLS_PER_PART as br, MAX_CONTENT_CONTROL_NESTING as bs, OFFICE_RELATIONSHIP_NAMESPACE_URI as bv, OOXML_NODE_IDENTITY_RULES as bw, isContentControlWrapper as c$, allocateContentControlId as cA, asciiFold as cB, buildContentTypeIndex as cC, buildRelationshipSet as cD, childElements as cE, commentAnchorsOfStory as cF, commentsOfPart as cG, contentControlContentChildren as cH, contentControlContentNodeOf as cI, contentControlEndPropertiesNodeOf as cJ, contentControlLevelOf as cK, contentControlPropertiesNodeOf as cL, contentControlPropertiesOf as cM, contentControlTextOf as cN, contentControlsIn as cO, detectDuplicateNames as cP, extensionKey as cQ, findContentControl as cR, findElement as cS, firstReviewRange as cT, flattenContentControls as cU, hasAnyComment as cV, hyperlinkAnchorOf as cW, hyperlinkRelationshipIdOf as cX, hyperlinkTargetOf as cY, isContentControlContentNode as cZ, isContentControlNode as c_, TABLE_BORDER_STYLES as ch, W15_NAMESPACE_URI as cp, WML_NAMESPACE_URI as cq, XMLNS_NAMESPACE_URI as cr, XML_NAMESPACE_URI as cs, isContentRevisionKind as d0, isHyperlinkNode as d1, isRangeMarkerKind as d2, isValidMime as d3, legacyCheckboxFieldsOf as d4, lockForbidsEdit as d5, lockForbidsRemoval as d6, normalizePartName as d7, orderedContentControlProperties as d8, parseContentControlId as d9, reviewItemsAt as dA, reviewThreadRootOf as dB, partNameKey as da, planRevisionBatch as db, projectDrawing as dc, readOnOffChild as dd, readOoxmlPackage as de, readOoxmlPart as df, readXml as dg, readZip as dh, resolveContentControlLock as di, resolveContentType as dj, resolveImageRelationship as dk, resolveInternalTarget as dl, resolveRelationship as dm, reviewItemKey as dn, reviewItemRanges as dp, textContent as dq, textFormFieldsOf as dr, threadStateOfPart as ds, validateExternalTarget as dt, withPart as du, writeOoxmlPackage as dv, writeZip as dw, activeReviewItem as dy, reviewItemPositionRank as dz };
-export type { OoxmlContentControlContentNode as $, ParagraphTabStop as A, Block as B, CommentRecord as C, DocxDocument as D, ExecResult as E, RevisionType as F, Section as G, HeaderFooterSet as H, InsertableContentControlType as I, SectionProperties as J, StyleDefinition as K, Theme as L, ThemeColorScheme as M, OoxmlNode as N, OoxmlPart as O, Paragraph as P, OoxmlPackage as Q, ReviewModelInput as R, StyleDefinitions as S, Table as T, OoxmlNodeId as U, OoxmlGenericElementNode as V, TreeDocOp as W, OoxmlProperty as X, OoxmlPackageRejection as Y, OoxmlElement as Z, OoxmlContentControlNode as _, ReviewItem as a, CommentPosition as a$, DrawingProjection as a0, OoxmlPackageLimits as a1, RevisionBatchEntry as a2, RevisionBatchResult as a3, RevisionBatchSkipReason as a4, TreeOpRejection as a5, AutomationTableMutation as a6, RevisionAttributionInput as a7, SourceCrop as a8, DrawingKind as a9, OoxmlSeparatorNode as aA, DrawingTreeDocOp as aB, ImpactClass as aC, TreeDocColorValue as aD, TableBorderStyle as aG, DrawingAccessibility as aH, DrawingImageEffects as aI, DrawingTransform as aJ, VectorShapeProjection as aK, OoxmlDrawingNode as aL, OoxmlInvariantResult as aM, OoxmlFldCharNode as aN, OoxmlFldSimpleNode as aO, OoxmlInstrTextNode as aP, OoxmlInvariantIssue as aQ, TreeOpResult as aR, RelationshipRecord as aS, OoxmlHardBreakNode as aT, OoxmlAttribute as aU, CommentThreadState as aV, CommentAnchor as a_, ImageWrapTarget as aa, DrawingPositionInput as ab, DrawingLocks as ac, ParagraphFormatCommand as ad, Watermark as ae, Rect as af, SelectionPin as ag, Unsubscribe as ah, DocxDocumentJSON as ai, DrawingHorizontalReferenceFrame as aj, DrawingVerticalReferenceFrame as ak, FontDefinition as al, NumberingRef as am, PageMargins as an, ParagraphDisagreements as ao, Point as ap, Run as aq, TableCell as ar, TableRow as as, OoxmlParagraphNode as at, OoxmlNoteNode as au, OoxmlContinuationSeparatorNode as av, OoxmlEndnotesNode as aw, OoxmlFootnotesNode as ax, OoxmlNoteRefNode as ay, OoxmlNoteReferenceNode as az, ReviewRevisionItem as b, OoxmlReadRejection as b$, CommitTextFormFieldOp as b0, ContentControlCheckbox as b1, ContentControlCheckboxState as b2, ContentControlDataBinding as b3, ContentControlDateFormat as b4, ContentControlEntry as b5, ContentControlKind as b6, ContentControlLevel as b7, ContentControlListItem as b8, ContentControlLock as b9, OoxmlContentControlCalendarNode as bA, OoxmlContentControlCheckboxNode as bB, OoxmlContentControlCheckedNode as bC, OoxmlContentControlCheckedStateNode as bD, OoxmlContentControlComboBoxNode as bE, OoxmlContentControlDataBindingNode as bF, OoxmlContentControlDateFormatNode as bG, OoxmlContentControlDateNode as bH, OoxmlContentControlDropDownListNode as bI, OoxmlContentControlEndPropertiesNode as bJ, OoxmlContentControlLidNode as bK, OoxmlContentControlListItemNode as bL, OoxmlContentControlPropertiesNode as bM, OoxmlContentControlStoreMappedDataAsNode as bN, OoxmlContentControlTextNode as bO, OoxmlContentControlUncheckedStateNode as bP, OoxmlDocumentNode as bQ, OoxmlExternalTarget as bR, OoxmlGenericExtensionAttribute as bS, OoxmlHyperlinkNode as bT, OoxmlInvariantIssueCode as bU, OoxmlKnownNodeAttribute as bV, OoxmlNamespaceBinding as bW, OoxmlNodeIdentityRules as bX, OoxmlPackageResult as bY, OoxmlParagraphPropertiesNode as bZ, OoxmlPartMetadata as b_, ContentControlProperties as ba, ContentTypeError as bb, ContentTypeIndex as bc, ContentTypeRecords as bd, DefaultRecord as bg, DeleteTextOp as bh, HyperlinkKind as bj, HyperlinkTarget as bk, ImageRelationshipResolution as bm, IndexResult as bn, InsertBuildingBlockOp as bo, InsertTextOp as bp, LegacyCheckboxFieldRange as bq, NameRejection as bt, NameResult as bu, OoxmlBodyNode as bx, OoxmlBookmarkEndNode as by, OoxmlBookmarkStartNode as bz, ReviewCommentItem as c, OoxmlReadResult as c0, OoxmlRunNode as c1, OoxmlRunPropertiesNode as c2, OoxmlTabNode as c3, OoxmlTextElementNode as c4, OoxmlTextNode as c5, OoxmlWmlValAttribute as c6, OoxmlXmlSpaceAttribute as c7, OverrideRecord as c8, RelationshipError as c9, RelationshipSetResult as ca, RelationshipTargetResolver as cb, ResolveResult as cc, ResolvedRelationship as cd, SetLegacyCheckboxOp as ce, SetLegacyDropdownOp as cf, SetTextFormFieldDefaultOp as cg, TabStopWrite as ci, TargetMode as cj, TextFormFieldOptions as ck, TextFormFieldRange as cl, TextFormFieldType as cm, TreeDocOpKind as cn, TreeOpEffect as co, XmlLimits as ct, XmlNode as cu, XmlRejection as cv, XmlResult as cw, ZipLimits as cx, ZipReadResult as cy, ZipRejection as cz, ReviewCustomItem as d, VectorShapeComponent as dx, ReviewPosition as e, ReviewRange as f, ReviewRevisionKind as g, RevisionAddress as h, ContentControlType as i, DocTarget as j, RunFormatting as k, Extent as l, ContainerRef as m, ContentControlFilter as n, DocRange as o, Revision as p, DocComment as q, ColorValue as r, ContentControl as s, DocAnchor as t, DocAnchorRange as u, DocLocation as v, DocumentBody as w, ExecErrorCode as x, IndentFormatting as y, ParagraphFlags as z };
+export { CONTENT_CONTROL_ID_MAX as a$, IMAGE_WRAP_TARGETS as aH, TEXT_FORM_FORMATS as aI, ACCEPTED_PARAGRAPH_PROPERTIES as aZ, ACCEPTED_RUN_PROPERTIES as a_, CONTENT_CONTROL_PROPERTY_ORDER as b0, DEFAULT_OOXML_PACKAGE_LIMITS as bh, DEFAULT_ZIP_LIMITS as bi, HYPERLINK_RELATIONSHIP_TYPE as bl, IMAGE_RELATIONSHIP_TYPE as bo, MAX_CONTENT_CONTROLS_PER_PART as bu, MAX_CONTENT_CONTROL_NESTING as bv, OFFICE_RELATIONSHIP_NAMESPACE_URI as by, OOXML_NODE_IDENTITY_RULES as bz, hyperlinkTargetOf as c$, allocateContentControlId as cD, asciiFold as cE, buildContentTypeIndex as cF, buildRelationshipSet as cG, childElements as cH, commentAnchorsOfStory as cI, commentsOfPart as cJ, contentControlContentChildren as cK, contentControlContentNodeOf as cL, contentControlEndPropertiesNodeOf as cM, contentControlLevelOf as cN, contentControlPropertiesNodeOf as cO, contentControlPropertiesOf as cP, contentControlTextOf as cQ, contentControlsIn as cR, detectDuplicateNames as cS, extensionKey as cT, findContentControl as cU, findElement as cV, firstReviewRange as cW, flattenContentControls as cX, hasAnyComment as cY, hyperlinkAnchorOf as cZ, hyperlinkRelationshipIdOf as c_, TABLE_BORDER_STYLES as ck, W15_NAMESPACE_URI as cs, WML_NAMESPACE_URI as ct, XMLNS_NAMESPACE_URI as cu, XML_NAMESPACE_URI as cv, isContentControlContentNode as d0, isContentControlNode as d1, isContentControlWrapper as d2, isContentRevisionKind as d3, isHyperlinkNode as d4, isRangeMarkerKind as d5, isValidMime as d6, legacyCheckboxFieldsOf as d7, lockForbidsEdit as d8, lockForbidsRemoval as d9, writeZip as dA, activeReviewItem as dC, reviewItemPositionRank as dD, reviewItemsAt as dE, reviewThreadRootOf as dF, normalizePartName as da, orderedContentControlProperties as db, parseContentControlId as dc, partNameKey as dd, planRevisionAuthorChange as de, planRevisionBatch as df, projectDrawing as dg, readOnOffChild as dh, readOoxmlPackage as di, readOoxmlPart as dj, readXml as dk, readZip as dl, resolveContentControlLock as dm, resolveContentType as dn, resolveImageRelationship as dp, resolveInternalTarget as dq, resolveRelationship as dr, reviewItemKey as ds, reviewItemRanges as dt, textContent as du, textFormFieldsOf as dv, threadStateOfPart as dw, validateExternalTarget as dx, withPart as dy, writeOoxmlPackage as dz };
+export type { OoxmlContentControlContentNode as $, ParagraphTabStop as A, Block as B, CommentRecord as C, DocxDocument as D, ExecResult as E, RevisionType as F, Section as G, HeaderFooterSet as H, InsertableContentControlType as I, SectionProperties as J, StyleDefinition as K, Theme as L, ThemeColorScheme as M, OoxmlNode as N, OoxmlPart as O, Paragraph as P, OoxmlPackage as Q, ReviewModelInput as R, StyleDefinitions as S, Table as T, OoxmlNodeId as U, OoxmlGenericElementNode as V, TreeDocOp as W, OoxmlProperty as X, OoxmlPackageRejection as Y, OoxmlElement as Z, OoxmlContentControlNode as _, ReviewItem as a, DrawingProjection as a0, OoxmlPackageLimits as a1, RevisionAuthorEntry as a2, RevisionAuthorResult as a3, RevisionAuthorSkipReason as a4, RevisionBatchEntry as a5, RevisionBatchResult as a6, RevisionBatchSkipReason as a7, TreeOpRejection as a8, AutomationTableMutation as a9, PageMargins as aA, ParagraphDisagreements as aB, Point as aC, Run as aD, TableCell as aE, TableRow as aF, TreeDocColorValue as aG, TableBorderStyle as aJ, DrawingAccessibility as aK, DrawingImageEffects as aL, DrawingTransform as aM, VectorShapeProjection as aN, OoxmlDrawingNode as aO, OoxmlInvariantResult as aP, OoxmlInvariantIssue as aQ, OoxmlFldCharNode as aR, OoxmlFldSimpleNode as aS, OoxmlInstrTextNode as aT, TreeOpResult as aU, RelationshipRecord as aV, OoxmlHardBreakNode as aW, OoxmlAttribute as aX, CommentThreadState as aY, RevisionAttributionInput as aa, OoxmlParagraphNode as ab, OoxmlNoteNode as ac, OoxmlContinuationSeparatorNode as ad, OoxmlEndnotesNode as ae, OoxmlFootnotesNode as af, OoxmlNoteRefNode as ag, OoxmlNoteReferenceNode as ah, OoxmlSeparatorNode as ai, DrawingTreeDocOp as aj, ImpactClass as ak, SourceCrop as al, DrawingKind as am, ImageWrapTarget as an, DrawingPositionInput as ao, DrawingLocks as ap, ParagraphFormatCommand as aq, Watermark as ar, Rect as as, SelectionPin as at, Unsubscribe as au, DocxDocumentJSON as av, DrawingHorizontalReferenceFrame as aw, DrawingVerticalReferenceFrame as ax, FontDefinition as ay, NumberingRef as az, ReviewRevisionItem as b, OoxmlPackageResult as b$, CommentAnchor as b1, CommentPosition as b2, CommitTextFormFieldOp as b3, ContentControlCheckbox as b4, ContentControlCheckboxState as b5, ContentControlDataBinding as b6, ContentControlDateFormat as b7, ContentControlEntry as b8, ContentControlKind as b9, OoxmlBodyNode as bA, OoxmlBookmarkEndNode as bB, OoxmlBookmarkStartNode as bC, OoxmlContentControlCalendarNode as bD, OoxmlContentControlCheckboxNode as bE, OoxmlContentControlCheckedNode as bF, OoxmlContentControlCheckedStateNode as bG, OoxmlContentControlComboBoxNode as bH, OoxmlContentControlDataBindingNode as bI, OoxmlContentControlDateFormatNode as bJ, OoxmlContentControlDateNode as bK, OoxmlContentControlDropDownListNode as bL, OoxmlContentControlEndPropertiesNode as bM, OoxmlContentControlLidNode as bN, OoxmlContentControlListItemNode as bO, OoxmlContentControlPropertiesNode as bP, OoxmlContentControlStoreMappedDataAsNode as bQ, OoxmlContentControlTextNode as bR, OoxmlContentControlUncheckedStateNode as bS, OoxmlDocumentNode as bT, OoxmlExternalTarget as bU, OoxmlGenericExtensionAttribute as bV, OoxmlHyperlinkNode as bW, OoxmlInvariantIssueCode as bX, OoxmlKnownNodeAttribute as bY, OoxmlNamespaceBinding as bZ, OoxmlNodeIdentityRules as b_, ContentControlLevel as ba, ContentControlListItem as bb, ContentControlLock as bc, ContentControlProperties as bd, ContentTypeError as be, ContentTypeIndex as bf, ContentTypeRecords as bg, DefaultRecord as bj, DeleteTextOp as bk, HyperlinkKind as bm, HyperlinkTarget as bn, ImageRelationshipResolution as bp, IndexResult as bq, InsertBuildingBlockOp as br, InsertTextOp as bs, LegacyCheckboxFieldRange as bt, NameRejection as bw, NameResult as bx, ReviewCommentItem as c, OoxmlParagraphPropertiesNode as c0, OoxmlPartMetadata as c1, OoxmlReadRejection as c2, OoxmlReadResult as c3, OoxmlRunNode as c4, OoxmlRunPropertiesNode as c5, OoxmlTabNode as c6, OoxmlTextElementNode as c7, OoxmlTextNode as c8, OoxmlWmlValAttribute as c9, ZipLimits as cA, ZipReadResult as cB, ZipRejection as cC, OoxmlXmlSpaceAttribute as ca, OverrideRecord as cb, RelationshipError as cc, RelationshipSetResult as cd, RelationshipTargetResolver as ce, ResolveResult as cf, ResolvedRelationship as cg, SetLegacyCheckboxOp as ch, SetLegacyDropdownOp as ci, SetTextFormFieldDefaultOp as cj, TabStopWrite as cl, TargetMode as cm, TextFormFieldOptions as cn, TextFormFieldRange as co, TextFormFieldType as cp, TreeDocOpKind as cq, TreeOpEffect as cr, XmlLimits as cw, XmlNode as cx, XmlRejection as cy, XmlResult as cz, ReviewCustomItem as d, VectorShapeComponent as dB, ReviewPosition as e, ReviewRange as f, ReviewRevisionKind as g, RevisionAddress as h, ContentControlType as i, DocTarget as j, RunFormatting as k, Extent as l, ContainerRef as m, ContentControlFilter as n, DocRange as o, Revision as p, DocComment as q, ColorValue as r, ContentControl as s, DocAnchor as t, DocAnchorRange as u, DocLocation as v, DocumentBody as w, ExecErrorCode as x, IndentFormatting as y, ParagraphFlags as z };