@docx-editor.dev/core 2.27.0 → 2.29.0

package/dist/store.d.ts

@@ -1,18 +1,32 @@
-import { e as ResourceLimits } from './image-resources-BDFxcu7W.js';
-export { C as CreateImageResourceCacheOptions, D as DEFAULT_IMAGE_RESOURCE_LIMITS, f as DEFAULT_LIMITS, H as HARD_CEILINGS, g as IMAGE_RESOURCE_HARD_CEILINGS, a as ImageDecodePort, I as ImageResourceLimits, h as ImageResourceLookup, b as ImageResourceState, M as MAX_SVG_SNIFF_BYTES, P as PreservedImageMime, R as RenderableImageMime, S as SupportedImageMime, V as ValidatedImageBytesHandle, i as ValidatedRasterHeader, j as createImageResourceCache, k as hasBoundedSvgRoot, l as imageResourceLookupFor, m as liveDrawingReferenceCount, r as resolveImageResourceLimits, n as resolveLimits, s as sniffImageMime, o as validateGifHeader, p as validateJpegHeader, q as validatePngHeader, v as validateRasterHeader } from './image-resources-BDFxcu7W.js';
-import { O as OoxmlPart, N as OoxmlNode, aM as OoxmlInvariantResult, at as OoxmlParagraphNode, aN as OoxmlFldCharNode, aO as OoxmlFldSimpleNode, aP as OoxmlInstrTextNode, aQ as OoxmlInvariantIssue, Z as OoxmlElement, W as TreeDocOp, a5 as TreeOpRejection, aR as TreeOpResult, Q as OoxmlPackage, aS as RelationshipRecord, V as OoxmlGenericElementNode, aT as OoxmlHardBreakNode, aU as OoxmlAttribute, X as OoxmlProperty, f as ReviewRange, R as ReviewModelInput, a as ReviewItem, C as CommentRecord, e as ReviewPosition, aV as CommentThreadState, c as ReviewCommentItem, b as ReviewRevisionItem, aB as DrawingTreeDocOp, aC as ImpactClass, aa as ImageWrapTarget } from './types-barrel-BFKR8Pzp.js';
-export { aW as ACCEPTED_PARAGRAPH_PROPERTIES, aX as ACCEPTED_RUN_PROPERTIES, aY as CONTENT_CONTROL_ID_MAX, aZ as CONTENT_CONTROL_PROPERTY_ORDER, a_ as CommentAnchor, a$ as CommentPosition, b0 as CommitTextFormFieldOp, b1 as ContentControlCheckbox, b2 as ContentControlCheckboxState, b3 as ContentControlDataBinding, b4 as ContentControlDateFormat, b5 as ContentControlEntry, b6 as ContentControlKind, b7 as ContentControlLevel, b8 as ContentControlListItem, b9 as ContentControlLock, ba as ContentControlProperties, bb as ContentTypeError, bc as ContentTypeIndex, bd as ContentTypeRecords, be as DEFAULT_OOXML_PACKAGE_LIMITS, bf as DEFAULT_ZIP_LIMITS, bg as DefaultRecord, bh as DeleteTextOp, aI as DrawingImageEffects, a9 as DrawingKind, ac as DrawingLocks, ab as DrawingPositionInput, bi as HYPERLINK_RELATIONSHIP_TYPE, bj as HyperlinkKind, bk as HyperlinkTarget, bl as IMAGE_RELATIONSHIP_TYPE, aE as IMAGE_WRAP_TARGETS, bm as ImageRelationshipResolution, bn as IndexResult, bo as InsertBuildingBlockOp, bp as InsertTextOp, bq as LegacyCheckboxFieldRange, br as MAX_CONTENT_CONTROLS_PER_PART, bs as MAX_CONTENT_CONTROL_NESTING, bt as NameRejection, bu as NameResult, bv as OFFICE_RELATIONSHIP_NAMESPACE_URI, bw as OOXML_NODE_IDENTITY_RULES, bx as OoxmlBodyNode, by as OoxmlBookmarkEndNode, bz as OoxmlBookmarkStartNode, bA as OoxmlContentControlCalendarNode, bB as OoxmlContentControlCheckboxNode, bC as OoxmlContentControlCheckedNode, bD as OoxmlContentControlCheckedStateNode, bE as OoxmlContentControlComboBoxNode, $ as OoxmlContentControlContentNode, bF as OoxmlContentControlDataBindingNode, bG as OoxmlContentControlDateFormatNode, bH as OoxmlContentControlDateNode, bI as OoxmlContentControlDropDownListNode, bJ as OoxmlContentControlEndPropertiesNode, bK as OoxmlContentControlLidNode, bL as OoxmlContentControlListItemNode, _ as OoxmlContentControlNode, bM as OoxmlContentControlPropertiesNode, bN as OoxmlContentControlStoreMappedDataAsNode, bO as OoxmlContentControlTextNode, bP as OoxmlContentControlUncheckedStateNode, av as OoxmlContinuationSeparatorNode, bQ as OoxmlDocumentNode, aw as OoxmlEndnotesNode, bR as OoxmlExternalTarget, ax as OoxmlFootnotesNode, bS as OoxmlGenericExtensionAttribute, bT as OoxmlHyperlinkNode, bU as OoxmlInvariantIssueCode, bV as OoxmlKnownNodeAttribute, bW as OoxmlNamespaceBinding, U as OoxmlNodeId, bX as OoxmlNodeIdentityRules, au as OoxmlNoteNode, ay as OoxmlNoteRefNode, az as OoxmlNoteReferenceNode, a1 as OoxmlPackageLimits, Y as OoxmlPackageRejection, bY as OoxmlPackageResult, bZ as OoxmlParagraphPropertiesNode, b_ as OoxmlPartMetadata, b$ as OoxmlReadRejection, c0 as OoxmlReadResult, c1 as OoxmlRunNode, c2 as OoxmlRunPropertiesNode, aA as OoxmlSeparatorNode, c3 as OoxmlTabNode, c4 as OoxmlTextElementNode, c5 as OoxmlTextNode, c6 as OoxmlWmlValAttribute, c7 as OoxmlXmlSpaceAttribute, c8 as OverrideRecord, c9 as RelationshipError, ca as RelationshipSetResult, cb as RelationshipTargetResolver, cc as ResolveResult, cd as ResolvedRelationship, d as ReviewCustomItem, g as ReviewRevisionKind, h as RevisionAddress, a2 as RevisionBatchEntry, a3 as RevisionBatchResult, a4 as RevisionBatchSkipReason, ce as SetLegacyCheckboxOp, cf as SetLegacyDropdownOp, cg as SetTextFormFieldDefaultOp, a8 as SourceCrop, ch as TABLE_BORDER_STYLES, ci as TabStopWrite, aG as TableBorderStyle, cj as TargetMode, ck as TextFormFieldOptions, cl as TextFormFieldRange, cm as TextFormFieldType, cn as TreeDocOpKind, co as TreeOpEffect, cp as W15_NAMESPACE_URI, cq as WML_NAMESPACE_URI, cr as XMLNS_NAMESPACE_URI, cs as XML_NAMESPACE_URI, ct as XmlLimits, cu as XmlNode, cv as XmlRejection, cw as XmlResult, cx as ZipLimits, cy as ZipReadResult, cz as ZipRejection, cA as allocateContentControlId, cB as asciiFold, cC as buildContentTypeIndex, cD as buildRelationshipSet, cE as childElements, cF as commentAnchorsOfStory, cG as commentsOfPart, cH as contentControlContentChildren, cI as contentControlContentNodeOf, cJ as contentControlEndPropertiesNodeOf, cK as contentControlLevelOf, cL as contentControlPropertiesNodeOf, cM as contentControlPropertiesOf, cN as contentControlTextOf, cO as contentControlsIn, cP as detectDuplicateNames, cQ as extensionKey, cR as findContentControl, cS as findElement, cT as firstReviewRange, cU as flattenContentControls, cV as hasAnyComment, cW as hyperlinkAnchorOf, cX as hyperlinkRelationshipIdOf, cY as hyperlinkTargetOf, cZ as isContentControlContentNode, c_ as isContentControlNode, c$ as isContentControlWrapper, d0 as isContentRevisionKind, d1 as isHyperlinkNode, d2 as isRangeMarkerKind, d3 as isValidMime, d4 as legacyCheckboxFieldsOf, d5 as lockForbidsEdit, d6 as lockForbidsRemoval, d7 as normalizePartName, d8 as orderedContentControlProperties, d9 as parseContentControlId, da as partNameKey, db as planRevisionBatch, dc as projectDrawing, dd as readOnOffChild, de as readOoxmlPackage, df as readOoxmlPart, dg as readXml, dh as readZip, di as resolveContentControlLock, dj as resolveContentType, dk as resolveImageRelationship, dl as resolveInternalTarget, dm as resolveRelationship, dn as reviewItemKey, dp as reviewItemRanges, dq as textContent, dr as textFormFieldsOf, ds as threadStateOfPart, dt as validateExternalTarget, du as withPart, dv as writeOoxmlPackage, dw as writeZip } from './types-barrel-BFKR8Pzp.js';
-import { e as TreeModelChange, f as TreeDocumentStore, T as TreePackageStore, S as StoryScope } from './tree-package-fragment-DYZIk1rY.js';
-export { k as AtomicNoteSpan, C as CascadeDeletedNoteReferencesOptions, D as DEFAULT_MAX_EDITABLE_STORY_PARTS, l as DrawingPropertyIdResult, F as FragmentPasteInput, j as FragmentPasteResult, m as HeaderFooterKind, n as HeaderFooterLifecycleImpact, o as HeaderFooterLifecycleOp, p as HeaderFooterLifecycleRejection, q as HeaderFooterLifecycleResult, H as HeaderFooterParts, b as HeaderFooterSectionResolution, s as HeaderFooterSlotMeta, c as HeaderFooterVariant, t as HistoryCaptureKind, d as HistoryGroup, M as MAX_FRAGMENT_DECODED_BYTES, u as MAX_NOTES_PER_PART, v as MAX_NOTE_REFERENCE_PARTS, w as MAX_NOTE_REFERENCE_SCAN, x as NOTE_ATOM_CHAR, y as NOTE_CONTINUATION_SEPARATOR_ID, z as NOTE_ID_MAX, B as NOTE_ID_MIN, E as NOTE_SEPARATOR_ID, G as NoteDiagnostic, J as NoteDiagnosticCode, N as NoteKind, K as NoteLifecycleImpact, L as NoteLifecycleOp, O as NoteLifecycleOptions, P as NoteLifecycleRejection, Q as NoteLifecycleResult, U as NoteReferenceHit, V as NoteReferenceScanBudget, W as NoteType, X as PackageTransactResult, Y as RemotePackageAttribution, g as SelectionMark, Z as StoryResolveResult, a as StoryTargetRejection, _ as TreeDocumentStoreOptions, $ as TreePackageStoreOptions, a0 as TreeStoryRef, h as TreeTransactOptions, a1 as TreeTransactResult, a2 as TreeTransactionContext, a3 as allocateDrawingPropertyId, a4 as allocateNoteId, a5 as applyFragmentPaste, a6 as applyHeaderFooterLifecycleOp, a7 as applyNoteLifecycleOp, a8 as atomicNoteSpansOf, a9 as cascadeDeletedNoteReferences, aa as collectNoteReferences, ab as collectPackageNoteReferences, ac as collectSectionPropertyNodes, ad as createNoteReferenceScanBudget, ae as customMarkFollows, af as diagnoseNoteReferences, ag as findNoteById, ah as formatNoteScopeId, ai as isContinuationSeparatorNode, aj as isEndnotesNode, ak as isFootnotesNode, al as isHeaderFooterLifecycleOp, am as isNormalNote, an as isNoteAtomNode, ao as isNoteLifecycleOp, ap as isNoteNode, aq as isNoteRefNode, ar as isNoteReferenceNode, as as isSeparatorNode, at as normalNoteIds, au as noteAtomText, av as noteIdOf, aw as noteKindOf, ax as noteRefKindOf, ay as noteReferenceKindOf, az as noteTypeOf, aA as notesOf, aB as notesPartHasId, aC as observeHistoryGroup, aD as parseNoteId, aE as parseNoteScopeId, r as reportHistoryGroup, aF as resolveHeaderFooterParts, aG as resolveHeaderFooterPartsBySection, aH as resolveHeaderFooterResolutionBySection, aI as resolveNotesPart, aJ as withBinaryPart, aK as withEmbeddedImage, aL as withoutUnreferencedImagePart } from './tree-package-fragment-DYZIk1rY.js';
-import { O as OmmlEquationProjection } from './omml-equation-DuczgG5o.js';
-export { D as DEFAULT_OMML_LIMITS, E as EquationExpression, L as LinearMathOmmlResult, a as LinearMathParseResult, b as LinearMathRejection, c as OFFICE_MATH_NAMESPACE_URI, d as OmmlLimits, e as equationExpressionToLinearMath, l as linearMathToOmml, p as parseLinearMath, f as projectOmmlEquation } from './omml-equation-DuczgG5o.js';
-import { I as InsertCustomNodeWrite, C as CustomNodeWriteResult } from './custom-node-writes-Vzpq9I8_.js';
-export { b as BookmarkAnchor, B as BookmarkIndex, c as CustomNodePayloadRead, d as CustomNodePayloadWrite, a as CustomNodeSweepOutcome, e as CustomNodeSweepResult, f as CustomNodeWriteRejection, D as DocumentTrackingSettings, E as EmbeddedFont, F as FontStyleKey, L as ListKind, M as MAX_CUSTOM_NODE_LABEL_LENGTH, g as MAX_CUSTOM_NODE_PAYLOAD_LENGTH, N as NO_TRACKING_SETTINGS, R as ReadEmbeddedFontsOptions, h as buildBookmarkIndex, i as customNodePayloadsByControl, j as customNodePayloadsOf, k as deobfuscateFont, l as ensureListDefinition, m as ensureNumberingLevel, n as insertCustomNodeWrite, r as readEmbeddedFonts, o as readTrackingSettings, p as removeCustomNodeWrite, s as sweepCustomNodePayloads } from './custom-node-writes-Vzpq9I8_.js';
-export { c as collectFlowBlocks, a as commentBodyText, b as commentInitials, d as contentControlContentOf, e as deepParagraphOrderOfPart, i as isContentControl, f as isContentControlContent, p as paragraphOrderOfPart, w as walkAllStoryParagraphs, g as walkParagraphInline, h as walkStoryBlocks } from './review-paragraph-order-Ddj5d6rp.js';
-export { D as DocumentProperties, E as EnsuredHyperlinkRelationship, a as HeadlessDocumentRejection, H as HeadlessDocumentView, b as HeadlessThemeFonts, O as OpenHeadlessDocumentResult, c as authorableHyperlinkTarget, e as ensureHyperlinkRelationship, h as headlessViewOfStore, o as openHeadlessDocument, r as relationshipTargetIn } from './headless-document-view-ICYqNkQ1.js';
-export { A as AuthoredNoteProperties, D as DEFAULT_ENDNOTE_PROPERTIES, a as DEFAULT_FOOTNOTE_PROPERTIES, E as EndnotePosition, F as FootnotePosition, N as NoteNumRestart, R as ResolvedEndnoteProperties, b as ResolvedFootnoteProperties, c as authoredDocumentEndnoteProperties, d as authoredDocumentFootnoteProperties, e as authoredEndnotePropertiesFromSectPr, f as authoredFootnotePropertiesFromSectPr, i as isLegalEndnotePosition, g as isLegalFootnotePosition, h as isLegalNumRestart, p as parseAuthoredNoteProperties, r as resolveEndnoteProperties, j as resolveFootnoteProperties, s as settingsPartOf } from './note-properties-CkAk7g-n.js';
-export { a as DocumentProtectionEdit, D as DocumentProtectionState, N as NO_DOCUMENT_PROTECTION, r as readDocumentProtection } from './document-protection-9zpIHWTE.js';
-import './editor-scope-OHPwVQ5l.js';
+/**
+ * `@docx-editor.dev/core/store` — the canonical OOXML tree and the only write path into it.
+ *
+ * Bytes become a typed-where-layout-needs-it, generic-everywhere-else tree. Every mutation is a
+ * `TreeDocOp` addressed by node id plus UTF-16 offset, applied in one transaction, so a batch
+ * refused halfway leaves the document exactly as it was.
+ *
+ * This is also the trust boundary: zip and XML limits, entity-free parsing, OPC name validation,
+ * and inert executable content all live here, because everything downstream assumes a sanitized
+ * projection.
+ *
+ * @packageDocumentation
+ * @public
+ */
+import { e as ResourceLimits } from './image-resources-tXLQShoC.js';
+export { C as CreateImageResourceCacheOptions, D as DEFAULT_IMAGE_RESOURCE_LIMITS, f as DEFAULT_LIMITS, H as HARD_CEILINGS, g as IMAGE_RESOURCE_HARD_CEILINGS, c as ImageDecodePort, b as ImageResourceLimits, h as ImageResourceLookup, I as ImageResourceState, M as MAX_SVG_SNIFF_BYTES, P as PreservedImageMime, R as RenderableImageMime, S as SupportedImageMime, V as ValidatedImageBytesHandle, i as ValidatedRasterHeader, j as createImageResourceCache, k as hasBoundedSvgRoot, l as imageResourceLookupFor, m as liveDrawingReferenceCount, r as resolveImageResourceLimits, n as resolveLimits, s as sniffImageMime, o as validateGifHeader, p as validateJpegHeader, q as validatePngHeader, v as validateRasterHeader } from './image-resources-tXLQShoC.js';
+import { O as OoxmlPart, N as OoxmlNode, aU as OoxmlInvariantResult, aV as OoxmlInvariantIssue, ak as OoxmlElement, az as OoxmlParagraphNode, aW as OoxmlFldCharNode, aX as OoxmlFldSimpleNode, aY as OoxmlInstrTextNode, ag as TreeDocOp, av as TreeOpRejection, aZ as TreeOpResult, Q as OoxmlPackage, a_ as RelationshipRecord, V as OoxmlGenericElementNode, a$ as OoxmlHardBreakNode, b0 as OoxmlAttribute, ah as OoxmlProperty, au as RevisionSiteRefusal, f as ReviewRange, R as ReviewModelInput, a as ReviewItem, C as CommentRecord, e as ReviewPosition, b1 as CommentThreadState, c as ReviewCommentItem, b as ReviewRevisionItem, ay as DrawingTreeDocOp, aH as ImpactClass, a1 as ImageWrapTarget } from './types-barrel-DuC5QBNC.js';
+export { b2 as ACCEPTED_PARAGRAPH_PROPERTIES, b3 as ACCEPTED_RUN_PROPERTIES, b4 as CONTENT_CONTROL_ID_MAX, b5 as CONTENT_CONTROL_PROPERTY_ORDER, b6 as CommentAnchor, b7 as CommentPosition, b8 as CommitTextFormFieldOp, b9 as ContentControlCheckbox, ba as ContentControlCheckboxState, bb as ContentControlDataBinding, bc as ContentControlDateFormat, bd as ContentControlEntry, be as ContentControlKind, bf as ContentControlLevel, bg as ContentControlListItem, bh as ContentControlLock, bi as ContentControlProperties, bj as ContentTypeError, bk as ContentTypeIndex, bl as ContentTypeRecords, bm as DEFAULT_OOXML_PACKAGE_LIMITS, bn as DEFAULT_ZIP_LIMITS, bo as DefaultRecord, bp as DeleteTextOp, aO as DrawingImageEffects, Y as DrawingKind, Z as DrawingLocks, _ as DrawingPositionInput, bq as HYPERLINK_RELATIONSHIP_TYPE, br as HyperlinkKind, bs as HyperlinkTarget, bt as IMAGE_RELATIONSHIP_TYPE, aK as IMAGE_WRAP_TARGETS, bu as ImageRelationshipResolution, bv as IndexResult, bw as InsertBuildingBlockOp, bx as InsertTextOp, by as LegacyCheckboxFieldRange, bz as MAX_CONTENT_CONTROLS_PER_PART, bA as MAX_CONTENT_CONTROL_NESTING, bB as NameRejection, bC as NameResult, bD as OFFICE_RELATIONSHIP_NAMESPACE_URI, bE as OOXML_NODE_IDENTITY_RULES, bF as OoxmlBodyNode, bG as OoxmlBookmarkEndNode, bH as OoxmlBookmarkStartNode, bI as OoxmlContentControlCalendarNode, bJ as OoxmlContentControlCheckboxNode, bK as OoxmlContentControlCheckedNode, bL as OoxmlContentControlCheckedStateNode, bM as OoxmlContentControlComboBoxNode, am as OoxmlContentControlContentNode, bN as OoxmlContentControlDataBindingNode, bO as OoxmlContentControlDateFormatNode, bP as OoxmlContentControlDateNode, bQ as OoxmlContentControlDropDownListNode, bR as OoxmlContentControlEndPropertiesNode, bS as OoxmlContentControlLidNode, bT as OoxmlContentControlListItemNode, al as OoxmlContentControlNode, bU as OoxmlContentControlPropertiesNode, bV as OoxmlContentControlStoreMappedDataAsNode, bW as OoxmlContentControlTextNode, bX as OoxmlContentControlUncheckedStateNode, aB as OoxmlContinuationSeparatorNode, bY as OoxmlDocumentNode, aC as OoxmlEndnotesNode, bZ as OoxmlExternalTarget, aD as OoxmlFootnotesNode, b_ as OoxmlGenericExtensionAttribute, b$ as OoxmlHyperlinkNode, c0 as OoxmlInvariantIssueCode, c1 as OoxmlKnownNodeAttribute, c2 as OoxmlNamespaceBinding, U as OoxmlNodeId, c3 as OoxmlNodeIdentityRules, aA as OoxmlNoteNode, aE as OoxmlNoteRefNode, aF as OoxmlNoteReferenceNode, ao as OoxmlPackageLimits, aj as OoxmlPackageRejection, ai as OoxmlPackageResult, c4 as OoxmlParagraphPropertiesNode, c5 as OoxmlPartMetadata, c6 as OoxmlReadRejection, c7 as OoxmlReadResult, c8 as OoxmlRunNode, c9 as OoxmlRunPropertiesNode, aG as OoxmlSeparatorNode, ca as OoxmlTabNode, cb as OoxmlTextElementNode, cc as OoxmlTextNode, cd as OoxmlWmlValAttribute, ce as OoxmlXmlSpaceAttribute, cf as OverrideRecord, cg as RelationshipError, ch as RelationshipSetResult, ci as RelationshipTargetResolver, cj as ResolveResult, ck as ResolvedRelationship, d as ReviewCustomItem, g as ReviewRevisionKind, h as RevisionAddress, ap as RevisionAuthorEntry, a8 as RevisionAuthorResult, aq as RevisionAuthorSkipReason, ar as RevisionBatchEntry, a9 as RevisionBatchResult, as as RevisionBatchSkipDetail, at as RevisionBatchSkipReason, cl as SetLegacyCheckboxOp, cm as SetLegacyDropdownOp, cn as SetTextFormFieldDefaultOp, aI as SourceCrop, co as TABLE_BORDER_STYLES, cp as TabStopWrite, aM as TableBorderStyle, cq as TargetMode, aT as TextFormFieldOptions, aS as TextFormFieldRange, cr as TextFormFieldType, cs as TreeDocOpKind, ct as TreeOpEffect, cu as W15_NAMESPACE_URI, cv as WML_NAMESPACE_URI, cw as XMLNS_NAMESPACE_URI, cx as XML_NAMESPACE_URI, cy as XmlLimits, cz as XmlNode, cA as XmlRejection, cB as XmlResult, cC as ZipLimits, cD as ZipReadResult, cE as ZipRejection, cF as allocateContentControlId, cG as asciiFold, cH as buildContentTypeIndex, cI as buildRelationshipSet, cJ as childElements, cK as commentAnchorsOfStory, cL as commentsOfPart, cM as contentControlContentChildren, cN as contentControlContentNodeOf, cO as contentControlEndPropertiesNodeOf, cP as contentControlLevelOf, cQ as contentControlPropertiesNodeOf, cR as contentControlPropertiesOf, cS as contentControlTextOf, cT as contentControlsIn, cU as detectDuplicateNames, cV as extensionKey, cW as findContentControl, cX as findElement, cY as firstReviewRange, cZ as flattenContentControls, c_ as hasAnyComment, c$ as hyperlinkAnchorOf, d0 as hyperlinkRelationshipIdOf, d1 as hyperlinkTargetOf, d2 as isContentControlContentNode, d3 as isContentControlNode, d4 as isContentControlWrapper, d5 as isContentRevisionKind, d6 as isHyperlinkNode, d7 as isRangeMarkerKind, d8 as isValidMime, d9 as legacyCheckboxFieldsOf, da as lockForbidsEdit, db as lockForbidsRemoval, dc as normalizePartName, dd as orderedContentControlProperties, de as parseContentControlId, df as partNameKey, dg as planRevisionAuthorChange, dh as planRevisionBatch, di as projectDrawing, dj as readOnOffChild, dk as readOoxmlPackage, dl as readOoxmlPart, dm as readXml, dn as readZip, dp as resolveContentControlLock, dq as resolveContentType, dr as resolveImageRelationship, ds as resolveInternalTarget, dt as resolveRelationship, du as reviewItemKey, dv as reviewItemRanges, dw as textContent, dx as textFormFieldsOf, dy as threadStateOfPart, dz as validateExternalTarget, dA as withPart, dB as writeOoxmlPackage, dC as writeZip } from './types-barrel-DuC5QBNC.js';
+import { F as FieldResultsMode, e as TreeModelChange, f as TreeDocumentStore, T as TreePackageStore, S as StoryScope } from './tree-package-store-CovjNARF.js';
+export { l as AtomicNoteSpan, C as CascadeDeletedNoteReferencesOptions, D as DEFAULT_MAX_EDITABLE_STORY_PARTS, m as DrawingPropertyIdResult, j as FragmentPasteInput, k as FragmentPasteResult, n as HeaderFooterKind, o as HeaderFooterLifecycleImpact, p as HeaderFooterLifecycleOp, q as HeaderFooterLifecycleRejection, s as HeaderFooterLifecycleResult, H as HeaderFooterParts, b as HeaderFooterSectionResolution, t as HeaderFooterSlotMeta, c as HeaderFooterVariant, u as HistoryCaptureKind, d as HistoryGroup, M as MAX_FRAGMENT_DECODED_BYTES, v as MAX_NOTES_PER_PART, w as MAX_NOTE_REFERENCE_PARTS, x as MAX_NOTE_REFERENCE_SCAN, y as NOTE_ATOM_CHAR, z as NOTE_CONTINUATION_SEPARATOR_ID, B as NOTE_ID_MAX, E as NOTE_ID_MIN, G as NOTE_SEPARATOR_ID, J as NoteDiagnostic, K as NoteDiagnosticCode, N as NoteKind, L as NoteLifecycleImpact, O as NoteLifecycleOp, P as NoteLifecycleOptions, Q as NoteLifecycleRejection, U as NoteLifecycleResult, V as NoteReferenceHit, W as NoteReferenceScanBudget, X as NoteType, Y as PackageTransactResult, Z as RemotePackageAttribution, g as SelectionMark, _ as StoryResolveResult, a as StoryTargetRejection, $ as TreeDocumentStoreOptions, a0 as TreePackageStoreOptions, a1 as TreeStoryRef, h as TreeTransactOptions, a2 as TreeTransactResult, a3 as TreeTransactionContext, a4 as allocateDrawingPropertyId, a5 as allocateNoteId, a6 as applyFragmentPaste, a7 as applyHeaderFooterLifecycleOp, a8 as applyNoteLifecycleOp, a9 as atomicNoteSpansOf, aa as cascadeDeletedNoteReferences, ab as collectNoteReferences, ac as collectPackageNoteReferences, ad as collectSectionPropertyNodes, ae as createNoteReferenceScanBudget, af as customMarkFollows, ag as diagnoseNoteReferences, ah as findNoteById, ai as formatNoteScopeId, aj as isContinuationSeparatorNode, ak as isEndnotesNode, al as isFootnotesNode, am as isHeaderFooterLifecycleOp, an as isNormalNote, ao as isNoteAtomNode, ap as isNoteLifecycleOp, aq as isNoteNode, ar as isNoteRefNode, as as isNoteReferenceNode, at as isSeparatorNode, au as normalNoteIds, av as noteAtomText, aw as noteIdOf, ax as noteKindOf, ay as noteRefKindOf, az as noteReferenceKindOf, aA as noteTypeOf, aB as notesOf, aC as notesPartHasId, aD as observeHistoryGroup, aE as parseNoteId, aF as parseNoteScopeId, r as reportHistoryGroup, aG as resolveHeaderFooterParts, aH as resolveHeaderFooterPartsBySection, aI as resolveHeaderFooterResolutionBySection, aJ as resolveNotesPart, aK as withBinaryPart, aL as withEmbeddedImage, aM as withoutUnreferencedImagePart } from './tree-package-store-CovjNARF.js';
+import { O as OmmlEquationProjection } from './omml-equation-BUbU0utM.js';
+export { D as DEFAULT_OMML_LIMITS, E as EquationExpression, L as LinearMathOmmlResult, a as LinearMathParseResult, b as LinearMathRejection, c as OFFICE_MATH_NAMESPACE_URI, d as OmmlLimits, e as equationExpressionToLinearMath, l as linearMathToOmml, p as parseLinearMath, f as projectOmmlEquation } from './omml-equation-BUbU0utM.js';
+import { I as InsertCustomNodeWrite, C as CustomNodeWriteResult } from './custom-node-writes-Bn6uciLb.js';
+export { b as BookmarkAnchor, B as BookmarkIndex, c as CustomNodePayloadRead, d as CustomNodePayloadWrite, a as CustomNodeSweepOutcome, e as CustomNodeSweepResult, f as CustomNodeWriteRejection, D as DocumentTrackingSettings, E as EmbeddedFont, F as FontStyleKey, L as ListKind, M as MAX_CUSTOM_NODE_LABEL_LENGTH, g as MAX_CUSTOM_NODE_PAYLOAD_LENGTH, N as NO_TRACKING_SETTINGS, R as ReadEmbeddedFontsOptions, h as buildBookmarkIndex, i as customNodePayloadsByControl, j as customNodePayloadsOf, k as deobfuscateFont, l as ensureListDefinition, m as ensureNumberingLevel, n as insertCustomNodeWrite, r as readEmbeddedFonts, o as readTrackingSettings, p as removeCustomNodeWrite, s as sweepCustomNodePayloads } from './custom-node-writes-Bn6uciLb.js';
+export { c as collectFlowBlocks, a as commentBodyText, b as commentInitials, d as contentControlContentOf, e as deepParagraphOrderOfPart, i as isContentControl, f as isContentControlContent, p as paragraphOrderOfPart, w as walkAllStoryParagraphs, g as walkParagraphInline, h as walkStoryBlocks } from './review-paragraph-order-CN_0l2Cb.js';
+export { D as DocumentProperties, E as EnsuredHyperlinkRelationship, a as HeadlessDocumentRejection, H as HeadlessDocumentView, b as HeadlessThemeFonts, O as OpenHeadlessDocumentResult, c as authorableHyperlinkTarget, e as ensureHyperlinkRelationship, h as headlessViewOfStore, o as openHeadlessDocument, r as relationshipTargetIn } from './headless-document-view-pp3q7wIh.js';
+export { A as AuthoredNoteProperties, D as DEFAULT_ENDNOTE_PROPERTIES, b as DEFAULT_FOOTNOTE_PROPERTIES, E as EndnotePosition, F as FootnotePosition, N as NoteNumRestart, a as ResolvedEndnoteProperties, R as ResolvedFootnoteProperties, c as authoredDocumentEndnoteProperties, d as authoredDocumentFootnoteProperties, e as authoredEndnotePropertiesFromSectPr, f as authoredFootnotePropertiesFromSectPr, i as isLegalEndnotePosition, g as isLegalFootnotePosition, h as isLegalNumRestart, p as parseAuthoredNoteProperties, r as resolveEndnoteProperties, j as resolveFootnoteProperties, s as settingsPartOf } from './note-properties-qQUjO1GQ.js';
+export { D as DocumentProtectionEdit, a as DocumentProtectionState, N as NO_DOCUMENT_PROTECTION, r as readDocumentProtection } from './document-protection-CUb55pl_.js';
+import './editor-scope-7o9xweiJ.js';
 
 /**
  * Serialize normalized XML from a canonical part using repository-controlled
@@ -37,6 +51,119 @@ declare function ooxmlTreesEqual(left: OoxmlPart | OoxmlNode, right: OoxmlPart |
  */
 declare function validateOoxmlPart(part: OoxmlPart): OoxmlInvariantResult;
 
+/** An edited part, or the invariant violations that rejected the edit. */
+type OoxmlEditResult = {
+    readonly ok: true;
+    readonly part: OoxmlPart;
+} | {
+    readonly ok: false;
+    readonly issues: readonly OoxmlInvariantIssue[];
+};
+/**
+ * How an edit primitive validates its result.
+ *
+ * By default every primitive runs the full-part invariant validation before handing its
+ * result back — the safe reading for an isolated call. A TRANSACTION applying many ops pays
+ * that full-tree walk once per primitive, which is what made a hundred-paragraph paste
+ * quadratic; it defers instead, and runs the same validation ONCE on the final tree before
+ * anything is published. Deferring is only sound for a caller that owns a commit boundary:
+ * nothing may escape between the unvalidated intermediate and the validated result.
+ */
+interface EditOptions {
+    readonly deferValidation?: boolean;
+    /**
+     * A shared minter for `@w:id` on a NEW revision, for the ops of one transaction.
+     *
+     * `nextRevisionId` walks the whole part to find the highest id in use, and a formatting
+     * write emits one op per run — so a Select All + Bold in suggesting mode paid a
+     * document-wide walk thousands of times over. The transaction hands its ops one minter
+     * instead, and it is DROPPED the moment an op that can import foreign revision ids runs
+     * (a paste carries its own), because a stale minter would hand out an id the document had
+     * just started using — and two revisions sharing an address are one card in the pane.
+     *
+     * Absent means "mint your own": every applier falls back to its own walk, which is what a
+     * caller outside a transaction gets.
+     */
+    readonly revisionIds?: () => string;
+    /**
+     * The transaction's revision-id bookkeeping for the tracked TEXT ops, where `revisionIds`
+     * above hands the property ops one shared id for their whole group.
+     *
+     * Absent means "mint your own and remember nothing", which is what a caller outside a
+     * transaction gets: every applier falls back to its own walk of the part.
+     */
+    readonly trackedRevisionIds?: TransactionRevisionIds;
+    /**
+     * How the op addresses saved field results (`field-result-mode.ts`). Absent keeps the mode
+     * of the enclosing store call, which is `atomic` outside any editable transaction.
+     */
+    readonly fieldResults?: FieldResultsMode;
+}
+/**
+ * What one transaction knows about the revision ids its tracked text ops write.
+ *
+ * TWO questions, and they are the same bookkeeping. `nextRevisionId` walks the whole part, so
+ * a replacement — a `deleteText` and an `insertText` in one transaction — walked it twice, and
+ * on a five-hundred-page document that doubled the cost of every one. And an insertion aimed
+ * at the front edge of a deletion relocates past it only when that deletion is THIS
+ * transaction's own: typing over a selection. Backspace, then a keystroke, is two
+ * transactions, and there the typed text belongs in FRONT of the struck character, as Word
+ * writes it. Adjacency alone cannot tell the two apart; the ids can.
+ */
+interface TransactionRevisionIds {
+    /** A fresh `@w:id`, from this transaction's one walk of the part. */
+    mint(): string;
+    /**
+     * Record a wrapper this transaction wrote, by its FULL `CT_TrackChange` identity — id,
+     * author and date, as `revisionKey` spells it. Not by the id alone: that number comes out
+     * of the file, nothing makes it unique, and a strike joining `w:id="3"` in one paragraph
+     * would otherwise claim an unrelated `w:id="3"` elsewhere as this edit's own.
+     */
+    wrote(key: string): void;
+    /** Whether this transaction wrote a wrapper with that identity. */
+    wroteUnder(key: string): boolean;
+}
+/** Every node id currently present in the part. */
+declare function collectNodeIds(part: OoxmlPart): Set<string>;
+/**
+ * Mint ids for nodes an edit introduces.
+ *
+ * Deterministic and collision-checked against the whole part: a structural-path id from the
+ * original parse (`/word/document.xml#0.1.2`) and a minted one (`/word/document.xml#new:3`)
+ * can never coincide, and the counter skips anything already taken so repeated edits in one
+ * session stay unique.
+ *
+ * Allocators share reservations across edited roots and restored roots. Preview edits,
+ * detached nodes, and undo branches must not reuse an identity that collaboration retains.
+ *
+ * Checks the part's node index directly rather than copying every id into a fresh set: the
+ * copy was O(document) per op, and an allocator is created for every op.
+ */
+declare function createNodeIdAllocator(part: OoxmlPart, family?: 'new' | 'paste'): () => string;
+/** Whether a node id exists in the part. */
+declare function hasNode(part: OoxmlPart, nodeId: string): boolean;
+/** Read a node back out of a part by id. */
+declare function findNode(part: OoxmlPart, nodeId: string): OoxmlNode | null;
+/** The element that holds a node, or null for the root and for unknown ids. */
+declare function parentNodeOf(part: OoxmlPart, nodeId: string): OoxmlElement | null;
+/** Replace one node's children wholesale. */
+declare function replaceChildren(part: OoxmlPart, nodeId: string, children: readonly OoxmlNode[], options?: EditOptions): OoxmlEditResult;
+/** Insert children into a node at `index` (clamped to the child list). */
+declare function insertChildren(part: OoxmlPart, nodeId: string, index: number, children: readonly OoxmlNode[], options?: EditOptions): OoxmlEditResult;
+/** Replace one node with another, keeping its position among its siblings. */
+declare function replaceNode(part: OoxmlPart, nodeId: string, replacement: OoxmlNode, options?: EditOptions): OoxmlEditResult;
+/** Remove a node and its subtree. */
+declare function removeNode(part: OoxmlPart, nodeId: string, options?: EditOptions): OoxmlEditResult;
+/**
+ * Apply several primitives as ONE atomic step.
+ *
+ * Each edit runs against the result of the previous one, and the whole sequence is
+ * validated once at the end. If any step fails, the ORIGINAL part is what the caller keeps
+ * — there is no partially-edited intermediate to publish. This is the shape a multi-`DocOp`
+ * store transaction needs.
+ */
+declare function applyEdits(part: OoxmlPart, edits: readonly ((current: OoxmlPart) => OoxmlEditResult)[], options?: EditOptions): OoxmlEditResult;
+
 /** UTF-16 placeholder for one atomic field unit in `paragraphTextOf` / segments. */
 declare const FIELD_ATOM_CHAR = "\uFFFC";
 /**
@@ -130,6 +257,7 @@ interface AtomicFieldSpan {
 declare function atomicFieldSpansOf(paragraph: OoxmlParagraphNode, options?: {
     readonly maxNesting?: number;
     readonly maxInstructionChars?: number;
+    readonly fieldResults?: FieldResultsMode;
 }): readonly AtomicFieldSpan[];
 /** Whether `fldCharType` is a legal ST_FldCharType value (used by tests / guards). */
 declare function isLegalFldCharType(value: string): boolean;
@@ -226,1843 +354,1738 @@ declare function inlineControlEndingAt(paragraph: OoxmlParagraphNode, offset: nu
 /** The forward-delete mirror: the control whose content STARTS exactly at `offset`. */
 declare function inlineControlStartingAt(paragraph: OoxmlParagraphNode, offset: number): InlineControlSpan | null;
 
-/** An edited part, or the invariant violations that rejected the edit. */
-type OoxmlEditResult = {
-    readonly ok: true;
-    readonly part: OoxmlPart;
-} | {
-    readonly ok: false;
-    readonly issues: readonly OoxmlInvariantIssue[];
-};
+/** Structural validation, run before any tree work so a rejection changes nothing. */
+declare function validateTreeOp(part: OoxmlPart, op: TreeDocOp): TreeOpRejection | null;
+
 /**
- * How an edit primitive validates its result.
+ * Paragraph text as the ops address it, for tests and callers computing offsets.
  *
- * By default every primitive runs the full-part invariant validation before handing its
- * result back — the safe reading for an isolated call. A TRANSACTION applying many ops pays
- * that full-tree walk once per primitive, which is what made a hundred-paragraph paste
- * quadratic; it defers instead, and runs the same validation ONCE on the final tree before
- * anything is published. Deferring is only sound for a caller that owns a commit boundary:
- * nothing may escape between the unvalidated intermediate and the validated result.
+ * `fieldResults` defaults to the mode of the store call in progress, which is `atomic` outside
+ * any editable transaction: every field is one unit, the raw text collaboration and
+ * automation read. `editable` reads saved field results as text, as an editor in that mode
+ * addresses them.
  */
-interface EditOptions {
-    readonly deferValidation?: boolean;
-    /**
-     * A shared minter for `@w:id` on a NEW revision, for the ops of one transaction.
-     *
-     * `nextRevisionId` walks the whole part to find the highest id in use, and a formatting
-     * write emits one op per run — so a Select All + Bold in suggesting mode paid a
-     * document-wide walk thousands of times over. The transaction hands its ops one minter
-     * instead, and it is DROPPED the moment an op that can import foreign revision ids runs
-     * (a paste carries its own), because a stale minter would hand out an id the document had
-     * just started using — and two revisions sharing an address are one card in the pane.
-     *
-     * Absent means "mint your own": every applier falls back to its own walk, which is what a
-     * caller outside a transaction gets.
-     */
-    readonly revisionIds?: () => string;
-    /**
-     * The transaction's revision-id bookkeeping for the tracked TEXT ops, where `revisionIds`
-     * above hands the property ops one shared id for their whole group.
-     *
-     * Absent means "mint your own and remember nothing", which is what a caller outside a
-     * transaction gets: every applier falls back to its own walk of the part.
-     */
-    readonly trackedRevisionIds?: TransactionRevisionIds;
-}
+declare function paragraphTextOf(part: OoxmlPart, paragraphId: string, options?: {
+    readonly fieldResults?: FieldResultsMode;
+}): string | null;
+
 /**
- * What one transaction knows about the revision ids its tracked text ops write.
- *
- * TWO questions, and they are the same bookkeeping. `nextRevisionId` walks the whole part, so
- * a replacement — a `deleteText` and an `insertText` in one transaction — walked it twice, and
- * on a five-hundred-page document that doubled the cost of every one. And an insertion aimed
- * at the front edge of a deletion relocates past it only when that deletion is THIS
- * transaction's own: typing over a selection. Backspace, then a keystroke, is two
- * transactions, and there the typed text belongs in FRONT of the struck character, as Word
- * writes it. Adjacency alone cannot tell the two apart; the ids can.
+ * Apply one op. `options.fieldResults` installs the field-result addressing mode for the
+ * op's whole run (`field-result-mode.ts`); absent keeps the enclosing mode.
  */
-interface TransactionRevisionIds {
-    /** A fresh `@w:id`, from this transaction's one walk of the part. */
-    mint(): string;
-    /**
-     * Record a wrapper this transaction wrote, by its FULL `CT_TrackChange` identity — id,
-     * author and date, as `revisionKey` spells it. Not by the id alone: that number comes out
-     * of the file, nothing makes it unique, and a strike joining `w:id="3"` in one paragraph
-     * would otherwise claim an unrelated `w:id="3"` elsewhere as this edit's own.
-     */
-    wrote(key: string): void;
-    /** Whether this transaction wrote a wrapper with that identity. */
-    wroteUnder(key: string): boolean;
-}
-/** Every node id currently present in the part. */
-declare function collectNodeIds(part: OoxmlPart): Set<string>;
+declare function applyTreeOp(part: OoxmlPart, op: TreeDocOp, options?: EditOptions): TreeOpResult;
+
 /**
- * Mint ids for nodes an edit introduces.
- *
- * Deterministic and collision-checked against the whole part: a structural-path id from the
- * original parse (`/word/document.xml#0.1.2`) and a minted one (`/word/document.xml#new:3`)
- * can never coincide, and the counter skips anything already taken so repeated edits in one
- * session stay unique.
- *
- * Allocators share reservations across edited roots and restored roots. Preview edits,
- * detached nodes, and undo branches must not reuse an identity that collaboration retains.
+ * Keys that must never be assigned from file data.
  *
- * Checks the part's node index directly rather than copying every id into a fresh set: the
- * copy was O(document) per op, and an allocator is created for every op.
+ * XML attribute names become object keys, and a document controls those names — assigning
+ * `__proto__` into an ordinary object is the prototype-pollution hazard this engine audits for.
  */
-declare function createNodeIdAllocator(part: OoxmlPart, family?: 'new' | 'paste'): () => string;
-/** Whether a node id exists in the part. */
-declare function hasNode(part: OoxmlPart, nodeId: string): boolean;
-/** Read a node back out of a part by id. */
-declare function findNode(part: OoxmlPart, nodeId: string): OoxmlNode | null;
-/** The element that holds a node, or null for the root and for unknown ids. */
-declare function parentNodeOf(part: OoxmlPart, nodeId: string): OoxmlElement | null;
-/** Replace one node's children wholesale. */
-declare function replaceChildren(part: OoxmlPart, nodeId: string, children: readonly OoxmlNode[], options?: EditOptions): OoxmlEditResult;
-/** Insert children into a node at `index` (clamped to the child list). */
-declare function insertChildren(part: OoxmlPart, nodeId: string, index: number, children: readonly OoxmlNode[], options?: EditOptions): OoxmlEditResult;
-/** Replace one node with another, keeping its position among its siblings. */
-declare function replaceNode(part: OoxmlPart, nodeId: string, replacement: OoxmlNode, options?: EditOptions): OoxmlEditResult;
-/** Remove a node and its subtree. */
-declare function removeNode(part: OoxmlPart, nodeId: string, options?: EditOptions): OoxmlEditResult;
+declare const DANGEROUS_KEYS: readonly string[];
+/** A file-derived key that would pollute a prototype. Refused, never sanitized-and-accepted. */
+declare class DangerousKeyError extends Error {
+    readonly key: string;
+    readonly path: string;
+    constructor(key: string, path: string);
+}
+/** Whether a key is one of {@link DANGEROUS_KEYS}. */
+declare function isDangerousKey(key: string): boolean;
+/** A fresh null-prototype record — the only object shape parser intermediates use. */
+declare function nullRecord<T = unknown>(): Record<string, T>;
 /**
- * Apply several primitives as ONE atomic step.
- *
- * Each edit runs against the result of the previous one, and the whole sequence is
- * validated once at the end. If any step fails, the ORIGINAL part is what the caller keeps
- * — there is no partially-edited intermediate to publish. This is the shape a multi-`DocOp`
- * store transaction needs.
+ * Recursively convert `value` into null-prototype records, rejecting any
+ * dangerous object key. Arrays and primitives pass through (arrays rebuilt so no
+ * inherited prototype pollution survives). Throws DangerousKeyError on the first
+ * unsafe key, naming its path. Cyclic inputs are rejected.
  */
-declare function applyEdits(part: OoxmlPart, edits: readonly ((current: OoxmlPart) => OoxmlEditResult)[], options?: EditOptions): OoxmlEditResult;
-
-/** Structural validation, run before any tree work so a rejection changes nothing. */
-declare function validateTreeOp(part: OoxmlPart, op: TreeDocOp): TreeOpRejection | null;
+declare function toSafeRecord(value: unknown, path?: string): unknown;
 
+/** Locate `[Content_Types].xml` bytes regardless of zip key spelling. */
+declare function contentTypesPartBytes(pkg: OoxmlPackage): {
+    readonly storageKey: string;
+    readonly bytes: Uint8Array;
+} | null;
 /**
- * Apply one validated op to a part.
- *
- * Validation runs first and returns before any tree work, so a rejected op is a true no-op:
- * the caller keeps the part it passed in, unchanged and still frozen.
+ * What a package-level invariant walk found wrong.
  *
- * `options.deferValidation` passes through to the edit primitives: a transaction applying
- * many ops re-validates the whole part once at its commit boundary rather than after every
- * primitive, which is the difference between a paste that is linear and one that is
- * quadratic in document size.
+ * Package invariants are cross-PART: a relationship pointing at a part that does not exist, or a
+ * part no content-type record covers. Neither is visible from inside a single part's tree.
  */
-declare function applyTreeOp(part: OoxmlPart, op: TreeDocOp, options?: EditOptions): TreeOpResult;
-/** Paragraph text as the ops address it, for tests and callers computing offsets. */
-declare function paragraphTextOf(part: OoxmlPart, paragraphId: string): string | null;
-
-/**
- * Every kind of thing the registry gives a stable identity to.
- *
- * Identity is `(kind, id)` plus version and NEVER registration order, so two bundles contributing
- * the same command resolve deterministically regardless of which loaded first.
+type PackageInvariantCode = 'dangling-relationship' | 'missing-content-type'
+/** A part occupies a name OPC reserves for package infrastructure. */
+ | 'reserved-part-name'
+/** Two parts whose names differ only by case, which OPC treats as one part. */
+ | 'duplicate-part-name'
+/** A part name the OPC screens refuse; `writeZip` would throw on save. */
+ | 'unsafe-part-name';
+/** One package invariant violation, located by part name and relationship id. */
+interface PackageInvariantIssue {
+    readonly code: PackageInvariantCode;
+    /** The part the issue is about: the missing target, or the part with no type. */
+    readonly partName: string;
+    /** For a dangling relationship, the owner that points at nothing. */
+    readonly ownerPart?: string;
+}
+/** Whether a package satisfies its cross-part invariants, listing every violation otherwise. */
+type PackageInvariantResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly issues: readonly PackageInvariantIssue[];
+};
+/** Relationship records owned by one part, in authored order. */
+declare function relationshipsOf(pkg: OoxmlPackage, ownerPart: string): readonly RelationshipRecord[];
+/** The content type that resolves for a part name, or null when nothing declares one. */
+declare function resolveContentTypeOf(pkg: OoxmlPackage, partName: string): string | null;
+/** The `.rels` part that owns a part's relationships, by OPC convention. */
+declare function relsPartNameFor(partName: string): string;
+/**
+ * Declare a content type for a part, by upserting an `<Override>` in the content-types tree.
+ *
+ * A no-op when the part already resolves to the same type, so repeating a write does not append
+ * a duplicate entry. Resolving to a DIFFERENT type replaces the existing Override in place.
+ * `forceOverride` writes an explicit Override even when a Default already matches.
  */
-declare const ID_KINDS: readonly ['extension', 'capability', 'command', 'query', 'schema', 'dependencyKey', 'runtimePort', 'result', 'origin'];
-/** One of {@link ID_KINDS}. */
-/** One of {@link ID_KINDS} — which sort of thing an identifier names. */
-type IdKind = (typeof ID_KINDS)[number];
+declare function withContentTypeOverride(pkg: OoxmlPackage, partName: string, contentType: string, options?: {
+    readonly forceOverride?: boolean;
+}): OoxmlPackage;
+/** What {@link withoutPart} answers: `ok: false` leaves the package exactly as it was. */
+interface WithoutPartResult {
+    readonly pkg: OoxmlPackage;
+    readonly ok: boolean;
+}
+/** Add or replace one relationship on a part, returning a new package. */
+declare function withRelationship(pkg: OoxmlPackage, ownerPart: string, type: string, rawTarget: string): {
+    readonly pkg: OoxmlPackage;
+    readonly relationshipId: string;
+    readonly ok: boolean;
+};
 /**
- * Whether a string is a well-formed identifier in either accepted grammar.
+ * Add a part that does not exist yet, with the content-type override it needs to be openable.
  *
- * Reverse-domain (`dev.docx-editor.core.command.insert-text`) or package-owned
- * (`@docx-editor.dev/engine-core#command/insert-text`). Ids are opaque once validated.
+ * Deliberately does NOT create a relationship: a part is reachable because something points at
+ * it, and which part points at it is the caller's decision. Creating one here would guess.
  */
-declare function isValidId(id: string): boolean;
+declare function withNewPart(pkg: OoxmlPackage, partName: string, root: OoxmlElement, contentType: string): OoxmlPackage;
 /**
- * Validate an identifier, throwing when it is malformed.
+ * The two invariants a package must satisfy before it is published.
  *
- * Throws rather than returning: a bad id is an author mistake at registration time, not file
- * input, and accepting it would produce a registry whose identities silently collide.
+ * Both describe the half-written state that splitting a multi-part write across transactions
+ * produces, and both make a package Word refuses to open:
+ *
+ *  - a relationship pointing at a part nobody created;
+ *  - a part with no content type, which is unopenable even though the XML is well formed.
+ *
+ * Checked at the commit boundary rather than inside each primitive, for the same reason part
+ * validation moved there: a transaction is allowed to pass through an inconsistent intermediate
+ * as long as nothing can observe it.
  */
-declare function assertValidId(id: string, kind?: IdKind): void;
-/** A validated (kind, id, version) triple — the registry's unit of identity. */
-interface CapabilityId {
-    readonly kind: IdKind;
-    readonly id: string;
-    readonly version: string;
-}
+declare function validatePackageInvariants(pkg: OoxmlPackage): PackageInvariantResult;
 
-/** A parsed semantic version. Only the three numeric components — no pre-release or build. */
-interface SemVer {
-    readonly major: number;
-    readonly minor: number;
-    readonly patch: number;
-}
 /**
- * Parse a semantic version, rejecting anything the registry's rules do not need.
+ * Whether a string is a valid XML NCName in the strict ASCII profile — a name with no colon.
  *
- * Deliberately narrow: an unsupported range form is refused rather than accepted, so a malformed
- * range can never masquerade as "compatible".
+ * This is the rule for names the engine itself writes or accepts from a caller. Names read
+ * from a document use {@link isXmlNCName}, which admits every XML 1.0 name.
  */
-declare function parseSemVer(input: string): SemVer;
-/** Order two versions: negative, zero or positive, by major then minor then patch. */
-declare function compareSemVer(a: SemVer, b: SemVer): -1 | 0 | 1;
+declare function isValidNCName(name: string): boolean;
+/** A QName is an optional `prefix:` (both NCNames) — never attacker-derived. */
+declare function isValidQName(name: string): boolean;
 /**
- * Whether `version` satisfies `range`. Supported range grammar:
- *   - `*`            any version
- *   - `1.2.3`        exact
- *   - `^1.2.3`       caret: same major, and >= the floor (major 0 pins the minor)
- *   - `>=1.2.3 <2.0.0`  a single lower (inclusive) + upper (exclusive) bound pair
- * Any other shape throws — an unparseable range is a registration error, not a pass.
+ * Validate a qualified name, throwing when it is malformed.
+ *
+ * Guards the serializer: an invalid QName written into XML produces a file Word cannot open, so
+ * it fails here rather than at save.
  */
-declare function satisfies(version: string, range: string): boolean;
-
+declare function assertValidQName(name: string): void;
 /**
- * Why registry resolution failed.
- *
- * Every code names a declaration conflict a bundle author can fix — a missing dependency, an
- * unsatisfied version range, a duplicate contribution with no replacement policy.
+ * Controlled namespace-prefix allocation: deterministic, collision-free prefixes
+ * for namespace URIs. A known URI always yields the same registered prefix; new
+ * URIs get a generated `ns{n}` prefix, never one derived from file content.
  */
-type RegistryErrorCode = 'invalid-id' | 'invalid-version' | 'duplicate-extension' | 'id-collision' | 'replacement-target-missing' | 'unauthorized-replacement' | 'replacement-version-mismatch' | 'ambiguous-replacement' | 'missing-dependency' | 'dependency-cycle' | 'conflict' | 'missing-port';
+declare class PrefixAllocator {
+    private readonly byUri;
+    private readonly usedPrefixes;
+    private counter;
+    constructor(known?: Readonly<Record<string, string>>);
+    prefixFor(namespaceUri: string): string;
+    /** The declared bindings, for emitting xmlns declarations. */
+    bindings(): {
+        prefix: string;
+        uri: string;
+    }[];
+}
+
 /**
- * A resolution failure naming every responsible party.
+ * A hyperlink target projected for a RUNTIME sink, or the reason it was withheld.
  *
- * Thrown rather than returned: an unresolvable registry is a build-time composition mistake, and
- * an engine running with a half-resolved registry would fail later in ways that do not point back
- * to the bundle that caused it.
+ * The authored target stays authored — the record layer keeps it verbatim and escapes it into
+ * owned OOXML, which is not a runtime sink. Only this allowlist-sanitized projection reaches DOM,
+ * CSS, navigation or fetch, so `javascript:`, `data:` and `vbscript:` never leave the boundary.
  */
-declare class RegistryError extends Error {
-    readonly code: RegistryErrorCode;
-    /** Stable identities responsible for the failure (extensions, ids). */
-    readonly responsible: readonly string[];
-    constructor(code: RegistryErrorCode, message: string, 
-    /** Stable identities responsible for the failure (extensions, ids). */
-    responsible?: readonly string[]);
-}
-/** How a base contribution permits replacement by other bundles. */
-type ReplacementPolicy = {
-    readonly kind: 'none';
-} | {
-    readonly kind: 'single';
+type HrefProjection = {
+    readonly ok: true;
+    readonly href: string;
 } | {
-    readonly kind: 'priority';
+    readonly ok: false;
+    readonly inert: true;
 };
-/** One thing a bundle contributes: a command, a query, a schema, a port, keyed by `(kind, id)`. */
-interface Contribution {
-    readonly kind: Exclude<IdKind, 'extension' | 'origin' | 'result'>;
-    readonly id: string;
-    readonly version: string;
-    /** If set, this contribution replaces an existing base contribution. */
-    readonly replaces?: {
-        readonly targetId: string;
-        readonly targetRange: string;
-        readonly priority?: number;
-    };
-    /** Policy this contribution exposes to would-be replacers (default `none`). */
-    readonly replaceable?: ReplacementPolicy;
-    readonly payload?: unknown;
-}
 /**
- * A unit of engine functionality: its identity, version, dependencies, conflicts, required ports,
- * and contributions.
+ * Project a file-derived URL for a DOM/navigation sink. Strips embedded
+ * tab/LF/CR (used to smuggle `java\nscript:`), allows relative URLs and the
+ * scheme allowlist, and renders everything else inert. Never fetches.
+ */
+declare function sanitizeHref(raw: string): HrefProjection;
+/** XML-escape a value for validated serialization back into owned OOXML. */
+declare function escapeXml(value: string): string;
+/**
+ * CSS string-escape a file-derived value (e.g. an `@font-face` family name or an
+ * inline style value). Emits `\<hex> ` escapes for quotes, backslash, and
+ * controls so the value cannot break out of its CSS string.
+ */
+declare function escapeCssString(value: string): string;
+/** Whether a file-derived CSS fragment contains a `url()` or `@import` (must be rejected). */
+declare function containsCssFetch(value: string): boolean;
+/**
+ * Content that must never execute or auto-resolve: OLE objects, macros, DDE and `INCLUDE*` field
+ * instructions.
  *
- * The registry's whole input. Everything a bundle needs and everything it offers is DECLARED, so
- * resolution can be deterministic and order-independent.
+ * Rendered INERT by default rather than stripped — removing it would be a lossless-preservation
+ * failure, so it is carried and never acted on.
  */
-interface FeatureBundle {
+declare const INERT_EXECUTABLE_KINDS: readonly ['field-dde', 'field-include', 'macro', 'activex', 'ole', 'embedded-object', 'executable-relationship'];
+/** One of {@link INERT_EXECUTABLE_KINDS}. */
+/** One of {@link INERT_EXECUTABLE_KINDS} — content carried but never executed. */
+type InertExecutableKind = (typeof INERT_EXECUTABLE_KINDS)[number];
+/** Whether a content kind is one this engine refuses to execute or auto-resolve. */
+declare function isInertExecutable(kind: string): boolean;
+/** Whether a field instruction's leading keyword is safe to evaluate. */
+declare function isEvaluableField(instruction: string): boolean;
+/** One item a scrub pass considers: its kind, and where in the package it sits. */
+interface ContentItem {
     readonly id: string;
-    readonly version: string;
-    readonly dependencies?: readonly string[];
-    readonly conflicts?: readonly string[];
-    readonly requiredPorts?: readonly string[];
-    readonly contributions: readonly Contribution[];
-}
-/** The resolved result: every contribution selected, indexed by `(kind, id)`. */
-interface ResolvedRegistry {
-    readonly extensions: ReadonlyMap<string, FeatureBundle>;
-    readonly contributions: ReadonlyMap<string, Contribution>;
-    get(kind: Contribution['kind'], id: string): Contribution | undefined;
-}
-/** How resolution treats optional bundles and replacement policies. */
-interface ResolveOptions {
-    /** Runtime port ids available in this environment (design D9 / task 0.3). */
-    readonly availablePorts?: readonly string[];
+    readonly kind: string;
 }
 /**
- * Resolve a set of bundles into one registry, or throw.
- *
- * Deterministic and registration-order independent: selection is by `(kind, id)` plus version,
- * and ties break only on declared policy. Array order never decides anything.
+ * What an explicit scrub removed.
  *
- * @throws RegistryError naming every bundle responsible for the failure.
+ * A scrub DECLARES ITSELF non-lossless: removing executable content changes the file, which is a
+ * choice a caller makes deliberately rather than a default the engine applies.
  */
-declare function resolve(bundles: readonly FeatureBundle[], options?: ResolveOptions): ResolvedRegistry;
+interface ScrubResult {
+    readonly kept: readonly ContentItem[];
+    readonly removed: readonly ContentItem[];
+    /** A scrub that removes anything is non-lossless by definition. */
+    readonly nonLossless: boolean;
+}
+/** Explicit scrub export: remove inert executable classes, report removals. */
+declare function scrubExport(items: readonly ContentItem[]): ScrubResult;
 
+/** True for an `m:oMathPara` display equation. */
+declare function isOmmlDisplay(node: OoxmlNode): node is OoxmlGenericElementNode;
+/** True for a paragraph-level equation atom: `m:oMath` or `m:oMathPara`. */
+declare function isOmmlEquationAtom(node: OoxmlNode): node is OoxmlGenericElementNode;
+/** The `m:oMath` equations of a display, or the equation itself for an inline `m:oMath`. */
+declare function equationsOfAtom(node: OoxmlNode): readonly OoxmlGenericElementNode[];
 /**
- * Typed-origin domains (design D5 / ADR-S5). `mutation.*` are the canonical
- * write origins; `projection` and `awareness` MUST NOT enter history, audit,
- * snapshots, or replication.
- */
-declare const ORIGIN_IDS: {
-    readonly mutationHuman: "dev.docx-editor.core.origin.mutation.human";
-    readonly mutationAgent: "dev.docx-editor.core.origin.mutation.agent";
-    readonly mutationRemote: "dev.docx-editor.core.origin.mutation.remote";
-    readonly mutationUndo: "dev.docx-editor.core.origin.mutation.undo";
-    readonly mutationRedo: "dev.docx-editor.core.origin.mutation.redo";
-    readonly mutationMigration: "dev.docx-editor.core.origin.mutation.migration";
-    readonly mutationRepair: "dev.docx-editor.core.origin.mutation.repair";
-    readonly mutationServer: "dev.docx-editor.core.origin.mutation.server";
-    readonly projection: "dev.docx-editor.core.origin.projection";
-    readonly awareness: "dev.docx-editor.core.origin.awareness";
-};
-/** Canonical writes carry a mutation origin; these are the undoable-eligibility inputs. */
-declare const CANONICAL_MUTATION_ORIGINS: readonly string[];
-/** Origins that never enter authored state / history / audit / snapshot / replication. */
-declare const NON_CANONICAL_ORIGINS: readonly string[];
+ * Project a display equation as one layout atom. A display with one equation keeps that
+ * equation's projection, so the painted atom names the editable `m:oMath`. Several equations
+ * share one row, separated by an em space.
+ */
+declare function projectOmmlDisplay(node: OoxmlNode): OmmlEquationProjection | null;
 /**
- * Result taxonomy (design D8 / task 7.8). A transport/protocol failure that
- * prevents a valid envelope is a typed exception, not a member here.
+ * The physical justification of a paragraph whose only visible content is display math.
+ * `m:oMathParaPr/m:jc` sets it; the default `centerGroup` centers the display. Returns null
+ * when the paragraph also holds text or other content, which keeps the paragraph `w:jc`.
  */
-declare const RESULT_IDS: {
-    readonly applied: "dev.docx-editor.core.result.applied";
-    readonly validation: "dev.docx-editor.core.result.validation";
-    readonly conflict: "dev.docx-editor.core.result.conflict";
-    readonly resource: "dev.docx-editor.core.result.resource";
-    readonly authorization: "dev.docx-editor.core.result.authorization";
-    readonly aborted: "dev.docx-editor.core.result.aborted";
-};
-/** Runtime ports (extensions-and-runtime-ports spec; design D9). */
-declare const RUNTIME_PORT_IDS: {
-    readonly fonts: "dev.docx-editor.core.port.fonts";
-    readonly shaping: "dev.docx-editor.core.port.shaping";
-    readonly images: "dev.docx-editor.core.port.images";
-    readonly clock: "dev.docx-editor.core.port.clock";
-    readonly identity: "dev.docx-editor.core.port.identity";
-    readonly persistence: "dev.docx-editor.core.port.persistence";
-    readonly transport: "dev.docx-editor.core.port.transport";
-    readonly scheduling: "dev.docx-editor.core.port.scheduling";
-    readonly audit: "dev.docx-editor.core.port.audit";
-    readonly authorization: "dev.docx-editor.core.port.authorization";
-    readonly resourceAccounting: "dev.docx-editor.core.port.resource-accounting";
-    readonly cancellation: "dev.docx-editor.core.port.cancellation";
-    readonly externalResourceConsent: "dev.docx-editor.core.port.external-resource-consent";
-};
-/** Layout dependency keys (design D6 / task 8.2). */
-declare const DEPENDENCY_KEY_IDS: {
-    readonly style: "dev.docx-editor.core.dep.style";
-    readonly numbering: "dev.docx-editor.core.dep.numbering";
-    readonly section: "dev.docx-editor.core.dep.section";
-    readonly story: "dev.docx-editor.core.dep.story";
-    readonly font: "dev.docx-editor.core.dep.font";
-    readonly image: "dev.docx-editor.core.dep.image";
-    readonly table: "dev.docx-editor.core.dep.table";
-    readonly field: "dev.docx-editor.core.dep.field";
-    readonly note: "dev.docx-editor.core.dep.note";
-    readonly headerFooter: "dev.docx-editor.core.dep.header-footer";
-    readonly annotation: "dev.docx-editor.core.dep.annotation";
-};
-/** Every frozen id as a flat list, for the immutability / uniqueness gate. */
-declare const ALL_FROZEN_IDS: readonly string[];
+declare function displayMathAlignment(paragraph: {
+    readonly children: readonly OoxmlNode[];
+}): 'left' | 'center' | 'right' | null;
+/** Project a paragraph-level equation atom: inline `m:oMath` or display `m:oMathPara`. */
+declare function projectOmmlAtom(node: OoxmlNode): OmmlEquationProjection | null;
+
+/** UTF-16 placeholder for a page break in paragraph text projections. */
+declare const PAGE_BREAK_CHAR = "\f";
+/** What a `w:br` breaks. `other` covers values this engine does not model, kept losslessly. */
+type HardBreakKind = 'line' | 'page' | 'column' | 'other';
+/** Read the semantic break kind from a typed `w:br` node. */
+declare function hardBreakKind(node: OoxmlHardBreakNode): HardBreakKind;
+/** Whether a node is a `w:br` with `w:type="page"`. */
+declare function isPageBreakNode(node: OoxmlNode): node is OoxmlHardBreakNode;
+/** Text projection for a `w:br` node — one UTF-16 code unit per break. */
+declare function hardBreakText(node: OoxmlHardBreakNode): string;
+/** Attributes for a newly authored `w:br`. */
+declare function hardBreakAttributes(kind: 'line' | 'page'): OoxmlHardBreakNode['attributes'];
 
+/** Parsed TOC instruction. Unknown switches are ignored for generation but left on the wire. */
+interface TocInstruction {
+    readonly keyword: 'TOC';
+    /** Include hyperlinks (`\\h`). */
+    readonly hyperlink: boolean;
+    /** Omit page numbers (`\\n`). */
+    readonly omitPageNumbers: boolean;
+    /** Inclusive 1-based outline levels from `\\o "n-m"`. Defaults 1–9. */
+    readonly outlineStart: number;
+    readonly outlineEnd: number;
+    readonly raw: string;
+}
+/** Longest TOC field instruction read. Instructions come from a file; the parse is bounded. */
+declare const TOC_MAX_INSTRUCTION_CHARS = 256;
+/** Most entries one generated table of contents may hold. */
+declare const TOC_MAX_ENTRIES = 512;
+/** Most bookmarks minted during one TOC refresh. */
+declare const TOC_MAX_BOOKMARKS_PER_REFRESH = 512;
+/** Deepest nested field instruction followed. Caps recursion on file-supplied structure. */
+declare const TOC_MAX_FIELD_NESTING = 4;
 /**
- * A counter's limit was reached. Carries the label, the limit, and what was attempted.
+ * Most layout passes a TOC refresh runs before settling.
  *
- * Thrown at the N → N+1 boundary, so the increment that would have crossed the limit never
- * happens rather than being detected afterwards.
+ * Page numbers change the TOC's own height, which changes page numbers — bounded so a
+ * non-converging document stops rather than looping.
  */
-declare class LimitExceededError extends Error {
-    readonly label: string;
-    readonly limit: number;
-    readonly attempted: number;
-    constructor(label: string, limit: number, attempted: number);
-}
+declare const TOC_MAX_PAGE_PASSES = 3;
 /**
- * Overflow-safe counting against a fixed limit.
+ * Parse a TOC field instruction string.
  *
- * Never silently wraps: it rejects the increment that would cross its limit AND any arithmetic
- * that would exceed `Number.MAX_SAFE_INTEGER`. That second guard is the point — a file-supplied
- * count must never be trusted into an allocation, and a wrapped counter reads as small.
+ * Returns null when the leading keyword is not TOC, the string is over-long, or the
+ * outline range is hostile. Does not evaluate or fetch anything.
  */
-declare class BoundedCounter {
-    readonly label: string;
-    readonly limit: number;
-    private value;
-    constructor(label: string, limit: number);
-    get current(): number;
-    /** Remaining headroom before the limit. */
-    get remaining(): number;
-    /**
-     * Add `n` (default 1). Throws LimitExceededError if the result would exceed the
-     * limit (so `limit` itself is reachable but `limit + 1` is not) or overflow the
-     * safe-integer range. On rejection the counter is unchanged.
-     */
-    add(n?: number): number;
-    /** Whether adding `n` would be accepted, without mutating. */
-    canAdd(n?: number): boolean;
-    release(n: number): void;
+declare function parseTocInstruction(raw: string): TocInstruction | null;
+
+/** A table of contents found in a document, whether wrapped in an SDT or a bare field. */
+interface DetectedToc {
+    /** Enclosing control id when it identifies one TOC, otherwise the begin fldChar id. */
+    readonly id: string;
+    readonly beginNodeId: string;
+    readonly beginParagraphId: string;
+    readonly endParagraphId: string;
+    readonly resultParagraphIds: readonly string[];
+    /** Direct parent whose paragraph children delimit the cached result. */
+    readonly containerId: string;
+    readonly contentControlId?: string;
+    readonly instruction: TocInstruction;
 }
+/** Discover refreshable body TOCs without evaluating any field instruction. */
+declare function detectBodyTocs(part: OoxmlPart): readonly DetectedToc[];
+/** Locate the table of contents containing a position, or null. */
+declare function findDetectedToc(tocs: readonly DetectedToc[], tocId: string): DetectedToc | null;
 
-/** A budget was misused: over-carved, over-reserved, or disposed with children outstanding. */
-declare class BudgetError extends Error {
-    constructor(message: string);
+/** One heading symbol: its `w:font` and `w:char`, as the file wrote them. */
+interface TocSymbol {
+    readonly font: string | null;
+    readonly char: string;
 }
+
+declare const TWIPS: unique symbol;
+declare const POINTS: unique symbol;
 /**
- * Capacity claimed BEFORE it is allocated.
+ * A length in twentieths of a point — OOXML's `ST_TwipsMeasure` / `ST_SignedTwipsMeasure`.
  *
- * Reserve-then-allocate rather than allocate-then-check: discovering the overrun after the
- * allocation has already happened defeats the point of having a budget.
+ * The brand is intersection-typed onto `number`, so a `Twips` value still decays to `number`
+ * wherever arithmetic consumes it; only the reverse direction — passing a raw number where
+ * `Twips` is declared — is refused.
+ *
+ * @public
  */
-interface Reservation {
-    readonly amount: number;
-    readonly released: boolean;
-    release(): void;
-}
+type Twips = number & {
+    readonly [TWIPS]: true;
+};
 /**
- * One node in the hierarchical resource budget tree.
+ * A length in typographic points, the unit layout and paint compute in.
  *
- * An operation owns a root budget; parsers, extensions, workers, layout, transport and output
- * carve children from it, so no subsystem can consume more than the operation as a whole allows.
+ * @public
+ */
+type Points = number & {
+    readonly [POINTS]: true;
+};
+/**
+ * Twentieths of a point per point.
  *
- * `dispose()` REFUSES while children or reservations are outstanding, then runs registered
- * cleanups LIFO — spill files, worker termination — even if one throws. A leaked child budget is a
- * leaked worker, so the refusal is the diagnostic.
+ * @public
  */
-declare class Budget {
-    readonly label: string;
-    readonly capacity: number;
-    private readonly used;
-    private readonly children;
-    private activeReservations;
-    private readonly cleanups;
-    private disposed;
-    private carveAmount;
-    private parent?;
-    constructor(label: string, capacity: number);
-    get inUse(): number;
-    get available(): number;
-    get isDisposed(): boolean;
-    /** Reserve `amount` from this budget. Throws if it would exceed capacity. */
-    reserve(amount: number): Reservation;
-    /** Carve a child budget of `capacity` out of this budget's headroom. */
-    child(label: string, capacity: number): Budget;
-    /** Register cleanup for a spill file, worker, or queue tied to this budget. */
-    onRelease(cleanup: () => void): void;
-    /**
-     * Release this budget. Refuses while any child budget or reservation is
-     * outstanding (children must finish first). Runs cleanups LIFO, returns the
-     * carve-out to the parent, and marks disposed. Cleanup errors are collected and
-     * rethrown after every cleanup has run.
-     */
-    dispose(): void;
-    private assertLive;
-}
-
+declare const TWIPS_PER_POINT = 20;
 /**
- * Which side of the point of no return an operation is on.
+ * Assert that a number is a twips measurement.
  *
- * Canonical publication is that point. Cancelling BEFORE it rolls the whole operation back;
- * cancelling after it leaves the commit standing and cancels only derived work — layout, export,
- * caches.
+ * A compile-time cast, not a validator: bounds, integrality and finiteness stay at the parse
+ * boundary that produced the number, exactly where they are enforced today. The cast is the
+ * caller's claim about the UNIT, nothing more.
+ *
+ * @public
  */
-type CancellationPhase = 'pre-publication' | 'post-publication';
-/** Thrown from a `checkpoint()` when the operation has been cancelled. */
-declare class CancellationError extends Error {
-    /** True when the commit is already published and only derived work is cancelled. */
-    readonly derivedOnly: boolean;
-    constructor(
-    /** True when the commit is already published and only derived work is cancelled. */
-    derivedOnly: boolean, reason?: string);
-}
+declare const twips: (value: number) => Twips;
 /**
- * The read side of cancellation, handed to cooperative work.
+ * Assert that a number is a points measurement. A compile-time cast; see {@link twips}.
  *
- * Cooperative rather than pre-emptive: long work calls `checkpoint()` at declared intervals, which
- * is what lets an operation unwind promptly without the engine having to interrupt it mid-mutation.
+ * @public
  */
-interface CancellationToken {
-    readonly isCancelled: boolean;
-    readonly phase: CancellationPhase;
-    /** True only when cancelled AND the commit is already published. */
-    readonly derivedOnly: boolean;
-    /** Throws CancellationError if cancelled; call at declared checkpoint intervals. */
-    checkpoint(): void;
-}
+declare const points: (value: number) => Points;
 /**
- * The write side of cancellation, and the owner of the phase.
+ * The one twips-to-points conversion. Exact division; twips are the finer unit.
  *
- * Whoever starts an operation holds this; everything it calls gets only the token.
+ * @public
  */
-declare class CancellationController {
-    private _cancelled;
-    private _phase;
-    private _reason?;
-    cancel(reason?: string): void;
-    /** Mark canonical publication — the point of no return. */
-    markPublished(): void;
-    get isCancelled(): boolean;
-    get phase(): CancellationPhase;
-    get isPublished(): boolean;
-    /** Cancelled after publication -> full rollback is no longer possible. */
-    get derivedOnly(): boolean;
-    get token(): CancellationToken;
-}
-
-/** Injectable time source — the engine never calls Date.now directly (determinism). */
-interface ClockPort {
-    now(): number;
-}
-/** Stable id minting for sessions, commits, and allocator seeds. */
-interface IdentityPort {
-    newId(): string;
-}
-/** Cooperative scheduling of deferred work. */
-interface SchedulingPort {
-    schedule(task: () => void): void;
-}
-/** Redacted observability sink (raw text never enters here — design D5). */
-interface AuditPort {
-    record(entry: {
-        readonly kind: string;
-        readonly at: number;
-        readonly meta?: Record<string, unknown>;
-    }): void;
-}
-/** Read/write/export authorization decisions. */
-interface AuthorizationPort {
-    authorize(action: string, subject?: string): boolean;
-}
-/** Explicit consent gate for any remote/external resource (no zero-click fetch). */
-interface ExternalResourceConsentPort {
-    requestConsent(target: string): boolean;
-}
-/** Cancellation source for the current operation. */
-interface CancellationPort {
-    readonly token: CancellationToken;
-}
-/** Where documents are stored and retrieved. Opaque marker until its milestone. */
-interface PersistencePort {
-    readonly kind: 'persistence';
-}
-/** How the engine talks to a remote peer. Opaque marker until its milestone. */
-interface TransportPort {
-    readonly kind: 'transport';
-}
-/** Where font bytes come from. Opaque marker until its milestone. */
-interface FontPort {
-    readonly kind: 'font';
-}
-/** Which shaping backend measures text. Opaque marker until its milestone. */
-interface ShapingPort {
-    readonly kind: 'shaping';
-}
-/** How image bytes are decoded. Opaque marker until its milestone. */
-interface ImagePort {
-    readonly kind: 'image';
-}
-/** Where resource consumption is reported. Opaque marker until its milestone. */
-interface ResourceAccountingPort {
-    readonly kind: 'resource-accounting';
-}
+declare const twipsToPoints: (value: Twips) => Points;
 /**
- * A required port the runtime did not provide.
+ * The one points-to-twips conversion.
  *
- * Thrown rather than falling back: silently reaching for a browser global when a worker or server
- * adapter did not supply a port is exactly the coupling ports exist to prevent.
+ * Rounds to the nearest twip: every OOXML twips measurement is integral, and emitting a
+ * fractional twip would write a value no consumer of the file can represent.
+ *
+ * @public
  */
-declare class PortResolutionError extends Error {
-    readonly portId: string;
-    constructor(portId: string);
-}
+declare const pointsToTwips: (value: Points) => Twips;
 /**
- * The environment-dependent services an engine instance may reach.
+ * Read a twips attribute (`ST_TwipsMeasure`, `ST_SignedTwipsMeasure`, or a `dxa` table width)
+ * as a whole, signed number of twips, or `null` when the value is not a measurement.
  *
- * Everything outside pure computation — the clock, identity minting, scheduling, fonts, images —
- * is reached only through here, which is what lets browser, worker and server adapters supply
- * only what their runtime actually offers.
+ * The schema allows an integer or a universal measure, but files also carry decimal twips
+ * (`4743.74`, `708.0`, `707.9999999999998`). The accepted forms read as follows:
+ *
+ * - A decimal truncates toward zero: `1443.74` is 1443 and `-720.6` is -720. A leading `+`,
+ *   leading zeros, a bare fraction (`.5`) and a trailing point (`1440.`) are accepted.
+ * - A universal measure (`mm`, `cm`, `in`, `pt`, `pc`, `pi`) converts exactly and then
+ *   truncates: `1.27cm` is 720 and `0.333in` is 479. Its sign is ignored, so `-0.5in` is 720.
+ * - Whitespace, exponents, hexadecimal, uppercase units, and an integer part longer than nine
+ *   digits are not measurements.
+ *
+ * The result is NOT bounded. Callers apply their own sign rule and range clamp, because each
+ * attribute has a different valid range and a different fallback.
+ *
+ * @internal
  */
-declare class PortRegistry {
-    private readonly ports;
-    provide(portId: string, port: unknown): this;
-    has(portId: string): boolean;
-    /** Resolve a port by id or throw. */
-    resolve<T>(portId: string): T;
-    /** Assert every id in `portIds` is present; returns the missing ones (empty if all present). */
-    missing(portIds: readonly string[]): string[];
-    /** The provided port ids (for bridging to registry.resolve availablePorts). */
-    availablePorts(): string[];
-    clock(): ClockPort;
-    identity(): IdentityPort;
-}
-/** Deterministic clock: starts at `start` and advances by `step` each call. */
-declare class DeterministicClock implements ClockPort {
-    private readonly step;
-    private t;
-    constructor(start?: number, step?: number);
-    now(): number;
-}
-/** Sequential identity for tests and deterministic fixtures. */
-declare class SequentialIdentity implements IdentityPort {
-    private readonly prefix;
-    private n;
-    constructor(prefix?: string);
-    newId(): string;
+declare function readTwipsMeasure(raw: string | undefined): number | null;
+
+/** Outline heading shape consumed by TOC planning (mirrors DocumentOutlineEntry). */
+interface TocOutlineHeading {
+    readonly text: string;
+    readonly level: number;
+    readonly blockId: string;
 }
 
-/** What one operation is started with. Only `ports` is required. */
-interface OperationInit {
-    readonly ports: PortRegistry;
-    readonly limits?: Partial<ResourceLimits>;
-    readonly config?: Readonly<Record<string, unknown>>;
-    /** Root budget capacity in abstract units (default: the byte decompression limit). */
-    readonly capacity?: number;
-    /** Operation identity (from IdentityPort in production); defaulted for tests. */
-    readonly id?: string;
+/** Left-indent step between TOC levels, in twips (matches `scripts/demo-doc/toc-block.xml`). */
+declare const TOC_LEVEL_INDENT_TWIPS: Twips;
+/** Bounded left-indent twips for a TOC entry level (0-based heading depth). */
+declare function tocLeftIndentTwips(level: number): Twips;
+/** One planned TOC entry: its level, its text, and the heading it points at. */
+interface TocEntryPlan {
+    readonly level: number;
+    readonly text: string;
+    readonly headingParagraphId: string;
+    readonly bookmarkName: string;
+    readonly pageNumberText: string;
+    /** The heading's symbols, one per {@link TOC_SYMBOL_MARK} in `text`, in order. */
+    readonly symbols?: readonly TocSymbol[];
 }
+/** Build one TOC entry paragraph node. */
+declare function buildTocEntryParagraph(mint: () => string, entry: TocEntryPlan, instruction: TocInstruction, paragraphPropertiesTemplate?: OoxmlNode): OoxmlNode;
+/** Build an SDT-wrapped complex TOC field with an already planned cached result. */
+declare function buildTocContentControl(mint: () => string, entries: readonly TocEntryPlan[], instruction: TocInstruction, alias: string): OoxmlNode;
 /**
- * The frozen environment of one operation: its limits, config, ports, root budget and
- * cancellation controller.
- *
- * IMMUTABLE for the operation's lifetime, which is what lets cache reuse and replica agreement
- * key on it. A new operation always gets a fresh snapshot rather than observing a mutated one.
+ * Word flattens manual line/tab breaks from a heading into spaces in its TOC cache.
+ * Carrying them verbatim makes a short title wrap even when the row has ample room, and the
+ * same normalization is what lets a cached row be matched back to the heading it came from.
  */
-interface OperationContext {
-    readonly id: string;
-    readonly limits: ResourceLimits;
-    readonly config: Readonly<Record<string, unknown>>;
-    readonly ports: PortRegistry;
-    readonly budget: Budget;
-    readonly cancellation: CancellationController;
-}
+declare function tocEntryText(text: string): string;
 /**
- * Begin an operation, capturing its immutable environment snapshot.
+ * Plan TOC entries from the outline and existing bookmarks.
  *
- * Resolves and freezes limits and configuration, carves the root budget, and creates the
- * cancellation controller — everything downstream work needs, fixed for the operation's duration.
+ * `actorId` is explicit because this planner runs BEFORE the store transaction, so the
+ * ambient transaction actor is not bound. Callers that already have the collaboration
+ * identity pass it here. `resolveAllocationActor` still honours a
+ * `runWithTransactionActor` wrap when the caller prefers that seam.
  */
-declare function beginOperation(init: OperationInit): OperationContext;
-/** Release the operation's root budget (requires every child/reservation released). */
-declare function endOperation(ctx: OperationContext): void;
+declare function planTocEntries(part: OoxmlPart, outline: readonly TocOutlineHeading[], instruction: TocInstruction, pageNumberByParagraphId: ReadonlyMap<string, string>, excludeParagraphIds: ReadonlySet<string>, actorId?: string): {
+    readonly entries: readonly TocEntryPlan[];
+    readonly bookmarksToCreate: readonly {
+        paragraphId: string;
+        name: string;
+    }[];
+};
+/** Create bookmarkStart/End pair nodes for insertion at the start of a paragraph. */
+declare function bookmarkPairNodes(mint: () => string, name: string, id: string): {
+    readonly start: OoxmlNode;
+    readonly end: OoxmlNode;
+};
 
-/** What a limit counts. Typed so a byte cap and a depth cap cannot be compared by accident. */
-type LimitUnit = 'bytes' | 'count' | 'depth' | 'ratio' | 'passes';
 /**
- * Where a limit is enforced.
+ * The heading each cached result row stands for, aligned with `toc.resultParagraphIds`.
  *
- * Declared per limit so enforcement happens at the boundary that can still refuse cheaply — a zip
- * cap checked during layout has already let the bomb decompress.
+ * `null` for a row that names no heading this document still has — a stale row, or the
+ * chrome/blank paragraphs a cached result can carry. Callers leave those alone rather than
+ * writing another row's number into them.
  */
-type EnforcementPhase = 'package-read' | 'xml-parse' | 'layout' | 'output';
-/** One limit's unit and enforcement phase — the metadata that makes limits testable uniformly. */
-interface LimitSpec {
-    readonly unit: LimitUnit;
-    readonly phase: EnforcementPhase;
+declare function resolveTocRowHeadings(part: OoxmlPart, toc: DetectedToc, outline: readonly TocOutlineHeading[], excludeParagraphIds: ReadonlySet<string>): readonly (string | null)[];
+
+/** One paragraph in the index: its node id, its story, and its position. */
+interface ParagraphIndexEntry {
+    /** Canonical tree node id — the stable identity operations address. */
+    readonly nodeId: string;
+    /** Position among the story's paragraphs, in document order. */
+    readonly ordinal: number;
+    /** Concatenated text content, with tabs and breaks mapped as the model reads them. */
+    readonly text: string;
+    /** Node ids of the paragraph's runs, in order. */
+    readonly runIds: readonly string[];
 }
-/** Unit + enforcement phase for every resource limit. */
-declare const LIMIT_SPECS: Readonly<Record<keyof ResourceLimits, LimitSpec>>;
-/** Every limit name, for iterating the specs and asserting each has a unit and phase. */
-declare const LIMIT_KEYS: (keyof ResourceLimits)[];
-/** A phase-scoped overflow-safe counter for one limit. */
-declare function makeLimitCounter(limits: ResourceLimits, key: keyof ResourceLimits): BoundedCounter;
-/**
- * Deterministic memory substitute. Tracks current and peak "allocated" units
- * against a hard byte ceiling; `allocate` fails closed (LimitExceededError) past
- * the limit. Used in place of process RSS so memory-limit tests are reproducible
- * and cancellation/cleanup can be asserted without a real allocator.
- */
-declare class DeterministicMemoryMeter {
-    private readonly counter;
-    private current;
-    private peak;
-    constructor(limitBytes: number);
-    allocate(bytes: number): void;
-    free(bytes: number): void;
-    get currentBytes(): number;
-    get peakBytes(): number;
-    /** Release everything (cancellation/cleanup path). */
-    reset(): void;
-}
-/** Assert the finite-default / hard-ceiling invariant holds for every limit. */
-declare function assertLimitInvariants(): void;
-
-/** Any JSON value. The domain canonicalization and stable hashing operate over. */
-type Json = null | boolean | number | string | Json[] | {
-    [k: string]: Json;
-};
-/**
- * Produce a canonical string for `value`, dropping any object key whose name is
- * in `ephemera` at any depth. Numbers are emitted losslessly; -0 normalizes to 0;
- * non-finite numbers are rejected (they must never enter a comparator input).
- */
-declare function canonicalize(value: unknown, ephemera?: ReadonlySet<string>): string;
-/** 64-bit FNV-1a over the canonical form, returned as a 16-char hex string. */
-declare function stableHash(value: unknown, ephemera?: ReadonlySet<string>): string;
-
-/**
- * How one artifact class is compared.
- *
- * Frozen per artifact: nothing here invents a tolerance for an artifact the spec requires to
- * match exactly.
- */
-type ComparatorMode = 'canonical-exact' | 'exact' | 'tolerance' | 'sync-optimization-only';
-/** One artifact class's comparison mode and its declared ephemera — fields excluded from equality. */
-interface ComparatorDescriptor {
-    readonly id: string;
-    readonly mode: ComparatorMode;
-    /** Object keys excluded from canonical-exact comparison (declared ephemera). */
-    readonly ephemera: readonly string[];
-    readonly note: string;
-}
-/** The frozen artifact comparator set. */
-declare const COMPARATORS: {
-    readonly authoredState: {
-        readonly id: "dev.docx-editor.core.comparator.authored-state";
-        readonly mode: 'canonical-exact';
-        readonly ephemera: readonly ["revision", "provenance", "producedAt", "commitId"];
-        readonly note: 'canonical normalized authored records; ephemera excluded';
-    };
-    readonly anchor: {
-        readonly id: "dev.docx-editor.core.comparator.anchor";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'internal anchor identity/affinity compares exactly';
-    };
-    readonly yjsStateVector: {
-        readonly id: "dev.docx-editor.core.comparator.yjs-state-vector";
-        readonly mode: 'sync-optimization-only';
-        readonly ephemera: readonly [];
-        readonly note: 'exchange optimization only; never proves update or delete-set coverage';
-    };
-    readonly shapedRun: {
-        readonly id: "dev.docx-editor.core.comparator.shaped-run";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'glyph ids, clusters, and fixed-point advances compare exactly';
-    };
-    readonly paginationFingerprint: {
-        readonly id: "dev.docx-editor.core.comparator.pagination-fingerprint";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'page/column boundaries, break causes, fixed-point geometry compare exactly';
-    };
-    readonly semanticTree: {
-        readonly id: "dev.docx-editor.core.comparator.semantic-tree";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'reading order, roles, headings, alt text compare exactly';
-    };
-    readonly hitTest: {
-        readonly id: "dev.docx-editor.core.comparator.hit-test";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'resolved hit target and cluster affinity compare exactly';
-    };
-    readonly pdfSemantics: {
-        readonly id: "dev.docx-editor.core.comparator.pdf-semantics";
-        readonly mode: 'canonical-exact';
-        readonly ephemera: readonly ["objectNumber", "producer", "creationDate", "modDate", "subsetTag"];
-        readonly note: 'canonical semantic PDF objects; container ephemera excluded';
-    };
-    readonly rasterCheckpoint: {
-        readonly id: "dev.docx-editor.core.comparator.raster-checkpoint";
-        readonly mode: 'tolerance';
-        readonly ephemera: readonly [];
-        readonly note: 'documented unavoidable raster comparison; explicit tolerance only';
-    };
-    readonly benchmarkEvidence: {
-        readonly id: "dev.docx-editor.core.comparator.benchmark-evidence";
-        readonly mode: 'sync-optimization-only';
-        readonly ephemera: readonly [];
-        readonly note: 'diagnostic evidence, not an equivalence basis';
-    };
-};
-/** Which frozen comparator to use. */
-type ComparatorName = keyof typeof COMPARATORS;
-/** Whether two artifacts matched, and where they diverged when they did not. */
-interface ComparisonResult {
-    readonly equal: boolean;
-    /** Canonical forms when unequal (diagnostic). */
-    readonly left?: string;
-    readonly right?: string;
-}
-/**
- * Compare two artifacts under a named comparator. `canonical-exact` and `exact`
- * compare canonical forms (exact drops no ephemera). `tolerance` requires an
- * epsilon and compares finite numbers structurally. `sync-optimization-only`
- * throws — such artifacts are never an equivalence basis.
- */
-declare function compareArtifacts(name: ComparatorName, left: unknown, right: unknown, opts?: {
-    epsilon?: number;
-}): ComparisonResult;
-/** Fingerprint an artifact under a named comparator's canonicalization policy. */
-declare function fingerprint(name: ComparatorName, value: unknown): string;
-
-/** Whether a recorded conformance step was expected to commit or be refused. */
-type FixtureOutcome = 'applied' | 'aborted' | 'validation' | 'conflict' | 'resource' | 'authorization';
-/** The change one step produced, summarized to what a fixture can compare across runtimes. */
-interface ModelChangeSummary {
-    readonly fromRevision: number;
-    readonly toRevision: number;
-    readonly origin: string;
-    readonly dirty: readonly string[];
-    readonly dependencyKeys: readonly string[];
-}
-/** Where anchors sat after a step — how a fixture proves positions survived an edit. */
-interface AnchorSnapshot {
-    readonly anchorId: string;
-    readonly story: string;
-    readonly block: string;
-    readonly affinity: 'before' | 'after';
-}
-/** What one step must produce: its outcome, its change summary, and its authored-state hash. */
-interface FixtureExpectation {
-    readonly outcome: FixtureOutcome;
-    /** Present iff outcome === 'applied'; MUST be > baseRevision. */
-    readonly committedRevision?: number;
-    readonly modelChange?: ModelChangeSummary;
-    /** 16-hex authored-state fingerprint (comparator 0.4). */
-    readonly authoredStateHash?: string;
-    readonly outputHash?: string;
-    readonly anchors?: readonly AnchorSnapshot[];
-}
-/** One recorded operation and what it was expected to do. */
-interface FixtureStep {
-    readonly baseRevision: number;
-    readonly origin: string;
-    /** Opaque DocOp payloads (schema owned by section 4). */
-    readonly ops: readonly unknown[];
-    readonly expect: FixtureExpectation;
+/** One story root — body, a header/footer variant, or a note part. */
+interface StoryIndexEntry {
+    /** The part the story lives in. */
+    readonly partName: string;
+    /** The `w:body` (or story root) node id. */
+    readonly rootId: string;
+    readonly paragraphs: readonly ParagraphIndexEntry[];
 }
-/** Opaque encoded backend bytes (snapshot or replication update). */
-interface EncodedEnvelope {
-    readonly kind: 'snapshot' | 'update';
-    readonly protocolVersion: number;
-    readonly schemaVersion: number;
-    readonly documentId: string;
-    readonly byteLength: number;
-    /** Hex-encoded opaque bytes; length MUST equal byteLength. */
-    readonly bytesHex: string;
+/** One style definition, indexed by the id content references it under. */
+interface StyleIndexEntry {
+    readonly styleId: string;
+    readonly type: string;
+    readonly nodeId: string;
+    readonly name: string | null;
+    readonly basedOn: string | null;
+    /** Whether the part marks this the default style for its type (`w:default="1"`). */
+    readonly isDefault: boolean;
 }
-/** Which implementation recorded a fixture — local store, Yjs, or a binding. */
-type FixtureSource = {
-    readonly kind: 'create';
-} | {
-    readonly kind: 'docx';
-    readonly sha256: string;
-    readonly bytesRef: string;
-};
 /**
- * The frozen conformance container: revisions, origins, operations, changes, snapshots and
- * hashes.
+ * The derived lookups over a part: paragraphs, stories and styles by id.
  *
- * The CONTAINER is what is frozen — field names, origin membership, revision monotonicity, hash
- * format. The op and change payloads travel opaquely, so their schemas can evolve without
- * invalidating every recorded fixture.
+ * Diff-patched on commit rather than rebuilt — rebuilding every index per keystroke is what made
+ * typing scale with document length.
  */
-interface ConformanceFixture {
-    readonly formatVersion: 1;
-    readonly documentId: string;
-    readonly source: FixtureSource;
-    readonly steps: readonly FixtureStep[];
-    readonly snapshots?: readonly EncodedEnvelope[];
-    readonly updates?: readonly EncodedEnvelope[];
-}
-/** Whether a fixture is well-formed, listing every structural violation. */
-interface ValidationResult {
-    readonly valid: boolean;
-    readonly errors: readonly string[];
-}
-/** Structurally validate a fixture against the frozen format rules. */
-declare function validateFixture(fixture: ConformanceFixture): ValidationResult;
-
-/** The outcome a store reports for one replayed step. */
-interface ReplayOutcome {
-    readonly outcome: FixtureOutcome;
-    readonly committedRevision?: number;
-    /** Canonical authored-state value AFTER the step (hashed via comparator 0.4). */
-    readonly authoredState?: unknown;
-}
-/** The interface a conformance runtime implements so one fixture can drive every backend. */
-interface ReplayStore {
-    /** Initialize from the fixture source; return the initial revision (0 for create). */
-    init(fixture: ConformanceFixture): number;
-    /** Apply one step and report what happened. */
-    applyStep(step: FixtureStep): ReplayOutcome;
-}
-/** What replaying a fixture produced: per-step outcomes and where they diverged. */
-interface ReplayReport {
-    readonly ok: boolean;
-    readonly mismatches: readonly string[];
+interface OoxmlIndexes {
+    /** The tree revision these projections were derived from. */
+    readonly revision: number;
+    /** Body story first, then any other story parts, keyed by part name. */
+    readonly stories: ReadonlyMap<string, StoryIndexEntry>;
+    /** Every paragraph across every story, keyed by node id. */
+    readonly paragraphs: ReadonlyMap<string, ParagraphIndexEntry>;
+    readonly relationships: ReadonlyMap<string, readonly RelationshipRecord[]>;
+    readonly styles: ReadonlyMap<string, StyleIndexEntry>;
 }
+/** Style definitions, read out of the generic `w:styles` tree. */
+declare function indexStyles(part: OoxmlPart | undefined): Map<string, StyleIndexEntry>;
+/** The package's style definitions part, if it has one. */
+declare function stylesPartOf(pkg: OoxmlPackage): OoxmlPart | undefined;
 /**
- * Replay a fixture against a store and check every step's outcome, committed
- * revision, and authored-state fingerprint against the fixture's expectations.
- */
-declare function replayFixture(fixture: ConformanceFixture, store: ReplayStore): ReplayReport;
-/** Hash a store's authored state, so two runtimes replaying one fixture can be compared. */
-declare function hashAuthored(authoredState: unknown): string;
-
-/**
- * Keys that must never be assigned from file data.
+ * Derive every index from one canonical package revision.
  *
- * XML attribute names become object keys, and a document controls those names — assigning
- * `__proto__` into an ordinary object is the prototype-pollution hazard this engine audits for.
- */
-declare const DANGEROUS_KEYS: readonly string[];
-/** A file-derived key that would pollute a prototype. Refused, never sanitized-and-accepted. */
-declare class DangerousKeyError extends Error {
-    readonly key: string;
-    readonly path: string;
-    constructor(key: string, path: string);
-}
-/** Whether a key is one of {@link DANGEROUS_KEYS}. */
-declare function isDangerousKey(key: string): boolean;
-/** A fresh null-prototype record — the only object shape parser intermediates use. */
-declare function nullRecord<T = unknown>(): Record<string, T>;
-/**
- * Recursively convert `value` into null-prototype records, rejecting any
- * dangerous object key. Arrays and primitives pass through (arrays rebuilt so no
- * inherited prototype pollution survives). Throws DangerousKeyError on the first
- * unsafe key, naming its path. Cyclic inputs are rejected.
+ * Pure: the same package and revision always produce the same index, which is what makes
+ * "rebuild rather than mutate" a safe invalidation strategy.
  */
-declare function toSafeRecord(value: unknown, path?: string): unknown;
+declare function deriveOoxmlIndexes(pkg: OoxmlPackage, revision: number): OoxmlIndexes;
 
-/** Locate `[Content_Types].xml` bytes regardless of zip key spelling. */
-declare function contentTypesPartBytes(pkg: OoxmlPackage): {
-    readonly storageKey: string;
-    readonly bytes: Uint8Array;
-} | null;
+/** One paragraph's meaning, independent of how it was spelled in XML. */
+interface ParagraphDigest {
+    /** Ordinal identity within its story. Node ids are NOT used: a reopened package
+     *  legitimately re-derives them, and requiring them to match would test the id scheme
+     *  rather than the content. */
+    readonly ordinal: number;
+    /**
+     * Where the paragraph SITS: the element path from the story root, so a paragraph that
+     * moves out of the table cell it was written in is a difference rather than a paragraph
+     * with the same ordinal and the same text.
+     */
+    readonly path: string;
+    /**
+     * `w14:paraId`, uppercase-normalized (matching is case-insensitive), or null. This is
+     * MANAGED identity — the agent contract anchors on it and comment threading references
+     * it — so a serializer silently dropping it must be a digest difference. Other paragraph
+     * attributes (`w:rsidR` …) stay deliberately undigested: they are revision noise.
+     */
+    readonly paraId: string | null;
+    /** Text content, including tabs and hard breaks as their characters. */
+    readonly text: string;
+    /** Accepted paragraph properties, as sorted tokens including nested children. */
+    readonly paragraphProperties: readonly string[];
+    /** Per-run accepted properties, in run order. */
+    readonly runProperties: readonly (readonly string[])[];
+    /** Fingerprints of every generic (unknown) subtree, in document order. */
+    readonly genericStructure: readonly string[];
+}
+/** One story reduced to its semantic content, ignoring everything a normalized re-emit changes. */
+interface StoryDigest {
+    readonly partName: string;
+    readonly paragraphs: readonly ParagraphDigest[];
+    /**
+     * Every block-level element of the part OUTSIDE a paragraph, in document order, as
+     * `path name(attributes)` — the tables, rows, cells, sections, content controls and
+     * their property children, each at the position that says what contains it.
+     *
+     * A paragraph's own internals are not here (they are its `ParagraphDigest`), which keeps
+     * this list proportional to a document's STRUCTURE rather than its text.
+     */
+    readonly structure: readonly string[];
+}
 /**
- * What a package-level invariant walk found wrong.
+ * The whole document's semantic content — one of the D9 losslessness oracles.
  *
- * Package invariants are cross-PART: a relationship pointing at a part that does not exist, or a
- * part no content-type record covers. Neither is visible from inside a single part's tree.
+ * What a save/reopen round-trip is compared on. Byte identity applies only to non-XML parts;
+ * modelled parts re-emit normalized, so equality is asserted HERE rather than on bytes.
  */
-type PackageInvariantCode = 'dangling-relationship' | 'missing-content-type'
-/** A part occupies a name OPC reserves for package infrastructure. */
- | 'reserved-part-name'
-/** Two parts whose names differ only by case, which OPC treats as one part. */
- | 'duplicate-part-name'
-/** A part name the OPC screens refuse; `writeZip` would throw on save. */
- | 'unsafe-part-name';
-/** One package invariant violation, located by part name and relationship id. */
-interface PackageInvariantIssue {
-    readonly code: PackageInvariantCode;
-    /** The part the issue is about: the missing target, or the part with no type. */
-    readonly partName: string;
-    /** For a dangling relationship, the owner that points at nothing. */
-    readonly ownerPart?: string;
+interface SemanticDigest {
+    readonly stories: readonly StoryDigest[];
 }
-/** Whether a package satisfies its cross-part invariants, listing every violation otherwise. */
-type PackageInvariantResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly issues: readonly PackageInvariantIssue[];
+/** Where two digests diverge — the diagnostic when a round-trip loses something. */
+type DigestDifference = {
+    readonly path: string;
+    readonly before: string;
+    readonly after: string;
 };
-/** Relationship records owned by one part, in authored order. */
-declare function relationshipsOf(pkg: OoxmlPackage, ownerPart: string): readonly RelationshipRecord[];
-/** The content type that resolves for a part name, or null when nothing declares one. */
-declare function resolveContentTypeOf(pkg: OoxmlPackage, partName: string): string | null;
-/** The `.rels` part that owns a part's relationships, by OPC convention. */
-declare function relsPartNameFor(partName: string): string;
+/** Digest one part: its paragraphs, and the structure that holds them. */
+declare function digestPart(part: OoxmlPart): StoryDigest | null;
+/** Digest every part, in the given order. */
+declare function semanticDigest(parts: Iterable<OoxmlPart>): SemanticDigest;
 /**
- * Declare a content type for a part, by upserting an `<Override>` in the content-types tree.
+ * Every way two digests differ, as readable paths.
  *
- * A no-op when the part already resolves to the same type, so repeating a write does not append
- * a duplicate entry. Resolving to a DIFFERENT type replaces the existing Override in place.
- * `forceOverride` writes an explicit Override even when a Default already matches.
+ * Returns the differences rather than a boolean because "the round trip lost something" is
+ * useless without saying what — the failure this oracle exists to catch is a silent drop,
+ * and a bare `false` reproduces the silence.
  */
-declare function withContentTypeOverride(pkg: OoxmlPackage, partName: string, contentType: string, options?: {
-    readonly forceOverride?: boolean;
-}): OoxmlPackage;
-/** What {@link withoutPart} answers: `ok: false` leaves the package exactly as it was. */
-interface WithoutPartResult {
-    readonly pkg: OoxmlPackage;
-    readonly ok: boolean;
-}
-/** Add or replace one relationship on a part, returning a new package. */
-declare function withRelationship(pkg: OoxmlPackage, ownerPart: string, type: string, rawTarget: string): {
-    readonly pkg: OoxmlPackage;
-    readonly relationshipId: string;
-    readonly ok: boolean;
-};
+declare function diffSemanticDigests(before: SemanticDigest, after: SemanticDigest): DigestDifference[];
+
+/** Valid per MS-DOCX: 8 hex digits, non-zero, below 0x80000000. */
+declare function isValidParaId(value: string): boolean;
+/** The authored `w14:paraId` value of an element, verbatim, or null. */
+declare function paraIdOf(node: OoxmlNode): string | null;
+/** FNV-1a over UTF-16 code units — the deterministic mint every id derivation shares. */
+declare function fnv1a32(value: string): number;
 /**
- * Add a part that does not exist yet, with the content-type override it needs to be openable.
+ * Deterministic 8-hex mint in (0x00000000, 0x80000000), collision-free against
+ * `used` (uppercase hex). Same seed + same used-set → same value, which is what
+ * keeps `splitParagraphMany` byte-identical to its equivalent single splits and
+ * a reopened save identical to the session that produced it.
+ */
+declare function mintParaId(seed: string, used: ReadonlySet<string>): string;
+/** Every valid `w14:paraId` in the tree, uppercased. Memoized per root object. */
+declare function usedParaIds(root: OoxmlElement): ReadonlySet<string>;
+/**
+ * The non-empty prefix the part ROOT binds to the w14 namespace, or null.
  *
- * Deliberately does NOT create a relationship: a part is reachable because something points at
- * it, and which part points at it is the caller's decision. Creating one here would guess.
+ * Minted attributes require an in-scope binding (the invariant validator reports
+ * `invalid-qname` otherwise, and the serializer would allocate an `nsN` alias).
+ * Only the root binding counts: a binding authored on some descendant does not
+ * cover paragraphs elsewhere in the tree.
  */
-declare function withNewPart(pkg: OoxmlPackage, partName: string, root: OoxmlElement, contentType: string): OoxmlPackage;
+declare function w14RootPrefix(root: OoxmlElement): string | null;
+/** The minted `[w14:paraId, w14:textId]` pair. `textId` mirrors `paraId`: it has no uniqueness requirement, no consumer reads it, and one allocator is simpler than two — but Word writes both, so we write both. */
+declare function mintedParagraphIdentityAttributes(prefix: string, value: string): readonly OoxmlAttribute[];
 /**
- * The two invariants a package must satisfy before it is published.
+ * Load-time paragraph-identity normalization for a session's main part.
  *
- * Both describe the half-written state that splitting a multi-part write across transactions
- * produces, and both make a package Word refuses to open:
+ * Keeps every valid, first-seen paraId verbatim; mints (deterministically, seeded
+ * by the paragraph's structural node id) for paragraphs whose id is missing,
+ * malformed, zero, out of range, or a duplicate. Adds the root `xmlns` binding
+ * the minted attributes need. Returns the INPUT PART REFERENCE when there is
+ * nothing to do — a document Word saved yesterday re-serializes byte-identical.
  *
- *  - a relationship pointing at a part nobody created;
- *  - a part with no content type, which is unopenable even though the XML is well formed.
+ * Attribute-only rebuilds move no child, so every node keeps its structural-path
+ * id; the copy respreads only the ancestors of changed paragraphs.
  *
- * Checked at the commit boundary rather than inside each primitive, for the same reason part
- * validation moved there: a transaction is allowed to pass through an inconsistent intermediate
- * as long as nothing can observe it.
+ * Fail-open: if the rebuilt part does not validate (a bug, or a pathology the
+ * prefix choice could not defuse), the original part is returned — a document
+ * must never become unopenable over an identity enhancement.
  */
-declare function validatePackageInvariants(pkg: OoxmlPackage): PackageInvariantResult;
+declare function normalizeParagraphIdentity(part: OoxmlPart): OoxmlPart;
+
+/** One `w:docPart` of the glossary, with the blocks its body holds. */
+interface BuildingBlock {
+    /** `w:docPartPr/w:name`, the identity a control's placeholder and a pick refer to. */
+    readonly name: string;
+    /** `w:category/w:gallery`, an `ST_DocPartGallery` value such as `docParts`. */
+    readonly gallery: string;
+    /** `w:category/w:name`; `General` when the block declares none. */
+    readonly category: string;
+    /** The `w:docPartBody` children: paragraphs, tables and block controls, in order. */
+    readonly blocks: readonly OoxmlNode[];
+}
+/** The gallery and category a `w:docPartList` control lists. */
+interface BuildingBlockGalleryFilter {
+    readonly gallery: string;
+    readonly category: string | null;
+}
+/** The glossary part, through the main part's relationship or the conventional name. */
+declare function glossaryPartOf(pkg: OoxmlPackage): OoxmlPart | null;
+/** Every named building block of the glossary, in authored order. Empty without a glossary. */
+declare function buildingBlocksOf(pkg: OoxmlPackage): readonly BuildingBlock[];
+/** The gallery a `w:docPartList` control lists, or null for any other control. */
+declare function buildingBlockGalleryOf(control: OoxmlNode): BuildingBlockGalleryFilter | null;
+/**
+ * The blocks a gallery control offers: same gallery, and the control's category when it names
+ * one. Sorted by category, then name, as Word groups its list.
+ */
+declare function buildingBlocksForControl(pkg: OoxmlPackage, control: OoxmlNode): readonly BuildingBlock[];
 
 /**
- * Whether a string is a valid XML NCName in the strict ASCII profile — a name with no colon.
+ * Which story a comment deletion or resolution may read markers from.
  *
- * This is the rule for names the engine itself writes or accepts from a caller. Names read
- * from a document use {@link isXmlNCName}, which admits every XML 1.0 name.
+ * `w:id` is not unique across stories: a header and the body can both hold comment 1.
  */
-declare function isValidNCName(name: string): boolean;
-/** A QName is an optional `prefix:` (both NCNames) — never attacker-derived. */
-declare function isValidQName(name: string): boolean;
+interface CommentDeletionOwner {
+    /** Canonical name of the part holding the story's markers. */
+    readonly storyPartName: string;
+    /**
+     * When the story is one note inside a shared notes part, that note's `w:id`.
+     * Absent means the whole part is the story (body, header, footer).
+     */
+    readonly noteId?: number;
+}
+
 /**
- * Validate a qualified name, throwing when it is malformed.
+ * Delete a comment thread: that story's markers, and metadata no other story still names.
  *
- * Guards the serializer: an invalid QName written into XML produces a file Word cannot open, so
- * it fails here rather than at save.
+ * `owner` names the story whose markers may be stripped. Omitted, it is the main document
+ * body — never every XML part. A header or note that reused the same `w:id` is a different
+ * remark; pass its part (and `noteId` when the story is one note) to delete that one.
+ *
+ * Returns the package unchanged when the id names no comment, and null when a removal was
+ * refused — a caller inside a transaction rolls back rather than committing a package whose
+ * comment is half gone.
  */
-declare function assertValidQName(name: string): void;
+declare function deleteCommentThread(pkg: OoxmlPackage, commentId: string, owner?: CommentDeletionOwner): OoxmlPackage | null;
 /**
- * Controlled namespace-prefix allocation: deterministic, collision-free prefixes
- * for namespace URIs. A known URI always yields the same registered prefix; new
- * URIs get a generated `ns{n}` prefix, never one derived from file content.
+ * Delete every comment the edit between `before` and `after` emptied in `owner`'s story.
+ *
+ * `owner` omitted is the main document body, matching {@link deleteCommentThread}.
+ *
+ * THE TEST, exactly, and per story. A comment dies when the words it covered in that story are
+ * gone and nothing in that story still places it. A neighbour that reused the same `w:id` is
+ * judged under its own owner. Notes that vanished (reference cascade) are reaped as their own
+ * stories so a unique id still loses its `comments.xml` body. Remaining-marker overflow
+ * preserves comments/commentEx/commentId metadata rather than deleting records the scan could
+ * not prove unused. Null is reserved for a removal that actually failed.
  */
-declare class PrefixAllocator {
-    private readonly byUri;
-    private readonly usedPrefixes;
-    private counter;
-    constructor(known?: Readonly<Record<string, string>>);
-    prefixFor(namespaceUri: string): string;
-    /** The declared bindings, for emitting xmlns declarations. */
-    bindings(): {
-        prefix: string;
-        uri: string;
-    }[];
+declare function cascadeEmptiedComments(before: OoxmlPackage, after: OoxmlPackage, owner?: CommentDeletionOwner): OoxmlPackage | null;
+
+/** Presentation settings the document itself states. Absence is the answer, never an error. */
+interface DocumentViewSettings {
+    /**
+     * `w:doNotShadeFormData` (§17.15.1.49) — do NOT shade legacy form fields.
+     *
+     * Word draws a grey block behind every `w:ffData` field so a reader can find the blanks in a
+     * form. It is on by DEFAULT, and this element is how a document turns it off, so the absent
+     * case means shading. Reading the name as "shade form data" inverts it and blanks the shading
+     * on exactly the documents that asked for it loudest.
+     *
+     * Never printed, by Word or by us: it marks where to type, and a printed form has no blanks
+     * to find.
+     */
+    readonly doNotShadeFormData: boolean;
 }
+/** The defaults a document with no `settings.xml` gets: everything Word would shade, shaded. */
+declare const DEFAULT_VIEW_SETTINGS: DocumentViewSettings;
+/** Read the view settings from a `settings.xml` root, or the defaults when it has none. */
+declare function readViewSettings(settingsRoot: OoxmlNode | null | undefined): DocumentViewSettings;
 
+/** How deep transparent block wrappers may nest before the walk stops descending. */
+declare const MAX_STORY_SDT_NESTING = 32;
+/** Which kind of story a root is. Layout walks all four the same way. */
+type OoxmlStoryKind = 'body' | 'header' | 'footer' | 'note';
+/** One story root and the blocks under it, with transparent block wrappers already flattened. */
+interface OoxmlStoryRoot {
+    readonly kind: OoxmlStoryKind;
+    /** The `w:body` / `w:hdr` / `w:ftr` / `w:footnote` element that holds the blocks. */
+    readonly root: OoxmlNode;
+}
 /**
- * A hyperlink target projected for a RUNTIME sink, or the reason it was withheld.
+ * Every story root in a part, in document order.
  *
- * The authored target stays authored — the record layer keeps it verbatim and escapes it into
- * owned OOXML, which is not a runtime sink. Only this allowlist-sanitized projection reaches DOM,
- * CSS, navigation or fetch, so `javascript:`, `data:` and `vbscript:` never leave the boundary.
- */
-type HrefProjection = {
-    readonly ok: true;
-    readonly href: string;
-} | {
-    readonly ok: false;
-    readonly inert: true;
-};
+ * Does not descend INTO a story: a story's blocks are the walk below, and a story root never
+ * contains another story root.
+ */
+declare function storyRootsOf(part: OoxmlPart): readonly OoxmlStoryRoot[];
 /**
- * Project a file-derived URL for a DOM/navigation sink. Strips embedded
- * tab/LF/CR (used to smuggle `java\nscript:`), allows relative URLs and the
- * scheme allowlist, and renders everything else inert. Never fetches.
+ * Whether a part is SHAPED to hold stories — a body, a header, a footer, or a notes part.
+ *
+ * A shape test, deliberately not `storyRootsOf(part).length > 0`. That counts EDITABLE stories,
+ * and a notes part holding nothing but `w:separator` and `w:continuationSeparator` has none —
+ * which is the footnotes part Word writes into every document that ever held a footnote. A
+ * caller asking "should I walk this part at all" that used the editable count skipped it
+ * entirely, and the two callers that ask are a payload sweep and an export strip: both DELETE
+ * what they conclude nothing names.
  */
-declare function sanitizeHref(raw: string): HrefProjection;
-/** XML-escape a value for validated serialization back into owned OOXML. */
-declare function escapeXml(value: string): string;
+declare function isStoryPart(part: OoxmlPart): boolean;
+/** The main body story of a part, or null when the part holds none. */
+declare function bodyStoryRoot(part: OoxmlPart): OoxmlNode | null;
 /**
- * CSS string-escape a file-derived value (e.g. an `@font-face` family name or an
- * inline style value). Emits `\<hex> ` escapes for quotes, backslash, and
- * controls so the value cannot break out of its CSS string.
+ * Every paragraph of one story, in reading order.
+ *
+ * Descends through tables (rows, cells, nested tables), block controls and block custom XML.
+ * The returned nodes are paragraph elements; a caller addresses them by `id`.
  */
-declare function escapeCssString(value: string): string;
-/** Whether a file-derived CSS fragment contains a `url()` or `@import` (must be rejected). */
-declare function containsCssFetch(value: string): boolean;
+declare function storyParagraphs(root: OoxmlNode): readonly OoxmlNode[];
 /**
- * Content that must never execute or auto-resolve: OLE objects, macros, DDE and `INCLUDE*` field
- * instructions.
+ * The block walk itself, appending into `out`.
  *
- * Rendered INERT by default rather than stripped — removing it would be a lossless-preservation
- * failure, so it is carried and never acted on.
+ * Exported so `allParagraphs` in the binding lane is the same traversal rather than a second
+ * copy of it.
  */
-declare const INERT_EXECUTABLE_KINDS: readonly ['field-dde', 'field-include', 'macro', 'activex', 'ole', 'embedded-object', 'executable-relationship'];
-/** One of {@link INERT_EXECUTABLE_KINDS}. */
-/** One of {@link INERT_EXECUTABLE_KINDS} — content carried but never executed. */
-type InertExecutableKind = (typeof INERT_EXECUTABLE_KINDS)[number];
-/** Whether a content kind is one this engine refuses to execute or auto-resolve. */
-declare function isInertExecutable(kind: string): boolean;
-/** Whether a field instruction's leading keyword is safe to evaluate. */
-declare function isEvaluableField(instruction: string): boolean;
-/** One item a scrub pass considers: its kind, and where in the package it sits. */
-interface ContentItem {
-    readonly id: string;
-    readonly kind: string;
+declare function collectStoryParagraphs(children: readonly OoxmlNode[], out: OoxmlNode[], sdtDepth: number): void;
+
+/** One searchable text-box story and the drawing location that can reveal it. */
+interface TextboxStoryRoot {
+    /** The `w:txbxContent` story root. */
+    readonly root: OoxmlElement;
+    /** Layout atom id used to select the drawing, including an MC wrapper when present. */
+    readonly drawingNodeId: string;
+    /** Canonical node id of the paragraph that anchors the drawing. */
+    readonly hostParagraphId: string;
 }
 /**
- * What an explicit scrub removed.
+ * List the text-box stories in one part, in document order.
  *
- * A scrub DECLARES ITSELF non-lossless: removing executable content changes the file, which is a
- * choice a caller makes deliberately rather than a default the engine applies.
+ * The bounded walk stops at drawings. It does not project pictures, shape geometry, or story
+ * content. Results are memoized by immutable part-root identity.
  */
-interface ScrubResult {
-    readonly kept: readonly ContentItem[];
-    readonly removed: readonly ContentItem[];
-    /** A scrub that removes anything is non-lossless by definition. */
-    readonly nonLossless: boolean;
-}
-/** Explicit scrub export: remove inert executable classes, report removals. */
-declare function scrubExport(items: readonly ContentItem[]): ScrubResult;
+declare function textboxStoriesInPart(part: OoxmlPart): readonly TextboxStoryRoot[];
 
-/** True for an `m:oMathPara` display equation. */
-declare function isOmmlDisplay(node: OoxmlNode): node is OoxmlGenericElementNode;
-/** True for a paragraph-level equation atom: `m:oMath` or `m:oMathPara`. */
-declare function isOmmlEquationAtom(node: OoxmlNode): node is OoxmlGenericElementNode;
-/** The `m:oMath` equations of a display, or the equation itself for an inline `m:oMath`. */
-declare function equationsOfAtom(node: OoxmlNode): readonly OoxmlGenericElementNode[];
+/** Relationship from the story to one data part. */
+declare const CUSTOM_XML_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
+/** Relationship from a data part to the properties that carry its `ds:itemID`. */
+declare const CUSTOM_XML_PROPS_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXmlProps";
+/** `itemPropsN.xml` needs an Override; `itemN.xml` rides the package's `xml` default. */
+declare const CUSTOM_XML_PROPS_TYPE = "application/vnd.openxmlformats-officedocument.customXmlProperties+xml";
+/** The datastore namespace `ds:datastoreItem` lives in. */
+declare const DATASTORE_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/customXml";
+/** A data part located in a package: where it lives, and the GUID an SDT binds to. */
+interface CustomXmlDataPart {
+    /** Canonical part name, e.g. `/customXml/item1.xml`. */
+    readonly partName: string;
+    /** Part name of its properties, e.g. `/customXml/itemProps1.xml`. */
+    readonly propsPartName: string;
+    /** `ds:itemID`, braced and upper-case, as `w:storeItemID` must spell it. */
+    readonly itemId: string;
+    /** Namespace URI of the payload root, which is what identifies one store among several. */
+    readonly namespaceUri: string;
+}
 /**
- * Project a display equation as one layout atom. A display with one equation keeps that
- * equation's projection, so the painted atom names the editable `m:oMath`. Several equations
- * share one row, separated by an em space.
+ * A `ds:itemID` derived from the seed rather than drawn at random.
+ *
+ * Exported so a caller that authors a store OUTSIDE a package — a template engine splicing
+ * markup it will assemble into a `.docx` later — mints the id the same way this does, rather
+ * than inventing a second GUID shape Word has to be tolerant of.
+ *
+ * The store is a pure function of what it is asked to write: the same document written twice
+ * has to produce the same bytes, or a save/reopen/save round trip stops being a fixed point
+ * and every digest taken over saved bytes moves. A GUID's job here is uniqueness within one
+ * package, not unguessability, so four FNV-1a passes over a salted seed carry it.
  */
-declare function projectOmmlDisplay(node: OoxmlNode): OmmlEquationProjection | null;
+declare function datastoreItemIdFor(seed: string): string;
 /**
- * The physical justification of a paragraph whose only visible content is display math.
- * `m:oMathParaPr/m:jc` sets it; the default `centerGroup` centers the display. Returns null
- * when the paragraph also holds text or other content, which keeps the paragraph `w:jc`.
+ * The data parts a story relates to, in relationship order.
+ *
+ * Reads the relationships rather than scanning `/customXml/` by name: a part nothing relates
+ * to is not part of the document, and a package from a hostile sender can hold as many
+ * plausibly-named files as it likes.
  */
-declare function displayMathAlignment(paragraph: {
-    readonly children: readonly OoxmlNode[];
-}): 'left' | 'center' | 'right' | null;
-/** Project a paragraph-level equation atom: inline `m:oMath` or display `m:oMathPara`. */
-declare function projectOmmlAtom(node: OoxmlNode): OmmlEquationProjection | null;
-
-/** UTF-16 placeholder for a page break in paragraph text projections. */
-declare const PAGE_BREAK_CHAR = "\f";
-/** What a `w:br` breaks. `other` covers values this engine does not model, kept losslessly. */
-type HardBreakKind = 'line' | 'page' | 'column' | 'other';
-/** Read the semantic break kind from a typed `w:br` node. */
-declare function hardBreakKind(node: OoxmlHardBreakNode): HardBreakKind;
-/** Whether a node is a `w:br` with `w:type="page"`. */
-declare function isPageBreakNode(node: OoxmlNode): node is OoxmlHardBreakNode;
-/** Text projection for a `w:br` node — one UTF-16 code unit per break. */
-declare function hardBreakText(node: OoxmlHardBreakNode): string;
-/** Attributes for a newly authored `w:br`. */
-declare function hardBreakAttributes(kind: 'line' | 'page'): OoxmlHardBreakNode['attributes'];
-
-/** Parsed TOC instruction. Unknown switches are ignored for generation but left on the wire. */
-interface TocInstruction {
-    readonly keyword: 'TOC';
-    /** Include hyperlinks (`\\h`). */
-    readonly hyperlink: boolean;
-    /** Omit page numbers (`\\n`). */
-    readonly omitPageNumbers: boolean;
-    /** Inclusive 1-based outline levels from `\\o "n-m"`. Defaults 1–9. */
-    readonly outlineStart: number;
-    readonly outlineEnd: number;
-    readonly raw: string;
+declare function customXmlDataParts(pkg: OoxmlPackage, storyPartName: string): CustomXmlDataPart[];
+/** The data part carrying this namespace, or null when the document has none yet. */
+declare function findCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): CustomXmlDataPart | null;
+/** What {@link withCustomXmlDataPart} answers. */
+interface CustomXmlDataPartResult {
+    readonly pkg: OoxmlPackage;
+    /** Null when the part could not be authored; the package then comes back unchanged. */
+    readonly part: CustomXmlDataPart | null;
 }
-/** Longest TOC field instruction read. Instructions come from a file; the parse is bounded. */
-declare const TOC_MAX_INSTRUCTION_CHARS = 256;
-/** Most entries one generated table of contents may hold. */
-declare const TOC_MAX_ENTRIES = 512;
-/** Most bookmarks minted during one TOC refresh. */
-declare const TOC_MAX_BOOKMARKS_PER_REFRESH = 512;
-/** Deepest nested field instruction followed. Caps recursion on file-supplied structure. */
-declare const TOC_MAX_FIELD_NESTING = 4;
 /**
- * Most layout passes a TOC refresh runs before settling.
+ * Ensure the document carries a data part for this namespace, creating it and everything it
+ * needs — properties, both relationships, the properties content type — when it does not.
  *
- * Page numbers change the TOC's own height, which changes page numbers — bounded so a
- * non-converging document stops rather than looping.
+ * Idempotent: a package that already has one for the namespace comes back untouched, so a
+ * second node added to the same store does not author a second store.
+ *
+ * @param storyPartName - Whose relationships the store hangs off. Word enumerates its data
+ * store from the MAIN DOCUMENT part, so a store authored off a header or footer is one Word
+ * never sees.
  */
-declare const TOC_MAX_PAGE_PASSES = 3;
+declare function withCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string, rootLocalName: string): CustomXmlDataPartResult;
 /**
- * Parse a TOC field instruction string.
+ * Remove a store from a document: both parts, both relationships, the Override.
  *
- * Returns null when the leading keyword is not TOC, the string is over-long, or the
- * outline range is hostile. Does not evaluate or fetch anything.
+ * PACKAGE ONLY. It does not touch the body, so a `w:sdt` bound to the store keeps its
+ * `w:dataBinding`, its `w:storeItemID` and its `w:tag`, and Word then opens a control bound to
+ * a store that is not there. Stripping those is the export path's job and is not built; this
+ * is the half that removes the payload, which is the half a caller can rely on.
+ *
+ * `ok: false` means nothing was removed and the package is unchanged — most often because an
+ * owner's `.rels` was never parsed into a tree, which {@link withoutPart} refuses to work
+ * around. A caller exporting a document has to treat that as a failure to export rather than
+ * as a document with nothing to strip, or it ships the payload it meant to remove.
  */
-declare function parseTocInstruction(raw: string): TocInstruction | null;
+declare function withoutCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): WithoutPartResult;
 
-/** A table of contents found in a document, whether wrapped in an SDT or a bare field. */
-interface DetectedToc {
-    /** Enclosing control id when it identifies one TOC, otherwise the begin fldChar id. */
+/** One node in a store: its id, the bound text, and the payload beside it. */
+interface CustomXmlNode {
     readonly id: string;
-    readonly beginNodeId: string;
-    readonly beginParagraphId: string;
-    readonly endParagraphId: string;
-    readonly resultParagraphIds: readonly string[];
-    /** Direct parent whose paragraph children delimit the cached result. */
-    readonly containerId: string;
-    readonly contentControlId?: string;
-    readonly instruction: TocInstruction;
-}
-/** Discover refreshable body TOCs without evaluating any field instruction. */
-declare function detectBodyTocs(part: OoxmlPart): readonly DetectedToc[];
-/** Locate the table of contents containing a position, or null. */
-declare function findDetectedToc(tocs: readonly DetectedToc[], tocId: string): DetectedToc | null;
-
-/** One heading symbol: its `w:font` and `w:char`, as the file wrote them. */
-interface TocSymbol {
-    readonly font: string | null;
-    readonly char: string;
+    /** Text a `w:dataBinding` resolves to. Untrusted file input. */
+    readonly label: string;
+    /** Payload as authored, JSON by convention and unparsed here. Untrusted file input. */
+    readonly data: string;
 }
-
-declare const TWIPS: unique symbol;
-declare const POINTS: unique symbol;
+/** Every node a store holds, in document order. */
+declare function customXmlNodes(pkg: OoxmlPackage, partName: string): CustomXmlNode[];
+/** One node by id, or null. */
+declare function readCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): CustomXmlNode | null;
+/**
+ * Write a node, replacing one that already has the id.
+ *
+ * Replace rather than append: a second node with the same id makes the binding xpath ambiguous,
+ * and Word resolves an ambiguous xpath to the first match — so an "update" that appended would
+ * leave the control showing its old text forever.
+ */
+declare function withCustomXmlNode(pkg: OoxmlPackage, partName: string, node: CustomXmlNode): OoxmlPackage;
+/** Drop one node by id. A store that never held it comes back unchanged. */
+declare function withoutCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): OoxmlPackage;
+/**
+ * Drop every node no longer referenced, given the ids the document still binds.
+ *
+ * This is the whole deletion story. Deleting a control in THIS editor can remove its node
+ * directly, but a control deleted in Word leaves the node behind — Word has no lifecycle link
+ * between the two and no way to run our code. Reconciling against what the story actually binds
+ * collects both, and is the only thing that can collect the second.
+ *
+ * Takes the referenced ids rather than reading the story itself: the caller already walked it,
+ * and a sweep that guessed at which controls exist would delete a payload on a mistake.
+ */
+declare function withoutOrphanCustomXmlNodes(pkg: OoxmlPackage, partName: string, referencedIds: ReadonlySet<string>): {
+    readonly pkg: OoxmlPackage;
+    readonly removed: readonly string[];
+};
 /**
- * A length in twentieths of a point — OOXML's `ST_TwipsMeasure` / `ST_SignedTwipsMeasure`.
- *
- * The brand is intersection-typed onto `number`, so a `Twips` value still decays to `number`
- * wherever arithmetic consumes it; only the reverse direction — passing a raw number where
- * `Twips` is declared — is refused.
+ * The `w:xpath` a binding uses to reach a node's label, or null when the id cannot be addressed.
  *
- * @public
+ * Word needs a prefix for the payload namespace even when the store declares it as a default —
+ * an unprefixed step in an XPath means "no namespace", so `/docxEditor/node` would match
+ * nothing in a namespaced store. The prefix is declared in `w:prefixMappings` beside it.
  */
-type Twips = number & {
-    readonly [TWIPS]: true;
-};
+declare function customXmlLabelXPath(prefix: string, rootLocalName: string, nodeId: string): string | null;
+/** The `w:prefixMappings` value declaring that prefix, or null when it cannot be written.
+ *  The namespace sits inside single quotes inside a double-quoted attribute, so a namespace
+ *  carrying either quote character has no representation here. */
+declare function customXmlPrefixMappings(prefix: string, namespaceUri: string): string | null;
+
+/** The prefix every binding this library authors declares and quotes. */
+declare const CUSTOM_NODE_XPATH_PREFIX = "ns0";
+/** The three attributes a `w:dataBinding` carries. */
+interface CustomNodeBinding {
+    readonly prefixMappings: string;
+    readonly xpath: string;
+    readonly storeItemId: string;
+}
 /**
- * A length in typographic points, the unit layout and paint compute in.
+ * The binding for one node in one store, or null when the id cannot be addressed by an XPath.
  *
- * @public
+ * Refuses rather than escapes: XPath 1.0 has no escape for a quote inside a literal, so an id
+ * carrying one could close the predicate and append an expression of the sender's choosing.
+ * The ids are minted by a host, so refusing is honest — see `ADDRESSABLE_ID`.
  */
-type Points = number & {
-    readonly [POINTS]: true;
-};
+declare function customNodeBinding(part: CustomXmlDataPart, rootLocalName: string, nodeId: string): CustomNodeBinding | null;
 /**
- * Twentieths of a point per point.
+ * Every node id the story's controls bind to in one store, in document order.
  *
- * @public
+ * This is the input the orphan sweep takes: a node whose id is not in here is one no control
+ * names, whether it was deleted in this editor or in Word. Reading it from the STORY rather than
+ * from a host's bookkeeping is what makes the two cases one mechanism.
  */
-declare const TWIPS_PER_POINT = 20;
+declare function boundCustomXmlNodeIds(part: OoxmlPart, storeItemId: string): Set<string>;
 /**
- * Assert that a number is a twips measurement.
+ * Every node id ANY story in the package binds, in one store.
  *
- * A compile-time cast, not a validator: bounds, integrality and finiteness stay at the parse
- * boundary that produced the number, exactly where they are enforced today. The cast is the
- * caller's claim about the UNIT, nothing more.
+ * THE WHOLE PACKAGE, not one story. A payload is reachable from a header as easily as from the
+ * body — Word enumerates its data store from the main part, but nothing stops a control
+ * elsewhere quoting the same `w:storeItemID` — and the two callers that decide what is an orphan
+ * both destroy data when they are wrong. The sweep would collect a payload a header still paints;
+ * the export would strip a store a header still names, which is a document Word offers to repair.
  *
- * @public
+ * Costs one walk per story per store, on open and on export. Neither is a keystroke.
  */
-declare const twips: (value: number) => Twips;
+declare function boundCustomXmlNodeIdsInPackage(pkg: OoxmlPackage, storeItemId: string): Set<string>;
+/** The node id one control binds to in the named store, or null when it binds to nothing there. */
+declare function boundCustomXmlNodeIdOf(control: OoxmlNode, storeItemId: string): string | null;
+
+/** What happens to one control when the document is exported. */
+type CustomNodeExportPolicy = 'keep' | 'text' | 'remove';
+/** How {@link withExportedCustomNodes} decides, and which stores it may tidy afterwards. */
+interface CustomNodeExportRequest {
+    /** The story whose controls are policed, and whose relationships the stores hang off. */
+    readonly storyPartName: string;
+    /**
+     * Payload namespaces the caller CLAIMS.
+     *
+     * The store cleanup runs only over these. Word's own Cover Page Properties store rides in most
+     * templates, and an export that tidied every customXml part would be deleting from documents it
+     * was only asked to strip its own markup from.
+     */
+    readonly namespaces: readonly string[];
+    /** The fate of a control carrying this `w:tag`. A control with no tag is never touched. */
+    readonly decide: (tag: string) => CustomNodeExportPolicy;
+}
 /**
- * Assert that a number is a points measurement. A compile-time cast; see {@link twips}.
+ * The export, or the reason there is no export.
  *
- * @public
+ * A refusal answers no package on purpose. "Stripping failed, here is the document anyway" is the
+ * one outcome that must not be possible: a caller would ship the markup it asked to remove and
+ * have been told the export succeeded.
  */
-declare const points: (value: number) => Points;
+type CustomNodeExportResult = {
+    readonly ok: true;
+    readonly pkg: OoxmlPackage;
+    /** Controls unwrapped (`text`) and controls removed (`remove`). */
+    readonly unwrapped: number;
+    readonly removed: number;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
 /**
- * The one twips-to-points conversion. Exact division; twips are the finer unit.
+ * Apply the policy, then take the payloads and the stores the policy orphaned.
  *
- * @public
+ * Order matters and is the reverse of the write's. The BODY goes first, so the sweep that follows
+ * sees the controls that actually survive; the stores go last, once nothing binds them. Doing it
+ * the other way would strip a store while a control still quoted its `w:storeItemID`, which is a
+ * document Word opens and offers to repair.
  */
-declare const twipsToPoints: (value: Twips) => Points;
+declare function withExportedCustomNodes(pkg: OoxmlPackage, request: CustomNodeExportRequest): CustomNodeExportResult;
+
 /**
- * The one points-to-twips conversion.
- *
- * Rounds to the nearest twip: every OOXML twips measurement is integral, and emitting a
- * fractional twip would write a value no consumer of the file can represent.
+ * Every kind of thing the registry gives a stable identity to.
  *
- * @public
+ * Identity is `(kind, id)` plus version and NEVER registration order, so two bundles contributing
+ * the same command resolve deterministically regardless of which loaded first.
  */
-declare const pointsToTwips: (value: Points) => Twips;
+declare const ID_KINDS: readonly ['extension', 'capability', 'command', 'query', 'schema', 'dependencyKey', 'runtimePort', 'result', 'origin'];
+/** One of {@link ID_KINDS}. */
+/** One of {@link ID_KINDS} — which sort of thing an identifier names. */
+type IdKind = (typeof ID_KINDS)[number];
 /**
- * Read a twips attribute (`ST_TwipsMeasure`, `ST_SignedTwipsMeasure`, or a `dxa` table width)
- * as a whole, signed number of twips, or `null` when the value is not a measurement.
- *
- * The schema allows an integer or a universal measure, but files also carry decimal twips
- * (`4743.74`, `708.0`, `707.9999999999998`). The accepted forms read as follows:
- *
- * - A decimal truncates toward zero: `1443.74` is 1443 and `-720.6` is -720. A leading `+`,
- *   leading zeros, a bare fraction (`.5`) and a trailing point (`1440.`) are accepted.
- * - A universal measure (`mm`, `cm`, `in`, `pt`, `pc`, `pi`) converts exactly and then
- *   truncates: `1.27cm` is 720 and `0.333in` is 479. Its sign is ignored, so `-0.5in` is 720.
- * - Whitespace, exponents, hexadecimal, uppercase units, and an integer part longer than nine
- *   digits are not measurements.
+ * Whether a string is a well-formed identifier in either accepted grammar.
  *
- * The result is NOT bounded. Callers apply their own sign rule and range clamp, because each
- * attribute has a different valid range and a different fallback.
+ * Reverse-domain (`dev.docx-editor.core.command.insert-text`) or package-owned
+ * (`@docx-editor.dev/engine-core#command/insert-text`). Ids are opaque once validated.
+ */
+declare function isValidId(id: string): boolean;
+/**
+ * Validate an identifier, throwing when it is malformed.
  *
- * @internal
+ * Throws rather than returning: a bad id is an author mistake at registration time, not file
+ * input, and accepting it would produce a registry whose identities silently collide.
  */
-declare function readTwipsMeasure(raw: string | undefined): number | null;
-
-/** Outline heading shape consumed by TOC planning (mirrors DocumentOutlineEntry). */
-interface TocOutlineHeading {
-    readonly text: string;
-    readonly level: number;
-    readonly blockId: string;
+declare function assertValidId(id: string, kind?: IdKind): void;
+/** A validated (kind, id, version) triple — the registry's unit of identity. */
+interface CapabilityId {
+    readonly kind: IdKind;
+    readonly id: string;
+    readonly version: string;
 }
 
-/** Left-indent step between TOC levels, in twips (matches `scripts/demo-doc/toc-block.xml`). */
-declare const TOC_LEVEL_INDENT_TWIPS: Twips;
-/** Bounded left-indent twips for a TOC entry level (0-based heading depth). */
-declare function tocLeftIndentTwips(level: number): Twips;
-/** One planned TOC entry: its level, its text, and the heading it points at. */
-interface TocEntryPlan {
-    readonly level: number;
-    readonly text: string;
-    readonly headingParagraphId: string;
-    readonly bookmarkName: string;
-    readonly pageNumberText: string;
-    /** The heading's symbols, one per {@link TOC_SYMBOL_MARK} in `text`, in order. */
-    readonly symbols?: readonly TocSymbol[];
+/** A parsed semantic version. Only the three numeric components — no pre-release or build. */
+interface SemVer {
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
 }
-/** Build one TOC entry paragraph node. */
-declare function buildTocEntryParagraph(mint: () => string, entry: TocEntryPlan, instruction: TocInstruction, paragraphPropertiesTemplate?: OoxmlNode): OoxmlNode;
-/** Build an SDT-wrapped complex TOC field with an already planned cached result. */
-declare function buildTocContentControl(mint: () => string, entries: readonly TocEntryPlan[], instruction: TocInstruction, alias: string): OoxmlNode;
 /**
- * Word flattens manual line/tab breaks from a heading into spaces in its TOC cache.
- * Carrying them verbatim makes a short title wrap even when the row has ample room, and the
- * same normalization is what lets a cached row be matched back to the heading it came from.
+ * Parse a semantic version, rejecting anything the registry's rules do not need.
+ *
+ * Deliberately narrow: an unsupported range form is refused rather than accepted, so a malformed
+ * range can never masquerade as "compatible".
  */
-declare function tocEntryText(text: string): string;
+declare function parseSemVer(input: string): SemVer;
+/** Order two versions: negative, zero or positive, by major then minor then patch. */
+declare function compareSemVer(a: SemVer, b: SemVer): -1 | 0 | 1;
 /**
- * Plan TOC entries from the outline and existing bookmarks.
+ * Whether `version` satisfies `range`. Supported range grammar:
+ *   - `*`            any version
+ *   - `1.2.3`        exact
+ *   - `^1.2.3`       caret: same major, and >= the floor (major 0 pins the minor)
+ *   - `>=1.2.3 <2.0.0`  a single lower (inclusive) + upper (exclusive) bound pair
+ * Any other shape throws — an unparseable range is a registration error, not a pass.
+ */
+declare function satisfies(version: string, range: string): boolean;
+
+/**
+ * Why registry resolution failed.
  *
- * `actorId` is explicit because this planner runs BEFORE the store transaction, so the
- * ambient transaction actor is not bound. Callers that already have the collaboration
- * identity pass it here. `resolveAllocationActor` still honours a
- * `runWithTransactionActor` wrap when the caller prefers that seam.
+ * Every code names a declaration conflict a bundle author can fix — a missing dependency, an
+ * unsatisfied version range, a duplicate contribution with no replacement policy.
  */
-declare function planTocEntries(part: OoxmlPart, outline: readonly TocOutlineHeading[], instruction: TocInstruction, pageNumberByParagraphId: ReadonlyMap<string, string>, excludeParagraphIds: ReadonlySet<string>, actorId?: string): {
-    readonly entries: readonly TocEntryPlan[];
-    readonly bookmarksToCreate: readonly {
-        paragraphId: string;
-        name: string;
-    }[];
-};
-/** Create bookmarkStart/End pair nodes for insertion at the start of a paragraph. */
-declare function bookmarkPairNodes(mint: () => string, name: string, id: string): {
-    readonly start: OoxmlNode;
-    readonly end: OoxmlNode;
+type RegistryErrorCode = 'invalid-id' | 'invalid-version' | 'duplicate-extension' | 'id-collision' | 'replacement-target-missing' | 'unauthorized-replacement' | 'replacement-version-mismatch' | 'ambiguous-replacement' | 'missing-dependency' | 'dependency-cycle' | 'conflict' | 'missing-port';
+/**
+ * A resolution failure naming every responsible party.
+ *
+ * Thrown rather than returned: an unresolvable registry is a build-time composition mistake, and
+ * an engine running with a half-resolved registry would fail later in ways that do not point back
+ * to the bundle that caused it.
+ */
+declare class RegistryError extends Error {
+    readonly code: RegistryErrorCode;
+    /** Stable identities responsible for the failure (extensions, ids). */
+    readonly responsible: readonly string[];
+    constructor(code: RegistryErrorCode, message: string, 
+    /** Stable identities responsible for the failure (extensions, ids). */
+    responsible?: readonly string[]);
+}
+/** How a base contribution permits replacement by other bundles. */
+type ReplacementPolicy = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'single';
+} | {
+    readonly kind: 'priority';
 };
-
+/** One thing a bundle contributes: a command, a query, a schema, a port, keyed by `(kind, id)`. */
+interface Contribution {
+    readonly kind: Exclude<IdKind, 'extension' | 'origin' | 'result'>;
+    readonly id: string;
+    readonly version: string;
+    /** If set, this contribution replaces an existing base contribution. */
+    readonly replaces?: {
+        readonly targetId: string;
+        readonly targetRange: string;
+        readonly priority?: number;
+    };
+    /** Policy this contribution exposes to would-be replacers (default `none`). */
+    readonly replaceable?: ReplacementPolicy;
+    readonly payload?: unknown;
+}
 /**
- * The heading each cached result row stands for, aligned with `toc.resultParagraphIds`.
+ * A unit of engine functionality: its identity, version, dependencies, conflicts, required ports,
+ * and contributions.
  *
- * `null` for a row that names no heading this document still has — a stale row, or the
- * chrome/blank paragraphs a cached result can carry. Callers leave those alone rather than
- * writing another row's number into them.
+ * The registry's whole input. Everything a bundle needs and everything it offers is DECLARED, so
+ * resolution can be deterministic and order-independent.
  */
-declare function resolveTocRowHeadings(part: OoxmlPart, toc: DetectedToc, outline: readonly TocOutlineHeading[], excludeParagraphIds: ReadonlySet<string>): readonly (string | null)[];
-
-/** One paragraph in the index: its node id, its story, and its position. */
-interface ParagraphIndexEntry {
-    /** Canonical tree node id — the stable identity operations address. */
-    readonly nodeId: string;
-    /** Position among the story's paragraphs, in document order. */
-    readonly ordinal: number;
-    /** Concatenated text content, with tabs and breaks mapped as the model reads them. */
-    readonly text: string;
-    /** Node ids of the paragraph's runs, in order. */
-    readonly runIds: readonly string[];
+interface FeatureBundle {
+    readonly id: string;
+    readonly version: string;
+    readonly dependencies?: readonly string[];
+    readonly conflicts?: readonly string[];
+    readonly requiredPorts?: readonly string[];
+    readonly contributions: readonly Contribution[];
 }
-/** One story root — body, a header/footer variant, or a note part. */
-interface StoryIndexEntry {
-    /** The part the story lives in. */
-    readonly partName: string;
-    /** The `w:body` (or story root) node id. */
-    readonly rootId: string;
-    readonly paragraphs: readonly ParagraphIndexEntry[];
+/** The resolved result: every contribution selected, indexed by `(kind, id)`. */
+interface ResolvedRegistry {
+    readonly extensions: ReadonlyMap<string, FeatureBundle>;
+    readonly contributions: ReadonlyMap<string, Contribution>;
+    get(kind: Contribution['kind'], id: string): Contribution | undefined;
 }
-/** One style definition, indexed by the id content references it under. */
-interface StyleIndexEntry {
-    readonly styleId: string;
-    readonly type: string;
-    readonly nodeId: string;
-    readonly name: string | null;
-    readonly basedOn: string | null;
-    /** Whether the part marks this the default style for its type (`w:default="1"`). */
-    readonly isDefault: boolean;
+/** How resolution treats optional bundles and replacement policies. */
+interface ResolveOptions {
+    /** Runtime port ids available in this environment (design D9 / task 0.3). */
+    readonly availablePorts?: readonly string[];
 }
 /**
- * The derived lookups over a part: paragraphs, stories and styles by id.
+ * Resolve a set of bundles into one registry, or throw.
  *
- * Diff-patched on commit rather than rebuilt — rebuilding every index per keystroke is what made
- * typing scale with document length.
+ * Deterministic and registration-order independent: selection is by `(kind, id)` plus version,
+ * and ties break only on declared policy. Array order never decides anything.
+ *
+ * @throws RegistryError naming every bundle responsible for the failure.
  */
-interface OoxmlIndexes {
-    /** The tree revision these projections were derived from. */
-    readonly revision: number;
-    /** Body story first, then any other story parts, keyed by part name. */
-    readonly stories: ReadonlyMap<string, StoryIndexEntry>;
-    /** Every paragraph across every story, keyed by node id. */
-    readonly paragraphs: ReadonlyMap<string, ParagraphIndexEntry>;
-    readonly relationships: ReadonlyMap<string, readonly RelationshipRecord[]>;
-    readonly styles: ReadonlyMap<string, StyleIndexEntry>;
-}
-/** Style definitions, read out of the generic `w:styles` tree. */
-declare function indexStyles(part: OoxmlPart | undefined): Map<string, StyleIndexEntry>;
-/** The package's style definitions part, if it has one. */
-declare function stylesPartOf(pkg: OoxmlPackage): OoxmlPart | undefined;
+declare function resolve(bundles: readonly FeatureBundle[], options?: ResolveOptions): ResolvedRegistry;
+
 /**
- * Derive every index from one canonical package revision.
- *
- * Pure: the same package and revision always produce the same index, which is what makes
- * "rebuild rather than mutate" a safe invalidation strategy.
+ * Typed-origin domains (design D5 / ADR-S5). `mutation.*` are the canonical
+ * write origins; `projection` and `awareness` MUST NOT enter history, audit,
+ * snapshots, or replication.
  */
-declare function deriveOoxmlIndexes(pkg: OoxmlPackage, revision: number): OoxmlIndexes;
+declare const ORIGIN_IDS: {
+    readonly mutationHuman: "dev.docx-editor.core.origin.mutation.human";
+    readonly mutationAgent: "dev.docx-editor.core.origin.mutation.agent";
+    readonly mutationRemote: "dev.docx-editor.core.origin.mutation.remote";
+    readonly mutationUndo: "dev.docx-editor.core.origin.mutation.undo";
+    readonly mutationRedo: "dev.docx-editor.core.origin.mutation.redo";
+    readonly mutationMigration: "dev.docx-editor.core.origin.mutation.migration";
+    readonly mutationRepair: "dev.docx-editor.core.origin.mutation.repair";
+    readonly mutationServer: "dev.docx-editor.core.origin.mutation.server";
+    readonly projection: "dev.docx-editor.core.origin.projection";
+    readonly awareness: "dev.docx-editor.core.origin.awareness";
+};
+/** Canonical writes carry a mutation origin; these are the undoable-eligibility inputs. */
+declare const CANONICAL_MUTATION_ORIGINS: readonly string[];
+/** Origins that never enter authored state / history / audit / snapshot / replication. */
+declare const NON_CANONICAL_ORIGINS: readonly string[];
+/**
+ * Result taxonomy (design D8 / task 7.8). A transport/protocol failure that
+ * prevents a valid envelope is a typed exception, not a member here.
+ */
+declare const RESULT_IDS: {
+    readonly applied: "dev.docx-editor.core.result.applied";
+    readonly validation: "dev.docx-editor.core.result.validation";
+    readonly conflict: "dev.docx-editor.core.result.conflict";
+    readonly resource: "dev.docx-editor.core.result.resource";
+    readonly authorization: "dev.docx-editor.core.result.authorization";
+    readonly aborted: "dev.docx-editor.core.result.aborted";
+};
+/** Runtime ports (extensions-and-runtime-ports spec; design D9). */
+declare const RUNTIME_PORT_IDS: {
+    readonly fonts: "dev.docx-editor.core.port.fonts";
+    readonly shaping: "dev.docx-editor.core.port.shaping";
+    readonly images: "dev.docx-editor.core.port.images";
+    readonly clock: "dev.docx-editor.core.port.clock";
+    readonly identity: "dev.docx-editor.core.port.identity";
+    readonly persistence: "dev.docx-editor.core.port.persistence";
+    readonly transport: "dev.docx-editor.core.port.transport";
+    readonly scheduling: "dev.docx-editor.core.port.scheduling";
+    readonly audit: "dev.docx-editor.core.port.audit";
+    readonly authorization: "dev.docx-editor.core.port.authorization";
+    readonly resourceAccounting: "dev.docx-editor.core.port.resource-accounting";
+    readonly cancellation: "dev.docx-editor.core.port.cancellation";
+    readonly externalResourceConsent: "dev.docx-editor.core.port.external-resource-consent";
+};
+/** Layout dependency keys (design D6 / task 8.2). */
+declare const DEPENDENCY_KEY_IDS: {
+    readonly style: "dev.docx-editor.core.dep.style";
+    readonly numbering: "dev.docx-editor.core.dep.numbering";
+    readonly section: "dev.docx-editor.core.dep.section";
+    readonly story: "dev.docx-editor.core.dep.story";
+    readonly font: "dev.docx-editor.core.dep.font";
+    readonly image: "dev.docx-editor.core.dep.image";
+    readonly table: "dev.docx-editor.core.dep.table";
+    readonly field: "dev.docx-editor.core.dep.field";
+    readonly note: "dev.docx-editor.core.dep.note";
+    readonly headerFooter: "dev.docx-editor.core.dep.header-footer";
+    readonly annotation: "dev.docx-editor.core.dep.annotation";
+};
+/** Every frozen id as a flat list, for the immutability / uniqueness gate. */
+declare const ALL_FROZEN_IDS: readonly string[];
 
-/** One paragraph's meaning, independent of how it was spelled in XML. */
-interface ParagraphDigest {
-    /** Ordinal identity within its story. Node ids are NOT used: a reopened package
-     *  legitimately re-derives them, and requiring them to match would test the id scheme
-     *  rather than the content. */
-    readonly ordinal: number;
-    /**
-     * Where the paragraph SITS: the element path from the story root, so a paragraph that
-     * moves out of the table cell it was written in is a difference rather than a paragraph
-     * with the same ordinal and the same text.
-     */
-    readonly path: string;
-    /**
-     * `w14:paraId`, uppercase-normalized (matching is case-insensitive), or null. This is
-     * MANAGED identity — the agent contract anchors on it and comment threading references
-     * it — so a serializer silently dropping it must be a digest difference. Other paragraph
-     * attributes (`w:rsidR` …) stay deliberately undigested: they are revision noise.
-     */
-    readonly paraId: string | null;
-    /** Text content, including tabs and hard breaks as their characters. */
-    readonly text: string;
-    /** Accepted paragraph properties, as sorted tokens including nested children. */
-    readonly paragraphProperties: readonly string[];
-    /** Per-run accepted properties, in run order. */
-    readonly runProperties: readonly (readonly string[])[];
-    /** Fingerprints of every generic (unknown) subtree, in document order. */
-    readonly genericStructure: readonly string[];
-}
-/** One story reduced to its semantic content, ignoring everything a normalized re-emit changes. */
-interface StoryDigest {
-    readonly partName: string;
-    readonly paragraphs: readonly ParagraphDigest[];
-    /**
-     * Every block-level element of the part OUTSIDE a paragraph, in document order, as
-     * `path name(attributes)` — the tables, rows, cells, sections, content controls and
-     * their property children, each at the position that says what contains it.
-     *
-     * A paragraph's own internals are not here (they are its `ParagraphDigest`), which keeps
-     * this list proportional to a document's STRUCTURE rather than its text.
-     */
-    readonly structure: readonly string[];
-}
 /**
- * The whole document's semantic content — one of the D9 losslessness oracles.
+ * A counter's limit was reached. Carries the label, the limit, and what was attempted.
  *
- * What a save/reopen round-trip is compared on. Byte identity applies only to non-XML parts;
- * modelled parts re-emit normalized, so equality is asserted HERE rather than on bytes.
+ * Thrown at the N → N+1 boundary, so the increment that would have crossed the limit never
+ * happens rather than being detected afterwards.
  */
-interface SemanticDigest {
-    readonly stories: readonly StoryDigest[];
+declare class LimitExceededError extends Error {
+    readonly label: string;
+    readonly limit: number;
+    readonly attempted: number;
+    constructor(label: string, limit: number, attempted: number);
 }
-/** Where two digests diverge — the diagnostic when a round-trip loses something. */
-type DigestDifference = {
-    readonly path: string;
-    readonly before: string;
-    readonly after: string;
-};
-/** Digest one part: its paragraphs, and the structure that holds them. */
-declare function digestPart(part: OoxmlPart): StoryDigest | null;
-/** Digest every part, in the given order. */
-declare function semanticDigest(parts: Iterable<OoxmlPart>): SemanticDigest;
 /**
- * Every way two digests differ, as readable paths.
+ * Overflow-safe counting against a fixed limit.
  *
- * Returns the differences rather than a boolean because "the round trip lost something" is
- * useless without saying what — the failure this oracle exists to catch is a silent drop,
- * and a bare `false` reproduces the silence.
+ * Never silently wraps: it rejects the increment that would cross its limit AND any arithmetic
+ * that would exceed `Number.MAX_SAFE_INTEGER`. That second guard is the point — a file-supplied
+ * count must never be trusted into an allocation, and a wrapped counter reads as small.
  */
-declare function diffSemanticDigests(before: SemanticDigest, after: SemanticDigest): DigestDifference[];
+declare class BoundedCounter {
+    readonly label: string;
+    readonly limit: number;
+    private value;
+    constructor(label: string, limit: number);
+    get current(): number;
+    /** Remaining headroom before the limit. */
+    get remaining(): number;
+    /**
+     * Add `n` (default 1). Throws LimitExceededError if the result would exceed the
+     * limit (so `limit` itself is reachable but `limit + 1` is not) or overflow the
+     * safe-integer range. On rejection the counter is unchanged.
+     */
+    add(n?: number): number;
+    /** Whether adding `n` would be accepted, without mutating. */
+    canAdd(n?: number): boolean;
+    release(n: number): void;
+}
 
-/** Valid per MS-DOCX: 8 hex digits, non-zero, below 0x80000000. */
-declare function isValidParaId(value: string): boolean;
-/** The authored `w14:paraId` value of an element, verbatim, or null. */
-declare function paraIdOf(node: OoxmlNode): string | null;
-/** FNV-1a over UTF-16 code units — the deterministic mint every id derivation shares. */
-declare function fnv1a32(value: string): number;
-/**
- * Deterministic 8-hex mint in (0x00000000, 0x80000000), collision-free against
- * `used` (uppercase hex). Same seed + same used-set → same value, which is what
- * keeps `splitParagraphMany` byte-identical to its equivalent single splits and
- * a reopened save identical to the session that produced it.
- */
-declare function mintParaId(seed: string, used: ReadonlySet<string>): string;
-/** Every valid `w14:paraId` in the tree, uppercased. Memoized per root object. */
-declare function usedParaIds(root: OoxmlElement): ReadonlySet<string>;
+/** A budget was misused: over-carved, over-reserved, or disposed with children outstanding. */
+declare class BudgetError extends Error {
+    constructor(message: string);
+}
 /**
- * The non-empty prefix the part ROOT binds to the w14 namespace, or null.
+ * Capacity claimed BEFORE it is allocated.
  *
- * Minted attributes require an in-scope binding (the invariant validator reports
- * `invalid-qname` otherwise, and the serializer would allocate an `nsN` alias).
- * Only the root binding counts: a binding authored on some descendant does not
- * cover paragraphs elsewhere in the tree.
+ * Reserve-then-allocate rather than allocate-then-check: discovering the overrun after the
+ * allocation has already happened defeats the point of having a budget.
  */
-declare function w14RootPrefix(root: OoxmlElement): string | null;
-/** The minted `[w14:paraId, w14:textId]` pair. `textId` mirrors `paraId`: it has no uniqueness requirement, no consumer reads it, and one allocator is simpler than two — but Word writes both, so we write both. */
-declare function mintedParagraphIdentityAttributes(prefix: string, value: string): readonly OoxmlAttribute[];
+interface Reservation {
+    readonly amount: number;
+    readonly released: boolean;
+    release(): void;
+}
 /**
- * Load-time paragraph-identity normalization for a session's main part.
- *
- * Keeps every valid, first-seen paraId verbatim; mints (deterministically, seeded
- * by the paragraph's structural node id) for paragraphs whose id is missing,
- * malformed, zero, out of range, or a duplicate. Adds the root `xmlns` binding
- * the minted attributes need. Returns the INPUT PART REFERENCE when there is
- * nothing to do — a document Word saved yesterday re-serializes byte-identical.
+ * One node in the hierarchical resource budget tree.
  *
- * Attribute-only rebuilds move no child, so every node keeps its structural-path
- * id; the copy respreads only the ancestors of changed paragraphs.
+ * An operation owns a root budget; parsers, extensions, workers, layout, transport and output
+ * carve children from it, so no subsystem can consume more than the operation as a whole allows.
  *
- * Fail-open: if the rebuilt part does not validate (a bug, or a pathology the
- * prefix choice could not defuse), the original part is returned — a document
- * must never become unopenable over an identity enhancement.
+ * `dispose()` REFUSES while children or reservations are outstanding, then runs registered
+ * cleanups LIFO — spill files, worker termination — even if one throws. A leaked child budget is a
+ * leaked worker, so the refusal is the diagnostic.
  */
-declare function normalizeParagraphIdentity(part: OoxmlPart): OoxmlPart;
-
-/** One `w:docPart` of the glossary, with the blocks its body holds. */
-interface BuildingBlock {
-    /** `w:docPartPr/w:name`, the identity a control's placeholder and a pick refer to. */
-    readonly name: string;
-    /** `w:category/w:gallery`, an `ST_DocPartGallery` value such as `docParts`. */
-    readonly gallery: string;
-    /** `w:category/w:name`; `General` when the block declares none. */
-    readonly category: string;
-    /** The `w:docPartBody` children: paragraphs, tables and block controls, in order. */
-    readonly blocks: readonly OoxmlNode[];
+declare class Budget {
+    readonly label: string;
+    readonly capacity: number;
+    private readonly used;
+    private readonly children;
+    private activeReservations;
+    private readonly cleanups;
+    private disposed;
+    private carveAmount;
+    private parent?;
+    constructor(label: string, capacity: number);
+    get inUse(): number;
+    get available(): number;
+    get isDisposed(): boolean;
+    /** Reserve `amount` from this budget. Throws if it would exceed capacity. */
+    reserve(amount: number): Reservation;
+    /** Carve a child budget of `capacity` out of this budget's headroom. */
+    child(label: string, capacity: number): Budget;
+    /** Register cleanup for a spill file, worker, or queue tied to this budget. */
+    onRelease(cleanup: () => void): void;
+    /**
+     * Release this budget. Refuses while any child budget or reservation is
+     * outstanding (children must finish first). Runs cleanups LIFO, returns the
+     * carve-out to the parent, and marks disposed. Cleanup errors are collected and
+     * rethrown after every cleanup has run.
+     */
+    dispose(): void;
+    private assertLive;
 }
-/** The gallery and category a `w:docPartList` control lists. */
-interface BuildingBlockGalleryFilter {
-    readonly gallery: string;
-    readonly category: string | null;
+
+/**
+ * Which side of the point of no return an operation is on.
+ *
+ * Canonical publication is that point. Cancelling BEFORE it rolls the whole operation back;
+ * cancelling after it leaves the commit standing and cancels only derived work — layout, export,
+ * caches.
+ */
+type CancellationPhase = 'pre-publication' | 'post-publication';
+/** Thrown from a `checkpoint()` when the operation has been cancelled. */
+declare class CancellationError extends Error {
+    /** True when the commit is already published and only derived work is cancelled. */
+    readonly derivedOnly: boolean;
+    constructor(
+    /** True when the commit is already published and only derived work is cancelled. */
+    derivedOnly: boolean, reason?: string);
 }
-/** The glossary part, through the main part's relationship or the conventional name. */
-declare function glossaryPartOf(pkg: OoxmlPackage): OoxmlPart | null;
-/** Every named building block of the glossary, in authored order. Empty without a glossary. */
-declare function buildingBlocksOf(pkg: OoxmlPackage): readonly BuildingBlock[];
-/** The gallery a `w:docPartList` control lists, or null for any other control. */
-declare function buildingBlockGalleryOf(control: OoxmlNode): BuildingBlockGalleryFilter | null;
 /**
- * The blocks a gallery control offers: same gallery, and the control's category when it names
- * one. Sorted by category, then name, as Word groups its list.
+ * The read side of cancellation, handed to cooperative work.
+ *
+ * Cooperative rather than pre-emptive: long work calls `checkpoint()` at declared intervals, which
+ * is what lets an operation unwind promptly without the engine having to interrupt it mid-mutation.
  */
-declare function buildingBlocksForControl(pkg: OoxmlPackage, control: OoxmlNode): readonly BuildingBlock[];
-
+interface CancellationToken {
+    readonly isCancelled: boolean;
+    readonly phase: CancellationPhase;
+    /** True only when cancelled AND the commit is already published. */
+    readonly derivedOnly: boolean;
+    /** Throws CancellationError if cancelled; call at declared checkpoint intervals. */
+    checkpoint(): void;
+}
 /**
- * Which story a comment deletion or resolution may read markers from.
+ * The write side of cancellation, and the owner of the phase.
  *
- * `w:id` is not unique across stories: a header and the body can both hold comment 1.
+ * Whoever starts an operation holds this; everything it calls gets only the token.
  */
-interface CommentDeletionOwner {
-    /** Canonical name of the part holding the story's markers. */
-    readonly storyPartName: string;
-    /**
-     * When the story is one note inside a shared notes part, that note's `w:id`.
-     * Absent means the whole part is the story (body, header, footer).
-     */
-    readonly noteId?: number;
+declare class CancellationController {
+    private _cancelled;
+    private _phase;
+    private _reason?;
+    cancel(reason?: string): void;
+    /** Mark canonical publication — the point of no return. */
+    markPublished(): void;
+    get isCancelled(): boolean;
+    get phase(): CancellationPhase;
+    get isPublished(): boolean;
+    /** Cancelled after publication -> full rollback is no longer possible. */
+    get derivedOnly(): boolean;
+    get token(): CancellationToken;
 }
 
+/** Injectable time source — the engine never calls Date.now directly (determinism). */
+interface ClockPort {
+    now(): number;
+}
+/** Stable id minting for sessions, commits, and allocator seeds. */
+interface IdentityPort {
+    newId(): string;
+}
+/** Cooperative scheduling of deferred work. */
+interface SchedulingPort {
+    schedule(task: () => void): void;
+}
+/** Redacted observability sink (raw text never enters here — design D5). */
+interface AuditPort {
+    record(entry: {
+        readonly kind: string;
+        readonly at: number;
+        readonly meta?: Record<string, unknown>;
+    }): void;
+}
+/** Read/write/export authorization decisions. */
+interface AuthorizationPort {
+    authorize(action: string, subject?: string): boolean;
+}
+/** Explicit consent gate for any remote/external resource (no zero-click fetch). */
+interface ExternalResourceConsentPort {
+    requestConsent(target: string): boolean;
+}
+/** Cancellation source for the current operation. */
+interface CancellationPort {
+    readonly token: CancellationToken;
+}
+/** Where documents are stored and retrieved. Opaque marker until its milestone. */
+interface PersistencePort {
+    readonly kind: 'persistence';
+}
+/** How the engine talks to a remote peer. Opaque marker until its milestone. */
+interface TransportPort {
+    readonly kind: 'transport';
+}
+/** Where font bytes come from. Opaque marker until its milestone. */
+interface FontPort {
+    readonly kind: 'font';
+}
+/** Which shaping backend measures text. Opaque marker until its milestone. */
+interface ShapingPort {
+    readonly kind: 'shaping';
+}
+/** How image bytes are decoded. Opaque marker until its milestone. */
+interface ImagePort {
+    readonly kind: 'image';
+}
+/** Where resource consumption is reported. Opaque marker until its milestone. */
+interface ResourceAccountingPort {
+    readonly kind: 'resource-accounting';
+}
 /**
- * Delete a comment thread: that story's markers, and metadata no other story still names.
- *
- * `owner` names the story whose markers may be stripped. Omitted, it is the main document
- * body — never every XML part. A header or note that reused the same `w:id` is a different
- * remark; pass its part (and `noteId` when the story is one note) to delete that one.
+ * A required port the runtime did not provide.
  *
- * Returns the package unchanged when the id names no comment, and null when a removal was
- * refused — a caller inside a transaction rolls back rather than committing a package whose
- * comment is half gone.
+ * Thrown rather than falling back: silently reaching for a browser global when a worker or server
+ * adapter did not supply a port is exactly the coupling ports exist to prevent.
  */
-declare function deleteCommentThread(pkg: OoxmlPackage, commentId: string, owner?: CommentDeletionOwner): OoxmlPackage | null;
+declare class PortResolutionError extends Error {
+    readonly portId: string;
+    constructor(portId: string);
+}
 /**
- * Delete every comment the edit between `before` and `after` emptied in `owner`'s story.
- *
- * `owner` omitted is the main document body, matching {@link deleteCommentThread}.
+ * The environment-dependent services an engine instance may reach.
  *
- * THE TEST, exactly, and per story. A comment dies when the words it covered in that story are
- * gone and nothing in that story still places it. A neighbour that reused the same `w:id` is
- * judged under its own owner. Notes that vanished (reference cascade) are reaped as their own
- * stories so a unique id still loses its `comments.xml` body. Remaining-marker overflow
- * preserves comments/commentEx/commentId metadata rather than deleting records the scan could
- * not prove unused. Null is reserved for a removal that actually failed.
+ * Everything outside pure computation — the clock, identity minting, scheduling, fonts, images —
+ * is reached only through here, which is what lets browser, worker and server adapters supply
+ * only what their runtime actually offers.
  */
-declare function cascadeEmptiedComments(before: OoxmlPackage, after: OoxmlPackage, owner?: CommentDeletionOwner): OoxmlPackage | null;
-
-/** Presentation settings the document itself states. Absence is the answer, never an error. */
-interface DocumentViewSettings {
-    /**
-     * `w:doNotShadeFormData` (§17.15.1.49) — do NOT shade legacy form fields.
-     *
-     * Word draws a grey block behind every `w:ffData` field so a reader can find the blanks in a
-     * form. It is on by DEFAULT, and this element is how a document turns it off, so the absent
-     * case means shading. Reading the name as "shade form data" inverts it and blanks the shading
-     * on exactly the documents that asked for it loudest.
-     *
-     * Never printed, by Word or by us: it marks where to type, and a printed form has no blanks
-     * to find.
-     */
-    readonly doNotShadeFormData: boolean;
+declare class PortRegistry {
+    private readonly ports;
+    provide(portId: string, port: unknown): this;
+    has(portId: string): boolean;
+    /** Resolve a port by id or throw. */
+    resolve<T>(portId: string): T;
+    /** Assert every id in `portIds` is present; returns the missing ones (empty if all present). */
+    missing(portIds: readonly string[]): string[];
+    /** The provided port ids (for bridging to registry.resolve availablePorts). */
+    availablePorts(): string[];
+    clock(): ClockPort;
+    identity(): IdentityPort;
+}
+/** Deterministic clock: starts at `start` and advances by `step` each call. */
+declare class DeterministicClock implements ClockPort {
+    private readonly step;
+    private t;
+    constructor(start?: number, step?: number);
+    now(): number;
+}
+/** Sequential identity for tests and deterministic fixtures. */
+declare class SequentialIdentity implements IdentityPort {
+    private readonly prefix;
+    private n;
+    constructor(prefix?: string);
+    newId(): string;
 }
-/** The defaults a document with no `settings.xml` gets: everything Word would shade, shaded. */
-declare const DEFAULT_VIEW_SETTINGS: DocumentViewSettings;
-/** Read the view settings from a `settings.xml` root, or the defaults when it has none. */
-declare function readViewSettings(settingsRoot: OoxmlNode | null | undefined): DocumentViewSettings;
 
-/** How deep transparent block wrappers may nest before the walk stops descending. */
-declare const MAX_STORY_SDT_NESTING = 32;
-/** Which kind of story a root is. Layout walks all four the same way. */
-type OoxmlStoryKind = 'body' | 'header' | 'footer' | 'note';
-/** One story root and the blocks under it, with transparent block wrappers already flattened. */
-interface OoxmlStoryRoot {
-    readonly kind: OoxmlStoryKind;
-    /** The `w:body` / `w:hdr` / `w:ftr` / `w:footnote` element that holds the blocks. */
-    readonly root: OoxmlNode;
+/** What one operation is started with. Only `ports` is required. */
+interface OperationInit {
+    readonly ports: PortRegistry;
+    readonly limits?: Partial<ResourceLimits>;
+    readonly config?: Readonly<Record<string, unknown>>;
+    /** Root budget capacity in abstract units (default: the byte decompression limit). */
+    readonly capacity?: number;
+    /** Operation identity (from IdentityPort in production); defaulted for tests. */
+    readonly id?: string;
 }
 /**
- * Every story root in a part, in document order.
- *
- * Does not descend INTO a story: a story's blocks are the walk below, and a story root never
- * contains another story root.
- */
-declare function storyRootsOf(part: OoxmlPart): readonly OoxmlStoryRoot[];
-/**
- * Whether a part is SHAPED to hold stories — a body, a header, a footer, or a notes part.
+ * The frozen environment of one operation: its limits, config, ports, root budget and
+ * cancellation controller.
  *
- * A shape test, deliberately not `storyRootsOf(part).length > 0`. That counts EDITABLE stories,
- * and a notes part holding nothing but `w:separator` and `w:continuationSeparator` has none —
- * which is the footnotes part Word writes into every document that ever held a footnote. A
- * caller asking "should I walk this part at all" that used the editable count skipped it
- * entirely, and the two callers that ask are a payload sweep and an export strip: both DELETE
- * what they conclude nothing names.
+ * IMMUTABLE for the operation's lifetime, which is what lets cache reuse and replica agreement
+ * key on it. A new operation always gets a fresh snapshot rather than observing a mutated one.
  */
-declare function isStoryPart(part: OoxmlPart): boolean;
-/** The main body story of a part, or null when the part holds none. */
-declare function bodyStoryRoot(part: OoxmlPart): OoxmlNode | null;
+interface OperationContext {
+    readonly id: string;
+    readonly limits: ResourceLimits;
+    readonly config: Readonly<Record<string, unknown>>;
+    readonly ports: PortRegistry;
+    readonly budget: Budget;
+    readonly cancellation: CancellationController;
+}
 /**
- * Every paragraph of one story, in reading order.
+ * Begin an operation, capturing its immutable environment snapshot.
  *
- * Descends through tables (rows, cells, nested tables), block controls and block custom XML.
- * The returned nodes are paragraph elements; a caller addresses them by `id`.
+ * Resolves and freezes limits and configuration, carves the root budget, and creates the
+ * cancellation controller — everything downstream work needs, fixed for the operation's duration.
  */
-declare function storyParagraphs(root: OoxmlNode): readonly OoxmlNode[];
+declare function beginOperation(init: OperationInit): OperationContext;
+/** Release the operation's root budget (requires every child/reservation released). */
+declare function endOperation(ctx: OperationContext): void;
+
+/** What a limit counts. Typed so a byte cap and a depth cap cannot be compared by accident. */
+type LimitUnit = 'bytes' | 'count' | 'depth' | 'ratio' | 'passes';
 /**
- * The block walk itself, appending into `out`.
+ * Where a limit is enforced.
  *
- * Exported so `allParagraphs` in the binding lane is the same traversal rather than a second
- * copy of it.
+ * Declared per limit so enforcement happens at the boundary that can still refuse cheaply — a zip
+ * cap checked during layout has already let the bomb decompress.
  */
-declare function collectStoryParagraphs(children: readonly OoxmlNode[], out: OoxmlNode[], sdtDepth: number): void;
-
-/** One searchable text-box story and the drawing location that can reveal it. */
-interface TextboxStoryRoot {
-    /** The `w:txbxContent` story root. */
-    readonly root: OoxmlElement;
-    /** Layout atom id used to select the drawing, including an MC wrapper when present. */
-    readonly drawingNodeId: string;
-    /** Canonical node id of the paragraph that anchors the drawing. */
-    readonly hostParagraphId: string;
+type EnforcementPhase = 'package-read' | 'xml-parse' | 'layout' | 'output';
+/** One limit's unit and enforcement phase — the metadata that makes limits testable uniformly. */
+interface LimitSpec {
+    readonly unit: LimitUnit;
+    readonly phase: EnforcementPhase;
 }
+/** Unit + enforcement phase for every resource limit. */
+declare const LIMIT_SPECS: Readonly<Record<keyof ResourceLimits, LimitSpec>>;
+/** Every limit name, for iterating the specs and asserting each has a unit and phase. */
+declare const LIMIT_KEYS: (keyof ResourceLimits)[];
+/** A phase-scoped overflow-safe counter for one limit. */
+declare function makeLimitCounter(limits: ResourceLimits, key: keyof ResourceLimits): BoundedCounter;
 /**
- * List the text-box stories in one part, in document order.
- *
- * The bounded walk stops at drawings. It does not project pictures, shape geometry, or story
- * content. Results are memoized by immutable part-root identity.
+ * Deterministic memory substitute. Tracks current and peak "allocated" units
+ * against a hard byte ceiling; `allocate` fails closed (LimitExceededError) past
+ * the limit. Used in place of process RSS so memory-limit tests are reproducible
+ * and cancellation/cleanup can be asserted without a real allocator.
  */
-declare function textboxStoriesInPart(part: OoxmlPart): readonly TextboxStoryRoot[];
-
-/** Relationship from the story to one data part. */
-declare const CUSTOM_XML_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
-/** Relationship from a data part to the properties that carry its `ds:itemID`. */
-declare const CUSTOM_XML_PROPS_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXmlProps";
-/** `itemPropsN.xml` needs an Override; `itemN.xml` rides the package's `xml` default. */
-declare const CUSTOM_XML_PROPS_TYPE = "application/vnd.openxmlformats-officedocument.customXmlProperties+xml";
-/** The datastore namespace `ds:datastoreItem` lives in. */
-declare const DATASTORE_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/customXml";
-/** A data part located in a package: where it lives, and the GUID an SDT binds to. */
-interface CustomXmlDataPart {
-    /** Canonical part name, e.g. `/customXml/item1.xml`. */
-    readonly partName: string;
-    /** Part name of its properties, e.g. `/customXml/itemProps1.xml`. */
-    readonly propsPartName: string;
-    /** `ds:itemID`, braced and upper-case, as `w:storeItemID` must spell it. */
-    readonly itemId: string;
-    /** Namespace URI of the payload root, which is what identifies one store among several. */
-    readonly namespaceUri: string;
+declare class DeterministicMemoryMeter {
+    private readonly counter;
+    private current;
+    private peak;
+    constructor(limitBytes: number);
+    allocate(bytes: number): void;
+    free(bytes: number): void;
+    get currentBytes(): number;
+    get peakBytes(): number;
+    /** Release everything (cancellation/cleanup path). */
+    reset(): void;
 }
+/** Assert the finite-default / hard-ceiling invariant holds for every limit. */
+declare function assertLimitInvariants(): void;
+
+/** Any JSON value. The domain canonicalization and stable hashing operate over. */
+type Json = null | boolean | number | string | Json[] | {
+    [k: string]: Json;
+};
 /**
- * A `ds:itemID` derived from the seed rather than drawn at random.
- *
- * Exported so a caller that authors a store OUTSIDE a package — a template engine splicing
- * markup it will assemble into a `.docx` later — mints the id the same way this does, rather
- * than inventing a second GUID shape Word has to be tolerant of.
- *
- * The store is a pure function of what it is asked to write: the same document written twice
- * has to produce the same bytes, or a save/reopen/save round trip stops being a fixed point
- * and every digest taken over saved bytes moves. A GUID's job here is uniqueness within one
- * package, not unguessability, so four FNV-1a passes over a salted seed carry it.
+ * Produce a canonical string for `value`, dropping any object key whose name is
+ * in `ephemera` at any depth. Numbers are emitted losslessly; -0 normalizes to 0;
+ * non-finite numbers are rejected (they must never enter a comparator input).
  */
-declare function datastoreItemIdFor(seed: string): string;
+declare function canonicalize(value: unknown, ephemera?: ReadonlySet<string>): string;
+/** 64-bit FNV-1a over the canonical form, returned as a 16-char hex string. */
+declare function stableHash(value: unknown, ephemera?: ReadonlySet<string>): string;
+
 /**
- * The data parts a story relates to, in relationship order.
+ * How one artifact class is compared.
  *
- * Reads the relationships rather than scanning `/customXml/` by name: a part nothing relates
- * to is not part of the document, and a package from a hostile sender can hold as many
- * plausibly-named files as it likes.
+ * Frozen per artifact: nothing here invents a tolerance for an artifact the spec requires to
+ * match exactly.
  */
-declare function customXmlDataParts(pkg: OoxmlPackage, storyPartName: string): CustomXmlDataPart[];
-/** The data part carrying this namespace, or null when the document has none yet. */
-declare function findCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): CustomXmlDataPart | null;
-/** What {@link withCustomXmlDataPart} answers. */
-interface CustomXmlDataPartResult {
-    readonly pkg: OoxmlPackage;
-    /** Null when the part could not be authored; the package then comes back unchanged. */
-    readonly part: CustomXmlDataPart | null;
+type ComparatorMode = 'canonical-exact' | 'exact' | 'tolerance' | 'sync-optimization-only';
+/** One artifact class's comparison mode and its declared ephemera — fields excluded from equality. */
+interface ComparatorDescriptor {
+    readonly id: string;
+    readonly mode: ComparatorMode;
+    /** Object keys excluded from canonical-exact comparison (declared ephemera). */
+    readonly ephemera: readonly string[];
+    readonly note: string;
+}
+/** The frozen artifact comparator set. */
+declare const COMPARATORS: {
+    readonly authoredState: {
+        readonly id: "dev.docx-editor.core.comparator.authored-state";
+        readonly mode: 'canonical-exact';
+        readonly ephemera: readonly ["revision", "provenance", "producedAt", "commitId"];
+        readonly note: 'canonical normalized authored records; ephemera excluded';
+    };
+    readonly anchor: {
+        readonly id: "dev.docx-editor.core.comparator.anchor";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'internal anchor identity/affinity compares exactly';
+    };
+    readonly yjsStateVector: {
+        readonly id: "dev.docx-editor.core.comparator.yjs-state-vector";
+        readonly mode: 'sync-optimization-only';
+        readonly ephemera: readonly [];
+        readonly note: 'exchange optimization only; never proves update or delete-set coverage';
+    };
+    readonly shapedRun: {
+        readonly id: "dev.docx-editor.core.comparator.shaped-run";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'glyph ids, clusters, and fixed-point advances compare exactly';
+    };
+    readonly paginationFingerprint: {
+        readonly id: "dev.docx-editor.core.comparator.pagination-fingerprint";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'page/column boundaries, break causes, fixed-point geometry compare exactly';
+    };
+    readonly semanticTree: {
+        readonly id: "dev.docx-editor.core.comparator.semantic-tree";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'reading order, roles, headings, alt text compare exactly';
+    };
+    readonly hitTest: {
+        readonly id: "dev.docx-editor.core.comparator.hit-test";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'resolved hit target and cluster affinity compare exactly';
+    };
+    readonly pdfSemantics: {
+        readonly id: "dev.docx-editor.core.comparator.pdf-semantics";
+        readonly mode: 'canonical-exact';
+        readonly ephemera: readonly ["objectNumber", "producer", "creationDate", "modDate", "subsetTag"];
+        readonly note: 'canonical semantic PDF objects; container ephemera excluded';
+    };
+    readonly rasterCheckpoint: {
+        readonly id: "dev.docx-editor.core.comparator.raster-checkpoint";
+        readonly mode: 'tolerance';
+        readonly ephemera: readonly [];
+        readonly note: 'documented unavoidable raster comparison; explicit tolerance only';
+    };
+    readonly benchmarkEvidence: {
+        readonly id: "dev.docx-editor.core.comparator.benchmark-evidence";
+        readonly mode: 'sync-optimization-only';
+        readonly ephemera: readonly [];
+        readonly note: 'diagnostic evidence, not an equivalence basis';
+    };
+};
+/** Which frozen comparator to use. */
+type ComparatorName = keyof typeof COMPARATORS;
+/** Whether two artifacts matched, and where they diverged when they did not. */
+interface ComparisonResult {
+    readonly equal: boolean;
+    /** Canonical forms when unequal (diagnostic). */
+    readonly left?: string;
+    readonly right?: string;
 }
 /**
- * Ensure the document carries a data part for this namespace, creating it and everything it
- * needs — properties, both relationships, the properties content type — when it does not.
- *
- * Idempotent: a package that already has one for the namespace comes back untouched, so a
- * second node added to the same store does not author a second store.
- *
- * @param storyPartName - Whose relationships the store hangs off. Word enumerates its data
- * store from the MAIN DOCUMENT part, so a store authored off a header or footer is one Word
- * never sees.
- */
-declare function withCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string, rootLocalName: string): CustomXmlDataPartResult;
-/**
- * Remove a store from a document: both parts, both relationships, the Override.
- *
- * PACKAGE ONLY. It does not touch the body, so a `w:sdt` bound to the store keeps its
- * `w:dataBinding`, its `w:storeItemID` and its `w:tag`, and Word then opens a control bound to
- * a store that is not there. Stripping those is the export path's job and is not built; this
- * is the half that removes the payload, which is the half a caller can rely on.
- *
- * `ok: false` means nothing was removed and the package is unchanged — most often because an
- * owner's `.rels` was never parsed into a tree, which {@link withoutPart} refuses to work
- * around. A caller exporting a document has to treat that as a failure to export rather than
- * as a document with nothing to strip, or it ships the payload it meant to remove.
+ * Compare two artifacts under a named comparator. `canonical-exact` and `exact`
+ * compare canonical forms (exact drops no ephemera). `tolerance` requires an
+ * epsilon and compares finite numbers structurally. `sync-optimization-only`
+ * throws — such artifacts are never an equivalence basis.
  */
-declare function withoutCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): WithoutPartResult;
+declare function compareArtifacts(name: ComparatorName, left: unknown, right: unknown, opts?: {
+    epsilon?: number;
+}): ComparisonResult;
+/** Fingerprint an artifact under a named comparator's canonicalization policy. */
+declare function fingerprint(name: ComparatorName, value: unknown): string;
 
-/** One node in a store: its id, the bound text, and the payload beside it. */
-interface CustomXmlNode {
-    readonly id: string;
-    /** Text a `w:dataBinding` resolves to. Untrusted file input. */
-    readonly label: string;
-    /** Payload as authored, JSON by convention and unparsed here. Untrusted file input. */
-    readonly data: string;
+/** Whether a recorded conformance step was expected to commit or be refused. */
+type FixtureOutcome = 'applied' | 'aborted' | 'validation' | 'conflict' | 'resource' | 'authorization';
+/** The change one step produced, summarized to what a fixture can compare across runtimes. */
+interface ModelChangeSummary {
+    readonly fromRevision: number;
+    readonly toRevision: number;
+    readonly origin: string;
+    readonly dirty: readonly string[];
+    readonly dependencyKeys: readonly string[];
 }
-/** Every node a store holds, in document order. */
-declare function customXmlNodes(pkg: OoxmlPackage, partName: string): CustomXmlNode[];
-/** One node by id, or null. */
-declare function readCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): CustomXmlNode | null;
-/**
- * Write a node, replacing one that already has the id.
- *
- * Replace rather than append: a second node with the same id makes the binding xpath ambiguous,
- * and Word resolves an ambiguous xpath to the first match — so an "update" that appended would
- * leave the control showing its old text forever.
- */
-declare function withCustomXmlNode(pkg: OoxmlPackage, partName: string, node: CustomXmlNode): OoxmlPackage;
-/** Drop one node by id. A store that never held it comes back unchanged. */
-declare function withoutCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): OoxmlPackage;
-/**
- * Drop every node no longer referenced, given the ids the document still binds.
- *
- * This is the whole deletion story. Deleting a control in THIS editor can remove its node
- * directly, but a control deleted in Word leaves the node behind — Word has no lifecycle link
- * between the two and no way to run our code. Reconciling against what the story actually binds
- * collects both, and is the only thing that can collect the second.
- *
- * Takes the referenced ids rather than reading the story itself: the caller already walked it,
- * and a sweep that guessed at which controls exist would delete a payload on a mistake.
- */
-declare function withoutOrphanCustomXmlNodes(pkg: OoxmlPackage, partName: string, referencedIds: ReadonlySet<string>): {
-    readonly pkg: OoxmlPackage;
-    readonly removed: readonly string[];
+/** Where anchors sat after a step — how a fixture proves positions survived an edit. */
+interface AnchorSnapshot {
+    readonly anchorId: string;
+    readonly story: string;
+    readonly block: string;
+    readonly affinity: 'before' | 'after';
+}
+/** What one step must produce: its outcome, its change summary, and its authored-state hash. */
+interface FixtureExpectation {
+    readonly outcome: FixtureOutcome;
+    /** Present iff outcome === 'applied'; MUST be > baseRevision. */
+    readonly committedRevision?: number;
+    readonly modelChange?: ModelChangeSummary;
+    /** 16-hex authored-state fingerprint (comparator 0.4). */
+    readonly authoredStateHash?: string;
+    readonly outputHash?: string;
+    readonly anchors?: readonly AnchorSnapshot[];
+}
+/** One recorded operation and what it was expected to do. */
+interface FixtureStep {
+    readonly baseRevision: number;
+    readonly origin: string;
+    /** Opaque DocOp payloads (schema owned by section 4). */
+    readonly ops: readonly unknown[];
+    readonly expect: FixtureExpectation;
+}
+/** Opaque encoded backend bytes (snapshot or replication update). */
+interface EncodedEnvelope {
+    readonly kind: 'snapshot' | 'update';
+    readonly protocolVersion: number;
+    readonly schemaVersion: number;
+    readonly documentId: string;
+    readonly byteLength: number;
+    /** Hex-encoded opaque bytes; length MUST equal byteLength. */
+    readonly bytesHex: string;
+}
+/** Which implementation recorded a fixture — local store, Yjs, or a binding. */
+type FixtureSource = {
+    readonly kind: 'create';
+} | {
+    readonly kind: 'docx';
+    readonly sha256: string;
+    readonly bytesRef: string;
 };
 /**
- * The `w:xpath` a binding uses to reach a node's label, or null when the id cannot be addressed.
+ * The frozen conformance container: revisions, origins, operations, changes, snapshots and
+ * hashes.
  *
- * Word needs a prefix for the payload namespace even when the store declares it as a default —
- * an unprefixed step in an XPath means "no namespace", so `/docxEditor/node` would match
- * nothing in a namespaced store. The prefix is declared in `w:prefixMappings` beside it.
+ * The CONTAINER is what is frozen — field names, origin membership, revision monotonicity, hash
+ * format. The op and change payloads travel opaquely, so their schemas can evolve without
+ * invalidating every recorded fixture.
  */
-declare function customXmlLabelXPath(prefix: string, rootLocalName: string, nodeId: string): string | null;
-/** The `w:prefixMappings` value declaring that prefix, or null when it cannot be written.
- *  The namespace sits inside single quotes inside a double-quoted attribute, so a namespace
- *  carrying either quote character has no representation here. */
-declare function customXmlPrefixMappings(prefix: string, namespaceUri: string): string | null;
-
-/** The prefix every binding this library authors declares and quotes. */
-declare const CUSTOM_NODE_XPATH_PREFIX = "ns0";
-/** The three attributes a `w:dataBinding` carries. */
-interface CustomNodeBinding {
-    readonly prefixMappings: string;
-    readonly xpath: string;
-    readonly storeItemId: string;
+interface ConformanceFixture {
+    readonly formatVersion: 1;
+    readonly documentId: string;
+    readonly source: FixtureSource;
+    readonly steps: readonly FixtureStep[];
+    readonly snapshots?: readonly EncodedEnvelope[];
+    readonly updates?: readonly EncodedEnvelope[];
 }
-/**
- * The binding for one node in one store, or null when the id cannot be addressed by an XPath.
- *
- * Refuses rather than escapes: XPath 1.0 has no escape for a quote inside a literal, so an id
- * carrying one could close the predicate and append an expression of the sender's choosing.
- * The ids are minted by a host, so refusing is honest — see `ADDRESSABLE_ID`.
- */
-declare function customNodeBinding(part: CustomXmlDataPart, rootLocalName: string, nodeId: string): CustomNodeBinding | null;
-/**
- * Every node id the story's controls bind to in one store, in document order.
- *
- * This is the input the orphan sweep takes: a node whose id is not in here is one no control
- * names, whether it was deleted in this editor or in Word. Reading it from the STORY rather than
- * from a host's bookkeeping is what makes the two cases one mechanism.
- */
-declare function boundCustomXmlNodeIds(part: OoxmlPart, storeItemId: string): Set<string>;
-/**
- * Every node id ANY story in the package binds, in one store.
- *
- * THE WHOLE PACKAGE, not one story. A payload is reachable from a header as easily as from the
- * body — Word enumerates its data store from the main part, but nothing stops a control
- * elsewhere quoting the same `w:storeItemID` — and the two callers that decide what is an orphan
- * both destroy data when they are wrong. The sweep would collect a payload a header still paints;
- * the export would strip a store a header still names, which is a document Word offers to repair.
- *
- * Costs one walk per story per store, on open and on export. Neither is a keystroke.
- */
-declare function boundCustomXmlNodeIdsInPackage(pkg: OoxmlPackage, storeItemId: string): Set<string>;
-/** The node id one control binds to in the named store, or null when it binds to nothing there. */
-declare function boundCustomXmlNodeIdOf(control: OoxmlNode, storeItemId: string): string | null;
+/** Whether a fixture is well-formed, listing every structural violation. */
+interface ValidationResult {
+    readonly valid: boolean;
+    readonly errors: readonly string[];
+}
+/** Structurally validate a fixture against the frozen format rules. */
+declare function validateFixture(fixture: ConformanceFixture): ValidationResult;
 
-/** What happens to one control when the document is exported. */
-type CustomNodeExportPolicy = 'keep' | 'text' | 'remove';
-/** How {@link withExportedCustomNodes} decides, and which stores it may tidy afterwards. */
-interface CustomNodeExportRequest {
-    /** The story whose controls are policed, and whose relationships the stores hang off. */
-    readonly storyPartName: string;
-    /**
-     * Payload namespaces the caller CLAIMS.
-     *
-     * The store cleanup runs only over these. Word's own Cover Page Properties store rides in most
-     * templates, and an export that tidied every customXml part would be deleting from documents it
-     * was only asked to strip its own markup from.
-     */
-    readonly namespaces: readonly string[];
-    /** The fate of a control carrying this `w:tag`. A control with no tag is never touched. */
-    readonly decide: (tag: string) => CustomNodeExportPolicy;
+/** The outcome a store reports for one replayed step. */
+interface ReplayOutcome {
+    readonly outcome: FixtureOutcome;
+    readonly committedRevision?: number;
+    /** Canonical authored-state value AFTER the step (hashed via comparator 0.4). */
+    readonly authoredState?: unknown;
+}
+/** The interface a conformance runtime implements so one fixture can drive every backend. */
+interface ReplayStore {
+    /** Initialize from the fixture source; return the initial revision (0 for create). */
+    init(fixture: ConformanceFixture): number;
+    /** Apply one step and report what happened. */
+    applyStep(step: FixtureStep): ReplayOutcome;
+}
+/** What replaying a fixture produced: per-step outcomes and where they diverged. */
+interface ReplayReport {
+    readonly ok: boolean;
+    readonly mismatches: readonly string[];
 }
 /**
- * The export, or the reason there is no export.
- *
- * A refusal answers no package on purpose. "Stripping failed, here is the document anyway" is the
- * one outcome that must not be possible: a caller would ship the markup it asked to remove and
- * have been told the export succeeded.
- */
-type CustomNodeExportResult = {
-    readonly ok: true;
-    readonly pkg: OoxmlPackage;
-    /** Controls unwrapped (`text`) and controls removed (`remove`). */
-    readonly unwrapped: number;
-    readonly removed: number;
-} | {
-    readonly ok: false;
-    readonly reason: string;
-};
-/**
- * Apply the policy, then take the payloads and the stores the policy orphaned.
- *
- * Order matters and is the reverse of the write's. The BODY goes first, so the sweep that follows
- * sees the controls that actually survive; the stores go last, once nothing binds them. Doing it
- * the other way would strip a store while a control still quoted its `w:storeItemID`, which is a
- * document Word opens and offers to repair.
+ * Replay a fixture against a store and check every step's outcome, committed
+ * revision, and authored-state fingerprint against the fixture's expectations.
  */
-declare function withExportedCustomNodes(pkg: OoxmlPackage, request: CustomNodeExportRequest): CustomNodeExportResult;
+declare function replayFixture(fixture: ConformanceFixture, store: ReplayStore): ReplayReport;
+/** Hash a store's authored state, so two runtimes replaying one fixture can be compared. */
+declare function hashAuthored(authoredState: unknown): string;
 
 /**
  * WHERE a copy reaches, computed by the editing surface against the published layout with
@@ -2461,6 +2484,8 @@ interface RevisionSite {
     readonly parent: OoxmlElement | null;
     /** True when this site cannot be resolved and the whole op must refuse. */
     readonly refused: boolean;
+    /** Why, when `refused` is true. */
+    readonly refusal?: RevisionSiteRefusal;
     /** True for `w:pPr/w:rPr/w:ins|w:del` — the paragraph MARK, not content. */
     readonly paragraphMark: boolean;
     /** True for a supported property-history wrapper. */
@@ -2677,7 +2702,7 @@ declare function formsProtectionEnabled(root: OoxmlNode | null | undefined): boo
 declare function sectionProtectsForms(part: OoxmlPart, nodeId: string): boolean;
 
 /** Every {@link TreeDocOpKind}, for validation and exhaustiveness checks. */
-declare const TREE_DOC_OP_KINDS: readonly ["replaceStoryBlocks", "insertText", "deleteText", "setParagraphMarkRevision", "proposeParagraphMerge", "insertCommentMarker", "acceptRevision", "rejectRevision", "acceptAllRevisions", "rejectAllRevisions", "insertTab", "insertHardBreak", "insertPageBreak", "insertPageField", "setFieldCode", "setListLevel", "setListNumbering", "setParagraphTabStops", "setParagraphMarkProperties", "splitParagraph", "splitParagraphMany", "joinParagraphs", "setRunProperties", "setParagraphProperties", "setSectionProperties", "setSectionMark", "insertHyperlink", "setHyperlinkTarget", "removeHyperlink", "setMathEquation", "removeMathEquation", "setContentControlValue", "removeContentControl", "insertInlineContentControl", "addRepeatingSectionItem", "removeRepeatingSectionItem", "deleteBlock", "insertTable", "insertTableRow", "deleteTableRow", "insertTableColumn", "deleteTableColumn", "setTableColumnWidths", "setTableRightEdgeWidth", "setTableRowHeight", "setTableProperties", "authorTable", "setTableCellBorders", "setTableCellFill", "setTableCellVerticalAlignment", "createHeaderFooter", "deleteHeaderFooter", "linkToPrevious", "unlinkFromPrevious", "setSectionFurnitureOptions", "setDocumentProtection", "insertNote", "deleteNote", "convertNote", "convertAllNotes", "setNoteProperties", "setContentControlProperties", "insertContentControl", "insertFragment", "insertDrawing", "replaceDrawingResource", "deleteDrawing", "resizeDrawing", "cropDrawing", "positionDrawing", "setDrawingWrap", "setDrawingMetadata", "setDrawingLocks", "transformDrawing", "insertToc", "replaceTocResult", "rewriteTocPageNumbers", "refreshFieldResults", "setTextFormFieldDefault", "commitTextFormField", "setLegacyCheckbox", "setLegacyDropdown", "insertBuildingBlock"];
+declare const TREE_DOC_OP_KINDS: readonly ["replaceStoryBlocks", "insertText", "deleteText", "setParagraphMarkRevision", "proposeParagraphMerge", "insertCommentMarker", "acceptRevision", "rejectRevision", "acceptAllRevisions", "rejectAllRevisions", "setRevisionAttribution", "insertTab", "insertHardBreak", "insertPageBreak", "insertPageField", "setFieldCode", "setListLevel", "setListNumbering", "setParagraphTabStops", "setParagraphMarkProperties", "splitParagraph", "splitParagraphMany", "joinParagraphs", "setRunProperties", "setParagraphProperties", "setSectionProperties", "setSectionMark", "insertHyperlink", "setHyperlinkTarget", "removeHyperlink", "setMathEquation", "removeMathEquation", "setContentControlValue", "removeContentControl", "insertInlineContentControl", "addRepeatingSectionItem", "removeRepeatingSectionItem", "deleteBlock", "insertTable", "insertTableRow", "deleteTableRow", "insertTableColumn", "deleteTableColumn", "setTableColumnWidths", "setTableRightEdgeWidth", "setTableRowHeight", "setTableProperties", "authorTable", "setTableCellBorders", "setTableCellFill", "setTableCellVerticalAlignment", "createHeaderFooter", "deleteHeaderFooter", "linkToPrevious", "unlinkFromPrevious", "setSectionFurnitureOptions", "setDocumentProtection", "insertNote", "deleteNote", "convertNote", "convertAllNotes", "setNoteProperties", "setContentControlProperties", "insertContentControl", "insertFragment", "insertDrawing", "replaceDrawingResource", "deleteDrawing", "resizeDrawing", "cropDrawing", "positionDrawing", "setDrawingWrap", "setDrawingMetadata", "setDrawingLocks", "transformDrawing", "insertToc", "replaceTocResult", "rewriteTocPageNumbers", "refreshFieldResults", "setTextFormFieldDefault", "commitTextFormField", "setLegacyCheckbox", "setLegacyDropdown", "insertBuildingBlock"];
 
-export { ALL_FROZEN_IDS, AUTHORABLE_PARAGRAPH_PROPERTIES, AUTHORABLE_RUN_PROPERTIES, BoundedCounter, Budget, BudgetError, CANONICAL_MUTATION_ORIGINS, COMPARATORS, CUSTOM_NODE_XPATH_PREFIX, CUSTOM_XML_PROPS_REL, CUSTOM_XML_PROPS_TYPE, CUSTOM_XML_REL, CancellationController, CancellationError, CommentRecord, CommentThreadState, CustomNodeWriteResult, DANGEROUS_KEYS, DATASTORE_NAMESPACE_URI, DEFAULT_FORMATTING_DISPLAY_MODE, DEFAULT_VIEW_SETTINGS, DEPENDENCY_KEY_IDS, DangerousKeyError, DeterministicClock, DeterministicMemoryMeter, DrawingTreeDocOp, FIELD_ATOM_CHAR, ID_KINDS, INERT_EXECUTABLE_KINDS, ImageWrapTarget, ImpactClass, InsertCustomNodeWrite, LIMIT_KEYS, LIMIT_SPECS, LimitExceededError, MAX_STORY_SDT_NESTING, NON_CANONICAL_ORIGINS, ORIGIN_IDS, OmmlEquationProjection, OoxmlAttribute, OoxmlElement, OoxmlFldCharNode, OoxmlFldSimpleNode, OoxmlGenericElementNode, OoxmlHardBreakNode, OoxmlInstrTextNode, OoxmlInvariantIssue, OoxmlInvariantResult, OoxmlNode, OoxmlPackage, OoxmlParagraphNode, OoxmlPart, OoxmlProperty, PAGE_BREAK_CHAR, PortRegistry, PortResolutionError, PrefixAllocator, RESULT_IDS, RUNTIME_PORT_IDS, RegistryError, RelationshipRecord, ResourceLimits, ReviewCommentItem, ReviewItem, ReviewModelInput, ReviewPosition, ReviewRange, ReviewRevisionItem, SEARCH_MATCH_LIMIT, SEARCH_QUERY_MAX, SequentialIdentity, StoryScope, TOC_LEVEL_INDENT_TWIPS, TOC_MAX_BOOKMARKS_PER_REFRESH, TOC_MAX_ENTRIES, TOC_MAX_FIELD_NESTING, TOC_MAX_INSTRUCTION_CHARS, TOC_MAX_PAGE_PASSES, TREE_DOC_OP_KINDS, TWIPS_PER_POINT, TreeDocOp, TreeDocumentStore, TreeModelChange, TreeOpRejection, TreeOpResult, TreePackageStore, addComment, addPackageComment, applyEdits, applyTreeOp, assertLimitInvariants, assertValidId, assertValidQName, atomicFieldSpansOf, authoredProperties, beginOperation, bodyStoryRoot, bookmarkPairNodes, boundCustomXmlNodeIdOf, boundCustomXmlNodeIds, boundCustomXmlNodeIdsInPackage, buildTocContentControl, buildTocEntryParagraph, buildingBlockGalleryOf, buildingBlocksForControl, buildingBlocksOf, canonicalOoxmlFingerprint, canonicalize, cascadeEmptiedComments, collectNodeIds, collectReviewItems, collectRevisionSites, collectStoryParagraphs, commentItemsOf, commentPartNameOf, commentsExtendedPartNameOf, compareArtifacts, compareSemVer, containsCssFetch, contentTypesPartBytes, createNodeIdAllocator, customNodeBinding, customXmlDataParts, customXmlLabelXPath, customXmlNodes, customXmlPrefixMappings, datastoreItemIdFor, deleteCommentThread, deletePackageComments, deriveOoxmlIndexes, detectBodyTocs, diffSemanticDigests, digestPart, directParagraphMarkProperties, directParagraphProperties, displayMathAlignment, drawingOpImpact, endOperation, equationsOfAtom, escapeCssString, escapeXml, extractFragmentPackage, fieldAtomText, fieldOnOffAttribute, findCustomXmlDataPart, findDetectedToc, findNode, findOccurrences, fingerprint, fldCharType, fldSimpleInstr, fnv1a32, foldCase, formatOwnedRunIds, formattableRanges, formsProtectionEnabled, glossaryPartOf, hardBreakAttributes, hardBreakKind, hardBreakText, hasCommentPart, hasLegacyFormFieldData, hasNode, hashAuthored, indexStyles, inlineControlEndingAt, inlineControlStartingAt, insertChildren, insertPackageCustomNode, instrTextValue, isAuthorableRunProperty, isDangerousKey, isDrawingTreeDocOp, isEvaluableField, isFieldChrome, isFldChar, isFldCharNode, isFldSimple, isFldSimpleNode, isInertExecutable, isInstrText, isInstrTextNode, isLegalFldCharType, isOmmlDisplay, isOmmlEquationAtom, isPageBreakNode, isSearchableQuery, isStoryPart, isValidId, isValidNCName, isValidParaId, isValidQName, isWholeWord, linkRevisionReplies, locateSites, makeLimitCounter, materializeGlossaryPlaceholders, mergeFragmentIntoPackage, mergedFontProperty, mergedMultiSettingProperty, mergedParagraphMarkProperties, mergedProperties, mintParaId, mintedParagraphIdentityAttributes, nextCommentId, normalizeParagraphIdentity, nullRecord, ooxmlTreesEqual, paraIdOf, paragraphOffsetIndex, paragraphTextOf, parentNodeOf, parseSemVer, parseTocInstruction, planTocEntries, points, pointsToTwips, projectOmmlAtom, projectOmmlDisplay, propertyContainer, readCustomXmlNode, readTwipsMeasure, readViewSettings, relationshipsOf, relsPartNameFor, removeNode, removePackageCustomNode, replaceChildren, replaceNode, replayFixture, resolve, resolveContentTypeOf, resolveTocRowHeadings, revisionItemsOf, runAddressRanges, runPropertyEdits, runsCovering, sanitizeHref, satisfies, scrubExport, sectionProtectsForms, segmentsOf, semanticDigest, serializeOoxmlPart, setCommentResolved, setPackageCommentResolved, stableHash, storyParagraphs, storyRootsOf, stylesPartOf, textboxStoriesInPart, toSafeRecord, tocEntryText, tocLeftIndentTwips, twips, twipsToPoints, usedParaIds, validateDrawingOp, validateFixture, validateOoxmlPart, validatePackageInvariants, validateTreeOp, w14RootPrefix, withContentTypeOverride, withCustomXmlDataPart, withCustomXmlNode, withExportedCustomNodes, withNewPart, withRelationship, withoutCustomXmlDataPart, withoutCustomXmlNode, withoutOrphanCustomXmlNodes, wrapTargetToAnchorSpec };
+export { ALL_FROZEN_IDS, AUTHORABLE_PARAGRAPH_PROPERTIES, AUTHORABLE_RUN_PROPERTIES, BoundedCounter, Budget, BudgetError, CANONICAL_MUTATION_ORIGINS, COMPARATORS, CUSTOM_NODE_XPATH_PREFIX, CUSTOM_XML_PROPS_REL, CUSTOM_XML_PROPS_TYPE, CUSTOM_XML_REL, CancellationController, CancellationError, CommentRecord, CommentThreadState, CustomNodeWriteResult, DANGEROUS_KEYS, DATASTORE_NAMESPACE_URI, DEFAULT_FORMATTING_DISPLAY_MODE, DEFAULT_VIEW_SETTINGS, DEPENDENCY_KEY_IDS, DangerousKeyError, DeterministicClock, DeterministicMemoryMeter, DrawingTreeDocOp, FIELD_ATOM_CHAR, FieldResultsMode, ID_KINDS, INERT_EXECUTABLE_KINDS, ImageWrapTarget, ImpactClass, InsertCustomNodeWrite, LIMIT_KEYS, LIMIT_SPECS, LimitExceededError, MAX_STORY_SDT_NESTING, NON_CANONICAL_ORIGINS, ORIGIN_IDS, OmmlEquationProjection, OoxmlAttribute, OoxmlElement, OoxmlFldCharNode, OoxmlFldSimpleNode, OoxmlGenericElementNode, OoxmlHardBreakNode, OoxmlInstrTextNode, OoxmlInvariantIssue, OoxmlInvariantResult, OoxmlNode, OoxmlPackage, OoxmlParagraphNode, OoxmlPart, OoxmlProperty, PAGE_BREAK_CHAR, PortRegistry, PortResolutionError, PrefixAllocator, RESULT_IDS, RUNTIME_PORT_IDS, RegistryError, RelationshipRecord, ResourceLimits, ReviewCommentItem, ReviewItem, ReviewModelInput, ReviewPosition, ReviewRange, ReviewRevisionItem, RevisionSiteRefusal, SEARCH_MATCH_LIMIT, SEARCH_QUERY_MAX, SequentialIdentity, StoryScope, TOC_LEVEL_INDENT_TWIPS, TOC_MAX_BOOKMARKS_PER_REFRESH, TOC_MAX_ENTRIES, TOC_MAX_FIELD_NESTING, TOC_MAX_INSTRUCTION_CHARS, TOC_MAX_PAGE_PASSES, TREE_DOC_OP_KINDS, TWIPS_PER_POINT, TreeDocOp, TreeDocumentStore, TreeModelChange, TreeOpRejection, TreeOpResult, TreePackageStore, addComment, addPackageComment, applyEdits, applyTreeOp, assertLimitInvariants, assertValidId, assertValidQName, atomicFieldSpansOf, authoredProperties, beginOperation, bodyStoryRoot, bookmarkPairNodes, boundCustomXmlNodeIdOf, boundCustomXmlNodeIds, boundCustomXmlNodeIdsInPackage, buildTocContentControl, buildTocEntryParagraph, buildingBlockGalleryOf, buildingBlocksForControl, buildingBlocksOf, canonicalOoxmlFingerprint, canonicalize, cascadeEmptiedComments, collectNodeIds, collectReviewItems, collectRevisionSites, collectStoryParagraphs, commentItemsOf, commentPartNameOf, commentsExtendedPartNameOf, compareArtifacts, compareSemVer, containsCssFetch, contentTypesPartBytes, createNodeIdAllocator, customNodeBinding, customXmlDataParts, customXmlLabelXPath, customXmlNodes, customXmlPrefixMappings, datastoreItemIdFor, deleteCommentThread, deletePackageComments, deriveOoxmlIndexes, detectBodyTocs, diffSemanticDigests, digestPart, directParagraphMarkProperties, directParagraphProperties, displayMathAlignment, drawingOpImpact, endOperation, equationsOfAtom, escapeCssString, escapeXml, extractFragmentPackage, fieldAtomText, fieldOnOffAttribute, findCustomXmlDataPart, findDetectedToc, findNode, findOccurrences, fingerprint, fldCharType, fldSimpleInstr, fnv1a32, foldCase, formatOwnedRunIds, formattableRanges, formsProtectionEnabled, glossaryPartOf, hardBreakAttributes, hardBreakKind, hardBreakText, hasCommentPart, hasLegacyFormFieldData, hasNode, hashAuthored, indexStyles, inlineControlEndingAt, inlineControlStartingAt, insertChildren, insertPackageCustomNode, instrTextValue, isAuthorableRunProperty, isDangerousKey, isDrawingTreeDocOp, isEvaluableField, isFieldChrome, isFldChar, isFldCharNode, isFldSimple, isFldSimpleNode, isInertExecutable, isInstrText, isInstrTextNode, isLegalFldCharType, isOmmlDisplay, isOmmlEquationAtom, isPageBreakNode, isSearchableQuery, isStoryPart, isValidId, isValidNCName, isValidParaId, isValidQName, isWholeWord, linkRevisionReplies, locateSites, makeLimitCounter, materializeGlossaryPlaceholders, mergeFragmentIntoPackage, mergedFontProperty, mergedMultiSettingProperty, mergedParagraphMarkProperties, mergedProperties, mintParaId, mintedParagraphIdentityAttributes, nextCommentId, normalizeParagraphIdentity, nullRecord, ooxmlTreesEqual, paraIdOf, paragraphOffsetIndex, paragraphTextOf, parentNodeOf, parseSemVer, parseTocInstruction, planTocEntries, points, pointsToTwips, projectOmmlAtom, projectOmmlDisplay, propertyContainer, readCustomXmlNode, readTwipsMeasure, readViewSettings, relationshipsOf, relsPartNameFor, removeNode, removePackageCustomNode, replaceChildren, replaceNode, replayFixture, resolve, resolveContentTypeOf, resolveTocRowHeadings, revisionItemsOf, runAddressRanges, runPropertyEdits, runsCovering, sanitizeHref, satisfies, scrubExport, sectionProtectsForms, segmentsOf, semanticDigest, serializeOoxmlPart, setCommentResolved, setPackageCommentResolved, stableHash, storyParagraphs, storyRootsOf, stylesPartOf, textboxStoriesInPart, toSafeRecord, tocEntryText, tocLeftIndentTwips, twips, twipsToPoints, usedParaIds, validateDrawingOp, validateFixture, validateOoxmlPart, validatePackageInvariants, validateTreeOp, w14RootPrefix, withContentTypeOverride, withCustomXmlDataPart, withCustomXmlNode, withExportedCustomNodes, withNewPart, withRelationship, withoutCustomXmlDataPart, withoutCustomXmlNode, withoutOrphanCustomXmlNodes, wrapTargetToAnchorSpec };
 export type { AddCommentRequest, AddCommentResult, AnchorSnapshot, AtomicFieldSpan, AuditPort, AuthorizationPort, BuildingBlock, BuildingBlockGalleryFilter, CancellationPhase, CancellationPort, CancellationToken, CapabilityId, ClockPort, CommentAnchorRequest, CommentDeletionOwner, ComparatorDescriptor, ComparatorMode, ComparatorName, ComparisonResult, ConformanceFixture, ContentItem, Contribution, CustomNodeBinding, CustomNodeExportPolicy, CustomNodeExportRequest, CustomNodeExportResult, CustomXmlDataPart, CustomXmlDataPartResult, CustomXmlNode, DetectedToc, DigestDifference, DocumentViewSettings, EditOptions, EncodedEnvelope, EnforcementPhase, ExternalResourceConsentPort, FeatureBundle, FixtureExpectation, FixtureOutcome, FixtureSource, FixtureStep, FldCharType, FontPort, FormattingDisplayMode, FormattingRevisionAuthorFilter, FragmentCoverage, FragmentExtractRejection, FragmentExtractResult, FragmentMergeRejection, FragmentMergeResult, HardBreakKind, HrefProjection, IdKind, IdentityPort, ImagePort, InertExecutableKind, InlineControlSpan, Json, LimitSpec, LimitUnit, LinkableReviewItem, ModelChangeSummary, OffsetSpan, OoxmlEditResult, OoxmlIndexes, OoxmlStoryKind, OoxmlStoryRoot, OperationContext, OperationInit, PackageCommentDelete, PackageInvariantCode, PackageInvariantIssue, PackageInvariantResult, ParagraphDigest, ParagraphIndexEntry, ParagraphOffsetIndex, PersistencePort, Points, RegistryErrorCode, ReplacementPolicy, ReplayOutcome, ReplayReport, ReplayStore, Reservation, ResolveOptions, ResolvedRegistry, ResourceAccountingPort, RunPropertyEdit, SchedulingPort, ScrubResult, Segment, SemVer, SemanticDigest, SetCommentResolvedResult, ShapingPort, StoryDigest, StoryIndexEntry, StyleIndexEntry, TextMatchOptions, TextOccurrence, TextOccurrences, TextboxStoryRoot, TocEntryPlan, TocInstruction, TocOutlineHeading, TransactionRevisionIds, TransportPort, Twips, ValidationResult };