@docx-editor.dev/core 2.35.0-canary.20261104032723.sha-43c2012 → 2.35.0

package/dist/store.d.ts

@@ -12,18 +12,18 @@
  * @packageDocumentation
  * @public
  */
-import { bd as OoxmlAttribute, O as OoxmlPart, a4 as OoxmlNode, be as OoxmlInvariantResult, av as OoxmlElement, bf as LegacyTextArtProjection, aW as VectorShapeComponent, bg as ChartPartResolver, bh as ChartexPartResolver, bi as ShapeSchemeColorResolver, bj as ShapeEffectList, b0 as PictureFrameEffects, a$ as VectorShapeProjection, bk as GroupTextboxProjection, bl as MetafileImageMime, aL as OoxmlParagraphNode, bm as OoxmlFldCharNode, bn as OoxmlFldSimpleNode, bo as OoxmlInstrTextNode, au as TreeDocOp, aF as TreeOpRejection, bp as TreeOpResult, a5 as OoxmlPackage, bq as RelationshipRecord, ax as OoxmlGenericElementNode, br as OoxmlHardBreakNode, bs as ShapeColor, bt as ResourceLimits, aC as OoxmlProperty, V as RevisionSiteRefusal, f as ReviewRange, R as ReviewModelInput, a as ReviewItem, C as CommentRecord, e as ReviewPosition, bu as CommentThreadState, c as ReviewCommentItem, b as ReviewRevisionItem, aJ as DrawingTreeDocOp, aK as ImpactClass, ag as ImageWrapTarget } from './tree-op-types-CGlwCQXg.js';
-export { bv as ACCEPTED_PARAGRAPH_PROPERTIES, bw as ACCEPTED_RUN_PROPERTIES, bx as BookmarkOpPosition, by as CHARTEX_GRAPHIC_DATA_URI, bz as CHARTEX_NAMESPACE_URI, bA as CHART_GRAPHIC_DATA_URI, bB as CHART_NAMESPACE_URI, bC as CHART_STYLE_NAMESPACE_URI, bD as CONTENT_CONTROL_ID_MAX, bE as CONTENT_CONTROL_PROPERTY_ORDER, bF as ChartPart, bG as ChartThemeFaces, bH as ChartexPart, bI as CommentAnchor, bJ as CommentPosition, bK as CommitTextFormFieldOp, bL as ContentControlCheckbox, bM as ContentControlCheckboxState, bN as ContentControlDataBinding, bO as ContentControlDateFormat, bP as ContentControlEntry, bQ as ContentControlKind, bR as ContentControlLevel, bS as ContentControlListItem, bT as ContentControlLock, bU as ContentControlProperties, bV as ContentTypeError, bW as ContentTypeIndex, bX as ContentTypeRecords, bY as CreateImageResourceCacheOptions, b6 as DEFAULT_IMAGE_RESOURCE_LIMITS, bZ as DEFAULT_LIMITS, b_ as DEFAULT_OOXML_PACKAGE_LIMITS, b$ as DEFAULT_ZIP_LIMITS, c0 as DIAGRAM_NAMESPACE_URI, c1 as DRAWINGML_MAIN_NAMESPACE_URI, c2 as DefaultRecord, c3 as DeleteBookmarkOp, c4 as DeleteTextOp, c5 as DiagramPartResolver, c6 as DiagramParts, aY as DrawingImageEffects, a8 as DrawingKind, a9 as DrawingLocks, aa as DrawingPositionInput, c7 as HARD_CEILINGS, c8 as HYPERLINK_RELATIONSHIP_TYPE, c9 as HyperlinkKind, ca as HyperlinkTarget, cb as IMAGE_RELATIONSHIP_TYPE, cc as IMAGE_RESOURCE_HARD_CEILINGS, b7 as IMAGE_WRAP_TARGETS, ad as ImageDecodePort, cd as ImageRelationshipResolution, ae as ImageResourceLimits, ce as ImageResourceLookup, af as ImageResourceState, cf as IndexResult, cg as InsertBookmarkOp, ch as InsertBuildingBlockOp, ci as InsertComplexFieldOp, cj as InsertEquationOp, ck as InsertPageFieldOp, cl as InsertParagraphBesideTableOp, cm as InsertTableOp, cn as InsertTextOp, co as LegacyCheckboxFieldRange, cp as MAX_CONTENT_CONTROLS_PER_PART, cq as MAX_CONTENT_CONTROL_NESTING, cr as MAX_SVG_SNIFF_BYTES, cs as MoveTableOp, ct as NameRejection, cu as NameResult, cv as OFFICE_RELATIONSHIP_NAMESPACE_URI, cw as OOXML_NODE_IDENTITY_RULES, cx as OoxmlBodyNode, cy as OoxmlBookmarkEndNode, cz as OoxmlBookmarkStartNode, cA as OoxmlContentControlCalendarNode, cB as OoxmlContentControlCheckboxNode, cC as OoxmlContentControlCheckedNode, cD as OoxmlContentControlCheckedStateNode, cE as OoxmlContentControlComboBoxNode, ay as OoxmlContentControlContentNode, cF as OoxmlContentControlDataBindingNode, cG as OoxmlContentControlDateFormatNode, cH as OoxmlContentControlDateNode, cI as OoxmlContentControlDropDownListNode, cJ as OoxmlContentControlEndPropertiesNode, cK as OoxmlContentControlLidNode, cL as OoxmlContentControlListItemNode, aw as OoxmlContentControlNode, cM as OoxmlContentControlPropertiesNode, cN as OoxmlContentControlStoreMappedDataAsNode, cO as OoxmlContentControlTextNode, cP as OoxmlContentControlUncheckedStateNode, aN as OoxmlContinuationSeparatorNode, cQ as OoxmlDocumentNode, aO as OoxmlEndnotesNode, cR as OoxmlExternalTarget, aP as OoxmlFootnotesNode, cS as OoxmlGenericExtensionAttribute, cT as OoxmlHyperlinkNode, aI as OoxmlInvariantIssue, cU as OoxmlInvariantIssueCode, cV as OoxmlKnownNodeAttribute, cW as OoxmlNamespaceBinding, aG as OoxmlNodeId, cX as OoxmlNodeIdentityRules, aM as OoxmlNoteNode, aQ as OoxmlNoteRefNode, aR as OoxmlNoteReferenceNode, az as OoxmlPackageLimits, aA as OoxmlPackageRejection, aD as OoxmlPackageResult, cY as OoxmlParagraphPropertiesNode, cZ as OoxmlPartMetadata, c_ as OoxmlReadRejection, c$ as OoxmlReadResult, d0 as OoxmlRunNode, d1 as OoxmlRunPropertiesNode, aS as OoxmlSeparatorNode, d2 as OoxmlTabNode, d3 as OoxmlTextElementNode, d4 as OoxmlTextNode, d5 as OoxmlWmlValAttribute, d6 as OoxmlXmlSpaceAttribute, d7 as OverrideRecord, aj as PreservedImageMime, d8 as RelationshipError, d9 as RelationshipSetResult, da as RelationshipTargetResolver, al as RenderableImageMime, db as ResolveResult, dc as ResolvedRelationship, d as ReviewCustomItem, g as ReviewRevisionKind, h as RevisionAddress, J as RevisionAuthorEntry, K as RevisionAuthorResult, L as RevisionAuthorSkipReason, M as RevisionBatchEntry, Q as RevisionBatchResult, T as RevisionBatchSkipDetail, U as RevisionBatchSkipReason, dd as SetFieldResultOp, de as SetLegacyCheckboxOp, df as SetLegacyDropdownOp, dg as SetTextFormFieldDefaultOp, dh as ShapeReflection, di as ShapeShadow, aT as SourceCrop, an as SupportedImageMime, dj as TABLE_BORDER_STYLES, dk as TabStopWrite, aU as TableBorderStyle, dl as TargetMode, b4 as TextFormFieldOptions, b3 as TextFormFieldRange, dm as TextFormFieldType, dn as TextboxStoryProjection, dp as TreeDocOpKind, dq as TreeOpEffect, ap as ValidatedImageBytesHandle, dr as ValidatedRasterHeader, ds as VectorGradient, dt as VectorPattern, du as W15_NAMESPACE_URI, dv as WML_NAMESPACE_URI, dw as XMLNS_NAMESPACE_URI, dx as XML_NAMESPACE_URI, dy as XmlLimits, dz as XmlNode, dA as XmlRejection, dB as XmlResult, dC as ZipLimits, dD as ZipReadResult, dE as ZipRejection, dF as allocateContentControlId, dG as asciiFold, dH as buildContentTypeIndex, dI as buildRelationshipSet, dJ as childElements, dK as commentAnchorsOfStory, dL as commentsOfPart, dM as contentControlContentChildren, dN as contentControlContentNodeOf, dO as contentControlEndPropertiesNodeOf, dP as contentControlLevelOf, dQ as contentControlPropertiesNodeOf, dR as contentControlPropertiesOf, dS as contentControlTextOf, dT as contentControlsIn, dU as createImageResourceCache, dV as detectDuplicateNames, dW as directFill, dX as enclosedBookmarkDeletions, dY as extensionKey, dZ as findContentControl, d_ as findElement, d$ as firstReviewRange, e0 as flattenContentControls, e1 as hasAnyComment, e2 as hasBoundedSvgRoot, e3 as hyperlinkAnchorOf, e4 as hyperlinkRelationshipIdOf, e5 as hyperlinkTargetOf, e6 as imageResourceLookupFor, e7 as isContentControlContentNode, e8 as isContentControlNode, e9 as isContentControlWrapper, ea as isContentRevisionKind, eb as isElement, ec as isHyperlinkNode, ed as isRangeMarkerKind, ee as isValidMime, ef as legacyCheckboxFieldsOf, eg as liveDrawingReferenceCount, eh as lockForbidsEdit, ei as lockForbidsRemoval, ej as normalizePartName, ek as orderedContentControlProperties, el as parseContentControlId, em as partNameKey, en as planRevisionAuthorChange, eo as planRevisionBatch, ep as projectDrawing, eq as readOnOffChild, er as readOoxmlPackage, es as readOoxmlPart, et as readXml, eu as readZip, ev as resolveColorNode, ew as resolveContentControlLock, ex as resolveContentType, ey as resolveImageRelationship, b9 as resolveImageResourceLimits, ez as resolveInternalTarget, eA as resolveLimits, eB as resolveRelationship, eC as reviewItemKey, eD as reviewItemRanges, bb as sniffImageMime, eE as textContent, eF as textFormFieldsOf, eG as threadStateOfPart, eH as validateExternalTarget, eI as validateGifHeader, eJ as validateJpegHeader, eK as validatePngHeader, bc as validateRasterHeader, eL as withPart, eM as withoutBookmarkInPart, eN as writeOoxmlPackage, eO as writeOoxmlPackageKeepingRevisionIds, eP as writeZip } from './tree-op-types-CGlwCQXg.js';
-import { F as FieldResultsMode, E as EditOptions, c as TreeModelChange, d as TreeDocumentStore, T as TreePackageStore, S as StoryScope, b as HistoryGroup } from './tree-package-store-D0_BOm-r.js';
-export { l as AtomicNoteSpan, m as CascadeDeletedNoteReferencesOptions, C as ContentLockPolicy, D as DEFAULT_MAX_EDITABLE_STORY_PARTS, n as DrawingPropertyIdResult, j as FragmentPasteInput, k as FragmentPasteResult, o as HeaderFooterKind, p as HeaderFooterLifecycleImpact, q as HeaderFooterLifecycleOp, s as HeaderFooterLifecycleRejection, t as HeaderFooterLifecycleResult, e as HeaderFooterParts, f as HeaderFooterSectionResolution, u as HeaderFooterSlotMeta, H as HeaderFooterVariant, v as HistoryCaptureKind, M as MAX_FRAGMENT_DECODED_BYTES, w as MAX_NOTES_PER_PART, x as MAX_NOTE_REFERENCE_PARTS, y as MAX_NOTE_REFERENCE_SCAN, z as NOTE_ATOM_CHAR, B as NOTE_CONTINUATION_SEPARATOR_ID, G as NOTE_ID_MAX, J as NOTE_ID_MIN, K as NOTE_SEPARATOR_ID, L as NoteDiagnostic, O as NoteDiagnosticCode, N as NoteKind, P as NoteLifecycleImpact, Q as NoteLifecycleOp, U as NoteLifecycleOptions, V as NoteLifecycleRejection, W as NoteLifecycleResult, X as NoteReferenceHit, Y as NoteReferenceScanBudget, Z as NoteType, _ as OoxmlEditResult, $ as PackageTransactResult, a0 as RemotePackageAttribution, g as SelectionMark, a1 as StoryResolveResult, a as StoryTargetRejection, a2 as TransactionRevisionIds, a3 as TreeDocumentStoreOptions, a4 as TreePackageStoreOptions, a5 as TreeStoryRef, h as TreeTransactOptions, a6 as TreeTransactResult, a7 as TreeTransactionContext, a8 as allocateDrawingPropertyId, a9 as allocateNoteId, aa as applyEdits, ab as applyFragmentPaste, ac as applyHeaderFooterLifecycleOp, ad as applyNoteLifecycleOp, ae as atomicNoteSpansOf, af as cascadeDeletedNoteReferences, ag as collectNodeIds, ah as collectNoteReferences, ai as collectPackageNoteReferences, aj as collectSectionPropertyNodes, ak as createNodeIdAllocator, al as createNoteReferenceScanBudget, am as customMarkFollows, an as diagnoseNoteReferences, ao as findNode, ap as findNoteById, aq as formatNoteScopeId, ar as hasNode, as as insertChildren, at as isContinuationSeparatorNode, au as isEndnotesNode, av as isFootnotesNode, aw as isHeaderFooterLifecycleOp, ax as isNormalNote, ay as isNoteAtomNode, az as isNoteLifecycleOp, aA as isNoteNode, aB as isNoteRefNode, aC as isNoteReferenceNode, aD as isSeparatorNode, aE as normalNoteIds, aF as noteAtomText, aG as noteIdOf, aH as noteKindOf, aI as noteRefKindOf, aJ as noteReferenceKindOf, aK as noteTypeOf, aL as notesOf, aM as notesPartHasId, aN as observeHistoryGroup, aO as parentNodeOf, aP as parseNoteId, aQ as parseNoteScopeId, aR as removeNode, aS as replaceChildren, aT as replaceNode, r as reportHistoryGroup, aU as resolveHeaderFooterParts, aV as resolveHeaderFooterPartsBySection, aW as resolveHeaderFooterResolutionBySection, aX as resolveNotesPart, aY as withBinaryPart, aZ as withEmbeddedImage, a_ as withoutUnreferencedImagePart } from './tree-package-store-D0_BOm-r.js';
-import { O as OmmlEquationProjection, a as DrawingSupport, D as DrawingGraphicKind, b as DrawingSupportIssue } from './drawing-graphic-kind-_5u2E4ee.js';
-export { e as DEFAULT_OMML_LIMITS, c as DocumentProperties, E as EnsuredHyperlinkRelationship, f as EquationBoxEdges, g as EquationBoxStrikes, h as EquationControlSource, i as EquationExpression, d as HeadlessDocumentRejection, H as HeadlessDocumentView, j as HeadlessThemeFonts, L as LinearMathOmmlResult, k as LinearMathParseResult, l as LinearMathRejection, m as OFFICE_MATH_NAMESPACE_URI, n as OmmlLimits, o as OpenHeadlessDocumentResult, p as authorableHyperlinkTarget, q as ensureHyperlinkRelationship, r as equationExpressionToLinearMath, s as headlessViewOfStore, t as linearMathToOmml, u as openHeadlessDocument, v as parseLinearMath, w as projectOmmlEquation, x as relationshipTargetIn } from './drawing-graphic-kind-_5u2E4ee.js';
-import { I as InsertCustomNodeWrite, C as CustomNodeWriteResult } from './custom-node-writes-BC3z8NwO.js';
-export { c as BookmarkAnchor, B as BookmarkIndex, d as CustomNodePayloadRead, e as CustomNodePayloadWrite, a as CustomNodeSweepOutcome, f as CustomNodeSweepResult, g as CustomNodeWriteRejection, D as DocumentTrackingSettings, E as EmbeddedFont, F as FontStyleKey, b as ListDefinitionGeometry, L as ListKind, h as ListLevelGeometry, M as MAX_CUSTOM_NODE_LABEL_LENGTH, i as MAX_CUSTOM_NODE_PAYLOAD_LENGTH, N as NO_TRACKING_SETTINGS, R as ReadEmbeddedFontsOptions, j as buildBookmarkIndex, k as customNodePayloadsByControl, l as customNodePayloadsOf, m as deobfuscateFont, n as ensureListDefinition, o as ensureNumberingLevel, p as insertCustomNodeWrite, r as readEmbeddedFonts, q as readTrackingSettings, s as removeCustomNodeWrite, t as sweepCustomNodePayloads } from './custom-node-writes-BC3z8NwO.js';
-export { B as BookmarkNameProblem, D as DrawingPreviewPackageLimits, a as DrawingPreviewPackageResult, b as DrawingPreviewTarget, M as MAX_AUTHORED_BOOKMARK_NAME_LENGTH, c as bookmarkNameKey, d as bookmarkNameProblem, e as createDrawingPreviewPackage, i as isHiddenBookmarkName } from './drawing-preview-package-JyAqL6OV.js';
-export { c as collectFlowBlocks, a as commentBodyText, b as commentInitials, d as contentControlContentOf, e as deepParagraphOrderOfPart, i as isContentControl, f as isContentControlContent, p as paragraphOrderOfPart, w as walkAllStoryParagraphs, g as walkParagraphInline, h as walkStoryBlocks } from './review-paragraph-order-DeQp2_iu.js';
-export { A as AuthoredNoteProperties, D as DEFAULT_ENDNOTE_PROPERTIES, b as DEFAULT_FOOTNOTE_PROPERTIES, E as EndnotePosition, F as FootnotePosition, N as NoteNumRestart, a as ResolvedEndnoteProperties, R as ResolvedFootnoteProperties, c as authoredDocumentEndnoteProperties, d as authoredDocumentFootnoteProperties, e as authoredEndnotePropertiesFromSectPr, f as authoredFootnotePropertiesFromSectPr, i as isLegalEndnotePosition, g as isLegalFootnotePosition, h as isLegalNumRestart, p as parseAuthoredNoteProperties, r as resolveEndnoteProperties, j as resolveFootnoteProperties, s as settingsPartOf } from './note-properties-DGPzKUuA.js';
-export { D as DocumentProtectionEdit, a as DocumentProtectionState, N as NO_DOCUMENT_PROTECTION, r as readDocumentProtection } from './document-protection-8hXPdn5U.js';
+import { bx as OoxmlAttribute, O as OoxmlPart, am as OoxmlNode, by as OoxmlInvariantResult, aU as OoxmlElement, bz as LegacyTextArtProjection, be as VectorShapeComponent, bA as ChartPartResolver, bB as ChartexPartResolver, bC as ShapeSchemeColorResolver, bD as ShapeEffectList, bk as PictureFrameEffects, bj as VectorShapeProjection, bE as GroupTextboxProjection, bF as MetafileImageMime, b1 as OoxmlParagraphNode, bG as OoxmlFldCharNode, bH as OoxmlFldSimpleNode, bI as OoxmlInstrTextNode, aO as TreeDocOp, aZ as TreeOpRejection, bJ as TreeOpResult, bK as ResourceLimits, r as OoxmlPackage, s as RelationshipRecord, aW as OoxmlGenericElementNode, bL as OoxmlHardBreakNode, bM as ShapeColor, aS as OoxmlProperty, ab as RevisionSiteRefusal, w as ReviewRange, R as ReviewModelInput, a as ReviewItem, e as CommentRecord, v as ReviewPosition, bN as CommentThreadState, t as ReviewCommentItem, d as ReviewRevisionItem, b9 as DrawingTreeDocOp, ba as ImpactClass, az as ImageWrapTarget } from './tree-op-types-DmrePCMo.js';
+export { bO as ACCEPTED_PARAGRAPH_PROPERTIES, bP as ACCEPTED_RUN_PROPERTIES, bQ as BookmarkOpPosition, bR as CHARTEX_GRAPHIC_DATA_URI, bS as CHARTEX_NAMESPACE_URI, bT as CHART_GRAPHIC_DATA_URI, bU as CHART_NAMESPACE_URI, bV as CHART_STYLE_NAMESPACE_URI, bW as CONTENT_CONTROL_ID_MAX, bX as CONTENT_CONTROL_PROPERTY_ORDER, bY as ChartPart, bZ as ChartThemeFaces, b_ as ChartexPart, b$ as CommentAnchor, c0 as CommentPosition, c1 as CommitTextFormFieldOp, c2 as ContentControlCheckbox, c3 as ContentControlCheckboxState, c4 as ContentControlDataBinding, c5 as ContentControlDateFormat, c6 as ContentControlEntry, c7 as ContentControlKind, c8 as ContentControlLevel, c9 as ContentControlListItem, ca as ContentControlLock, cb as ContentControlProperties, cc as ContentTypeError, p as ContentTypeIndex, cd as ContentTypeRecords, ce as CreateImageResourceCacheOptions, bq as DEFAULT_IMAGE_RESOURCE_LIMITS, cf as DEFAULT_LIMITS, cg as DEFAULT_OOXML_PACKAGE_LIMITS, ch as DEFAULT_ZIP_LIMITS, ci as DIAGRAM_NAMESPACE_URI, cj as DRAWINGML_MAIN_NAMESPACE_URI, ck as DefaultRecord, cl as DeleteBookmarkOp, cm as DeleteTextOp, cn as DiagramPartResolver, co as DiagramParts, bg as DrawingImageEffects, ar as DrawingKind, as as DrawingLocks, at as DrawingPositionInput, cp as HARD_CEILINGS, cq as HYPERLINK_RELATIONSHIP_TYPE, cr as HyperlinkKind, cs as HyperlinkTarget, ct as IMAGE_RELATIONSHIP_TYPE, cu as IMAGE_RESOURCE_HARD_CEILINGS, br as IMAGE_WRAP_TARGETS, aw as ImageDecodePort, cv as ImageRelationshipResolution, ax as ImageResourceLimits, cw as ImageResourceLookup, ay as ImageResourceState, cx as IndexResult, cy as InsertBookmarkOp, cz as InsertBuildingBlockOp, cA as InsertComplexFieldOp, cB as InsertEquationOp, cC as InsertPageFieldOp, cD as InsertParagraphBesideTableOp, cE as InsertTableOp, cF as InsertTextOp, cG as LegacyCheckboxFieldRange, cH as MAX_CONTENT_CONTROLS_PER_PART, cI as MAX_CONTENT_CONTROL_NESTING, cJ as MAX_SVG_SNIFF_BYTES, cK as MoveTableOp, cL as NameRejection, cM as NameResult, cN as OFFICE_RELATIONSHIP_NAMESPACE_URI, cO as OOXML_NODE_IDENTITY_RULES, cP as OoxmlBodyNode, cQ as OoxmlBookmarkEndNode, cR as OoxmlBookmarkStartNode, cS as OoxmlContentControlCalendarNode, cT as OoxmlContentControlCheckboxNode, cU as OoxmlContentControlCheckedNode, cV as OoxmlContentControlCheckedStateNode, cW as OoxmlContentControlComboBoxNode, aX as OoxmlContentControlContentNode, cX as OoxmlContentControlDataBindingNode, cY as OoxmlContentControlDateFormatNode, cZ as OoxmlContentControlDateNode, c_ as OoxmlContentControlDropDownListNode, c$ as OoxmlContentControlEndPropertiesNode, d0 as OoxmlContentControlLidNode, d1 as OoxmlContentControlListItemNode, aV as OoxmlContentControlNode, d2 as OoxmlContentControlPropertiesNode, d3 as OoxmlContentControlStoreMappedDataAsNode, d4 as OoxmlContentControlTextNode, d5 as OoxmlContentControlUncheckedStateNode, b3 as OoxmlContinuationSeparatorNode, d6 as OoxmlDocumentNode, b4 as OoxmlEndnotesNode, q as OoxmlExternalTarget, b5 as OoxmlFootnotesNode, d7 as OoxmlGenericExtensionAttribute, d8 as OoxmlHyperlinkNode, b0 as OoxmlInvariantIssue, d9 as OoxmlInvariantIssueCode, da as OoxmlKnownNodeAttribute, db as OoxmlNamespaceBinding, a_ as OoxmlNodeId, dc as OoxmlNodeIdentityRules, b2 as OoxmlNoteNode, b6 as OoxmlNoteRefNode, b7 as OoxmlNoteReferenceNode, aP as OoxmlPackageLimits, aQ as OoxmlPackageRejection, aT as OoxmlPackageResult, dd as OoxmlParagraphPropertiesNode, de as OoxmlPartMetadata, df as OoxmlReadRejection, dg as OoxmlReadResult, dh as OoxmlRunNode, di as OoxmlRunPropertiesNode, b8 as OoxmlSeparatorNode, dj as OoxmlTabNode, dk as OoxmlTextElementNode, dl as OoxmlTextNode, dm as OoxmlWmlValAttribute, dn as OoxmlXmlSpaceAttribute, dp as OverrideRecord, aC as PreservedImageMime, dq as RelationshipError, dr as RelationshipSetResult, ds as RelationshipTargetResolver, aE as RenderableImageMime, dt as ResolveResult, du as ResolvedRelationship, u as ReviewCustomItem, x as ReviewRevisionKind, y as RevisionAddress, a4 as RevisionAuthorEntry, a5 as RevisionAuthorResult, a6 as RevisionAuthorSkipReason, a7 as RevisionBatchEntry, a8 as RevisionBatchResult, a9 as RevisionBatchSkipDetail, aa as RevisionBatchSkipReason, dv as SetFieldResultOp, dw as SetLegacyCheckboxOp, dx as SetLegacyDropdownOp, dy as SetTextFormFieldDefaultOp, dz as ShapeReflection, dA as ShapeShadow, bb as SourceCrop, aG as SupportedImageMime, dB as TABLE_BORDER_STYLES, dC as TabStopWrite, bc as TableBorderStyle, T as TargetMode, bo as TextFormFieldOptions, bn as TextFormFieldRange, dD as TextFormFieldType, dE as TextboxStoryProjection, dF as TreeDocOpKind, dG as TreeOpEffect, aI as ValidatedImageBytesHandle, dH as ValidatedRasterHeader, dI as VectorGradient, dJ as VectorPattern, dK as W15_NAMESPACE_URI, dL as WML_NAMESPACE_URI, dM as XMLNS_NAMESPACE_URI, dN as XML_NAMESPACE_URI, dO as XmlLimits, dP as XmlNode, dQ as XmlRejection, dR as XmlResult, dS as ZipLimits, dT as ZipReadResult, dU as ZipRejection, dV as allocateContentControlId, dW as asciiFold, dX as buildContentTypeIndex, dY as buildRelationshipSet, dZ as childElements, d_ as commentAnchorsOfStory, d$ as commentsOfPart, e0 as contentControlContentChildren, e1 as contentControlContentNodeOf, e2 as contentControlEndPropertiesNodeOf, e3 as contentControlLevelOf, e4 as contentControlPropertiesNodeOf, e5 as contentControlPropertiesOf, e6 as contentControlTextOf, e7 as contentControlsIn, e8 as createImageResourceCache, e9 as detectDuplicateNames, ea as directFill, eb as enclosedBookmarkDeletions, ec as extensionKey, ed as findContentControl, ee as findElement, ef as firstReviewRange, eg as flattenContentControls, eh as hasAnyComment, ei as hasBoundedSvgRoot, ej as hyperlinkAnchorOf, ek as hyperlinkRelationshipIdOf, el as hyperlinkTargetOf, em as imageResourceLookupFor, en as isContentControlContentNode, eo as isContentControlNode, ep as isContentControlWrapper, eq as isContentRevisionKind, er as isElement, es as isHyperlinkNode, et as isRangeMarkerKind, eu as isValidMime, ev as legacyCheckboxFieldsOf, ew as liveDrawingReferenceCount, ex as lockForbidsEdit, ey as lockForbidsRemoval, ez as normalizePartName, eA as orderedContentControlProperties, eB as parseContentControlId, eC as partNameKey, eD as planRevisionAuthorChange, eE as planRevisionBatch, eF as projectDrawing, eG as readOnOffChild, eH as readOoxmlPackage, eI as readOoxmlPart, eJ as readXml, eK as readZip, eL as resolveColorNode, eM as resolveContentControlLock, eN as resolveContentType, eO as resolveImageRelationship, bt as resolveImageResourceLimits, eP as resolveInternalTarget, eQ as resolveLimits, eR as resolveRelationship, eS as reviewItemKey, eT as reviewItemRanges, bv as sniffImageMime, eU as textContent, eV as textFormFieldsOf, eW as threadStateOfPart, eX as validateExternalTarget, eY as validateGifHeader, eZ as validateJpegHeader, e_ as validatePngHeader, bw as validateRasterHeader, e$ as withPart, f0 as withoutBookmarkInPart, f1 as writeOoxmlPackage, f2 as writeOoxmlPackageKeepingRevisionIds, f3 as writeZip } from './tree-op-types-DmrePCMo.js';
+export { c as collectFlowBlocks, a as commentBodyText, b as commentInitials, d as contentControlContentOf, e as deepParagraphOrderOfPart, i as isContentControl, f as isContentControlContent, p as paragraphOrderOfPart, s as sha256Bytes, w as walkAllStoryParagraphs, g as walkParagraphInline, h as walkStoryBlocks } from './review-paragraph-order-aEHnQTt7.js';
+import { F as FieldResultsMode, E as EditOptions, c as TreeModelChange, d as TreeDocumentStore, T as TreePackageStore, S as StoryScope, b as HistoryGroup } from './tree-package-fragment-DXZ2B7x0.js';
+export { l as AtomicNoteSpan, m as CascadeDeletedNoteReferencesOptions, C as ContentLockPolicy, D as DEFAULT_MAX_EDITABLE_STORY_PARTS, n as DrawingPropertyIdResult, j as FragmentPasteInput, k as FragmentPasteResult, o as HeaderFooterKind, p as HeaderFooterLifecycleImpact, q as HeaderFooterLifecycleOp, s as HeaderFooterLifecycleRejection, t as HeaderFooterLifecycleResult, e as HeaderFooterParts, f as HeaderFooterSectionResolution, u as HeaderFooterSlotMeta, H as HeaderFooterVariant, v as HistoryCaptureKind, M as MAX_FRAGMENT_DECODED_BYTES, w as MAX_NOTES_PER_PART, x as MAX_NOTE_REFERENCE_PARTS, y as MAX_NOTE_REFERENCE_SCAN, z as NOTE_ATOM_CHAR, B as NOTE_CONTINUATION_SEPARATOR_ID, G as NOTE_ID_MAX, J as NOTE_ID_MIN, K as NOTE_SEPARATOR_ID, L as NoteDiagnostic, O as NoteDiagnosticCode, N as NoteKind, P as NoteLifecycleImpact, Q as NoteLifecycleOp, U as NoteLifecycleOptions, V as NoteLifecycleRejection, W as NoteLifecycleResult, X as NoteReferenceHit, Y as NoteReferenceScanBudget, Z as NoteType, _ as OoxmlEditResult, $ as PackageTransactResult, a0 as RemotePackageAttribution, g as SelectionMark, a1 as StoryResolveResult, a as StoryTargetRejection, a2 as TransactionRevisionIds, a3 as TreeDocumentStoreOptions, a4 as TreePackageStoreOptions, a5 as TreeStoryRef, h as TreeTransactOptions, a6 as TreeTransactResult, a7 as TreeTransactionContext, a8 as allocateDrawingPropertyId, a9 as allocateNoteId, aa as applyEdits, ab as applyFragmentPaste, ac as applyHeaderFooterLifecycleOp, ad as applyNoteLifecycleOp, ae as atomicNoteSpansOf, af as cascadeDeletedNoteReferences, ag as collectNodeIds, ah as collectNoteReferences, ai as collectPackageNoteReferences, aj as collectSectionPropertyNodes, ak as createNodeIdAllocator, al as createNoteReferenceScanBudget, am as customMarkFollows, an as diagnoseNoteReferences, ao as findNode, ap as findNoteById, aq as formatNoteScopeId, ar as hasNode, as as insertChildren, at as isContinuationSeparatorNode, au as isEndnotesNode, av as isFootnotesNode, aw as isHeaderFooterLifecycleOp, ax as isNormalNote, ay as isNoteAtomNode, az as isNoteLifecycleOp, aA as isNoteNode, aB as isNoteRefNode, aC as isNoteReferenceNode, aD as isSeparatorNode, aE as normalNoteIds, aF as noteAtomText, aG as noteIdOf, aH as noteKindOf, aI as noteRefKindOf, aJ as noteReferenceKindOf, aK as noteTypeOf, aL as notesOf, aM as notesPartHasId, aN as observeHistoryGroup, aO as parentNodeOf, aP as parseNoteId, aQ as parseNoteScopeId, aR as removeNode, aS as replaceChildren, aT as replaceNode, r as reportHistoryGroup, aU as resolveHeaderFooterParts, aV as resolveHeaderFooterPartsBySection, aW as resolveHeaderFooterResolutionBySection, aX as resolveNotesPart, aY as withBinaryPart, aZ as withEmbeddedImage, a_ as withoutUnreferencedImagePart } from './tree-package-fragment-DXZ2B7x0.js';
+import { O as OmmlEquationProjection, a as DrawingSupport, D as DrawingGraphicKind, b as DrawingSupportIssue } from './drawing-graphic-kind-8zt6pugF.js';
+export { e as DEFAULT_OMML_LIMITS, c as DocumentProperties, E as EnsuredHyperlinkRelationship, f as EquationBoxEdges, g as EquationBoxStrikes, h as EquationControlSource, i as EquationExpression, d as HeadlessDocumentRejection, H as HeadlessDocumentView, j as HeadlessThemeFonts, L as LinearMathOmmlResult, k as LinearMathParseResult, l as LinearMathRejection, m as OFFICE_MATH_NAMESPACE_URI, n as OmmlLimits, o as OpenHeadlessDocumentResult, p as authorableHyperlinkTarget, q as ensureHyperlinkRelationship, r as equationExpressionToLinearMath, s as headlessViewOfStore, t as linearMathToOmml, u as openHeadlessDocument, v as parseLinearMath, w as projectOmmlEquation, x as relationshipTargetIn } from './drawing-graphic-kind-8zt6pugF.js';
+import { I as InsertCustomNodeWrite, C as CustomNodeWriteResult } from './custom-node-writes-Cj0itq58.js';
+export { c as BookmarkAnchor, B as BookmarkIndex, d as CustomNodePayloadRead, e as CustomNodePayloadWrite, a as CustomNodeSweepOutcome, f as CustomNodeSweepResult, g as CustomNodeWriteRejection, D as DocumentTrackingSettings, E as EmbeddedFont, F as FontStyleKey, b as ListDefinitionGeometry, L as ListKind, h as ListLevelGeometry, M as MAX_CUSTOM_NODE_LABEL_LENGTH, i as MAX_CUSTOM_NODE_PAYLOAD_LENGTH, N as NO_TRACKING_SETTINGS, R as ReadEmbeddedFontsOptions, j as buildBookmarkIndex, k as customNodePayloadsByControl, l as customNodePayloadsOf, m as deobfuscateFont, n as ensureListDefinition, o as ensureNumberingLevel, p as insertCustomNodeWrite, r as readEmbeddedFonts, q as readTrackingSettings, s as removeCustomNodeWrite, t as sweepCustomNodePayloads } from './custom-node-writes-Cj0itq58.js';
+export { B as BookmarkNameProblem, D as DrawingPreviewPackageLimits, a as DrawingPreviewPackageResult, b as DrawingPreviewTarget, M as MAX_AUTHORED_BOOKMARK_NAME_LENGTH, c as bookmarkNameKey, d as bookmarkNameProblem, e as createDrawingPreviewPackage, i as isHiddenBookmarkName } from './drawing-preview-package-8o9LSfzP.js';
+export { A as AuthoredNoteProperties, D as DEFAULT_ENDNOTE_PROPERTIES, b as DEFAULT_FOOTNOTE_PROPERTIES, E as EndnotePosition, F as FootnotePosition, N as NoteNumRestart, a as ResolvedEndnoteProperties, R as ResolvedFootnoteProperties, c as authoredDocumentEndnoteProperties, d as authoredDocumentFootnoteProperties, e as authoredEndnotePropertiesFromSectPr, f as authoredFootnotePropertiesFromSectPr, i as isLegalEndnotePosition, g as isLegalFootnotePosition, h as isLegalNumRestart, p as parseAuthoredNoteProperties, r as resolveEndnoteProperties, j as resolveFootnoteProperties, s as settingsPartOf } from './note-properties-BRpskBeh.js';
+export { D as DocumentProtectionEdit, a as DocumentProtectionState, N as NO_DOCUMENT_PROTECTION, r as readDocumentProtection } from './document-protection-CDLoYQI3.js';
 import { h as MetafileRenderOptions, a as MetafileReplay } from './metafile-drawing-Ce6TuWLm.js';
 export { b as MetafileCommand, c as MetafileDrawing, M as MetafileFont, d as MetafileMatrix, e as MetafilePaint, f as MetafilePathCommand, g as MetafileRaster } from './metafile-drawing-Ce6TuWLm.js';
 import './editor-scope-CA6egMaK.js';
@@ -399,6 +399,23 @@ declare function atomicFieldSpansOf(paragraph: OoxmlParagraphNode, options?: {
 /** Whether `fldCharType` is a legal ST_FldCharType value (used by tests / guards). */
 declare function isLegalFldCharType(value: string): boolean;
 
+/** One inline content control's identity and the UTF-16 span its content covers. */
+interface InlineControlSpan {
+    readonly controlId: string;
+    readonly start: number;
+    readonly end: number;
+}
+/**
+ * The innermost inline content control whose content ends exactly at `offset` — the caret
+ * at its right outer edge. What Backspace consults to delete the node as ONE unit
+ * (pro-review-and-custom-nodes 4.6): deleting its last character from outside would either
+ * strip one letter from a content-locked label (refused, so the key looks dead) or leave a
+ * half-deleted chip whose tag still claims the full payload.
+ */
+declare function inlineControlEndingAt(paragraph: OoxmlParagraphNode, offset: number): InlineControlSpan | null;
+/** The forward-delete mirror: the control whose content STARTS exactly at `offset`. */
+declare function inlineControlStartingAt(paragraph: OoxmlParagraphNode, offset: number): InlineControlSpan | null;
+
 /** One addressable unit of paragraph text: text, tab, hard break, or atomic field. */
 interface Segment {
     readonly runId: string;
@@ -417,25 +434,11 @@ interface Segment {
     readonly formatRunIds?: readonly string[];
 }
 /**
- * Flatten a paragraph into UTF-16 addressable segments, in document order.
- *
- * A HYPERLINK's runs are addressed too. `w:hyperlink` is a run container, not a leaf, and
- * the characters inside a link are ordinary paragraph text: the user selects them, types
- * over them and deletes them like any other. Skipping the container — which is what
- * iterating only direct `w:r` children did — left every link's text with no offsets at all,
- * so `paragraphTextOf` read "Visit  or ." for a sentence that says "Visit Example.com or
- * Anthropic's website." and layout, selection and the ops all agreed on the wrong string.
- *
- * Inline CONTENT CONTROLS are the same class of wrapper: their `w:sdtContent` runs join the
- * paragraph's offset stream with no break opportunity at the boundary. Nesting is bounded
- * (`MAX_INLINE_CONTAINER_DEPTH`); beyond the bound the wrapper is opaque so recursion
- * cannot exhaust the stack.
- *
- * `runId` stays the id of the run the content actually lives in, at whatever depth: the
- * appliers resolve it with `findNode` and rebuild that run's children, so nesting costs them
- * nothing.
+ * A paragraph's segments as caller-owned objects: {@link segmentsOf} for the public entry
+ * point. Internal readers share one frozen array; a host gets its own copies, as it did when
+ * every call walked the paragraph again.
  */
-declare function segmentsOf(paragraph: OoxmlParagraphNode): Segment[];
+declare function segmentsOfCopy(paragraph: OoxmlParagraphNode): Segment[];
 /** Half-open `[start, end)` of one node in its paragraph's model offset space. */
 interface OffsetSpan {
     readonly start: number;
@@ -474,22 +477,6 @@ interface ParagraphOffsetIndex {
  * second implementation that disagreed would place edits inside content that cannot be split.
  */
 declare function paragraphOffsetIndex(paragraph: OoxmlParagraphNode): ParagraphOffsetIndex;
-/** One inline content control's identity and the UTF-16 span its content covers. */
-interface InlineControlSpan {
-    readonly controlId: string;
-    readonly start: number;
-    readonly end: number;
-}
-/**
- * The innermost inline content control whose content ends exactly at `offset` — the caret
- * at its right outer edge. What Backspace consults to delete the node as ONE unit
- * (pro-review-and-custom-nodes 4.6): deleting its last character from outside would either
- * strip one letter from a content-locked label (refused, so the key looks dead) or leave a
- * half-deleted chip whose tag still claims the full payload.
- */
-declare function inlineControlEndingAt(paragraph: OoxmlParagraphNode, offset: number): InlineControlSpan | null;
-/** The forward-delete mirror: the control whose content STARTS exactly at `offset`. */
-declare function inlineControlStartingAt(paragraph: OoxmlParagraphNode, offset: number): InlineControlSpan | null;
 
 /** Structural validation, run before any tree work so a rejection changes nothing. */
 declare function validateTreeOp(part: OoxmlPart, op: TreeDocOp, options?: Pick<EditOptions, 'contentLockPolicy'>): TreeOpRejection | null;
@@ -513,1913 +500,1926 @@ declare function paragraphTextOf(part: OoxmlPart, paragraphId: string, options?:
 declare function applyTreeOp(part: OoxmlPart, op: TreeDocOp, options?: EditOptions): TreeOpResult;
 
 /**
- * Keys that must never be assigned from file data.
+ * Every kind of thing the registry gives a stable identity to.
  *
- * XML attribute names become object keys, and a document controls those names — assigning
- * `__proto__` into an ordinary object is the prototype-pollution hazard this engine audits for.
- */
-declare const DANGEROUS_KEYS: readonly string[];
-/** A file-derived key that would pollute a prototype. Refused, never sanitized-and-accepted. */
-declare class DangerousKeyError extends Error {
-    readonly key: string;
-    readonly path: string;
-    constructor(key: string, path: string);
-}
-/** Whether a key is one of {@link DANGEROUS_KEYS}. */
-declare function isDangerousKey(key: string): boolean;
-/** A fresh null-prototype record — the only object shape parser intermediates use. */
-declare function nullRecord<T = unknown>(): Record<string, T>;
-/**
- * Recursively convert `value` into null-prototype records, rejecting any
- * dangerous object key. Arrays and primitives pass through (arrays rebuilt so no
- * inherited prototype pollution survives). Throws DangerousKeyError on the first
- * unsafe key, naming its path. Cyclic inputs are rejected.
+ * Identity is `(kind, id)` plus version and NEVER registration order, so two bundles contributing
+ * the same command resolve deterministically regardless of which loaded first.
  */
-declare function toSafeRecord(value: unknown, path?: string): unknown;
-
-/** Locate `[Content_Types].xml` bytes regardless of zip key spelling. */
-declare function contentTypesPartBytes(pkg: OoxmlPackage): {
-    readonly storageKey: string;
-    readonly bytes: Uint8Array;
-} | null;
+declare const ID_KINDS: readonly ['extension', 'capability', 'command', 'query', 'schema', 'dependencyKey', 'runtimePort', 'result', 'origin'];
+/** One of {@link ID_KINDS}. */
+/** One of {@link ID_KINDS} — which sort of thing an identifier names. */
+type IdKind = (typeof ID_KINDS)[number];
 /**
- * What a package-level invariant walk found wrong.
+ * Whether a string is a well-formed identifier in either accepted grammar.
  *
- * Package invariants are cross-PART: a relationship pointing at a part that does not exist, or a
- * part no content-type record covers. Neither is visible from inside a single part's tree.
+ * Reverse-domain (`dev.docx-editor.core.command.insert-text`) or package-owned
+ * (`@docx-editor.dev/engine-core#command/insert-text`). Ids are opaque once validated.
  */
-type PackageInvariantCode = 'dangling-relationship' | 'missing-content-type'
-/** A part occupies a name OPC reserves for package infrastructure. */
- | 'reserved-part-name'
-/** Two parts whose names differ only by case, which OPC treats as one part. */
- | 'duplicate-part-name'
-/** A part name the OPC screens refuse; `writeZip` would throw on save. */
- | 'unsafe-part-name';
-/** One package invariant violation, located by part name and relationship id. */
-interface PackageInvariantIssue {
-    readonly code: PackageInvariantCode;
-    /** The part the issue is about: the missing target, or the part with no type. */
-    readonly partName: string;
-    /** For a dangling relationship, the owner that points at nothing. */
-    readonly ownerPart?: string;
-}
-/** Whether a package satisfies its cross-part invariants, listing every violation otherwise. */
-type PackageInvariantResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly issues: readonly PackageInvariantIssue[];
-};
-/** Relationship records owned by one part, in authored order. */
-declare function relationshipsOf(pkg: OoxmlPackage, ownerPart: string): readonly RelationshipRecord[];
-/** The content type that resolves for a part name, or null when nothing declares one. */
-declare function resolveContentTypeOf(pkg: OoxmlPackage, partName: string): string | null;
-/** The `.rels` part that owns a part's relationships, by OPC convention. */
-declare function relsPartNameFor(partName: string): string;
+declare function isValidId(id: string): boolean;
 /**
- * Declare a content type for a part, by upserting an `<Override>` in the content-types tree.
+ * Validate an identifier, throwing when it is malformed.
  *
- * A no-op when the part already resolves to the same type, so repeating a write does not append
- * a duplicate entry. Resolving to a DIFFERENT type replaces the existing Override in place.
- * `forceOverride` writes an explicit Override even when a Default already matches.
+ * Throws rather than returning: a bad id is an author mistake at registration time, not file
+ * input, and accepting it would produce a registry whose identities silently collide.
  */
-declare function withContentTypeOverride(pkg: OoxmlPackage, partName: string, contentType: string, options?: {
-    readonly forceOverride?: boolean;
-}): OoxmlPackage;
-/** What {@link withoutPart} answers: `ok: false` leaves the package exactly as it was. */
-interface WithoutPartResult {
-    readonly pkg: OoxmlPackage;
-    readonly ok: boolean;
+declare function assertValidId(id: string, kind?: IdKind): void;
+/** A validated (kind, id, version) triple — the registry's unit of identity. */
+interface CapabilityId {
+    readonly kind: IdKind;
+    readonly id: string;
+    readonly version: string;
+}
+
+/** A parsed semantic version. Only the three numeric components — no pre-release or build. */
+interface SemVer {
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
 }
-/** Add or replace one relationship on a part, returning a new package. */
-declare function withRelationship(pkg: OoxmlPackage, ownerPart: string, type: string, rawTarget: string): {
-    readonly pkg: OoxmlPackage;
-    readonly relationshipId: string;
-    readonly ok: boolean;
-};
 /**
- * Add a part that does not exist yet, with the content-type override it needs to be openable.
+ * Parse a semantic version, rejecting anything the registry's rules do not need.
  *
- * Deliberately does NOT create a relationship: a part is reachable because something points at
- * it, and which part points at it is the caller's decision. Creating one here would guess.
+ * Deliberately narrow: an unsupported range form is refused rather than accepted, so a malformed
+ * range can never masquerade as "compatible".
  */
-declare function withNewPart(pkg: OoxmlPackage, partName: string, root: OoxmlElement, contentType: string): OoxmlPackage;
+declare function parseSemVer(input: string): SemVer;
+/** Order two versions: negative, zero or positive, by major then minor then patch. */
+declare function compareSemVer(a: SemVer, b: SemVer): -1 | 0 | 1;
 /**
- * The two invariants a package must satisfy before it is published.
- *
- * Both describe the half-written state that splitting a multi-part write across transactions
- * produces, and both make a package Word refuses to open:
- *
- *  - a relationship pointing at a part nobody created;
- *  - a part with no content type, which is unopenable even though the XML is well formed.
- *
- * Checked at the commit boundary rather than inside each primitive, for the same reason part
- * validation moved there: a transaction is allowed to pass through an inconsistent intermediate
- * as long as nothing can observe it.
+ * Whether `version` satisfies `range`. Supported range grammar:
+ *   - `*`            any version
+ *   - `1.2.3`        exact
+ *   - `^1.2.3`       caret: same major, and >= the floor (major 0 pins the minor)
+ *   - `>=1.2.3 <2.0.0`  a single lower (inclusive) + upper (exclusive) bound pair
+ * Any other shape throws — an unparseable range is a registration error, not a pass.
  */
-declare function validatePackageInvariants(pkg: OoxmlPackage): PackageInvariantResult;
+declare function satisfies(version: string, range: string): boolean;
 
 /**
- * Whether a string is a valid XML NCName in the strict ASCII profile — a name with no colon.
+ * Why registry resolution failed.
  *
- * This is the rule for names the engine itself writes or accepts from a caller. Names read
- * from a document use {@link isXmlNCName}, which admits every XML 1.0 name.
+ * Every code names a declaration conflict a bundle author can fix — a missing dependency, an
+ * unsatisfied version range, a duplicate contribution with no replacement policy.
  */
-declare function isValidNCName(name: string): boolean;
-/** A QName is an optional `prefix:` (both NCNames) — never attacker-derived. */
-declare function isValidQName(name: string): boolean;
+type RegistryErrorCode = 'invalid-id' | 'invalid-version' | 'duplicate-extension' | 'id-collision' | 'replacement-target-missing' | 'unauthorized-replacement' | 'replacement-version-mismatch' | 'ambiguous-replacement' | 'missing-dependency' | 'dependency-cycle' | 'conflict' | 'missing-port';
 /**
- * Validate a qualified name, throwing when it is malformed.
+ * A resolution failure naming every responsible party.
  *
- * Guards the serializer: an invalid QName written into XML produces a file Word cannot open, so
- * it fails here rather than at save.
- */
-declare function assertValidQName(name: string): void;
-/**
- * Controlled namespace-prefix allocation: deterministic, collision-free prefixes
- * for namespace URIs. A known URI always yields the same registered prefix; new
- * URIs get a generated `ns{n}` prefix, never one derived from file content.
+ * Thrown rather than returned: an unresolvable registry is a build-time composition mistake, and
+ * an engine running with a half-resolved registry would fail later in ways that do not point back
+ * to the bundle that caused it.
  */
-declare class PrefixAllocator {
-    private readonly byUri;
-    private readonly usedPrefixes;
-    private counter;
-    constructor(known?: Readonly<Record<string, string>>);
-    prefixFor(namespaceUri: string): string;
-    /** The declared bindings, for emitting xmlns declarations. */
-    bindings(): {
-        prefix: string;
-        uri: string;
-    }[];
+declare class RegistryError extends Error {
+    readonly code: RegistryErrorCode;
+    /** Stable identities responsible for the failure (extensions, ids). */
+    readonly responsible: readonly string[];
+    constructor(code: RegistryErrorCode, message: string, 
+    /** Stable identities responsible for the failure (extensions, ids). */
+    responsible?: readonly string[]);
 }
-
-/**
- * A hyperlink target projected for a RUNTIME sink, or the reason it was withheld.
- *
- * The authored target stays authored — the record layer keeps it verbatim and escapes it into
- * owned OOXML, which is not a runtime sink. Only this allowlist-sanitized projection reaches DOM,
- * CSS, navigation or fetch, so `javascript:`, `data:` and `vbscript:` never leave the boundary.
- */
-type HrefProjection = {
-    readonly ok: true;
-    readonly href: string;
+/** How a base contribution permits replacement by other bundles. */
+type ReplacementPolicy = {
+    readonly kind: 'none';
 } | {
-    readonly ok: false;
-    readonly inert: true;
+    readonly kind: 'single';
+} | {
+    readonly kind: 'priority';
 };
+/** One thing a bundle contributes: a command, a query, a schema, a port, keyed by `(kind, id)`. */
+interface Contribution {
+    readonly kind: Exclude<IdKind, 'extension' | 'origin' | 'result'>;
+    readonly id: string;
+    readonly version: string;
+    /** If set, this contribution replaces an existing base contribution. */
+    readonly replaces?: {
+        readonly targetId: string;
+        readonly targetRange: string;
+        readonly priority?: number;
+    };
+    /** Policy this contribution exposes to would-be replacers (default `none`). */
+    readonly replaceable?: ReplacementPolicy;
+    readonly payload?: unknown;
+}
 /**
- * Project a file-derived URL for a DOM/navigation sink. Strips embedded
- * tab/LF/CR (used to smuggle `java\nscript:`), allows relative URLs and the
- * scheme allowlist, and renders everything else inert. Never fetches.
+ * A unit of engine functionality: its identity, version, dependencies, conflicts, required ports,
+ * and contributions.
+ *
+ * The registry's whole input. Everything a bundle needs and everything it offers is DECLARED, so
+ * resolution can be deterministic and order-independent.
  */
-declare function sanitizeHref(raw: string): HrefProjection;
-/** XML-escape a value for validated serialization back into owned OOXML. */
-declare function escapeXml(value: string): string;
-/** XML-escape a value bound for an ATTRIBUTE, preserving CR/LF/TAB across a re-parse. @internal */
-declare function escapeXmlAttribute(value: string): string;
-/**
- * Validate that a string contains only characters legal in XML 1.0 text/attributes. escapeXml
- * handles the markup-significant characters but leaves control chars, U+FFFE/U+FFFF, and unpaired
- * surrogates — which would emit malformed XML (or be silently mangled during UTF-8 encoding). Returns
- * false so a caller can reject fail-closed. Valid supplementary characters (correct surrogate pairs)
- * pass.
- *
- * @internal
- */
-declare function isValidXmlText(value: string): boolean;
-/**
- * CSS string-escape a file-derived value (e.g. an `@font-face` family name or an
- * inline style value). Emits `\<hex> ` escapes for quotes, backslash, and
- * controls so the value cannot break out of its CSS string.
- */
-declare function escapeCssString(value: string): string;
-/** Whether a file-derived CSS fragment contains a `url()` or `@import` (must be rejected). */
-declare function containsCssFetch(value: string): boolean;
-/**
- * Content that must never execute or auto-resolve: OLE objects, macros, DDE and `INCLUDE*` field
- * instructions.
- *
- * Rendered INERT by default rather than stripped — removing it would be a lossless-preservation
- * failure, so it is carried and never acted on.
- */
-declare const INERT_EXECUTABLE_KINDS: readonly ['field-dde', 'field-include', 'macro', 'activex', 'ole', 'embedded-object', 'executable-relationship'];
-/** One of {@link INERT_EXECUTABLE_KINDS}. */
-/** One of {@link INERT_EXECUTABLE_KINDS} — content carried but never executed. */
-type InertExecutableKind = (typeof INERT_EXECUTABLE_KINDS)[number];
-/** Whether a content kind is one this engine refuses to execute or auto-resolve. */
-declare function isInertExecutable(kind: string): boolean;
-/** Whether a field instruction's leading keyword is safe to evaluate. */
-declare function isEvaluableField(instruction: string): boolean;
-/** One item a scrub pass considers: its kind, and where in the package it sits. */
-interface ContentItem {
+interface FeatureBundle {
     readonly id: string;
-    readonly kind: string;
+    readonly version: string;
+    readonly dependencies?: readonly string[];
+    readonly conflicts?: readonly string[];
+    readonly requiredPorts?: readonly string[];
+    readonly contributions: readonly Contribution[];
+}
+/** The resolved result: every contribution selected, indexed by `(kind, id)`. */
+interface ResolvedRegistry {
+    readonly extensions: ReadonlyMap<string, FeatureBundle>;
+    readonly contributions: ReadonlyMap<string, Contribution>;
+    get(kind: Contribution['kind'], id: string): Contribution | undefined;
+}
+/** How resolution treats optional bundles and replacement policies. */
+interface ResolveOptions {
+    /** Runtime port ids available in this environment (design D9 / task 0.3). */
+    readonly availablePorts?: readonly string[];
 }
 /**
- * What an explicit scrub removed.
+ * Resolve a set of bundles into one registry, or throw.
  *
- * A scrub DECLARES ITSELF non-lossless: removing executable content changes the file, which is a
- * choice a caller makes deliberately rather than a default the engine applies.
+ * Deterministic and registration-order independent: selection is by `(kind, id)` plus version,
+ * and ties break only on declared policy. Array order never decides anything.
+ *
+ * @throws RegistryError naming every bundle responsible for the failure.
  */
-interface ScrubResult {
-    readonly kept: readonly ContentItem[];
-    readonly removed: readonly ContentItem[];
-    /** A scrub that removes anything is non-lossless by definition. */
-    readonly nonLossless: boolean;
-}
-/** Explicit scrub export: remove inert executable classes, report removals. */
-declare function scrubExport(items: readonly ContentItem[]): ScrubResult;
+declare function resolve(bundles: readonly FeatureBundle[], options?: ResolveOptions): ResolvedRegistry;
 
-/** True for an `m:oMathPara` display equation. */
-declare function isOmmlDisplay(node: OoxmlNode): node is OoxmlGenericElementNode;
-/** True for a paragraph-level equation atom: `m:oMath` or `m:oMathPara`. */
-declare function isOmmlEquationAtom(node: OoxmlNode): node is OoxmlGenericElementNode;
-/** The `m:oMath` equations of a display, or the equation itself for an inline `m:oMath`. */
-declare function equationsOfAtom(node: OoxmlNode): readonly OoxmlGenericElementNode[];
 /**
- * Project a display equation as one layout atom. A display with one equation keeps that
- * equation's projection, so the painted atom names the editable `m:oMath`. Several equations
- * share one row, separated by an em space.
+ * Typed-origin domains (design D5 / ADR-S5). `mutation.*` are the canonical
+ * write origins; `projection` and `awareness` MUST NOT enter history, audit,
+ * snapshots, or replication.
  */
-declare function projectOmmlDisplay(node: OoxmlNode): OmmlEquationProjection | null;
+declare const ORIGIN_IDS: {
+    readonly mutationHuman: "dev.docx-editor.core.origin.mutation.human";
+    readonly mutationAgent: "dev.docx-editor.core.origin.mutation.agent";
+    readonly mutationRemote: "dev.docx-editor.core.origin.mutation.remote";
+    readonly mutationUndo: "dev.docx-editor.core.origin.mutation.undo";
+    readonly mutationRedo: "dev.docx-editor.core.origin.mutation.redo";
+    readonly mutationMigration: "dev.docx-editor.core.origin.mutation.migration";
+    readonly mutationRepair: "dev.docx-editor.core.origin.mutation.repair";
+    readonly mutationServer: "dev.docx-editor.core.origin.mutation.server";
+    readonly projection: "dev.docx-editor.core.origin.projection";
+    readonly awareness: "dev.docx-editor.core.origin.awareness";
+};
+/** Canonical writes carry a mutation origin; these are the undoable-eligibility inputs. */
+declare const CANONICAL_MUTATION_ORIGINS: readonly string[];
+/** Origins that never enter authored state / history / audit / snapshot / replication. */
+declare const NON_CANONICAL_ORIGINS: readonly string[];
 /**
- * The physical justification of a paragraph whose only visible content is display math.
- * `m:oMathParaPr/m:jc` sets it; the default `centerGroup` centers the display. Returns null
- * when the paragraph also holds text or other content, which keeps the paragraph `w:jc`.
+ * Result taxonomy (design D8 / task 7.8). A transport/protocol failure that
+ * prevents a valid envelope is a typed exception, not a member here.
  */
-declare function displayMathAlignment(paragraph: {
-    readonly children: readonly OoxmlNode[];
-}): 'left' | 'center' | 'right' | null;
-/** Project a paragraph-level equation atom: inline `m:oMath` or display `m:oMathPara`. */
-declare function projectOmmlAtom(node: OoxmlNode): OmmlEquationProjection | null;
-
-/** UTF-16 placeholder for a page break in paragraph text projections. */
-declare const PAGE_BREAK_CHAR = "\f";
-/** What a `w:br` breaks. `other` covers values this engine does not model, kept losslessly. */
-type HardBreakKind = 'line' | 'page' | 'column' | 'other';
-/** Read the semantic break kind from a typed `w:br` node. */
-declare function hardBreakKind(node: OoxmlHardBreakNode): HardBreakKind;
-/** Whether a node is a `w:br` with `w:type="page"`. */
-declare function isPageBreakNode(node: OoxmlNode): node is OoxmlHardBreakNode;
-/** Text projection for a `w:br` node — one UTF-16 code unit per break. */
-declare function hardBreakText(node: OoxmlHardBreakNode): string;
-/** Attributes for a newly authored `w:br`. */
-declare function hardBreakAttributes(kind: 'line' | 'page'): OoxmlHardBreakNode['attributes'];
+declare const RESULT_IDS: {
+    readonly applied: "dev.docx-editor.core.result.applied";
+    readonly validation: "dev.docx-editor.core.result.validation";
+    readonly conflict: "dev.docx-editor.core.result.conflict";
+    readonly resource: "dev.docx-editor.core.result.resource";
+    readonly authorization: "dev.docx-editor.core.result.authorization";
+    readonly aborted: "dev.docx-editor.core.result.aborted";
+};
+/** Runtime ports (extensions-and-runtime-ports spec; design D9). */
+declare const RUNTIME_PORT_IDS: {
+    readonly fonts: "dev.docx-editor.core.port.fonts";
+    readonly shaping: "dev.docx-editor.core.port.shaping";
+    readonly images: "dev.docx-editor.core.port.images";
+    readonly clock: "dev.docx-editor.core.port.clock";
+    readonly identity: "dev.docx-editor.core.port.identity";
+    readonly persistence: "dev.docx-editor.core.port.persistence";
+    readonly transport: "dev.docx-editor.core.port.transport";
+    readonly scheduling: "dev.docx-editor.core.port.scheduling";
+    readonly audit: "dev.docx-editor.core.port.audit";
+    readonly authorization: "dev.docx-editor.core.port.authorization";
+    readonly resourceAccounting: "dev.docx-editor.core.port.resource-accounting";
+    readonly cancellation: "dev.docx-editor.core.port.cancellation";
+    readonly externalResourceConsent: "dev.docx-editor.core.port.external-resource-consent";
+};
+/** Layout dependency keys (design D6 / task 8.2). */
+declare const DEPENDENCY_KEY_IDS: {
+    readonly style: "dev.docx-editor.core.dep.style";
+    readonly numbering: "dev.docx-editor.core.dep.numbering";
+    readonly section: "dev.docx-editor.core.dep.section";
+    readonly story: "dev.docx-editor.core.dep.story";
+    readonly font: "dev.docx-editor.core.dep.font";
+    readonly image: "dev.docx-editor.core.dep.image";
+    readonly table: "dev.docx-editor.core.dep.table";
+    readonly field: "dev.docx-editor.core.dep.field";
+    readonly note: "dev.docx-editor.core.dep.note";
+    readonly headerFooter: "dev.docx-editor.core.dep.header-footer";
+    readonly annotation: "dev.docx-editor.core.dep.annotation";
+};
+/** Every frozen id as a flat list, for the immutability / uniqueness gate. */
+declare const ALL_FROZEN_IDS: readonly string[];
 
-/** Parsed TOC instruction. Unknown switches are ignored for generation but left on the wire. */
-interface TocInstruction {
-    readonly keyword: 'TOC';
-    /** Include hyperlinks (`\\h`). */
-    readonly hyperlink: boolean;
-    /** Omit page numbers (`\\n`). */
-    readonly omitPageNumbers: boolean;
-    /** Inclusive 1-based outline levels from `\\o "n-m"`. Defaults 1–9. */
-    readonly outlineStart: number;
-    readonly outlineEnd: number;
-    readonly raw: string;
-}
-/** Longest TOC field instruction read. Instructions come from a file; the parse is bounded. */
-declare const TOC_MAX_INSTRUCTION_CHARS = 256;
-/** Most entries one generated table of contents may hold. */
-declare const TOC_MAX_ENTRIES = 512;
-/** Most bookmarks minted during one TOC refresh. */
-declare const TOC_MAX_BOOKMARKS_PER_REFRESH = 512;
-/** Deepest nested field instruction followed. Caps recursion on file-supplied structure. */
-declare const TOC_MAX_FIELD_NESTING = 4;
 /**
- * Most layout passes a TOC refresh runs before settling.
+ * A counter's limit was reached. Carries the label, the limit, and what was attempted.
  *
- * Page numbers change the TOC's own height, which changes page numbers — bounded so a
- * non-converging document stops rather than looping.
+ * Thrown at the N → N+1 boundary, so the increment that would have crossed the limit never
+ * happens rather than being detected afterwards.
  */
-declare const TOC_MAX_PAGE_PASSES = 3;
+declare class LimitExceededError extends Error {
+    readonly label: string;
+    readonly limit: number;
+    readonly attempted: number;
+    constructor(label: string, limit: number, attempted: number);
+}
 /**
- * Parse a TOC field instruction string.
+ * Overflow-safe counting against a fixed limit.
  *
- * Returns null when the leading keyword is not TOC, the string is over-long, or the
- * outline range is hostile. Does not evaluate or fetch anything.
+ * Never silently wraps: it rejects the increment that would cross its limit AND any arithmetic
+ * that would exceed `Number.MAX_SAFE_INTEGER`. That second guard is the point — a file-supplied
+ * count must never be trusted into an allocation, and a wrapped counter reads as small.
  */
-declare function parseTocInstruction(raw: string): TocInstruction | null;
-
-/** A table of contents found in a document, whether wrapped in an SDT or a bare field. */
-interface DetectedToc {
-    /** Enclosing control id when it identifies one TOC, otherwise the begin fldChar id. */
-    readonly id: string;
-    readonly beginNodeId: string;
-    readonly beginParagraphId: string;
-    readonly endParagraphId: string;
-    readonly resultParagraphIds: readonly string[];
-    /** Direct parent whose paragraph children delimit the cached result. */
-    readonly containerId: string;
-    readonly contentControlId?: string;
-    readonly instruction: TocInstruction;
+declare class BoundedCounter {
+    readonly label: string;
+    readonly limit: number;
+    private value;
+    constructor(label: string, limit: number);
+    get current(): number;
+    /** Remaining headroom before the limit. */
+    get remaining(): number;
+    /**
+     * Add `n` (default 1). Throws LimitExceededError if the result would exceed the
+     * limit (so `limit` itself is reachable but `limit + 1` is not) or overflow the
+     * safe-integer range. On rejection the counter is unchanged.
+     */
+    add(n?: number): number;
+    /** Whether adding `n` would be accepted, without mutating. */
+    canAdd(n?: number): boolean;
+    release(n: number): void;
 }
-/** Discover refreshable body TOCs without evaluating any field instruction. */
-declare function detectBodyTocs(part: OoxmlPart): readonly DetectedToc[];
-/** Locate the table of contents containing a position, or null. */
-declare function findDetectedToc(tocs: readonly DetectedToc[], tocId: string): DetectedToc | null;
 
-/** One heading symbol: its `w:font` and `w:char`, as the file wrote them. */
-interface TocSymbol {
-    readonly font: string | null;
-    readonly char: string;
+/** A budget was misused: over-carved, over-reserved, or disposed with children outstanding. */
+declare class BudgetError extends Error {
+    constructor(message: string);
 }
-
-declare const TWIPS: unique symbol;
-declare const POINTS: unique symbol;
 /**
- * A length in twentieths of a point — OOXML's `ST_TwipsMeasure` / `ST_SignedTwipsMeasure`.
- *
- * The brand is intersection-typed onto `number`, so a `Twips` value still decays to `number`
- * wherever arithmetic consumes it; only the reverse direction — passing a raw number where
- * `Twips` is declared — is refused.
+ * Capacity claimed BEFORE it is allocated.
  *
- * @public
+ * Reserve-then-allocate rather than allocate-then-check: discovering the overrun after the
+ * allocation has already happened defeats the point of having a budget.
  */
-type Twips = number & {
-    readonly [TWIPS]: true;
-};
+interface Reservation {
+    readonly amount: number;
+    readonly released: boolean;
+    release(): void;
+}
 /**
- * A length in typographic points, the unit layout and paint compute in.
+ * One node in the hierarchical resource budget tree.
  *
- * @public
- */
-type Points = number & {
-    readonly [POINTS]: true;
-};
-/**
- * Twentieths of a point per point.
+ * An operation owns a root budget; parsers, extensions, workers, layout, transport and output
+ * carve children from it, so no subsystem can consume more than the operation as a whole allows.
  *
- * @public
+ * `dispose()` REFUSES while children or reservations are outstanding, then runs registered
+ * cleanups LIFO — spill files, worker termination — even if one throws. A leaked child budget is a
+ * leaked worker, so the refusal is the diagnostic.
  */
-declare const TWIPS_PER_POINT = 20;
+declare class Budget {
+    readonly label: string;
+    readonly capacity: number;
+    private readonly used;
+    private readonly children;
+    private activeReservations;
+    private readonly cleanups;
+    private disposed;
+    private carveAmount;
+    private parent?;
+    constructor(label: string, capacity: number);
+    get inUse(): number;
+    get available(): number;
+    get isDisposed(): boolean;
+    /** Reserve `amount` from this budget. Throws if it would exceed capacity. */
+    reserve(amount: number): Reservation;
+    /** Carve a child budget of `capacity` out of this budget's headroom. */
+    child(label: string, capacity: number): Budget;
+    /** Register cleanup for a spill file, worker, or queue tied to this budget. */
+    onRelease(cleanup: () => void): void;
+    /**
+     * Release this budget. Refuses while any child budget or reservation is
+     * outstanding (children must finish first). Runs cleanups LIFO, returns the
+     * carve-out to the parent, and marks disposed. Cleanup errors are collected and
+     * rethrown after every cleanup has run.
+     */
+    dispose(): void;
+    private assertLive;
+}
+
 /**
- * Assert that a number is a twips measurement.
- *
- * A compile-time cast, not a validator: bounds, integrality and finiteness stay at the parse
- * boundary that produced the number, exactly where they are enforced today. The cast is the
- * caller's claim about the UNIT, nothing more.
+ * Which side of the point of no return an operation is on.
  *
- * @public
+ * Canonical publication is that point. Cancelling BEFORE it rolls the whole operation back;
+ * cancelling after it leaves the commit standing and cancels only derived work — layout, export,
+ * caches.
  */
-declare const twips: (value: number) => Twips;
+type CancellationPhase = 'pre-publication' | 'post-publication';
+/** Thrown from a `checkpoint()` when the operation has been cancelled. */
+declare class CancellationError extends Error {
+    /** True when the commit is already published and only derived work is cancelled. */
+    readonly derivedOnly: boolean;
+    constructor(
+    /** True when the commit is already published and only derived work is cancelled. */
+    derivedOnly: boolean, reason?: string);
+}
 /**
- * Assert that a number is a points measurement. A compile-time cast; see {@link twips}.
+ * The read side of cancellation, handed to cooperative work.
  *
- * @public
+ * Cooperative rather than pre-emptive: long work calls `checkpoint()` at declared intervals, which
+ * is what lets an operation unwind promptly without the engine having to interrupt it mid-mutation.
  */
-declare const points$1: (value: number) => Points;
+interface CancellationToken {
+    readonly isCancelled: boolean;
+    readonly phase: CancellationPhase;
+    /** True only when cancelled AND the commit is already published. */
+    readonly derivedOnly: boolean;
+    /** Throws CancellationError if cancelled; call at declared checkpoint intervals. */
+    checkpoint(): void;
+}
 /**
- * The one twips-to-points conversion. Exact division; twips are the finer unit.
+ * The write side of cancellation, and the owner of the phase.
  *
- * @public
+ * Whoever starts an operation holds this; everything it calls gets only the token.
  */
-declare const twipsToPoints: (value: Twips) => Points;
+declare class CancellationController {
+    private _cancelled;
+    private _phase;
+    private _reason?;
+    cancel(reason?: string): void;
+    /** Mark canonical publication — the point of no return. */
+    markPublished(): void;
+    get isCancelled(): boolean;
+    get phase(): CancellationPhase;
+    get isPublished(): boolean;
+    /** Cancelled after publication -> full rollback is no longer possible. */
+    get derivedOnly(): boolean;
+    get token(): CancellationToken;
+}
+
+/** Injectable time source — the engine never calls Date.now directly (determinism). */
+interface ClockPort {
+    now(): number;
+}
+/** Stable id minting for sessions, commits, and allocator seeds. */
+interface IdentityPort {
+    newId(): string;
+}
+/** Cooperative scheduling of deferred work. */
+interface SchedulingPort {
+    schedule(task: () => void): void;
+}
+/** Redacted observability sink (raw text never enters here — design D5). */
+interface AuditPort {
+    record(entry: {
+        readonly kind: string;
+        readonly at: number;
+        readonly meta?: Record<string, unknown>;
+    }): void;
+}
+/** Read/write/export authorization decisions. */
+interface AuthorizationPort {
+    authorize(action: string, subject?: string): boolean;
+}
+/** Explicit consent gate for any remote/external resource (no zero-click fetch). */
+interface ExternalResourceConsentPort {
+    requestConsent(target: string): boolean;
+}
+/** Cancellation source for the current operation. */
+interface CancellationPort {
+    readonly token: CancellationToken;
+}
+/** Where documents are stored and retrieved. Opaque marker until its milestone. */
+interface PersistencePort {
+    readonly kind: 'persistence';
+}
+/** How the engine talks to a remote peer. Opaque marker until its milestone. */
+interface TransportPort {
+    readonly kind: 'transport';
+}
+/** Where font bytes come from. Opaque marker until its milestone. */
+interface FontPort {
+    readonly kind: 'font';
+}
+/** Which shaping backend measures text. Opaque marker until its milestone. */
+interface ShapingPort {
+    readonly kind: 'shaping';
+}
+/** How image bytes are decoded. Opaque marker until its milestone. */
+interface ImagePort {
+    readonly kind: 'image';
+}
+/** Where resource consumption is reported. Opaque marker until its milestone. */
+interface ResourceAccountingPort {
+    readonly kind: 'resource-accounting';
+}
 /**
- * The one points-to-twips conversion.
- *
- * Rounds to the nearest twip: every OOXML twips measurement is integral, and emitting a
- * fractional twip would write a value no consumer of the file can represent.
+ * A required port the runtime did not provide.
  *
- * @public
+ * Thrown rather than falling back: silently reaching for a browser global when a worker or server
+ * adapter did not supply a port is exactly the coupling ports exist to prevent.
  */
-declare const pointsToTwips: (value: Points) => Twips;
+declare class PortResolutionError extends Error {
+    readonly portId: string;
+    constructor(portId: string);
+}
 /**
- * Read a twips attribute (`ST_TwipsMeasure`, `ST_SignedTwipsMeasure`, or a `dxa` table width)
- * as a whole, signed number of twips, or `null` when the value is not a measurement.
- *
- * The schema allows an integer or a universal measure, but files also carry decimal twips
- * (`4743.74`, `708.0`, `707.9999999999998`). The accepted forms read as follows:
- *
- * - A decimal truncates toward zero: `1443.74` is 1443 and `-720.6` is -720. A leading `+`,
- *   leading zeros, a bare fraction (`.5`) and a trailing point (`1440.`) are accepted.
- * - A universal measure (`mm`, `cm`, `in`, `pt`, `pc`, `pi`) converts exactly and then
- *   truncates: `1.27cm` is 720 and `0.333in` is 479. Its sign is ignored, so `-0.5in` is 720.
- * - Whitespace, exponents, hexadecimal, uppercase units, and an integer part longer than nine
- *   digits are not measurements.
- *
- * The result is NOT bounded. Callers apply their own sign rule and range clamp, because each
- * attribute has a different valid range and a different fallback.
+ * The environment-dependent services an engine instance may reach.
  *
- * @internal
+ * Everything outside pure computation — the clock, identity minting, scheduling, fonts, images —
+ * is reached only through here, which is what lets browser, worker and server adapters supply
+ * only what their runtime actually offers.
  */
-declare function readTwipsMeasure(raw: string | undefined): number | null;
-
-/** Outline heading shape consumed by TOC planning (mirrors DocumentOutlineEntry). */
-interface TocOutlineHeading {
-    readonly text: string;
-    readonly level: number;
-    readonly blockId: string;
+declare class PortRegistry {
+    private readonly ports;
+    provide(portId: string, port: unknown): this;
+    has(portId: string): boolean;
+    /** Resolve a port by id or throw. */
+    resolve<T>(portId: string): T;
+    /** Assert every id in `portIds` is present; returns the missing ones (empty if all present). */
+    missing(portIds: readonly string[]): string[];
+    /** The provided port ids (for bridging to registry.resolve availablePorts). */
+    availablePorts(): string[];
+    clock(): ClockPort;
+    identity(): IdentityPort;
+}
+/** Deterministic clock: starts at `start` and advances by `step` each call. */
+declare class DeterministicClock implements ClockPort {
+    private readonly step;
+    private t;
+    constructor(start?: number, step?: number);
+    now(): number;
+}
+/** Sequential identity for tests and deterministic fixtures. */
+declare class SequentialIdentity implements IdentityPort {
+    private readonly prefix;
+    private n;
+    constructor(prefix?: string);
+    newId(): string;
 }
 
-/** Left-indent step between TOC levels, in twips (matches `scripts/demo-doc/toc-block.xml`). */
-declare const TOC_LEVEL_INDENT_TWIPS: Twips;
-/** Bounded left-indent twips for a TOC entry level (0-based heading depth). */
-declare function tocLeftIndentTwips(level: number): Twips;
-/** One planned TOC entry: its level, its text, and the heading it points at. */
-interface TocEntryPlan {
-    readonly level: number;
-    readonly text: string;
-    readonly headingParagraphId: string;
-    readonly bookmarkName: string;
-    readonly pageNumberText: string;
-    /** The heading's symbols, one per {@link TOC_SYMBOL_MARK} in `text`, in order. */
-    readonly symbols?: readonly TocSymbol[];
+/** What one operation is started with. Only `ports` is required. */
+interface OperationInit {
+    readonly ports: PortRegistry;
+    readonly limits?: Partial<ResourceLimits>;
+    readonly config?: Readonly<Record<string, unknown>>;
+    /** Root budget capacity in abstract units (default: the byte decompression limit). */
+    readonly capacity?: number;
+    /** Operation identity (from IdentityPort in production); defaulted for tests. */
+    readonly id?: string;
 }
-/** Build one TOC entry paragraph node. */
-declare function buildTocEntryParagraph(mint: () => string, entry: TocEntryPlan, instruction: TocInstruction, paragraphPropertiesTemplate?: OoxmlNode): OoxmlNode;
-/** Build an SDT-wrapped complex TOC field with an already planned cached result. */
-declare function buildTocContentControl(mint: () => string, entries: readonly TocEntryPlan[], instruction: TocInstruction, alias: string): OoxmlNode;
 /**
- * Word flattens manual line/tab breaks from a heading into spaces in its TOC cache.
- * Carrying them verbatim makes a short title wrap even when the row has ample room, and the
- * same normalization is what lets a cached row be matched back to the heading it came from.
- */
-declare function tocEntryText(text: string): string;
-/**
- * Plan TOC entries from the outline and existing bookmarks.
- *
- * `actorId` is explicit because this planner runs BEFORE the store transaction, so the
- * ambient transaction actor is not bound. Callers that already have the collaboration
- * identity pass it here. `resolveAllocationActor` still honours a
- * `runWithTransactionActor` wrap when the caller prefers that seam.
- */
-declare function planTocEntries(part: OoxmlPart, outline: readonly TocOutlineHeading[], instruction: TocInstruction, pageNumberByParagraphId: ReadonlyMap<string, string>, excludeParagraphIds: ReadonlySet<string>, actorId?: string): {
-    readonly entries: readonly TocEntryPlan[];
-    readonly bookmarksToCreate: readonly {
-        paragraphId: string;
-        name: string;
-    }[];
-};
-/** Create bookmarkStart/End pair nodes for insertion at the start of a paragraph. */
-declare function bookmarkPairNodes(mint: () => string, name: string, id: string): {
-    readonly start: OoxmlNode;
-    readonly end: OoxmlNode;
-};
-
-/**
- * The heading each cached result row stands for, aligned with `toc.resultParagraphIds`.
+ * The frozen environment of one operation: its limits, config, ports, root budget and
+ * cancellation controller.
  *
- * `null` for a row that names no heading this document still has — a stale row, or the
- * chrome/blank paragraphs a cached result can carry. Callers leave those alone rather than
- * writing another row's number into them.
+ * IMMUTABLE for the operation's lifetime, which is what lets cache reuse and replica agreement
+ * key on it. A new operation always gets a fresh snapshot rather than observing a mutated one.
  */
-declare function resolveTocRowHeadings(part: OoxmlPart, toc: DetectedToc, outline: readonly TocOutlineHeading[], excludeParagraphIds: ReadonlySet<string>): readonly (string | null)[];
-
-/** One paragraph in the index: its node id, its story, and its position. */
-interface ParagraphIndexEntry {
-    /** Canonical tree node id — the stable identity operations address. */
-    readonly nodeId: string;
-    /** Position among the story's paragraphs, in document order. */
-    readonly ordinal: number;
-    /** Concatenated text content, with tabs and breaks mapped as the model reads them. */
-    readonly text: string;
-    /** Node ids of the paragraph's runs, in order. */
-    readonly runIds: readonly string[];
-}
-/** One story root — body, a header/footer variant, or a note part. */
-interface StoryIndexEntry {
-    /** The part the story lives in. */
-    readonly partName: string;
-    /** The `w:body` (or story root) node id. */
-    readonly rootId: string;
-    readonly paragraphs: readonly ParagraphIndexEntry[];
-}
-/** One style definition, indexed by the id content references it under. */
-interface StyleIndexEntry {
-    readonly styleId: string;
-    readonly type: string;
-    readonly nodeId: string;
-    readonly name: string | null;
-    readonly basedOn: string | null;
-    /** Whether the part marks this the default style for its type (`w:default="1"`). */
-    readonly isDefault: boolean;
+interface OperationContext {
+    readonly id: string;
+    readonly limits: ResourceLimits;
+    readonly config: Readonly<Record<string, unknown>>;
+    readonly ports: PortRegistry;
+    readonly budget: Budget;
+    readonly cancellation: CancellationController;
 }
 /**
- * The derived lookups over a part: paragraphs, stories and styles by id.
+ * Begin an operation, capturing its immutable environment snapshot.
  *
- * Diff-patched on commit rather than rebuilt — rebuilding every index per keystroke is what made
- * typing scale with document length.
+ * Resolves and freezes limits and configuration, carves the root budget, and creates the
+ * cancellation controller — everything downstream work needs, fixed for the operation's duration.
  */
-interface OoxmlIndexes {
-    /** The tree revision these projections were derived from. */
-    readonly revision: number;
-    /** Body story first, then any other story parts, keyed by part name. */
-    readonly stories: ReadonlyMap<string, StoryIndexEntry>;
-    /** Every paragraph across every story, keyed by node id. */
-    readonly paragraphs: ReadonlyMap<string, ParagraphIndexEntry>;
-    readonly relationships: ReadonlyMap<string, readonly RelationshipRecord[]>;
-    readonly styles: ReadonlyMap<string, StyleIndexEntry>;
-}
-/** Style definitions, read out of the generic `w:styles` tree. */
-declare function indexStyles(part: OoxmlPart | undefined): Map<string, StyleIndexEntry>;
-/** The package's style definitions part, if it has one. */
-declare function stylesPartOf(pkg: OoxmlPackage): OoxmlPart | undefined;
+declare function beginOperation(init: OperationInit): OperationContext;
+/** Release the operation's root budget (requires every child/reservation released). */
+declare function endOperation(ctx: OperationContext): void;
+
+/** What a limit counts. Typed so a byte cap and a depth cap cannot be compared by accident. */
+type LimitUnit = 'bytes' | 'count' | 'depth' | 'ratio' | 'passes';
 /**
- * Derive every index from one canonical package revision.
+ * Where a limit is enforced.
  *
- * Pure: the same package and revision always produce the same index, which is what makes
- * "rebuild rather than mutate" a safe invalidation strategy.
+ * Declared per limit so enforcement happens at the boundary that can still refuse cheaply — a zip
+ * cap checked during layout has already let the bomb decompress.
  */
-declare function deriveOoxmlIndexes(pkg: OoxmlPackage, revision: number): OoxmlIndexes;
-
-/** One paragraph's meaning, independent of how it was spelled in XML. */
-interface ParagraphDigest {
-    /** Ordinal identity within its story. Node ids are NOT used: a reopened package
-     *  legitimately re-derives them, and requiring them to match would test the id scheme
-     *  rather than the content. */
-    readonly ordinal: number;
-    /**
-     * Where the paragraph SITS: the element path from the story root, so a paragraph that
-     * moves out of the table cell it was written in is a difference rather than a paragraph
-     * with the same ordinal and the same text.
-     */
-    readonly path: string;
-    /**
-     * `w14:paraId`, uppercase-normalized (matching is case-insensitive), or null. This is
-     * MANAGED identity — the agent contract anchors on it and comment threading references
-     * it — so a serializer silently dropping it must be a digest difference. Other paragraph
-     * attributes (`w:rsidR` …) stay deliberately undigested: they are revision noise.
-     */
-    readonly paraId: string | null;
-    /** Text content, including tabs and hard breaks as their characters. */
-    readonly text: string;
-    /** Accepted paragraph properties, as sorted tokens including nested children. */
-    readonly paragraphProperties: readonly string[];
-    /** Per-run accepted properties, in run order. */
-    readonly runProperties: readonly (readonly string[])[];
-    /** Fingerprints of every generic (unknown) subtree, in document order. */
-    readonly genericStructure: readonly string[];
-}
-/** One story reduced to its semantic content, ignoring everything a normalized re-emit changes. */
-interface StoryDigest {
-    readonly partName: string;
-    readonly paragraphs: readonly ParagraphDigest[];
-    /**
-     * Every block-level element of the part OUTSIDE a paragraph, in document order, as
-     * `path name(attributes)` — the tables, rows, cells, sections, content controls and
-     * their property children, each at the position that says what contains it.
-     *
-     * A paragraph's own internals are not here (they are its `ParagraphDigest`), which keeps
-     * this list proportional to a document's STRUCTURE rather than its text.
-     */
-    readonly structure: readonly string[];
+type EnforcementPhase = 'package-read' | 'xml-parse' | 'layout' | 'output';
+/** One limit's unit and enforcement phase — the metadata that makes limits testable uniformly. */
+interface LimitSpec {
+    readonly unit: LimitUnit;
+    readonly phase: EnforcementPhase;
 }
+/** Unit + enforcement phase for every resource limit. */
+declare const LIMIT_SPECS: Readonly<Record<keyof ResourceLimits, LimitSpec>>;
+/** Every limit name, for iterating the specs and asserting each has a unit and phase. */
+declare const LIMIT_KEYS: (keyof ResourceLimits)[];
+/** A phase-scoped overflow-safe counter for one limit. */
+declare function makeLimitCounter(limits: ResourceLimits, key: keyof ResourceLimits): BoundedCounter;
 /**
- * The whole document's semantic content — one of the D9 losslessness oracles.
- *
- * What a save/reopen round-trip is compared on. Byte identity applies only to non-XML parts;
- * modelled parts re-emit normalized, so equality is asserted HERE rather than on bytes.
+ * Deterministic memory substitute. Tracks current and peak "allocated" units
+ * against a hard byte ceiling; `allocate` fails closed (LimitExceededError) past
+ * the limit. Used in place of process RSS so memory-limit tests are reproducible
+ * and cancellation/cleanup can be asserted without a real allocator.
  */
-interface SemanticDigest {
-    readonly stories: readonly StoryDigest[];
+declare class DeterministicMemoryMeter {
+    private readonly counter;
+    private current;
+    private peak;
+    constructor(limitBytes: number);
+    allocate(bytes: number): void;
+    free(bytes: number): void;
+    get currentBytes(): number;
+    get peakBytes(): number;
+    /** Release everything (cancellation/cleanup path). */
+    reset(): void;
 }
-/** Where two digests diverge — the diagnostic when a round-trip loses something. */
-type DigestDifference = {
-    readonly path: string;
-    readonly before: string;
-    readonly after: string;
+/** Assert the finite-default / hard-ceiling invariant holds for every limit. */
+declare function assertLimitInvariants(): void;
+
+/** Any JSON value. The domain canonicalization and stable hashing operate over. */
+type Json = null | boolean | number | string | Json[] | {
+    [k: string]: Json;
 };
-/** Digest one part: its paragraphs, and the structure that holds them. */
-declare function digestPart(part: OoxmlPart): StoryDigest | null;
-/** Digest every part, in the given order. */
-declare function semanticDigest(parts: Iterable<OoxmlPart>): SemanticDigest;
 /**
- * Every way two digests differ, as readable paths.
- *
- * Returns the differences rather than a boolean because "the round trip lost something" is
- * useless without saying what — the failure this oracle exists to catch is a silent drop,
- * and a bare `false` reproduces the silence.
+ * Produce a canonical string for `value`, dropping any object key whose name is
+ * in `ephemera` at any depth. Numbers are emitted losslessly; -0 normalizes to 0;
+ * non-finite numbers are rejected (they must never enter a comparator input).
  */
-declare function diffSemanticDigests(before: SemanticDigest, after: SemanticDigest): DigestDifference[];
+declare function canonicalize(value: unknown, ephemera?: ReadonlySet<string>): string;
+/** 64-bit FNV-1a over the canonical form, returned as a 16-char hex string. */
+declare function stableHash(value: unknown, ephemera?: ReadonlySet<string>): string;
 
-/** Valid per MS-DOCX: 8 hex digits, non-zero, below 0x80000000. */
-declare function isValidParaId(value: string): boolean;
-/** The authored `w14:paraId` value of an element, verbatim, or null. */
-declare function paraIdOf(node: OoxmlNode): string | null;
-/** FNV-1a over UTF-16 code units — the deterministic mint every id derivation shares. */
-declare function fnv1a32(value: string): number;
-/**
- * Deterministic 8-hex mint in (0x00000000, 0x80000000), collision-free against
- * `used` (uppercase hex). Same seed + same used-set → same value, which is what
- * keeps `splitParagraphMany` byte-identical to its equivalent single splits and
- * a reopened save identical to the session that produced it.
- */
-declare function mintParaId(seed: string, used: ReadonlySet<string>): string;
-/** Every valid `w14:paraId` in the tree, uppercased. Memoized per root object. */
-declare function usedParaIds(root: OoxmlElement): ReadonlySet<string>;
-/**
- * The non-empty prefix the part ROOT binds to the w14 namespace, or null.
- *
- * Minted attributes require an in-scope binding (the invariant validator reports
- * `invalid-qname` otherwise, and the serializer would allocate an `nsN` alias).
- * Only the root binding counts: a binding authored on some descendant does not
- * cover paragraphs elsewhere in the tree.
- */
-declare function w14RootPrefix(root: OoxmlElement): string | null;
-/** The minted `[w14:paraId, w14:textId]` pair. `textId` mirrors `paraId`: it has no uniqueness requirement, no consumer reads it, and one allocator is simpler than two — but Word writes both, so we write both. */
-declare function mintedParagraphIdentityAttributes(prefix: string, value: string): readonly OoxmlAttribute[];
 /**
- * Load-time paragraph-identity normalization for a session's main part.
- *
- * Keeps every valid, first-seen paraId verbatim; mints (deterministically, seeded
- * by the paragraph's structural node id) for paragraphs whose id is missing,
- * malformed, zero, out of range, or a duplicate. Adds the root `xmlns` binding
- * the minted attributes need. Returns the INPUT PART REFERENCE when there is
- * nothing to do — a document Word saved yesterday re-serializes byte-identical.
- *
- * Attribute-only rebuilds move no child, so every node keeps its structural-path
- * id; the copy respreads only the ancestors of changed paragraphs.
+ * How one artifact class is compared.
  *
- * Fail-open: if the rebuilt part does not validate (a bug, or a pathology the
- * prefix choice could not defuse), the original part is returned — a document
- * must never become unopenable over an identity enhancement.
+ * Frozen per artifact: nothing here invents a tolerance for an artifact the spec requires to
+ * match exactly.
  */
-declare function normalizeParagraphIdentity(part: OoxmlPart): OoxmlPart;
-
-/** A text position: a paragraph's node id and a UTF-16 offset in its text. */
-interface BookmarkPosition {
-    readonly paragraphId: string;
-    readonly offset: number;
-}
-/** One bookmark, both ends resolved. */
-interface BookmarkRecord {
-    /** The name as the document writes it. */
-    readonly name: string;
-    /** Names starting with an underscore are hidden. */
-    readonly hidden: boolean;
-    /** The marker pair's `@w:id`. */
-    readonly markerId: string;
-    readonly start: BookmarkPosition;
-    readonly end: BookmarkPosition;
-    /** Node ids of the two markers. */
-    readonly startNodeId: string;
-    readonly endNodeId: string;
-    /**
-     * How many marker pairs in the part carry this name, compared without case: 1, or more
-     * where concurrent edits left copies. The record is the first; the rest are not listed.
-     */
-    readonly copies: number;
-}
-/** List each name once, using its first marker pair in document order. @public */
-declare function listBookmarks(part: OoxmlPart): readonly BookmarkRecord[];
-
-/** One `w:docPart` of the glossary, with the blocks its body holds. */
-interface BuildingBlock {
-    /** `w:docPartPr/w:name`, the identity a control's placeholder and a pick refer to. */
-    readonly name: string;
-    /** `w:category/w:gallery`, an `ST_DocPartGallery` value such as `docParts`. */
-    readonly gallery: string;
-    /** `w:category/w:name`; `General` when the block declares none. */
-    readonly category: string;
-    /** The `w:docPartBody` children: paragraphs, tables and block controls, in order. */
-    readonly blocks: readonly OoxmlNode[];
+type ComparatorMode = 'canonical-exact' | 'exact' | 'tolerance' | 'sync-optimization-only';
+/** One artifact class's comparison mode and its declared ephemera — fields excluded from equality. */
+interface ComparatorDescriptor {
+    readonly id: string;
+    readonly mode: ComparatorMode;
+    /** Object keys excluded from canonical-exact comparison (declared ephemera). */
+    readonly ephemera: readonly string[];
+    readonly note: string;
 }
-/** The gallery and category a `w:docPartList` control lists. */
-interface BuildingBlockGalleryFilter {
-    readonly gallery: string;
-    readonly category: string | null;
+/** The frozen artifact comparator set. */
+declare const COMPARATORS: {
+    readonly authoredState: {
+        readonly id: "dev.docx-editor.core.comparator.authored-state";
+        readonly mode: 'canonical-exact';
+        readonly ephemera: readonly ["revision", "provenance", "producedAt", "commitId"];
+        readonly note: 'canonical normalized authored records; ephemera excluded';
+    };
+    readonly anchor: {
+        readonly id: "dev.docx-editor.core.comparator.anchor";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'internal anchor identity/affinity compares exactly';
+    };
+    readonly yjsStateVector: {
+        readonly id: "dev.docx-editor.core.comparator.yjs-state-vector";
+        readonly mode: 'sync-optimization-only';
+        readonly ephemera: readonly [];
+        readonly note: 'exchange optimization only; never proves update or delete-set coverage';
+    };
+    readonly shapedRun: {
+        readonly id: "dev.docx-editor.core.comparator.shaped-run";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'glyph ids, clusters, and fixed-point advances compare exactly';
+    };
+    readonly paginationFingerprint: {
+        readonly id: "dev.docx-editor.core.comparator.pagination-fingerprint";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'page/column boundaries, break causes, fixed-point geometry compare exactly';
+    };
+    readonly semanticTree: {
+        readonly id: "dev.docx-editor.core.comparator.semantic-tree";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'reading order, roles, headings, alt text compare exactly';
+    };
+    readonly hitTest: {
+        readonly id: "dev.docx-editor.core.comparator.hit-test";
+        readonly mode: 'exact';
+        readonly ephemera: readonly [];
+        readonly note: 'resolved hit target and cluster affinity compare exactly';
+    };
+    readonly pdfSemantics: {
+        readonly id: "dev.docx-editor.core.comparator.pdf-semantics";
+        readonly mode: 'canonical-exact';
+        readonly ephemera: readonly ["objectNumber", "producer", "creationDate", "modDate", "subsetTag"];
+        readonly note: 'canonical semantic PDF objects; container ephemera excluded';
+    };
+    readonly rasterCheckpoint: {
+        readonly id: "dev.docx-editor.core.comparator.raster-checkpoint";
+        readonly mode: 'tolerance';
+        readonly ephemera: readonly [];
+        readonly note: 'documented unavoidable raster comparison; explicit tolerance only';
+    };
+    readonly benchmarkEvidence: {
+        readonly id: "dev.docx-editor.core.comparator.benchmark-evidence";
+        readonly mode: 'sync-optimization-only';
+        readonly ephemera: readonly [];
+        readonly note: 'diagnostic evidence, not an equivalence basis';
+    };
+};
+/** Which frozen comparator to use. */
+type ComparatorName = keyof typeof COMPARATORS;
+/** Whether two artifacts matched, and where they diverged when they did not. */
+interface ComparisonResult {
+    readonly equal: boolean;
+    /** Canonical forms when unequal (diagnostic). */
+    readonly left?: string;
+    readonly right?: string;
 }
-/** The glossary part, through the main part's relationship or the conventional name. */
-declare function glossaryPartOf(pkg: OoxmlPackage): OoxmlPart | null;
-/** Every named building block of the glossary, in authored order. Empty without a glossary. */
-declare function buildingBlocksOf(pkg: OoxmlPackage): readonly BuildingBlock[];
-/** The gallery a `w:docPartList` control lists, or null for any other control. */
-declare function buildingBlockGalleryOf(control: OoxmlNode): BuildingBlockGalleryFilter | null;
 /**
- * The blocks a gallery control offers: same gallery, and the control's category when it names
- * one. Sorted by category, then name, as Word groups its list.
+ * Compare two artifacts under a named comparator. `canonical-exact` and `exact`
+ * compare canonical forms (exact drops no ephemera). `tolerance` requires an
+ * epsilon and compares finite numbers structurally. `sync-optimization-only`
+ * throws — such artifacts are never an equivalence basis.
  */
-declare function buildingBlocksForControl(pkg: OoxmlPackage, control: OoxmlNode): readonly BuildingBlock[];
+declare function compareArtifacts(name: ComparatorName, left: unknown, right: unknown, opts?: {
+    epsilon?: number;
+}): ComparisonResult;
+/** Fingerprint an artifact under a named comparator's canonicalization policy. */
+declare function fingerprint(name: ComparatorName, value: unknown): string;
 
+/** Whether a recorded conformance step was expected to commit or be refused. */
+type FixtureOutcome = 'applied' | 'aborted' | 'validation' | 'conflict' | 'resource' | 'authorization';
+/** The change one step produced, summarized to what a fixture can compare across runtimes. */
+interface ModelChangeSummary {
+    readonly fromRevision: number;
+    readonly toRevision: number;
+    readonly origin: string;
+    readonly dirty: readonly string[];
+    readonly dependencyKeys: readonly string[];
+}
+/** Where anchors sat after a step — how a fixture proves positions survived an edit. */
+interface AnchorSnapshot {
+    readonly anchorId: string;
+    readonly story: string;
+    readonly block: string;
+    readonly affinity: 'before' | 'after';
+}
+/** What one step must produce: its outcome, its change summary, and its authored-state hash. */
+interface FixtureExpectation {
+    readonly outcome: FixtureOutcome;
+    /** Present iff outcome === 'applied'; MUST be > baseRevision. */
+    readonly committedRevision?: number;
+    readonly modelChange?: ModelChangeSummary;
+    /** 16-hex authored-state fingerprint (comparator 0.4). */
+    readonly authoredStateHash?: string;
+    readonly outputHash?: string;
+    readonly anchors?: readonly AnchorSnapshot[];
+}
+/** One recorded operation and what it was expected to do. */
+interface FixtureStep {
+    readonly baseRevision: number;
+    readonly origin: string;
+    /** Opaque DocOp payloads (schema owned by section 4). */
+    readonly ops: readonly unknown[];
+    readonly expect: FixtureExpectation;
+}
+/** Opaque encoded backend bytes (snapshot or replication update). */
+interface EncodedEnvelope {
+    readonly kind: 'snapshot' | 'update';
+    readonly protocolVersion: number;
+    readonly schemaVersion: number;
+    readonly documentId: string;
+    readonly byteLength: number;
+    /** Hex-encoded opaque bytes; length MUST equal byteLength. */
+    readonly bytesHex: string;
+}
+/** Which implementation recorded a fixture — local store, Yjs, or a binding. */
+type FixtureSource = {
+    readonly kind: 'create';
+} | {
+    readonly kind: 'docx';
+    readonly sha256: string;
+    readonly bytesRef: string;
+};
 /**
- * Which story a comment deletion or resolution may read markers from.
+ * The frozen conformance container: revisions, origins, operations, changes, snapshots and
+ * hashes.
  *
- * `w:id` is not unique across stories: a header and the body can both hold comment 1.
+ * The CONTAINER is what is frozen — field names, origin membership, revision monotonicity, hash
+ * format. The op and change payloads travel opaquely, so their schemas can evolve without
+ * invalidating every recorded fixture.
  */
-interface CommentDeletionOwner {
-    /** Canonical name of the part holding the story's markers. */
-    readonly storyPartName: string;
-    /**
-     * When the story is one note inside a shared notes part, that note's `w:id`.
-     * Absent means the whole part is the story (body, header, footer).
-     */
-    readonly noteId?: number;
+interface ConformanceFixture {
+    readonly formatVersion: 1;
+    readonly documentId: string;
+    readonly source: FixtureSource;
+    readonly steps: readonly FixtureStep[];
+    readonly snapshots?: readonly EncodedEnvelope[];
+    readonly updates?: readonly EncodedEnvelope[];
+}
+/** Whether a fixture is well-formed, listing every structural violation. */
+interface ValidationResult {
+    readonly valid: boolean;
+    readonly errors: readonly string[];
 }
+/** Structurally validate a fixture against the frozen format rules. */
+declare function validateFixture(fixture: ConformanceFixture): ValidationResult;
 
+/** The outcome a store reports for one replayed step. */
+interface ReplayOutcome {
+    readonly outcome: FixtureOutcome;
+    readonly committedRevision?: number;
+    /** Canonical authored-state value AFTER the step (hashed via comparator 0.4). */
+    readonly authoredState?: unknown;
+}
+/** The interface a conformance runtime implements so one fixture can drive every backend. */
+interface ReplayStore {
+    /** Initialize from the fixture source; return the initial revision (0 for create). */
+    init(fixture: ConformanceFixture): number;
+    /** Apply one step and report what happened. */
+    applyStep(step: FixtureStep): ReplayOutcome;
+}
+/** What replaying a fixture produced: per-step outcomes and where they diverged. */
+interface ReplayReport {
+    readonly ok: boolean;
+    readonly mismatches: readonly string[];
+}
 /**
- * Delete a comment thread: that story's markers, and metadata no other story still names.
- *
- * `owner` names the story whose markers may be stripped. Omitted, it is the main document
- * body — never every XML part. A header or note that reused the same `w:id` is a different
- * remark; pass its part (and `noteId` when the story is one note) to delete that one.
- *
- * Returns the package unchanged when the id names no comment, and null when a removal was
- * refused — a caller inside a transaction rolls back rather than committing a package whose
- * comment is half gone.
+ * Replay a fixture against a store and check every step's outcome, committed
+ * revision, and authored-state fingerprint against the fixture's expectations.
  */
-declare function deleteCommentThread(pkg: OoxmlPackage, commentId: string, owner?: CommentDeletionOwner): OoxmlPackage | null;
+declare function replayFixture(fixture: ConformanceFixture, store: ReplayStore): ReplayReport;
+/** Hash a store's authored state, so two runtimes replaying one fixture can be compared. */
+declare function hashAuthored(authoredState: unknown): string;
+
 /**
- * Delete every comment the edit between `before` and `after` emptied in `owner`'s story.
- *
- * `owner` omitted is the main document body, matching {@link deleteCommentThread}.
+ * Keys that must never be assigned from file data.
  *
- * THE TEST, exactly, and per story. A comment dies when the words it covered in that story are
- * gone and nothing in that story still places it. A neighbour that reused the same `w:id` is
- * judged under its own owner. Notes that vanished (reference cascade) are reaped as their own
- * stories so a unique id still loses its `comments.xml` body. Remaining-marker overflow
- * preserves comments/commentEx/commentId metadata rather than deleting records the scan could
- * not prove unused. Null is reserved for a removal that actually failed.
+ * XML attribute names become object keys, and a document controls those names — assigning
+ * `__proto__` into an ordinary object is the prototype-pollution hazard this engine audits for.
  */
-declare function cascadeEmptiedComments(before: OoxmlPackage, after: OoxmlPackage, owner?: CommentDeletionOwner): OoxmlPackage | null;
-
-/** Presentation settings the document itself states. Absence is the answer, never an error. */
-interface DocumentViewSettings {
-    /**
-     * `w:doNotShadeFormData` (§17.15.1.49) — do NOT shade legacy form fields.
-     *
-     * Word draws a grey block behind every `w:ffData` field so a reader can find the blanks in a
-     * form. It is on by DEFAULT, and this element is how a document turns it off, so the absent
-     * case means shading. Reading the name as "shade form data" inverts it and blanks the shading
-     * on exactly the documents that asked for it loudest.
-     *
-     * Never printed, by Word or by us: it marks where to type, and a printed form has no blanks
-     * to find.
-     */
-    readonly doNotShadeFormData: boolean;
+declare const DANGEROUS_KEYS: readonly string[];
+/** A file-derived key that would pollute a prototype. Refused, never sanitized-and-accepted. */
+declare class DangerousKeyError extends Error {
+    readonly key: string;
+    readonly path: string;
+    constructor(key: string, path: string);
 }
-/** The defaults a document with no `settings.xml` gets: everything Word would shade, shaded. */
-declare const DEFAULT_VIEW_SETTINGS: DocumentViewSettings;
-/** Read the view settings from a `settings.xml` root, or the defaults when it has none. */
-declare function readViewSettings(settingsRoot: OoxmlNode | null | undefined): DocumentViewSettings;
+/** Whether a key is one of {@link DANGEROUS_KEYS}. */
+declare function isDangerousKey(key: string): boolean;
+/** A fresh null-prototype record — the only object shape parser intermediates use. */
+declare function nullRecord<T = unknown>(): Record<string, T>;
+/**
+ * Recursively convert `value` into null-prototype records, rejecting any
+ * dangerous object key. Arrays and primitives pass through (arrays rebuilt so no
+ * inherited prototype pollution survives). Throws DangerousKeyError on the first
+ * unsafe key, naming its path. Cyclic inputs are rejected.
+ */
+declare function toSafeRecord(value: unknown, path?: string): unknown;
 
-/** How deep transparent block wrappers may nest before the walk stops descending. */
-declare const MAX_STORY_SDT_NESTING = 32;
-/** Which kind of story a root is. Layout walks all four the same way. */
-type OoxmlStoryKind = 'body' | 'header' | 'footer' | 'note';
-/** One story root and the blocks under it, with transparent block wrappers already flattened. */
-interface OoxmlStoryRoot {
-    readonly kind: OoxmlStoryKind;
-    /** The `w:body` / `w:hdr` / `w:ftr` / `w:footnote` element that holds the blocks. */
-    readonly root: OoxmlNode;
-}
+/** Locate `[Content_Types].xml` bytes regardless of zip key spelling. */
+declare function contentTypesPartBytes(pkg: OoxmlPackage): {
+    readonly storageKey: string;
+    readonly bytes: Uint8Array;
+} | null;
 /**
- * Every story root in a part, in document order.
+ * What a package-level invariant walk found wrong.
  *
- * Does not descend INTO a story: a story's blocks are the walk below, and a story root never
- * contains another story root.
+ * Package invariants are cross-PART: a relationship pointing at a part that does not exist, or a
+ * part no content-type record covers. Neither is visible from inside a single part's tree.
  */
-declare function storyRootsOf(part: OoxmlPart): readonly OoxmlStoryRoot[];
+type PackageInvariantCode = 'dangling-relationship' | 'missing-content-type'
+/** A part occupies a name OPC reserves for package infrastructure. */
+ | 'reserved-part-name'
+/** Two parts whose names differ only by case, which OPC treats as one part. */
+ | 'duplicate-part-name'
+/** A part name the OPC screens refuse; `writeZip` would throw on save. */
+ | 'unsafe-part-name';
+/** One package invariant violation, located by part name and relationship id. */
+interface PackageInvariantIssue {
+    readonly code: PackageInvariantCode;
+    /** The part the issue is about: the missing target, or the part with no type. */
+    readonly partName: string;
+    /** For a dangling relationship, the owner that points at nothing. */
+    readonly ownerPart?: string;
+}
+/** Whether a package satisfies its cross-part invariants, listing every violation otherwise. */
+type PackageInvariantResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly issues: readonly PackageInvariantIssue[];
+};
+/** Relationship records owned by one part, in authored order. */
+declare function relationshipsOf(pkg: OoxmlPackage, ownerPart: string): readonly RelationshipRecord[];
+/** The content type that resolves for a part name, or null when nothing declares one. */
+declare function resolveContentTypeOf(pkg: OoxmlPackage, partName: string): string | null;
+/** The `.rels` part that owns a part's relationships, by OPC convention. */
+declare function relsPartNameFor(partName: string): string;
 /**
- * Whether a part is SHAPED to hold stories — a body, a header, a footer, or a notes part.
+ * Declare a content type for a part, by upserting an `<Override>` in the content-types tree.
  *
- * A shape test, deliberately not `storyRootsOf(part).length > 0`. That counts EDITABLE stories,
- * and a notes part holding nothing but `w:separator` and `w:continuationSeparator` has none —
- * which is the footnotes part Word writes into every document that ever held a footnote. A
- * caller asking "should I walk this part at all" that used the editable count skipped it
- * entirely, and the two callers that ask are a payload sweep and an export strip: both DELETE
- * what they conclude nothing names.
+ * A no-op when the part already resolves to the same type, so repeating a write does not append
+ * a duplicate entry. Resolving to a DIFFERENT type replaces the existing Override in place.
+ * `forceOverride` writes an explicit Override even when a Default already matches.
  */
-declare function isStoryPart(part: OoxmlPart): boolean;
-/** The main body story of a part, or null when the part holds none. */
-declare function bodyStoryRoot(part: OoxmlPart): OoxmlNode | null;
+declare function withContentTypeOverride(pkg: OoxmlPackage, partName: string, contentType: string, options?: {
+    readonly forceOverride?: boolean;
+}): OoxmlPackage;
+/** What {@link withoutPart} answers: `ok: false` leaves the package exactly as it was. */
+interface WithoutPartResult {
+    readonly pkg: OoxmlPackage;
+    readonly ok: boolean;
+}
+/** Add or replace one relationship on a part, returning a new package. */
+declare function withRelationship(pkg: OoxmlPackage, ownerPart: string, type: string, rawTarget: string): {
+    readonly pkg: OoxmlPackage;
+    readonly relationshipId: string;
+    readonly ok: boolean;
+};
 /**
- * Every paragraph of one story, in reading order.
+ * Add a part that does not exist yet, with the content-type override it needs to be openable.
  *
- * Descends through tables (rows, cells, nested tables), block controls and block custom XML.
- * The returned nodes are paragraph elements; a caller addresses them by `id`.
+ * Deliberately does NOT create a relationship: a part is reachable because something points at
+ * it, and which part points at it is the caller's decision. Creating one here would guess.
  */
-declare function storyParagraphs(root: OoxmlNode): readonly OoxmlNode[];
+declare function withNewPart(pkg: OoxmlPackage, partName: string, root: OoxmlElement, contentType: string): OoxmlPackage;
 /**
- * The block walk itself, appending into `out`.
+ * The two invariants a package must satisfy before it is published.
  *
- * Exported so `allParagraphs` in the binding lane is the same traversal rather than a second
- * copy of it.
+ * Both describe the half-written state that splitting a multi-part write across transactions
+ * produces, and both make a package Word refuses to open:
+ *
+ *  - a relationship pointing at a part nobody created;
+ *  - a part with no content type, which is unopenable even though the XML is well formed.
+ *
+ * Checked at the commit boundary rather than inside each primitive, for the same reason part
+ * validation moved there: a transaction is allowed to pass through an inconsistent intermediate
+ * as long as nothing can observe it.
  */
-declare function collectStoryParagraphs(children: readonly OoxmlNode[], out: OoxmlNode[], sdtDepth: number): void;
+declare function validatePackageInvariants(pkg: OoxmlPackage): PackageInvariantResult;
 
-/** One searchable text-box story and the drawing location that can reveal it. */
-interface TextboxStoryRoot {
-    /** The `w:txbxContent` story root. */
-    readonly root: OoxmlElement;
-    /** Layout atom id used to select the drawing, including an MC wrapper when present. */
-    readonly drawingNodeId: string;
-    /** Canonical node id of the paragraph that anchors the drawing. */
-    readonly hostParagraphId: string;
-}
 /**
- * List the text-box stories in one part, in document order.
+ * Whether a string is a valid XML NCName in the strict ASCII profile — a name with no colon.
  *
- * The bounded walk stops at drawings. It does not project pictures, shape geometry, or story
- * content. Results are memoized by immutable part-root identity.
+ * This is the rule for names the engine itself writes or accepts from a caller. Names read
+ * from a document use {@link isXmlNCName}, which admits every XML 1.0 name.
  */
-declare function textboxStoriesInPart(part: OoxmlPart): readonly TextboxStoryRoot[];
-
-/** Relationship from the story to one data part. */
-declare const CUSTOM_XML_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
-/** Relationship from a data part to the properties that carry its `ds:itemID`. */
-declare const CUSTOM_XML_PROPS_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXmlProps";
-/** `itemPropsN.xml` needs an Override; `itemN.xml` rides the package's `xml` default. */
-declare const CUSTOM_XML_PROPS_TYPE = "application/vnd.openxmlformats-officedocument.customXmlProperties+xml";
-/** The datastore namespace `ds:datastoreItem` lives in. */
-declare const DATASTORE_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/customXml";
-/** A data part located in a package: where it lives, and the GUID an SDT binds to. */
-interface CustomXmlDataPart {
-    /** Canonical part name, e.g. `/customXml/item1.xml`. */
-    readonly partName: string;
-    /** Part name of its properties, e.g. `/customXml/itemProps1.xml`. */
-    readonly propsPartName: string;
-    /** `ds:itemID`, braced and upper-case, as `w:storeItemID` must spell it. */
-    readonly itemId: string;
-    /** Namespace URI of the payload root, which is what identifies one store among several. */
-    readonly namespaceUri: string;
+declare function isValidNCName(name: string): boolean;
+/** A QName is an optional `prefix:` (both NCNames) — never attacker-derived. */
+declare function isValidQName(name: string): boolean;
+/**
+ * Validate a qualified name, throwing when it is malformed.
+ *
+ * Guards the serializer: an invalid QName written into XML produces a file Word cannot open, so
+ * it fails here rather than at save.
+ */
+declare function assertValidQName(name: string): void;
+/**
+ * Controlled namespace-prefix allocation: deterministic, collision-free prefixes
+ * for namespace URIs. A known URI always yields the same registered prefix; new
+ * URIs get a generated `ns{n}` prefix, never one derived from file content.
+ */
+declare class PrefixAllocator {
+    private readonly byUri;
+    private readonly usedPrefixes;
+    private counter;
+    constructor(known?: Readonly<Record<string, string>>);
+    prefixFor(namespaceUri: string): string;
+    /** The declared bindings, for emitting xmlns declarations. */
+    bindings(): {
+        prefix: string;
+        uri: string;
+    }[];
 }
+
 /**
- * A `ds:itemID` derived from the seed rather than drawn at random.
- *
- * Exported so a caller that authors a store OUTSIDE a package — a template engine splicing
- * markup it will assemble into a `.docx` later — mints the id the same way this does, rather
- * than inventing a second GUID shape Word has to be tolerant of.
+ * A hyperlink target projected for a RUNTIME sink, or the reason it was withheld.
  *
- * The store is a pure function of what it is asked to write: the same document written twice
- * has to produce the same bytes, or a save/reopen/save round trip stops being a fixed point
- * and every digest taken over saved bytes moves. A GUID's job here is uniqueness within one
- * package, not unguessability, so four FNV-1a passes over a salted seed carry it.
+ * The authored target stays authored — the record layer keeps it verbatim and escapes it into
+ * owned OOXML, which is not a runtime sink. Only this allowlist-sanitized projection reaches DOM,
+ * CSS, navigation or fetch, so `javascript:`, `data:` and `vbscript:` never leave the boundary.
  */
-declare function datastoreItemIdFor(seed: string): string;
+type HrefProjection = {
+    readonly ok: true;
+    readonly href: string;
+} | {
+    readonly ok: false;
+    readonly inert: true;
+};
 /**
- * The data parts a story relates to, in relationship order.
- *
- * Reads the relationships rather than scanning `/customXml/` by name: a part nothing relates
- * to is not part of the document, and a package from a hostile sender can hold as many
- * plausibly-named files as it likes.
+ * Project a file-derived URL for a DOM/navigation sink. Strips embedded
+ * tab/LF/CR (used to smuggle `java\nscript:`), allows relative URLs and the
+ * scheme allowlist, and renders everything else inert. Never fetches.
  */
-declare function customXmlDataParts(pkg: OoxmlPackage, storyPartName: string): CustomXmlDataPart[];
-/** The data part carrying this namespace, or null when the document has none yet. */
-declare function findCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): CustomXmlDataPart | null;
-/** What {@link withCustomXmlDataPart} answers. */
-interface CustomXmlDataPartResult {
-    readonly pkg: OoxmlPackage;
-    /** Null when the part could not be authored; the package then comes back unchanged. */
-    readonly part: CustomXmlDataPart | null;
-}
+declare function sanitizeHref(raw: string): HrefProjection;
+/** XML-escape a value for validated serialization back into owned OOXML. */
+declare function escapeXml(value: string): string;
+/** XML-escape a value bound for an ATTRIBUTE, preserving CR/LF/TAB across a re-parse. @internal */
+declare function escapeXmlAttribute(value: string): string;
 /**
- * Ensure the document carries a data part for this namespace, creating it and everything it
- * needs — properties, both relationships, the properties content type — when it does not.
- *
- * Idempotent: a package that already has one for the namespace comes back untouched, so a
- * second node added to the same store does not author a second store.
+ * Validate that a string contains only characters legal in XML 1.0 text/attributes. escapeXml
+ * handles the markup-significant characters but leaves control chars, U+FFFE/U+FFFF, and unpaired
+ * surrogates — which would emit malformed XML (or be silently mangled during UTF-8 encoding). Returns
+ * false so a caller can reject fail-closed. Valid supplementary characters (correct surrogate pairs)
+ * pass.
  *
- * @param storyPartName - Whose relationships the store hangs off. Word enumerates its data
- * store from the MAIN DOCUMENT part, so a store authored off a header or footer is one Word
- * never sees.
+ * @internal
  */
-declare function withCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string, rootLocalName: string): CustomXmlDataPartResult;
+declare function isValidXmlText(value: string): boolean;
 /**
- * Remove a store from a document: both parts, both relationships, the Override.
- *
- * PACKAGE ONLY. It does not touch the body, so a `w:sdt` bound to the store keeps its
- * `w:dataBinding`, its `w:storeItemID` and its `w:tag`, and Word then opens a control bound to
- * a store that is not there. Stripping those is the export path's job and is not built; this
- * is the half that removes the payload, which is the half a caller can rely on.
+ * CSS string-escape a file-derived value (e.g. an `@font-face` family name or an
+ * inline style value). Emits `\<hex> ` escapes for quotes, backslash, and
+ * controls so the value cannot break out of its CSS string.
+ */
+declare function escapeCssString(value: string): string;
+/** Whether a file-derived CSS fragment contains a `url()` or `@import` (must be rejected). */
+declare function containsCssFetch(value: string): boolean;
+/**
+ * Content that must never execute or auto-resolve: OLE objects, macros, DDE and `INCLUDE*` field
+ * instructions.
  *
- * `ok: false` means nothing was removed and the package is unchanged — most often because an
- * owner's `.rels` was never parsed into a tree, which {@link withoutPart} refuses to work
- * around. A caller exporting a document has to treat that as a failure to export rather than
- * as a document with nothing to strip, or it ships the payload it meant to remove.
+ * Rendered INERT by default rather than stripped — removing it would be a lossless-preservation
+ * failure, so it is carried and never acted on.
  */
-declare function withoutCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): WithoutPartResult;
-
-/** One node in a store: its id, the bound text, and the payload beside it. */
-interface CustomXmlNode {
+declare const INERT_EXECUTABLE_KINDS: readonly ['field-dde', 'field-include', 'macro', 'activex', 'ole', 'embedded-object', 'executable-relationship'];
+/** One of {@link INERT_EXECUTABLE_KINDS}. */
+/** One of {@link INERT_EXECUTABLE_KINDS} — content carried but never executed. */
+type InertExecutableKind = (typeof INERT_EXECUTABLE_KINDS)[number];
+/** Whether a content kind is one this engine refuses to execute or auto-resolve. */
+declare function isInertExecutable(kind: string): boolean;
+/** Whether a field instruction's leading keyword is safe to evaluate. */
+declare function isEvaluableField(instruction: string): boolean;
+/** One item a scrub pass considers: its kind, and where in the package it sits. */
+interface ContentItem {
     readonly id: string;
-    /** Text a `w:dataBinding` resolves to. Untrusted file input. */
-    readonly label: string;
-    /** Payload as authored, JSON by convention and unparsed here. Untrusted file input. */
-    readonly data: string;
+    readonly kind: string;
 }
-/** Every node a store holds, in document order. */
-declare function customXmlNodes(pkg: OoxmlPackage, partName: string): CustomXmlNode[];
-/** One node by id, or null. */
-declare function readCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): CustomXmlNode | null;
 /**
- * Write a node, replacing one that already has the id.
+ * What an explicit scrub removed.
  *
- * Replace rather than append: a second node with the same id makes the binding xpath ambiguous,
- * and Word resolves an ambiguous xpath to the first match — so an "update" that appended would
- * leave the control showing its old text forever.
+ * A scrub DECLARES ITSELF non-lossless: removing executable content changes the file, which is a
+ * choice a caller makes deliberately rather than a default the engine applies.
  */
-declare function withCustomXmlNode(pkg: OoxmlPackage, partName: string, node: CustomXmlNode): OoxmlPackage;
-/** Drop one node by id. A store that never held it comes back unchanged. */
-declare function withoutCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): OoxmlPackage;
+interface ScrubResult {
+    readonly kept: readonly ContentItem[];
+    readonly removed: readonly ContentItem[];
+    /** A scrub that removes anything is non-lossless by definition. */
+    readonly nonLossless: boolean;
+}
+/** Explicit scrub export: remove inert executable classes, report removals. */
+declare function scrubExport(items: readonly ContentItem[]): ScrubResult;
+
+/** True for an `m:oMathPara` display equation. */
+declare function isOmmlDisplay(node: OoxmlNode): node is OoxmlGenericElementNode;
+/** True for a paragraph-level equation atom: `m:oMath` or `m:oMathPara`. */
+declare function isOmmlEquationAtom(node: OoxmlNode): node is OoxmlGenericElementNode;
+/** The `m:oMath` equations of a display, or the equation itself for an inline `m:oMath`. */
+declare function equationsOfAtom(node: OoxmlNode): readonly OoxmlGenericElementNode[];
 /**
- * Drop every node no longer referenced, given the ids the document still binds.
- *
- * This is the whole deletion story. Deleting a control in THIS editor can remove its node
- * directly, but a control deleted in Word leaves the node behind — Word has no lifecycle link
- * between the two and no way to run our code. Reconciling against what the story actually binds
- * collects both, and is the only thing that can collect the second.
- *
- * Takes the referenced ids rather than reading the story itself: the caller already walked it,
- * and a sweep that guessed at which controls exist would delete a payload on a mistake.
+ * Project a display equation as one layout atom. A display with one equation keeps that
+ * equation's projection, so the painted atom names the editable `m:oMath`. Several equations
+ * share one row, separated by an em space.
  */
-declare function withoutOrphanCustomXmlNodes(pkg: OoxmlPackage, partName: string, referencedIds: ReadonlySet<string>): {
-    readonly pkg: OoxmlPackage;
-    readonly removed: readonly string[];
-};
+declare function projectOmmlDisplay(node: OoxmlNode): OmmlEquationProjection | null;
 /**
- * The `w:xpath` a binding uses to reach a node's label, or null when the id cannot be addressed.
- *
- * Word needs a prefix for the payload namespace even when the store declares it as a default —
- * an unprefixed step in an XPath means "no namespace", so `/docxEditor/node` would match
- * nothing in a namespaced store. The prefix is declared in `w:prefixMappings` beside it.
+ * The physical justification of a paragraph whose only visible content is display math.
+ * `m:oMathParaPr/m:jc` sets it; the default `centerGroup` centers the display. Returns null
+ * when the paragraph also holds text or other content, which keeps the paragraph `w:jc`.
  */
-declare function customXmlLabelXPath(prefix: string, rootLocalName: string, nodeId: string): string | null;
-/** The `w:prefixMappings` value declaring that prefix, or null when it cannot be written.
- *  The namespace sits inside single quotes inside a double-quoted attribute, so a namespace
- *  carrying either quote character has no representation here. */
-declare function customXmlPrefixMappings(prefix: string, namespaceUri: string): string | null;
+declare function displayMathAlignment(paragraph: {
+    readonly children: readonly OoxmlNode[];
+}): 'left' | 'center' | 'right' | null;
+/** Project a paragraph-level equation atom: inline `m:oMath` or display `m:oMathPara`. */
+declare function projectOmmlAtom(node: OoxmlNode): OmmlEquationProjection | null;
 
-/** The prefix every binding this library authors declares and quotes. */
-declare const CUSTOM_NODE_XPATH_PREFIX = "ns0";
-/** The three attributes a `w:dataBinding` carries. */
-interface CustomNodeBinding {
-    readonly prefixMappings: string;
-    readonly xpath: string;
-    readonly storeItemId: string;
+/** UTF-16 placeholder for a page break in paragraph text projections. */
+declare const PAGE_BREAK_CHAR = "\f";
+/** What a `w:br` breaks. `other` covers values this engine does not model, kept losslessly. */
+type HardBreakKind = 'line' | 'page' | 'column' | 'other';
+/** Read the semantic break kind from a typed `w:br` node. */
+declare function hardBreakKind(node: OoxmlHardBreakNode): HardBreakKind;
+/** Whether a node is a `w:br` with `w:type="page"`. */
+declare function isPageBreakNode(node: OoxmlNode): node is OoxmlHardBreakNode;
+/** Text projection for a `w:br` node — one UTF-16 code unit per break. */
+declare function hardBreakText(node: OoxmlHardBreakNode): string;
+/** Attributes for a newly authored `w:br`. */
+declare function hardBreakAttributes(kind: 'line' | 'page'): OoxmlHardBreakNode['attributes'];
+
+/** Parsed TOC instruction. Unknown switches are ignored for generation but left on the wire. */
+interface TocInstruction {
+    readonly keyword: 'TOC';
+    /** Include hyperlinks (`\\h`). */
+    readonly hyperlink: boolean;
+    /** Omit page numbers (`\\n`). */
+    readonly omitPageNumbers: boolean;
+    /** Inclusive 1-based outline levels from `\\o "n-m"`. Defaults 1–9. */
+    readonly outlineStart: number;
+    readonly outlineEnd: number;
+    readonly raw: string;
 }
+/** Longest TOC field instruction read. Instructions come from a file; the parse is bounded. */
+declare const TOC_MAX_INSTRUCTION_CHARS = 256;
+/** Most entries one generated table of contents may hold. */
+declare const TOC_MAX_ENTRIES = 512;
+/** Most bookmarks minted during one TOC refresh. */
+declare const TOC_MAX_BOOKMARKS_PER_REFRESH = 512;
+/** Deepest nested field instruction followed. Caps recursion on file-supplied structure. */
+declare const TOC_MAX_FIELD_NESTING = 4;
 /**
- * The binding for one node in one store, or null when the id cannot be addressed by an XPath.
+ * Most layout passes a TOC refresh runs before settling.
  *
- * Refuses rather than escapes: XPath 1.0 has no escape for a quote inside a literal, so an id
- * carrying one could close the predicate and append an expression of the sender's choosing.
- * The ids are minted by a host, so refusing is honest — see `ADDRESSABLE_ID`.
+ * Page numbers change the TOC's own height, which changes page numbers — bounded so a
+ * non-converging document stops rather than looping.
  */
-declare function customNodeBinding(part: CustomXmlDataPart, rootLocalName: string, nodeId: string): CustomNodeBinding | null;
+declare const TOC_MAX_PAGE_PASSES = 3;
 /**
- * Every node id the story's controls bind to in one store, in document order.
+ * Parse a TOC field instruction string.
  *
- * This is the input the orphan sweep takes: a node whose id is not in here is one no control
- * names, whether it was deleted in this editor or in Word. Reading it from the STORY rather than
- * from a host's bookkeeping is what makes the two cases one mechanism.
+ * Returns null when the leading keyword is not TOC, the string is over-long, or the
+ * outline range is hostile. Does not evaluate or fetch anything.
  */
-declare function boundCustomXmlNodeIds(part: OoxmlPart, storeItemId: string): Set<string>;
+declare function parseTocInstruction(raw: string): TocInstruction | null;
+
+/** A table of contents found in a document, whether wrapped in an SDT or a bare field. */
+interface DetectedToc {
+    /** Enclosing control id when it identifies one TOC, otherwise the begin fldChar id. */
+    readonly id: string;
+    readonly beginNodeId: string;
+    readonly beginParagraphId: string;
+    readonly endParagraphId: string;
+    readonly resultParagraphIds: readonly string[];
+    /** Direct parent whose paragraph children delimit the cached result. */
+    readonly containerId: string;
+    readonly contentControlId?: string;
+    readonly instruction: TocInstruction;
+}
+/** Discover refreshable body TOCs without evaluating any field instruction. */
+declare function detectBodyTocs(part: OoxmlPart): readonly DetectedToc[];
+/** Locate the table of contents containing a position, or null. */
+declare function findDetectedToc(tocs: readonly DetectedToc[], tocId: string): DetectedToc | null;
+
+/** One heading symbol: its `w:font` and `w:char`, as the file wrote them. */
+interface TocSymbol {
+    readonly font: string | null;
+    readonly char: string;
+}
+
+declare const TWIPS: unique symbol;
+declare const POINTS: unique symbol;
 /**
- * Every node id ANY story in the package binds, in one store.
+ * A length in twentieths of a point — OOXML's `ST_TwipsMeasure` / `ST_SignedTwipsMeasure`.
  *
- * THE WHOLE PACKAGE, not one story. A payload is reachable from a header as easily as from the
- * body — Word enumerates its data store from the main part, but nothing stops a control
- * elsewhere quoting the same `w:storeItemID` — and the two callers that decide what is an orphan
- * both destroy data when they are wrong. The sweep would collect a payload a header still paints;
- * the export would strip a store a header still names, which is a document Word offers to repair.
+ * The brand is intersection-typed onto `number`, so a `Twips` value still decays to `number`
+ * wherever arithmetic consumes it; only the reverse direction — passing a raw number where
+ * `Twips` is declared — is refused.
  *
- * Costs one walk per story per store, on open and on export. Neither is a keystroke.
+ * @public
  */
-declare function boundCustomXmlNodeIdsInPackage(pkg: OoxmlPackage, storeItemId: string): Set<string>;
-/** The node id one control binds to in the named store, or null when it binds to nothing there. */
-declare function boundCustomXmlNodeIdOf(control: OoxmlNode, storeItemId: string): string | null;
-
-/** What happens to one control when the document is exported. */
-type CustomNodeExportPolicy = 'keep' | 'text' | 'remove';
-/** How {@link withExportedCustomNodes} decides, and which stores it may tidy afterwards. */
-interface CustomNodeExportRequest {
-    /** The story whose controls are policed, and whose relationships the stores hang off. */
-    readonly storyPartName: string;
-    /**
-     * Payload namespaces the caller CLAIMS.
-     *
-     * The store cleanup runs only over these. Word's own Cover Page Properties store rides in most
-     * templates, and an export that tidied every customXml part would be deleting from documents it
-     * was only asked to strip its own markup from.
-     */
-    readonly namespaces: readonly string[];
-    /** The fate of a control carrying this `w:tag`. A control with no tag is never touched. */
-    readonly decide: (tag: string) => CustomNodeExportPolicy;
-}
+type Twips = number & {
+    readonly [TWIPS]: true;
+};
 /**
- * The export, or the reason there is no export.
+ * A length in typographic points, the unit layout and paint compute in.
  *
- * A refusal answers no package on purpose. "Stripping failed, here is the document anyway" is the
- * one outcome that must not be possible: a caller would ship the markup it asked to remove and
- * have been told the export succeeded.
+ * @public
  */
-type CustomNodeExportResult = {
-    readonly ok: true;
-    readonly pkg: OoxmlPackage;
-    /** Controls unwrapped (`text`) and controls removed (`remove`). */
-    readonly unwrapped: number;
-    readonly removed: number;
-} | {
-    readonly ok: false;
-    readonly reason: string;
+type Points = number & {
+    readonly [POINTS]: true;
 };
 /**
- * Apply the policy, then take the payloads and the stores the policy orphaned.
+ * Twentieths of a point per point.
  *
- * Order matters and is the reverse of the write's. The BODY goes first, so the sweep that follows
- * sees the controls that actually survive; the stores go last, once nothing binds them. Doing it
- * the other way would strip a store while a control still quoted its `w:storeItemID`, which is a
- * document Word opens and offers to repair.
+ * @public
  */
-declare function withExportedCustomNodes(pkg: OoxmlPackage, request: CustomNodeExportRequest): CustomNodeExportResult;
-
-/** Named inputs a formula may read besides adjust values and earlier formulas. @internal */
-interface VmlFormulaContext {
-    readonly width: number;
-    readonly height: number;
-    readonly adjust: readonly number[];
-}
-/** The values of `eqns` in order, or null when one cannot be read. @internal */
-declare function vmlFormulaValues(eqns: readonly string[], context: VmlFormulaContext): readonly number[] | null;
-
-/** The VML namespace. @internal */
-declare const VML = "urn:schemas-microsoft-com:vml";
-/** The Office VML extensions namespace (`o:`). @internal */
-declare const OFFICE = "urn:schemas-microsoft-com:office:office";
-/** The Word VML extensions namespace (`w10:`). @internal */
-declare const WORD_VML = "urn:schemas-microsoft-com:office:word";
-/** Whether `node` is the element `ns`:`name`. @internal */
-declare const named: (node: OoxmlNode, ns: string, name: string) => boolean;
-/** The value of attribute `name` in namespace `ns` (none by default). @internal */
-declare const attribute: (node: OoxmlElement, name: string, ns?: string) => string | undefined;
-/** The element children of `node`. @internal */
-declare function children(node: OoxmlElement): OoxmlElement[];
-/** Whether a VML boolean is false (`f`, `false`, `0`). @internal */
-declare const off: (value: string | undefined) => boolean;
-/** A plain decimal number, bounded; NaN when malformed. @internal */
-declare function numeric(value: string | undefined): number;
-/** A VML length in points (`pt`, `in`, `cm`, `mm`, `px`); NaN when malformed. @internal */
-declare function points(value: string | undefined): number;
+declare const TWIPS_PER_POINT = 20;
 /**
- * VML rotation in degrees (`315`, `-45`, or `fd` sixty-five-thousandths). NaN when malformed.
+ * Assert that a number is a twips measurement.
  *
- * @internal
+ * A compile-time cast, not a validator: bounds, integrality and finiteness stay at the parse
+ * boundary that produced the number, exactly where they are enforced today. The cast is the
+ * caller's claim about the UNIT, nothing more.
+ *
+ * @public
  */
-declare function legacyRotationDegrees(raw: string | undefined): number;
-/** The declarations of a `style` attribute by lower-case name; null when malformed. @internal */
-declare function styleOf(node: OoxmlElement): ReadonlyMap<string, string> | null;
-/** A VML colour as `#rrggbb`, `fallback` when absent; null when malformed. @internal */
-declare function color(value: string | undefined, fallback: string): string | null;
-
-interface GeometryGuide {
-    readonly name: string;
-    readonly op: string;
-    readonly args: readonly string[];
-}
-
-type GeometryFill = 'norm' | 'none' | 'lighten' | 'lightenLess' | 'darken' | 'darkenLess';
-type GeometryCommand = {
-    readonly op: 'M' | 'L';
-    readonly args: readonly [string, string];
-} | {
-    readonly op: 'A';
-    readonly args: readonly [string, string, string, string];
-} | {
-    readonly op: 'Q';
-    readonly args: readonly [string, string, string, string];
-} | {
-    readonly op: 'C';
-    readonly args: readonly [string, string, string, string, string, string];
-} | {
-    readonly op: 'Z';
-    readonly args: readonly [];
-};
-interface GeometryPath {
-    /** Path coordinate space; 0 means the shape's own EMU space on that axis. */
-    readonly width: number;
-    readonly height: number;
-    readonly fill: GeometryFill;
-    readonly stroke: boolean;
-    readonly commands: readonly GeometryCommand[];
-}
-/** @internal */
-interface GeometryDefinition {
-    readonly avLst: readonly GeometryGuide[];
-    readonly gdLst: readonly GeometryGuide[];
-    /** Text rectangle guide references l/t/r/b; null means the whole shape. */
-    readonly textRect: readonly [string, string, string, string] | null;
-    readonly paths: readonly GeometryPath[];
-}
-interface GeometryPoint {
-    readonly x: number;
-    readonly y: number;
-}
-interface EvaluatedSubpath {
-    readonly points: readonly GeometryPoint[];
-    readonly closed: boolean;
-}
-interface EvaluatedPath {
-    readonly subpaths: readonly EvaluatedSubpath[];
-    readonly fill: GeometryFill;
-    readonly stroke: boolean;
-}
-/** @internal */
-interface EvaluatedGeometry {
-    readonly paths: readonly EvaluatedPath[];
-    readonly textRect: Readonly<{
-        left: number;
-        top: number;
-        right: number;
-        bottom: number;
-    }>;
-}
-/** The ECMA-376 preset geometry named by `a:prstGeom/@prst`, or null for an unknown name. @internal */
-declare function presetGeometryDefinition(name: string): GeometryDefinition | null;
+declare const twips: (value: number) => Twips;
 /**
- * Evaluate a definition at a shape size. `adjust` replaces avLst values by name, as
- * `a:prstGeom/a:avLst` does. Null when the flattened geometry would exceed
- * MAX_GEOMETRY_POINTS; sizes that are negative or not finite read as 0.
+ * Assert that a number is a points measurement. A compile-time cast; see {@link twips}.
  *
- * @internal
+ * @public
  */
-declare function evaluateGeometry(definition: GeometryDefinition, widthEmu: number, heightEmu: number, adjust?: ReadonlyMap<string, number>): EvaluatedGeometry | null;
-
-/** The text a shape's style supplies: `a:fontRef` names a theme font slot and a colour. @internal */
-interface DrawingTextDefaults {
-    readonly fontSlot: 'major' | 'minor' | null;
-    readonly color: ShapeColor | null;
-}
+declare const points$1: (value: number) => Points;
 /**
- * A lowered text body; `'no-text'` when it holds nothing to paint; `'unsupported'` when it
- * holds text the lowering cannot express (a vertical mode other than a quarter turn, several
- * columns, or a body past the bounds), so its shape must not render without it.
+ * The one twips-to-points conversion. Exact division; twips are the finer unit.
  *
- * @internal
+ * @public
  */
-type TextBodyLowering = LoweredDrawingText | 'no-text' | 'unsupported';
-/** @internal */
-interface LoweredDrawingText {
-    /** A `w:txbxContent` root holding the lowered paragraphs; node ids are namespaced. */
-    readonly content: OoxmlElement;
-    readonly insetsEmu: Readonly<{
-        top: number;
-        right: number;
-        bottom: number;
-        left: number;
-    }>;
-    readonly verticalAnchor: 'top' | 'center' | 'bottom';
-    readonly noWrap: boolean;
-    /** Clockwise turn `a:bodyPr/@rot` adds to the text, in degrees. */
-    readonly rotationDegrees: number;
-    /**
-     * `vert="vert"` (90) or `vert="vert270"` (270): the lines run along the box's long side, so
-     * the story lays out in the box turned a quarter. Insets are already in text space.
-     */
-    readonly quarterTurn: 0 | 90 | 270;
-}
-/** Lower one text body; see {@link TextBodyLowering}. @internal */
-declare function lowerDrawingTextBody(txBody: OoxmlElement, partName: string, defaults: DrawingTextDefaults, resolveSchemeColor?: ShapeSchemeColorResolver): TextBodyLowering;
-
-/** @internal */
-declare function findGraphicData(anchor: OoxmlElement): OoxmlElement | null;
-
+declare const twipsToPoints: (value: Twips) => Points;
 /**
- * The theme and settings identity behind a scheme colour resolver. Resolvers are rebuilt for
- * every package revision; the token stays the same while the theme and settings parts do.
+ * The one points-to-twips conversion.
+ *
+ * Rounds to the nearest twip: every OOXML twips measurement is integral, and emitting a
+ * fractional twip would write a value no consumer of the file can represent.
+ *
+ * @public
+ */
+declare const pointsToTwips: (value: Points) => Twips;
+/**
+ * Read a twips attribute (`ST_TwipsMeasure`, `ST_SignedTwipsMeasure`, or a `dxa` table width)
+ * as a whole, signed number of twips, or `null` when the value is not a measurement.
+ *
+ * The schema allows an integer or a universal measure, but files also carry decimal twips
+ * (`4743.74`, `708.0`, `707.9999999999998`). The accepted forms read as follows:
+ *
+ * - A decimal truncates toward zero: `1443.74` is 1443 and `-720.6` is -720. A leading `+`,
+ *   leading zeros, a bare fraction (`.5`) and a trailing point (`1440.`) are accepted.
+ * - A universal measure (`mm`, `cm`, `in`, `pt`, `pc`, `pi`) converts exactly and then
+ *   truncates: `1.27cm` is 720 and `0.333in` is 479. Its sign is ignored, so `-0.5in` is 720.
+ * - Whitespace, exponents, hexadecimal, uppercase units, and an integer part longer than nine
+ *   digits are not measurements.
+ *
+ * The result is NOT bounded. Callers apply their own sign rule and range clamp, because each
+ * attribute has a different valid range and a different fallback.
  *
  * @internal
  */
-declare function shapeThemeCacheToken(resolveSchemeColor: (token: string) => string | null): string | undefined;
+declare function readTwipsMeasure(raw: string | undefined): number | null;
+
+/** Outline heading shape consumed by TOC planning (mirrors DocumentOutlineEntry). */
+interface TocOutlineHeading {
+    readonly text: string;
+    readonly level: number;
+    readonly blockId: string;
+}
 
+/** Left-indent step between TOC levels, in twips (matches `scripts/demo-doc/toc-block.xml`). */
+declare const TOC_LEVEL_INDENT_TWIPS: Twips;
+/** Bounded left-indent twips for a TOC entry level (0-based heading depth). */
+declare function tocLeftIndentTwips(level: number): Twips;
+/** One planned TOC entry: its level, its text, and the heading it points at. */
+interface TocEntryPlan {
+    readonly level: number;
+    readonly text: string;
+    readonly headingParagraphId: string;
+    readonly bookmarkName: string;
+    readonly pageNumberText: string;
+    /** The heading's symbols, one per {@link TOC_SYMBOL_MARK} in `text`, in order. */
+    readonly symbols?: readonly TocSymbol[];
+}
+/** Build one TOC entry paragraph node. */
+declare function buildTocEntryParagraph(mint: () => string, entry: TocEntryPlan, instruction: TocInstruction, paragraphPropertiesTemplate?: OoxmlNode): OoxmlNode;
+/** Build an SDT-wrapped complex TOC field with an already planned cached result. */
+declare function buildTocContentControl(mint: () => string, entries: readonly TocEntryPlan[], instruction: TocInstruction, alias: string): OoxmlNode;
 /**
- * Every kind of thing the registry gives a stable identity to.
- *
- * Identity is `(kind, id)` plus version and NEVER registration order, so two bundles contributing
- * the same command resolve deterministically regardless of which loaded first.
+ * Word flattens manual line/tab breaks from a heading into spaces in its TOC cache.
+ * Carrying them verbatim makes a short title wrap even when the row has ample room, and the
+ * same normalization is what lets a cached row be matched back to the heading it came from.
  */
-declare const ID_KINDS: readonly ['extension', 'capability', 'command', 'query', 'schema', 'dependencyKey', 'runtimePort', 'result', 'origin'];
-/** One of {@link ID_KINDS}. */
-/** One of {@link ID_KINDS} — which sort of thing an identifier names. */
-type IdKind = (typeof ID_KINDS)[number];
+declare function tocEntryText(text: string): string;
 /**
- * Whether a string is a well-formed identifier in either accepted grammar.
+ * Plan TOC entries from the outline and existing bookmarks.
  *
- * Reverse-domain (`dev.docx-editor.core.command.insert-text`) or package-owned
- * (`@docx-editor.dev/engine-core#command/insert-text`). Ids are opaque once validated.
+ * `actorId` is explicit because this planner runs BEFORE the store transaction, so the
+ * ambient transaction actor is not bound. Callers that already have the collaboration
+ * identity pass it here. `resolveAllocationActor` still honours a
+ * `runWithTransactionActor` wrap when the caller prefers that seam.
  */
-declare function isValidId(id: string): boolean;
+declare function planTocEntries(part: OoxmlPart, outline: readonly TocOutlineHeading[], instruction: TocInstruction, pageNumberByParagraphId: ReadonlyMap<string, string>, excludeParagraphIds: ReadonlySet<string>, actorId?: string): {
+    readonly entries: readonly TocEntryPlan[];
+    readonly bookmarksToCreate: readonly {
+        paragraphId: string;
+        name: string;
+    }[];
+};
+/** Create bookmarkStart/End pair nodes for insertion at the start of a paragraph. */
+declare function bookmarkPairNodes(mint: () => string, name: string, id: string): {
+    readonly start: OoxmlNode;
+    readonly end: OoxmlNode;
+};
+
 /**
- * Validate an identifier, throwing when it is malformed.
+ * The heading each cached result row stands for, aligned with `toc.resultParagraphIds`.
  *
- * Throws rather than returning: a bad id is an author mistake at registration time, not file
- * input, and accepting it would produce a registry whose identities silently collide.
+ * `null` for a row that names no heading this document still has — a stale row, or the
+ * chrome/blank paragraphs a cached result can carry. Callers leave those alone rather than
+ * writing another row's number into them.
  */
-declare function assertValidId(id: string, kind?: IdKind): void;
-/** A validated (kind, id, version) triple — the registry's unit of identity. */
-interface CapabilityId {
-    readonly kind: IdKind;
-    readonly id: string;
-    readonly version: string;
-}
+declare function resolveTocRowHeadings(part: OoxmlPart, toc: DetectedToc, outline: readonly TocOutlineHeading[], excludeParagraphIds: ReadonlySet<string>): readonly (string | null)[];
 
-/** A parsed semantic version. Only the three numeric components — no pre-release or build. */
-interface SemVer {
-    readonly major: number;
-    readonly minor: number;
-    readonly patch: number;
+/** One paragraph in the index: its node id, its story, and its position. */
+interface ParagraphIndexEntry {
+    /** Canonical tree node id — the stable identity operations address. */
+    readonly nodeId: string;
+    /** Position among the story's paragraphs, in document order. */
+    readonly ordinal: number;
+    /** Concatenated text content, with tabs and breaks mapped as the model reads them. */
+    readonly text: string;
+    /** Node ids of the paragraph's runs, in order. */
+    readonly runIds: readonly string[];
+}
+/** One story root — body, a header/footer variant, or a note part. */
+interface StoryIndexEntry {
+    /** The part the story lives in. */
+    readonly partName: string;
+    /** The `w:body` (or story root) node id. */
+    readonly rootId: string;
+    readonly paragraphs: readonly ParagraphIndexEntry[];
+}
+/** One style definition, indexed by the id content references it under. */
+interface StyleIndexEntry {
+    readonly styleId: string;
+    readonly type: string;
+    readonly nodeId: string;
+    readonly name: string | null;
+    readonly basedOn: string | null;
+    /** Whether the part marks this the default style for its type (`w:default="1"`). */
+    readonly isDefault: boolean;
 }
 /**
- * Parse a semantic version, rejecting anything the registry's rules do not need.
+ * The derived lookups over a part: paragraphs, stories and styles by id.
  *
- * Deliberately narrow: an unsupported range form is refused rather than accepted, so a malformed
- * range can never masquerade as "compatible".
+ * Diff-patched on commit rather than rebuilt — rebuilding every index per keystroke is what made
+ * typing scale with document length.
  */
-declare function parseSemVer(input: string): SemVer;
-/** Order two versions: negative, zero or positive, by major then minor then patch. */
-declare function compareSemVer(a: SemVer, b: SemVer): -1 | 0 | 1;
+interface OoxmlIndexes {
+    /** The tree revision these projections were derived from. */
+    readonly revision: number;
+    /** Body story first, then any other story parts, keyed by part name. */
+    readonly stories: ReadonlyMap<string, StoryIndexEntry>;
+    /** Every paragraph across every story, keyed by node id. */
+    readonly paragraphs: ReadonlyMap<string, ParagraphIndexEntry>;
+    readonly relationships: ReadonlyMap<string, readonly RelationshipRecord[]>;
+    readonly styles: ReadonlyMap<string, StyleIndexEntry>;
+}
+/** Style definitions, read out of the generic `w:styles` tree. */
+declare function indexStyles(part: OoxmlPart | undefined): Map<string, StyleIndexEntry>;
+/** The package's style definitions part, if it has one. */
+declare function stylesPartOf(pkg: OoxmlPackage): OoxmlPart | undefined;
 /**
- * Whether `version` satisfies `range`. Supported range grammar:
- *   - `*`            any version
- *   - `1.2.3`        exact
- *   - `^1.2.3`       caret: same major, and >= the floor (major 0 pins the minor)
- *   - `>=1.2.3 <2.0.0`  a single lower (inclusive) + upper (exclusive) bound pair
- * Any other shape throws — an unparseable range is a registration error, not a pass.
+ * The numbering part's root, chosen as the editor session chooses the one it paints with: the
+ * main document's FIRST numbering relationship, else the default path.
  */
-declare function satisfies(version: string, range: string): boolean;
-
+declare function numberingRootOf(pkg: OoxmlPackage): OoxmlElement | null;
 /**
- * Why registry resolution failed.
+ * Derive every index from one canonical package revision.
  *
- * Every code names a declaration conflict a bundle author can fix — a missing dependency, an
- * unsatisfied version range, a duplicate contribution with no replacement policy.
+ * Pure: the same package and revision always produce the same index, which is what makes
+ * "rebuild rather than mutate" a safe invalidation strategy.
  */
-type RegistryErrorCode = 'invalid-id' | 'invalid-version' | 'duplicate-extension' | 'id-collision' | 'replacement-target-missing' | 'unauthorized-replacement' | 'replacement-version-mismatch' | 'ambiguous-replacement' | 'missing-dependency' | 'dependency-cycle' | 'conflict' | 'missing-port';
+declare function deriveOoxmlIndexes(pkg: OoxmlPackage, revision: number): OoxmlIndexes;
+
+/** One paragraph's meaning, independent of how it was spelled in XML. */
+interface ParagraphDigest {
+    /** Ordinal identity within its story. Node ids are NOT used: a reopened package
+     *  legitimately re-derives them, and requiring them to match would test the id scheme
+     *  rather than the content. */
+    readonly ordinal: number;
+    /**
+     * Where the paragraph SITS: the element path from the story root, so a paragraph that
+     * moves out of the table cell it was written in is a difference rather than a paragraph
+     * with the same ordinal and the same text.
+     */
+    readonly path: string;
+    /**
+     * `w14:paraId`, uppercase-normalized (matching is case-insensitive), or null. This is
+     * MANAGED identity — the agent contract anchors on it and comment threading references
+     * it — so a serializer silently dropping it must be a digest difference. Other paragraph
+     * attributes (`w:rsidR` …) stay deliberately undigested: they are revision noise.
+     */
+    readonly paraId: string | null;
+    /** Text content, including tabs and hard breaks as their characters. */
+    readonly text: string;
+    /** Accepted paragraph properties, as sorted tokens including nested children. */
+    readonly paragraphProperties: readonly string[];
+    /** Per-run accepted properties, in run order. */
+    readonly runProperties: readonly (readonly string[])[];
+    /** Fingerprints of every generic (unknown) subtree, in document order. */
+    readonly genericStructure: readonly string[];
+}
+/** One story reduced to its semantic content, ignoring everything a normalized re-emit changes. */
+interface StoryDigest {
+    readonly partName: string;
+    readonly paragraphs: readonly ParagraphDigest[];
+    /**
+     * Every block-level element of the part OUTSIDE a paragraph, in document order, as
+     * `path name(attributes)` — the tables, rows, cells, sections, content controls and
+     * their property children, each at the position that says what contains it.
+     *
+     * A paragraph's own internals are not here (they are its `ParagraphDigest`), which keeps
+     * this list proportional to a document's STRUCTURE rather than its text.
+     */
+    readonly structure: readonly string[];
+}
 /**
- * A resolution failure naming every responsible party.
+ * The whole document's semantic content — one of the D9 losslessness oracles.
  *
- * Thrown rather than returned: an unresolvable registry is a build-time composition mistake, and
- * an engine running with a half-resolved registry would fail later in ways that do not point back
- * to the bundle that caused it.
+ * What a save/reopen round-trip is compared on. Byte identity applies only to non-XML parts;
+ * modelled parts re-emit normalized, so equality is asserted HERE rather than on bytes.
  */
-declare class RegistryError extends Error {
-    readonly code: RegistryErrorCode;
-    /** Stable identities responsible for the failure (extensions, ids). */
-    readonly responsible: readonly string[];
-    constructor(code: RegistryErrorCode, message: string, 
-    /** Stable identities responsible for the failure (extensions, ids). */
-    responsible?: readonly string[]);
+interface SemanticDigest {
+    readonly stories: readonly StoryDigest[];
 }
-/** How a base contribution permits replacement by other bundles. */
-type ReplacementPolicy = {
-    readonly kind: 'none';
-} | {
-    readonly kind: 'single';
-} | {
-    readonly kind: 'priority';
+/** Where two digests diverge — the diagnostic when a round-trip loses something. */
+type DigestDifference = {
+    readonly path: string;
+    readonly before: string;
+    readonly after: string;
 };
-/** One thing a bundle contributes: a command, a query, a schema, a port, keyed by `(kind, id)`. */
-interface Contribution {
-    readonly kind: Exclude<IdKind, 'extension' | 'origin' | 'result'>;
-    readonly id: string;
-    readonly version: string;
-    /** If set, this contribution replaces an existing base contribution. */
-    readonly replaces?: {
-        readonly targetId: string;
-        readonly targetRange: string;
-        readonly priority?: number;
-    };
-    /** Policy this contribution exposes to would-be replacers (default `none`). */
-    readonly replaceable?: ReplacementPolicy;
-    readonly payload?: unknown;
-}
+/** Digest one part: its paragraphs, and the structure that holds them. */
+declare function digestPart(part: OoxmlPart): StoryDigest | null;
+/** Digest every part, in the given order. */
+declare function semanticDigest(parts: Iterable<OoxmlPart>): SemanticDigest;
 /**
- * A unit of engine functionality: its identity, version, dependencies, conflicts, required ports,
- * and contributions.
+ * Every way two digests differ, as readable paths.
  *
- * The registry's whole input. Everything a bundle needs and everything it offers is DECLARED, so
- * resolution can be deterministic and order-independent.
+ * Returns the differences rather than a boolean because "the round trip lost something" is
+ * useless without saying what — the failure this oracle exists to catch is a silent drop,
+ * and a bare `false` reproduces the silence.
  */
-interface FeatureBundle {
-    readonly id: string;
-    readonly version: string;
-    readonly dependencies?: readonly string[];
-    readonly conflicts?: readonly string[];
-    readonly requiredPorts?: readonly string[];
-    readonly contributions: readonly Contribution[];
-}
-/** The resolved result: every contribution selected, indexed by `(kind, id)`. */
-interface ResolvedRegistry {
-    readonly extensions: ReadonlyMap<string, FeatureBundle>;
-    readonly contributions: ReadonlyMap<string, Contribution>;
-    get(kind: Contribution['kind'], id: string): Contribution | undefined;
-}
-/** How resolution treats optional bundles and replacement policies. */
-interface ResolveOptions {
-    /** Runtime port ids available in this environment (design D9 / task 0.3). */
-    readonly availablePorts?: readonly string[];
-}
+declare function diffSemanticDigests(before: SemanticDigest, after: SemanticDigest): DigestDifference[];
+
+/** Valid per MS-DOCX: 8 hex digits, non-zero, below 0x80000000. */
+declare function isValidParaId(value: string): boolean;
+/** The authored `w14:paraId` value of an element, verbatim, or null. */
+declare function paraIdOf(node: OoxmlNode): string | null;
+/** FNV-1a over UTF-16 code units — the deterministic mint every id derivation shares. */
+declare function fnv1a32(value: string): number;
+/**
+ * Deterministic 8-hex mint in (0x00000000, 0x80000000), collision-free against
+ * `used` (uppercase hex). Same seed + same used-set → same value, which is what
+ * keeps `splitParagraphMany` byte-identical to its equivalent single splits and
+ * a reopened save identical to the session that produced it.
+ */
+declare function mintParaId(seed: string, used: ReadonlySet<string>): string;
+/** Every valid `w14:paraId` in the tree, uppercased. Memoized per root object. */
+declare function usedParaIds(root: OoxmlElement): ReadonlySet<string>;
 /**
- * Resolve a set of bundles into one registry, or throw.
- *
- * Deterministic and registration-order independent: selection is by `(kind, id)` plus version,
- * and ties break only on declared policy. Array order never decides anything.
+ * The non-empty prefix the part ROOT binds to the w14 namespace, or null.
  *
- * @throws RegistryError naming every bundle responsible for the failure.
+ * Minted attributes require an in-scope binding (the invariant validator reports
+ * `invalid-qname` otherwise, and the serializer would allocate an `nsN` alias).
+ * Only the root binding counts: a binding authored on some descendant does not
+ * cover paragraphs elsewhere in the tree.
  */
-declare function resolve(bundles: readonly FeatureBundle[], options?: ResolveOptions): ResolvedRegistry;
-
+declare function w14RootPrefix(root: OoxmlElement): string | null;
+/** The minted `[w14:paraId, w14:textId]` pair. `textId` mirrors `paraId`: it has no uniqueness requirement, no consumer reads it, and one allocator is simpler than two — but Word writes both, so we write both. */
+declare function mintedParagraphIdentityAttributes(prefix: string, value: string): readonly OoxmlAttribute[];
 /**
- * Typed-origin domains (design D5 / ADR-S5). `mutation.*` are the canonical
- * write origins; `projection` and `awareness` MUST NOT enter history, audit,
- * snapshots, or replication.
+ * Load-time paragraph-identity normalization for a session's main part.
+ *
+ * Keeps every valid, first-seen paraId verbatim; mints (deterministically, seeded
+ * by the paragraph's structural node id) for paragraphs whose id is missing,
+ * malformed, zero, out of range, or a duplicate. Adds the root `xmlns` binding
+ * the minted attributes need. Returns the INPUT PART REFERENCE when there is
+ * nothing to do — a document Word saved yesterday re-serializes byte-identical.
+ *
+ * Attribute-only rebuilds move no child, so every node keeps its structural-path
+ * id; the copy respreads only the ancestors of changed paragraphs.
+ *
+ * Fail-open: if the rebuilt part does not validate (a bug, or a pathology the
+ * prefix choice could not defuse), the original part is returned — a document
+ * must never become unopenable over an identity enhancement.
  */
-declare const ORIGIN_IDS: {
-    readonly mutationHuman: "dev.docx-editor.core.origin.mutation.human";
-    readonly mutationAgent: "dev.docx-editor.core.origin.mutation.agent";
-    readonly mutationRemote: "dev.docx-editor.core.origin.mutation.remote";
-    readonly mutationUndo: "dev.docx-editor.core.origin.mutation.undo";
-    readonly mutationRedo: "dev.docx-editor.core.origin.mutation.redo";
-    readonly mutationMigration: "dev.docx-editor.core.origin.mutation.migration";
-    readonly mutationRepair: "dev.docx-editor.core.origin.mutation.repair";
-    readonly mutationServer: "dev.docx-editor.core.origin.mutation.server";
-    readonly projection: "dev.docx-editor.core.origin.projection";
-    readonly awareness: "dev.docx-editor.core.origin.awareness";
-};
-/** Canonical writes carry a mutation origin; these are the undoable-eligibility inputs. */
-declare const CANONICAL_MUTATION_ORIGINS: readonly string[];
-/** Origins that never enter authored state / history / audit / snapshot / replication. */
-declare const NON_CANONICAL_ORIGINS: readonly string[];
+declare function normalizeParagraphIdentity(part: OoxmlPart): OoxmlPart;
+
+/** A text position: a paragraph's node id and a UTF-16 offset in its text. */
+interface BookmarkPosition {
+    readonly paragraphId: string;
+    readonly offset: number;
+}
+/** One bookmark, both ends resolved. */
+interface BookmarkRecord {
+    /** The name as the document writes it. */
+    readonly name: string;
+    /** Names starting with an underscore are hidden. */
+    readonly hidden: boolean;
+    /** The marker pair's `@w:id`. */
+    readonly markerId: string;
+    readonly start: BookmarkPosition;
+    readonly end: BookmarkPosition;
+    /** Node ids of the two markers. */
+    readonly startNodeId: string;
+    readonly endNodeId: string;
+    /**
+     * How many marker pairs in the part carry this name, compared without case: 1, or more
+     * where concurrent edits left copies. The record is the first; the rest are not listed.
+     */
+    readonly copies: number;
+}
+/** List each name once, using its first marker pair in document order. @public */
+declare function listBookmarks(part: OoxmlPart): readonly BookmarkRecord[];
+
+/** One `w:docPart` of the glossary, with the blocks its body holds. */
+interface BuildingBlock {
+    /** `w:docPartPr/w:name`, the identity a control's placeholder and a pick refer to. */
+    readonly name: string;
+    /** `w:category/w:gallery`, an `ST_DocPartGallery` value such as `docParts`. */
+    readonly gallery: string;
+    /** `w:category/w:name`; `General` when the block declares none. */
+    readonly category: string;
+    /** The `w:docPartBody` children: paragraphs, tables and block controls, in order. */
+    readonly blocks: readonly OoxmlNode[];
+}
+/** The gallery and category a `w:docPartList` control lists. */
+interface BuildingBlockGalleryFilter {
+    readonly gallery: string;
+    readonly category: string | null;
+}
+/** The glossary part, through the main part's relationship or the conventional name. */
+declare function glossaryPartOf(pkg: OoxmlPackage): OoxmlPart | null;
+/** Every named building block of the glossary, in authored order. Empty without a glossary. */
+declare function buildingBlocksOf(pkg: OoxmlPackage): readonly BuildingBlock[];
+/** The gallery a `w:docPartList` control lists, or null for any other control. */
+declare function buildingBlockGalleryOf(control: OoxmlNode): BuildingBlockGalleryFilter | null;
 /**
- * Result taxonomy (design D8 / task 7.8). A transport/protocol failure that
- * prevents a valid envelope is a typed exception, not a member here.
+ * The blocks a gallery control offers: same gallery, and the control's category when it names
+ * one. Sorted by category, then name, as Word groups its list.
  */
-declare const RESULT_IDS: {
-    readonly applied: "dev.docx-editor.core.result.applied";
-    readonly validation: "dev.docx-editor.core.result.validation";
-    readonly conflict: "dev.docx-editor.core.result.conflict";
-    readonly resource: "dev.docx-editor.core.result.resource";
-    readonly authorization: "dev.docx-editor.core.result.authorization";
-    readonly aborted: "dev.docx-editor.core.result.aborted";
-};
-/** Runtime ports (extensions-and-runtime-ports spec; design D9). */
-declare const RUNTIME_PORT_IDS: {
-    readonly fonts: "dev.docx-editor.core.port.fonts";
-    readonly shaping: "dev.docx-editor.core.port.shaping";
-    readonly images: "dev.docx-editor.core.port.images";
-    readonly clock: "dev.docx-editor.core.port.clock";
-    readonly identity: "dev.docx-editor.core.port.identity";
-    readonly persistence: "dev.docx-editor.core.port.persistence";
-    readonly transport: "dev.docx-editor.core.port.transport";
-    readonly scheduling: "dev.docx-editor.core.port.scheduling";
-    readonly audit: "dev.docx-editor.core.port.audit";
-    readonly authorization: "dev.docx-editor.core.port.authorization";
-    readonly resourceAccounting: "dev.docx-editor.core.port.resource-accounting";
-    readonly cancellation: "dev.docx-editor.core.port.cancellation";
-    readonly externalResourceConsent: "dev.docx-editor.core.port.external-resource-consent";
-};
-/** Layout dependency keys (design D6 / task 8.2). */
-declare const DEPENDENCY_KEY_IDS: {
-    readonly style: "dev.docx-editor.core.dep.style";
-    readonly numbering: "dev.docx-editor.core.dep.numbering";
-    readonly section: "dev.docx-editor.core.dep.section";
-    readonly story: "dev.docx-editor.core.dep.story";
-    readonly font: "dev.docx-editor.core.dep.font";
-    readonly image: "dev.docx-editor.core.dep.image";
-    readonly table: "dev.docx-editor.core.dep.table";
-    readonly field: "dev.docx-editor.core.dep.field";
-    readonly note: "dev.docx-editor.core.dep.note";
-    readonly headerFooter: "dev.docx-editor.core.dep.header-footer";
-    readonly annotation: "dev.docx-editor.core.dep.annotation";
-};
-/** Every frozen id as a flat list, for the immutability / uniqueness gate. */
-declare const ALL_FROZEN_IDS: readonly string[];
+declare function buildingBlocksForControl(pkg: OoxmlPackage, control: OoxmlNode): readonly BuildingBlock[];
 
 /**
- * A counter's limit was reached. Carries the label, the limit, and what was attempted.
+ * The comments part this story names, when it exists and really is one.
  *
- * Thrown at the N → N+1 boundary, so the increment that would have crossed the limit never
- * happens rather than being detected afterwards.
+ * Conventional `/word/comments.xml` is used only when no usable relationship exists AND the
+ * part's content type is the comments type. A present wrong-typed part is not a comments part.
  */
-declare class LimitExceededError extends Error {
-    readonly label: string;
-    readonly limit: number;
-    readonly attempted: number;
-    constructor(label: string, limit: number, attempted: number);
-}
+declare function commentsPartNameForStory(pkg: OoxmlPackage, storyPartName: string): string | null;
+
 /**
- * Overflow-safe counting against a fixed limit.
+ * Which story a comment deletion or resolution may read markers from.
  *
- * Never silently wraps: it rejects the increment that would cross its limit AND any arithmetic
- * that would exceed `Number.MAX_SAFE_INTEGER`. That second guard is the point — a file-supplied
- * count must never be trusted into an allocation, and a wrapped counter reads as small.
+ * `w:id` is not unique across stories: a header and the body can both hold comment 1.
  */
-declare class BoundedCounter {
-    readonly label: string;
-    readonly limit: number;
-    private value;
-    constructor(label: string, limit: number);
-    get current(): number;
-    /** Remaining headroom before the limit. */
-    get remaining(): number;
+interface CommentDeletionOwner {
+    /** Canonical name of the part holding the story's markers. */
+    readonly storyPartName: string;
     /**
-     * Add `n` (default 1). Throws LimitExceededError if the result would exceed the
-     * limit (so `limit` itself is reachable but `limit + 1` is not) or overflow the
-     * safe-integer range. On rejection the counter is unchanged.
+     * When the story is one note inside a shared notes part, that note's `w:id`.
+     * Absent means the whole part is the story (body, header, footer).
      */
-    add(n?: number): number;
-    /** Whether adding `n` would be accepted, without mutating. */
-    canAdd(n?: number): boolean;
-    release(n: number): void;
+    readonly noteId?: number;
 }
 
-/** A budget was misused: over-carved, over-reserved, or disposed with children outstanding. */
-declare class BudgetError extends Error {
-    constructor(message: string);
-}
 /**
- * Capacity claimed BEFORE it is allocated.
+ * Delete a comment thread: that story's markers, and metadata no other story still names.
  *
- * Reserve-then-allocate rather than allocate-then-check: discovering the overrun after the
- * allocation has already happened defeats the point of having a budget.
+ * `owner` names the story whose markers may be stripped. Omitted, it is the main document
+ * body — never every XML part. A header or note that reused the same `w:id` is a different
+ * remark; pass its part (and `noteId` when the story is one note) to delete that one.
+ *
+ * Returns the package unchanged when the id names no comment, and null when a removal was
+ * refused — a caller inside a transaction rolls back rather than committing a package whose
+ * comment is half gone.
  */
-interface Reservation {
-    readonly amount: number;
-    readonly released: boolean;
-    release(): void;
-}
+declare function deleteCommentThread(pkg: OoxmlPackage, commentId: string, owner?: CommentDeletionOwner): OoxmlPackage | null;
 /**
- * One node in the hierarchical resource budget tree.
+ * Delete every comment the edit between `before` and `after` emptied in `owner`'s story.
  *
- * An operation owns a root budget; parsers, extensions, workers, layout, transport and output
- * carve children from it, so no subsystem can consume more than the operation as a whole allows.
+ * `owner` omitted is the main document body, matching {@link deleteCommentThread}.
  *
- * `dispose()` REFUSES while children or reservations are outstanding, then runs registered
- * cleanups LIFO — spill files, worker termination — even if one throws. A leaked child budget is a
- * leaked worker, so the refusal is the diagnostic.
+ * THE TEST, exactly, and per story. A comment dies when the words it covered in that story are
+ * gone and nothing in that story still places it. A neighbour that reused the same `w:id` is
+ * judged under its own owner. Notes that vanished (reference cascade) are reaped as their own
+ * stories so a unique id still loses its `comments.xml` body. Remaining-marker overflow
+ * preserves comments/commentEx/commentId metadata rather than deleting records the scan could
+ * not prove unused. Null is reserved for a removal that actually failed.
  */
-declare class Budget {
-    readonly label: string;
-    readonly capacity: number;
-    private readonly used;
-    private readonly children;
-    private activeReservations;
-    private readonly cleanups;
-    private disposed;
-    private carveAmount;
-    private parent?;
-    constructor(label: string, capacity: number);
-    get inUse(): number;
-    get available(): number;
-    get isDisposed(): boolean;
-    /** Reserve `amount` from this budget. Throws if it would exceed capacity. */
-    reserve(amount: number): Reservation;
-    /** Carve a child budget of `capacity` out of this budget's headroom. */
-    child(label: string, capacity: number): Budget;
-    /** Register cleanup for a spill file, worker, or queue tied to this budget. */
-    onRelease(cleanup: () => void): void;
+declare function cascadeEmptiedComments(before: OoxmlPackage, after: OoxmlPackage, owner?: CommentDeletionOwner): OoxmlPackage | null;
+
+/** Presentation settings the document itself states. Absence is the answer, never an error. */
+interface DocumentViewSettings {
     /**
-     * Release this budget. Refuses while any child budget or reservation is
-     * outstanding (children must finish first). Runs cleanups LIFO, returns the
-     * carve-out to the parent, and marks disposed. Cleanup errors are collected and
-     * rethrown after every cleanup has run.
+     * `w:doNotShadeFormData` (§17.15.1.49) — do NOT shade legacy form fields.
+     *
+     * Word draws a grey block behind every `w:ffData` field so a reader can find the blanks in a
+     * form. It is on by DEFAULT, and this element is how a document turns it off, so the absent
+     * case means shading. Reading the name as "shade form data" inverts it and blanks the shading
+     * on exactly the documents that asked for it loudest.
+     *
+     * Never printed, by Word or by us: it marks where to type, and a printed form has no blanks
+     * to find.
      */
-    dispose(): void;
-    private assertLive;
+    readonly doNotShadeFormData: boolean;
 }
+/** The defaults a document with no `settings.xml` gets: everything Word would shade, shaded. */
+declare const DEFAULT_VIEW_SETTINGS: DocumentViewSettings;
+/** Read the view settings from a `settings.xml` root, or the defaults when it has none. */
+declare function readViewSettings(settingsRoot: OoxmlNode | null | undefined): DocumentViewSettings;
 
+/** How deep transparent block wrappers may nest before the walk stops descending. */
+declare const MAX_STORY_SDT_NESTING = 32;
+/** Which kind of story a root is. Layout walks all four the same way. */
+type OoxmlStoryKind = 'body' | 'header' | 'footer' | 'note';
+/** One story root and the blocks under it, with transparent block wrappers already flattened. */
+interface OoxmlStoryRoot {
+    readonly kind: OoxmlStoryKind;
+    /** The `w:body` / `w:hdr` / `w:ftr` / `w:footnote` element that holds the blocks. */
+    readonly root: OoxmlNode;
+}
 /**
- * Which side of the point of no return an operation is on.
+ * Every story root in a part, in document order.
  *
- * Canonical publication is that point. Cancelling BEFORE it rolls the whole operation back;
- * cancelling after it leaves the commit standing and cancels only derived work — layout, export,
- * caches.
+ * Does not descend INTO a story: a story's blocks are the walk below, and a story root never
+ * contains another story root.
  */
-type CancellationPhase = 'pre-publication' | 'post-publication';
-/** Thrown from a `checkpoint()` when the operation has been cancelled. */
-declare class CancellationError extends Error {
-    /** True when the commit is already published and only derived work is cancelled. */
-    readonly derivedOnly: boolean;
-    constructor(
-    /** True when the commit is already published and only derived work is cancelled. */
-    derivedOnly: boolean, reason?: string);
-}
+declare function storyRootsOf(part: OoxmlPart): readonly OoxmlStoryRoot[];
 /**
- * The read side of cancellation, handed to cooperative work.
+ * Whether a part is SHAPED to hold stories — a body, a header, a footer, or a notes part.
  *
- * Cooperative rather than pre-emptive: long work calls `checkpoint()` at declared intervals, which
- * is what lets an operation unwind promptly without the engine having to interrupt it mid-mutation.
+ * A shape test, deliberately not `storyRootsOf(part).length > 0`. That counts EDITABLE stories,
+ * and a notes part holding nothing but `w:separator` and `w:continuationSeparator` has none —
+ * which is the footnotes part Word writes into every document that ever held a footnote. A
+ * caller asking "should I walk this part at all" that used the editable count skipped it
+ * entirely, and the two callers that ask are a payload sweep and an export strip: both DELETE
+ * what they conclude nothing names.
  */
-interface CancellationToken {
-    readonly isCancelled: boolean;
-    readonly phase: CancellationPhase;
-    /** True only when cancelled AND the commit is already published. */
-    readonly derivedOnly: boolean;
-    /** Throws CancellationError if cancelled; call at declared checkpoint intervals. */
-    checkpoint(): void;
-}
+declare function isStoryPart(part: OoxmlPart): boolean;
+/** The main body story of a part, or null when the part holds none. */
+declare function bodyStoryRoot(part: OoxmlPart): OoxmlNode | null;
 /**
- * The write side of cancellation, and the owner of the phase.
+ * Every paragraph of one story, in reading order.
  *
- * Whoever starts an operation holds this; everything it calls gets only the token.
+ * Descends through tables (rows, cells, nested tables), block controls and block custom XML.
+ * The returned nodes are paragraph elements; a caller addresses them by `id`.
  */
-declare class CancellationController {
-    private _cancelled;
-    private _phase;
-    private _reason?;
-    cancel(reason?: string): void;
-    /** Mark canonical publication — the point of no return. */
-    markPublished(): void;
-    get isCancelled(): boolean;
-    get phase(): CancellationPhase;
-    get isPublished(): boolean;
-    /** Cancelled after publication -> full rollback is no longer possible. */
-    get derivedOnly(): boolean;
-    get token(): CancellationToken;
-}
+declare function storyParagraphs(root: OoxmlNode): readonly OoxmlNode[];
+/**
+ * The block walk itself, appending into `out`.
+ *
+ * Exported so `allParagraphs` in the binding lane is the same traversal rather than a second
+ * copy of it.
+ */
+declare function collectStoryParagraphs(children: readonly OoxmlNode[], out: OoxmlNode[], sdtDepth: number): void;
 
-/** Injectable time source — the engine never calls Date.now directly (determinism). */
-interface ClockPort {
-    now(): number;
-}
-/** Stable id minting for sessions, commits, and allocator seeds. */
-interface IdentityPort {
-    newId(): string;
-}
-/** Cooperative scheduling of deferred work. */
-interface SchedulingPort {
-    schedule(task: () => void): void;
-}
-/** Redacted observability sink (raw text never enters here — design D5). */
-interface AuditPort {
-    record(entry: {
-        readonly kind: string;
-        readonly at: number;
-        readonly meta?: Record<string, unknown>;
-    }): void;
-}
-/** Read/write/export authorization decisions. */
-interface AuthorizationPort {
-    authorize(action: string, subject?: string): boolean;
-}
-/** Explicit consent gate for any remote/external resource (no zero-click fetch). */
-interface ExternalResourceConsentPort {
-    requestConsent(target: string): boolean;
-}
-/** Cancellation source for the current operation. */
-interface CancellationPort {
-    readonly token: CancellationToken;
-}
-/** Where documents are stored and retrieved. Opaque marker until its milestone. */
-interface PersistencePort {
-    readonly kind: 'persistence';
-}
-/** How the engine talks to a remote peer. Opaque marker until its milestone. */
-interface TransportPort {
-    readonly kind: 'transport';
-}
-/** Where font bytes come from. Opaque marker until its milestone. */
-interface FontPort {
-    readonly kind: 'font';
-}
-/** Which shaping backend measures text. Opaque marker until its milestone. */
-interface ShapingPort {
-    readonly kind: 'shaping';
-}
-/** How image bytes are decoded. Opaque marker until its milestone. */
-interface ImagePort {
-    readonly kind: 'image';
-}
-/** Where resource consumption is reported. Opaque marker until its milestone. */
-interface ResourceAccountingPort {
-    readonly kind: 'resource-accounting';
+/** One searchable text-box story and the drawing location that can reveal it. */
+interface TextboxStoryRoot {
+    /** The `w:txbxContent` story root. */
+    readonly root: OoxmlElement;
+    /** Layout atom id used to select the drawing, including an MC wrapper when present. */
+    readonly drawingNodeId: string;
+    /** Canonical node id of the paragraph that anchors the drawing. */
+    readonly hostParagraphId: string;
 }
 /**
- * A required port the runtime did not provide.
+ * List the text-box stories in one part, in document order.
  *
- * Thrown rather than falling back: silently reaching for a browser global when a worker or server
- * adapter did not supply a port is exactly the coupling ports exist to prevent.
+ * The bounded walk stops at drawings. It does not project pictures, shape geometry, or story
+ * content. Results are memoized by immutable part-root identity.
  */
-declare class PortResolutionError extends Error {
-    readonly portId: string;
-    constructor(portId: string);
+declare function textboxStoriesInPart(part: OoxmlPart): readonly TextboxStoryRoot[];
+
+/** Relationship from the story to one data part. */
+declare const CUSTOM_XML_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
+/** Relationship from a data part to the properties that carry its `ds:itemID`. */
+declare const CUSTOM_XML_PROPS_REL = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXmlProps";
+/** `itemPropsN.xml` needs an Override; `itemN.xml` rides the package's `xml` default. */
+declare const CUSTOM_XML_PROPS_TYPE = "application/vnd.openxmlformats-officedocument.customXmlProperties+xml";
+/** The datastore namespace `ds:datastoreItem` lives in. */
+declare const DATASTORE_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/customXml";
+/** A data part located in a package: where it lives, and the GUID an SDT binds to. */
+interface CustomXmlDataPart {
+    /** Canonical part name, e.g. `/customXml/item1.xml`. */
+    readonly partName: string;
+    /** Part name of its properties, e.g. `/customXml/itemProps1.xml`. */
+    readonly propsPartName: string;
+    /** `ds:itemID`, braced and upper-case, as `w:storeItemID` must spell it. */
+    readonly itemId: string;
+    /** Namespace URI of the payload root, which is what identifies one store among several. */
+    readonly namespaceUri: string;
 }
 /**
- * The environment-dependent services an engine instance may reach.
+ * A `ds:itemID` derived from the seed rather than drawn at random.
  *
- * Everything outside pure computation — the clock, identity minting, scheduling, fonts, images —
- * is reached only through here, which is what lets browser, worker and server adapters supply
- * only what their runtime actually offers.
+ * Exported so a caller that authors a store OUTSIDE a package — a template engine splicing
+ * markup it will assemble into a `.docx` later — mints the id the same way this does, rather
+ * than inventing a second GUID shape Word has to be tolerant of.
+ *
+ * The store is a pure function of what it is asked to write: the same document written twice
+ * has to produce the same bytes, or a save/reopen/save round trip stops being a fixed point
+ * and every digest taken over saved bytes moves. A GUID's job here is uniqueness within one
+ * package, not unguessability, so four FNV-1a passes over a salted seed carry it.
  */
-declare class PortRegistry {
-    private readonly ports;
-    provide(portId: string, port: unknown): this;
-    has(portId: string): boolean;
-    /** Resolve a port by id or throw. */
-    resolve<T>(portId: string): T;
-    /** Assert every id in `portIds` is present; returns the missing ones (empty if all present). */
-    missing(portIds: readonly string[]): string[];
-    /** The provided port ids (for bridging to registry.resolve availablePorts). */
-    availablePorts(): string[];
-    clock(): ClockPort;
-    identity(): IdentityPort;
-}
-/** Deterministic clock: starts at `start` and advances by `step` each call. */
-declare class DeterministicClock implements ClockPort {
-    private readonly step;
-    private t;
-    constructor(start?: number, step?: number);
-    now(): number;
-}
-/** Sequential identity for tests and deterministic fixtures. */
-declare class SequentialIdentity implements IdentityPort {
-    private readonly prefix;
-    private n;
-    constructor(prefix?: string);
-    newId(): string;
+declare function datastoreItemIdFor(seed: string): string;
+/**
+ * The data parts a story relates to, in relationship order.
+ *
+ * Reads the relationships rather than scanning `/customXml/` by name: a part nothing relates
+ * to is not part of the document, and a package from a hostile sender can hold as many
+ * plausibly-named files as it likes.
+ */
+declare function customXmlDataParts(pkg: OoxmlPackage, storyPartName: string): CustomXmlDataPart[];
+/** The data part carrying this namespace, or null when the document has none yet. */
+declare function findCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): CustomXmlDataPart | null;
+/** What {@link withCustomXmlDataPart} answers. */
+interface CustomXmlDataPartResult {
+    readonly pkg: OoxmlPackage;
+    /** Null when the part could not be authored; the package then comes back unchanged. */
+    readonly part: CustomXmlDataPart | null;
 }
+/**
+ * Ensure the document carries a data part for this namespace, creating it and everything it
+ * needs — properties, both relationships, the properties content type — when it does not.
+ *
+ * Idempotent: a package that already has one for the namespace comes back untouched, so a
+ * second node added to the same store does not author a second store.
+ *
+ * @param storyPartName - Whose relationships the store hangs off. Word enumerates its data
+ * store from the MAIN DOCUMENT part, so a store authored off a header or footer is one Word
+ * never sees.
+ */
+declare function withCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string, rootLocalName: string): CustomXmlDataPartResult;
+/**
+ * Remove a store from a document: both parts, both relationships, the Override.
+ *
+ * PACKAGE ONLY. It does not touch the body, so a `w:sdt` bound to the store keeps its
+ * `w:dataBinding`, its `w:storeItemID` and its `w:tag`, and Word then opens a control bound to
+ * a store that is not there. Stripping those is the export path's job and is not built; this
+ * is the half that removes the payload, which is the half a caller can rely on.
+ *
+ * `ok: false` means nothing was removed and the package is unchanged — most often because an
+ * owner's `.rels` was never parsed into a tree, which {@link withoutPart} refuses to work
+ * around. A caller exporting a document has to treat that as a failure to export rather than
+ * as a document with nothing to strip, or it ships the payload it meant to remove.
+ */
+declare function withoutCustomXmlDataPart(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): WithoutPartResult;
 
-/** What one operation is started with. Only `ports` is required. */
-interface OperationInit {
-    readonly ports: PortRegistry;
-    readonly limits?: Partial<ResourceLimits>;
-    readonly config?: Readonly<Record<string, unknown>>;
-    /** Root budget capacity in abstract units (default: the byte decompression limit). */
-    readonly capacity?: number;
-    /** Operation identity (from IdentityPort in production); defaulted for tests. */
-    readonly id?: string;
+/** One node in a store: its id, the bound text, and the payload beside it. */
+interface CustomXmlNode {
+    readonly id: string;
+    /** Text a `w:dataBinding` resolves to. Untrusted file input. */
+    readonly label: string;
+    /** Payload as authored, JSON by convention and unparsed here. Untrusted file input. */
+    readonly data: string;
 }
+/** Every node a store holds, in document order. */
+declare function customXmlNodes(pkg: OoxmlPackage, partName: string): CustomXmlNode[];
+/** One node by id, or null. */
+declare function readCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): CustomXmlNode | null;
 /**
- * The frozen environment of one operation: its limits, config, ports, root budget and
- * cancellation controller.
+ * Write a node, replacing one that already has the id.
  *
- * IMMUTABLE for the operation's lifetime, which is what lets cache reuse and replica agreement
- * key on it. A new operation always gets a fresh snapshot rather than observing a mutated one.
+ * Replace rather than append: a second node with the same id makes the binding xpath ambiguous,
+ * and Word resolves an ambiguous xpath to the first match — so an "update" that appended would
+ * leave the control showing its old text forever.
  */
-interface OperationContext {
-    readonly id: string;
-    readonly limits: ResourceLimits;
-    readonly config: Readonly<Record<string, unknown>>;
-    readonly ports: PortRegistry;
-    readonly budget: Budget;
-    readonly cancellation: CancellationController;
-}
+declare function withCustomXmlNode(pkg: OoxmlPackage, partName: string, node: CustomXmlNode): OoxmlPackage;
+/** Drop one node by id. A store that never held it comes back unchanged. */
+declare function withoutCustomXmlNode(pkg: OoxmlPackage, partName: string, nodeId: string): OoxmlPackage;
 /**
- * Begin an operation, capturing its immutable environment snapshot.
+ * Drop every node no longer referenced, given the ids the document still binds.
  *
- * Resolves and freezes limits and configuration, carves the root budget, and creates the
- * cancellation controller — everything downstream work needs, fixed for the operation's duration.
+ * This is the whole deletion story. Deleting a control in THIS editor can remove its node
+ * directly, but a control deleted in Word leaves the node behind — Word has no lifecycle link
+ * between the two and no way to run our code. Reconciling against what the story actually binds
+ * collects both, and is the only thing that can collect the second.
+ *
+ * Takes the referenced ids rather than reading the story itself: the caller already walked it,
+ * and a sweep that guessed at which controls exist would delete a payload on a mistake.
  */
-declare function beginOperation(init: OperationInit): OperationContext;
-/** Release the operation's root budget (requires every child/reservation released). */
-declare function endOperation(ctx: OperationContext): void;
-
-/** What a limit counts. Typed so a byte cap and a depth cap cannot be compared by accident. */
-type LimitUnit = 'bytes' | 'count' | 'depth' | 'ratio' | 'passes';
+declare function withoutOrphanCustomXmlNodes(pkg: OoxmlPackage, partName: string, referencedIds: ReadonlySet<string>): {
+    readonly pkg: OoxmlPackage;
+    readonly removed: readonly string[];
+};
 /**
- * Where a limit is enforced.
+ * The `w:xpath` a binding uses to reach a node's label, or null when the id cannot be addressed.
  *
- * Declared per limit so enforcement happens at the boundary that can still refuse cheaply — a zip
- * cap checked during layout has already let the bomb decompress.
+ * Word needs a prefix for the payload namespace even when the store declares it as a default —
+ * an unprefixed step in an XPath means "no namespace", so `/docxEditor/node` would match
+ * nothing in a namespaced store. The prefix is declared in `w:prefixMappings` beside it.
  */
-type EnforcementPhase = 'package-read' | 'xml-parse' | 'layout' | 'output';
-/** One limit's unit and enforcement phase — the metadata that makes limits testable uniformly. */
-interface LimitSpec {
-    readonly unit: LimitUnit;
-    readonly phase: EnforcementPhase;
+declare function customXmlLabelXPath(prefix: string, rootLocalName: string, nodeId: string): string | null;
+/** The `w:prefixMappings` value declaring that prefix, or null when it cannot be written.
+ *  The namespace sits inside single quotes inside a double-quoted attribute, so a namespace
+ *  carrying either quote character has no representation here. */
+declare function customXmlPrefixMappings(prefix: string, namespaceUri: string): string | null;
+
+/** The prefix every binding this library authors declares and quotes. */
+declare const CUSTOM_NODE_XPATH_PREFIX = "ns0";
+/** The three attributes a `w:dataBinding` carries. */
+interface CustomNodeBinding {
+    readonly prefixMappings: string;
+    readonly xpath: string;
+    readonly storeItemId: string;
 }
-/** Unit + enforcement phase for every resource limit. */
-declare const LIMIT_SPECS: Readonly<Record<keyof ResourceLimits, LimitSpec>>;
-/** Every limit name, for iterating the specs and asserting each has a unit and phase. */
-declare const LIMIT_KEYS: (keyof ResourceLimits)[];
-/** A phase-scoped overflow-safe counter for one limit. */
-declare function makeLimitCounter(limits: ResourceLimits, key: keyof ResourceLimits): BoundedCounter;
 /**
- * Deterministic memory substitute. Tracks current and peak "allocated" units
- * against a hard byte ceiling; `allocate` fails closed (LimitExceededError) past
- * the limit. Used in place of process RSS so memory-limit tests are reproducible
- * and cancellation/cleanup can be asserted without a real allocator.
+ * The binding for one node in one store, or null when the id cannot be addressed by an XPath.
+ *
+ * Refuses rather than escapes: XPath 1.0 has no escape for a quote inside a literal, so an id
+ * carrying one could close the predicate and append an expression of the sender's choosing.
+ * The ids are minted by a host, so refusing is honest — see `ADDRESSABLE_ID`.
  */
-declare class DeterministicMemoryMeter {
-    private readonly counter;
-    private current;
-    private peak;
-    constructor(limitBytes: number);
-    allocate(bytes: number): void;
-    free(bytes: number): void;
-    get currentBytes(): number;
-    get peakBytes(): number;
-    /** Release everything (cancellation/cleanup path). */
-    reset(): void;
-}
-/** Assert the finite-default / hard-ceiling invariant holds for every limit. */
-declare function assertLimitInvariants(): void;
-
-/** Any JSON value. The domain canonicalization and stable hashing operate over. */
-type Json = null | boolean | number | string | Json[] | {
-    [k: string]: Json;
-};
+declare function customNodeBinding(part: CustomXmlDataPart, rootLocalName: string, nodeId: string): CustomNodeBinding | null;
 /**
- * Produce a canonical string for `value`, dropping any object key whose name is
- * in `ephemera` at any depth. Numbers are emitted losslessly; -0 normalizes to 0;
- * non-finite numbers are rejected (they must never enter a comparator input).
+ * Every node id the story's controls bind to in one store, in document order.
+ *
+ * This is the input the orphan sweep takes: a node whose id is not in here is one no control
+ * names, whether it was deleted in this editor or in Word. Reading it from the STORY rather than
+ * from a host's bookkeeping is what makes the two cases one mechanism.
  */
-declare function canonicalize(value: unknown, ephemera?: ReadonlySet<string>): string;
-/** 64-bit FNV-1a over the canonical form, returned as a 16-char hex string. */
-declare function stableHash(value: unknown, ephemera?: ReadonlySet<string>): string;
-
+declare function boundCustomXmlNodeIds(part: OoxmlPart, storeItemId: string): Set<string>;
 /**
- * How one artifact class is compared.
+ * Every node id ANY story in the package binds, in one store.
  *
- * Frozen per artifact: nothing here invents a tolerance for an artifact the spec requires to
- * match exactly.
+ * THE WHOLE PACKAGE, not one story. A payload is reachable from a header as easily as from the
+ * body — Word enumerates its data store from the main part, but nothing stops a control
+ * elsewhere quoting the same `w:storeItemID` — and the two callers that decide what is an orphan
+ * both destroy data when they are wrong. The sweep would collect a payload a header still paints;
+ * the export would strip a store a header still names, which is a document Word offers to repair.
+ *
+ * Costs one walk per story per store, on open and on export. Neither is a keystroke.
  */
-type ComparatorMode = 'canonical-exact' | 'exact' | 'tolerance' | 'sync-optimization-only';
-/** One artifact class's comparison mode and its declared ephemera — fields excluded from equality. */
-interface ComparatorDescriptor {
-    readonly id: string;
-    readonly mode: ComparatorMode;
-    /** Object keys excluded from canonical-exact comparison (declared ephemera). */
-    readonly ephemera: readonly string[];
-    readonly note: string;
+declare function boundCustomXmlNodeIdsInPackage(pkg: OoxmlPackage, storeItemId: string): Set<string>;
+/** The node id one control binds to in the named store, or null when it binds to nothing there. */
+declare function boundCustomXmlNodeIdOf(control: OoxmlNode, storeItemId: string): string | null;
+
+/** What happens to one control when the document is exported. */
+type CustomNodeExportPolicy = 'keep' | 'text' | 'remove';
+/** How {@link withExportedCustomNodes} decides, and which stores it may tidy afterwards. */
+interface CustomNodeExportRequest {
+    /** The story whose controls are policed, and whose relationships the stores hang off. */
+    readonly storyPartName: string;
+    /**
+     * Payload namespaces the caller CLAIMS.
+     *
+     * The store cleanup runs only over these. Word's own Cover Page Properties store rides in most
+     * templates, and an export that tidied every customXml part would be deleting from documents it
+     * was only asked to strip its own markup from.
+     */
+    readonly namespaces: readonly string[];
+    /** The fate of a control carrying this `w:tag`. A control with no tag is never touched. */
+    readonly decide: (tag: string) => CustomNodeExportPolicy;
 }
-/** The frozen artifact comparator set. */
-declare const COMPARATORS: {
-    readonly authoredState: {
-        readonly id: "dev.docx-editor.core.comparator.authored-state";
-        readonly mode: 'canonical-exact';
-        readonly ephemera: readonly ["revision", "provenance", "producedAt", "commitId"];
-        readonly note: 'canonical normalized authored records; ephemera excluded';
-    };
-    readonly anchor: {
-        readonly id: "dev.docx-editor.core.comparator.anchor";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'internal anchor identity/affinity compares exactly';
-    };
-    readonly yjsStateVector: {
-        readonly id: "dev.docx-editor.core.comparator.yjs-state-vector";
-        readonly mode: 'sync-optimization-only';
-        readonly ephemera: readonly [];
-        readonly note: 'exchange optimization only; never proves update or delete-set coverage';
-    };
-    readonly shapedRun: {
-        readonly id: "dev.docx-editor.core.comparator.shaped-run";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'glyph ids, clusters, and fixed-point advances compare exactly';
-    };
-    readonly paginationFingerprint: {
-        readonly id: "dev.docx-editor.core.comparator.pagination-fingerprint";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'page/column boundaries, break causes, fixed-point geometry compare exactly';
-    };
-    readonly semanticTree: {
-        readonly id: "dev.docx-editor.core.comparator.semantic-tree";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'reading order, roles, headings, alt text compare exactly';
-    };
-    readonly hitTest: {
-        readonly id: "dev.docx-editor.core.comparator.hit-test";
-        readonly mode: 'exact';
-        readonly ephemera: readonly [];
-        readonly note: 'resolved hit target and cluster affinity compare exactly';
-    };
-    readonly pdfSemantics: {
-        readonly id: "dev.docx-editor.core.comparator.pdf-semantics";
-        readonly mode: 'canonical-exact';
-        readonly ephemera: readonly ["objectNumber", "producer", "creationDate", "modDate", "subsetTag"];
-        readonly note: 'canonical semantic PDF objects; container ephemera excluded';
-    };
-    readonly rasterCheckpoint: {
-        readonly id: "dev.docx-editor.core.comparator.raster-checkpoint";
-        readonly mode: 'tolerance';
-        readonly ephemera: readonly [];
-        readonly note: 'documented unavoidable raster comparison; explicit tolerance only';
-    };
-    readonly benchmarkEvidence: {
-        readonly id: "dev.docx-editor.core.comparator.benchmark-evidence";
-        readonly mode: 'sync-optimization-only';
-        readonly ephemera: readonly [];
-        readonly note: 'diagnostic evidence, not an equivalence basis';
-    };
-};
-/** Which frozen comparator to use. */
-type ComparatorName = keyof typeof COMPARATORS;
-/** Whether two artifacts matched, and where they diverged when they did not. */
-interface ComparisonResult {
-    readonly equal: boolean;
-    /** Canonical forms when unequal (diagnostic). */
-    readonly left?: string;
-    readonly right?: string;
+/**
+ * The export, or the reason there is no export.
+ *
+ * A refusal answers no package on purpose. "Stripping failed, here is the document anyway" is the
+ * one outcome that must not be possible: a caller would ship the markup it asked to remove and
+ * have been told the export succeeded.
+ */
+type CustomNodeExportResult = {
+    readonly ok: true;
+    readonly pkg: OoxmlPackage;
+    /** Controls unwrapped (`text`) and controls removed (`remove`). */
+    readonly unwrapped: number;
+    readonly removed: number;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Apply the policy, then take the payloads and the stores the policy orphaned.
+ *
+ * Order matters and is the reverse of the write's. The BODY goes first, so the sweep that follows
+ * sees the controls that actually survive; the stores go last, once nothing binds them. Doing it
+ * the other way would strip a store while a control still quoted its `w:storeItemID`, which is a
+ * document Word opens and offers to repair.
+ */
+declare function withExportedCustomNodes(pkg: OoxmlPackage, request: CustomNodeExportRequest): CustomNodeExportResult;
+
+/** Named inputs a formula may read besides adjust values and earlier formulas. @internal */
+interface VmlFormulaContext {
+    readonly width: number;
+    readonly height: number;
+    readonly adjust: readonly number[];
 }
+/** The values of `eqns` in order, or null when one cannot be read. @internal */
+declare function vmlFormulaValues(eqns: readonly string[], context: VmlFormulaContext): readonly number[] | null;
+
+/** The VML namespace. @internal */
+declare const VML = "urn:schemas-microsoft-com:vml";
+/** The Office VML extensions namespace (`o:`). @internal */
+declare const OFFICE = "urn:schemas-microsoft-com:office:office";
+/** The Word VML extensions namespace (`w10:`). @internal */
+declare const WORD_VML = "urn:schemas-microsoft-com:office:word";
+/** Whether `node` is the element `ns`:`name`. @internal */
+declare const named: (node: OoxmlNode, ns: string, name: string) => boolean;
+/** The value of attribute `name` in namespace `ns` (none by default). @internal */
+declare const attribute: (node: OoxmlElement, name: string, ns?: string) => string | undefined;
+/** The element children of `node`. @internal */
+declare function children(node: OoxmlElement): OoxmlElement[];
+/** Whether a VML boolean is false (`f`, `false`, `0`). @internal */
+declare const off: (value: string | undefined) => boolean;
+/** A plain decimal number, bounded; NaN when malformed. @internal */
+declare function numeric(value: string | undefined): number;
+/** A VML length in points (`pt`, `in`, `cm`, `mm`, `px`); NaN when malformed. @internal */
+declare function points(value: string | undefined): number;
 /**
- * Compare two artifacts under a named comparator. `canonical-exact` and `exact`
- * compare canonical forms (exact drops no ephemera). `tolerance` requires an
- * epsilon and compares finite numbers structurally. `sync-optimization-only`
- * throws — such artifacts are never an equivalence basis.
+ * VML rotation in degrees (`315`, `-45`, or `fd` sixty-five-thousandths). NaN when malformed.
+ *
+ * @internal
  */
-declare function compareArtifacts(name: ComparatorName, left: unknown, right: unknown, opts?: {
-    epsilon?: number;
-}): ComparisonResult;
-/** Fingerprint an artifact under a named comparator's canonicalization policy. */
-declare function fingerprint(name: ComparatorName, value: unknown): string;
+declare function legacyRotationDegrees(raw: string | undefined): number;
+/** The declarations of a `style` attribute by lower-case name; null when malformed. @internal */
+declare function styleOf(node: OoxmlElement): ReadonlyMap<string, string> | null;
+/** A VML colour as `#rrggbb`, `fallback` when absent; null when malformed. @internal */
+declare function color(value: string | undefined, fallback: string): string | null;
 
-/** Whether a recorded conformance step was expected to commit or be refused. */
-type FixtureOutcome = 'applied' | 'aborted' | 'validation' | 'conflict' | 'resource' | 'authorization';
-/** The change one step produced, summarized to what a fixture can compare across runtimes. */
-interface ModelChangeSummary {
-    readonly fromRevision: number;
-    readonly toRevision: number;
-    readonly origin: string;
-    readonly dirty: readonly string[];
-    readonly dependencyKeys: readonly string[];
+interface GeometryGuide {
+    readonly name: string;
+    readonly op: string;
+    readonly args: readonly string[];
 }
-/** Where anchors sat after a step — how a fixture proves positions survived an edit. */
-interface AnchorSnapshot {
-    readonly anchorId: string;
-    readonly story: string;
-    readonly block: string;
-    readonly affinity: 'before' | 'after';
+
+type GeometryFill = 'norm' | 'none' | 'lighten' | 'lightenLess' | 'darken' | 'darkenLess';
+type GeometryCommand = {
+    readonly op: 'M' | 'L';
+    readonly args: readonly [string, string];
+} | {
+    readonly op: 'A';
+    readonly args: readonly [string, string, string, string];
+} | {
+    readonly op: 'Q';
+    readonly args: readonly [string, string, string, string];
+} | {
+    readonly op: 'C';
+    readonly args: readonly [string, string, string, string, string, string];
+} | {
+    readonly op: 'Z';
+    readonly args: readonly [];
+};
+interface GeometryPath {
+    /** Path coordinate space; 0 means the shape's own EMU space on that axis. */
+    readonly width: number;
+    readonly height: number;
+    readonly fill: GeometryFill;
+    readonly stroke: boolean;
+    readonly commands: readonly GeometryCommand[];
 }
-/** What one step must produce: its outcome, its change summary, and its authored-state hash. */
-interface FixtureExpectation {
-    readonly outcome: FixtureOutcome;
-    /** Present iff outcome === 'applied'; MUST be > baseRevision. */
-    readonly committedRevision?: number;
-    readonly modelChange?: ModelChangeSummary;
-    /** 16-hex authored-state fingerprint (comparator 0.4). */
-    readonly authoredStateHash?: string;
-    readonly outputHash?: string;
-    readonly anchors?: readonly AnchorSnapshot[];
+/** @internal */
+interface GeometryDefinition {
+    readonly avLst: readonly GeometryGuide[];
+    readonly gdLst: readonly GeometryGuide[];
+    /** Text rectangle guide references l/t/r/b; null means the whole shape. */
+    readonly textRect: readonly [string, string, string, string] | null;
+    readonly paths: readonly GeometryPath[];
 }
-/** One recorded operation and what it was expected to do. */
-interface FixtureStep {
-    readonly baseRevision: number;
-    readonly origin: string;
-    /** Opaque DocOp payloads (schema owned by section 4). */
-    readonly ops: readonly unknown[];
-    readonly expect: FixtureExpectation;
+interface GeometryPoint {
+    readonly x: number;
+    readonly y: number;
 }
-/** Opaque encoded backend bytes (snapshot or replication update). */
-interface EncodedEnvelope {
-    readonly kind: 'snapshot' | 'update';
-    readonly protocolVersion: number;
-    readonly schemaVersion: number;
-    readonly documentId: string;
-    readonly byteLength: number;
-    /** Hex-encoded opaque bytes; length MUST equal byteLength. */
-    readonly bytesHex: string;
+interface EvaluatedSubpath {
+    readonly points: readonly GeometryPoint[];
+    readonly closed: boolean;
 }
-/** Which implementation recorded a fixture — local store, Yjs, or a binding. */
-type FixtureSource = {
-    readonly kind: 'create';
-} | {
-    readonly kind: 'docx';
-    readonly sha256: string;
-    readonly bytesRef: string;
-};
+interface EvaluatedPath {
+    readonly subpaths: readonly EvaluatedSubpath[];
+    readonly fill: GeometryFill;
+    readonly stroke: boolean;
+}
+/** @internal */
+interface EvaluatedGeometry {
+    readonly paths: readonly EvaluatedPath[];
+    readonly textRect: Readonly<{
+        left: number;
+        top: number;
+        right: number;
+        bottom: number;
+    }>;
+}
+/** The ECMA-376 preset geometry named by `a:prstGeom/@prst`, or null for an unknown name. @internal */
+declare function presetGeometryDefinition(name: string): GeometryDefinition | null;
 /**
- * The frozen conformance container: revisions, origins, operations, changes, snapshots and
- * hashes.
+ * Evaluate a definition at a shape size. `adjust` replaces avLst values by name, as
+ * `a:prstGeom/a:avLst` does. Null when the flattened geometry would exceed
+ * MAX_GEOMETRY_POINTS; sizes that are negative or not finite read as 0.
  *
- * The CONTAINER is what is frozen — field names, origin membership, revision monotonicity, hash
- * format. The op and change payloads travel opaquely, so their schemas can evolve without
- * invalidating every recorded fixture.
+ * @internal
  */
-interface ConformanceFixture {
-    readonly formatVersion: 1;
-    readonly documentId: string;
-    readonly source: FixtureSource;
-    readonly steps: readonly FixtureStep[];
-    readonly snapshots?: readonly EncodedEnvelope[];
-    readonly updates?: readonly EncodedEnvelope[];
-}
-/** Whether a fixture is well-formed, listing every structural violation. */
-interface ValidationResult {
-    readonly valid: boolean;
-    readonly errors: readonly string[];
-}
-/** Structurally validate a fixture against the frozen format rules. */
-declare function validateFixture(fixture: ConformanceFixture): ValidationResult;
+declare function evaluateGeometry(definition: GeometryDefinition, widthEmu: number, heightEmu: number, adjust?: ReadonlyMap<string, number>): EvaluatedGeometry | null;
 
-/** The outcome a store reports for one replayed step. */
-interface ReplayOutcome {
-    readonly outcome: FixtureOutcome;
-    readonly committedRevision?: number;
-    /** Canonical authored-state value AFTER the step (hashed via comparator 0.4). */
-    readonly authoredState?: unknown;
-}
-/** The interface a conformance runtime implements so one fixture can drive every backend. */
-interface ReplayStore {
-    /** Initialize from the fixture source; return the initial revision (0 for create). */
-    init(fixture: ConformanceFixture): number;
-    /** Apply one step and report what happened. */
-    applyStep(step: FixtureStep): ReplayOutcome;
+/** The text a shape's style supplies: `a:fontRef` names a theme font slot and a colour. @internal */
+interface DrawingTextDefaults {
+    readonly fontSlot: 'major' | 'minor' | null;
+    readonly color: ShapeColor | null;
 }
-/** What replaying a fixture produced: per-step outcomes and where they diverged. */
-interface ReplayReport {
-    readonly ok: boolean;
-    readonly mismatches: readonly string[];
+/**
+ * A lowered text body; `'no-text'` when it holds nothing to paint; `'unsupported'` when it
+ * holds text the lowering cannot express (a vertical mode other than a quarter turn, several
+ * columns, or a body past the bounds), so its shape must not render without it.
+ *
+ * @internal
+ */
+type TextBodyLowering = LoweredDrawingText | 'no-text' | 'unsupported';
+/** @internal */
+interface LoweredDrawingText {
+    /** A `w:txbxContent` root holding the lowered paragraphs; node ids are namespaced. */
+    readonly content: OoxmlElement;
+    readonly insetsEmu: Readonly<{
+        top: number;
+        right: number;
+        bottom: number;
+        left: number;
+    }>;
+    readonly verticalAnchor: 'top' | 'center' | 'bottom';
+    readonly noWrap: boolean;
+    /** Clockwise turn `a:bodyPr/@rot` adds to the text, in degrees. */
+    readonly rotationDegrees: number;
+    /**
+     * `vert="vert"` (90) or `vert="vert270"` (270): the lines run along the box's long side, so
+     * the story lays out in the box turned a quarter. Insets are already in text space.
+     */
+    readonly quarterTurn: 0 | 90 | 270;
 }
+/** Lower one text body; see {@link TextBodyLowering}. @internal */
+declare function lowerDrawingTextBody(txBody: OoxmlElement, partName: string, defaults: DrawingTextDefaults, resolveSchemeColor?: ShapeSchemeColorResolver): TextBodyLowering;
+
+/** @internal */
+declare function findGraphicData(anchor: OoxmlElement): OoxmlElement | null;
+
 /**
- * Replay a fixture against a store and check every step's outcome, committed
- * revision, and authored-state fingerprint against the fixture's expectations.
+ * The theme and settings identity behind a scheme colour resolver. Resolvers are rebuilt for
+ * every package revision; the token stays the same while the theme and settings parts do.
+ *
+ * @internal
  */
-declare function replayFixture(fixture: ConformanceFixture, store: ReplayStore): ReplayReport;
-/** Hash a store's authored state, so two runtimes replaying one fixture can be compared. */
-declare function hashAuthored(authoredState: unknown): string;
+declare function shapeThemeCacheToken(resolveSchemeColor: (token: string) => string | null): string | undefined;
 
 /**
  * WHERE a copy reaches, computed by the editing surface against the published layout with
@@ -3123,5 +3123,5 @@ declare function inspectDrawingSupport(pkg: OoxmlPackage): DrawingSupportReport;
 /** Every {@link TreeDocOpKind}, for validation and exhaustiveness checks. */
 declare const TREE_DOC_OP_KINDS: readonly ["replaceStoryBlocks", "insertText", "deleteText", "setParagraphMarkRevision", "proposeParagraphMerge", "insertCommentMarker", "acceptRevision", "rejectRevision", "acceptAllRevisions", "rejectAllRevisions", "setRevisionAttribution", "insertTab", "insertHardBreak", "insertPageBreak", "insertPageField", "insertComplexField", "insertEquation", "setFieldCode", "setListLevel", "setListNumbering", "setParagraphTabStops", "setParagraphMarkProperties", "splitParagraph", "splitParagraphMany", "joinParagraphs", "setRunProperties", "setParagraphProperties", "setSectionProperties", "setSectionMark", "insertHyperlink", "setHyperlinkTarget", "removeHyperlink", "setMathEquation", "removeMathEquation", "setContentControlValue", "removeContentControl", "insertInlineContentControl", "addRepeatingSectionItem", "removeRepeatingSectionItem", "deleteBlock", "insertTable", "moveTable", "insertParagraphBesideTable", "insertTableRow", "deleteTableRow", "insertTableColumn", "deleteTableColumn", "mergeTableCells", "splitTableCell", "setTableColumnWidths", "setTableRightEdgeWidth", "setTableRowHeight", "setTableProperties", "authorTable", "setTableCellBorders", "setTableCellFill", "setTableCellVerticalAlignment", "createHeaderFooter", "deleteHeaderFooter", "linkToPrevious", "unlinkFromPrevious", "setSectionFurnitureOptions", "setDocumentProtection", "setWatermark", "insertNote", "deleteNote", "convertNote", "convertAllNotes", "setNoteProperties", "setContentControlProperties", "insertContentControl", "insertFragment", "insertDrawing", "replaceDrawingResource", "deleteDrawing", "resizeDrawing", "cropDrawing", "positionDrawing", "setDrawingWrap", "setDrawingMetadata", "setDrawingLocks", "transformDrawing", "insertToc", "replaceTocResult", "removeToc", "rewriteTocPageNumbers", "refreshFieldResults", "setFieldResult", "setTextFormFieldDefault", "commitTextFormField", "setLegacyCheckbox", "setLegacyDropdown", "insertBuildingBlock", "insertBookmark", "deleteBookmark"];
 
-export { ALL_FROZEN_IDS, AUTHORABLE_PARAGRAPH_PROPERTIES, AUTHORABLE_RUN_PROPERTIES, BoundedCounter, Budget, BudgetError, CANONICAL_MUTATION_ORIGINS, COMPARATORS, CUSTOM_NODE_XPATH_PREFIX, CUSTOM_XML_PROPS_REL, CUSTOM_XML_PROPS_TYPE, CUSTOM_XML_REL, CancellationController, CancellationError, ChartPartResolver, ChartexPartResolver, CommentRecord, CommentThreadState, CustomNodeWriteResult, DANGEROUS_KEYS, DATASTORE_NAMESPACE_URI, DEFAULT_FORMATTING_DISPLAY_MODE, DEFAULT_VIEW_SETTINGS, DEPENDENCY_KEY_IDS, DangerousKeyError, DeterministicClock, DeterministicMemoryMeter, DrawingGraphicKind, DrawingSupport, DrawingSupportIssue, DrawingTreeDocOp, EditOptions, FIELD_ATOM_CHAR, FieldResultsMode, GroupTextboxProjection, HistoryGroup, ID_KINDS, INERT_EXECUTABLE_KINDS, ImageWrapTarget, ImpactClass, InsertCustomNodeWrite, LIMIT_KEYS, LIMIT_SPECS, LegacyTextArtProjection, LimitExceededError, MAX_STORY_SDT_NESTING, MetafileImageMime, MetafileRenderOptions, MetafileReplay, NON_CANONICAL_ORIGINS, ORIGIN_IDS, OmmlEquationProjection, OoxmlAttribute, OoxmlElement, OoxmlFldCharNode, OoxmlFldSimpleNode, OoxmlGenericElementNode, OoxmlHardBreakNode, OoxmlInstrTextNode, OoxmlInvariantResult, OoxmlNode, OoxmlPackage, OoxmlParagraphNode, OoxmlPart, OoxmlProperty, PAGE_BREAK_CHAR, PictureFrameEffects, PortRegistry, PortResolutionError, PrefixAllocator, RESULT_IDS, RUNTIME_PORT_IDS, RegistryError, RelationshipRecord, ResourceLimits, ReviewCommentItem, ReviewItem, ReviewModelInput, ReviewPosition, ReviewRange, ReviewRevisionItem, RevisionSiteRefusal, SEARCH_MATCH_LIMIT, SEARCH_QUERY_MAX, SequentialIdentity, ShapeColor, ShapeEffectList, ShapeSchemeColorResolver, StoryScope, TOC_LEVEL_INDENT_TWIPS, TOC_MAX_BOOKMARKS_PER_REFRESH, TOC_MAX_ENTRIES, TOC_MAX_FIELD_NESTING, TOC_MAX_INSTRUCTION_CHARS, TOC_MAX_PAGE_PASSES, TREE_DOC_OP_KINDS, TWIPS_PER_POINT, TreeDocOp, TreeDocumentStore, TreeModelChange, TreeOpRejection, TreeOpResult, TreePackageStore, VML as VML_NAMESPACE_URI, OFFICE as VML_OFFICE_NAMESPACE_URI, WORD_VML as VML_WORD_NAMESPACE_URI, VectorShapeComponent, VectorShapeProjection, addComment, addPackageComment, applyTreeOp, assertLimitInvariants, assertValidId, assertValidQName, atomicFieldSpansOf, authoredProperties, beginOperation, bodyStoryRoot, bookmarkPairNodes, boundCustomXmlNodeIdOf, boundCustomXmlNodeIds, boundCustomXmlNodeIdsInPackage, buildTocContentControl, buildTocEntryParagraph, buildingBlockGalleryOf, buildingBlocksForControl, buildingBlocksOf, canonicalOoxmlFingerprint, canonicalize, cascadeEmptiedComments, collectReviewItems, collectRevisionSites, collectStoryParagraphs, commentItemsOf, commentPartNameOf, commentsExtendedPartNameOf, compareArtifacts, compareSemVer, containsCssFetch, contentTypesPartBytes, customNodeBinding, customXmlDataParts, customXmlLabelXPath, customXmlNodes, customXmlPrefixMappings, datastoreItemIdFor, deleteCommentThread, deletePackageComments, deriveOoxmlIndexes, detectBodyTocs, diffSemanticDigests, digestPart, directParagraphMarkProperties, directParagraphProperties, displayMathAlignment, drawingOpImpact, endOperation, equationsOfAtom, escapeCssString, escapeXml, escapeXmlAttribute, evaluateGeometry, extractFragmentPackage, fieldAtomText, fieldOnOffAttribute, findCustomXmlDataPart, findDetectedToc, findDirectChild, findGraphicData, findOccurrences, fingerprint, fldCharType, fldSimpleInstr, fnv1a32, foldCase, formatOwnedRunIds, formattableRanges, formsProtectionEnabled, glossaryPartOf, hardBreakAttributes, hardBreakKind, hardBreakText, hasCommentPart, hasLegacyFormFieldData, hashAuthored, indexStyles, inlineControlEndingAt, inlineControlStartingAt, insertPackageCustomNode, inspectDrawingSupport, installDrawingRenderers, instrTextValue, isAuthorableRunProperty, isDangerousKey, isDrawingTreeDocOp, isEvaluableField, isFieldChrome, isFldChar, isFldCharNode, isFldSimple, isFldSimpleNode, isInertExecutable, isInstrText, isInstrTextNode, isLegalFldCharType, isOmmlDisplay, isOmmlEquationAtom, isPageBreakNode, isSearchableQuery, isStoryPart, isValidId, isValidNCName, isValidParaId, isValidQName, isValidXmlText, isWholeWord, legacyRotationDegrees, linkRevisionReplies, listBookmarks, locateSites, lowerDrawingTextBody, makeLimitCounter, materializeGlossaryPlaceholders, mergeFragmentIntoPackage, mergedFontProperty, mergedMultiSettingProperty, mergedParagraphMarkProperties, mergedProperties, mintParaId, mintedParagraphIdentityAttributes, nextCommentId, normalizeParagraphIdentity, nullRecord, ooxmlTreesEqual, paraIdOf, paragraphOffsetIndex, paragraphTextOf, parseEmu, parseSemVer, parseTocInstruction, planTocEntries, points$1 as points, pointsToTwips, presetGeometryDefinition, projectOmmlAtom, projectOmmlDisplay, propertyContainer, readCustomXmlNode, readTwipsMeasure, readViewSettings, refreshBoundContent, relationshipsOf, relsPartNameFor, removePackageCustomNode, replayFixture, resolve, resolveContentTypeOf, resolveTocRowHeadings, revisionItemsOf, runAddressRanges, runPropertyEdits, runsCovering, sanitizeHref, satisfies, schemaAttributeValue, scrubExport, sectionProtectsForms, segmentsOf, semanticDigest, serializeOoxmlPart, setCommentResolved, setPackageCommentResolved, shapeThemeCacheToken, stableHash, storyParagraphs, storyRootsOf, stylesPartOf, textboxStoriesInPart, toSafeRecord, tocEntryText, tocLeftIndentTwips, twips, twipsToPoints, usedParaIds, validateDrawingOp, validateFixture, validateOoxmlPart, validatePackageInvariants, validateTreeOp, attribute as vmlAttribute, children as vmlChildren, color as vmlColor, vmlFormulaValues, named as vmlNamed, numeric as vmlNumber, off as vmlOff, points as vmlPoints, styleOf as vmlStyle, w14RootPrefix, withContentTypeOverride, withCustomXmlDataPart, withCustomXmlNode, withExportedCustomNodes, withNewPart, withRelationship, withoutCustomXmlDataPart, withoutCustomXmlNode, withoutOrphanCustomXmlNodes, wrapTargetToAnchorSpec };
+export { ALL_FROZEN_IDS, AUTHORABLE_PARAGRAPH_PROPERTIES, AUTHORABLE_RUN_PROPERTIES, BoundedCounter, Budget, BudgetError, CANONICAL_MUTATION_ORIGINS, COMPARATORS, CUSTOM_NODE_XPATH_PREFIX, CUSTOM_XML_PROPS_REL, CUSTOM_XML_PROPS_TYPE, CUSTOM_XML_REL, CancellationController, CancellationError, ChartPartResolver, ChartexPartResolver, CommentRecord, CommentThreadState, CustomNodeWriteResult, DANGEROUS_KEYS, DATASTORE_NAMESPACE_URI, DEFAULT_FORMATTING_DISPLAY_MODE, DEFAULT_VIEW_SETTINGS, DEPENDENCY_KEY_IDS, DangerousKeyError, DeterministicClock, DeterministicMemoryMeter, DrawingGraphicKind, DrawingSupport, DrawingSupportIssue, DrawingTreeDocOp, EditOptions, FIELD_ATOM_CHAR, FieldResultsMode, GroupTextboxProjection, HistoryGroup, ID_KINDS, INERT_EXECUTABLE_KINDS, ImageWrapTarget, ImpactClass, InsertCustomNodeWrite, LIMIT_KEYS, LIMIT_SPECS, LegacyTextArtProjection, LimitExceededError, MAX_STORY_SDT_NESTING, MetafileImageMime, MetafileRenderOptions, MetafileReplay, NON_CANONICAL_ORIGINS, ORIGIN_IDS, OmmlEquationProjection, OoxmlAttribute, OoxmlElement, OoxmlFldCharNode, OoxmlFldSimpleNode, OoxmlGenericElementNode, OoxmlHardBreakNode, OoxmlInstrTextNode, OoxmlInvariantResult, OoxmlNode, OoxmlPackage, OoxmlParagraphNode, OoxmlPart, OoxmlProperty, PAGE_BREAK_CHAR, PictureFrameEffects, PortRegistry, PortResolutionError, PrefixAllocator, RESULT_IDS, RUNTIME_PORT_IDS, RegistryError, RelationshipRecord, ResourceLimits, ReviewCommentItem, ReviewItem, ReviewModelInput, ReviewPosition, ReviewRange, ReviewRevisionItem, RevisionSiteRefusal, SEARCH_MATCH_LIMIT, SEARCH_QUERY_MAX, SequentialIdentity, ShapeColor, ShapeEffectList, ShapeSchemeColorResolver, StoryScope, TOC_LEVEL_INDENT_TWIPS, TOC_MAX_BOOKMARKS_PER_REFRESH, TOC_MAX_ENTRIES, TOC_MAX_FIELD_NESTING, TOC_MAX_INSTRUCTION_CHARS, TOC_MAX_PAGE_PASSES, TREE_DOC_OP_KINDS, TWIPS_PER_POINT, TreeDocOp, TreeDocumentStore, TreeModelChange, TreeOpRejection, TreeOpResult, TreePackageStore, VML as VML_NAMESPACE_URI, OFFICE as VML_OFFICE_NAMESPACE_URI, WORD_VML as VML_WORD_NAMESPACE_URI, VectorShapeComponent, VectorShapeProjection, addComment, addPackageComment, applyTreeOp, assertLimitInvariants, assertValidId, assertValidQName, atomicFieldSpansOf, authoredProperties, beginOperation, bodyStoryRoot, bookmarkPairNodes, boundCustomXmlNodeIdOf, boundCustomXmlNodeIds, boundCustomXmlNodeIdsInPackage, buildTocContentControl, buildTocEntryParagraph, buildingBlockGalleryOf, buildingBlocksForControl, buildingBlocksOf, canonicalOoxmlFingerprint, canonicalize, cascadeEmptiedComments, collectReviewItems, collectRevisionSites, collectStoryParagraphs, commentItemsOf, commentPartNameOf, commentsExtendedPartNameOf, commentsPartNameForStory, compareArtifacts, compareSemVer, containsCssFetch, contentTypesPartBytes, customNodeBinding, customXmlDataParts, customXmlLabelXPath, customXmlNodes, customXmlPrefixMappings, datastoreItemIdFor, deleteCommentThread, deletePackageComments, deriveOoxmlIndexes, detectBodyTocs, diffSemanticDigests, digestPart, directParagraphMarkProperties, directParagraphProperties, displayMathAlignment, drawingOpImpact, endOperation, equationsOfAtom, escapeCssString, escapeXml, escapeXmlAttribute, evaluateGeometry, extractFragmentPackage, fieldAtomText, fieldOnOffAttribute, findCustomXmlDataPart, findDetectedToc, findDirectChild, findGraphicData, findOccurrences, fingerprint, fldCharType, fldSimpleInstr, fnv1a32, foldCase, formatOwnedRunIds, formattableRanges, formsProtectionEnabled, glossaryPartOf, hardBreakAttributes, hardBreakKind, hardBreakText, hasCommentPart, hasLegacyFormFieldData, hashAuthored, indexStyles, inlineControlEndingAt, inlineControlStartingAt, insertPackageCustomNode, inspectDrawingSupport, installDrawingRenderers, instrTextValue, isAuthorableRunProperty, isDangerousKey, isDrawingTreeDocOp, isEvaluableField, isFieldChrome, isFldChar, isFldCharNode, isFldSimple, isFldSimpleNode, isInertExecutable, isInstrText, isInstrTextNode, isLegalFldCharType, isOmmlDisplay, isOmmlEquationAtom, isPageBreakNode, isSearchableQuery, isStoryPart, isValidId, isValidNCName, isValidParaId, isValidQName, isValidXmlText, isWholeWord, legacyRotationDegrees, linkRevisionReplies, listBookmarks, locateSites, lowerDrawingTextBody, makeLimitCounter, materializeGlossaryPlaceholders, mergeFragmentIntoPackage, mergedFontProperty, mergedMultiSettingProperty, mergedParagraphMarkProperties, mergedProperties, mintParaId, mintedParagraphIdentityAttributes, nextCommentId, normalizeParagraphIdentity, nullRecord, numberingRootOf, ooxmlTreesEqual, paraIdOf, paragraphOffsetIndex, paragraphTextOf, parseEmu, parseSemVer, parseTocInstruction, planTocEntries, points$1 as points, pointsToTwips, presetGeometryDefinition, projectOmmlAtom, projectOmmlDisplay, propertyContainer, readCustomXmlNode, readTwipsMeasure, readViewSettings, refreshBoundContent, relationshipsOf, relsPartNameFor, removePackageCustomNode, replayFixture, resolve, resolveContentTypeOf, resolveTocRowHeadings, revisionItemsOf, runAddressRanges, runPropertyEdits, runsCovering, sanitizeHref, satisfies, schemaAttributeValue, scrubExport, sectionProtectsForms, segmentsOfCopy as segmentsOf, semanticDigest, serializeOoxmlPart, setCommentResolved, setPackageCommentResolved, shapeThemeCacheToken, stableHash, storyParagraphs, storyRootsOf, stylesPartOf, textboxStoriesInPart, toSafeRecord, tocEntryText, tocLeftIndentTwips, twips, twipsToPoints, usedParaIds, validateDrawingOp, validateFixture, validateOoxmlPart, validatePackageInvariants, validateTreeOp, attribute as vmlAttribute, children as vmlChildren, color as vmlColor, vmlFormulaValues, named as vmlNamed, numeric as vmlNumber, off as vmlOff, points as vmlPoints, styleOf as vmlStyle, w14RootPrefix, withContentTypeOverride, withCustomXmlDataPart, withCustomXmlNode, withExportedCustomNodes, withNewPart, withRelationship, withoutCustomXmlDataPart, withoutCustomXmlNode, withoutOrphanCustomXmlNodes, wrapTargetToAnchorSpec };
 export type { AddCommentRequest, AddCommentResult, AnchorSnapshot, AtomicFieldSpan, AuditPort, AuthorizationPort, BookmarkPosition, BookmarkRecord, BuildingBlock, BuildingBlockGalleryFilter, CancellationPhase, CancellationPort, CancellationToken, CapabilityId, ChartRenderContext, ClockPort, CommentAnchorRequest, CommentDeletionOwner, ComparatorDescriptor, ComparatorMode, ComparatorName, ComparisonResult, ConformanceFixture, ContentItem, Contribution, CustomNodeBinding, CustomNodeExportPolicy, CustomNodeExportRequest, CustomNodeExportResult, CustomXmlDataPart, CustomXmlDataPartResult, CustomXmlNode, DetectedToc, DiagramLayoutOptions, DiagramLayoutParts, DigestDifference, DocumentViewSettings, DrawingEffectsRenderer, DrawingGraphicProjection, DrawingRenderers, DrawingSupportEntry, DrawingSupportReport, DrawingTextDefaults, EncodedEnvelope, EnforcementPhase, EvaluatedGeometry, ExternalResourceConsentPort, FeatureBundle, FixtureExpectation, FixtureOutcome, FixtureSource, FixtureStep, FldCharType, FontPort, FormattingDisplayMode, FormattingRevisionAuthorFilter, FragmentCoverage, FragmentExtractRejection, FragmentExtractResult, FragmentMergeRejection, FragmentMergeResult, GeometryDefinition, HardBreakKind, HrefProjection, IdKind, IdentityPort, ImagePort, InertExecutableKind, InlineControlSpan, Json, LegacyTextArtContext, LimitSpec, LimitUnit, LinkableReviewItem, LoweredDrawingText, MetafileRasterImage, MetafileRenderer, ModelChangeSummary, OffsetSpan, OoxmlIndexes, OoxmlStoryKind, OoxmlStoryRoot, OperationContext, OperationInit, PackageCommentDelete, PackageInvariantCode, PackageInvariantIssue, PackageInvariantResult, ParagraphDigest, ParagraphIndexEntry, ParagraphOffsetIndex, PersistencePort, PictureEffectsProjection, Points, RegistryErrorCode, ReplacementPolicy, ReplayOutcome, ReplayReport, ReplayStore, Reservation, ResolveOptions, ResolvedRegistry, ResourceAccountingPort, RunPropertyEdit, SchedulingPort, ScrubResult, Segment, SemVer, SemanticDigest, SetCommentResolvedResult, ShapeEffectsInput, ShapingPort, StoryDigest, StoryIndexEntry, StyleIndexEntry, TextArtLayout, TextArtLayoutInput, TextArtLayoutRenderer, TextArtOutline, TextBodyLowering, TextMatchOptions, TextOccurrence, TextOccurrences, TextboxStoryRoot, TocEntryPlan, TocInstruction, TocOutlineHeading, TransportPort, Twips, ValidationResult, VmlFormulaContext };