@docx-editor.dev/core 2.35.0-canary.20261104032723.sha-43c2012 → 2.35.0

package/dist/{tree-package-store-D0_BOm-r.d.ts → tree-package-fragment-DXZ2B7x0.d.ts}

@@ -1,4 +1,4 @@
-import { a5 as OoxmlPackage, an as SupportedImageMime, O as OoxmlPart, a4 as OoxmlNode, av as OoxmlElement, aH as PackageWatermarkWrite, aI as OoxmlInvariantIssue, ad as ImageDecodePort, aE as RevisionAttributionInput, aJ as DrawingTreeDocOp, aK as ImpactClass, au as TreeDocOp, aF as TreeOpRejection, aL as OoxmlParagraphNode, aM as OoxmlNoteNode, aN as OoxmlContinuationSeparatorNode, aO as OoxmlEndnotesNode, aP as OoxmlFootnotesNode, aQ as OoxmlNoteRefNode, aR as OoxmlNoteReferenceNode, aS as OoxmlSeparatorNode } from './tree-op-types-CGlwCQXg.js';
+import { r as OoxmlPackage, aG as SupportedImageMime, O as OoxmlPart, am as OoxmlNode, aU as OoxmlElement, a$ as PackageWatermarkWrite, b0 as OoxmlInvariantIssue, b1 as OoxmlParagraphNode, b2 as OoxmlNoteNode, b3 as OoxmlContinuationSeparatorNode, b4 as OoxmlEndnotesNode, b5 as OoxmlFootnotesNode, b6 as OoxmlNoteRefNode, b7 as OoxmlNoteReferenceNode, b8 as OoxmlSeparatorNode, aY as RevisionAttributionInput, aw as ImageDecodePort, b9 as DrawingTreeDocOp, ba as ImpactClass, aO as TreeDocOp, aZ as TreeOpRejection } from './tree-op-types-DmrePCMo.js';
 
 /** A freshly allocated drawing property id, or the reason one could not be minted. */
 type DrawingPropertyIdResult = {
@@ -256,6 +256,14 @@ interface ContentLockPolicy {
  */
 interface EditOptions {
     readonly deferValidation?: boolean;
+    /**
+     * The text of the glossary block a control's `w:placeholder/w:docPart` names, so a control
+     * an edit empties shows the document's own prompt. Absent, or `undefined` for a name, means
+     * the type's default prompt.
+     *
+     * @internal
+     */
+    readonly placeholderText?: (docPart: string) => string | undefined;
     /**
      * How a content control's `w:lock` is read for ops that only restyle text. Absent means
      * the default: `contentLocked` / `sdtContentLocked` refuse every write, formatting included.
@@ -354,769 +362,739 @@ declare function removeNode(part: OoxmlPart, nodeId: string, options?: EditOptio
  */
 declare function applyEdits(part: OoxmlPart, edits: readonly ((current: OoxmlPart) => OoxmlEditResult)[], options?: EditOptions): OoxmlEditResult;
 
-interface InsertImageInput {
-    readonly paragraphId: string;
-    readonly offset: number;
-    readonly bytes: Uint8Array;
-    readonly mime: SupportedImageMime;
-    readonly widthPoints: number;
-    readonly heightPoints: number;
-    readonly decodePort: ImageDecodePort;
-    readonly expectedPackageRevision: number;
-    readonly commitGuard?: () => boolean;
-    readonly title?: string;
-    readonly description?: string;
-    readonly hyperlink?: string;
-    /** Present in suggesting mode: the inserted drawing's run goes into a `w:ins`. */
-    readonly revision?: RevisionAttributionInput;
-    /**
-     * Collaboration actor for the ids this insert mints — `wp:docPr/@id`, the image
-     * relationship, and a hyperlink relationship when one is asked for.
-     *
-     * EXPLICIT, and not the ambient `runWithTransactionActor` binding, because this entry is
-     * async: the mint runs after `await validateEmbeddedImageForCommit` and the ambient actor
-     * is synchronous-only. A wrap around the call would compile, read as correct, and be gone
-     * by the time the id is taken. Omitted (solo) keeps Word's dense `highest + 1` sequence.
-     */
-    readonly actorId?: string;
-}
-interface ReplaceImageOptions {
-    readonly expectedPackageRevision: number;
-    readonly commitGuard?: () => boolean;
-    /** Collaboration actor for the replacement's minted ids. See {@link InsertImageInput.actorId}. */
-    readonly actorId?: string;
-}
-type ImageIntentResult = (Extract<PackageTransactResult, {
-    ok: true;
-}> & {
-    readonly drawingNodeId?: string;
-    readonly mediaPartName?: string;
-}) | Extract<PackageTransactResult, {
-    ok: false;
-}>;
-interface ApplyImagePropertiesInput {
-    readonly drawingNodeId: string;
-    readonly ops: readonly DrawingTreeDocOp[];
-    readonly hyperlink: string | null;
-}
-
-/** How one transaction behaves: its story scope, its attribution, and its selection marks. */
-interface TransactOptions {
-    readonly origin?: string;
-    /** Stable actor attribution for collaboration and audit correlation. */
-    readonly actorId?: string;
-    /** Stable constituent identity for collaboration duplicate correlation. */
-    readonly operationId?: string;
-    /**
-     * Whether this transaction enters the legacy snapshot undo stack.
-     *
-     * Collaboration commits set this to false because their actor-local undo authority is the
-     * CRDT undo manager. Omitted preserves the ordinary non-collaborative history behavior.
-     */
-    readonly recordsHistory?: boolean;
-    /**
-     * A COMMAND is one user intent that may need several ops (a toolbar click applying a
-     * property across a multi-run selection). It is still exactly one history entry, which is
-     * the same rule a plain transaction follows — the option exists to say so explicitly at
-     * the call site rather than leaving it implied.
-     */
-    readonly scope?: 'transaction' | 'command';
-    /**
-     * Floor on the published impact. Header/footer story edits use `global` so every page
-     * sharing the part invalidates rather than keeping stale furniture.
-     */
-    readonly minimumImpact?: ImpactClass;
-    /** Story identity stamped onto the published ModelChange (package-aware targeting). */
-    readonly story?: TreeStoryRef;
-    /**
-     * The gesture this transaction belongs to: consecutive transactions carrying the SAME
-     * token extend one history entry (package from before the first, selection after the
-     * latest). Another token, none, undo or redo closes the group. See {@link HistoryGroup}.
-     */
-    readonly historyGroup?: HistoryGroup;
-    /**
-     * How the transaction's ops address saved field results. `atomic` (the default) keeps
-     * every field one offset unit; `editable` addresses saved results as text. See
-     * `field-result-mode.ts`.
-     */
-    readonly fieldResults?: FieldResultsMode;
-}
-/** How a store is constructed: its limits, its history depth, and its identity source. */
-interface TreeDocumentStoreOptions {
-    /** Bound on retained history entries. Oldest entries drop first. */
-    readonly historyLimit?: number;
-    /**
-     * The document's `settings.xml`, for a store built from a PART rather than a package.
-     *
-     * Forms protection lives one part up from the op, and a store built from a part gets a
-     * synthetic one-part package that cannot see it — so `w:documentProtection w:edit="forms"`
-     * was enforced in the body and nowhere else, and a header, a footer or a note accepted every
-     * write a protected document is supposed to refuse. Read through a getter, not captured: a
-     * document can gain or lose protection while its stories stay open.
-     */
-    readonly settingsPart?: () => OoxmlPart | null | undefined;
-    /**
-     * Opt-in relaxation of `w:lock` for run-property writes. See {@link ContentLockPolicy};
-     * absent, `contentLocked` and `sdtContentLocked` refuse formatting like any other write.
-     */
-    readonly contentLockPolicy?: ContentLockPolicy;
-}
-
-/** A selection the caller wants restored when an entry is undone or redone. */
-/** A selection captured with a transaction, so undo restores where the caret was. */
-interface SelectionMark {
-    readonly paragraphId: string;
-    readonly start: number;
-    readonly end: number;
-}
+/** UTF-16 placeholder for one atomic note unit in `paragraphTextOf` / segments. */
+declare const NOTE_ATOM_CHAR = "\uFFFC";
+/** Signed 32-bit Word-compatible note id range (positive allocation only). */
+declare const NOTE_ID_MIN = 1;
+/** Largest note id Word accepts — signed 32-bit. */
+declare const NOTE_ID_MAX = 2147483647;
+/** Reserved separator / continuation ids — never allocated for normal notes. */
+declare const NOTE_SEPARATOR_ID = -1;
+/** Reserved id of the continuation-separator entry. Never allocated to a real note. */
+declare const NOTE_CONTINUATION_SEPARATOR_ID = 0;
+/** Which notes part a note lives in. Decides both placement and numbering rules. */
+type NoteKind = 'footnote' | 'endnote';
+/** Authored `ST_FtnEdn` including explicit `normal`. Absent means Word default (normal). */
 /**
- * Which editable story a ModelChange came from.
+ * What a note entry IS.
  *
- * Mirrors `EditorScope` for body and header/footer — `{ kind: 'headerFooter'; rId }` —
- * so package-aware mutation and the public scope contract stay one vocabulary. Body
- * commits omit `rId`; header/footer commits carry the relationship id that addressed
- * the part. Notes parts use `{ kind: 'notesPart'; noteKind }` (one store per part).
+ * Only `normal` is a note a reader sees. The others are the furniture Word stores in the same
+ * part — the rules and notices drawn around the note area — reached by reserved ids.
  */
-/** Which story a transaction targets: the body, a header/footer part, or a notes part. */
-type TreeStoryRef = {
-    readonly kind: 'body';
-    readonly partName: string;
-} | {
-    readonly kind: 'headerFooter';
-    readonly partName: string;
-    readonly rId: string;
-} | {
-    readonly kind: 'notesPart';
-    readonly partName: string;
-    readonly noteKind: 'footnote' | 'endnote';
-};
+type NoteType = 'normal' | 'separator' | 'continuationSeparator' | 'continuationNotice';
+/** Parse a signed decimal note id; reject non-integers and out-of-int32 values. */
+declare function parseNoteId(raw: string | undefined): number | null;
 /**
- * What one committed transaction changed: the revision, the ids touched, and the impact class.
+ * Canonical `EditorScope { kind: 'note'; id }` encoding.
  *
- * The ids are what let layout and paint re-do only the affected blocks instead of the document.
+ * Footnote id `1` and endnote id `1` coexist, so the kind is part of the string:
+ * `footnote:2` / `endnote:-1`. Do not invent a parallel scope union arm.
  */
-interface TreeModelChange {
-    readonly change: 'model-change';
-    readonly fromRevision: number;
-    readonly toRevision: number;
-    readonly commitId: string;
-    readonly origin: string;
-    /** Stable collaboration actor attribution, when the caller supplied it. */
-    readonly actorId?: string;
-    /** Stable collaboration operation identity, when the caller supplied it. */
-    readonly operationId?: string;
-    readonly dirty: readonly string[];
-    readonly created: readonly string[];
-    readonly deleted: readonly string[];
-    readonly splitJoin: readonly ({
-        readonly split: {
-            readonly from: string;
-            readonly tail: string;
-        };
-    } | {
-        readonly join: {
-            readonly kept: string;
-            readonly removed: string;
-        };
-    })[];
-    readonly dependencyKeys: readonly string[];
-    /** The widest impact among the transaction's ops — what layout must scope to. */
-    readonly impact: ImpactClass;
-    /**
-     * Story that published this change. Absent on body-only store publishes that predate
-     * package-aware targeting; `TreePackageStore` always sets it.
-     */
-    readonly story?: TreeStoryRef;
-    /**
-     * Committed collapsed caret for this transaction, when one exists.
-     * Matches history `selectionAfter` when that mark is collapsed; absent for explicit
-     * null, non-collapsed explicit selection, or when no caret was committed.
-     */
-    readonly caret?: SelectionMark;
+declare function formatNoteScopeId(noteKind: NoteKind, noteId: number): string;
+/**
+ * Parse {@link formatNoteScopeId}. Returns `null` for malformed / out-of-range ids.
+ */
+declare function parseNoteScopeId(id: string): {
+    readonly noteKind: NoteKind;
+    readonly noteId: number;
+} | null;
+/** Whether a node is a `w:footnotes` part root. */
+declare function isFootnotesNode(node: OoxmlNode): node is OoxmlFootnotesNode;
+/** Whether a node is a `w:endnotes` part root. */
+declare function isEndnotesNode(node: OoxmlNode): node is OoxmlEndnotesNode;
+/** Whether a node is a `w:footnote` or `w:endnote` body. */
+declare function isNoteNode(node: OoxmlNode): node is OoxmlNoteNode;
+/** Whether a node is a body-side `w:footnoteReference` / `w:endnoteReference`. */
+declare function isNoteReferenceNode(node: OoxmlNode): node is OoxmlNoteReferenceNode;
+/** Whether a node is the `w:footnoteRef` / `w:endnoteRef` mark inside a note's own body. */
+declare function isNoteRefNode(node: OoxmlNode): node is OoxmlNoteRefNode;
+/** Whether a node is the `w:separator` rule drawn above the note area. */
+declare function isSeparatorNode(node: OoxmlNode): node is OoxmlSeparatorNode;
+/** Whether a node is the `w:continuationSeparator` rule used on continuation pages. */
+declare function isContinuationSeparatorNode(node: OoxmlNode): node is OoxmlContinuationSeparatorNode;
+/** Typed or generic `w:footnote` / `w:endnote`. */
+declare function noteKindOf(node: OoxmlNode): NoteKind | null;
+/** Authored `@w:id` on a note or noteReference when parseable. */
+declare function noteIdOf(node: OoxmlNode): number | null;
+/** Authored `@w:type` (`ST_FtnEdn`) when present and schema-legal; else `undefined`. */
+declare function noteTypeOf(node: OoxmlNode): NoteType | undefined;
+/** Whether a note is a normal (body) note — absent type and explicit `normal` both count. */
+declare function isNormalNote(node: OoxmlNode): boolean;
+/** Typed or generic footnote/endnote reference kind. */
+declare function noteReferenceKindOf(node: OoxmlNode): NoteKind | null;
+/** Typed or generic `w:footnoteRef` / `w:endnoteRef`. */
+declare function noteRefKindOf(node: OoxmlNode): NoteKind | null;
+/**
+ * Read `@w:customMarkFollows` on a note reference.
+ * Returns `undefined` when absent; otherwise the OOXML on/off interpretation.
+ */
+declare function customMarkFollows(node: OoxmlNode): boolean | undefined;
+/** Model text contributed by one atomic note unit. */
+declare function noteAtomText(): typeof NOTE_ATOM_CHAR;
+/**
+ * True when a run-inner node is a typed note atom that contributes one UTF-16 unit.
+ * Demoted/malformed known locals stay generic and contribute nothing.
+ */
+declare function isNoteAtomNode(node: OoxmlNode): boolean;
+/**
+ * One atomic note span inside a paragraph for caret / delete / selection.
+ *
+ * Each typed note atom is a single-node span (`removeNodeIds` = that node).
+ */
+interface AtomicNoteSpan {
+    readonly kind: 'noteReference' | 'noteRef' | 'separator' | 'continuationSeparator';
+    readonly node: OoxmlNode;
+    readonly runId: string;
+    readonly removeNodeIds: readonly string[];
 }
-/** Whether a transaction committed, or the typed reason it was refused. */
-type TransactResult = {
-    readonly ok: true;
-    readonly change: TreeModelChange | null;
+/**
+ * Collect typed note atoms in document order (one segment each).
+ *
+ * Walks the same paragraph-inline surface as `segmentsOf` / `walkParagraphInline`:
+ * hyperlinks and content controls flatten; only direct run children contribute atoms.
+ * A demoted run-inner SDT husk stays opaque — no phantom addressable hit.
+ */
+declare function atomicNoteSpansOf(paragraph: OoxmlParagraphNode): readonly AtomicNoteSpan[];
+/** Cap on notes scanned when allocating / indexing a notes part. */
+declare const MAX_NOTES_PER_PART = 10000;
+/**
+ * Allocate the next positive signed 32-bit note id for a notes-part root.
+ *
+ * Solo: `max(existing)+1`, the dense sequence Word writes. `null` on exhaustion, so the
+ * caller refuses rather than wrapping onto an id a note already holds.
+ *
+ * With a collaboration actor bound — explicit argument, or the open store transaction — the
+ * id is the next unused value in that actor's stripe. Two peers each adding their first
+ * footnote from one snapshot otherwise both mint `w:id="1"`: the merge keeps both bodies
+ * under one id, both `w:footnoteReference` marks resolve to the first, and one author's note
+ * becomes unreachable.
+ *
+ * The reserved ids stay reserved either way. `0` (continuation separator) is seeded as used,
+ * so a residue of 0 advances one class instead of taking Word's furniture, and a stripe walk
+ * only ever climbs from a non-negative residue, so `-1` (separator) is unreachable.
+ */
+declare function allocateNoteId(notesRoot: OoxmlNode, actorId?: string): number | null;
+/** Collect note bodies from a footnotes/endnotes root, bounded. */
+declare function notesOf(root: OoxmlNode): readonly OoxmlNoteNode[];
+/** Find a typed note by id inside a notes-part root. */
+declare function findNoteById(root: OoxmlNode, noteId: number): OoxmlNoteNode | undefined;
+
+/** Cap on nodes visited while scanning for note references across stories. */
+declare const MAX_NOTE_REFERENCE_SCAN = 20000;
+/**
+ * Cap on XML parts walked in one package-wide note-reference scan (N/N+1 gate).
+ * Soft targets are not allowed: exceeding this marks the shared budget truncated.
+ */
+declare const MAX_NOTE_REFERENCE_PARTS = 256;
+/**
+ * A load-time note problem worth reporting.
+ *
+ * `dangling-note-reference` is a citation pointing at no note; `note-reference-scan-truncated`
+ * says the scan hit its budget, so absence of further diagnostics is not proof of correctness.
+ */
+type NoteDiagnosticCode = 'dangling-note-reference' | 'note-reference-scan-truncated';
+/**
+ * Load-time note diagnostics. Array API preserved; truncation is signaled as a typed
+ * entry rather than by throwing or rejecting the package.
+ */
+type NoteDiagnostic = {
+    readonly code: 'dangling-note-reference';
+    readonly noteKind: NoteKind;
+    readonly noteId: number;
+    /** Paragraph / container node id when known. */
+    readonly sourceNodeId?: string;
 } | {
-    readonly ok: false;
-    readonly reason: TreeOpRejection;
-    readonly detail?: string;
+    /** Hard visited/part budget or soft hit cap stopped the scan before full coverage. */
+    readonly code: 'note-reference-scan-truncated';
 };
-/** What a transaction body is handed: the working tree, and the means to stage ops against it. */
-interface TransactionContext {
-    /** Stage one op against the STORY part. Returns false once the transaction has failed. */
-    apply(op: TreeDocOp): boolean;
-    /**
-     * Stage one op against a named part.
-     *
-     * A comment body lives in `comments.xml` and is edited by the same ops that edit the story,
-     * so this is `apply` with the target named rather than a second vocabulary.
-     */
-    applyTo(partName: string, op: TreeDocOp): boolean;
+/** One note reference found in a story, with where it sits. */
+interface NoteReferenceHit {
+    readonly noteKind: NoteKind;
+    readonly noteId: number;
+    readonly nodeId: string;
+    readonly paragraphId: string;
+    /** Canonical UTF-16 atom offset within {@link paragraphId} (U+FFFC model). */
+    readonly atomOffset: number;
+    readonly customMarkFollows: boolean;
+    /** Canonical part name that owns this reference. */
+    readonly partName: string;
+}
+/** Mutable visited-node + part budget shared across parts / package snapshots. */
+interface NoteReferenceScanBudget {
+    visited: number;
+    readonly maxVisited: number;
+    parts: number;
+    readonly maxParts: number;
+    /** Set when a walk stops before finishing because a cap was hit. */
+    truncated: boolean;
+}
+/** A bounded budget for scanning note references, so a crafted document cannot stall a load. */
+declare function createNoteReferenceScanBudget(maxVisited?: number, maxParts?: number): NoteReferenceScanBudget;
+/**
+ * Resolve the footnotes or endnotes part via safe Internal document relationships.
+ *
+ * Unusable matching relationships (External, unsafe target, missing part, wrong root)
+ * are skipped — never fetched, never accepted — so a decoy first match cannot hide a
+ * later usable Internal notes part (same continue-past-bad pattern as settingsPartOf).
+ */
+declare function resolveNotesPart(pkg: OoxmlPackage, noteKind: NoteKind): OoxmlPart | null;
+/** Walk a part without applying a layout projection. */
+declare function collectNoteReferences(part: OoxmlPart, options?: {
+    readonly maxHits?: number;
+    readonly budget?: NoteReferenceScanBudget;
+}): readonly NoteReferenceHit[];
+/** Collect references across every XML part under one shared part + visited-node budget. */
+declare function collectPackageNoteReferences(pkg: OoxmlPackage, options?: {
+    readonly budget?: NoteReferenceScanBudget;
+    /** Soft hit cap for diagnostics. Omit / Infinity for mutation scans. */
+    readonly maxHits?: number;
+}): readonly NoteReferenceHit[];
+/**
+ * Load diagnostics for dangling note references. Fail-open: never throws or mutates;
+ * returns diagnostics for callers to surface. Does not invent missing note bodies.
+ *
+ * When the hard visited/part budget truncates or the soft hit cap binds, appends a single
+ * `note-reference-scan-truncated` entry so incomplete coverage is visible without breaking
+ * consumers that filter on `dangling-note-reference`.
+ */
+declare function diagnoseNoteReferences(pkg: OoxmlPackage): readonly NoteDiagnostic[];
+/** Whether a notes-part root contains a note with the given id (any type). */
+declare function notesPartHasId(part: OoxmlPart, noteId: number): boolean;
+/** List normal (body) note ids in document order, bounded. */
+declare function normalNoteIds(part: OoxmlPart): readonly number[];
+
+/** How far a note lifecycle op reaches — which parts a caller must expect to have changed. */
+type NoteLifecycleImpact = 'flow-structural' | 'global';
+/**
+ * A note lifecycle mutation: insert, delete, convert, or set properties.
+ *
+ * Package-level rather than story-level, because every one of these touches the main document,
+ * the notes part, the document relationships AND `[Content_Types].xml` together.
+ */
+type NoteLifecycleOp = {
+    readonly op: 'insertNote';
+    readonly noteKind: NoteKind;
+    readonly paragraphId: string;
+    readonly offset: number;
     /**
-     * Stage a whole-package edit: a new part, a relationship, a content-type override.
-     *
-     * The edit is a pure function of the working package, so a rejected transaction discards it
-     * with everything else. Returning the SAME package is a no-op, not a failure — a primitive
-     * that finds nothing to do says so that way.
-     *
-     * Engine package edits refuse by throwing the internal `PackageEditRefusal`
-     * (`package-edit-refusal.ts`): the transaction is refused with its reason, `package-changed`
-     * by default, and nothing is applied. Any other throw escapes `transact` as a crash.
+     * Write the citing reference as a TRACKED insertion: the reference run goes inside a
+     * `w:ins` carrying this attribution. The note body stays plain — rejecting the
+     * reference removes it, and the orphaned body is swept by the same cascade an
+     * untracked reference deletion triggers.
      */
-    applyPackage(edit: (pkg: OoxmlPackage) => OoxmlPackage): boolean;
-    /** The selection to restore when this entry is undone. */
-    selectionBefore(selection: SelectionMark | null): void;
-    /** The selection to restore when this entry is redone. */
-    selectionAfter(selection: SelectionMark | null): void;
-}
-interface HistoryEntry {
+    readonly revision?: RevisionAttributionInput;
+} | {
+    readonly op: 'deleteNote';
+    readonly noteKind: NoteKind;
+    readonly noteId: number;
+} | {
+    readonly op: 'convertNote';
+    readonly fromKind: NoteKind;
+    readonly noteId: number;
+} | {
     /**
-     * The whole package as it was, not just the story part.
-     *
-     * Affordable for the same reason a part snapshot was: parts are immutable and deep-frozen, so
-     * a package snapshot is a Map of references and every part the transaction did not touch is
-     * object-identical to the one before it. Undo stays a pointer swap, and it now reverses every
-     * part one intent wrote rather than only the story.
+     * Convert every normal note of `fromKind` in document order. One atomic package
+     * transaction / undo unit with the same validation as repeated `convertNote`.
      */
-    readonly pkg: OoxmlPackage;
-    readonly revision: number;
-    readonly selectionBefore: SelectionMark | null;
-    readonly selectionAfter: SelectionMark | null;
+    readonly op: 'convertAllNotes';
+    readonly fromKind: NoteKind;
+} | {
+    readonly op: 'setNoteProperties';
+    readonly scope: 'document' | 'section';
+    readonly sectionIndex?: number;
+    readonly footnote?: {
+        readonly numFmt?: string;
+        readonly numRestart?: string;
+        readonly position?: string;
+        readonly numStart?: number;
+    };
+    readonly endnote?: {
+        readonly numFmt?: string;
+        readonly numRestart?: string;
+        readonly position?: string;
+        readonly numStart?: number;
+    };
+};
+/** Why a note lifecycle op was refused. */
+type NoteLifecycleRejection = 'invalidArgs' | 'invalid-property-value' | 'tree-invariant';
+/**
+ * A new package, or a typed rejection.
+ *
+ * Application is PURE and all-or-nothing: there are no partial writes, so a refused op leaves the
+ * caller's package untouched rather than half-migrated across four parts.
+ */
+type NoteLifecycleResult = {
+    readonly ok: true;
+    readonly package: OoxmlPackage;
+    readonly impact: NoteLifecycleImpact;
+    readonly noteId?: number;
+    readonly noteKind?: NoteKind;
+    readonly createdPartName?: string;
+} | {
+    readonly ok: false;
+    readonly reason: NoteLifecycleRejection;
+    readonly detail?: string;
+};
+/** Whether an op is a note lifecycle op rather than a story-level one. */
+declare function isNoteLifecycleOp(op: {
+    readonly op: string;
+}): op is NoteLifecycleOp;
+/** Attribution and limits applied to one note lifecycle op. */
+interface NoteLifecycleOptions {
     /**
-     * The gesture this entry is still collecting, while it is the newest entry and nothing
-     * has closed it. Only ever set on the top of the undo stack: {@link closeHistoryGroup}
-     * strips it, and undo and redo never copy it onto the entries they push.
+     * Shared part + visited-node budget for reference scans. When omitted a fresh default
+     * budget is used. Truncation rejects the op with the original package unchanged.
      */
-    readonly group?: HistoryGroup;
+    readonly scanBudget?: NoteReferenceScanBudget;
 }
 /**
- * Opaque document+history checkpoint for package-coordinator rollback.
- * Used when a story mutation may promote to a package undo unit (note-ref cascade).
+ * Apply one note lifecycle op atomically. Rejected ops leave the input package untouched.
  */
-/** A restorable point in history — one entry of the intent-scoped undo stack. */
-interface TreeDocumentCheckpoint {
+declare function applyNoteLifecycleOp(pkg: OoxmlPackage, op: NoteLifecycleOp, options?: NoteLifecycleOptions): NoteLifecycleResult;
+/**
+ * How deleting text cascades into the notes it referenced.
+ *
+ * A note's body and the citation reaching it are one thing to a reader, so removing the reference
+ * must remove the body too or the notes part keeps an entry nothing points at.
+ */
+interface CascadeDeletedNoteReferencesOptions {
     /**
-     * The whole package, not one part. The store owns the package so a transaction spanning
-     * several parts is one publication — a checkpoint of only the story part could not roll
-     * back the comment or numbering part the same transaction wrote.
+     * Independent full budgets per snapshot. When omitted each snapshot gets its own
+     * default budget — never share one counter across before/after walks.
      */
-    readonly pkg: OoxmlPackage;
-    readonly revision: number;
-    readonly undoStack: readonly HistoryEntry[];
-    readonly redoStack: readonly HistoryEntry[];
-    readonly composition: {
-        readonly entry: HistoryEntry;
-        readonly committed: boolean;
-    } | null;
+    readonly beforeBudget?: NoteReferenceScanBudget;
+    readonly afterBudget?: NoteReferenceScanBudget;
 }
 /**
- * The document store: one transaction is one atomic publication and one history entry.
+ * Remove note bodies for references that disappeared between two package snapshots.
+ * Used when `deleteText` or `deleteBlock` removes a `noteReference` atom so body+ref stay
+ * one undo unit.
  *
- * `apply` STAGES ops against a working part and nothing is visible until `transact` returns, so a
- * batch rejected halfway leaves the revision, the tree, the indexes and every subscriber exactly
- * as they were. That all-or-nothing property is what lets a caller compose ops without having to
- * reason about partial application.
+ * Each snapshot gets an independent full visited/part budget. If either scan truncates
+ * the cascade fails closed so a hostile package cannot skip body deletion silently —
+ * without accidentally halving capacity by charging both walks to one counter.
  */
-declare class TreeDocumentStore {
-    private current;
-    /** The part `apply` targets and `part` returns: the story this store is editing. */
-    private readonly storyPartName;
-    private rev;
-    private commitCounter;
-    private readonly undoStack;
-    private readonly redoStack;
-    private pushCount;
-    private readonly subscribers;
-    private readonly historyLimit;
-    /** See {@link TreeDocumentStoreOptions.settingsPart}. */
-    private readonly settingsPartOverride;
-    /** See {@link TreeDocumentStoreOptions.contentLockPolicy}. */
-    private readonly contentLockPolicy;
-    /** Package-aware story tag applied to publishes (including undo/redo). */
-    private storyRef;
-    /** Open composition, if any. While set, transactions extend one entry (task 5.5). */
-    private composition;
+declare function cascadeDeletedNoteReferences(before: OoxmlPackage, after: OoxmlPackage, options?: CascadeDeletedNoteReferencesOptions): OoxmlPackage | null;
+
+interface InsertImageInput {
+    readonly paragraphId: string;
+    readonly offset: number;
+    readonly bytes: Uint8Array;
+    readonly mime: SupportedImageMime;
+    readonly widthPoints: number;
+    readonly heightPoints: number;
+    readonly decodePort: ImageDecodePort;
+    readonly expectedPackageRevision: number;
+    readonly commitGuard?: () => boolean;
+    readonly title?: string;
+    readonly description?: string;
+    readonly hyperlink?: string;
+    /** Present in suggesting mode: the inserted drawing's run goes into a `w:ins`. */
+    readonly revision?: RevisionAttributionInput;
     /**
-     * Open a store over a package, editing the named story part.
+     * Collaboration actor for the ids this insert mints — `wp:docPr/@id`, the image
+     * relationship, and a hyperlink relationship when one is asked for.
      *
-     * A bare part is accepted and wrapped in a single-part package, so callers that never open a
-     * real package — tests, headless tooling — are unaffected by the widening.
-     */
-    constructor(source: OoxmlPart | OoxmlPackage, storyPartNameOrOptions?: string | TreeDocumentStoreOptions, maybeOptions?: TreeDocumentStoreOptions);
-    /**
-     * Stamp story identity onto subsequent publishes for this store (including undo/redo).
-     * Used by the package coordinator so history navigation keeps the same scope tag.
-     */
-    setStoryRef(story: TreeStoryRef | null): void;
-    /** The story part being edited. Unchanged for every caller that predates the widening. */
-    get part(): OoxmlPart;
-    /** Every part, including the ones a multi-part transaction wrote. */
-    get package(): OoxmlPackage;
-    get revision(): number;
-    get canUndo(): boolean;
-    get canRedo(): boolean;
-    /** Retained entries — the unit `undo()` reverses, so tests can assert grouping. */
-    get historyDepth(): number;
-    /**
-     * How many entries this store has ever pushed. Monotonic, unlike `historyDepth`, which
-     * stands still at the history limit because the oldest entry is shifted out.
-     * @internal
+     * EXPLICIT, and not the ambient `runWithTransactionActor` binding, because this entry is
+     * async: the mint runs after `await validateEmbeddedImageForCommit` and the ambient actor
+     * is synchronous-only. A wrap around the call would compile, read as correct, and be gone
+     * by the time the id is taken. Omitted (solo) keeps Word's dense `highest + 1` sequence.
      */
-    get historyPushCount(): number;
-    get compositionActive(): boolean;
+    readonly actorId?: string;
+}
+interface ReplaceImageOptions {
+    readonly expectedPackageRevision: number;
+    readonly commitGuard?: () => boolean;
+    /** Collaboration actor for the replacement's minted ids. See {@link InsertImageInput.actorId}. */
+    readonly actorId?: string;
+}
+type ImageIntentResult = (Extract<PackageTransactResult, {
+    ok: true;
+}> & {
+    readonly drawingNodeId?: string;
+    readonly mediaPartName?: string;
+}) | Extract<PackageTransactResult, {
+    ok: false;
+}>;
+interface ApplyImagePropertiesInput {
+    readonly drawingNodeId: string;
+    readonly ops: readonly DrawingTreeDocOp[];
+    readonly hyperlink: string | null;
+}
+
+/** How one transaction behaves: its story scope, its attribution, and its selection marks. */
+interface TransactOptions {
+    readonly origin?: string;
+    /** Stable actor attribution for collaboration and audit correlation. */
+    readonly actorId?: string;
+    /** Stable constituent identity for collaboration duplicate correlation. */
+    readonly operationId?: string;
     /**
-     * Replace the package OUTSIDE the transaction and history lanes.
-     *
-     * For package writes that are not a user intent and publish no revision: grafting
-     * `numbering.xml` into a document that never had one, which the caller performs as a
-     * precondition of the list op that follows. Those edits were previously kept in a package
-     * variable beside the store, which meant two owners of one value and, predictably, two
-     * values — a graft written to one and a save read from the other.
+     * Whether this transaction enters the legacy snapshot undo stack.
      *
-     * Deliberately narrow and deliberately awkward to reach for: anything a user did belongs in
-     * `transact`, where it gets a revision, an undo entry and the invariant checks.
+     * Collaboration commits set this to false because their actor-local undo authority is the
+     * CRDT undo manager. Omitted preserves the ordinary non-collaborative history behavior.
      */
-    graftPackage(edit: (pkg: OoxmlPackage) => OoxmlPackage): void;
+    readonly recordsHistory?: boolean;
     /**
-     * Replace the current part without recording history, but advance the revision so
-     * revision-keyed projections cannot survive a package snapshot install.
+     * A COMMAND is one user intent that may need several ops (a toolbar click applying a
+     * property across a multi-run selection). It is still exactly one history entry, which is
+     * the same rule a plain transaction follows — the option exists to say so explicitly at
+     * the call site rather than leaving it implied.
      */
-    replacePart(part: OoxmlPart): void;
+    readonly scope?: 'transaction' | 'command';
     /**
-     * Snapshot part, revision, and undo/redo stacks so the package coordinator can roll
-     * back a story transaction that fails after commit (e.g. note-reference cascade) or
-     * discard a local history entry when promoting to a package undo unit.
+     * Floor on the published impact. Header/footer story edits use `global` so every page
+     * sharing the part invalidates rather than keeping stale furniture.
      */
-    checkpoint(): TreeDocumentCheckpoint;
-    /** Full restore — part, revision, history stacks, and composition. */
-    restoreCheckpoint(checkpoint: TreeDocumentCheckpoint): void;
+    readonly minimumImpact?: ImpactClass;
+    /** Story identity stamped onto the published ModelChange (package-aware targeting). */
+    readonly story?: TreeStoryRef;
     /**
-     * Restore undo/redo stacks only, keeping the current part and revision.
-     * Used when a story mutation is promoted to a package history pointer so the local
-     * orphan entry does not steal a later undo.
+     * The gesture this transaction belongs to: consecutive transactions carrying the SAME
+     * token extend one history entry (package from before the first, selection after the
+     * latest). Another token, none, undo or redo closes the group. See {@link HistoryGroup}.
      */
-    restoreHistoryStacks(checkpoint: TreeDocumentCheckpoint): void;
-    subscribe(listener: (change: TreeModelChange) => void): () => void;
+    readonly historyGroup?: HistoryGroup;
     /**
-     * Run one atomic transaction.
-     *
-     * Ops are staged against a working copy. On the first rejection the whole transaction is
-     * abandoned: no revision, no history entry, no notification. On success exactly one
-     * revision is published and exactly one history entry is recorded — unless a composition
-     * is open, in which case the entry already exists and this transaction joins it.
+     * How the transaction's ops address saved field results. `atomic` (the default) keeps
+     * every field one offset unit; `editable` addresses saved results as text. See
+     * `field-result-mode.ts`.
      */
-    transact(build: (ctx: TransactionContext) => void, options?: TransactOptions): TransactResult;
-    private commitTransaction;
+    readonly fieldResults?: FieldResultsMode;
+}
+/** How a store is constructed: its limits, its history depth, and its identity source. */
+interface TreeDocumentStoreOptions {
+    /** Bound on retained history entries. Oldest entries drop first. */
+    readonly historyLimit?: number;
     /**
-     * Open one history entry for an IME composition.
+     * The document's `settings.xml`, for a store built from a PART rather than a package.
      *
-     * Everything committed until `endComposition` collapses into this single entry, which is
-     * what makes a composed word one undo step rather than one per intermediate transaction.
-     */
-    beginComposition(selectionBefore?: SelectionMark | null): void;
-    /** Close the composition, recording its entry only if anything actually committed. */
-    endComposition(): void;
-    /**
-     * Cancel an open composition without recording an entry, leaving whatever it committed
-     * in place. An IME cancel is not an undo request; the caller decides what to revert.
-     */
-    cancelComposition(): void;
-    /**
-     * Close the open history group, if any: the next transaction records its own entry.
-     * The store does this itself for another token, none, undo and redo; the package
-     * coordinator does it for history moving ABOVE the store (a package unit, another
-     * story's pointer), which the store cannot see.
+     * Forms protection lives one part up from the op, and a store built from a part gets a
+     * synthetic one-part package that cannot see it — so `w:documentProtection w:edit="forms"`
+     * was enforced in the body and nowhere else, and a header, a footer or a note accepted every
+     * write a protected document is supposed to refuse. Read through a getter, not captured: a
+     * document can gain or lose protection while its stories stay open.
      */
-    closeHistoryGroup(): void;
-    undo(): TreeModelChange | null;
-    redo(): TreeModelChange | null;
-    /** The selection to restore for the entry `undo()` would reverse next. */
-    selectionForUndo(): SelectionMark | null;
-    /** The selection to restore for the entry `redo()` would reapply next. */
-    selectionForRedo(): SelectionMark | null;
+    readonly settingsPart?: () => OoxmlPart | null | undefined;
     /**
-     * Remove the newest undo entry and answer its selections, for the package coordinator
-     * when a package history group absorbs the story pointer that entry belonged to.
-     * @internal
+     * Opt-in relaxation of `w:lock` for run-property writes. See {@link ContentLockPolicy};
+     * absent, `contentLocked` and `sdtContentLocked` refuse formatting like any other write.
      */
-    discardNewestUndoEntry(): Pick<HistoryEntry, 'selectionBefore' | 'selectionAfter'> | null;
-    private pushUndo;
-    private publish;
-}
-
-/**
- * The identity of one continuous user gesture, for history grouping.
- *
- * A live color picker, a font-size stepper or a spacing slider applies every intermediate
- * value so the document updates under the pointer, and each of those writes is a
- * transaction in its own right — it must render, and a collaborator must receive it. What
- * they are NOT is separate undo steps. The caller mints one token when the gesture starts
- * (`Symbol('color-drag')`) and passes it with every write until the gesture ends.
- *
- * A symbol rather than a string, so two unrelated callers cannot collide by naming their
- * gesture the same way, and so a token cannot outlive its gesture by accident through
- * serialization.
- */
-type HistoryGroup = symbol;
-type HistoryCaptureKind = 'started' | 'extended' | 'split';
-type HistoryCaptureReason = 'package-unit' | 'composition';
-declare function observeHistoryGroup<T>(group: HistoryGroup, report: (kind: HistoryCaptureKind, reason?: HistoryCaptureReason) => void, run: () => T): T;
-declare function reportHistoryGroup(group: HistoryGroup | undefined, kind: HistoryCaptureKind, reason?: HistoryCaptureReason): void;
-
-/** UTF-16 placeholder for one atomic note unit in `paragraphTextOf` / segments. */
-declare const NOTE_ATOM_CHAR = "\uFFFC";
-/** Signed 32-bit Word-compatible note id range (positive allocation only). */
-declare const NOTE_ID_MIN = 1;
-/** Largest note id Word accepts — signed 32-bit. */
-declare const NOTE_ID_MAX = 2147483647;
-/** Reserved separator / continuation ids — never allocated for normal notes. */
-declare const NOTE_SEPARATOR_ID = -1;
-/** Reserved id of the continuation-separator entry. Never allocated to a real note. */
-declare const NOTE_CONTINUATION_SEPARATOR_ID = 0;
-/** Which notes part a note lives in. Decides both placement and numbering rules. */
-type NoteKind = 'footnote' | 'endnote';
-/** Authored `ST_FtnEdn` including explicit `normal`. Absent means Word default (normal). */
-/**
- * What a note entry IS.
- *
- * Only `normal` is a note a reader sees. The others are the furniture Word stores in the same
- * part — the rules and notices drawn around the note area — reached by reserved ids.
- */
-type NoteType = 'normal' | 'separator' | 'continuationSeparator' | 'continuationNotice';
-/** Parse a signed decimal note id; reject non-integers and out-of-int32 values. */
-declare function parseNoteId(raw: string | undefined): number | null;
-/**
- * Canonical `EditorScope { kind: 'note'; id }` encoding.
- *
- * Footnote id `1` and endnote id `1` coexist, so the kind is part of the string:
- * `footnote:2` / `endnote:-1`. Do not invent a parallel scope union arm.
- */
-declare function formatNoteScopeId(noteKind: NoteKind, noteId: number): string;
-/**
- * Parse {@link formatNoteScopeId}. Returns `null` for malformed / out-of-range ids.
- */
-declare function parseNoteScopeId(id: string): {
-    readonly noteKind: NoteKind;
-    readonly noteId: number;
-} | null;
-/** Whether a node is a `w:footnotes` part root. */
-declare function isFootnotesNode(node: OoxmlNode): node is OoxmlFootnotesNode;
-/** Whether a node is a `w:endnotes` part root. */
-declare function isEndnotesNode(node: OoxmlNode): node is OoxmlEndnotesNode;
-/** Whether a node is a `w:footnote` or `w:endnote` body. */
-declare function isNoteNode(node: OoxmlNode): node is OoxmlNoteNode;
-/** Whether a node is a body-side `w:footnoteReference` / `w:endnoteReference`. */
-declare function isNoteReferenceNode(node: OoxmlNode): node is OoxmlNoteReferenceNode;
-/** Whether a node is the `w:footnoteRef` / `w:endnoteRef` mark inside a note's own body. */
-declare function isNoteRefNode(node: OoxmlNode): node is OoxmlNoteRefNode;
-/** Whether a node is the `w:separator` rule drawn above the note area. */
-declare function isSeparatorNode(node: OoxmlNode): node is OoxmlSeparatorNode;
-/** Whether a node is the `w:continuationSeparator` rule used on continuation pages. */
-declare function isContinuationSeparatorNode(node: OoxmlNode): node is OoxmlContinuationSeparatorNode;
-/** Typed or generic `w:footnote` / `w:endnote`. */
-declare function noteKindOf(node: OoxmlNode): NoteKind | null;
-/** Authored `@w:id` on a note or noteReference when parseable. */
-declare function noteIdOf(node: OoxmlNode): number | null;
-/** Authored `@w:type` (`ST_FtnEdn`) when present and schema-legal; else `undefined`. */
-declare function noteTypeOf(node: OoxmlNode): NoteType | undefined;
-/** Whether a note is a normal (body) note — absent type and explicit `normal` both count. */
-declare function isNormalNote(node: OoxmlNode): boolean;
-/** Typed or generic footnote/endnote reference kind. */
-declare function noteReferenceKindOf(node: OoxmlNode): NoteKind | null;
-/** Typed or generic `w:footnoteRef` / `w:endnoteRef`. */
-declare function noteRefKindOf(node: OoxmlNode): NoteKind | null;
-/**
- * Read `@w:customMarkFollows` on a note reference.
- * Returns `undefined` when absent; otherwise the OOXML on/off interpretation.
- */
-declare function customMarkFollows(node: OoxmlNode): boolean | undefined;
-/** Model text contributed by one atomic note unit. */
-declare function noteAtomText(): typeof NOTE_ATOM_CHAR;
-/**
- * True when a run-inner node is a typed note atom that contributes one UTF-16 unit.
- * Demoted/malformed known locals stay generic and contribute nothing.
- */
-declare function isNoteAtomNode(node: OoxmlNode): boolean;
-/**
- * One atomic note span inside a paragraph for caret / delete / selection.
- *
- * Each typed note atom is a single-node span (`removeNodeIds` = that node).
- */
-interface AtomicNoteSpan {
-    readonly kind: 'noteReference' | 'noteRef' | 'separator' | 'continuationSeparator';
-    readonly node: OoxmlNode;
-    readonly runId: string;
-    readonly removeNodeIds: readonly string[];
-}
-/**
- * Collect typed note atoms in document order (one segment each).
- *
- * Walks the same paragraph-inline surface as `segmentsOf` / `walkParagraphInline`:
- * hyperlinks and content controls flatten; only direct run children contribute atoms.
- * A demoted run-inner SDT husk stays opaque — no phantom addressable hit.
- */
-declare function atomicNoteSpansOf(paragraph: OoxmlParagraphNode): readonly AtomicNoteSpan[];
-/** Cap on notes scanned when allocating / indexing a notes part. */
-declare const MAX_NOTES_PER_PART = 10000;
-/**
- * Allocate the next positive signed 32-bit note id for a notes-part root.
- *
- * Solo: `max(existing)+1`, the dense sequence Word writes. `null` on exhaustion, so the
- * caller refuses rather than wrapping onto an id a note already holds.
- *
- * With a collaboration actor bound — explicit argument, or the open store transaction — the
- * id is the next unused value in that actor's stripe. Two peers each adding their first
- * footnote from one snapshot otherwise both mint `w:id="1"`: the merge keeps both bodies
- * under one id, both `w:footnoteReference` marks resolve to the first, and one author's note
- * becomes unreachable.
- *
- * The reserved ids stay reserved either way. `0` (continuation separator) is seeded as used,
- * so a residue of 0 advances one class instead of taking Word's furniture, and a stripe walk
- * only ever climbs from a non-negative residue, so `-1` (separator) is unreachable.
- */
-declare function allocateNoteId(notesRoot: OoxmlNode, actorId?: string): number | null;
-/** Collect note bodies from a footnotes/endnotes root, bounded. */
-declare function notesOf(root: OoxmlNode): readonly OoxmlNoteNode[];
-/** Find a typed note by id inside a notes-part root. */
-declare function findNoteById(root: OoxmlNode, noteId: number): OoxmlNoteNode | undefined;
+    readonly contentLockPolicy?: ContentLockPolicy;
+    /**
+     * The glossary prompt a control's `w:placeholder/w:docPart` names, for a store built from
+     * a PART. Its synthetic package holds no glossary, so an emptied control in a header or a
+     * note would show the type's default prompt instead of the document's own.
+     *
+     * @internal
+     */
+    readonly placeholderText?: (docPart: string) => string | undefined;
+}
 
-/** Cap on nodes visited while scanning for note references across stories. */
-declare const MAX_NOTE_REFERENCE_SCAN = 20000;
-/**
- * Cap on XML parts walked in one package-wide note-reference scan (N/N+1 gate).
- * Soft targets are not allowed: exceeding this marks the shared budget truncated.
- */
-declare const MAX_NOTE_REFERENCE_PARTS = 256;
-/**
- * A load-time note problem worth reporting.
- *
- * `dangling-note-reference` is a citation pointing at no note; `note-reference-scan-truncated`
- * says the scan hit its budget, so absence of further diagnostics is not proof of correctness.
- */
-type NoteDiagnosticCode = 'dangling-note-reference' | 'note-reference-scan-truncated';
-/**
- * Load-time note diagnostics. Array API preserved; truncation is signaled as a typed
- * entry rather than by throwing or rejecting the package.
- */
-type NoteDiagnostic = {
-    readonly code: 'dangling-note-reference';
-    readonly noteKind: NoteKind;
-    readonly noteId: number;
-    /** Paragraph / container node id when known. */
-    readonly sourceNodeId?: string;
-} | {
-    /** Hard visited/part budget or soft hit cap stopped the scan before full coverage. */
-    readonly code: 'note-reference-scan-truncated';
-};
-/** One note reference found in a story, with where it sits. */
-interface NoteReferenceHit {
-    readonly noteKind: NoteKind;
-    readonly noteId: number;
-    readonly nodeId: string;
+/** A selection the caller wants restored when an entry is undone or redone. */
+/** A selection captured with a transaction, so undo restores where the caret was. */
+interface SelectionMark {
     readonly paragraphId: string;
-    /** Canonical UTF-16 atom offset within {@link paragraphId} (U+FFFC model). */
-    readonly atomOffset: number;
-    readonly customMarkFollows: boolean;
-    /** Canonical part name that owns this reference. */
-    readonly partName: string;
-}
-/** Mutable visited-node + part budget shared across parts / package snapshots. */
-interface NoteReferenceScanBudget {
-    visited: number;
-    readonly maxVisited: number;
-    parts: number;
-    readonly maxParts: number;
-    /** Set when a walk stops before finishing because a cap was hit. */
-    truncated: boolean;
+    readonly start: number;
+    readonly end: number;
 }
-/** A bounded budget for scanning note references, so a crafted document cannot stall a load. */
-declare function createNoteReferenceScanBudget(maxVisited?: number, maxParts?: number): NoteReferenceScanBudget;
-/**
- * Resolve the footnotes or endnotes part via safe Internal document relationships.
- *
- * Unusable matching relationships (External, unsafe target, missing part, wrong root)
- * are skipped — never fetched, never accepted — so a decoy first match cannot hide a
- * later usable Internal notes part (same continue-past-bad pattern as settingsPartOf).
- */
-declare function resolveNotesPart(pkg: OoxmlPackage, noteKind: NoteKind): OoxmlPart | null;
-/** Walk a part without applying a layout projection. */
-declare function collectNoteReferences(part: OoxmlPart, options?: {
-    readonly maxHits?: number;
-    readonly budget?: NoteReferenceScanBudget;
-}): readonly NoteReferenceHit[];
-/** Collect references across every XML part under one shared part + visited-node budget. */
-declare function collectPackageNoteReferences(pkg: OoxmlPackage, options?: {
-    readonly budget?: NoteReferenceScanBudget;
-    /** Soft hit cap for diagnostics. Omit / Infinity for mutation scans. */
-    readonly maxHits?: number;
-}): readonly NoteReferenceHit[];
 /**
- * Load diagnostics for dangling note references. Fail-open: never throws or mutates;
- * returns diagnostics for callers to surface. Does not invent missing note bodies.
+ * Which editable story a ModelChange came from.
  *
- * When the hard visited/part budget truncates or the soft hit cap binds, appends a single
- * `note-reference-scan-truncated` entry so incomplete coverage is visible without breaking
- * consumers that filter on `dangling-note-reference`.
+ * Mirrors `EditorScope` for body and header/footer — `{ kind: 'headerFooter'; rId }` —
+ * so package-aware mutation and the public scope contract stay one vocabulary. Body
+ * commits omit `rId`; header/footer commits carry the relationship id that addressed
+ * the part. Notes parts use `{ kind: 'notesPart'; noteKind }` (one store per part).
  */
-declare function diagnoseNoteReferences(pkg: OoxmlPackage): readonly NoteDiagnostic[];
-/** Whether a notes-part root contains a note with the given id (any type). */
-declare function notesPartHasId(part: OoxmlPart, noteId: number): boolean;
-/** List normal (body) note ids in document order, bounded. */
-declare function normalNoteIds(part: OoxmlPart): readonly number[];
-
-/** How far a note lifecycle op reaches — which parts a caller must expect to have changed. */
-type NoteLifecycleImpact = 'flow-structural' | 'global';
+/** Which story a transaction targets: the body, a header/footer part, or a notes part. */
+type TreeStoryRef = {
+    readonly kind: 'body';
+    readonly partName: string;
+} | {
+    readonly kind: 'headerFooter';
+    readonly partName: string;
+    readonly rId: string;
+} | {
+    readonly kind: 'notesPart';
+    readonly partName: string;
+    readonly noteKind: 'footnote' | 'endnote';
+};
 /**
- * A note lifecycle mutation: insert, delete, convert, or set properties.
+ * What one committed transaction changed: the revision, the ids touched, and the impact class.
  *
- * Package-level rather than story-level, because every one of these touches the main document,
- * the notes part, the document relationships AND `[Content_Types].xml` together.
+ * The ids are what let layout and paint re-do only the affected blocks instead of the document.
  */
-type NoteLifecycleOp = {
-    readonly op: 'insertNote';
-    readonly noteKind: NoteKind;
-    readonly paragraphId: string;
-    readonly offset: number;
+interface TreeModelChange {
+    readonly change: 'model-change';
+    readonly fromRevision: number;
+    readonly toRevision: number;
+    readonly commitId: string;
+    readonly origin: string;
+    /** Stable collaboration actor attribution, when the caller supplied it. */
+    readonly actorId?: string;
+    /** Stable collaboration operation identity, when the caller supplied it. */
+    readonly operationId?: string;
+    readonly dirty: readonly string[];
+    readonly created: readonly string[];
+    readonly deleted: readonly string[];
+    readonly splitJoin: readonly ({
+        readonly split: {
+            readonly from: string;
+            readonly tail: string;
+        };
+    } | {
+        readonly join: {
+            readonly kept: string;
+            readonly removed: string;
+        };
+    })[];
+    readonly dependencyKeys: readonly string[];
+    /** The widest impact among the transaction's ops — what layout must scope to. */
+    readonly impact: ImpactClass;
     /**
-     * Write the citing reference as a TRACKED insertion: the reference run goes inside a
-     * `w:ins` carrying this attribution. The note body stays plain — rejecting the
-     * reference removes it, and the orphaned body is swept by the same cascade an
-     * untracked reference deletion triggers.
+     * Story that published this change. Absent on body-only store publishes that predate
+     * package-aware targeting; `TreePackageStore` always sets it.
      */
-    readonly revision?: RevisionAttributionInput;
-} | {
-    readonly op: 'deleteNote';
-    readonly noteKind: NoteKind;
-    readonly noteId: number;
-} | {
-    readonly op: 'convertNote';
-    readonly fromKind: NoteKind;
-    readonly noteId: number;
-} | {
+    readonly story?: TreeStoryRef;
     /**
-     * Convert every normal note of `fromKind` in document order. One atomic package
-     * transaction / undo unit with the same validation as repeated `convertNote`.
+     * Committed collapsed caret for this transaction, when one exists.
+     * Matches history `selectionAfter` when that mark is collapsed; absent for explicit
+     * null, non-collapsed explicit selection, or when no caret was committed.
      */
-    readonly op: 'convertAllNotes';
-    readonly fromKind: NoteKind;
-} | {
-    readonly op: 'setNoteProperties';
-    readonly scope: 'document' | 'section';
-    readonly sectionIndex?: number;
-    readonly footnote?: {
-        readonly numFmt?: string;
-        readonly numRestart?: string;
-        readonly position?: string;
-        readonly numStart?: number;
-    };
-    readonly endnote?: {
-        readonly numFmt?: string;
-        readonly numRestart?: string;
-        readonly position?: string;
-        readonly numStart?: number;
-    };
-};
-/** Why a note lifecycle op was refused. */
-type NoteLifecycleRejection = 'invalidArgs' | 'invalid-property-value' | 'tree-invariant';
-/**
- * A new package, or a typed rejection.
- *
- * Application is PURE and all-or-nothing: there are no partial writes, so a refused op leaves the
- * caller's package untouched rather than half-migrated across four parts.
- */
-type NoteLifecycleResult = {
+    readonly caret?: SelectionMark;
+}
+/** Whether a transaction committed, or the typed reason it was refused. */
+type TransactResult = {
     readonly ok: true;
-    readonly package: OoxmlPackage;
-    readonly impact: NoteLifecycleImpact;
-    readonly noteId?: number;
-    readonly noteKind?: NoteKind;
-    readonly createdPartName?: string;
+    readonly change: TreeModelChange | null;
 } | {
     readonly ok: false;
-    readonly reason: NoteLifecycleRejection;
+    readonly reason: TreeOpRejection;
     readonly detail?: string;
 };
-/** Whether an op is a note lifecycle op rather than a story-level one. */
-declare function isNoteLifecycleOp(op: {
-    readonly op: string;
-}): op is NoteLifecycleOp;
-/** Attribution and limits applied to one note lifecycle op. */
-interface NoteLifecycleOptions {
+/** What a transaction body is handed: the working tree, and the means to stage ops against it. */
+interface TransactionContext {
+    /** Stage one op against the STORY part. Returns false once the transaction has failed. */
+    apply(op: TreeDocOp): boolean;
+    /**
+     * Stage one op against a named part.
+     *
+     * A comment body lives in `comments.xml` and is edited by the same ops that edit the story,
+     * so this is `apply` with the target named rather than a second vocabulary.
+     */
+    applyTo(partName: string, op: TreeDocOp): boolean;
+    /**
+     * Stage a whole-package edit: a new part, a relationship, a content-type override.
+     *
+     * The edit is a pure function of the working package, so a rejected transaction discards it
+     * with everything else. Returning the SAME package is a no-op, not a failure — a primitive
+     * that finds nothing to do says so that way.
+     *
+     * Engine package edits refuse by throwing the internal `PackageEditRefusal`
+     * (`package-edit-refusal.ts`): the transaction is refused with its reason, `package-changed`
+     * by default, and nothing is applied. Any other throw escapes `transact` as a crash.
+     */
+    applyPackage(edit: (pkg: OoxmlPackage) => OoxmlPackage): boolean;
+    /** The selection to restore when this entry is undone. */
+    selectionBefore(selection: SelectionMark | null): void;
+    /** The selection to restore when this entry is redone. */
+    selectionAfter(selection: SelectionMark | null): void;
+}
+interface HistoryEntry {
+    /**
+     * The whole package as it was, not just the story part.
+     *
+     * Affordable for the same reason a part snapshot was: parts are immutable and deep-frozen, so
+     * a package snapshot is a Map of references and every part the transaction did not touch is
+     * object-identical to the one before it. Undo stays a pointer swap, and it now reverses every
+     * part one intent wrote rather than only the story.
+     */
+    readonly pkg: OoxmlPackage;
+    readonly revision: number;
+    readonly selectionBefore: SelectionMark | null;
+    readonly selectionAfter: SelectionMark | null;
     /**
-     * Shared part + visited-node budget for reference scans. When omitted a fresh default
-     * budget is used. Truncation rejects the op with the original package unchanged.
+     * The gesture this entry is still collecting, while it is the newest entry and nothing
+     * has closed it. Only ever set on the top of the undo stack: {@link closeHistoryGroup}
+     * strips it, and undo and redo never copy it onto the entries they push.
      */
-    readonly scanBudget?: NoteReferenceScanBudget;
+    readonly group?: HistoryGroup;
 }
 /**
- * Apply one note lifecycle op atomically. Rejected ops leave the input package untouched.
- */
-declare function applyNoteLifecycleOp(pkg: OoxmlPackage, op: NoteLifecycleOp, options?: NoteLifecycleOptions): NoteLifecycleResult;
-/**
- * How deleting text cascades into the notes it referenced.
- *
- * A note's body and the citation reaching it are one thing to a reader, so removing the reference
- * must remove the body too or the notes part keeps an entry nothing points at.
+ * Opaque document+history checkpoint for package-coordinator rollback.
+ * Used when a story mutation may promote to a package undo unit (note-ref cascade).
  */
-interface CascadeDeletedNoteReferencesOptions {
+/** A restorable point in history — one entry of the intent-scoped undo stack. */
+interface TreeDocumentCheckpoint {
     /**
-     * Independent full budgets per snapshot. When omitted each snapshot gets its own
-     * default budget — never share one counter across before/after walks.
+     * The whole package, not one part. The store owns the package so a transaction spanning
+     * several parts is one publication — a checkpoint of only the story part could not roll
+     * back the comment or numbering part the same transaction wrote.
      */
-    readonly beforeBudget?: NoteReferenceScanBudget;
-    readonly afterBudget?: NoteReferenceScanBudget;
+    readonly pkg: OoxmlPackage;
+    readonly revision: number;
+    readonly undoStack: readonly HistoryEntry[];
+    readonly redoStack: readonly HistoryEntry[];
+    readonly composition: {
+        readonly entry: HistoryEntry;
+        readonly committed: boolean;
+    } | null;
 }
 /**
- * Remove note bodies for references that disappeared between two package snapshots.
- * Used when `deleteText` or `deleteBlock` removes a `noteReference` atom so body+ref stay
- * one undo unit.
+ * The document store: one transaction is one atomic publication and one history entry.
  *
- * Each snapshot gets an independent full visited/part budget. If either scan truncates
- * the cascade fails closed so a hostile package cannot skip body deletion silently —
- * without accidentally halving capacity by charging both walks to one counter.
+ * `apply` STAGES ops against a working part and nothing is visible until `transact` returns, so a
+ * batch rejected halfway leaves the revision, the tree, the indexes and every subscriber exactly
+ * as they were. That all-or-nothing property is what lets a caller compose ops without having to
+ * reason about partial application.
  */
-declare function cascadeDeletedNoteReferences(before: OoxmlPackage, after: OoxmlPackage, options?: CascadeDeletedNoteReferencesOptions): OoxmlPackage | null;
-
-/** Decoded fragment payloads above this cap are refused before any package work. */
-declare const MAX_FRAGMENT_DECODED_BYTES: number;
-interface FragmentPasteInput {
-    readonly paragraphId: string;
-    readonly offset: number;
-    /** The fragment package zip (from the clipboard codec or the HTML projection). */
-    readonly fragmentBytes: Uint8Array;
-    readonly lastMarkCovered: boolean;
-    /** Ops that clear the current selection first (the surface's deleteSelectionPlan). */
-    readonly priorOps?: readonly TreeDocOp[];
+declare class TreeDocumentStore {
+    private current;
+    /** The part `apply` targets and `part` returns: the story this store is editing. */
+    private readonly storyPartName;
+    private rev;
+    private commitCounter;
+    private readonly undoStack;
+    private readonly redoStack;
+    private pushCount;
+    private readonly subscribers;
+    private readonly historyLimit;
+    /** See {@link TreeDocumentStoreOptions.settingsPart}. */
+    private readonly settingsPartOverride;
+    private readonly placeholderTextOverride;
+    /** See {@link TreeDocumentStoreOptions.contentLockPolicy}. */
+    private readonly contentLockPolicy;
+    /** Package-aware story tag applied to publishes (including undo/redo). */
+    private storyRef;
+    /** Open composition, if any. While set, transactions extend one entry (task 5.5). */
+    private composition;
     /**
-     * Collaboration actor for the ids this paste mints.
+     * Open a store over a package, editing the named story part.
      *
-     * A paste freshens three package-wide namespaces — bookmark `@w:id`, revision `@w:id` and
-     * `wp:docPr/@id` — and the merge reads the actor off the open transaction. Without one, two
-     * replicas pasting the same fragment from one snapshot mint the same numbers, and only the
-     * merged document shows it. Omitted (solo) keeps Word's dense sequences.
+     * A bare part is accepted and wrapped in a single-part package, so callers that never open a
+     * real package — tests, headless tooling — are unaffected by the widening.
      */
-    readonly actorId?: string;
+    constructor(source: OoxmlPart | OoxmlPackage, storyPartNameOrOptions?: string | TreeDocumentStoreOptions, maybeOptions?: TreeDocumentStoreOptions);
     /**
-     * Suggesting mode: the author and date the whole paste is proposed under, as one tracked
-     * insertion (`trackedFragment`). The caller tracks `priorOps` itself.
+     * Stamp story identity onto subsequent publishes for this store (including undo/redo).
+     * Used by the package coordinator so history navigation keeps the same scope tag.
      */
-    readonly revision?: RevisionAttributionInput;
+    setStoryRef(story: TreeStoryRef | null): void;
+    /** The story part being edited. Unchanged for every caller that predates the widening. */
+    get part(): OoxmlPart;
+    /** Every part, including the ones a multi-part transaction wrote. */
+    get package(): OoxmlPackage;
+    get revision(): number;
+    get canUndo(): boolean;
+    get canRedo(): boolean;
+    /** Retained entries — the unit `undo()` reverses, so tests can assert grouping. */
+    get historyDepth(): number;
+    /**
+     * How many entries this store has ever pushed. Monotonic, unlike `historyDepth`, which
+     * stands still at the history limit because the oldest entry is shifted out.
+     * @internal
+     */
+    get historyPushCount(): number;
+    get compositionActive(): boolean;
+    /**
+     * Replace the package OUTSIDE the transaction and history lanes.
+     *
+     * For package writes that are not a user intent and publish no revision: grafting
+     * `numbering.xml` into a document that never had one, which the caller performs as a
+     * precondition of the list op that follows. Those edits were previously kept in a package
+     * variable beside the store, which meant two owners of one value and, predictably, two
+     * values — a graft written to one and a save read from the other.
+     *
+     * Deliberately narrow and deliberately awkward to reach for: anything a user did belongs in
+     * `transact`, where it gets a revision, an undo entry and the invariant checks.
+     */
+    graftPackage(edit: (pkg: OoxmlPackage) => OoxmlPackage): void;
+    /**
+     * Replace the current part without recording history, but advance the revision so
+     * revision-keyed projections cannot survive a package snapshot install.
+     */
+    replacePart(part: OoxmlPart): void;
+    /**
+     * Snapshot part, revision, and undo/redo stacks so the package coordinator can roll
+     * back a story transaction that fails after commit (e.g. note-reference cascade) or
+     * discard a local history entry when promoting to a package undo unit.
+     */
+    checkpoint(): TreeDocumentCheckpoint;
+    /** Full restore — part, revision, history stacks, and composition. */
+    restoreCheckpoint(checkpoint: TreeDocumentCheckpoint): void;
+    /**
+     * Restore undo/redo stacks only, keeping the current part and revision.
+     * Used when a story mutation is promoted to a package history pointer so the local
+     * orphan entry does not steal a later undo.
+     */
+    restoreHistoryStacks(checkpoint: TreeDocumentCheckpoint): void;
+    subscribe(listener: (change: TreeModelChange) => void): () => void;
+    /**
+     * Run one atomic transaction.
+     *
+     * Ops are staged against a working copy. On the first rejection the whole transaction is
+     * abandoned: no revision, no history entry, no notification. On success exactly one
+     * revision is published and exactly one history entry is recorded — unless a composition
+     * is open, in which case the entry already exists and this transaction joins it.
+     */
+    transact(build: (ctx: TransactionContext) => void, options?: TransactOptions): TransactResult;
+    private commitTransaction;
+    /**
+     * Open one history entry for an IME composition.
+     *
+     * Everything committed until `endComposition` collapses into this single entry, which is
+     * what makes a composed word one undo step rather than one per intermediate transaction.
+     */
+    beginComposition(selectionBefore?: SelectionMark | null): void;
+    /** Close the composition, recording its entry only if anything actually committed. */
+    endComposition(): void;
+    /**
+     * Cancel an open composition without recording an entry, leaving whatever it committed
+     * in place. An IME cancel is not an undo request; the caller decides what to revert.
+     */
+    cancelComposition(): void;
+    /**
+     * Close the open history group, if any: the next transaction records its own entry.
+     * The store does this itself for another token, none, undo and redo; the package
+     * coordinator does it for history moving ABOVE the store (a package unit, another
+     * story's pointer), which the store cannot see.
+     */
+    closeHistoryGroup(): void;
+    undo(): TreeModelChange | null;
+    redo(): TreeModelChange | null;
+    /** The selection to restore for the entry `undo()` would reverse next. */
+    selectionForUndo(): SelectionMark | null;
+    /** The selection to restore for the entry `redo()` would reapply next. */
+    selectionForRedo(): SelectionMark | null;
+    /**
+     * Remove the newest undo entry and answer its selections, for the package coordinator
+     * when a package history group absorbs the story pointer that entry belonged to.
+     * @internal
+     */
+    discardNewestUndoEntry(): Pick<HistoryEntry, 'selectionBefore' | 'selectionAfter'> | null;
+    private pushUndo;
+    private publish;
 }
-type FragmentPasteResult = (Extract<PackageTransactResult, {
-    ok: true;
-}> & {
-    readonly blockCount: number;
-}) | Extract<PackageTransactResult, {
-    ok: false;
-}>;
+
 /**
- * Read the fragment through the bounded file-open trust boundary, merge its resources,
- * and land its blocks — all inside one transaction. Any refusal leaves the document
- * exactly as it was; the caller (the paste router) degrades to the next flavour.
+ * The identity of one continuous user gesture, for history grouping.
+ *
+ * A live color picker, a font-size stepper or a spacing slider applies every intermediate
+ * value so the document updates under the pointer, and each of those writes is a
+ * transaction in its own right — it must render, and a collaborator must receive it. What
+ * they are NOT is separate undo steps. The caller mints one token when the gesture starts
+ * (`Symbol('color-drag')`) and passes it with every write until the gesture ends.
+ *
+ * A symbol rather than a string, so two unrelated callers cannot collide by naming their
+ * gesture the same way, and so a token cannot outlive its gesture by accident through
+ * serialization.
  */
-declare function applyFragmentPaste(store: TreePackageStore, scope: StoryScope, input: FragmentPasteInput): FragmentPasteResult;
+type HistoryGroup = symbol;
+type HistoryCaptureKind = 'started' | 'extended' | 'split';
+type HistoryCaptureReason = 'package-unit' | 'composition';
+declare function observeHistoryGroup<T>(group: HistoryGroup, report: (kind: HistoryCaptureKind, reason?: HistoryCaptureReason) => void, run: () => T): T;
+declare function reportHistoryGroup(group: HistoryGroup | undefined, kind: HistoryCaptureKind, reason?: HistoryCaptureReason): void;
 
 /** Attribution stamped on one remote canonical publication. */
 interface RemotePackageAttribution {
@@ -1226,13 +1204,7 @@ declare class TreePackageStore {
      * a matching tuple proves the snapshot cannot differ; nothing invalidates explicitly.
      */
     private currentPackageMemo;
-    /**
-     * What the body and every story store open with. `settingsPart` is the SAME live getter for
-     * all of them: a story store is built from a PART, whose synthetic package holds no
-     * `settings.xml`, and a store keeps its own working copy, so a replaced `settings.xml` left one
-     * story reading stale protection. Protection that holds in a header but not the body is worse
-     * than none: it looks enforced. The lock policy reaches every story for the same reason.
-     */
+    /** What the body and every story store open with; see {@link storyStoreOptionsFor}. */
     private storyStoreOptions;
     constructor(pkg: OoxmlPackage, main: OoxmlPart, options?: TreePackageStoreOptions);
     get packageRevision(): number;
@@ -1386,5 +1358,44 @@ declare class TreePackageStore {
     private publishSynthetic;
 }
 
+/** Decoded fragment payloads above this cap are refused before any package work. */
+declare const MAX_FRAGMENT_DECODED_BYTES: number;
+interface FragmentPasteInput {
+    readonly paragraphId: string;
+    readonly offset: number;
+    /** The fragment package zip (from the clipboard codec or the HTML projection). */
+    readonly fragmentBytes: Uint8Array;
+    readonly lastMarkCovered: boolean;
+    /** Ops that clear the current selection first (the surface's deleteSelectionPlan). */
+    readonly priorOps?: readonly TreeDocOp[];
+    /**
+     * Collaboration actor for the ids this paste mints.
+     *
+     * A paste freshens three package-wide namespaces — bookmark `@w:id`, revision `@w:id` and
+     * `wp:docPr/@id` — and the merge reads the actor off the open transaction. Without one, two
+     * replicas pasting the same fragment from one snapshot mint the same numbers, and only the
+     * merged document shows it. Omitted (solo) keeps Word's dense sequences.
+     */
+    readonly actorId?: string;
+    /**
+     * Suggesting mode: the author and date the whole paste is proposed under, as one tracked
+     * insertion (`trackedFragment`). The caller tracks `priorOps` itself.
+     */
+    readonly revision?: RevisionAttributionInput;
+}
+type FragmentPasteResult = (Extract<PackageTransactResult, {
+    ok: true;
+}> & {
+    readonly blockCount: number;
+}) | Extract<PackageTransactResult, {
+    ok: false;
+}>;
+/**
+ * Read the fragment through the bounded file-open trust boundary, merge its resources,
+ * and land its blocks — all inside one transaction. Any refusal leaves the document
+ * exactly as it was; the caller (the paste router) degrades to the next flavour.
+ */
+declare function applyFragmentPaste(store: TreePackageStore, scope: StoryScope, input: FragmentPasteInput): FragmentPasteResult;
+
 export { NOTE_CONTINUATION_SEPARATOR_ID as B, DEFAULT_MAX_EDITABLE_STORY_PARTS as D, NOTE_ID_MAX as G, NOTE_ID_MIN as J, NOTE_SEPARATOR_ID as K, MAX_FRAGMENT_DECODED_BYTES as M, TreePackageStore as T, allocateDrawingPropertyId as a8, allocateNoteId as a9, isNoteNode as aA, isNoteRefNode as aB, isNoteReferenceNode as aC, isSeparatorNode as aD, normalNoteIds as aE, noteAtomText as aF, noteIdOf as aG, noteKindOf as aH, noteRefKindOf as aI, noteReferenceKindOf as aJ, noteTypeOf as aK, notesOf as aL, notesPartHasId as aM, observeHistoryGroup as aN, parentNodeOf as aO, parseNoteId as aP, parseNoteScopeId as aQ, removeNode as aR, replaceChildren as aS, replaceNode as aT, resolveHeaderFooterParts as aU, resolveHeaderFooterPartsBySection as aV, resolveHeaderFooterResolutionBySection as aW, resolveNotesPart as aX, withBinaryPart as aY, withEmbeddedImage as aZ, withoutUnreferencedImagePart as a_, applyEdits as aa, applyFragmentPaste as ab, applyHeaderFooterLifecycleOp as ac, applyNoteLifecycleOp as ad, atomicNoteSpansOf as ae, cascadeDeletedNoteReferences as af, collectNodeIds as ag, collectNoteReferences as ah, collectPackageNoteReferences as ai, collectSectionPropertyNodes as aj, createNodeIdAllocator as ak, createNoteReferenceScanBudget as al, customMarkFollows as am, diagnoseNoteReferences as an, findNode as ao, findNoteById as ap, formatNoteScopeId as aq, hasNode as ar, insertChildren as as, isContinuationSeparatorNode as at, isEndnotesNode as au, isFootnotesNode as av, isHeaderFooterLifecycleOp as aw, isNormalNote as ax, isNoteAtomNode as ay, isNoteLifecycleOp as az, TreeDocumentStore as d, reportHistoryGroup as r, MAX_NOTES_PER_PART as w, MAX_NOTE_REFERENCE_PARTS as x, MAX_NOTE_REFERENCE_SCAN as y, NOTE_ATOM_CHAR as z };
 export type { PackageTransactResult as $, ApplyImagePropertiesInput as A, ContentLockPolicy as C, EditOptions as E, FieldResultsMode as F, HeaderFooterVariant as H, InsertImageInput as I, NoteDiagnostic as L, NoteKind as N, NoteDiagnosticCode as O, NoteLifecycleImpact as P, NoteLifecycleOp as Q, ReplaceImageOptions as R, StoryScope as S, NoteLifecycleOptions as U, NoteLifecycleRejection as V, NoteLifecycleResult as W, NoteReferenceHit as X, NoteReferenceScanBudget as Y, NoteType as Z, OoxmlEditResult as _, StoryTargetRejection as a, RemotePackageAttribution as a0, StoryResolveResult as a1, TransactionRevisionIds as a2, TreeDocumentStoreOptions as a3, TreePackageStoreOptions as a4, TreeStoryRef as a5, TransactResult as a6, TransactionContext as a7, HistoryGroup as b, TreeModelChange as c, HeaderFooterParts as e, HeaderFooterSectionResolution as f, SelectionMark as g, TransactOptions as h, ImageIntentResult as i, FragmentPasteInput as j, FragmentPasteResult as k, AtomicNoteSpan as l, CascadeDeletedNoteReferencesOptions as m, DrawingPropertyIdResult as n, HeaderFooterKind as o, HeaderFooterLifecycleImpact as p, HeaderFooterLifecycleOp as q, HeaderFooterLifecycleRejection as s, HeaderFooterLifecycleResult as t, HeaderFooterSlotMeta as u, HistoryCaptureKind as v };