@docx-editor.dev/core 2.9.2 → 2.10.0

package/dist/{tree-op-types-D1vNJ7XC.d.cts → tree-op-types-DSJYmf5b.d.cts}

@@ -1,5 +1,60 @@
+import { a as OoxmlNode, b as OoxmlElement, r as OoxmlDrawingNode, c as OoxmlPackage, p as OoxmlContentControlNode, q as OoxmlContentControlContentNode, s as OoxmlContentControlEndPropertiesNode, t as OoxmlContentControlPropertiesNode, O as OoxmlPart } from './ooxml-package-CdEy9ufK.cjs';
 import { ParagraphTabStop } from './contracts/types.cjs';
-import { a as OoxmlNode, b as OoxmlElement, r as OoxmlDrawingNode, p as OoxmlContentControlNode, q as OoxmlContentControlContentNode, s as OoxmlContentControlEndPropertiesNode, t as OoxmlContentControlPropertiesNode, O as OoxmlPart } from './ooxml-package-CdEy9ufK.cjs';
+import { a as RevisionAttributionInput, R as RevisionAddress } from './tree-op-revision-attribution-CN06Xshv.cjs';
+
+/**
+ * The engine's trust-boundary caps: recursion depth, element counts, and the rest.
+ *
+ * A caller may LOWER any of these but never raise or disable one — an override of `Infinity`,
+ * zero, a negative or `NaN` clamps into `(0, ceiling]` rather than turning the limit off. These
+ * are security ceilings, not performance budgets.
+ */
+interface ResourceLimits {
+    /** Max nested-structure recursion (tables/shapes/SDT/groups). */
+    readonly maxRecursionDepth: number;
+    /** Max total parsed element count. */
+    readonly maxElementCount: number;
+    /** Max package part count. */
+    readonly maxPartCount: number;
+    /** Max total decompressed bytes (zip-bomb guard). */
+    readonly maxDecompressedBytes: number;
+    /** Max total compressed input bytes. */
+    readonly maxCompressedBytes: number;
+    /** Max decompressed:compressed ratio per entry. */
+    readonly maxCompressionRatio: number;
+    /** In-memory chunk budget for streaming/spooling. */
+    readonly maxChunkBytes: number;
+    /** Max pagination passes before non-convergence is declared. */
+    readonly maxPaginationPasses: number;
+    /** Max queued items in any bounded work queue. */
+    readonly maxQueueDepth: number;
+}
+/** Non-disableable hard ceilings: no resolved limit may exceed these. */
+declare const HARD_CEILINGS: ResourceLimits;
+/** Finite defaults, all <= their hard ceiling. */
+declare const DEFAULT_LIMITS: ResourceLimits;
+/**
+ * Resolve caller overrides into a frozen, always-finite limit set. Each value is
+ * `min(override>0 ? override : default, ceiling)`. Infinity/0/negative/NaN can
+ * never disable a limit — the hard ceiling always wins.
+ */
+declare function resolveLimits(overrides?: Partial<ResourceLimits>): ResourceLimits;
+/** Bounded image decode limits (typed-drawings-and-images task 4). */
+/** Trust-boundary caps specific to image decoding and embedding. */
+interface ImageResourceLimits {
+    readonly maxEncodedBytes: number;
+    readonly maxDecodedBytes: number;
+    readonly maxPixels: number;
+    readonly maxDimension: number;
+    readonly maxPolygonPoints: number;
+    readonly maxExternalRedirects: number;
+}
+/** Image caps nothing can raise past. A caller's override clamps into these. */
+declare const IMAGE_RESOURCE_HARD_CEILINGS: ImageResourceLimits;
+/** The image caps in force when a host configures none. Conservative and finite. */
+declare const DEFAULT_IMAGE_RESOURCE_LIMITS: ImageResourceLimits;
+/** Resolve caller overrides into frozen image limits; hard ceilings cannot be raised. */
+declare function resolveImageResourceLimits(overrides?: Partial<ImageResourceLimits>): ImageResourceLimits;
 
 /** The relationship namespace `r:id` lives in. */
 declare const OFFICE_RELATIONSHIP_NAMESPACE_URI = "http://schemas.openxmlformats.org/officeDocument/2006/relationships";
@@ -328,6 +383,151 @@ declare function projectDrawing(drawing: OoxmlDrawingNode, context: Readonly<{
     resolveRelationship?: RelationshipTargetResolver;
 }>): DrawingProjection | null;
 
+/** Opaque handle — bytes are reachable only through {@link mintValidatedImageBytes}. */
+interface ValidatedImageBytesHandle {
+    readonly registryId: number;
+    readonly resourceKey: string;
+    readonly contentId: string;
+    readonly generation: number;
+}
+
+/**
+ * Raster media the decode port measures and any authoring path may write.
+ *
+ * BMP and WebP are here for the same reason the other three are: an `<img>` decodes them
+ * natively, so they need a signature and a structural header and nothing else. BMP is what
+ * older documents carry; WebP is what current Word writes.
+ */
+type SupportedImageMime = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/bmp' | 'image/webp';
+/**
+ * Vector media painted straight from validated bytes. An `<img>` renders SVG in the
+ * browser's secure static mode — no script, no external subresource loads — so there is
+ * no decode step and no raster buffer sized by a file-supplied number.
+ */
+type VectorImageMime = 'image/svg+xml';
+/** Every mime the painter can hand to an `<img>`. */
+type RenderableImageMime = SupportedImageMime | VectorImageMime;
+/**
+ * Media kept in the package byte-for-byte that the painter cannot hand to an `<img>`.
+ * A decode port may rasterize it; without one it paints as a labelled placeholder.
+ */
+type PreservedImageMime = 'image/tiff' | 'image/x-emf' | 'image/x-wmf';
+/**
+ * What is known about one embedded image: validated, refused, or still decoding.
+ *
+ * Content type is a CLAIM. Signature sniffing, structural header validation and the decode port
+ * are authoritative, and bytes that fail them never enter public state.
+ */
+type ImageResourceState = {
+    readonly kind: 'ready';
+    readonly partName: string;
+    readonly contentId: string;
+    readonly resourceKey: string;
+    readonly validatedHandle: ValidatedImageBytesHandle;
+    readonly mime: RenderableImageMime;
+    readonly pixelWidth: number;
+    readonly pixelHeight: number;
+    readonly dpiX: number;
+    readonly dpiY: number;
+} | {
+    readonly kind: 'unrenderable';
+    readonly partName: string | null;
+    readonly mime: RenderableImageMime | PreservedImageMime | 'unknown';
+    readonly reason: 'unsupported-format' | 'non-picture-graphic' | 'signature-mismatch' | 'decode-failed' | 'resource-limit';
+} | {
+    readonly kind: 'external';
+    readonly relationshipId: string;
+    readonly sinkSafe: boolean;
+} | {
+    readonly kind: 'missing';
+    readonly relationshipId: string;
+} | {
+    readonly kind: 'pending';
+    readonly resourceKey: string;
+};
+/**
+ * The injected image decoder.
+ *
+ * A port rather than a direct `Image`/`createImageBitmap` call, so a worker or server runtime
+ * supplies its own and the engine never reaches for a browser global.
+ */
+interface ImageDecodePort {
+    decode(bytes: Uint8Array, mime: SupportedImageMime, limits: ImageResourceLimits): Promise<Readonly<{
+        pixelWidth: number;
+        pixelHeight: number;
+        dpiX: number;
+        dpiY: number;
+    }>>;
+    /**
+     * Optional conversion of media an `<img>` cannot render (EMF/WMF metafiles, TIFF) into a
+     * renderable raster. The returned bytes are untrusted and re-enter the full raster
+     * validation path (sniff, header, pixel caps, decode) before they can become a ready
+     * resource. A null return declines the format and keeps the labelled placeholder; so does
+     * a throw, as `decode-failed`.
+     */
+    convertPreserved?(bytes: Uint8Array, mime: PreservedImageMime, limits: ImageResourceLimits): Promise<Readonly<{
+        bytes: Uint8Array;
+        mime: SupportedImageMime;
+    }> | null>;
+}
+/** Resolves a relationship id to a validated image resource, or reports why it could not. */
+interface ImageResourceLookup {
+    readonly resolveEmbedded: (ownerPartName: string, relationshipId: string) => Promise<ImageResourceState>;
+    readonly resolveLinked: (ownerPartName: string, relationshipId: string) => ImageResourceState;
+    readonly resolveForProjection: (projection: DrawingProjection) => Promise<ImageResourceState>;
+    readonly liveReferenceCount: (partName: string) => number;
+    readonly dispose: () => void;
+}
+/** Maximum prefix inspected for SVG root detection (exported for bounded-scan tests). */
+declare const MAX_SVG_SNIFF_BYTES = 512;
+/** A raster header that passed structural validation: its real MIME type and pixel extent. */
+interface ValidatedRasterHeader {
+    readonly pixelWidth: number;
+    readonly pixelHeight: number;
+}
+/** Bounded scan for an `<svg` document root (optional `<?xml` prolog only). */
+declare function hasBoundedSvgRoot(bytes: Uint8Array): boolean;
+/** Signature sniffing — authoritative over declared content type. */
+declare function sniffImageMime(bytes: Uint8Array): RenderableImageMime | PreservedImageMime | 'unknown';
+/** Structural PNG IHDR validation before decode. */
+declare function validatePngHeader(bytes: Uint8Array): ValidatedRasterHeader | null;
+/** Structural GIF logical screen descriptor validation before decode. */
+declare function validateGifHeader(bytes: Uint8Array): ValidatedRasterHeader | null;
+/** Bounded JPEG marker scan through the first supported SOF marker. */
+declare function validateJpegHeader(bytes: Uint8Array): ValidatedRasterHeader | null;
+/**
+ * Intrinsic size of an SVG, resolved the way a browser sizes one: absolute `width`/`height`
+ * first, then `viewBox` for the missing axis or ratio, then the CSS 300x150 default.
+ *
+ * This is metadata for insert and reset-to-natural-size only. Layout uses the authored
+ * `wp:extent` and the browser rasterizes into that box, so nothing here sizes an allocation
+ * and an out-of-range value is clamped rather than refused.
+ */
+declare function resolveSvgIntrinsicSize(bytes: Uint8Array, limits: ImageResourceLimits): ValidatedRasterHeader | null;
+/**
+ * Validate a raster image's header structurally and report its real MIME type and extent.
+ *
+ * Content type is a CLAIM; this is what makes it a fact. A file declaring `image/png` over JPEG
+ * bytes is caught here rather than at decode.
+ */
+declare function validateRasterHeader(bytes: Uint8Array, mime: SupportedImageMime): ValidatedRasterHeader | null;
+/** Package-wide live drawing references to a media part name. */
+declare function liveDrawingReferenceCount(pkg: OoxmlPackage, partName: string): number;
+/** How the image cache decodes, and what it will spend doing so. */
+interface CreateImageResourceCacheOptions {
+    readonly limits?: Partial<ImageResourceLimits>;
+    readonly decodePort: ImageDecodePort;
+}
+/**
+ * Derived cache for one immutable package snapshot. Registry identity is
+ * `(package snapshot, decodePort object, normalized limits)` — the first caller
+ * never imposes its decoder or limits on later callers with different options.
+ */
+declare function imageResourceLookupFor(pkg: OoxmlPackage, options: CreateImageResourceCacheOptions): ImageResourceLookup;
+/** @deprecated Prefer {@link imageResourceLookupFor} — registry binds cache to package identity. */
+/** Build the per-document image cache. Validated bytes only; refusals are remembered too. */
+declare function createImageResourceCache(initialPkg: OoxmlPackage, options: CreateImageResourceCacheOptions): ImageResourceLookup;
+
 /** How deep controls may nest before a walk stops descending. Shared by every lane. */
 declare const MAX_CONTENT_CONTROL_NESTING = 32;
 /** Cap on controls one walk reports, so a hostile file cannot make a read unbounded. */
@@ -649,32 +849,7 @@ interface OoxmlProperty {
     readonly localName: string;
     readonly attributes?: Readonly<Record<string, string>>;
 }
-/**
- * The identity of one revision WITHIN a part: `@w:id`, `@w:author` and `@w:date` together.
- *
- * `@w:id` is not unique and not author-scoped, so `(part, id)` alone would merge two authors'
- * distinct revisions; and one logical revision — a tracked row insertion — is deliberately
- * many elements sharing an id, which a uniqueness rule could not express at all.
- */
-/**
- * How a tracked change is addressed: its numeric id plus the PART it lives in.
- *
- * Both, always — `@w:id` is unique only within a part, so an id alone names two revisions in any
- * package with a header or a comments part.
- */
-interface RevisionAddress {
-    readonly id: string;
-    readonly author: string;
-    /** Absent when the file wrote no `@w:date`; part of the identity either way. */
-    readonly date?: string;
-}
-/** Who a tracked edit is attributed to. `CT_TrackChange` requires an author. */
-/** The author and timestamp a tracked edit is recorded under. */
-interface RevisionAttributionInput {
-    readonly author: string;
-    /** ISO-8601. Omitted writes no `@w:date`. */
-    readonly date?: string;
-}
+
 /**
  * Every mutation the store accepts, as one JSON-safe discriminated union.
  *
@@ -877,6 +1052,8 @@ type TreeDocOp = {
     readonly op: 'setParagraphMarkProperties';
     readonly paragraphId: string;
     readonly properties: readonly OoxmlProperty[];
+    /** Record this as a TRACKED format change (`w:pPr/w:rPr/w:rPrChange`, §17.13.5.31). */
+    readonly revision?: RevisionAttributionInput;
 } | {
     readonly op: 'setListNumbering';
     readonly paragraphId: string;
@@ -909,6 +1086,16 @@ type TreeDocOp = {
     readonly op: 'splitParagraph';
     readonly paragraphId: string;
     readonly offset: number;
+    /**
+     * The `w:pStyle` the MINTED tail takes, instead of the head's own.
+     *
+     * A split otherwise clones the whole `w:pPr`, which is right for every property but
+     * the style when the caller is an Enter at the end of a paragraph: Word gives that
+     * new paragraph the style's `w:next`, so a heading is followed by body text rather
+     * than by a second heading. `null` authors no `w:pStyle` at all, which is what the
+     * document's default style is spelled as. Omit to clone the head's style unchanged.
+     */
+    readonly tailStyleId?: string | null;
 } | {
     /**
      * Split one `w:p` at MANY offsets in a single op.
@@ -944,6 +1131,11 @@ type TreeDocOp = {
     readonly start: number;
     readonly end: number;
     readonly properties: readonly OoxmlProperty[];
+    /**
+     * Record this as a TRACKED format change: each run keeps its new `w:rPr` and gains a
+     * `w:rPrChange` (§17.13.5.30) holding the properties it had, so Reject restores them.
+     */
+    readonly revision?: RevisionAttributionInput;
     /**
      * When set, format only these runs (field result ownership). Offset range still
      * gates the edit and drives edge splits; without this, multi-run field results that
@@ -954,6 +1146,8 @@ type TreeDocOp = {
     readonly op: 'setParagraphProperties';
     readonly paragraphId: string;
     readonly properties: readonly OoxmlProperty[];
+    /** Record this as a TRACKED format change (`w:pPrChange`, §17.13.5.29). */
+    readonly revision?: RevisionAttributionInput;
 } | {
     /**
      * Set page-setup fields — page size, orientation, margins — on every targeted
@@ -983,11 +1177,20 @@ type TreeDocOp = {
     /**
      * End a section AT this paragraph: mint a `w:pPr/w:sectPr` cloning the governing
      * section's effective page setup, so the blocks up to and including this paragraph
-     * become their own section (a next-page section break). The paragraph must not
-     * already carry one.
+     * become their own section. The paragraph must not already carry one.
      */
     readonly op: 'setSectionMark';
     readonly paragraphId: string;
+    /**
+     * Where the section that STARTS after this mark begins — Word's Breaks menu.
+     *
+     * `w:type` states how a section starts relative to the previous one (§17.6.22), so it
+     * is written on the section FOLLOWING the mark, never on the minted one, which keeps
+     * the cloned type because it starts where the section it was cut from did. `'nextPage'`
+     * clears `w:type` (absent IS nextPage), so a next-page break inside a continuous
+     * section really starts a page. Omitted leaves the following section untouched.
+     */
+    readonly breakType?: 'nextPage' | 'continuous';
 } | {
     /**
      * Wrap `[start, end)` of a paragraph in a `w:hyperlink`.
@@ -1366,11 +1569,29 @@ type TreeDocOp = {
         readonly position?: string;
         readonly numStart?: number;
     };
+} | {
+    /**
+     * Insert clipboard-fragment blocks at a paragraph position, atomically.
+     *
+     * Blocks only — resources (styles, numbering, media, rels, note parts) merge through
+     * the package-edit path in the same transaction, and the whole commit is promoted to
+     * a package undo unit. A merged edge paragraph takes the properties of the paragraph
+     * mark that ends it: the fragment's first mark leading, the host's original mark
+     * trailing. Nodes receive fresh ids at apply.
+     */
+    readonly op: 'insertFragment';
+    readonly paragraphId: string;
+    readonly offset: number;
+    readonly blocks: readonly OoxmlNode[];
+    /** True when the fragment's last paragraph mark travelled (its paragraph stays whole). */
+    readonly lastMarkCovered?: boolean;
 } | {
     readonly op: 'insertDrawing';
     readonly paragraphId: string;
     readonly offset: number;
     readonly drawing: OoxmlDrawingNode;
+    /** Present in suggesting mode: the drawing's run goes into a `w:ins` as one proposal. */
+    readonly revision?: RevisionAttributionInput;
 } | {
     readonly op: 'replaceDrawingResource';
     readonly drawingNodeId: string;
@@ -1451,7 +1672,7 @@ type DrawingTreeDocOp = Extract<TreeDocOp, {
 /** Just the `op` discriminants, for dispatch tables and validation. */
 type TreeDocOpKind = TreeDocOp['op'];
 /** Every {@link TreeDocOpKind}, for validation and exhaustiveness checks. */
-declare const TREE_DOC_OP_KINDS: readonly ["replaceStoryBlocks", "insertText", "deleteText", "setParagraphMarkRevision", "proposeParagraphMerge", "insertCommentMarker", "acceptRevision", "rejectRevision", "acceptAllRevisions", "rejectAllRevisions", "insertTab", "insertHardBreak", "insertPageBreak", "insertPageField", "setListLevel", "setListNumbering", "setParagraphTabStops", "setParagraphMarkProperties", "splitParagraph", "splitParagraphMany", "joinParagraphs", "setRunProperties", "setParagraphProperties", "setSectionProperties", "setSectionMark", "insertHyperlink", "setHyperlinkTarget", "removeHyperlink", "setMathEquation", "removeMathEquation", "setContentControlValue", "removeContentControl", "insertInlineContentControl", "addRepeatingSectionItem", "removeRepeatingSectionItem", "deleteBlock", "insertTable", "insertTableRow", "deleteTableRow", "insertTableColumn", "deleteTableColumn", "setTableColumnWidths", "setTableRightEdgeWidth", "setTableRowHeight", "setTableCellBorders", "setTableCellFill", "setTableCellVerticalAlignment", "createHeaderFooter", "deleteHeaderFooter", "linkToPrevious", "unlinkFromPrevious", "setSectionFurnitureOptions", "insertNote", "deleteNote", "convertNote", "convertAllNotes", "setNoteProperties", "setContentControlProperties", "insertContentControl", "insertDrawing", "replaceDrawingResource", "deleteDrawing", "resizeDrawing", "cropDrawing", "positionDrawing", "setDrawingWrap", "setDrawingMetadata", "setDrawingLocks", "transformDrawing", "insertToc", "replaceTocResult", "rewriteTocPageNumbers"];
+declare const TREE_DOC_OP_KINDS: readonly ["replaceStoryBlocks", "insertText", "deleteText", "setParagraphMarkRevision", "proposeParagraphMerge", "insertCommentMarker", "acceptRevision", "rejectRevision", "acceptAllRevisions", "rejectAllRevisions", "insertTab", "insertHardBreak", "insertPageBreak", "insertPageField", "setListLevel", "setListNumbering", "setParagraphTabStops", "setParagraphMarkProperties", "splitParagraph", "splitParagraphMany", "joinParagraphs", "setRunProperties", "setParagraphProperties", "setSectionProperties", "setSectionMark", "insertHyperlink", "setHyperlinkTarget", "removeHyperlink", "setMathEquation", "removeMathEquation", "setContentControlValue", "removeContentControl", "insertInlineContentControl", "addRepeatingSectionItem", "removeRepeatingSectionItem", "deleteBlock", "insertTable", "insertTableRow", "deleteTableRow", "insertTableColumn", "deleteTableColumn", "setTableColumnWidths", "setTableRightEdgeWidth", "setTableRowHeight", "setTableCellBorders", "setTableCellFill", "setTableCellVerticalAlignment", "createHeaderFooter", "deleteHeaderFooter", "linkToPrevious", "unlinkFromPrevious", "setSectionFurnitureOptions", "insertNote", "deleteNote", "convertNote", "convertAllNotes", "setNoteProperties", "setContentControlProperties", "insertContentControl", "insertFragment", "insertDrawing", "replaceDrawingResource", "deleteDrawing", "resizeDrawing", "cropDrawing", "positionDrawing", "setDrawingWrap", "setDrawingMetadata", "setDrawingLocks", "transformDrawing", "insertToc", "replaceTocResult", "rewriteTocPageNumbers"];
 /**
  * How far a committed op can reach, so layout can scope its work (task 5.2).
  *
@@ -1574,7 +1795,13 @@ type TreeOpRejection = 'unknown-op' | 'unknown-paragraph' | 'not-a-paragraph' |
 /** Suggesting-mode drawing deletion is not implemented in this change. */
  | 'trackedDrawingDeletionUnsupported'
 /** Hyperlink target creation or change needs an OPC relationship in a package transaction. */
- | 'packageTransactionRequired';
+ | 'packageTransactionRequired'
+/** A clipboard fragment block nests deeper than the recursion cap. */
+ | 'fragment-too-deep'
+/** A clipboard fragment block is not a paragraph, table, or content control subtree. */
+ | 'fragment-invalid-block'
+/** A clipboard fragment exceeds its block or node budget. */
+ | 'fragment-resource-budget';
 /** Whether an op applied, with the effect it produced or the reason it was refused. */
 type TreeOpResult = {
     readonly ok: true;
@@ -1586,4 +1813,4 @@ type TreeOpResult = {
     readonly detail?: string;
 };
 
-export { contentControlPropertiesNodeOf as $, ACCEPTED_PARAGRAPH_PROPERTIES as A, type ContentControlProperties as B, type ContentControlKind as C, type DrawingProjection as D, type HyperlinkKind as E, type HyperlinkTarget as F, MAX_CONTENT_CONTROL_NESTING as G, HYPERLINK_RELATIONSHIP_TYPE as H, type ImpactClass as I, OFFICE_RELATIONSHIP_NAMESPACE_URI as J, type RelationshipTargetResolver as K, TABLE_BORDER_STYLES as L, MAX_CONTENT_CONTROLS_PER_PART as M, TREE_DOC_OP_KINDS as N, type OoxmlProperty as O, type TabStopWrite as P, type TreeDocOpKind as Q, type RevisionAddress as R, type SourceCrop as S, type TreeDocOp as T, type TreeOpEffect as U, type VectorShapeProjection as V, allocateContentControlId as W, contentControlContentChildren as X, contentControlContentNodeOf as Y, contentControlEndPropertiesNodeOf as Z, contentControlLevelOf as _, type TreeOpRejection as a, contentControlPropertiesOf as a0, contentControlTextOf as a1, contentControlsIn as a2, findContentControl as a3, flattenContentControls as a4, hyperlinkAnchorOf as a5, hyperlinkRelationshipIdOf as a6, hyperlinkTargetOf as a7, isContentControlContentNode as a8, isContentControlNode as a9, isContentControlWrapper as aa, isHyperlinkNode as ab, lockForbidsEdit as ac, lockForbidsRemoval as ad, orderedContentControlProperties as ae, parseContentControlId as af, projectDrawing as ag, resolveContentControlLock as ah, type ImageWrapTarget as b, type DrawingKind as c, type DrawingPositionInput as d, type DrawingLocks as e, type DrawingHorizontalReferenceFrame as f, type DrawingVerticalReferenceFrame as g, type RevisionAttributionInput as h, type DrawingTreeDocOp as i, type TreeDocColorValue as j, IMAGE_WRAP_TARGETS as k, type DrawingAccessibility as l, type DrawingTransform as m, type TableBorderStyle as n, type ContentControlLevel as o, type ContentControlLock as p, type ContentControlDataBinding as q, type TreeOpResult as r, ACCEPTED_RUN_PROPERTIES as s, CONTENT_CONTROL_ID_MAX as t, CONTENT_CONTROL_PROPERTY_ORDER as u, type ContentControlCheckbox as v, type ContentControlCheckboxState as w, type ContentControlDateFormat as x, type ContentControlEntry as y, type ContentControlListItem as z };
+export { type HyperlinkTarget as $, type ContentControlDataBinding as A, type ResourceLimits as B, type ContentControlKind as C, type DrawingKind as D, type TreeOpResult as E, ACCEPTED_PARAGRAPH_PROPERTIES as F, ACCEPTED_RUN_PROPERTIES as G, CONTENT_CONTROL_ID_MAX as H, type ImpactClass as I, CONTENT_CONTROL_PROPERTY_ORDER as J, type ContentControlCheckbox as K, type ContentControlCheckboxState as L, type ContentControlDateFormat as M, type ContentControlEntry as N, type OoxmlProperty as O, type PreservedImageMime as P, type ContentControlListItem as Q, type RenderableImageMime as R, type SourceCrop as S, type TreeDocOp as T, type ContentControlProperties as U, type ValidatedImageBytesHandle as V, type CreateImageResourceCacheOptions as W, DEFAULT_LIMITS as X, HARD_CEILINGS as Y, HYPERLINK_RELATIONSHIP_TYPE as Z, type HyperlinkKind as _, type TreeOpRejection as a, IMAGE_RESOURCE_HARD_CEILINGS as a0, type ImageResourceLookup as a1, MAX_CONTENT_CONTROLS_PER_PART as a2, MAX_CONTENT_CONTROL_NESTING as a3, MAX_SVG_SNIFF_BYTES as a4, OFFICE_RELATIONSHIP_NAMESPACE_URI as a5, type RelationshipTargetResolver as a6, TABLE_BORDER_STYLES as a7, TREE_DOC_OP_KINDS as a8, type TabStopWrite as a9, lockForbidsRemoval as aA, orderedContentControlProperties as aB, parseContentControlId as aC, projectDrawing as aD, resolveContentControlLock as aE, resolveLimits as aF, validateGifHeader as aG, validateJpegHeader as aH, validatePngHeader as aI, type TreeDocOpKind as aa, type TreeOpEffect as ab, type ValidatedRasterHeader as ac, allocateContentControlId as ad, contentControlContentChildren as ae, contentControlContentNodeOf as af, contentControlEndPropertiesNodeOf as ag, contentControlLevelOf as ah, contentControlPropertiesNodeOf as ai, contentControlPropertiesOf as aj, contentControlTextOf as ak, contentControlsIn as al, createImageResourceCache as am, findContentControl as an, flattenContentControls as ao, hasBoundedSvgRoot as ap, hyperlinkAnchorOf as aq, hyperlinkRelationshipIdOf as ar, hyperlinkTargetOf as as, imageResourceLookupFor as at, isContentControlContentNode as au, isContentControlNode as av, isContentControlWrapper as aw, isHyperlinkNode as ax, liveDrawingReferenceCount as ay, lockForbidsEdit as az, type ImageWrapTarget as b, type SupportedImageMime as c, type DrawingPositionInput as d, type DrawingLocks as e, type ImageResourceState as f, type DrawingHorizontalReferenceFrame as g, type DrawingVerticalReferenceFrame as h, type VectorImageMime as i, type ImageDecodePort as j, type DrawingTreeDocOp as k, type TreeDocColorValue as l, DEFAULT_IMAGE_RESOURCE_LIMITS as m, IMAGE_WRAP_TARGETS as n, type ImageResourceLimits as o, resolveSvgIntrinsicSize as p, type DrawingAccessibility as q, resolveImageResourceLimits as r, sniffImageMime as s, type DrawingTransform as t, type VectorShapeProjection as u, validateRasterHeader as v, type DrawingProjection as w, type TableBorderStyle as x, type ContentControlLevel as y, type ContentControlLock as z };

package/dist/{tree-session-Df02ajqc.d.cts → tree-session-contract-ByWx8eew.d.cts}

@@ -1,12 +1,11 @@
-import { S as SupportedImageMime, b as ImageDecodePort } from './image-resources-BiA-IXgo.cjs';
-import { S as StoryScope, a as StoryTargetRejection, D as DocumentTrackingSettings, I as InsertCustomNodeWrite, C as CustomNodeWriteResult, b as CustomNodeSweepOutcome, E as EmbeddedFont, B as BookmarkIndex, L as ListKind, c as InsertImageInput, d as ImageIntentResult, R as ReplaceImageOptions, A as ApplyImagePropertiesInput } from './custom-node-writes-Dy3b20PS.cjs';
-import { Node } from 'prosemirror-model';
-import { O as OoxmlPart, a as OoxmlNode, c as OoxmlPackage, b as OoxmlElement, o as OoxmlPackageRejection } from './ooxml-package-CdEy9ufK.cjs';
+import { S as StoryScope, a as StoryTargetRejection, D as DocumentTrackingSettings, I as InsertCustomNodeWrite, C as CustomNodeWriteResult, b as CustomNodeSweepOutcome, E as EmbeddedFont, B as BookmarkIndex, L as ListKind, c as InsertImageInput, d as ImageIntentResult, R as ReplaceImageOptions, A as ApplyImagePropertiesInput, F as FragmentPasteInput, e as FragmentPasteResult } from './custom-node-writes-Db8H6Z3n.cjs';
+import { T as TreeDocOp, c as SupportedImageMime, j as ImageDecodePort } from './tree-op-types-DSJYmf5b.cjs';
+import { O as OoxmlPart, a as OoxmlNode, c as OoxmlPackage, b as OoxmlElement } from './ooxml-package-CdEy9ufK.cjs';
 import { a as HeaderFooterParts, b as HeaderFooterSectionResolution } from './hf-references-Dvk6De4Q.cjs';
-import { T as TreeDocOp } from './tree-op-types-D1vNJ7XC.cjs';
-import { S as SelectionMark, T as TreeModelChange, D as DocumentProperties } from './tree-store-B_sJBMIS.cjs';
-import { a as ReviewItem } from './review-items-B8tffIXj.cjs';
-import { ReviewModuleContribution } from './contracts/modules.cjs';
+import { S as SelectionMark, T as TreeModelChange, D as DocumentProperties } from './tree-store-CWOUMGN8.cjs';
+import { a as ReviewItem } from './review-items-CwixiHNe.cjs';
+import { Node } from 'prosemirror-model';
+import { a as RevisionAttributionInput } from './tree-op-revision-attribution-CN06Xshv.cjs';
 
 /**
  * Why an edited projection could not be mapped back into tree ops.
@@ -91,6 +90,27 @@ interface DocumentStyleEntry {
     readonly preview: DocumentStylePreview;
 }
 
+/**
+ * The scheme slots the picker shows, in Word's column order.
+ *
+ * Assumes the default `w:clrSchemeMapping` (bg1→lt1, t1→dk1, ...); a settings part
+ * that remaps them is rare and a follow-up.
+ */
+declare const PICKER_SLOTS: readonly ["lt1", "dk1", "lt2", "dk2", "accent1", "accent2", "accent3", "accent4", "accent5", "accent6"];
+type ThemeColorSlot = (typeof PICKER_SLOTS)[number];
+/** One theme colour: the scheme slot and its resolved six-digit hex (no '#'). */
+interface DocumentThemeColorEntry {
+    readonly slot: ThemeColorSlot;
+    readonly hex: string;
+}
+/** The theme's two font slots, for resolving `w:rFonts` theme attributes. */
+interface DocumentThemeFonts {
+    /** `a:majorFont` latin typeface — headings. */
+    readonly major: string | null;
+    /** `a:minorFont` latin typeface — body text. */
+    readonly minor: string | null;
+}
+
 /** One heading of the outline, in document order. `level` is 0-based (Heading 1 = 0). */
 interface DocumentOutlineEntry {
     /** The paragraph's text, control characters flattened, bounded to 200 characters. */
@@ -142,38 +162,6 @@ interface DocumentSearchResult {
     readonly truncated: boolean;
 }
 
-/**
- * The scheme slots the picker shows, in Word's column order.
- *
- * Assumes the default `w:clrSchemeMapping` (bg1→lt1, t1→dk1, ...); a settings part
- * that remaps them is rare and a follow-up.
- */
-declare const PICKER_SLOTS: readonly ["lt1", "dk1", "lt2", "dk2", "accent1", "accent2", "accent3", "accent4", "accent5", "accent6"];
-type ThemeColorSlot = (typeof PICKER_SLOTS)[number];
-/** One theme colour: the scheme slot and its resolved six-digit hex (no '#'). */
-interface DocumentThemeColorEntry {
-    readonly slot: ThemeColorSlot;
-    readonly hex: string;
-}
-/** The theme's two font slots, for resolving `w:rFonts` theme attributes. */
-interface DocumentThemeFonts {
-    /** `a:majorFont` latin typeface — headings. */
-    readonly major: string | null;
-    /** `a:minorFont` latin typeface — body text. */
-    readonly minor: string | null;
-}
-
-/** What a run inherits at one point of the chain — null means "nothing authored". */
-interface StyleRunDefaults {
-    readonly fontFamily: string | null;
-    readonly fontSizeHalfPoints: number | null;
-}
-/** One run property as the layout records carry it (structurally SurfaceProperty). */
-interface RunPropertyLike {
-    readonly localName: string;
-    readonly attributes?: Record<string, string>;
-}
-
 interface ParagraphAnchorIndex {
     /** nodeId → `w14:paraId`, verbatim as authored/minted. Paragraphs without one are absent. */
     readonly paraIdByNode: ReadonlyMap<string, string>;
@@ -209,6 +197,17 @@ interface ParagraphAnchorIndex {
     readonly claimantsByParaId: ReadonlyMap<string, readonly string[]>;
 }
 
+/** What a run inherits at one point of the chain — null means "nothing authored". */
+interface StyleRunDefaults {
+    readonly fontFamily: string | null;
+    readonly fontSizeHalfPoints: number | null;
+}
+/** One run property as the layout records carry it (structurally SurfaceProperty). */
+interface RunPropertyLike {
+    readonly localName: string;
+    readonly attributes?: Record<string, string>;
+}
+
 /**
  * What applying ops produced: whether it committed, and why not when it did not.
  *
@@ -570,71 +569,12 @@ interface TreeDocxSessionView {
     replaceImage(scope: StoryScope, drawingNodeId: string, bytes: Uint8Array, mime: SupportedImageMime, decodePort: ImageDecodePort, options: ReplaceImageOptions): Promise<ImageIntentResult>;
     /** Delete a picture drawing and collect orphaned media in one package undo unit. */
     deleteImage(scope: StoryScope, drawingNodeId: string): ImageIntentResult;
+    /** Propose the drawing's deletion as a tracked change (`w:del`); media stays untouched. */
+    deleteImageTracked(scope: StoryScope, drawingNodeId: string, revision: RevisionAttributionInput): ImageIntentResult;
     /** Apply image property tree ops plus hyperlink relationship wiring atomically. */
     applyImageProperties(scope: StoryScope, input: ApplyImagePropertiesInput): ImageIntentResult;
+    /** Land a clipboard fragment (resource merge + blocks) as one package undo unit. */
+    applyFragmentPaste(scope: StoryScope, input: FragmentPasteInput): FragmentPasteResult;
 }
-/**
- * Binding-only session methods that exchange ProseMirror projections.
- *
- * Editor surfaces expose {@link TreeDocxSessionView}. Only the binding lane sees this extension.
- */
-interface TreeDocxSession extends TreeDocxSessionView {
-    /** Project the current BODY revision into a ProseMirror doc. */
-    projectDoc(): Node;
-    /** Re-project incrementally from the last committed change, reusing untouched paragraphs. */
-    reconcile(previousDoc: Node): Node;
-    /**
-     * Whether the last commit changed the BLOCK SEQUENCE (a split, join, insert or delete).
-     *
-     * A host needs this to decide whether the view must be re-projected at all. After a pure
-     * text edit, the view already holds what the model holds. Re-projecting wastes work and
-     * races the next keystroke.
-     */
-    lastCommitWasStructural(): boolean;
-    /** Map an edited BODY doc to tree ops and commit them as one transaction. */
-    applyPmDoc(doc: Node): TreeApplyResult;
-}
-
-/**
- * Why bytes could not be opened: any bounded-reader rejection, plus the package that parsed but
- * carried no main document tree.
- */
-type TreeSessionRejection = OoxmlPackageRejection | 'no-main-document-tree';
-/**
- * An open session, or a typed refusal.
- *
- * A result rather than a throw: every failure here is a property of the FILE, and a host needs to
- * tell "this is not a package" from "this package is malicious" from "this document has no body".
- */
-type OpenTreeSessionResult = {
-    readonly ok: true;
-    readonly session: TreeDocxSession;
-} | {
-    readonly ok: false;
-    readonly reason: TreeSessionRejection;
-    readonly detail?: string;
-};
-interface OpenTreeSessionOptions {
-    /**
-     * The review module's derivation hooks, contributed through the editor's
-     * `EditorModule` seam. Absent — the free engine — the session's
-     * `reviewItems()` reports the typed empty queue; parse, preservation, and
-     * `hasReviewContent` are unaffected.
-     */
-    readonly reviewModel?: ReviewModuleContribution;
-}
-/**
- * Open DOCX bytes into a tree-backed session.
- *
- * Returns a typed rejection rather than throwing: every failure here is a property of the FILE,
- * and a host needs to tell "this is not a package" from "this package is malicious" from "this
- * document has no body".
- *
- * The read is BOUNDED — decompression ratio, part count, XML depth and element counts are all
- * capped — because the bytes are untrusted by definition.
- */
-declare function openTreeSession(bytes: Uint8Array, options?: OpenTreeSessionOptions): OpenTreeSessionResult;
-/** The origin a host should use when committing a reconciliation rather than a user edit. */
-declare const PROJECTION_ORIGIN: "dev.docx-editor.core.origin.projection";
 
-export { type DocumentStyleEntry as D, type MapResult as M, type OpenTreeSessionResult as O, PROJECTION_ORIGIN as P, type TreeDocxSession as T, type TreeApplyResult as a, type TreeBindingRejection as b, type TreeDocxSessionView as c, type TreeSessionRejection as d, bodyParagraphs as e, docToTreeOps as f, type DocumentThemeColorEntry as g, openTreeSession as o, partHasNode as p, reconcileDoc as r, treeToDoc as t };
+export { type DocumentStyleEntry as D, type MapResult as M, type TreeDocxSessionView as T, type TreeApplyResult as a, type TreeBindingRejection as b, bodyParagraphs as c, docToTreeOps as d, type DocumentThemeColorEntry as e, partHasNode as p, reconcileDoc as r, treeToDoc as t };