@docx-editor.dev/core 2.9.2 → 2.11.0

package/dist/{custom-node-writes-D6SGwebL.d.ts → tree-package-fragment-BjZ3RWAS.d.cts}

@@ -1,9 +1,5 @@
-import { c as OoxmlPackage, O as OoxmlPart, a as OoxmlNode } from './ooxml-package-CdEy9ufK.js';
-import { S as SupportedImageMime, b as ImageDecodePort } from './image-resources-BgA9EQxY.js';
-import { h as RevisionAttributionInput, i as DrawingTreeDocOp, a as TreeOpRejection, T as TreeDocOp } from './tree-op-types-CnRb7AYo.js';
-import { c as HeaderFooterKind, H as HeaderFooterVariant } from './hf-references-z5Y4N1ab.js';
-import { N as NoteKind } from './note-nodes-BNCANoGN.js';
-import { T as TreeModelChange, a as TreeStoryRef, b as TreeDocumentStore, c as TransactionContext, d as TransactOptions, S as SelectionMark, e as TreeDocumentCheckpoint } from './tree-store-DgETo6Mf.js';
+import { b as OoxmlPackage, y as SupportedImageMime, O as OoxmlPart, a as OoxmlNode, g as OoxmlElement, E as RevisionAttributionInput, C as ImageDecodePort, F as DrawingTreeDocOp, r as TreeOpRejection, T as TreeDocOp } from './tree-op-types-BPyXNxyL.cjs';
+import { N as NoteKind, T as TreeModelChange, a as TreeDocumentStore, c as TreeStoryRef, d as TransactionContext, b as TransactOptions, S as SelectionMark, e as TreeDocumentCheckpoint } from './tree-store-DfZi7FqY.cjs';
 
 /** A freshly allocated drawing property id, or the reason one could not be minted. */
 type DrawingPropertyIdResult = {
@@ -18,8 +14,13 @@ type DrawingPropertyIdResult = {
  *
  * Package-wide rather than per-part: Word treats these ids as document-global, and a collision
  * makes it renumber on open.
+ *
+ * Solo: `highest + 1`, the dense sequence Word writes. With a collaboration actor bound —
+ * explicit argument, or the open store transaction — the id is the next unused value in that
+ * actor's stripe. Two peers inserting a picture from one snapshot otherwise both mint `id="1"`,
+ * and the merged document carries two drawings under one document-global id.
  */
-declare function allocateDrawingPropertyId(pkg: OoxmlPackage): DrawingPropertyIdResult;
+declare function allocateDrawingPropertyId(pkg: OoxmlPackage, actorId?: string): DrawingPropertyIdResult;
 /**
  * Store raw bytes for a part and declare its exact content type.
  *
@@ -62,103 +63,72 @@ interface ExternalImageFetchPort {
     }>>;
 }
 
-/** Which of a family's four faces an embedded font relationship supplies. */
-type FontStyleKey = 'regular' | 'bold' | 'italic' | 'boldItalic';
+/** `w:headerReference w:type` vocabulary (ECMA-376 §17.10.5): default, first page, even pages. */
+type HeaderFooterVariant = 'default' | 'first' | 'even';
+/** Header vs footer region kind for chrome and lifecycle ops. */
+type HeaderFooterKind = 'header' | 'footer';
+/**
+ * A section's resolved header and footer parts, by variant.
+ *
+ * The `even` variant is only honoured when `w:evenAndOddHeaders` is set in settings.xml —
+ * without it Word ignores an authored even header, and so does this.
+ */
+interface HeaderFooterParts {
+    readonly headers: ReadonlyMap<HeaderFooterVariant, OoxmlPart>;
+    readonly footers: ReadonlyMap<HeaderFooterVariant, OoxmlPart>;
+    /** `w:evenAndOddHeaders` in settings.xml — without it the `even` variant is ignored. */
+    readonly evenAndOddHeaders: boolean;
+    /** Whether this section enables first-page header/footer furniture (`w:titlePg`). */
+    readonly titlePage: boolean;
+}
 /**
- * One font whose bytes travel inside the package.
+ * One resolved furniture slot with enough metadata for "Same as previous" chrome.
  *
- * The family name is the DOCUMENT's and is not validated — it is attacker-controlled, so it is
- * escaped into CSS and never registered globally on `document.fonts`, where it would shadow the
- * host application's own fonts.
+ * `inherited: true` means this section has no declared reference for the slot and the
+ * part comes from a predecessor. The first section never reports inherited — omitting a
+ * ref there is blank furniture, not inheritance from a later section.
  */
-interface EmbeddedFont {
-    /** The family as the document names it. Not validated against anything. */
-    readonly family: string;
-    readonly style: FontStyleKey;
-    /** Deobfuscated bytes, ready to be offered to a font validator. */
-    readonly bytes: Uint8Array;
-    /** The part they came from, for diagnostics. */
+interface HeaderFooterSlotMeta {
+    readonly part: OoxmlPart;
     readonly partName: string;
+    readonly rId: string;
+    readonly inherited: boolean;
 }
-/**
- * Undo Word's embedded-font obfuscation (ECMA-376 Part 4 §2.8.1).
- *
- * The key is the `w:fontKey` GUID's 16 bytes in REVERSED order — not the per-group
- * little-endian reading a GUID usually gets. It is XORed over the first 32 bytes of the
- * part, applied twice. Getting the order wrong produces a font that looks corrupt rather
- * than obfuscated, which is indistinguishable from a damaged file at the point it fails.
- *
- * Pure XOR, so the same operation obfuscates and deobfuscates.
- */
-declare function deobfuscateFont(bytes: Uint8Array, fontKey: string): Uint8Array | null;
-/** Limits and instrumentation for reading embedded fonts out of a package. */
-interface ReadEmbeddedFontsOptions {
-    /** Refuse a font part larger than this. Defaults to 16 MB. */
-    readonly maxFontBytes?: number;
-    /** Refuse more than this many fonts. Defaults to 64. */
-    readonly maxFonts?: number;
+/** Per-section resolution including declared-vs-inherited metadata. */
+interface HeaderFooterSectionResolution {
+    readonly headers: ReadonlyMap<HeaderFooterVariant, HeaderFooterSlotMeta>;
+    readonly footers: ReadonlyMap<HeaderFooterVariant, HeaderFooterSlotMeta>;
+    readonly evenAndOddHeaders: boolean;
+    readonly titlePage: boolean;
 }
 /**
- * Every font the package embeds, deobfuscated.
+ * `w:sectPr` nodes in section order, aligned with layout's `enumerateDocumentSections`.
  *
- * Silently skips anything malformed rather than rejecting the document: a broken font table
- * is a reason to fall back to substitution, never a reason to refuse to open the file.
+ * `null` means a section with no `w:sectPr` node (Word defaults, inherits HF from previous).
+ * Paragraph-level breaks first; the final entry covers remaining blocks (body-level or null).
  */
-declare function readEmbeddedFonts(pkg: OoxmlPackage, fontTable: OoxmlPart | undefined, options?: ReadEmbeddedFontsOptions): EmbeddedFont[];
-
-/** The two list kinds a toolbar offers. */
-type ListKind = 'bullet' | 'ordered';
-interface EnsuredListDefinition {
-    readonly pkg: OoxmlPackage;
-    /** The `w:numId` a paragraph's `w:numPr` should name. */
-    readonly numId: string;
-}
+declare function collectSectionPropertyNodes(root: OoxmlNode): Array<OoxmlElement | null>;
 /**
- * Find or create a list definition of `kind`, returning the package that holds it.
+ * Resolve header/footer parts for every section with declared-vs-inherited metadata.
  *
- * An existing abstract definition of the same kind is reused, but every disconnected list
- * gets a fresh `w:num` instance. Counters belong to `w:num`, so reusing that instance would
- * continue an earlier list. Returns null only when the part cannot be built at all.
+ * Index aligns with `enumerateDocumentSections` in the layout package. Existing merged
+ * maps stay available via {@link resolveHeaderFooterPartsBySection}.
  */
-declare function ensureListDefinition(pkg: OoxmlPackage, kind: ListKind): EnsuredListDefinition | null;
+declare function resolveHeaderFooterResolutionBySection(pkg: OoxmlPackage): readonly HeaderFooterSectionResolution[];
 /**
- * Declare `level` in the definition `numId` names, with Word's default format for that
- * level, or refuse.
- *
- * Word never greys Increase Indent out on a list item: demoting past the deepest level a
- * `w:abstractNum` declares makes Word DEFINE the level, cycling its stock bullets
- * (Symbol •, Courier `o`, Wingdings ▪) or number formats (decimal, lowerLetter,
- * lowerRoman) by depth. This is that write. An already-declared level returns the package
- * unchanged, so callers may ask first and act second without a second lookup.
+ * Resolve header/footer parts for every section, applying OOXML inheritance.
  *
- * A delegating definition (`w:numStyleLink`, 17.9.21) is refused: its levels live on the
- * linked style's definition, and a `w:lvl` grafted here would be shadowed the moment the
- * link resolves.
+ * Index aligns with `enumerateDocumentSections` in the layout package.
  */
-declare function ensureNumberingLevel(pkg: OoxmlPackage, numId: string, level: number, kind: ListKind): OoxmlPackage | null;
-
-/** One bookmark's name and the range its marker pair currently encloses. */
-interface BookmarkAnchor {
-    readonly name: string;
-    /** Canonical node id of the paragraph the marker sits in. */
-    readonly paragraphId: string;
-    /** UTF-16 offset within that paragraph, in `paragraphTextOf`'s vocabulary. */
-    readonly offset: number;
-}
-/** Bookmarks by name. A name the document declares twice resolves to the first in order. */
-type BookmarkIndex = ReadonlyMap<string, BookmarkAnchor>;
+declare function resolveHeaderFooterPartsBySection(pkg: OoxmlPackage): readonly HeaderFooterParts[];
 /**
- * Build `name -> position` for every bookmark start in a part, in document order.
+ * Resolve the main-document header/footer references to their parts, gated by the
+ * settings the section actually declares.
  *
- * FIRST IN DOCUMENT ORDER WINS on a duplicate name. Word treats a repeated bookmark name as
- * the same bookmark and jumps to the first, and the alternative — last-wins — makes a jump
- * target move when an edit far away happens to duplicate a name.
- *
- * The offset is measured the way the ops measure: text of the runs before the marker inside
- * its own paragraph, hyperlink runs included, so the position a jump places the caret at is a
- * position `setSelection` accepts.
+ * Returns the FINAL section's effective parts (after inheritance). Multi-section hosts
+ * should prefer `resolveHeaderFooterPartsBySection`.
  */
-declare function buildBookmarkIndex(part: OoxmlPart): BookmarkIndex;
+declare function resolveHeaderFooterParts(pkg: OoxmlPackage): HeaderFooterParts;
 
 /** Lifecycle impact — furniture always reaches multiple pages; never narrower than flow-structural. */
 type HeaderFooterLifecycleImpact = 'flow-structural' | 'global';
@@ -429,26 +399,6 @@ interface CascadeDeletedNoteReferencesOptions {
  */
 declare function cascadeDeletedNoteReferences(before: OoxmlPackage, after: OoxmlPackage, options?: CascadeDeletedNoteReferencesOptions): OoxmlPackage | null;
 
-/** What the document asks for. Every field defaults to "the document said nothing". */
-interface DocumentTrackingSettings {
-    /** `w:trackRevisions` — the document asks for edits to be tracked. */
-    readonly trackRevisions: boolean;
-    /**
-     * `w:documentProtection/@w:edit="trackedChanges"` — tracking may not be turned OFF.
-     *
-     * Advisory. Presenting it as enforcement would be a lie about a file anyone can edit.
-     */
-    readonly restrictedToTrackedChanges: boolean;
-    /** `w:doNotTrackMoves` — write a move as a delete and an insert. */
-    readonly doNotTrackMoves: boolean;
-    /** `w:doNotTrackFormatting` — apply formatting without recording a `w:rPrChange`. */
-    readonly doNotTrackFormatting: boolean;
-}
-/** The frozen "nothing is tracked" settings — what a document with no `w:trackChanges` gets. */
-declare const NO_TRACKING_SETTINGS: DocumentTrackingSettings;
-/** Read the tracking settings from a `settings.xml` root, or the defaults when it has none. */
-declare function readTrackingSettings(settingsRoot: OoxmlNode | null | undefined): DocumentTrackingSettings;
-
 interface InsertImageInput {
     readonly paragraphId: string;
     readonly offset: number;
@@ -462,10 +412,24 @@ interface InsertImageInput {
     readonly title?: string;
     readonly description?: string;
     readonly hyperlink?: string;
+    /** Present in suggesting mode: the inserted drawing's run goes into a `w:ins`. */
+    readonly revision?: RevisionAttributionInput;
+    /**
+     * Collaboration actor for the ids this insert mints — `wp:docPr/@id`, the image
+     * relationship, and a hyperlink relationship when one is asked for.
+     *
+     * EXPLICIT, and not the ambient `runWithTransactionActor` binding, because this entry is
+     * async: the mint runs after `await validateEmbeddedImageForCommit` and the ambient actor
+     * is synchronous-only. A wrap around the call would compile, read as correct, and be gone
+     * by the time the id is taken. Omitted (solo) keeps Word's dense `highest + 1` sequence.
+     */
+    readonly actorId?: string;
 }
 interface ReplaceImageOptions {
     readonly expectedPackageRevision: number;
     readonly commitGuard?: () => boolean;
+    /** Collaboration actor for the replacement's minted ids. See {@link InsertImageInput.actorId}. */
+    readonly actorId?: string;
 }
 type ImageIntentResult = (Extract<PackageTransactResult, {
     ok: true;
@@ -481,6 +445,13 @@ interface ApplyImagePropertiesInput {
     readonly hyperlink: string | null;
 }
 
+/** Attribution stamped on one remote canonical publication. */
+interface RemotePackageAttribution {
+    readonly origin: string;
+    readonly actorId?: string;
+    readonly operationId?: string;
+}
+
 type NoteCascadeFn = (before: OoxmlPackage, after: OoxmlPackage) => OoxmlPackage | null;
 /**
  * Editable story target.
@@ -571,13 +542,11 @@ declare class TreePackageStore {
     private compositionSession;
     private commitCounter;
     /**
-     * Memo for {@link currentPackage}, keyed on the COMPLETE read set of that method by
-     * object identity: the package shell, the body part, and each open story's part in
-     * map order. Identity is the only sound key — `packageRevision` deliberately is not
-     * part of it, because shell writes (`replacePackageShell`, story-store grafts, lazy
-     * store opens) move `this.pkg` or a `store.part` without bumping the revision.
-     * Packages and parts are frozen-immutable, so a matching tuple proves the merged
-     * snapshot cannot differ; no explicit invalidation exists anywhere.
+     * Memo for {@link currentPackage}, keyed on that method's COMPLETE read set by object identity:
+     * the shell, the body part, and each open story's part in map order. Identity is the only sound
+     * key — `packageRevision` is excluded, because shell writes (`replacePackageShell`, story-store
+     * grafts, lazy opens) move `this.pkg` or a `store.part` without bumping it. Parts are frozen, so
+     * a matching tuple proves the snapshot cannot differ; nothing invalidates explicitly.
      */
     private currentPackageMemo;
     constructor(pkg: OoxmlPackage, main: OoxmlPart, options?: TreePackageStoreOptions);
@@ -617,6 +586,7 @@ declare class TreePackageStore {
      * cascades the note body in the same package undo unit.
      */
     transact(scope: StoryScope, build: (ctx: TransactionContext) => void, options?: Omit<TransactOptions, 'story' | 'minimumImpact'>): PackageTransactResult;
+    private commitStoryTransaction;
     /** Whether a package-wide IME composition session is open on any story. */
     compositionSessionOpen(): boolean;
     beginComposition(scope: StoryScope, selectionBefore?: SelectionMark | null): boolean;
@@ -627,6 +597,7 @@ declare class TreePackageStore {
      * restores the entire package atomically (parts, rels, content-types, settings).
      */
     applyLifecycleOp(op: HeaderFooterLifecycleOp | NoteLifecycleOp | TreeDocOp): PackageTransactResult;
+    private commitLifecycleOp;
     undo(): TreeModelChange | null;
     redo(): TreeModelChange | null;
     selectionForUndo(): SelectionMark | null;
@@ -637,16 +608,18 @@ declare class TreePackageStore {
     openedStoryCount(): number;
     /** See {@link openStoryTokenOf}. */
     openStoryToken(): string;
-    /**
-     * Insert a validated raster image as one package undo unit (task 12).
-     */
+    /** Insert a validated raster image as one package undo unit (task 12). */
     insertImage(scope: StoryScope, input: InsertImageInput): Promise<ImageIntentResult>;
+    /** Land a clipboard fragment (resource merge + blocks) as one package undo unit. */
+    applyFragmentPaste(scope: StoryScope, input: FragmentPasteInput): FragmentPasteResult;
     /** Replace a picture drawing's embedded media in one package undo unit. */
     replaceImage(scope: StoryScope, drawingNodeId: string, bytes: Uint8Array, mime: SupportedImageMime, decodePort: ImageDecodePort, options: ReplaceImageOptions): Promise<ImageIntentResult>;
     /** Delete a picture drawing and collect orphaned media in one package undo unit. */
     deleteImage(scope: StoryScope, drawingNodeId: string): ImageIntentResult;
+    /** Propose the deletion as a tracked change: the drawing goes into a `w:del`, media stays. */
+    deleteImageTracked(scope: StoryScope, drawingNodeId: string, revision: RevisionAttributionInput): ImageIntentResult;
     /** Fetch external bytes explicitly and embed them; no fetch on open/load. */
-    embedExternalImage(scope: StoryScope, drawingNodeId: string, url: string, port: ExternalImageFetchPort, signal: AbortSignal, decodePort: ImageDecodePort): Promise<ImageIntentResult>;
+    embedExternalImage(scope: StoryScope, drawingNodeId: string, url: string, port: ExternalImageFetchPort, signal: AbortSignal, decodePort: ImageDecodePort, actorId?: string): Promise<ImageIntentResult>;
     /** Metadata plus hyperlink target creation in one package transaction. */
     setDrawingMetadataWithHyperlink(scope: StoryScope, drawingNodeId: string, title: string, description: string, hyperlink: string | null): ImageIntentResult;
     /** Properties batch with hyperlink relationship create/update/remove in one package unit. */
@@ -678,17 +651,23 @@ declare class TreePackageStore {
     /**
      * Record a write that spanned SEVERAL parts as one package undo unit.
      *
-     * A comment is not in one part — the body in `comments.xml`, the thread record in
-     * `commentsExtended.xml`, the markers in the story — and those writes reach the store
-     * through the story store directly rather than through `transact`. The story store's own
-     * history entry cannot undo them: `undo()` on a story pointer syncs the STORY PART back and
-     * nothing else, so undoing a comment restored the markers and left the body behind, or the
-     * other way round. The caller discards the story entry and hands the package it started
-     * from to this instead, which is the same promotion the note cascade does.
+     * A comment spans parts — the body in `comments.xml`, the thread record in
+     * `commentsExtended.xml`, the markers in the story — and those writes reach the store through
+     * the story store rather than `transact`. The story store's history cannot undo them: `undo()`
+     * on a story pointer syncs the STORY PART alone, so undoing a comment restored the markers and
+     * left the body, or the reverse. The caller discards the story entry and hands the package it
+     * started from to this instead, the same promotion the note cascade does.
      */
     adoptPackageUnit(before: OoxmlPackage): void;
     /** Install a full package snapshot (public seam for post-fetch cleanup). */
     installPackageSnapshot(snapshot: OoxmlPackage): void;
+    /**
+     * Install a package this replica did not author, verbatim. No shell merge — see
+     * `publishRemoteCanonicalPackage` for why merging one here diverges two replicas.
+     */
+    installAuthoritativePackageSnapshot(snapshot: OoxmlPackage): void;
+    /** Publish one remotely materialized canonical package as one revision. */
+    publishRemotePackage(pkg: OoxmlPackage, attribution: RemotePackageAttribution): PackageTransactResult;
     /**
      * Replace the package shell while preserving opened stores. Used when numbering /
      * content-types mutate the package outside story trees.
@@ -720,205 +699,42 @@ declare class TreePackageStore {
      * live and not history-reachable (see `pruneUnreachableHyperlinkShell`).
      */
     private evictUnreachableStories;
-    private retainedStoryPartNames;
-    /**
-     * Owners whose scoped hyperlink shell must survive while furniture/notes parts are
-     * temporarily absent: opened/parked story retention plus every part name that package
-     * history can still restore (even when the story store was never opened).
-     */
-    private retainedHyperlinkOwnerParts;
-    private retainPointerStoryParts;
-    private retainPointerHyperlinkOwners;
     private publish;
     private publishSynthetic;
 }
 
-/**
- * The payload half of an insert: which store, which node, and what it holds.
- *
- * `data` is opaque here. The lane that owns a schema is the one that declared it, and a store
- * that parsed payloads would be a second opinion about what a host's node means.
- */
-interface CustomNodePayloadWrite {
-    /** Namespace of the store's root element — what identifies one store among several. */
-    readonly namespaceUri: string;
-    /** Local name of that root. An NCName; anything else refuses. */
-    readonly rootLocalName: string;
-    /** The node's own id, which the binding's xpath quotes. */
-    readonly nodeId: string;
-    /** The text the control shows. Word paints this from the store, so an empty one is an empty chip. */
-    readonly label: string;
-    /** The payload, serialized. JSON by convention; never parsed here. */
-    readonly data: string;
-}
-/** Where the control goes, what it says, and the payload it carries. */
-interface InsertCustomNodeWrite {
+/** Decoded fragment payloads above this cap are refused before any package work. */
+declare const MAX_FRAGMENT_DECODED_BYTES: number;
+interface FragmentPasteInput {
     readonly paragraphId: string;
     readonly offset: number;
+    /** The fragment package zip (from the clipboard codec or the HTML projection). */
+    readonly fragmentBytes: Uint8Array;
+    readonly lastMarkCovered: boolean;
+    /** Ops that clear the current selection first (the surface's deleteSelectionPlan). */
+    readonly priorOps?: readonly TreeDocOp[];
     /**
-     * Wrap rather than insert: the text from `offset` to here is removed first.
-     *
-     * The node's label REPLACES the words it covered, because that is what turning a stretch of a
-     * sentence into a citation means. Removed inside the same transaction, so a refused insert
-     * leaves the text where it was.
-     */
-    readonly replaceUntil?: number;
-    /**
-     * Rewrite an existing control: it and the payload it bound go first, in this transaction.
+     * Collaboration actor for the ids this paste mints.
      *
-     * An UPDATE is remove-and-reinsert, because the tag codec has no in-place rewrite and
-     * pretending it did would put a second write path beside this one. Doing both halves here is
-     * what keeps it one undo step, and what stops an update from leaving a label and a payload
-     * that disagree.
+     * A paste freshens three package-wide namespaces — bookmark `@w:id`, revision `@w:id` and
+     * `wp:docPr/@id` — and the merge reads the actor off the open transaction. Without one, two
+     * replicas pasting the same fragment from one snapshot mint the same numbers, and only the
+     * merged document shows it. Omitted (solo) keeps Word's dense sequences.
      */
-    readonly replaceControlId?: string;
-    readonly tag: string;
-    readonly text: string;
-    readonly alias?: string;
-    /** Defaults to none. Callers that want Word's own "cannot type into it" pass `contentLocked`. */
-    readonly lock?: 'sdtLocked' | 'sdtContentLocked' | 'contentLocked';
-    /** Omitted authors an ordinary tagged control with no store — the pre-payload behaviour. */
-    readonly payload?: CustomNodePayloadWrite;
+    readonly actorId?: string;
 }
-/**
- * Why a payload write was refused.
- *
- * The tree rejections pass through unchanged, so a locked paragraph refuses a bound insert for
- * the same named reason it refuses a plain one. The three added here are the payload's own.
- */
-type CustomNodeWriteRejection = TreeOpRejection
-/** The id, root name or namespace cannot be spelled in an XPath, so no binding could name it. */
- | 'unaddressable-payload'
-/** The store could not be authored — see `withCustomXmlDataPart` for every way that happens. */
- | 'store-not-authored'
-/** The payload or the label is past the cap. */
- | 'payload-too-large';
-type CustomNodeWriteResult = {
-    readonly ok: true;
-    readonly change: TreeModelChange | null;
-    /**
-     * The control this write authored, when it authored one. A rewrite replaces the control
-     * rather than editing it, so the id the caller passed in names nothing afterwards.
-     */
-    readonly nodeId?: string;
-} | {
-    readonly ok: false;
-    readonly reason: CustomNodeWriteRejection;
-    readonly detail?: string;
-};
-/**
- * The largest payload one node may carry, in UTF-16 code units.
- *
- * Same figure as the read side's (`parseCustomNodeData`) and for the same reason: far past any
- * legitimate chip, far short of anything that hurts. Checked on the WRITE too, so a document
- * cannot be authored here holding a payload the reader will later refuse to parse.
- */
-declare const MAX_CUSTOM_NODE_PAYLOAD_LENGTH: number;
-/** The longest label a binding may paint. Word renders it as the control's whole content. */
-declare const MAX_CUSTOM_NODE_LABEL_LENGTH = 4096;
-/**
- * Insert one custom node, with its payload, as a single transaction.
- *
- * Answers the store transaction's own change so the caller can publish it — a payload write is a
- * package write reaching through a story store, exactly as a comment is, and the coordinator
- * needs the change to know which paragraphs went dirty.
- */
-declare function insertCustomNodeWrite(store: TreeDocumentStore, write: InsertCustomNodeWrite, 
-/**
- * The part the customXml store hangs off, defaulting to the story being written.
- *
- * A chip in a header is written against the HEADER store, but Word enumerates the data
- * store from the main document part — a store authored off a header is one Word never
- * sees. So the caller passes the main part while the control itself lands in the story.
- */
-dataOwnerPartName?: string): CustomNodeWriteResult;
-/**
- * Remove a control and, in the same transaction, the payload it bound.
- *
- * The sweep would collect the node eventually — that is what makes deletion in Word survivable —
- * but "eventually" is the next open, and a document saved in between carries a payload for a
- * chip that is gone. Doing it here means the ordinary case is exact and the sweep is a backstop.
- */
-declare function removeCustomNodeWrite(store: TreeDocumentStore, controlNodeId: string): CustomNodeWriteResult;
-/**
- * What one sweep collected, or why it collected nothing.
- *
- * `ok: false` is NOT "the document was already tidy" — that is `ok: true` with an empty
- * `removed`. It means a store this sweep was asked to tidy refused the rewrite, which a caller
- * that keeps saving into the same document should know about rather than silently retry forever.
- */
-type CustomNodeSweepResult = {
-    readonly ok: true;
-    readonly pkg: OoxmlPackage;
-    /** Node ids removed, across every store swept. Empty means there were no orphans. */
-    readonly removed: readonly string[];
-} | {
-    readonly ok: false;
-    readonly reason: string;
-};
-/**
- * Drop every payload no control binds, in the stores whose namespaces a host claims.
- *
- * ON OPEN, NOT ON SAVE. A chip cut to the clipboard is unbound for as long as it sits there, so a
- * save mid-cut would destroy the payload the user is about to paste. On open the only unbound
- * nodes are ones a control genuinely lost — deleted here, or deleted in Word, which is the case
- * nothing else can collect.
- *
- * `namespaces` is the claim, and it is what keeps this off other people's stores: Word's own Cover
- * Page Properties store rides in most templates, and a sweep that walked every customXml part
- * would be deleting from it on the strength of a name collision.
- */
-declare function sweepCustomNodePayloads(pkg: OoxmlPackage, storyPartName: string, namespaces: readonly string[]): CustomNodeSweepResult;
-/** One control's payload, as the store holds it. Both strings are untrusted file input. */
-interface CustomNodePayloadRead {
-    /** The store node's own id. */
-    readonly nodeId: string;
-    /** The text Word paints the control from. */
-    readonly label: string;
-    /** The payload as authored. JSON by convention, unparsed here. */
-    readonly data: string;
-}
-/**
- * The payload every control in a story binds to, keyed by the CONTROL's canonical node id.
- *
- * Keyed by the control rather than by the store node because that is the question a reader
- * actually has — "what does this chip carry" — and because two stores may each hold a `cx1`.
- * Resolved here rather than by a capability package: the stores are package parts, and a
- * derivation that only gets story parts has no way to reach them.
- *
- * Every store the story relates to, so a document carrying two definitions' payloads answers
- * for both without anyone naming a namespace.
- */
-declare function customNodePayloadsByControl(pkg: OoxmlPackage, storyPartName: string, 
-/**
- * The part that RELATES the customXml store, when it is not the story's own.
- *
- * Two different questions wear one name here: which part holds the CONTROLS, and which part
- * relates the STORE they bind into. Word only reads a store hung off the main document part,
- * so {@link writeCustomNode} already takes them separately — this read did not, and answered
- * with the body's controls whatever story it was asked about. A chip in a header therefore
- * read as having no payload at all, and an update that meant to keep the existing data
- * dropped it.
- */
-dataOwnerPartName?: string): ReadonlyMap<string, CustomNodePayloadRead>;
-/** Every payload one store holds, for a caller resolving a control's `data`. */
-declare function customNodePayloadsOf(pkg: OoxmlPackage, storyPartName: string, namespaceUri: string): ReadonlyMap<string, {
-    readonly label: string;
-    readonly data: string;
+type FragmentPasteResult = (Extract<PackageTransactResult, {
+    ok: true;
+}> & {
+    readonly blockCount: number;
+}) | Extract<PackageTransactResult, {
+    ok: false;
 }>;
 /**
- * What the session answers for a sweep: the ids collected, or the reason none were.
- *
- * Narrower than {@link CustomNodeSweepResult}, which also carries the rewritten package — the
- * session has already installed that, and handing it back would invite a caller to install it
- * twice.
+ * Read the fragment through the bounded file-open trust boundary, merge its resources,
+ * and land its blocks — all inside one transaction. Any refusal leaves the document
+ * exactly as it was; the caller (the paste router) degrades to the next flavour.
  */
-type CustomNodeSweepOutcome = {
-    readonly ok: true;
-    readonly removed: readonly string[];
-} | {
-    readonly ok: false;
-    readonly reason: string;
-};
+declare function applyFragmentPaste(store: TreePackageStore, scope: StoryScope, input: FragmentPasteInput): FragmentPasteResult;
 
-export { customNodePayloadsByControl as $, type ApplyImagePropertiesInput as A, type BookmarkIndex as B, type CustomNodeWriteResult as C, type DocumentTrackingSettings as D, type EmbeddedFont as E, type FontStyleKey as F, type NoteReferenceScanBudget as G, type HeaderFooterLifecycleImpact as H, type InsertCustomNodeWrite as I, type ReadEmbeddedFontsOptions as J, type StoryResolveResult as K, type ListKind as L, MAX_CUSTOM_NODE_LABEL_LENGTH as M, NO_TRACKING_SETTINGS as N, type TreePackageStoreOptions as O, type PackageTransactResult as P, allocateDrawingPropertyId as Q, type ReplaceImageOptions as R, type StoryScope as S, TreePackageStore as T, applyHeaderFooterLifecycleOp as U, applyNoteLifecycleOp as V, buildBookmarkIndex as W, cascadeDeletedNoteReferences as X, collectNoteReferences as Y, collectPackageNoteReferences as Z, createNoteReferenceScanBudget as _, type StoryTargetRejection as a, customNodePayloadsOf as a0, deobfuscateFont as a1, diagnoseNoteReferences as a2, ensureListDefinition as a3, ensureNumberingLevel as a4, insertCustomNodeWrite as a5, isHeaderFooterLifecycleOp as a6, isNoteLifecycleOp as a7, normalNoteIds as a8, notesPartHasId as a9, readEmbeddedFonts as aa, readTrackingSettings as ab, removeCustomNodeWrite as ac, resolveNotesPart as ad, sweepCustomNodePayloads as ae, withBinaryPart as af, withEmbeddedImage as ag, withoutUnreferencedImagePart as ah, type CustomNodeSweepOutcome as b, type InsertImageInput as c, type ImageIntentResult as d, type BookmarkAnchor as e, type CascadeDeletedNoteReferencesOptions as f, type CustomNodePayloadRead as g, type CustomNodePayloadWrite as h, type CustomNodeSweepResult as i, type CustomNodeWriteRejection as j, DEFAULT_MAX_EDITABLE_STORY_PARTS as k, type DrawingPropertyIdResult as l, type HeaderFooterLifecycleOp as m, type HeaderFooterLifecycleRejection as n, type HeaderFooterLifecycleResult as o, MAX_CUSTOM_NODE_PAYLOAD_LENGTH as p, MAX_NOTE_REFERENCE_PARTS as q, MAX_NOTE_REFERENCE_SCAN as r, type NoteDiagnostic as s, type NoteDiagnosticCode as t, type NoteLifecycleImpact as u, type NoteLifecycleOp as v, type NoteLifecycleOptions as w, type NoteLifecycleRejection as x, type NoteLifecycleResult as y, type NoteReferenceHit as z };
+export { resolveHeaderFooterResolutionBySection as $, type ApplyImagePropertiesInput as A, applyFragmentPaste as B, type CascadeDeletedNoteReferencesOptions as C, DEFAULT_MAX_EDITABLE_STORY_PARTS as D, applyHeaderFooterLifecycleOp as E, type FragmentPasteInput as F, applyNoteLifecycleOp as G, type HeaderFooterVariant as H, type InsertImageInput as I, cascadeDeletedNoteReferences as J, collectNoteReferences as K, collectPackageNoteReferences as L, MAX_FRAGMENT_DECODED_BYTES as M, type NoteDiagnostic as N, collectSectionPropertyNodes as O, type PackageTransactResult as P, createNoteReferenceScanBudget as Q, type ReplaceImageOptions as R, type StoryScope as S, TreePackageStore as T, diagnoseNoteReferences as U, isHeaderFooterLifecycleOp as V, isNoteLifecycleOp as W, normalNoteIds as X, notesPartHasId as Y, resolveHeaderFooterParts as Z, resolveHeaderFooterPartsBySection as _, type StoryTargetRejection as a, resolveNotesPart as a0, withBinaryPart as a1, withEmbeddedImage as a2, withoutUnreferencedImagePart as a3, type HeaderFooterParts as b, type HeaderFooterSectionResolution as c, type ImageIntentResult as d, type FragmentPasteResult as e, type DrawingPropertyIdResult as f, type HeaderFooterKind as g, type HeaderFooterLifecycleImpact as h, type HeaderFooterLifecycleOp as i, type HeaderFooterLifecycleRejection as j, type HeaderFooterLifecycleResult as k, type HeaderFooterSlotMeta as l, MAX_NOTE_REFERENCE_PARTS as m, MAX_NOTE_REFERENCE_SCAN as n, type NoteDiagnosticCode as o, type NoteLifecycleImpact as p, type NoteLifecycleOp as q, type NoteLifecycleOptions as r, type NoteLifecycleRejection as s, type NoteLifecycleResult as t, type NoteReferenceHit as u, type NoteReferenceScanBudget as v, type RemotePackageAttribution as w, type StoryResolveResult as x, type TreePackageStoreOptions as y, allocateDrawingPropertyId as z };