@docx-editor.dev/editor-api 0.0.1-placeholder → 2.0.0

package/dist/server-C96AzKaT.d.mts

@@ -0,0 +1,1965 @@
+import { AutomationOperation, AutomationValue, AutomationHandle, AutomationHost, AutomationCapabilities, AutomationSpan } from '@docx-editor.dev/core/automation';
+
+/** Whether an action reads or writes. Drives the conditional-revision rule in `sync()`. */
+type ActionSort = 'read' | 'write';
+interface QueuedAction {
+    readonly sort: ActionSort;
+    /** The consumer-facing name of what this action is for, for errors. Never a handle. */
+    readonly label: string;
+    /**
+     * The host operation for this action.
+     *
+     * Called once, at dispatch. May throw `InvalidObjectPath` if the object it addresses stopped
+     * being addressable between the call that queued it and the sync — which refuses the batch
+     * before anything is sent.
+     */
+    plan(): AutomationOperation;
+    /** The host's answer for this action, in batch order. */
+    settle(value: AutomationValue): void;
+}
+declare class ActionQueue {
+    #private;
+    get size(): number;
+    /** What is queued right now, for tests and for the empty-batch shortcut. */
+    get pending(): readonly QueuedAction[];
+    push(action: QueuedAction): void;
+    /** Hand over everything queued and forget it. Never replayed — see the file header. */
+    take(): readonly QueuedAction[];
+    /** Drop everything queued: what a finished run does with actions nobody synced. */
+    clear(): void;
+}
+
+/** What a promised member is told once the read that looked for it has answered. */
+interface PromisedItem {
+    /** @internal The member was there, at this address. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal There was no such member. */
+    hydrateNull(): void;
+}
+declare abstract class ItemCollection<T extends ClientObject> extends ClientObject {
+    #private;
+    protected constructor(context: RequestContext, path: ObjectPath);
+    /**
+     * The read that lists this collection's members, or `null` when a write already answered them.
+     *
+     * `Paragraph#split` is the case that needs the second shape: the operation that breaks the
+     * paragraph is the same operation that says what the pieces are, so the collection it answers is
+     * filled by that command's own result. Listing it again afterwards would describe a DIFFERENT
+     * document — the one the split produced — and quietly turn one atomic call into two.
+     */
+    protected abstract listing(): AutomationOperation | null;
+    /** How many members an answer holds, without building any of them. */
+    protected abstract size(value: AutomationValue, label: string): number;
+    /** Where the member at `index` is, or `undefined` if the answer has no such member. */
+    protected abstract addressAt(value: AutomationValue, label: string, index: number): ObjectAddress | undefined;
+    /** A member of this collection, already addressed. */
+    protected abstract itemAt(label: string, address: ObjectAddress): T;
+    /** A member with no verdict yet — what both item accessors answer with. */
+    protected abstract promised(label: string, nullable: boolean): T & PromisedItem;
+    /**
+     * The members this collection was loaded with.
+     *
+     * `PropertyNotLoaded` until a `load(...)` has been synced: a collection that answered `[]`
+     * before it had been read would be indistinguishable from an empty document.
+     */
+    get items(): readonly T[];
+    /** @internal Take the members straight from the command that produced them. */
+    fill(value: AutomationValue, label: string): void;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+    /** One member, by which end of the collection it is at. */
+    protected edge(edge: 'first' | 'last', accessor: string, nullable: boolean): T;
+}
+/**
+ * The shape almost every collection here has: a listing that answers HANDLES.
+ *
+ * Only the paragraph and range collections need anything else — ranges are spans, and a split
+ * answers its own members — so the size-and-address half is written once rather than in each of the
+ * seven collections that would otherwise copy it and be able to copy it wrongly.
+ */
+declare abstract class HandleCollection<T extends ClientObject & PromisedItem> extends ItemCollection<T> {
+    /** @internal How many members the listing's answer describes. */
+    protected size(value: AutomationValue, label: string): number;
+    /** @internal The address of one member of the listing's answer. */
+    protected addressAt(value: AutomationValue, label: string, index: number): ObjectAddress | undefined;
+}
+
+declare abstract class ModelObject extends ClientObject {
+    /** Queue a read whose text answer becomes the loaded property `name`. */
+    protected loadTextInto(name: string, plan: () => AutomationOperation): void;
+    /** Queue a command with nothing to answer. Nothing is written until `sync()`. */
+    protected command(name: string, plan: () => AutomationOperation): void;
+    /**
+     * Queue a command whose answer this call has no use for.
+     *
+     * `clear()` is the case: the operation behind it is a replacement, and a replacement answers the
+     * range it wrote — a range over no text, here. The answer is dropped rather than checked for a
+     * shape the method does not return, so that the operation stays the same one an insertion uses.
+     */
+    protected commandDiscarding(name: string, plan: () => AutomationOperation): void;
+    /** Queue a command whose answer names something the caller keeps. */
+    protected commandAnswering(label: string, plan: () => AutomationOperation, settle: (value: AutomationValue) => void): void;
+    /** Queue a read whose answer is hydrated by the caller. */
+    protected read(label: string, plan: () => AutomationOperation, settle: (value: AutomationValue) => void): void;
+    /** The properties a load asked for, refusing any name this object does not have. */
+    protected selection(request: ResolvedLoadOptions, available: readonly string[]): readonly string[];
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/**
+ * A list: the set of paragraphs sharing one numbering id.
+ *
+ * A list is not an ELEMENT. OOXML has no list — it has paragraphs that each name a `w:numId`, and
+ * a list is the set that name the same one. So {@link List.id} is that number,
+ * {@link List.paragraphs} is the set, and a list exists exactly as long as some paragraph is
+ * still in it.
+ *
+ * @public
+ */
+declare class List extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A list a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): List;
+    /** @internal A list a queued read will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): List;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /** The `w:numId` the list's paragraphs share — the document's own identity for the list. */
+    get id(): number;
+    /** Every paragraph in the list, in reading order. */
+    get paragraphs(): ParagraphCollection;
+    /** The list's paragraphs at one level, in reading order. */
+    getLevelParagraphs(level: number): ParagraphCollection;
+    /**
+     * Add a numbered paragraph to the list, at its start or its end.
+     *
+     * All four of Word's locations are accepted and `Before`/`After` land INSIDE the list, at the
+     * first and last position — the same places `Start` and `End` name. A list is a set of paragraphs
+     * rather than a region, so "before the list" is a position in the story rather than in the list,
+     * and `Paragraph#insertParagraph` is what addresses that. The divergence is recorded in
+     * `compat/manifest.json`.
+     */
+    insertParagraph(paragraphText: string, insertLocation: 'Start' | 'End' | 'Before' | 'After'): Paragraph;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The lists in a story, as of the batch that loaded them.
+ *
+ * @public
+ */
+declare class ListCollection extends HandleCollection<List> {
+    #private;
+    /** @internal The lists of one story, in the order their numbers first appear. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, body: AutomationHandle): ListCollection;
+    private constructor();
+    /** The first list. `ItemNotFound` at the sync if the story has none. */
+    getFirst(): List;
+    /**
+     * The list with one `w:numId`, or `ItemNotFound` where the story has none.
+     *
+     * ONE read, answered by the host: a `w:numId` is a document value, and matching it against a
+     * listing on this side would mean asking every list for its id and choosing locally — a batch
+     * whose size depends on the document, to answer a question the host can answer directly. A number
+     * no paragraph uses names a numbering definition rather than a list, and is refused.
+     */
+    getById(id: number): List;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): List;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): List & PromisedItem;
+}
+/**
+ * A paragraph's membership of a list: which list, and at what level.
+ *
+ * `listString` (the "3." or "iv)" a reader sees) and `siblingIndex` are absent because they are
+ * PAINTED, not authored — computed during layout by a counter that walks the story applying
+ * `numbering.xml`, its abstract-numbering indirection, restarts and overrides. Answering them
+ * here would mean a second counter that disagrees with the one on screen the first time a
+ * document overrides a level.
+ *
+ * @public
+ */
+declare class ListItem extends ModelObject {
+    #private;
+    /** @internal The list membership of the paragraph `owner` addresses. */
+    static of(context: RequestContext, label: string, owner: ObjectPath): ListItem;
+    private constructor();
+    /**
+     * How deeply the item is nested: zero for a top-level item, up to eight.
+     *
+     * Writing it is Word's Increase/Decrease Indent on a list item — the paragraph keeps its list and
+     * changes its level, which is why this is one property rather than a pair of verbs.
+     */
+    get level(): number;
+    set level(value: number);
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/** What the object is, which is what decides how its characters are named. */
+type SpanOwner = 'body' | 'paragraph' | 'span';
+
+/**
+ * The character formatting of whatever it belongs to: a story, a stretch of one, or a paragraph.
+ *
+ * A font has no identity of its own — it is a view onto its owner's characters and shares its
+ * owner's path, so a font reached from a deleted paragraph's range refuses at the same moment the
+ * range does rather than holding a stale address.
+ *
+ * Reading is AGREEMENT, and `null` means "no agreed value": every run the owner covers says bold,
+ * or the answer is null. Null is also the answer when nothing in range authors the property at
+ * all. Both are one answer on purpose, because this API reads what the document AUTHORS rather
+ * than what the style cascade computes — a heading whose bold comes from `styles.xml` reads null.
+ * Answering the cascade would let a caller read an inherited value, write it straight back, and
+ * silently freeze it into the paragraph as if the author had chosen it.
+ *
+ * Assignments within one `sync()` are ONE write: `font.bold = true; font.size = 12` accumulates
+ * into a single run-property operation. That is required, not an optimisation — a run-property
+ * write carries the run's whole property bag, so a second write planned from the same pre-batch
+ * tree would carry a bag the first had already superseded, which the host refuses with
+ * `ConflictingChanges`.
+ *
+ * @public
+ */
+declare class Font extends ModelObject {
+    #private;
+    /** @internal The font of the object `owner` addresses. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, kind: SpanOwner): Font;
+    private constructor();
+    /** Whether every character agrees it is bold, or `null` where they do not. */
+    get bold(): boolean;
+    set bold(value: boolean);
+    /** Whether every run in range is italic. `null` where they disagree or none says. */
+    get italic(): boolean;
+    set italic(value: boolean);
+    /** `#RRGGBB`. `null` where the characters disagree, or where the colour is `auto`. */
+    get color(): string;
+    set color(value: string);
+    /** The typeface name the characters state, or `null` where they do not agree on one. */
+    get name(): string;
+    set name(value: string);
+    /** Points. */
+    get size(): number;
+    set size(value: number);
+    /**
+     * One read for every property asked for.
+     *
+     * They all come out of the same runs, so asking for them one at a time would send several
+     * operations about the same characters and make a caller's cost depend on how many fields they
+     * happened to name.
+     */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/** Every place this API can insert at. Individual members accept a subset. */
+type InsertLocation = 'Replace' | 'Start' | 'End' | 'Before' | 'After';
+/** Where a story accepts text: over all of it, or at either edge. */
+type BodyInsertTextLocation = Extract<InsertLocation, 'Replace' | 'Start' | 'End'>;
+/** Where a story accepts a paragraph. `Start`/`End` mean "before the first"/"after the last". */
+type BodyInsertParagraphLocation = Extract<InsertLocation, 'Start' | 'End'>;
+/** Where a paragraph accepts text: over all of it, or at either edge of it. */
+type ParagraphInsertTextLocation = Extract<InsertLocation, 'Replace' | 'Start' | 'End'>;
+/** Which side of a paragraph or a range a new paragraph goes on. */
+type BesideLocation = Extract<InsertLocation, 'Before' | 'After'>;
+/** Where a range accepts text. See `Range#insertText` for what `Before`/`Start` mean here. */
+type RangeInsertTextLocation = InsertLocation;
+/** Where a selection lands: over the range, or collapsed to one of its edges. */
+type SelectionMode = 'Select' | 'Start' | 'End';
+
+/**
+ * A name a document gives to a stretch of itself.
+ *
+ * A bookmark IS its name. OOXML writes it as a pair of markers around the text, and the name is
+ * the only thing identifying it — so this object is a name plus the range those markers currently
+ * enclose. A bookmark whose markers left with the text they surrounded refuses rather than
+ * answering where they used to be.
+ *
+ * `start`, `end` and `delete` are absent by design: the first two are document-wide character
+ * offsets, the coordinate space this API does not maintain, and `delete` would have to remove a
+ * marker pair, which the canonical write path does not offer.
+ *
+ * @public
+ */
+declare class Bookmark extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A bookmark a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): Bookmark;
+    /** @internal A bookmark a queued read will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): Bookmark;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /** The name the document declares this bookmark with. */
+    get name(): string;
+    /**
+     * The text the bookmark's markers enclose.
+     *
+     * Read when it is asked for rather than carried by the bookmark, because the markers move with the
+     * text: the range a caller gets is where the bookmark is now, not where it was when the collection
+     * was loaded.
+     */
+    get range(): Range;
+    /** Put the reader's selection on the bookmark. `NotSupported` where there is no reader. */
+    select(selectionMode_?: SelectionMode): void;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The bookmarks of a story or a range, as of the batch that loaded them.
+ *
+ * Like every collection here, `items` is the LOADED answer rather than a live view: bookmarks
+ * added after the load are not in it, and reaching them means loading again.
+ *
+ * @public
+ */
+declare class BookmarkCollection extends HandleCollection<Bookmark> {
+    #private;
+    /** @internal The bookmarks a scope holds: a whole story's, or the ones a range overlaps. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): BookmarkCollection;
+    private constructor();
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): Bookmark;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): Bookmark & PromisedItem;
+}
+
+/**
+ * How a search is narrowed.
+ *
+ * Every flag is honoured or REFUSED — never quietly ignored. A search that accepted
+ * `matchWildcards` and then ran a plain-text scan would answer the wrong offsets to a caller who
+ * edits at them, so the unimplemented options reach the host and come back as `NotSupported`.
+ *
+ * They are declared here rather than left off the type because omitting them would make
+ * `{ matchWildcards: true }` a compile error in code that is otherwise source-compatible with
+ * Word. The honest answer to that code is a runtime refusal naming the option, not a type error
+ * naming the interface.
+ *
+ * @public
+ */
+interface SearchOptions {
+    /** Match the query's case. Off by default, like Word's Find. */
+    readonly matchCase?: boolean;
+    /** Only match where the query stands alone as a word. */
+    readonly matchWholeWord?: boolean;
+    /** Not implemented; `true` is refused with `NotSupported`. */
+    readonly ignorePunct?: boolean;
+    /** Not implemented; `true` is refused with `NotSupported`. */
+    readonly ignoreSpace?: boolean;
+    /** Not implemented; `true` is refused with `NotSupported`. */
+    readonly matchWildcards?: boolean;
+}
+
+/**
+ * A stretch of a story: two endpoints, each a paragraph and a UTF-16 offset.
+ *
+ * A range is a SNAPSHOT, not a tracked region. Its endpoints name the paragraphs they were found
+ * in and the offsets they were found at, so it stays meaningful across edits ELSEWHERE in the
+ * document and becomes an explicit `InvalidObjectPath` refusal once one of its paragraphs is
+ * gone. What it deliberately does not do is follow edits INSIDE itself: a range over `"alpha"`
+ * whose paragraph then gains a word at offset 0 still names offsets 0..5. Word's own ranges do
+ * move, by keeping a live region in the document; this API has none, and pretending otherwise
+ * would answer text from a place the caller was not looking at.
+ *
+ * That is also why `start` and `end` are absent rather than unimplemented — they are
+ * document-wide character positions, a different addressing scheme from this API's paragraph
+ * identity plus UTF-16 offset. Ask a range for its {@link Range.paragraphs} instead.
+ *
+ * @public
+ */
+declare class Range extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A range a read already found. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): Range;
+    /** @internal A range a queued operation will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): Range;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /**
+     * The text between this range's endpoints.
+     *
+     * A range that crosses paragraph marks reads a carriage return at each one, so counting
+     * characters in this string counts the same positions the engine writes at.
+     */
+    get text(): string;
+    /** The character formatting of the characters this range covers. */
+    get font(): Font;
+    /** The paragraphs this range covers, in reading order. */
+    get paragraphs(): ParagraphCollection;
+    /**
+     * The paragraph style, by the name a reader sees in the styles gallery.
+     *
+     * Reading answers the name every paragraph this range covers agrees on, and `null` where they do not or
+     * where the document names no style. Writing applies it to all of them, and a name the document
+     * does not already define is refused rather than created — a minted style would report itself
+     * applied while the text stayed exactly as it looked.
+     */
+    get style(): string;
+    set style(value: string);
+    /**
+     * The hyperlink over these characters: an absolute URL, or `#anchor` for a place in the document.
+     *
+     * `''` where the range is not in a link, and where it straddles two — a stretch covering parts of
+     * two different links has no one target, and answering either would be a guess.
+     *
+     * WRITING IT AUTHORS A LINK over exactly these characters, and `''` removes one. A URL whose
+     * scheme this engine would refuse to OPEN is refused here too, by the same allowlist: a document
+     * this API writes must not be one it would then decline to follow.
+     */
+    get hyperlink(): string;
+    set hyperlink(value: string);
+    /** The bookmarks whose text this range overlaps, in document order. */
+    get bookmarks(): BookmarkCollection;
+    /** Every occurrence of `searchText` inside this range, as ranges. */
+    search(searchText: string, options?: SearchOptions): RangeCollection;
+    /**
+     * Write text at or over this range. Answers the range the written text occupies.
+     *
+     * `Before`/`Start` and `After`/`End` land at the SAME position here, and the difference Word
+     * draws between them — whether the new text becomes part of this range — has no meaning for a
+     * snapshot. Both pairs are accepted because source-compatible code uses all four; what a caller
+     * gets back is a range naming the text that was written, in every case.
+     */
+    insertText(text: string, insertLocation: 'Replace' | 'Start' | 'End' | 'Before' | 'After'): Range;
+    /** Add a paragraph before or after the one this range starts or ends in. */
+    insertParagraph(paragraphText: string, insertLocation: 'Before' | 'After'): Paragraph;
+    /**
+     * Put the reader's selection on this range.
+     *
+     * Refused with `NotSupported` where there is no reader — a document opened from bytes on a
+     * server has no caret, and moving one would be a claim about a screen nobody is looking at. The
+     * check is at the CALL rather than at the sync, so the mistake is reported where it was made.
+     */
+    select(selectionMode_?: SelectionMode): void;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/** Paragraph alignment values readable and writable through this object model. */
+type ParagraphAlignment = 'Mixed' | 'Unknown' | 'Left' | 'Centered' | 'Right' | 'Justified';
+/**
+ * One paragraph: what it says, what it is, and the ways it can be changed.
+ *
+ * Identity is the document's own. {@link Paragraph.uniqueLocalId} is the `w14:paraId` the file
+ * carries — the value Word writes, and the one `commentsExtended.xml` and coauthoring merges
+ * already anchor to — never a position in a collection. Deleting the paragraph above this one
+ * does not change it, which is the point: an agent that read a document, thought about it, and
+ * now wants to write to "the paragraph I was looking at" cannot express that with an index. A
+ * paragraph the file gave no id gets one deterministically at open, so the same bytes always
+ * answer the same identities and saving writes them back.
+ *
+ * A structural edit owns its paragraph for the batch: `delete()`, `split()` and
+ * `insertParagraph()` change what offsets mean, so a second call in the same `sync()` that also
+ * touches this paragraph is refused with `ConflictingChanges` rather than planned against
+ * coordinates that have stopped describing it. Two syncs get both edits, each exactly as asked.
+ *
+ * @public
+ */
+declare class Paragraph extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A paragraph a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): Paragraph;
+    /** @internal A paragraph a queued operation will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): Paragraph;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /** This paragraph's text. Readable after `load('text')` and a `sync()`. */
+    get text(): string;
+    /**
+     * The document's own identity for this paragraph.
+     *
+     * Stable across edits elsewhere in the document and across a save and reopen, because it is
+     * written into the file rather than worked out from where the paragraph sits.
+     */
+    get uniqueLocalId(): string;
+    /**
+     * The paragraph style, by the name a reader sees in the styles gallery.
+     *
+     * `null` where the document names none. A name it does not already define is refused rather than
+     * created, and the write rides the same `w:pPr` rewrite the alignment and indent members do — so
+     * applying a style and adjusting a spacing in one sync is one write rather than a refusal.
+     */
+    get style(): string;
+    set style(value: string);
+    /** The character formatting of this paragraph's characters, and of its paragraph mark. */
+    get font(): Font;
+    /**
+     * How the paragraph's lines are aligned, or `Unknown` where it authors no alignment.
+     *
+     * `Unknown` rather than `Left`: a paragraph that states nothing may still be centred by its
+     * style, and naming a side would be a claim about the cascade this lane does not resolve.
+     */
+    get alignment(): ParagraphAlignment;
+    set alignment(value: ParagraphAlignment);
+    /** Points. Negative for a hanging indent — the first line starting left of the rest. */
+    get firstLineIndent(): number;
+    set firstLineIndent(value: number);
+    /** Points. */
+    get leftIndent(): number;
+    set leftIndent(value: number);
+    /** Points. */
+    get rightIndent(): number;
+    set rightIndent(value: number);
+    /** Points between the paragraph's lines. */
+    get lineSpacing(): number;
+    set lineSpacing(value: number);
+    /** Points above the paragraph. */
+    get spaceBefore(): number;
+    set spaceBefore(value: number);
+    /** Points below the paragraph. */
+    get spaceAfter(): number;
+    set spaceAfter(value: number);
+    /**
+     * The list this paragraph is in.
+     *
+     * A paragraph in NO list refuses the batch (`InvalidArgument`), the way upstream's own accessor
+     * throws: a list a paragraph is not in has no members to answer, and a null object here would
+     * make "not numbered" indistinguishable from "numbered by a list this document has lost".
+     */
+    get list(): List;
+    /** Where this paragraph sits in its list. Reading `level` on a paragraph in none refuses. */
+    get listItem(): ListItem;
+    /** Empty this paragraph's text, leaving the paragraph itself where it is. */
+    clear(): void;
+    /** Remove this paragraph and everything in it. */
+    delete(): void;
+    /** Write text over this paragraph or at either edge of it. Answers the written text's range. */
+    insertText(text: string, insertLocation: 'Replace' | 'Start' | 'End'): Range;
+    /** Add a paragraph beside this one. Answers the new paragraph. */
+    insertParagraph(paragraphText: string, insertLocation: 'Before' | 'After'): Paragraph;
+    /**
+     * Break this paragraph at every occurrence of any delimiter.
+     *
+     * Answers one range per resulting paragraph, in reading order, INCLUDING the piece that keeps
+     * this paragraph's identity — so a caller can read back what each piece became without having to
+     * work out which of them is the original. The collection is filled by the split itself: there is
+     * no second read, because a second read would describe the document the split had already made.
+     */
+    split(delimiters: string[], trimDelimiters?: boolean, trimSpacing?: boolean): RangeCollection;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/**
+ * The paragraphs of a story, a range, or a list, as of the batch that loaded them.
+ *
+ * Contains paragraphs at every depth — inside table cells, nested tables, and block-level content
+ * controls — matching Word's own collection rather than only the owner's direct children.
+ *
+ * One of the two collections whose members are not plain handles: the pieces a
+ * {@link Paragraph.split} answers are filled in by the split's own command rather than by a
+ * separate listing read.
+ *
+ * @public
+ */
+declare class ParagraphCollection extends ItemCollection<Paragraph> {
+    #private;
+    /** @internal A story's paragraphs, or a range's, depending on the path it derives from. */
+    static of(context: RequestContext, label: string, owner: ObjectPath): ParagraphCollection;
+    /**
+     * @internal Paragraphs a named read answers: a list's items, or one level of them.
+     *
+     * The owner's own address does not say which paragraphs are wanted — a list is not a place in the
+     * story, it is a set of them — so the operation is supplied instead of derived.
+     */
+    static overListing(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): ParagraphCollection;
+    private constructor();
+    /** The first paragraph. `ItemNotFound` at the sync if the collection holds none. */
+    getFirst(): Paragraph;
+    /** The last paragraph. `ItemNotFound` at the sync if the collection holds none. */
+    getLast(): Paragraph;
+    /** The first paragraph, or an object that will report `isNullObject`. */
+    getFirstOrNullObject(): Paragraph;
+    /** The last paragraph, or an object that will report `isNullObject`. */
+    getLastOrNullObject(): Paragraph;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal How many members the listing's answer describes. */
+    protected size(value: AutomationValue, label: string): number;
+    /** @internal The address of one member of the listing's answer. */
+    protected addressAt(value: AutomationValue, label: string, index: number): ObjectAddress | undefined;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): Paragraph;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): Paragraph & PromisedItem;
+}
+/**
+ * Ranges a read produced — the hits of a search, or the pieces a split answered.
+ *
+ * Its members are SPANS rather than handles, which is what separates it from the handle-backed
+ * collections: each item carries its own paragraph-plus-offset endpoints instead of an opaque
+ * host-minted id.
+ *
+ * @public
+ */
+declare class RangeCollection extends ItemCollection<Range> {
+    #private;
+    /** @internal Ranges a read answers: where some text occurs. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): RangeCollection;
+    /** @internal Ranges a command answers: the pieces a split produced. Filled by that command. */
+    static answered(context: RequestContext, label: string, owner: ObjectPath): RangeCollection;
+    private constructor();
+    /** The first range. `ItemNotFound` at the sync if nothing matched. */
+    getFirst(): Range;
+    /**
+     * The last range. `ItemNotFound` at the sync if nothing matched.
+     *
+     * A DocxEditor member rather than a compatibility one: the reference's range collection publishes
+     * only its first, and the pieces of a split are the case that makes the other end worth having —
+     * "the paragraph this one ended up as" is the last piece, and counting `items` to find it means
+     * loading them all. Recorded as an omission in `compat/manifest.json` for that reason.
+     */
+    getLast(): Range;
+    /** The first range, or an object that will report `isNullObject`. */
+    getFirstOrNullObject(): Range;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation | null;
+    /** @internal How many members the listing's answer describes. */
+    protected size(value: AutomationValue, label: string): number;
+    /** @internal The address of one member of the listing's answer. */
+    protected addressAt(value: AutomationValue, label: string, index: number): ObjectAddress | undefined;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): Range;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): Range & PromisedItem;
+}
+
+/**
+ * What a control's own type accepts as a value.
+ *
+ * A discriminated union rather than `unknown`: a dropdown and a checkbox do not take the same
+ * kind of thing, and a single `setValue(value: string)` would have to guess what `'true'` means
+ * to a date picker.
+ */
+type ContentControlValue = {
+    readonly kind: 'text';
+    readonly text: string;
+} | {
+    readonly kind: 'listItem';
+    readonly value: string;
+} | {
+    readonly kind: 'checkbox';
+    readonly checked: boolean;
+}
+/** `YYYY-MM-DD`, or a full ISO-8601 instant. */
+ | {
+    readonly kind: 'date';
+    readonly iso: string;
+};
+/** The lock a control carries. `ST_Lock`, spelled as the schema spells it. */
+type ContentControlLockState = 'unlocked' | 'sdtLocked' | 'contentLocked' | 'sdtContentLocked';
+/** The control types this API can create. Picture and repeating section are deferred. */
+type ContentControlSubtype = 'richText' | 'plainText' | 'dropDownList' | 'comboBox' | 'date';
+/**
+ * A part of a document a template marked as a field.
+ *
+ * A control is NOT its `w:id`. The attribute is optional in OOXML and unique nowhere, so a
+ * document may hold one control with no id and two with the same one. This object is addressed by
+ * an opaque host-minted handle instead, and {@link ContentControl.id} is answered as METADATA — a
+ * label the file wrote, empty where it wrote none. `getById` still exists, because a template
+ * author knows their own numbering, and it answers the first match in document order rather than
+ * refusing.
+ *
+ * A control's contents are not its value. `text` reads the characters; `setValue` writes in the
+ * vocabulary the control's own type accepts — a declared item for a dropdown, an ISO date for a
+ * date picker, a state for a checkbox — because writing `"true"` into a checkbox's runs would
+ * produce a document whose glyph and whose `w14:checked` disagree.
+ *
+ * @public
+ */
+declare class ContentControl extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A control a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): ContentControl;
+    /** @internal A control a queued read will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): ContentControl;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /**
+     * The `w:id` the file wrote, as a string, and `''` where it wrote none.
+     *
+     * A STRING and not a number, deliberately. The identity of this object is its handle; a numeric
+     * `id` invites a caller to key a map on a value the schema lets a document repeat.
+     */
+    get id(): string;
+    /** `w:tag` — the machine-readable label a template puts on a field. `''` where absent. */
+    get tag(): string;
+    set tag(value: string);
+    /** `w:alias` — what Word's UI calls the control's title. `''` where absent. */
+    get title(): string;
+    set title(value: string);
+    /** What kind of control it is: `plainText`, `dropDownList`, `checkbox`, `date`, … */
+    get subtype(): string;
+    /**
+     * Whether the control refuses to be deleted.
+     *
+     * Reads the lock IN FORCE, so a control an enclosing one protects reports true even when its
+     * own `w:lock` says otherwise — that is what the document does, and reporting the control's own
+     * half would tell a caller an edit will work when the store is about to refuse it.
+     */
+    get cannotDelete(): boolean;
+    set cannotDelete(value: boolean);
+    /** Whether the control's contents refuse to be edited. Resolved like `cannotDelete`. */
+    get cannotEdit(): boolean;
+    set cannotEdit(value: boolean);
+    /**
+     * Whether the control is showing its prompt rather than a value (`w:showingPlcHdr`).
+     *
+     * STATE, not text. A control showing its placeholder holds the prompt in its runs, and the
+     * first thing written into it replaces the whole prompt — so a caller that treats `text` as a
+     * value must ask this before believing it.
+     */
+    get placeholderShown(): boolean;
+    /** Whether the control removes its own wrapper on the first content edit (`w:temporary`). */
+    get temporary(): boolean;
+    /** The characters the control encloses, as the document reads them. */
+    get text(): string;
+    /** The paragraphs the control holds. Empty for an inline control, which holds none. */
+    get paragraphs(): ParagraphCollection;
+    /** The controls INSIDE this one, in document order. */
+    get contentControls(): ContentControlCollection;
+    /**
+     * The stretch of the story the control's content covers.
+     *
+     * Read when it is asked for rather than carried by the control, because the content moves as
+     * the document is edited: the range a caller gets is where the control is now.
+     */
+    getRange(rangeLocation?: 'Whole' | 'Start' | 'End' | 'Before' | 'After' | 'Content'): Range;
+    /**
+     * Write the control's value.
+     *
+     * The refusals belong to the document, not to this method: a locked control, a control the file
+     * bound to custom XML, and a value the control's type does not accept are all refused by the
+     * engine's single write path, which is the same path a keystroke takes.
+     */
+    setValue(value: ContentControlValue): void;
+    /**
+     * Put text into the control: over what it holds, or at one end of it.
+     *
+     * `Replace` goes through the control's own value path, so the prompt it was showing and a
+     * `w:temporary` wrapper are dealt with there rather than a second time here. The range comes
+     * back from the WRITE and not from a read beside it: reads answer the document as it is when
+     * the batch is planned, so a read here would name the text the write was about to replace.
+     */
+    insertText(text: string, insertLocation: 'Replace' | 'Start' | 'End'): Range;
+    /**
+     * Remove the control.
+     *
+     * `keepContent` true is Word's own "Remove content control": the wrapper goes and the text it
+     * held stays exactly where it was. False takes the content with it.
+     */
+    delete(keepContent: boolean): void;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/** Where a collection of controls looks: a story, or inside one control. */
+type ContentControlScope = {
+    readonly body: AutomationHandle;
+} | {
+    readonly contentControl: AutomationHandle;
+};
+/**
+ * The content controls of a document, story or range, as of the batch that loaded them.
+ *
+ * `getById` answers the first match in document order, because `w:id` is optional in OOXML and
+ * unique nowhere — see {@link ContentControl} for why choosing predictably beats refusing.
+ *
+ * @public
+ */
+declare class ContentControlCollection extends HandleCollection<ContentControl> {
+    #private;
+    /** @internal The controls of a scope, in document order. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, scope: ContentControlScope): ContentControlCollection;
+    private constructor();
+    /** The first control. `ItemNotFound` at the sync if the scope holds none. */
+    getFirst(): ContentControl;
+    /** The first control, or an object that says `isNullObject` where there is none. */
+    getFirstOrNullObject(): ContentControl;
+    /**
+     * The first control carrying one `w:id`, or `ItemNotFound` where the scope holds none.
+     *
+     * FIRST in document order, because `w:id` is not unique. The lookup is one read answered by the
+     * host: matching it here would mean asking every control for its id and choosing locally, which
+     * is a batch whose size depends on how many controls the document has.
+     */
+    getById(id: number): ContentControl;
+    /** Every control in the scope carrying one tag, in document order. */
+    getByTag(tag: string): ContentControlCollection;
+    /** Every control in the scope carrying one title, in document order. */
+    getByTitle(title: string): ContentControlCollection;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): ContentControl;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): ContentControl & PromisedItem;
+}
+
+/** Which kind of note: Word's own two. */
+type NoteItemType = 'Footnote' | 'Endnote';
+/**
+ * One footnote or endnote: text that belongs to the document but not to its flow.
+ *
+ * A note IS a story. Its {@link NoteItem.body} is an ordinary {@link Body} — paragraphs,
+ * formatting, styles, the same operations — laid out at the foot of a page or the end of the
+ * document rather than in the column, so everything the object model can do to the main story it
+ * can do to a note without a second vocabulary.
+ *
+ * `delete()` removes the reference too. A note's body and the citation that reached it are one
+ * thing to a reader, and deleting the body alone would leave a mark pointing at nothing. The
+ * engine spells that as a package-level transaction, which is why it travels alone in its batch.
+ *
+ * @public
+ */
+declare class NoteItem extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A note a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): NoteItem;
+    /** @internal A note a queued read will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): NoteItem;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /** Whether this is a footnote or an endnote. */
+    get type(): NoteItemType;
+    /** The note's own story. */
+    get body(): Body;
+    /**
+     * Remove the note and every reference to it.
+     *
+     * A package transaction, so it is the ONLY operation its `sync()` may carry — the host refuses it
+     * any company rather than committing half a batch. Two syncs get a delete and anything else.
+     */
+    delete(): void;
+    /** The next note of the same kind. `ItemNotFound` at the sync when this is the last one. */
+    getNext(): NoteItem;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The notes of one kind, in the order the notes part writes them.
+ *
+ * DocxEditor's own collection type: the pinned reference fixture does not carry
+ * `Word.NoteItemCollection`, so it is not measured for conformance — recorded as an omission in
+ * `compat/manifest.json` — while `NoteItem` itself is. Without it a note would be unreachable, which
+ * is the one thing worse than an unmeasured collection.
+ */
+declare class NoteItemCollection extends HandleCollection<NoteItem> {
+    #private;
+    /** @internal A collection a named read will answer. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): NoteItemCollection;
+    private constructor();
+    /** The first note. `ItemNotFound` at the sync if the document has none of this kind. */
+    getFirst(): NoteItem;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): NoteItem;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): NoteItem & PromisedItem;
+}
+
+/**
+ * Word's own names for a kind of change.
+ *
+ * The WHOLE upstream vocabulary, because a declaration says what a caller may be handed and a caller
+ * switching on it should not have to be told which subset this engine happens to produce. Seven of
+ * these actually occur — insert, delete, replace, the two property kinds and the two move halves —
+ * because a change to a row, a cell or a section is structural, and this engine reports only the
+ * changes it can also accept or reject. See `compat/manifest.json`.
+ */
+type RevisionType = 'None' | 'Insert' | 'Delete' | 'Property' | 'ParagraphNumber' | 'DisplayField' | 'Reconcile' | 'Conflict' | 'Style' | 'Replace' | 'ParagraphProperty' | 'TableProperty' | 'SectionProperty' | 'StyleDefinition' | 'MovedFrom' | 'MovedTo' | 'CellInsertion' | 'CellDeletion' | 'CellMerge' | 'CellSplit' | 'ConflictInsert' | 'ConflictDelete';
+/** What a comment and a reply both are: an author, a date, an id and a body. */
+declare abstract class CommentBase extends ModelObject implements PromisedItem {
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /** Who wrote it. Always present: `CT_TrackChange` makes the author mandatory. */
+    get authorName(): string;
+    /** When it was written, or `null` where the file recorded no date. */
+    get creationDate(): Date;
+    /** The document's own id for it (`w:id` in the comments part). */
+    get id(): string;
+    /**
+     * What it says, as plain text.
+     *
+     * DocxEditor's own member rather than upstream's `content`: upstream declares that one writable,
+     * and rewriting a comment body is not an operation this engine offers, so publishing a read-only
+     * `content` under the same name would be a quieter divergence than a differently named read.
+     */
+    get text(): string;
+    protected loadCommentFields(request: ResolvedLoadOptions, extra: readonly string[]): void;
+    protected commentHandle(): AutomationHandle;
+}
+/**
+ * One answer in a comment thread.
+ *
+ * Authored over the parent comment's own range, because that is where the conversation is
+ * anchored and OOXML gives a reply no other place to be. Resolving is a property of the whole
+ * thread rather than of any one reply — see {@link Comment.resolved}.
+ *
+ * @public
+ */
+declare class CommentReply extends CommentBase {
+    /** @internal A reply a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): CommentReply;
+    /** @internal A reply a queued operation will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): CommentReply;
+    private constructor();
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The replies to one comment, in thread order, as of the batch that loaded them.
+ *
+ * @public
+ */
+declare class CommentReplyCollection extends HandleCollection<CommentReply> {
+    #private;
+    /** @internal The replies to one comment, in document order. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): CommentReplyCollection;
+    private constructor();
+    /** The first reply. `ItemNotFound` at the sync if nobody answered. */
+    getFirst(): CommentReply;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): CommentReply;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): CommentReply & PromisedItem;
+}
+/**
+ * A comment: a conversation about a stretch of the document, not a single remark.
+ *
+ * {@link Comment.replies} holds the answers, and resolving is a property of the whole thread —
+ * assigning `resolved` marks this comment and everything answering it, which is what Word's own
+ * pane does.
+ *
+ * `authorEmail`, a writable `content`, and `delete` are absent: `CT_Comment` records only an
+ * author and initials (Word's addresses live in `people.xml`, which this API does not read), and
+ * neither a body rewrite nor a marker-pair removal is an operation the canonical write path
+ * offers. The comment's text is published as `text`.
+ *
+ * @public
+ */
+declare class Comment extends CommentBase {
+    #private;
+    /** @internal A comment a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): Comment;
+    /** @internal A comment a queued operation will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): Comment;
+    private constructor();
+    /**
+     * Whether the thread is resolved.
+     *
+     * Assigning it resolves or reopens the WHOLE thread — this comment and its replies — because that
+     * is what resolving a conversation means, and marking the parent alone would leave a reply reading
+     * as open under a closed remark.
+     */
+    get resolved(): boolean;
+    set resolved(value: boolean);
+    /** The answers to this comment, in document order. */
+    get replies(): CommentReplyCollection;
+    /** The words the comment is about. */
+    getRange(): Range;
+    /**
+     * Answer the comment, over the same words it is anchored to.
+     *
+     * The author is the one the request context was opened with: a reply records who wrote it, and
+     * `CT_TrackChange` makes that mandatory, so a context with no author refuses here rather than
+     * writing an anonymous remark the file cannot represent.
+     */
+    reply(replyText: string): CommentReply;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The comments on a document, story or range, as of the batch that loaded them.
+ *
+ * @public
+ */
+declare class CommentCollection extends HandleCollection<Comment> {
+    #private;
+    /** @internal The comments of a scope: a whole story's, or the ones a range overlaps. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): CommentCollection;
+    private constructor();
+    /** The first comment. `ItemNotFound` at the sync if there are none. */
+    getFirst(): Comment;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): Comment;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): Comment & PromisedItem;
+}
+/**
+ * One tracked change, and a decision the engine can act on.
+ *
+ * Only revisions the engine can actually resolve are answered as objects. Structural ones — a
+ * row, a cell, a section, the table grid — are omitted from the collection entirely rather than
+ * shipped as objects whose `accept` and `reject` both refuse: code walking the collection would
+ * stall on such an item with nothing to read that explains why.
+ *
+ * @public
+ */
+declare class Revision extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A change a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): Revision;
+    /** @internal A change a queued read will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): Revision;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /** Who proposed the change. */
+    get author(): string;
+    /** When they proposed it, or `null` where the file recorded no date. */
+    get date(): Date;
+    /** What kind of change it is, by Word's own name for it. */
+    get type(): RevisionType;
+    /** The words the change covers. */
+    get range(): Range;
+    /** Keep the change, resolving every site that carries its identity in one transaction. */
+    accept(): void;
+    /** Undo the change, likewise in one transaction. */
+    reject(): void;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The tracked changes on a document, story or range, as of the batch that loaded them.
+ *
+ * Carries only the revisions the engine can resolve; see {@link Revision} for what is left out
+ * and why.
+ *
+ * @public
+ */
+declare class RevisionCollection extends HandleCollection<Revision> {
+    #private;
+    /** @internal The pending decisions of one story. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, body: AutomationHandle, document: AutomationHandle): RevisionCollection;
+    private constructor();
+    /**
+     * Keep every change, as ONE decision and one undo unit.
+     *
+     * The engine's own whole-document operation rather than a loop over `accept`: a reviewer who
+     * accepted a document's changes made one decision, and one undo should take all of them back. It
+     * refuses outright where the document holds a change the engine cannot resolve, which is the
+     * honest answer — accepting the rest would report a document as reviewed while it still carries
+     * pending changes.
+     */
+    acceptAll(): void;
+    /** Undo every change, likewise as one decision. */
+    rejectAll(): void;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): Revision;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): Revision & PromisedItem;
+    /** A collection is a `ClientObject` rather than a `ModelObject`, so it queues its own writes. */
+    private commandOn;
+}
+
+/**
+ * Which way round a page is, in Word's own spelling.
+ *
+ * Capitalised here and lower-case in the engine on purpose: the engine speaks OOXML's vocabulary,
+ * and this is the public API's. The mapping lives in this file and nowhere else.
+ */
+type PageOrientation = 'Portrait' | 'Landscape';
+/** Which header or footer of a section: Word's own three variants. */
+type HeaderFooterType = 'Primary' | 'FirstPage' | 'EvenPages';
+/**
+ * The page a section is laid out on: paper size, margins, and orientation.
+ *
+ * This is `w:sectPr` — everything a caller usually wants from a section lives here rather than on
+ * {@link Section} itself, which is mostly navigation.
+ *
+ * @public
+ */
+declare class PageSetup extends ModelObject {
+    #private;
+    /** @internal The page geometry of the section `owner` addresses. */
+    static of(context: RequestContext, label: string, owner: ObjectPath): PageSetup;
+    private constructor();
+    /** Points. */
+    get pageWidth(): number;
+    set pageWidth(value: number);
+    /** Points. */
+    get pageHeight(): number;
+    set pageHeight(value: number);
+    /**
+     * Which way round the page is.
+     *
+     * Writing it alone SWAPS this section's own dimensions rather than assuming a paper size, so a
+     * document of mixed sizes survives a flip with its sizes intact.
+     */
+    get orientation(): PageOrientation;
+    set orientation(value: PageOrientation);
+    /** Points. */
+    get topMargin(): number;
+    set topMargin(value: number);
+    /** Points. */
+    get bottomMargin(): number;
+    set bottomMargin(value: number);
+    /** Points. */
+    get leftMargin(): number;
+    set leftMargin(value: number);
+    /** Points. */
+    get rightMargin(): number;
+    set rightMargin(value: number);
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * One section: the document's layout, not its content.
+ *
+ * Everything a caller usually wants — paper size, margins, orientation — is on
+ * {@link Section.pageSetup}. The section itself is mostly navigation: the story it governs, the
+ * header and footer stories it declares, and the section after it.
+ *
+ * `getHeader` and `getFooter` answer a body that may not exist yet, and say so. A section with no
+ * first-page header inherits the previous section's; one at the start of a document with none at
+ * all is refused with `ItemNotFound` rather than minting the part. Word creates the header when a
+ * script asks for it — doing that here would make a READ write to the document, and a header that
+ * exists only because it was asked about is a header the author never added.
+ *
+ * @public
+ */
+declare class Section extends ModelObject implements PromisedItem {
+    #private;
+    /** @internal A section a read has already named. */
+    static at(context: RequestContext, label: string, address: ObjectAddress): Section;
+    /** @internal A section a queued read will name, or report as nothing. */
+    static promised(context: RequestContext, label: string, nullable: boolean): Section;
+    private constructor();
+    /** @internal Bind this object to the address the owning read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    /** @internal Settle as the null object: the read found nothing to name. */
+    hydrateNull(): void;
+    /**
+     * The story this section governs.
+     *
+     * The MAIN story, which every section of a document shares: sections divide a body's layout, not
+     * its text, so this is the same story `document.body` names rather than a slice of it.
+     */
+    get body(): Body;
+    /** The page this section is laid out on. */
+    get pageSetup(): PageSetup;
+    /** The header story of one variant, as a body. `ItemNotFound` where the document has none. */
+    getHeader(type: HeaderFooterType): Body;
+    /** The footer story of one variant, as a body. `ItemNotFound` where the document has none. */
+    getFooter(type: HeaderFooterType): Body;
+    /** The next section. `ItemNotFound` at the sync when this is the last one. */
+    getNext(): Section;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+/**
+ * The sections of a document, in document order, as of the batch that loaded them.
+ *
+ * @public
+ */
+declare class SectionCollection extends HandleCollection<Section> {
+    #private;
+    /** @internal The document's sections, in document order. */
+    static of(context: RequestContext, label: string, owner: ObjectPath, plan: () => AutomationOperation): SectionCollection;
+    private constructor();
+    /** The first section. `ItemNotFound` at the sync if the document has none. */
+    getFirst(): Section;
+    /** @internal The read that answers this collection's members. */
+    protected listing(): AutomationOperation;
+    /** @internal Build one member from an address the listing answered. */
+    protected itemAt(label: string, address: ObjectAddress): Section;
+    /** @internal A member an edge accessor named before the sync that finds it. */
+    protected promised(label: string, nullable: boolean): Section & PromisedItem;
+}
+
+/**
+ * The document: the root every other object is reached from.
+ *
+ * Deliberately thin. A document here is not a bag of content — it is the thing that HAS stories.
+ * It publishes the main story as {@link Document.body}, plus that story's paragraphs directly as
+ * `document.paragraphs`, because that is how source-compatible code walks a document.
+ *
+ * Reached once per {@link RequestContext} and memoized: `context.document` is the same object
+ * every time, so a property loaded through one reference reads back through any other.
+ *
+ * @example
+ * ```ts
+ * await runtime.run(async (context) => {
+ *   const paragraphs = context.document.paragraphs;
+ *   paragraphs.load('text');
+ *   await context.sync();
+ *   for (const paragraph of paragraphs.items) console.log(paragraph.text);
+ * });
+ * ```
+ *
+ * @public
+ */
+declare class Document extends ModelObject {
+    #private;
+    /** @internal One per request context; the context memoizes it. */
+    static open(context: RequestContext): Document;
+    private constructor();
+    /**
+     * The main story.
+     *
+     * The same proxy every time, like every navigation property in this API: a consumer who loads
+     * `document.body` and then reads `document.body.text` is talking about one object, and handing
+     * back a fresh proxy per access would put the load on one and the read on another.
+     */
+    get body(): Body;
+    /** The main story's paragraphs, in reading order. */
+    get paragraphs(): ParagraphCollection;
+    /** The document's sections, in document order. */
+    get sections(): SectionCollection;
+    /** The content controls of the main story, in document order — the outermost ones. */
+    get contentControls(): ContentControlCollection;
+    /** The comments anchored in the main story, in document order. */
+    get comments(): CommentCollection;
+    /**
+     * The tracked changes of the main story that the engine can resolve.
+     *
+     * Structural changes — a row, a cell, a section, the table grid — are not in it: they are ones the
+     * engine refuses to accept or reject, and an item whose two verbs both refuse would stall code
+     * walking the collection. `acceptAll`/`rejectAll` refuse outright where the document holds one,
+     * rather than reporting a document as reviewed while pending changes remain.
+     */
+    get revisions(): RevisionCollection;
+    /**
+     * The document's footnotes, in the order its notes part writes them.
+     *
+     * DocxEditor's own accessor: upstream reaches notes through `Body#footnotes`, whose collection type
+     * the pinned reference fixture does not carry — see `compat/manifest.json`. Without an accessor a
+     * note would be unreachable, so it is published here and recorded as unmeasured.
+     */
+    get footnotes(): NoteItemCollection;
+    /** The document's endnotes, in the order its notes part writes them. */
+    get endnotes(): NoteItemCollection;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/** What a `run` callback is given, and what it may answer with. */
+type RunCallback<T> = (context: RequestContext) => Promise<T>;
+/** Capabilities exposed by a DocxEditor runtime, frozen for its lifetime. */
+interface DocumentCapabilities {
+    /** There is a document to address at all. False for a browser host between mounts. */
+    readonly document: boolean;
+    /** `save()` is offered — true for a server runtime, false for one borrowing an editor. */
+    readonly save: boolean;
+    /** The host raises document events. */
+    readonly events: boolean;
+    /** The host has a user selection to read or move. */
+    readonly selection: boolean;
+    /** The host can be scrolled to a position. */
+    readonly scrolling: boolean;
+    /** The host lays the document out, so paginated positions are meaningful. */
+    readonly layout: boolean;
+}
+/**
+ * A runtime: one document host, many runs.
+ *
+ * Runs are ISOLATED, not serialized. Every {@link DocxEditorRuntime.run} gets its own context and
+ * its own queue, so two runs cannot interleave into one batch, and a run started inside another
+ * run works instead of waiting for a lock its own caller holds. Batches are still ordered — each
+ * `sync()` sends one atomic batch, in the order the `sync()` calls happen.
+ *
+ * Disposal is final: {@link DocxEditorRuntime.dispose} releases the host once and is safe to call
+ * again, and every later `run` fails with `RuntimeDisposed`.
+ *
+ * @public
+ */
+interface DocxEditorRuntime {
+    /** What the document host behind this runtime can do. Frozen at construction. */
+    readonly capabilities: DocumentCapabilities;
+    /** Run one batch of work against the document. Answers with the callback's value. */
+    run<T>(callback: RunCallback<T>): Promise<T>;
+    /** Run one batch of work, adopting objects a previous run tracked. */
+    run<T>(object: ClientObject | readonly ClientObject[], callback: RunCallback<T>): Promise<T>;
+    /** Release the host. Idempotent. */
+    dispose(): void;
+}
+/**
+ * A runtime over DOCX bytes rather than a live editor — what `DocxEditor.createServer` answers.
+ *
+ * Adds {@link DocxEditorServerRuntime.save} to the shared contract, because a server runtime owns
+ * its document and can serialize it; a browser runtime borrows the editor's and cannot.
+ *
+ * @public
+ */
+interface DocxEditorServerRuntime extends DocxEditorRuntime {
+    /** The current document as DOCX bytes. */
+    save(): Promise<Uint8Array>;
+}
+
+/**
+ * The objects a context keeps addressable beyond the run that created them.
+ *
+ * An ordinary proxy stops being usable when its run ends. Tracking one keeps its address alive so
+ * a later `run(object, callback)` can adopt it, and untracking releases it — which matters for
+ * long-lived callers, since a tracked object is a document reference that will not be collected
+ * on its own.
+ *
+ * @public
+ */
+declare class TrackedObjects {
+    #private;
+    /** @internal Built by the static factories above, never directly. */
+    constructor(internals: ContextInternals, owns: (object: ClientObject) => boolean);
+    /** Keep these objects usable after this run ends. */
+    add(object: ClientObject | readonly ClientObject[]): void;
+    /** Stop keeping them: they are released when this run ends, like any other object. */
+    remove(object: ClientObject | readonly ClientObject[]): void;
+}
+
+/** What a context needs from the runtime that made it. */
+interface RuntimeSession {
+    readonly host: AutomationHost;
+    readonly capabilities: AutomationCapabilities;
+    /** Who a comment this runtime writes is recorded as, or absent when it may not write one. */
+    readonly author?: string;
+    /** Identity for adoption checks. The session object itself. */
+    readonly id: object;
+    roots(): RootHandles;
+    /** Refuse if the runtime has been disposed. */
+    assertLive(target?: string): void;
+    /**
+     * Build the document proxy for a context.
+     *
+     * Injected rather than imported, so this module does not depend on the object model that
+     * depends on it. The runtime composes the two; the context only knows it can ask for one.
+     */
+    openDocument(context: RequestContext): Document;
+}
+/**
+ * What a `run` hands its callback: one queue, one document, one sync at a time.
+ *
+ * `sync()` is the only thing in this runtime that talks to the document, and it does so exactly
+ * once per call — plan the queued actions in order, send ONE batch, hydrate the answers. That is
+ * where atomicity comes from: the host commits a batch as one transaction, and the runtime never
+ * splits a consumer's `sync()` into several batches behind their back.
+ *
+ * Conditional writes come from the same place. A context that has READ from the document
+ * remembers the revision it read at, and a later batch that writes goes out conditional on it,
+ * failing `StaleDocument` if the document moved. That is what stops a decision made from a cached
+ * read being applied to a document that has since changed — the hazard the read-decide-write
+ * shape of any batching API invites. A context that has read nothing has nothing to be stale
+ * about, so its writes go out unconditionally.
+ *
+ * @public
+ */
+declare class RequestContext {
+    #private;
+    private constructor();
+    /**
+     * The document this run is against.
+     *
+     * The SAME object for the life of the context, like every navigation property in this API: a
+     * consumer who loads `context.document.body` and then reads its text is talking about one
+     * object, and a fresh proxy per access would put the load on one and the read on another.
+     */
+    get document(): Document;
+    /** What the document host behind this context can do. */
+    get capabilities(): DocumentCapabilities;
+    /** Objects kept addressable past the run that created them. See {@link TrackedObjects}. */
+    get trackedObjects(): TrackedObjects;
+    /**
+     * Send everything queued as one batch and hydrate the answers.
+     *
+     * An empty queue is not a round trip. Office-shaped code syncs defensively at the end of a
+     * batch, and turning "nothing to say" into a host call would make a no-op sync advance a
+     * revision and fire a change event for nobody.
+     */
+    sync(): Promise<void>;
+    /** @internal The seam proxies reach the context through. */
+    get [INTERNALS](): ContextInternals;
+    /** @internal Only `run` may build one, and only `run` may end one. */
+    static begin(session: RuntimeSession): {
+        context: RequestContext;
+        adopt: (objects: readonly ClientObject[]) => void;
+        finish: () => void;
+    };
+}
+
+declare const INTERNALS: unique symbol;
+declare const RELEASE: unique symbol;
+declare const REBIND: unique symbol;
+/** The handles every object model starts from. Resolved once per runtime. */
+interface RootHandles {
+    readonly document: AutomationHandle;
+    readonly body: AutomationHandle;
+}
+/** What a proxy may ask of the context it belongs to. */
+interface ContextInternals {
+    readonly host: AutomationHost;
+    readonly capabilities: AutomationCapabilities;
+    /**
+     * Who a comment written through this context is recorded as, or absent when none was given.
+     *
+     * `CT_TrackChange` makes `@w:author` mandatory, and this API has no signed-in user, so a comment
+     * write refuses (`NotSupported`) rather than putting a made-up name in the file.
+     */
+    readonly author?: string;
+    readonly queue: ActionQueue;
+    /**
+     * Identity of the runtime session behind this context.
+     *
+     * Compared, never called: it is how `run(object, ...)` refuses to adopt an object minted by a
+     * different runtime, whose handles name a document this host never opened.
+     */
+    readonly session: object;
+    roots(): RootHandles;
+    /**
+     * Refuse if this context can no longer be used — its run finished, or the runtime was
+     * disposed. `target` names the object or property the caller was reaching for.
+     */
+    assertUsable(target?: string): void;
+    /**
+     * Whether this context's run has ended.
+     *
+     * Narrower than `assertUsable`, and asked by adoption for a reason: a LIVE context's objects are
+     * still its own, and taking one would interleave that run's next call into another run's batch.
+     */
+    isFinished(): boolean;
+    /** The revision this context last read at, or `null` if it has never read. */
+    readRevision(): number | null;
+    register(object: RuntimeManagedObject): void;
+    track(object: RuntimeManagedObject): void;
+    untrack(object: RuntimeManagedObject): void;
+    isTracked(object: RuntimeManagedObject): boolean;
+    /**
+     * Give up every claim on an object: it belongs to another context now.
+     *
+     * The other half of a rebind. Without it the object would still be in this context's registries
+     * — two owners for one lifetime, one of which could release it out from under the other.
+     */
+    disown(object: RuntimeManagedObject): void;
+}
+/** What a context may do to a proxy it owns. */
+interface RuntimeManagedObject {
+    /** @internal Drop this object's document reference; the run that owned it has ended. */
+    [RELEASE](): void;
+    /** Adoption: this object now belongs to another run's context on the same runtime. */
+    [REBIND](context: RequestContext): void;
+}
+
+/**
+ * The object form of `load(...)`: which properties, and how much of a collection.
+ *
+ * An unknown key, a non-integer `top`, a property name that is not an identifier, or a value of
+ * the wrong type is refused as `InvalidArgument` here, naming the option — a misspelled key is
+ * the difference between "load selected properties" and "load nothing", which would otherwise
+ * surface as a `PropertyNotLoaded` much later at a call that looks correct.
+ *
+ * @public
+ */
+interface LoadQueryOptions {
+    /** Which properties to load. */
+    readonly select?: string | readonly string[];
+    /** Which navigation properties to load along with them. */
+    readonly expand?: string | readonly string[];
+    /** For a collection: at most this many items. */
+    readonly top?: number;
+    /** For a collection: skip this many items first. */
+    readonly skip?: number;
+}
+/**
+ * Everything `load(...)` accepts: one property name, several, or a
+ * {@link LoadQueryOptions} object.
+ *
+ * @example
+ * ```ts
+ * paragraph.load('text');
+ * paragraph.load(['text', 'style']);
+ * paragraphs.load({ select: ['text'], top: 5 });
+ * ```
+ *
+ * @public
+ */
+type LoadOption = string | readonly string[] | LoadQueryOptions;
+interface ResolvedLoadOptions {
+    /** Selected property names. Empty means "this object's default set". */
+    readonly select: readonly string[];
+    readonly expand: readonly string[];
+    readonly top?: number;
+    readonly skip?: number;
+}
+
+/**
+ * What the host is told to look at.
+ *
+ * Two shapes, because the protocol names two kinds of thing. Most objects ARE something the host
+ * minted a handle for. A stretch of a story is not: it is two endpoints, each a paragraph handle
+ * and a UTF-16 offset, and there is no third object behind it to hand out a handle for. Giving a
+ * range a handle of its own would mean the host tracking a region across every edit, which is a
+ * promise it cannot keep — so the address is the endpoints, and a deleted paragraph makes the
+ * whole address refuse rather than silently name a different place.
+ */
+type ObjectAddress = {
+    readonly kind: 'handle';
+    readonly handle: AutomationHandle;
+} | {
+    readonly kind: 'span';
+    readonly span: AutomationSpan;
+};
+type ObjectPathState = 
+/** Promised: created by a queued read that has not answered yet. */
+{
+    readonly status: 'pending';
+}
+/** Addressable: the host has named this object, or the span it stands for is known. */
+ | {
+    readonly status: 'resolved';
+    readonly address: ObjectAddress;
+}
+/** A `get…OrNullObject` that found nothing. Not an error, and never addressable. */
+ | {
+    readonly status: 'null';
+}
+/** Its run ended without tracking it. Terminal. */
+ | {
+    readonly status: 'released';
+};
+declare class ObjectPath {
+    #private;
+    readonly label: string;
+    private constructor();
+    /** A path that is addressable from the moment it exists — a root, or an item just hydrated. */
+    static of(label: string, handle: AutomationHandle): ObjectPath;
+    /** The same, for an object that IS a stretch of a story. */
+    static ofSpan(label: string, span: AutomationSpan): ObjectPath;
+    /** A path a queued read will fill in — or mark null. */
+    static pending(label: string): ObjectPath;
+    /** A path that is whatever its owner's path is, under its own name. */
+    static derived(label: string, parent: ObjectPath): ObjectPath;
+    get state(): ObjectPathState;
+    get isAddressable(): boolean;
+    get isPending(): boolean;
+    get isNull(): boolean;
+    get isReleased(): boolean;
+    /**
+     * What to put in a batch, or a refusal.
+     *
+     * Both refusals are `InvalidObjectPath` on purpose: from a consumer's side "this object was
+     * released" and "this object is still a promise" are the same mistake — using an object the
+     * runtime cannot address yet or any more — and the `target` says which object it was.
+     */
+    address(): ObjectAddress;
+    /** The handle to address this object with. Refused for anything that is not handle-shaped. */
+    handle(): AutomationHandle;
+    /** The span this object stands for. Refused for anything that is not span-shaped. */
+    span(): AutomationSpan;
+    /**
+     * Hydration: the read answered, and this is the object it named.
+     *
+     * A released path stays released. Hydration arriving for one is not an error — a batch can be
+     * in flight when a run ends — but resurrecting the object would hand back a proxy whose
+     * lifetime rules had already been applied.
+     */
+    resolveTo(handle: AutomationHandle): void;
+    /** The same, for an object that came back as a stretch of a story. */
+    resolveToSpan(span: AutomationSpan): void;
+    /** Hydration: the read answered, and there was nothing there. */
+    resolveNull(): void;
+    /**
+     * The run ended and nothing kept this object alive. Terminal.
+     *
+     * A derived path does not release: its owner's release is what governs it, and releasing here
+     * would let a collection's lifetime end its parent's.
+     */
+    release(): void;
+}
+
+/**
+ * The base every document proxy extends.
+ *
+ * A proxy is three things and no more: the context it belongs to, the path that says whether it
+ * can be addressed, and the properties a completed `load` filled in.
+ *
+ * A RELEASED proxy still answers what it already knew. Reading a property loaded before the run
+ * ended is served from memory, because that value is a copy the consumer already holds — it is
+ * not a reach into a document. Anything that would talk to the document (`load`, a write, a
+ * method) refuses with `InvalidObjectPath`. The line is "does this need the document", not "does
+ * this look like a read".
+ *
+ * @public
+ */
+declare abstract class ClientObject implements RuntimeManagedObject {
+    #private;
+    protected constructor(context: RequestContext, path: ObjectPath, options?: {
+        readonly nullable?: boolean;
+    });
+    /** The context this object currently belongs to. */
+    get context(): RequestContext;
+    /**
+     * Whether this object turned out not to exist.
+     *
+     * Only ever an answer, never a guess: an object that came from a `getItemOrNullObject` has no
+     * verdict until the sync that looked for it, and reading one before then is
+     * `PropertyNotLoaded` rather than a plausible `false`. Objects that are not "or null" are
+     * never null, so they answer immediately.
+     */
+    get isNullObject(): boolean;
+    /**
+     * Queue the reads that fill in the selected properties.
+     *
+     * Returns `this` so a load can be chained, and queues rather than fetches: the values are
+     * readable after the next `sync()`, and reading before then is `PropertyNotLoaded`.
+     */
+    load(option?: LoadOption): this;
+    /** What this kind of object does with a resolved load request. */
+    protected abstract onLoad(request: ResolvedLoadOptions): void;
+    /** @internal This object's address, or the placeholder standing in until a sync resolves it. */
+    protected get path(): ObjectPath;
+    /** @internal The owning context's internal surface. */
+    protected get internals(): ContextInternals;
+    /** The handle to address this object with, or `InvalidObjectPath`. */
+    protected handle(): AutomationHandle;
+    /**
+     * The check every call that talks to the document makes first.
+     *
+     * At the CALL, not at the sync: a consumer who writes to an object whose run has ended has
+     * made the mistake already, and reporting it three lines later at `sync()` describes it as a
+     * batch failure instead of as the bad call it was.
+     *
+     * THE OBJECT IS ASKED ABOUT BEFORE ITS CONTEXT, and the order is the answer to a real
+     * question: an untracked object outside its run is BOTH released and holding a finished
+     * context. `InvalidObjectPath` is the useful half — the object itself is gone, and no amount
+     * of starting another run brings it back — whereas a tracked object in the same position is
+     * perfectly good and only needs adopting, which is what `InvalidRequestContext` says.
+     */
+    protected requireAddressable(): void;
+    /** @internal Add one action to the context's queue, to be planned at the next sync. */
+    protected enqueue(action: QueuedAction): void;
+    /** @internal Read a property a completed `load` filled in; refuses if none did. */
+    protected loadedProperty<T>(name: string): T;
+    /** @internal Whether a completed `load` filled this property in. */
+    protected hasLoadedProperty(name: string): boolean;
+    /** @internal Record a value a completed load produced. */
+    protected setLoadedProperty(name: string, value: unknown): void;
+    /** @internal Drop this object's document reference; the run that owned it has ended. */
+    [RELEASE](): void;
+    /** @internal Adopt this object into another run's context. */
+    [REBIND](context: RequestContext): void;
+}
+
+/**
+ * A value a queued method promised to produce, readable after the next `sync()`.
+ *
+ * Deliberately not a `Promise`. A method call inside a batch has not been sent yet, so there is
+ * no pending work to await and nothing that could resolve on its own — awaiting one would
+ * deadlock a consumer who then never calls `sync()`. A result is a box that stays EMPTY until the
+ * sync fills it, and reading it early is `ValueNotLoaded` rather than `undefined` flowing onwards
+ * into something that misinterprets it.
+ *
+ * @example
+ * ```ts
+ * const count = body.getParagraphCount();
+ * await context.sync();
+ * console.log(count.value);
+ * ```
+ *
+ * @public
+ */
+declare class ClientResult<T> {
+    #private;
+    /** @internal Use `clientResult()`; only the creator gets the filling half. */
+    private constructor();
+    /**
+     * The value, once a `sync()` has filled it in.
+     *
+     * Reading before then is `ValueNotLoaded` rather than `undefined`, so a mistake surfaces at the
+     * read instead of flowing onwards into something that misinterprets it.
+     */
+    get value(): T;
+    /** Whether the sync that fills this has happened. */
+    get isLoaded(): boolean;
+    /** @internal The box and the way to fill it, so only the creator can settle it. */
+    static create<T>(target: string): {
+        result: ClientResult<T>;
+        fill: (value: T) => void;
+    };
+}
+
+/** What went wrong, as a value a consumer may branch on. */
+type DocxEditorErrorCode = 
+/** A property was read before a `load(...)` for it completed in a `sync()`. */
+'PropertyNotLoaded'
+/** A `ClientResult` value was read before the sync that fills it. */
+ | 'ValueNotLoaded'
+/** The object is no longer addressable: its run ended and it was not tracked. */
+ | 'InvalidObjectPath'
+/** The object still belongs to a run that has not finished, so it cannot be handed over. */
+ | 'ObjectInUse'
+/** An argument or load option this API does not accept. */
+ | 'InvalidArgument'
+/** The collection has no such item — `getFirst()` on an empty one. */
+ | 'ItemNotFound'
+/** The host cannot do this at all — a capability it reports false. */
+ | 'NotSupported'
+/**
+ * The member exists in this API's shape but this version does not implement it.
+ *
+ * Distinct from `NotSupported`, which is about the HOST: a headless document really has no
+ * caret, and no version of this library will give it one. This code means the library, not the
+ * document, is the limit — so a consumer knows to check the release notes rather than the host.
+ */
+ | 'NotImplemented'
+/**
+ * Two calls in one batch make claims on the same paragraph that cannot both hold.
+ *
+ * A batch is one transaction planned against the state at its start, which stops being
+ * unambiguous once two calls restructure the same paragraph. Split them across two `sync()`
+ * calls and each gets exactly what it asked for.
+ */
+ | 'ConflictingChanges'
+/** The request context's `run` has finished, so it can no longer be used. */
+ | 'InvalidRequestContext'
+/** The runtime was disposed. Every later operation fails this way. */
+ | 'RuntimeDisposed'
+/** The document moved under a context that had already read from it; nothing was applied. */
+ | 'StaleDocument'
+/** The host is live but holds no document right now — an editor between mounts. */
+ | 'DocumentUnavailable'
+/** The document refused the change, or answered something this runtime cannot use. */
+ | 'GeneralException';
+/**
+ * The fields a {@link DocxEditorError} is constructed from.
+ *
+ * @public
+ */
+interface DocxEditorErrorInit {
+    /** Which refusal this is. The stable thing to branch on. */
+    readonly code: DocxEditorErrorCode;
+    /**
+     * The consumer-facing path of the object or property involved — `document.body.text`, not a
+     * handle. Omitted when there is nothing to name.
+     */
+    readonly target?: string;
+    /** The revision the context had read at, for `StaleDocument`. */
+    readonly expectedRevision?: number;
+    /** The revision the document was actually at, for `StaleDocument`. */
+    readonly actualRevision?: number;
+}
+/**
+ * Every refusal this runtime throws.
+ *
+ * Branch on {@link DocxEditorError.code}, never on the message. Codes are stable public API —
+ * added rather than repurposed — so a consumer that handles `PropertyNotLoaded` by loading and
+ * syncing again keeps working across versions.
+ *
+ * Nothing from the engine appears in the message. Host rejection reasons, opaque handle refs and
+ * offset ranges are all withheld: a ref in a message is a name a consumer can start depending on,
+ * and a store's rejection reason would become a documented one the moment somebody matched on it.
+ * What a consumer gets instead is a stable code, a fixed sentence, and `target` — the
+ * consumer-facing path they wrote themselves.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   await context.sync();
+ * } catch (error) {
+ *   if (error instanceof DocxEditorError && error.code === 'StaleDocument') {
+ *     // Re-read and retry: someone else changed the document first.
+ *   }
+ * }
+ * ```
+ *
+ * @public
+ */
+declare class DocxEditorError extends Error {
+    /** Which refusal this is. Stable across versions; the thing to branch on. */
+    readonly code: DocxEditorErrorCode;
+    /** Consumer-facing path of the object or property involved, when there is one to name. */
+    readonly target?: string;
+    /** For `StaleDocument`: the revision the context had read at. */
+    readonly expectedRevision?: number;
+    /** For `StaleDocument`: the revision the document was actually at. */
+    readonly actualRevision?: number;
+    constructor(init: DocxEditorErrorInit);
+}
+/**
+ * Whether a caught value is one of ours.
+ *
+ * By `name` as well as by `instanceof`: a consumer can end up with two copies of this module
+ * (a bundle plus a dependency's), and an `instanceof` that fails across them would send a
+ * perfectly ordinary `PropertyNotLoaded` down a consumer's unexpected-error path.
+ */
+declare function isDocxEditorError(value: unknown): value is DocxEditorError;
+
+/**
+ * A story: the main body of a document, a header or footer variant, or a note's body — and
+ * everything in it in reading order.
+ *
+ * Its paragraphs are the DOCUMENT'S, not just the top level's. A paragraph inside a table cell,
+ * or inside a table inside a cell, or inside a block-level content control, is an ordinary
+ * editable paragraph and appears here, exactly as it does in Word's own paragraph collection. A
+ * collection listing only direct children would describe a smaller document than the one on
+ * screen.
+ *
+ * {@link Body.clear} leaves one empty paragraph, matching what Word produces when a reader
+ * selects everything and deletes. A body that already holds no paragraph reports
+ * `InvalidArgument` rather than inventing a block.
+ *
+ * @public
+ */
+declare class Body extends ModelObject {
+    #private;
+    /** @internal The main story of the document this context is running against. */
+    static main(context: RequestContext, label: string): Body;
+    /**
+     * @internal A story a read will name: a header or footer variant, or a note's body.
+     *
+     * The OWNER queues that read — a section, a note — because a pending object cannot address the
+     * document yet, and it is the owner that can. Like every object a batch produces in this runtime,
+     * the story is addressable from the next batch on.
+     */
+    static promisedStory(context: RequestContext, label: string): Body;
+    /** @internal Bind this story to the handle the owner's read answered. */
+    hydrateAddress(address: ObjectAddress): void;
+    private constructor();
+    /**
+     * The whole story's text.
+     *
+     * Its paragraphs joined by a carriage return — one paragraph mark each — which is the separator
+     * Word's own text property uses, so a caller counting characters counts what Word counts.
+     */
+    get text(): string;
+    /** Every paragraph in this story in reading order, at every depth. */
+    get paragraphs(): ParagraphCollection;
+    /** The character formatting of the whole story: what all of it agrees on, and what a write sets. */
+    get font(): Font;
+    /**
+     * @internal A collection over this story under another name.
+     *
+     * `document.paragraphs` is the main story's paragraphs, and it is its OWN object: loading it must
+     * not quietly load `document.body.paragraphs` too, and an error about it should say which of the
+     * two the consumer wrote.
+     */
+    paragraphsUnder(label: string): ParagraphCollection;
+    /**
+     * The paragraph style, by the name a reader sees in the styles gallery.
+     *
+     * Reading answers the name every paragraph in the story agrees on, and `null` where they do not or
+     * where the document names no style. Writing applies it to all of them, and a name the document
+     * does not already define is refused rather than created — a minted style would report itself
+     * applied while the text stayed exactly as it looked.
+     */
+    get style(): string;
+    set style(value: string);
+    /** Every list this story holds, in the order their numbers first appear. */
+    get lists(): ListCollection;
+    /**
+     * The content controls this story holds, in document order — the OUTERMOST ones.
+     *
+     * A control inside another is reached through the control that holds it, because a flat list of
+     * a story's controls makes a field and the group wrapping it look like siblings.
+     */
+    get contentControls(): ContentControlCollection;
+    /** The comments anchored in this story, in document order. Replies hang off the comment. */
+    getComments(): CommentCollection;
+    /**
+     * The tracked changes in this story that the engine can resolve, in document order.
+     *
+     * DocxEditor's own accessor: upstream reaches revisions from the document, and this story-scoped
+     * one is what makes a header's or a note's changes reachable at all. Recorded in
+     * `compat/manifest.json`.
+     */
+    get revisions(): RevisionCollection;
+    /** Every occurrence of `searchText` in this story, as ranges, in reading order. */
+    search(searchText: string, options?: SearchOptions): RangeCollection;
+    /** Empty the story, leaving one empty paragraph behind. */
+    clear(): void;
+    /** Write text over the whole story, or at either edge of it. Answers the text's own range. */
+    insertText(text: string, insertLocation: 'Replace' | 'Start' | 'End'): Range;
+    /** Add a paragraph at the start or the end of the story. Answers the new paragraph. */
+    insertParagraph(paragraphText: string, insertLocation: 'Start' | 'End'): Paragraph;
+    /** @internal Plan the read this object's `load(...)` asked for. */
+    protected onLoad(request: ResolvedLoadOptions): void;
+}
+
+/** Resource limits for the DOCX archive. */
+interface DocumentZipLimits {
+    /** Most entries the archive may contain. */
+    readonly maxEntries: number;
+    /** Most bytes the archive may decompress to in total. */
+    readonly maxTotalBytes: number;
+    /** Highest tolerated decompression ratio — the zip-bomb guard. */
+    readonly maxRatio?: number;
+}
+/** Resource limits for each parsed XML part. */
+interface DocumentXmlLimits {
+    /** Most bytes any one XML part may be. */
+    readonly maxBytes: number;
+    /** Most elements any one XML part may contain. */
+    readonly maxElements?: number;
+}
+/** Optional tighter limits applied while opening untrusted DOCX bytes. */
+interface DocumentLimits {
+    /** Archive-level caps. */
+    readonly zip?: DocumentZipLimits;
+    /** Per-part XML caps. */
+    readonly xml?: DocumentXmlLimits;
+    /** Most XML parts the package may hold. */
+    readonly maxXmlParts?: number;
+    /** Most relationships the package may declare. */
+    readonly maxRelationships?: number;
+}
+/**
+ * How `DocxEditor.createServer` opens a document.
+ *
+ * Opening DOCX bytes is a bounded parse: decompression-ratio and size caps, part and relationship
+ * path validation, DTD- and entity-free XML. A refusal comes back as `InvalidArgument` rather
+ * than as a throw from inside a zip decoder, and says nothing about WHY — a caller opening files
+ * they did not author gets "not a document this API can open", so a probe cannot use the error to
+ * learn the reader's limits.
+ *
+ * @public
+ */
+interface CreateServerOptions {
+    /**
+     * Tighter budgets for the bounded reader — zip ratio, part count, XML depth.
+     *
+     * Exposed because a server opening documents it did not author is exactly where a caller may
+     * want smaller limits than the defaults. Omitted means the engine's own defaults.
+     */
+    readonly limits?: DocumentLimits;
+    /**
+     * Who comments this runtime writes are recorded as.
+     *
+     * Required to write one at all: `CT_TrackChange` makes `@w:author` mandatory and a server has no
+     * signed-in user, so a runtime opened without this refuses comment writes rather than putting a
+     * placeholder name into someone's document.
+     */
+    readonly author?: string;
+}
+
+export { type SearchOptions as $, ListItem as A, type BesideLocation as B, type CreateServerOptions as C, type DocxEditorServerRuntime as D, type LoadOption as E, Font as F, type LoadQueryOptions as G, type HeaderFooterType as H, type InsertLocation as I, NoteItemCollection as J, type NoteItemType as K, List as L, PageSetup as M, NoteItem as N, Paragraph as O, type PageOrientation as P, type ParagraphAlignment as Q, ParagraphCollection as R, type ParagraphInsertTextLocation as S, Range as T, RangeCollection as U, type RangeInsertTextLocation as V, RequestContext as W, Revision as X, RevisionCollection as Y, type RevisionType as Z, type RunCallback as _, Body as a, Section as a0, SectionCollection as a1, type SelectionMode as a2, TrackedObjects as a3, isDocxEditorError as a4, type BodyInsertParagraphLocation as b, type BodyInsertTextLocation as c, Bookmark as d, BookmarkCollection as e, ClientObject as f, ClientResult as g, Comment as h, CommentCollection as i, CommentReply as j, CommentReplyCollection as k, ContentControl as l, ContentControlCollection as m, type ContentControlLockState as n, type ContentControlSubtype as o, type ContentControlValue as p, Document as q, type DocumentCapabilities as r, type DocumentLimits as s, type DocumentXmlLimits as t, type DocumentZipLimits as u, DocxEditorError as v, type DocxEditorErrorCode as w, type DocxEditorErrorInit as x, type DocxEditorRuntime as y, ListCollection as z };