@sametalmdr/word-editor 0.2.0-alpha → 0.3.0-alpha

package/dist/io/ooxml/drawingml.js

@@ -1,232 +1,232 @@
-// wp:anchor -> geometry, group-child coordinates, paragraph/run/mark
-// extraction. Ported from scripts/docx-to-canvas-json.py's convert()/
-// parse_xfrm()/paragraphs_of()/run_marks() — same fields, same "findall is
-// DIRECT CHILDREN ONLY" semantics, same silent-continue gaps (PARITY FIRST,
-// ADR-0020 §2: this piece must not fix what Python doesn't read yet —
-// pic:pic, bodyPr, anything beyond bold/italic/underline).
-//
-// `walkDocumentOrder` is THE single-pass replacement for Python's already
-// bugfixed-but-still-two-list `collect()` + regex `anchor_starts` pair
-// (ADR-0020 §1a/B1). Every element carries its own byte offset (xml-scan.js),
-// so there is no second list to build, and nothing to zip by index — the
-// anchor IS its own true offset. sections.js imports this same walker for
-// sectPr collection so the txbxContent/mc:Fallback exclusion rule is written
-// ONCE, not twice (the exact "two copies drifted" risk network-patterns.js
-// already had once in this project).
-
-import { getAttr, isElement as isEl, findChild, findChildren } from "./xml-scan.js";
-import { W_NS, WP_NS, A_NS, WPS_NS, WPG_NS, PIC_NS, MC_NS } from "./ns.js";
-import { rejectInlineDrawing } from "./import-gate.js";
-
-/**
- * @param {import("./xml-scan.js").XmlElement} el
- * @param {string} uri
- * @param {string} localName
- * @param {import("./xml-scan.js").XmlElement} path
- * @returns {string}
- */
-function requireAttr(el, uri, localName, path) {
-  const v = getAttr(el, uri, localName);
-  if (v === undefined) {
-    throw new Error(`drawingml: <${path.prefix ? path.prefix + ":" : ""}${path.localName}> is missing required attribute ${JSON.stringify(localName)} (bayt ${el.start})`);
-  }
-  return v;
-}
-
-/**
- * Single-pass, document-order walk. Never descends into `w:txbxContent`
- * (a drawing nested inside a text box's own content — parity with Python's
- * `collect()`, which excludes it for the same reason its separate
- * `anchor_starts` regex scan masks it out first). For `mc:AlternateContent`,
- * descends ONLY into the first `mc:Choice` found — never `mc:Fallback` (the
- * VML duplicate) — matching `el.find(q("mc","Choice"))`'s "first match,
- * Requires ignored" simplification exactly, not a spec-correct MC processor.
- * @param {import("./xml-scan.js").XmlElement} el
- * @param {(el: import("./xml-scan.js").XmlElement) => void} visit
- * @returns {void}
- */
-export function walkDocumentOrder(el, visit) {
-  visit(el);
-  if (isEl(el, W_NS, "txbxContent")) return;
-  if (isEl(el, MC_NS, "AlternateContent")) {
-    const choice = findChild(el, MC_NS, "Choice");
-    if (choice) walkDocumentOrder(choice, visit);
-    return;
-  }
-  for (const child of el.children) {
-    if (child.kind === "element") walkDocumentOrder(child, visit);
-  }
-}
-
-/**
- * Every `wp:anchor`, in true document order — a `w:drawing`'s own direct
- * children, collected as `walkDocumentOrder` reaches each `w:drawing`.
- *
- * A `w:drawing` wrapping `wp:inline` instead is rejected here rather than
- * silently producing zero anchors for it (ADR-0020 Karar 4: 0/46 real corpus
- * documents use inline placement, so a document that does is corpus-external
- * and this importer has no coordinate to give it).
- * @param {import("./xml-scan.js").XmlElement} root
- * @returns {import("./xml-scan.js").XmlElement[]}
- */
-export function collectAnchors(root) {
-  /** @type {import("./xml-scan.js").XmlElement[]} */
-  const anchors = [];
-  walkDocumentOrder(root, (el) => {
-    if (isEl(el, W_NS, "drawing")) {
-      if (findChildren(el, WP_NS, "inline").length > 0) {
-        rejectInlineDrawing(`w:drawing at byte ${el.start}`);
-      }
-      anchors.push(...findChildren(el, WP_NS, "anchor"));
-    }
-  });
-  return anchors;
-}
-
-/**
- * @typedef {object} Xfrm
- * @property {number} offX
- * @property {number} offY
- * @property {number} extCx
- * @property {number} extCy
- * @property {number} chOffX
- * @property {number} chOffY
- * @property {number} chExtCx
- * @property {number} chExtCy
- * @property {number} rot
- * @property {boolean} flipH
- * @property {boolean} flipV
- */
-
-/**
- * off/ext/chOff/chExt, plus rot/flipH/flipV — read unconditionally (ported
- * from parse_xfrm; docs/corpus-inventory.md Bölüm 8 found these were never
- * read at all, a real gap: a rotated shape's position was computed as if it
- * were not rotated, with no signal anywhere that anything had been dropped).
- * Values are carried through as-is, not interpreted.
- * @param {import("./xml-scan.js").XmlElement | undefined} spPr
- * @returns {Xfrm | null}
- */
-export function parseXfrm(spPr) {
-  if (!spPr) return null;
-  const xfrm = findChild(spPr, A_NS, "xfrm");
-  if (!xfrm) return null;
-  const off = findChild(xfrm, A_NS, "off");
-  const ext = findChild(xfrm, A_NS, "ext");
-  if (!off || !ext) return null;
-  const chOff = findChild(xfrm, A_NS, "chOff");
-  const chExt = findChild(xfrm, A_NS, "chExt");
-
-  const extCx = Number.parseInt(requireAttr(ext, "", "cx", ext), 10);
-  const extCy = Number.parseInt(requireAttr(ext, "", "cy", ext), 10);
-
-  return {
-    offX: Number.parseInt(requireAttr(off, "", "x", off), 10),
-    offY: Number.parseInt(requireAttr(off, "", "y", off), 10),
-    extCx,
-    extCy,
-    chOffX: chOff ? Number.parseInt(requireAttr(chOff, "", "x", chOff), 10) : 0,
-    chOffY: chOff ? Number.parseInt(requireAttr(chOff, "", "y", chOff), 10) : 0,
-    chExtCx: chExt ? Number.parseInt(requireAttr(chExt, "", "cx", chExt), 10) : extCx,
-    chExtCy: chExt ? Number.parseInt(requireAttr(chExt, "", "cy", chExt), 10) : extCy,
-    rot: Number.parseInt(getAttr(xfrm, "", "rot") ?? "0", 10),
-    flipH: getAttr(xfrm, "", "flipH") === "1",
-    flipV: getAttr(xfrm, "", "flipV") === "1",
-  };
-}
-
-// Python's `val not in ("0", "false", "none")` guard against an explicit off-value.
-const MARK_OFF_VALUES = new Set(["0", "false", "none"]);
-
-/**
- * @param {import("./xml-scan.js").XmlElement} runEl
- * @returns {{bold?: true, italic?: true, underline?: true}}
- */
-export function runMarks(runEl) {
-  const rPr = findChild(runEl, W_NS, "rPr");
-  /** @type {{bold?: true, italic?: true, underline?: true}} */
-  const marks = {};
-  if (!rPr) return marks;
-  for (const [tag, name] of /** @type {const} */ ([
-    ["b", "bold"],
-    ["i", "italic"],
-    ["u", "underline"],
-  ])) {
-    const el = findChild(rPr, W_NS, tag);
-    if (!el) continue;
-    const val = getAttr(el, W_NS, "val");
-    if (val === undefined || !MARK_OFF_VALUES.has(val)) {
-      marks[name] = true;
-    }
-  }
-  return marks;
-}
-
-/**
- * A run's own text — every DIRECT `w:t` child's content concatenated. A
- * `w:t` with no children (self-closing) contributes "". CDATA content is
- * folded in exactly like plain text — ElementTree's own `.text` does this
- * transparently (CDATA is an escaping mechanism, not a distinct parsed
- * value), so parity requires the same here even though this scanner models
- * CDATA as its own node kind.
- * @param {import("./xml-scan.js").XmlElement} runEl
- * @returns {string}
- */
-function runText(runEl) {
-  let text = "";
-  for (const t of findChildren(runEl, W_NS, "t")) {
-    for (const child of t.children) {
-      if (child.kind === "text" || child.kind === "cdata") text += child.value;
-    }
-  }
-  return text;
-}
-
-/**
- * @typedef {object} ParsedRun
- * @property {string} text
- * @property {{bold?: true, italic?: true, underline?: true}} marks
- * @property {import("./xml-scan.js").XmlElement | undefined} rPrEl  raw
- *   element, for styles-resolve.js's PropRef interning — this file stays
- *   styles-agnostic, it only hands back what it already walked past
- */
-
-/**
- * @typedef {object} ParsedParagraph
- * @property {ParsedRun[]} runs
- * @property {import("./xml-scan.js").XmlElement | undefined} pPrEl  raw element
- * @property {string | undefined} pStyleId  the RAW `w:pStyle` value if this
- *   paragraph declares one — undefined (not defaulted) when absent; applying
- *   `sx.defaultParagraphStyle` is the caller's job (import.js), since this
- *   function has no styles.xml in scope
- */
-
-/**
- * Every DIRECT `w:p` child of a `w:txbxContent`, and every DIRECT `w:r`
- * child of each paragraph — ported from paragraphs_of(), including its
- * "runs with no w:t text are dropped entirely, even from the marks dict"
- * behavior. Does NOT mint ids (that stays the caller's job, matching
- * IdFactory's own "paragraph ids minted before the container id" ordering,
- * which lives in import.js where the container id is also minted).
- * @param {import("./xml-scan.js").XmlElement} txbxContent
- * @returns {ParsedParagraph[]}
- */
-export function paragraphsOf(txbxContent) {
-  /** @type {ParsedParagraph[]} */
-  const out = [];
-  for (const p of findChildren(txbxContent, W_NS, "p")) {
-    const pPrEl = findChild(p, W_NS, "pPr");
-    const pStyleEl = pPrEl && findChild(pPrEl, W_NS, "pStyle");
-    const pStyleId = pStyleEl ? getAttr(pStyleEl, W_NS, "val") : undefined;
-    /** @type {ParsedRun[]} */
-    const runs = [];
-    for (const r of findChildren(p, W_NS, "r")) {
-      const text = runText(r);
-      if (text === "") continue;
-      runs.push({ text, marks: runMarks(r), rPrEl: findChild(r, W_NS, "rPr") });
-    }
-    out.push({ runs, pPrEl, pStyleId });
-  }
-  return out;
-}
-
+// wp:anchor -> geometry, group-child coordinates, paragraph/run/mark
+// extraction. Ported from scripts/docx-to-canvas-json.py's convert()/
+// parse_xfrm()/paragraphs_of()/run_marks() — same fields, same "findall is
+// DIRECT CHILDREN ONLY" semantics, same silent-continue gaps (PARITY FIRST,
+// ADR-0020 §2: this piece must not fix what Python doesn't read yet —
+// pic:pic, bodyPr, anything beyond bold/italic/underline).
+//
+// `walkDocumentOrder` is THE single-pass replacement for Python's already
+// bugfixed-but-still-two-list `collect()` + regex `anchor_starts` pair
+// (ADR-0020 §1a/B1). Every element carries its own byte offset (xml-scan.js),
+// so there is no second list to build, and nothing to zip by index — the
+// anchor IS its own true offset. sections.js imports this same walker for
+// sectPr collection so the txbxContent/mc:Fallback exclusion rule is written
+// ONCE, not twice (the exact "two copies drifted" risk network-patterns.js
+// already had once in this project).
+
+import { getAttr, isElement as isEl, findChild, findChildren } from "./xml-scan.js";
+import { W_NS, WP_NS, A_NS, WPS_NS, WPG_NS, PIC_NS, MC_NS } from "./ns.js";
+import { rejectInlineDrawing } from "./import-gate.js";
+
+/**
+ * @param {import("./xml-scan.js").XmlElement} el
+ * @param {string} uri
+ * @param {string} localName
+ * @param {import("./xml-scan.js").XmlElement} path
+ * @returns {string}
+ */
+function requireAttr(el, uri, localName, path) {
+  const v = getAttr(el, uri, localName);
+  if (v === undefined) {
+    throw new Error(`drawingml: <${path.prefix ? path.prefix + ":" : ""}${path.localName}> is missing required attribute ${JSON.stringify(localName)} (bayt ${el.start})`);
+  }
+  return v;
+}
+
+/**
+ * Single-pass, document-order walk. Never descends into `w:txbxContent`
+ * (a drawing nested inside a text box's own content — parity with Python's
+ * `collect()`, which excludes it for the same reason its separate
+ * `anchor_starts` regex scan masks it out first). For `mc:AlternateContent`,
+ * descends ONLY into the first `mc:Choice` found — never `mc:Fallback` (the
+ * VML duplicate) — matching `el.find(q("mc","Choice"))`'s "first match,
+ * Requires ignored" simplification exactly, not a spec-correct MC processor.
+ * @param {import("./xml-scan.js").XmlElement} el
+ * @param {(el: import("./xml-scan.js").XmlElement) => void} visit
+ * @returns {void}
+ */
+export function walkDocumentOrder(el, visit) {
+  visit(el);
+  if (isEl(el, W_NS, "txbxContent")) return;
+  if (isEl(el, MC_NS, "AlternateContent")) {
+    const choice = findChild(el, MC_NS, "Choice");
+    if (choice) walkDocumentOrder(choice, visit);
+    return;
+  }
+  for (const child of el.children) {
+    if (child.kind === "element") walkDocumentOrder(child, visit);
+  }
+}
+
+/**
+ * Every `wp:anchor`, in true document order — a `w:drawing`'s own direct
+ * children, collected as `walkDocumentOrder` reaches each `w:drawing`.
+ *
+ * A `w:drawing` wrapping `wp:inline` instead is rejected here rather than
+ * silently producing zero anchors for it (ADR-0020 Karar 4: 0/46 real corpus
+ * documents use inline placement, so a document that does is corpus-external
+ * and this importer has no coordinate to give it).
+ * @param {import("./xml-scan.js").XmlElement} root
+ * @returns {import("./xml-scan.js").XmlElement[]}
+ */
+export function collectAnchors(root) {
+  /** @type {import("./xml-scan.js").XmlElement[]} */
+  const anchors = [];
+  walkDocumentOrder(root, (el) => {
+    if (isEl(el, W_NS, "drawing")) {
+      if (findChildren(el, WP_NS, "inline").length > 0) {
+        rejectInlineDrawing(`w:drawing at byte ${el.start}`);
+      }
+      anchors.push(...findChildren(el, WP_NS, "anchor"));
+    }
+  });
+  return anchors;
+}
+
+/**
+ * @typedef {object} Xfrm
+ * @property {number} offX
+ * @property {number} offY
+ * @property {number} extCx
+ * @property {number} extCy
+ * @property {number} chOffX
+ * @property {number} chOffY
+ * @property {number} chExtCx
+ * @property {number} chExtCy
+ * @property {number} rot
+ * @property {boolean} flipH
+ * @property {boolean} flipV
+ */
+
+/**
+ * off/ext/chOff/chExt, plus rot/flipH/flipV — read unconditionally (ported
+ * from parse_xfrm; docs/corpus-inventory.md Bölüm 8 found these were never
+ * read at all, a real gap: a rotated shape's position was computed as if it
+ * were not rotated, with no signal anywhere that anything had been dropped).
+ * Values are carried through as-is, not interpreted.
+ * @param {import("./xml-scan.js").XmlElement | undefined} spPr
+ * @returns {Xfrm | null}
+ */
+export function parseXfrm(spPr) {
+  if (!spPr) return null;
+  const xfrm = findChild(spPr, A_NS, "xfrm");
+  if (!xfrm) return null;
+  const off = findChild(xfrm, A_NS, "off");
+  const ext = findChild(xfrm, A_NS, "ext");
+  if (!off || !ext) return null;
+  const chOff = findChild(xfrm, A_NS, "chOff");
+  const chExt = findChild(xfrm, A_NS, "chExt");
+
+  const extCx = Number.parseInt(requireAttr(ext, "", "cx", ext), 10);
+  const extCy = Number.parseInt(requireAttr(ext, "", "cy", ext), 10);
+
+  return {
+    offX: Number.parseInt(requireAttr(off, "", "x", off), 10),
+    offY: Number.parseInt(requireAttr(off, "", "y", off), 10),
+    extCx,
+    extCy,
+    chOffX: chOff ? Number.parseInt(requireAttr(chOff, "", "x", chOff), 10) : 0,
+    chOffY: chOff ? Number.parseInt(requireAttr(chOff, "", "y", chOff), 10) : 0,
+    chExtCx: chExt ? Number.parseInt(requireAttr(chExt, "", "cx", chExt), 10) : extCx,
+    chExtCy: chExt ? Number.parseInt(requireAttr(chExt, "", "cy", chExt), 10) : extCy,
+    rot: Number.parseInt(getAttr(xfrm, "", "rot") ?? "0", 10),
+    flipH: getAttr(xfrm, "", "flipH") === "1",
+    flipV: getAttr(xfrm, "", "flipV") === "1",
+  };
+}
+
+// Python's `val not in ("0", "false", "none")` guard against an explicit off-value.
+const MARK_OFF_VALUES = new Set(["0", "false", "none"]);
+
+/**
+ * @param {import("./xml-scan.js").XmlElement} runEl
+ * @returns {{bold?: true, italic?: true, underline?: true}}
+ */
+export function runMarks(runEl) {
+  const rPr = findChild(runEl, W_NS, "rPr");
+  /** @type {{bold?: true, italic?: true, underline?: true}} */
+  const marks = {};
+  if (!rPr) return marks;
+  for (const [tag, name] of /** @type {const} */ ([
+    ["b", "bold"],
+    ["i", "italic"],
+    ["u", "underline"],
+  ])) {
+    const el = findChild(rPr, W_NS, tag);
+    if (!el) continue;
+    const val = getAttr(el, W_NS, "val");
+    if (val === undefined || !MARK_OFF_VALUES.has(val)) {
+      marks[name] = true;
+    }
+  }
+  return marks;
+}
+
+/**
+ * A run's own text — every DIRECT `w:t` child's content concatenated. A
+ * `w:t` with no children (self-closing) contributes "". CDATA content is
+ * folded in exactly like plain text — ElementTree's own `.text` does this
+ * transparently (CDATA is an escaping mechanism, not a distinct parsed
+ * value), so parity requires the same here even though this scanner models
+ * CDATA as its own node kind.
+ * @param {import("./xml-scan.js").XmlElement} runEl
+ * @returns {string}
+ */
+function runText(runEl) {
+  let text = "";
+  for (const t of findChildren(runEl, W_NS, "t")) {
+    for (const child of t.children) {
+      if (child.kind === "text" || child.kind === "cdata") text += child.value;
+    }
+  }
+  return text;
+}
+
+/**
+ * @typedef {object} ParsedRun
+ * @property {string} text
+ * @property {{bold?: true, italic?: true, underline?: true}} marks
+ * @property {import("./xml-scan.js").XmlElement | undefined} rPrEl  raw
+ *   element, for styles-resolve.js's PropRef interning — this file stays
+ *   styles-agnostic, it only hands back what it already walked past
+ */
+
+/**
+ * @typedef {object} ParsedParagraph
+ * @property {ParsedRun[]} runs
+ * @property {import("./xml-scan.js").XmlElement | undefined} pPrEl  raw element
+ * @property {string | undefined} pStyleId  the RAW `w:pStyle` value if this
+ *   paragraph declares one — undefined (not defaulted) when absent; applying
+ *   `sx.defaultParagraphStyle` is the caller's job (import.js), since this
+ *   function has no styles.xml in scope
+ */
+
+/**
+ * Every DIRECT `w:p` child of a `w:txbxContent`, and every DIRECT `w:r`
+ * child of each paragraph — ported from paragraphs_of(), including its
+ * "runs with no w:t text are dropped entirely, even from the marks dict"
+ * behavior. Does NOT mint ids (that stays the caller's job, matching
+ * IdFactory's own "paragraph ids minted before the container id" ordering,
+ * which lives in import.js where the container id is also minted).
+ * @param {import("./xml-scan.js").XmlElement} txbxContent
+ * @returns {ParsedParagraph[]}
+ */
+export function paragraphsOf(txbxContent) {
+  /** @type {ParsedParagraph[]} */
+  const out = [];
+  for (const p of findChildren(txbxContent, W_NS, "p")) {
+    const pPrEl = findChild(p, W_NS, "pPr");
+    const pStyleEl = pPrEl && findChild(pPrEl, W_NS, "pStyle");
+    const pStyleId = pStyleEl ? getAttr(pStyleEl, W_NS, "val") : undefined;
+    /** @type {ParsedRun[]} */
+    const runs = [];
+    for (const r of findChildren(p, W_NS, "r")) {
+      const text = runText(r);
+      if (text === "") continue;
+      runs.push({ text, marks: runMarks(r), rPrEl: findChild(r, W_NS, "rPr") });
+    }
+    out.push({ runs, pPrEl, pStyleId });
+  }
+  return out;
+}
+

package/dist/io/ooxml/edits.js

@@ -1,67 +1,67 @@
-// Byte-range edits over an original buffer, shared by the editor's export
-// (export-splice.js) and the template fill engine (fill.js, ADR-0037).
-// Moved from export-splice.js in FR2 so both writers apply edits through the
-// same validated pass.
-
-/**
- * Applies `edits` to `original` and returns the new bytes.
- *
- * ONE list, ONE pass, and every edit's `[start, end)` addresses `original` —
- * never a partially rebuilt buffer. The output is allocated once at its final
- * length and assembled front to back: the original's bytes between edits, then
- * each edit's own bytes. Until FR2 the edits were applied from the highest
- * offset down, re-concatenating the WHOLE buffer per edit — O(edits × size),
- * which the template fill engine (hundreds of edits on a 1.75 MB document.xml)
- * could not afford. The result is the same for every accepted edit list,
- * including a zero-length insert listed before a replacement at the same
- * offset (test/io/edits.test.js keeps the old algorithm as its oracle).
- *
- * 🔴 The disjointness is ASSERTED, not assumed. It used to be argued in a
- * comment ("two edits can never overlap — distinct anchors, distinct ranges"),
- * which stopped being true the moment geometry joined text: a moved-AND-edited
- * box now produces TWO edits inside ONE anchor. They are genuinely disjoint
- * (measured 2026-08-29: `max(posOffsetH.end, posOffsetV.end, extent.end) <=
- * txbxContent.contentStart` for 7,990/7,990 corpus containers), but a
- * measurement is not a runtime guarantee — a duplicated id or a stale range
- * would silently corrupt the document, so the invariant is checked here.
- *
- * @param {Uint8Array} original
- * @param {{start: number, end: number, bytes: Uint8Array}[]} edits
- * @returns {Uint8Array}  `original` itself when there is nothing to apply
- */
-export function applyEdits(original, edits) {
-  if (edits.length === 0) {
-    return original;
-  }
-  const sorted = [...edits].sort((a, b) => a.start - b.start);
-  let total = original.length;
-  for (let i = 0; i < sorted.length; i += 1) {
-    const edit = sorted[i];
-    if (!(edit.start >= 0 && edit.end >= edit.start && edit.end <= original.length)) {
-      throw new Error(`splice: edit range [${edit.start}, ${edit.end}) is outside the document (${original.length} bytes)`);
-    }
-    if (i > 0) {
-      const previous = sorted[i - 1];
-      const duplicate = previous.start === edit.start && previous.end === edit.end;
-      if (duplicate || previous.end > edit.start) {
-        throw new Error(
-          `splice: overlapping edits [${previous.start}, ${previous.end}) and [${edit.start}, ${edit.end}) — ` +
-            "a duplicated dirty id or a stale range would corrupt the document",
-        );
-      }
-    }
-    total += edit.bytes.length - (edit.end - edit.start);
-  }
-  const out = new Uint8Array(total);
-  let at = 0;
-  let cursor = 0;
-  for (const { start, end, bytes } of sorted) {
-    out.set(original.subarray(cursor, start), at);
-    at += start - cursor;
-    out.set(bytes, at);
-    at += bytes.length;
-    cursor = end;
-  }
-  out.set(original.subarray(cursor), at);
-  return out;
-}
+// Byte-range edits over an original buffer, shared by the editor's export
+// (export-splice.js) and the template fill engine (fill.js, ADR-0037).
+// Moved from export-splice.js in FR2 so both writers apply edits through the
+// same validated pass.
+
+/**
+ * Applies `edits` to `original` and returns the new bytes.
+ *
+ * ONE list, ONE pass, and every edit's `[start, end)` addresses `original` —
+ * never a partially rebuilt buffer. The output is allocated once at its final
+ * length and assembled front to back: the original's bytes between edits, then
+ * each edit's own bytes. Until FR2 the edits were applied from the highest
+ * offset down, re-concatenating the WHOLE buffer per edit — O(edits × size),
+ * which the template fill engine (hundreds of edits on a 1.75 MB document.xml)
+ * could not afford. The result is the same for every accepted edit list,
+ * including a zero-length insert listed before a replacement at the same
+ * offset (test/io/edits.test.js keeps the old algorithm as its oracle).
+ *
+ * 🔴 The disjointness is ASSERTED, not assumed. It used to be argued in a
+ * comment ("two edits can never overlap — distinct anchors, distinct ranges"),
+ * which stopped being true the moment geometry joined text: a moved-AND-edited
+ * box now produces TWO edits inside ONE anchor. They are genuinely disjoint
+ * (measured 2026-08-29: `max(posOffsetH.end, posOffsetV.end, extent.end) <=
+ * txbxContent.contentStart` for 7,990/7,990 corpus containers), but a
+ * measurement is not a runtime guarantee — a duplicated id or a stale range
+ * would silently corrupt the document, so the invariant is checked here.
+ *
+ * @param {Uint8Array} original
+ * @param {{start: number, end: number, bytes: Uint8Array}[]} edits
+ * @returns {Uint8Array}  `original` itself when there is nothing to apply
+ */
+export function applyEdits(original, edits) {
+  if (edits.length === 0) {
+    return original;
+  }
+  const sorted = [...edits].sort((a, b) => a.start - b.start);
+  let total = original.length;
+  for (let i = 0; i < sorted.length; i += 1) {
+    const edit = sorted[i];
+    if (!(edit.start >= 0 && edit.end >= edit.start && edit.end <= original.length)) {
+      throw new Error(`splice: edit range [${edit.start}, ${edit.end}) is outside the document (${original.length} bytes)`);
+    }
+    if (i > 0) {
+      const previous = sorted[i - 1];
+      const duplicate = previous.start === edit.start && previous.end === edit.end;
+      if (duplicate || previous.end > edit.start) {
+        throw new Error(
+          `splice: overlapping edits [${previous.start}, ${previous.end}) and [${edit.start}, ${edit.end}) — ` +
+            "a duplicated dirty id or a stale range would corrupt the document",
+        );
+      }
+    }
+    total += edit.bytes.length - (edit.end - edit.start);
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  let cursor = 0;
+  for (const { start, end, bytes } of sorted) {
+    out.set(original.subarray(cursor, start), at);
+    at += start - cursor;
+    out.set(bytes, at);
+    at += bytes.length;
+    cursor = end;
+  }
+  out.set(original.subarray(cursor), at);
+  return out;
+}