@voithos-labs/aragonite 0.10.1

package/dist/selection/pointer-session.js

@@ -0,0 +1,111 @@
+/**
+ * Shared pointer-drag session: the document-listener + rAF-coalescing scaffold every drag
+ * lifecycle builds on. Owns the pointer-ownership filter, autoscroll wiring, and idempotent
+ * teardown; callers supply the per-surface move/end behavior and the options that genuinely
+ * differ. rAF here is frame-paced pointermove coalescing, not async sequencing (G4.4).
+ */
+import { createAutoScroll } from './autoscroll';
+export function createPointerDragSession(down, opts) {
+    const pointerId = down.pointerId;
+    const startX = down.clientX;
+    const startY = down.clientY;
+    const threshold = opts.threshold;
+    let dragging = threshold === undefined;
+    let pending = null;
+    let rafId = null;
+    const autoScroll = createAutoScroll({
+        axis: opts.autoScroll.axis,
+        getPointer: () => pending,
+        getTargets: opts.autoScroll.getTargets,
+        onScrolled: () => {
+            if (pending)
+                opts.onMove(pending);
+        }
+    });
+    function onPointerMove(e) {
+        if (!dragging && threshold !== undefined) {
+            const moved = Math.abs(e.clientX - startX) >= threshold || Math.abs(e.clientY - startY) >= threshold;
+            if (!moved)
+                return;
+            dragging = true;
+            opts.onDragRecognized?.();
+        }
+        pending = { clientX: e.clientX, clientY: e.clientY };
+        if (rafId !== null)
+            return;
+        rafId = requestAnimationFrame(() => {
+            rafId = null;
+            if (!pending)
+                return;
+            opts.onMove(pending);
+            autoScroll.maybeStart();
+        });
+    }
+    // A release before the coalescing rAF runs would otherwise drop the final move (a stale drop
+    // index, or isCrossBlock false on a fast flick / pointercancel). Guard on a LIVE rAF so an
+    // already-processed move is never replayed.
+    function flushPendingMove() {
+        if (rafId !== null && pending)
+            opts.onMove(pending);
+    }
+    let disposed = false;
+    function dispose() {
+        if (disposed)
+            return;
+        disposed = true;
+        document.removeEventListener('pointermove', onPointerMove);
+        document.removeEventListener('pointerup', onPointerUp);
+        document.removeEventListener('pointercancel', onPointerCancel);
+        if (opts.escape)
+            document.removeEventListener('keydown', onKeyDown, true);
+        opts.lifetimeSignal?.removeEventListener('abort', onAbort);
+        if (rafId !== null) {
+            cancelAnimationFrame(rafId);
+            rafId = null;
+        }
+        autoScroll.dispose();
+        if (opts.disableUserSelect)
+            document.body.style.userSelect = '';
+        opts.onTeardown?.();
+        pending = null;
+    }
+    // Only the pointer that opened the drag ends it: a second touch's up/cancel would otherwise
+    // commit or tear down someone else's gesture.
+    function onPointerUp(e) {
+        if (e.pointerId !== pointerId)
+            return;
+        flushPendingMove();
+        dispose();
+        opts.onEnd?.('up');
+    }
+    // Touch/stylus and Tauri WebView2 fire pointercancel instead of pointerup when the OS
+    // reclaims the pointer; without this the pointermove + rAF leak until editor unmount.
+    function onPointerCancel(e) {
+        if (e.pointerId !== pointerId)
+            return;
+        flushPendingMove();
+        dispose();
+        opts.onEnd?.('cancel');
+    }
+    // Editor unmount aborts the lifetime, not a pointer: always tears down, never runs onEnd
+    // (no gesture result to finalize into an unmounting tree).
+    function onAbort() {
+        dispose();
+    }
+    function onKeyDown(e) {
+        if (e.key === 'Escape')
+            dispose();
+    }
+    if (opts.lifetimeSignal?.aborted) {
+        return { dispose };
+    }
+    if (opts.disableUserSelect)
+        document.body.style.userSelect = 'none';
+    document.addEventListener('pointermove', onPointerMove);
+    document.addEventListener('pointerup', onPointerUp);
+    document.addEventListener('pointercancel', onPointerCancel);
+    if (opts.escape)
+        document.addEventListener('keydown', onKeyDown, true);
+    opts.lifetimeSignal?.addEventListener('abort', onAbort, { once: true });
+    return { dispose };
+}

package/dist/selection/primitives.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Pure primitives for cross-block selection: types, document-order walking, overlay
+ * classification, the delete-commit snapshot rule. No DOM, no state. Path-level predicates
+ * live in `./path-math`.
+ */
+import type { CommitSnapshotArg, UndoEntryMode } from '../action-contracts';
+import type { DocumentView } from '../core/node-views';
+import { type CellIndex, type RawOffset } from '../cursor/coordinate-spaces';
+/** Char-space endpoint: `offset` is a character index into the leaf's `raw`. */
+export interface CharSelectionPoint {
+    path: number[];
+    offset: number;
+    cellCoordinate?: false;
+}
+/** Cell-space endpoint: `offset` is a row-major table cell index; `path` addresses the table block. */
+export interface CellSelectionPoint {
+    path: number[];
+    offset: number;
+    cellCoordinate: true;
+}
+/**
+ * A single selection endpoint, discriminated on `cellCoordinate`; empty path is the
+ * document root. `offset` keeps its name on both arms, and its space is the
+ * discriminant's job: read it through {@link charOffsetOf} / {@link cellIndexOf}.
+ * Exception: intra-table selections share the table path and carry cell-valued offsets
+ * on UNFLAGGED points, established by their shared scope rather than the flag.
+ */
+export type SelectionPoint = CharSelectionPoint | CellSelectionPoint;
+/** An endpoint whose block offered no position to land on; the funnel resolves the side. */
+export interface WholeBlockEndpoint {
+    path: number[];
+    wholeBlock: true;
+}
+/**
+ * What an entry path may hand the selection funnel. Only {@link SelectionPoint} is ever
+ * stored, so an unresolved endpoint cannot reach a consumer.
+ */
+export type SelectionEndpoint = SelectionPoint | WholeBlockEndpoint;
+export declare function isWholeBlockEndpoint(endpoint: SelectionEndpoint): endpoint is WholeBlockEndpoint;
+/**
+ * Anchor/focus pair. Same path + same offset is collapsed; same path + different offsets
+ * is a single-block range the browser owns (SelectionState stays null); different paths
+ * is cross-block.
+ */
+export interface EditorSelection {
+    anchor: SelectionPoint;
+    focus: SelectionPoint;
+}
+/** Offset as a char index into the leaf's `raw`. DEV-warns on a cell point, but always returns. */
+export declare function charOffsetOf(point: SelectionPoint, tag: string): RawOffset;
+/** Offset as a row-major table cell index. DEV-warns on a char point, but always returns. */
+export declare function cellIndexOf(point: SelectionPoint, tag: string): CellIndex;
+/**
+ * `{start, end}` in document order: by path, then by offset when paths match. Published on the
+ * consumer barrel as `normalizeSelection`, which is what a host anchors UI to. The offset tiebreak
+ * is coordinate-space agnostic: two endpoints sharing a table's path carry row-major CELL indices,
+ * whose order IS document order inside that table. A caller with no selection has nothing to
+ * order, since `getSelection()` answers null with nothing focused and at a gap caret.
+ */
+export declare function normalize(selection: EditorSelection): {
+    start: SelectionPoint;
+    end: SelectionPoint;
+};
+/** A join delete rides the caller's snapshot; every other one seats undo at its own coordinate. */
+export declare function deleteSnapshot(options: {
+    undoEntry?: UndoEntryMode;
+} | undefined, path: number[], offset?: number): CommitSnapshotArg;
+/** Every block path strictly between `start` and `end`, at every nesting level. */
+export declare function walkBetween(doc: DocumentView, start: number[], end: number[]): number[][];
+export type BlockSelectionClass = 'outside' | 'start' | 'middle' | 'end' | 'single-block';
+/**
+ * Position of a block relative to a selection, for overlay rendering. 'single-block'
+ * tells the caller to delegate to the browser instead of painting.
+ */
+export declare function classifyBlockForSelection(path: number[], selection: EditorSelection): BlockSelectionClass;

package/dist/selection/primitives.js

@@ -0,0 +1,91 @@
+/**
+ * Pure primitives for cross-block selection: types, document-order walking, overlay
+ * classification, the delete-commit snapshot rule. No DOM, no state. Path-level predicates
+ * live in `./path-math`.
+ */
+import { comparePaths, isPathBetween, pathHasPrefix } from './path-math';
+import { asCellIndex, asRawOffset, docPathFrom } from '../cursor/coordinate-spaces';
+import { devWarn } from '../dev-warn';
+export function isWholeBlockEndpoint(endpoint) {
+    return 'wholeBlock' in endpoint;
+}
+/** Offset as a char index into the leaf's `raw`. DEV-warns on a cell point, but always returns. */
+export function charOffsetOf(point, tag) {
+    if (point.cellCoordinate) {
+        devWarn(tag, 'char-offset site received a cell-coordinate SelectionPoint', point);
+    }
+    return asRawOffset(point.offset);
+}
+/** Offset as a row-major table cell index. DEV-warns on a char point, but always returns. */
+export function cellIndexOf(point, tag) {
+    if (!point.cellCoordinate) {
+        devWarn(tag, 'cell-index site received a char-offset SelectionPoint', point);
+    }
+    return asCellIndex(point.offset);
+}
+// ── Normalization ──────────────────────────────────────────────────────────
+/**
+ * `{start, end}` in document order: by path, then by offset when paths match. Published on the
+ * consumer barrel as `normalizeSelection`, which is what a host anchors UI to. The offset tiebreak
+ * is coordinate-space agnostic: two endpoints sharing a table's path carry row-major CELL indices,
+ * whose order IS document order inside that table. A caller with no selection has nothing to
+ * order, since `getSelection()` answers null with nothing focused and at a gap caret.
+ */
+export function normalize(selection) {
+    const { anchor, focus } = selection;
+    const cmp = comparePaths(anchor.path, focus.path);
+    if (cmp < 0)
+        return { start: anchor, end: focus };
+    if (cmp > 0)
+        return { start: focus, end: anchor };
+    if (anchor.offset <= focus.offset)
+        return { start: anchor, end: focus };
+    return { start: focus, end: anchor };
+}
+// ── Undo snapshot ──────────────────────────────────────────────────────────
+/** A join delete rides the caller's snapshot; every other one seats undo at its own coordinate. */
+export function deleteSnapshot(options, path, offset = 0) {
+    return options?.undoEntry === 'join' ? 'skip' : { path: docPathFrom(path), offset };
+}
+// ── Range walk ─────────────────────────────────────────────────────────────
+/** Every block path strictly between `start` and `end`, at every nesting level. */
+export function walkBetween(doc, start, end) {
+    if (comparePaths(start, end) >= 0)
+        return [];
+    const result = [];
+    function visit(node, path) {
+        if (isPathBetween(path, start, end)) {
+            result.push([...path]);
+        }
+        if (!node.children)
+            return;
+        for (let i = 0; i < node.children.length; i++) {
+            const childPath = [...path, i];
+            // Skip subtrees entirely before start (an ancestor of start still holds it) or after end.
+            if (!pathHasPrefix(start, childPath) && comparePaths(childPath, start) < 0)
+                continue;
+            if (comparePaths(childPath, end) >= 0)
+                break;
+            visit(node.children[i], childPath);
+        }
+    }
+    visit(doc, []);
+    return result;
+}
+/**
+ * Position of a block relative to a selection, for overlay rendering. 'single-block'
+ * tells the caller to delegate to the browser instead of painting.
+ */
+export function classifyBlockForSelection(path, selection) {
+    const { start, end } = normalize(selection);
+    if (comparePaths(start.path, end.path) === 0) {
+        return comparePaths(path, start.path) === 0 ? 'single-block' : 'outside';
+    }
+    if (comparePaths(path, start.path) === 0)
+        return 'start';
+    if (comparePaths(path, end.path) === 0)
+        return 'end';
+    if (isPathBetween(path, start.path, end.path))
+        return 'middle';
+    return 'outside';
+}

package/dist/selection/range-delete-ceremony.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Deletion ceremony shared by every rangeDelete branch (generic, chrome, table): covered paths
+ * splice identity-gated in reverse doc order, with cascading empty-ancestor cleanup. The wall
+ * branches also reduce covered paths to subtree roots so a container dies as ONE splice with
+ * children intact, keeping a commit scope or undo entry holding the detached node clean.
+ */
+import type { GrammarView } from '../schema/block-openers';
+import type { PresentationMode } from '../presentation-mode';
+import type { InlineResolverRef } from '../schema/inline-construct-policy';
+import type { CstNode, Document } from '../core/nodes';
+import type { SelectionPoint } from './primitives';
+import type { SharingState } from '../tree-operations/sharing';
+import { type ChromeContainer } from './range-delete-chrome';
+/**
+ * Identity-gated reverse-doc-order deletion: a deeper delete + cascade can shift a survivor
+ * into an outer slot, so each path is re-resolved and spliced only while it still holds the
+ * node captured up front. Caller must own every parent spine BEFORE calling (G1.9).
+ */
+export declare function deleteSubtreesIdentityGated(doc: Document, deletionPaths: number[][], lcaPath: number[], sharing: SharingState): void;
+/** The live-seam reads a prose truncation needs; both undefined outside live. */
+export interface LiveSeamContext {
+    presentationMode: PresentationMode | undefined;
+    linkRef: InlineResolverRef | undefined;
+}
+/**
+ * Reparse the bytes surviving at an endpoint's slot, through the source kind's own write rule:
+ * the reparse re-derives metadata from bytes, so structure the truncation dropped and the rule
+ * restores (a fence closer) has to land before it. The slot's leading trivia rides across, and
+ * an empty slice gives a bare paragraph, on the source block's line ending (G4.20).
+ */
+export declare function reparseTruncatedEndpoint(node: CstNode, slice: string): CstNode[];
+/**
+ * Install an endpoint's replacement, stamped as the live tree's own. The splice door settles the
+ * blank run a truncation left the slot in (G2.13); `sharing` owns the writes.
+ */
+export declare function installTruncatedEndpoint(doc: Document, path: number[], replacement: CstNode[], sharing: SharingState): void;
+/**
+ * Truncate the start endpoint in place, after the planned deletion: a chrome start keeps its
+ * bytes literal by raw write; a prose head crosses the unpaired-run cleanup, then reinstalls
+ * through the endpoint reparse. Returns the seam the collapsed caret lands on. `isChrome` is
+ * the caller's own derivation, read before any splice moved the tree.
+ */
+export declare function truncateStartInPlace(doc: Document, start: SelectionPoint, startBlock: CstNode, isChrome: boolean, live: LiveSeamContext, sharing: SharingState, tag: string): number;
+/**
+ * Truncate the end endpoint in place, before the planned deletion (its path is still live):
+ * chrome by raw write, prose through the cleanup + reparse. Returns the surviving tail node
+ * re-read through the tree (design rule 5), for a caller that must locate it after splices.
+ */
+export declare function truncateEndInPlace(doc: Document, end: SelectionPoint, endBlock: CstNode, isChrome: boolean, live: LiveSeamContext, sharing: SharingState, tag: string): CstNode | null;
+export interface EndWall {
+    container: ChromeContainer;
+    consumed: boolean;
+}
+/**
+ * End-side wall context: the chrome container holding the end point, when the range enters it
+ * from outside. `consumed` means the whole subtree is covered (a prose end's last-byte rule, or
+ * an emptied table on the container's last-child chain), so the container unit-deletes.
+ */
+export declare function resolveEndWall(doc: Document, start: SelectionPoint, end: SelectionPoint, endTableEmptied: boolean | null): EndWall | null;
+export interface DeletionPlan {
+    deletionPaths: number[][];
+    chromeClearChain: CstNode[] | null;
+    /** The epoch the plan was collected against; the apply step's splices own their
+     *  spines through it, so no case has to re-thread it. */
+    sharing: SharingState;
+}
+/**
+ * Plan the deletion via {@link collectDeletionPlan}, own every deletion path's parent spine
+ * before any splice (G1.9), and resolve the LCA cascade cleanup stops at. The caller resolves
+ * `wall` itself: its `consumed` flag also gates each case's endpoint prose-replace.
+ */
+export declare function planCrossBlockDeletion(doc: Document, start: SelectionPoint, end: SelectionPoint, endpointPaths: number[][], wall: EndWall | null, sharing: SharingState): {
+    plan: DeletionPlan;
+    lcaPath: number[];
+};
+/**
+ * Apply the plan atomically: clear a surviving end container's covered chrome (raw write, never
+ * a node delete), then splice the covered subtrees in reverse doc order under the identity gate.
+ */
+export declare function applyPlannedDeletion(doc: Document, plan: DeletionPlan, lcaPath: number[]): void;
+/**
+ * Rebuild every deletion path's surviving ancestry, then the cleared chrome's opener line
+ * (chain-based, so the re-emit survives the splices). Case-specific rebuilds stay at call sites.
+ */
+export declare function rebuildSharedAncestries(doc: Document, plan: DeletionPlan, sharing: SharingState, grammar: GrammarView | undefined): void;

package/dist/selection/range-delete-ceremony.js

@@ -0,0 +1,197 @@
+/**
+ * Deletion ceremony shared by every rangeDelete branch (generic, chrome, table): covered paths
+ * splice identity-gated in reverse doc order, with cascading empty-ancestor cleanup. The wall
+ * branches also reduce covered paths to subtree roots so a container dies as ONE splice with
+ * children intact, keeping a commit scope or undo entry holding the detached node clean.
+ */
+import { parse } from '../core/parser';
+import { displayLength, terminateLine, trailingLineEnding } from '../core/lines';
+import { charOffsetOf, walkBetween } from './primitives';
+import { comparePaths, isStrictAncestorOf, isPathSubtreeBetween, lowestCommonAncestor, pathHasPrefix, pathsEqual } from './path-math';
+import { cascadeCleanupEmptyAncestors } from '../tree-operations/cleanup';
+import { deleteAtPath, replaceAtPath } from '../tree-operations/path-mutate';
+import { blockNodeAt, cleanJoinedRaw, emptyParagraph, nodeAt, normalizeOwnRaw } from '../tree-operations/node-ops';
+import { ensureUnsharedPath, rebuildUnsharedAncestry, rebuildUnsharedChain } from '../tree-operations/unshare';
+// Wall primitives live with the chrome branch, which imports the atoms below back. The
+// resulting cycle is function-body-only (resolved at call time, never at module load), so it
+// is safe.
+import { nearestChromeContainer, rangeConsumesContainer, lastChildDescendant } from './range-delete-chrome';
+/** Subtree roots only: one splice per covered subtree, never a child-by-child emptying. */
+function filterToSubtreeRoots(paths) {
+    return paths.filter((p) => !paths.some((q) => isStrictAncestorOf(q, p)));
+}
+/**
+ * Identity-gated reverse-doc-order deletion: a deeper delete + cascade can shift a survivor
+ * into an outer slot, so each path is re-resolved and spliced only while it still holds the
+ * node captured up front. Caller must own every parent spine BEFORE calling (G1.9).
+ */
+export function deleteSubtreesIdentityGated(doc, deletionPaths, lcaPath, sharing) {
+    const targetNodes = deletionPaths.map((p) => nodeAt(doc, p));
+    const reverseSortedIndices = deletionPaths
+        .map((_, i) => i)
+        .sort((a, b) => comparePaths(deletionPaths[b], deletionPaths[a]));
+    for (const i of reverseSortedIndices) {
+        const path = deletionPaths[i];
+        if (nodeAt(doc, path) === targetNodes[i]) {
+            deleteAtPath(doc, path, sharing);
+            cascadeCleanupEmptyAncestors(doc, path, lcaPath, sharing);
+        }
+    }
+}
+/**
+ * A wall-branch truncation is half a join: the runs it strands, their partner gone with the
+ * cut, are bytes the reader never saw, so a kept prose side crosses the registered cleaner
+ * (live-mode.md § 4.5), expressed as a join with the block's own edge. Identity outside live;
+ * a chrome child's raw write never routes here — the wall stays byte-literal.
+ */
+function cleanTruncatedProse(node, kept, cut, live) {
+    const join = kept === 'head'
+        ? {
+            mergedRaw: node.raw.slice(0, cut),
+            seam: cut,
+            start: { node, offset: cut },
+            end: { node, offset: displayLength(node.raw) }
+        }
+        : {
+            mergedRaw: node.raw.slice(cut),
+            seam: 0,
+            start: { node, offset: 0 },
+            end: { node, offset: cut }
+        };
+    return cleanJoinedRaw({ ...join, linkRef: live.linkRef }, live.presentationMode);
+}
+/**
+ * Reparse the bytes surviving at an endpoint's slot, through the source kind's own write rule:
+ * the reparse re-derives metadata from bytes, so structure the truncation dropped and the rule
+ * restores (a fence closer) has to land before it. The slot's leading trivia rides across, and
+ * an empty slice gives a bare paragraph, on the source block's line ending (G4.20).
+ */
+export function reparseTruncatedEndpoint(node, slice) {
+    const lineEnding = trailingLineEnding(node.raw);
+    const reparsed = parse(normalizeOwnRaw(node, slice) || lineEnding, { scope: 'fragment' });
+    if (reparsed.children.length === 0) {
+        return [emptyParagraph(node.leadingTrivia, lineEnding)];
+    }
+    const cloned = reparsed.children.slice();
+    cloned[0] = { ...cloned[0], leadingTrivia: node.leadingTrivia };
+    // The peeled trailing blank line has no follower slot here, so it stays in raw.
+    cloned[cloned.length - 1].raw += reparsed.suffix;
+    return cloned;
+}
+/**
+ * Install an endpoint's replacement, stamped as the live tree's own. The splice door settles the
+ * blank run a truncation left the slot in (G2.13); `sharing` owns the writes.
+ */
+export function installTruncatedEndpoint(doc, path, replacement, sharing) {
+    for (const node of replacement)
+        sharing.stamp(node);
+    replaceAtPath(doc, path, replacement, sharing);
+}
+/**
+ * Truncate the start endpoint in place, after the planned deletion: a chrome start keeps its
+ * bytes literal by raw write; a prose head crosses the unpaired-run cleanup, then reinstalls
+ * through the endpoint reparse. Returns the seam the collapsed caret lands on. `isChrome` is
+ * the caller's own derivation, read before any splice moved the tree.
+ */
+export function truncateStartInPlace(doc, start, startBlock, isChrome, live, sharing, tag) {
+    const cut = charOffsetOf(start, tag);
+    const head = isChrome
+        ? { raw: startBlock.raw.slice(0, cut), seam: cut }
+        : cleanTruncatedProse(startBlock, 'head', cut, live);
+    if (isChrome) {
+        startBlock.raw = terminateLine(head.raw, startBlock.raw);
+    }
+    else {
+        installTruncatedEndpoint(doc, start.path, reparseTruncatedEndpoint(startBlock, terminateLine(head.raw, startBlock.raw)), sharing);
+    }
+    return head.seam;
+}
+/**
+ * Truncate the end endpoint in place, before the planned deletion (its path is still live):
+ * chrome by raw write, prose through the cleanup + reparse. Returns the surviving tail node
+ * re-read through the tree (design rule 5), for a caller that must locate it after splices.
+ */
+export function truncateEndInPlace(doc, end, endBlock, isChrome, live, sharing, tag) {
+    const cut = charOffsetOf(end, tag);
+    if (isChrome) {
+        endBlock.raw = endBlock.raw.slice(cut) || trailingLineEnding(endBlock.raw);
+        return endBlock;
+    }
+    const tail = cleanTruncatedProse(endBlock, 'tail', cut, live).raw;
+    installTruncatedEndpoint(doc, end.path, reparseTruncatedEndpoint(endBlock, tail), sharing);
+    return blockNodeAt(doc, end.path);
+}
+/**
+ * End-side wall context: the chrome container holding the end point, when the range enters it
+ * from outside. `consumed` means the whole subtree is covered (a prose end's last-byte rule, or
+ * an emptied table on the container's last-child chain), so the container unit-deletes.
+ */
+export function resolveEndWall(doc, start, end, endTableEmptied) {
+    const container = nearestChromeContainer(doc, end.path);
+    if (!container || pathHasPrefix(start.path, container.path))
+        return null;
+    const consumed = endTableEmptied === null
+        ? rangeConsumesContainer(container, end)
+        : endTableEmptied && lastChildDescendant(container, end.path) !== null;
+    return { container, consumed };
+}
+/**
+ * Covered subtree roots plus endpoint paths the caller marks for removal, honoring the chrome
+ * wall: a surviving end container's covered chrome CLEARS instead of deleting (returned as an
+ * unshared chain for the caller's raw write), and a consumed container becomes one unit delete.
+ */
+function collectDeletionPlan(doc, start, end, endpointPaths, wall, sharing) {
+    const between = walkBetween(doc, start.path, end.path).filter((p) => isPathSubtreeBetween(p, start.path, end.path));
+    const chromeClearPath = wall && !wall.consumed ? [...wall.container.path, 0] : null;
+    let chromeClearChain = null;
+    let candidates = [];
+    for (const p of between) {
+        if (chromeClearPath && pathsEqual(p, chromeClearPath)) {
+            const chain = ensureUnsharedPath(doc, p, sharing);
+            if (chain.length === p.length)
+                chromeClearChain = chain;
+        }
+        else {
+            candidates.push(p);
+        }
+    }
+    candidates.push(...endpointPaths);
+    if (wall?.consumed) {
+        candidates = candidates.filter((p) => !pathHasPrefix(p, wall.container.path));
+        candidates.push(wall.container.path.slice());
+    }
+    return { deletionPaths: filterToSubtreeRoots(candidates), chromeClearChain, sharing };
+}
+/**
+ * Plan the deletion via {@link collectDeletionPlan}, own every deletion path's parent spine
+ * before any splice (G1.9), and resolve the LCA cascade cleanup stops at. The caller resolves
+ * `wall` itself: its `consumed` flag also gates each case's endpoint prose-replace.
+ */
+export function planCrossBlockDeletion(doc, start, end, endpointPaths, wall, sharing) {
+    const plan = collectDeletionPlan(doc, start, end, endpointPaths, wall, sharing);
+    for (const path of plan.deletionPaths) {
+        ensureUnsharedPath(doc, path.slice(0, -1), sharing);
+    }
+    return { plan, lcaPath: lowestCommonAncestor(start.path, end.path) };
+}
+/**
+ * Apply the plan atomically: clear a surviving end container's covered chrome (raw write, never
+ * a node delete), then splice the covered subtrees in reverse doc order under the identity gate.
+ */
+export function applyPlannedDeletion(doc, plan, lcaPath) {
+    const chrome = plan.chromeClearChain?.[plan.chromeClearChain.length - 1];
+    if (chrome)
+        chrome.raw = '\n';
+    deleteSubtreesIdentityGated(doc, plan.deletionPaths, lcaPath, plan.sharing);
+}
+/**
+ * Rebuild every deletion path's surviving ancestry, then the cleared chrome's opener line
+ * (chain-based, so the re-emit survives the splices). Case-specific rebuilds stay at call sites.
+ */
+export function rebuildSharedAncestries(doc, plan, sharing, grammar) {
+    for (const path of plan.deletionPaths) {
+        rebuildUnsharedAncestry(doc, path, sharing, null, grammar);
+    }
+    if (plan.chromeClearChain)
+        rebuildUnsharedChain(doc, plan.chromeClearChain, sharing, null, grammar);
+}

package/dist/selection/range-delete-chrome.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Reserved-chrome branch of rangeDelete, the wall rule: nothing merges across a
+ * `reservedChrome` container's wall. Outside endpoints truncate in place, covered chrome clears
+ * (never node-deletes, G1.14), covered body children delete, and the container dies only when
+ * the range consumes its whole subtree, then as ONE splice with children intact.
+ */
+import type { GrammarView } from '../schema/block-openers';
+import type { PresentationMode } from '../presentation-mode';
+import type { InlineResolverRef } from '../schema/inline-construct-policy';
+import type { CstNode, Document } from '../core/nodes';
+import type { SelectionPoint } from './primitives';
+import type { RangeDeleteResult } from './range-delete';
+import type { SharingState } from '../tree-operations/sharing';
+/**
+ * True when the range must take the wall path: an endpoint sits inside a `reservedChrome`
+ * container the range crosses out of or into, or the range starts in the chrome leaf itself.
+ * Same-block, body-only, and enclose-from-outside ranges stay on the generic path.
+ */
+export declare function involvesReservedChrome(doc: Document, start: SelectionPoint, end: SelectionPoint): boolean;
+/**
+ * Delete [start, end] under the wall rule. Both endpoints truncate in place (chrome by a raw
+ * write, keeping the kind via contextDependentKind; prose by a reparse of the surviving slice),
+ * and nothing merges across the wall. Collapsed caret keeps generic start-position semantics.
+ */
+export declare function chromeAwareRangeDelete(doc: Document, start: SelectionPoint, end: SelectionPoint, sharing: SharingState, grammar: GrammarView | undefined, presentationMode?: PresentationMode, linkRef?: InlineResolverRef): RangeDeleteResult;
+export interface ChromeContainer {
+    path: number[];
+    node: CstNode;
+}
+/** Deepest strict ancestor of `path` whose kind declares reservedChrome. */
+export declare function nearestChromeContainer(doc: Document, path: number[]): ChromeContainer | null;
+export declare function isChromeChild(container: ChromeContainer, leafPath: number[]): boolean;
+/**
+ * The range's end lands on the container's last byte: every step from the container is a
+ * last-child edge and the offset consumes the block's visible text.
+ */
+export declare function rangeConsumesContainer(container: ChromeContainer, end: SelectionPoint): boolean;
+/** The node at `path` when every step from the container is a last-child edge, else null. */
+export declare function lastChildDescendant(container: ChromeContainer, path: number[]): CstNode | null;