README

bobzhang/docx2html/splice does not have a README file

#
SpanEdit

pub struct SpanEdit {
// private fields
}

One byte-range replacement inside a part: the bytes at [start, end) are replaced by replacement. A pure insertion has start == end; a pure deletion has empty replacement.

#
SpliceLimits

pub struct SpliceLimits {
// private fields
}

Transaction-grade limits applied before a splice allocates edited payloads or serialized package bytes. The type is opaque so callers must construct a complete, internally consistent limit set.

#
SpliceLimits::with_max_materialized_bytes

fn SpliceLimits::with_max_materialized_bytes(self : SpliceLimits, bytes : Int) -> SpliceLimits raise
DocxError

A copy of these limits with a reduced materialization ceiling — a multi-step fold shrinks it per step so cumulative staged growth stays under the transaction's single splice allowance. bytes may be zero (an all-consumed budget); a negative value is refused.

#
SplicePlan

pub struct SplicePlan {
// private fields
}

The full mutation plan for one splice: per-part span edits plus whole new parts. Build with edit_part/add_part, apply with splice_docx.

#
SplicePlan::add_part

fn SplicePlan::add_part(self : SplicePlan, name : String, bytes : Bytes) -> Unit raise
DocxError

Adds a whole NEW part. The name must not exist in the original package (checked at splice time) nor be added twice.

#
SplicePlan::add_part_limited

fn SplicePlan::add_part_limited(self : SplicePlan, name : String, bytes : Bytes, limits : SpliceLimits) -> Unit raise
DocxError

Adds a whole new part after applying the transaction-grade name and entry ceilings. The Unicode-scalar/UTF-16 check deliberately runs before path splitting or diagnostics can copy an attacker-controlled name.

#
SplicePlan::check_against

fn SplicePlan::check_against(self : SplicePlan, archive :
Archive
, require_pins? : Bool, limits? : SpliceLimits) -> Unit raise
DocxError

Validates the complete plan against an already materialized archive without mutating the archive or serializing a candidate. With require_pins=true, every edited part must carry exact source bytes.

#
SplicePlan::copy

fn SplicePlan::copy(self : SplicePlan) -> SplicePlan

Returns an independently mutable plan snapshot. Every map and edit array is copied; replacement/addition Bytes and source BytesView values may be shared because MoonBit exposes both as immutable byte sequences.

#
SplicePlan::declared_parts

fn SplicePlan::declared_parts(self : SplicePlan) -> Array[String]

Returns the canonical, sorted union of edited and added package parts.

#
SplicePlan::edit_part

fn SplicePlan::edit_part(self : SplicePlan, name : String, edit : SpanEdit) -> Unit raise
DocxError

Adds one span edit to an EXISTING part (zip entry name, e.g. "word/document.xml"). Edits on one part may arrive in any order; they are sorted and checked for overlap at splice time.

#
SplicePlan::is_empty

fn SplicePlan::is_empty(self : SplicePlan) -> Bool

True when the plan changes no existing part and adds no new part.

#
SplicePlan::merge

Merges another plan without consuming it. Source-pin disagreement, duplicate additions, and edit/add conflicts fail before self changes.

#
SplicePlan::new

fn SplicePlan::new() -> SplicePlan

An empty plan.

#
SplicePlan::pin_part

fn SplicePlan::pin_part(self : SplicePlan, name : String, source : BytesView) -> Unit raise
DocxError

Pins an exact source payload for later stale-plan detection. Repeated pins are allowed only when their bytes are identical.

#
SplicePlan::unpinned_edited_parts

fn SplicePlan::unpinned_edited_parts(self : SplicePlan) -> Array[String]

Returns edited parts that do not carry exact source bytes, sorted by name. Preservation-safe edit sessions reject such plans before adopting them.

#
span_edit

fn span_edit(start~ : Int, end~ : Int, replacement : Bytes) -> SpanEdit raise
DocxError

Validates and builds a SpanEdit (0 <= start <= end; range bounds against the part are checked at splice time).

#
splice_docx

fn splice_docx(original : BytesView, plan : SplicePlan) -> Bytes raise
DocxError

Applies the plan to the original package bytes and returns the new package. All-or-nothing: every failure raises before any output is produced (see the module header for the full fail-closed list).

#
splice_docx_archive

fn splice_docx_archive(original :
Archive
, plan : SplicePlan, max_output_bytes~ : Int, require_pins? : Bool, limits? : SpliceLimits) -> Bytes raise
DocxError

Applies a plan to an already materialized archive and serializes through a hard output ceiling. The caller's archive is never mutated; untouched source records remain available to the ZIP writer for byte preservation.

#
splice_limits

fn splice_limits(max_archive_entries~ : Int, max_changed_parts~ : Int, max_part_name_chars~ : Int, max_entry_uncompressed_bytes~ : Int, max_total_uncompressed_bytes~ : Int, max_materialized_bytes~ : Int, max_xml_tokens~ : Int) -> SpliceLimits raise
DocxError

Builds the fail-closed resource contract for a preservation splice.

#
stage_spliced_archive

Applies a plan to an isolated fork and returns the spliced ARCHIVE without serializing it — the seam a multi-step fold uses to stage one op, reindex on the result, and stage the next, serializing only once at the end. Limits are enforced before any edited payload is allocated, exactly as splice_docx_archive does.