twig/

lib.rs

mod error;

// The raw FFI layer moved to the `twig-sys` crate. Alias it as `ffi` so every
// `ffi::…` / `crate::ffi::…` reference in this crate keeps resolving unchanged,
// and so `twig-sys`'s build script (via its `links = "twig"`) links `libtwig.a`
// into this crate.
pub(crate) use twig_sys as ffi;

use std::marker::PhantomData;
use std::ops::Range;
use std::os::raw::{c_char, c_int};
use std::ptr::NonNull;

pub use error::Error;
pub use ffi::TwigSpan as Span;

/// Every format Twig can **parse** — the input axis, as opposed to [`Target`],
/// which is where output bytes can go.
///
/// `#[non_exhaustive]` for the same reason [`Target`] is: Twig's parser list
/// grows (reStructuredText is written and awaiting a registry entry), and a
/// caller matching on this enum should not have to be recompiled to keep
/// compiling. Match with a `_` arm.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum Format {
    Djot,
    Markdown,
    Xml,
    Html,
    /// Parsed, rendered, serialized (`Target::Asciidoc`) and authored into:
    /// every block gesture, the inline marks, a link and an image work over
    /// an AsciiDoc document, while the footnote and table gestures report
    /// [`Error::UnsupportedFormat`] — their AsciiDoc spellings have a shape
    /// the gesture algorithms cannot write (see [`Format::supports`]).
    ///
    /// The parser covers the language as the AsciiDoc ASG schema enumerates
    /// it. The few constructs it leaves unmodelled (`menu:`, `icon:`,
    /// `include::`, the CSV table forms) survive as literal source text
    /// rather than failing the parse.
    Asciidoc,
    /// Strict CommonMark 0.31.2: Markdown with every extension off. A
    /// **dialect** of [`Format::Markdown`] — one parser under a different
    /// preset, with a [`MarkdownExtensions`] laid over it — carried as a
    /// format of its own so it can be named in one word, the way fig's
    /// `json`/`jsonc`/`json5` are three formats over one language. It writes
    /// as [`Target::Markdown`] (there is one Markdown serializer), and
    /// [`Format::supports`] answers for it: strict CommonMark cannot author
    /// the `~~x~~` the other two dialects can.
    Commonmark,
    /// GitHub-Flavored Markdown: the spec's four extensions and GFM's HTML
    /// conventions (a cell's alignment as `align=` rather than `style=`). A
    /// dialect of [`Format::Markdown`], as [`Format::Commonmark`] is.
    /// [`Format::Markdown`] itself stays Twig's default flavor, CommonMark
    /// plus the default-on extensions.
    Gfm,
    /// SVG: a **dialect** of [`Format::Xml`] — the same parser, serializer,
    /// [`Target`] and spelling table, under a name of its own so a `.svg`
    /// file is recognised on sight and a document records what it was
    /// opened as. Twig knows nothing about what a `<rect>` means; what makes
    /// an SVG an SVG is its consumer's business (a canvas editor reading the
    /// elements it draws), and the variant exists so that consumer has a
    /// format to name. It writes as [`Target::Xml`], and the one gesture it
    /// supports is [`Gesture::SetNodeAttrs`], as XML does.
    Svg,
}

impl From<Format> for ffi::TwigFormat {
    fn from(value: Format) -> Self {
        match value {
            Format::Djot => ffi::TwigFormat::Djot,
            Format::Markdown => ffi::TwigFormat::Markdown,
            Format::Xml => ffi::TwigFormat::Xml,
            Format::Html => ffi::TwigFormat::Html,
            Format::Asciidoc => ffi::TwigFormat::Asciidoc,
            Format::Commonmark => ffi::TwigFormat::Commonmark,
            Format::Gfm => ffi::TwigFormat::Gfm,
            Format::Svg => ffi::TwigFormat::Svg,
        }
    }
}

impl Format {
    /// The language this format is a dialect of, or `None` for a language
    /// itself: `Some(Format::Markdown)` for [`Format::Commonmark`] and
    /// [`Format::Gfm`], `Some(Format::Xml)` for [`Format::Svg`], `None` for
    /// everything else. A dialect shares its language's [`Target`]
    /// (`Target::from`), which is what makes serializing a GFM document as
    /// [`Target::Markdown`] a round trip rather than a conversion.
    pub fn dialect_of(self) -> Option<Format> {
        match self {
            Format::Commonmark | Format::Gfm => Some(Format::Markdown),
            Format::Svg => Some(Format::Xml),
            _ => None,
        }
    }
}

/// Every format Twig can **write** — the output axis, as opposed to [`Format`],
/// which is what Twig can **parse**.
///
/// Every [`Format`] is also a `Target` (use `Target::from(format)`), so the two
/// lists coincide today and the distinction costs nothing to ignore. It exists
/// because only one of them can grow freely: a [`Format`] must have a parser
/// behind it, while a target only needs somewhere for bytes to go. That makes an
/// *export-only* target — one Twig can write and no parser reads back, PDF being
/// the motivating case — expressible here and nowhere else. See the two format
/// axes in the Zig library's `DESIGN.md`.
///
/// `#[non_exhaustive]` for exactly that reason: a future export-only variant is
/// then an additive change rather than a breaking one for callers that match on
/// this enum.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum Target {
    Djot,
    Markdown,
    Xml,
    Html,
    /// AsciiDoc source, in Asciidoctor's idiomatic spellings: `= Title`,
    /// `*strong*` where the boundaries allow and `**strong**` where they do
    /// not, `[source,lang]` listings, `|===` tables, `footnote:[]` macros.
    Asciidoc,
}

impl Target {
    /// The [`Format`] whose parser reads this target's own output back, or
    /// `None` for an export-only target.
    ///
    /// Always `Some` today. It is the question to ask before assuming a target
    /// can be round-tripped: `None` means bytes go out and nothing comes back,
    /// so there is no "parse it again and compare" available for that target.
    pub fn as_format(self) -> Option<Format> {
        match self {
            Target::Djot => Some(Format::Djot),
            Target::Markdown => Some(Format::Markdown),
            Target::Xml => Some(Format::Xml),
            Target::Html => Some(Format::Html),
            Target::Asciidoc => Some(Format::Asciidoc),
        }
    }
}

/// Total: every input format is also an output target, even the ones with no
/// serializer yet (converting *into* XML reports [`Error::UnsupportedFormat`]
/// rather than being unnameable). A dialect lands on its language's target —
/// [`Format::Commonmark`] and [`Format::Gfm`] both write as
/// [`Target::Markdown`] — so `Target` does not grow a row per dialect.
impl From<Format> for Target {
    fn from(value: Format) -> Self {
        match value {
            Format::Djot => Target::Djot,
            Format::Markdown | Format::Commonmark | Format::Gfm => Target::Markdown,
            Format::Xml | Format::Svg => Target::Xml,
            Format::Html => Target::Html,
            Format::Asciidoc => Target::Asciidoc,
        }
    }
}

impl From<Target> for ffi::TwigFormat {
    fn from(value: Target) -> Self {
        match value {
            Target::Djot => ffi::TwigFormat::Djot,
            Target::Markdown => ffi::TwigFormat::Markdown,
            Target::Xml => ffi::TwigFormat::Xml,
            Target::Html => ffi::TwigFormat::Html,
            Target::Asciidoc => ffi::TwigFormat::Asciidoc,
        }
    }
}

/// A node's kind, as the shared vocabulary publishes it.
///
/// A typed enum rather than the `String` this used to be, because the string
/// made a whole class of upstream change invisible here. When twig collapsed
/// its four generic container kinds (`div`, `span`, `directive`, `element`)
/// into one `container`, every site in this crate that compared a kind name
/// kept compiling and started being wrong at runtime. With this, each of those
/// sites is a compile error pointing at the exact line.
///
/// `#[non_exhaustive]`, and with an [`Other`](Kind::Other) arm, for the two
/// different ways the vocabulary can outrun a given build of this crate:
/// `#[non_exhaustive]` makes ADDING a variant here a non-breaking change for
/// callers, and `Other` carries a name the linked library published that this
/// crate has no variant for at all. Match with a `_` arm.
///
/// ## What is one variant here and two in the core
///
/// The nine inline marks share a single `inline_mark` kind in twig's own AST,
/// and the nine text leaves share a single `text_leaf`; both publish their
/// MEMBER name (`"superscript"`, not `"inline_mark"`). This enum follows the
/// published vocabulary, so they are variants here — the grouping is an
/// implementation detail of the core, not something a consumer should have to
/// know.
///
/// ## No `PartialEq<&str>`
///
/// Deliberately absent, though it would be one impl and would keep every
/// `node.kind == Kind::Image` in existing code compiling. That is precisely the
/// property this type exists to remove: a comparison against a string literal
/// is exactly what survived the container rename and went silently wrong.
/// Compare against a variant; reach for [`as_str`](Kind::as_str) only when you
/// genuinely want the name (logging it, or forwarding it to something that
/// speaks the wire vocabulary).
#[derive(Clone, Debug, Eq, PartialEq, Hash)]
#[non_exhaustive]
pub enum Kind {
    // ── Document root ─────────────────────────────────────────────────────
    Doc,
    // ── Blocks ────────────────────────────────────────────────────────────
    Para,
    Heading,
    ThematicBreak,
    Section,
    CodeBlock,
    RawBlock,
    Metadata,
    BlockQuote,
    BulletList,
    OrderedList,
    TaskList,
    DefinitionList,
    LineBlock,
    Table,
    // ── Structural children, and the document-level definitions ───────────
    ListItem,
    TaskListItem,
    DefinitionListItem,
    Term,
    Definition,
    Line,
    Row,
    Cell,
    Column,
    Caption,
    Footnote,
    Reference,
    Citation,
    Substitution,
    // ── Inlines ───────────────────────────────────────────────────────────
    Str,
    SoftBreak,
    HardBreak,
    NonBreakingSpace,
    RawInline,
    SmartPunctuation,
    Link,
    Image,
    // ── Inline marks — one `inline_mark` kind in the core, published apart
    Emph,
    Strong,
    Mark,
    Superscript,
    Subscript,
    Insert,
    Delete,
    DoubleQuoted,
    SingleQuoted,
    // ── Text leaves — one `text_leaf` kind in the core, published apart ───
    Symb,
    Verbatim,
    InlineMath,
    DisplayMath,
    Url,
    Email,
    FootnoteReference,
    CitationReference,
    SubstitutionReference,
    // ── Generic markup ────────────────────────────────────────────────────
    Container,
    ProcessingInstruction,
    Comment,
    Doctype,
    Cdata,
    /// A kind name the linked library published that this crate has no variant
    /// for — a newer twig against an older binding.
    ///
    /// Deliberately not an error: a node whose kind this crate cannot name is
    /// still a node with a span, children and attributes, and a renderer that
    /// wants to pass it through unchanged should not be stopped from doing so.
    Other(String),
}

impl Kind {
    /// The name twig publishes for this kind — the exact string the C ABI's
    /// `TwigFlatNode.kind` carries.
    pub fn as_str(&self) -> &str {
        match self {
            Kind::Doc => "doc",
            Kind::Para => "para",
            Kind::Heading => "heading",
            Kind::ThematicBreak => "thematic_break",
            Kind::Section => "section",
            Kind::CodeBlock => "code_block",
            Kind::RawBlock => "raw_block",
            Kind::Metadata => "metadata",
            Kind::BlockQuote => "block_quote",
            Kind::BulletList => "bullet_list",
            Kind::OrderedList => "ordered_list",
            Kind::TaskList => "task_list",
            Kind::DefinitionList => "definition_list",
            Kind::LineBlock => "line_block",
            Kind::Table => "table",
            Kind::ListItem => "list_item",
            Kind::TaskListItem => "task_list_item",
            Kind::DefinitionListItem => "definition_list_item",
            Kind::Term => "term",
            Kind::Definition => "definition",
            Kind::Line => "line",
            Kind::Row => "row",
            Kind::Cell => "cell",
            Kind::Column => "column",
            Kind::Caption => "caption",
            Kind::Footnote => "footnote",
            Kind::Reference => "reference",
            Kind::Citation => "citation",
            Kind::Substitution => "substitution",
            Kind::Str => "str",
            Kind::SoftBreak => "soft_break",
            Kind::HardBreak => "hard_break",
            Kind::NonBreakingSpace => "non_breaking_space",
            Kind::RawInline => "raw_inline",
            Kind::SmartPunctuation => "smart_punctuation",
            Kind::Link => "link",
            Kind::Image => "image",
            Kind::Container => "container",
            Kind::ProcessingInstruction => "processing_instruction",
            Kind::Emph => "emph",
            Kind::Strong => "strong",
            Kind::Mark => "mark",
            Kind::Superscript => "superscript",
            Kind::Subscript => "subscript",
            Kind::Insert => "insert",
            Kind::Delete => "delete",
            Kind::DoubleQuoted => "double_quoted",
            Kind::SingleQuoted => "single_quoted",
            Kind::Symb => "symb",
            Kind::Verbatim => "verbatim",
            Kind::InlineMath => "inline_math",
            Kind::DisplayMath => "display_math",
            Kind::Url => "url",
            Kind::Email => "email",
            Kind::FootnoteReference => "footnote_reference",
            Kind::CitationReference => "citation_reference",
            Kind::SubstitutionReference => "substitution_reference",
            Kind::Comment => "comment",
            Kind::Doctype => "doctype",
            Kind::Cdata => "cdata",
            Kind::Other(name) => name.as_str(),
        }
    }

    /// Whether this is a kind the linked library named and this crate could
    /// not — the [`Other`](Kind::Other) case, and the one worth logging when a
    /// renderer meets a node it has no arm for.
    pub fn is_unknown(&self) -> bool {
        matches!(self, Kind::Other(_))
    }
}

impl From<&str> for Kind {
    fn from(name: &str) -> Self {
        match name {
            "doc" => Kind::Doc,
            "para" => Kind::Para,
            "heading" => Kind::Heading,
            "thematic_break" => Kind::ThematicBreak,
            "section" => Kind::Section,
            "code_block" => Kind::CodeBlock,
            "raw_block" => Kind::RawBlock,
            "metadata" => Kind::Metadata,
            "block_quote" => Kind::BlockQuote,
            "bullet_list" => Kind::BulletList,
            "ordered_list" => Kind::OrderedList,
            "task_list" => Kind::TaskList,
            "definition_list" => Kind::DefinitionList,
            "line_block" => Kind::LineBlock,
            "table" => Kind::Table,
            "list_item" => Kind::ListItem,
            "task_list_item" => Kind::TaskListItem,
            "definition_list_item" => Kind::DefinitionListItem,
            "term" => Kind::Term,
            "definition" => Kind::Definition,
            "line" => Kind::Line,
            "row" => Kind::Row,
            "cell" => Kind::Cell,
            "column" => Kind::Column,
            "caption" => Kind::Caption,
            "footnote" => Kind::Footnote,
            "reference" => Kind::Reference,
            "citation" => Kind::Citation,
            "substitution" => Kind::Substitution,
            "str" => Kind::Str,
            "soft_break" => Kind::SoftBreak,
            "hard_break" => Kind::HardBreak,
            "non_breaking_space" => Kind::NonBreakingSpace,
            "raw_inline" => Kind::RawInline,
            "smart_punctuation" => Kind::SmartPunctuation,
            "link" => Kind::Link,
            "image" => Kind::Image,
            "container" => Kind::Container,
            "processing_instruction" => Kind::ProcessingInstruction,
            "emph" => Kind::Emph,
            "strong" => Kind::Strong,
            "mark" => Kind::Mark,
            "superscript" => Kind::Superscript,
            "subscript" => Kind::Subscript,
            "insert" => Kind::Insert,
            "delete" => Kind::Delete,
            "double_quoted" => Kind::DoubleQuoted,
            "single_quoted" => Kind::SingleQuoted,
            "symb" => Kind::Symb,
            "verbatim" => Kind::Verbatim,
            "inline_math" => Kind::InlineMath,
            "display_math" => Kind::DisplayMath,
            "url" => Kind::Url,
            "email" => Kind::Email,
            "footnote_reference" => Kind::FootnoteReference,
            "citation_reference" => Kind::CitationReference,
            "substitution_reference" => Kind::SubstitutionReference,
            "comment" => Kind::Comment,
            "doctype" => Kind::Doctype,
            "cdata" => Kind::Cdata,
            other => Kind::Other(other.to_string()),
        }
    }
}

impl std::fmt::Display for Kind {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// One node returned by [`Document::query`]: its AST id, byte spans, and kind.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct QueryMatch {
    /// The node's id in the shared AST.
    pub node_id: u32,
    /// The node's whole byte range in the source.
    pub span: Range<usize>,
    /// The node's interior byte range (between its delimiters), or `None` for
    /// a leaf / a container with no known interior.
    pub content_span: Option<Range<usize>>,
    /// The node's kind. See [`Kind`] for why this is an enum and not the
    /// name string the C ABI carries.
    pub kind: Kind,
}

/// The byte-level effect of an [`Editor`] edit: `old` is the range of the
/// pre-edit source that was replaced, `new` the range the replacement now
/// occupies in the post-edit source (they share a start). An insertion has an
/// empty `old`; a deletion an empty `new`. Everything a caret/selection needs
/// to re-anchor across an edit without re-diffing: shift any offset `>= old.end`
/// by `new.len() - old.len()`.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct Change {
    pub old: Range<usize>,
    pub new: Range<usize>,
}

impl Change {
    /// The net change in source length (`new.len() - old.len()`).
    pub fn delta(&self) -> isize {
        self.new.len() as isize - self.old.len() as isize
    }

    fn from_ffi(c: ffi::TwigChange) -> Self {
        Change {
            old: c.old_span.start..c.old_span.end,
            new: c.new_span.start..c.new_span.end,
        }
    }
}

/// One node of an [`Editor::nodes`] snapshot — the flat AST arena as owned Rust
/// data (the JSON-free read path). `id` indexes the snapshot; `parent`,
/// `first_child`, and `next_sibling` link the tree (`None` where absent).
/// `text` is the node's primary payload (a `str`'s bytes, a `code_block`'s
/// body, …) and `destination` a link/image target, each `None` when the kind
/// carries no such payload.
/// `#[non_exhaustive]`: a snapshot node is something twig *hands you*, never
/// something you build, so it gains a field whenever a node kind's payload is
/// surfaced (as `head`/`alignment` were for tables). Sealing construction here
/// keeps every future addition a minor release instead of a major one.
#[derive(Clone, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub struct FlatNode {
    pub id: NodeId,
    pub parent: Option<NodeId>,
    pub first_child: Option<NodeId>,
    pub next_sibling: Option<NodeId>,
    pub span: Range<usize>,
    pub content_span: Option<Range<usize>>,
    /// A heading's level; `None` for every other kind.
    pub level: Option<u32>,
    pub kind: Kind,
    /// The node's text payload — a `str`'s bytes, a `code_block`'s body — and
    /// `None` for a node whose content is its children. Since twig 3.5 this is
    /// also `Some` for a [`Kind::Container`] whose body the HTML tokenizer read
    /// as TEXT rather than markup (`<script>`, `<style>`, `<iframe>`, `<title>`,
    /// `<textarea>`, …): such a node has no children, and this is how an editor
    /// learns that the body is not prose without carrying the tokenizer's tag
    /// lists itself. Test `text.is_some()`, not the tag name.
    pub text: Option<String>,
    pub destination: Option<String>,
    /// Whether a `row`/`cell` belongs to the table head; `None` for every other
    /// kind.
    pub head: Option<bool>,
    /// A `cell`'s column alignment; `None` for every other kind. The delimiter
    /// row (`|:--|--:|`) that spells the alignment out is consumed by the parser
    /// and has no node of its own, so this is the only way to recover it.
    /// [`Alignment::Default`] is a real, unspecified alignment (a bare `---`) —
    /// distinct from the `None` a non-cell node reports.
    pub alignment: Option<Alignment>,
    /// The name a generic container carries in its own payload rather than in
    /// `kind`: an HTML/XML tag (`"picture"`, `"source"`, …) or a directive type
    /// (`"note"`, `"embed"`, `"vis"`, …, no leading colons). `None` for every
    /// semantic kind, whose identity is `kind` alone. With this an
    /// `html_elements` parse's `<picture>`/`<source>` are distinguishable — both
    /// report `kind == "container"` — and so are a `::embed` and a `::toc`.
    ///
    /// A tag and a directive type share one `kind` because they are one concept
    /// in the core: a named container with attributes and children. `name` is
    /// what tells them apart, which is why it is not optional in practice for
    /// anything a renderer cares about.
    pub name: Option<String>,
    /// Which of the three generic-container SPELLINGS this node's producer
    /// draws; `None` when it draws none. Pairs with [`name`](Self::name): the
    /// name says *which* container, this says *how it is written*, and a
    /// renderer needs both — the same type is a span inline
    /// ([`DirectiveForm::Text`]), a standalone block with no body
    /// ([`DirectiveForm::Leaf`]), and a wrapper around blocks
    /// ([`DirectiveForm::Container`]).
    ///
    /// **This does not answer "is it a directive?"** — use
    /// [`origin`](Self::origin). HTML's parser sets a form on `<div>` and
    /// `<span>`, the two tags djot and Markdown have generic spellings for, so
    /// this reports `Some(Container)` for a `<div>` and `None` for a
    /// `<video>`: right often enough to look usable, wrong on the two tags you
    /// meet first.
    pub directive_form: Option<DirectiveForm>,
    /// Whether a generic container was WRITTEN as a tag or as a directive;
    /// `None` when nothing recorded it — the node is not a container, or no
    /// parser produced it (a [`Builder`] tree).
    ///
    /// This is the field that separates an HTML `<div>` from a Markdown
    /// `:::div`. Those two agree on [`kind`](Self::kind) (`"container"`), on
    /// [`name`](Self::name) (`"div"`) and on
    /// [`directive_form`](Self::directive_form) (`Container`), field for field,
    /// so none of the three can tell you which one you have.
    pub origin: Option<ContainerOrigin>,
    /// The node's own MARKER — the leading bytes a rich view HIDES, on its
    /// opening line: a heading's `#`s and the space after them, a list item's
    /// `- ` / `1. `, a task item's marker plus its `[x] ` box, a block quote's
    /// `> `. `None` for a node with no leading marker (every inline, a
    /// paragraph, a SETEXT heading whose `---` sits *under* the block).
    ///
    /// **Not derivable from [`span`](Self::span) and
    /// [`content_span`](Self::content_span).** For a heading it happens to be
    /// `span.start..content_span.start`; for a marker-prefixed container it is
    /// not, because those report `content_span == span` — a prefix repeating on
    /// every line has no contiguous interior to point at. Before this field the
    /// answer was recoverable only by a per-format rule (from the item's inner
    /// paragraph in Markdown, from the item itself in Djot), which is the
    /// "which parser produced this?" reasoning a shared AST exists to remove.
    ///
    /// Covers ONE LINE, and this node's own marker alone. For the whole prefix a
    /// nested construct sits behind (`>   1. [ ] ` is four nodes' markers plus
    /// the indent between them), call [`Document::line_prefix`].
    pub marker_span: Option<Range<usize>>,
    /// A task list item's checkbox state; `None` for every other kind.
    ///
    /// The parser has always known this — it is what decides
    /// [`Kind::TaskListItem`] over [`Kind::ListItem`] in the first place — and
    /// until now nothing surfaced it, so a consumer rendering a clickable
    /// checkbox re-derived the state by scanning the source for `[x]`. That scan
    /// is fooled by a `[` in prose, and it asks the bytes a question the tree
    /// had already answered. Twig would WRITE a checkbox
    /// ([`Editor::set_task_checked`]) and not read one back.
    ///
    /// `None` is distinct from `Some(false)`: a consumer treating "not a task
    /// item" as unchecked draws an empty box beside every paragraph.
    pub checked: Option<bool>,
    /// The node's `{...}` / HTML attributes as `(key, value)` pairs in source
    /// order (empty when it has none). A bare attribute (HTML `disabled`, or a
    /// `<source media=…>` used as a flag) has a `None` value.
    pub attrs: Vec<(String, Option<String>)>,
}

/// A synthesized line prefix — what [`Document::continuation_prefix`] and
/// [`Document::blank_line_prefix`] build.
///
/// `columns` is deliberately not `text.len()`: a tab in a marker advances to a
/// tab stop, so `-\tx` yields a four-column prefix from a two-byte marker. An
/// editor sizing a Tab step, a caret's horizontal home, or an outdent wants the
/// column count; one writing the prefix into the document wants the bytes.
#[derive(Clone, Debug, Default, Eq, PartialEq)]
pub struct LinePrefix {
    /// The bytes to write at the head of the line.
    pub text: String,
    /// Their width in columns.
    pub columns: usize,
}

/// An inline mark for [`Editor::wrap_range`] / [`Editor::toggle_inline`] — a
/// rich editor's Bold / Italic / Code / … buttons. Djot spells all of them;
/// Markdown spells [`InlineKind::Strong`], [`InlineKind::Emph`],
/// [`InlineKind::Verbatim`] and [`InlineKind::Delete`] — GFM strikethrough is
/// parsed by default, so every editor this crate creates authors it — plus
/// [`InlineKind::Mark`] once [`MarkdownExtensions::highlight`] is set, since
/// `==x==` is otherwise text the reparse hands back unchanged. An unsupported
/// kind yields [`Error::UnsupportedFormat`]; [`Format::supports_with`] is the
/// question asked ahead of the call.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum InlineKind {
    Strong,
    Emph,
    Verbatim,
    Mark,
    Superscript,
    Subscript,
    Insert,
    Delete,
}

impl InlineKind {
    fn to_c(self) -> c_int {
        match self {
            InlineKind::Strong => 0,
            InlineKind::Emph => 1,
            InlineKind::Verbatim => 2,
            InlineKind::Mark => 3,
            InlineKind::Superscript => 4,
            InlineKind::Subscript => 5,
            InlineKind::Insert => 6,
            InlineKind::Delete => 7,
        }
    }
}

/// A block target for [`Editor::set_block`] — the toolbar's H1…H6 / Body switch.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum BlockKind {
    Paragraph,
    /// A heading of the given level (1–6; out of range is [`Error::InvalidArgument`]).
    Heading(u32),
}

impl BlockKind {
    /// `(block_kind_code, level)` for the C ABI.
    fn to_c(self) -> (c_int, u32) {
        match self {
            BlockKind::Paragraph => (0, 0),
            BlockKind::Heading(level) => (1, level),
        }
    }
}

/// A block container for [`Editor::toggle_block_container`] — the toolbar's
/// Quote / Bulleted list / Numbered list buttons. Where a [`BlockKind`] rewrites
/// one block's leading marker, a container prefixes every line of a range and
/// nests. Djot and Markdown spell all three; other formats yield
/// [`Error::UnsupportedFormat`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum BlockContainerKind {
    BlockQuote,
    BulletList,
    OrderedList,
}

impl BlockContainerKind {
    fn to_c(self) -> c_int {
        match self {
            BlockContainerKind::BlockQuote => 0,
            BlockContainerKind::BulletList => 1,
            BlockContainerKind::OrderedList => 2,
        }
    }
}

/// The colour of a highlight — the palette [`Editor::set_mark_color`] writes.
///
/// Obsidian's spelling, which is what Twig reads and writes: a large-circle
/// emoji immediately after the opening `==`, so `==🔴 text==` is a highlight
/// whose text is `text` and whose colour is [`MarkColor::Red`]. The emoji is
/// **spelling**, not content — it is stripped from the highlighted text and
/// carried as the mark's `data-color` attribute, which is where a
/// [`Document::query`] for `mark[data-color=red]` finds it.
///
/// An enum rather than a string because the palette is closed: a name Twig has
/// no emoji for is not a colour it can write, and an emoji it does not read
/// back is text. The C ABI takes the name — [`MarkColor::as_str`] is it, and is
/// exactly the attribute value.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum MarkColor {
    Red,
    Orange,
    Yellow,
    Green,
    Blue,
    Purple,
    Brown,
}

impl MarkColor {
    /// The `data-color` value — `"red"` — and what the C ABI is handed.
    pub fn as_str(self) -> &'static str {
        match self {
            MarkColor::Red => "red",
            MarkColor::Orange => "orange",
            MarkColor::Yellow => "yellow",
            MarkColor::Green => "green",
            MarkColor::Blue => "blue",
            MarkColor::Purple => "purple",
            MarkColor::Brown => "brown",
        }
    }

    /// The colour a `data-color` attribute names, or `None` for a value this
    /// build has no spelling for.
    pub fn from_str(s: &str) -> Option<Self> {
        Some(match s {
            "red" => MarkColor::Red,
            "orange" => MarkColor::Orange,
            "yellow" => MarkColor::Yellow,
            "green" => MarkColor::Green,
            "blue" => MarkColor::Blue,
            "purple" => MarkColor::Purple,
            "brown" => MarkColor::Brown,
            _ => return None,
        })
    }
}

/// One authoring gesture, named with whatever kind it takes — the question
/// [`Format::supports`] answers.
///
/// Twig's formats are **ragged**: Djot spells all eight inline marks and
/// Markdown four (a fifth with [`MarkdownExtensions::highlight`]), HTML spells
/// marks, headings, quotes, lists, code blocks, links and images but no task
/// box, footnote or table edit, AsciiDoc spells everything but footnotes and
/// tables, XML nothing. Every [`Editor`]
/// method already reports that as
/// [`Error::UnsupportedFormat`] — but only once called, which is too late for a
/// UI that wants to *disable* the button rather than let it fail.
///
/// A variant carries a kind exactly where the [`Editor`] method takes one, so
/// the query is spelled with the same value as the call:
///
/// ```no_run
/// # use twig::{Format, Gesture, InlineKind};
/// if Format::Markdown.supports(Gesture::ToggleInline(InlineKind::Mark)) {
///     // never runs: `==mark==` is emit-only in Markdown.
/// }
/// ```
///
/// Only the gestures with a **format-level** gate appear — which, since the last
/// nine were added, is every gesture the editor has. Those nine read no format
/// spelling at all until an HTML document showed what that cost:
///
/// - The `Table*` variants. HTML's parser lowers `<table>/<tr>/<td>` to the same
///   nodes a pipe table produces, so [`Editor::table_insert_row`] and its
///   siblings extracted the grid and wrote pipe text over the elements. HTML
///   reparses that as a paragraph —
///   a document that still parses, so nothing rolled it back and no error was
///   returned. The table was simply gone.
/// - [`Gesture::SplitBlock`]. The blank line it writes means "two blocks" only
///   where blank lines separate blocks; inside a `<p>` it is whitespace, so
///   [`Editor::split_block`] reported success over an unchanged document.
/// - [`Gesture::RenumberOrderedLists`]. A textual `N.` rewrite finds nothing in
///   an `<ol>`, whose numbering is in the tag, and called the no-op a success.
///
/// `#[non_exhaustive]` for the reason [`Format`] is: the gesture list grows with
/// the editor surface, and a caller matching on this should not need a rebuild.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum Gesture {
    WrapRange(InlineKind),
    ToggleInline(InlineKind),
    SetBlock,
    ToggleBlockContainer(BlockContainerKind),
    InsertThematicBreak,
    ToggleCodeBlock,
    SetCodeLanguage,
    ToggleTaskItem,
    SetTaskChecked,
    ToggleTaskChecked,
    InsertLink,
    InsertImage,
    InsertFootnote,
    InsertLiteral,
    InsertLineBreak,
    SplitBlock,
    RenumberOrderedLists,
    TableInsertRow,
    TableDeleteRow,
    TableInsertColumn,
    TableDeleteColumn,
    TableSetAlignment,
    TableMoveRow,
    TableMoveColumn,
    /// Colour the highlight the caret is in — [`Editor::set_mark_color`].
    ///
    /// The one gesture whose support is a fact about the **parse extensions**
    /// rather than about the format: it needs
    /// [`MarkdownExtensions::highlight_colors`], so ask
    /// [`Format::supports_with`] rather than [`Format::supports`], which
    /// answers for default options and so always answers `false` here.
    SetMarkColor,
    /// Mint a fresh table — [`Editor::insert_table`]. Behind the same gate as
    /// the seven table edits: a format that can re-spell a table can write one.
    InsertTable,
    /// Write a leaf directive — [`Editor::insert_directive`]. Supported where
    /// the format's parser reads a printed named container back as one, which
    /// for Markdown means [`MarkdownExtensions::directives`]: ask
    /// [`Format::supports_with`] rather than [`Format::supports`], which
    /// answers for default options and so answers `false` there.
    InsertDirective,
    /// Replace a block's attribute set — [`Editor::set_block_attrs`].
    /// Supported where the format's parser reads a block's printed attributes
    /// back, which for Markdown means [`MarkdownExtensions::html_elements`]:
    /// ask [`Format::supports_with`] rather than [`Format::supports`].
    SetBlockAttrs,
    /// Wrap a range in an attributed span — [`Editor::wrap_range_attrs`].
    /// Supported where the format reads the printed span back: djot and HTML,
    /// and Markdown under [`MarkdownExtensions::html_elements`]; not AsciiDoc.
    WrapRangeAttrs,
    /// Join a block into the block before it — [`Editor::join_blocks`]. The
    /// inverse of [`Gesture::SplitBlock`] and a **wider** gate than it: a join
    /// writes a line break inside a block, which HTML spells, while a blank
    /// line between two of its `<p>`s is not what separates them. Ask for this
    /// one rather than reading the split's answer for both.
    JoinBlocks,
    /// Replace an element's attribute set by node id — [`Editor::set_node_attrs`].
    /// Supported where the format keeps a node's attributes on the node's own
    /// tag at a span its parser records: XML, and no prose format. The one
    /// gesture a tree-shaped editor asks for and a caret never does, which is
    /// why [`Format::is_authorable`] stays `false` for XML while this answers
    /// `true`.
    SetNodeAttrs,
    /// Move a block to a boundary, re-spelling the line prefixes of the
    /// container it lands in — [`Editor::move_block`]. Supported wherever a
    /// caret can name a block: every prose format, HTML included; not XML.
    MoveBlock,
}

impl Gesture {
    /// `(gesture_code, kind_code)` for the C ABI. The kind rides in the
    /// gesture's own space — an inline code for the two inline gestures, a
    /// container code for the container one, and 0 where the gesture takes
    /// none, which the C side *requires* rather than ignores.
    fn to_c(self) -> (c_int, c_int) {
        match self {
            Gesture::WrapRange(k) => (0, k.to_c()),
            Gesture::ToggleInline(k) => (1, k.to_c()),
            Gesture::SetBlock => (2, 0),
            Gesture::ToggleBlockContainer(k) => (3, k.to_c()),
            Gesture::InsertThematicBreak => (4, 0),
            Gesture::ToggleCodeBlock => (5, 0),
            Gesture::SetCodeLanguage => (6, 0),
            Gesture::ToggleTaskItem => (7, 0),
            Gesture::SetTaskChecked => (8, 0),
            Gesture::ToggleTaskChecked => (9, 0),
            Gesture::InsertLink => (10, 0),
            Gesture::InsertImage => (11, 0),
            Gesture::InsertFootnote => (12, 0),
            Gesture::InsertLiteral => (13, 0),
            Gesture::InsertLineBreak => (14, 0),
            Gesture::SplitBlock => (15, 0),
            Gesture::RenumberOrderedLists => (16, 0),
            Gesture::TableInsertRow => (17, 0),
            Gesture::TableDeleteRow => (18, 0),
            Gesture::TableInsertColumn => (19, 0),
            Gesture::TableDeleteColumn => (20, 0),
            Gesture::TableSetAlignment => (21, 0),
            Gesture::TableMoveRow => (22, 0),
            Gesture::TableMoveColumn => (23, 0),
            Gesture::SetMarkColor => (24, 0),
            Gesture::InsertTable => (25, 0),
            Gesture::InsertDirective => (26, 0),
            Gesture::SetBlockAttrs => (27, 0),
            Gesture::WrapRangeAttrs => (28, 0),
            Gesture::JoinBlocks => (29, 0),
            Gesture::SetNodeAttrs => (30, 0),
            Gesture::MoveBlock => (31, 0),
        }
    }
}

impl Format {
    /// Whether this format can spell `gesture` — the toolbar's gray-out
    /// question, answered **without a document**, so a caller can build its UI
    /// before it has one. Pure and cheap: ask at startup and cache.
    ///
    /// `true` means the gesture will not fail with
    /// [`Error::UnsupportedFormat`]. It is **not** a promise the call succeeds —
    /// the caret still decides, so a supported gesture can still report
    /// [`Error::NotFound`], [`Error::NotEditable`] or [`Error::EditConflict`] at
    /// the position it is actually run. Gray out on `false`; do not read `true`
    /// as "this will work here".
    ///
    /// Returns a plain `bool` rather than a `Result` because the two ways the C
    /// query can fail — an unknown format code, a kind from the wrong
    /// vocabulary — are both unrepresentable here: [`Format`] and [`Gesture`]
    /// are enums, and a `Gesture` carries a kind only where one applies.
    ///
    /// Distinct from BOTH neighbouring questions:
    ///
    /// - [`Format::is_authorable`] is "is there a door in", true for
    ///   [`Format::Html`] on its inline marks alone.
    /// - [`Warning::fidelity`] is "what survives a *conversion* to this target",
    ///   which is a different table with genuinely different answers — Djot
    ///   round-trips a smart-quote container faithfully while no editor gesture
    ///   may author one. Use that for a save-as warning, this for a button.
    pub fn supports(self, gesture: Gesture) -> bool {
        let (g, k) = gesture.to_c();
        let mut supported: c_int = 0;
        let status = unsafe {
            ffi::twig_format_supports(ffi::TwigFormat::from(self) as c_int, g, k, &mut supported)
        };
        debug_assert!(
            Error::from_status(status).is_ok(),
            "twig_format_supports rejected a combination the Rust types make unrepresentable",
        );
        supported == 1
    }

    /// [`Format::supports`] for a document parsed with `extensions` — the same
    /// question asked of the table an [`Editor`] created with them actually
    /// holds.
    ///
    /// A Markdown extension can **widen** what may be authored, which is why
    /// the format alone is not always the whole answer. `==x==` is literal text
    /// under default options and a `mark` under
    /// [`MarkdownExtensions::highlight`], so a toggle that wrote it without the
    /// extension would mint bytes the reparse hands back as plain text — one
    /// press that a second press cannot undo. [`Gesture::SetMarkColor`] needs
    /// [`MarkdownExtensions::highlight_colors`] on top of that.
    ///
    /// ```no_run
    /// # use twig::{Format, Gesture, InlineKind, MarkdownExtensions};
    /// let exts = MarkdownExtensions { highlight: true, ..Default::default() };
    /// assert!(!Format::Markdown.supports(Gesture::ToggleInline(InlineKind::Mark)));
    /// assert!(Format::Markdown.supports_with(exts, Gesture::ToggleInline(InlineKind::Mark)));
    /// ```
    ///
    /// Pass the extensions the editor was (or will be) created with in
    /// [`Editor::new_ext`]; anything else answers a question about a
    /// document you do not have. `extensions` is ignored for every
    /// non-Markdown format, exactly as it is at creation.
    pub fn supports_with(self, extensions: MarkdownExtensions, gesture: Gesture) -> bool {
        let (g, k) = gesture.to_c();
        let mut supported: c_int = 0;
        let status = unsafe {
            ffi::twig_format_supports_ext(
                ffi::TwigFormat::from(self) as c_int,
                extensions.to_flags(),
                g,
                k,
                &mut supported,
            )
        };
        debug_assert!(
            Error::from_status(status).is_ok(),
            "twig_format_supports_ext rejected a combination the Rust types make unrepresentable",
        );
        supported == 1
    }

    /// Whether this format can be authored into **at all** — `false` for a
    /// parse-only format ([`Format::Xml`]), where every gesture refuses and
    /// an editor should offer no toolbar. The open-read-only question.
    ///
    /// `true` is a **weaker** claim than it looks, and driving per-button state
    /// from it is the mistake this doc exists to prevent: [`Format::Html`]
    /// answers `true` — it spells the inline marks, a heading and a literal —
    /// while the container, code-block, task, link and footnote gestures are
    /// all still unsupported there. Use [`Format::supports`] per button.
    pub fn is_authorable(self) -> bool {
        let mut authorable: c_int = 0;
        let status = unsafe {
            ffi::twig_format_is_authorable(ffi::TwigFormat::from(self) as c_int, &mut authorable)
        };
        debug_assert!(Error::from_status(status).is_ok(), "unknown format code");
        authorable == 1
    }
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct Version {
    pub major: u8,
    pub minor: u8,
    pub patch: u8,
}

pub fn version() -> Version {
    let packed = unsafe { ffi::twig_version() };
    Version {
        major: (packed >> 16) as u8,
        minor: (packed >> 8) as u8,
        patch: packed as u8,
    }
}

/// The C ABI contract version this crate was **compiled** against — the
/// compile-time counterpart to [`abi_version`] (which reports the **linked
/// library's**). This crate builds and links its own vendored copy of the Zig
/// source, so the two always agree; the pair is exposed so a consumer embedding
/// a separately-built library can verify layout compatibility at load time.
pub const ABI_VERSION: u32 = ffi::TWIG_ABI_VERSION;

/// The C ABI contract version of the linked library. This crate is written
/// against [`ABI_VERSION`]; the two agreeing is what makes the `#[repr(C)]`
/// mirrors in `ffi` sound. It is bumped only on a breaking ABI change (a struct
/// layout change or a renumbered enum value), never on an additive one (a new
/// format code or a new function).
pub fn abi_version() -> u32 {
    unsafe { ffi::twig_abi_version() }
}

pub fn version_string() -> &'static str {
    let ptr = unsafe { ffi::twig_version_string() };
    unsafe { std::ffi::CStr::from_ptr(ptr) }
        .to_str()
        .unwrap_or("")
}

#[derive(Debug)]
pub struct Document {
    raw: NonNull<ffi::TwigDocument>,
}

impl Document {
    pub fn parse(input: &[u8], format: Format) -> Result<Self, Error> {
        Self::parse_with(input, format, MarkdownExtensions::default())
    }

    pub fn parse_str(input: &str, format: Format) -> Result<Self, Error> {
        Self::parse(input.as_bytes(), format)
    }

    /// Like [`Document::parse`], plus Markdown `extensions` to enable (ignored
    /// for other formats) — the read-path counterpart of [`Editor::new_ext`].
    /// Enable [`MarkdownExtensions::html_elements`] here to make embedded HTML
    /// (`<img>`, `<picture>`, …) queryable via [`Document::query`] instead of
    /// arriving as opaque raw HTML.
    pub fn parse_with(
        input: &[u8],
        format: Format,
        extensions: MarkdownExtensions,
    ) -> Result<Self, Error> {
        let mut raw = std::ptr::null_mut();
        let ffi_format: ffi::TwigFormat = format.into();
        let status = unsafe {
            ffi::twig_parse_ext(
                input.as_ptr(),
                input.len(),
                ffi_format as i32,
                extensions.to_flags(),
                &mut raw,
            )
        };
        Error::from_status(status)?;
        let raw = NonNull::new(raw).ok_or(Error::Internal)?;
        Ok(Self { raw })
    }

    /// [`Document::parse_with`] for a `&str`.
    pub fn parse_str_with(
        input: &str,
        format: Format,
        extensions: MarkdownExtensions,
    ) -> Result<Self, Error> {
        Self::parse_with(input.as_bytes(), format, extensions)
    }

    /// Render the document to HTML. For Djot/Markdown this is the rich
    /// rendering path that resolves reference/footnote side tables.
    pub fn render_html(&mut self) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_document_render_html(raw, ptr, len) })
    }

    /// Serialize the document to `target`'s own syntax: a round-trip when
    /// `target` names the document's own format, cross-format conversion
    /// otherwise (e.g. parse Markdown, serialize as Djot). Returns
    /// [`Error::UnsupportedFormat`] when the requested direction has no
    /// serializer (today: converting into XML from another format).
    ///
    /// Prefer this over [`Document::serialize`]: serializing is a question about
    /// where the bytes are going, so it takes a [`Target`]. The older spelling
    /// takes a [`Format`] and still works — every `Format` is a `Target` — but
    /// it cannot name an export-only target, and this one can.
    pub fn serialize_to(&mut self, target: Target) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        let ffi_target: ffi::TwigFormat = target.into();
        collect_bytes(|ptr, len| unsafe {
            ffi::twig_document_serialize(raw, ffi_target as i32, ptr, len)
        })
    }

    /// Serialize the document to `format`'s own source syntax.
    ///
    /// The original spelling of [`Document::serialize_to`], kept for
    /// compatibility and defined in terms of it. It types the output axis as
    /// [`Format`], which is the input vocabulary; reach for `serialize_to` in
    /// new code.
    pub fn serialize(&mut self, format: Format) -> Result<Vec<u8>, Error> {
        self.serialize_to(format.into())
    }

    /// Encode the document's AST as pretty-printed JSON (the same encoding as
    /// `twig convert -o ast`).
    pub fn ast_json(&mut self) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_document_ast_json(raw, ptr, len) })
    }

    /// Resolve a CSS-lite selector (e.g. `heading[level=2]`,
    /// `link[dest^="http"]`, `code`, `list > item`) against the document,
    /// returning one [`QueryMatch`] per matching node in document order. A
    /// malformed selector yields [`Error::InvalidArgument`].
    ///
    /// This is the general replacement for scanning code spans by hand: a
    /// `verbatim` / `code_block` / `raw_inline` / `raw_block` selector recovers
    /// those, and every other node kind is reachable too.
    pub fn query(&mut self, selector: &str) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        collect_matches(|ptr, len| unsafe {
            ffi::twig_document_query(raw, selector.as_ptr(), selector.len(), ptr, len)
        })
    }

    /// Return the whole source span of `node` without running a selector query.
    pub fn span(&mut self, node: NodeId) -> Result<Range<usize>, Error> {
        let mut span = ffi::TwigSpan { start: 0, end: 0 };
        let status = unsafe { ffi::twig_document_node_span(self.raw.as_ptr(), node.0, &mut span) };
        Error::from_status(status)?;
        Ok(span.start..span.end)
    }

    /// Return the interior span of `node`, or `None` when the node has no
    /// recorded content span.
    pub fn content_span(&mut self, node: NodeId) -> Result<Option<Range<usize>>, Error> {
        let mut span = ffi::TwigSpan { start: 0, end: 0 };
        let status =
            unsafe { ffi::twig_document_node_content_span(self.raw.as_ptr(), node.0, &mut span) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(span.start..span.end)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// The span of `node`'s own leading MARKER — the leading bytes a rich view
    /// HIDES on its opening line — or `None` when it has none. See
    /// [`FlatNode::marker_span`], which is the same answer inside a snapshot.
    pub fn marker_span(&mut self, node: NodeId) -> Result<Option<Range<usize>>, Error> {
        let mut span = ffi::TwigSpan { start: 0, end: 0 };
        let status =
            unsafe { ffi::twig_document_node_marker_span(self.raw.as_ptr(), node.0, &mut span) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(span.start..span.end)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// The source span of the `{...}` attribute block attached to `node` — the
    /// bytes a lossless serializer re-emits instead of the flattened
    /// [`FlatNode::attrs`] projection, which a multi-line option block, or a
    /// nested or array-valued entry, says more than.
    ///
    /// `None` when the node has no attributes, or has some with no single
    /// recorded range: a synthesized set, or one merged from several source
    /// blocks. That is the case a caller has to handle rather than assume away
    /// — without this the only way to find an attribute block's extent was to
    /// scan the source for `{` near the node, which reads a `{` in prose as an
    /// attribute block and strands a real one that a heuristic missed.
    ///
    /// An accessor rather than a [`FlatNode`] field because the range is per
    /// attribute BLOCK, not per `(key, value)` pair.
    pub fn attrs_span(&mut self, node: NodeId) -> Result<Option<Range<usize>>, Error> {
        let mut span = ffi::TwigSpan { start: 0, end: 0 };
        let status =
            unsafe { ffi::twig_document_attrs_span(self.raw.as_ptr(), node.0, &mut span) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(span.start..span.end)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// Everything HIDDEN before the content on the line byte `offset` sits on:
    /// every marker a node OPENS that line with, and the indentation between
    /// them, as one range running from the line start.
    ///
    /// This is the assembled form of [`FlatNode::marker_span`], which records
    /// each node's own marker alone. `>   1. [ ] ` is four nodes' markers plus
    /// the spaces between them, and the union is contiguous from the line start
    /// — so a caller gets one range to hide, or one width for a caret to step
    /// over, rather than a chain to walk and stitch together itself.
    ///
    /// `None` when nothing opens on this line — a CONTINUATION line, the second
    /// line of a wrapped paragraph or of a block quote. That is a real answer
    /// rather than a gap: what a continuation line repeats is a different
    /// question (a quote re-emits `> `, a list item re-emits spaces) and is not
    /// answerable from marker spans. [`Error::InvalidArgument`] if `offset`
    /// exceeds the source length.
    pub fn line_prefix(&mut self, offset: usize) -> Result<Option<Range<usize>>, Error> {
        let mut span = ffi::TwigSpan { start: 0, end: 0 };
        let status =
            unsafe { ffi::twig_document_line_prefix(self.raw.as_ptr(), offset, &mut span) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(span.start..span.end)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// What a CONTINUATION LINE at `offset` must open with to stay inside every
    /// container holding it.
    ///
    /// The other half of [`Document::line_prefix`], and not derivable from it.
    /// That one reports the bytes ALREADY THERE on a line something opens, so it
    /// hands back a range into the source. This one reports the bytes that WOULD
    /// HAVE TO BE WRITTEN on a line nothing opens — a list item's continuation
    /// is spaces where its marker was, which is not source at all, so it is
    /// built rather than pointed at.
    ///
    /// A quote's `> ` is REPRODUCED (dropping it ends the quote); a list item's
    /// marker becomes its WIDTH IN SPACES (repeating it would open a second
    /// item). Each container on the caret's chain contributes the columns its
    /// own marker occupies, on its own opening line — which may be a different
    /// line for each of them, and is why this is a tree walk rather than a
    /// re-read of one line:
    ///
    /// ```text
    /// > - a      quote "> " + item "- " as width   ->  ">   "
    /// - a
    ///   - b      outer item + inner item           ->  "    "
    /// ```
    ///
    /// Empty at the top level, which is the correct prefix there: none.
    /// [`Error::InvalidArgument`] if `offset` exceeds the source length.
    pub fn continuation_prefix(&mut self, offset: usize) -> Result<LinePrefix, Error> {
        self.prefix_via(offset, ffi::twig_document_continuation_prefix)
    }

    /// What a BLANK line inside the containers at `offset` must carry.
    ///
    /// A quote's blank line still has to carry its `>` or the quote ENDS there;
    /// a list item's must carry nothing, because a blank line between two of an
    /// item's blocks is what makes its list loose and indenting it changes
    /// nothing about that. So this is [`Document::continuation_prefix`] with its
    /// trailing spaces cut back — which drops an item's indent entirely and
    /// leaves a quote marker standing.
    ///
    /// The quote form is `>` and not `> `, because the space after the marker is
    /// content indentation and a blank line has no content.
    pub fn blank_line_prefix(&mut self, offset: usize) -> Result<LinePrefix, Error> {
        self.prefix_via(offset, ffi::twig_document_blank_line_prefix)
    }

    /// Shared marshalling for the two prefix builders above.
    fn prefix_via(
        &mut self,
        offset: usize,
        f: unsafe extern "C" fn(
            *mut ffi::TwigDocument,
            usize,
            *mut *const u8,
            *mut usize,
            *mut usize,
        ) -> ffi::TwigStatus,
    ) -> Result<LinePrefix, Error> {
        let mut ptr: *const u8 = std::ptr::null();
        let mut len = 0usize;
        let mut columns = 0usize;
        let status = unsafe { f(self.raw.as_ptr(), offset, &mut ptr, &mut len, &mut columns) };
        Error::from_status(status)?;
        let text = if ptr.is_null() || len == 0 {
            String::new()
        } else {
            let bytes = unsafe { std::slice::from_raw_parts(ptr, len) };
            String::from_utf8(bytes.to_vec()).map_err(|_| Error::Internal)?
        };
        Ok(LinePrefix { text, columns })
    }

    /// The grid extent of the cell at `node` — how many `(columns, rows)` it
    /// occupies — or `None` when the node is not a cell. Both are at least 1,
    /// and `(1, 1)` is the ordinary one-square cell; anything larger is a merged
    /// cell from a format with a real grid (HTML's `colspan`/`rowspan`, an rST
    /// grid table). GFM and djot pipe tables always report `(1, 1)`.
    ///
    /// HTML's `rowspan="0"` ("to the end of the row group") is not a count and
    /// reports 1; the source spelling survives on the node's attributes.
    ///
    /// This is an accessor rather than a [`FlatNode`] field because the C struct
    /// it snapshots is ABI-frozen — see [`Document::span`] for the same shape.
    pub fn cell_extent(&mut self, node: NodeId) -> Result<Option<(u32, u32)>, Error> {
        let raw = self.raw.as_ptr();
        let mut colspan: u32 = 0;
        let status = unsafe { ffi::twig_document_cell_colspan(raw, node.0, &mut colspan) };
        match status.0 {
            ffi::TwigStatus::OK => {}
            ffi::TwigStatus::NOT_FOUND => return Ok(None),
            _ => return Err(Error::from_status(status).unwrap_err()),
        }
        let mut rowspan: u32 = 0;
        Error::from_status(unsafe { ffi::twig_document_cell_rowspan(raw, node.0, &mut rowspan) })?;
        Ok(Some((colspan, rowspan)))
    }

    /// Snapshot the whole tree as a flat [`FlatNode`] array (the JSON-free read
    /// path for a renderer), indexed so `nodes[i].id == NodeId(i)`. Walk it via
    /// the `parent`/`first_child`/`next_sibling` links; the root is the node
    /// whose `parent` is `None`.
    pub fn nodes(&mut self) -> Result<Vec<FlatNode>, Error> {
        let raw = self.raw.as_ptr();
        collect_flat_nodes(|ptr, len| unsafe { ffi::twig_document_nodes(raw, ptr, len) })
    }

    /// The document-level **definitions**: every node that hangs off no parent
    /// and is not the document root, in arena order. Usually empty.
    ///
    /// A parsed document is not one tree. Footnote definitions and
    /// link-reference definitions are resolved by LABEL rather than by
    /// position, so twig attaches them to nothing — walking from the root over
    /// [`FlatNode::first_child`] never reaches them, and a renderer that wants
    /// to resolve `[^1]` has to find the definition some other way. This is
    /// that way, and it replaces scanning the whole [`Document::nodes`] array
    /// for entries whose `parent` is `None`.
    ///
    /// Not filtered to a kind list: WHICH kinds end up detached is a property
    /// of how a format resolves its definitions (djot and Markdown detach
    /// [`Kind::Footnote`] and [`Kind::Reference`]; rST adds [`Kind::Citation`]
    /// and [`Kind::Substitution`]), not something a caller should enumerate.
    /// Read the [`kind`](QueryMatch::kind) on each match.
    pub fn definitions(&mut self) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        collect_matches(|ptr, len| unsafe { ffi::twig_document_definitions(raw, ptr, len) })
    }

    /// What converting this document to `target` would silently **lose**: one
    /// [`Warning`] per lossy node — two at one path for a node whose
    /// attributes are lost as well as its kind — in document order. An empty vec means the
    /// conversion is lossless.
    ///
    /// Twig's serializers degrade or drop a node whenever the target has no
    /// spelling for it — a djot `{=mark=}` written into Markdown comes back as
    /// plain text, an HTML comment converted to djot vanishes entirely. None of
    /// it is an error, so all of it happens quietly. This is the call that makes
    /// it loud, and it replaces guessing from the outside: the answers are
    /// measured against the serializers by a round-trip probe in the Zig
    /// library, not asserted.
    ///
    /// The answer belongs to the (document, target) PAIR, not to the document —
    /// the same document has different answers for different targets, which is
    /// why this takes one and why nothing is cached on [`Document`] itself.
    ///
    /// [`Error::UnsupportedFormat`] for a target with no serializer at all
    /// ([`Target::Xml`]): "this cannot be written" is a capability answer,
    /// not a per-node diagnosis.
    pub fn diagnostics(&mut self, target: Target) -> Result<Vec<Warning>, Error> {
        let raw = self.raw.as_ptr();
        let code = ffi::TwigFormat::from(target) as c_int;
        let mut ptr: *const ffi::TwigWarning = std::ptr::null();
        let mut len = 0usize;
        let status = unsafe { ffi::twig_document_diagnostics(raw, code, &mut ptr, &mut len) };
        Error::from_status(status)?;
        if len == 0 || ptr.is_null() {
            return Ok(Vec::new());
        }
        let raw_warnings = unsafe { std::slice::from_raw_parts(ptr, len) };
        Ok(raw_warnings
            .iter()
            .map(|w| Warning {
                fidelity: Fidelity::from_c(w.fidelity),
                path: borrowed_bytes(w.path_ptr, w.path_len).unwrap_or_default(),
                kind: Kind::from(borrowed_cstr(w.kind).unwrap_or_default().as_str()),
            })
            .collect())
    }

    /// The direct children of `node` as [`QueryMatch`]es (id, span, kind) —
    /// `None` enumerates the document root's children (the top-level blocks).
    /// The cheap enumeration an incremental renderer walks to decide which
    /// blocks to re-marshal with [`Document::subtree`]. A childless node yields
    /// an empty vec.
    pub fn children(&mut self, node: Option<NodeId>) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        let id = node.map_or(ffi::TWIG_NO_NODE, |n| n.0);
        collect_matches(|ptr, len| unsafe { ffi::twig_document_children(raw, id, ptr, len) })
    }

    /// Snapshot the subtree rooted at `node` as a self-contained [`FlatNode`]
    /// array with *local* ids: `array[0]` is the root, every link is an index
    /// into the returned vec (or `None`), and spans stay absolute. The root's
    /// `parent` and `next_sibling` are `None`, so a walk from index 0 stays
    /// inside the subtree. [`Error::InvalidArgument`] if `node` is out of range.
    pub fn subtree(&mut self, node: NodeId) -> Result<Vec<FlatNode>, Error> {
        let raw = self.raw.as_ptr();
        collect_flat_nodes(|ptr, len| unsafe { ffi::twig_document_subtree(raw, node.0, ptr, len) })
    }

    /// The deepest node whose span contains byte `offset` (with `offset` equal
    /// to the source length treated as inside the root) — hit-testing and
    /// cursor context. `Ok(None)` if no node covers the offset;
    /// [`Error::InvalidArgument`] if `offset` exceeds the source length.
    pub fn node_at(&mut self, offset: usize) -> Result<Option<QueryMatch>, Error> {
        let mut m = empty_ffi_match();
        let status = unsafe { ffi::twig_document_node_at(self.raw.as_ptr(), offset, &mut m) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(query_match_from_ffi(&m)?)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// The chain of nodes containing byte `offset`, root-first down to the
    /// deepest (the node [`Document::node_at`] returns) — the ancestor path for
    /// a breadcrumb. Empty if no node covers the offset.
    pub fn ancestors_at(&mut self, offset: usize) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        let mut ptr: *const ffi::TwigQueryMatch = std::ptr::null();
        let mut len = 0usize;
        let status = unsafe { ffi::twig_document_nodes_at(raw, offset, &mut ptr, &mut len) };
        match status.0 {
            ffi::TwigStatus::OK => {}
            ffi::TwigStatus::NOT_FOUND => return Ok(Vec::new()),
            _ => return Err(Error::from_status(status).unwrap_err()),
        }
        if len == 0 || ptr.is_null() {
            return Ok(Vec::new());
        }
        let raw_matches = unsafe { std::slice::from_raw_parts(ptr, len) };
        raw_matches.iter().map(query_match_from_ffi).collect()
    }

    /// [`Document::node_at`] under CARET containment — the same descent, under
    /// the rule an editing caret needs rather than the one a byte range needs.
    ///
    /// Two differences, both because a caret is a position BETWEEN bytes while a
    /// span is a range OF bytes:
    ///
    /// 1. **A block's end is inside it.** A caret after the last character of a
    ///    paragraph is *in* that paragraph — it is where you stand to type the
    ///    rest of it. Half-open containment puts it outside, which is why a
    ///    consumer probing [`Document::ancestors_at`] ends up guessing at
    ///    contrived offsets (the content start, `caret - 1`, a marker byte) to
    ///    find the block it was plainly inside of.
    ///
    /// 2. **A trailing newline is not part of the block**, which is what makes
    ///    the two authorable formats AGREE. Djot ends a paragraph's span after
    ///    its newline and Markdown before it, so on `"a\n\nb\n"` the caret at
    ///    offset 1 read as `para` through Djot and `doc` through Markdown — the
    ///    same caret, two answers, decided by which parser produced the tree.
    ///
    /// Never `Ok(None)` for a non-empty document: a caret in the gap between two
    /// blocks reports the container holding the gap (usually the root) rather
    /// than nothing at all.
    pub fn node_at_caret(&mut self, offset: usize) -> Result<Option<QueryMatch>, Error> {
        let mut m = empty_ffi_match();
        let status = unsafe { ffi::twig_document_node_at_caret(self.raw.as_ptr(), offset, &mut m) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(query_match_from_ffi(&m)?)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// [`Document::ancestors_at`] under caret containment — root-first down to
    /// the node [`Document::node_at_caret`] returns. See that method for the
    /// containment rule and why it differs.
    pub fn ancestors_at_caret(&mut self, offset: usize) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        let mut ptr: *const ffi::TwigQueryMatch = std::ptr::null();
        let mut len = 0usize;
        let status = unsafe { ffi::twig_document_nodes_at_caret(raw, offset, &mut ptr, &mut len) };
        match status.0 {
            ffi::TwigStatus::OK => {}
            ffi::TwigStatus::NOT_FOUND => return Ok(Vec::new()),
            _ => return Err(Error::from_status(status).unwrap_err()),
        }
        if len == 0 || ptr.is_null() {
            return Ok(Vec::new());
        }
        let raw_matches = unsafe { std::slice::from_raw_parts(ptr, len) };
        raw_matches.iter().map(query_match_from_ffi).collect()
    }
}

/// A [`Document`] borrowed from an [`Editor`] (see [`Editor::document`]): the
/// editor's live tree behind the whole document read surface, without a parse.
///
/// It holds the editor mutably borrowed for as long as it lives, so the tree —
/// and every node id and span read out of it — cannot change underneath it.
/// Dropping it frees nothing; the editor owns the tree.
///
/// [`Document::render_html`] and [`Document::serialize`] are the two methods it
/// cannot serve ([`Error::UnsupportedFormat`] — they need a real parse's
/// language tag and side tables). Parse [`Editor::source`] for those.
#[derive(Debug)]
pub struct DocumentView<'a> {
    doc: Document,
    _editor: PhantomData<&'a mut Editor>,
}

impl std::ops::Deref for DocumentView<'_> {
    type Target = Document;

    fn deref(&self) -> &Document {
        &self.doc
    }
}

impl std::ops::DerefMut for DocumentView<'_> {
    fn deref_mut(&mut self) -> &mut Document {
        &mut self.doc
    }
}

impl Drop for Document {
    fn drop(&mut self) {
        unsafe { ffi::twig_document_destroy(self.raw.as_ptr()) }
    }
}

/// Opt-in Markdown extensions to enable for a parse — for either the read path
/// ([`Document::parse_with`]) or the edit path ([`Editor::new_ext`]). Ignored
/// for non-Markdown formats. Every field defaults off, matching the library.
///
/// These lay **over** whichever Markdown dialect the [`Format`] named —
/// `Format::Gfm` with `math` is GFM plus math — and the default-on set
/// (tables, strikethrough, task lists, …) is the dialect's to decide, which is
/// why there is no field to turn one off: that is what [`Format::Commonmark`]
/// is.
#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
pub struct MarkdownExtensions {
    /// Generic directives: `:name`, `::name`, `:::name`.
    pub directives: bool,
    /// `$...$` / `$$...$$` math.
    pub math: bool,
    /// Parse recognized raw HTML into semantic AST nodes — an `<img>` becomes an
    /// [`image` node](FlatNode) instead of an opaque `raw_block`/`raw_inline`, so
    /// it is addressable by [`Document::query`] and the tree read paths. Only
    /// tags that map verbatim onto the source are promoted; the rest stay raw.
    /// A bare `<div>` line paired with its bare `</div>` line, and a `<span>`
    /// paired with its `</span>` in the same run, become one container over
    /// what lies between — the spellings twig writes for a block's and a run's
    /// attributes, and what this flag reads back.
    pub html_elements: bool,
    /// `==text==` highlight, parsed as a `mark` node (the markdown-it-mark /
    /// Obsidian extension). Only a run of exactly two `=` delimits.
    pub highlight: bool,
    /// Coloured highlights on top of `highlight` (Obsidian 1.14): a circle
    /// emoji right after the opening `==` — `==🔴 text==` — is stripped from
    /// the content and recorded as the mark's `data-color` attribute
    /// (`red`, `orange`, `yellow`, `green`, `blue`, `purple`, `brown`). Inert
    /// unless `highlight` is also set.
    pub highlight_colors: bool,
}

impl MarkdownExtensions {
    fn to_flags(self) -> u32 {
        let mut flags = 0;
        if self.directives {
            flags |= ffi::TWIG_MD_DIRECTIVES;
        }
        if self.math {
            flags |= ffi::TWIG_MD_MATH;
        }
        if self.html_elements {
            flags |= ffi::TWIG_MD_HTML_ELEMENTS;
        }
        if self.highlight {
            flags |= ffi::TWIG_MD_HIGHLIGHT;
        }
        if self.highlight_colors {
            flags |= ffi::TWIG_MD_HIGHLIGHT_COLORS;
        }
        flags
    }
}

/// A span-splice editor over a document: applies lossless, in-place edits and
/// reparses after each one, so node addressing stays valid as the document
/// evolves. Every op is addressed by a `locator` — a dot-separated index path
/// (`"0.3.1"`) or a selector that must match exactly one node
/// (`heading("Status")`). A failed edit leaves the document unchanged.
#[derive(Debug)]
pub struct Editor {
    raw: NonNull<ffi::TwigEditor>,
}

impl Editor {
    /// Create an editor over a private copy of `input`, parsed as `format` with
    /// default options.
    pub fn new(input: &[u8], format: Format) -> Result<Self, Error> {
        let mut raw = std::ptr::null_mut();
        let ffi_format: ffi::TwigFormat = format.into();
        let status = unsafe {
            ffi::twig_editor_create(input.as_ptr(), input.len(), ffi_format as i32, &mut raw)
        };
        Error::from_status(status)?;
        let raw = NonNull::new(raw).ok_or(Error::Internal)?;
        Ok(Self { raw })
    }

    pub fn new_str(input: &str, format: Format) -> Result<Self, Error> {
        Self::new(input.as_bytes(), format)
    }

    /// Like [`Editor::new`], plus Markdown `extensions` to enable (ignored for
    /// other formats). The editor reparses with these after every edit, so a
    /// directive-bearing document stays parseable — needed before
    /// [`Editor::filter`] can match `directive[...]` selectors.
    ///
    /// They also decide what the authoring gestures may **write**, since a
    /// gesture may only mint bytes this editor's own reparse reads back:
    /// [`MarkdownExtensions::highlight`] makes `==x==` a highlight
    /// [`Editor::toggle_inline`] can add and remove, and
    /// [`MarkdownExtensions::highlight_colors`] makes
    /// [`Editor::set_mark_color`] available on top of it. Without them those
    /// calls are [`Error::UnsupportedFormat`] — see [`Format::supports_with`],
    /// which answers for the extensions rather than for the format alone.
    pub fn new_ext(
        input: &[u8],
        format: Format,
        extensions: MarkdownExtensions,
    ) -> Result<Self, Error> {
        let mut raw = std::ptr::null_mut();
        let ffi_format: ffi::TwigFormat = format.into();
        let status = unsafe {
            ffi::twig_editor_create_ext(
                input.as_ptr(),
                input.len(),
                ffi_format as i32,
                extensions.to_flags(),
                &mut raw,
            )
        };
        Error::from_status(status)?;
        let raw = NonNull::new(raw).ok_or(Error::Internal)?;
        Ok(Self { raw })
    }

    /// Replace the whole source of the located node with `text`.
    pub fn replace(&mut self, locator: &str, text: &str) -> Result<(), Error> {
        self.apply(locator, text, |ed, loc, loc_len, txt, txt_len| unsafe {
            ffi::twig_editor_replace(ed, loc, loc_len, txt, txt_len)
        })
    }

    /// Replace the interior (between-delimiters content) of the located
    /// container.
    pub fn replace_content(&mut self, locator: &str, text: &str) -> Result<(), Error> {
        self.apply(locator, text, |ed, loc, loc_len, txt, txt_len| unsafe {
            ffi::twig_editor_replace_content(ed, loc, loc_len, txt, txt_len)
        })
    }

    /// Insert `text` immediately before the located node.
    pub fn insert_before(&mut self, locator: &str, text: &str) -> Result<(), Error> {
        self.apply(locator, text, |ed, loc, loc_len, txt, txt_len| unsafe {
            ffi::twig_editor_insert_before(ed, loc, loc_len, txt, txt_len)
        })
    }

    /// Insert `text` immediately after the located node.
    pub fn insert_after(&mut self, locator: &str, text: &str) -> Result<(), Error> {
        self.apply(locator, text, |ed, loc, loc_len, txt, txt_len| unsafe {
            ffi::twig_editor_insert_after(ed, loc, loc_len, txt, txt_len)
        })
    }

    /// Insert `text` as the `index`-th child of the located container (an index
    /// at or past the child count appends).
    pub fn insert_child(&mut self, locator: &str, index: usize, text: &str) -> Result<(), Error> {
        let status = unsafe {
            ffi::twig_editor_insert_child(
                self.raw.as_ptr(),
                locator.as_ptr(),
                locator.len(),
                index,
                text.as_ptr(),
                text.len(),
            )
        };
        Error::from_status(status)
    }

    /// Delete the located node (removes exactly its span; no whitespace
    /// cleanup).
    pub fn delete(&mut self, locator: &str) -> Result<(), Error> {
        let status =
            unsafe { ffi::twig_editor_delete(self.raw.as_ptr(), locator.as_ptr(), locator.len()) };
        Error::from_status(status)
    }

    /// Delete the located node, tidying surrounding blank lines for a
    /// whole-line node — a block, or an element alone on an indented line,
    /// which goes with its indentation; an inline node degrades to the exact
    /// delete.
    pub fn delete_smart(&mut self, locator: &str) -> Result<(), Error> {
        let status = unsafe {
            ffi::twig_editor_delete_smart(self.raw.as_ptr(), locator.as_ptr(), locator.len())
        };
        Error::from_status(status)
    }

    /// Unwrap the located node: replace it with its interior (drop the wrapper,
    /// keep the children) — e.g. peel a `:::vis{...}` container. A node with no
    /// interior (a leaf, or an empty container) is removed.
    pub fn unwrap_node(&mut self, locator: &str) -> Result<(), Error> {
        let status =
            unsafe { ffi::twig_editor_unwrap(self.raw.as_ptr(), locator.as_ptr(), locator.len()) };
        Error::from_status(status)
    }

    /// Move the node `locator` names to immediately before the node `anchor`
    /// names — a canvas's "send backward", a list's reorder — in one splice
    /// and one undo step, the bytes between the two copied verbatim in their
    /// new order. The node travels with the whitespace run ahead of it (the
    /// line break and indentation a pretty-printed document separates
    /// siblings with), which lands after it here, so every sibling keeps its
    /// separator: `<g>\n  <a/>\n  <b/>\n</g>` reorders to
    /// `<g>\n  <b/>\n  <a/>\n</g>`, never to a line holding both. The rule is
    /// about bytes, not structure — a block quote's `> ` prefixes do not
    /// travel — and the anchor need not be a sibling: next to a node in
    /// another container is a reparent.
    ///
    /// [`Error::InvalidArgument`] when either node's span holds the other's,
    /// or the two are one node; [`Error::NotFound`] and [`Error::Ambiguous`]
    /// as every other tree op; [`Error::EditConflict`] when the moved document
    /// no longer parses, in which case nothing changed.
    pub fn move_before(&mut self, locator: &str, anchor: &str) -> Result<(), Error> {
        self.apply(locator, anchor, |ed, loc, loc_len, a, a_len| unsafe {
            ffi::twig_editor_move_before(ed, loc, loc_len, a, a_len)
        })
    }

    /// Move the node `locator` names to immediately after the node `anchor`
    /// names — a canvas's "bring forward". The whitespace run ahead of the
    /// node travels with it and stays ahead of it. Otherwise
    /// [`Editor::move_before`].
    pub fn move_after(&mut self, locator: &str, anchor: &str) -> Result<(), Error> {
        self.apply(locator, anchor, |ed, loc, loc_len, a, a_len| unsafe {
            ffi::twig_editor_move_after(ed, loc, loc_len, a, a_len)
        })
    }

    /// Prune the document in place: remove every node matching the `drop`
    /// selector except those also matching `keep` (`None` spares nothing),
    /// then — if `unwrap_kept` — unwrap the survivors. Read the result with
    /// [`Editor::source`].
    pub fn filter(
        &mut self,
        drop: &str,
        keep: Option<&str>,
        unwrap_kept: bool,
    ) -> Result<(), Error> {
        let (keep_ptr, keep_len) = match keep {
            Some(k) => (k.as_ptr(), k.len()),
            None => (std::ptr::null(), 0),
        };
        let status = unsafe {
            ffi::twig_editor_filter(
                self.raw.as_ptr(),
                drop.as_ptr(),
                drop.len(),
                keep_ptr,
                keep_len,
                unwrap_kept as i32,
            )
        };
        Error::from_status(status)
    }

    /// The editor's current (edited) source bytes.
    pub fn source(&mut self) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_editor_source(raw, ptr, len) })
    }

    /// The editor's current source bytes as a UTF-8 string.
    pub fn source_str(&mut self) -> Result<String, Error> {
        String::from_utf8(self.source()?).map_err(|_| Error::Internal)
    }

    /// Encode the editor's current tree as pretty-printed JSON — the live
    /// counterpart of [`Document::ast_json`], for inspecting between edits.
    pub fn ast_json(&mut self) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_editor_ast_json(raw, ptr, len) })
    }

    /// Resolve a selector against the editor's current tree — the live
    /// counterpart of [`Document::query`].
    pub fn query(&mut self, selector: &str) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        collect_matches(|ptr, len| unsafe {
            ffi::twig_editor_query(raw, selector.as_ptr(), selector.len(), ptr, len)
        })
    }

    // ── offset-addressed editing & read-back ────────────────────────────────

    /// Splice `[start, end)` of the current source with `text`, reparse, and
    /// return the [`Change`] the edit produced — the offset-addressed primitive
    /// a caret editor is built on: a keystroke is `edit_range(c, c, "x")`,
    /// backspace `edit_range(c - 1, c, "")`, a selection replace
    /// `edit_range(a, b, s)`. `start <= end <= ` source length, else
    /// [`Error::InvalidArgument`]. A reparse-breaking edit is rolled back and
    /// returns [`Error::EditConflict`], leaving the document untouched.
    pub fn edit_range(&mut self, start: usize, end: usize, text: &str) -> Result<Change, Error> {
        let mut change = ffi::TwigChange {
            old_span: ffi::TwigSpan { start: 0, end: 0 },
            new_span: ffi::TwigSpan { start: 0, end: 0 },
        };
        let status = unsafe {
            ffi::twig_editor_edit_range(
                self.raw.as_ptr(),
                start,
                end,
                text.as_ptr(),
                text.len(),
                &mut change,
            )
        };
        Error::from_status(status)?;
        Ok(Change::from_ffi(change))
    }

    /// The byte effect of the last successful edit — including the locator ops
    /// ([`Editor::replace`], [`Editor::delete_smart`], …), so any edit can
    /// re-anchor a caret without re-diffing. `None` before the first successful
    /// edit. (A multi-splice op such as [`Editor::filter`] reports only its
    /// final splice.)
    pub fn last_change(&mut self) -> Option<Change> {
        let mut change = ffi::TwigChange {
            old_span: ffi::TwigSpan { start: 0, end: 0 },
            new_span: ffi::TwigSpan { start: 0, end: 0 },
        };
        let status = unsafe { ffi::twig_editor_last_change(self.raw.as_ptr(), &mut change) };
        match status.0 {
            ffi::TwigStatus::OK => Some(Change::from_ffi(change)),
            _ => None,
        }
    }

    /// Undo the last edit step, restoring the previous source and reparsing.
    /// Returns the [`Change`] the undo produced (current → restored) so a caret
    /// can re-anchor, or `None` when there's nothing to undo. History accrues
    /// across every successful edit that funnels through the splice primitive.
    pub fn undo(&mut self) -> Result<Option<Change>, Error> {
        let mut change = ffi::TwigChange {
            old_span: ffi::TwigSpan { start: 0, end: 0 },
            new_span: ffi::TwigSpan { start: 0, end: 0 },
        };
        let status = unsafe { ffi::twig_editor_undo(self.raw.as_ptr(), &mut change) };
        if status.0 == ffi::TwigStatus::NOT_FOUND {
            return Ok(None);
        }
        Error::from_status(status)?;
        Ok(Some(Change::from_ffi(change)))
    }

    /// Redo the most recently undone edit step; the inverse of [`Editor::undo`].
    /// Returns `None` when the redo stack is empty (nothing undone, or a fresh
    /// edit has invalidated it).
    pub fn redo(&mut self) -> Result<Option<Change>, Error> {
        let mut change = ffi::TwigChange {
            old_span: ffi::TwigSpan { start: 0, end: 0 },
            new_span: ffi::TwigSpan { start: 0, end: 0 },
        };
        let status = unsafe { ffi::twig_editor_redo(self.raw.as_ptr(), &mut change) };
        if status.0 == ffi::TwigStatus::NOT_FOUND {
            return Ok(None);
        }
        Error::from_status(status)?;
        Ok(Some(Change::from_ffi(change)))
    }

    /// Fold the most recent edit into the undo step before it, so a caret editor
    /// can coalesce a run of keystrokes into a single undo. Call right after an
    /// `edit_range` that continues a run (same kind, no intervening caret move);
    /// a no-op unless there are at least two steps to merge.
    pub fn coalesce_last_undo(&mut self) -> Result<(), Error> {
        let status = unsafe { ffi::twig_editor_coalesce_last(self.raw.as_ptr()) };
        Error::from_status(status)
    }

    /// A monotonic change token, bumped once per successful mutation of the
    /// document (every edit and every undo/redo). Never decreases and never
    /// repeats for the life of the editor; the initial parse is revision 0.
    /// Equal revision means a byte-identical document, so it can key a cache
    /// instead of hand-tracking "did anything change?".
    pub fn revision(&mut self) -> u64 {
        unsafe { ffi::twig_editor_revision(self.raw.as_ptr()) }
    }

    /// The cumulative dirty byte range since the last [`Editor::clear_dirty`]
    /// (or since the editor was created) — the union of every mutation's byte
    /// effect over that window, in current source coordinates — or `None` when
    /// the document is clean relative to the last clear.
    ///
    /// The incremental-rebuild companion to [`Editor::revision`]: `revision`
    /// says *whether* a cached view (glyph rows, syntax spans) needs rebuilding,
    /// this says *which bytes* changed, so a consumer rebuilds only the affected
    /// part instead of the whole document. A single conservative interval: it
    /// always covers every changed byte and may over-cover the gap between edits
    /// to disjoint regions, but never under-covers.
    ///
    /// It reports where *bytes* differ — exact, because twig splices losslessly
    /// and never reflows untouched bytes — not where the *parse* differs. An
    /// edit can reinterpret bytes outside the range (opening a code fence, a `#`
    /// promoting a paragraph to a heading), so a consumer rebuilding *structure*
    /// from it should widen the range to the enclosing block(s) itself (e.g. via
    /// [`Editor::node_at`] on each end). Typical loop: on a repaint, if
    /// [`Editor::revision`] moved, read this range, rebuild the rows it (widened)
    /// covers, then call [`Editor::clear_dirty`].
    pub fn dirty_range(&mut self) -> Option<Range<usize>> {
        let mut span = ffi::TwigSpan { start: 0, end: 0 };
        let status = unsafe { ffi::twig_editor_dirty_range(self.raw.as_ptr(), &mut span) };
        match status.0 {
            ffi::TwigStatus::OK => Some(span.start..span.end),
            _ => None,
        }
    }

    /// Acknowledge the current dirty range: mark the document clean so a later
    /// [`Editor::dirty_range`] reports only mutations made after this call. Call
    /// it once you've consumed the range (rebuilt the affected view). Leaves the
    /// document, [`Editor::revision`], and [`Editor::last_change`] untouched.
    pub fn clear_dirty(&mut self) {
        unsafe { ffi::twig_editor_clear_dirty(self.raw.as_ptr()) };
    }

    /// Attach an opaque, caller-owned blob (e.g. a serialized caret/selection)
    /// to the editor's current document state. Twig copies the bytes and never
    /// interprets them; it only carries them through the undo history so
    /// [`Editor::undo`]/[`Editor::redo`] hand back the caret matching the
    /// restored source (via [`Editor::caret_blob`]). Set it with the pre-edit
    /// caret *before* an edit so the retired undo step captures it. An empty
    /// blob clears the current caret.
    pub fn set_caret_blob(&mut self, blob: &[u8]) -> Result<(), Error> {
        let status = unsafe {
            ffi::twig_editor_set_caret_blob(self.raw.as_ptr(), blob.as_ptr(), blob.len())
        };
        Error::from_status(status)
    }

    /// The opaque caret blob for the editor's current document state (see
    /// [`Editor::set_caret_blob`]). After [`Editor::undo`]/[`Editor::redo`] this
    /// is the restored state's caret; after an edit it is empty until set again.
    /// Returns an owned copy, so it outlives the next edit.
    pub fn caret_blob(&mut self) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_editor_caret_blob(raw, ptr, len) })
    }

    /// The editor's current tree as a borrowed [`Document`], so the whole
    /// document read surface ([`Document::nodes`], [`Document::children`],
    /// [`Document::subtree`], [`Document::node_at`], [`Document::query`],
    /// [`Document::span`], …) applies to a document being edited.
    ///
    /// The view borrows the editor mutably, so no edit can land while it is
    /// alive and the ids it yields cannot go stale; drop it to edit again. See
    /// [`DocumentView`] for the two methods it cannot serve.
    pub fn document(&mut self) -> Result<DocumentView<'_>, Error> {
        let mut raw = std::ptr::null_mut();
        let status = unsafe { ffi::twig_editor_document(self.raw.as_ptr(), &mut raw) };
        Error::from_status(status)?;
        let raw = NonNull::new(raw).ok_or(Error::Internal)?;
        Ok(DocumentView {
            doc: Document { raw },
            _editor: PhantomData,
        })
    }

    /// Snapshot the current tree as a flat [`FlatNode`] array (the JSON-free
    /// read path for a renderer), indexed so `nodes[i].id == NodeId(i)`. Walk it
    /// via the `parent`/`first_child`/`next_sibling` links; the root is the node
    /// whose `parent` is `None`.
    pub fn nodes(&mut self) -> Result<Vec<FlatNode>, Error> {
        let mut ptr: *const ffi::TwigFlatNode = std::ptr::null();
        let mut len = 0usize;
        let status = unsafe { ffi::twig_editor_nodes(self.raw.as_ptr(), &mut ptr, &mut len) };
        Error::from_status(status)?;
        if len == 0 {
            return Ok(Vec::new());
        }
        if ptr.is_null() {
            return Err(Error::Internal);
        }
        let raw = unsafe { std::slice::from_raw_parts(ptr, len) };
        raw.iter().map(flat_node_from_ffi).collect()
    }

    /// The direct children of `node` as [`QueryMatch`]es (id, span, kind) —
    /// `None` enumerates the document root's children (the top-level blocks). The
    /// cheap top-level enumeration an incremental renderer walks to decide which
    /// blocks changed, without marshalling the whole arena; pair it with
    /// [`Editor::subtree`] to then re-marshal only those that did. A childless
    /// node yields an empty vec.
    pub fn child_spans(&mut self, node: Option<NodeId>) -> Result<Vec<QueryMatch>, Error> {
        let id = node.map_or(ffi::TWIG_NO_NODE, |n| n.0);
        let mut ptr: *const ffi::TwigQueryMatch = std::ptr::null();
        let mut len = 0usize;
        let status =
            unsafe { ffi::twig_editor_child_spans(self.raw.as_ptr(), id, &mut ptr, &mut len) };
        Error::from_status(status)?;
        if len == 0 || ptr.is_null() {
            return Ok(Vec::new());
        }
        let raw = unsafe { std::slice::from_raw_parts(ptr, len) };
        raw.iter().map(query_match_from_ffi).collect()
    }

    /// Snapshot the subtree rooted at `node` as a self-contained [`FlatNode`]
    /// array with *local* ids: `array[0]` is the root, every link is an index
    /// into the returned vec (or `None`), and spans stay absolute. The
    /// incremental-render companion to [`Editor::nodes`] — re-marshal one edited
    /// block's subtree instead of the whole document. The root's `parent` and
    /// `next_sibling` are `None`, so a walk from index 0 stays inside the
    /// subtree. [`Error::InvalidArgument`] if `node` is out of range.
    pub fn subtree(&mut self, node: NodeId) -> Result<Vec<FlatNode>, Error> {
        let mut ptr: *const ffi::TwigFlatNode = std::ptr::null();
        let mut len = 0usize;
        let status =
            unsafe { ffi::twig_editor_subtree(self.raw.as_ptr(), node.0, &mut ptr, &mut len) };
        Error::from_status(status)?;
        if len == 0 || ptr.is_null() {
            return Ok(Vec::new());
        }
        let raw = unsafe { std::slice::from_raw_parts(ptr, len) };
        raw.iter().map(flat_node_from_ffi).collect()
    }

    /// The deepest node whose span contains byte `offset` (with `offset` equal
    /// to the source length treated as inside the root) — mouse hit-testing and
    /// cursor context. `Ok(None)` if no node covers the offset;
    /// [`Error::InvalidArgument`] if `offset` exceeds the source length.
    pub fn node_at(&mut self, offset: usize) -> Result<Option<QueryMatch>, Error> {
        let mut m = ffi::TwigQueryMatch {
            node_id: 0,
            span: ffi::TwigSpan { start: 0, end: 0 },
            content_span: ffi::TwigSpan { start: 0, end: 0 },
            has_content_span: 0,
            kind: std::ptr::null(),
        };
        let status = unsafe { ffi::twig_editor_node_at(self.raw.as_ptr(), offset, &mut m) };
        match status.0 {
            ffi::TwigStatus::OK => Ok(Some(query_match_from_ffi(&m)?)),
            ffi::TwigStatus::NOT_FOUND => Ok(None),
            _ => Err(Error::from_status(status).unwrap_err()),
        }
    }

    /// The chain of nodes containing byte `offset`, root-first down to the
    /// deepest (the node [`Editor::node_at`] returns) — the ancestor path for a
    /// breadcrumb or context-scoped edit. Empty if no node covers the offset.
    pub fn ancestors_at(&mut self, offset: usize) -> Result<Vec<QueryMatch>, Error> {
        let mut ptr: *const ffi::TwigQueryMatch = std::ptr::null();
        let mut len = 0usize;
        let status =
            unsafe { ffi::twig_editor_nodes_at(self.raw.as_ptr(), offset, &mut ptr, &mut len) };
        match status.0 {
            ffi::TwigStatus::OK => {}
            ffi::TwigStatus::NOT_FOUND => return Ok(Vec::new()),
            _ => return Err(Error::from_status(status).unwrap_err()),
        }
        if len == 0 || ptr.is_null() {
            return Ok(Vec::new());
        }
        let raw = unsafe { std::slice::from_raw_parts(ptr, len) };
        raw.iter().map(query_match_from_ffi).collect()
    }

    // ── range-oriented rich-text ops (the toolbar) ──────────────────────────

    /// Wrap `[start, end)` with `kind`'s delimiters — the unconditional half of
    /// the inline toolbar (always adds a mark; `*word*` → `**word**` stacks).
    /// [`Error::UnsupportedFormat`] if the document's format can't spell `kind`
    /// (e.g. a Markdown [`InlineKind::Mark`]); [`Error::InvalidArgument`] for a
    /// bad range; [`Error::EditConflict`] if the result doesn't reparse.
    ///
    /// A range crossing a **block boundary** gets one pair per block, in a
    /// single splice — so one undo step and one [`Change`]:
    ///
    /// ```text
    /// one two\n\nthree four   ->   **one two**\n\n**three four**
    /// ```
    ///
    /// rather than one pair straddling the blank line, which reparses as four
    /// literal asterisks and no mark at all. A block's own marker stays outside
    /// the pair (a heading keeps its `# `, a list item its `- `), and a code
    /// block inside the range is stepped over — `**` in a program is two
    /// asterisks. A code span the range cuts into is taken whole, so the pair
    /// closes around its backticks (`` **`word`** `` from a selection of
    /// `word`) rather than inside them. A range with no inline content
    /// anywhere in it, one wholly inside a fence, is [`Error::NotEditable`].
    /// A zero-width range is exempt
    /// from all of this: it crosses nothing, and opening an empty pair for the
    /// caret to type between is the gesture.
    pub fn wrap_range(
        &mut self,
        start: usize,
        end: usize,
        kind: InlineKind,
    ) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_wrap_range(ed, start, end, kind.to_c(), out)
        })
    }

    /// Toggle `kind` over `[start, end)`: remove the mark if the range already
    /// *is* a node of `kind` — covers its whole rendered interior and reaches
    /// no further than its own delimiters, or is a mark of another kind that
    /// is nothing but it (`***word***` selected whole is the strong inside the
    /// emphasis) — else wrap it — a rich editor's Cmd-B. Same error rules as
    /// [`Editor::wrap_range`], and the same per-block cutting: remove-or-wrap
    /// is decided once per block the range touches, so a second press over a
    /// multi-block selection takes off every mark the first one put on instead
    /// of nesting a second pair around each.
    pub fn toggle_inline(
        &mut self,
        start: usize,
        end: usize,
        kind: InlineKind,
    ) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_toggle_inline(ed, start, end, kind.to_c(), out)
        })
    }

    /// Set — or clear, with `None` — the colour of the highlight (a `mark`) the
    /// caret at `offset` is inside.
    ///
    /// Markdown only, and only for an editor created with
    /// [`MarkdownExtensions::highlight_colors`] (which needs
    /// [`MarkdownExtensions::highlight`] with it) — else
    /// [`Error::UnsupportedFormat`]. Ask [`Format::supports_with`] with
    /// [`Gesture::SetMarkColor`] and the same extensions.
    ///
    /// Setting a colour on an uncoloured highlight inserts the prefix, setting
    /// one on a coloured highlight replaces it, and `None` removes it — with
    /// the space after the emoji, which is part of the spelling. An existing
    /// prefix keeps its own spacing: `==🔴text==` recolours tight, because that
    /// is what its author wrote.
    ///
    /// [`Error::NotEditable`] when the caret is not inside a highlight.
    /// Clearing a colour a highlight does not have is a no-op that succeeds,
    /// and the [`Change`] it returns then describes the most recent **prior**
    /// edit (or an empty one), so it is not proof the source moved.
    ///
    /// Authoring a coloured highlight from nothing is two gestures — a colour
    /// is a property of a highlight that already exists:
    ///
    /// ```no_run
    /// # use twig::{Editor, Format, MarkColor, MarkdownExtensions};
    /// # fn main() -> Result<(), twig::Error> {
    /// let exts = MarkdownExtensions {
    ///     highlight: true,
    ///     highlight_colors: true,
    ///     ..Default::default()
    /// };
    /// let mut ed = Editor::new_ext(b"a word b\n", Format::Markdown, exts)?;
    /// ed.toggle_inline(2, 6, twig::InlineKind::Mark)?; // a ==word== b
    /// ed.set_mark_color(4, Some(MarkColor::Red))?;     // a ==🔴 word== b
    /// # Ok(())
    /// # }
    /// ```
    pub fn set_mark_color(
        &mut self,
        offset: usize,
        color: Option<MarkColor>,
    ) -> Result<Change, Error> {
        let name = color.map(MarkColor::as_str);
        let (ptr, len, has) = opt_str(name);
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_set_mark_color(ed, offset, ptr, len, has, out)
        })
    }

    /// Convert the innermost heading/paragraph covering byte `offset` to `kind`
    /// (the toolbar's H1…H6 / Body switch). Where the format spells a heading
    /// with a leading marker (Djot, Markdown, AsciiDoc) that marker is
    /// rewritten and the inline content kept byte for byte; where it spells
    /// one as a tag pair (HTML) the block is rebuilt as a node of the new kind
    /// and printed by the format's own serializer, so `<p>a <em>b</em></p>`
    /// becomes `<h2>a <em>b</em></h2>` with its attributes along.
    /// [`Error::UnsupportedFormat`] for a format that can do neither (XML);
    /// [`Error::InvalidArgument`] for a heading level outside 1–6.
    ///
    /// On a BLANK LINE this OPENS the block rather than converting one, so
    /// "H2, then type" works from an empty line the way it works from a full
    /// one — there is no node there to rewrite, since no format spells an empty
    /// paragraph. The marker is blank-separated from whatever precedes it (Djot
    /// does not let a heading interrupt a paragraph, so a marker flush under one
    /// is read as that paragraph's text) and carries the line's quote markers,
    /// so a heading opened on a quote's blank line stays inside the quote.
    /// [`BlockKind::Paragraph`] there is a no-op: a blank line already holds no
    /// marker.
    ///
    /// [`Error::NotEditable`] when the blank line is INTERIOR to a block rather
    /// than between blocks — inside a fenced code block, or a table.
    pub fn set_block(&mut self, offset: usize, kind: BlockKind) -> Result<Change, Error> {
        let (block_kind, level) = kind.to_c();
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_set_block(ed, offset, block_kind, level, out)
        })
    }

    /// Toggle a block container over the blocks `[start, end)` covers — the
    /// toolbar's Quote / Bulleted list / Numbered list buttons. Djot and Markdown
    /// only, else [`Error::UnsupportedFormat`]; [`Error::NotFound`] if the range
    /// covers no block; [`Error::InvalidArgument`] for a bad range.
    ///
    /// The range widens to whole lines of the blocks it touches (you cannot quote
    /// half a paragraph), and the prefix lands at column 0, so a container wraps
    /// the outermost structure on those lines.
    ///
    /// Whether this adds or removes is decided from the **AST** — the ancestors
    /// of `start` — not by looking for a `>` in the source. It removes the
    /// container only when the range covers every block that container holds, and
    /// then only one level (`> > a` → `> a`). A partly covered container **nests**
    /// instead, since removing it would drag its uncovered siblings out with it:
    /// selecting the first paragraph of `> a\n>\n> b\n` gives `> > a\n>\n> b\n`.
    /// Toggling one list kind while inside the other **converts** in place
    /// (`- a` → `1. a`) rather than nesting.
    ///
    /// Each covered block becomes one item, so an ordered list numbers a
    /// multi-block range `1.`, `2.`, `3.`… Removing a list inserts a blank line
    /// between items that lacked one, keeping them separate blocks (a tight
    /// `- a\n- b\n` stripped bare would be a single two-line paragraph).
    pub fn toggle_block_container(
        &mut self,
        start: usize,
        end: usize,
        kind: BlockContainerKind,
    ) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_toggle_block_container(ed, start, end, kind.to_c(), out)
        })
    }

    /// Renumber the ordered list at byte `offset` so its markers run `1, 2, 3, …`,
    /// each nesting level restarting at 1 — the numbering a caret editor keeps as
    /// items are inserted, deleted, and nested, where a raw splice leaves the
    /// source numbers stale (`1. 2. 2. 3.`). Djot and Markdown; the display of an
    /// ordered list is renumbered by any CommonMark renderer regardless, so this
    /// is source hygiene, not a render fix.
    ///
    /// [`Error::NotFound`] when `offset` is not inside an ordered list. When the
    /// numbering is already sequential this is a no-op that still returns `Ok` —
    /// the source is left byte-for-byte unchanged. The `Change` is not returned
    /// because a no-op has none; re-read [`Editor::source_str`] for the result.
    ///
    /// Only lines the PARSER reads as items are touched, so this never rewrites a
    /// digit the author wrote as prose. That is not a corner case across formats:
    /// Djot doesn't let a list marker interrupt a paragraph, so in
    /// `1. a\n   2. b` the second line is text inside item `a`, while Markdown
    /// reads it as a nested item — the same bytes, renumbered in one format and
    /// left alone in the other.
    pub fn renumber_ordered_lists(&mut self, offset: usize) -> Result<(), Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_renumber_ordered_lists(ed, offset, out)
        })?;
        Ok(())
    }

    // ── Tables ───────────────────────────────────────────────────────────────
    // Structural editing of the pipe table at a byte `offset`: the caret's cell
    // is the anchor. The whole table is re-spelled and spliced in one edit, so a
    // caller re-reads [`Editor::source_str`] and re-places its caret rather than
    // leaning on the returned span. [`Error::NotFound`] when `offset` is not in a
    // table; [`Error::NotEditable`] for a refused (degenerate) edit.

    /// Insert an empty row below (`below`) or above the caret's row.
    pub fn table_insert_row(&mut self, offset: usize, below: bool) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_INSERT_ROW, below as c_int)
    }

    /// Delete the caret's row. [`Error::NotEditable`] for the header row or the
    /// last remaining body row.
    pub fn table_delete_row(&mut self, offset: usize) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_DELETE_ROW, 0)
    }

    /// Insert an empty column right (`right`) or left of the caret's column.
    pub fn table_insert_column(&mut self, offset: usize, right: bool) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_INSERT_COLUMN, right as c_int)
    }

    /// Delete the caret's column. [`Error::NotEditable`] when it is the only one.
    pub fn table_delete_column(&mut self, offset: usize) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_DELETE_COLUMN, 0)
    }

    /// Set the caret's column to `alignment`.
    pub fn table_set_alignment(
        &mut self,
        offset: usize,
        alignment: Alignment,
    ) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_SET_ALIGNMENT, alignment.to_c())
    }

    /// Move the caret's row one place down (`down`) or up, within the body rows.
    pub fn table_move_row(&mut self, offset: usize, down: bool) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_MOVE_ROW, down as c_int)
    }

    /// Move the caret's column one place right (`right`) or left.
    pub fn table_move_column(&mut self, offset: usize, right: bool) -> Result<(), Error> {
        self.table_edit(offset, ffi::TWIG_TABLE_MOVE_COLUMN, right as c_int)
    }

    fn table_edit(&mut self, offset: usize, op: c_int, arg: c_int) -> Result<(), Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_table_edit(ed, offset, op, arg, out) })?;
        Ok(())
    }

    /// Insert a fresh table — one header row, `rows` body rows, `cols` columns,
    /// every cell empty — as its own block after the block `offset` sits in.
    ///
    /// The placement is [`Editor::insert_thematic_break`]'s, decision for
    /// decision: after the caret's block rather than at the caret, blank-line
    /// separated on both sides, carrying a block quote's prefix on every line,
    /// and at column zero after a list item. The blank above is load-bearing
    /// here too — GFM can read a table's header row out of the paragraph it
    /// follows. The bytes are the format's own table spelling, through the
    /// same emitter the `table_*` edits re-spell with, so the table this
    /// writes is one they can edit.
    ///
    /// There is no [`Error::NotFound`]: an empty document is a fine place for
    /// a table. [`Error::InvalidArgument`] for `rows == 0` or `cols == 0` — a
    /// header with nothing under it is the shape [`Editor::table_delete_row`]
    /// refuses to leave — or an `offset` past the source;
    /// [`Error::UnsupportedFormat`] where the format has no table spelling,
    /// before anything is read. [`Gesture::InsertTable`] answers ahead of time.
    pub fn insert_table(
        &mut self,
        offset: usize,
        rows: usize,
        cols: usize,
    ) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_insert_table(ed, offset, rows, cols, out)
        })
    }

    /// Insert a **leaf directive** — Markdown's `::name[label]{attrs}` — as its
    /// own block after the block `offset` sits in.
    ///
    /// The placement is [`Editor::insert_thematic_break`]'s, decision for
    /// decision: after the caret's block rather than at the caret, blank-line
    /// separated on both sides, a block quote's prefix on **every** line (djot
    /// spells this over two lines, and a marker on the opener alone would leave
    /// the closing fence outside the quote), and column zero after a list item.
    ///
    /// What a name *means* is the application's. Twig writes a named container
    /// and reads one back; `"page-break"` and `"embed"` are your words and
    /// nothing here interprets them. The bytes are the format's own spelling of
    /// that node: `::name{…}` in Markdown, an empty `::: name` fence in djot
    /// (whose div is anonymous, so the name comes back as a *class*),
    /// `<name>…</name>` in HTML.
    ///
    /// `label` is the bracketed text, `None` for none — a different document
    /// from `Some("")` (`::name` against `::name[]`). `attrs` is the
    /// `(key, Some(value))` / `(key, None)` pair list [`Builder::set_attrs`]
    /// takes.
    ///
    /// A `name` is an ASCII letter followed by letters, digits, `-` and `_` —
    /// the grammar every format reads one back by, checked before anything is
    /// written because a name goes where a delimiter would otherwise be.
    /// `"page-break"` and `"x-embed"` are names; `"a b"`, `"a:b"`, `"]{"` and
    /// `"1x"` are not, and each is a *different* wrong document per format
    /// (`::a b` is a paragraph holding an inline directive named `a`,
    /// `::: a:b` is a paragraph of colons). A `label` may not carry a line end
    /// or a square bracket, either of which closes the `[…]` early.
    ///
    /// [`Error::InvalidArgument`] for a name outside that grammar (an empty one
    /// included), such a label, or an `offset` past the source. There is no
    /// [`Error::NotFound`]: an empty document is a fine place for one.
    /// [`Error::UnsupportedFormat`] where the format would not read the printed
    /// bytes back as a container carrying the name, before anything is read —
    /// and for Markdown that is the parse config's answer, so
    /// [`Format::supports`] reports `false` while [`Format::supports_with`]
    /// reports `true`:
    ///
    /// ```no_run
    /// # use twig::{Format, Gesture, MarkdownExtensions};
    /// let exts = MarkdownExtensions { directives: true, ..Default::default() };
    /// assert!(!Format::Markdown.supports(Gesture::InsertDirective));
    /// assert!(Format::Markdown.supports_with(exts, Gesture::InsertDirective));
    /// ```
    ///
    /// The editor must have been created with the same extensions
    /// ([`Editor::new_ext`]) or the call itself refuses.
    pub fn insert_directive(
        &mut self,
        offset: usize,
        name: &str,
        label: Option<&str>,
        attrs: &[(&str, Option<&str>)],
    ) -> Result<Change, Error> {
        let kvs: Vec<ffi::TwigKeyVal> = attrs
            .iter()
            .map(|(k, v)| ffi::TwigKeyVal {
                key: k.as_ptr(),
                key_len: k.len(),
                value: v.map_or(std::ptr::null(), |s| s.as_ptr()),
                value_len: v.map_or(0, |s| s.len()),
            })
            .collect();
        // A null label pointer with a zero length is "no label" across this
        // boundary; a non-null one with a zero length is an empty label. Going
        // through the `Option` rather than through a `&str` is what keeps the
        // two distinct.
        let label_ptr = label.map_or(std::ptr::null(), |s| s.as_ptr());
        let label_len = label.map_or(0, |s| s.len());
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_insert_directive(
                ed,
                offset,
                name.as_ptr(),
                name.len(),
                label_ptr,
                label_len,
                kvs.as_ptr(),
                kvs.len(),
                out,
            )
        })
    }

    /// Replace the attribute set of the block `offset` sits in — a paragraph
    /// or heading, the block [`Editor::set_block`] rewrites — with `attrs`,
    /// the `(key, Some(value))` list [`Builder::set_attrs`] takes. **Replace,
    /// not merge**: read the node's attributes, edit the list, pass it back
    /// whole; an empty list clears them.
    ///
    /// What a key *means* is yours, as a directive's name is: a centred
    /// paragraph is `set_block_attrs(off, &[("class", Some("center"))])` and
    /// twig spells the pair without interpreting either half. The spelling is
    /// the format's — djot's `{…}` line before the block, rewritten in place
    /// with the block's bytes untouched; HTML's tag and AsciiDoc's `[…]` line,
    /// the block re-printed; and in Markdown a `<div …>` around the block,
    /// blank-separated, which every Markdown renderer passes through and
    /// twig's own parser pairs back into a container only under
    /// [`MarkdownExtensions::html_elements`]. A block already the sole child
    /// of such a div has the div's attributes replaced instead, and an empty
    /// list unwraps it.
    ///
    /// An attribute must be one every format reads back: a key that is an
    /// ASCII letter or `_` followed by letters, digits, `-`, `_` and `:`, a
    /// `Some` value (djot has no bare attribute), and no line end or double
    /// quote in it. [`Error::InvalidArgument`] otherwise, or for an `offset`
    /// past the source. [`Error::NotFound`] when no paragraph or heading holds
    /// `offset`. [`Error::NotEditable`] where the spelling cannot be placed: a
    /// djot block starting on a list item's marker line, or whose attributes
    /// came from more than one `{…}` block; a Markdown block inside a list
    /// item. [`Error::UnsupportedFormat`] where the format would not read the
    /// printed attributes back, before anything is read — for Markdown the
    /// parse config's answer, so [`Format::supports`] reports `false` while
    /// [`Format::supports_with`] reports `true`:
    ///
    /// ```no_run
    /// # use twig::{Format, Gesture, MarkdownExtensions};
    /// let exts = MarkdownExtensions { html_elements: true, ..Default::default() };
    /// assert!(!Format::Markdown.supports(Gesture::SetBlockAttrs));
    /// assert!(Format::Markdown.supports_with(exts, Gesture::SetBlockAttrs));
    /// assert!(Format::Djot.supports(Gesture::SetBlockAttrs));
    /// ```
    pub fn set_block_attrs(
        &mut self,
        offset: usize,
        attrs: &[(&str, Option<&str>)],
    ) -> Result<Change, Error> {
        let kvs: Vec<ffi::TwigKeyVal> = attrs
            .iter()
            .map(|(k, v)| ffi::TwigKeyVal {
                key: k.as_ptr(),
                key_len: k.len(),
                value: v.map_or(std::ptr::null(), |s| s.as_ptr()),
                value_len: v.map_or(0, |s| s.len()),
            })
            .collect();
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_set_block_attrs(ed, offset, kvs.as_ptr(), kvs.len(), out)
        })
    }

    /// Replace the attribute set of the element `node` — an id from
    /// [`Editor::nodes`], valid against the **current** tree, so read the tree
    /// again after any successful edit — with `attrs`, the same list
    /// [`Editor::set_block_attrs`] takes; an empty list clears them. Replace,
    /// not merge.
    ///
    /// The node-addressed sibling of [`Editor::set_block_attrs`], for the
    /// caller that holds a tree rather than a caret: a canvas editor over an
    /// SVG names the `<rect>` it is dragging, and no byte offset stands for
    /// it. The run is written on the element's own start tag, at the span
    /// [`Document::attrs_span`] reports, as ` key="value"` pairs with `&`,
    /// `<`, `>` and `"` as entities. Nothing else in the element moves, its
    /// children included — a `<g>` holding a thousand paths is not re-printed
    /// to change its `transform`. An element with no attributes yet has the
    /// run inserted right after its name.
    ///
    /// [`Error::UnsupportedFormat`] where the format keeps a node's attributes
    /// anywhere but on the node's own tag — every format but [`Format::Xml`]
    /// today; [`Format::supports`] with [`Gesture::SetNodeAttrs`] says which.
    /// [`Error::InvalidArgument`] for an id past the tree or an attribute no
    /// format reads back (the rule [`Editor::set_block_attrs`] states);
    /// [`Error::NotEditable`] for a node that is not an element — a text run,
    /// a comment.
    ///
    /// ```no_run
    /// # use twig::{Editor, Format, Kind};
    /// let mut ed = Editor::new_str("<svg><rect x=\"1\"/></svg>", Format::Xml)?;
    /// let rect = ed.nodes()?.into_iter().find(|n| n.name.as_deref() == Some("rect")).unwrap();
    /// ed.set_node_attrs(rect.id, &[("x", Some("10")), ("fill", Some("red"))])?;
    /// assert_eq!(ed.source_str()?, "<svg><rect x=\"10\" fill=\"red\"/></svg>");
    /// # Ok::<(), twig::Error>(())
    /// ```
    pub fn set_node_attrs(
        &mut self,
        node: NodeId,
        attrs: &[(&str, Option<&str>)],
    ) -> Result<Change, Error> {
        let kvs: Vec<ffi::TwigKeyVal> = attrs
            .iter()
            .map(|(k, v)| ffi::TwigKeyVal {
                key: k.as_ptr(),
                key_len: k.len(),
                value: v.map_or(std::ptr::null(), |s| s.as_ptr()),
                value_len: v.map_or(0, |s| s.len()),
            })
            .collect();
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_set_node_attrs(ed, node.0, kvs.as_ptr(), kvs.len(), out)
        })
    }

    /// Wrap `[start, end)` in an anonymous inline container carrying `attrs`
    /// — djot's `[text]{…}`, HTML's and Markdown's `<span …>` — or, when the
    /// range already lies inside such a span, **replace** that span's
    /// attributes rather than nest a second; an empty list there unwraps it,
    /// keeping the content bytes. That is [`Editor::insert_link`]'s rule for
    /// a link covering the range, for the same reason. A span named `span`
    /// and an anonymous one are the same node here; a `:span[…]` the Markdown
    /// parser read as a directive is neither.
    ///
    /// The inline half of [`Editor::set_block_attrs`], with its vocabulary
    /// rule and its attribute grammar ([`Error::InvalidArgument`] for a key or
    /// value no format reads back, or a bad range). The covered inline nodes
    /// are printed under the container by the format's own serializer, so a
    /// mark inside the range rides along. [`Error::NotEditable`] for an empty
    /// range with no span to re-style, or a range cutting a node the gesture
    /// cannot slice. [`Error::UnsupportedFormat`] where the format would not
    /// read the printed span back: AsciiDoc, whose `[#id.role]#text#` keeps
    /// an id and a role and drops any other key, and Markdown without
    /// [`MarkdownExtensions::html_elements`] — ask [`Format::supports_with`].
    pub fn wrap_range_attrs(
        &mut self,
        start: usize,
        end: usize,
        attrs: &[(&str, Option<&str>)],
    ) -> Result<Change, Error> {
        let kvs: Vec<ffi::TwigKeyVal> = attrs
            .iter()
            .map(|(k, v)| ffi::TwigKeyVal {
                key: k.as_ptr(),
                key_len: k.len(),
                value: v.map_or(std::ptr::null(), |s| s.as_ptr()),
                value_len: v.map_or(0, |s| s.len()),
            })
            .collect();
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_wrap_range_attrs(ed, start, end, kvs.as_ptr(), kvs.len(), out)
        })
    }

    /// Link `[start, end)` to `destination` — `[text](destination)`. Djot and
    /// Markdown only, else [`Error::UnsupportedFormat`];
    /// [`Error::InvalidArgument`] for a bad range or a destination containing a
    /// newline (neither format can carry one, and quietly rewriting the URL would
    /// be worse than refusing).
    ///
    /// An existing link covering the range has its destination **replaced** and
    /// its text kept, so re-linking fixes a URL instead of nesting
    /// `[[t](a)](b)`; to unlink, use [`Editor::unwrap_node`].
    ///
    /// A **range inside an existing autolink** (`<https://x.dev>`) re-points it
    /// the same way, but there is no text to keep — an autolink's text *is* its
    /// destination — so the node is replaced whole, respelled canonically for the
    /// new destination. This covers a caret and any selection the autolink
    /// contains, including one covering it exactly: an autolink's URL is not
    /// editable text, so no part of it can host a `[`, and "link half this URL"
    /// has no spelling. A caret inside both an autolink and a link
    /// (`[<https://x.dev>](d)`) re-points the link, whose text is separable from
    /// its destination and so survives.
    ///
    /// A selection starting or ending strictly **inside** an autolink without
    /// being contained by it — running from ordinary text into the middle of a
    /// URL — is refused with [`Error::NotEditable`]: half of it is real text,
    /// so there is nothing to re-point, and any splice would rewrite the URL.
    /// A selection that *contains* an autolink whole is unaffected — it splices
    /// at the edges and wraps as usual.
    ///
    /// A link with **no text** — an empty range, or re-pointing an existing
    /// `[](old)` — is spelled canonically for the destination given, never as
    /// `[](destination)`: a childless link has nothing to render, so consumers
    /// fall back to showing the destination and a caret has nowhere to sit. A
    /// destination the format can autolink (an absolute URL or an email, by that
    /// format's own rules) yields `<destination>`; anything else yields
    /// `[destination](destination)`, the destination doubling as the text so it
    /// stays visible and editable. Which destinations autolink is not the
    /// caller's to guess — `<foo>` is raw HTML in Markdown, a relative path goes
    /// literal in both, and the formats disagree (`<mailto:a@b.dev>` is a url in
    /// Markdown, an email in Djot), so each is asked its own parser.
    ///
    /// The destination is escaped for the format, so a `)` or a space in it
    /// cannot break the markup — and the two formats genuinely differ: Markdown
    /// ends a destination at the first space (`[t](a b)` is not a link at all) so
    /// whitespace moves it into the `<…>` form, while Djot takes spaces literally
    /// and would read `<a b>` as the URL itself.
    pub fn insert_link(
        &mut self,
        start: usize,
        end: usize,
        destination: &str,
    ) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_insert_link(
                ed,
                start,
                end,
                destination.as_ptr(),
                destination.len(),
                out,
            )
        })
    }

    /// Spell `[start, end)` as an image pointing at `destination` —
    /// `![alt](destination)`, the selected source becoming the alt text.
    ///
    /// The destination is escaped exactly as [`insert_link`](Self::insert_link)
    /// escapes one, because it is the same grammar production: Markdown moves a
    /// destination holding whitespace into the `<…>` form, Djot leaves it bare
    /// because `<…>` there would read as the URL itself. That is the reason this
    /// exists rather than being a `format!` at the call site — `![](my file.png)`
    /// is not an image in Markdown at all, and no caller can fix that without
    /// reproducing twig's per-format escape table.
    ///
    /// Two ways it is simpler than a link. An empty range stays empty:
    /// `![](destination)` is a perfectly good image, where the childless
    /// `[](destination)` that `insert_link` works to avoid has nothing to render
    /// or put a caret in. And there is no autolink or re-point reasoning — an
    /// image has no bare-URL spelling, and re-pointing an existing one is a read
    /// of its destination plus an insert, above this op.
    ///
    /// Returns [`Error::InvalidArgument`] for a destination holding a newline and
    /// [`Error::UnsupportedFormat`] for a parse-only format (XML, HTML).
    pub fn insert_image(
        &mut self,
        start: usize,
        end: usize,
        destination: &str,
    ) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_insert_image(
                ed,
                start,
                end,
                destination.as_ptr(),
                destination.len(),
                out,
            )
        })
    }

    /// Insert `text` at `offset` as a literal run: every byte the format reads as
    /// markup is escaped the format's way so the run reparses as exactly `text`
    /// — a typed `*`, `#` or `` ` `` stays that character rather than opening
    /// emphasis, a heading or a code span. This is the inverse of serialization
    /// (which writes an already-parsed run verbatim): it is what a WYSIWYG
    /// surface calls so that keyboard input can never mint markup, leaving
    /// formatting to explicit commands.
    ///
    /// The escaping is positional and per-format, and neither is the caller's to
    /// reproduce. In the backslash formats (Djot, Markdown, AsciiDoc) inline
    /// specials (`*`, `` ` ``, `[`, `<`…, and `$` under Markdown's `math`
    /// extension) are escaped anywhere on the line, while block markers (`#`, `>`, `-`…) are escaped only where `offset` sits
    /// in its line's leading whitespace — so an inserted "5 - 3" keeps its `-`
    /// but "- item" at column zero does not become a bullet — and an embedded
    /// newline in `text` re-enters that line-start zone. Inside a code span,
    /// code block or raw node the run is written as it is, since a backslash
    /// there would show. HTML escapes with entities (`&lt;`, `&amp;`) in every
    /// position.
    ///
    /// Two constructs a byte-alphabet cannot reach are left as typed: a GFM
    /// bare-URL autolink (`https://x.com`, with no delimiter to escape) and an
    /// ordered-list marker (`1.`, special only after a digit run). Returns
    /// [`Error::UnsupportedFormat`] for a parse-only format (XML) and
    /// [`Error::InvalidArgument`] when `offset` is past the source.
    pub fn insert_literal(&mut self, offset: usize, text: &str) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_insert_literal(ed, offset, text.as_ptr(), text.len(), out)
        })
    }

    /// Insert a hard line break *inside a table cell* at `offset`, spelled the
    /// format's way (`<br>` for Markdown). A table row is one source line, so the
    /// ordinary newline-based hard break can't appear there; the spliced `<br>`
    /// reparses as a semantic `hard_break` node — not opaque raw HTML — so the
    /// break reads back as structure. Like the other gestures it leans on the
    /// splice+reparse+rollback backstop: a break that would no longer parse as the
    /// same table yields [`Error::EditConflict`] and changes nothing.
    ///
    /// Returns [`Error::UnsupportedFormat`] for a format with no in-cell break
    /// spelling — djot (no idiomatic in-cell break), HTML and XML (parse-only);
    /// [`Error::NotFound`] when `offset` is not inside a table cell (only the
    /// in-cell gesture is spelled today); and [`Error::InvalidArgument`] when
    /// `offset` is past the source.
    pub fn insert_line_break(&mut self, offset: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_insert_line_break(ed, offset, out) })
    }

    /// Insert a thematic break (a horizontal rule) as its own block, on the line
    /// after the block `offset` sits in. A rule is a block, so there is no
    /// spelling for one mid-paragraph.
    ///
    /// The rule is blank-line separated from its neighbours, and that is
    /// load-bearing rather than cosmetic: Markdown reads `---` on the line
    /// directly under a paragraph as a setext `<h2>` underline, so a rule written
    /// flush against its predecessor silently becomes a heading and swallows it.
    /// The blank below is added only when the next line isn't already blank. The
    /// spelling is the format's (`---` for Markdown, `* * *` for djot) and not
    /// the caller's to reproduce.
    ///
    /// Inside a block quote the rule inherits the quote's prefix and stays in the
    /// quote. Inside a list it lands at column zero after the caret's item, which
    /// splits the list in two with the rule between — a real document, nothing
    /// swallowed. There is no [`Error::NotFound`]: an empty document is a fine
    /// place for a rule. [`Error::UnsupportedFormat`] for a parse-only format
    /// (XML, HTML); [`Error::InvalidArgument`] when `offset` is past the source.
    pub fn insert_thematic_break(&mut self, offset: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_insert_thematic_break(ed, offset, out) })
    }

    /// Split the block at `offset` in two at the caret, both halves the same
    /// kind — Enter in the middle of a paragraph, and the gesture
    /// [`Editor::insert_thematic_break`] deliberately is not. A host wanting
    /// "rule at the caret" calls this and then that.
    ///
    /// Nearly a pure insertion at `offset`: what is minted is the separator
    /// between the halves, and the only bytes removed are the second half's
    /// leading spaces and tabs, which are structure rather than content at the
    /// start of a block — a split at `- b| c` that kept its space would write
    /// `-  c`, setting that item's content indent to three. A code block sheds
    /// nothing, because there leading whitespace *is* the content.
    ///
    /// * A **paragraph** gets a blank line. Inside a quote the blank carries the
    ///   quote's marker and the second half its full prefix, so the split
    ///   happens inside the quote rather than ending it.
    /// * A paragraph in a **list item** gets the item's marker instead of a
    ///   blank, so the second half is a sibling item: `- this is |a list item`
    ///   becomes `- this is ` and `- a list item`. The marker is repeated
    ///   verbatim, ordered numbers included, so a split `1.` item yields two
    ///   `1.` items — both formats renumber on render, and
    ///   [`Editor::renumber_ordered_lists`] is the gesture for fixing the
    ///   source. A **task** item's new half is an unchecked box whatever the
    ///   original's state. A **nested** item's leading indent rides along with
    ///   its marker, so the new sibling stays in its own list rather than
    ///   dropping to column zero and joining the enclosing one.
    /// * A **heading** repeats its own marker at its own level;
    ///   [`Editor::set_block`] is how a caller demotes the second half instead.
    /// * A **code block** becomes two code blocks, the opening fence line
    ///   reproduced verbatim so its width and info string both survive. A
    ///   consumer that doesn't want the gesture offered there can ask the tree
    ///   what block the caret is in before calling.
    ///
    /// At a block boundary this still splits, which is what makes it Enter: at
    /// the end of a list item it opens an empty sibling item, which is the block
    /// the caller wants to type into. A paragraph is the one place that empty
    /// block cannot be spelled — no format has an empty paragraph — so the
    /// source gains a blank line and reparses as one paragraph; the node appears
    /// when there is text to hold.
    ///
    /// [`Error::NotEditable`] where a caret-split has no honest meaning: a
    /// **table** (a newline mid-cell destroys rather than divides; splitting one
    /// table into two is a table gesture, not this one), a **setext heading**
    /// (whose `---` underline would end up under the second half alone —
    /// [`Editor::set_block`] normalises one to ATX, which makes this work), and
    /// an **indented code block** (where a blank line is interior, so the split
    /// would parse back as one block). [`Error::NotFound`] when nothing covers
    /// `offset`; [`Error::InvalidArgument`] when `offset` is past the source.
    pub fn split_block(&mut self, offset: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_split_block(ed, offset, out) })
    }

    /// Join the block at `offset` into the block **before** it — Backspace at
    /// the start of a block, and forward Delete at the end of the one above it.
    /// The inverse of [`Editor::split_block`], and the reason it is a gesture
    /// rather than a host's own delete: what joins two blocks is a fact about
    /// the **format**. Deleting the newline between them is right only for two
    /// Markdown paragraphs at the top level — in HTML that byte is the `>` of
    /// `</p>`, under a heading it leaves two blocks, and after a Markdown
    /// `<div>` it deletes the blank line the div needed and breaks the div.
    ///
    /// **B** is the innermost paragraph/heading covering `offset`. **A** is the
    /// leaf block immediately before it in **document order**, not the sibling
    /// before it: the block visually above `below` in
    /// `above` / `<div>` / `hello` / `</div>` / `below` is `hello`, three
    /// levels down, and joining into `above` would be the wrong paragraph.
    ///
    /// * What is **written** is a line break plus the container prefix A's own
    ///   line sits behind — a quote's `> ` repeated, a list item's marker's
    ///   *width* in spaces, nothing at the top level — which is what keeps the
    ///   joined line inside its containers in a format with no lazy
    ///   continuation. A heading A with a **leading marker** (`# Title`,
    ///   AsciiDoc's `== Title`) is one line by its own spelling, so what joins
    ///   there is a single **space**: `# Title` + `below` is `# Title below`.
    /// * What **travels** is A's own closing markup (an ATX closing `#` run, a
    ///   setext underline, `</p>`) and the closers of every container A is in
    ///   that B is not (a Markdown `</div>`, a djot `:::` fence), carried past
    ///   the text that was pulled in — so the joined block keeps A's
    ///   presentation and stays where it was.
    /// * What is **dropped** is everything between them: the blank line, B's
    ///   markers, B's attribute line (djot's `{…}`, AsciiDoc's `[…]`), B's
    ///   opening tags. B's attributes go on purpose — the joined text is A's
    ///   block, so it takes A's presentation.
    /// * A **prefix** container (a quote, a list item, a list, a section) has
    ///   no closing bytes, so whatever follows B inside one stays where it is:
    ///   joining the first item's text out of a list leaves the rest a list.
    ///
    /// [`Error::NotFound`] when no block covers `offset`, and when B is the
    /// document's first block — the ordinary Backspace-at-the-top answer.
    /// [`Error::NotEditable`] when A is not a paragraph or a heading (a code
    /// block, a table, a rule: there is no text to join into), when either
    /// block is in a **table cell**, when B is a **setext heading** (whose
    /// underline is how it is spelled at all — [`Editor::set_block`] normalises
    /// one to ATX, which makes this work), when B would have to leave a
    /// **delimited** container that still has content after it, which is the
    /// one shape this refuses rather than guesses at, and when the **gap**
    /// between A and B holds anything but separation — an empty container, or
    /// a definition the splice would destroy and no tree walk could see
    /// (Markdown keeps a link reference and a footnote definition as a lookup
    /// table, not as a node).
    /// [`Error::InvalidArgument`] when `offset` is past the source.
    ///
    /// [`Error::UnsupportedFormat`] where a block cannot span lines at all —
    /// and note this is a **different, wider** gate than `split_block`'s. Ask
    /// [`Format::supports`] with [`Gesture::JoinBlocks`].
    pub fn join_blocks(&mut self, offset: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_join_blocks(ed, offset, out) })
    }

    /// Move the block at `from` to the boundary `to` names, spelling the line
    /// prefixes of the container it lands in — a drag-and-drop, or Alt+↑/↓,
    /// in a host that has a caret and no tree.
    ///
    /// [`Editor::move_before`] and [`Editor::move_after`] move a node's
    /// **bytes** and say so: a quote's `> ` does not travel, a list item's
    /// continuation indent is not written. This is the gesture for a drop
    /// that crosses either — a paragraph dragged out of a quote arrives
    /// without its `> `, one dragged under a list item's text arrives behind
    /// the item's indent, and the blank lines a person would have typed are
    /// written and removed. Within one container the result is what
    /// `move_before` writes.
    ///
    /// * `from` names the deepest block owning the line it is on — the
    ///   paragraph or heading [`Editor::set_block`] acts on, or the code
    ///   block, table or rule where there is no text block — **widened to
    ///   the list item** when it is the item's first block: a bullet's text
    ///   is the bullet, and dragging it takes the item and everything under
    ///   it. A block later in an item's tail moves alone.
    /// * `to` is a position **between** blocks: at or before a block's first
    ///   content byte (the block lands before it), at or after its last
    ///   (after it), on a blank line, or the source's length (the document's
    ///   end, terminated or not). The block takes the prefixes of the
    ///   container that boundary is inside — the innermost one, so `to` at
    ///   the first content byte of a quote's first paragraph is inside the
    ///   quote, while `to` at or before the quote's marker is before the
    ///   quote, at its parent's level (`> > a` at 0 is before both quotes,
    ///   at 2 before the inner one, at 4 inside both). A boundary the block
    ///   already sits on is read at the container's level when the block is
    ///   the container's first or last: a quote's last paragraph dropped at
    ///   its own end, or on the blank line after the quote, leaves the
    ///   quote; its first dropped at its own start leaves it upward. Two
    ///   adjustments where a list item is involved, because a list holds
    ///   items and nothing else: a
    ///   boundary before an item's first block is before the **item**, at
    ///   the list's level, while one after an item's last block is inside
    ///   the item — how a block reaches an item's tail (`to` at the end of
    ///   the item's text); and a moved item is always a sibling — dropped
    ///   inside another item it lands after it, and elsewhere it stays a
    ///   bullet (a one-item list between two paragraphs, a quoted bullet in
    ///   a quote). An ordered list is not renumbered;
    ///   [`Editor::renumber_ordered_lists`] is the call for that.
    /// * One splice, so one undo step and one [`Change`]. The block's lines
    ///   go with the separator lines that kept them apart from their old
    ///   neighbours, and a quote or list they were the only content of goes
    ///   too; at the destination they are blank-separated from what they
    ///   land beside (`>` inside a quote), except between items of a tight
    ///   list. A delimited container (a `<div>`, a djot `:::` fence) that is
    ///   emptied stands, since it may carry attributes.
    ///
    /// [`Error::NotFound`] when `from` is on a blank line.
    /// [`Error::NotEditable`] when `to` is interior to a block — inside a
    /// fence, a table, a paragraph's second line — or when the block shares
    /// a line with something else (an HTML `<p>` written beside another).
    /// [`Error::InvalidArgument`] when `to` is inside the block being moved
    /// or at a boundary it already sits on that is no container's edge,
    /// which would move nothing, and when either offset is past the source. [`Error::UnsupportedFormat`]
    /// where the format has no blocks a caret could name (XML); ask
    /// [`Format::supports`] with [`Gesture::MoveBlock`].
    pub fn move_block(&mut self, from: usize, to: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_move_block(ed, from, to, out) })
    }

    /// Toggle a fenced code block over the blocks `[start, end)` covers: fence
    /// them if the caret is not in a code block, unfence the one it is in if it
    /// is. `language` tags the opening fence and is ignored when unfencing.
    ///
    /// `None` and `Some("")` are different requests: both write a bare fence, but
    /// the second says the caller asked for an empty info string. Reading the
    /// language back gives `None` either way — the distinction is in the ask, not
    /// the bytes. (Across the C ABI this rides as the `(ptr, len, has_*)` triple,
    /// the same spelling [`Builder::add_code_block`] uses for the same value.)
    ///
    /// Fencing *inserts* at the covered region's edges rather than rewriting its
    /// lines, so a body already carrying a quote's `> ` keeps it and the fence
    /// lines get the same prefix. The fence is **measured** — one character
    /// longer than the longest run of the fence character in the body — so
    /// fencing text that itself contains a fence nests instead of closing early.
    ///
    /// Unfencing peels the opening line and, when there is one, the closing fence
    /// line; a Markdown *indented* code block has no fence to peel and is
    /// dedented instead, so the toggle stays reversible on the older spelling.
    /// Note that unfencing can yield a different tree than the one that was
    /// fenced: a code body is by definition text the parser did not read as
    /// markup, so `# x` inside a fence becomes a heading once the fence is gone.
    ///
    /// [`Error::NotEditable`] **inside a list item**, in both directions: a
    /// quote's marker is on every line, a list item's is on its first line only,
    /// so a fence at column zero there would pull the `- ` into the code body and
    /// the item would stop being an item. [`Error::InvalidArgument`] for an info
    /// string the fence cannot carry (a line end, the fence character, or — in
    /// Markdown, whose info string ends at whitespace — a space);
    /// [`Error::UnsupportedFormat`] for a parse-only format;
    /// [`Error::NotFound`] when no block covers the range.
    pub fn toggle_code_block(
        &mut self,
        start: usize,
        end: usize,
        language: Option<&str>,
    ) -> Result<Change, Error> {
        let (ptr, len, has) = opt_str(language);
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_toggle_code_block(ed, start, end, ptr, len, has, out)
        })
    }

    /// Retag the code block at `offset` with `language`, or clear its info string
    /// with `None` — the language dropdown beside a code block. Same
    /// `None`/`Some("")` distinction as [`Editor::toggle_code_block`].
    ///
    /// Only the info string is rewritten; the fence's own width is kept, because
    /// it was measured against a body this does not touch. [`Error::NotEditable`]
    /// for an *indented* Markdown code block, which has no fence and so nowhere
    /// to carry a language; [`Error::NotFound`] when `offset` is not in a code
    /// block.
    pub fn set_code_language(
        &mut self,
        offset: usize,
        language: Option<&str>,
    ) -> Result<Change, Error> {
        let (ptr, len, has) = opt_str(language);
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_set_code_language(ed, offset, ptr, len, has, out)
        })
    }

    /// Add a checkbox to the list item at `offset`, or take one away — the
    /// gesture that converts between a plain list item and a task list item. A
    /// box is added unchecked; [`Editor::set_task_checked`] ticks it.
    ///
    /// The box is inline content of the item's first paragraph, not part of its
    /// marker, so adding or removing one leaves the item's continuation-line
    /// indentation alone. An item inside a quote is found past the quote markers.
    /// [`Error::NotFound`] when `offset` is in no list item;
    /// [`Error::NotEditable`] when the item's line carries no recognizable list
    /// marker; [`Error::UnsupportedFormat`] for a format with no checkbox.
    pub fn toggle_task_item(&mut self, offset: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_toggle_task_item(ed, offset, out) })
    }

    /// Tick or untick the task item at `offset` — a checkbox click when the
    /// caller knows which way it should end up.
    ///
    /// Rewrites the box alone, never the space after it, so an item spelled with
    /// unusual spacing keeps it. A capital `[X]` is read as checked.
    ///
    /// When the box is already in the requested state this is a no-op that still
    /// returns `Ok` — the source is left byte-for-byte unchanged. The `Change` is
    /// not returned because a no-op has none; re-read [`Editor::source_str`].
    ///
    /// [`Error::NotEditable`] when the item has no box: minting one here would
    /// make "set checked" silently convert a bullet into a task, which is
    /// [`Editor::toggle_task_item`]'s job to do explicitly.
    pub fn set_task_checked(&mut self, offset: usize, checked: bool) -> Result<(), Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_set_task_checked(ed, offset, checked as c_int, out)
        })?;
        Ok(())
    }

    /// Flip the task item at `offset` — what a checkbox click actually is when
    /// the caller does not already know the state. Always edits or fails, so
    /// unlike [`Editor::set_task_checked`] there is no silent no-op and the
    /// `Change` is always real.
    pub fn toggle_task_checked(&mut self, offset: usize) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe { ffi::twig_editor_toggle_task_checked(ed, offset, out) })
    }

    /// Insert a footnote reference at `offset` and, unless the label is already
    /// defined, the matching definition at the end of the document.
    ///
    /// It writes **both halves**, because in neither format is half a footnote a
    /// footnote: a bare `[^a]` with nothing defining it renders as four literal
    /// characters. The definition body is left empty — that parses, and the
    /// caller then types into it like any other block. A label that is already
    /// defined gets only the reference, so referring to one footnote twice does
    /// not append a second, dead definition.
    ///
    /// It is **one** edit, spanning the caret to the end of the document even
    /// though the halves are far apart: two edits would take two undos to
    /// reverse, and the returned `Change` would describe only the second,
    /// omitting the reference the caret is sitting in.
    ///
    /// [`Error::InvalidArgument`] for a label that is empty or holds a line end
    /// or a reference bracket; [`Error::UnsupportedFormat`] for a format with no
    /// footnotes.
    pub fn insert_footnote(&mut self, offset: usize, label: &str) -> Result<Change, Error> {
        self.change_op(|ed, out| unsafe {
            ffi::twig_editor_insert_footnote(ed, offset, label.as_ptr(), label.len(), out)
        })
    }

    /// Shared plumbing for the change-returning ops: run `op` (which fills a
    /// `TwigChange` out-param) and wrap the result.
    fn change_op(
        &mut self,
        op: impl FnOnce(*mut ffi::TwigEditor, *mut ffi::TwigChange) -> ffi::TwigStatus,
    ) -> Result<Change, Error> {
        let mut change = ffi::TwigChange {
            old_span: ffi::TwigSpan { start: 0, end: 0 },
            new_span: ffi::TwigSpan { start: 0, end: 0 },
        };
        let status = op(self.raw.as_ptr(), &mut change);
        Error::from_status(status)?;
        Ok(Change::from_ffi(change))
    }

    /// Shared plumbing for the `(locator, text)` edit ops.
    fn apply(
        &mut self,
        locator: &str,
        text: &str,
        op: impl FnOnce(*mut ffi::TwigEditor, *const u8, usize, *const u8, usize) -> ffi::TwigStatus,
    ) -> Result<(), Error> {
        let status = op(
            self.raw.as_ptr(),
            locator.as_ptr(),
            locator.len(),
            text.as_ptr(),
            text.len(),
        );
        Error::from_status(status)
    }
}

impl Drop for Editor {
    fn drop(&mut self) {
        unsafe { ffi::twig_editor_destroy(self.raw.as_ptr()) }
    }
}

/// Run `call` (which writes a borrowed `(ptr, len)` byte buffer) and copy the
/// result into an owned `Vec` — the buffer is only valid until the next
/// same-accessor call on the handle, so we copy before returning. Shared by
/// [`Document`] and [`Editor`].
fn collect_bytes(
    call: impl FnOnce(*mut *const u8, *mut usize) -> ffi::TwigStatus,
) -> Result<Vec<u8>, Error> {
    let mut ptr = std::ptr::null();
    let mut len = 0usize;
    let status = call(&mut ptr, &mut len);
    Error::from_status(status)?;
    if len == 0 {
        return Ok(Vec::new());
    }
    if ptr.is_null() {
        return Err(Error::Internal);
    }
    let bytes = unsafe { std::slice::from_raw_parts(ptr, len) };
    Ok(bytes.to_vec())
}

/// Run `call` (which writes a borrowed `(ptr, len)` match array) and copy each
/// match into an owned [`QueryMatch`]. Shared by [`Document`] and [`Editor`].
fn collect_matches(
    call: impl FnOnce(*mut *const ffi::TwigQueryMatch, *mut usize) -> ffi::TwigStatus,
) -> Result<Vec<QueryMatch>, Error> {
    let mut ptr = std::ptr::null();
    let mut len = 0usize;
    let status = call(&mut ptr, &mut len);
    Error::from_status(status)?;
    if len == 0 {
        return Ok(Vec::new());
    }
    if ptr.is_null() {
        return Err(Error::Internal);
    }
    let matches = unsafe { std::slice::from_raw_parts(ptr, len) };
    matches.iter().map(query_match_from_ffi).collect()
}

/// `collect_matches` for the flat-node reads (`nodes` / `subtree`), which hand
/// back a borrowed [`ffi::TwigFlatNode`] array on the same contract.
fn collect_flat_nodes(
    call: impl FnOnce(*mut *const ffi::TwigFlatNode, *mut usize) -> ffi::TwigStatus,
) -> Result<Vec<FlatNode>, Error> {
    let mut ptr = std::ptr::null();
    let mut len = 0usize;
    let status = call(&mut ptr, &mut len);
    Error::from_status(status)?;
    if len == 0 {
        return Ok(Vec::new());
    }
    if ptr.is_null() {
        return Err(Error::Internal);
    }
    let nodes = unsafe { std::slice::from_raw_parts(ptr, len) };
    nodes.iter().map(flat_node_from_ffi).collect()
}

/// The zeroed out-parameter the `node_at` hit-tests fill.
fn empty_ffi_match() -> ffi::TwigQueryMatch {
    ffi::TwigQueryMatch {
        node_id: 0,
        span: ffi::TwigSpan { start: 0, end: 0 },
        content_span: ffi::TwigSpan { start: 0, end: 0 },
        has_content_span: 0,
        kind: std::ptr::null(),
    }
}

/// Copy a borrowed C ABI [`ffi::TwigQueryMatch`] into an owned [`QueryMatch`].
/// Shared by `collect_matches`, [`Editor::node_at`], and [`Editor::ancestors_at`].
fn query_match_from_ffi(m: &ffi::TwigQueryMatch) -> Result<QueryMatch, Error> {
    Ok(QueryMatch {
        node_id: m.node_id,
        span: m.span.start..m.span.end,
        content_span: if m.has_content_span != 0 {
            Some(m.content_span.start..m.content_span.end)
        } else {
            None
        },
        kind: Kind::from(borrowed_cstr(m.kind)?.as_str()),
    })
}

/// Copy a borrowed C ABI [`ffi::TwigFlatNode`] into an owned [`FlatNode`].
fn flat_node_from_ffi(n: &ffi::TwigFlatNode) -> Result<FlatNode, Error> {
    let node_id = |v: u32| {
        if v == ffi::TWIG_NO_NODE {
            None
        } else {
            Some(NodeId(v))
        }
    };
    Ok(FlatNode {
        id: NodeId(n.id),
        parent: node_id(n.parent),
        first_child: node_id(n.first_child),
        next_sibling: node_id(n.next_sibling),
        span: n.span.start..n.span.end,
        content_span: if n.has_content_span != 0 {
            Some(n.content_span.start..n.content_span.end)
        } else {
            None
        },
        level: if n.level != 0 { Some(n.level) } else { None },
        kind: Kind::from(borrowed_cstr(n.kind)?.as_str()),
        text: borrowed_bytes(n.text_ptr, n.text_len),
        destination: borrowed_bytes(n.destination_ptr, n.destination_len),
        head: match n.head {
            ffi::TWIG_HEAD_NONE => None,
            v => Some(v != 0),
        },
        alignment: Alignment::from_c(n.alignment),
        name: borrowed_bytes(n.name_ptr, n.name_len),
        directive_form: DirectiveForm::from_c(n.directive_form),
        origin: ContainerOrigin::from_c(n.container_origin),
        marker_span: if n.has_marker_span != 0 {
            Some(n.marker_span.start..n.marker_span.end)
        } else {
            None
        },
        checked: match n.checked {
            ffi::TWIG_TASK_CHECKED_NONE => None,
            v => Some(v != 0),
        },
        attrs: borrowed_attrs(n.attrs_ptr, n.attrs_len),
    })
}

/// Copy a borrowed `TwigKeyVal` array into owned `(key, value)` pairs, or an
/// empty vec for a NULL pointer (the node has no attributes). A bare attribute
/// (NULL `value`) maps to a `None` value, distinct from a present-but-empty one.
fn borrowed_attrs(ptr: *const ffi::TwigKeyVal, len: usize) -> Vec<(String, Option<String>)> {
    if ptr.is_null() || len == 0 {
        return Vec::new();
    }
    let kvs = unsafe { std::slice::from_raw_parts(ptr, len) };
    kvs.iter()
        .map(|kv| {
            let key = borrowed_bytes(kv.key, kv.key_len).unwrap_or_default();
            (key, borrowed_bytes(kv.value, kv.value_len))
        })
        .collect()
}

/// Copy a NUL-terminated, library-owned C string into an owned `String`.
fn borrowed_cstr(ptr: *const c_char) -> Result<String, Error> {
    if ptr.is_null() {
        return Err(Error::Internal);
    }
    Ok(unsafe { std::ffi::CStr::from_ptr(ptr) }
        .to_str()
        .map_err(|_| Error::Internal)?
        .to_owned())
}

/// Copy a borrowed `(ptr, len)` payload slice into an owned `String`, or `None`
/// for a NULL pointer (the kind carries no such payload). The bytes are a slice
/// of a UTF-8 document, so a lossy decode never actually substitutes.
fn borrowed_bytes(ptr: *const u8, len: usize) -> Option<String> {
    if ptr.is_null() {
        return None;
    }
    let bytes = unsafe { std::slice::from_raw_parts(ptr, len) };
    Some(String::from_utf8_lossy(bytes).into_owned())
}

/// The id of a node added to a [`Builder`], returned by every `add*` method and
/// used to wire up the tree via [`Builder::set_children`] and to root a
/// render/serialize/query.
#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
pub struct NodeId(pub u32);

/// The void-payload node kinds, addable via [`Builder::add`]. Kinds with a
/// payload have their own dedicated `add_*` method instead.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum VoidKind {
    Doc,
    Para,
    ThematicBreak,
    Section,
    Div,
    BlockQuote,
    DefinitionList,
    Table,
    ListItem,
    DefinitionListItem,
    Term,
    Definition,
    Caption,
    SoftBreak,
    HardBreak,
    NonBreakingSpace,
    Emph,
    Strong,
    Span,
    Mark,
    Superscript,
    Subscript,
    Insert,
    Delete,
    DoubleQuoted,
    SingleQuoted,
}

impl VoidKind {
    fn to_c(self) -> c_int {
        // Discriminants match `TwigNodeKind` in the C ABI.
        match self {
            VoidKind::Doc => 0,
            VoidKind::Para => 1,
            VoidKind::ThematicBreak => 3,
            VoidKind::Section => 4,
            VoidKind::Div => 5,
            VoidKind::BlockQuote => 9,
            VoidKind::DefinitionList => 13,
            VoidKind::Table => 14,
            VoidKind::ListItem => 15,
            VoidKind::DefinitionListItem => 17,
            VoidKind::Term => 18,
            VoidKind::Definition => 19,
            VoidKind::Caption => 22,
            VoidKind::SoftBreak => 26,
            VoidKind::HardBreak => 27,
            VoidKind::NonBreakingSpace => 28,
            VoidKind::Emph => 38,
            VoidKind::Strong => 39,
            VoidKind::Span => 42,
            VoidKind::Mark => 43,
            VoidKind::Superscript => 44,
            VoidKind::Subscript => 45,
            VoidKind::Insert => 46,
            VoidKind::Delete => 47,
            VoidKind::DoubleQuoted => 48,
            VoidKind::SingleQuoted => 49,
        }
    }
}

/// The single-string-payload node kinds, addable via [`Builder::add_text`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum TextKind {
    Str,
    Symb,
    Verbatim,
    InlineMath,
    DisplayMath,
    Url,
    Email,
    FootnoteReference,
    /// reStructuredText's `[CIT2002]_` — a use of a citation definition. The
    /// payload is the label as WRITTEN, not the normalized name it resolves by.
    CitationReference,
    /// reStructuredText's `|name|` — a use of a substitution definition.
    SubstitutionReference,
    Comment,
    Doctype,
    Cdata,
}

impl TextKind {
    fn to_c(self) -> c_int {
        match self {
            TextKind::Str => 25,
            TextKind::Symb => 29,
            TextKind::Verbatim => 30,
            TextKind::InlineMath => 32,
            TextKind::DisplayMath => 33,
            TextKind::Url => 34,
            TextKind::Email => 35,
            TextKind::FootnoteReference => 36,
            TextKind::CitationReference => 58,
            TextKind::SubstitutionReference => 59,
            TextKind::Comment => 52,
            TextKind::Doctype => 53,
            TextKind::Cdata => 55,
        }
    }
}

/// Bullet marker style for [`Builder::add_bullet_list`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum BulletStyle {
    Dash,
    Plus,
    Star,
}

impl BulletStyle {
    fn to_c(self) -> c_int {
        match self {
            BulletStyle::Dash => 0,
            BulletStyle::Plus => 1,
            BulletStyle::Star => 2,
        }
    }
}

/// Numbering scheme for [`Builder::add_ordered_list`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum OrderedNumbering {
    Decimal,
    LowerAlpha,
    UpperAlpha,
    LowerRoman,
    UpperRoman,
}

impl OrderedNumbering {
    fn to_c(self) -> c_int {
        match self {
            OrderedNumbering::Decimal => 0,
            OrderedNumbering::LowerAlpha => 1,
            OrderedNumbering::UpperAlpha => 2,
            OrderedNumbering::LowerRoman => 3,
            OrderedNumbering::UpperRoman => 4,
        }
    }
}

/// Delimiter around an ordered-list number (`1.`, `1)`, `(1)`).
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum OrderedDelim {
    Period,
    ParenAfter,
    ParenBoth,
}

impl OrderedDelim {
    fn to_c(self) -> c_int {
        match self {
            OrderedDelim::Period => 0,
            OrderedDelim::ParenAfter => 1,
            OrderedDelim::ParenBoth => 2,
        }
    }
}

/// Table-cell alignment: written via [`Builder::add_cell`], read back on
/// [`FlatNode::alignment`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum Alignment {
    Default,
    Left,
    Right,
    Center,
}

impl Alignment {
    fn to_c(self) -> c_int {
        match self {
            Alignment::Default => ffi::TWIG_ALIGN_DEFAULT,
            Alignment::Left => ffi::TWIG_ALIGN_LEFT,
            Alignment::Right => ffi::TWIG_ALIGN_RIGHT,
            Alignment::Center => ffi::TWIG_ALIGN_CENTER,
        }
    }

    /// The inverse of [`Alignment::to_c`]; `None` for [`ffi::TWIG_ALIGN_NONE`]
    /// (the node isn't a cell) or any code this binding doesn't know.
    fn from_c(v: c_int) -> Option<Self> {
        match v {
            ffi::TWIG_ALIGN_DEFAULT => Some(Alignment::Default),
            ffi::TWIG_ALIGN_LEFT => Some(Alignment::Left),
            ffi::TWIG_ALIGN_RIGHT => Some(Alignment::Right),
            ffi::TWIG_ALIGN_CENTER => Some(Alignment::Center),
            _ => None,
        }
    }
}

/// The smart-punctuation kind for [`Builder::add_smart_punctuation`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum SmartPunctuation {
    LeftSingleQuote,
    RightSingleQuote,
    LeftDoubleQuote,
    RightDoubleQuote,
    Ellipses,
    EmDash,
    EnDash,
}

impl SmartPunctuation {
    fn to_c(self) -> c_int {
        match self {
            SmartPunctuation::LeftSingleQuote => 0,
            SmartPunctuation::RightSingleQuote => 1,
            SmartPunctuation::LeftDoubleQuote => 2,
            SmartPunctuation::RightDoubleQuote => 3,
            SmartPunctuation::Ellipses => 4,
            SmartPunctuation::EmDash => 5,
            SmartPunctuation::EnDash => 6,
        }
    }
}

/// Whether a generic container was written as a TAG or as a DIRECTIVE — the
/// axis [`DirectiveForm`] is repeatedly mistaken for and cannot answer.
///
/// `DirectiveForm` is a spelling hint: which of a directive-capable format's
/// three spellings fits this node. Twig's HTML parser sets one on `<div>` and
/// `<span>` because those are the two tags djot and Markdown have generic
/// spellings for — so a `<div>` and a Markdown `:::div` produce nodes that
/// agree on kind, name and form alike. Until this axis existed, the only way
/// to separate them was to re-read the source bytes under the node's span and
/// look at the first character.
///
/// Read-only: it records what a parser saw, and there is nothing to set on the
/// build path.
/// One thing a conversion would silently lose. See [`Document::diagnostics`].
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct Warning {
    pub fidelity: Fidelity,
    /// A slash-separated child-index trail from the document root (`"1/0/2"`),
    /// EMPTY for the root itself.
    ///
    /// A path and not a byte span, because the output being described does not
    /// exist yet — there is nothing in it to point at. Resolve it against the
    /// tree you already have.
    pub path: String,
    /// The affected node's kind, with family members reported as themselves
    /// ([`Kind::Superscript`], not an `inline_mark`).
    pub kind: Kind,
}

/// How much of a node survives a conversion.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum Fidelity {
    /// Something is emitted, but the target's parser reads it back as a
    /// DIFFERENT kind. The content survives; its meaning does not.
    Degraded,
    /// Nothing is emitted at all: the node and its subtree leave no trace.
    Dropped,
    /// Some of the node's **attributes** are written where the target's
    /// parser does not read them back as that node's — djot spells a
    /// heading's on its text, AsciiDoc moves a section title's onto the
    /// section. Independent of the node's own answer: a node that degrades
    /// and still has its attributes written — Markdown's `<div lang=…>` for
    /// a section it cannot spell — is reported twice at the same path,
    /// [`Degraded`](Fidelity::Degraded) and then this. Which keys is not carried across the C boundary: the node at
    /// [`Warning::path`] has them, and a consumer that wants the list reads
    /// them from the tree.
    AttrsDegraded,
    /// Some of the node's attributes are not written at all. Never reported
    /// beside [`Dropped`](Fidelity::Dropped): nothing of a dropped node is
    /// written, so that one variant is the whole answer.
    AttrsDropped,
}

impl Fidelity {
    /// Only the lossy codes have a variant — a faithful node is never reported
    /// as a warning, so there is nothing for it to map to. An unknown code
    /// reads as [`Fidelity::Degraded`], the weakest of the claims.
    fn from_c(v: c_int) -> Self {
        match v {
            ffi::TWIG_FIDELITY_DROPPED => Fidelity::Dropped,
            ffi::TWIG_FIDELITY_ATTRS_DEGRADED => Fidelity::AttrsDegraded,
            ffi::TWIG_FIDELITY_ATTRS_DROPPED => Fidelity::AttrsDropped,
            _ => Fidelity::Degraded,
        }
    }
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum ContainerOrigin {
    /// An HTML or XML tag: `<div>`, `<video>`, `<svg:rect>`.
    Element,
    /// A lightweight-markup generic container: a djot fenced div or bracketed
    /// span, a Markdown `:::note` / `::name` / `:name`, an rST `.. note::`, an
    /// AsciiDoc delimited block.
    Directive,
}

impl ContainerOrigin {
    /// `None` for [`ffi::TWIG_CONTAINER_ORIGIN_NONE`] (nothing recorded an
    /// origin) or any code this binding doesn't know.
    fn from_c(v: c_int) -> Option<Self> {
        match v {
            ffi::TWIG_CONTAINER_ORIGIN_ELEMENT => Some(ContainerOrigin::Element),
            ffi::TWIG_CONTAINER_ORIGIN_DIRECTIVE => Some(ContainerOrigin::Directive),
            _ => None,
        }
    }
}

/// The surface form of a generic directive for [`Builder::add_directive`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum DirectiveForm {
    Text,
    Leaf,
    Container,
}

impl DirectiveForm {
    fn to_c(self) -> c_int {
        match self {
            DirectiveForm::Text => ffi::TWIG_DIRECTIVE_TEXT,
            DirectiveForm::Leaf => ffi::TWIG_DIRECTIVE_LEAF,
            DirectiveForm::Container => ffi::TWIG_DIRECTIVE_CONTAINER,
        }
    }

    /// The inverse of [`DirectiveForm::to_c`]; `None` for
    /// [`ffi::TWIG_DIRECTIVE_NONE`] (the node isn't a directive) or any code
    /// this binding doesn't know.
    fn from_c(v: c_int) -> Option<Self> {
        match v {
            ffi::TWIG_DIRECTIVE_TEXT => Some(DirectiveForm::Text),
            ffi::TWIG_DIRECTIVE_LEAF => Some(DirectiveForm::Leaf),
            ffi::TWIG_DIRECTIVE_CONTAINER => Some(DirectiveForm::Container),
            _ => None,
        }
    }
}

/// Decompose an optional string into `(ptr, len, has)` for the C ABI's
/// `(ptr, len, has_*)` optional-string triples. The pointer borrows `s` and is
/// only used within the same call.
fn opt_str(s: Option<&str>) -> (*const u8, usize, c_int) {
    match s {
        Some(x) => (x.as_ptr(), x.len(), 1),
        None => (std::ptr::null(), 0, 0),
    }
}

/// Programmatic construction of a document — the write-path mirror of
/// [`Document::parse`]. Build the tree bottom-up (add children, then the
/// container, wiring them with [`Builder::set_children`]); every `add*` method
/// returns the new node's [`NodeId`]. Then render, serialize, query, or dump the
/// subtree rooted at any id, on demand, without consuming the builder. All input
/// strings are copied, so caller buffers need not outlive a call.
#[derive(Debug)]
pub struct Builder {
    raw: NonNull<ffi::TwigBuilder>,
}

impl Builder {
    /// Create an empty builder.
    pub fn new() -> Result<Self, Error> {
        let mut raw = std::ptr::null_mut();
        let status = unsafe { ffi::twig_builder_create(&mut raw) };
        Error::from_status(status)?;
        let raw = NonNull::new(raw).ok_or(Error::Internal)?;
        Ok(Self { raw })
    }

    /// Add a void-payload node (attach children later with
    /// [`Builder::set_children`]).
    pub fn add(&mut self, kind: VoidKind) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe { ffi::twig_builder_add(b, kind.to_c(), out) })
    }

    /// Add a single-string-payload node (a `str`, code span, url, comment, …).
    pub fn add_text(&mut self, kind: TextKind, text: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_text(b, kind.to_c(), text.as_ptr(), text.len(), out)
        })
    }

    /// Add a heading of the given level (attach its inline children afterward).
    pub fn add_heading(&mut self, level: u32) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe { ffi::twig_builder_add_heading(b, level, out) })
    }

    /// Add a code block, with an optional info-string language.
    pub fn add_code_block(&mut self, lang: Option<&str>, text: &str) -> Result<NodeId, Error> {
        let (lp, ll, has) = opt_str(lang);
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_code_block(b, lp, ll, has, text.as_ptr(), text.len(), out)
        })
    }

    /// Add a raw block targeting `format` (e.g. `"html"`).
    pub fn add_raw_block(&mut self, format: &str, text: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_raw_block(
                b,
                format.as_ptr(),
                format.len(),
                text.as_ptr(),
                text.len(),
                out,
            )
        })
    }

    /// Add a document-metadata block written in config language `lang`.
    pub fn add_metadata(&mut self, lang: &str, text: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_metadata(
                b,
                lang.as_ptr(),
                lang.len(),
                text.as_ptr(),
                text.len(),
                out,
            )
        })
    }

    /// Add a raw inline targeting `format`.
    pub fn add_raw_inline(&mut self, format: &str, text: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_raw_inline(
                b,
                format.as_ptr(),
                format.len(),
                text.as_ptr(),
                text.len(),
                out,
            )
        })
    }

    /// Add a smart-punctuation node of `kind`. `text` is accepted for ABI
    /// compatibility but ignored by the underlying builder: the node's
    /// spelling is always the canonical one for `kind` (e.g. `"---"` for an
    /// em dash), never a caller-supplied one.
    pub fn add_smart_punctuation(
        &mut self,
        kind: SmartPunctuation,
        text: &str,
    ) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_smart_punctuation(b, kind.to_c(), text.as_ptr(), text.len(), out)
        })
    }

    /// Add a link with an optional destination and/or reference label (attach
    /// the link text as children).
    pub fn add_link(
        &mut self,
        destination: Option<&str>,
        reference: Option<&str>,
    ) -> Result<NodeId, Error> {
        let (dp, dl, hd) = opt_str(destination);
        let (rp, rl, hr) = opt_str(reference);
        self.emit(|b, out| unsafe { ffi::twig_builder_add_link(b, dp, dl, hd, rp, rl, hr, out) })
    }

    /// Add an image — like [`Builder::add_link`], but children are the alt text.
    pub fn add_image(
        &mut self,
        destination: Option<&str>,
        reference: Option<&str>,
    ) -> Result<NodeId, Error> {
        let (dp, dl, hd) = opt_str(destination);
        let (rp, rl, hr) = opt_str(reference);
        self.emit(|b, out| unsafe { ffi::twig_builder_add_image(b, dp, dl, hd, rp, rl, hr, out) })
    }

    /// Add a generic directive of the given form and name.
    pub fn add_directive(&mut self, form: DirectiveForm, name: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_directive(b, form.to_c(), name.as_ptr(), name.len(), out)
        })
    }

    /// Add a generic named element (the escape hatch for HTML/XML tags).
    pub fn add_element(&mut self, name: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_element(b, name.as_ptr(), name.len(), out)
        })
    }

    /// Add an XML processing instruction (`<?target data?>`).
    pub fn add_processing_instruction(
        &mut self,
        target: &str,
        data: &str,
    ) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_processing_instruction(
                b,
                target.as_ptr(),
                target.len(),
                data.as_ptr(),
                data.len(),
                out,
            )
        })
    }

    /// Add a footnote definition with the given label.
    pub fn add_footnote(&mut self, label: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_footnote(b, label.as_ptr(), label.len(), out)
        })
    }

    /// Add a citation definition — reStructuredText's `.. [CIT2002] ...`. Holds
    /// blocks, like a footnote; the two differ in which name registry resolves
    /// them, which is why this is its own call and not a flag on
    /// [`Builder::add_footnote`].
    pub fn add_citation(&mut self, label: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_citation(b, label.as_ptr(), label.len(), out)
        })
    }

    /// Add a substitution definition — reStructuredText's
    /// `.. |name| image:: p.png`. Unlike a footnote or citation, its children
    /// are INLINE nodes.
    pub fn add_substitution(&mut self, label: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_substitution(b, label.as_ptr(), label.len(), out)
        })
    }

    /// Add a link/image reference definition (`label` → `destination`).
    pub fn add_reference(&mut self, label: &str, destination: &str) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_reference(
                b,
                label.as_ptr(),
                label.len(),
                destination.as_ptr(),
                destination.len(),
                out,
            )
        })
    }

    /// Add a bullet list.
    pub fn add_bullet_list(&mut self, style: BulletStyle, tight: bool) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_bullet_list(b, style.to_c(), tight as c_int, out)
        })
    }

    /// Add an ordered list, with an optional explicit start number.
    pub fn add_ordered_list(
        &mut self,
        numbering: OrderedNumbering,
        delim: OrderedDelim,
        tight: bool,
        start: Option<u32>,
    ) -> Result<NodeId, Error> {
        let (start_val, has_start) = match start {
            Some(s) => (s, 1),
            None => (0, 0),
        };
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_ordered_list(
                b,
                numbering.to_c(),
                delim.to_c(),
                tight as c_int,
                start_val,
                has_start,
                out,
            )
        })
    }

    /// Add a task list.
    pub fn add_task_list(&mut self, tight: bool) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe { ffi::twig_builder_add_task_list(b, tight as c_int, out) })
    }

    /// Add a task-list item with the given checkbox state.
    pub fn add_task_list_item(&mut self, checked: bool) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_task_list_item(b, checked as c_int, out)
        })
    }

    /// Add a table row (`head` marks a header row).
    pub fn add_row(&mut self, head: bool) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe { ffi::twig_builder_add_row(b, head as c_int, out) })
    }

    /// Add a one-square table cell (`head` marks a header cell).
    pub fn add_cell(&mut self, head: bool, alignment: Alignment) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_cell(b, head as c_int, alignment.to_c(), out)
        })
    }

    /// Add a table cell occupying `colspan` columns and `rowspan` rows — a grid
    /// table's merged cell. Both must be at least 1
    /// ([`Error::InvalidArgument`] otherwise); `(1, 1)` is exactly
    /// [`Builder::add_cell`]. Read back with [`Document::cell_extent`].
    pub fn add_cell_spanning(
        &mut self,
        head: bool,
        alignment: Alignment,
        colspan: u32,
        rowspan: u32,
    ) -> Result<NodeId, Error> {
        self.emit(|b, out| unsafe {
            ffi::twig_builder_add_cell_spanning(
                b,
                head as c_int,
                alignment.to_c(),
                colspan,
                rowspan,
                out,
            )
        })
    }

    /// Set `parent`'s children to `children` (in order), replacing any it had.
    /// Each child id should appear in exactly one `set_children` call.
    pub fn set_children(&mut self, parent: NodeId, children: &[NodeId]) -> Result<(), Error> {
        let ids: Vec<u32> = children.iter().map(|n| n.0).collect();
        let status = unsafe {
            ffi::twig_builder_set_children(self.raw.as_ptr(), parent.0, ids.as_ptr(), ids.len())
        };
        Error::from_status(status)
    }

    /// Attach `{...}` attributes to `id` (`(key, Some(value))`, or
    /// `(key, None)` for a bare attribute), replacing any it had. An empty slice
    /// clears them.
    pub fn set_attrs(&mut self, id: NodeId, attrs: &[(&str, Option<&str>)]) -> Result<(), Error> {
        let kvs: Vec<ffi::TwigKeyVal> = attrs
            .iter()
            .map(|(k, v)| ffi::TwigKeyVal {
                key: k.as_ptr(),
                key_len: k.len(),
                value: v.map_or(std::ptr::null(), |s| s.as_ptr()),
                value_len: v.map_or(0, |s| s.len()),
            })
            .collect();
        let status = unsafe {
            ffi::twig_builder_set_attrs(self.raw.as_ptr(), id.0, kvs.as_ptr(), kvs.len())
        };
        Error::from_status(status)
    }

    /// Render the subtree rooted at `root` to HTML (generic whole-vocabulary
    /// printer — a built tree has no djot/Markdown side tables).
    pub fn render_html(&mut self, root: NodeId) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_builder_render_html(raw, root.0, ptr, len) })
    }

    /// Serialize the subtree rooted at `root` to `target`'s syntax. Returns
    /// [`Error::UnsupportedFormat`] when the target can't represent the built
    /// tree (e.g. semantic kinds into XML).
    ///
    /// Prefer this over [`Builder::serialize`], for the reason
    /// [`Document::serialize_to`] gives.
    pub fn serialize_to(&mut self, root: NodeId, target: Target) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        let ffi_target: ffi::TwigFormat = target.into();
        collect_bytes(|ptr, len| unsafe {
            ffi::twig_builder_serialize(raw, root.0, ffi_target as i32, ptr, len)
        })
    }

    /// Serialize the subtree rooted at `root` to `format`'s source syntax.
    ///
    /// The original spelling of [`Builder::serialize_to`], kept for
    /// compatibility and defined in terms of it.
    pub fn serialize(&mut self, root: NodeId, format: Format) -> Result<Vec<u8>, Error> {
        self.serialize_to(root, format.into())
    }

    /// Encode the subtree rooted at `root` as pretty-printed JSON.
    pub fn ast_json(&mut self, root: NodeId) -> Result<Vec<u8>, Error> {
        let raw = self.raw.as_ptr();
        collect_bytes(|ptr, len| unsafe { ffi::twig_builder_ast_json(raw, root.0, ptr, len) })
    }

    /// Resolve a selector against the subtree rooted at `root` (same grammar as
    /// [`Document::query`]).
    pub fn query(&mut self, root: NodeId, selector: &str) -> Result<Vec<QueryMatch>, Error> {
        let raw = self.raw.as_ptr();
        collect_matches(|ptr, len| unsafe {
            ffi::twig_builder_query(raw, root.0, selector.as_ptr(), selector.len(), ptr, len)
        })
    }

    /// Shared plumbing for the `add*` constructors: run `call` (which writes the
    /// new node's id) and wrap the result.
    fn emit(
        &mut self,
        call: impl FnOnce(*mut ffi::TwigBuilder, *mut u32) -> ffi::TwigStatus,
    ) -> Result<NodeId, Error> {
        let mut id: u32 = 0;
        let status = call(self.raw.as_ptr(), &mut id);
        Error::from_status(status)?;
        Ok(NodeId(id))
    }
}

impl Drop for Builder {
    fn drop(&mut self) {
        unsafe { ffi::twig_builder_destroy(self.raw.as_ptr()) }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn abi_version_matches() {
        // The linked library must speak the exact ABI layout this crate's
        // `#[repr(C)]` mirrors assume. If this fails, the Zig `TWIG_ABI_VERSION`
        // was bumped without updating `ffi::TWIG_ABI_VERSION` (and the mirrors).
        assert_eq!(abi_version(), ffi::TWIG_ABI_VERSION);
    }

    #[test]
    fn parses_and_renders_markdown_html() {
        let mut doc = Document::parse_str("# hi\n", Format::Markdown).expect("parse markdown");
        let html = doc.render_html().expect("render html");
        assert_eq!(String::from_utf8_lossy(&html), "<h1>hi</h1>\n");
    }

    #[test]
    fn parses_html_input() {
        let mut doc = Document::parse_str("<p>hi</p>", Format::Html).expect("parse html");
        let html = doc.render_html().expect("render html");
        assert!(String::from_utf8_lossy(&html).contains("hi"));
    }

    #[test]
    fn parses_renders_and_writes_asciidoc() {
        let mut doc = Document::parse_str("= Title\n\nsome *bold* text\n", Format::Asciidoc)
            .expect("parse asciidoc");
        let html = String::from_utf8_lossy(&doc.render_html().expect("render html")).into_owned();
        assert!(html.contains("<h1>Title</h1>"), "got {html:?}");
        assert!(html.contains("<strong>bold</strong>"), "got {html:?}");

        // Round-trip, and a cross-format conversion from Markdown.
        let back = doc.serialize_to(Target::Asciidoc).expect("serialize asciidoc");
        assert_eq!(String::from_utf8_lossy(&back), "= Title\n\nsome *bold* text\n");
        let mut md = Document::parse_str("# Title\n\nsome **bold** text\n", Format::Markdown)
            .expect("parse markdown");
        let converted = md.serialize_to(Target::Asciidoc).expect("convert to asciidoc");
        assert_eq!(String::from_utf8_lossy(&converted), "= Title\n\nsome *bold* text\n");
        assert_eq!(Target::from(Format::Asciidoc), Target::Asciidoc);
        assert_eq!(Target::Asciidoc.as_format(), Some(Format::Asciidoc));
    }

    #[test]
    fn markdown_dialects_are_formats_over_one_parser() {
        // Three formats, one parser: strict CommonMark reads `~~x~~` as text
        // and a pipe table as a paragraph; GFM and the default read both; an
        // extension laid over GFM adds what GFM proper leaves out.
        let src = "a ~~b~~ c\n\n| x |\n| - |\n| $m$ |\n";
        let count = |doc: &mut Document, sel: &str| doc.query(sel).expect("query").len();
        for (format, ext, delete, table, math) in [
            (Format::Commonmark, MarkdownExtensions::default(), 0, 0, 0),
            (Format::Markdown, MarkdownExtensions::default(), 1, 1, 0),
            (Format::Gfm, MarkdownExtensions::default(), 1, 1, 0),
            (Format::Gfm, MarkdownExtensions { math: true, ..Default::default() }, 1, 1, 1),
        ] {
            let mut doc = Document::parse_str_with(src, format, ext).expect("parse");
            assert_eq!(count(&mut doc, "delete"), delete, "{format:?} {ext:?}");
            assert_eq!(count(&mut doc, "table"), table, "{format:?} {ext:?}");
            assert_eq!(count(&mut doc, "inline_math"), math, "{format:?} {ext:?}");
        }

        // A dialect writes as its language, and a GFM document serialized as
        // Markdown is a round trip, spelling intact.
        assert_eq!(Format::Gfm.dialect_of(), Some(Format::Markdown));
        assert_eq!(Format::Commonmark.dialect_of(), Some(Format::Markdown));
        assert_eq!(Format::Markdown.dialect_of(), None);
        // And xml's one dialect, which writes as xml and takes xml's gesture.
        assert_eq!(Format::Svg.dialect_of(), Some(Format::Xml));
        assert_eq!(Target::from(Format::Svg), Target::Xml);
        let mut svg =
            Document::parse_str("<svg><rect x=\"1\"/></svg>", Format::Svg).expect("parse svg");
        assert_eq!(
            String::from_utf8_lossy(&svg.serialize(Format::Xml).expect("serialize")),
            "<svg><rect x=\"1\"/></svg>"
        );
        assert!(Format::Svg.supports(Gesture::SetNodeAttrs));
        assert!(!Format::Svg.is_authorable());
        assert_eq!(Target::from(Format::Gfm), Target::Markdown);
        let mut gfm = Document::parse_str("* a ~~b~~\n", Format::Gfm).expect("parse gfm");
        let back = gfm.serialize(Format::Gfm).expect("serialize");
        assert_eq!(String::from_utf8_lossy(&back), "* a ~~b~~\n");

        // The render follows the row: GFM spells alignment as an attribute.
        let mut table = Document::parse_str("| a |\n| :-: |\n| 1 |\n", Format::Gfm).expect("parse");
        let html = String::from_utf8_lossy(&table.render_html().expect("render")).into_owned();
        assert!(html.contains("align=\"center\""), "got {html:?}");

        // And the capability query answers per dialect.
        assert!(!Format::Commonmark.supports(Gesture::ToggleInline(InlineKind::Delete)));
        assert!(Format::Gfm.supports(Gesture::ToggleInline(InlineKind::Delete)));
    }

    #[test]
    fn serialize_round_trips_and_cross_converts() {
        let mut doc = Document::parse_str("# hi\n", Format::Markdown).expect("parse markdown");

        let canonical = doc.serialize(Format::Markdown).expect("serialize markdown");
        assert!(String::from_utf8_lossy(&canonical).contains("# hi"));

        // Cross-format Markdown -> XML has no serializer.
        assert_eq!(doc.serialize(Format::Xml), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn serialize_markdown_to_djot() {
        let mut doc =
            Document::parse_str("This is *markdown*.\n", Format::Markdown).expect("parse markdown");
        let djot = doc.serialize(Format::Djot).expect("serialize djot");
        assert!(String::from_utf8_lossy(&djot).contains("_markdown_"));
    }

    #[test]
    fn serialize_to_takes_the_output_axis() {
        let mut doc =
            Document::parse_str("This is *markdown*.\n", Format::Markdown).expect("parse markdown");

        let djot = doc.serialize_to(Target::Djot).expect("serialize djot");
        assert!(String::from_utf8_lossy(&djot).contains("_markdown_"));

        // The capability answer is the target's, not the input's: converting
        // INTO XML has no serializer regardless of what parsed the document.
        assert_eq!(doc.serialize_to(Target::Xml), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn serialize_and_serialize_to_agree() {
        // `serialize` is defined in terms of `serialize_to`, so the older
        // spelling stays exact rather than merely similar.
        let mut a = Document::parse_str("# hi\n", Format::Markdown).expect("parse markdown");
        let mut b = Document::parse_str("# hi\n", Format::Markdown).expect("parse markdown");
        for format in [Format::Markdown, Format::Djot, Format::Html] {
            assert_eq!(a.serialize(format), b.serialize_to(Target::from(format)));
        }
    }

    #[test]
    fn every_format_is_a_target_that_names_it_back() {
        // The subset invariant the Zig `targets` table enforces, restated at
        // this layer: `Target::from` is total, and `as_format` round-trips it.
        for format in [Format::Djot, Format::Markdown, Format::Xml, Format::Html] {
            assert_eq!(Target::from(format).as_format(), Some(format));
        }
    }

    #[test]
    fn ast_json_dumps_the_tree() {
        let mut doc = Document::parse_str("hello\n", Format::Djot).expect("parse djot");
        let json = doc.ast_json().expect("ast json");
        assert!(String::from_utf8_lossy(&json).contains("\"kind\": \"doc\""));
    }

    #[test]
    fn query_finds_nodes_by_selector() {
        let source = "# One\n\n## Two\n";
        let mut doc = Document::parse_str(source, Format::Markdown).expect("parse markdown");
        let matches = doc.query("heading").expect("query");

        assert_eq!(matches.len(), 2);
        for m in &matches {
            assert_eq!(m.kind, Kind::Heading);
            assert!(m.span.start < m.span.end);
        }
    }

    #[test]
    fn query_recovers_code_spans() {
        let source = "prose `code` more prose\n";
        let mut doc = Document::parse_str(source, Format::Markdown).expect("parse markdown");
        let matches = doc.query("verbatim").expect("query");

        assert_eq!(matches.len(), 1);
        assert_eq!(&source[matches[0].span.clone()], "`code`");
    }

    #[test]
    fn document_span_accessors_read_by_node_id() {
        let source = "# hi\n\ntext\n";
        let mut doc = Document::parse_str(source, Format::Markdown).expect("parse markdown");
        let heading = doc.query("heading").expect("query").pop().expect("heading");

        assert_eq!(
            doc.span(NodeId(heading.node_id)).expect("span"),
            heading.span
        );
        assert_eq!(
            doc.content_span(NodeId(heading.node_id))
                .expect("content span"),
            heading.content_span
        );
        assert_eq!(doc.span(NodeId(u32::MAX)), Err(Error::InvalidArgument));
    }

    #[test]
    fn document_walks_its_tree_without_an_editor() {
        let source = "# hi\n\ntext\n";
        let mut doc = Document::parse_str(source, Format::Markdown).expect("parse markdown");

        let nodes = doc.nodes().expect("nodes");
        assert!(nodes.len() >= 3);
        for (i, n) in nodes.iter().enumerate() {
            assert_eq!(n.id, NodeId(i as u32));
        }

        let kids = doc.children(None).expect("children");
        assert_eq!(kids.len(), 2);
        assert_eq!(kids[0].kind, Kind::Heading);

        let sub = doc.subtree(NodeId(kids[0].node_id)).expect("subtree");
        assert_eq!(sub[0].id, NodeId(0));
        assert_eq!(sub[0].parent, None);
        assert_eq!(sub[0].span, kids[0].span);

        let hit = doc.node_at(2).expect("node_at").expect("a node at 2");
        let chain = doc.ancestors_at(2).expect("ancestors");
        assert_eq!(chain.last().expect("deepest").node_id, hit.node_id);
        assert_eq!(chain[0].kind, Kind::Doc);

        assert_eq!(doc.subtree(NodeId(u32::MAX)), Err(Error::InvalidArgument));
    }

    #[test]
    fn editor_document_view_reads_the_live_tree() {
        let mut ed = Editor::new_str("# one\n\ntwo\n", Format::Markdown).expect("editor");

        {
            let mut view = ed.document().expect("view");
            let kids = view.children(None).expect("children");
            assert_eq!(kids.len(), 2);
            assert_eq!(kids[0].kind, Kind::Heading);
            assert_eq!(view.span(NodeId(kids[0].node_id)).expect("span"), 0..5);
            // The two the view can't serve.
            assert_eq!(view.render_html(), Err(Error::UnsupportedFormat));
            assert_eq!(
                view.serialize(Format::Markdown),
                Err(Error::UnsupportedFormat)
            );
        }

        ed.replace("0", "# one and a half").expect("replace");
        let mut view = ed.document().expect("view");
        let kids = view.children(None).expect("children");
        assert_eq!(view.span(NodeId(kids[0].node_id)).expect("span"), 0..16);
    }

    #[test]
    fn query_rejects_a_malformed_selector() {
        let mut doc = Document::parse_str("hi\n", Format::Markdown).expect("parse markdown");
        assert_eq!(doc.query("list >"), Err(Error::InvalidArgument));
    }

    #[test]
    fn editor_edits_by_index_path() {
        let mut ed = Editor::new_str("<a><b>hi</b></a>", Format::Xml).expect("editor");
        ed.replace_content("0.0", "bye").expect("replace_content");
        assert_eq!(ed.source_str().expect("source"), "<a><b>bye</b></a>");
    }

    #[test]
    fn flat_nodes_expose_element_name_and_attrs() {
        // A `<picture>` with a theme-switching `<source>`: the dark alternative
        // lives only in the `<source>`'s attributes, which the snapshot now
        // surfaces (both `<picture>` and `<source>` report `kind == "container"`).
        let src = "<picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"d.svg\"><img src=\"l.svg\" alt=\"x\"></picture>\n";
        let mut ed = Editor::new_ext(
            src.as_bytes(),
            Format::Markdown,
            MarkdownExtensions {
                html_elements: true,
                ..Default::default()
            },
        )
        .expect("editor");
        let nodes = ed.nodes().expect("nodes");

        let source = nodes
            .iter()
            .find(|n| n.name.as_deref() == Some("source"))
            .expect("a <source> element node");
        assert_eq!(
            source.attrs,
            vec![
                (
                    "media".to_string(),
                    Some("(prefers-color-scheme: dark)".to_string())
                ),
                ("srcset".to_string(), Some("d.svg".to_string())),
            ]
        );

        // The `<img>` fallback stays an `image` node (no element name), and its
        // `src` is the ordinary `destination`.
        let img = nodes
            .iter()
            .find(|n| n.kind == Kind::Image)
            .expect("an image node");
        assert!(img.name.is_none());
        assert_eq!(img.destination.as_deref(), Some("l.svg"));

        // A semantic node carries neither an element name nor attributes.
        let picture_kids_str = nodes.iter().find(|n| n.kind == Kind::Str);
        if let Some(s) = picture_kids_str {
            assert!(s.name.is_none() && s.attrs.is_empty());
        }
    }

    #[test]
    fn definitions_finds_what_a_walk_from_the_root_cannot() {
        // Both definitions are resolved by label, so neither is anybody's
        // child: the document root's subtree contains the paragraph and
        // nothing else.
        let mut doc = Document::parse_str(
            "text[^1] [x][a]\n\n[^1]: note\n\n[a]: /u\n",
            Format::Markdown,
        )
        .expect("parse markdown");

        let defs = doc.definitions().expect("definitions");
        let mut kinds: Vec<Kind> = defs.iter().map(|m| m.kind.clone()).collect();
        kinds.sort_by(|a, b| a.as_str().cmp(b.as_str()));
        assert_eq!(kinds, vec![Kind::Footnote, Kind::Reference]);

        // Each one knows where it stands. A link reference definition used
        // to answer `0..0`, which left an editor unable to tell its lines
        // from blank ones.
        for d in &defs {
            let want = match d.kind {
                Kind::Footnote => 17..27,
                Kind::Reference => 29..36,
                _ => unreachable!(),
            };
            assert_eq!(d.span, want, "{} stands on its own bytes", d.kind);
        }

        // None of them is reachable from the root — the property that made a
        // whole-arena rescan the only way to find them.
        let all = doc.nodes().expect("nodes");
        let root = all
            .iter()
            .find(|n| n.kind == Kind::Doc)
            .expect("a doc root");
        let mut reachable = vec![root.id];
        let mut i = 0;
        while i < reachable.len() {
            let n = &all[reachable[i].0 as usize];
            let mut c = n.first_child;
            while let Some(cid) = c {
                reachable.push(cid);
                c = all[cid.0 as usize].next_sibling;
            }
            i += 1;
        }
        for d in &defs {
            assert!(
                !reachable.contains(&NodeId(d.node_id)),
                "{} should be unreachable from the root",
                d.kind
            );
        }

        // A document that defines nothing gets an empty vec, not an error.
        let mut plain = Document::parse_str("just text\n", Format::Markdown).expect("parse");
        assert_eq!(plain.definitions().expect("definitions"), Vec::new());
    }

    #[test]
    fn kind_round_trips_through_its_published_name() {
        // `as_str` is the wire vocabulary and `from` is its inverse, so any
        // variant whose spelling drifts from the C ABI's fails here rather
        // than quietly becoming `Other`.
        for k in [
            Kind::Doc,
            Kind::Para,
            Kind::Heading,
            Kind::Container,
            Kind::TaskListItem,
            Kind::Superscript,
            Kind::FootnoteReference,
            Kind::ProcessingInstruction,
            Kind::Cdata,
        ] {
            assert_eq!(Kind::from(k.as_str()), k, "{k} did not round-trip");
            assert!(!k.is_unknown());
        }
    }

    #[test]
    fn an_unknown_kind_name_is_carried_rather_than_lost() {
        // A newer library against an older binding. The node is still a node,
        // and a renderer that passes it through unchanged should be able to.
        let k = Kind::from("some_future_kind");
        assert!(k.is_unknown());
        assert_eq!(k.as_str(), "some_future_kind");
        assert_eq!(k, Kind::Other("some_future_kind".to_string()));
    }

    #[test]
    fn every_kind_the_library_publishes_has_a_variant() {
        // Walks documents covering every corner of the vocabulary this crate
        // can reach from Rust and asserts nothing arrives as `Other`. If twig
        // adds a kind, or renames one, this fails — which is the whole reason
        // the enum is here instead of a `String`.
        let cases: &[(&str, Format, MarkdownExtensions)] = &[
            (
                "# h\n\npara *emph* **strong** `code`\n\n- a\n- b\n\n1. c\n\n> q\n\n---\n\n```zig\nx\n```\n",
                Format::Markdown,
                MarkdownExtensions {
                    directives: false,
                    math: false,
                    html_elements: false,
                    highlight: false,
                    highlight_colors: false,
                },
            ),
            (
                "| a | b |\n| --- | --- |\n| 1 | 2 |\n\n- [ ] task\n- [x] done\n\nfoot[^1]\n\n[^1]: note\n\n[l]: /u\n\n[x][l]\n",
                Format::Markdown,
                MarkdownExtensions::default(),
            ),
            (
                ":::note\nbody\n:::\n\n:role[x]\n\n$a+b$ ==h== ==🔴 r==\n",
                Format::Markdown,
                MarkdownExtensions {
                    directives: true,
                    math: true,
                    html_elements: false,
                    highlight: true,
                    highlight_colors: true,
                },
            ),
            (
                "a^b^ c~d~ {=e=} {+f+} {-g-} 'q' \"dq\"\n\n![i](/p)\n\n<https://e.com>\n",
                Format::Djot,
                MarkdownExtensions::default(),
            ),
            (
                "<!-- c --><!DOCTYPE html><video controls><p>x</p></video>",
                Format::Html,
                MarkdownExtensions::default(),
            ),
        ];

        let mut unknown: Vec<String> = Vec::new();
        let mut seen: Vec<String> = Vec::new();
        for (src, format, ext) in cases {
            let mut ed = Editor::new_ext(src.as_bytes(), *format, *ext).expect("editor");
            for n in ed.nodes().expect("nodes") {
                if n.kind.is_unknown() {
                    unknown.push(n.kind.as_str().to_string());
                }
                seen.push(n.kind.as_str().to_string());
            }
        }
        unknown.sort();
        unknown.dedup();
        assert!(unknown.is_empty(), "kinds with no variant: {unknown:?}");

        // And the sweep really swept: without this the assertion above passes
        // just as happily on an empty walk.
        seen.sort();
        seen.dedup();
        assert!(
            seen.len() >= 30,
            "only {} distinct kinds reached: {seen:?}",
            seen.len()
        );
    }

    #[test]
    fn diagnostics_report_what_a_conversion_would_lose() {
        // A djot superscript has no Markdown spelling. The two answers below
        // are for the SAME document — fidelity is a property of the
        // (document, target) pair, which is why it is asked per target.
        let mut doc = Document::parse_str("a^b^ c\n", Format::Djot).expect("parse djot");

        let to_md = doc
            .diagnostics(Target::Markdown)
            .expect("markdown diagnostics");
        assert_eq!(
            to_md,
            vec![Warning {
                fidelity: Fidelity::Degraded,
                path: "0/1".to_string(),
                kind: Kind::Superscript,
            }]
        );

        // Lossless to djot: an empty vec is a real answer, not a failure.
        assert_eq!(
            doc.diagnostics(Target::Djot).expect("djot diagnostics"),
            Vec::new()
        );
    }

    #[test]
    fn diagnostics_separate_a_droppable_node_from_a_degradable_one() {
        // An HTML comment converted to djot leaves NOTHING behind — a
        // different and worse answer than "comes back as something else", and
        // the distinction a consumer needs to decide whether to warn or refuse.
        let mut doc =
            Document::parse_str("<p>hi</p><!-- secret -->", Format::Html).expect("parse html");
        let warnings = doc.diagnostics(Target::Djot).expect("djot diagnostics");
        let comment = warnings
            .iter()
            .find(|w| w.kind == Kind::Comment)
            .expect("a warning about the comment");
        assert_eq!(comment.fidelity, Fidelity::Dropped);
    }

    #[test]
    fn diagnostics_report_a_surviving_nodes_lost_attributes() {
        // A djot paragraph carrying a class converts to Markdown as a `<div>`
        // around the paragraph, which Markdown's default parser reads as raw
        // HTML beside it: the node survives, the class is written where it is
        // not read back, and the warning says which of the two it is about.
        let mut doc = Document::parse_str("{.center}\nhello\n", Format::Djot).expect("parse djot");
        assert_eq!(
            doc.diagnostics(Target::Markdown).expect("markdown diagnostics"),
            vec![Warning {
                fidelity: Fidelity::AttrsDegraded,
                path: "0".to_string(),
                kind: Kind::Para,
            }]
        );
        // An emphasis carrying one has nowhere to put it.
        let mut em = Document::parse_str("_x_{.big}\n", Format::Djot).expect("parse djot");
        assert_eq!(
            em.diagnostics(Target::Markdown).expect("markdown diagnostics"),
            vec![Warning {
                fidelity: Fidelity::AttrsDropped,
                path: "0/0".to_string(),
                kind: Kind::Emph,
            }]
        );
        // HTML and AsciiDoc keep a paragraph's class: nothing to report.
        assert_eq!(doc.diagnostics(Target::Html).expect("html"), Vec::new());
        assert_eq!(doc.diagnostics(Target::Asciidoc).expect("asciidoc"), Vec::new());
    }

    #[test]
    fn diagnostics_report_a_degraded_nodes_attributes_beside_it() {
        // A Word paste: `<html>` and `<body>` are sections, which Markdown
        // degrades and still writes a `<div>` for each one's attributes.
        // Three `<div>`s, three attribute warnings — two of them at a path
        // that also carries the node's own.
        let mut doc = Document::parse_str(
            r#"<html xmlns:o="urn:x"><body lang="EN-US"><p class="MsoNormal">Word text</p></body></html>"#,
            Format::Html,
        )
        .expect("parse html");
        let w = |fidelity, path: &str, kind| Warning {
            fidelity,
            path: path.to_string(),
            kind,
        };
        assert_eq!(
            doc.diagnostics(Target::Markdown).expect("markdown diagnostics"),
            vec![
                w(Fidelity::Degraded, "0", Kind::Section),
                w(Fidelity::AttrsDegraded, "0", Kind::Section),
                w(Fidelity::Degraded, "0/0", Kind::Section),
                w(Fidelity::AttrsDegraded, "0/0", Kind::Section),
                w(Fidelity::AttrsDegraded, "0/0/0", Kind::Para),
            ]
        );
    }

    #[test]
    fn diagnostics_say_nothing_of_what_a_link_or_image_already_spells() {
        // `href`, `src` and `alt` are the node's destination and alt text,
        // which Markdown writes in full.
        for html in [r#"<p>a <a href="https://x.dev">l</a></p>"#, r#"<p><img src="u" alt="p"></p>"#] {
            let mut doc = Document::parse_str(html, Format::Html).expect("parse html");
            assert_eq!(doc.diagnostics(Target::Markdown).expect("markdown"), Vec::new());
            assert_eq!(doc.diagnostics(Target::Djot).expect("djot"), Vec::new());
        }
    }

    #[test]
    fn diagnostics_refuse_a_target_with_no_serializer() {
        // "This target cannot be written" is a capability answer, not a
        // per-node diagnosis of every node in the document.
        let mut doc = Document::parse_str("# hi\n", Format::Markdown).expect("parse markdown");
        assert_eq!(doc.diagnostics(Target::Xml), Err(Error::UnsupportedFormat));
        // AsciiDoc has a serializer now, so it gets a per-node answer instead.
        assert!(doc.diagnostics(Target::Asciidoc).is_ok());
    }

    #[test]
    fn diagnostics_flag_a_header_less_table_and_leave_a_headed_one_alone() {
        // The instance-level answer, and the one a consumer cannot reach by
        // looking at kinds: both documents contain a `table`, and only one of
        // them costs anything to convert. GFM's delimiter row is mandatory, so
        // the header-less table gets an empty header synthesized above it.
        let mut headed = Document::parse_str(
            "<table><tr><th>H</th></tr><tr><td>a</td></tr></table>",
            Format::Html,
        )
        .expect("parse headed table");
        assert!(
            headed
                .diagnostics(Target::Markdown)
                .expect("diagnostics")
                .iter()
                .all(|w| w.kind != Kind::Table)
        );

        let mut headless = Document::parse_str("<table><tr><td>a</td></tr></table>", Format::Html)
            .expect("parse header-less table");
        let table_warning = headless
            .diagnostics(Target::Markdown)
            .expect("diagnostics")
            .into_iter()
            .find(|w| w.kind == Kind::Table)
            .expect("a warning about the table");
        assert_eq!(table_warning.fidelity, Fidelity::Degraded);
    }

    #[test]
    fn container_origin_separates_a_div_from_a_div() {
        // The collision this field exists for. These two documents produce
        // container nodes that agree on `kind`, on `name` AND on
        // `directive_form` — so a consumer holding one of them could not say
        // which syntax the author wrote without re-reading the source bytes.
        let mut html =
            Editor::new("<div>hi</div>\n".as_bytes(), Format::Html).expect("html editor");
        let mut md = Editor::new_ext(
            ":::div\nhi\n:::\n".as_bytes(),
            Format::Markdown,
            MarkdownExtensions {
                directives: true,
                ..Default::default()
            },
        )
        .expect("markdown editor");

        let html_nodes = html.nodes().expect("html nodes");
        let md_nodes = md.nodes().expect("markdown nodes");
        let tag = html_nodes
            .iter()
            .find(|n| n.name.as_deref() == Some("div"))
            .expect("a <div> container");
        let directive = md_nodes
            .iter()
            .find(|n| n.name.as_deref() == Some("div"))
            .expect("a :::div container");

        // Indistinguishable on every field that predates `origin`.
        assert_eq!(tag.kind, directive.kind);
        assert_eq!(tag.name, directive.name);
        assert_eq!(tag.directive_form, directive.directive_form);
        assert_eq!(tag.directive_form, Some(DirectiveForm::Container));

        // And decidable now.
        assert_eq!(tag.origin, Some(ContainerOrigin::Element));
        assert_eq!(directive.origin, Some(ContainerOrigin::Directive));
    }

    #[test]
    fn a_container_whose_body_is_text_says_so_in_text() {
        // `<script>` and `<span>` used to be the same shape — a container over
        // one `str` — and differ only in name, so an editor could not tell a
        // JavaScript body from prose without its own tag list. The tokenizer
        // knows: a raw-text or rcdata body is the node's `text`, and there
        // are no children to step into.
        let mut html = Editor::new(
            "<script>a < b</script><title>a &amp; b</title><span>a &amp; b</span>\n".as_bytes(),
            Format::Html,
        )
        .expect("html editor");
        let nodes = html.nodes().expect("html nodes");
        let by_name = |name: &str| {
            nodes
                .iter()
                .find(|n| n.name.as_deref() == Some(name))
                .unwrap_or_else(|| panic!("a <{name}> container"))
        };
        let script = by_name("script");
        assert_eq!(script.kind, Kind::Container);
        assert_eq!(script.text.as_deref(), Some("a < b"));
        assert_eq!(script.first_child, None);
        // rcdata is decoded, like any text.
        assert_eq!(by_name("title").text.as_deref(), Some("a & b"));
        // A markup body is children, and `text` stays `None`.
        let span = by_name("span");
        assert_eq!(span.text, None);
        assert!(span.first_child.is_some());
    }

    /// Parse `src` as both authorable formats and run `check` over each — the
    /// shape every test below wants, because the point of these two APIs is
    /// that a consumer cannot tell which parser produced the tree.
    fn for_both_formats(src: &str, check: impl Fn(&mut Document, Format)) {
        for format in [Format::Markdown, Format::Djot] {
            let mut doc = Document::parse(src.as_bytes(), format).expect("parse");
            check(&mut doc, format);
        }
    }

    #[test]
    fn marker_span_is_what_a_rich_view_hides() {
        for_both_formats("> - [x] done\n", |doc, format| {
            let nodes = doc.nodes().expect("nodes");
            let quote = nodes
                .iter()
                .find(|n| n.kind == Kind::BlockQuote)
                .expect("a block quote");
            let item = nodes
                .iter()
                .find(|n| n.kind == Kind::TaskListItem)
                .expect("a task item");

            // The quote's `> ` and the item's `- [x] ` — the item's marker
            // takes its checkbox with it, because the rendered view draws a
            // checkbox in PLACE of those bytes rather than beside them.
            assert_eq!(quote.marker_span, Some(0..2), "{format:?}");
            assert_eq!(item.marker_span, Some(2..8), "{format:?}");

            // Not derivable from the other two spans: a marker-prefixed
            // container reports its whole extent as its interior, so the
            // subtraction a caller might reach for yields nothing.
            assert_eq!(quote.content_span, Some(quote.span.clone()), "{format:?}");

            // A paragraph has no marker of its own; only its ancestors do.
            let para = nodes
                .iter()
                .find(|n| n.kind == Kind::Para)
                .expect("a paragraph");
            assert_eq!(para.marker_span, None, "{format:?}");
        });
    }

    #[test]
    fn attrs_span_locates_the_attribute_block_a_heuristic_had_to_guess_at() {
        // A Djot attribute line sits on its OWN line above the block it
        // attaches to, so a consumer dropping the block has to drop that line
        // too. Without this the extent was guessed at by scanning for `{`,
        // which strands the line as a published paragraph when the guess
        // misses — and the line names the audience.
        let src = "{.vis .family}\nheld back\n\nplain\n";
        let mut doc = Document::parse(src.as_bytes(), Format::Djot).expect("parse");
        let nodes = doc.nodes().expect("nodes");
        let paras: Vec<&FlatNode> = nodes.iter().filter(|n| n.kind == Kind::Para).collect();
        assert_eq!(paras.len(), 2);

        let span = doc
            .attrs_span(paras[0].id)
            .expect("attrs span")
            .expect("the attributed paragraph has one");
        assert_eq!(&src[span.clone()], "{.vis .family}");
        // The block's own span starts AFTER the attribute line, which is why
        // dropping the block alone leaves the line behind.
        assert!(span.end <= paras[0].span.start);

        // `None` is a real answer, not a failure: the second paragraph is
        // unattributed.
        assert_eq!(doc.attrs_span(paras[1].id).expect("attrs span"), None);
    }

    #[test]
    fn line_prefix_assembles_every_marker_on_the_line() {
        for_both_formats("> - [x] done\n", |doc, format| {
            // Four nodes' worth of hidden width as one range, which is what a
            // caret stepping over it needs — not a chain to stitch together.
            assert_eq!(doc.line_prefix(9).expect("prefix"), Some(0..8), "{format:?}");
        });
    }

    #[test]
    fn line_prefix_is_none_on_a_continuation_line() {
        // Line two continues the quote but OPENS nothing. `None` is the honest
        // answer: what a continuation line repeats is a different question with
        // a different answer, and guessing it from marker spans is how an
        // editor ends up restructuring a document that never had the shape it
        // inferred.
        for_both_formats("> c\n> d\n", |doc, format| {
            assert_eq!(doc.line_prefix(2).expect("prefix"), Some(0..2), "{format:?}");
            assert_eq!(doc.line_prefix(6).expect("prefix"), None, "{format:?}");
        });
    }

    #[test]
    fn a_caret_at_a_blocks_end_is_in_that_block_in_both_formats() {
        // The divergence this API exists for. Djot ends a paragraph's span
        // AFTER its newline and Markdown BEFORE it, so under half-open
        // containment offset 1 — the caret you get by pressing End on line one,
        // the commonest caret position there is — resolved to the paragraph
        // through Djot and to the root through Markdown.
        for_both_formats("a\n\nb\n", |doc, format| {
            for offset in [0usize, 1, 3, 4] {
                let hit = doc
                    .node_at_caret(offset)
                    .expect("caret hit")
                    .expect("some node");
                assert_eq!(hit.kind, Kind::Str, "{format:?} at {offset}");
            }
            // The blank line between the two blocks belongs to neither, and
            // neither does the empty line after the final newline.
            for offset in [2usize, 5] {
                let hit = doc
                    .node_at_caret(offset)
                    .expect("caret hit")
                    .expect("some node");
                assert_eq!(hit.kind, Kind::Doc, "{format:?} at {offset}");
            }
        });
    }

    #[test]
    fn the_caret_chain_ends_at_the_node_the_scalar_call_returns() {
        for_both_formats("- a\n", |doc, format| {
            let hit = doc.node_at_caret(3).expect("hit").expect("some node");
            let chain = doc.ancestors_at_caret(3).expect("chain");
            assert_eq!(chain.last().map(|m| m.node_id), Some(hit.node_id), "{format:?}");
            // And the chain passes through the item, which is what a gesture
            // scoped to "the block I'm in" needs at a caret sitting at its end.
            assert!(
                chain.iter().any(|m| m.kind == Kind::ListItem),
                "{format:?}: chain should reach the list item"
            );
        });
    }

    #[test]
    fn continuation_prefix_repeats_a_quote_and_indents_past_an_item() {
        for_both_formats("> - a\n", |doc, format| {
            // The bytes already on the line, and the bytes a continuation would
            // need. They differ exactly where an editor gets it wrong by hand:
            // the item's `- ` is PRESENT and must not be repeated, or the
            // continuation opens a second item instead of continuing the first.
            assert_eq!(doc.line_prefix(4).expect("prefix"), Some(0..4), "{format:?}");
            let cont = doc.continuation_prefix(4).expect("continuation");
            assert_eq!(cont.text, ">   ", "{format:?}");
            assert_eq!(cont.columns, 4, "{format:?}");
        });
    }

    #[test]
    fn continuation_prefix_answers_on_a_line_that_opens_nothing() {
        // The case `line_prefix` declines. Each ancestor answers from its own
        // opening line, so the quote's marker is still found on line one.
        for_both_formats("> c\n> d\n", |doc, format| {
            assert_eq!(doc.line_prefix(6).expect("prefix"), None, "{format:?}");
            assert_eq!(
                doc.continuation_prefix(6).expect("continuation").text,
                "> ",
                "{format:?}"
            );
        });
    }

    #[test]
    fn continuation_prefix_takes_an_ordered_markers_own_width() {
        // `10. ` is four columns where `1. ` is three. A fixed indent is the
        // assumption that makes Tab wrong on the tenth item.
        for_both_formats("10. x\n", |doc, format| {
            assert_eq!(
                doc.continuation_prefix(4).expect("continuation").columns,
                4,
                "{format:?}"
            );
        });
        for_both_formats("1. x\n", |doc, format| {
            assert_eq!(
                doc.continuation_prefix(3).expect("continuation").columns,
                3,
                "{format:?}"
            );
        });
    }

    #[test]
    fn a_blank_line_keeps_a_quote_alive_and_drops_an_items_indent() {
        for_both_formats("> - a\n", |doc, format| {
            let blank = doc.blank_line_prefix(4).expect("blank");
            // `>` and not `> `: the space after the marker is content indent,
            // and a blank line has no content.
            assert_eq!(blank.text, ">", "{format:?}");
            assert_eq!(blank.columns, 1, "{format:?}");
        });
        // Inside a list alone there is nothing to keep alive, so a blank line
        // carries nothing at all.
        for_both_formats("- a\n", |doc, format| {
            assert_eq!(doc.blank_line_prefix(3).expect("blank").text, "", "{format:?}");
        });
    }

    #[test]
    fn a_prefix_column_count_is_not_its_byte_length() {
        // A tab in a marker advances to a tab stop, so the two diverge — which
        // is why `columns` is carried rather than left to the caller to infer.
        let mut doc = Document::parse("-	x
".as_bytes(), Format::Markdown).expect("parse");
        let cont = doc.continuation_prefix(2).expect("continuation");
        assert_eq!(cont.columns, 4);
    }

    #[test]
    fn set_block_opens_a_heading_on_a_blank_line() {
        for format in [Format::Markdown, Format::Djot] {
            let mut ed = Editor::new("a\n\n".as_bytes(), format).expect("editor");
            ed.set_block(3, BlockKind::Heading(2)).expect("set_block");
            assert_eq!(ed.source().expect("source"), b"a\n\n## ", "{format:?}");
            // The reparse is the assertion that matters, not the bytes: Djot
            // does not let a heading interrupt a paragraph, so a marker written
            // without the separating blank would come back as literal text.
            let nodes = ed.nodes().expect("nodes");
            assert!(
                nodes.iter().any(|n| n.kind == Kind::Heading),
                "{format:?}: should have parsed a heading"
            );
        }
    }

    #[test]
    fn set_block_refuses_a_blank_line_inside_a_code_block() {
        // `innermostBlock` reports nothing here exactly as it does between
        // blocks; only the line's owner tells them apart. Writing `# ` in would
        // add no heading and corrupt the listing.
        for format in [Format::Markdown, Format::Djot] {
            let src = "```\nx\n\ny\n```\n";
            let mut ed = Editor::new(src.as_bytes(), format).expect("editor");
            let blank = src.find("\n\n").expect("a blank line") + 1;
            assert!(
                matches!(
                    ed.set_block(blank, BlockKind::Heading(1)),
                    Err(Error::NotEditable)
                ),
                "{format:?}"
            );
            assert_eq!(ed.source().expect("source"), src.as_bytes(), "{format:?}");
        }
    }

    #[test]
    fn task_items_report_their_checkbox_state() {
        // Twig would WRITE a checkbox and not read one back, so a consumer
        // rendering a clickable box re-derived the state by scanning for `[x]`.
        // A capital `[X]` is checked too, which that scan misses.
        for_both_formats("- [ ] a\n- [x] b\n- [X] c\n- d\n", |doc, format| {
            let nodes = doc.nodes().expect("nodes");
            let states: Vec<Option<bool>> = nodes
                .iter()
                .filter(|n| matches!(n.kind, Kind::TaskListItem | Kind::ListItem))
                .map(|n| n.checked)
                .collect();
            assert_eq!(
                states,
                vec![Some(false), Some(true), Some(true), None],
                "{format:?}"
            );

            // `None` is not `Some(false)`: a consumer treating "not a task
            // item" as unchecked draws an empty box beside every paragraph.
            for n in nodes.iter().filter(|n| n.kind == Kind::Para) {
                assert_eq!(n.checked, None, "{format:?}");
            }
        });
    }

    #[test]
    fn an_editor_reaches_the_caret_reads_through_its_document_view() {
        // The path an editing host actually takes. These reads are questions
        // about a TREE, not about an editing session, so they live on the
        // document surface and an editor borrows it — no `twig_editor_*` alias
        // to keep in step. See DESIGN.md, "The reads are not editor-specific."
        let mut ed = Editor::new("- a\n".as_bytes(), Format::Markdown).expect("editor");
        let mut view = ed.document().expect("document view");

        assert_eq!(view.line_prefix(3).expect("prefix"), Some(0..2));
        let hit = view.node_at_caret(3).expect("hit").expect("some node");
        assert_eq!(hit.kind, Kind::Str);
    }

    #[test]
    fn container_origin_is_none_for_non_containers() {
        // The field is a container's, so everything else reports `None` rather
        // than a default that would read as a real answer.
        let mut ed = Editor::new("# hi\n\npara\n".as_bytes(), Format::Markdown).expect("editor");
        for n in ed.nodes().expect("nodes") {
            assert_eq!(n.origin, None, "{} should carry no origin", n.kind);
        }
    }

    #[test]
    fn flat_nodes_expose_directive_name_and_form() {
        // All three surface forms report `kind == "container"`, so the snapshot
        // has to carry both halves of a directive's identity: which type it is
        // (`name`) and how it was written (`directive_form`). Without them a
        // renderer can't tell an `::embed` from a `::toc`, nor an inline span
        // from a standalone block.
        let src = ":::note{.warning}\nBody\n:::\n\n::embed{src=\"demo.html\"}\n\nSee :abbr[HTML]{title=\"HyperText\"} inline.\n";
        let mut ed = Editor::new_ext(
            src.as_bytes(),
            Format::Markdown,
            MarkdownExtensions {
                directives: true,
                ..Default::default()
            },
        )
        .expect("editor");
        let nodes = ed.nodes().expect("nodes");

        let forms: Vec<(Option<&str>, Option<DirectiveForm>)> = nodes
            .iter()
            .filter(|n| n.kind == Kind::Container)
            .map(|n| (n.name.as_deref(), n.directive_form))
            .collect();
        assert_eq!(
            forms,
            vec![
                (Some("note"), Some(DirectiveForm::Container)),
                (Some("embed"), Some(DirectiveForm::Leaf)),
                (Some("abbr"), Some(DirectiveForm::Text)),
            ]
        );

        // The attributes still ride the ordinary side-table, and a non-directive
        // reports no form at all.
        let embed = nodes
            .iter()
            .find(|n| n.name.as_deref() == Some("embed"))
            .expect("embed");
        assert_eq!(
            embed.attrs,
            vec![("src".to_string(), Some("demo.html".to_string()))]
        );
        let para = nodes.iter().find(|n| n.kind == Kind::Para).expect("a para");
        assert!(para.directive_form.is_none() && para.name.is_none());
    }

    #[test]
    fn editor_insert_child_and_delete() {
        let mut ed = Editor::new_str("<r><a/><c/></r>", Format::Xml).expect("editor");
        ed.insert_child("0", 1, "<b/>").expect("insert_child");
        assert_eq!(ed.source_str().expect("source"), "<r><a/><b/><c/></r>");
        ed.delete("0.1").expect("delete");
        assert_eq!(ed.source_str().expect("source"), "<r><a/><c/></r>");
    }

    #[test]
    fn editor_edits_by_selector() {
        let mut ed = Editor::new_str("# One\n\n## Two\n", Format::Markdown).expect("editor");
        ed.replace("heading(\"Two\")", "## Renamed")
            .expect("replace");
        assert_eq!(ed.source_str().expect("source"), "# One\n\n## Renamed\n");
    }

    #[test]
    fn editor_locator_errors_are_distinct() {
        let mut ed = Editor::new_str("<r><a/><a/></r>", Format::Xml).expect("editor");
        assert_eq!(ed.replace("0.9", "x"), Err(Error::NotFound));
        assert_eq!(ed.replace("element", "x"), Err(Error::Ambiguous));
        assert_eq!(ed.replace("element(", "x"), Err(Error::InvalidArgument));
        // Untouched by the failed edits.
        assert_eq!(ed.source_str().expect("source"), "<r><a/><a/></r>");
    }

    #[test]
    fn editor_reparse_break_rolls_back() {
        let mut ed = Editor::new_str("<a>ok</a>", Format::Xml).expect("editor");
        assert_eq!(ed.replace_content("0", "<b>"), Err(Error::EditConflict));
        assert_eq!(ed.source_str().expect("source"), "<a>ok</a>");
    }

    #[test]
    fn editor_leaf_content_is_not_editable() {
        let mut ed = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(ed.replace_content("0.0", "x"), Err(Error::NotEditable));
    }

    #[test]
    fn editor_query_reflects_current_tree() {
        let mut ed = Editor::new_str("<r><a/></r>", Format::Xml).expect("editor");
        ed.insert_child("0", 1, "<b/>").expect("insert_child");
        // Root <r> plus <a/> and <b/>.
        assert_eq!(ed.query("element").expect("query").len(), 3);
        let json = ed.ast_json().expect("ast_json");
        assert!(String::from_utf8_lossy(&json).contains("\"kind\": \"doc\""));
    }

    // ── offset-addressed editing & read-back (P0–P3) ────────────────────────

    #[test]
    fn editor_edit_range_types_backspaces_and_reports_change() {
        let mut ed = Editor::new_str("ab\n", Format::Markdown).expect("editor");

        // Type "X" at offset 1 (a zero-width splice = an insertion).
        let c = ed.edit_range(1, 1, "X").expect("edit_range insert");
        assert_eq!(ed.source_str().unwrap(), "aXb\n");
        assert_eq!(c.old, 1..1);
        assert_eq!(c.new, 1..2);
        assert_eq!(c.delta(), 1);

        // Backspace it (delete the "X").
        let c2 = ed.edit_range(1, 2, "").expect("edit_range delete");
        assert_eq!(ed.source_str().unwrap(), "ab\n");
        assert_eq!(c2.old, 1..2);
        assert_eq!(c2.new, 1..1);
        assert_eq!(c2.delta(), -1);
    }

    #[test]
    fn editor_edit_range_rejects_bad_ranges() {
        let mut ed = Editor::new_str("hi\n", Format::Markdown).expect("editor");
        assert_eq!(ed.edit_range(0, 99, "x"), Err(Error::InvalidArgument)); // end past len
        assert_eq!(ed.edit_range(2, 1, "x"), Err(Error::InvalidArgument)); // start > end
        assert_eq!(ed.source_str().unwrap(), "hi\n"); // untouched
    }

    #[test]
    fn editor_last_change_reports_locator_ops_too() {
        let mut ed = Editor::new_str("# One\n\n## Two\n", Format::Markdown).expect("editor");
        assert_eq!(ed.last_change(), None); // nothing edited yet

        ed.replace("heading(\"Two\")", "## Renamed")
            .expect("replace");
        assert_eq!(ed.source_str().unwrap(), "# One\n\n## Renamed\n");
        let c = ed.last_change().expect("a change was recorded");
        // "## Two" occupied [7,13); "## Renamed" (10 bytes) now occupies [7,17).
        assert_eq!(c.old, 7..13);
        assert_eq!(c.new, 7..17);
    }

    #[test]
    fn editor_nodes_is_a_walkable_flat_tree() {
        let mut ed = Editor::new_str("# Hi\n\ntext\n", Format::Markdown).expect("editor");
        let nodes = ed.nodes().expect("nodes");
        assert!(!nodes.is_empty());

        // Dense, index-aligned ids.
        for (i, n) in nodes.iter().enumerate() {
            assert_eq!(n.id, NodeId(i as u32));
        }
        // Exactly one root (no parent), and it's the doc.
        let roots: Vec<_> = nodes.iter().filter(|n| n.parent.is_none()).collect();
        assert_eq!(roots.len(), 1);
        assert_eq!(roots[0].kind, Kind::Doc);

        // The heading carries its level; the "Hi" text is reachable as a payload.
        let heading = nodes
            .iter()
            .find(|n| n.kind == Kind::Heading)
            .expect("a heading");
        assert_eq!(heading.level, Some(1));
        assert!(nodes.iter().any(|n| n.text.as_deref() == Some("Hi")));

        // A kind with no row/cell payload reports neither.
        assert_eq!(heading.head, None);
        assert_eq!(heading.alignment, None);

        // Every non-root node's parent links back to a node that lists it as a
        // child (via first_child/next_sibling).
        for n in nodes.iter().filter(|n| n.parent.is_some()) {
            let p = &nodes[n.parent.unwrap().0 as usize];
            let mut kid = p.first_child;
            let mut seen = false;
            while let Some(NodeId(k)) = kid {
                if k == n.id.0 {
                    seen = true;
                    break;
                }
                kid = nodes[k as usize].next_sibling;
            }
            assert!(
                seen,
                "node {:?} not found among its parent's children",
                n.id
            );
        }
    }

    #[test]
    fn editor_child_spans_and_subtree_agree_with_nodes() {
        let src = "# Title\n\nHello **world** and more.\n\n- one\n- two\n";
        let mut ed = Editor::new_str(src, Format::Markdown).expect("editor");
        let all = ed.nodes().expect("nodes");
        let doc = all.iter().find(|n| n.kind == Kind::Doc).expect("doc");

        // child_spans(None) == the doc root's children, same ids/kinds/spans and
        // in the same order.
        let top = ed.child_spans(None).expect("child_spans");
        let mut want = Vec::new();
        let mut c = doc.first_child;
        while let Some(id) = c {
            want.push(id);
            c = all[id.0 as usize].next_sibling;
        }
        assert_eq!(top.len(), want.len(), "top-level count");
        for (m, id) in top.iter().zip(&want) {
            assert_eq!(m.node_id, id.0, "child id");
            assert_eq!(m.kind, all[id.0 as usize].kind, "child kind");
            assert_eq!(m.span, all[id.0 as usize].span, "child span");
        }
        // The span addresses the block as written (absolute offsets).
        assert!(
            src[top[0].span.clone()].starts_with('#'),
            "first block is the heading"
        );

        // child_spans works below the top level too.
        let list = top
            .iter()
            .find(|m| {
                matches!(
                    m.kind,
                    Kind::BulletList | Kind::OrderedList | Kind::TaskList
                )
            })
            .expect("a list");
        let items = ed.child_spans(Some(NodeId(list.node_id))).expect("items");
        assert_eq!(items.len(), 2);
        assert!(
            items.iter().all(|m| m.kind == Kind::ListItem),
            "items: {items:?}"
        );

        // subtree(para) is self-contained, local-indexed, and spans stay absolute.
        let para = top
            .iter()
            .find(|m| m.kind == Kind::Para)
            .expect("a para")
            .node_id;
        let sub = ed.subtree(NodeId(para)).expect("subtree");
        assert_eq!(sub[0].id, NodeId(0), "root is local id 0");
        assert_eq!(sub[0].parent, None, "root has no parent inside the subtree");
        assert_eq!(sub[0].next_sibling, None, "root's sibling is severed");
        assert_eq!(sub[0].kind, Kind::Para);
        for (i, n) in sub.iter().enumerate() {
            assert_eq!(n.id, NodeId(i as u32), "dense local ids");
            for link in [n.parent, n.first_child, n.next_sibling]
                .into_iter()
                .flatten()
            {
                assert!(
                    (link.0 as usize) < sub.len(),
                    "link {link:?} escapes the subtree"
                );
            }
        }
        assert!(
            src[sub[0].span.clone()].starts_with("Hello"),
            "absolute span: {:?}",
            &src[sub[0].span.clone()]
        );

        // Same multiset of node kinds as the paragraph's arena subtree.
        fn arena_kinds(all: &[FlatNode], root: NodeId) -> Vec<Kind> {
            let mut out = Vec::new();
            let mut stack = vec![root];
            while let Some(id) = stack.pop() {
                let n = &all[id.0 as usize];
                out.push(n.kind.clone());
                let mut c = n.first_child;
                while let Some(cid) = c {
                    stack.push(cid);
                    c = all[cid.0 as usize].next_sibling;
                }
            }
            out
        }
        let mut want_kinds = arena_kinds(&all, NodeId(para));
        let mut got_kinds: Vec<Kind> = sub.iter().map(|n| n.kind.clone()).collect();
        // Sorted by NAME: `Kind` is deliberately not `Ord` (there is no
        // meaningful order over a vocabulary), and this only needs a canonical
        // one to compare two multisets.
        want_kinds.sort_by(|a, b| a.as_str().cmp(b.as_str()));
        got_kinds.sort_by(|a, b| a.as_str().cmp(b.as_str()));
        assert_eq!(got_kinds, want_kinds, "subtree kinds match the arena");

        // Out-of-range id is rejected.
        assert!(matches!(
            ed.subtree(NodeId(9999)),
            Err(Error::InvalidArgument)
        ));
    }

    #[test]
    fn flat_nodes_carry_table_head_and_alignment() {
        // The delimiter row (`|:-----|----:|`) is consumed by the parser and has
        // no node of its own, so `alignment` on the cells is the only way a
        // consumer can recover the column alignment from a snapshot.
        let src = "| Name | Qty |\n|:-----|----:|\n| Pear | 3 |\n";
        let mut ed = Editor::new_str(src, Format::Markdown).expect("editor");
        let nodes = ed.nodes().expect("nodes");

        let rows: Vec<_> = nodes.iter().filter(|n| n.kind == Kind::Row).collect();
        assert_eq!(rows.len(), 2, "a header row and one body row");
        assert_eq!(rows[0].head, Some(true), "first row is the header");
        assert_eq!(rows[1].head, Some(false), "second row is a body row");

        let cells: Vec<_> = nodes.iter().filter(|n| n.kind == Kind::Cell).collect();
        assert_eq!(cells.len(), 4);
        // Alignment comes from the delimiter row and applies down the column.
        assert_eq!(cells[0].alignment, Some(Alignment::Left));
        assert_eq!(cells[1].alignment, Some(Alignment::Right));
        assert_eq!(cells[2].alignment, Some(Alignment::Left));
        assert_eq!(cells[3].alignment, Some(Alignment::Right));
        // Header cells are flagged too, not just their row.
        assert_eq!(cells[0].head, Some(true));
        assert_eq!(cells[2].head, Some(false));

        // A table with no alignment spelled out reports Default — a real value,
        // distinct from the None a non-cell reports.
        let mut plain =
            Editor::new_str("| A |\n| --- |\n| b |\n", Format::Markdown).expect("editor");
        let pnodes = plain.nodes().expect("nodes");
        let pcell = pnodes
            .iter()
            .find(|n| n.kind == Kind::Cell)
            .expect("a cell");
        assert_eq!(pcell.alignment, Some(Alignment::Default));
    }

    #[test]
    fn cell_extent_reports_merged_cells_and_nothing_else() {
        let src = "<table><tr><td colspan=\"2\" rowspan=\"3\">a</td><td>b</td></tr></table>";
        let mut doc = Document::parse_str(src, Format::Html).expect("parse");
        let cells: Vec<NodeId> = doc
            .nodes()
            .expect("nodes")
            .iter()
            .filter(|n| n.kind == Kind::Cell)
            .map(|n| n.id)
            .collect();
        assert_eq!(cells.len(), 2);
        assert_eq!(doc.cell_extent(cells[0]).expect("extent"), Some((2, 3)));
        // A plain cell is one square — 1, never 0.
        assert_eq!(doc.cell_extent(cells[1]).expect("extent"), Some((1, 1)));

        // A pipe table cannot express a span at all, so every cell is (1, 1).
        let mut pipe =
            Document::parse_str("| a |\n| --- |\n| b |\n", Format::Markdown).expect("parse");
        let pipe_cell = pipe
            .nodes()
            .expect("nodes")
            .iter()
            .find(|n| n.kind == Kind::Cell)
            .expect("a cell")
            .id;
        assert_eq!(pipe.cell_extent(pipe_cell).expect("extent"), Some((1, 1)));

        // Not a cell at all: None, distinct from any extent.
        let root = NodeId(0);
        assert_eq!(pipe.cell_extent(root).expect("extent"), None);
    }

    #[test]
    fn builder_add_cell_spanning_renders_colspan_and_rowspan() {
        let mut b = Builder::new().expect("builder");
        let wide_text = b.add_text(TextKind::Str, "wide").expect("str");
        let wide = b
            .add_cell_spanning(false, Alignment::Default, 2, 3)
            .expect("cell");
        b.set_children(wide, &[wide_text]).expect("children");
        let plain_text = b.add_text(TextKind::Str, "one").expect("str");
        let plain = b.add_cell(false, Alignment::Default).expect("cell");
        b.set_children(plain, &[plain_text]).expect("children");
        let row = b.add_row(false).expect("row");
        b.set_children(row, &[wide, plain]).expect("children");
        let table = b.add(VoidKind::Table).expect("table");
        b.set_children(table, &[row]).expect("children");

        let html = String::from_utf8(b.render_html(table).expect("html")).expect("utf-8");
        assert!(
            html.contains("<td colspan=\"2\" rowspan=\"3\">wide</td>"),
            "{html}"
        );
        // `add_cell` is the one-square case: the default extent writes nothing.
        assert!(html.contains("<td>one</td>"), "{html}");

        // A zero extent is no cell anyone can lay out.
        assert!(matches!(
            b.add_cell_spanning(false, Alignment::Default, 0, 1),
            Err(Error::InvalidArgument)
        ));
    }

    #[test]
    fn editor_node_at_and_ancestors_hit_test_offsets() {
        let mut ed = Editor::new_str("# Hi\n\ntext\n", Format::Markdown).expect("editor");

        // Offset 2 is the "H" of the heading "# Hi" [0,4).
        let m = ed
            .node_at(2)
            .expect("node_at")
            .expect("a node covers offset 2");
        assert!(m.span.contains(&2));

        // The ancestor chain is root-first and ends at the deepest (== node_at).
        let chain = ed.ancestors_at(2).expect("ancestors_at");
        assert!(!chain.is_empty());
        assert_eq!(chain[0].kind, Kind::Doc);
        assert_eq!(chain.last().unwrap().node_id, m.node_id);

        // An out-of-range offset is an error; a gap covers nothing deeper than doc.
        assert_eq!(ed.node_at(999), Err(Error::InvalidArgument));
    }

    // ── range-oriented rich-text ops (P5) ───────────────────────────────────

    #[test]
    fn editor_wrap_and_toggle_inline_round_trip() {
        let mut ed = Editor::new_str("a word b\n", Format::Markdown).expect("editor");

        // Bold "word" [2,6); the Change reports the new "**word**" region.
        let c = ed.wrap_range(2, 6, InlineKind::Strong).expect("wrap");
        assert_eq!(ed.source_str().unwrap(), "a **word** b\n");
        assert_eq!(&ed.source_str().unwrap()[c.new.clone()], "**word**");

        // Toggle it off by selecting the strong node's interior [4,8).
        ed.toggle_inline(4, 8, InlineKind::Strong)
            .expect("toggle off");
        assert_eq!(ed.source_str().unwrap(), "a word b\n");

        // Toggle emphasis on when the range isn't already marked.
        ed.toggle_inline(2, 6, InlineKind::Emph).expect("toggle on");
        assert_eq!(ed.source_str().unwrap(), "a *word* b\n");
    }

    #[test]
    fn editor_inline_marks_cut_at_block_boundaries() {
        // One pair per block, not one pair straddling the blank line — which
        // would reparse as four literal asterisks and no mark.
        let mut ed = Editor::new_str("one two\n\nthree four\n", Format::Markdown)
            .expect("editor");
        let c = ed.toggle_inline(0, 19, InlineKind::Strong).expect("toggle on");
        assert_eq!(
            ed.source_str().unwrap(),
            "**one two**\n\n**three four**\n"
        );

        // One splice, so one Change spanning the lot and one undo step — the
        // whole reason the pieces are assembled before anything is written.
        assert_eq!(&ed.source_str().unwrap()[c.new.clone()], "**one two**\n\n**three four**");
        ed.undo().expect("undo");
        assert_eq!(ed.source_str().unwrap(), "one two\n\nthree four\n");

        // And the second press removes both, rather than nesting a second pair
        // around each.
        ed.toggle_inline(0, 19, InlineKind::Strong).expect("toggle on");
        ed.toggle_inline(0, 27, InlineKind::Strong).expect("toggle off");
        assert_eq!(ed.source_str().unwrap(), "one two\n\nthree four\n");

        // A range with nowhere in it to put a mark says so.
        let mut fenced = Editor::new_str("```\nx y\n```\n", Format::Markdown).expect("editor");
        assert_eq!(
            fenced.toggle_inline(4, 7, InlineKind::Strong),
            Err(Error::NotEditable)
        );
    }

    #[test]
    fn editor_inline_kind_support_is_format_specific() {
        // Markdown has no highlight/mark spelling.
        let mut md = Editor::new_str("a word b\n", Format::Markdown).expect("editor");
        assert_eq!(
            md.wrap_range(2, 6, InlineKind::Mark),
            Err(Error::UnsupportedFormat)
        );

        // Djot spells it {=…=}.
        let mut dj = Editor::new_str("a word b\n", Format::Djot).expect("editor");
        dj.wrap_range(2, 6, InlineKind::Mark).expect("djot mark");
        assert_eq!(dj.source_str().unwrap(), "a {=word=} b\n");
    }

    #[test]
    fn editor_authors_gfm_strikethrough_out_of_the_box() {
        // The extension that defaults ON, so the default editor is the one
        // that can write it — the opposite direction from `highlight` below,
        // and no flag on this side turns it off.
        assert!(Format::Markdown.supports(Gesture::ToggleInline(InlineKind::Delete)));
        let mut ed = Editor::new_str("a word b\n", Format::Markdown).expect("editor");
        ed.toggle_inline(2, 6, InlineKind::Delete).expect("strike");
        assert_eq!(ed.source_str().unwrap(), "a ~~word~~ b\n");
        ed.toggle_inline(4, 8, InlineKind::Delete).expect("unstrike");
        assert_eq!(ed.source_str().unwrap(), "a word b\n");
    }

    #[test]
    fn editor_highlight_is_authorable_with_the_extension_on() {
        let exts = MarkdownExtensions {
            highlight: true,
            ..Default::default()
        };
        // The same format and the same gesture, answered two ways: `==x==` is
        // text under default options and a mark under `highlight`, so the
        // toggle refuses in one and reverses in the other.
        assert!(!Format::Markdown.supports(Gesture::ToggleInline(InlineKind::Mark)));
        assert!(Format::Markdown.supports_with(exts, Gesture::ToggleInline(InlineKind::Mark)));

        let mut ed =
            Editor::new_ext(b"a word b\n", Format::Markdown, exts).expect("editor");
        ed.toggle_inline(2, 6, InlineKind::Mark).expect("highlight");
        assert_eq!(ed.source_str().unwrap(), "a ==word== b\n");
        ed.toggle_inline(4, 8, InlineKind::Mark).expect("unhighlight");
        assert_eq!(ed.source_str().unwrap(), "a word b\n");
    }

    #[test]
    fn editor_set_mark_color_writes_reads_and_clears_the_colour() {
        let exts = MarkdownExtensions {
            highlight: true,
            highlight_colors: true,
            ..Default::default()
        };
        assert!(Format::Markdown.supports_with(exts, Gesture::SetMarkColor));
        // The narrower gate: highlights alone do not buy a palette.
        let hi_only = MarkdownExtensions {
            highlight: true,
            ..Default::default()
        };
        assert!(!Format::Markdown.supports_with(hi_only, Gesture::SetMarkColor));
        assert!(!Format::Markdown.supports(Gesture::SetMarkColor));
        assert!(!Format::Djot.supports_with(exts, Gesture::SetMarkColor));

        let mut ed =
            Editor::new_ext("a ==word== b\n".as_bytes(), Format::Markdown, exts).expect("editor");
        ed.set_mark_color(6, Some(MarkColor::Red)).expect("colour");
        assert_eq!(ed.source_str().unwrap(), "a ==\u{1F534} word== b\n");

        // And it is queryable as the attribute it is, not as text.
        let mut doc =
            Document::parse_with(ed.source_str().unwrap().as_bytes(), Format::Markdown, exts)
                .expect("parse");
        assert_eq!(doc.query("mark[data-color=red]").expect("query").len(), 1);

        ed.set_mark_color(9, Some(MarkColor::Blue)).expect("recolour");
        assert_eq!(ed.source_str().unwrap(), "a ==\u{1F535} word== b\n");
        ed.set_mark_color(9, None).expect("clear");
        assert_eq!(ed.source_str().unwrap(), "a ==word== b\n");

        // A caret outside any highlight edits nothing.
        assert_eq!(
            ed.set_mark_color(0, Some(MarkColor::Red)),
            Err(Error::NotEditable)
        );
        assert_eq!(ed.source_str().unwrap(), "a ==word== b\n");

        // The names are the attribute values, both ways.
        for c in [
            MarkColor::Red,
            MarkColor::Orange,
            MarkColor::Yellow,
            MarkColor::Green,
            MarkColor::Blue,
            MarkColor::Purple,
            MarkColor::Brown,
        ] {
            assert_eq!(MarkColor::from_str(c.as_str()), Some(c));
        }
        assert_eq!(MarkColor::from_str("pink"), None);
    }

    #[test]
    fn editor_toggle_strips_verbatim_via_content_span() {
        let mut ed = Editor::new_str("a `code` b\n", Format::Markdown).expect("editor");
        // The verbatim node [2,8) reports content_span [3,7); toggle peels it.
        ed.toggle_inline(2, 8, InlineKind::Verbatim)
            .expect("toggle code off");
        assert_eq!(ed.source_str().unwrap(), "a code b\n");

        // A multi-backtick span peels BOTH runs via content_span, not by
        // stripping a single delimiter (which would corrupt it to "`x`").
        let mut ed2 = Editor::new_str("a ``x`` b\n", Format::Markdown).expect("editor");
        ed2.toggle_inline(2, 7, InlineKind::Verbatim)
            .expect("toggle multi off");
        assert_eq!(ed2.source_str().unwrap(), "a x b\n");
    }

    #[test]
    fn editor_set_block_switches_para_and_heading_levels() {
        let mut ed = Editor::new_str("Title\n\nbody text\n", Format::Markdown).expect("editor");

        // Paragraph -> H2 (offset 0 is inside "Title").
        ed.set_block(0, BlockKind::Heading(2)).expect("to h2");
        assert_eq!(ed.source_str().unwrap(), "## Title\n\nbody text\n");

        // H2 -> H1 (offset now inside "## Title").
        ed.set_block(3, BlockKind::Heading(1)).expect("to h1");
        assert_eq!(ed.source_str().unwrap(), "# Title\n\nbody text\n");

        // Heading -> paragraph, dropping the marker.
        ed.set_block(2, BlockKind::Paragraph).expect("to para");
        assert_eq!(ed.source_str().unwrap(), "Title\n\nbody text\n");
    }

    #[test]
    fn editor_set_block_rejects_bad_level_and_format() {
        let mut md = Editor::new_str("hi\n", Format::Markdown).expect("editor");
        assert_eq!(
            md.set_block(0, BlockKind::Heading(9)),
            Err(Error::InvalidArgument)
        );

        let mut xml = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(
            xml.set_block(1, BlockKind::Heading(1)),
            Err(Error::UnsupportedFormat)
        );
    }

    #[test]
    fn editor_toggle_block_container_round_trips() {
        let mut ed = Editor::new_str("a\n", Format::Djot).expect("editor");

        let c = ed
            .toggle_block_container(0, 1, BlockContainerKind::BlockQuote)
            .expect("quote on");
        assert_eq!(ed.source_str().unwrap(), "> a\n");
        assert_eq!(&ed.source_str().unwrap()[c.new.clone()], "> a\n");

        ed.toggle_block_container(2, 3, BlockContainerKind::BlockQuote)
            .expect("quote off");
        assert_eq!(ed.source_str().unwrap(), "a\n");
    }

    #[test]
    fn editor_toggle_block_container_nests_a_partial_selection() {
        let mut ed = Editor::new_str("> a\n>\n> b\n", Format::Djot).expect("editor");

        // Only the first paragraph is covered, so the quote is not fully
        // selected: nest rather than drag `b` out of the quote too.
        ed.toggle_block_container(2, 3, BlockContainerKind::BlockQuote)
            .expect("nest");
        assert_eq!(ed.source_str().unwrap(), "> > a\n>\n> b\n");

        // Peel the inner level back off, leaving the outer quote intact.
        ed.toggle_block_container(4, 5, BlockContainerKind::BlockQuote)
            .expect("peel");
        assert_eq!(ed.source_str().unwrap(), "> a\n>\n> b\n");
    }

    #[test]
    fn editor_toggle_block_container_numbers_and_converts_lists() {
        let mut ed = Editor::new_str("a\n\nb\n", Format::Djot).expect("editor");

        // Each covered block becomes its own numbered item.
        ed.toggle_block_container(0, 4, BlockContainerKind::OrderedList)
            .expect("ordered on");
        assert_eq!(ed.source_str().unwrap(), "1. a\n\n2. b\n");

        // The other list kind converts in place instead of nesting.
        ed.toggle_block_container(3, 9, BlockContainerKind::BulletList)
            .expect("convert");
        assert_eq!(ed.source_str().unwrap(), "- a\n\n- b\n");
    }

    #[test]
    fn editor_toggle_block_container_rejects_unspellable_format() {
        let mut xml = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(
            xml.toggle_block_container(3, 5, BlockContainerKind::BlockQuote),
            Err(Error::UnsupportedFormat)
        );
    }

    #[test]
    fn editor_insert_link_wraps_and_repoints() {
        let mut ed = Editor::new_str("a word b\n", Format::Djot).expect("editor");

        ed.insert_link(2, 6, "http://x.dev").expect("link");
        assert_eq!(ed.source_str().unwrap(), "a [word](http://x.dev) b\n");

        // A caret inside the existing link re-points it rather than nesting.
        ed.insert_link(3, 7, "http://y.dev").expect("re-point");
        assert_eq!(ed.source_str().unwrap(), "a [word](http://y.dev) b\n");
    }

    #[test]
    fn editor_insert_link_repoints_an_autolink() {
        // The regression: an autolink is a `url`/`email` node whose text IS its
        // destination. Read as ordinary text, a caret inside it spliced a whole
        // new link into the middle of the old URL —
        // `see <https<https://y.dev>://x.dev> ok`.
        for format in [Format::Markdown, Format::Djot] {
            let mut ed = Editor::new_str("see <https://x.dev> ok\n", format).expect("editor");
            ed.insert_link(10, 10, "https://y.dev").expect("re-point");
            assert_eq!(ed.source_str().unwrap(), "see <https://y.dev> ok\n");

            // Source that looks right can still parse wrong: assert the reparse.
            let nodes = ed.nodes().expect("nodes");
            let url = nodes
                .iter()
                .find(|n| n.kind == Kind::Url)
                .expect("still an autolink");
            assert_eq!(url.text.as_deref(), Some("https://y.dev"));
            assert!(!nodes.iter().any(|n| n.kind == Kind::Link));
        }
    }

    #[test]
    fn editor_insert_link_escapes_the_destination() {
        // Unescaped, the `)` would close the link early and spill `b` into the
        // paragraph as literal text.
        let mut dj = Editor::new_str("w\n", Format::Djot).expect("editor");
        dj.insert_link(0, 1, "a)b").expect("link");
        assert_eq!(dj.source_str().unwrap(), "[w](a\\)b)\n");

        // Whitespace is where the formats part ways: Markdown needs the angle
        // form (a bare space ends the destination and kills the link outright),
        // Djot must NOT use it (it would link to the literal text `<a b>`).
        let mut md = Editor::new_str("w\n", Format::Markdown).expect("editor");
        md.insert_link(0, 1, "a b").expect("link");
        assert_eq!(md.source_str().unwrap(), "[w](<a b>)\n");

        let mut dj2 = Editor::new_str("w\n", Format::Djot).expect("editor");
        dj2.insert_link(0, 1, "a b").expect("link");
        assert_eq!(dj2.source_str().unwrap(), "[w](a b)\n");
    }

    #[test]
    fn editor_insert_image_escapes_the_destination_per_format() {
        // The whole point of the op: a caller's `![](my cat.png)` is not an image
        // in Markdown, and the correct repair differs by format.
        let mut md = Editor::new_str("w\n", Format::Markdown).expect("editor");
        md.insert_image(0, 1, "my cat.png").expect("image");
        assert_eq!(md.source_str().unwrap(), "![w](<my cat.png>)\n");

        let mut dj = Editor::new_str("w\n", Format::Djot).expect("editor");
        dj.insert_image(0, 1, "my cat.png").expect("image");
        assert_eq!(dj.source_str().unwrap(), "![w](my cat.png)\n");

        // A `)` would close the image early and spill the rest as literal text.
        let mut paren = Editor::new_str("w\n", Format::Djot).expect("editor");
        paren.insert_image(0, 1, "a)b.png").expect("image");
        assert_eq!(paren.source_str().unwrap(), "![w](a\\)b.png)\n");
    }

    #[test]
    fn editor_insert_image_keeps_an_empty_alt_empty() {
        // Unlike a link, where an empty range spells an autolink or doubles the
        // destination as text — an image with no alt is ordinary.
        let mut ed = Editor::new_str("ab\n", Format::Markdown).expect("editor");
        ed.insert_image(1, 1, "cat.png").expect("image");
        assert_eq!(ed.source_str().unwrap(), "a![](cat.png)b\n");
    }

    #[test]
    fn editor_insert_image_rejects_a_newline_destination() {
        let mut ed = Editor::new_str("w\n", Format::Djot).expect("editor");
        assert_eq!(
            ed.insert_image(0, 1, "a\nb.png"),
            Err(Error::InvalidArgument)
        );

        let mut xml = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(
            xml.insert_image(3, 5, "x.png"),
            Err(Error::UnsupportedFormat)
        );
    }

    #[test]
    fn editor_insert_link_rejects_a_newline_destination() {
        let mut ed = Editor::new_str("w\n", Format::Djot).expect("editor");
        assert_eq!(ed.insert_link(0, 1, "a\nb"), Err(Error::InvalidArgument));

        let mut xml = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(xml.insert_link(3, 5, "u"), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn editor_insert_literal_keeps_typed_specials_literal() {
        for format in [Format::Markdown, Format::Djot] {
            let mut ed = Editor::new_str("z\n", format).expect("editor");
            // A `*` at a line start would open emphasis unescaped.
            ed.insert_literal(0, "*hi*").expect("literal");

            // Source that looks right can still parse wrong: assert the reparse.
            let nodes = ed.nodes().expect("nodes");
            assert!(
                !nodes
                    .iter()
                    .any(|n| n.kind == Kind::Emph || n.kind == Kind::Strong)
            );
            let text: String = nodes
                .iter()
                .filter(|n| n.kind == Kind::Str)
                .filter_map(|n| n.text.clone())
                .collect();
            assert_eq!(text, "*hi*z");
        }
    }

    #[test]
    fn editor_insert_literal_escapes_block_markers_only_at_line_start() {
        // Mid-line, a `#` opens nothing and is left as typed.
        let mut ed = Editor::new_str("az\n", Format::Markdown).expect("editor");
        ed.insert_literal(1, "# ").expect("literal");
        assert_eq!(ed.source_str().unwrap(), "a# z\n");

        // At a line start it would open a heading, so it is escaped.
        let mut ed2 = Editor::new_str("z\n", Format::Markdown).expect("editor");
        ed2.insert_literal(0, "# ").expect("literal");
        assert_eq!(ed2.source_str().unwrap(), "\\# z\n");
        assert!(
            !ed2.nodes()
                .expect("nodes")
                .iter()
                .any(|n| n.kind == Kind::Heading)
        );
    }

    #[test]
    fn editor_insert_literal_escapes_a_dollar_only_under_math() {
        // Under the math extension `$` opens a formula, so it is escaped.
        let exts = MarkdownExtensions { math: true, ..Default::default() };
        let mut ed = Editor::new_ext(b"a \n", Format::Markdown, exts).expect("editor");
        ed.insert_literal(2, "$x$ and $$y$$").expect("literal");
        assert_eq!(ed.source_str().unwrap(), "a \\$x\\$ and \\$\\$y\\$\\$\n");

        // Without it a `$` is text, and stays bare.
        let mut plain = Editor::new_str("a \n", Format::Markdown).expect("editor");
        plain.insert_literal(2, "$x$ and $$y$$").expect("literal");
        assert_eq!(plain.source_str().unwrap(), "a $x$ and $$y$$\n");
    }

    #[test]
    fn editor_insert_literal_rejects_bad_offset_and_parse_only_format() {
        let mut ed = Editor::new_str("ab\n", Format::Markdown).expect("editor");
        assert_eq!(ed.insert_literal(99, "x"), Err(Error::InvalidArgument));

        let mut xml = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(xml.insert_literal(3, "x"), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn editor_insert_line_break_splices_in_cell_br() {
        let mut ed =
            Editor::new_str("| a | b |\n| --- | --- |\n", Format::Markdown).expect("editor");
        // Caret just after `a` in the header cell.
        ed.insert_line_break(3).expect("line break");
        assert_eq!(ed.source_str().unwrap(), "| a<br> | b |\n| --- | --- |\n");
        // The break reads back as a semantic node, not raw HTML.
        let nodes = ed.nodes().expect("nodes");
        assert!(nodes.iter().any(|n| n.kind == Kind::HardBreak));
        assert!(!nodes.iter().any(|n| n.kind == Kind::RawInline));
    }

    #[test]
    fn editor_insert_line_break_rejects_off_cell_off_format_and_bad_offset() {
        // Not inside a cell → NotFound.
        let mut para = Editor::new_str("just text\n", Format::Markdown).expect("editor");
        assert_eq!(para.insert_line_break(3), Err(Error::NotFound));

        // Djot has no in-cell break spelling → UnsupportedFormat.
        let mut dj = Editor::new_str("| a | b |\n| --- | --- |\n", Format::Djot).expect("editor");
        assert_eq!(dj.insert_line_break(3), Err(Error::UnsupportedFormat));

        // Out-of-range offset → InvalidArgument.
        let mut ed =
            Editor::new_str("| a | b |\n| --- | --- |\n", Format::Markdown).expect("editor");
        assert_eq!(ed.insert_line_break(9999), Err(Error::InvalidArgument));
    }

    #[test]
    fn editor_insert_thematic_break_is_blank_separated_per_format() {
        // The blank line above is load-bearing, not cosmetic: flush against the
        // paragraph, Markdown's `---` is a setext underline and the paragraph
        // becomes an <h2>. So assert the reparsed KIND, not just the bytes.
        let mut md = Editor::new_str("a\n", Format::Markdown).expect("editor");
        md.insert_thematic_break(0).expect("rule");
        assert_eq!(md.source_str().unwrap(), "a\n\n---\n");
        let nodes = md.nodes().expect("nodes");
        assert!(nodes.iter().any(|n| n.kind == Kind::ThematicBreak));
        assert!(!nodes.iter().any(|n| n.kind == Kind::Heading));

        // Djot spells the same construct differently — the reason the spelling
        // is the library's and not the caller's.
        let mut dj = Editor::new_str("a\n", Format::Djot).expect("editor");
        dj.insert_thematic_break(0).expect("rule");
        assert_eq!(dj.source_str().unwrap(), "a\n\n* * *\n");

        let mut xml = Editor::new_str("<a>hi</a>", Format::Xml).expect("editor");
        assert_eq!(xml.insert_thematic_break(3), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn editor_insert_table_writes_an_editable_table_after_the_block() {
        let mut md = Editor::new_str("a\n", Format::Markdown).expect("editor");
        md.insert_table(0, 1, 2).expect("table");
        assert_eq!(md.source_str().unwrap(), "a\n\n|  |  |\n| --- | --- |\n|  |  |\n");
        // What was minted is what the table edits read back.
        md.table_insert_row(4, true).expect("row");
        assert_eq!(
            md.source_str().unwrap(),
            "a\n\n|  |  |\n| --- | --- |\n|  |  |\n|  |  |\n"
        );

        let mut dj = Editor::new_str("a\n", Format::Djot).expect("editor");
        dj.insert_table(0, 1, 2).expect("table");
        assert_eq!(dj.source_str().unwrap(), "a\n\n|  |  |\n|---|---|\n|  |  |\n");

        let mut md = Editor::new_str("a\n", Format::Markdown).expect("editor");
        assert_eq!(md.insert_table(0, 0, 2), Err(Error::InvalidArgument));
        assert_eq!(md.insert_table(0, 1, 0), Err(Error::InvalidArgument));
        assert_eq!(md.source_str().unwrap(), "a\n");

        let mut html = Editor::new_str("<p>ab</p>\n", Format::Html).expect("editor");
        assert_eq!(html.insert_table(4, 1, 1), Err(Error::UnsupportedFormat));
        assert!(!Format::Html.supports(Gesture::InsertTable));
        assert!(Format::Markdown.supports(Gesture::InsertTable));
    }

    #[test]
    fn editor_split_block_keeps_both_halves_the_same_kind() {
        // A list item's halves are both items — the marker is repeated, so the
        // second half doesn't fall out of the list as a paragraph.
        let mut item = Editor::new_str("- this is a list item\n", Format::Markdown).expect("editor");
        item.split_block(10).expect("split");
        assert_eq!(item.source_str().unwrap(), "- this is \n- a list item\n");
        let nodes = item.nodes().expect("nodes");
        assert_eq!(nodes.iter().filter(|n| n.kind == Kind::ListItem).count(), 2);

        // At the item's end the empty sibling IS the point — that is Enter.
        let mut tail = Editor::new_str("- a\n", Format::Markdown).expect("editor");
        tail.split_block(3).expect("split");
        assert_eq!(tail.source_str().unwrap(), "- a\n- \n");

        // A paragraph divides on a blank line instead.
        let mut para = Editor::new_str("ab\n", Format::Markdown).expect("editor");
        para.split_block(1).expect("split");
        assert_eq!(para.source_str().unwrap(), "a\n\nb\n");

        // A table has no honest caret-split: a newline mid-cell destroys it.
        let mut table =
            Editor::new_str("| a | b |\n|---|---|\n| c | d |\n", Format::Markdown).expect("editor");
        assert_eq!(table.split_block(3), Err(Error::NotEditable));

        let mut empty = Editor::new_str("", Format::Markdown).expect("editor");
        assert_eq!(empty.split_block(0), Err(Error::NotFound));
    }

    #[test]
    fn editor_join_blocks_carries_the_markup_that_has_to_travel() {
        // The Markdown `<div>` case, which is the whole reason this is a
        // gesture: `below` joins the div's last paragraph, and the `</div>` is
        // carried past the text that came in rather than being left above it.
        let src = "above\n\n<div class=\"center\">\n\nhello\n\n</div>\n\nbelow\n";
        let exts = MarkdownExtensions {
            html_elements: true,
            ..Default::default()
        };
        let mut into = Editor::new_ext(src.as_bytes(), Format::Markdown, exts).expect("editor");
        into.join_blocks(44).expect("join");
        assert_eq!(
            into.source_str().unwrap(),
            "above\n\n<div class=\"center\">\n\nhello\nbelow\n\n</div>\n"
        );
        let nodes = into.nodes().expect("nodes");
        assert_eq!(nodes.iter().filter(|n| n.kind == Kind::Para).count(), 2);

        // Out of the div instead: B leaves it, so the div's own closers go with
        // B's markup — and the paragraph's attributes go with them, because the
        // joined text is the other block's.
        let mut out_of = Editor::new_ext(src.as_bytes(), Format::Markdown, exts).expect("editor");
        out_of.join_blocks(29).expect("join");
        assert_eq!(out_of.source_str().unwrap(), "above\nhello\n\nbelow\n");

        // A list item's continuation is spaces, not its marker: two items in,
        // one out.
        let mut item = Editor::new_str("- a\n- b\n", Format::Markdown).expect("editor");
        item.join_blocks(6).expect("join");
        assert_eq!(item.source_str().unwrap(), "- a\n  b\n");
        let nodes = item.nodes().expect("nodes");
        assert_eq!(nodes.iter().filter(|n| n.kind == Kind::ListItem).count(), 1);

        // The document's first block has nothing above it.
        let mut first = Editor::new_str("above\n", Format::Markdown).expect("editor");
        assert_eq!(first.join_blocks(0), Err(Error::NotFound));
    }

    #[test]
    fn editor_move_block_spells_the_destination_prefixes() {
        // Out of a quote: the `> ` and the `>` separator line go with the
        // block, and it arrives blank-separated at the top level.
        let mut out = Editor::new_str("> a\n>\n> y\n\nb\n", Format::Markdown).expect("editor");
        let change = out.move_block(8, 13).expect("move");
        assert_eq!(out.source_str().unwrap(), "> a\n\nb\n\ny\n");
        assert_eq!(change.old.start, 4);

        // Into a list item's tail: the continuation indent and the blank line
        // that makes it a second block of the item.
        let mut tail = Editor::new_str("- x\n\ny\n", Format::Markdown).expect("editor");
        tail.move_block(5, 3).expect("move");
        assert_eq!(tail.source_str().unwrap(), "- x\n\n  y\n");
        let nodes = tail.nodes().expect("nodes");
        assert_eq!(nodes.iter().filter(|n| n.kind == Kind::ListItem).count(), 1);

        // A bullet's text is the bullet: the item moves whole, and between
        // two items of a tight list no blank is written.
        let mut items = Editor::new_str("- a\n  - b\n- c\n", Format::Markdown).expect("editor");
        items.move_block(12, 0).expect("move");
        assert_eq!(items.source_str().unwrap(), "- c\n- a\n  - b\n");

        // Where it already is moves nothing; inside a fence is no boundary.
        let mut same = Editor::new_str("a\n\n```\nx\n```\n", Format::Markdown).expect("editor");
        assert_eq!(same.move_block(0, 1), Err(Error::InvalidArgument));
        assert_eq!(same.move_block(0, 8), Err(Error::NotEditable));
        assert_eq!(same.move_block(2, 0), Err(Error::NotFound));

        // XML has no blocks a caret could name.
        let mut xml = Editor::new_str("<r><a/><b/></r>", Format::Xml).expect("editor");
        assert_eq!(xml.move_block(3, 11), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn editor_join_blocks_is_spelled_in_html_where_the_split_is_not() {
        // The pair that motivates the separate gate. A blank line between two
        // `<p>`s is not what separates them, so the split refuses; a newline
        // inside one is exactly the break the join needs, and the reparse hands
        // back the single paragraph the gesture claims to have made.
        let mut ed =
            Editor::new_str("<p>a</p>\n<p class=\"x\">b</p>\n", Format::Html).expect("editor");
        assert_eq!(ed.split_block(4), Err(Error::UnsupportedFormat));
        assert!(Format::Html.supports(Gesture::JoinBlocks));
        ed.join_blocks(22).expect("join");
        assert_eq!(ed.source_str().unwrap(), "<p>a\nb</p>\n");
        let nodes = ed.nodes().expect("nodes");
        assert_eq!(nodes.iter().filter(|n| n.kind == Kind::Para).count(), 1);

        // XML spells nothing at all, so there the refusal is the format's.
        let mut xml = Editor::new_str("<r>ab</r>", Format::Xml).expect("editor");
        assert_eq!(xml.join_blocks(4), Err(Error::UnsupportedFormat));
    }

    #[test]
    fn editor_toggle_code_block_round_trips_and_measures_the_fence() {
        let mut ed = Editor::new_str("a\n", Format::Markdown).expect("editor");
        ed.toggle_code_block(0, 1, Some("zig")).expect("fence");
        assert_eq!(ed.source_str().unwrap(), "```zig\na\n```\n");
        let nodes = ed.nodes().expect("nodes");
        assert!(nodes.iter().any(|n| n.kind == Kind::CodeBlock));

        ed.toggle_code_block(0, 0, None).expect("unfence");
        assert_eq!(ed.source_str().unwrap(), "a\n");

        // Three backticks in the body would close a three-backtick fence, so the
        // fence is measured against the body rather than fixed.
        let mut runs = Editor::new_str("a ``` b\n", Format::Markdown).expect("editor");
        runs.toggle_code_block(0, 7, None).expect("fence");
        assert_eq!(runs.source_str().unwrap(), "````\na ``` b\n````\n");
    }

    #[test]
    fn editor_toggle_code_block_refuses_inside_a_list_item() {
        // A fence at column zero here would pull the item's `- ` into the code
        // body and the item would stop being an item.
        let mut ed = Editor::new_str("- a\n- b\n", Format::Markdown).expect("editor");
        assert_eq!(ed.toggle_code_block(2, 3, None), Err(Error::NotEditable));
        assert_eq!(ed.source_str().unwrap(), "- a\n- b\n");
    }

    #[test]
    fn editor_set_code_language_retags_clears_and_refuses() {
        let mut ed = Editor::new_str("```zig\na\n```\n", Format::Markdown).expect("editor");
        ed.set_code_language(0, Some("rust")).expect("retag");
        assert_eq!(ed.source_str().unwrap(), "```rust\na\n```\n");

        // `None` clears the info string; `Some("")` writes the same bytes but is
        // a different request.
        ed.set_code_language(0, None).expect("clear");
        assert_eq!(ed.source_str().unwrap(), "```\na\n```\n");
        ed.set_code_language(0, Some("")).expect("empty");
        assert_eq!(ed.source_str().unwrap(), "```\na\n```\n");

        // Markdown's info string ends at whitespace, so a space would come back
        // truncated — refused rather than silently clipped.
        assert_eq!(
            ed.set_code_language(0, Some("a b")),
            Err(Error::InvalidArgument)
        );
        // Djot's runs to the end of the line, so the same string is fine there.
        let mut dj = Editor::new_str("```\na\n```\n", Format::Djot).expect("editor");
        dj.set_code_language(0, Some("a b"))
            .expect("djot info string");
        assert_eq!(dj.source_str().unwrap(), "```a b\na\n```\n");

        let mut para = Editor::new_str("x\n", Format::Markdown).expect("editor");
        assert_eq!(para.set_code_language(0, Some("zig")), Err(Error::NotFound));
    }

    #[test]
    fn editor_task_checkbox_gestures() {
        let mut ed = Editor::new_str("- a\n", Format::Markdown).expect("editor");

        // The box is added by one gesture and ticked by another — adding
        // converts the item's kind, ticking only changes what the box holds.
        ed.toggle_task_item(2).expect("add box");
        assert_eq!(ed.source_str().unwrap(), "- [ ] a\n");
        assert!(
            ed.nodes()
                .unwrap()
                .iter()
                .any(|n| n.kind == Kind::TaskListItem)
        );

        ed.set_task_checked(6, true).expect("tick");
        assert_eq!(ed.source_str().unwrap(), "- [x] a\n");
        // Already checked: a no-op that still succeeds and moves nothing.
        ed.set_task_checked(6, true).expect("no-op");
        assert_eq!(ed.source_str().unwrap(), "- [x] a\n");

        ed.toggle_task_checked(6).expect("flip");
        assert_eq!(ed.source_str().unwrap(), "- [ ] a\n");

        ed.toggle_task_item(6).expect("remove box");
        assert_eq!(ed.source_str().unwrap(), "- a\n");

        // A plain bullet has no box to tick; `toggle_task_item` is how a caller
        // asks for one.
        assert_eq!(ed.set_task_checked(2, true), Err(Error::NotEditable));
        // And a caret in no list item has no item at all.
        let mut para = Editor::new_str("a\n", Format::Markdown).expect("editor");
        assert_eq!(para.toggle_task_item(0), Err(Error::NotFound));
    }

    #[test]
    fn editor_insert_footnote_writes_both_halves_as_one_edit() {
        for format in [Format::Markdown, Format::Djot] {
            let mut ed = Editor::new_str("see\n", format).expect("editor");
            ed.insert_footnote(3, "a").expect("footnote");
            assert_eq!(ed.source_str().unwrap(), "see[^a]\n\n[^a]: \n");

            // Half a footnote is not a footnote, so assert both nodes exist.
            let nodes = ed.nodes().expect("nodes");
            assert!(nodes.iter().any(|n| n.kind == Kind::FootnoteReference));
            assert!(nodes.iter().any(|n| n.kind == Kind::Footnote));

            // One edit, so one undo takes both halves back.
            ed.undo().expect("undo");
            assert_eq!(ed.source_str().unwrap(), "see\n");
        }
    }

    #[test]
    fn editor_insert_footnote_reuses_an_existing_definition() {
        let mut ed = Editor::new_str("see\n", Format::Markdown).expect("editor");
        ed.insert_footnote(3, "a").expect("first");
        ed.insert_footnote(7, "a").expect("second reference");
        assert_eq!(ed.source_str().unwrap(), "see[^a][^a]\n\n[^a]: \n");
        let defs = ed
            .nodes()
            .unwrap()
            .iter()
            .filter(|n| n.kind == Kind::Footnote)
            .count();
        assert_eq!(defs, 1);

        assert_eq!(ed.insert_footnote(3, ""), Err(Error::InvalidArgument));
        assert_eq!(ed.insert_footnote(3, "a]b"), Err(Error::InvalidArgument));
    }

    #[test]
    fn editor_undo_redo_round_trip() {
        let mut ed = Editor::new_str("hello\n", Format::Markdown).expect("editor");
        ed.edit_range(5, 5, "!").expect("edit");
        assert_eq!(ed.source_str().unwrap(), "hello!\n");

        let change = ed.undo().expect("undo ok").expect("something to undo");
        assert_eq!(ed.source_str().unwrap(), "hello\n");
        assert_eq!(change.new.end, 5);
        assert!(ed.undo().expect("undo ok").is_none(), "history exhausted");

        ed.redo().expect("redo ok").expect("something to redo");
        assert_eq!(ed.source_str().unwrap(), "hello!\n");
    }

    #[test]
    fn editor_coalesce_folds_a_run() {
        let mut ed = Editor::new_str("\n", Format::Markdown).expect("editor");
        ed.edit_range(0, 0, "a").expect("edit");
        ed.edit_range(1, 1, "b").expect("edit");
        ed.coalesce_last_undo().expect("coalesce");
        assert_eq!(ed.source_str().unwrap(), "ab\n");
        // One undo removes the whole coalesced run.
        ed.undo().expect("undo ok").expect("something to undo");
        assert_eq!(ed.source_str().unwrap(), "\n");
        assert!(ed.undo().expect("undo ok").is_none());
    }

    #[test]
    fn editor_revision_bumps_per_successful_mutation() {
        let mut ed = Editor::new_str("x\n", Format::Markdown).expect("editor");
        assert_eq!(ed.revision(), 0);
        ed.edit_range(1, 1, "y").expect("edit");
        assert_eq!(ed.revision(), 1);

        // A reparse-breaking edit is rolled back and must not bump the revision.
        let mut xml = Editor::new_str("<a>ok</a>", Format::Xml).expect("editor");
        assert_eq!(xml.revision(), 0);
        assert!(xml.replace_content("0", "<b>").is_err());
        assert_eq!(xml.revision(), 0);

        // undo and redo are mutations too.
        ed.undo().expect("undo ok").expect("something to undo");
        assert_eq!(ed.revision(), 2);
        ed.redo().expect("redo ok").expect("something to redo");
        assert_eq!(ed.revision(), 3);
    }

    #[test]
    fn editor_dirty_range_tracks_and_clears() {
        let mut ed = Editor::new_str("abcdefgh\n", Format::Markdown).expect("editor");
        // Clean to start.
        assert_eq!(ed.dirty_range(), None);

        // One insertion of two bytes at offset 2 dirties exactly [2, 4).
        ed.edit_range(2, 2, "XY").expect("edit");
        assert_eq!(ed.dirty_range(), Some(2..4));

        // A second, disjoint edit near the end accumulates conservatively: the
        // reported range is a superset covering both edits.
        ed.edit_range(9, 9, "Z").expect("edit"); // source is now "abXYcdefgZh\n"
        let d = ed.dirty_range().expect("dirty");
        assert!(
            d.start <= 2 && d.end >= 10,
            "range {d:?} must cover both edits"
        );

        // clear_dirty acknowledges without moving the revision.
        let rev = ed.revision();
        ed.clear_dirty();
        assert_eq!(ed.dirty_range(), None);
        assert_eq!(ed.revision(), rev);

        // Post-clear, only new mutations show up — and undo counts as one.
        ed.undo().expect("undo ok").expect("something to undo");
        assert!(ed.dirty_range().is_some());
    }

    #[test]
    fn editor_caret_blob_follows_undo_and_redo() {
        let mut ed = Editor::new_str("hello\n", Format::Markdown).expect("editor");
        assert!(ed.caret_blob().unwrap().is_empty());

        // Set the pre-edit caret, then edit: the retired undo step captures it.
        ed.set_caret_blob(b"before").expect("set caret");
        ed.edit_range(5, 5, "!").expect("edit");
        // A fresh state starts caret-less until the host sets one.
        assert!(ed.caret_blob().unwrap().is_empty());
        ed.set_caret_blob(b"after").expect("set caret");

        // Undo restores the pre-edit source AND the pre-edit caret.
        ed.undo().expect("undo ok").expect("something to undo");
        assert_eq!(ed.source_str().unwrap(), "hello\n");
        assert_eq!(ed.caret_blob().unwrap(), b"before");

        // Redo restores the post-edit source AND the post-edit caret.
        ed.redo().expect("redo ok").expect("something to redo");
        assert_eq!(ed.source_str().unwrap(), "hello!\n");
        assert_eq!(ed.caret_blob().unwrap(), b"after");
    }

    #[test]
    fn editor_coalesced_run_keeps_the_pre_run_caret() {
        let mut ed = Editor::new_str("\n", Format::Markdown).expect("editor");
        ed.set_caret_blob(b"c0").expect("set caret");
        ed.edit_range(0, 0, "a").expect("edit");
        ed.set_caret_blob(b"c1").expect("set caret");
        ed.edit_range(1, 1, "b").expect("edit");
        ed.coalesce_last_undo().expect("coalesce");
        ed.set_caret_blob(b"c2").expect("set caret");

        // One undo folds the run and restores the caret from before it began.
        ed.undo().expect("undo ok").expect("something to undo");
        assert_eq!(ed.source_str().unwrap(), "\n");
        assert_eq!(ed.caret_blob().unwrap(), b"c0");
    }

    #[test]
    fn editor_renumber_ordered_lists_fixes_a_stale_sequence() {
        let mut ed = Editor::new_str("1. a\n2. x\n2. b\n3. c\n", Format::Markdown).expect("editor");
        ed.renumber_ordered_lists(0).expect("renumber ok");
        assert_eq!(ed.source_str().unwrap(), "1. a\n2. x\n3. b\n4. c\n");
    }

    #[test]
    fn editor_renumber_ordered_lists_leaves_djot_prose_alone() {
        // Djot reads `   2. b` as text inside item `a`; Markdown reads the same
        // bytes as a nested item. The author's digit survives in the one case.
        let src = "1. a\n   2. b\n2. c\n";
        let mut dj = Editor::new_str(src, Format::Djot).expect("editor");
        dj.renumber_ordered_lists(0).expect("renumber ok");
        assert_eq!(dj.source_str().unwrap(), src);

        let mut md = Editor::new_str(src, Format::Markdown).expect("editor");
        md.renumber_ordered_lists(0).expect("renumber ok");
        assert_eq!(md.source_str().unwrap(), "1. a\n   1. b\n2. c\n");
    }

    #[test]
    fn editor_renumber_ordered_lists_off_a_list_is_not_found() {
        let mut ed = Editor::new_str("a paragraph\n", Format::Markdown).expect("editor");
        assert!(matches!(ed.renumber_ordered_lists(2), Err(Error::NotFound)));
    }

    #[test]
    fn editor_table_insert_row_and_set_alignment() {
        let src = "| a | b |\n| --- | --- |\n| 1 | 2 |\n";
        let mut ed = Editor::new_str(src, Format::Markdown).expect("editor");
        ed.table_insert_row(24, true).expect("insert row"); // caret in body `1`
        assert_eq!(
            ed.source_str().unwrap(),
            "| a | b |\n| --- | --- |\n| 1 | 2 |\n|  |  |\n"
        );
        ed.table_set_alignment(6, Alignment::Center).expect("align"); // column `b`
        assert!(ed.source_str().unwrap().contains("| --- | :---: |"));
    }

    #[test]
    fn editor_table_edit_off_a_table_is_not_found() {
        let mut ed = Editor::new_str("nope\n", Format::Markdown).expect("editor");
        assert!(matches!(ed.table_delete_row(2), Err(Error::NotFound)));
    }

    #[test]
    fn editor_set_block_converts_setext_heading() {
        // A setext heading rebuilt from its content_span collapses the underline.
        let mut ed = Editor::new_str("Title\n=====\n\nbody\n", Format::Markdown).expect("editor");
        ed.set_block(0, BlockKind::Heading(1))
            .expect("setext to atx");
        assert_eq!(ed.source_str().unwrap(), "# Title\n\nbody\n");
    }

    #[test]
    fn editor_moves_a_node_next_to_another_in_one_step() {
        let mut ed = Editor::new_str("<svg>\n  <rect/>\n  <circle/>\n</svg>\n", Format::Xml)
            .expect("editor");
        ed.move_after("element[name=\"rect\"]", "element[name=\"circle\"]")
            .expect("after");
        assert_eq!(
            ed.source_str().unwrap(),
            "<svg>\n  <circle/>\n  <rect/>\n</svg>\n"
        );
        ed.move_before("element[name=\"rect\"]", "element[name=\"circle\"]")
            .expect("before");
        assert_eq!(
            ed.source_str().unwrap(),
            "<svg>\n  <rect/>\n  <circle/>\n</svg>\n"
        );
        // One undo step per move.
        ed.undo().expect("undo");
        assert_eq!(
            ed.source_str().unwrap(),
            "<svg>\n  <circle/>\n  <rect/>\n</svg>\n"
        );
        assert_eq!(
            ed.move_after("element[name=\"rect\"]", "element[name=\"svg\"]"),
            Err(Error::InvalidArgument)
        );
        assert_eq!(
            ed.move_after("element[name=\"rect\"]", "element[name=\"path\"]"),
            Err(Error::NotFound)
        );
        // Markdown's blank-line separator travels the same way.
        let mut md = Editor::new_str("A\n\nB\n\nC\n", Format::Markdown).expect("editor");
        md.move_after("1", "2").expect("after");
        assert_eq!(md.source_str().unwrap(), "A\n\nC\n\nB\n");
    }

    #[test]
    fn editor_unwrap_and_smart_delete() {
        let mut ed = Editor::new_str("<r><box><b/><c/></box></r>", Format::Xml).expect("editor");
        ed.unwrap_node("0.0").expect("unwrap"); // <box>
        assert_eq!(ed.source_str().expect("source"), "<r><b/><c/></r>");

        let mut md = Editor::new_str("A\n\nB\n\nC\n", Format::Markdown).expect("editor");
        md.delete_smart("1").expect("delete_smart"); // the "B" paragraph
        assert_eq!(md.source_str().expect("source"), "A\n\nC\n");
    }

    #[test]
    fn editor_directives_require_the_extension_flag() {
        let src = ":::vis{.public}\nhi\n:::\n";
        // Without the flag, the colon-fence lines are plain paragraph text —
        // no directive node.
        let mut plain = Editor::new_str(src, Format::Markdown).expect("editor");
        assert_eq!(plain.query("directive").expect("query").len(), 0);
        // With it enabled, the container directive is recognized.
        let mut ext = Editor::new_ext(
            src.as_bytes(),
            Format::Markdown,
            MarkdownExtensions {
                directives: true,
                ..Default::default()
            },
        )
        .expect("editor");
        assert_eq!(ext.query("directive").expect("query").len(), 1);
    }

    #[test]
    fn editor_set_node_attrs_rewrites_an_xml_tag_by_id_and_nothing_else() {
        assert!(Format::Xml.supports(Gesture::SetNodeAttrs));
        assert!(!Format::Xml.is_authorable());
        assert!(!Format::Html.supports(Gesture::SetNodeAttrs));
        assert!(!Format::Djot.supports(Gesture::SetNodeAttrs));

        let src = "<svg>\n  <g id=\"a\">\n    <rect x=\"1\" y=\"2\"/>\n  </g>\n</svg>\n";
        let mut ed = Editor::new_str(src, Format::Xml).expect("editor");
        let rect = |ed: &mut Editor| {
            ed.nodes()
                .expect("nodes")
                .into_iter()
                .find(|n| n.name.as_deref() == Some("rect"))
                .expect("a rect")
                .id
        };
        let id = rect(&mut ed);
        let change = ed
            .set_node_attrs(
                id,
                &[("x", Some("10")), ("y", Some("2")), ("fill", Some("#f00"))],
            )
            .expect("set");
        assert_eq!(
            ed.source_str().unwrap(),
            "<svg>\n  <g id=\"a\">\n    <rect x=\"10\" y=\"2\" fill=\"#f00\"/>\n  </g>\n</svg>\n"
        );
        // The change is the tag's interior alone: the `<g>` around it and the
        // whitespace runs are not re-printed.
        assert_eq!(change.old, 28..40);
        assert_eq!(change.new, 28..53);
        // Ids are the current tree's: read them again after an edit.
        let id = rect(&mut ed);
        assert_eq!(
            ed.nodes()
                .unwrap()
                .iter()
                .find(|n| n.id == id)
                .unwrap()
                .attrs,
            vec![
                ("x".to_string(), Some("10".to_string())),
                ("y".to_string(), Some("2".to_string())),
                ("fill".to_string(), Some("#f00".to_string())),
            ]
        );
        ed.set_node_attrs(id, &[]).expect("clear");
        assert_eq!(
            ed.source_str().unwrap(),
            "<svg>\n  <g id=\"a\">\n    <rect/>\n  </g>\n</svg>\n"
        );
        // A text run is no element; an id past the tree is no node; a bare
        // attribute is one no format reads back; and a prose format refuses
        // before looking.
        let text = ed
            .nodes()
            .unwrap()
            .into_iter()
            .find(|n| n.kind == Kind::Str)
            .expect("a text run")
            .id;
        assert_eq!(
            ed.set_node_attrs(text, &[("a", Some("b"))]),
            Err(Error::NotEditable)
        );
        let past = NodeId(ed.nodes().unwrap().len() as u32 + 5);
        assert_eq!(
            ed.set_node_attrs(past, &[("a", Some("b"))]),
            Err(Error::InvalidArgument)
        );
        assert_eq!(
            ed.set_node_attrs(id, &[("hidden", None)]),
            Err(Error::InvalidArgument)
        );
        let mut md = Editor::new_str("hello\n", Format::Markdown).expect("editor");
        assert_eq!(
            md.set_node_attrs(NodeId(0), &[("a", Some("b"))]),
            Err(Error::UnsupportedFormat)
        );
    }

    #[test]
    fn editor_set_block_attrs_spells_per_format_and_replaces_rather_than_merging() {
        // djot: the line before the block, rewritten in place; the block's
        // bytes are never touched.
        let mut dj = Editor::new_str("hello _em_\n", Format::Djot).expect("editor");
        dj.set_block_attrs(0, &[("class", Some("center"))]).expect("class");
        assert_eq!(dj.source_str().unwrap(), "{.center}\nhello _em_\n");
        dj.set_block_attrs(12, &[("data-size", Some("large"))]).expect("size");
        assert_eq!(dj.source_str().unwrap(), "{data-size=\"large\"}\nhello _em_\n");
        dj.set_block_attrs(22, &[]).expect("clear");
        assert_eq!(dj.source_str().unwrap(), "hello _em_\n");

        // HTML: the tag; AsciiDoc: its attribute line.
        let mut html = Editor::new_str("<p>a</p>\n", Format::Html).expect("editor");
        html.set_block_attrs(4, &[("class", Some("c"))]).expect("class");
        assert_eq!(html.source_str().unwrap(), "<p class=\"c\">a</p>\n");
        let mut adoc = Editor::new_str("hello\n", Format::Asciidoc).expect("editor");
        adoc.set_block_attrs(0, &[("class", Some("c"))]).expect("class");
        assert_eq!(adoc.source_str().unwrap(), "[.c]\nhello\n");

        // Markdown: refused without the flag; a div with it, rewritten rather
        // than nested on a second call, unwrapped by an empty list.
        assert!(!Format::Markdown.supports(Gesture::SetBlockAttrs));
        let exts = MarkdownExtensions {
            html_elements: true,
            ..Default::default()
        };
        assert!(Format::Markdown.supports_with(exts, Gesture::SetBlockAttrs));
        let mut plain = Editor::new_str("hello\n", Format::Markdown).expect("editor");
        assert_eq!(
            plain.set_block_attrs(0, &[("class", Some("c"))]),
            Err(Error::UnsupportedFormat)
        );
        let mut md = Editor::new_ext(b"hello\n", Format::Markdown, exts).expect("editor");
        md.set_block_attrs(0, &[("class", Some("c"))]).expect("class");
        assert_eq!(md.source_str().unwrap(), "<div class=\"c\">\n\nhello\n\n</div>\n");
        md.set_block_attrs(20, &[("class", Some("d"))]).expect("reclass");
        assert_eq!(md.source_str().unwrap(), "<div class=\"d\">\n\nhello\n\n</div>\n");
        md.set_block_attrs(20, &[]).expect("clear");
        assert_eq!(md.source_str().unwrap(), "hello\n");

        // An attribute no format reads back is refused before anything is
        // written.
        assert_eq!(
            dj.set_block_attrs(0, &[("hidden", None)]),
            Err(Error::InvalidArgument)
        );
        assert_eq!(
            dj.set_block_attrs(0, &[("a b", Some("x"))]),
            Err(Error::InvalidArgument)
        );
        assert_eq!(dj.source_str().unwrap(), "hello _em_\n");
    }

    #[test]
    fn editor_wrap_range_attrs_spells_a_span_and_re_styles_rather_than_nesting() {
        let mut dj = Editor::new_str("a big b\n", Format::Djot).expect("editor");
        dj.wrap_range_attrs(2, 5, &[("class", Some("large"))]).expect("wrap");
        assert_eq!(dj.source_str().unwrap(), "a [big]{.large} b\n");
        dj.wrap_range_attrs(3, 6, &[("class", Some("small"))]).expect("re-style");
        assert_eq!(dj.source_str().unwrap(), "a [big]{.small} b\n");
        dj.wrap_range_attrs(3, 6, &[]).expect("unwrap");
        assert_eq!(dj.source_str().unwrap(), "a big b\n");

        let mut html = Editor::new_str("<p>a big b</p>\n", Format::Html).expect("editor");
        html.wrap_range_attrs(5, 8, &[("class", Some("large"))]).expect("wrap");
        assert_eq!(html.source_str().unwrap(), "<p>a <span class=\"large\">big</span> b</p>\n");

        // Markdown reads the span back only under `html_elements`; AsciiDoc
        // has no spelling that keeps every key.
        assert!(!Format::Markdown.supports(Gesture::WrapRangeAttrs));
        assert!(!Format::Asciidoc.supports(Gesture::WrapRangeAttrs));
        let exts = MarkdownExtensions {
            html_elements: true,
            ..Default::default()
        };
        assert!(Format::Markdown.supports_with(exts, Gesture::WrapRangeAttrs));
        let mut md = Editor::new_ext(b"a big b\n", Format::Markdown, exts).expect("editor");
        md.wrap_range_attrs(2, 5, &[("class", Some("large"))]).expect("wrap");
        assert_eq!(md.source_str().unwrap(), "a <span class=\"large\">big</span> b\n");
        let mut plain = Editor::new_str("a big b\n", Format::Markdown).expect("editor");
        assert_eq!(
            plain.wrap_range_attrs(2, 5, &[("class", Some("large"))]),
            Err(Error::UnsupportedFormat)
        );
    }

    #[test]
    fn editor_insert_directive_writes_a_directive_the_reparse_reads_back() {
        let exts = MarkdownExtensions {
            directives: true,
            ..Default::default()
        };
        let mut md = Editor::new_ext(b"a\n\nb\n", Format::Markdown, exts).expect("editor");
        md.insert_directive(0, "page-break", None, &[])
            .expect("directive");
        assert_eq!(md.source_str().unwrap(), "a\n\n::page-break\n\nb\n");
        // A directive to the parser, not a paragraph that starts with colons.
        assert_eq!(md.query("directive").expect("query").len(), 1);

        // A label and an attribute, in the serializer's own spelling — the
        // value is quoted because that is what the Markdown serializer writes.
        let mut em = Editor::new_ext(b"a\n", Format::Markdown, exts).expect("editor");
        em.insert_directive(0, "embed", Some("Contents"), &[("src", Some("x.html"))])
            .expect("directive");
        assert_eq!(
            em.source_str().unwrap(),
            "a\n\n::embed[Contents]{src=\"x.html\"}\n"
        );
        assert_eq!(em.query("directive").expect("query").len(), 1);

        // Djot's div is anonymous, so its spelling is an empty `:::` fence
        // carrying the name — which is why the gate asks about the NAME
        // surviving rather than about the syntax.
        let mut dj = Editor::new_str("a\n", Format::Djot).expect("editor");
        dj.insert_directive(0, "page-break", None, &[])
            .expect("directive");
        assert_eq!(dj.source_str().unwrap(), "a\n\n::: page-break\n:::\n");

        // `None` is no label and `Some("")` is an empty one — two different
        // documents, which is the whole reason the parameter is an `Option`
        // rather than a `&str`.
        let mut none = Editor::new_ext(b"", Format::Markdown, exts).expect("editor");
        none.insert_directive(0, "x", None, &[]).expect("directive");
        assert_eq!(none.source_str().unwrap(), "::x\n");
        let mut empty = Editor::new_ext(b"", Format::Markdown, exts).expect("editor");
        empty
            .insert_directive(0, "x", Some(""), &[])
            .expect("directive");
        assert_eq!(empty.source_str().unwrap(), "::x[]\n");
    }

    #[test]
    fn editor_insert_directive_needs_the_extension_it_will_be_read_back_with() {
        // Without the flag `::page-break` is a paragraph of colons, so the
        // gesture refuses rather than minting bytes one press cannot undo.
        let mut plain = Editor::new_str("a\n", Format::Markdown).expect("editor");
        assert_eq!(
            plain.insert_directive(0, "page-break", None, &[]),
            Err(Error::UnsupportedFormat)
        );
        assert_eq!(plain.source_str().unwrap(), "a\n");

        assert!(!Format::Markdown.supports(Gesture::InsertDirective));
        assert!(Format::Markdown.supports_with(
            MarkdownExtensions {
                directives: true,
                ..Default::default()
            },
            Gesture::InsertDirective
        ));
        // Djot needs no extension; XML spells nothing at all.
        assert!(Format::Djot.supports(Gesture::InsertDirective));
        assert!(!Format::Xml.supports(Gesture::InsertDirective));

        // An empty name is the caller's error, not a nameless directive.
        let mut ext = Editor::new_ext(
            b"a\n",
            Format::Markdown,
            MarkdownExtensions {
                directives: true,
                ..Default::default()
            },
        )
        .expect("editor");
        assert_eq!(
            ext.insert_directive(0, "", None, &[]),
            Err(Error::InvalidArgument)
        );
        assert_eq!(
            ext.insert_directive(0, "a\nb", None, &[]),
            Err(Error::InvalidArgument)
        );
        // A name goes where a delimiter would otherwise be, so the grammar is
        // checked rather than left to the serializer: `::a b` would reparse as
        // a paragraph holding an inline directive named `a`.
        assert_eq!(
            ext.insert_directive(0, "a b", None, &[]),
            Err(Error::InvalidArgument)
        );
        // And a bracket in the label closes the `[…]` early.
        assert_eq!(
            ext.insert_directive(0, "page-break", Some("]"), &[]),
            Err(Error::InvalidArgument)
        );
        assert_eq!(ext.source_str().unwrap(), "a\n");
    }

    #[test]
    fn document_html_elements_make_embedded_img_queryable() {
        let src = "text <img src=\"a.png\" alt=\"x\"> more\n";
        // Without the flag, the `<img>` is opaque raw HTML — no `image` node.
        let mut plain = Document::parse_str(src, Format::Markdown).expect("parse");
        assert_eq!(plain.query("image").expect("query").len(), 0);
        // With it enabled on the read path, the promoted image is queryable.
        let mut ext = Document::parse_str_with(
            src,
            Format::Markdown,
            MarkdownExtensions {
                html_elements: true,
                ..Default::default()
            },
        )
        .expect("parse");
        let images = ext.query("image").expect("query");
        assert_eq!(images.len(), 1);
        assert_eq!(images[0].kind, Kind::Image);
    }

    #[test]
    fn editor_filter_public_audience_view() {
        let src = "# Archive\n\n:::vis{.public}\nPublic.\n:::\n\n:::vis{.family}\nPrivate.\n:::\n";
        let mut ed = Editor::new_ext(
            src.as_bytes(),
            Format::Markdown,
            MarkdownExtensions {
                directives: true,
                ..Default::default()
            },
        )
        .expect("editor");
        // Drop every vis block except the public one, then unwrap it.
        ed.filter(
            "directive[name=vis]",
            Some("directive[class~=public]"),
            true,
        )
        .expect("filter");
        assert_eq!(ed.source_str().expect("source"), "# Archive\n\nPublic.\n");
    }

    #[test]
    fn editor_filter_rejects_a_malformed_selector() {
        let mut ed = Editor::new_str("hi\n", Format::Markdown).expect("editor");
        assert_eq!(
            ed.filter("list >", None, false),
            Err(Error::InvalidArgument)
        );
    }

    #[test]
    fn builder_builds_and_renders_a_document() {
        let mut b = Builder::new().expect("builder");

        // # Title\n\nhello *world*
        let title = b.add_text(TextKind::Str, "Title").unwrap();
        let heading = b.add_heading(1).unwrap();
        b.set_children(heading, &[title]).unwrap();

        let hello = b.add_text(TextKind::Str, "hello ").unwrap();
        let world = b.add_text(TextKind::Str, "world").unwrap();
        let emph = b.add(VoidKind::Emph).unwrap();
        b.set_children(emph, &[world]).unwrap();
        let para = b.add(VoidKind::Para).unwrap();
        b.set_children(para, &[hello, emph]).unwrap();

        let doc = b.add(VoidKind::Doc).unwrap();
        b.set_children(doc, &[heading, para]).unwrap();

        let html = String::from_utf8(b.render_html(doc).unwrap()).unwrap();
        assert!(html.contains("<h1>Title</h1>"), "{html}");
        assert!(html.contains("<em>world</em>"), "{html}");

        let md = String::from_utf8(b.serialize(doc, Format::Markdown).unwrap()).unwrap();
        assert!(md.contains("# Title"), "{md}");
        assert!(md.contains("*world*"), "{md}");

        let matches = b.query(doc, "heading").unwrap();
        assert_eq!(matches.len(), 1);
        assert_eq!(matches[0].kind, Kind::Heading);

        let json = String::from_utf8(b.ast_json(doc).unwrap()).unwrap();
        assert!(json.contains("\"kind\": \"doc\""), "{json}");
    }

    #[test]
    fn builder_element_with_attributes() {
        let mut b = Builder::new().expect("builder");
        let inner = b.add_text(TextKind::Str, "hi").unwrap();
        let el = b.add_element("section").unwrap();
        b.set_children(el, &[inner]).unwrap();
        b.set_attrs(el, &[("class", Some("note")), ("hidden", None)])
            .unwrap();

        let html = String::from_utf8(b.render_html(el).unwrap()).unwrap();
        assert!(html.contains("<section"), "{html}");
        assert!(html.contains("class=\"note\""), "{html}");
        assert!(html.contains("hidden"), "{html}");
    }

    #[test]
    fn builder_lists_round_trip_to_markdown() {
        let mut b = Builder::new().expect("builder");

        // An ordered list: 1. one / 2. two
        let one_txt = b.add_text(TextKind::Str, "one").unwrap();
        let one_para = b.add(VoidKind::Para).unwrap();
        b.set_children(one_para, &[one_txt]).unwrap();
        let one = b.add(VoidKind::ListItem).unwrap();
        b.set_children(one, &[one_para]).unwrap();

        let two_txt = b.add_text(TextKind::Str, "two").unwrap();
        let two_para = b.add(VoidKind::Para).unwrap();
        b.set_children(two_para, &[two_txt]).unwrap();
        let two = b.add(VoidKind::ListItem).unwrap();
        b.set_children(two, &[two_para]).unwrap();

        let list = b
            .add_ordered_list(
                OrderedNumbering::Decimal,
                OrderedDelim::Period,
                true,
                Some(1),
            )
            .unwrap();
        b.set_children(list, &[one, two]).unwrap();
        let doc = b.add(VoidKind::Doc).unwrap();
        b.set_children(doc, &[list]).unwrap();

        let md = String::from_utf8(b.serialize(doc, Format::Markdown).unwrap()).unwrap();
        assert!(md.contains("1. one"), "{md}");
        assert!(md.contains("2. two"), "{md}");
    }

    #[test]
    fn builder_rejects_invalid_kind_and_id() {
        let b = Builder::new().expect("builder");
        // `heading` (code 2) carries a payload, so the void-kind `add` rejects it
        // — the safe `VoidKind` enum has no such variant, so we go through the raw
        // ABI to prove the guard.
        let mut id = 0u32;
        let status = unsafe { ffi::twig_builder_add(b.raw.as_ptr(), 2, &mut id) };
        assert_eq!(Error::from_status(status), Err(Error::InvalidArgument));

        // A root id past the end can't be rendered.
        let mut ptr = std::ptr::null();
        let mut len = 0usize;
        let status =
            unsafe { ffi::twig_builder_render_html(b.raw.as_ptr(), 4242, &mut ptr, &mut len) };
        assert_eq!(Error::from_status(status), Err(Error::InvalidArgument));
    }

    // ── Format capability ───────────────────────────────────────────────────

    /// Every gesture with a format-level gate, both kind vocabularies in full.
    fn all_gestures() -> Vec<Gesture> {
        let inline = [
            InlineKind::Strong,
            InlineKind::Emph,
            InlineKind::Verbatim,
            InlineKind::Mark,
            InlineKind::Superscript,
            InlineKind::Subscript,
            InlineKind::Insert,
            InlineKind::Delete,
        ];
        let mut all: Vec<Gesture> = Vec::new();
        for k in inline {
            all.push(Gesture::WrapRange(k));
            all.push(Gesture::ToggleInline(k));
        }
        for k in [
            BlockContainerKind::BlockQuote,
            BlockContainerKind::BulletList,
            BlockContainerKind::OrderedList,
        ] {
            all.push(Gesture::ToggleBlockContainer(k));
        }
        all.extend([
            Gesture::SetMarkColor,
            Gesture::SetBlock,
            Gesture::InsertThematicBreak,
            Gesture::ToggleCodeBlock,
            Gesture::SetCodeLanguage,
            Gesture::ToggleTaskItem,
            Gesture::SetTaskChecked,
            Gesture::ToggleTaskChecked,
            Gesture::InsertLink,
            Gesture::InsertImage,
            Gesture::InsertFootnote,
            Gesture::InsertLiteral,
            Gesture::InsertLineBreak,
            Gesture::SplitBlock,
            Gesture::RenumberOrderedLists,
            Gesture::TableInsertRow,
            Gesture::TableDeleteRow,
            Gesture::TableInsertColumn,
            Gesture::TableDeleteColumn,
            Gesture::TableSetAlignment,
            Gesture::TableMoveRow,
            Gesture::TableMoveColumn,
            Gesture::InsertTable,
            Gesture::InsertDirective,
            Gesture::SetBlockAttrs,
            Gesture::WrapRangeAttrs,
            Gesture::JoinBlocks,
            Gesture::SetNodeAttrs,
            Gesture::MoveBlock,
        ]);
        all
    }

    #[test]
    fn the_wire_space_ends_where_the_sweep_does() {
        // `all_gestures` is hand-written and, unlike the Zig union it mirrors,
        // has no compile-time cross-check: a variant added to the enum and to
        // `to_c` can silently miss the sweep below. So pin the space from both
        // ends — the sweep must cover a contiguous range of codes, every one of
        // them must decode C-side, and one past the end must not.
        let mut codes: Vec<c_int> = all_gestures().iter().map(|g| g.to_c().0).collect();
        codes.sort_unstable();
        codes.dedup();
        assert_eq!(codes, (0..=31).collect::<Vec<c_int>>());

        let mut supported = -1;
        for code in &codes {
            let status = unsafe {
                ffi::twig_format_supports(
                    ffi::TwigFormat::from(Format::Markdown) as c_int,
                    *code,
                    0,
                    &mut supported,
                )
            };
            assert_eq!(Error::from_status(status), Ok(()), "code {code} did not decode");
        }
        // One past the end is not a gesture, which is what makes appending safe.
        let status = unsafe {
            ffi::twig_format_supports(
                ffi::TwigFormat::from(Format::Markdown) as c_int,
                32,
                0,
                &mut supported,
            )
        };
        assert_eq!(Error::from_status(status), Err(Error::InvalidArgument));
    }

    #[test]
    fn supports_answers_per_gesture_where_authorable_cannot() {
        // HTML is why the per-gesture query exists. `is_authorable` is true for
        // it — it spells the inline marks, and every block its parser reads
        // back through a renderer — while a toolbar built on that predicate
        // would show a task-box button and a footnote button that both fail.
        assert!(Format::Html.is_authorable());
        assert!(Format::Html.supports(Gesture::ToggleInline(InlineKind::Strong)));
        assert!(Format::Html.supports(Gesture::SetBlock));
        assert!(Format::Html.supports(Gesture::InsertLiteral));
        assert!(Format::Html.supports(Gesture::ToggleBlockContainer(
            BlockContainerKind::BlockQuote
        )));
        assert!(Format::Html.supports(Gesture::ToggleCodeBlock));
        assert!(Format::Html.supports(Gesture::InsertLink));
        assert!(!Format::Html.supports(Gesture::ToggleTaskItem));
        assert!(!Format::Html.supports(Gesture::InsertFootnote));
        // The nine that used to answer nothing at all: HTML has a table its
        // parser reads and no spelling to write one back with, no blank-line
        // block separation, and no numbered list marker.
        assert!(!Format::Html.supports(Gesture::TableInsertRow));
        assert!(!Format::Html.supports(Gesture::TableSetAlignment));
        assert!(!Format::Html.supports(Gesture::SplitBlock));
        // And the one that goes the other way, which is why the join has a gate
        // of its own: HTML cannot be split at a blank line and *can* be joined
        // at a newline inside its `<p>`.
        assert!(Format::Html.supports(Gesture::JoinBlocks));
        // And the block move, whose lines HTML has like any other format.
        assert!(Format::Html.supports(Gesture::MoveBlock));
        assert!(!Format::Html.supports(Gesture::RenumberOrderedLists));
        assert!(Format::Markdown.supports(Gesture::TableInsertRow));
        assert!(Format::Djot.supports(Gesture::SplitBlock));

        // A format that spells no prose answers false to every caret gesture,
        // so the coarse predicate agrees there — it only misleads in the middle
        // of the range. The one gesture XML (and its svg dialect) supports is
        // the node-addressed one, which no caret asks for and `is_authorable`
        // deliberately does not count.
        for fmt in [Format::Xml, Format::Svg] {
            assert!(!fmt.is_authorable());
            for g in all_gestures() {
                assert_eq!(
                    fmt.supports(g),
                    g == Gesture::SetNodeAttrs,
                    "{fmt:?} on {g:?}"
                );
            }
        }
        // AsciiDoc is in the middle of the range the other way round from
        // HTML: the block gestures work, a link prints through its renderer,
        // the footnote/table shapes don't.
        assert!(Format::Asciidoc.is_authorable());
        assert!(Format::Asciidoc.supports(Gesture::SetBlock));
        assert!(Format::Asciidoc.supports(Gesture::ToggleInline(InlineKind::Mark)));
        assert!(Format::Asciidoc.supports(Gesture::InsertLink));
        assert!(!Format::Asciidoc.supports(Gesture::InsertFootnote));
        assert!(!Format::Asciidoc.supports(Gesture::TableInsertRow));

        // And the two authorable formats differ from each other, which is the
        // other half of why one boolean can't serve.
        assert!(Format::Djot.supports(Gesture::ToggleInline(InlineKind::Mark)));
        assert!(!Format::Markdown.supports(Gesture::ToggleInline(InlineKind::Mark)));
        assert!(Format::Markdown.supports(Gesture::InsertLineBreak));
        assert!(!Format::Djot.supports(Gesture::InsertLineBreak));
    }

    #[test]
    fn supports_agrees_with_what_the_editor_then_does() {
        // The pin at this layer: for the gestures whose refusal an `Editor`
        // can be made to demonstrate, the query's answer is the call's answer.
        // Zig covers the full (format x gesture) sweep; what's checked here is
        // that the Rust decode reaches the same question.
        for fmt in [Format::Djot, Format::Markdown, Format::Html] {
            let mut ed = Editor::new_str("ab\n", fmt).expect("editor");
            let claimed = fmt.supports(Gesture::ToggleInline(InlineKind::Mark));
            let observed = ed.toggle_inline(0, 2, InlineKind::Mark);
            assert_eq!(
                claimed,
                !matches!(observed, Err(Error::UnsupportedFormat)),
                "{fmt:?}: supports said {claimed}, gesture said {observed:?}",
            );

            let mut ed = Editor::new_str("ab\n", fmt).expect("editor");
            let claimed = fmt.supports(Gesture::SetBlock);
            let observed = ed.set_block(0, BlockKind::Heading(1));
            assert_eq!(
                claimed,
                !matches!(observed, Err(Error::UnsupportedFormat)),
                "{fmt:?}: supports said {claimed}, gesture said {observed:?}",
            );
        }

        // The destructive one, spelled out: an HTML `<table>` extracts as a grid
        // and cannot be written back, so the refusal has to arrive before
        // anything is spliced. A `Ok(())` here once meant a destroyed table.
        let src = "<table><tr><td>a</td></tr></table>";
        let mut ed = Editor::new_str(src, Format::Html).expect("editor");
        assert!(!Format::Html.supports(Gesture::TableInsertRow));
        assert_eq!(ed.table_insert_row(15, true), Err(Error::UnsupportedFormat));
        assert_eq!(ed.renumber_ordered_lists(15), Err(Error::UnsupportedFormat));
        assert!(matches!(ed.split_block(15), Err(Error::UnsupportedFormat)));
        // The join is spelled in HTML, so its refusal here is about the caret
        // being in a table — a different answer, from a different gate.
        assert_eq!(ed.join_blocks(15), Err(Error::NotEditable));
        assert_eq!(ed.source().expect("source"), src.as_bytes());
    }

    #[test]
    fn supports_rides_the_gestures_own_kind_space() {
        // The same integer means different things per gesture on the wire (1 is
        // `emph` inline and `bullet_list` container). The Rust types make that
        // unrepresentable, which is why `supports` returns a bare bool — but
        // the raw call underneath still has to be handed the right pair.
        let (g, k) = Gesture::ToggleBlockContainer(BlockContainerKind::BulletList).to_c();
        assert_eq!((g, k), (3, 1));
        let (g, k) = Gesture::ToggleInline(InlineKind::Emph).to_c();
        assert_eq!((g, k), (1, 1));
        // A kindless gesture sends 0, which the C side requires rather than
        // ignores.
        assert_eq!(Gesture::InsertLink.to_c(), (10, 0));

        // And the C side does reject the combinations Rust can't build.
        let mut out: c_int = 0;
        let status = unsafe {
            ffi::twig_format_supports(ffi::TwigFormat::Markdown as c_int, 10, 3, &mut out)
        };
        assert_eq!(Error::from_status(status), Err(Error::InvalidArgument));
        let status = unsafe {
            ffi::twig_format_supports(ffi::TwigFormat::Markdown as c_int, 9999, 0, &mut out)
        };
        assert_eq!(Error::from_status(status), Err(Error::InvalidArgument));
    }
}