@likecoin/epubcheck-ts 0.3.5 → 0.3.6

package/dist/index.cjs

@@ -870,7 +870,7 @@ var MessageDefs = {
   NAV_001: {
     id: "NAV-001",
     severity: "error",
-    description: "Nav file not supported for EPUB v2"
+    description: 'Navigation Document must have a nav element with epub:type="toc"'
   },
   NAV_002: { id: "NAV-002", severity: "suppressed", description: "Missing toc nav element" },
   NAV_003: {
@@ -1634,6 +1634,81 @@ var CSSValidator = class {
   }
 };
 
+// src/opf/types.ts
+var CORE_MEDIA_TYPES = /* @__PURE__ */ new Set([
+  // Image types
+  "image/gif",
+  "image/jpeg",
+  "image/png",
+  "image/svg+xml",
+  "image/webp",
+  // Audio types
+  "audio/mpeg",
+  "audio/mp4",
+  "audio/ogg",
+  // CSS
+  "text/css",
+  // Fonts
+  "font/otf",
+  "font/ttf",
+  "font/woff",
+  "font/woff2",
+  "application/font-sfnt",
+  // deprecated alias for font/otf, font/ttf
+  "application/font-woff",
+  // deprecated alias for font/woff
+  "application/vnd.ms-opentype",
+  // deprecated alias
+  // Content documents
+  "application/xhtml+xml",
+  "application/x-dtbncx+xml",
+  // NCX
+  // JavaScript (EPUB 3)
+  "text/javascript",
+  "application/javascript",
+  // Media overlays
+  "application/smil+xml",
+  // PLS (Pronunciation Lexicon)
+  "application/pls+xml"
+]);
+function isCoreMediaType(mimeType) {
+  if (CORE_MEDIA_TYPES.has(mimeType)) return true;
+  if (mimeType.startsWith("video/")) return true;
+  if (/^audio\/ogg\s*;\s*codecs=opus$/i.test(mimeType)) return true;
+  const semicolonIndex = mimeType.indexOf(";");
+  if (semicolonIndex >= 0) {
+    const baseType = mimeType.substring(0, semicolonIndex).trim();
+    if (CORE_MEDIA_TYPES.has(baseType)) return true;
+    if (baseType.startsWith("video/")) return true;
+  }
+  return false;
+}
+var ITEM_PROPERTIES = /* @__PURE__ */ new Set([
+  "cover-image",
+  "mathml",
+  "nav",
+  "remote-resources",
+  "scripted",
+  "svg",
+  "switch"
+]);
+var LINK_PROPERTIES = /* @__PURE__ */ new Set(["onix", "marc21xml-record", "mods-record", "xmp-record"]);
+var SPINE_PROPERTIES = /* @__PURE__ */ new Set([
+  "page-spread-left",
+  "page-spread-right",
+  "rendition:spread-none",
+  "rendition:spread-landscape",
+  "rendition:spread-portrait",
+  "rendition:spread-both",
+  "rendition:spread-auto",
+  "rendition:page-spread-center",
+  "rendition:layout-reflowable",
+  "rendition:layout-pre-paginated",
+  "rendition:orientation-auto",
+  "rendition:orientation-landscape",
+  "rendition:orientation-portrait"
+]);
+
 // src/references/types.ts
 function isPublicationResourceReference(type) {
   return [
@@ -1644,7 +1719,10 @@ function isPublicationResourceReference(type) {
     "audio" /* AUDIO */,
     "video" /* VIDEO */,
     "track" /* TRACK */,
-    "media-overlay" /* MEDIA_OVERLAY */
+    "media-overlay" /* MEDIA_OVERLAY */,
+    "svg-symbol" /* SVG_SYMBOL */,
+    "svg-paint" /* SVG_PAINT */,
+    "svg-clip-path" /* SVG_CLIP_PATH */
   ].includes(type);
 }
 
@@ -1702,6 +1780,17 @@ function isHTTP(url) {
 function isRemoteURL(url) {
   return isHTTP(url) || isHTTPS(url);
 }
+function checkUrlLeaking(href) {
+  const TEST_BASE_A = "https://a.example.org/A/";
+  const TEST_BASE_B = "https://b.example.org/B/";
+  try {
+    const urlA = new URL(href, TEST_BASE_A).toString();
+    const urlB = new URL(href, TEST_BASE_B).toString();
+    return !urlA.startsWith(TEST_BASE_A) || !urlB.startsWith(TEST_BASE_B);
+  } catch {
+    return false;
+  }
+}
 function resolveManifestHref(opfDir, href) {
   if (isRemoteURL(href)) return href;
   try {
@@ -1837,6 +1926,9 @@ var ContentValidator = class {
         if (context.version.startsWith("3")) {
           this.validateSVGDocument(context, fullPath, item);
         }
+        if (refValidator) {
+          this.extractSVGReferences(context, fullPath, opfDir, refValidator);
+        }
       }
     }
   }
@@ -1884,6 +1976,133 @@ var ContentValidator = class {
       doc.dispose();
     }
   }
+  /**
+   * Extract references from SVG documents: font-face-uri, xml-stylesheet PI, @import in style
+   */
+  extractSVGReferences(context, path, opfDir, refValidator) {
+    const svgData = context.files.get(path);
+    if (!svgData) return;
+    const svgContent = new TextDecoder().decode(svgData);
+    let doc;
+    try {
+      doc = libxml2Wasm.XmlDocument.fromString(svgContent);
+    } catch {
+      return;
+    }
+    const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
+    try {
+      const root = doc.root;
+      try {
+        const fontFaceUris = root.find(".//svg:font-face-uri", {
+          svg: "http://www.w3.org/2000/svg"
+        });
+        for (const uri of fontFaceUris) {
+          const href = this.getAttribute(uri, "xlink:href") ?? this.getAttribute(uri, "href");
+          if (!href) continue;
+          if (href.startsWith("http://") || href.startsWith("https://")) {
+            refValidator.addReference({
+              url: href,
+              targetResource: href,
+              type: "font" /* FONT */,
+              location: { path, line: uri.line }
+            });
+          } else {
+            const resolvedPath = this.resolveRelativePath(docDir, href, opfDir);
+            refValidator.addReference({
+              url: href,
+              targetResource: resolvedPath,
+              type: "font" /* FONT */,
+              location: { path, line: uri.line }
+            });
+          }
+        }
+      } catch {
+      }
+      try {
+        const styles = root.find(".//svg:style", { svg: "http://www.w3.org/2000/svg" });
+        for (const style of styles) {
+          const cssContent = style.content;
+          if (cssContent) {
+            this.extractCSSImports(path, cssContent, opfDir, refValidator);
+          }
+        }
+      } catch {
+      }
+      try {
+        const svgUseXlink = root.find(".//svg:use[@xlink:href]", {
+          svg: "http://www.w3.org/2000/svg",
+          xlink: "http://www.w3.org/1999/xlink"
+        });
+        const svgUseHref = root.find(".//svg:use[@href]", {
+          svg: "http://www.w3.org/2000/svg"
+        });
+        for (const useNode of [...svgUseXlink, ...svgUseHref]) {
+          const useElem = useNode;
+          const href = this.getAttribute(useElem, "xlink:href") ?? this.getAttribute(useElem, "href");
+          if (!href) continue;
+          if (href.startsWith("http://") || href.startsWith("https://")) continue;
+          if (!href.includes("#")) {
+            pushMessage(context.messages, {
+              id: MessageId.RSC_015,
+              message: `SVG "use" element requires a fragment identifier, but found "${href}"`,
+              location: { path, line: useNode.line }
+            });
+            continue;
+          }
+          const resolvedPath = this.resolveRelativePath(docDir, href, opfDir);
+          const hashIndex = resolvedPath.indexOf("#");
+          const targetResource = hashIndex >= 0 ? resolvedPath.slice(0, hashIndex) : path;
+          const fragment = hashIndex >= 0 ? resolvedPath.slice(hashIndex + 1) : void 0;
+          const useRef = {
+            url: href,
+            targetResource,
+            type: "svg-symbol" /* SVG_SYMBOL */,
+            location: { path, line: useNode.line }
+          };
+          if (fragment) {
+            useRef.fragment = fragment;
+          }
+          refValidator.addReference(useRef);
+        }
+      } catch {
+      }
+    } finally {
+      doc.dispose();
+    }
+    this.extractXmlStylesheetPIs(svgContent, path, docDir, opfDir, refValidator);
+  }
+  /**
+   * Extract href from <?xml-stylesheet?> processing instructions
+   */
+  extractXmlStylesheetPIs(content, path, docDir, opfDir, refValidator) {
+    const piRegex = /<\?xml-stylesheet\s+([^?]*)\?>/g;
+    let match;
+    while ((match = piRegex.exec(content)) !== null) {
+      const attrs = match[1];
+      if (!attrs) continue;
+      const hrefMatch = /href\s*=\s*["']([^"']*)["']/.exec(attrs);
+      if (!hrefMatch?.[1]) continue;
+      const href = hrefMatch[1];
+      const beforeMatch = content.substring(0, match.index);
+      const line = beforeMatch.split("\n").length;
+      if (href.startsWith("http://") || href.startsWith("https://")) {
+        refValidator.addReference({
+          url: href,
+          targetResource: href,
+          type: "stylesheet" /* STYLESHEET */,
+          location: { path, line }
+        });
+      } else {
+        const resolvedPath = this.resolveRelativePath(docDir, href, opfDir);
+        refValidator.addReference({
+          url: href,
+          targetResource: resolvedPath,
+          type: "stylesheet" /* STYLESHEET */,
+          location: { path, line }
+        });
+      }
+    }
+  }
   detectSVGRemoteResources(root) {
     try {
       const fontFaceUris = root.find(".//svg:font-face-uri", {
@@ -1949,9 +2168,11 @@ var ContentValidator = class {
     for (const ref of result.references) {
       if (ref.type === "font") {
         if (ref.url.startsWith("http://") || ref.url.startsWith("https://")) {
+          const hashIndex = ref.url.indexOf("#");
+          const targetResource = hashIndex >= 0 ? ref.url.slice(0, hashIndex) : ref.url;
           refValidator.addReference({
             url: ref.url,
-            targetResource: ref.url,
+            targetResource,
             type: "font" /* FONT */,
             location: { path }
           });
@@ -1968,9 +2189,11 @@ var ContentValidator = class {
         }
       } else if (ref.type === "image") {
         if (ref.url.startsWith("http://") || ref.url.startsWith("https://")) {
+          const hashIndex = ref.url.indexOf("#");
+          const targetResource = hashIndex >= 0 ? ref.url.slice(0, hashIndex) : ref.url;
           refValidator.addReference({
             url: ref.url,
-            targetResource: ref.url,
+            targetResource,
             type: "image" /* IMAGE */,
             location: { path }
           });
@@ -1985,9 +2208,27 @@ var ContentValidator = class {
             location: { path }
           });
         }
+      } else if (ref.type === "import") {
+        const location = { path };
+        if (ref.line !== void 0) location.line = ref.line;
+        if (ref.url.startsWith("http://") || ref.url.startsWith("https://")) {
+          refValidator.addReference({
+            url: ref.url,
+            targetResource: ref.url,
+            type: "stylesheet" /* STYLESHEET */,
+            location
+          });
+        } else {
+          const resolvedPath = this.resolveRelativePath(cssDir, ref.url, opfDir);
+          refValidator.addReference({
+            url: ref.url,
+            targetResource: resolvedPath,
+            type: "stylesheet" /* STYLESHEET */,
+            location
+          });
+        }
       }
     }
-    this.extractCSSImports(path, cssContent, opfDir, refValidator);
   }
   validateXHTMLDocument(context, path, itemId, opfDir, registry, refValidator) {
     const data = context.files.get(path);
@@ -2094,6 +2335,13 @@ var ContentValidator = class {
             location: { path }
           });
         }
+        if (!hasMathML && manifestItem?.properties?.includes("mathml")) {
+          pushMessage(context.messages, {
+            id: MessageId.OPF_015,
+            message: 'The property "mathml" should not be declared in the OPF file',
+            location: { path }
+          });
+        }
         const hasSVG = this.detectSVG(context, path, root);
         if (hasSVG && !manifestItem?.properties?.includes("svg")) {
           pushMessage(context.messages, {
@@ -2117,6 +2365,13 @@ var ContentValidator = class {
             location: { path }
           });
         }
+        if (!hasSwitch && manifestItem?.properties?.includes("switch")) {
+          pushMessage(context.messages, {
+            id: MessageId.OPF_015,
+            message: 'The property "switch" should not be declared in the OPF file',
+            location: { path }
+          });
+        }
         const hasRemoteResources = this.detectRemoteResources(context, path, root);
         if (hasRemoteResources && !manifestItem?.properties?.includes("remote-resources")) {
           pushMessage(context.messages, {
@@ -2145,13 +2400,21 @@ var ContentValidator = class {
         this.extractAndRegisterIDs(path, root, registry);
       }
       if (refValidator && opfDir !== void 0) {
-        this.extractAndRegisterHyperlinks(context, path, root, opfDir, refValidator);
+        this.extractAndRegisterHyperlinks(context, path, root, opfDir, refValidator, !!isNavItem);
         this.extractAndRegisterStylesheets(path, root, opfDir, refValidator);
-        this.extractAndRegisterImages(path, root, opfDir, refValidator);
+        this.extractAndRegisterImages(context, path, root, opfDir, refValidator, registry);
         this.extractAndRegisterMathMLAltimg(path, root, opfDir, refValidator);
         this.extractAndRegisterScripts(path, root, opfDir, refValidator);
         this.extractAndRegisterCiteAttributes(path, root, opfDir, refValidator);
-        this.extractAndRegisterMediaElements(path, root, opfDir, refValidator);
+        this.extractAndRegisterMediaElements(context, path, root, opfDir, refValidator, registry);
+        this.extractAndRegisterEmbeddedElements(
+          context,
+          path,
+          root,
+          opfDir,
+          refValidator,
+          registry
+        );
       }
     } finally {
       doc.dispose();
@@ -2207,14 +2470,12 @@ var ContentValidator = class {
       return epubTypeAttr ? epubTypeAttr.value.trim().split(/\s+/) : [];
     };
     let tocNav;
-    let tocEpubTypeValue = "";
     let pageListCount = 0;
     let landmarksCount = 0;
     for (const nav of navElements) {
       const types = getNavTypes(nav);
       if (types.includes("toc") && !tocNav) {
         tocNav = nav;
-        tocEpubTypeValue = types.join(" ");
       }
       if (types.includes("page-list")) pageListCount++;
       if (types.includes("landmarks")) landmarksCount++;
@@ -2265,7 +2526,7 @@ var ContentValidator = class {
     }
     this.checkNavHeadingContent(context, path, root);
     this.checkNavHiddenAttribute(context, path, root);
-    this.checkNavRemoteLinks(context, path, root, tocEpubTypeValue);
+    this.checkNavRemoteLinks(context, path, root);
     this.collectTocLinks(context, path, tocNav);
   }
   checkNavFirstChildHeading(context, path, navElem) {
@@ -2448,24 +2709,30 @@ var ContentValidator = class {
       }
     }
   }
-  checkNavRemoteLinks(context, path, root, epubTypeValue) {
-    const navTypes = epubTypeValue.split(/\s+/);
-    const isToc = navTypes.includes("toc");
-    const isLandmarks = navTypes.includes("landmarks");
-    const isPageList = navTypes.includes("page-list");
-    if (!isToc && !isLandmarks && !isPageList) {
-      return;
-    }
-    const links = root.find(".//html:a[@href]", { html: "http://www.w3.org/1999/xhtml" });
-    for (const link of links) {
-      const href = this.getAttribute(link, "href");
-      if (href && (href.startsWith("http://") || href.startsWith("https://"))) {
-        const navType = isToc ? "toc" : isLandmarks ? "landmarks" : "page-list";
-        pushMessage(context.messages, {
-          id: MessageId.NAV_010,
-          message: `"${navType}" nav must not link to remote resources; found link to "${href}"`,
-          location: { path }
-        });
+  checkNavRemoteLinks(context, path, root) {
+    const HTML_NS = { html: "http://www.w3.org/1999/xhtml" };
+    const navElements = root.find(".//html:nav", HTML_NS);
+    for (const nav of navElements) {
+      const navElem = nav;
+      const epubTypeAttr = "attrs" in navElem ? navElem.attrs.find(
+        (attr) => attr.name === "type" && attr.prefix === "epub" && attr.namespaceUri === "http://www.idpf.org/2007/ops"
+      ) : void 0;
+      const types = epubTypeAttr ? epubTypeAttr.value.trim().split(/\s+/) : [];
+      const isToc = types.includes("toc");
+      const isLandmarks = types.includes("landmarks");
+      const isPageList = types.includes("page-list");
+      if (!isToc && !isLandmarks && !isPageList) continue;
+      const navType = isToc ? "toc" : isLandmarks ? "landmarks" : "page-list";
+      const links = navElem.find(".//html:a[@href]", HTML_NS);
+      for (const link of links) {
+        const href = this.getAttribute(link, "href");
+        if (href && (href.startsWith("http://") || href.startsWith("https://"))) {
+          pushMessage(context.messages, {
+            id: MessageId.NAV_010,
+            message: `"${navType}" nav must not link to remote resources; found link to "${href}"`,
+            location: { path }
+          });
+        }
       }
     }
   }
@@ -2603,6 +2870,20 @@ var ContentValidator = class {
         return true;
       }
     }
+    const objects = root.find(".//html:object[@data]", { html: "http://www.w3.org/1999/xhtml" });
+    for (const obj of objects) {
+      const data = this.getAttribute(obj, "data");
+      if (data && (data.startsWith("http://") || data.startsWith("https://"))) {
+        return true;
+      }
+    }
+    const embeds = root.find(".//html:embed[@src]", { html: "http://www.w3.org/1999/xhtml" });
+    for (const embed of embeds) {
+      const src = this.getAttribute(embed, "src");
+      if (src && (src.startsWith("http://") || src.startsWith("https://"))) {
+        return true;
+      }
+    }
     const linkElements = root.find(".//html:link[@rel and @href]", {
       html: "http://www.w3.org/1999/xhtml"
     });
@@ -2881,14 +3162,38 @@ var ContentValidator = class {
   extractAndRegisterIDs(path, root, registry) {
     const elementsWithId = root.find(".//*[@id]");
     for (const elem of elementsWithId) {
-      const id = this.getAttribute(elem, "id");
+      const xmlElem = elem;
+      const id = this.getAttribute(xmlElem, "id");
       if (id) {
         registry.registerID(path, id);
+        const localName = xmlElem.name.includes(":") ? xmlElem.name.split(":").pop() : xmlElem.name;
+        if (localName === "symbol") {
+          registry.registerSVGSymbolID(path, id);
+        }
       }
     }
   }
-  extractAndRegisterHyperlinks(context, path, root, opfDir, refValidator) {
+  extractAndRegisterHyperlinks(context, path, root, opfDir, refValidator, isNavDocument = false) {
     const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
+    const navAnchorTypes = /* @__PURE__ */ new Map();
+    if (isNavDocument) {
+      const HTML_NS = { html: "http://www.w3.org/1999/xhtml" };
+      const navElements = root.find(".//html:nav", HTML_NS);
+      for (const nav of navElements) {
+        const navElem = nav;
+        const epubTypeAttr = "attrs" in navElem ? navElem.attrs.find(
+          (attr) => attr.name === "type" && attr.prefix === "epub" && attr.namespaceUri === "http://www.idpf.org/2007/ops"
+        ) : void 0;
+        const types = epubTypeAttr ? epubTypeAttr.value.trim().split(/\s+/) : [];
+        let refType = "hyperlink" /* HYPERLINK */;
+        if (types.includes("toc")) refType = "nav-toc-link" /* NAV_TOC_LINK */;
+        else if (types.includes("page-list")) refType = "nav-pagelist-link" /* NAV_PAGELIST_LINK */;
+        const navAnchors = navElem.find(".//html:a[@href]", HTML_NS);
+        for (const a of navAnchors) {
+          navAnchorTypes.set(a.line, refType);
+        }
+      }
+    }
     const links = root.find(".//html:a[@href]", { html: "http://www.w3.org/1999/xhtml" });
     for (const link of links) {
       const href = this.getAttribute(link, "href")?.trim() ?? null;
@@ -2902,6 +3207,7 @@ var ContentValidator = class {
         continue;
       }
       const line = link.line;
+      const refType = isNavDocument ? navAnchorTypes.get(line) ?? "hyperlink" /* HYPERLINK */ : "hyperlink" /* HYPERLINK */;
       if (href.startsWith("http://") || href.startsWith("https://")) {
         continue;
       }
@@ -2918,7 +3224,7 @@ var ContentValidator = class {
           url: href,
           targetResource: targetResource2,
           fragment,
-          type: "hyperlink" /* HYPERLINK */,
+          type: refType,
           location: { path, line }
         });
         continue;
@@ -2930,7 +3236,7 @@ var ContentValidator = class {
       const ref = {
         url: href,
         targetResource,
-        type: "hyperlink" /* HYPERLINK */,
+        type: refType,
         location: { path, line }
       };
       if (fragmentPart) {
@@ -2938,6 +3244,39 @@ var ContentValidator = class {
       }
       refValidator.addReference(ref);
     }
+    const areaLinks = root.find(".//html:area[@href]", { html: "http://www.w3.org/1999/xhtml" });
+    for (const area of areaLinks) {
+      const href = this.getAttribute(area, "href")?.trim();
+      if (!href) continue;
+      const line = area.line;
+      if (href.startsWith("http://") || href.startsWith("https://")) continue;
+      if (href.startsWith("mailto:") || href.startsWith("tel:")) continue;
+      if (href.includes("#epubcfi(")) continue;
+      if (href.startsWith("#")) {
+        refValidator.addReference({
+          url: href,
+          targetResource: path,
+          fragment: href.slice(1),
+          type: "hyperlink" /* HYPERLINK */,
+          location: { path, line }
+        });
+        continue;
+      }
+      const resolvedAreaPath = this.resolveRelativePath(docDir, href, opfDir);
+      const areaHashIndex = resolvedAreaPath.indexOf("#");
+      const areaTarget = areaHashIndex >= 0 ? resolvedAreaPath.slice(0, areaHashIndex) : resolvedAreaPath;
+      const areaFragment = areaHashIndex >= 0 ? resolvedAreaPath.slice(areaHashIndex + 1) : void 0;
+      const areaRef = {
+        url: href,
+        targetResource: areaTarget,
+        type: "hyperlink" /* HYPERLINK */,
+        location: { path, line }
+      };
+      if (areaFragment) {
+        areaRef.fragment = areaFragment;
+      }
+      refValidator.addReference(areaRef);
+    }
     const svgLinks = root.find(".//svg:a", {
       svg: "http://www.w3.org/2000/svg",
       xlink: "http://www.w3.org/1999/xlink"
@@ -3014,10 +3353,10 @@ var ContentValidator = class {
   extractCSSImports(cssPath, cssContent, opfDir, refValidator) {
     const cssDir = cssPath.includes("/") ? cssPath.substring(0, cssPath.lastIndexOf("/")) : "";
     const cleanedCSS = cssContent.replace(/\/\*[\s\S]*?\*\//g, "");
-    const importRegex = /@import\s+(?:url\s*\(\s*)?["']([^"']+)["']\s*\)?[^;]*;/gi;
+    const importRegex = /@import\s+(?:url\s*\(\s*["']?([^"')]+?)["']?\s*\)|["']([^"']+)["'])[^;]*;/gi;
     let match;
     while ((match = importRegex.exec(cleanedCSS)) !== null) {
-      const importUrl = match[1];
+      const importUrl = match[1] ?? match[2];
       if (!importUrl) continue;
       const beforeMatch = cleanedCSS.substring(0, match.index);
       const line = beforeMatch.split("\n").length;
@@ -3039,21 +3378,56 @@ var ContentValidator = class {
       });
     }
   }
-  extractAndRegisterImages(path, root, opfDir, refValidator) {
+  extractAndRegisterImages(context, path, root, opfDir, refValidator, registry) {
     const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
-    const images = root.find(".//html:img[@src]", { html: "http://www.w3.org/1999/xhtml" });
+    const ns = { html: "http://www.w3.org/1999/xhtml" };
+    const pictureHasCMTSource = /* @__PURE__ */ new Set();
+    if (registry) {
+      const pictures = root.find(".//html:picture", ns);
+      for (const pic of pictures) {
+        const picElem = pic;
+        const sources = picElem.find("html:source[@src]", ns);
+        const sourcesWithSrcset = picElem.find("html:source[@srcset]", ns);
+        for (const source of [...sources, ...sourcesWithSrcset]) {
+          const srcAttr = this.getAttribute(source, "src");
+          const srcsetAttr = this.getAttribute(source, "srcset");
+          const sourceUrl = srcAttr ?? srcsetAttr?.split(",")[0]?.trim().split(/\s+/)[0];
+          if (!sourceUrl || sourceUrl.startsWith("http://") || sourceUrl.startsWith("https://"))
+            continue;
+          const resolvedSource = this.resolveRelativePath(docDir, sourceUrl, opfDir);
+          const resource = registry.getResource(resolvedSource);
+          if (resource && isCoreMediaType(resource.mimeType)) {
+            pictureHasCMTSource.add(pic.line);
+            break;
+          }
+        }
+      }
+    }
+    const images = root.find(".//html:img[@src]", ns);
     for (const img of images) {
       const imgElem = img;
       const src = this.getAttribute(imgElem, "src");
       if (!src) continue;
       const line = img.line;
+      let hasIntrinsicFallback;
+      if (pictureHasCMTSource.size > 0) {
+        try {
+          const pictureParent = imgElem.get("ancestor::html:picture", ns);
+          if (pictureParent && pictureHasCMTSource.has(pictureParent.line)) {
+            hasIntrinsicFallback = true;
+          }
+        } catch {
+        }
+      }
       if (src.startsWith("http://") || src.startsWith("https://")) {
-        refValidator.addReference({
+        const ref = {
           url: src,
           targetResource: src,
           type: "image" /* IMAGE */,
           location: { path, line }
-        });
+        };
+        if (hasIntrinsicFallback) ref.hasIntrinsicFallback = true;
+        refValidator.addReference(ref);
       } else {
         const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
         const hashIndex = resolvedPath.indexOf("#");
@@ -3065,6 +3439,7 @@ var ContentValidator = class {
           type: "image" /* IMAGE */,
           location: { path, line }
         };
+        if (hasIntrinsicFallback) ref.hasIntrinsicFallback = true;
         if (fragment) {
           ref.fragment = fragment;
         }
@@ -3117,6 +3492,45 @@ var ContentValidator = class {
       }
       refValidator.addReference(svgImgRef);
     }
+    try {
+      const svgUseXlink = root.find(".//svg:use[@xlink:href]", {
+        svg: "http://www.w3.org/2000/svg",
+        xlink: "http://www.w3.org/1999/xlink"
+      });
+      const svgUseHref = root.find(".//svg:use[@href]", {
+        svg: "http://www.w3.org/2000/svg"
+      });
+      for (const useNode of [...svgUseXlink, ...svgUseHref]) {
+        const useElem = useNode;
+        const href = this.getAttribute(useElem, "xlink:href") ?? this.getAttribute(useElem, "href");
+        if (href === null) continue;
+        const line = useNode.line;
+        if (href.startsWith("http://") || href.startsWith("https://")) continue;
+        if (href === "" || !href.includes("#")) {
+          pushMessage(context.messages, {
+            id: MessageId.RSC_015,
+            message: `SVG "use" element requires a fragment identifier, but found "${href}"`,
+            location: { path, line }
+          });
+          continue;
+        }
+        const resolvedPath = this.resolveRelativePath(docDir, href, opfDir);
+        const hashIndex = resolvedPath.indexOf("#");
+        const targetResource = hashIndex >= 0 ? resolvedPath.slice(0, hashIndex) : path;
+        const fragment = hashIndex >= 0 ? resolvedPath.slice(hashIndex + 1) : void 0;
+        const useRef = {
+          url: href,
+          targetResource,
+          type: "svg-symbol" /* SVG_SYMBOL */,
+          location: { path, line }
+        };
+        if (fragment) {
+          useRef.fragment = fragment;
+        }
+        refValidator.addReference(useRef);
+      }
+    } catch {
+    }
     const videos = root.find(".//html:video[@poster]", { html: "http://www.w3.org/1999/xhtml" });
     for (const video of videos) {
       const poster = this.getAttribute(video, "poster");
@@ -3218,7 +3632,7 @@ var ContentValidator = class {
           url: cite,
           targetResource: targetResource2,
           fragment: fragment2,
-          type: "hyperlink" /* HYPERLINK */,
+          type: "cite" /* CITE */,
           location: { path, line }
         });
         continue;
@@ -3230,93 +3644,71 @@ var ContentValidator = class {
       const ref = {
         url: cite,
         targetResource,
-        type: "hyperlink" /* HYPERLINK */,
+        type: "cite" /* CITE */,
         location: { path, line }
       };
       if (fragment) {
         ref.fragment = fragment;
       }
       refValidator.addReference(ref);
-    }
-  }
-  extractAndRegisterMediaElements(path, root, opfDir, refValidator) {
-    const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
-    const audioElements = root.find(".//html:audio[@src]", {
-      html: "http://www.w3.org/1999/xhtml"
-    });
-    for (const audio of audioElements) {
-      const src = this.getAttribute(audio, "src");
-      if (!src) continue;
-      const line = audio.line;
-      if (src.startsWith("http://") || src.startsWith("https://")) {
-        refValidator.addReference({
-          url: src,
-          targetResource: src,
-          type: "audio" /* AUDIO */,
-          location: line !== void 0 ? { path, line } : { path }
-        });
-      } else {
-        const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
-        refValidator.addReference({
-          url: src,
-          targetResource: resolvedPath,
-          type: "audio" /* AUDIO */,
-          location: line !== void 0 ? { path, line } : { path }
-        });
-      }
-    }
-    const videoElements = root.find(".//html:video[@src]", {
-      html: "http://www.w3.org/1999/xhtml"
-    });
-    for (const video of videoElements) {
-      const src = this.getAttribute(video, "src");
-      if (!src) continue;
-      const line = video.line;
-      if (src.startsWith("http://") || src.startsWith("https://")) {
-        refValidator.addReference({
-          url: src,
-          targetResource: src,
-          type: "video" /* VIDEO */,
-          location: line !== void 0 ? { path, line } : { path }
-        });
-      } else {
-        const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
-        refValidator.addReference({
-          url: src,
-          targetResource: resolvedPath,
-          type: "video" /* VIDEO */,
-          location: line !== void 0 ? { path, line } : { path }
-        });
-      }
-    }
-    const sourceElements = root.find(".//html:source[@src]", {
-      html: "http://www.w3.org/1999/xhtml"
-    });
-    for (const source of sourceElements) {
-      const src = this.getAttribute(source, "src");
-      if (!src) continue;
-      const parent = source.parent;
-      const parentName = parent?.name ?? "";
-      const isAudioChild = parentName === "audio";
-      const type = isAudioChild ? "audio" /* AUDIO */ : "video" /* VIDEO */;
-      const line = source.line;
-      if (src.startsWith("http://") || src.startsWith("https://")) {
-        refValidator.addReference({
-          url: src,
-          targetResource: src,
-          type,
-          location: line !== void 0 ? { path, line } : { path }
-        });
-      } else {
-        const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
-        refValidator.addReference({
-          url: src,
-          targetResource: resolvedPath,
-          type,
-          location: line !== void 0 ? { path, line } : { path }
-        });
+    }
+  }
+  extractAndRegisterMediaElements(context, path, root, opfDir, refValidator, registry) {
+    const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
+    const ns = { html: "http://www.w3.org/1999/xhtml" };
+    for (const tagName of ["audio", "video"]) {
+      const isAudio = tagName === "audio";
+      const refType = isAudio ? "audio" /* AUDIO */ : "video" /* VIDEO */;
+      const elements = root.find(`.//html:${tagName}`, ns);
+      for (const elem of elements) {
+        const mediaElem = elem;
+        const pendingRefs = [];
+        const src = this.getAttribute(mediaElem, "src");
+        if (src) {
+          const line = elem.line;
+          if (src.startsWith("http://") || src.startsWith("https://")) {
+            pendingRefs.push({ url: src, targetResource: src, type: refType, line });
+          } else {
+            const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
+            pendingRefs.push({ url: src, targetResource: resolvedPath, type: refType, line });
+          }
+        }
+        const sources = mediaElem.find("html:source[@src]", ns);
+        for (const source of sources) {
+          const sourceElem = source;
+          const sourceSrc = this.getAttribute(sourceElem, "src");
+          if (!sourceSrc) continue;
+          const line = source.line;
+          if (sourceSrc.startsWith("http://") || sourceSrc.startsWith("https://")) {
+            pendingRefs.push({ url: sourceSrc, targetResource: sourceSrc, type: refType, line });
+          } else {
+            const resolvedPath = this.resolveRelativePath(docDir, sourceSrc, opfDir);
+            pendingRefs.push({ url: sourceSrc, targetResource: resolvedPath, type: refType, line });
+          }
+          if (registry) {
+            this.checkMimeTypeMatch(context, path, docDir, opfDir, sourceElem, "src", registry);
+          }
+        }
+        let hasIntrinsicFallback = false;
+        if (registry && pendingRefs.length > 1) {
+          hasIntrinsicFallback = pendingRefs.some((ref) => {
+            const resource = registry.getResource(ref.targetResource);
+            return resource && isCoreMediaType(resource.mimeType);
+          });
+        }
+        for (const ref of pendingRefs) {
+          const reference = {
+            url: ref.url,
+            targetResource: ref.targetResource,
+            type: ref.type,
+            location: ref.line !== void 0 ? { path, line: ref.line } : { path }
+          };
+          if (hasIntrinsicFallback) reference.hasIntrinsicFallback = true;
+          refValidator.addReference(reference);
+        }
       }
     }
+    this.extractAndRegisterPictureElements(context, path, root, opfDir, refValidator, registry);
     const iframeElements = root.find(".//html:iframe[@src]", {
       html: "http://www.w3.org/1999/xhtml"
     });
@@ -3366,6 +3758,188 @@ var ContentValidator = class {
       }
     }
   }
+  extractAndRegisterEmbeddedElements(context, path, root, opfDir, refValidator, registry) {
+    const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
+    const ns = { html: "http://www.w3.org/1999/xhtml" };
+    const addRef = (src, type, line, hasIntrinsicFallback) => {
+      const location = line !== void 0 ? { path, line } : { path };
+      if (src.startsWith("http://") || src.startsWith("https://")) {
+        const ref = {
+          url: src,
+          targetResource: src,
+          type,
+          location
+        };
+        if (hasIntrinsicFallback) ref.hasIntrinsicFallback = true;
+        refValidator.addReference(ref);
+      } else {
+        const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
+        const hashIndex = resolvedPath.indexOf("#");
+        const targetResource = hashIndex >= 0 ? resolvedPath.slice(0, hashIndex) : resolvedPath;
+        const ref = {
+          url: src,
+          targetResource,
+          type,
+          location
+        };
+        if (hashIndex >= 0) ref.fragment = resolvedPath.slice(hashIndex + 1);
+        if (hasIntrinsicFallback) ref.hasIntrinsicFallback = true;
+        refValidator.addReference(ref);
+      }
+    };
+    for (const elem of root.find(".//html:embed[@src]", ns)) {
+      const embedElem = elem;
+      const src = this.getAttribute(embedElem, "src");
+      if (src) addRef(src, "generic" /* GENERIC */, elem.line);
+      if (registry) {
+        this.checkMimeTypeMatch(context, path, docDir, opfDir, embedElem, "src", registry);
+      }
+    }
+    for (const elem of root.find(".//html:input[@src]", ns)) {
+      const type = this.getAttribute(elem, "type");
+      if (type?.toLowerCase() === "image") {
+        const src = this.getAttribute(elem, "src");
+        if (src) addRef(src, "image" /* IMAGE */, elem.line);
+      }
+    }
+    for (const elem of root.find(".//html:object[@data]", ns)) {
+      const objElem = elem;
+      const data = this.getAttribute(objElem, "data");
+      if (!data) continue;
+      const allChildren = objElem.find("html:*", ns);
+      const hasFallbackContent = allChildren.some((child) => {
+        const c = child;
+        return c.name !== "param" && this.getAttribute(c, "hidden") === null;
+      });
+      addRef(data, "generic" /* GENERIC */, elem.line, hasFallbackContent || void 0);
+      if (registry) {
+        this.checkMimeTypeMatch(context, path, docDir, opfDir, objElem, "data", registry);
+      }
+    }
+  }
+  /**
+   * Check if an element's type attribute matches the manifest MIME type (OPF-013)
+   */
+  checkMimeTypeMatch(context, path, docDir, opfDir, element, srcAttr, registry) {
+    const typeAttr = this.getAttribute(element, "type");
+    if (!typeAttr) return;
+    const src = this.getAttribute(element, srcAttr);
+    if (!src || src.startsWith("http://") || src.startsWith("https://")) return;
+    const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
+    const hashIndex = resolvedPath.indexOf("#");
+    const targetResource = hashIndex >= 0 ? resolvedPath.slice(0, hashIndex) : resolvedPath;
+    const resource = registry.getResource(targetResource);
+    if (!resource) return;
+    const stripParams = (t) => {
+      const idx = t.indexOf(";");
+      return (idx >= 0 ? t.substring(0, idx) : t).trim();
+    };
+    const declaredType = stripParams(typeAttr);
+    const manifestType = stripParams(resource.mimeType);
+    if (declaredType && declaredType !== manifestType) {
+      pushMessage(context.messages, {
+        id: MessageId.OPF_013,
+        message: `Resource "${targetResource}" is declared with MIME type "${declaredType}" in content, but has MIME type "${manifestType}" in the package document`,
+        location: { path, line: element.line }
+      });
+    }
+  }
+  /**
+   * Extract and validate picture elements (MED-003, MED-007, OPF-013)
+   */
+  extractAndRegisterPictureElements(context, path, root, opfDir, refValidator, registry) {
+    const docDir = path.includes("/") ? path.substring(0, path.lastIndexOf("/")) : "";
+    const ns = { html: "http://www.w3.org/1999/xhtml" };
+    const BLESSED_IMAGE_TYPES = /* @__PURE__ */ new Set([
+      "image/gif",
+      "image/jpeg",
+      "image/png",
+      "image/svg+xml",
+      "image/webp"
+    ]);
+    const pictures = root.find(".//html:picture", ns);
+    for (const pic of pictures) {
+      const picElem = pic;
+      const imgs = picElem.find("html:img[@src]", ns);
+      for (const img of imgs) {
+        const imgElem = img;
+        const src = this.getAttribute(imgElem, "src");
+        if (!src || src.startsWith("http://") || src.startsWith("https://")) continue;
+        if (registry) {
+          const resolvedPath = this.resolveRelativePath(docDir, src, opfDir);
+          const resource = registry.getResource(resolvedPath);
+          if (resource && !BLESSED_IMAGE_TYPES.has(resource.mimeType)) {
+            pushMessage(context.messages, {
+              id: MessageId.MED_003,
+              message: `Image in "picture" element must be a core image type, but found "${resource.mimeType}"`,
+              location: { path, line: img.line }
+            });
+          }
+        }
+        const srcset = this.getAttribute(imgElem, "srcset");
+        if (srcset && registry) {
+          const entries = srcset.split(",");
+          for (const entry of entries) {
+            const url = entry.trim().split(/\s+/)[0];
+            if (!url || url.startsWith("http://") || url.startsWith("https://")) continue;
+            const resolvedPath = this.resolveRelativePath(docDir, url, opfDir);
+            const resource = registry.getResource(resolvedPath);
+            if (resource && !BLESSED_IMAGE_TYPES.has(resource.mimeType)) {
+              pushMessage(context.messages, {
+                id: MessageId.MED_003,
+                message: `Image in "picture" element must be a core image type, but found "${resource.mimeType}"`,
+                location: { path, line: img.line }
+              });
+            }
+          }
+        }
+      }
+      const sourcesWithSrc = picElem.find("html:source[@src]", ns);
+      const sourcesWithSrcset = picElem.find("html:source[@srcset]", ns);
+      const allSources = /* @__PURE__ */ new Set([...sourcesWithSrc, ...sourcesWithSrcset]);
+      for (const source of allSources) {
+        const sourceElem = source;
+        const typeAttr = this.getAttribute(sourceElem, "type");
+        const src = this.getAttribute(sourceElem, "src");
+        const srcset = this.getAttribute(sourceElem, "srcset");
+        const sourceUrl = src ?? srcset?.split(",")[0]?.trim().split(/\s+/)[0];
+        if (!sourceUrl || sourceUrl.startsWith("http://") || sourceUrl.startsWith("https://"))
+          continue;
+        if (registry) {
+          if (src) {
+            this.checkMimeTypeMatch(context, path, docDir, opfDir, sourceElem, "src", registry);
+          } else if (srcset && typeAttr) {
+            const resolvedPath2 = this.resolveRelativePath(docDir, sourceUrl, opfDir);
+            const resource2 = registry.getResource(resolvedPath2);
+            if (resource2) {
+              const stripParams = (t) => {
+                const idx = t.indexOf(";");
+                return (idx >= 0 ? t.substring(0, idx) : t).trim();
+              };
+              const declaredType = stripParams(typeAttr);
+              const manifestType = stripParams(resource2.mimeType);
+              if (declaredType && declaredType !== manifestType) {
+                pushMessage(context.messages, {
+                  id: MessageId.OPF_013,
+                  message: `Resource "${resolvedPath2}" is declared with MIME type "${declaredType}" in content, but has MIME type "${manifestType}" in the package document`,
+                  location: { path, line: source.line }
+                });
+              }
+            }
+          }
+          const resolvedPath = this.resolveRelativePath(docDir, sourceUrl, opfDir);
+          const resource = registry.getResource(resolvedPath);
+          if (resource && !BLESSED_IMAGE_TYPES.has(resource.mimeType) && !typeAttr) {
+            pushMessage(context.messages, {
+              id: MessageId.MED_007,
+              message: `Source element in "picture" with foreign resource type "${resource.mimeType}" must declare a "type" attribute`,
+              location: { path, line: source.line }
+            });
+          }
+        }
+      }
+    }
+  }
   parseSrcset(srcset, docDir, opfDir, path, line, refValidator) {
     const entries = srcset.split(",");
     for (const entry of entries) {
@@ -4574,69 +5148,6 @@ function parseCollections(xml) {
   return collections;
 }
 
-// src/opf/types.ts
-var CORE_MEDIA_TYPES = /* @__PURE__ */ new Set([
-  // Image types
-  "image/gif",
-  "image/jpeg",
-  "image/png",
-  "image/svg+xml",
-  "image/webp",
-  // Audio types
-  "audio/mpeg",
-  "audio/mp4",
-  "audio/ogg",
-  // CSS
-  "text/css",
-  // Fonts
-  "font/otf",
-  "font/ttf",
-  "font/woff",
-  "font/woff2",
-  "application/font-sfnt",
-  // deprecated alias for font/otf, font/ttf
-  "application/font-woff",
-  // deprecated alias for font/woff
-  "application/vnd.ms-opentype",
-  // deprecated alias
-  // Content documents
-  "application/xhtml+xml",
-  "application/x-dtbncx+xml",
-  // NCX
-  // JavaScript (EPUB 3)
-  "text/javascript",
-  "application/javascript",
-  // Media overlays
-  "application/smil+xml",
-  // PLS (Pronunciation Lexicon)
-  "application/pls+xml"
-]);
-var ITEM_PROPERTIES = /* @__PURE__ */ new Set([
-  "cover-image",
-  "mathml",
-  "nav",
-  "remote-resources",
-  "scripted",
-  "svg",
-  "switch"
-]);
-var LINK_PROPERTIES = /* @__PURE__ */ new Set(["onix", "marc21xml-record", "mods-record", "xmp-record"]);
-var SPINE_PROPERTIES = /* @__PURE__ */ new Set([
-  "page-spread-left",
-  "page-spread-right",
-  "rendition:spread-none",
-  "rendition:spread-landscape",
-  "rendition:spread-portrait",
-  "rendition:spread-both",
-  "rendition:spread-auto",
-  "rendition:page-spread-center",
-  "rendition:layout-reflowable",
-  "rendition:layout-pre-paginated",
-  "rendition:orientation-auto",
-  "rendition:orientation-landscape",
-  "rendition:orientation-portrait"
-]);
-
 // src/opf/validator.ts
 var OPFValidator = class {
   packageDoc = null;
@@ -5050,9 +5561,17 @@ var OPFValidator = class {
       this.detectRefinesCycles(context, opfPath);
     }
     if (this.packageDoc.version !== "2.0") {
-      const modifiedMeta = this.packageDoc.metaElements.find(
+      const modifiedMetas = this.packageDoc.metaElements.filter(
         (meta) => meta.property === "dcterms:modified"
       );
+      const modifiedMeta = modifiedMetas[0];
+      if (modifiedMetas.length > 1) {
+        pushMessage(context.messages, {
+          id: MessageId.RSC_005,
+          message: "package dcterms:modified meta element must occur exactly once",
+          location: { path: opfPath }
+        });
+      }
       if (!modifiedMeta) {
         pushMessage(context.messages, {
           id: MessageId.RSC_005,
@@ -5186,7 +5705,7 @@ var OPFValidator = class {
         });
       }
       if (!item.href.startsWith("http") && !item.href.startsWith("mailto:")) {
-        const leaked = checkUrlLeaking(item.href);
+        const leaked = checkUrlLeaking2(item.href);
         if (leaked) {
           pushMessage(context.messages, {
             id: MessageId.RSC_026,
@@ -5280,20 +5799,23 @@ var OPFValidator = class {
         });
       }
       if (this.packageDoc.version !== "2.0" && (item.href.startsWith("http://") || item.href.startsWith("https://"))) {
-        if (!item.mediaType.startsWith("audio/") && !item.mediaType.startsWith("video/") && !item.mediaType.startsWith("font/") && item.mediaType !== "application/font-sfnt" && item.mediaType !== "application/font-woff" && item.mediaType !== "application/vnd.ms-opentype") {
-          pushMessage(context.messages, {
-            id: MessageId.RSC_006,
-            message: `Remote resource reference is not allowed in this context; resource "${item.href}" must be located in the EPUB container`,
-            location: { path: opfPath }
-          });
-        }
+        const isAllowedRemoteType = item.mediaType.startsWith("audio/") || item.mediaType.startsWith("video/") || item.mediaType.startsWith("font/") || item.mediaType === "application/font-sfnt" || item.mediaType === "application/font-woff" || item.mediaType === "application/vnd.ms-opentype";
         const inSpine = this.packageDoc.spine.some((s) => s.idref === item.id);
-        if (inSpine && !item.properties?.includes("remote-resources")) {
-          pushMessage(context.messages, {
-            id: MessageId.RSC_006,
-            message: `Manifest item "${item.id}" references remote resource but is missing "remote-resources" property`,
-            location: { path: opfPath }
-          });
+        if (inSpine) {
+          if (!isAllowedRemoteType) {
+            pushMessage(context.messages, {
+              id: MessageId.RSC_006,
+              message: `Remote resource reference is not allowed in this context; resource "${item.href}" must be located in the EPUB container`,
+              location: { path: opfPath }
+            });
+          }
+          if (!item.properties?.includes("remote-resources")) {
+            pushMessage(context.messages, {
+              id: MessageId.RSC_006,
+              message: `Manifest item "${item.id}" references remote resource but is missing "remote-resources" property`,
+              location: { path: opfPath }
+            });
+          }
         }
       }
     }
@@ -5398,12 +5920,20 @@ var OPFValidator = class {
         });
       }
       seenIdrefs.add(itemref.idref);
-      if (!isSpineMediaType(item.mediaType) && !item.fallback) {
-        pushMessage(context.messages, {
-          id: MessageId.OPF_043,
-          message: `Spine item "${item.id}" has non-standard media type "${item.mediaType}" without fallback`,
-          location: { path: opfPath }
-        });
+      if (!isSpineMediaType(item.mediaType)) {
+        if (!item.fallback) {
+          pushMessage(context.messages, {
+            id: MessageId.OPF_043,
+            message: `Spine item "${item.id}" has non-standard media type "${item.mediaType}" without fallback`,
+            location: { path: opfPath }
+          });
+        } else if (!this.fallbackChainResolvesToContentDocument(item.id)) {
+          pushMessage(context.messages, {
+            id: MessageId.OPF_044,
+            message: `Spine item "${item.id}" has non-standard media type "${item.mediaType}" and its fallback chain does not resolve to a content document`,
+            location: { path: opfPath }
+          });
+        }
       }
       if (this.packageDoc.version !== "2.0" && itemref.properties) {
         for (const prop of itemref.properties) {
@@ -5601,14 +6131,57 @@ var OPFValidator = class {
       }
     }
   }
+  fallbackChainResolvesToContentDocument(itemId) {
+    const visited = /* @__PURE__ */ new Set();
+    let currentId = itemId;
+    while (currentId) {
+      if (visited.has(currentId)) return false;
+      visited.add(currentId);
+      const item = this.manifestById.get(currentId);
+      if (!item) return false;
+      if (isSpineMediaType(item.mediaType)) return true;
+      currentId = item.fallback;
+    }
+    return false;
+  }
 };
 function isSpineMediaType(mediaType) {
   return mediaType === "application/xhtml+xml" || mediaType === "image/svg+xml" || // EPUB 2 also allows these in spine
   mediaType === "application/x-dtbook+xml";
 }
 function isValidLanguageTag(tag) {
-  const pattern = /^[a-zA-Z]{2,3}(-[a-zA-Z]{4})?(-[a-zA-Z]{2}|-\d{3})?(-([a-zA-Z\d]{5,8}|\d[a-zA-Z\d]{3}))*$/;
-  return pattern.test(tag);
+  const pattern = /^[a-zA-Z]{2,3}(-[a-zA-Z]{4})?(-[a-zA-Z]{2}|-\d{3})?(-([a-zA-Z\d]{5,8}|\d[a-zA-Z\d]{3}))*(-[a-wyzA-WYZ](-[a-zA-Z\d]{2,8})+)*(-x(-[a-zA-Z\d]{1,8})+)?$/;
+  if (pattern.test(tag)) return true;
+  if (/^x(-[a-zA-Z\d]{1,8})+$/.test(tag)) return true;
+  const grandfathered = /* @__PURE__ */ new Set([
+    "en-GB-oed",
+    "i-ami",
+    "i-bnn",
+    "i-default",
+    "i-enochian",
+    "i-hak",
+    "i-klingon",
+    "i-lux",
+    "i-mingo",
+    "i-navajo",
+    "i-pwn",
+    "i-tao",
+    "i-tay",
+    "i-tsu",
+    "sgn-BE-FR",
+    "sgn-BE-NL",
+    "sgn-CH-DE",
+    "art-lojban",
+    "cel-gaulish",
+    "no-bok",
+    "no-nyn",
+    "zh-guoyu",
+    "zh-hakka",
+    "zh-min",
+    "zh-min-nan",
+    "zh-xiang"
+  ]);
+  return grandfathered.has(tag);
 }
 function resolvePath(basePath, relativePath) {
   if (relativePath.startsWith("/")) {
@@ -5636,7 +6209,7 @@ function tryDecodeUriComponent(encoded) {
     return encoded;
   }
 }
-function checkUrlLeaking(href) {
+function checkUrlLeaking2(href) {
   const TEST_BASE_A = "https://a.example.org/A/";
   const TEST_BASE_B = "https://b.example.org/B/";
   try {
@@ -5714,9 +6287,11 @@ function isValidW3CDateFormat(dateStr) {
 var ResourceRegistry = class {
   resources;
   ids;
+  svgSymbolIds;
   constructor() {
     this.resources = /* @__PURE__ */ new Map();
     this.ids = /* @__PURE__ */ new Map();
+    this.svgSymbolIds = /* @__PURE__ */ new Map();
   }
   /**
    * Register a resource from manifest
@@ -5778,6 +6353,21 @@ var ResourceRegistry = class {
     }
     return -1;
   }
+  /**
+   * Register an ID as belonging to an SVG symbol element
+   */
+  registerSVGSymbolID(resourceURL, id) {
+    if (!this.svgSymbolIds.has(resourceURL)) {
+      this.svgSymbolIds.set(resourceURL, /* @__PURE__ */ new Set());
+    }
+    this.svgSymbolIds.get(resourceURL)?.add(id);
+  }
+  /**
+   * Check if an ID in a resource belongs to an SVG symbol element
+   */
+  isSVGSymbolID(resourceURL, id) {
+    return this.svgSymbolIds.get(resourceURL)?.has(id) ?? false;
+  }
   /**
    * Get all resources
    */
@@ -5827,6 +6417,7 @@ var ReferenceValidator = class {
     for (const reference of this.references) {
       this.validateReference(context, reference);
     }
+    this.checkRemoteResources(context);
     this.checkUndeclaredResources(context);
     this.checkReadingOrder(context);
     this.checkNonLinearReachability(context);
@@ -5836,14 +6427,6 @@ var ReferenceValidator = class {
    */
   validateReference(context, reference) {
     const url = reference.url.trim();
-    if (isMalformedURL(url)) {
-      pushMessage(context.messages, {
-        id: MessageId.RSC_020,
-        message: `Malformed URL: ${url}`,
-        location: reference.location
-      });
-      return;
-    }
     if (isDataURL(url)) {
       if (this.version.startsWith("3.")) {
         const forbiddenDataUrlTypes = [
@@ -5858,10 +6441,35 @@ var ReferenceValidator = class {
             message: "Data URLs are not allowed in this context",
             location: reference.location
           });
+        } else {
+          const fallbackCheckedTypes = [
+            "image" /* IMAGE */,
+            "audio" /* AUDIO */,
+            "video" /* VIDEO */,
+            "generic" /* GENERIC */
+          ];
+          if (fallbackCheckedTypes.includes(reference.type) && !reference.hasIntrinsicFallback) {
+            const dataUrlMimeType = this.extractDataURLMimeType(url);
+            if (dataUrlMimeType && !isCoreMediaType(dataUrlMimeType)) {
+              pushMessage(context.messages, {
+                id: MessageId.RSC_032,
+                message: `Fallback must be provided for foreign resources, but found none for data URL of type "${dataUrlMimeType}"`,
+                location: reference.location
+              });
+            }
+          }
         }
       }
       return;
     }
+    if (isMalformedURL(url)) {
+      pushMessage(context.messages, {
+        id: MessageId.RSC_020,
+        message: `Malformed URL: ${url}`,
+        location: reference.location
+      });
+      return;
+    }
     if (isFileURL(url)) {
       pushMessage(context.messages, {
         id: MessageId.RSC_030,
@@ -5873,6 +6481,13 @@ var ReferenceValidator = class {
     const resourcePath = reference.targetResource || parseURL(url).resource;
     const fragment = reference.fragment ?? parseURL(url).fragment;
     const hasFragment = fragment !== void 0 && fragment !== "";
+    if (!isRemoteURL(url) && url.includes("?")) {
+      pushMessage(context.messages, {
+        id: MessageId.RSC_033,
+        message: `Relative URL strings must not have a query component: "${url}"`,
+        location: reference.location
+      });
+    }
     if (!isRemoteURL(url)) {
       this.validateLocalReference(context, reference, resourcePath);
     } else {
@@ -5888,7 +6503,7 @@ var ReferenceValidator = class {
   validateLocalReference(context, reference, resourcePath) {
     if (hasAbsolutePath(resourcePath)) {
       pushMessage(context.messages, {
-        id: MessageId.RSC_027,
+        id: MessageId.RSC_026,
         message: "Absolute paths are not allowed in EPUB",
         location: reference.location
       });
@@ -5900,10 +6515,16 @@ var ReferenceValidator = class {
     ];
     if (hasParentDirectoryReference(reference.url) && forbiddenParentDirTypes.includes(reference.type)) {
       pushMessage(context.messages, {
-        id: MessageId.RSC_028,
+        id: MessageId.RSC_026,
         message: "Parent directory references (..) are not allowed",
         location: reference.location
       });
+    } else if (!hasAbsolutePath(resourcePath) && !hasParentDirectoryReference(reference.url) && checkUrlLeaking(reference.url)) {
+      pushMessage(context.messages, {
+        id: MessageId.RSC_026,
+        message: `URL "${reference.url}" leaks outside the container`,
+        location: reference.location
+      });
     }
     if (!this.registry.hasResource(resourcePath)) {
       const fileExistsInContainer = context.files.has(resourcePath);
@@ -5928,14 +6549,15 @@ var ReferenceValidator = class {
       return;
     }
     const resource = this.registry.getResource(resourcePath);
-    if (reference.type === "hyperlink" /* HYPERLINK */ && !resource?.inSpine) {
+    const isHyperlinkLike = reference.type === "hyperlink" /* HYPERLINK */ || reference.type === "nav-toc-link" /* NAV_TOC_LINK */ || reference.type === "nav-pagelist-link" /* NAV_PAGELIST_LINK */;
+    if (this.version.startsWith("3") && isHyperlinkLike && !resource?.inSpine) {
       pushMessage(context.messages, {
         id: MessageId.RSC_011,
         message: "Hyperlinks must reference spine items",
         location: reference.location
       });
     }
-    if (reference.type === "hyperlink" /* HYPERLINK */ || reference.type === "overlay-text-link" /* OVERLAY_TEXT_LINK */) {
+    if (isHyperlinkLike || reference.type === "overlay-text-link" /* OVERLAY_TEXT_LINK */) {
       const targetMimeType = resource?.mimeType;
       if (targetMimeType && !this.isBlessedItemType(targetMimeType, context.version) && !this.isDeprecatedBlessedItemType(targetMimeType) && !resource.hasCoreMediaTypeFallback) {
         pushMessage(context.messages, {
@@ -5945,7 +6567,13 @@ var ReferenceValidator = class {
         });
       }
     }
-    if (resource && isPublicationResourceReference(reference.type) && !CORE_MEDIA_TYPES.has(resource.mimeType) && !resource.hasCoreMediaTypeFallback && !reference.hasIntrinsicFallback) {
+    const fallbackCheckedTypes = [
+      "image" /* IMAGE */,
+      "audio" /* AUDIO */,
+      "video" /* VIDEO */,
+      "generic" /* GENERIC */
+    ];
+    if (resource && fallbackCheckedTypes.includes(reference.type) && !isCoreMediaType(resource.mimeType) && !resource.hasCoreMediaTypeFallback && !reference.hasIntrinsicFallback) {
       pushMessage(context.messages, {
         id: MessageId.RSC_032,
         message: `Fallback must be provided for foreign resources, but found none for resource "${resourcePath}" of type "${resource.mimeType}"`,
@@ -5958,20 +6586,24 @@ var ReferenceValidator = class {
    */
   validateRemoteReference(context, reference) {
     const url = reference.url;
-    if (isHTTP(url) && !isHTTPS(url)) {
-      pushMessage(context.messages, {
-        id: MessageId.RSC_031,
-        message: "Remote resources must use HTTPS",
-        location: reference.location
-      });
-    }
     if (isPublicationResourceReference(reference.type)) {
-      const allowedRemoteTypes = /* @__PURE__ */ new Set([
+      if (isHTTP(url) && !isHTTPS(url)) {
+        pushMessage(context.messages, {
+          id: MessageId.RSC_031,
+          message: "Remote resources must use HTTPS",
+          location: reference.location
+        });
+      }
+      const allowedRemoteRefTypes = /* @__PURE__ */ new Set([
         "audio" /* AUDIO */,
         "video" /* VIDEO */,
         "font" /* FONT */
       ]);
-      if (!allowedRemoteTypes.has(reference.type)) {
+      const targetResource = reference.targetResource || url;
+      const resource = this.registry.getResource(targetResource);
+      const isAllowedByRefType = allowedRemoteRefTypes.has(reference.type);
+      const isAllowedByMimeType = resource && this.isRemoteResourceType(resource.mimeType);
+      if (!isAllowedByRefType && !isAllowedByMimeType) {
         pushMessage(context.messages, {
           id: MessageId.RSC_006,
           message: "Remote resources are only allowed for audio, video, and fonts",
@@ -5979,8 +6611,7 @@ var ReferenceValidator = class {
         });
         return;
       }
-      const targetResource = reference.targetResource || url;
-      if (!this.registry.hasResource(targetResource)) {
+      if (!resource) {
         pushMessage(context.messages, {
           id: MessageId.RSC_008,
           message: `Referenced resource "${targetResource}" is not declared in the OPF manifest`,
@@ -6013,9 +6644,9 @@ var ReferenceValidator = class {
       });
       return;
     }
-    if (resource?.mimeType === "image/svg+xml") {
+    if (resource?.mimeType === "image/svg+xml" && reference.type === "hyperlink" /* HYPERLINK */) {
       const hasSVGView = fragment.includes("svgView(") || fragment.includes("viewBox(");
-      if (hasSVGView && reference.type === "hyperlink" /* HYPERLINK */) {
+      if (hasSVGView) {
         pushMessage(context.messages, {
           id: MessageId.RSC_014,
           message: "SVG view fragments can only be referenced from SVG documents",
@@ -6023,11 +6654,51 @@ var ReferenceValidator = class {
         });
       }
     }
-    if (!this.registry.hasID(resourcePath, fragment)) {
+    if (reference.type === "hyperlink" /* HYPERLINK */) {
+      if (this.registry.isSVGSymbolID(resourcePath, fragment)) {
+        pushMessage(context.messages, {
+          id: MessageId.RSC_014,
+          message: `Fragment identifier "${fragment}" defines an incompatible resource type (SVG symbol)`,
+          location: reference.location
+        });
+      }
+    }
+    const parsedMimeTypes = ["application/xhtml+xml", "image/svg+xml"];
+    if (resource && parsedMimeTypes.includes(resource.mimeType) && !isRemoteURL(resourcePath)) {
+      if (!this.registry.hasID(resourcePath, fragment)) {
+        pushMessage(context.messages, {
+          id: MessageId.RSC_012,
+          message: `Fragment identifier not found: #${fragment}`,
+          location: reference.location
+        });
+      }
+    }
+  }
+  /**
+   * Check non-spine remote resources that have non-standard types.
+   * Fires RSC-006 for remote items that aren't audio/video/font types
+   * and aren't referenced as audio/video/font by content documents.
+   * This mirrors Java's checkItemAfterResourceValidation behavior.
+   */
+  checkRemoteResources(context) {
+    if (!this.version.startsWith("3")) return;
+    const referencedAsAllowed = /* @__PURE__ */ new Set();
+    for (const ref of this.references) {
+      if (isRemoteURL(ref.url) || isRemoteURL(ref.targetResource)) {
+        if (ref.type === "font" /* FONT */ || ref.type === "audio" /* AUDIO */ || ref.type === "video" /* VIDEO */) {
+          referencedAsAllowed.add(ref.targetResource);
+        }
+      }
+    }
+    for (const resource of this.registry.getAllResources()) {
+      if (!isRemoteURL(resource.url)) continue;
+      if (resource.inSpine) continue;
+      if (this.isRemoteResourceType(resource.mimeType)) continue;
+      if (referencedAsAllowed.has(resource.url)) continue;
       pushMessage(context.messages, {
-        id: MessageId.RSC_012,
-        message: `Fragment identifier not found: #${fragment}`,
-        location: reference.location
+        id: MessageId.RSC_006,
+        message: `Remote resource reference is not allowed; resource "${resource.url}" must be located in the EPUB container`,
+        location: { path: resource.url }
       });
     }
   }
@@ -6051,9 +6722,9 @@ var ReferenceValidator = class {
     for (const resource of this.registry.getAllResources()) {
       if (resource.inSpine) continue;
       if (referencedResources.has(resource.url)) continue;
-      if (resource.url.includes("nav")) continue;
-      if (resource.url.includes("toc.ncx") || resource.url.includes(".ncx")) continue;
-      if (resource.url.includes("cover-image")) continue;
+      if (resource.isNav) continue;
+      if (resource.isNcx) continue;
+      if (resource.isCoverImage) continue;
       pushMessage(context.messages, {
         id: MessageId.OPF_097,
         message: `Resource declared in manifest but not referenced: ${resource.url}`,
@@ -6114,7 +6785,7 @@ var ReferenceValidator = class {
     const opfDir = opfPath.includes("/") ? opfPath.substring(0, opfPath.lastIndexOf("/")) : "";
     const hyperlinkTargets = /* @__PURE__ */ new Set();
     for (const ref of this.references) {
-      if (ref.type === "hyperlink" /* HYPERLINK */) {
+      if (ref.type === "hyperlink" /* HYPERLINK */ || ref.type === "nav-toc-link" /* NAV_TOC_LINK */ || ref.type === "nav-pagelist-link" /* NAV_PAGELIST_LINK */) {
         hyperlinkTargets.add(ref.targetResource);
       }
     }
@@ -6151,6 +6822,13 @@ var ReferenceValidator = class {
   isDeprecatedBlessedItemType(mimeType) {
     return mimeType === "text/x-oeb1-document" || mimeType === "text/html";
   }
+  extractDataURLMimeType(url) {
+    const match = /^data:([^;,]+)/.exec(url);
+    return match?.[1]?.trim().toLowerCase() ?? "text/plain";
+  }
+  isRemoteResourceType(mimeType) {
+    return mimeType.startsWith("audio/") || mimeType.startsWith("video/") || mimeType.startsWith("font/") || mimeType === "application/font-sfnt" || mimeType === "application/font-woff" || mimeType === "application/font-woff2" || mimeType === "application/vnd.ms-opentype";
+  }
 };
 var COMPRESSED_SCHEMAS = {
   "applications.rng": "H4sIAJC0cWkCA81aX2/bNhB/76fgXKBPtb1u6zC4ToqgSdMC7TqsGbZXWqIlohQpUFQS99PvSOq/RVmSZTdBHhLy/vF49+PxqPXbx4iheyITKvjF7NXi5xki3BM+5cHF7J+79/M/Zm8vn60DiaMISwTUPFnhi1moVLxaLiVh+JEHCyGDJU+WnohirOiGMqp2S8y5UPCvgBkj2XC7eBMlU0+lkhjay2cIrX+az9HzKX7QfG4E+mRLOUEcR+RiBsZGgi+wUjJZUK6IxJ6aIRjeANHFzAwxgu+JsQbY8coXXhoRbld1if6++XT1H/rzFn31QhJhtBUSfbj7/Am9XqF/yQZdxTGjniFG7wnWq0u0pPLn+XrZlGp1Tb32FvOvfJ+a3UFKoHfGG+gKvEE3qSKJy7DSLXYAhkSs5zHLB2BIkm2bmz0B3PALivGGkdmykLFsChkg1Zc4CCaUF1LfJ3wiYbGIBSSYW9p6WXfpemnD9EDEChWC1K5wdRhUhLqxqKe25sY5Quomm4dwMvQrsK/G6IoqrcXEXaG8TR8QeqGgXhF6MHCPWUouATxAtv27ORczrNf8qOaCs52LaotZ4hJR2buqflhMbvYAV5bR6nDidU6AbhjRwytU8PT1X1PJOM+1+WQKF2QJ5lj/BzNbLt5S9115TbZ72bnQ9oWnXFE234qU++cIiRwjHA75y06XHsno+7qkLt7tE5wq4fJIhHmKmWs2hAQ7h6M0HkBpMuiUvmVigxkq1CUI22NZZxgcecR6NUEPVIUoR5wcuE5yDFIepyoS/lQHVhITxqAE8b5NJFBHgodjcAWj36eyUuO5/EZ2OlieznGYh9SQ07DcPyeEcYXIY0w8OMKQjxVGaheTFSo4++ZuU5U7e7ngTiDXp597zpnWqXROQblLnZMcliWp55r2iUcjN5gkBEsvPMGxU0kTx759LSggJBDmPspvPvngCpVS+u7hnt7pTuOToGwj+13XhyqVGerrj1b5bp+I7dYZaB0xr+1xBZiGdk/fcdoJHoT0nZNeiHX5DHfmE4RoDSMdjr8DJEFii240LQIFCk4x+L2nUsEZjYB9IzCsYAV3+VJc391pMcG9N4bYmecduxM4Kw3egVWxJPdUpM69aYWO6r43y7mRexZLEcBdHvYLigdn2QZEQIM+cl83AYRcoRdMvcl5XwTqjWtPspqkoa3cjf3qo3bAFeZRzqtXz3YiE3nVA7kpfb3M7OnpFCvQXSi1n8QVCzprirqahdnO8RVKQ1qEH4fKamZGR1UlKV7QSBefVC1yzRtc26ED7FIw4mKtB/MxpVWrjx14UZ1sM15XP4stE1gtAK7nnAQQ6VCWZYYPz7lypxwWlVMH7IlFAsXfMbbYBHNVmGZ2EYcSJ+0lpu7yvTN9UoBq6B56BOlSLeue6H5ihBWCypZ0tTB1dpZayhrYRsO+dXX0OlD4+hQzEXQC3bUhQRvx+BIKXKh2PAC7lwiaoQ+U++LB4p4V1B/1LH1vzMvs7EK8jGQqvKuJOxXaVZUsRDy8LTkWnjL3D0QmzIhU+6zTIdO+PxwgUJnrKC2B6EQVdS0euwECwOih5/3TpLqhP5zm1cw9IB2CPe1M8TshGJw2NpM1df881tS9s9gY0pXDhmCqDK4ImzZ/xyYdo0mlNdIv5XwqDeDuhjIGUqTxUKYxFmoeOByGspnAGcEzoqCS2KdwJo7wh24WjnCJsvk0mE2SSq3bt1gk+sJrEvQ0mFxJWncafSdSfJGfhXQkPqMVpLL691kOSamiZOJJGqt5ksaxkGWLr1304K7jECAu0fUQDOdO6EZhRBWJLBQz2h+IGe0Pw2BIJwrD/GQgXMj6oRhcIJV27hjYOYbPNAdHQqTmN/g1lNn6bATgjUGtMd45A3IVcT5BhYb5PbZ3KkvvSGK47wGd+Vbkeges1EO3Esch9aBhp3PaCuqf15a+d25ndjYX5qKbKs2r7inuqpOvp37XPtOaTnsDrCpZhIQGYcfr2SBhD9RX4VQvhpC1kzzqtazW9dJfnXV2erTiACLjqN5Ti9scRlUnz2JTJY+7MUxJDL0ZLCGqh+BZI69Gt7qOLaL24HWAigG9sVaYOtQiIwoeQ7sfA/KP7eB95gufX8PzKTwuftQ9P+jwwXjWI7OSBjTJLEP/LllmamebLKOZrE9Wk3eyRllVy1k7ZW33Rt3Y1VRz+AgAdho+AojSRKEN9HfhhRfRLdIWmo9SUFbmvLFvzGizQzhJoI1mPs3Mv94cfamfsPW27+Gn2nurRflejiepftLf1e6b5+7NVSHjgPiauc6i0mzqMqM11WWmI//AySJMRtAfYTKG3giTW9uFMDnNVAhTl/c0Wnn2XX7olWefa7r8re/MAC+5SutuQA5f7TV0htWX4S/HCvj1WAG/HSvg9bECfj9WgDkQDghxx9B6mX0Adfnsf1i38T4sMgAA",
@@ -6665,11 +7343,15 @@ var EpubCheck = class _EpubCheck {
     const manifestById = new Map(packageDoc.manifest.map((item) => [item.id, item]));
     for (const item of packageDoc.manifest) {
       const fullPath = resolveManifestHref(opfDir, item.href);
+      const properties = item.properties ?? [];
       registry.registerResource({
         url: fullPath,
         mimeType: item.mediaType,
         inSpine: spineIdrefs.has(item.id),
         hasCoreMediaTypeFallback: this.hasCMTFallback(item.id, manifestById),
+        isNav: properties.includes("nav"),
+        isCoverImage: properties.includes("cover-image"),
+        isNcx: item.mediaType === "application/x-dtbncx+xml",
         ids: /* @__PURE__ */ new Set()
       });
     }
@@ -6685,7 +7367,7 @@ var EpubCheck = class _EpubCheck {
       visited.add(currentId);
       const item = manifestById.get(currentId);
       if (!item) return false;
-      if (CORE_MEDIA_TYPES.has(item.mediaType)) return true;
+      if (isCoreMediaType(item.mediaType)) return true;
       currentId = item.fallback;
     }
     return false;