@pptx-studio/validate 0.1.0

package/dist/index.js

@@ -0,0 +1,2131 @@
+import { NS, attribute, attributeNamespaceOf, attributeValue, childElements, childRanks, descendantElements, elementKey, isSchemaNamespace, namespaceOf, outOfOrderChildren, parseXml, sourceOf, textContent } from "@pptx-studio/xml";
+import { CONTENT_TYPE, CONTENT_TYPES_PART, FONT_DATA_CONTENT_TYPE, FONT_DATA_EXTENSION, PartStore, REL_TYPE, checkPartNameCollisions, isContentTypesStreamName, isRelationshipPartName, isValidRelationshipId, normalizePartName, partExtension, readZip, resolveRelativeTarget, sourcePartNameForRels, validatePartName } from "@pptx-studio/opc";
+//#region src/errors.ts
+/**
+* The single error type this package throws.
+*
+* Same invariant as `@pptx-studio/opc` and `@pptx-studio/xml`: **every failure
+* path throws a `ValidateError` and nothing else.**
+*
+* There is a second thing worth saying here, because this package is the one
+* where the distinction matters most. A *finding* is not an error. A finding is
+* the normal output of this package - it says a rule was broken, names the part
+* and the element, and is data a caller can render, sort or ignore. An error is
+* thrown only when validation itself could not be carried out, or when a caller
+* asked for bytes and the report says they must not have them.
+*
+* Getting that split wrong is how a validator becomes something people disable.
+* If every broken rule were an exception, the only way to see the second
+* problem would be to fix the first, and a caller with a deck that breaks nine
+* rules would learn about them one export at a time.
+*/
+/**
+* Machine-readable failure reasons.
+*
+* Deliberately few. Almost everything this package has to say is a finding.
+*/
+const VALIDATE_ERROR_CODES = [
+	"ERR_VALIDATION_FAILED",
+	"ERR_UNVALIDATABLE",
+	"ERR_UNKNOWN_RULE"
+];
+var ValidateError = class extends Error {
+	code;
+	detail;
+	constructor(code, message, detail = {}) {
+		super(message);
+		this.name = "ValidateError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+function isValidateError(value) {
+	return value instanceof ValidateError;
+}
+//#endregion
+//#region src/rules/rules.ts
+const RULES = [
+	{
+		id: "V001",
+		category: "package",
+		severity: "fatal",
+		evidence: "both",
+		title: "every part resolves to a content type",
+		why: "OPC has no default type. A part whose extension matches no `Default` and which carries no `Override` has no type at all, and a consumer has no way to know what it is holding. PowerPoint refuses such a package outright."
+	},
+	{
+		id: "V002",
+		category: "package",
+		severity: "fatal",
+		evidence: "both",
+		title: "the content-type map is internally consistent",
+		why: "Every `Override` names a part that exists; no extension is declared `Default` twice; no part is `Override`-ed twice. And the one Office omission that is famous for it: whenever any `.fntdata` part exists there must be a `<Default Extension=\"fntdata\" ContentType=\"application/x-fontdata\"/>`. Leaving it out is the canonical \"PowerPoint found a problem with content\" bug and it is what sub-phase 8.7 exists to get right."
+	},
+	{
+		id: "V003",
+		category: "package",
+		severity: "fatal",
+		evidence: "schema",
+		title: "the archive carries no directory entries and no ZIP64 record",
+		why: "A directory entry is not a part - no OPC part name may end in a slash - so writing one puts a thing in the package that nothing can name. ZIP64 is refused for a narrower reason: PowerPoint reads it, but our writer emits ZIP32 only, so a ZIP64 record in something we produced means a length field went somewhere it should not have. Both are about what *we* hand over; a package that arrives with either is reported and not refused."
+	},
+	{
+		id: "V004",
+		category: "package",
+		severity: "fatal",
+		evidence: "both",
+		title: "part names are ASCII, well formed, and free of pointless percent-escapes",
+		why: "The OPC grammar, plus the one thing it does not say. RFC 3986 §6.2.2.2 normalisation is enforced by PowerPoint rather than merely recommended: a percent-escape of an *unreserved* character is a whole-package refusal with `0x808D1005`. Measured nine for nine on one-name packages - `%2D`, `%41`, `%5F` and `%7E` refused; `%20`, `%23`, `%24`, `%2C` and `%3A` open. `@pptx-studio/opc` reports this as a warning (`M1.8`) because it must open what it is given; here it is fatal, because we are about to write it."
+	},
+	{
+		id: "V005",
+		category: "package",
+		severity: "fatal",
+		evidence: "both",
+		title: "there is exactly one main presentation part, of a matching content type",
+		why: "`_rels/.rels` must carry exactly one `officeDocument` relationship and it must resolve to a part whose content type is one of the four PresentationML main-part types. And the pairing PowerPoint enforces outside the schema: it checks the *file extension* against that content type and refuses the pair when they disagree, which is why a macro-enabled deck has to be written `.pptm`. `a32-macros` is the corpus deck that measured it."
+	},
+	{
+		id: "V006",
+		category: "relationships",
+		severity: "fatal",
+		evidence: "both",
+		title: "every relationship reference resolves in its own part’s `.rels`",
+		why: "`r:id`, `r:embed`, `r:link`, `r:pict`, `r:dm`, `r:lo`, `r:qs`, `r:cs` and every other attribute in the relationship namespace. Relationship ids are `xsd:ID` scoped to one `.rels` part, so the lookup is always against the referring part’s own collection and never against a global registry - a global one is not a shortcut, it is a bug. A dangling reference is fatal where an orphan relationship is harmless, which is the asymmetry that decides which direction media garbage collection may be aggressive in."
+	},
+	{
+		id: "V007",
+		category: "relationships",
+		severity: "fatal",
+		evidence: "schema",
+		title: "relationship ids are unique within a `.rels` and match the `xsd:ID` grammar",
+		why: "`Relationship/@Id` is `xsd:ID`: an XML Name, unique in its document. Two relationships sharing an id in one `.rels` makes every reference to it ambiguous, and which one a consumer picks is not defined anywhere."
+	},
+	{
+		id: "V008",
+		category: "relationships",
+		severity: "fatal",
+		evidence: "both",
+		title: "internal targets resolve inside the package, relative to the source part’s folder",
+		why: "A target is resolved against the folder of the part that *owns the `.rels`*, not against the package root and not against the `.rels` part’s own folder. Getting that wrong moves every relative target one directory up and is the classic reason a rebuilt deck loses all its images at once. `TargetMode=\"External\"` is passed through untouched and not resolved at all."
+	},
+	{
+		id: "V009",
+		category: "relationships",
+		severity: "fatal",
+		evidence: "measured",
+		title: "the relationship edges a part must have, and the ones it must not",
+		why: "Four findings, none of them in any schema, all found by bisection. (1) A slide needs **exactly one** `slideLayout` relationship resolving to a layout part - zero, two, one pointing at a master and one pointing at a missing part were each built as a single change and each refused; the binding lives only in the rels part, which is why \"change layout\" is a relationship rewrite. (2) A layout needs exactly one `slideMaster`. (3) A `cx:chartSpace` part with no `.rels` of its own is a whole-package refusal - it needs a `chartStyle` and a `chartColorStyle`, where the classic `c:chartSpace` needs neither. (4) A media part may not be both a media object’s target and a transition’s `p:snd`; two copies of the same bytes open, one shared copy does not."
+	},
+	{
+		id: "V010",
+		category: "order",
+		severity: "fatal",
+		evidence: "both",
+		title: "children appear in schema-sequence order",
+		why: "OOXML complex types are `xsd:sequence` almost everywhere, and PowerPoint enforces it. Microsoft’s own Open XML SDK shipped a regression that merely swapped two elements in `slideMaster1.xml` and PowerPoint refused the file. The ranks come from `@pptx-studio/xml`’s table, generated from the ECMA-376 Transitional schemas and checked against 194 148 elements PowerPoint wrote. This rule also covers the two the plan calls out by name, because the table already ranks them: `a:rPr` before `a:t`, and `a:endParaRPr` last in `a:p`."
+	},
+	{
+		id: "V011",
+		category: "order",
+		severity: "fatal",
+		evidence: "schema",
+		title: "`extLst` is last among its siblings, and every `a:ext` carries a `@uri`",
+		why: "Its own rule rather than a case of `V010`, because it has to hold in the places the generated table cannot rank - extension markup, `xsd:any` wildcards, and the vocabularies outside the four schemas we generate from. `extLst` is always last in every type that has one, and an `a:ext` without a `@uri` is an extension nobody can identify, which makes it unpreservable: the whole `extLst` contract is \"carry it through untouched, keyed by uri\"."
+	},
+	{
+		id: "V012",
+		category: "order",
+		severity: "fatal",
+		evidence: "both",
+		title: "no child appears in a parent whose content model has no place for it",
+		why: "Ordering catches a child in the wrong *position*; this catches one in the wrong *parent*, which the ordering rule cannot see because an unrankable child is skipped there rather than reported. The case that made it a rule is measured: `a:ahXY` or `a:cxn` as a direct child of `a:custGeom`, without its `a:ahLst`/`a:cxnLst` wrapper, is a whole-package refusal. Only parents the table knows and whose model has no `xsd:any` are checked, and markup in a namespace the table does not cover is left alone."
+	},
+	{
+		id: "V013",
+		category: "required",
+		severity: "fatal",
+		evidence: "schema",
+		title: "`p:presentation` carries `p:notesSz`",
+		why: "The asymmetry that catches people: in `CT_Presentation`, `p:sldSz` is `[0..1]` and `p:notesSz` is `[1..1]`. A generator that treats the two the same way, or that omits both because the deck has no notes, writes a presentation part that is missing a required child."
+	},
+	{
+		id: "V014",
+		category: "required",
+		severity: "fatal",
+		evidence: "schema",
+		title: "`p:clrMap` carries all twelve attributes",
+		why: "`CT_ColorMapping` has twelve attributes - `bg1`, `tx1`, `bg2`, `tx2`, `accent1`…`accent6`, `hlink`, `folHlink` - and every one is required. There is no default and no partial map: eleven of twelve is not a map with one slot missing, it is an invalid element. This is also the element that decides what `bg1` and `tx1` resolve to, so a wrong one is a deck that renders in the wrong colours everywhere at once."
+	},
+	{
+		id: "V015",
+		category: "required",
+		severity: "fatal",
+		evidence: "schema",
+		title: "`p:spTree` begins with `p:nvGrpSpPr` then `p:grpSpPr`",
+		why: "A shape tree is a group shape, and `CT_GroupShape` requires both of them first, in that order, before any child shape. An empty slide still has them. This is separate from `V010` because the failure is a missing required child rather than a misordered optional one, and the two need different messages: \"add this\" against \"move this\"."
+	},
+	{
+		id: "V016",
+		category: "required",
+		severity: "fatal",
+		evidence: "schema",
+		title: "every text body has `a:bodyPr` and at least one `a:p`",
+		why: "`CT_TextBody` is `bodyPr` then optional `lstStyle` then `a:p` at `[1..unbounded]`. A shape whose text was deleted down to nothing is the way this gets broken in an editor: the last paragraph goes, and what is left is a `p:txBody` with no `a:p` in it. An empty paragraph is not the same as no paragraph, and `a:endParaRPr` is where its height comes from."
+	},
+	{
+		id: "V017",
+		category: "required",
+		severity: "fatal",
+		evidence: "schema",
+		title: "`p:graphicFrame` carries `p:xfrm` and `a:graphic`",
+		why: "And note the namespace: it is `p:xfrm`, PresentationML, not the `a:xfrm` that every other shape uses. A graphic frame has no placeholder-inherited geometry path, so this is also the reason sub-phase 7.4 gives a rebound chart or table a *copy* of the target layout’s transform instead of deleting its own the way it does for every other shape - delete it there and the frame collapses to zero size."
+	},
+	{
+		id: "V018",
+		category: "ids",
+		severity: "fatal",
+		evidence: "schema",
+		title: "`p:sldId/@id` is 256…2147483647 and unique",
+		why: "`ST_SlideId` is not zero-based and not unbounded. The floor of 256 is the part people get wrong, because nothing about a first slide suggests its id should start there. Four id spaces exist in a presentation and they are not one allocator; this is the first of them."
+	},
+	{
+		id: "V019",
+		category: "ids",
+		severity: "fatal",
+		evidence: "both",
+		title: "master and layout ids are ≥ 2147483648 and unique **across both lists**",
+		why: "`ST_SlideMasterId` and `ST_SlideLayoutId` are both \"2147483648 and up\" and no schema says they may not overlap. PowerPoint allocates them from one running counter - master, its layouts, next master, its layouts - and refuses a package that does not. Found by bisection when `a12-masters` would not open: two counters are indistinguishable from correct with one master and collide on the second, so **every** two-master package was refused."
+	},
+	{
+		id: "V020",
+		category: "ids",
+		severity: "fatal",
+		evidence: "both",
+		title: "`p:cNvPr/@id` is unique within its part and ≤ 2147483647",
+		why: "Unique *within a part*, and free to repeat across parts - a shape id is not a document-wide identity and treating it as one is how a duplicate-slide implementation ends up renumbering things it should not. The range is measured rather than read: `ST_DrawingElementId` is `xsd:unsignedInt`, but every value from 0 to 2147483647 opens, 2147483648…4294967294 are whole-package refusals, and 4294967295 opens - PowerPoint reads the attribute as a signed 32-bit integer and keeps `0xFFFFFFFF` as a sentinel it renumbers away on save. `a39-large-ids` is the corpus deck."
+	},
+	{
+		id: "V021",
+		category: "ids",
+		severity: "warning",
+		evidence: "schema",
+		title: "a slide placeholder’s `(type, idx)` has a counterpart in its layout",
+		why: "A `p:ph` that matches nothing in the layout inherits nothing: no geometry, no text style, no prompt. PowerPoint opens the file and draws the shape at whatever it can work out, which is why this is a warning and not fatal - the deck is not refused, it is silently wrong. Matching follows the five tiers sub-phase 7.1 hardens, and the asymmetry that matters is checked here too: slide→layout matches on `(type, idx)` where layout→master matches on **type only**."
+	},
+	{
+		id: "V022",
+		category: "refused",
+		severity: "fatal",
+		evidence: "measured",
+		title: "`p:ph/@type` is not `hdr` or `sldImg` outside a notes or handout part",
+		why: "A whole-package refusal, on a slide layout and on a slide alike, either one alone with no other change. The other seven content types were built as one-type packages in the same bisection and every one opens: `obj`, `chart`, `tbl`, `clipArt`, `dgm`, `media`, `pic`. Nothing in the schema says so - `CT_Placeholder` is one complex type shared by masters, layouts, slides, notes slides and handout masters, and `ST_PlaceholderType` is one enumeration holding all sixteen values. The restriction is real and unwritten: those two belong to the notes and handout families."
+	},
+	{
+		id: "V023",
+		category: "refused",
+		severity: "fatal",
+		evidence: "measured",
+		title: "every geometry guide named is a guide that is defined",
+		why: "A whole-package refusal, not a repair and not a dropped shape. It applies both to an `a:gd` formula naming an adjust value no `a:avLst` defines and to an `a:pt` coordinate naming a guide no `a:gdLst` defines. `ST_GeomGuideName` is an unconstrained token, so this is schema-legal markup refused for a reason no schema states - and it is the rule that sub-phase 2.5 needs, because dragging an adjust handle is exactly the operation that can write a formula referring to a guide that is no longer there."
+	},
+	{
+		id: "V024",
+		category: "refused",
+		severity: "fatal",
+		evidence: "both",
+		title: "`c:tx` holds `c:strRef` or `c:v`, never `c:strLit`",
+		why: "`CT_SerTx` is a choice of exactly those two. The trap is that `c:cat` and `c:val`, two elements away in the same series, both accept the literal forms - so the markup looks like something that ought to work, and it is a whole-package refusal."
+	},
+	{
+		id: "V025",
+		category: "refused",
+		severity: "fatal",
+		evidence: "measured",
+		title: "no `p:control`",
+		why: "A whole-package refusal in all eight forms tried: bare, name-only, with and without `r:id`, with a `p:pic` preview, with an ActiveX part and its `.bin`, and inside a macro-enabled package. An empty `p:controls` is accepted, which places the refusal precisely on the child element. We do not author ActiveX controls and never will; the rule exists so that a file that has one is not handed back with it re-serialised into a form PowerPoint likes less than the original."
+	},
+	{
+		id: "V026",
+		category: "refused",
+		severity: "fatal",
+		evidence: "measured",
+		title: "a `cs:chartStyle` carries all thirty-one of its entries",
+		why: "Four entries refused; thirty-one opened. And the shape of the finding is the interesting half: a chart with **no** chart-style relationship at all is fine, so this is not \"the part is required\" - it is \"if the part exists it must be complete\". A subset is worse than an absence, which is the opposite of what a partial-styling model would predict."
+	},
+	{
+		id: "V027",
+		category: "preservation",
+		severity: "fatal",
+		evidence: "schema",
+		needsBaseline: true,
+		title: "a part nobody edited comes back out byte-for-byte",
+		why: "The load-bearing one, and the reason the architecture is what it is. Preserving charts, SmartArt, animations, OLE and macros is unachievable in any design where the writer has to *understand* a feature to emit it, so preservation is the default state rather than a feature - and this rule is where that stops being an intention. `ppt/embeddings/*.bin` is called out inside it: those are OLE2/CFB compound files and any rewrite of one is a guaranteed repair prompt."
+	},
+	{
+		id: "V028",
+		category: "preservation",
+		severity: "fatal",
+		evidence: "schema",
+		needsBaseline: true,
+		title: "no `mc:AlternateContent` branch and no `extLst` was rebuilt",
+		why: "Two things we hold opaque, for one reason: we do not know what is in them. An `mc:AlternateContent` branch we do not understand must arrive and leave identical, because `mc:Choice/@Requires` names a *prefix* and rewriting the branch is how ignorable extension markup becomes a hard error. An `extLst` is an ordered list keyed by `@uri` and never a typed model that is rebuilt from fields - `a34-extlst` measured that PowerPoint carries an unknown `a:ext/@uri` through untouched, so anything we drop there is something the file would otherwise have kept forever."
+	},
+	{
+		id: "V029",
+		category: "preservation",
+		severity: "fatal",
+		evidence: "both",
+		needsBaseline: true,
+		title: "text and field identity survive: `xml:space`, `a:fld/@id`, cached field text",
+		why: "Three small things that are each silently destructive. An `a:t` with leading or trailing whitespace needs `xml:space=\"preserve\"` if it was written with it, because dropping the attribute changes what the text *is*. `a:fld/@id` is a required `ST_Guid` and regenerating one can make PowerPoint repair the file. And a field’s cached `a:t` is the only thing that renders when we cannot evaluate the field ourselves, so discarding it turns a date placeholder into an empty box on every consumer that is not PowerPoint."
+	}
+];
+const BY_ID = new Map(RULES.map((rule) => [rule.id, rule]));
+function ruleById(id) {
+	return BY_ID.get(id);
+}
+const RULE_IDS = RULES.map((rule) => rule.id);
+/** Rules that need the package as it was opened. See `Rule.needsBaseline`. */
+const BASELINE_RULES = RULES.filter((rule) => "needsBaseline" in rule).map((rule) => rule.id);
+//#endregion
+//#region src/report/report.ts
+/** Fatal, then warning; then by part; then by offset; then by rule. */
+function compareFindings(a, b) {
+	if (a.severity !== b.severity) return a.severity === "fatal" ? -1 : 1;
+	if (a.where.part !== b.where.part) return a.where.part.localeCompare(b.where.part);
+	const offsetA = a.where.offset ?? -1;
+	const offsetB = b.where.offset ?? -1;
+	if (offsetA !== offsetB) return offsetA - offsetB;
+	return a.rule.localeCompare(b.rule);
+}
+/**
+* The key two reports are differenced on.
+*
+* Includes the message, because the message carries the instance - the id that
+* collided, the guide that was not defined. Two findings of the same rule at
+* the same place with different values are different findings, and treating
+* them as one would let an introduced defect hide behind an inherited one.
+*/
+function findingKey(finding) {
+	return [
+		finding.rule,
+		finding.where.part,
+		finding.where.xpath ?? "",
+		finding.message
+	].join("\0");
+}
+function buildReport(input) {
+	const findings = [...input.findings].sort(compareFindings);
+	const blocking = findings.filter((finding) => finding.severity === "fatal" && finding.origin !== "inherited").length;
+	return {
+		findings,
+		checked: input.checked,
+		skipped: input.skipped,
+		problems: input.problems,
+		blocking,
+		ok: blocking === 0
+	};
+}
+function isReport(value) {
+	return typeof value === "object" && value !== null && Array.isArray(value.findings) && typeof value.blocking === "number";
+}
+/**
+* A report as text.
+*
+* Grouped by part rather than by rule, because the question a reader has is
+* "what is wrong with this file", and a file is a set of parts. Grouping by
+* rule is the right shape for the corpus gate and the wrong one here.
+*/
+function formatReport(report, options = {}) {
+	const showInherited = options.inherited ?? true;
+	const showWarnings = options.warnings ?? true;
+	const shown = report.findings.filter((finding) => (showInherited || finding.origin !== "inherited") && (showWarnings || finding.severity === "fatal"));
+	const lines = [];
+	if (shown.length === 0) lines.push(report.findings.length === 0 ? "no findings" : "no findings shown");
+	else {
+		const byPart = /* @__PURE__ */ new Map();
+		for (const finding of shown) {
+			const bucket = byPart.get(finding.where.part);
+			if (bucket) bucket.push(finding);
+			else byPart.set(finding.where.part, [finding]);
+		}
+		for (const [part, findings] of byPart) {
+			lines.push("");
+			lines.push("  " + (part === "/" ? "(package)" : part));
+			for (const finding of findings) {
+				const tag = finding.severity === "fatal" ? finding.origin === "inherited" ? "fatal (already there)" : "fatal" : "warning";
+				lines.push("    " + finding.rule + "  " + tag);
+				if (finding.where.xpath !== null) lines.push("      " + finding.where.xpath);
+				lines.push("      " + finding.message);
+			}
+		}
+	}
+	for (const problem of report.problems) {
+		lines.push("");
+		lines.push("  " + problem.part + " could not be read: " + problem.message);
+	}
+	for (const skipped of report.skipped) {
+		lines.push("");
+		lines.push("  " + skipped.rule + " did not run: " + skipped.why);
+	}
+	if (options.explain === true) {
+		const seen = /* @__PURE__ */ new Set();
+		for (const finding of shown) {
+			if (seen.has(finding.rule)) continue;
+			seen.add(finding.rule);
+			const rule = ruleById(finding.rule);
+			if (rule === void 0) continue;
+			lines.push("");
+			lines.push("  " + rule.id + " - " + rule.title);
+			lines.push("    " + rule.why);
+		}
+	}
+	lines.push("");
+	lines.push("validate: " + String(report.checked.length) + " rule(s), " + String(report.findings.length) + " finding(s), " + String(report.blocking) + " blocking");
+	return lines.join("\n");
+}
+//#endregion
+//#region src/report/location.ts
+/** A location that names a part and nothing inside it. */
+function partLocation(part) {
+	return {
+		part,
+		xpath: null,
+		offset: null
+	};
+}
+/** The location of the package itself: the archive, the content types, the graph. */
+const PACKAGE_LOCATION = {
+	part: "/",
+	xpath: null,
+	offset: null
+};
+/** 1-based position among same-named element siblings, or `null` if it is alone. */
+function positionAmongSiblings(element) {
+	const parent = element.parent;
+	if (parent === void 0) return null;
+	let position = 0;
+	let seen = 0;
+	for (const child of parent.children) {
+		if (child.type !== "element" || child.qname !== element.qname) continue;
+		seen++;
+		if (child === element) position = seen;
+	}
+	return seen > 1 ? position : null;
+}
+/**
+* The XPath of an element, from the document root.
+*
+* Never throws and never returns an empty string: a detached element - one
+* whose `parent` chain does not reach a root - still gets its own name, so a
+* finding built from a node the caller synthesised is degraded rather than
+* lost.
+*/
+function xpathOf(element) {
+	const steps = [];
+	for (let node = element; node !== void 0; node = node.parent) {
+		const position = positionAmongSiblings(node);
+		steps.push(position === null ? node.qname : node.qname + "[" + String(position) + "]");
+	}
+	steps.reverse();
+	return "/" + steps.join("/");
+}
+/** The XPath of an attribute: its owner's path, then `/@qname`. */
+function xpathOfAttribute(owner, attr) {
+	const qname = typeof attr === "string" ? attr : attr.qname;
+	return xpathOf(owner) + "/@" + qname;
+}
+/** A location for an element inside a named part. */
+function elementLocation(part, element) {
+	return {
+		part,
+		xpath: xpathOf(element),
+		offset: element.start
+	};
+}
+/**
+* A location for one attribute of an element.
+*
+* The offset is the attribute's own start when the element carries it, and the
+* element's start when it does not - which is the case that matters, because a
+* *missing* required attribute is a finding and it has to point somewhere.
+*/
+function attributeLocation(part, element, qname) {
+	const attr = attribute(element, qname);
+	return {
+		part,
+		xpath: xpathOfAttribute(element, qname),
+		offset: attr === void 0 ? element.start : attr.start
+	};
+}
+/**
+* `line:column` for an offset, 1-based, or `null`.
+*
+* Not part of `Location`, because computing it means scanning the source from
+* the beginning and a report with three hundred findings would scan it three
+* hundred times. Callers that render a report for a human ask for it once, at
+* the point of rendering, for the findings they are about to show.
+*/
+function lineColumn(source, offset) {
+	let line = 1;
+	let lineStart = 0;
+	const limit = Math.min(offset, source.length);
+	for (let i = 0; i < limit; i++) if (source.charCodeAt(i) === 10) {
+		line++;
+		lineStart = i + 1;
+	}
+	return {
+		line,
+		column: limit - lineStart + 1
+	};
+}
+/** Document order, for sorting findings within a part. */
+function inDocumentOrder(a, b) {
+	return a.start - b.start;
+}
+/** The root element's qname, for the handful of rules that dispatch on it. */
+function rootName(document) {
+	return document.root.qname;
+}
+//#endregion
+//#region src/context.ts
+/** Content types whose parts are XML, beyond everything ending in `+xml`. */
+const XML_CONTENT_TYPES = /* @__PURE__ */ new Set(["application/xml", "text/xml"]);
+function isXmlContentType(contentType) {
+	if (contentType === void 0) return false;
+	const base = contentType.split(";")[0].trim().toLowerCase();
+	return base.endsWith("+xml") || XML_CONTENT_TYPES.has(base);
+}
+var RuntimeContext = class {
+	store;
+	bytes;
+	archive;
+	baseline;
+	findings = [];
+	problems = [];
+	#parts = null;
+	#documents = /* @__PURE__ */ new Map();
+	#baselineDocuments = /* @__PURE__ */ new Map();
+	constructor(input) {
+		this.store = input.store;
+		this.bytes = input.bytes ?? null;
+		this.archive = input.archive ?? null;
+		this.baseline = input.baseline ?? null;
+	}
+	parts() {
+		this.#parts ??= this.store.partNames;
+		return this.#parts;
+	}
+	read(part) {
+		if (!this.store.has(part)) return null;
+		try {
+			return this.store.read(part);
+		} catch (error) {
+			this.problem(part, describe(error));
+			return null;
+		}
+	}
+	contentType(part) {
+		return this.store.contentTypeOf(part);
+	}
+	document(part) {
+		const key = normalizePartName(part);
+		const cached = this.#documents.get(key);
+		if (cached !== void 0) return cached;
+		const parsed = this.#parse(part, this.read(part));
+		this.#documents.set(key, parsed);
+		return parsed;
+	}
+	baselineDocument(part) {
+		if (this.baseline === null) return null;
+		const key = normalizePartName(part);
+		const cached = this.#baselineDocuments.get(key);
+		if (cached !== void 0) return cached;
+		const parsed = this.#parse(part, this.baselineRead(part), true);
+		this.#baselineDocuments.set(key, parsed);
+		return parsed;
+	}
+	#parse(part, bytes, quiet = false) {
+		if (bytes === null) return null;
+		if (!isRelationshipPartName(part) && !isXmlContentType(this.contentType(part))) return null;
+		try {
+			return parseXml(bytes);
+		} catch (error) {
+			if (!quiet) this.problem(part, describe(error));
+			return null;
+		}
+	}
+	#contentTypesDocument;
+	contentTypesDocument() {
+		if (this.#contentTypesDocument !== void 0) return this.#contentTypesDocument;
+		this.#contentTypesDocument = null;
+		const archive = this.archive;
+		if (archive !== null) {
+			const entry = archive.entries.find((e) => isContentTypesStreamName(e.name));
+			if (entry !== void 0) try {
+				this.#contentTypesDocument = parseXml(archive.read(entry));
+			} catch (error) {
+				this.problem(CONTENT_TYPES_PART, describe(error));
+			}
+		}
+		return this.#contentTypesDocument;
+	}
+	baselineRead(part) {
+		if (this.baseline === null || !this.baseline.has(part)) return null;
+		try {
+			return this.baseline.read(part);
+		} catch {
+			return null;
+		}
+	}
+	edited(part) {
+		return this.store.info(part)?.fromArchive === false;
+	}
+	add(rule, where, message) {
+		const definition = ruleById(rule);
+		if (definition === void 0) return;
+		this.findings.push({
+			rule,
+			severity: definition.severity,
+			category: definition.category,
+			where,
+			message,
+			origin: "unknown"
+		});
+	}
+	problem(part, message) {
+		if (!this.problems.some((p) => p.part === part && p.message === message)) this.problems.push({
+			part,
+			message
+		});
+	}
+};
+function describe(error) {
+	if (error instanceof Error) {
+		const code = error.code;
+		return typeof code === "string" ? code + ": " + error.message : error.message;
+	}
+	return String(error);
+}
+function createContext(input) {
+	return new RuntimeContext(input);
+}
+//#endregion
+//#region src/rels.ts
+/**
+* Every relationship part in the package, parsed.
+*
+* A `.rels` whose root is not `Relationships` in the OPC namespace is skipped
+* and recorded as a problem, because there is nothing sensible to say about it
+* rule by rule and saying it once is better than saying it four times.
+*/
+const CACHE = /* @__PURE__ */ new WeakMap();
+function readRelsParts(ctx) {
+	const cached = CACHE.get(ctx);
+	if (cached !== void 0) return cached;
+	const parts = scanRelsParts(ctx);
+	CACHE.set(ctx, parts);
+	return parts;
+}
+/**
+* Memoised above, because five of the twenty-nine rules want this list and each
+* would otherwise re-walk every `.rels` part in the package. The parsed trees
+* are already cached on the context; what is saved here is the element scan and
+* the allocation, which on a three-hundred-slide deck is five passes over a
+* thousand relationship parts for one answer that cannot have changed.
+*
+* Keyed by context rather than by store, so nothing survives one validation run
+* into the next.
+*/
+function scanRelsParts(ctx) {
+	const out = [];
+	for (const partName of ctx.parts()) {
+		if (!isRelationshipPartName(partName)) continue;
+		const document = ctx.document(partName);
+		if (document === null) continue;
+		const root = document.root;
+		if (root.local !== "Relationships") {
+			ctx.problem(partName, "root element is <" + root.qname + ">, not <Relationships>");
+			continue;
+		}
+		let source;
+		try {
+			source = partName === "/_rels/.rels" ? "/" : sourcePartNameForRels(partName);
+		} catch {
+			ctx.problem(partName, "is not a well-formed relationship part name");
+			continue;
+		}
+		const relationships = [];
+		for (const child of childElements(root)) {
+			if (child.local !== "Relationship") continue;
+			relationships.push({
+				id: attributeValue(child, "Id") ?? "",
+				type: attributeValue(child, "Type") ?? "",
+				target: attributeValue(child, "Target") ?? "",
+				targetMode: attributeValue(child, "TargetMode") ?? "Internal",
+				element: child
+			});
+		}
+		out.push({
+			partName,
+			source,
+			relationships,
+			root
+		});
+	}
+	return out;
+}
+/**
+* Resolve an internal target against the folder of the part that owns the
+* `.rels` - never against the package root, and never against the `.rels`
+* part's own folder.
+*
+* The distinction is the whole of rule `V008`. `_rels/` is a directory in the
+* archive but not in the resolution model: a `Target="../media/image1.png"` in
+* `/ppt/slides/_rels/slide1.xml.rels` resolves against `/ppt/slides/`, giving
+* `/ppt/media/image1.png`. Resolving it against `/ppt/slides/_rels/` instead
+* yields `/ppt/slides/media/image1.png`, which is one directory too deep and is
+* why a rebuilt deck loses every image at once rather than one of them.
+*/
+function resolveTarget(source, target) {
+	try {
+		return {
+			part: resolveRelativeTarget(source, target),
+			failure: null
+		};
+	} catch (error) {
+		return {
+			part: null,
+			failure: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/** `.rels` parts keyed by the **source** part they describe, normalised. */
+function bySource(parts) {
+	const map = /* @__PURE__ */ new Map();
+	for (const part of parts) map.set(part.source === "/" ? "/" : normalizePartName(part.source), part);
+	return map;
+}
+//#endregion
+//#region src/rules/package.ts
+/**
+* `V001` … `V005`: the container.
+*
+* These five run before any markup is looked at, and they are the ones whose
+* failure mode is "PowerPoint declines to open the file at all" rather than
+* "the slide renders wrong". The package layer has no partial credit: a part
+* with no content type is not a part with an unknown type, it is a stream
+* nothing is allowed to interpret.
+*/
+/** Every part resolves to a content type. */
+function v001ContentTypeCoverage(ctx) {
+	for (const part of ctx.parts()) {
+		if (ctx.contentType(part) !== void 0) continue;
+		const extension = partExtension(part);
+		ctx.add("V001", partLocation(part), "no content type: nothing in [Content_Types].xml covers it. Add an Override for the part, " + (extension === "" ? "or give it an extension a Default covers." : "or a Default for the \"" + extension + "\" extension."));
+	}
+}
+/**
+* The content-type map holds together.
+*
+* Four separate things, one rule, because they are one question - "does this
+* map say exactly one thing about every part" - and a caller who has to
+* remember four rule ids to know whether their content types are sound is a
+* caller who will remember three.
+*/
+function v002ContentTypeMap(ctx) {
+	const document = ctx.contentTypesDocument();
+	if (document === null) {
+		if (ctx.archive === null) ctx.problem(CONTENT_TYPES_PART, "not available: only a PartStore was supplied, so V002 checked the parsed map and not the markup. A duplicate <Default> or <Override> is visible only in the markup.");
+		else ctx.add("V002", partLocation(CONTENT_TYPES_PART), "the content-type stream is missing or would not parse.");
+	} else {
+		const seenDefault = /* @__PURE__ */ new Map();
+		const seenOverride = /* @__PURE__ */ new Map();
+		for (const child of childElements(document.root)) if (child.local === "Default") {
+			const extension = (attributeValue(child, "Extension") ?? "").toLowerCase();
+			const count = (seenDefault.get(extension) ?? 0) + 1;
+			seenDefault.set(extension, count);
+			if (count === 2) ctx.add("V002", elementLocation(CONTENT_TYPES_PART, child), "the \"" + extension + "\" extension has two <Default> entries. PowerPoint refuses a duplicate even when the two agree.");
+		} else if (child.local === "Override") {
+			const partName = attributeValue(child, "PartName") ?? "";
+			const key = partName.toLowerCase();
+			const count = (seenOverride.get(key) ?? 0) + 1;
+			seenOverride.set(key, count);
+			if (count === 2) ctx.add("V002", elementLocation(CONTENT_TYPES_PART, child), partName + " has two <Override> entries.");
+			if (partName !== "" && !ctx.store.has(partName)) ctx.add("V002", elementLocation(CONTENT_TYPES_PART, child), "an <Override> names " + partName + ", which is not in the package.");
+		}
+	}
+	const fontParts = ctx.parts().filter((part) => partExtension(part).toLowerCase() === FONT_DATA_EXTENSION);
+	if (fontParts.length > 0) {
+		const declared = ctx.store.contentTypes.defaults.find((entry) => entry.extension.toLowerCase() === FONT_DATA_EXTENSION);
+		if (declared === void 0) ctx.add("V002", partLocation(CONTENT_TYPES_PART), "the package has " + String(fontParts.length) + " .fntdata part(s) and no <Default Extension=\"fntdata\" ContentType=\"" + FONT_DATA_CONTENT_TYPE + "\"/>. PowerPoint reports the file as having a problem with its content.");
+		else if (declared.contentType.toLowerCase() !== FONT_DATA_CONTENT_TYPE.toLowerCase()) ctx.add("V002", partLocation(CONTENT_TYPES_PART), "the fntdata Default is typed \"" + declared.contentType + "\"; embedded fonts are \"" + FONT_DATA_CONTENT_TYPE + "\".");
+	}
+}
+/** No directory entries, no ZIP64 record. */
+function v003ArchiveShape(ctx) {
+	const archive = ctx.archive;
+	if (archive === null) return;
+	for (const entry of archive.entries) {
+		if (!entry.isDirectory) continue;
+		ctx.add("V003", PACKAGE_LOCATION, "the archive carries a directory entry, \"" + entry.name + "\". No OPC part name may end in a slash, so nothing in the package can name it.");
+	}
+	if (ctx.bytes !== null && hasZip64Locator(ctx.bytes)) ctx.add("V003", PACKAGE_LOCATION, "the archive carries a ZIP64 end-of-central-directory locator. Our writer emits ZIP32 only, so one in a package we produced means a size or offset field overflowed.");
+}
+/**
+* The ZIP64 locator signature, searched backwards from the end.
+*
+* The locator sits immediately before the end-of-central-directory record,
+* which is within 64 KB + 22 bytes of the end once a comment is allowed for.
+* Same computation `@pptx-studio/census` makes; duplicated rather than shared
+* because `census` is a sibling at layer 1 and depending on it to answer one
+* boolean would put a whole feature scanner in the export path.
+*/
+function hasZip64Locator(bytes) {
+	if (bytes.byteLength < 20) return false;
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	const from = Math.max(0, bytes.byteLength - 65536 - 40);
+	for (let at = bytes.byteLength - 20; at >= from; at--) if (view.getUint32(at, true) === 117853008) return true;
+	return false;
+}
+/**
+* Part names, with `M1.8` raised from warning to fatal.
+*
+* `@pptx-studio/opc` rates a percent-escape of an unreserved character a
+* warning, and that is right *there*: the package layer has to open what it is
+* given, and a file that arrives with `%5F` in a part name is a file the user
+* still wants to see. Here we are about to write one, and PowerPoint refuses
+* it with `0x808D1005` - measured nine for nine on one-name packages. Raising
+* the severity at the point of writing rather than at the point of reading is
+* the whole shape of the read-leniently/write-strictly split this project uses
+* everywhere.
+*/
+function v004PartNames(ctx) {
+	for (const part of ctx.parts()) for (const violation of validatePartName(part)) ctx.add("V004", partLocation(part), violation.rule + ": " + violation.message);
+	for (const collision of checkPartNameCollisions([...ctx.parts()])) ctx.add("V004", partLocation(collision.names[0]), collision.rule + ": " + collision.message);
+}
+/** The main presentation part: exactly one, of a type that matches the file. */
+const MAIN_PART_TYPES = /* @__PURE__ */ new Set([
+	CONTENT_TYPE.presentation,
+	CONTENT_TYPE.template,
+	CONTENT_TYPE.slideshow,
+	"application/vnd.ms-powerpoint.presentation.macroEnabled.main+xml",
+	"application/vnd.ms-powerpoint.template.macroEnabled.main+xml",
+	"application/vnd.ms-powerpoint.slideshow.macroEnabled.main+xml"
+]);
+function v005MainPart(ctx) {
+	const rootRels = readRelsParts(ctx).find((rels) => rels.source === "/");
+	if (rootRels === void 0) {
+		ctx.add("V005", partLocation("/_rels/.rels"), "the package has no root relationship part. It is the only way in to a .pptx; without it nothing can be reached and PowerPoint reports the file as corrupted and unreadable.");
+		return;
+	}
+	const officeDocuments = rootRels.relationships.filter((rel) => rel.type === REL_TYPE.officeDocument);
+	if (officeDocuments.length === 0) {
+		ctx.add("V005", partLocation(rootRels.partName), "no officeDocument relationship. Nothing names the main presentation part.");
+		return;
+	}
+	if (officeDocuments.length > 1) for (const rel of officeDocuments.slice(1)) ctx.add("V005", elementLocation(rootRels.partName, rel.element), "a second officeDocument relationship (" + rel.id + " -> " + rel.target + "). Exactly one part is the main part.");
+	const main = officeDocuments[0];
+	const resolved = resolveTarget(rootRels.source, main.target);
+	if (resolved.part === null) {
+		ctx.add("V005", elementLocation(rootRels.partName, main.element), "the officeDocument target does not resolve: " + (resolved.failure ?? "unknown reason"));
+		return;
+	}
+	if (!ctx.store.has(resolved.part)) {
+		ctx.add("V005", elementLocation(rootRels.partName, main.element), "the officeDocument target " + resolved.part + " is not in the package.");
+		return;
+	}
+	const contentType = ctx.contentType(resolved.part);
+	if (contentType === void 0 || !MAIN_PART_TYPES.has(contentType)) ctx.add("V005", partLocation(resolved.part), "the main part is typed " + (contentType === void 0 ? "(nothing)" : "\"" + contentType + "\"") + ", which is not a PresentationML main-part type. PowerPoint also checks this against the file extension and refuses the pair when they disagree, which is why a macro-enabled deck has to be written .pptm.");
+}
+//#endregion
+//#region src/rules/relationships.ts
+/**
+* `V006` … `V009`: the relationship graph.
+*
+* The graph is where a `.pptx` keeps almost everything that is not text. A
+* slide does not name its layout, a picture does not name its image, and a
+* chart does not name its workbook: each of them names an `rId`, and the `rId`
+* means something only inside one `.rels` part. Three consequences run through
+* all four rules below.
+*
+* **Ids are scoped, not global.** `rId3` in `slide1.xml.rels` and `rId3` in
+* `slide2.xml.rels` are unrelated. A global id registry is not an optimisation,
+* it is a bug, and it is a bug that works fine on every one-slide test deck.
+*
+* **Dangling is fatal; orphaned is harmless.** A reference to a relationship
+* that is not there, or a relationship to a part that is not there, breaks the
+* file. A relationship nothing references does not. That asymmetry is what
+* decides the direction media garbage collection is allowed to be aggressive
+* in, and getting it backwards is how a "clean-up" pass deletes the layouts a
+* user was about to switch to.
+*
+* **Targets resolve against the source part's folder.** Not the package root,
+* and not the `.rels` file's own folder.
+*/
+/**
+* Attributes in the relationship namespace that name a relationship id.
+*
+* All of them do, in practice - `r:id`, `r:embed`, `r:link`, `r:pict`,
+* `r:dm`, `r:lo`, `r:qs`, `r:cs`, `r:href` and the rest. Rather than list the
+* ones we know, this rule matches on the *namespace*, so an attribute from a
+* schema we have not read yet is checked rather than skipped. The two things
+* that must not be treated as ids are handled explicitly below.
+*/
+function isRelationshipReference(owner, attr) {
+	if (attr.prefix === "" || attr.prefix === "xmlns") return false;
+	return attributeNamespaceOf(owner, attr) === NS.r;
+}
+/** Every `r:*` reference resolves in its own part's `.rels`. */
+function v006ReferencesResolve(ctx) {
+	const relsBySource = bySource(readRelsParts(ctx));
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const rels = relsBySource.get(normalizePartName(part));
+		const known = new Set((rels?.relationships ?? []).map((rel) => rel.id));
+		for (const element of descendantElements(document.root)) for (const attr of element.attributes) {
+			if (!isRelationshipReference(element, attr)) continue;
+			if (attr.value === "") continue;
+			if (known.has(attr.value)) continue;
+			ctx.add("V006", attributeLocation(part, element, attr.qname), rels === void 0 ? "<" + element.qname + " " + attr.qname + "=\"" + attr.value + "\"> refers to a relationship, but this part has no .rels at all." : "<" + element.qname + " " + attr.qname + "=\"" + attr.value + "\"> names a relationship that " + rels.partName + " does not declare. Ids are scoped to one .rels part; this one has " + (known.size === 0 ? "none" : [...known].sort().join(", ")) + ".");
+		}
+	}
+}
+/** Relationship ids are unique within a `.rels` and are `xsd:ID`s. */
+function v007RelationshipIds(ctx) {
+	for (const rels of readRelsParts(ctx)) {
+		const seen = /* @__PURE__ */ new Map();
+		for (const rel of rels.relationships) {
+			if (rel.id === "") {
+				ctx.add("V007", elementLocation(rels.partName, rel.element), "a <Relationship> has no Id.");
+				continue;
+			}
+			if (!isValidRelationshipId(rel.id)) ctx.add("V007", elementLocation(rels.partName, rel.element), "Id=\"" + rel.id + "\" is not an xsd:ID. An xsd:ID is an XML NCName: it cannot begin with a digit and cannot contain a space or a colon.");
+			const count = (seen.get(rel.id) ?? 0) + 1;
+			seen.set(rel.id, count);
+			if (count === 2) ctx.add("V007", elementLocation(rels.partName, rel.element), "Id=\"" + rel.id + "\" appears twice. Which target a reference to it means would be undecidable.");
+		}
+	}
+}
+/** Internal targets resolve, stay inside the package, and name a part that exists. */
+function v008TargetsResolve(ctx) {
+	for (const rels of readRelsParts(ctx)) for (const rel of rels.relationships) {
+		if (rel.targetMode === "External") continue;
+		if (rel.targetMode !== "Internal") {
+			ctx.add("V008", elementLocation(rels.partName, rel.element), "TargetMode=\"" + rel.targetMode + "\" is neither Internal nor External.");
+			continue;
+		}
+		if (rel.target === "") {
+			ctx.add("V008", elementLocation(rels.partName, rel.element), rel.id + " has an empty Target.");
+			continue;
+		}
+		const resolved = resolveTarget(rels.source, rel.target);
+		if (resolved.part === null) {
+			ctx.add("V008", elementLocation(rels.partName, rel.element), rel.id + " -> \"" + rel.target + "\" does not resolve against " + rels.source + ": " + (resolved.failure ?? "unknown reason"));
+			continue;
+		}
+		if (!ctx.store.has(resolved.part)) ctx.add("V008", elementLocation(rels.partName, rel.element), rel.id + " -> " + resolved.part + " names a part that is not in the package. A dangling relationship is fatal where an orphaned one is harmless, which is why garbage collection may only ever be aggressive in the other direction.");
+	}
+}
+/** The chartex content type. Not in `CONTENT_TYPE`: it is Microsoft's, not ECMA's. */
+const CHART_EX_CONTENT_TYPE = "application/vnd.ms-office.chartex+xml";
+/**
+* The ECMA `customXml` relationship type.
+*
+* A `p:contentPart` reached by *this* type is a whole-package refusal, while
+* the Microsoft 2010 type of the same name opens - and so do two relationship
+* types that make no sense at all. PowerPoint validates that one type rather
+* than types in general, which is a strange enough finding that it is worth
+* writing the constant down beside the rule that uses it.
+*/
+const REL_CUSTOM_XML_ECMA = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml";
+/** Elements whose `r:` attribute means "this is a media object's target". */
+const MEDIA_REFERENCE_ELEMENTS = /* @__PURE__ */ new Set([
+	"audioFile",
+	"videoFile",
+	"media"
+]);
+/**
+* The edges a part must have, and the ones it must not.
+*
+* Four findings, none of them in any schema. See the rule's `why` in
+* `rules.ts` for the bisections; the code below is deliberately a table read
+* against the package rather than four separate walks.
+*/
+function v009RequiredEdges(ctx) {
+	const relsBySource = bySource(readRelsParts(ctx));
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const contentType = ctx.contentType(part);
+		const rels = relsBySource.get(normalizePartName(part));
+		if (contentType === CONTENT_TYPE.slide) requireExactlyOne(ctx, part, rels, REL_TYPE.slideLayout, CONTENT_TYPE.slideLayout, "layout");
+		else if (contentType === CONTENT_TYPE.slideLayout) requireExactlyOne(ctx, part, rels, REL_TYPE.slideMaster, CONTENT_TYPE.slideMaster, "master");
+		else if (contentType === CHART_EX_CONTENT_TYPE) for (const [type, label] of [["http://schemas.microsoft.com/office/2011/relationships/chartStyle", "chartStyle"], ["http://schemas.microsoft.com/office/2011/relationships/chartColorStyle", "chartColorStyle"]]) {
+			if ((rels?.relationships ?? []).some((rel) => rel.type === type)) continue;
+			ctx.add("V009", partLocation(part), "a chartex part with no " + label + " relationship. Unlike a classic c:chartSpace, which needs neither, a cx:chartSpace without both is a whole-package refusal.");
+		}
+	}
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const rels = relsBySource.get(normalizePartName(part));
+		if (rels === void 0) continue;
+		for (const element of descendantElements(document.root)) {
+			if (element.local !== "contentPart") continue;
+			for (const attr of element.attributes) {
+				if (attr.local !== "id" || attr.prefix === "") continue;
+				if (rels.relationships.find((rel) => rel.id === attr.value)?.type !== REL_CUSTOM_XML_ECMA) continue;
+				ctx.add("V009", attributeLocation(part, element, attr.qname), "a <" + element.qname + "> reached by the ECMA customXml relationship type is a whole-package refusal. The Microsoft 2010 type of the same name opens; PowerPoint validates this one type rather than types in general.");
+			}
+		}
+	}
+	checkSharedMedia(ctx, relsBySource);
+}
+function requireExactlyOne(ctx, part, rels, type, targetContentType, label) {
+	const matching = (rels?.relationships ?? []).filter((rel) => rel.type === type);
+	if (matching.length !== 1) {
+		ctx.add("V009", partLocation(part), "has " + String(matching.length) + " " + label + " relationship(s); it needs exactly one. The binding lives only in the .rels part - nothing in the part itself names its " + label + " - so zero and two are both whole-package refusals.");
+		return;
+	}
+	const rel = matching[0];
+	const resolved = resolveTarget(rels.source, rel.target);
+	if (resolved.part === null || !ctx.store.has(resolved.part)) {
+		ctx.add("V009", elementLocation(rels.partName, rel.element), "the " + label + " relationship points at a part that is not in the package.");
+		return;
+	}
+	const actual = ctx.contentType(resolved.part);
+	if (actual !== targetContentType) ctx.add("V009", elementLocation(rels.partName, rel.element), "the " + label + " relationship resolves to " + resolved.part + ", which is typed " + (actual === void 0 ? "(nothing)" : "\"" + actual + "\"") + " rather than \"" + targetContentType + "\". One pointing at a master instead was built as a single change and refused.");
+}
+/**
+* A media part that is both a transition sound and a media object's target.
+*
+* The only refusal we have measured whose message is "PowerPoint could not open
+* the file" rather than "the file or directory is corrupted and unreadable" -
+* which is worth recording, because the message is the only signal there is.
+* Two copies of the same bytes open; one shared copy does not.
+*/
+function checkSharedMedia(ctx, relsBySource) {
+	const asTransitionSound = /* @__PURE__ */ new Map();
+	const asMediaObject = /* @__PURE__ */ new Map();
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const rels = relsBySource.get(normalizePartName(part));
+		if (rels === void 0) continue;
+		for (const element of descendantElements(document.root)) {
+			const isSound = element.local === "snd";
+			const isMedia = MEDIA_REFERENCE_ELEMENTS.has(element.local);
+			if (!isSound && !isMedia) continue;
+			for (const attr of element.attributes) {
+				if (attr.prefix === "" || attr.value === "") continue;
+				if (attr.local !== "embed" && attr.local !== "link") continue;
+				const rel = rels.relationships.find((r) => r.id === attr.value);
+				if (rel === void 0 || rel.targetMode === "External") continue;
+				const target = resolveTarget(rels.source, rel.target).part;
+				if (target === null) continue;
+				(isSound ? asTransitionSound : asMediaObject).set(normalizePartName(target), part);
+			}
+		}
+	}
+	for (const [target, soundOwner] of asTransitionSound) {
+		const mediaOwner = asMediaObject.get(target);
+		if (mediaOwner === void 0) continue;
+		ctx.add("V009", partLocation(target), "is both a transition sound (from " + soundOwner + ") and a media object target (from " + mediaOwner + "). Two copies of the same bytes open; one shared copy is a refusal.");
+	}
+}
+//#endregion
+//#region src/rules/order.ts
+/**
+* `V010` … `V012`: where children are allowed to be.
+*
+* OOXML complex types are `xsd:sequence` almost everywhere, and this is the
+* category with the best-attested consequence in the whole appendix: Microsoft's
+* own Open XML SDK shipped a regression that swapped two elements in
+* `slideMaster1.xml`, changed nothing else, and PowerPoint refused the file.
+*
+* The ranks come from `@pptx-studio/xml`'s generated table, which is built from
+* the ECMA-376 Transitional schemas and checked against 194 148 elements
+* PowerPoint wrote. That second number is what makes the rule safe to make
+* fatal: a table generated from a standard and never compared with reality
+* would be a very confident way to reject files that work.
+*
+* The three rules divide the question by what the table can and cannot see:
+*
+* - `V010` - the child is in the model but in the wrong place.
+* - `V011` - `extLst` last, which has to hold in the places the table cannot
+*   rank at all.
+* - `V012` - the child is not in the model.
+*
+* `V010` skips anything it cannot rank, which is correct for ordering and is
+* exactly the blind spot `V012` exists to cover.
+*/
+/** Children in schema-sequence order. */
+function v010SchemaOrder(ctx) {
+	forEachElement$1(ctx, (part, element) => {
+		for (const problem of outOfOrderChildren(element)) ctx.add("V010", {
+			part,
+			xpath: xpathOf(element),
+			offset: problem.at
+		}, problem.detail + ". OOXML complex types are xsd:sequence and PowerPoint enforces the order literally.");
+	});
+}
+/**
+* `extLst` is last, and every `a:ext` names its extension.
+*
+* There is exactly one type in the whole generated table where `extLst` is not
+* last: `p:control`, whose model is `extLst` then `pic`. That is not an
+* exception worth handling gracefully - `V025` refuses `p:control` outright,
+* because PowerPoint refuses it in all eight forms we tried - but it is skipped
+* here rather than reported twice.
+*/
+function v011ExtLstLast(ctx) {
+	forEachElement$1(ctx, (part, element) => {
+		if (element.local !== "extLst") return;
+		const parent = element.parent;
+		if (parent === void 0 || parent.local === "control") return;
+		const siblings = childElements(parent);
+		const last = siblings[siblings.length - 1];
+		if (last !== element) ctx.add("V011", elementLocation(part, element), "<" + element.qname + "> is followed by <" + (last?.qname ?? "?") + "> inside <" + parent.qname + ">. An extension list is last in every type that has one.");
+		for (const ext of childElements(element)) {
+			if (ext.local !== "ext") continue;
+			const uri = attributeValue(ext, "uri");
+			if (uri !== void 0 && uri !== "") continue;
+			ctx.add("V011", elementLocation(part, ext), "<" + ext.qname + "> has no @uri. The uri is the only identity an extension has, and the contract for extension markup is that it is carried through untouched *keyed by that uri* - so one without it cannot be preserved, only guessed at.");
+		}
+	});
+}
+/**
+* No child in a parent whose content model has no place for it.
+*
+* Deliberately conservative in four ways, because a false positive here refuses
+* a file somebody wanted:
+*
+* - only parents the generated table knows are checked, and `childRanks`
+*   returns `undefined` for every open (`xsd:any`) type, so `a:ext`,
+*   `p:ext` and `a:graphicData` - the three places the plan forbids us to
+*   rebuild - are never looked at;
+* - **only children in the four namespaces the table was generated from.**
+*   This is the one the corpus taught us. `childRanks` collapses "the schema
+*   forbids this here" and "we have never read this schema" into the same
+*   `undefined`, which is right for a caller trying to insert a child and
+*   catastrophic for one trying to judge an existing one: without the
+*   namespace test, the rule fired on forty `mc:AlternateContent` elements,
+*   on `a14:m`, on `p14:honeycomb` and on `a37-mce`'s deliberate `zz:` markup -
+*   which is `mc:Ignorable` extension markup doing exactly what it exists for;
+* - `mc:Choice` and `mc:Fallback` are unrankable parents, so their contents
+*   fall out for free.
+*/
+function v012UnexpectedChild(ctx) {
+	forEachElement$1(ctx, (part, element) => {
+		const ranks = childRanks(element);
+		if (ranks === void 0) return;
+		for (const child of childElements(element)) {
+			if (!isSchemaNamespace(namespaceOf(child))) continue;
+			const key = elementKey(child);
+			if (key === void 0 || ranks.has(key)) continue;
+			ctx.add("V012", elementLocation(part, child), "<" + child.qname + "> is not a child <" + element.qname + "> admits. `a:ahXY` or `a:cxn` placed directly under `a:custGeom`, without its `a:ahLst`/`a:cxnLst` wrapper, is the case that made this a rule: a whole-package refusal that the ordering rule cannot see, because an unrankable child is skipped there rather than reported.");
+		}
+	});
+}
+/**
+* Every element of every XML part, once.
+*
+* The three rules above each want the same walk. Sharing it means one traversal
+* of the package instead of three, and - more usefully - one place where the
+* decision "which parts does an order rule apply to" is made. Relationship
+* parts are excluded: `Relationships` is not in any schema we generate from, so
+* every one of its children would be unrankable and the rules would be checking
+* nothing while appearing to check everything.
+*/
+function forEachElement$1(ctx, visit) {
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		for (const element of descendantElements(document.root)) visit(part, element);
+	}
+}
+//#endregion
+//#region src/rules/required.ts
+/**
+* `V013` … `V017`: children and attributes that are not optional.
+*
+* Every one of these is a `minOccurs` the schema states plainly, and every one
+* is broken the same way: by an editor deleting the last of something. The last
+* paragraph goes and a `p:txBody` is left with no `a:p`; a shape is dragged out
+* of a group and the group's `p:grpSpPr` is dropped with it. That is why these
+* are separate rules from the ordering ones even though a missing child and a
+* misplaced child are both "the sequence is wrong": the messages have to say
+* *add this*, not *move this*, and they have to fire on the parent rather than
+* on a child that is not there to point at.
+*/
+/** The twelve attributes of `CT_ColorMapping`. All required, no defaults. */
+const CLR_MAP_ATTRIBUTES = [
+	"bg1",
+	"tx1",
+	"bg2",
+	"tx2",
+	"accent1",
+	"accent2",
+	"accent3",
+	"accent4",
+	"accent5",
+	"accent6",
+	"hlink",
+	"folHlink"
+];
+/** `p:presentation` carries `p:notesSz`. */
+function v013NotesSize(ctx) {
+	for (const part of ctx.parts()) {
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const root = document.root;
+		if (root.local !== "presentation" || namespaceOf(root) !== NS.p) continue;
+		if (childElements(root).some((child) => child.local === "notesSz")) continue;
+		ctx.add("V013", elementLocation(part, root), "no <p:notesSz>. In CT_Presentation p:sldSz is [0..1] and p:notesSz is [1..1] - the asymmetry is the whole of this rule, and a generator that treats the two the same way writes a presentation part that is missing a required child.");
+	}
+}
+/** `p:clrMap` carries all twelve attributes. */
+function v014ColorMap(ctx) {
+	forEachElement(ctx, (part, element) => {
+		if (element.local !== "clrMap" || namespaceOf(element) !== NS.p) return;
+		const missing = CLR_MAP_ATTRIBUTES.filter((name) => attribute(element, name) === void 0);
+		if (missing.length === 0) return;
+		ctx.add("V014", elementLocation(part, element), "the colour map is missing " + missing.join(", ") + ". All twelve attributes of CT_ColorMapping are required and none has a default; a partial map is not a map with a gap, it is an invalid element - and it is the element that decides what bg1 and tx1 resolve to everywhere in the deck.");
+	});
+}
+/** `p:spTree` begins with `p:nvGrpSpPr` then `p:grpSpPr`. */
+function v015ShapeTreePrologue(ctx) {
+	forEachElement(ctx, (part, element) => {
+		if (element.local !== "spTree" || namespaceOf(element) !== NS.p) return;
+		const children = childElements(element);
+		if (children[0]?.local !== "nvGrpSpPr" || children[1]?.local !== "grpSpPr") ctx.add("V015", elementLocation(part, element), "a shape tree begins with <nvGrpSpPr> then <grpSpPr>, in that order, before any shape. This one begins " + (children.length === 0 ? "with nothing" : children.slice(0, 2).map((child) => "<" + child.qname + ">").join(" then ")) + ". A shape tree is a group shape, and CT_GroupShape requires both even when the slide is empty.");
+	});
+}
+/** Every text body has `a:bodyPr` and at least one `a:p`. */
+function v016TextBody(ctx) {
+	forEachElement(ctx, (part, element) => {
+		if (element.local !== "txBody") return;
+		const children = childElements(element);
+		if (!children.some((child) => child.local === "bodyPr")) ctx.add("V016", elementLocation(part, element), "<" + element.qname + "> has no <a:bodyPr>. CT_TextBody requires it first.");
+		if (!children.some((child) => child.local === "p")) ctx.add("V016", elementLocation(part, element), "<" + element.qname + "> has no <a:p>. CT_TextBody is [1..unbounded] paragraphs, and an empty paragraph is not the same thing as no paragraph - a:endParaRPr is where an empty one gets its height. This is what deleting the last paragraph in an editor produces.");
+	});
+}
+/** `p:graphicFrame` carries `p:xfrm` and `a:graphic`. */
+function v017GraphicFrame(ctx) {
+	forEachElement(ctx, (part, element) => {
+		if (element.local !== "graphicFrame" || namespaceOf(element) !== NS.p) return;
+		const xfrm = childElements(element).find((child) => child.local === "xfrm");
+		if (xfrm === void 0) ctx.add("V017", elementLocation(part, element), "no <p:xfrm>. Note the namespace: a graphic frame carries the PresentationML transform, not the a:xfrm every other shape uses. It has no placeholder-inherited geometry path either, which is why a rebound chart or table gets a copy of its layout transform rather than having its own deleted.");
+		else if (namespaceOf(xfrm) !== NS.p) ctx.add("V017", elementLocation(part, xfrm), "the transform here is <" + xfrm.qname + ">, in the DrawingML namespace. CT_GraphicalObjectFrame takes p:xfrm; a:xfrm in its place is the same element name bound to the wrong schema.");
+		if (childElements(element).find((child) => child.local === "graphic" && namespaceOf(child) === NS.a) === void 0) ctx.add("V017", elementLocation(part, element), "no <a:graphic>. The frame is the wrapper; the graphic is the thing in it, and a frame without one names no table, chart, diagram or OLE object at all.");
+	});
+}
+/**
+* Presentation-family parts only.
+*
+* A `.pptx` carries whole foreign documents inside it - an embedded workbook
+* behind every chart, a Word document behind some OLE objects - and their parts
+* are XML with elements called `txBody` and `graphicFrame` in namespaces these
+* rules do not govern. Checking them would be applying PresentationML's
+* cardinalities to SpreadsheetML's schema, which is why every rule above tests
+* the namespace and not only the local name, and why the walk itself stops at
+* parts whose content type belongs to another format.
+*/
+const FOREIGN_CONTENT_TYPES = /* @__PURE__ */ new Set([
+	CONTENT_TYPE.spreadsheet,
+	"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	"application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml",
+	"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"
+]);
+function forEachElement(ctx, visit) {
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const contentType = ctx.contentType(part);
+		if (contentType !== void 0 && FOREIGN_CONTENT_TYPES.has(contentType)) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		for (const element of descendantElements(document.root)) visit(part, element);
+	}
+}
+//#endregion
+//#region src/rules/id.ts
+/**
+* `V018` … `V021`: four identifier spaces, and never one allocator.
+*
+* A presentation has four kinds of id and they do not share a rule between
+* them. Slide ids start at 256 and stop at 2147483647. Master and layout ids
+* start at 2147483648, and - the part no schema says - come out of **one**
+* counter shared between them. Shape ids are unique inside a part and free to
+* repeat across parts. Placeholder indices are not identifiers at all; they are
+* a join key against another part.
+*
+* Every one of those is a way to break a file that looks like a way to be
+* tidy. Renumbering shape ids to be unique across the deck is the obvious
+* example: it is more consistent, it is what a database would do, and it
+* detaches every `p:custDataLst`, VML `@spid` and animation target that names
+* the old number.
+*/
+const SLIDE_ID_MIN = 256;
+const SLIDE_ID_MAX = 2147483647;
+const SHEET_ID_MIN = 2147483648;
+const SHEET_ID_MAX = 4294967295;
+/** An `@id` read as a base-10 integer, or `null` when it is not one. */
+function integerAttribute(element, name) {
+	const raw = attributeValue(element, name);
+	if (raw === void 0 || !/^\d+$/.test(raw.trim())) return null;
+	return Number(raw.trim());
+}
+/** `p:sldId/@id` is 256…2147483647 and unique. */
+function v018SlideIds(ctx) {
+	for (const part of ctx.parts()) {
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const seen = /* @__PURE__ */ new Map();
+		for (const element of descendantElements(document.root)) {
+			if (element.local !== "sldId" || namespaceOf(element) !== NS.p) continue;
+			const raw = attributeValue(element, "id");
+			const value = integerAttribute(element, "id");
+			if (value === null) {
+				ctx.add("V018", attributeLocation(part, element, "id"), raw === void 0 ? "<p:sldId> has no @id." : "@id=\"" + raw + "\" is not a base-10 unsigned integer.");
+				continue;
+			}
+			if (value < SLIDE_ID_MIN || value > SLIDE_ID_MAX) ctx.add("V018", attributeLocation(part, element, "id"), "@id=" + String(value) + " is outside ST_SlideId, which is " + String(SLIDE_ID_MIN) + "…" + String(SLIDE_ID_MAX) + ". The floor is the part that gets missed: nothing about a first slide suggests its id should start at 256.");
+			if (seen.has(value)) ctx.add("V018", attributeLocation(part, element, "id"), "@id=" + String(value) + " is used twice in this slide list.");
+			else seen.set(value, element);
+		}
+	}
+}
+/**
+* Master and layout ids share one number space.
+*
+* The uniqueness check runs across the whole package rather than per part,
+* because `p:sldMasterId` lives in `ppt/presentation.xml` and `p:sldLayoutId`
+* lives in each master's own `p:sldLayoutIdLst` - so a collision between the
+* two is invisible to anything that validates one part at a time. That is
+* exactly how `a12-masters` was written wrong: a chassis numbering masters and
+* layouts from two counters is indistinguishable from correct with one master
+* and collides on the second.
+*/
+function v019SheetIds(ctx) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const part of ctx.parts()) {
+		const document = ctx.document(part);
+		if (document === null) continue;
+		for (const element of descendantElements(document.root)) {
+			const isMaster = element.local === "sldMasterId";
+			const isLayout = element.local === "sldLayoutId";
+			if (!isMaster && !isLayout || namespaceOf(element) !== NS.p) continue;
+			const raw = attributeValue(element, "id");
+			const value = integerAttribute(element, "id");
+			if (value === null) {
+				if (raw !== void 0) ctx.add("V019", attributeLocation(part, element, "id"), "@id=\"" + raw + "\" is not a base-10 unsigned integer.");
+				continue;
+			}
+			if (value < SHEET_ID_MIN || value > SHEET_ID_MAX) {
+				ctx.add("V019", attributeLocation(part, element, "id"), "@id=" + String(value) + " is outside " + (isMaster ? "ST_SlideMasterId" : "ST_SlideLayoutId") + ", which is " + String(SHEET_ID_MIN) + " and up.");
+				continue;
+			}
+			const previous = seen.get(value);
+			if (previous !== void 0) ctx.add("V019", attributeLocation(part, element, "id"), "@id=" + String(value) + " is already used by " + previous + ". Master and layout ids are one number space, not two: PowerPoint allocates them from a single running counter - master, its layouts, next master, its layouts - and refuses a package that does not.");
+			else seen.set(value, "<" + element.qname + "> in " + part);
+		}
+	}
+}
+/**
+* The `mc:Choice` / `mc:Fallback` ancestors of an element, outermost first.
+*
+* Two shapes in different branches of the same `mc:AlternateContent` never
+* exist in the same document: a consumer picks one branch and the other is not
+* there. So they may carry the same `@id`, and PowerPoint's own writer does
+* exactly that - `a22-chartex` has a `p:graphicFrame` with `id="10"` in the
+* `mc:Choice` and the `p:pic` that stands in for it, also `id="10"`, in the
+* `mc:Fallback`. Reporting that as a duplicate would fire on files PowerPoint
+* wrote, which is the corpus's whole job to prevent.
+*/
+function branchPath(element) {
+	const path = [];
+	for (let node = element.parent; node !== void 0; node = node.parent) if (node.local === "Choice" || node.local === "Fallback") path.push(node);
+	return path.reverse();
+}
+/**
+* True when two elements can never both be present.
+*
+* They cannot when their branch paths diverge at some depth *into two branches
+* of the same `mc:AlternateContent`*. Diverging into branches of two different
+* `mc:AlternateContent` elements is not exclusion - both are chosen, and both
+* sets of shapes are on the slide together.
+*/
+function mutuallyExclusive(a, b) {
+	const depth = Math.min(a.length, b.length);
+	for (let i = 0; i < depth; i++) {
+		if (a[i] === b[i]) continue;
+		return a[i].parent === b[i].parent;
+	}
+	return false;
+}
+/**
+* `p:cNvPr/@id` is unique within its part and reads as a positive signed
+* 32-bit integer.
+*
+* PresentationML only, which is narrower than "every element called `cNvPr`"
+* and had to be. A SmartArt drawing part writes `dsp:cNvPr id="0"` on every
+* shape it contains - PowerPoint generates those parts and regenerates them on
+* any diagram interaction, so whatever the ids there are for, it is not
+* identity. `a23-smartart` is where that turned up.
+*/
+function v020ShapeIds(ctx) {
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part)) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const seen = /* @__PURE__ */ new Map();
+		for (const element of descendantElements(document.root)) {
+			if (element.local !== "cNvPr" || namespaceOf(element) !== NS.p) continue;
+			const raw = attributeValue(element, "id");
+			if (raw === void 0) {
+				ctx.add("V020", elementLocation(part, element), "<" + element.qname + "> has no @id.");
+				continue;
+			}
+			const value = integerAttribute(element, "id");
+			if (value === null) {
+				ctx.add("V020", attributeLocation(part, element, "id"), "@id=\"" + raw + "\" is not a base-10 unsigned integer.");
+				continue;
+			}
+			if (value > SLIDE_ID_MAX && value !== SHEET_ID_MAX) ctx.add("V020", attributeLocation(part, element, "id"), "@id=" + String(value) + " is in 2147483648…4294967294, which PowerPoint refuses outright. ST_DrawingElementId is xsd:unsignedInt and every value up to 2147483647 opens; PowerPoint reads this one signed. (4294967295 also opens - it is minus one, which PowerPoint keeps as a sentinel and renumbers away on save.)");
+			const branch = branchPath(element);
+			const others = seen.get(value) ?? [];
+			const clash = others.find((other) => !mutuallyExclusive(other.branch, branch));
+			if (clash !== void 0) ctx.add("V020", attributeLocation(part, element, "id"), "@id=" + String(value) + " is already used by <" + clash.label + "> in this part. Shape ids are unique within a part and free to repeat across parts - renumbering them to be unique across the deck is tidier and detaches every VML @spid and animation target that names the old number.");
+			others.push({
+				label: element.qname + " " + (attributeValue(element, "name") ?? ""),
+				branch
+			});
+			seen.set(value, others);
+		}
+	}
+}
+/**
+* `CT_Placeholder` defaults, materialised.
+*
+* `@type` defaults to `body` and `@idx` to `0` in the ECMA-376 schema, and
+* `ctrTitle` normalises to `title` because they are the same slot with
+* different centring. Worth flagging while it is fresh: the plan says
+* `<p:ph/>` means `type="obj"` in sub-phase 2.9 and `type ??= 'body'` in 7.1,
+* and those cannot both be right. The schema says `body`, so that is what this
+* rule uses - and it is one of the reasons the rule is a warning rather than
+* fatal. Sub-phase 7.1 settles it against the 121-case matrix.
+*/
+function placeholdersOf(root) {
+	const out = [];
+	for (const element of descendantElements(root)) {
+		if (element.local !== "ph" || namespaceOf(element) !== NS.p) continue;
+		const rawType = attributeValue(element, "type") ?? "body";
+		const type = rawType === "ctrTitle" ? "title" : rawType;
+		const idx = Number(attributeValue(element, "idx") ?? "0");
+		out.push({
+			type,
+			idx: Number.isFinite(idx) ? idx : 0,
+			element
+		});
+	}
+	return out;
+}
+/** Types matched on type alone, ignoring `@idx`. See tier 3. */
+const TYPE_ONLY = /* @__PURE__ */ new Set([
+	"sldNum",
+	"dt",
+	"ftr",
+	"hdr"
+]);
+/** The five tiers, in order. Returns the matching layout placeholder, or `null`. */
+function matchInLayout(slide, layout) {
+	const exact = layout.find((ph) => ph.type === slide.type && ph.idx === slide.idx);
+	if (exact !== void 0) return exact;
+	if (slide.type === "title") {
+		const anyTitle = layout.find((ph) => ph.type === "title");
+		if (anyTitle !== void 0) return anyTitle;
+	}
+	if (TYPE_ONLY.has(slide.type)) {
+		const byType = layout.find((ph) => ph.type === slide.type);
+		if (byType !== void 0) return byType;
+	}
+	if (slide.type === "body") {
+		const bodies = layout.filter((ph) => ph.type === "body");
+		if (bodies.length === 1) return bodies[0];
+	}
+	return null;
+}
+/**
+* Every slide placeholder finds a counterpart in its layout.
+*
+* A warning, and the reason matters: PowerPoint opens the file. A `p:ph` that
+* matches nothing inherits nothing - no geometry, no text style, no prompt -
+* and the shape is drawn wherever the renderer can work out, which is a deck
+* that is silently wrong rather than a deck that is refused. Refusing an export
+* over it would block a user from saving a file that already opened fine
+* everywhere, which is the failure mode a validator has to avoid most.
+*/
+function v021PlaceholderIndices(ctx) {
+	const relsBySource = bySource(readRelsParts(ctx));
+	for (const part of ctx.parts()) {
+		if (ctx.contentType(part) !== CONTENT_TYPE.slide) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const rels = relsBySource.get(normalizePartName(part));
+		const layoutRel = (rels?.relationships ?? []).find((rel) => rel.type === REL_TYPE.slideLayout);
+		if (layoutRel === void 0) continue;
+		const layoutPart = resolveTarget(rels.source, layoutRel.target).part;
+		if (layoutPart === null) continue;
+		const layoutDocument = ctx.document(layoutPart);
+		if (layoutDocument === null) continue;
+		const layout = placeholdersOf(layoutDocument.root);
+		for (const slidePh of placeholdersOf(document.root)) {
+			if (matchInLayout(slidePh, layout) !== null) continue;
+			ctx.add("V021", elementLocation(part, slidePh.element), "placeholder (type=" + slidePh.type + ", idx=" + String(slidePh.idx) + ") matches nothing in " + layoutPart + ", which offers " + (layout.length === 0 ? "none" : layout.map((ph) => ph.type + "/" + String(ph.idx)).join(", ")) + ". An unmatched placeholder inherits no geometry and no text style.");
+		}
+	}
+}
+//#endregion
+//#region src/rules/refusal.ts
+/**
+* `V022` … `V026`: schema-legal markup PowerPoint refuses.
+*
+* This is the category that justifies the package. Nothing here can be derived
+* from ECMA-376; every rule is the record of a package built with one change in
+* it, opened, and declined - "PowerPoint could not open the file", or
+* `0x80070570`, "the file or directory is corrupted and unreadable". No log, no
+* part named, no line number. Sub-phase 1.5's `cli bisect` exists because that
+* is the entire diagnostic channel, and these five rules are what it found
+* before it existed, by hand.
+*
+* Which means each of them is falsifiable in a way the schema rules are not: if
+* a later PowerPoint build opens one of these, the rule is wrong and should be
+* deleted. The `why` in `rules.ts` records what was tried and what opened, so
+* that the person who deletes it knows what they are contradicting.
+*/
+/** Parts where `hdr` and `sldImg` placeholders are legal - they belong to these families. */
+const NOTES_FAMILY = /* @__PURE__ */ new Set([
+	CONTENT_TYPE.notesSlide,
+	CONTENT_TYPE.notesMaster,
+	CONTENT_TYPE.handoutMaster
+]);
+/** `p:ph/@type` is not `hdr` or `sldImg` on a slide, layout or master. */
+function v022PlaceholderType(ctx) {
+	for (const part of ctx.parts()) {
+		const contentType = ctx.contentType(part);
+		if (contentType === void 0 || NOTES_FAMILY.has(contentType)) continue;
+		if (contentType !== CONTENT_TYPE.slide && contentType !== CONTENT_TYPE.slideLayout && contentType !== CONTENT_TYPE.slideMaster) continue;
+		const document = ctx.document(part);
+		if (document === null) continue;
+		for (const element of descendantElements(document.root)) {
+			if (element.local !== "ph" || namespaceOf(element) !== NS.p) continue;
+			const type = attributeValue(element, "type");
+			if (type !== "hdr" && type !== "sldImg") continue;
+			ctx.add("V022", attributeLocation(part, element, "type"), "type=\"" + type + "\" is a whole-package refusal here, alone and with no other change. The other seven content types were built as one-type packages in the same bisection and every one opens: obj, chart, tbl, clipArt, dgm, media, pic. Nothing in the schema says so - CT_Placeholder is one complex type shared by every sheet family and ST_PlaceholderType is one enumeration holding all sixteen values - but hdr and sldImg belong to the notes and handout families and PowerPoint enforces it.");
+		}
+	}
+}
+/**
+* The built-in geometry guides.
+*
+* Deliberately generous, and deliberately temporary. The authoritative table is
+* sub-phase 2.2's - forty-four seeded guides beside the seventeen `fmla`
+* operators - and it belongs in `@pptx-studio/geometry` rather than here. Until
+* it exists this list plus the two shape tests below stand in for it.
+*
+* Generous in the safe direction on purpose. This rule is fatal, so a name we
+* wrongly think is undefined refuses a file that works, while a name we wrongly
+* accept only means we miss one instance of a defect whose real-world form is a
+* typo or a deleted `a:gd` - and neither of those looks anything like `wd12`.
+*/
+const BUILTIN_GUIDES = /* @__PURE__ */ new Set([
+	"3cd4",
+	"3cd8",
+	"5cd8",
+	"7cd8",
+	"b",
+	"cd2",
+	"cd4",
+	"cd8",
+	"h",
+	"hc",
+	"hd2",
+	"hd3",
+	"hd4",
+	"hd5",
+	"hd6",
+	"hd8",
+	"l",
+	"ls",
+	"r",
+	"ss",
+	"ssd2",
+	"ssd4",
+	"ssd6",
+	"ssd8",
+	"ssd16",
+	"ssd32",
+	"t",
+	"vc",
+	"w",
+	"wd2",
+	"wd3",
+	"wd4",
+	"wd5",
+	"wd6",
+	"wd8",
+	"wd10",
+	"wd32"
+]);
+/** `wd12`, `hd10`, `ssd12` - the same shape as a built-in, with a divisor we did not list. */
+const BUILTIN_SHAPED = /^(?:w|h|ss|ls)d\d+$/;
+/** `2cd4`, `5cd8` - a fraction of a full circle. */
+const ANGLE_SHAPED = /^\d+cd\d+$/;
+/** A literal number, in EMU or in 60000ths of a degree. Both may be negative. */
+const LITERAL = /^-?\d+$/;
+function isDefinedGuide(name, defined) {
+	if (name === "" || LITERAL.test(name)) return true;
+	if (defined.has(name) || BUILTIN_GUIDES.has(name)) return true;
+	return BUILTIN_SHAPED.test(name) || ANGLE_SHAPED.test(name);
+}
+/** Attributes that hold a guide name rather than a value of their own. */
+const GUIDE_VALUED = {
+	pt: ["x", "y"],
+	pos: ["x", "y"],
+	rect: [
+		"l",
+		"t",
+		"r",
+		"b"
+	],
+	ahXY: [
+		"minX",
+		"maxX",
+		"minY",
+		"maxY",
+		"gdRefX",
+		"gdRefY"
+	],
+	ahPolar: [
+		"minAng",
+		"maxAng",
+		"minR",
+		"maxR",
+		"gdRefAng",
+		"gdRefR"
+	],
+	cxn: ["ang"],
+	arcTo: [
+		"wR",
+		"hR",
+		"stAng",
+		"swAng"
+	]
+};
+/**
+* Every geometry guide named is a guide that is defined.
+*
+* Scoped to one `a:custGeom` or `a:prstGeom` at a time, because that is the
+* scope a guide has: `adj1` in one shape has nothing to do with `adj1` in the
+* next. A `prstGeom`'s guides come from the preset definition rather than from
+* the markup, so only its `a:avLst` is checked - which is the whole of what a
+* preset shape can get wrong from here, and is exactly what dragging an adjust
+* handle writes.
+*/
+function v023GeometryGuides(ctx) {
+	forEachElement(ctx, (part, geometry) => {
+		if (!(geometry.local === "custGeom") && geometry.local !== "prstGeom" || namespaceOf(geometry) !== NS.a) return;
+		const defined = /* @__PURE__ */ new Set();
+		for (const element of descendantElements(geometry)) {
+			if (element.local !== "gd") continue;
+			const name = attributeValue(element, "name");
+			if (name !== void 0 && name !== "") defined.add(name);
+		}
+		for (const element of descendantElements(geometry)) {
+			if (element.local === "gd") {
+				const formula = attributeValue(element, "fmla");
+				if (formula === void 0) continue;
+				const args = formula.trim().split(/\s+/).slice(1);
+				for (const arg of args) {
+					if (isDefinedGuide(arg, defined)) continue;
+					report(ctx, part, element, "fmla", arg, defined);
+				}
+				continue;
+			}
+			const names = GUIDE_VALUED[element.local];
+			if (names === void 0 || namespaceOf(element) !== NS.a) continue;
+			for (const attributeName of names) {
+				const value = attribute(element, attributeName);
+				if (value === void 0 || isDefinedGuide(value.value, defined)) continue;
+				report(ctx, part, element, attributeName, value.value, defined);
+			}
+		}
+	});
+}
+function report(ctx, part, element, attributeName, name, defined) {
+	ctx.add("V023", attributeLocation(part, element, attributeName), "\"" + name + "\" names a guide nothing defines. This geometry defines " + (defined.size === 0 ? "none" : [...defined].sort().join(", ")) + ". ST_GeomGuideName is an unconstrained token, so nothing in the schema forbids it - and a package containing it is refused outright, not repaired and not drawn without the shape.");
+}
+/** The chart namespace, for `V024`. */
+const CHART_NS = "http://schemas.openxmlformats.org/drawingml/2006/chart";
+/**
+* A series' `c:tx` holds `c:strRef` or `c:v`, and nothing else.
+*
+* Scoped to `c:ser/c:tx` rather than to every `c:tx`, and the distinction is
+* real: a series' text is `CT_SerTx`, a choice of `c:strRef` or `c:v`, while a
+* title's or a data label's `c:tx` is `CT_Tx`, a choice of `c:strRef` or
+* `c:rich`. Checking both with one list would refuse every chart title in the
+* corpus.
+*/
+function v024SeriesText(ctx) {
+	forEachElement(ctx, (part, element) => {
+		if (element.local !== "tx" || namespaceOf(element) !== CHART_NS) return;
+		const parent = element.parent;
+		if (parent === void 0 || parent.local !== "ser" || namespaceOf(parent) !== CHART_NS) return;
+		for (const child of childElements(element)) {
+			if (child.local === "strRef" || child.local === "v") continue;
+			ctx.add("V024", elementLocation(part, child), "<" + child.qname + "> inside a series <" + element.qname + ">. CT_SerTx is a choice of c:strRef or c:v and nothing else. The trap is that c:cat and c:val, two elements away in the same series, both accept the literal forms - so a c:strLit here looks like markup that ought to work, and it is a whole-package refusal.");
+		}
+	});
+}
+/** No `p:control`. */
+function v025Control(ctx) {
+	forEachElement(ctx, (part, element) => {
+		if (element.local !== "control" || namespaceOf(element) !== NS.p) return;
+		ctx.add("V025", elementLocation(part, element), "a <p:control> is a whole-package refusal in all eight forms tried: bare, name-only, with and without r:id, with a p:pic preview, with an ActiveX part and its .bin, and inside a macro-enabled package. An empty <p:controls> is accepted, which places the refusal precisely on this element.");
+	});
+}
+/** The chart-style namespace and its thirty-one entries. */
+const CHART_STYLE_NS = "http://schemas.microsoft.com/office/drawing/2012/chartStyle";
+const CHART_STYLE_ENTRIES = [
+	"axisTitle",
+	"categoryAxis",
+	"chartArea",
+	"dataLabel",
+	"dataLabelCallout",
+	"dataPoint",
+	"dataPoint3D",
+	"dataPointLine",
+	"dataPointMarker",
+	"dataPointMarkerLayout",
+	"dataPointWireframe",
+	"dataTable",
+	"downBar",
+	"dropLine",
+	"errorBar",
+	"floor",
+	"gridlineMajor",
+	"gridlineMinor",
+	"hiLoLine",
+	"leaderLine",
+	"legend",
+	"plotArea",
+	"plotArea3D",
+	"seriesAxis",
+	"seriesLine",
+	"title",
+	"trendline",
+	"trendlineLabel",
+	"upBar",
+	"valueAxis",
+	"wall"
+];
+/**
+* A `cs:chartStyle` carries all thirty-one of its entries.
+*
+* The shape of this finding is the interesting half. A chart with **no**
+* chart-style relationship at all opens; a chart whose style part is present
+* and has four of thirty-one does not. So the rule is not "the part is
+* required", it is "if the part exists it must be complete" - a subset is worse
+* than an absence, which is the opposite of what any partial-styling model
+* would predict, and is why we found it by shipping four entries rather than by
+* reasoning.
+*/
+function v026ChartStyleComplete(ctx) {
+	for (const part of ctx.parts()) {
+		const document = ctx.document(part);
+		if (document === null) continue;
+		const root = document.root;
+		if (root.local !== "chartStyle" || namespaceOf(root) !== CHART_STYLE_NS) continue;
+		const present = new Set(childElements(root).map((child) => child.local));
+		const missing = CHART_STYLE_ENTRIES.filter((name) => !present.has(name));
+		if (missing.length === 0) continue;
+		ctx.add("V026", elementLocation(part, root), "a chart style with " + String(CHART_STYLE_ENTRIES.length - missing.length) + " of its " + String(CHART_STYLE_ENTRIES.length) + " entries. Missing: " + missing.join(", ") + ". Four entries were refused and thirty-one opened; a chart with no chart-style relationship at all is fine.");
+	}
+}
+//#endregion
+//#region src/rules/preservation.ts
+/**
+* `V027` … `V029`: what has to come back out unchanged.
+*
+* These are the rules the architecture exists for. Preserving charts, SmartArt,
+* animations, OLE objects and macros is unachievable in any design where the
+* writer has to *understand* a feature in order to emit it - and the moment
+* preservation is a feature rather than the default state, it is a feature with
+* a coverage percentage, and the percentage is never a hundred.
+*
+* So the default is that nothing changes, and these three rules are where that
+* intention becomes falsifiable.
+*
+* ## They need two packages, and they say so when they only have one
+*
+* All three compare against the package as it was opened. Asked to validate a
+* file with no history - `pptx-studio validate deck.pptx`, a deck somebody
+* dropped on a page - there is nothing to compare against and they do not run.
+* The report lists them under `skipped` with that reason, because a
+* preservation rule that reports nothing because it had nothing to compare
+* against looks exactly like one that found nothing, and those are opposite
+* answers.
+*/
+/** `ppt/embeddings/…` - OLE2/CFB compound files. Never ours to rewrite. */
+function isEmbedding(part) {
+	return /^\/ppt\/embeddings\//i.test(part);
+}
+/**
+* A part nobody edited comes back out byte for byte.
+*
+* "Nobody edited" is `PartInfo.fromArchive`, the store's own record of whether a
+* part's bytes still come from the archive it was opened from - not a byte
+* comparison, which could not tell an edit that happened to produce identical
+* bytes from no edit at all. The rule then checks the converse: a part the store
+* says is untouched really is identical.
+*
+* That is not circular, because the two facts come from different places. The
+* flag is set by whoever called `replacePart`; the bytes come from whatever the
+* writer actually emitted. A writer that re-serialised a clean part - the exact
+* failure this rule exists for - would leave the flag alone and change the
+* bytes, and this is where the two stop agreeing.
+*/
+function v027UneditedPartsUnchanged(ctx) {
+	if (ctx.baseline === null) return;
+	for (const part of ctx.parts()) {
+		const before = ctx.baselineRead(part);
+		if (before === null) continue;
+		const embedding = isEmbedding(part);
+		if (embedding && ctx.edited(part)) {
+			ctx.add("V027", partLocation(part), "an OLE embedding was replaced. ppt/embeddings/*.bin are OLE2/CFB compound files and any rewrite of one is a guaranteed repair prompt - we render their preview and never touch the object.");
+			continue;
+		}
+		if (!embedding && ctx.edited(part)) continue;
+		const after = ctx.read(part);
+		if (after === null) continue;
+		if (sameBytes(before, after)) continue;
+		ctx.add("V027", partLocation(part), "nobody edited this part and its bytes changed anyway (" + String(before.byteLength) + " bytes in, " + String(after.byteLength) + " out). A part that was not edited is streamed through, never re-serialised: the moment that stops being true, every feature we cannot parse is a feature we can lose.");
+	}
+}
+function sameBytes(a, b) {
+	if (a.byteLength !== b.byteLength) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+}
+/** Local names of the containers held opaque, with the namespace-free test that finds them. */
+function isOpaqueContainer(element) {
+	return element.local === "AlternateContent" || element.local === "ext";
+}
+/** Every opaque container in a document, as its exact source text. */
+function opaqueSources(document) {
+	const out = [];
+	for (const element of descendantElements(document.root)) {
+		if (!isOpaqueContainer(element)) continue;
+		out.push({
+			element,
+			source: sourceOf(document, element)
+		});
+	}
+	return out;
+}
+/**
+* No `mc:AlternateContent` branch and no extension was rebuilt.
+*
+* The check is a multiset test, not a positional one: every opaque container in
+* the part we are about to write must appear, character for character,
+* somewhere in the part as it was opened. That formulation is deliberate.
+*
+* A positional comparison - same XPath, same text - would be exact and would
+* also fire every time a shape was inserted above one, because the index in the
+* path shifts. The multiset test cannot be fooled in the direction that matters
+* (text nobody wrote before is text we wrote) and is immune to the reordering
+* that is a normal, permitted edit.
+*
+* **Deletion is not this rule's business.** An extension can leave because the
+* shape holding it was deleted, and that is a document operation the user asked
+* for. What must never happen is markup *appearing* here that we composed:
+* `mc:Choice/@Requires` names a prefix rather than a URI, so a rewritten branch
+* is how ignorable extension markup becomes a hard error - and `a34-extlst`
+* measured that PowerPoint carries an unknown `a:ext/@uri` through untouched,
+* so an extension we rebuild is one the file would otherwise have kept for ever.
+*/
+function v028OpaqueContainersUnchanged(ctx) {
+	if (ctx.baseline === null) return;
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part) || !ctx.edited(part)) continue;
+		const after = ctx.document(part);
+		const before = ctx.baselineDocument(part);
+		if (after === null || before === null) continue;
+		const known = new Set(opaqueSources(before).map((entry) => entry.source));
+		for (const entry of opaqueSources(after)) {
+			if (known.has(entry.source)) continue;
+			const uri = attributeValue(entry.element, "uri");
+			ctx.add("V028", elementLocation(part, entry.element), "<" + entry.element.qname + ">" + (uri === void 0 ? "" : " uri=\"" + uri + "\"") + " is not markup this part arrived with. These containers are carried through byte for byte and never composed: we do not know what is in them, which is the whole reason they are held opaque.");
+		}
+	}
+}
+function fieldsOf(root) {
+	const out = [];
+	for (const element of descendantElements(root)) {
+		if (element.local !== "fld") continue;
+		out.push({
+			id: attributeValue(element, "id") ?? "",
+			text: textContent(element),
+			element
+		});
+	}
+	return out;
+}
+/** `a:t` elements whose `xml:space` was declared, keyed by path. */
+function spacePreserved(root) {
+	const out = /* @__PURE__ */ new Map();
+	for (const element of descendantElements(root)) {
+		if (element.local !== "t") continue;
+		if (attributeValue(element, "xml:space") !== "preserve") continue;
+		out.set(xpathOf(element), element);
+	}
+	return out;
+}
+/** The path of every `a:t`, so "is this one still there" is a set lookup. */
+function textPaths(root) {
+	const out = /* @__PURE__ */ new Set();
+	for (const element of descendantElements(root)) if (element.local === "t") out.add(xpathOf(element));
+	return out;
+}
+/**
+* Text and field identity survive an edit.
+*
+* Three small, separately silent losses.
+*
+* **`xml:space="preserve"` is preserved, not required.** The distinction is
+* measured: 120 `<a:t>` elements in the corpus carry leading or trailing
+* whitespace *without* the attribute and PowerPoint round-trips every one of
+* them with the whitespace intact, so a rule that demanded the attribute would
+* fire on real files that work. What is not allowed is dropping one that was
+* there, because then the attribute's absence starts meaning something it did
+* not mean before.
+*
+* **`a:fld/@id` is a required `ST_Guid`** identifying the field across saves.
+* Regenerating one can make PowerPoint repair the file, and a repair is the one
+* outcome this whole package exists to prevent.
+*
+* **A field's cached `a:t` is its only rendering** anywhere we cannot evaluate
+* the field ourselves. Discarding it turns a date placeholder into an empty box
+* on every consumer that is not PowerPoint - including, for anything we have
+* not implemented, us.
+*/
+function v029TextAndFieldIdentity(ctx) {
+	if (ctx.baseline === null) return;
+	for (const part of ctx.parts()) {
+		if (isRelationshipPartName(part) || !ctx.edited(part)) continue;
+		const after = ctx.document(part);
+		const before = ctx.baselineDocument(part);
+		if (after === null || before === null) continue;
+		const afterSpace = spacePreserved(after.root);
+		const afterPaths = textPaths(after.root);
+		for (const [path, element] of spacePreserved(before.root)) {
+			if (afterSpace.has(path)) continue;
+			if (!afterPaths.has(path)) continue;
+			ctx.add("V029", {
+				part,
+				xpath: path,
+				offset: element.start
+			}, "this <" + element.qname + "> arrived with xml:space=\"preserve\" and no longer has it. The attribute is not required - 120 elements in our corpus carry edge whitespace without it - but dropping one that was written changes what the text is.");
+		}
+		const afterFields = fieldsOf(after.root);
+		const beforeById = new Map(fieldsOf(before.root).map((field) => [field.id, field]));
+		const beforeIds = new Set(beforeById.keys());
+		for (const field of afterFields) {
+			if (beforeIds.has(field.id)) {
+				const original = beforeById.get(field.id);
+				if (original.text !== "" && field.text.trim() === "") ctx.add("V029", elementLocation(part, field.element), "field " + field.id + " has lost its cached text (\"" + original.text + "\"). The cache is what renders anywhere the field cannot be evaluated, which includes every consumer that is not PowerPoint.");
+				continue;
+			}
+			ctx.add("V029", elementLocation(part, field.element), "field id=\"" + field.id + "\" is not one this part arrived with. a:fld/@id is a required ST_Guid identifying the field across saves; regenerating one can make PowerPoint repair the file. The ids that were here: " + (beforeIds.size === 0 ? "none" : [...beforeIds].join(", ")) + ".");
+		}
+	}
+}
+//#endregion
+//#region src/validate.ts
+/**
+* The twenty-nine, wired to their implementations.
+*
+* A plain table, so that "is every rule reachable" is a thing a test can ask
+* rather than a thing a reader has to believe. `rules.test.ts` asserts that the
+* keys here are exactly `RULE_IDS` - a rule with a definition and no function
+* would otherwise sit in the table looking enforced.
+*/
+const IMPLEMENTATIONS = {
+	V001: v001ContentTypeCoverage,
+	V002: v002ContentTypeMap,
+	V003: v003ArchiveShape,
+	V004: v004PartNames,
+	V005: v005MainPart,
+	V006: v006ReferencesResolve,
+	V007: v007RelationshipIds,
+	V008: v008TargetsResolve,
+	V009: v009RequiredEdges,
+	V010: v010SchemaOrder,
+	V011: v011ExtLstLast,
+	V012: v012UnexpectedChild,
+	V013: v013NotesSize,
+	V014: v014ColorMap,
+	V015: v015ShapeTreePrologue,
+	V016: v016TextBody,
+	V017: v017GraphicFrame,
+	V018: v018SlideIds,
+	V019: v019SheetIds,
+	V020: v020ShapeIds,
+	V021: v021PlaceholderIndices,
+	V022: v022PlaceholderType,
+	V023: v023GeometryGuides,
+	V024: v024SeriesText,
+	V025: v025Control,
+	V026: v026ChartStyleComplete,
+	V027: v027UneditedPartsUnchanged,
+	V028: v028OpaqueContainersUnchanged,
+	V029: v029TextAndFieldIdentity
+};
+/** Rules that cannot run without the archive bytes. See `Context.archive`. */
+const ARCHIVE_RULES = ["V003"];
+function openArchive(bytes, zip) {
+	if (bytes === void 0) return null;
+	try {
+		return readZip(bytes, zip ?? {});
+	} catch {
+		return null;
+	}
+}
+/**
+* Check a package against the rules.
+*
+* Never throws for anything it finds - a broken package produces a report with
+* findings in it, which is the shape a caller can render. It throws only when
+* it was handed something it cannot open at all.
+*/
+function validatePackage(options) {
+	const archive = openArchive(options.bytes, options.zip);
+	const store = options.store ?? openStore(options);
+	const requested = resolveRules(options.rules);
+	const skipped = [];
+	const running = [];
+	for (const id of requested) {
+		if (ruleById(id).needsBaseline === true && options.baseline === void 0) {
+			skipped.push({
+				rule: id,
+				why: "it compares against the package as it was opened, and none was supplied. A preservation rule with nothing to compare against reports nothing, which looks exactly like finding nothing."
+			});
+			continue;
+		}
+		if (ARCHIVE_RULES.includes(id) && archive === null) {
+			skipped.push({
+				rule: id,
+				why: "it reads the archive itself, and only a PartStore was supplied."
+			});
+			continue;
+		}
+		running.push(id);
+	}
+	const ctx = createContext({
+		store,
+		bytes: options.bytes ?? null,
+		archive,
+		baseline: options.baseline ?? null
+	});
+	run(ctx, running);
+	return buildReport({
+		findings: attributeOrigins(ctx, options, running),
+		checked: running,
+		skipped,
+		problems: ctx.problems
+	});
+}
+function openStore(options) {
+	if (options.bytes === void 0) throw new ValidateError("ERR_UNVALIDATABLE", "validatePackage needs either a `store` or the archive `bytes`; it was given neither.");
+	try {
+		return PartStore.open(options.bytes, options.zip);
+	} catch (error) {
+		throw new ValidateError("ERR_UNVALIDATABLE", "the package could not be opened, so there is nothing to validate: " + (error instanceof Error ? error.message : String(error)));
+	}
+}
+function resolveRules(requested) {
+	if (requested === void 0) return RULE_IDS;
+	for (const id of requested) if (ruleById(id) === void 0) throw new ValidateError("ERR_UNKNOWN_RULE", "there is no rule " + id, { rule: id });
+	return RULE_IDS.filter((id) => requested.includes(id));
+}
+function run(ctx, rules) {
+	for (const id of rules) IMPLEMENTATIONS[id](ctx);
+}
+/**
+* Decide, for each finding, whether we introduced it.
+*
+* The second pass is the whole of it: run the same rules against the package as
+* it was opened and difference the two sets. A finding in both was already
+* there. See `report.ts` for why that question is the one that decides whether
+* an export is refused, and why answering it by differencing beats answering it
+* per rule.
+*
+* Three properties make it cheap enough to be unconditional in the only case
+* that matters. It runs **only when something fatal was found**, so a clean
+* export - which is nearly all of them - pays nothing. It runs **only the rules
+* that fired**, not all twenty-nine. And it skips the preservation rules, which
+* would be comparing the baseline against itself and would find nothing by
+* construction.
+*/
+function attributeOrigins(ctx, options, running) {
+	const baseline = options.baseline;
+	if (baseline === void 0) return ctx.findings;
+	const fatal = ctx.findings.filter((finding) => finding.severity === "fatal");
+	if (fatal.length === 0) return ctx.findings.map((finding) => ({
+		...finding,
+		origin: "introduced"
+	}));
+	const firedRules = new Set(fatal.map((finding) => finding.rule));
+	const replay = running.filter((id) => firedRules.has(id) && ruleById(id).needsBaseline !== true);
+	const before = createContext({
+		store: baseline,
+		bytes: options.baselineBytes ?? null,
+		archive: openArchive(options.baselineBytes, options.zip),
+		baseline: null
+	});
+	run(before, replay);
+	const inherited = new Set(before.findings.map(findingKey));
+	return ctx.findings.map((finding) => ({
+		...finding,
+		origin: inherited.has(findingKey(finding)) ? "inherited" : "introduced"
+	}));
+}
+/**
+* Validate, and refuse to go on if we broke something.
+*
+* The one call an export path makes. It throws rather than returning a boolean
+* because the failure has to be impossible to ignore: PowerPoint emits no
+* diagnostic log, its refusal message names no part and no line, and a user who
+* gets a repair prompt has no way at all to find out why. This is the only
+* feedback loop that exists, and a caller who forgot to check a return value
+* would have removed it.
+*/
+function assertValid(options) {
+	const report = validatePackage(options);
+	if (report.ok) return report;
+	const blocking = report.findings.filter((finding) => finding.severity === "fatal" && finding.origin !== "inherited");
+	throw new ValidateError("ERR_VALIDATION_FAILED", "refusing to hand over the package: " + String(report.blocking) + " fatal finding(s) this session introduced. First: " + blocking[0].rule + " at " + blocking[0].where.part + (blocking[0].where.xpath === null ? "" : " " + blocking[0].where.xpath) + " - " + blocking[0].message, {
+		part: blocking[0].where.part,
+		report
+	});
+}
+//#endregion
+export { BASELINE_RULES, PACKAGE_LOCATION, RULES, RULE_IDS, VALIDATE_ERROR_CODES, ValidateError, assertValid, attributeLocation, buildReport, createContext, elementLocation, findingKey, formatReport, inDocumentOrder, isReport, isValidateError, lineColumn, partLocation, rootName, ruleById, validatePackage, xpathOf, xpathOfAttribute };
+
+//# sourceMappingURL=index.js.map