ooxml-core 0.12.0 → 0.13.0

package/dist/pptx/cli/index.mjs

@@ -13615,10 +13615,10 @@ var init_ole_utils = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
 var OLE_MAGIC, ENDOFCHAIN, FREESECT, FATSECT, DIFSECT, MAXREGSECT, ENTRY_TYPE_EMPTY, ENTRY_TYPE_STREAM, ENTRY_TYPE_ROOT, DIR_ENTRY_SIZE, Ole2ParseError;
 var init_ole2_parser_types = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js"() {
     OLE_MAGIC = new Uint8Array([208, 207, 17, 224, 161, 177, 26, 225]);
     ENDOFCHAIN = 4294967294;
     FREESECT = 4294967295;
@@ -13638,10 +13638,13 @@ var init_ole2_parser_types = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js
 function parseOle2(buffer) {
   const data = new Uint8Array(buffer);
   const view = new DataView(buffer);
+  if (data.length < 512) {
+    throw new Ole2ParseError("Truncated OLE2 compound file header");
+  }
   for (let i = 0; i < OLE_MAGIC.length; i++) {
     if (data[i] !== OLE_MAGIC[i]) {
       throw new Ole2ParseError("Not a valid OLE2 compound file");
@@ -13655,8 +13658,15 @@ function parseOle2(buffer) {
   }
   const sectorSizePower = view.getUint16(30, true);
   const miniSectorSizePower = view.getUint16(32, true);
+  if (majorVersion !== 3 && majorVersion !== 4 || sectorSizePower !== (majorVersion === 3 ? 9 : 12) || miniSectorSizePower !== 6) {
+    throw new Ole2ParseError("Unsupported OLE2 version or sector size");
+  }
   const sectorSize = 1 << sectorSizePower;
   const miniSectorSize = 1 << miniSectorSizePower;
+  if (data.length < sectorSize || data.length % sectorSize !== 0) {
+    throw new Ole2ParseError("Truncated OLE2 sector");
+  }
+  const sectorCount = data.length / sectorSize - 1;
   const totalFATSectors = view.getUint32(44, true);
   const firstDirectorySector = view.getUint32(48, true);
   const miniStreamCutoff = view.getUint32(56, true);
@@ -13664,6 +13674,9 @@ function parseOle2(buffer) {
   const totalMiniFATSectors = view.getUint32(64, true);
   const firstDIFATSector = view.getUint32(68, true);
   const totalDIFATSectors = view.getUint32(72, true);
+  if (totalFATSectors > sectorCount || totalMiniFATSectors > sectorCount || totalDIFATSectors > sectorCount) {
+    throw new Ole2ParseError("Allocation table count exceeds file size");
+  }
   function sectorOffset(sector) {
     return (sector + 1) * sectorSize;
   }
@@ -13682,7 +13695,11 @@ function parseOle2(buffer) {
     }
   }
   let difatSector = firstDIFATSector;
+  const difatSeen = /* @__PURE__ */ new Set();
   for (let d = 0; d < totalDIFATSectors && difatSector <= MAXREGSECT; d++) {
+    if (difatSeen.has(difatSector))
+      throw new Ole2ParseError("Circular DIFAT chain");
+    difatSeen.add(difatSector);
     const difatData = readSector(difatSector);
     const difatView = new DataView(difatData.buffer, difatData.byteOffset, difatData.byteLength);
     const entriesPerSector = (sectorSize - 4) / 4;
@@ -13694,11 +13711,14 @@ function parseOle2(buffer) {
     }
     difatSector = difatView.getUint32(sectorSize - 4, true);
   }
+  if (difatSeen.size !== totalDIFATSectors || fatSectors.length !== totalFATSectors || new Set(fatSectors).size !== fatSectors.length || fatSectors.some((id) => difatSeen.has(id))) {
+    throw new Ole2ParseError("Invalid DIFAT allocation table");
+  }
   const fatEntries = [];
   for (const fatSector of fatSectors) {
     const fatData = readSector(fatSector);
     const fatView = new DataView(fatData.buffer, fatData.byteOffset, fatData.byteLength);
-    for (let i = 0; i < sectorSize / 4; i++) {
+    for (let i = 0; i < sectorSize / 4 && fatEntries.length < sectorCount; i++) {
       fatEntries.push(fatView.getUint32(i * 4, true));
     }
   }
@@ -13712,8 +13732,12 @@ function parseOle2(buffer) {
       }
       visited.add(current);
       sectors.push(readSector(current));
-      current = fatEntries[current] ?? ENDOFCHAIN;
+      if (fatEntries[current] === void 0)
+        throw new Ole2ParseError("Missing FAT chain entry");
+      current = fatEntries[current];
     }
+    if (current !== ENDOFCHAIN)
+      throw new Ole2ParseError("Invalid FAT chain terminator");
     const totalLength = sectors.length * sectorSize;
     const result = new Uint8Array(totalLength);
     let offset = 0;
@@ -13724,16 +13748,14 @@ function parseOle2(buffer) {
     return result;
   }
   function readStream(startSector, size) {
+    if (size === 0)
+      return new Uint8Array(0);
+    if (size > sectorCount * sectorSize)
+      throw new Ole2ParseError("Stream size exceeds file size");
     const raw = readSectorChain(startSector);
-    return raw.subarray(0, Math.min(size, raw.length));
-  }
-  const miniFatEntries = [];
-  if (firstMiniFATSector <= MAXREGSECT && totalMiniFATSectors > 0) {
-    const miniFatRaw = readSectorChain(firstMiniFATSector);
-    const miniFatView = new DataView(miniFatRaw.buffer, miniFatRaw.byteOffset, miniFatRaw.byteLength);
-    for (let i = 0; i < miniFatRaw.length / 4; i++) {
-      miniFatEntries.push(miniFatView.getUint32(i * 4, true));
-    }
+    if (raw.length < size)
+      throw new Ole2ParseError("Truncated stream sector chain");
+    return raw.subarray(0, size);
   }
   const dirRaw = readSectorChain(firstDirectorySector);
   const numEntries = Math.floor(dirRaw.length / DIR_ENTRY_SIZE);
@@ -13746,6 +13768,9 @@ function parseOle2(buffer) {
     if (objectType === ENTRY_TYPE_EMPTY) {
       continue;
     }
+    if (nameLen < 2 || nameLen > 64 || nameLen % 2 !== 0 || entryView.getUint16(nameLen - 2, true) !== 0) {
+      throw new Ole2ParseError("Invalid directory entry name");
+    }
     const nameBytes = Math.max(0, nameLen - 2);
     let name = "";
     for (let j = 0; j < nameBytes; j += 2) {
@@ -13759,8 +13784,11 @@ function parseOle2(buffer) {
     const sizeLow = entryView.getUint32(120, true);
     let size = sizeLow;
     if (majorVersion === 4) {
-      entryView.getUint32(124, true);
-      size = sizeLow;
+      const sizeHigh = entryView.getUint32(124, true);
+      size = sizeLow + sizeHigh * 4294967296;
+      if (!Number.isSafeInteger(size) || size > sectorCount * sectorSize) {
+        throw new Ole2ParseError("Stream size exceeds supported file bounds");
+      }
     }
     entries.push({
       name,
@@ -13774,11 +13802,28 @@ function parseOle2(buffer) {
     });
   }
   const rootEntry = entries.find((e) => e.type === ENTRY_TYPE_ROOT);
+  if (!rootEntry || entries.filter((e) => e.type === ENTRY_TYPE_ROOT).length !== 1) {
+    throw new Ole2ParseError("Invalid root directory entry");
+  }
   let miniStreamData;
   if (rootEntry && rootEntry.startSector <= MAXREGSECT) {
-    miniStreamData = readSectorChain(rootEntry.startSector);
+    miniStreamData = readStream(rootEntry.startSector, rootEntry.size);
+  }
+  const miniFatEntries = [];
+  if (firstMiniFATSector <= MAXREGSECT && totalMiniFATSectors > 0) {
+    const miniFatRaw = readSectorChain(firstMiniFATSector);
+    if (miniFatRaw.length !== totalMiniFATSectors * sectorSize) {
+      throw new Ole2ParseError("Unexpected mini FAT chain length");
+    }
+    const miniFatView = new DataView(miniFatRaw.buffer, miniFatRaw.byteOffset, miniFatRaw.byteLength);
+    const miniCapacity = Math.floor((miniStreamData?.length ?? 0) / miniSectorSize);
+    for (let i = 0; i < miniFatRaw.length / 4 && i < miniCapacity; i++) {
+      miniFatEntries.push(miniFatView.getUint32(i * 4, true));
+    }
   }
   function readMiniStream(startSector, size) {
+    if (size === 0)
+      return new Uint8Array(0);
     if (!miniStreamData) {
       throw new Ole2ParseError("Mini stream container not found");
     }
@@ -13791,17 +13836,24 @@ function parseOle2(buffer) {
       }
       visited.add(current);
       const offset2 = current * miniSectorSize;
+      if (offset2 + miniSectorSize > miniStreamData.length || miniFatEntries[current] === void 0) {
+        throw new Ole2ParseError("Mini stream sector exceeds allocation bounds");
+      }
       sectors.push(miniStreamData.subarray(offset2, offset2 + miniSectorSize));
-      current = miniFatEntries[current] ?? ENDOFCHAIN;
+      current = miniFatEntries[current];
     }
+    if (current !== ENDOFCHAIN)
+      throw new Ole2ParseError("Invalid mini FAT chain terminator");
     const totalLength = sectors.length * miniSectorSize;
+    if (totalLength < size)
+      throw new Ole2ParseError("Truncated mini stream sector chain");
     const result = new Uint8Array(totalLength);
     let offset = 0;
     for (const sector of sectors) {
       result.set(sector, offset);
       offset += miniSectorSize;
     }
-    return result.subarray(0, Math.min(size, result.length));
+    return result.subarray(0, size);
   }
   function getStream(name) {
     const entry = entries.find((e) => (e.type === ENTRY_TYPE_STREAM || e.type === ENTRY_TYPE_ROOT) && e.name === name);
@@ -13816,7 +13868,7 @@ function parseOle2(buffer) {
   return { entries, getStream };
 }
 var init_ole2_parser_read = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js"() {
     init_ole2_parser_types();
   }
 });
@@ -13956,13 +14008,16 @@ var init_ole_embedded_extract = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js
 function compareDirEntryNames(a, b) {
+  const ua = a.toUpperCase();
+  const ub = b.toUpperCase();
+  if (ua.length !== a.length || ub.length !== b.length) {
+    throw new Error("CFB stream names with expanding uppercase mappings are unsupported");
+  }
   if (a.length !== b.length) {
     return a.length - b.length;
   }
-  const ua = a.toUpperCase();
-  const ub = b.toUpperCase();
   for (let i = 0; i < ua.length; i++) {
     const diff = ua.charCodeAt(i) - ub.charCodeAt(i);
     if (diff !== 0) {
@@ -13979,6 +14034,24 @@ function encodeName(name) {
   }
   return bytes;
 }
+function buildDirectoryTree(entryCount) {
+  const links = /* @__PURE__ */ new Map();
+  let redLevel = 0;
+  for (let remaining = entryCount - 2; remaining >= 0; remaining = Math.floor(remaining / 2) - 1)
+    redLevel++;
+  const build = (low, high, level2) => {
+    if (low > high)
+      return 4294967295;
+    const id = Math.floor((low + high) / 2);
+    links.set(id, {
+      left: build(low, id - 1, level2 + 1),
+      right: build(id + 1, high, level2 + 1),
+      color: level2 === redLevel ? 0 : 1
+    });
+    return id;
+  };
+  return { root: build(1, entryCount - 1, 0), links };
+}
 function writeFatChain(fat, chain) {
   for (let i = 0; i < chain.sectors.length; i++) {
     fat[chain.sectors[i]] = i < chain.sectors.length - 1 ? chain.sectors[i + 1] : ENDOFCHAIN;
@@ -14002,12 +14075,12 @@ function writeInt32Sectors(outBytes, int32Data, firstSector, numSectors, sectorS
   }
 }
 var init_ole2_parser_write_helpers = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js"() {
     init_ole2_parser_types();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js
 function writeHeader(outView, outBytes, params) {
   outBytes.set(OLE_MAGIC, 0);
   outView.setUint16(24, 62, true);
@@ -14064,6 +14137,7 @@ function writeDifatSectors(outView, params) {
 function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
   const dirData = new Uint8Array(numDirSectors * sectorSize);
   const dirView = new DataView(dirData.buffer);
+  const tree = buildDirectoryTree(dirEntries.length);
   for (let i = 0; i < dirEntries.length; i++) {
     const entry = dirEntries[i];
     const entryOffset = i * DIR_ENTRY_SIZE;
@@ -14071,17 +14145,17 @@ function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
     dirData.set(nameBytes.subarray(0, Math.min(nameBytes.length, 64)), entryOffset);
     dirView.setUint16(entryOffset + 64, Math.min((entry.name.length + 1) * 2, 64), true);
     dirData[entryOffset + 66] = entry.type;
-    dirData[entryOffset + 67] = 1;
+    dirData[entryOffset + 67] = i === 0 ? 1 : tree.links.get(i).color;
     if (entry.clsid) {
       dirData.set(entry.clsid.subarray(0, 16), entryOffset + 80);
     }
     if (i === 0) {
       dirView.setUint32(entryOffset + 68, 4294967295, true);
       dirView.setUint32(entryOffset + 72, 4294967295, true);
-      dirView.setUint32(entryOffset + 76, dirEntries.length > 1 ? 1 : 4294967295, true);
+      dirView.setUint32(entryOffset + 76, tree.root, true);
     } else {
-      dirView.setUint32(entryOffset + 68, 4294967295, true);
-      dirView.setUint32(entryOffset + 72, i + 1 < dirEntries.length ? i + 1 : 4294967295, true);
+      dirView.setUint32(entryOffset + 68, tree.links.get(i).left, true);
+      dirView.setUint32(entryOffset + 72, tree.links.get(i).right, true);
       dirView.setUint32(entryOffset + 76, 4294967295, true);
     }
     dirView.setUint32(entryOffset + 116, entry.startSector, true);
@@ -14099,17 +14173,32 @@ function writeStreamSectors(outBytes, streamData, chain, sectorSize) {
 }
 var HEADER_DIFAT_ENTRIES;
 var init_ole2_parser_write_serialize = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js"() {
     init_ole2_parser_types();
     init_ole2_parser_write_helpers();
     HEADER_DIFAT_ENTRIES = 109;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js
 function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   const sectorSize = 512;
   const miniSectorSize = 64;
+  if (rootClsid && rootClsid.length !== 16)
+    throw new Error("Root CLSID must contain 16 bytes");
+  const names = [...streams2.keys()].sort(compareDirEntryNames);
+  for (let i = 0; i < names.length; i++) {
+    const name = names[i];
+    if (name.toUpperCase().length !== name.length) {
+      throw new Error("CFB stream names with expanding uppercase mappings are unsupported");
+    }
+    if (!name.length || name.length > 31 || /[\x00\\/:!]/.test(name)) {
+      throw new Error("CFB stream names must be 1-31 UTF-16 code units without NUL, \\, /, :, or !");
+    }
+    if (i > 0 && compareDirEntryNames(names[i - 1], name) === 0) {
+      throw new Error("Duplicate CFB stream names");
+    }
+  }
   const regularStreams = [];
   const miniStreams = [];
   for (const [name, data] of streams2) {
@@ -14127,7 +14216,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
     for (let i = 0; i < numSectors; i++) {
       sectors.push(nextSector++);
     }
-    fatChains.set(stream.name, { start: sectors[0] ?? 0, sectors });
+    fatChains.set(stream.name, { start: sectors[0] ?? ENDOFCHAIN, sectors });
   }
   let miniStreamContainer = new Uint8Array(0);
   const miniFatChains = /* @__PURE__ */ new Map();
@@ -14150,7 +14239,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
         miniOffset += miniSectorSize;
       }
       miniFatChains.set(stream.name, {
-        start: miniSectors[0] ?? 0,
+        start: miniSectors[0] ?? ENDOFCHAIN,
         sectors: miniSectors
       });
     }
@@ -14198,7 +14287,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   nextSector += numDirSectors;
   let firstMiniFATSector = ENDOFCHAIN;
   let numMiniFATSectors = 0;
-  if (miniStreams.length > 0) {
+  if (nextMiniSector > 0) {
     numMiniFATSectors = Math.ceil(nextMiniSector * 4 / sectorSize);
     firstMiniFATSector = nextSector;
     nextSector += numMiniFATSectors;
@@ -14272,7 +14361,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   return output;
 }
 var init_ole2_parser_write = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js"() {
     init_ole2_parser_types();
     init_ole2_parser_write_helpers();
     init_ole2_parser_write_serialize();
@@ -14734,7 +14823,7 @@ var init_xml_whitespace = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js
 function adler32(bytes) {
   let a = 1;
   let b = 0;
@@ -14783,7 +14872,7 @@ function zlibStore(data) {
   return concatBytes([zlibHeader, ...blocks, adlerBytes]);
 }
 var init_png_encoder = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js"() {
     (() => {
       const table = new Uint32Array(256);
       for (let n = 0; n < 256; n++) {
@@ -33317,7 +33406,7 @@ var init_encryption_detection = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js
 function getSubtle() {
   if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle) {
     return globalThis.crypto.subtle;
@@ -33435,7 +33524,7 @@ async function hmac(algorithm, key2, data) {
   return new Uint8Array(result);
 }
 var init_ooxml_crypto_primitives = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js"() {
   }
 });
 
@@ -34633,7 +34722,7 @@ var init_ole2_parser = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js
 function rotl32(x, n) {
   return (x << n | x >>> 32 - n) >>> 0;
 }
@@ -34682,11 +34771,11 @@ function mdStyleDigest(message, initialState, transform2) {
   return out;
 }
 var init_bit_ops = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js"() {
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js
 function f1(x, y, z) {
   return x & y | ~x & z;
 }
@@ -34710,7 +34799,7 @@ function md4(message) {
 }
 var INITIAL_STATE, K22, K3, ROUND1, ROUND2, ROUND3;
 var init_md4 = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js"() {
     init_bit_ops();
     INITIAL_STATE = [1732584193, 4023233417, 2562383102, 271733878];
     K22 = 1518500249;
@@ -90725,7 +90814,7 @@ var init_metro_blob_collect = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js
 function record(recType, data, recInstance = 0, isContainer2 = false, recVer = 0) {
   const header = new Uint8Array(8);
   const view = new DataView(header.buffer);
@@ -90740,7 +90829,7 @@ function record(recType, data, recInstance = 0, isContainer2 = false, recVer = 0
 }
 var ByteWriter;
 var init_byte_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js"() {
     ByteWriter = class {
       chunks = [];
       length = 0;
@@ -90823,13 +90912,13 @@ var init_byte_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js
 function masterToEmu(mu) {
   return Math.round(mu * EMU_PER_MASTER);
 }
 var RT, OA, TEXT_TYPE, HEADER_TOKEN_PLAIN, HEADER_TOKEN_ENCRYPTED, EMU_PER_MASTER;
 var init_legacy_ppt_record_types = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js"() {
     RT = {
       Document: 1e3,
       DocumentAtom: 1001,
@@ -90958,14 +91047,14 @@ var init_legacy_ppt_record_types = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js
 var init_record_types = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js"() {
     init_legacy_ppt_record_types();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js
 function buildCurrentUserStream(offsetToCurrentEdit, encrypted) {
   const nameBytes = new ByteWriter().ansi(USER_NAME).toBytes();
   const data = new ByteWriter().u32(20).u32(encrypted ? HEADER_TOKEN_ENCRYPTED : HEADER_TOKEN_PLAIN).u32(offsetToCurrentEdit).u16(nameBytes.length).u16(1012).u8(3).u8(0).bytes(new Uint8Array(2)).bytes(nameBytes).u32(8).toBytes();
@@ -90979,7 +91068,7 @@ function buildCurrentUserStream(offsetToCurrentEdit, encrypted) {
 }
 var USER_NAME, CURRENT_USER_STREAM_SIZE;
 var init_current_user_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js"() {
     init_record_types();
     init_byte_writer();
     USER_NAME = "pptx-viewer";
@@ -90987,7 +91076,7 @@ var init_current_user_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js
 function pictureUid(picture) {
   return md4(picture.bytes);
 }
@@ -91010,7 +91099,7 @@ function buildFbse(picture, uid, foDelay, size) {
 }
 var MSOBLIP_PICT, BLIP_INFO;
 var init_blip_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js"() {
     init_md4();
     init_png_encoder();
     init_record_types();
@@ -91026,7 +91115,7 @@ var init_blip_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js
 function boolPropValue(flag, bit, useBit) {
   return useBit | (flag ? bit : 0);
 }
@@ -91062,7 +91151,7 @@ function buildMetroBlobTertiaryFopt(metroBlob) {
 }
 var OPT, FBID_FLAG, METRO_BLOB_OPID;
 var init_fopt_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js"() {
     init_record_types();
     init_byte_writer();
     OPT = {
@@ -91090,7 +91179,7 @@ var init_fopt_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js
 function buildDggDefaultProperties() {
   return buildFopt([
     { id: 385, value: 134217732 },
@@ -91148,7 +91237,7 @@ function buildPictureStore(pictures, shapesPerDrawing) {
 }
 var SHAPE_ID_CLUSTER_SIZE;
 var init_bstore_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js"() {
     init_record_types();
     init_blip_writer();
     init_byte_writer();
@@ -91157,7 +91246,7 @@ var init_bstore_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js
 function buildFontEntityAtom(name, index) {
   const nameBytes = new ByteWriter().utf16(name.slice(0, 31)).u16(0).toBytes();
   const padded = new Uint8Array(LF_FACE_NAME_BYTES);
@@ -91185,14 +91274,14 @@ function buildEnvironment(fonts, otherTextStyle) {
 }
 var LF_FACE_NAME_BYTES;
 var init_font_collection_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js"() {
     init_record_types();
     init_byte_writer();
     LF_FACE_NAME_BYTES = 64;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js
 function emuToMaster(emu2) {
   return Math.round(emu2 / EMU_PER_MASTER);
 }
@@ -91248,7 +91337,7 @@ function buildDocumentContainer(input) {
 }
 var MASTER_SLIDE_ID_SENTINEL, RT_CSTRING, RT_BINARY_TAG_DATA_BLOB;
 var init_document_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_font_collection_writer();
@@ -91258,7 +91347,7 @@ var init_document_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js
 function buildCString(text2, recInstance) {
   return record(RT.CString, new ByteWriter().utf16(text2).toBytes(), recInstance, false, 0);
 }
@@ -91394,7 +91483,7 @@ function buildTextInteractiveInfoAtom(beginChar, endChar) {
 }
 var II_ACTION, II_JUMP, LT, FLAG_CUSTOM_SHOW_RETURN, HyperlinkCollector;
 var init_hyperlink_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js"() {
     init_record_types();
     init_byte_writer();
     II_ACTION = {
@@ -91457,7 +91546,7 @@ var init_hyperlink_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js
 function buildCString2(text2, recInstance) {
   return record(RT.CString, new ByteWriter().utf16(text2).toBytes(), recInstance, false, 0);
 }
@@ -91493,7 +91582,7 @@ function buildMediaExObjEntries(media) {
 }
 var MediaCollector, SOUND_EXTENSION_WAV, SOUND_LENGTH_UNKNOWN;
 var init_media_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js"() {
     init_record_types();
     init_byte_writer();
     MediaCollector = class {
@@ -91529,7 +91618,7 @@ var init_media_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js
 function hexToBytes(hex3) {
   const out = new Uint8Array(hex3.length / 2);
   for (let i = 0; i < out.length; i++) {
@@ -91591,7 +91680,7 @@ function buildExObjRefAtom(exObjId) {
 }
 var PACKAGE_ROOT_CLSID, COMP_OBJ_HEX, EX_OLE_EMBEDDED, DV_ASPECT_ICON, EX_OLE_SUB_DEFAULT, PACKAGER_MENU_NAME, OleCollector;
 var init_ole_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js"() {
     init_ole2_parser_write();
     init_record_types();
     init_byte_writer();
@@ -91651,7 +91740,7 @@ var init_ole_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js
 function buildExObjList(hyperlinks, ole, media) {
   const oleEntries = ole?.all ?? [];
   const mediaEntries = media?.all ?? [];
@@ -91678,7 +91767,7 @@ function buildExObjList(hyperlinks, ole, media) {
   return record(RT.ExternalObjectList, w.toBytes(), 0, true);
 }
 var init_ex_obj_list_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_hyperlink_writer();
@@ -91687,7 +91776,7 @@ var init_ex_obj_list_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js
 function emuToMaster2(emu2) {
   return Math.round(emu2 / EMU_PER_MASTER);
 }
@@ -91732,7 +91821,7 @@ function buildChildAnchor(rect2) {
 }
 var INT16_MIN, INT16_MAX;
 var init_anchor_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js"() {
     init_record_types();
     init_byte_writer();
     INT16_MIN = -32768;
@@ -91740,7 +91829,7 @@ var init_anchor_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js
 function parseHex(rgb) {
   const hex3 = (rgb ?? DEFAULT_RGB).replace(/^#/u, "");
   if (!/^[0-9a-fA-F]{6}$/u.test(hex3)) {
@@ -91762,12 +91851,12 @@ function encodeColorIndex(rgb) {
 }
 var DEFAULT_RGB;
 var init_colors = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js"() {
     DEFAULT_RGB = "000000";
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js
 function writePfException(w, para) {
   let mask = 0;
   if (para.hasBullet !== void 0) {
@@ -91857,7 +91946,7 @@ function writeCfException(w, run, fontIndex) {
 }
 var ALIGN_CODE, EMU_PER_MASTER_UNIT;
 var init_text_exception_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js"() {
     init_colors();
     ALIGN_CODE = {
       l: 0,
@@ -91869,7 +91958,7 @@ var init_text_exception_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js
 function joinParagraphText(body) {
   return body.paragraphs.map((p) => p.runs.map((r) => r.text).join("")).join("\r");
 }
@@ -91930,7 +92019,7 @@ function buildTextAtoms(body, fonts, hyperlinks) {
   return new ByteWriter().bytes(buildTextHeaderAtom(body.textType)).bytes(buildTextCharsAtom(text2)).bytes(buildStyleTextPropAtom(body, fontIndex)).bytes(buildRunHyperlinks(body, hyperlinks)).toBytes();
 }
 var init_text_atom_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_hyperlink_writer();
@@ -91938,7 +92027,7 @@ var init_text_atom_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js
 function utf16z(text2) {
   return new ByteWriter().utf16(text2).u16(0).toBytes();
 }
@@ -92035,7 +92124,7 @@ function buildMasterPlaceholders(placeholders, allocator, fieldFontIndex) {
 }
 var FSP_FLAGS, RECTANGLE_SPT, TEXT_TYPE_TITLE, TEXT_TYPE_BODY, TEXT_TYPE_OTHER, SPECS, MASTER_PLACEHOLDER_ORDER, TITLE_PROMPT, BODY_PROMPT, DEFAULT_FRAMES;
 var init_master_placeholders_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js"() {
     init_record_types();
     init_anchor_writer();
     init_byte_writer();
@@ -92102,18 +92191,18 @@ var init_master_placeholders_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js
 function masterStyleFonts(styles) {
   if (!styles)
     return [];
   return [styles.title, styles.body, styles.other].flatMap((levels) => levels ?? []).map((level2) => level2.run.fontName).filter((name) => Boolean(name));
 }
 var init_master_style_fonts = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js"() {
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js
 function buildMasterStyleAtom(recInstance, levels, fontIndex) {
   const w = new ByteWriter().u16(levels.length);
   for (const level2 of levels) {
@@ -92144,7 +92233,7 @@ function buildMasterTextStyles(styles, fontIndex) {
 }
 var EMPTY_LEVELS, FIXED_INSTANCE_DATA;
 var init_master_text_styles_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_text_exception_writer();
@@ -92160,7 +92249,7 @@ var init_master_text_styles_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js
 function fillEntries(fill) {
   if (!fill || fill.kind === "none") {
     return [{ id: OPT.fNoFillHitTest, value: boolPropValue(false, 16, 1048576) }];
@@ -92215,7 +92304,7 @@ function buildShapeFoptProps(input) {
 }
 var DASH_CODE;
 var init_shape_props_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js"() {
     init_colors();
     init_fopt_writer();
     DASH_CODE = {
@@ -92230,7 +92319,7 @@ var init_shape_props_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js
 function buildShapeAnchor(rect2, inGroup) {
   return inGroup ? buildChildAnchor(rect2) : buildClientAnchor(rect2);
 }
@@ -92332,7 +92421,7 @@ function buildMediaShapeContainer(media, allocator, hyperlinks, mediaEmbeds, inG
 }
 var FSP_FLAG_FLIPH, FSP_FLAG_FLIPV, FSP_FLAG_OLE_SHAPE, FSP_FLAG_CHILD, PLACEHOLDER_ID;
 var init_shape_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js"() {
     init_record_types();
     init_anchor_writer();
     init_byte_writer();
@@ -92354,7 +92443,7 @@ var init_shape_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js
 function buildFspgr(childRect) {
   return record(OA.FSPGR, buildChildAnchorData(childRect), 0, false, 1);
 }
@@ -92395,7 +92484,7 @@ function buildGroupContainer(group, fonts, allocator, hyperlinks, oleEmbeds, med
 }
 var FSP_FLAG_GROUP, FSP_FLAG_PATRIARCH, FSP_FLAG_HAVE_ANCHOR, ZERO_RECT;
 var init_group_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js"() {
     init_record_types();
     init_anchor_writer();
     init_byte_writer();
@@ -92407,10 +92496,10 @@ var init_group_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js
 var ShapeIdAllocator2;
 var init_shape_id_allocator = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js"() {
     ShapeIdAllocator2 = class {
       current;
       constructor(drawingId, clusterSize) {
@@ -92436,7 +92525,7 @@ var init_shape_id_allocator = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js
 function buildDg(drawingId, shapeCount, lastShapeId) {
   const data = new ByteWriter().u32(shapeCount + 1).u32(lastShapeId).toBytes();
   return record(OA.Dg, data, drawingId, false, 0);
@@ -92467,7 +92556,7 @@ function buildDrawing(canvasRect, shapes, backgroundRgb, fonts, drawingId, hyper
 }
 var FSP_FLAG_BACKGROUND, BACKGROUND_RECT_SPT, SHAPE_ID_CLUSTER_SIZE2;
 var init_drawing_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_colors();
@@ -92480,7 +92569,7 @@ var init_drawing_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js
 function buildNotesAtom(slidePersistIdRef) {
   const data = new ByteWriter().i32(slidePersistIdRef).u16(0).u16(0).toBytes();
   return record(RT.NotesAtom, data, 0, false, 1);
@@ -92498,16 +92587,16 @@ function buildNotesContainer(paragraphs, notesRect, slidePersistIdRef, fonts, dr
   return record(RT.Notes, data, 0, true);
 }
 var init_notes_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_drawing_writer();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js
 function readRecord(view, offset) {
-  if (offset < 0 || offset + RECORD_HEADER_SIZE > view.byteLength) {
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset + RECORD_HEADER_SIZE > view.byteLength) {
     return void 0;
   }
   const verAndInstance = view.getUint16(offset, true);
@@ -92535,6 +92624,9 @@ function isContainer(rec) {
   return rec.recVer === 15;
 }
 function* iterateRecords(view, start, end) {
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) {
+    return;
+  }
   let offset = start;
   const limit = Math.min(end, view.byteLength);
   while (offset + RECORD_HEADER_SIZE <= limit) {
@@ -92561,16 +92653,19 @@ function findChild4(view, container2, recType, recInstance) {
   return void 0;
 }
 function findDescendant(view, container2, recType, recInstance) {
-  for (const child27 of iterateChildren(view, container2)) {
+  const stack = [iterateChildren(view, container2)];
+  while (stack.length > 0) {
+    const next = stack[stack.length - 1].next();
+    if (next.done) {
+      stack.pop();
+      continue;
+    }
+    const child27 = next.value;
     if (child27.recType === recType && (recInstance === void 0)) {
       return child27;
     }
-    if (isContainer(child27)) {
-      const found = findDescendant(view, child27, recType, recInstance);
-      if (found) {
-        return found;
-      }
-    }
+    if (isContainer(child27))
+      stack.push(iterateChildren(view, child27));
   }
   return void 0;
 }
@@ -92579,7 +92674,7 @@ function recordBytes(data, rec) {
 }
 var PptParseError, RECORD_HEADER_SIZE;
 var init_legacy_ppt_record_stream = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js"() {
     PptParseError = class extends Error {
       constructor(message) {
         super(message);
@@ -92590,14 +92685,14 @@ var init_legacy_ppt_record_stream = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js
 var init_record_stream = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js"() {
     init_legacy_ppt_record_stream();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js
 function toHex3(r, g, b) {
   return [r, g, b].map((v) => (v & 255).toString(16).padStart(2, "0").toUpperCase()).join("");
 }
@@ -92648,7 +92743,7 @@ function resolveEscherColor(colorRef, scheme) {
 }
 var SCHEME, DEFAULT_SCHEME;
 var init_color_scheme = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js"() {
     init_record_stream();
     init_record_types();
     SCHEME = {
@@ -92674,7 +92769,7 @@ var init_color_scheme = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js
 function buildColorSchemeAtom(recInstance = 1, colors) {
   const w = new ByteWriter();
   for (const rgb of colors?.length === 8 ? colors : DEFAULT_SCHEME) {
@@ -92683,7 +92778,7 @@ function buildColorSchemeAtom(recInstance = 1, colors) {
   return record(RT.ColorSchemeAtom, w.toBytes(), recInstance, false, 0);
 }
 var init_color_scheme_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js"() {
     init_color_scheme();
     init_record_types();
     init_byte_writer();
@@ -92691,7 +92786,7 @@ var init_color_scheme_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js
 function buildSlideAtomRaw(geom, masterIdRef, notesIdRef, flags) {
   const data = new ByteWriter().i32(geom).bytes(new Uint8Array(8)).u32(masterIdRef).i32(notesIdRef).u16(flags).u16(0).toBytes();
   return record(RT.SlideAtom, data, 0, false, 2);
@@ -92728,7 +92823,7 @@ function buildMainMasterContainer(slideRect, drawingId, hyperlinks, oleEmbeds, m
 }
 var SLIDE_FLAG_MASTER_OBJECTS, SLIDE_FLAG_MASTER_SCHEME, SLIDE_FLAG_MASTER_BACKGROUND, SLIDE_MASTER_ID_SENTINEL, MASTER_FIRST_COLOR_SCHEME_INSTANCE;
 var init_slide_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_color_scheme_writer();
@@ -92743,7 +92838,7 @@ var init_slide_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js
 function masterSlideId(index) {
   return MASTER_SLIDE_ID_SENTINEL + index;
 }
@@ -92867,7 +92962,7 @@ function ensureMinimumDocumentStreamSize(contentSizeWithoutPadding, maxPersistId
 }
 var DOC_ID, MASTER_ID;
 var init_document_stream_layout = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js"() {
     init_bstore_writer();
     init_byte_writer();
     init_document_writer();
@@ -92885,15 +92980,15 @@ var init_document_stream_layout = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js
 var RC4_ALG_ID2;
 var init_crypto_constants = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js"() {
     RC4_ALG_ID2 = 26625;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js
 function rc4Cipher(key2, data) {
   if (key2.length === 0) {
     throw new Error("RC4 key must not be empty.");
@@ -92924,11 +93019,11 @@ function rc4Cipher(key2, data) {
   return out;
 }
 var init_rc4_cipher = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js"() {
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js
 async function rc4CryptoApiKeyBase(password, salt) {
   return hash("SHA-1", concatArrays(salt, encodePasswordUtf16LE(password)));
 }
@@ -92969,14 +93064,14 @@ async function rc4CryptoApiEncryptVerifier(key0, verifier) {
 }
 var PADDED_40_BIT_KEY_BYTES;
 var init_rc4_cryptoapi_key = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js"() {
     init_ooxml_crypto_primitives();
     init_rc4_cipher();
     PADDED_40_BIT_KEY_BYTES = 16;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js
 function readHeader(bytes) {
   const view = new DataView(bytes.buffer, bytes.byteOffset, RECORD_HEADER_SIZE);
   return {
@@ -93045,7 +93140,7 @@ async function cipherPicturesStream(stream, keyFor2, mode) {
 }
 var UID_SIZE, METAFILE_HEADER_SIZE, BITMAP_TAG_SIZE, METAFILE_BLIPS, BITMAP_BLIPS;
 var init_rc4_cryptoapi_streams = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js"() {
     init_rc4_cipher();
     init_record_stream();
     UID_SIZE = 16;
@@ -93056,7 +93151,7 @@ var init_rc4_cryptoapi_streams = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js
 async function buildCryptSession(password) {
   const salt = new Uint8Array(SALT_SIZE);
   crypto.getRandomValues(salt);
@@ -93084,7 +93179,7 @@ async function encryptPicturesStream(stream, ctx) {
 }
 var CSP_NAME, KEY_SIZE_BITS, SALT_SIZE, VERIFIER_SIZE, VERIFIER_HASH_SIZE, ENCRYPTION_FLAGS;
 var init_encrypt_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js"() {
     init_crypto_constants();
     init_rc4_cryptoapi_key();
     init_rc4_cryptoapi_streams();
@@ -93099,7 +93194,7 @@ var init_encrypt_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js
 function levelsFor(styles, textType) {
   switch (textType) {
     case 0:
@@ -93165,12 +93260,12 @@ function withMasterRelativeRunStyles(deck) {
 }
 var STYLE_KEYS;
 var init_master_relative_runs = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js"() {
     STYLE_KEYS = ["bold", "italic", "underline"];
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js
 function buildPersistDirectoryAtom(entries) {
   const sorted = [...entries].sort((a, b) => a[0] - b[0]);
   const w = new ByteWriter();
@@ -93200,17 +93295,17 @@ function buildEncryptedUserEditAtom(input) {
 }
 var MAX_RUN;
 var init_persist_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js"() {
     init_record_types();
     init_byte_writer();
     MAX_RUN = 4095;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js
 var PPT_STORAGE_CLSID;
 var init_ppt_clsid = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js"() {
     PPT_STORAGE_CLSID = new Uint8Array([
       16,
       141,
@@ -93232,7 +93327,7 @@ var init_ppt_clsid = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js
 async function finishUnencrypted(layout, lastSlideId) {
   const w = new ByteWriter().append(layout.bytes);
   const dirAtom = buildPersistDirectoryAtom(layout.offsets);
@@ -93286,7 +93381,7 @@ async function buildPptFile(deck, options = {}) {
   return new Uint8Array(buildOle2(streams2, PPT_STORAGE_CLSID, 0));
 }
 var init_write_ppt = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js"() {
     init_ole2_parser_write();
     init_byte_writer();
     init_current_user_writer();
@@ -93298,9 +93393,9 @@ var init_write_ppt = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js
 var init_legacy_ppt_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js"() {
     init_write_ppt();
     init_master_style_fonts();
   }
@@ -131667,61 +131762,115 @@ var init_deflate_utils = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js
-function parseUserEditAtom(view, offset) {
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js
+function checkedLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new PptParseError("Invalid persist directory resource limit");
+  return value;
+}
+function boundedAtom(view, offset, type) {
   const rec = readRecordOrThrow(view, offset);
-  if (rec.recType !== RT.UserEditAtom) {
-    throw new PptParseError(`Expected UserEditAtom at offset ${offset}, found recType 0x${rec.recType.toString(16)}`);
+  if (rec.recType !== type || rec.recVer !== 0 || rec.recInstance !== 0) {
+    throw new PptParseError(`Invalid persist atom header at offset ${offset}`);
   }
+  if (rec.recLen > view.byteLength - rec.dataOffset) {
+    throw new PptParseError(`Persist atom payload out of bounds at offset ${offset}`);
+  }
+  return rec;
+}
+function parseUserEditAtom(view, offset) {
+  const rec = boundedAtom(view, offset, RT.UserEditAtom);
   if (rec.recLen !== 28 && rec.recLen !== 32) {
     throw new PptParseError(`UserEditAtom has invalid length ${rec.recLen}`);
   }
   const d = rec.dataOffset;
-  return {
+  const edit = {
     offsetLastEdit: view.getUint32(d + 8, true),
     offsetPersistDirectory: view.getUint32(d + 12, true),
     docPersistIdRef: view.getUint32(d + 16, true),
     encryptSessionPersistIdRef: rec.recLen === 32 ? view.getUint32(d + 28, true) : void 0
   };
-}
-function parsePersistDirectoryAtom(view, offset) {
-  const rec = readRecordOrThrow(view, offset);
-  if (rec.recType !== RT.PersistDirectoryAtom) {
-    throw new PptParseError(`Expected PersistDirectoryAtom at offset ${offset}, found recType 0x${rec.recType.toString(16)}`);
+  if (view.getUint8(d + 6) !== 0 || view.getUint8(d + 7) !== 3) {
+    throw new PptParseError("Unsupported UserEditAtom storage version");
+  }
+  if (edit.offsetLastEdit >= offset || edit.offsetPersistDirectory <= edit.offsetLastEdit || edit.offsetPersistDirectory >= offset) {
+    throw new PptParseError("Invalid UserEditAtom save history offsets");
   }
+  if (edit.docPersistIdRef !== 1)
+    throw new PptParseError("Invalid document persist identifier");
+  return edit;
+}
+function parsePersistDirectoryAtom(view, offset, maxEntries = DEFAULT_MAX_ENTRIES) {
+  checkedLimit(maxEntries);
+  const rec = boundedAtom(view, offset, RT.PersistDirectoryAtom);
   const pairs = [];
   let pos2 = rec.dataOffset;
   const end = rec.dataOffset + rec.recLen;
-  while (pos2 + 4 <= end) {
+  const seen = /* @__PURE__ */ new Set();
+  while (pos2 < end) {
+    if (end - pos2 < 4)
+      throw new PptParseError("Truncated persist directory entry");
     const packed = view.getUint32(pos2, true);
     const persistId = packed & 1048575;
     const cPersist = packed >>> 20 & 4095;
     pos2 += 4;
-    for (let i = 0; i < cPersist && pos2 + 4 <= end; i++, pos2 += 4) {
-      pairs.push([persistId + i, view.getUint32(pos2, true)]);
+    if (persistId > 1048574 || cPersist === 0 || persistId + cPersist - 1 > 1048575) {
+      throw new PptParseError("Invalid persist identifier run");
+    }
+    if (cPersist * 4 > end - pos2)
+      throw new PptParseError("Truncated persist offset run");
+    if (pairs.length + cPersist > maxEntries)
+      throw new PptParseError("Persist directory entry limit exceeded");
+    for (let i = 0; i < cPersist; i++, pos2 += 4) {
+      const id = persistId + i;
+      if (seen.has(id))
+        throw new PptParseError("Duplicate persist identifier");
+      seen.add(id);
+      const objectOffset = view.getUint32(pos2, true);
+      if (objectOffset >= offset || objectOffset + 8 > view.byteLength)
+        throw new PptParseError("Persist object offset out of bounds");
+      pairs.push([id, objectOffset]);
     }
   }
   return pairs;
 }
-function buildPersistDirectory(view, offsetToCurrentEdit) {
+function buildPersistDirectory(view, offsetToCurrentEdit, limits = {}) {
+  const maxEdits = checkedLimit(limits.maxEdits ?? DEFAULT_MAX_EDITS);
+  const maxEntries = checkedLimit(limits.maxEntries ?? DEFAULT_MAX_ENTRIES);
   const edits = [];
+  const editOffsets = [];
   const seen = /* @__PURE__ */ new Set();
   let offset = offsetToCurrentEdit;
   while (offset !== 0) {
+    if (edits.length >= maxEdits)
+      throw new PptParseError("User edit chain limit exceeded");
     if (seen.has(offset)) {
       throw new PptParseError(`Circular UserEditAtom chain at offset ${offset}`);
     }
     seen.add(offset);
     const edit = parseUserEditAtom(view, offset);
     edits.push(edit);
+    editOffsets.push(offset);
     offset = edit.offsetLastEdit;
   }
   if (edits.length === 0) {
     throw new PptParseError("No UserEditAtom found");
   }
   const directory = /* @__PURE__ */ new Map();
+  let entryCount = 0;
   for (let i = edits.length - 1; i >= 0; i--) {
-    for (const [id, off] of parsePersistDirectoryAtom(view, edits[i].offsetPersistDirectory)) {
+    const edit = edits[i];
+    const dirAtom = boundedAtom(view, edit.offsetPersistDirectory, RT.PersistDirectoryAtom);
+    const editOffset = editOffsets[i];
+    if (dirAtom.dataOffset + dirAtom.recLen > editOffset)
+      throw new PptParseError("Persist directory overlaps user edit");
+    const entries = parsePersistDirectoryAtom(view, edit.offsetPersistDirectory, maxEntries);
+    entryCount += entries.length;
+    if (entryCount > maxEntries)
+      throw new PptParseError("Save history persist entry limit exceeded");
+    for (const [id, off] of entries) {
+      if (off < edit.offsetLastEdit)
+        throw new PptParseError("Persist object precedes corresponding user edit");
       directory.set(id, off);
     }
   }
@@ -131732,12 +131881,18 @@ function readPersistRecord(view, directory, persistId) {
   if (offset === void 0) {
     return void 0;
   }
-  return readRecordOrThrow(view, offset);
+  const rec = readRecordOrThrow(view, offset);
+  if (rec.recLen > view.byteLength - rec.dataOffset)
+    throw new PptParseError("Persist object payload out of bounds");
+  return rec;
 }
+var DEFAULT_MAX_EDITS, DEFAULT_MAX_ENTRIES;
 var init_persist_directory = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js"() {
     init_record_stream();
     init_record_types();
+    DEFAULT_MAX_EDITS = 1e4;
+    DEFAULT_MAX_ENTRIES = 1e6;
   }
 });