ooxml-core 0.12.0 → 0.13.0

package/dist/pptx/index.cjs

@@ -20940,10 +20940,10 @@ var init_ole_utils = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
 var OLE_MAGIC, ENDOFCHAIN, FREESECT, FATSECT, DIFSECT, MAXREGSECT, ENTRY_TYPE_EMPTY, ENTRY_TYPE_STREAM, ENTRY_TYPE_ROOT, DIR_ENTRY_SIZE; exports.Ole2ParseError = void 0;
 var init_ole2_parser_types = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js"() {
     OLE_MAGIC = new Uint8Array([208, 207, 17, 224, 161, 177, 26, 225]);
     ENDOFCHAIN = 4294967294;
     FREESECT = 4294967295;
@@ -20963,10 +20963,13 @@ var init_ole2_parser_types = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js
 function parseOle2(buffer) {
   const data = new Uint8Array(buffer);
   const view = new DataView(buffer);
+  if (data.length < 512) {
+    throw new exports.Ole2ParseError("Truncated OLE2 compound file header");
+  }
   for (let i2 = 0; i2 < OLE_MAGIC.length; i2++) {
     if (data[i2] !== OLE_MAGIC[i2]) {
       throw new exports.Ole2ParseError("Not a valid OLE2 compound file");
@@ -20980,8 +20983,15 @@ function parseOle2(buffer) {
   }
   const sectorSizePower = view.getUint16(30, true);
   const miniSectorSizePower = view.getUint16(32, true);
+  if (majorVersion !== 3 && majorVersion !== 4 || sectorSizePower !== (majorVersion === 3 ? 9 : 12) || miniSectorSizePower !== 6) {
+    throw new exports.Ole2ParseError("Unsupported OLE2 version or sector size");
+  }
   const sectorSize = 1 << sectorSizePower;
   const miniSectorSize = 1 << miniSectorSizePower;
+  if (data.length < sectorSize || data.length % sectorSize !== 0) {
+    throw new exports.Ole2ParseError("Truncated OLE2 sector");
+  }
+  const sectorCount = data.length / sectorSize - 1;
   const totalFATSectors = view.getUint32(44, true);
   const firstDirectorySector = view.getUint32(48, true);
   const miniStreamCutoff = view.getUint32(56, true);
@@ -20989,6 +20999,9 @@ function parseOle2(buffer) {
   const totalMiniFATSectors = view.getUint32(64, true);
   const firstDIFATSector = view.getUint32(68, true);
   const totalDIFATSectors = view.getUint32(72, true);
+  if (totalFATSectors > sectorCount || totalMiniFATSectors > sectorCount || totalDIFATSectors > sectorCount) {
+    throw new exports.Ole2ParseError("Allocation table count exceeds file size");
+  }
   function sectorOffset(sector) {
     return (sector + 1) * sectorSize;
   }
@@ -21007,7 +21020,11 @@ function parseOle2(buffer) {
     }
   }
   let difatSector = firstDIFATSector;
+  const difatSeen = /* @__PURE__ */ new Set();
   for (let d = 0; d < totalDIFATSectors && difatSector <= MAXREGSECT; d++) {
+    if (difatSeen.has(difatSector))
+      throw new exports.Ole2ParseError("Circular DIFAT chain");
+    difatSeen.add(difatSector);
     const difatData = readSector(difatSector);
     const difatView = new DataView(difatData.buffer, difatData.byteOffset, difatData.byteLength);
     const entriesPerSector = (sectorSize - 4) / 4;
@@ -21019,11 +21036,14 @@ function parseOle2(buffer) {
     }
     difatSector = difatView.getUint32(sectorSize - 4, true);
   }
+  if (difatSeen.size !== totalDIFATSectors || fatSectors.length !== totalFATSectors || new Set(fatSectors).size !== fatSectors.length || fatSectors.some((id) => difatSeen.has(id))) {
+    throw new exports.Ole2ParseError("Invalid DIFAT allocation table");
+  }
   const fatEntries = [];
   for (const fatSector of fatSectors) {
     const fatData = readSector(fatSector);
     const fatView = new DataView(fatData.buffer, fatData.byteOffset, fatData.byteLength);
-    for (let i2 = 0; i2 < sectorSize / 4; i2++) {
+    for (let i2 = 0; i2 < sectorSize / 4 && fatEntries.length < sectorCount; i2++) {
       fatEntries.push(fatView.getUint32(i2 * 4, true));
     }
   }
@@ -21037,8 +21057,12 @@ function parseOle2(buffer) {
       }
       visited.add(current);
       sectors.push(readSector(current));
-      current = fatEntries[current] ?? ENDOFCHAIN;
+      if (fatEntries[current] === void 0)
+        throw new exports.Ole2ParseError("Missing FAT chain entry");
+      current = fatEntries[current];
     }
+    if (current !== ENDOFCHAIN)
+      throw new exports.Ole2ParseError("Invalid FAT chain terminator");
     const totalLength = sectors.length * sectorSize;
     const result = new Uint8Array(totalLength);
     let offset = 0;
@@ -21049,16 +21073,14 @@ function parseOle2(buffer) {
     return result;
   }
   function readStream(startSector, size) {
+    if (size === 0)
+      return new Uint8Array(0);
+    if (size > sectorCount * sectorSize)
+      throw new exports.Ole2ParseError("Stream size exceeds file size");
     const raw = readSectorChain(startSector);
-    return raw.subarray(0, Math.min(size, raw.length));
-  }
-  const miniFatEntries = [];
-  if (firstMiniFATSector <= MAXREGSECT && totalMiniFATSectors > 0) {
-    const miniFatRaw = readSectorChain(firstMiniFATSector);
-    const miniFatView = new DataView(miniFatRaw.buffer, miniFatRaw.byteOffset, miniFatRaw.byteLength);
-    for (let i2 = 0; i2 < miniFatRaw.length / 4; i2++) {
-      miniFatEntries.push(miniFatView.getUint32(i2 * 4, true));
-    }
+    if (raw.length < size)
+      throw new exports.Ole2ParseError("Truncated stream sector chain");
+    return raw.subarray(0, size);
   }
   const dirRaw = readSectorChain(firstDirectorySector);
   const numEntries = Math.floor(dirRaw.length / DIR_ENTRY_SIZE);
@@ -21071,6 +21093,9 @@ function parseOle2(buffer) {
     if (objectType === ENTRY_TYPE_EMPTY) {
       continue;
     }
+    if (nameLen < 2 || nameLen > 64 || nameLen % 2 !== 0 || entryView.getUint16(nameLen - 2, true) !== 0) {
+      throw new exports.Ole2ParseError("Invalid directory entry name");
+    }
     const nameBytes = Math.max(0, nameLen - 2);
     let name = "";
     for (let j = 0; j < nameBytes; j += 2) {
@@ -21084,8 +21109,11 @@ function parseOle2(buffer) {
     const sizeLow = entryView.getUint32(120, true);
     let size = sizeLow;
     if (majorVersion === 4) {
-      entryView.getUint32(124, true);
-      size = sizeLow;
+      const sizeHigh = entryView.getUint32(124, true);
+      size = sizeLow + sizeHigh * 4294967296;
+      if (!Number.isSafeInteger(size) || size > sectorCount * sectorSize) {
+        throw new exports.Ole2ParseError("Stream size exceeds supported file bounds");
+      }
     }
     entries.push({
       name,
@@ -21099,11 +21127,28 @@ function parseOle2(buffer) {
     });
   }
   const rootEntry = entries.find((e) => e.type === ENTRY_TYPE_ROOT);
+  if (!rootEntry || entries.filter((e) => e.type === ENTRY_TYPE_ROOT).length !== 1) {
+    throw new exports.Ole2ParseError("Invalid root directory entry");
+  }
   let miniStreamData;
   if (rootEntry && rootEntry.startSector <= MAXREGSECT) {
-    miniStreamData = readSectorChain(rootEntry.startSector);
+    miniStreamData = readStream(rootEntry.startSector, rootEntry.size);
+  }
+  const miniFatEntries = [];
+  if (firstMiniFATSector <= MAXREGSECT && totalMiniFATSectors > 0) {
+    const miniFatRaw = readSectorChain(firstMiniFATSector);
+    if (miniFatRaw.length !== totalMiniFATSectors * sectorSize) {
+      throw new exports.Ole2ParseError("Unexpected mini FAT chain length");
+    }
+    const miniFatView = new DataView(miniFatRaw.buffer, miniFatRaw.byteOffset, miniFatRaw.byteLength);
+    const miniCapacity = Math.floor((miniStreamData?.length ?? 0) / miniSectorSize);
+    for (let i2 = 0; i2 < miniFatRaw.length / 4 && i2 < miniCapacity; i2++) {
+      miniFatEntries.push(miniFatView.getUint32(i2 * 4, true));
+    }
   }
   function readMiniStream(startSector, size) {
+    if (size === 0)
+      return new Uint8Array(0);
     if (!miniStreamData) {
       throw new exports.Ole2ParseError("Mini stream container not found");
     }
@@ -21116,17 +21161,24 @@ function parseOle2(buffer) {
       }
       visited.add(current);
       const offset2 = current * miniSectorSize;
+      if (offset2 + miniSectorSize > miniStreamData.length || miniFatEntries[current] === void 0) {
+        throw new exports.Ole2ParseError("Mini stream sector exceeds allocation bounds");
+      }
       sectors.push(miniStreamData.subarray(offset2, offset2 + miniSectorSize));
-      current = miniFatEntries[current] ?? ENDOFCHAIN;
+      current = miniFatEntries[current];
     }
+    if (current !== ENDOFCHAIN)
+      throw new exports.Ole2ParseError("Invalid mini FAT chain terminator");
     const totalLength = sectors.length * miniSectorSize;
+    if (totalLength < size)
+      throw new exports.Ole2ParseError("Truncated mini stream sector chain");
     const result = new Uint8Array(totalLength);
     let offset = 0;
     for (const sector of sectors) {
       result.set(sector, offset);
       offset += miniSectorSize;
     }
-    return result.subarray(0, Math.min(size, result.length));
+    return result.subarray(0, size);
   }
   function getStream(name) {
     const entry = entries.find((e) => (e.type === ENTRY_TYPE_STREAM || e.type === ENTRY_TYPE_ROOT) && e.name === name);
@@ -21141,7 +21193,7 @@ function parseOle2(buffer) {
   return { entries, getStream };
 }
 var init_ole2_parser_read = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js"() {
     init_ole2_parser_types();
   }
 });
@@ -21281,13 +21333,16 @@ var init_ole_embedded_extract = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js
 function compareDirEntryNames(a, b) {
+  const ua = a.toUpperCase();
+  const ub = b.toUpperCase();
+  if (ua.length !== a.length || ub.length !== b.length) {
+    throw new Error("CFB stream names with expanding uppercase mappings are unsupported");
+  }
   if (a.length !== b.length) {
     return a.length - b.length;
   }
-  const ua = a.toUpperCase();
-  const ub = b.toUpperCase();
   for (let i2 = 0; i2 < ua.length; i2++) {
     const diff = ua.charCodeAt(i2) - ub.charCodeAt(i2);
     if (diff !== 0) {
@@ -21304,6 +21359,24 @@ function encodeName(name) {
   }
   return bytes;
 }
+function buildDirectoryTree(entryCount) {
+  const links = /* @__PURE__ */ new Map();
+  let redLevel = 0;
+  for (let remaining = entryCount - 2; remaining >= 0; remaining = Math.floor(remaining / 2) - 1)
+    redLevel++;
+  const build = (low, high, level2) => {
+    if (low > high)
+      return 4294967295;
+    const id = Math.floor((low + high) / 2);
+    links.set(id, {
+      left: build(low, id - 1, level2 + 1),
+      right: build(id + 1, high, level2 + 1),
+      color: level2 === redLevel ? 0 : 1
+    });
+    return id;
+  };
+  return { root: build(1, entryCount - 1, 0), links };
+}
 function writeFatChain(fat, chain2) {
   for (let i2 = 0; i2 < chain2.sectors.length; i2++) {
     fat[chain2.sectors[i2]] = i2 < chain2.sectors.length - 1 ? chain2.sectors[i2 + 1] : ENDOFCHAIN;
@@ -21327,12 +21400,12 @@ function writeInt32Sectors(outBytes, int32Data, firstSector, numSectors, sectorS
   }
 }
 var init_ole2_parser_write_helpers = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js"() {
     init_ole2_parser_types();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js
 function writeHeader(outView, outBytes, params) {
   outBytes.set(OLE_MAGIC, 0);
   outView.setUint16(24, 62, true);
@@ -21389,6 +21462,7 @@ function writeDifatSectors(outView, params) {
 function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
   const dirData = new Uint8Array(numDirSectors * sectorSize);
   const dirView = new DataView(dirData.buffer);
+  const tree = buildDirectoryTree(dirEntries.length);
   for (let i2 = 0; i2 < dirEntries.length; i2++) {
     const entry = dirEntries[i2];
     const entryOffset = i2 * DIR_ENTRY_SIZE;
@@ -21396,17 +21470,17 @@ function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
     dirData.set(nameBytes.subarray(0, Math.min(nameBytes.length, 64)), entryOffset);
     dirView.setUint16(entryOffset + 64, Math.min((entry.name.length + 1) * 2, 64), true);
     dirData[entryOffset + 66] = entry.type;
-    dirData[entryOffset + 67] = 1;
+    dirData[entryOffset + 67] = i2 === 0 ? 1 : tree.links.get(i2).color;
     if (entry.clsid) {
       dirData.set(entry.clsid.subarray(0, 16), entryOffset + 80);
     }
     if (i2 === 0) {
       dirView.setUint32(entryOffset + 68, 4294967295, true);
       dirView.setUint32(entryOffset + 72, 4294967295, true);
-      dirView.setUint32(entryOffset + 76, dirEntries.length > 1 ? 1 : 4294967295, true);
+      dirView.setUint32(entryOffset + 76, tree.root, true);
     } else {
-      dirView.setUint32(entryOffset + 68, 4294967295, true);
-      dirView.setUint32(entryOffset + 72, i2 + 1 < dirEntries.length ? i2 + 1 : 4294967295, true);
+      dirView.setUint32(entryOffset + 68, tree.links.get(i2).left, true);
+      dirView.setUint32(entryOffset + 72, tree.links.get(i2).right, true);
       dirView.setUint32(entryOffset + 76, 4294967295, true);
     }
     dirView.setUint32(entryOffset + 116, entry.startSector, true);
@@ -21424,17 +21498,32 @@ function writeStreamSectors(outBytes, streamData, chain2, sectorSize) {
 }
 var HEADER_DIFAT_ENTRIES;
 var init_ole2_parser_write_serialize = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js"() {
     init_ole2_parser_types();
     init_ole2_parser_write_helpers();
     HEADER_DIFAT_ENTRIES = 109;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js
 function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   const sectorSize = 512;
   const miniSectorSize = 64;
+  if (rootClsid && rootClsid.length !== 16)
+    throw new Error("Root CLSID must contain 16 bytes");
+  const names = [...streams2.keys()].sort(compareDirEntryNames);
+  for (let i2 = 0; i2 < names.length; i2++) {
+    const name = names[i2];
+    if (name.toUpperCase().length !== name.length) {
+      throw new Error("CFB stream names with expanding uppercase mappings are unsupported");
+    }
+    if (!name.length || name.length > 31 || /[\x00\\/:!]/.test(name)) {
+      throw new Error("CFB stream names must be 1-31 UTF-16 code units without NUL, \\, /, :, or !");
+    }
+    if (i2 > 0 && compareDirEntryNames(names[i2 - 1], name) === 0) {
+      throw new Error("Duplicate CFB stream names");
+    }
+  }
   const regularStreams = [];
   const miniStreams = [];
   for (const [name, data] of streams2) {
@@ -21452,7 +21541,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
     for (let i2 = 0; i2 < numSectors; i2++) {
       sectors.push(nextSector++);
     }
-    fatChains.set(stream.name, { start: sectors[0] ?? 0, sectors });
+    fatChains.set(stream.name, { start: sectors[0] ?? ENDOFCHAIN, sectors });
   }
   let miniStreamContainer = new Uint8Array(0);
   const miniFatChains = /* @__PURE__ */ new Map();
@@ -21475,7 +21564,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
         miniOffset += miniSectorSize;
       }
       miniFatChains.set(stream.name, {
-        start: miniSectors[0] ?? 0,
+        start: miniSectors[0] ?? ENDOFCHAIN,
         sectors: miniSectors
       });
     }
@@ -21523,7 +21612,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   nextSector += numDirSectors;
   let firstMiniFATSector = ENDOFCHAIN;
   let numMiniFATSectors = 0;
-  if (miniStreams.length > 0) {
+  if (nextMiniSector > 0) {
     numMiniFATSectors = Math.ceil(nextMiniSector * 4 / sectorSize);
     firstMiniFATSector = nextSector;
     nextSector += numMiniFATSectors;
@@ -21597,7 +21686,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   return output;
 }
 var init_ole2_parser_write = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js"() {
     init_ole2_parser_types();
     init_ole2_parser_write_helpers();
     init_ole2_parser_write_serialize();
@@ -22313,7 +22402,7 @@ var init_ole_sheet_xlsx_editor = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-stream-edit.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-edit.js
 function chain(table, start, limit) {
   if (start === END && limit === 0)
     return [];
@@ -22392,7 +22481,7 @@ function processCompoundFileStream(input, path, replacement) {
     const fat = [];
     for (const id of fatIds) {
       const bytes = sector(id), dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-      for (let j = 0; j < sectorSize / 4; j++)
+      for (let j = 0; j < sectorSize / 4 && fat.length < sectorCount; j++)
         fat.push(dv.getUint32(j * 4, true));
     }
     const exactChain = (table, start, bytes, unit) => chain(table, start, Math.ceil(bytes / unit));
@@ -22489,9 +22578,10 @@ function processCompoundFileStream(input, path, replacement) {
     if (new Set(metadataSectors).size !== metadataSectors.length)
       return reject();
     const miniFat = [];
+    const miniCapacity = Math.floor(Math.min(root.size, sectorCount * sectorSize) / miniSize);
     for (const id of miniFatSectors) {
       const bytes = sector(id), dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-      for (let j = 0; j < sectorSize / 4; j++)
+      for (let j = 0; j < sectorSize / 4 && miniFat.length < miniCapacity; j++)
         miniFat.push(dv.getUint32(j * 4, true));
     }
     const reserved = /* @__PURE__ */ new Set([...fatIds, ...difatIds, ...dirSectors, ...miniFatSectors]);
@@ -22515,7 +22605,7 @@ function processCompoundFileStream(input, path, replacement) {
         continue;
       const ids = exactChain(miniFat, entry.start, entry.size, miniSize);
       for (const id of ids) {
-        if (id * miniSize >= rootMini.size || miniUsed.has(id))
+        if ((id + 1) * miniSize > rootMini.size || miniUsed.has(id))
           return reject();
         miniUsed.add(id);
       }
@@ -22540,6 +22630,8 @@ function processCompoundFileStream(input, path, replacement) {
       });
       return result.slice(0, target.size);
     }
+    if (replacement.length === 0)
+      return input.slice();
     const output = input.slice();
     if (target.size >= miniCutoff) {
       const sectors = exactChain(fat, target.start, target.size, sectorSize);
@@ -22580,7 +22672,7 @@ function replaceCompoundFileStream(input, path, replacement) {
 }
 var END, MAX, NIL, SIZE;
 var init_ole2_stream_edit = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-stream-edit.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-edit.js"() {
     END = 4294967294;
     MAX = 4294967290;
     NIL = 4294967295;
@@ -22588,7 +22680,7 @@ var init_ole2_stream_edit = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-cfb.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-cfb.js
 function unwrapXlsBytes(bytes) {
   if (!isCfb(bytes)) {
     return { workbookBytes: bytes };
@@ -22655,7 +22747,7 @@ function isCfb(bytes) {
 }
 var WORKBOOK_STREAM_NAMES;
 var init_legacy_excel_cfb = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-cfb.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-cfb.js"() {
     init_ole2_parser_read();
     init_ole2_parser_types();
     init_ole2_parser_write();
@@ -22664,7 +22756,178 @@ var init_legacy_excel_cfb = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-edit.js
+function encodeRkExact(value) {
+  if (!Number.isFinite(value))
+    return void 0;
+  for (const scale of [1, 100]) {
+    const scaled = value * scale;
+    if (Number.isInteger(scaled) && scaled >= -536870912 && scaled < 536870912) {
+      const rk2 = (scaled << 2 | 2 | (scale === 100 ? 1 : 0)) >>> 0;
+      if (Object.is(decodeRk(rk2), value))
+        return rk2;
+    }
+    const view = new DataView(new ArrayBuffer(8));
+    view.setFloat64(0, scaled, true);
+    const rk = (view.getUint32(4, true) & 4294967292 | (scale === 100 ? 1 : 0)) >>> 0;
+    if (Object.is(decodeRk(rk), value))
+      return rk;
+  }
+  return void 0;
+}
+function worksheetRanges(bytes) {
+  const records = readRecords(bytes, 0, bytes.length);
+  const last = records.at(-1);
+  if (!last || bytes.subarray(last.dataOffset + last.length).some((b) => b !== 0))
+    return void 0;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const ranges = [];
+  let depth = 0;
+  let start;
+  for (const record2 of records) {
+    if (record2.opcode === 2057) {
+      if (record2.length < 4 || view.getUint16(record2.dataOffset, true) !== 1536 || depth >= 64)
+        return void 0;
+      if (depth === 0 && view.getUint16(record2.dataOffset + 2, true) === 16)
+        start = record2.headerOffset;
+      depth++;
+    } else if (record2.opcode === 10) {
+      if (depth === 0 || record2.length !== 0)
+        return void 0;
+      depth--;
+      if (depth === 0 && start !== void 0) {
+        ranges.push({ start, end: record2.dataOffset });
+        start = void 0;
+      }
+    }
+  }
+  if (depth !== 0)
+    return void 0;
+  const globalsEnd = records.find((r) => r.opcode === 10)?.headerOffset ?? 0;
+  const bounds = records.filter((r) => r.opcode === 133 && r.headerOffset < globalsEnd);
+  if (bounds.length === 0)
+    return ranges;
+  const ordered4 = [];
+  const used = /* @__PURE__ */ new Set();
+  for (const bound of bounds) {
+    if (bound.length < 8)
+      return void 0;
+    const p = bound.dataOffset;
+    const nameLength = view.getUint8(p + 6);
+    const width = view.getUint8(p + 7) & 1 ? 2 : 1;
+    if (nameLength < 1 || nameLength > 31 || bound.length !== 8 + nameLength * width)
+      return void 0;
+    const kind = view.getUint8(p + 5);
+    if (![0, 1, 2, 6].includes(kind))
+      return void 0;
+    if (kind !== 0)
+      continue;
+    const offset = view.getUint32(p, true);
+    const range = ranges.find((r) => r.start === offset);
+    if (!range || used.has(offset))
+      return void 0;
+    used.add(offset);
+    ordered4.push(range);
+  }
+  return ordered4.length === ranges.length ? ordered4 : void 0;
+}
+function editXlsNumericCell(input, edit) {
+  const unchanged2 = (reason) => ({ status: "unchanged", bytes: input, reason });
+  const sheet = edit.worksheetIndex ?? 0;
+  if (!Number.isInteger(edit.row) || edit.row < 0 || edit.row > 65535 || !Number.isInteger(edit.col) || edit.col < 0 || edit.col > 255 || !Number.isInteger(sheet) || sheet < 0 || !Number.isFinite(edit.value))
+    return unchanged2("invalid-edit");
+  try {
+    const { workbookBytes: bytes, rewrap } = unwrapXlsBytes(input);
+    if (!isSupportedBiff8Workbook(bytes))
+      return unchanged2("unsupported-workbook");
+    const ranges = worksheetRanges(bytes);
+    if (!ranges)
+      return unchanged2("malformed-records");
+    const range = ranges[sheet];
+    if (!range)
+      return unchanged2("sheet-not-found");
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    let payload;
+    let packed = false;
+    let depth = 0;
+    let matches = 0;
+    for (const record2 of readRecords(bytes, range.start, range.end)) {
+      if (record2.opcode === 2057) {
+        depth++;
+        continue;
+      }
+      if (record2.opcode === 10) {
+        depth--;
+        continue;
+      }
+      if (depth !== 1)
+        continue;
+      const p = record2.dataOffset;
+      if (record2.opcode === 189) {
+        if (record2.length < 12 || (record2.length - 6) % 6 !== 0)
+          return unchanged2("malformed-records");
+        const first = view.getUint16(p + 2, true);
+        const lastCol = view.getUint16(p + record2.length - 2, true);
+        if (lastCol > 255 || lastCol < first || lastCol - first + 1 !== (record2.length - 6) / 6)
+          return unchanged2("malformed-records");
+        if (view.getUint16(p, true) === edit.row && edit.col >= first && edit.col <= lastCol) {
+          if (++matches > 1)
+            return unchanged2("ambiguous-cell");
+          payload = p + 6 + (edit.col - first) * 6;
+          packed = true;
+        }
+      } else if (record2.opcode === 515 || record2.opcode === 638) {
+        if (record2.length !== (record2.opcode === 515 ? 14 : 10))
+          return unchanged2("malformed-records");
+        if (view.getUint16(p, true) === edit.row && view.getUint16(p + 2, true) === edit.col) {
+          if (++matches > 1)
+            return unchanged2("ambiguous-cell");
+          payload = p + 6;
+          packed = record2.opcode === 638;
+        }
+      } else if ([6, 513, 516, 517, 253, 214].includes(record2.opcode)) {
+        if (record2.length < 6)
+          return unchanged2("malformed-records");
+        if (view.getUint16(p, true) === edit.row && view.getUint16(p + 2, true) === edit.col && ++matches > 1)
+          return unchanged2("ambiguous-cell");
+      } else if (record2.opcode === 190) {
+        if (record2.length < 8 || (record2.length - 6) % 2 !== 0)
+          return unchanged2("malformed-records");
+        const first = view.getUint16(p + 2, true);
+        const lastCol = view.getUint16(p + record2.length - 2, true);
+        if (lastCol > 255 || lastCol < first || lastCol - first + 1 !== (record2.length - 6) / 2)
+          return unchanged2("malformed-records");
+        if (view.getUint16(p, true) === edit.row && edit.col >= first && edit.col <= lastCol && ++matches > 1)
+          return unchanged2("ambiguous-cell");
+      }
+    }
+    if (payload === void 0)
+      return unchanged2("cell-not-supported");
+    const rk = packed ? encodeRkExact(edit.value) : void 0;
+    if (packed && rk === void 0)
+      return unchanged2("inexact-rk");
+    const out = bytes.slice();
+    const outView = new DataView(out.buffer, out.byteOffset, out.byteLength);
+    if (packed)
+      outView.setUint32(payload, rk, true);
+    else
+      outView.setFloat64(payload, edit.value, true);
+    const result = rewrap ? rewrap(out) : out;
+    if (result === input)
+      return unchanged2("container-not-writable");
+    return { status: "edited", bytes: result, recalculationRequired: true };
+  } catch {
+    return unchanged2("malformed-records");
+  }
+}
+var init_legacy_excel_biff8_edit = __esm({
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-edit.js"() {
+    init_legacy_excel_biff8();
+    init_legacy_excel_cfb();
+  }
+});
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8.js
 function readRecords(bytes, start, end) {
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   const records = [];
@@ -22718,7 +22981,7 @@ function findFirstWorksheetRange(bytes) {
 function parseSstSingleRecord(bytes) {
   const records = readRecords(bytes, 0, bytes.length);
   const sst = records.find((r) => r.opcode === OPCODE_SST);
-  if (!sst) {
+  if (!sst || sst.length < 8) {
     return [];
   }
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
@@ -22726,7 +22989,8 @@ function parseSstSingleRecord(bytes) {
   let offset = sst.dataOffset + 8;
   const end = sst.dataOffset + sst.length;
   try {
-    while (offset + 3 <= end) {
+    const unique = view.getUint32(sst.dataOffset + 4, true);
+    while (strings2.length < unique && offset + 3 <= end) {
       const charCount = view.getUint16(offset, true);
       const flags = view.getUint8(offset + 2);
       offset += 3;
@@ -22736,13 +23000,19 @@ function parseSstSingleRecord(bytes) {
       let richRuns = 0;
       let extLen = 0;
       if (isRich) {
+        if (offset + 2 > end)
+          break;
         richRuns = view.getUint16(offset, true);
         offset += 2;
       }
       if (hasExt) {
+        if (offset + 4 > end)
+          break;
         extLen = view.getUint32(offset, true);
         offset += 4;
       }
+      if (offset + charCount * (isWide ? 2 : 1) + richRuns * 4 + extLen > end)
+        break;
       let text2 = "";
       for (let i2 = 0; i2 < charCount; i2++) {
         if (isWide) {
@@ -22823,52 +23093,13 @@ function decodeRk(rk) {
   }
   return isDiv100 ? value / 100 : value;
 }
-function encodeRk(value) {
-  if (Number.isInteger(value) && Math.abs(value) < 536870912) {
-    return (value << 2 | 2) >>> 0;
-  }
-  const buffer = new ArrayBuffer(8);
-  const view = new DataView(buffer);
-  view.setFloat64(0, value, false);
-  const high32 = view.getUint32(0, false);
-  return high32 & 4294967292;
-}
 function writeOleXlsNumericCellEdit(inputBytes, edit) {
-  if (!Number.isFinite(edit.value)) {
-    return inputBytes;
-  }
-  const { workbookBytes: xlsBytes, rewrap } = unwrapXlsBytes(inputBytes);
-  if (!isSupportedBiff8Workbook(xlsBytes))
-    return inputBytes;
-  const range = findFirstWorksheetRange(xlsBytes);
-  if (!range) {
-    return inputBytes;
-  }
-  const out = new Uint8Array(xlsBytes);
-  const view = new DataView(out.buffer, out.byteOffset, out.byteLength);
-  for (const record2 of readRecords(out, range.start, range.end)) {
-    if (record2.length < 6) {
-      continue;
-    }
-    const row = view.getUint16(record2.dataOffset, true);
-    const col = view.getUint16(record2.dataOffset + 2, true);
-    if (row !== edit.row || col !== edit.col) {
-      continue;
-    }
-    if (record2.opcode === OPCODE_NUMBER && record2.length >= 14) {
-      view.setFloat64(record2.dataOffset + 6, edit.value, true);
-      return rewrap ? rewrap(out) : out;
-    }
-    if (record2.opcode === OPCODE_RK && record2.length >= 10) {
-      view.setInt32(record2.dataOffset + 6, encodeRk(edit.value), true);
-      return rewrap ? rewrap(out) : out;
-    }
-  }
-  return inputBytes;
+  return editXlsNumericCell(inputBytes, edit).bytes;
 }
 var OPCODE_BOF, OPCODE_EOF, OPCODE_FILEPASS, OPCODE_NUMBER, OPCODE_RK, OPCODE_LABELSST, OPCODE_LABEL, OPCODE_SST, OPCODE_EXTSST, OPCODE_ROW, OPCODE_DBCELL, OPCODE_DIMENSIONS, OPCODE_BLANK, OPCODE_BOUNDSHEET, WORKSHEET_DT, DEFAULT_MAX_ROWS2, DEFAULT_MAX_COLS2;
 var init_legacy_excel_biff8 = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8.js"() {
+    init_legacy_excel_biff8_edit();
     init_legacy_excel_cfb();
     OPCODE_BOF = 2057;
     OPCODE_EOF = 10;
@@ -22897,7 +23128,7 @@ var init_ole_sheet_xls_biff8 = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-grid.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-grid.js
 function biffRecord(opcode, data) {
   return [
     opcode & 255,
@@ -22970,7 +23201,7 @@ function buildXlsRowCellRegion(grid) {
     const colFirst = cols[0] ?? 0;
     const colLast = cols.length > 0 ? cols[cols.length - 1] + 1 : 0;
     rowRecordOffsets.push(bytesOut.length);
-    const extra = row.extraRowBytes ?? [255, 0, 0, 0, 0, 1, 15, 0];
+    const extra = row.extraRowBytes ?? [255, 0, 0, 0, 0, 1, 15, 0, 0, 0];
     bytesOut.push(...biffRecord(OPCODE_ROW, [...u16le(r), ...u16le(colFirst), ...u16le(colLast), ...extra]));
   }
   for (const r of rows) {
@@ -23005,8 +23236,12 @@ function buildXlsRowCellRegion(grid) {
   if (rows.length > 0) {
     const dbCellOffset = bytesOut.length;
     const dbData = [0, 0, 0, 0];
-    for (const off of firstCellOffsetPerRow) {
-      dbData.push(...u16le(dbCellOffset - off));
+    for (let i2 = 0; i2 < firstCellOffsetPerRow.length; i2++) {
+      const base = i2 === 0 ? rowRecordOffsets[0] + 20 : firstCellOffsetPerRow[i2 - 1];
+      const offset = firstCellOffsetPerRow[i2] - base;
+      if (offset < 0 || offset > 65535)
+        throw new Error("DBCELL offset exceeds UInt16");
+      dbData.push(...u16le(offset));
     }
     const backToFirstRow = dbCellOffset - rowRecordOffsets[0];
     dbData[0] = backToFirstRow & 255;
@@ -23018,28 +23253,39 @@ function buildXlsRowCellRegion(grid) {
   return Uint8Array.from(bytesOut);
 }
 var init_legacy_excel_biff8_grid = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-grid.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-grid.js"() {
     init_legacy_excel_biff8();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-writer.js
-function resolveSstIndex(sharedStrings, value) {
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-writer.js
+function resolveSstIndex(sharedStrings, value, bytes) {
   const existing = sharedStrings.indexOf(value);
-  if (existing !== -1) {
+  if (existing !== -1)
     return { index: existing };
-  }
-  const next = [...sharedStrings, value];
-  const data = [];
-  data.push(...u16le(next.length & 65535), 0, 0);
-  data.push(...u16le(next.length & 65535), 0, 0);
-  for (const s of next) {
-    data.push(...u16le(s.length), 0);
-    for (const ch of s) {
-      data.push(ch.charCodeAt(0) & 255);
-    }
-  }
-  return { index: next.length - 1, rebuilt: biffRecord(OPCODE_SST, data) };
+  const records = readRecords(bytes, 0, bytes.length);
+  const sst = records.find((r) => r.opcode === OPCODE_SST);
+  if (!sst || sst.length < 8 || value.length > 32767)
+    throw new Error("Unsupported SST");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const unique = view.getUint32(sst.dataOffset + 4, true);
+  if (unique !== sharedStrings.length || records[records.indexOf(sst) + 1]?.opcode === 60)
+    throw new Error("Continued or incomplete SST");
+  const data = Array.from(bytes.subarray(sst.dataOffset, sst.dataOffset + sst.length));
+  const wide = Array.from({ length: value.length }, (_, i2) => value.charCodeAt(i2)).some((c) => c > 255);
+  data.push(...u16le(value.length), wide ? 1 : 0);
+  for (let i2 = 0; i2 < value.length; i2++) {
+    const c = value.charCodeAt(i2);
+    data.push(c & 255);
+    if (wide)
+      data.push(c >> 8);
+  }
+  if (data.length > 8224)
+    throw new Error("SST continuation required");
+  const counts = new DataView(new Uint8Array(data).buffer);
+  counts.setUint32(0, view.getUint32(sst.dataOffset, true) + 1, true);
+  counts.setUint32(4, unique + 1, true);
+  return { index: unique, rebuilt: biffRecord(OPCODE_SST, Array.from(new Uint8Array(counts.buffer))) };
 }
 function tryInPlaceStringEdit(bytes, range, edit, sstIndex) {
   const out = new Uint8Array(bytes);
@@ -23086,18 +23332,27 @@ function patchBoundsheetOffsets(bytes, delta2) {
   return out;
 }
 function writeOleXlsStringCellEdit(inputBytes, edit) {
+  if (!Number.isInteger(edit.row) || edit.row < 0 || edit.row > 65535 || !Number.isInteger(edit.col) || edit.col < 0 || edit.col > 255 || edit.value.length > 32767)
+    return inputBytes;
   try {
     const { workbookBytes: xlsBytes, rewrap } = unwrapXlsBytes(inputBytes);
     if (!isSupportedBiff8Workbook(xlsBytes))
       return inputBytes;
-    const finish2 = (result) => rewrap ? rewrap(result) : result;
+    const finish2 = (result2) => {
+      const records = readRecords(result2, 0, result2.length);
+      const sst = records.find((r) => r.opcode === OPCODE_SST);
+      if (sst && sst.length >= 8) {
+        new DataView(result2.buffer, result2.byteOffset, result2.byteLength).setUint32(sst.dataOffset, records.filter((r) => r.opcode === OPCODE_LABELSST).length, true);
+      }
+      return rewrap ? rewrap(result2) : result2;
+    };
     const ranges = findAllWorksheetRanges(xlsBytes);
     const target = ranges[0];
     if (!target) {
       return inputBytes;
     }
     const sharedStrings = parseSstSingleRecord(xlsBytes);
-    const { index: sstIndex, rebuilt: newSstRecord } = resolveSstIndex(sharedStrings, edit.value);
+    const { index: sstIndex, rebuilt: newSstRecord } = resolveSstIndex(sharedStrings, edit.value, xlsBytes);
     if (!newSstRecord) {
       const inPlace = tryInPlaceStringEdit(xlsBytes, target, edit, sstIndex);
       if (inPlace) {
@@ -23110,10 +23365,22 @@ function writeOleXlsStringCellEdit(inputBytes, edit) {
     const allRecords = readRecords(xlsBytes, 0, xlsBytes.length);
     const sstRecord = allRecords.find((r) => r.opcode === OPCODE_SST);
     const extSstRecord = allRecords.find((r) => r.opcode === OPCODE_EXTSST);
+    if (allRecords.filter((r) => r.opcode === OPCODE_BOUNDSHEET).length > 1)
+      return inputBytes;
+    if (sstRecord && extSstRecord && extSstRecord.headerOffset !== sstRecord.dataOffset + sstRecord.length)
+      return inputBytes;
     if (!sstRecord) {
       return inputBytes;
     }
+    const region = findRowCellRegion(xlsBytes, target);
+    const sheetRecords = readRecords(xlsBytes, target.start, target.end);
+    if (sheetRecords.some((r) => [523, 6, 517, 189, 190, OPCODE_LABEL, 214].includes(r.opcode)) || sheetRecords.filter((r) => r.opcode === 2057).length !== 1)
+      return inputBytes;
+    if (readRecords(xlsBytes, region.start, region.end).some((r) => !(r.opcode === OPCODE_ROW || r.opcode === OPCODE_DBCELL || r.opcode === OPCODE_NUMBER || r.opcode === OPCODE_RK || r.opcode === OPCODE_LABELSST || r.opcode === OPCODE_BLANK)))
+      return inputBytes;
     const grid = parseXlsGrid(xlsBytes, target);
+    if ((/* @__PURE__ */ new Set([...grid.keys(), edit.row])).size > 32)
+      return inputBytes;
     const row = grid.get(edit.row) ?? { cells: /* @__PURE__ */ new Map() };
     row.cells.set(edit.col, {
       ixfe: row.cells.get(edit.col)?.ixfe ?? 15,
@@ -23122,8 +23389,7 @@ function writeOleXlsStringCellEdit(inputBytes, edit) {
     });
     grid.set(edit.row, row);
     const newRegion = buildXlsRowCellRegion(grid);
-    const region = findRowCellRegion(xlsBytes, target);
-    const sstEnd = extSstRecord ? extSstRecord.dataOffset + extSstRecord.length : sstRecord.dataOffset + sstRecord.length;
+    const sstEnd = extSstRecord && extSstRecord.headerOffset === sstRecord.dataOffset + sstRecord.length ? extSstRecord.dataOffset + extSstRecord.length : sstRecord.dataOffset + sstRecord.length;
     const oldSstSpanLength = sstEnd - sstRecord.headerOffset;
     const newSstSpanLength = newSstRecord ? newSstRecord.length : oldSstSpanLength;
     const patchedXlsBytes = patchBoundsheetOffsets(xlsBytes, newSstSpanLength - oldSstSpanLength);
@@ -23135,13 +23401,26 @@ function writeOleXlsStringCellEdit(inputBytes, edit) {
       ...newRegion,
       ...patchedXlsBytes.subarray(region.end)
     ];
-    return finish2(Uint8Array.from(out));
+    const result = Uint8Array.from(out);
+    const dimensions = readRecords(result, 0, result.length).find((r) => r.opcode === OPCODE_DIMENSIONS);
+    if (dimensions) {
+      if (dimensions.length !== 14)
+        return inputBytes;
+      const view = new DataView(result.buffer);
+      const rows = [...grid.keys()];
+      const cols = [...grid.values()].flatMap((row2) => [...row2.cells.keys()]);
+      view.setUint32(dimensions.dataOffset, Math.min(...rows), true);
+      view.setUint32(dimensions.dataOffset + 4, Math.max(...rows) + 1, true);
+      view.setUint16(dimensions.dataOffset + 8, Math.min(...cols), true);
+      view.setUint16(dimensions.dataOffset + 10, Math.max(...cols) + 1, true);
+    }
+    return finish2(result);
   } catch {
     return inputBytes;
   }
 }
 var init_legacy_excel_biff8_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-excel-biff8-writer.js"() {
     init_legacy_excel_biff8();
     init_legacy_excel_biff8_grid();
     init_legacy_excel_cfb();
@@ -23247,15 +23526,20 @@ var init_ole_document_docx_editor = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fib.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fib.js
 function readDocFib(wordDoc) {
   const view = new DataView(wordDoc.buffer, wordDoc.byteOffset, wordDoc.byteLength);
   const wIdent = view.getUint16(0, true);
   if (wIdent !== 42476) {
     throw new Error("Not a WordDocument FIB (bad wIdent)");
   }
+  const nFibBase = view.getUint16(2, true);
+  if (![193, 217, 257, 268, 274].includes(nFibBase))
+    throw new Error("Unsupported Word FIB version");
   const flags1Offset = 10;
   const flags1 = view.getUint16(flags1Offset, true);
+  if ((flags1 & 33024) !== 0)
+    throw new Error("Encrypted or obfuscated Word document");
   const fWhichTblStm = flags1 >> 9 & 1;
   const csw = view.getUint16(32, true);
   const fibRgW97Offset = 34;
@@ -23264,6 +23548,21 @@ function readDocFib(wordDoc) {
   const fibRgLw97Offset = cslwOffset + 2;
   const cbRgFcLcbCountOffset = fibRgLw97Offset + cslw * 4;
   const fibRgFcLcbOffset = cbRgFcLcbCountOffset + 2;
+  const fibRgFcLcbCount = view.getUint16(cbRgFcLcbCountOffset, true);
+  if (csw !== 14 || cslw !== 22 || fibRgFcLcbOffset + fibRgFcLcbCount * 8 + 2 > wordDoc.length)
+    throw new Error("Truncated Word FIB arrays");
+  const cswNewOffset = fibRgFcLcbOffset + fibRgFcLcbCount * 8;
+  const cswNew = view.getUint16(cswNewOffset, true);
+  if (cswNewOffset + 2 + cswNew * 2 > wordDoc.length)
+    throw new Error("Truncated Word FIB extension");
+  const nFib = cswNew === 0 ? nFibBase : view.getUint16(cswNewOffset + 2, true);
+  const expectedCounts = /* @__PURE__ */ new Map([[193, 93], [217, 108], [257, 136], [268, 164], [274, 183]]);
+  if (expectedCounts.get(nFib) !== fibRgFcLcbCount || cswNew !== 0 && cswNew !== (nFib === 274 ? 5 : 2))
+    throw new Error("Word FIB version and array counts disagree");
+  const ccpText = view.getInt32(fibRgLw97Offset + 12, true);
+  const otherStories = [4, 5, 7, 8, 9, 10].map((i2) => view.getInt32(fibRgLw97Offset + i2 * 4, true));
+  if (ccpText < 0 || otherStories.some((cp) => cp < 0))
+    throw new Error("Negative Word story length");
   function fcLcbPair(index) {
     const off = fibRgFcLcbOffset + index * 8;
     return { fc: view.getUint32(off, true), lcb: view.getUint32(off + 4, true) };
@@ -23271,18 +23570,22 @@ function readDocFib(wordDoc) {
   const cbMacOffset = fibRgLw97Offset + 0;
   const ccpTextOffset = fibRgLw97Offset + 12;
   return {
+    nFib,
+    nFibBase,
     flags1Offset,
     flags1,
     tableStreamName: fWhichTblStm ? "1Table" : "0Table",
     cbMacOffset,
     cbMac: view.getUint32(cbMacOffset, true),
     ccpTextOffset,
-    ccpText: view.getInt32(ccpTextOffset, true),
+    ccpText,
+    ccpOtherStories: otherStories.reduce((sum, cp) => sum + cp, 0),
     plcfbteChpx: fcLcbPair(FC_LCB_INDEX.plcfbteChpx),
     plcfbtePapx: fcLcbPair(FC_LCB_INDEX.plcfbtePapx),
     sed: fcLcbPair(FC_LCB_INDEX.sed),
     clx: fcLcbPair(FC_LCB_INDEX.clx),
-    fibRgFcLcbOffset
+    fibRgFcLcbOffset,
+    fibRgFcLcbCount
   };
 }
 function fcLcbFieldOffset(fib, key2) {
@@ -23290,6 +23593,9 @@ function fcLcbFieldOffset(fib, key2) {
 }
 function readFcLcbAt(wordDoc, fib, index) {
   const view = new DataView(wordDoc.buffer, wordDoc.byteOffset, wordDoc.byteLength);
+  const count = view.getUint16(fib.fibRgFcLcbOffset - 2, true);
+  if (!Number.isInteger(index) || index < 0 || index >= count || fib.fibRgFcLcbCount !== void 0 && fib.fibRgFcLcbCount !== count)
+    throw new Error("FIB fc/lcb index outside declared array");
   const off = fib.fibRgFcLcbOffset + index * 8;
   return { fc: view.getUint32(off, true), lcb: view.getUint32(off + 4, true) };
 }
@@ -23310,7 +23616,7 @@ function patchDocFib(wordDoc, fib, patch) {
 }
 var FC_LCB_INDEX, F_COMPLEX_BIT;
 var init_ole_document_doc_fib = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fib.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fib.js"() {
     FC_LCB_INDEX = {
       plcfbteChpx: 12,
       plcfbtePapx: 13,
@@ -23321,62 +23627,578 @@ var init_ole_document_doc_fib = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cfb.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-v4.js
+function follow(table, start) {
+  const ids = [], seen = /* @__PURE__ */ new Set();
+  for (let id = start; id !== END2; id = table[id]) {
+    if (id >= table.length || seen.has(id))
+      throw new Error("Invalid allocation chain");
+    seen.add(id);
+    ids.push(id);
+  }
+  return ids;
+}
+function findSlot(slots, path) {
+  let parent = slots.get(0);
+  if (!parent || parent.type !== 5)
+    throw new Error("Invalid root");
+  const parents = /* @__PURE__ */ new Set();
+  for (let part = 0; part < path.length; part++) {
+    if (parents.has(parent.id))
+      throw new Error("Cyclic storage hierarchy");
+    parents.add(parent.id);
+    const stack = [parent.child], seen = /* @__PURE__ */ new Set(), matches = [];
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE)
+        continue;
+      if (seen.has(id))
+        throw new Error("Invalid directory tree");
+      seen.add(id);
+      const slot = slots.get(id);
+      if (!slot)
+        throw new Error("Missing directory slot");
+      if (slot.name.toLocaleLowerCase() === path[part].toLocaleLowerCase())
+        matches.push(slot);
+      stack.push(slot.left, slot.right);
+    }
+    if (matches.length !== 1)
+      throw new Error("Missing or ambiguous stream");
+    parent = matches[0];
+    if (parent.type !== (part === path.length - 1 ? 2 : 1))
+      throw new Error("Invalid storage path");
+  }
+  return parent;
+}
+function validateHierarchy(slots) {
+  const owners = /* @__PURE__ */ new Set(), storages = [0];
+  while (storages.length) {
+    const storage = slots.get(storages.pop());
+    const stack = [storage.child], names = /* @__PURE__ */ new Set();
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE)
+        continue;
+      const slot = slots.get(id);
+      if (!slot || slot.type !== 1 && slot.type !== 2 || owners.has(id))
+        throw new Error("Ambiguous directory ownership");
+      const name = slot.name.toLocaleLowerCase();
+      if (names.has(name))
+        throw new Error("Duplicate sibling name");
+      names.add(name);
+      owners.add(id);
+      stack.push(slot.left, slot.right);
+      if (slot.type === 1)
+        storages.push(id);
+    }
+  }
+  if (owners.size !== slots.size - 1)
+    throw new Error("Unreachable directory entries");
+}
+function resizeCompoundFileStreamV4(input, path, replacement) {
+  const fail2 = (reason) => ({ ok: false, bytes: input, reason });
+  try {
+    if (input.length < 512 || !path.length || path.some((part) => !part))
+      return fail2("invalid-or-missing-stream");
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const read = (offset) => view.getUint32(offset, true);
+    const version = view.getUint16(26, true);
+    if (version !== 4)
+      return fail2("unsupported-version");
+    const SECTOR3 = 4096, FAT_ENTRIES2 = SECTOR3 / 4, DIRECTORY_ENTRIES = SECTOR3 / 128;
+    if (read(72) !== 0 || read(44) > 109)
+      return fail2("unsupported-difat");
+    const cutoff = read(56);
+    if (cutoff !== 0 && cutoff !== 4096)
+      return fail2("unsupported-layout");
+    const original = readCompoundFileStream(input, path);
+    if (!original)
+      return fail2("invalid-or-missing-stream");
+    const name = path[path.length - 1].toLocaleLowerCase();
+    if (name === "worddocument" && original.length >= 12 && (original[10] | original[11] << 8) & 33024)
+      return fail2("unsafe-edit");
+    if (name === "book" || name === "workbook") {
+      for (let offset = 0; offset + 4 <= original.length; ) {
+        const record2 = original[offset] | original[offset + 1] << 8;
+        const length = original[offset + 2] | original[offset + 3] << 8;
+        if (record2 === 47)
+          return fail2("unsafe-edit");
+        if (record2 === 10 || offset + 4 + length > original.length)
+          break;
+        offset += 4 + length;
+      }
+    }
+    const validated = replaceCompoundFileStream(input, path, original);
+    if (validated === input)
+      return fail2("unsafe-edit");
+    const sameLength = replacement.length === original.length;
+    if (!sameLength && original.length < cutoff)
+      return fail2("unsupported-mini-stream");
+    if (!sameLength && replacement.length < cutoff)
+      return fail2("unsupported-mini-transition");
+    const sectorCount = input.length / SECTOR3 - 1, fatCount = read(44);
+    if (sectorCount > fatCount * FAT_ENTRIES2)
+      return fail2("unsafe-edit");
+    const fatIds = Array.from({ length: fatCount }, (_, i2) => read(76 + 4 * i2));
+    const fat = [];
+    for (const id of fatIds) {
+      for (let i2 = 0; i2 < FAT_ENTRIES2 && fat.length < sectorCount; i2++)
+        fat.push(read((id + 1) * SECTOR3 + i2 * 4));
+    }
+    if (fatIds.some((id) => fat[id] !== FAT))
+      return fail2("unsafe-edit");
+    const slots = /* @__PURE__ */ new Map();
+    const directoryChain = follow(fat, read(48));
+    if (read(40) !== directoryChain.length)
+      return fail2("unsafe-edit");
+    for (const [block, sector] of directoryChain.entries()) {
+      for (let entry = 0; entry < DIRECTORY_ENTRIES; entry++) {
+        const offset = (sector + 1) * SECTOR3 + entry * 128, type = view.getUint8(offset + 66);
+        if (!type)
+          continue;
+        const nameLength = view.getUint16(offset + 64, true);
+        if (![1, 2, 5].includes(type) || nameLength < 2 || nameLength > 64 || nameLength % 2 || view.getUint16(offset + nameLength - 2, true))
+          return fail2("unsafe-edit");
+        let name2 = "";
+        for (let i2 = 0; i2 < nameLength - 2; i2 += 2)
+          name2 += String.fromCharCode(view.getUint16(offset + i2, true));
+        if (read(offset + 124) !== 0)
+          return fail2("unsafe-edit");
+        const id = block * DIRECTORY_ENTRIES + entry;
+        slots.set(id, { id, name: name2, type, left: read(offset + 68), right: read(offset + 72), child: read(offset + 76), start: read(offset + 116), size: read(offset + 120), offset });
+      }
+    }
+    if ([...slots.values()].filter((slot) => slot.type === 5).length !== 1)
+      return fail2("unsafe-edit");
+    const target = findSlot(slots, path);
+    validateHierarchy(slots);
+    if (sameLength) {
+      const bytes = replaceCompoundFileStream(input, path, replacement);
+      return bytes === input ? fail2("unsafe-edit") : { ok: true, bytes };
+    }
+    const oldChain = follow(fat, target.start);
+    if (target.size !== original.length || oldChain.length !== Math.ceil(target.size / SECTOR3))
+      return fail2("unsafe-edit");
+    const payloadSectors = Math.ceil(replacement.length / SECTOR3);
+    let newFatCount = fatCount;
+    while (sectorCount + payloadSectors + newFatCount - fatCount > newFatCount * FAT_ENTRIES2)
+      newFatCount++;
+    if (newFatCount > 109)
+      return fail2("allocation-limit");
+    const totalSectors = sectorCount + payloadSectors + newFatCount - fatCount;
+    const output = new Uint8Array((totalSectors + 1) * SECTOR3);
+    output.set(input);
+    output.set(replacement, (sectorCount + 1) * SECTOR3);
+    const outView = new DataView(output.buffer);
+    for (let i2 = fatCount; i2 < newFatCount; i2++) {
+      const id = sectorCount + payloadSectors + i2 - fatCount;
+      fatIds.push(id);
+      output.fill(255, (id + 1) * SECTOR3, (id + 2) * SECTOR3);
+      outView.setUint32(76 + i2 * 4, id, true);
+    }
+    outView.setUint32(44, newFatCount, true);
+    const writeFat = (id, value) => outView.setUint32((fatIds[Math.floor(id / FAT_ENTRIES2)] + 1) * SECTOR3 + id % FAT_ENTRIES2 * 4, value, true);
+    for (const id of oldChain)
+      writeFat(id, FREE);
+    for (let i2 = 0; i2 < payloadSectors; i2++)
+      writeFat(sectorCount + i2, i2 + 1 === payloadSectors ? END2 : sectorCount + i2 + 1);
+    for (const id of fatIds)
+      writeFat(id, FAT);
+    outView.setUint32(target.offset + 116, payloadSectors ? sectorCount : END2, true);
+    outView.setUint32(target.offset + 120, replacement.length, true);
+    return { ok: true, bytes: output };
+  } catch {
+    return fail2("unsafe-edit");
+  }
+}
+var END2, FREE, FAT;
+var init_ole2_stream_resize_v4 = __esm({
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-v4.js"() {
+    init_ole2_stream_edit();
+    END2 = 4294967294;
+    FREE = 4294967295;
+    FAT = 4294967293;
+  }
+});
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-allocation.js
+function appendCompoundAllocations(input, existingFatIds, payloads, sectorSize = 512) {
+  const sectorCount = input.length / sectorSize - 1;
+  const entriesPerFat = sectorSize / 4;
+  const counts = payloads.map((payload) => Math.ceil(payload.length / sectorSize));
+  const payloadSectors = counts.reduce((sum, count) => sum + count, 0);
+  let fatCount = existingFatIds.length;
+  while (sectorCount + payloadSectors + fatCount - existingFatIds.length > fatCount * entriesPerFat)
+    fatCount++;
+  if (fatCount > 109)
+    return void 0;
+  const totalSectors = sectorCount + payloadSectors + fatCount - existingFatIds.length;
+  const bytes = new Uint8Array((totalSectors + 1) * sectorSize);
+  bytes.set(input);
+  const view = new DataView(bytes.buffer), fatIds = [...existingFatIds];
+  for (let i2 = existingFatIds.length; i2 < fatCount; i2++) {
+    const id = sectorCount + payloadSectors + i2 - existingFatIds.length;
+    fatIds.push(id);
+    bytes.fill(255, (id + 1) * sectorSize, (id + 2) * sectorSize);
+    view.setUint32(76 + i2 * 4, id, true);
+  }
+  view.setUint32(44, fatCount, true);
+  const writeFat = (id, value) => view.setUint32((fatIds[Math.floor(id / entriesPerFat)] + 1) * sectorSize + id % entriesPerFat * 4, value, true);
+  const chains = [];
+  let next = sectorCount;
+  for (let payload = 0; payload < payloads.length; payload++) {
+    bytes.set(payloads[payload], (next + 1) * sectorSize);
+    const chain2 = Array.from({ length: counts[payload] }, (_, i2) => next + i2);
+    chain2.forEach((id, i2) => writeFat(id, chain2[i2 + 1] ?? 4294967294));
+    chains.push(chain2);
+    next += counts[payload];
+  }
+  for (const id of fatIds)
+    writeFat(id, 4294967293);
+  return { bytes, view, chains, writeFat };
+}
+function followCompoundAllocation(table, start) {
+  const ids = [], seen = /* @__PURE__ */ new Set();
+  for (let id = start; id !== 4294967294; id = table[id]) {
+    if (id >= table.length || seen.has(id))
+      throw new Error("Invalid allocation chain");
+    seen.add(id);
+    ids.push(id);
+  }
+  return ids;
+}
+var init_ole2_stream_resize_allocation = __esm({
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-allocation.js"() {
+  }
+});
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-mini.js
+function resizeMiniCompoundStream(input, fat, fatIds, root, target, replacement, cutoff) {
+  const inputView = new DataView(input.buffer, input.byteOffset, input.byteLength);
+  const miniFatCount = inputView.getUint32(64, true);
+  const miniFatSectors = miniFatCount ? followCompoundAllocation(fat, inputView.getUint32(60, true)) : [];
+  if (miniFatSectors.length !== miniFatCount)
+    throw new Error("Invalid mini FAT count");
+  const rootSectors = root.size ? followCompoundAllocation(fat, root.start) : [];
+  if (rootSectors.length !== Math.ceil(root.size / SECTOR))
+    throw new Error("Invalid root mini stream");
+  const miniCapacity = Math.floor(root.size / MINI), miniFat = [];
+  for (const id of miniFatSectors) {
+    for (let slot = 0; slot < SECTOR / 4 && miniFat.length < miniCapacity; slot++)
+      miniFat.push(inputView.getUint32((id + 1) * SECTOR + slot * 4, true));
+  }
+  const wasMini = target.size < cutoff;
+  const oldChain = followCompoundAllocation(wasMini ? miniFat : fat, target.start);
+  if (oldChain.length !== Math.ceil(target.size / (wasMini ? MINI : SECTOR)))
+    throw new Error("Invalid stream allocation");
+  if (!replacement.length) {
+    const bytes = input.slice(), view = new DataView(bytes.buffer);
+    for (const id of oldChain) {
+      const table = wasMini ? miniFatSectors : fatIds;
+      view.setUint32((table[Math.floor(id / 128)] + 1) * SECTOR + id % 128 * 4, FREE2, true);
+    }
+    view.setUint32(target.offset + 116, END3, true);
+    view.setUint32(target.offset + 120, 0, true);
+    return bytes;
+  }
+  if (replacement.length >= cutoff) {
+    const output2 = appendCompoundAllocations(input, fatIds, [replacement]);
+    if (!output2)
+      return void 0;
+    for (const id of oldChain)
+      output2.view.setUint32((miniFatSectors[Math.floor(id / 128)] + 1) * SECTOR + id % 128 * 4, FREE2, true);
+    output2.view.setUint32(target.offset + 116, output2.chains[0][0] ?? END3, true);
+    output2.view.setUint32(target.offset + 120, replacement.length, true);
+    return output2.bytes;
+  }
+  const firstMini = Math.ceil(root.size / MINI), count = Math.ceil(replacement.length / MINI);
+  const newRootSize = count ? (firstMini + count) * MINI : root.size;
+  const newRoot = new Uint8Array(newRootSize);
+  rootSectors.forEach((id, i2) => newRoot.set(input.subarray((id + 1) * SECTOR, (id + 1) * SECTOR + Math.min(SECTOR, root.size - i2 * SECTOR)), i2 * SECTOR));
+  if (count)
+    newRoot.set(replacement, firstMini * MINI);
+  const newMiniFatCount = Math.max(miniFatCount, Math.ceil((firstMini + count) / 128));
+  const newMiniFat = new Uint8Array(newMiniFatCount * SECTOR).fill(255);
+  miniFatSectors.forEach((id, i2) => newMiniFat.set(input.subarray((id + 1) * SECTOR, (id + 2) * SECTOR), i2 * SECTOR));
+  const miniView = new DataView(newMiniFat.buffer);
+  if (wasMini)
+    for (const id of oldChain)
+      miniView.setUint32(id * 4, FREE2, true);
+  for (let i2 = 0; i2 < count; i2++)
+    miniView.setUint32((firstMini + i2) * 4, i2 + 1 === count ? END3 : firstMini + i2 + 1, true);
+  const output = appendCompoundAllocations(input, fatIds, [newRoot, newMiniFat]);
+  if (!output)
+    return void 0;
+  for (const id of [...rootSectors, ...miniFatSectors, ...wasMini ? [] : oldChain])
+    output.writeFat(id, FREE2);
+  output.view.setUint32(root.offset + 116, output.chains[0][0] ?? END3, true);
+  output.view.setUint32(root.offset + 120, newRootSize, true);
+  output.view.setUint32(60, output.chains[1][0] ?? END3, true);
+  output.view.setUint32(64, newMiniFatCount, true);
+  output.view.setUint32(target.offset + 116, count ? firstMini : END3, true);
+  output.view.setUint32(target.offset + 120, replacement.length, true);
+  return output.bytes;
+}
+var END3, FREE2, SECTOR, MINI;
+var init_ole2_stream_resize_mini = __esm({
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-mini.js"() {
+    init_ole2_stream_resize_allocation();
+    END3 = 4294967294;
+    FREE2 = 4294967295;
+    SECTOR = 512;
+    MINI = 64;
+  }
+});
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize.js
+function follow2(table, start) {
+  const ids = [], seen = /* @__PURE__ */ new Set();
+  for (let id = start; id !== END4; id = table[id]) {
+    if (id >= table.length || seen.has(id))
+      throw new Error("Invalid allocation chain");
+    seen.add(id);
+    ids.push(id);
+  }
+  return ids;
+}
+function findSlot2(slots, path) {
+  let parent = slots.get(0);
+  if (!parent || parent.type !== 5)
+    throw new Error("Invalid root");
+  const parents = /* @__PURE__ */ new Set();
+  for (let part = 0; part < path.length; part++) {
+    if (parents.has(parent.id))
+      throw new Error("Cyclic storage hierarchy");
+    parents.add(parent.id);
+    const stack = [parent.child], seen = /* @__PURE__ */ new Set(), matches = [];
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE3)
+        continue;
+      if (seen.has(id))
+        throw new Error("Invalid directory tree");
+      seen.add(id);
+      const slot = slots.get(id);
+      if (!slot)
+        throw new Error("Missing directory slot");
+      if (slot.name.toLocaleLowerCase() === path[part].toLocaleLowerCase())
+        matches.push(slot);
+      stack.push(slot.left, slot.right);
+    }
+    if (matches.length !== 1)
+      throw new Error("Missing or ambiguous stream");
+    parent = matches[0];
+    if (parent.type !== (part === path.length - 1 ? 2 : 1))
+      throw new Error("Invalid storage path");
+  }
+  return parent;
+}
+function validateHierarchy2(slots) {
+  const owners = /* @__PURE__ */ new Set(), storages = [0];
+  while (storages.length) {
+    const storage = slots.get(storages.pop());
+    const stack = [storage.child], names = /* @__PURE__ */ new Set();
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE3)
+        continue;
+      const slot = slots.get(id);
+      if (!slot || slot.type !== 1 && slot.type !== 2 || owners.has(id))
+        throw new Error("Ambiguous directory ownership");
+      const name = slot.name.toLocaleLowerCase();
+      if (names.has(name))
+        throw new Error("Duplicate sibling name");
+      names.add(name);
+      owners.add(id);
+      stack.push(slot.left, slot.right);
+      if (slot.type === 1)
+        storages.push(id);
+    }
+  }
+  if (owners.size !== slots.size - 1)
+    throw new Error("Unreachable directory entries");
+}
+function resizeCompoundFileStream(input, path, replacement) {
+  if (input.length >= 512 && new DataView(input.buffer, input.byteOffset, input.byteLength).getUint16(26, true) === 4)
+    return resizeCompoundFileStreamV4(input, path, replacement);
+  const fail2 = (reason) => ({ ok: false, bytes: input, reason });
+  try {
+    if (input.length < SECTOR2 || !path.length || path.some((part) => !part))
+      return fail2("invalid-or-missing-stream");
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const read = (offset) => view.getUint32(offset, true);
+    if (view.getUint16(26, true) !== 3)
+      return fail2("unsupported-version");
+    if (read(72) !== 0 || read(44) > 109)
+      return fail2("unsupported-difat");
+    const cutoff = read(56);
+    if (cutoff !== 0 && cutoff !== 4096)
+      return fail2("unsupported-layout");
+    const original = readCompoundFileStream(input, path);
+    if (!original)
+      return fail2("invalid-or-missing-stream");
+    const name = path[path.length - 1].toLocaleLowerCase();
+    if (name === "worddocument" && original.length >= 12 && (original[10] | original[11] << 8) & 33024)
+      return fail2("unsafe-edit");
+    if (name === "book" || name === "workbook") {
+      for (let offset = 0; offset + 4 <= original.length; ) {
+        const record2 = original[offset] | original[offset + 1] << 8;
+        const length = original[offset + 2] | original[offset + 3] << 8;
+        if (record2 === 47)
+          return fail2("unsafe-edit");
+        if (record2 === 10 || offset + 4 + length > original.length)
+          break;
+        offset += 4 + length;
+      }
+    }
+    const validated = replaceCompoundFileStream(input, path, original);
+    if (validated === input)
+      return fail2("unsafe-edit");
+    const sameLength = replacement.length === original.length;
+    const sectorCount = input.length / SECTOR2 - 1, fatCount = read(44);
+    if (sectorCount > fatCount * FAT_ENTRIES)
+      return fail2("unsafe-edit");
+    const fatIds = Array.from({ length: fatCount }, (_, i2) => read(76 + 4 * i2));
+    const fat = [];
+    for (const id of fatIds) {
+      for (let i2 = 0; i2 < FAT_ENTRIES && fat.length < sectorCount; i2++)
+        fat.push(read((id + 1) * SECTOR2 + i2 * 4));
+    }
+    if (fatIds.some((id) => fat[id] !== FAT2))
+      return fail2("unsafe-edit");
+    const slots = /* @__PURE__ */ new Map();
+    for (const [block, sector] of follow2(fat, read(48)).entries()) {
+      for (let entry = 0; entry < 4; entry++) {
+        const offset = (sector + 1) * SECTOR2 + entry * 128, type = view.getUint8(offset + 66);
+        if (!type)
+          continue;
+        const nameLength = view.getUint16(offset + 64, true);
+        if (![1, 2, 5].includes(type) || nameLength < 2 || nameLength > 64 || nameLength % 2 || view.getUint16(offset + nameLength - 2, true))
+          return fail2("unsafe-edit");
+        let name2 = "";
+        for (let i2 = 0; i2 < nameLength - 2; i2 += 2)
+          name2 += String.fromCharCode(view.getUint16(offset + i2, true));
+        const id = block * 4 + entry;
+        slots.set(id, { id, name: name2, type, left: read(offset + 68), right: read(offset + 72), child: read(offset + 76), start: read(offset + 116), size: read(offset + 120), offset });
+      }
+    }
+    if ([...slots.values()].filter((slot) => slot.type === 5).length !== 1)
+      return fail2("unsafe-edit");
+    const target = findSlot2(slots, path);
+    validateHierarchy2(slots);
+    if (sameLength) {
+      const bytes = replaceCompoundFileStream(input, path, replacement);
+      return bytes === input ? fail2("unsafe-edit") : { ok: true, bytes };
+    }
+    if (original.length < cutoff || replacement.length < cutoff) {
+      const bytes = resizeMiniCompoundStream(input, fat, fatIds, slots.get(0), target, replacement, cutoff);
+      return bytes ? { ok: true, bytes } : fail2("allocation-limit");
+    }
+    const oldChain = follow2(fat, target.start);
+    if (target.size !== original.length || oldChain.length !== Math.ceil(target.size / SECTOR2))
+      return fail2("unsafe-edit");
+    const output = appendCompoundAllocations(input, fatIds, [replacement]);
+    if (!output)
+      return fail2("allocation-limit");
+    for (const id of oldChain)
+      output.writeFat(id, FREE3);
+    output.view.setUint32(target.offset + 116, output.chains[0][0] ?? END4, true);
+    output.view.setUint32(target.offset + 120, replacement.length, true);
+    return { ok: true, bytes: output.bytes };
+  } catch {
+    return fail2("unsafe-edit");
+  }
+}
+var END4, FREE3, FAT2, SECTOR2, FAT_ENTRIES;
+var init_ole2_stream_resize = __esm({
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize.js"() {
+    init_ole2_stream_edit();
+    init_ole2_stream_resize_v4();
+    init_ole2_stream_resize_allocation();
+    init_ole2_stream_resize_mini();
+    END4 = 4294967294;
+    FREE3 = 4294967295;
+    FAT2 = 4294967293;
+    SECTOR2 = 512;
+    FAT_ENTRIES = SECTOR2 / 4;
+  }
+});
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cfb.js
 function unwrapDocBytes(bytes) {
   if (bytes.length < 8 || bytes[0] !== 208 || bytes[1] !== 207 || bytes[2] !== 17 || bytes[3] !== 224 || bytes[4] !== 161 || bytes[5] !== 177 || bytes[6] !== 26 || bytes[7] !== 225) {
     return void 0;
   }
   try {
-    const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-    const ole = parseOle2(buffer);
-    const wordDocBytes = ole.getStream("WordDocument");
+    const wordDocBytes = readCompoundFileStream(bytes, ["WordDocument"]);
     if (!wordDocBytes) {
       return void 0;
     }
     const fib = readDocFib(wordDocBytes);
-    const tableBytes = ole.getStream(fib.tableStreamName);
+    const tableBytes = readCompoundFileStream(bytes, [fib.tableStreamName]);
     if (!tableBytes) {
       return void 0;
     }
-    const rootClsid = ole.entries.find((e) => e.type === ENTRY_TYPE_ROOT)?.clsid;
+    const header = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const cutoff = header.getUint32(56, true);
+    const canRewrite = header.getUint16(26, true) === 3 && header.getUint32(72, true) === 0 && header.getUint32(44, true) <= 109 && (cutoff === 0 || cutoff === 4096) && wordDocBytes.length >= cutoff && tableBytes.length >= cutoff;
     return {
       wordDocBytes,
       tableStreamName: fib.tableStreamName,
       tableBytes,
+      canRewrite,
       rewrap: (editedWordDocBytes, editedTableBytes) => {
-        const streams2 = /* @__PURE__ */ new Map();
-        for (const entry of ole.entries) {
-          if (entry.type !== ENTRY_TYPE_STREAM) {
-            continue;
-          }
-          const data = entry.name === "WordDocument" ? editedWordDocBytes : entry.name === fib.tableStreamName ? editedTableBytes : ole.getStream(entry.name);
-          if (data) {
-            streams2.set(entry.name, data);
-          }
-        }
-        return new Uint8Array(buildOle2(streams2, rootClsid));
+        if (editedWordDocBytes.length === wordDocBytes.length && editedTableBytes.length === tableBytes.length) {
+          const patchedWord = replaceCompoundFileStream(bytes, ["WordDocument"], editedWordDocBytes);
+          if (patchedWord === bytes)
+            throw new DocCfbRewriteError("Cannot safely patch WordDocument");
+          if (editedTableBytes.every((value, i2) => value === tableBytes[i2]))
+            return patchedWord;
+          const patchedTable = replaceCompoundFileStream(patchedWord, [fib.tableStreamName], editedTableBytes);
+          if (patchedTable === patchedWord)
+            throw new DocCfbRewriteError("Cannot safely patch DOC table stream");
+          return patchedTable;
+        }
+        const word = resizeCompoundFileStream(bytes, ["WordDocument"], editedWordDocBytes);
+        if (!word.ok)
+          throw new DocCfbRewriteError(`Cannot resize WordDocument: ${word.reason}`);
+        const table = resizeCompoundFileStream(word.bytes, [fib.tableStreamName], editedTableBytes);
+        if (!table.ok)
+          throw new DocCfbRewriteError(`Cannot resize DOC table stream: ${table.reason}`);
+        return table.bytes;
       }
     };
   } catch {
     return void 0;
   }
 }
+var DocCfbRewriteError;
 var init_ole_document_doc_cfb = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cfb.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cfb.js"() {
     init_ole_document_doc_fib();
-    init_ole2_parser_read();
-    init_ole2_parser_types();
-    init_ole2_parser_write();
+    init_ole2_stream_edit();
+    init_ole2_stream_resize();
+    DocCfbRewriteError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "DocCfbRewriteError";
+      }
+    };
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fkp.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fkp.js
 function parseBteTable(tableStream, at2) {
   const view = new DataView(tableStream.buffer, tableStream.byteOffset, tableStream.byteLength);
-  const n = Math.floor((at2.lcb - 4) / (4 + 4));
+  if (!Number.isInteger(at2.fc) || !Number.isInteger(at2.lcb) || at2.fc < 0 || at2.lcb < 4 || (at2.lcb - 4) % 8 !== 0 || at2.fc > tableStream.length - at2.lcb)
+    throw new Error("Invalid BTE table bounds");
+  const n = (at2.lcb - 4) / 8;
   const fcs = [];
   for (let i2 = 0; i2 <= n; i2++) {
-    fcs.push(view.getInt32(at2.fc + i2 * 4, true));
+    const fc = view.getInt32(at2.fc + i2 * 4, true);
+    if (fc < 0 || i2 > 0 && fc <= fcs[i2 - 1])
+      throw new Error("Invalid BTE FC boundaries");
+    fcs.push(fc);
   }
   const pns = [];
   for (let i2 = 0; i2 < n; i2++) {
@@ -23397,10 +24219,17 @@ function buildBteTableBytes(table) {
   return bytes;
 }
 function findBteRangeIndex(table, fc) {
-  for (let i2 = 0; i2 < table.pns.length; i2++) {
-    if (fc >= table.fcs[i2] && fc < table.fcs[i2 + 1]) {
-      return i2;
-    }
+  let low = 0, high = table.pns.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if (fc < table.fcs[middle])
+      high = middle;
+    else if (fc >= table.fcs[middle + 1])
+      low = middle + 1;
+    else if (fc >= table.fcs[middle])
+      return middle;
+    else
+      break;
   }
   throw new Error(`FC ${fc} is not covered by any BTE range`);
 }
@@ -23416,7 +24245,11 @@ function extractPapxBlob(wordDoc, papxBte, fc) {
   const rangeIndex = findBteRangeIndex(papxBte, fc);
   const pageOffset = papxBte.pns[rangeIndex] * PAGE_SIZE;
   const page = wordDoc.subarray(pageOffset, pageOffset + PAGE_SIZE);
+  if (page.length !== PAGE_SIZE)
+    throw new Error("Truncated PAPX page");
   const crun = page[PAGE_SIZE - 1];
+  if (crun === 0 || (crun + 1) * 4 + crun * 13 > 511)
+    throw new Error("Invalid PAPX run count");
   const pageView = new DataView(page.buffer, page.byteOffset, page.byteLength);
   const rgbxOffset = (crun + 1) * 4;
   for (let i2 = 0; i2 < crun; i2++) {
@@ -23424,8 +24257,13 @@ function extractPapxBlob(wordDoc, papxBte, fc) {
     const runFcEnd = pageView.getInt32((i2 + 1) * 4, true);
     if (fc >= runFcStart && fc < runFcEnd) {
       const bOffsetWord = page[rgbxOffset + i2 * 13];
+      if (bOffsetWord === 0)
+        return new Uint8Array();
       const blobOffset = bOffsetWord * 2;
-      return page.slice(blobOffset, blobOffset + papxBlobLength(page, blobOffset));
+      const blobLength = papxBlobLength(page, blobOffset);
+      if (blobOffset < rgbxOffset + crun * 13 || !Number.isInteger(blobLength) || blobOffset + blobLength > 511)
+        throw new Error("Invalid PAPX blob bounds");
+      return page.slice(blobOffset, blobOffset + blobLength);
     }
   }
   throw new Error(`FC ${fc} is not covered by any run in PAPX page ${papxBte.pns[rangeIndex]}`);
@@ -23434,7 +24272,11 @@ function extractChpxBlob(wordDoc, chpxBte, fc) {
   const rangeIndex = findBteRangeIndex(chpxBte, fc);
   const pageOffset = chpxBte.pns[rangeIndex] * PAGE_SIZE;
   const page = wordDoc.subarray(pageOffset, pageOffset + PAGE_SIZE);
+  if (page.length !== PAGE_SIZE)
+    throw new Error("Truncated CHPX page");
   const crun = page[PAGE_SIZE - 1];
+  if (crun === 0 || (crun + 1) * 4 + crun > 511)
+    throw new Error("Invalid CHPX run count");
   const pageView = new DataView(page.buffer, page.byteOffset, page.byteLength);
   const rgbOffset = (crun + 1) * 4;
   for (let i2 = 0; i2 < crun; i2++) {
@@ -23447,6 +24289,8 @@ function extractChpxBlob(wordDoc, chpxBte, fc) {
       }
       const blobOffset = bOffsetWord * 2;
       const cb = page[blobOffset];
+      if (blobOffset < rgbOffset + crun || blobOffset + 1 + cb > 511)
+        throw new Error("Invalid CHPX blob bounds");
       return page.slice(blobOffset, blobOffset + 1 + cb);
     }
   }
@@ -23458,8 +24302,12 @@ function buildSingleRunPapxPage(fcStart, fcEnd, blob) {
   view.setInt32(0, fcStart, true);
   view.setInt32(4, fcEnd, true);
   const blobByteOffset = 22;
-  page[8] = blobByteOffset / 2;
-  page.set(blob, blobByteOffset);
+  if (blob.length > 511 - blobByteOffset)
+    throw new Error("PAPX blob exceeds page capacity");
+  if (blob.length > 0) {
+    page[8] = blobByteOffset / 2;
+    page.set(blob, blobByteOffset);
+  }
   page[PAGE_SIZE - 1] = 1;
   return page;
 }
@@ -23470,6 +24318,8 @@ function buildSingleRunChpxPage(fcStart, fcEnd, blob) {
   view.setInt32(4, fcEnd, true);
   if (blob.length > 0) {
     const blobByteOffset = 10;
+    if (blob.length > 511 - blobByteOffset)
+      throw new Error("CHPX blob exceeds page capacity");
     page[8] = blobByteOffset / 2;
     page.set(blob, blobByteOffset);
   }
@@ -23478,12 +24328,12 @@ function buildSingleRunChpxPage(fcStart, fcEnd, blob) {
 }
 var PAGE_SIZE;
 var init_ole_document_doc_fkp = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fkp.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fkp.js"() {
     PAGE_SIZE = 512;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cp1252.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cp1252.js
 function decodeCp1252Byte(byte) {
   if (byte >= 128 && byte <= 159) {
     return CP1252_HIGH_BLOCK[byte - 128];
@@ -23517,7 +24367,7 @@ function encodeCp1252(text2) {
 }
 var CP1252_HIGH_BLOCK, CP1252_HIGH_BLOCK_REVERSE;
 var init_ole_document_doc_cp1252 = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cp1252.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cp1252.js"() {
     CP1252_HIGH_BLOCK = [
       8364,
       129,
@@ -23556,21 +24406,42 @@ var init_ole_document_doc_cp1252 = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-pieces.js
-function parsePieceTable(tableStream, clx) {
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-pieces.js
+function parseDocClx(tableStream, clx, maxPieces) {
+  if (maxPieces !== void 0 && (!Number.isSafeInteger(maxPieces) || maxPieces < 0))
+    throw new Error("Invalid DOC piece limit");
   const view = new DataView(tableStream.buffer, tableStream.byteOffset, tableStream.byteLength);
+  if (!Number.isInteger(clx.fc) || !Number.isInteger(clx.lcb) || clx.fc < 0 || clx.lcb < 5 || clx.fc > tableStream.length - clx.lcb)
+    throw new Error("Clx is outside the table stream");
   let off = clx.fc;
   const end = clx.fc + clx.lcb;
+  let prcCount = 0;
   while (off < end) {
     const clxt = view.getUint8(off);
     if (clxt === CLXT_PRC) {
+      if (off + 3 > end)
+        throw new Error("Truncated Prc header");
       const cb = view.getUint16(off + 1, true);
+      if (cb > end - off - 3)
+        throw new Error("Prc extends beyond Clx");
       off += 1 + 2 + cb;
+      prcCount++;
       continue;
     }
     if (clxt === CLXT_PCDT) {
+      if (off + 5 > end)
+        throw new Error("Truncated Pcdt header");
       const lcb = view.getInt32(off + 1, true);
-      return parsePlcPcd(view, off + 1 + 4, lcb);
+      if (lcb < 4 || (lcb - 4) % 12 !== 0 || lcb !== end - off - 5)
+        throw new Error("Invalid PlcPcd length");
+      if (maxPieces !== void 0 && (lcb - 4) / 12 > maxPieces)
+        throw new DocResourceLimitError("DOC piece count exceeds the processing limit");
+      const pieces = parsePlcPcd(view, off + 5, lcb);
+      for (const piece of pieces) {
+        if ((piece.prm & 1) !== 0 && piece.prm >>> 1 >= prcCount)
+          throw new Error("Prm1 references a missing Prc");
+      }
+      return { pieces, prcBytes: tableStream.slice(clx.fc, off) };
     }
     throw new Error(`Unrecognised Clx entry type ${clxt} at ${off}`);
   }
@@ -23580,7 +24451,10 @@ function parsePlcPcd(view, plcStart, lcb) {
   const n = Math.floor((lcb - 4) / (4 + 8));
   const cps = [];
   for (let i2 = 0; i2 <= n; i2++) {
-    cps.push(view.getInt32(plcStart + i2 * 4, true));
+    const cp = view.getInt32(plcStart + i2 * 4, true);
+    if (i2 === 0 && cp !== 0 || i2 > 0 && cp <= cps[i2 - 1])
+      throw new Error("Piece CPs must start at zero and increase");
+    cps.push(cp);
   }
   const pcdStart = plcStart + (n + 1) * 4;
   const pieces = [];
@@ -23588,6 +24462,8 @@ function parsePlcPcd(view, plcStart, lcb) {
     const pOff = pcdStart + i2 * 8;
     const flagsWord = view.getUint16(pOff, true);
     const fcRaw = view.getUint32(pOff + 2, true);
+    if ((fcRaw & 2147483648) !== 0)
+      throw new Error("Reserved FcCompressed bit is set");
     const prm = view.getUint16(pOff + 6, true);
     const compressed = (fcRaw >>> 30 & 1) === 1;
     const fcField = fcRaw & 1073741823;
@@ -23604,6 +24480,9 @@ function parsePlcPcd(view, plcStart, lcb) {
 }
 function decodePieceText(wordDoc, piece) {
   const charLen = piece.cpEnd - piece.cpStart;
+  const byteLen = charLen * (piece.compressed ? 1 : 2);
+  if (!Number.isInteger(charLen) || charLen < 0 || !Number.isInteger(piece.fc) || piece.fc < 0 || piece.fc > wordDoc.length - byteLen)
+    throw new Error("Piece text is outside WordDocument");
   if (piece.compressed) {
     return decodeCp1252(wordDoc.subarray(piece.fc, piece.fc + charLen));
   }
@@ -23614,8 +24493,19 @@ function decodePieceText(wordDoc, piece) {
   }
   return out;
 }
-function decodePiecesText(wordDoc, pieces) {
-  return pieces.map((piece) => decodePieceText(wordDoc, piece)).join("");
+function decodePiecesText(wordDoc, pieces, maxChars) {
+  if (maxChars !== void 0 && (!Number.isInteger(maxChars) || maxChars < 0))
+    throw new Error("Invalid text character limit");
+  const out = [];
+  for (const piece of pieces) {
+    const bytes = (piece.cpEnd - piece.cpStart) * (piece.compressed ? 1 : 2);
+    if (piece.cpEnd < piece.cpStart || piece.fc < 0 || piece.fc > wordDoc.length - bytes)
+      throw new Error("Piece text is outside WordDocument");
+    const end = Math.min(piece.cpEnd, maxChars ?? piece.cpEnd);
+    if (end > piece.cpStart)
+      out.push(decodePieceText(wordDoc, { ...piece, cpEnd: end }));
+  }
+  return out.join("");
 }
 function encodePieceText(text2) {
   const compressedBytes = encodeCp1252(text2);
@@ -23653,7 +24543,7 @@ function replacePieceRange(pieces, cpStart, cpEnd, newPiece) {
         fc: newPiece.fc,
         compressed: newPiece.compressed,
         flagsWord: newPiece.flagsWord,
-        prm: 0,
+        prm: newPiece.prm ?? 0,
         charLength: newPiece.charLength
       });
       inserted = true;
@@ -23674,7 +24564,7 @@ function replacePieceRange(pieces, cpStart, cpEnd, newPiece) {
       fc: newPiece.fc,
       compressed: newPiece.compressed,
       flagsWord: newPiece.flagsWord,
-      prm: 0,
+      prm: newPiece.prm ?? 0,
       charLength: newPiece.charLength
     });
   }
@@ -23692,7 +24582,7 @@ function replacePieceRange(pieces, cpStart, cpEnd, newPiece) {
     };
   });
 }
-function buildClxBytes(pieces) {
+function buildClxBytes(pieces, prcBytes = new Uint8Array()) {
   const n = pieces.length;
   const plcLcb = (n + 1) * 4 + n * 8;
   const bytes = new Uint8Array(1 + 4 + plcLcb);
@@ -23713,20 +24603,138 @@ function buildClxBytes(pieces) {
     view.setUint16(off + 6, piece.prm, true);
     off += 8;
   }
-  return bytes;
+  const result = new Uint8Array(prcBytes.length + bytes.length);
+  result.set(prcBytes);
+  result.set(bytes, prcBytes.length);
+  parseDocClx(result, { fc: 0, lcb: result.length });
+  return result;
 }
-var CLXT_PRC, CLXT_PCDT;
+var CLXT_PRC, CLXT_PCDT, DocResourceLimitError;
 var init_ole_document_doc_pieces = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-pieces.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-pieces.js"() {
     init_ole_document_doc_cp1252();
     CLXT_PRC = 1;
     CLXT_PCDT = 2;
+    DocResourceLimitError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "DocResourceLimitError";
+      }
+    };
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-editor.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fields.js
+function checkFieldRanges(markers, editStart, editEnd, maxDepth2) {
+  const stack = [];
+  for (const { cp, ch } of markers) {
+    if (ch === 19) {
+      if (stack.length >= maxDepth2)
+        throw new DocResourceLimitError("DOC field nesting exceeds the processing limit");
+      stack.push({ start: cp, separated: false });
+    } else if (ch === 20) {
+      const field = stack.at(-1);
+      if (!field || field.separated)
+        throw new Error("Invalid DOC field separator nesting");
+      field.separated = true;
+    } else if (ch === 21) {
+      const field = stack.pop();
+      if (!field)
+        throw new Error("Unmatched DOC field end");
+      if (field.start < editEnd && cp + 1 > editStart)
+        throw new UnsupportedDocFieldEditError("Paragraph overlaps a field code/result range");
+    }
+  }
+  if (stack.length)
+    throw new Error("Unterminated DOC field");
+}
+function* bodyMarkers(body) {
+  for (let cp = 0; cp < body.length; cp++) {
+    const ch = body.charCodeAt(cp);
+    if (ch >= 19 && ch <= 21)
+      yield { cp, ch };
+  }
+}
+function shiftDocMainFieldCps(table, at2, body, editStart, editEnd, delta2, maxFields) {
+  if (![editStart, editEnd, delta2, maxFields].every(Number.isSafeInteger) || editStart < 0 || editEnd <= editStart || editEnd > body.length || maxFields < 0 || body.length + delta2 < 0)
+    throw new Error("Invalid field edit bounds or budget");
+  checkFieldRanges(bodyMarkers(body), editStart, editEnd, maxFields);
+  if (at2.lcb === 0)
+    return void 0;
+  if (!Number.isSafeInteger(at2.fc) || at2.fc < 0 || at2.lcb < 4 || (at2.lcb - 4) % 6 !== 0 || at2.fc > table.length - at2.lcb)
+    throw new Error("Invalid main-story field PLC bounds");
+  const n = (at2.lcb - 4) / 6;
+  if (n > maxFields)
+    throw new DocResourceLimitError("DOC field count exceeds the processing limit");
+  const source = table.subarray(at2.fc, at2.fc + at2.lcb);
+  const view = new DataView(source.buffer, source.byteOffset, source.byteLength);
+  const markers = [];
+  let previous = -1;
+  for (let i2 = 0; i2 < n; i2++) {
+    const cp = view.getInt32(i2 * 4, true);
+    const ch = source[(n + 1) * 4 + i2 * 2] & 31;
+    if (cp <= previous || cp >= body.length || ![19, 20, 21].includes(ch) || body.charCodeAt(cp) !== ch)
+      throw new Error("Invalid main-story field marker");
+    markers.push({ cp, ch });
+    previous = cp;
+  }
+  checkFieldRanges(markers, editStart, editEnd, maxFields);
+  const sentinel = view.getInt32(n * 4, true);
+  if (sentinel < 0 || sentinel <= previous)
+    throw new Error("Invalid field PLC sentinel");
+  const result = source.slice();
+  const out = new DataView(result.buffer);
+  let shiftedLast = -1;
+  for (let i2 = 0; i2 < n; i2++) {
+    const cp = markers[i2].cp;
+    const shifted = cp >= editEnd ? cp + delta2 : cp;
+    if (shifted < 0 || shifted >= body.length + delta2 || shifted <= shiftedLast)
+      throw new Error("Field position shifts outside the main story");
+    out.setInt32(i2 * 4, shifted, true);
+    shiftedLast = shifted;
+  }
+  let shiftedSentinel = sentinel >= editEnd ? sentinel + delta2 : sentinel;
+  if (shiftedSentinel > 2147483647 || shiftedSentinel <= shiftedLast)
+    shiftedSentinel = sentinel;
+  if (shiftedSentinel <= shiftedLast)
+    throw new Error("No representable field PLC sentinel");
+  out.setInt32(n * 4, shiftedSentinel, true);
+  return result;
+}
+var UnsupportedDocFieldEditError;
+var init_ole_document_doc_fields = __esm({
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fields.js"() {
+    init_ole_document_doc_pieces();
+    UnsupportedDocFieldEditError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "UnsupportedDocFieldEditError";
+      }
+    };
+  }
+});
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-editor.js
+function processingLimits(limits) {
+  const resolved = {
+    maxCharacters: limits?.maxCharacters ?? DEFAULT_OLE_DOC_PROCESSING_LIMITS.maxCharacters,
+    maxPieces: limits?.maxPieces ?? DEFAULT_OLE_DOC_PROCESSING_LIMITS.maxPieces,
+    maxFieldRecords: limits?.maxFieldRecords ?? DEFAULT_OLE_DOC_PROCESSING_LIMITS.maxFieldRecords
+  };
+  if (!Number.isSafeInteger(resolved.maxCharacters) || resolved.maxCharacters < 0 || !Number.isSafeInteger(resolved.maxPieces) || resolved.maxPieces < 0 || !Number.isSafeInteger(resolved.maxFieldRecords) || resolved.maxFieldRecords < 0)
+    throw new Error("DOC processing limits must be nonnegative safe integers");
+  return resolved;
+}
 function hasUnsupportedFeatures(wordDoc, fib) {
+  if (fib.ccpOtherStories > 0)
+    return true;
+  for (let index = 93; index < fib.fibRgFcLcbCount; index++) {
+    if (!SAFE_EXTENDED_FC_LCB_INDICES.has(index) && readFcLcbAt(wordDoc, fib, index).lcb !== 0)
+      return true;
+  }
   for (const index of RISKY_PLCF_INDICES) {
+    if (index >= fib.fibRgFcLcbCount)
+      continue;
     if (readFcLcbAt(wordDoc, fib, index).lcb > 4) {
       return true;
     }
@@ -23759,15 +24767,30 @@ function paragraphBoundaries(bodyText) {
   }
   return boundaries;
 }
-function readOleDocParagraphs(docBytes) {
+function encodePieceTextUtf16(text2) {
+  const bytes = new Uint8Array(text2.length * 2);
+  const view = new DataView(bytes.buffer);
+  for (let i2 = 0; i2 < text2.length; i2++)
+    view.setUint16(i2 * 2, text2.charCodeAt(i2), true);
+  return bytes;
+}
+function readOleDocParagraphs(docBytes, limits) {
   try {
+    const budget = processingLimits(limits);
     const cfb = unwrapDocBytes(docBytes);
     if (!cfb) {
       return void 0;
     }
     const fib = readDocFib(cfb.wordDocBytes);
-    const pieces = parsePieceTable(cfb.tableBytes, fib.clx);
-    const fullText = decodePiecesText(cfb.wordDocBytes, pieces);
+    if (fib.ccpText > budget.maxCharacters)
+      return void 0;
+    const pieces = parseDocClx(cfb.tableBytes, fib.clx, budget.maxPieces).pieces;
+    const totalCp = pieces.at(-1)?.cpEnd ?? 0;
+    if (totalCp > fib.ccpText + fib.ccpOtherStories + 1)
+      return void 0;
+    const fullText = decodePiecesText(cfb.wordDocBytes, pieces, fib.ccpText);
+    if (fullText.length < fib.ccpText)
+      return void 0;
     const bodyText = fullText.slice(0, fib.ccpText);
     const boundaries = paragraphBoundaries(bodyText);
     let start = 0;
@@ -23784,7 +24807,9 @@ function readOleDocParagraphs(docBytes) {
 }
 function shiftSectionTableCps(tableBytes, sed, editEndCp, delta2) {
   const view = new DataView(tableBytes.buffer, tableBytes.byteOffset, tableBytes.byteLength);
-  const n = Math.floor((sed.lcb - 4) / (4 + 12));
+  if (sed.lcb < 4 || (sed.lcb - 4) % 16 !== 0 || sed.fc > tableBytes.length - sed.lcb)
+    throw new Error("Invalid section table");
+  const n = (sed.lcb - 4) / 16;
   for (let i2 = 0; i2 <= n; i2++) {
     const off = sed.fc + i2 * 4;
     const cp = view.getInt32(off, true);
@@ -23793,31 +24818,101 @@ function shiftSectionTableCps(tableBytes, sed, editEndCp, delta2) {
     }
   }
 }
-function writeOleDocParagraphEdit(docBytes, paragraphIndex, text2) {
+function writeOleDocParagraphEdit(docBytes, paragraphIndex, text2, limits) {
+  return tryWriteOleDocParagraphEdit(docBytes, paragraphIndex, text2, limits).bytes;
+}
+function tryWriteOleDocParagraphEdit(docBytes, paragraphIndex, text2, limits) {
+  const rejected = (reason) => ({ status: "rejected", bytes: docBytes, reason });
+  let budget;
+  try {
+    budget = processingLimits(limits);
+  } catch {
+    return rejected("invalid-limits");
+  }
+  if (text2.length > budget.maxCharacters)
+    return rejected("resource-limit");
+  if (!Number.isInteger(paragraphIndex) || paragraphIndex < 0)
+    return rejected("invalid-paragraph-index");
+  if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/u.test(text2))
+    return rejected("invalid-text");
   try {
     const cfb = unwrapDocBytes(docBytes);
     if (!cfb) {
-      return docBytes;
+      return rejected("invalid-payload");
     }
     const fib = readDocFib(cfb.wordDocBytes);
-    if (hasUnsupportedFeatures(cfb.wordDocBytes, fib)) {
-      return docBytes;
-    }
-    const pieces = parsePieceTable(cfb.tableBytes, fib.clx);
-    const fullText = decodePiecesText(cfb.wordDocBytes, pieces);
+    if (fib.ccpText > budget.maxCharacters)
+      return rejected("resource-limit");
+    const { pieces, prcBytes } = parseDocClx(cfb.tableBytes, fib.clx, budget.maxPieces);
+    const totalCp = pieces.at(-1)?.cpEnd ?? 0;
+    if (totalCp > fib.ccpText + fib.ccpOtherStories + 1)
+      return rejected("invalid-document");
+    const fullText = decodePiecesText(cfb.wordDocBytes, pieces, fib.ccpText);
+    if (fullText.length < fib.ccpText)
+      return rejected("invalid-document");
     const bodyText = fullText.slice(0, fib.ccpText);
     const boundaries = paragraphBoundaries(bodyText);
     const paragraphEndCp = boundaries[paragraphIndex];
     if (paragraphEndCp === void 0) {
-      return docBytes;
+      return rejected("invalid-paragraph-index");
     }
     const paragraphStartCp = paragraphIndex === 0 ? 0 : boundaries[paragraphIndex - 1];
+    if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/u.test(bodyText.slice(paragraphStartCp, paragraphEndCp)))
+      return rejected("unsupported-features");
+    const sanitizedText = text2.replaceAll(/[\r\n]+/gu, " ");
+    if (fib.ccpText - (paragraphEndCp - paragraphStartCp) + sanitizedText.length + 1 > budget.maxCharacters)
+      return rejected("resource-limit");
+    if (sanitizedText.length + 1 === paragraphEndCp - paragraphStartCp && bodyText[paragraphEndCp - 1] === "\r") {
+      const replacement = `${sanitizedText}\r`;
+      const patched = cfb.wordDocBytes.slice();
+      let canPatch = true;
+      for (const piece of pieces) {
+        const start = Math.max(paragraphStartCp, piece.cpStart);
+        const end = Math.min(paragraphEndCp, piece.cpEnd);
+        if (start >= end)
+          continue;
+        const part = replacement.slice(start - paragraphStartCp, end - paragraphStartCp);
+        const unit = piece.compressed ? 1 : 2;
+        const fc = piece.fc + (start - piece.cpStart) * unit;
+        const fcEnd = fc + part.length * unit;
+        if (pieces.some((other) => other !== piece && other.fc < fcEnd && other.fc + (other.cpEnd - other.cpStart) * (other.compressed ? 1 : 2) > fc)) {
+          canPatch = false;
+          break;
+        }
+        const encoded = piece.compressed ? encodeCp1252(part) : encodePieceTextUtf16(part);
+        if (!encoded) {
+          canPatch = false;
+          break;
+        }
+        patched.set(encoded, fc);
+      }
+      if (canPatch)
+        return { status: "edited", strategy: "preserved-runs", bytes: cfb.rewrap(patched, cfb.tableBytes) };
+    }
+    if (!cfb.canRewrite)
+      return rejected("unsupported-container");
+    if (hasUnsupportedFeatures(cfb.wordDocBytes, fib))
+      return rejected("unsupported-features");
+    const delta2 = sanitizedText.length + 1 - (paragraphEndCp - paragraphStartCp);
+    const mainFields = readFcLcbAt(cfb.wordDocBytes, fib, 16);
+    if (mainFields.lcb > 0) {
+      for (let index = 0; index < fib.fibRgFcLcbCount; index++) {
+        if (index === 16 || index === 87)
+          continue;
+        const other = readFcLcbAt(cfb.wordDocBytes, fib, index);
+        if (other.lcb > 0 && other.fc < mainFields.fc + mainFields.lcb && other.fc + other.lcb > mainFields.fc)
+          return rejected("invalid-document");
+      }
+    }
+    const shiftedFields = shiftDocMainFieldCps(cfb.tableBytes, mainFields, bodyText, paragraphStartCp, paragraphEndCp, delta2, budget.maxFieldRecords);
     const { piece: startPiece, fc: startFc } = pieceAndFcAtCp(pieces, paragraphStartCp);
+    if (pieces.some((piece) => piece.cpStart < paragraphEndCp && piece.cpEnd > paragraphStartCp && piece.prm !== startPiece.prm))
+      return rejected("unsupported-features");
+    const { fc: paragraphMarkFc } = pieceAndFcAtCp(pieces, paragraphEndCp - 1);
     const papxBte = parseBteTable(cfb.tableBytes, fib.plcfbtePapx);
     const chpxBte = parseBteTable(cfb.tableBytes, fib.plcfbteChpx);
-    const papxBlob = extractPapxBlob(cfb.wordDocBytes, papxBte, startFc);
+    const papxBlob = extractPapxBlob(cfb.wordDocBytes, papxBte, paragraphMarkFc);
     const chpxBlob = extractChpxBlob(cfb.wordDocBytes, chpxBte, startFc);
-    const sanitizedText = text2.replaceAll(/[\r\n]+/gu, " ");
     const { bytes: textBytes, compressed } = encodePieceText(`${sanitizedText}\r`);
     const originalLen = cfb.wordDocBytes.length;
     const newTextFc = originalLen;
@@ -23845,15 +24940,19 @@ function writeOleDocParagraphEdit(docBytes, paragraphIndex, text2) {
       fc: newTextFc,
       compressed,
       charLength: sanitizedText.length + 1,
-      flagsWord: startPiece.flagsWord
+      flagsWord: startPiece.flagsWord,
+      prm: startPiece.prm
     });
-    const delta2 = sanitizedText.length + 1 - (paragraphEndCp - paragraphStartCp);
+    if (newPieces.length > budget.maxPieces)
+      return rejected("resource-limit");
     const newCcpText = fib.ccpText + delta2;
-    const clxBytes = buildClxBytes(newPieces);
+    const clxBytes = buildClxBytes(newPieces, prcBytes);
     const papxBteBytes = buildBteTableBytes(newPapxBte);
     const chpxBteBytes = buildBteTableBytes(newChpxBte);
     const newTableBytes = new Uint8Array(cfb.tableBytes.length + clxBytes.length + papxBteBytes.length + chpxBteBytes.length);
     newTableBytes.set(cfb.tableBytes, 0);
+    if (shiftedFields)
+      newTableBytes.set(shiftedFields, mainFields.fc);
     let tableOff = cfb.tableBytes.length;
     const newClx = { fc: tableOff, lcb: clxBytes.length };
     newTableBytes.set(clxBytes, tableOff);
@@ -23871,20 +24970,30 @@ function writeOleDocParagraphEdit(docBytes, paragraphIndex, text2) {
       plcfbteChpx: newChpxBteFcLcb,
       plcfbtePapx: newPapxBteFcLcb
     });
-    return cfb.rewrap(newWordDoc, newTableBytes);
-  } catch {
-    return docBytes;
+    return { status: "edited", strategy: "piece-append", bytes: cfb.rewrap(newWordDoc, newTableBytes) };
+  } catch (error) {
+    if (error instanceof UnsupportedDocFieldEditError)
+      return rejected("unsupported-features");
+    if (error instanceof DocResourceLimitError)
+      return rejected("resource-limit");
+    if (error instanceof DocCfbRewriteError)
+      return rejected("unsupported-container");
+    return rejected("invalid-document");
   }
 }
-var RISKY_PLCF_INDICES, RISKY_STTB_INDICES;
+var RISKY_PLCF_INDICES, RISKY_STTB_INDICES, SAFE_EXTENDED_FC_LCB_INDICES, DEFAULT_OLE_DOC_PROCESSING_LIMITS;
 var init_ole_document_doc_editor = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-editor.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-editor.js"() {
     init_ole_document_doc_cfb();
     init_ole_document_doc_fib();
     init_ole_document_doc_fkp();
     init_ole_document_doc_pieces();
-    RISKY_PLCF_INDICES = [3, 4, 5, 16, 17, 18, 19, 20];
+    init_ole_document_doc_cp1252();
+    init_ole_document_doc_fields();
+    RISKY_PLCF_INDICES = [2, 3, 4, 5, 17, 18, 19, 20, 40, 41, 42, 43, 46, 47, 48, 54, 55, 56, 57, 58, 59, 75, 76, 89, 90];
     RISKY_STTB_INDICES = [21, 22, 23];
+    SAFE_EXTENDED_FC_LCB_INDICES = /* @__PURE__ */ new Set([93, 94, 113, 181, 182]);
+    DEFAULT_OLE_DOC_PROCESSING_LIMITS = Object.freeze({ maxCharacters: 16777216, maxPieces: 65536, maxFieldRecords: 65536 });
   }
 });
 
@@ -23978,7 +25087,7 @@ var init_ole_nested_deck_editor = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js
 function crc32(bytes) {
   let crc = 4294967295;
   for (let i2 = 0; i2 < bytes.length; i2++) {
@@ -24088,7 +25197,7 @@ function decodePngDimensions(png) {
 }
 var CRC_TABLE, PNG_SIGNATURE;
 var init_png_encoder = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/png-encoder.js"() {
     CRC_TABLE = (() => {
       const table = new Uint32Array(256);
       for (let n = 0; n < 256; n++) {
@@ -44746,7 +45855,7 @@ var init_encryption_detection = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js
 function getSubtle() {
   if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle) {
     return globalThis.crypto.subtle;
@@ -44864,7 +45973,7 @@ async function hmac(algorithm, key2, data) {
   return new Uint8Array(result);
 }
 var init_ooxml_crypto_primitives = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js"() {
   }
 });
 
@@ -46407,7 +47516,7 @@ var init_md2 = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js
 function rotl32(x, n) {
   return (x << n | x >>> 32 - n) >>> 0;
 }
@@ -46467,11 +47576,11 @@ function mdStyleDigest(message, initialState, transform6) {
   return out;
 }
 var init_bit_ops = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/bit-ops.js"() {
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js
 function f1(x, y, z) {
   return x & y | ~x & z;
 }
@@ -46495,7 +47604,7 @@ function md4(message) {
 }
 var INITIAL_STATE, K22, K3, ROUND1, ROUND2, ROUND3;
 var init_md4 = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/digests/md4.js"() {
     init_bit_ops();
     INITIAL_STATE = [1732584193, 4023233417, 2562383102, 271733878];
     K22 = 1518500249;
@@ -108825,7 +109934,7 @@ var init_metro_blob_collect = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js
 function record(recType, data, recInstance = 0, isContainer2 = false, recVer = 0) {
   const header = new Uint8Array(8);
   const view = new DataView(header.buffer);
@@ -108840,7 +109949,7 @@ function record(recType, data, recInstance = 0, isContainer2 = false, recVer = 0
 }
 var ByteWriter;
 var init_byte_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/byte-writer.js"() {
     ByteWriter = class {
       chunks = [];
       length = 0;
@@ -108923,13 +110032,13 @@ var init_byte_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js
 function masterToEmu(mu) {
   return Math.round(mu * EMU_PER_MASTER);
 }
 var RT, OA, TEXT_TYPE, HEADER_TOKEN_PLAIN, HEADER_TOKEN_ENCRYPTED, EMU_PER_MASTER;
 var init_legacy_ppt_record_types = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-types.js"() {
     RT = {
       Document: 1e3,
       DocumentAtom: 1001,
@@ -109058,14 +110167,14 @@ var init_legacy_ppt_record_types = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js
 var init_record_types = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-types.js"() {
     init_legacy_ppt_record_types();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js
 function buildCurrentUserStream(offsetToCurrentEdit, encrypted) {
   const nameBytes = new ByteWriter().ansi(USER_NAME).toBytes();
   const data = new ByteWriter().u32(20).u32(encrypted ? HEADER_TOKEN_ENCRYPTED : HEADER_TOKEN_PLAIN).u32(offsetToCurrentEdit).u16(nameBytes.length).u16(1012).u8(3).u8(0).bytes(new Uint8Array(2)).bytes(nameBytes).u32(8).toBytes();
@@ -109079,7 +110188,7 @@ function buildCurrentUserStream(offsetToCurrentEdit, encrypted) {
 }
 var USER_NAME, CURRENT_USER_STREAM_SIZE;
 var init_current_user_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/current-user-writer.js"() {
     init_record_types();
     init_byte_writer();
     USER_NAME = "pptx-viewer";
@@ -109087,7 +110196,7 @@ var init_current_user_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js
 function pictureUid(picture) {
   return md4(picture.bytes);
 }
@@ -109110,7 +110219,7 @@ function buildFbse(picture, uid, foDelay, size) {
 }
 var MSOBLIP_PICT, BLIP_INFO;
 var init_blip_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/blip-writer.js"() {
     init_md4();
     init_png_encoder();
     init_record_types();
@@ -109126,7 +110235,7 @@ var init_blip_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js
 function boolPropValue(flag, bit, useBit) {
   return useBit | (flag ? bit : 0);
 }
@@ -109162,7 +110271,7 @@ function buildMetroBlobTertiaryFopt(metroBlob) {
 }
 var OPT, FBID_FLAG, METRO_BLOB_OPID;
 var init_fopt_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/fopt-writer.js"() {
     init_record_types();
     init_byte_writer();
     OPT = {
@@ -109190,7 +110299,7 @@ var init_fopt_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js
 function buildDggDefaultProperties() {
   return buildFopt([
     { id: 385, value: 134217732 },
@@ -109248,7 +110357,7 @@ function buildPictureStore(pictures, shapesPerDrawing) {
 }
 var SHAPE_ID_CLUSTER_SIZE;
 var init_bstore_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/bstore-writer.js"() {
     init_record_types();
     init_blip_writer();
     init_byte_writer();
@@ -109257,7 +110366,7 @@ var init_bstore_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js
 function buildFontEntityAtom(name, index) {
   const nameBytes = new ByteWriter().utf16(name.slice(0, 31)).u16(0).toBytes();
   const padded = new Uint8Array(LF_FACE_NAME_BYTES);
@@ -109285,14 +110394,14 @@ function buildEnvironment(fonts, otherTextStyle) {
 }
 var LF_FACE_NAME_BYTES;
 var init_font_collection_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/font-collection-writer.js"() {
     init_record_types();
     init_byte_writer();
     LF_FACE_NAME_BYTES = 64;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js
 function emuToMaster(emu2) {
   return Math.round(emu2 / EMU_PER_MASTER);
 }
@@ -109348,7 +110457,7 @@ function buildDocumentContainer(input) {
 }
 var MASTER_SLIDE_ID_SENTINEL, RT_CSTRING, RT_BINARY_TAG_DATA_BLOB;
 var init_document_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_font_collection_writer();
@@ -109358,7 +110467,7 @@ var init_document_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js
 function buildCString(text2, recInstance) {
   return record(RT.CString, new ByteWriter().utf16(text2).toBytes(), recInstance, false, 0);
 }
@@ -109494,7 +110603,7 @@ function buildTextInteractiveInfoAtom(beginChar, endChar) {
 }
 var II_ACTION, II_JUMP, LT, FLAG_CUSTOM_SHOW_RETURN, HyperlinkCollector;
 var init_hyperlink_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/hyperlink-writer.js"() {
     init_record_types();
     init_byte_writer();
     II_ACTION = {
@@ -109557,7 +110666,7 @@ var init_hyperlink_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js
 function buildCString2(text2, recInstance) {
   return record(RT.CString, new ByteWriter().utf16(text2).toBytes(), recInstance, false, 0);
 }
@@ -109593,7 +110702,7 @@ function buildMediaExObjEntries(media) {
 }
 var MediaCollector, SOUND_EXTENSION_WAV, SOUND_LENGTH_UNKNOWN;
 var init_media_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/media-writer.js"() {
     init_record_types();
     init_byte_writer();
     MediaCollector = class {
@@ -109629,7 +110738,7 @@ var init_media_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js
 function hexToBytes(hex3) {
   const out = new Uint8Array(hex3.length / 2);
   for (let i2 = 0; i2 < out.length; i2++) {
@@ -109691,7 +110800,7 @@ function buildExObjRefAtom(exObjId) {
 }
 var PACKAGE_ROOT_CLSID, COMP_OBJ_HEX, EX_OLE_EMBEDDED, DV_ASPECT_ICON, EX_OLE_SUB_DEFAULT, PACKAGER_MENU_NAME, OleCollector;
 var init_ole_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ole-writer.js"() {
     init_ole2_parser_write();
     init_record_types();
     init_byte_writer();
@@ -109751,7 +110860,7 @@ var init_ole_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js
 function buildExObjList(hyperlinks, ole, media) {
   const oleEntries = ole?.all ?? [];
   const mediaEntries = media?.all ?? [];
@@ -109778,7 +110887,7 @@ function buildExObjList(hyperlinks, ole, media) {
   return record(RT.ExternalObjectList, w.toBytes(), 0, true);
 }
 var init_ex_obj_list_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ex-obj-list-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_hyperlink_writer();
@@ -109787,7 +110896,7 @@ var init_ex_obj_list_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js
 function emuToMaster2(emu2) {
   return Math.round(emu2 / EMU_PER_MASTER);
 }
@@ -109832,7 +110941,7 @@ function buildChildAnchor(rect2) {
 }
 var INT16_MIN, INT16_MAX;
 var init_anchor_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/anchor-writer.js"() {
     init_record_types();
     init_byte_writer();
     INT16_MIN = -32768;
@@ -109840,7 +110949,7 @@ var init_anchor_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js
 function parseHex(rgb2) {
   const hex3 = (rgb2 ?? DEFAULT_RGB).replace(/^#/u, "");
   if (!/^[0-9a-fA-F]{6}$/u.test(hex3)) {
@@ -109862,12 +110971,12 @@ function encodeColorIndex(rgb2) {
 }
 var DEFAULT_RGB;
 var init_colors = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/colors.js"() {
     DEFAULT_RGB = "000000";
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js
 function writePfException(w, para) {
   let mask = 0;
   if (para.hasBullet !== void 0) {
@@ -109957,7 +111066,7 @@ function writeCfException(w, run, fontIndex) {
 }
 var ALIGN_CODE, EMU_PER_MASTER_UNIT;
 var init_text_exception_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-exception-writer.js"() {
     init_colors();
     ALIGN_CODE = {
       l: 0,
@@ -109969,7 +111078,7 @@ var init_text_exception_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js
 function joinParagraphText(body) {
   return body.paragraphs.map((p) => p.runs.map((r) => r.text).join("")).join("\r");
 }
@@ -110030,7 +111139,7 @@ function buildTextAtoms(body, fonts, hyperlinks) {
   return new ByteWriter().bytes(buildTextHeaderAtom(body.textType)).bytes(buildTextCharsAtom(text2)).bytes(buildStyleTextPropAtom(body, fontIndex)).bytes(buildRunHyperlinks(body, hyperlinks)).toBytes();
 }
 var init_text_atom_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/text-atom-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_hyperlink_writer();
@@ -110038,7 +111147,7 @@ var init_text_atom_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js
 function utf16z(text2) {
   return new ByteWriter().utf16(text2).u16(0).toBytes();
 }
@@ -110135,7 +111244,7 @@ function buildMasterPlaceholders(placeholders, allocator, fieldFontIndex) {
 }
 var FSP_FLAGS, RECTANGLE_SPT, TEXT_TYPE_TITLE, TEXT_TYPE_BODY, TEXT_TYPE_OTHER, SPECS, MASTER_PLACEHOLDER_ORDER, TITLE_PROMPT, BODY_PROMPT, DEFAULT_FRAMES;
 var init_master_placeholders_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-placeholders-writer.js"() {
     init_record_types();
     init_anchor_writer();
     init_byte_writer();
@@ -110202,18 +111311,18 @@ var init_master_placeholders_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js
 function masterStyleFonts(styles) {
   if (!styles)
     return [];
   return [styles.title, styles.body, styles.other].flatMap((levels) => levels ?? []).map((level2) => level2.run.fontName).filter((name) => Boolean(name));
 }
 var init_master_style_fonts = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-style-fonts.js"() {
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js
 function buildMasterStyleAtom(recInstance, levels, fontIndex) {
   const w = new ByteWriter().u16(levels.length);
   for (const level2 of levels) {
@@ -110244,7 +111353,7 @@ function buildMasterTextStyles(styles, fontIndex) {
 }
 var EMPTY_LEVELS, FIXED_INSTANCE_DATA;
 var init_master_text_styles_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-text-styles-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_text_exception_writer();
@@ -110260,7 +111369,7 @@ var init_master_text_styles_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js
 function fillEntries(fill) {
   if (!fill || fill.kind === "none") {
     return [{ id: OPT.fNoFillHitTest, value: boolPropValue(false, 16, 1048576) }];
@@ -110315,7 +111424,7 @@ function buildShapeFoptProps(input) {
 }
 var DASH_CODE;
 var init_shape_props_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-props-writer.js"() {
     init_colors();
     init_fopt_writer();
     DASH_CODE = {
@@ -110330,7 +111439,7 @@ var init_shape_props_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js
 function buildShapeAnchor(rect2, inGroup) {
   return inGroup ? buildChildAnchor(rect2) : buildClientAnchor(rect2);
 }
@@ -110432,7 +111541,7 @@ function buildMediaShapeContainer(media, allocator, hyperlinks, mediaEmbeds, inG
 }
 var FSP_FLAG_FLIPH, FSP_FLAG_FLIPV, FSP_FLAG_OLE_SHAPE, FSP_FLAG_CHILD, PLACEHOLDER_ID;
 var init_shape_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-writer.js"() {
     init_record_types();
     init_anchor_writer();
     init_byte_writer();
@@ -110454,7 +111563,7 @@ var init_shape_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js
 function buildFspgr(childRect) {
   return record(OA.FSPGR, buildChildAnchorData(childRect), 0, false, 1);
 }
@@ -110495,7 +111604,7 @@ function buildGroupContainer(group, fonts, allocator, hyperlinks, oleEmbeds, med
 }
 var FSP_FLAG_GROUP, FSP_FLAG_PATRIARCH, FSP_FLAG_HAVE_ANCHOR, ZERO_RECT;
 var init_group_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/group-writer.js"() {
     init_record_types();
     init_anchor_writer();
     init_byte_writer();
@@ -110507,10 +111616,10 @@ var init_group_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js
 var ShapeIdAllocator2;
 var init_shape_id_allocator = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/shape-id-allocator.js"() {
     ShapeIdAllocator2 = class {
       current;
       constructor(drawingId, clusterSize) {
@@ -110536,7 +111645,7 @@ var init_shape_id_allocator = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js
 function buildDg(drawingId, shapeCount, lastShapeId) {
   const data = new ByteWriter().u32(shapeCount + 1).u32(lastShapeId).toBytes();
   return record(OA.Dg, data, drawingId, false, 0);
@@ -110567,7 +111676,7 @@ function buildDrawing(canvasRect, shapes, backgroundRgb, fonts, drawingId, hyper
 }
 var FSP_FLAG_BACKGROUND, BACKGROUND_RECT_SPT, SHAPE_ID_CLUSTER_SIZE2;
 var init_drawing_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/drawing-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_colors();
@@ -110580,7 +111689,7 @@ var init_drawing_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js
 function buildNotesAtom(slidePersistIdRef) {
   const data = new ByteWriter().i32(slidePersistIdRef).u16(0).u16(0).toBytes();
   return record(RT.NotesAtom, data, 0, false, 1);
@@ -110598,16 +111707,16 @@ function buildNotesContainer(paragraphs, notesRect, slidePersistIdRef, fonts, dr
   return record(RT.Notes, data, 0, true);
 }
 var init_notes_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/notes-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_drawing_writer();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js
 function readRecord(view, offset) {
-  if (offset < 0 || offset + RECORD_HEADER_SIZE > view.byteLength) {
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset + RECORD_HEADER_SIZE > view.byteLength) {
     return void 0;
   }
   const verAndInstance = view.getUint16(offset, true);
@@ -110635,6 +111744,9 @@ function isContainer(rec) {
   return rec.recVer === 15;
 }
 function* iterateRecords(view, start, end) {
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) {
+    return;
+  }
   let offset = start;
   const limit = Math.min(end, view.byteLength);
   while (offset + RECORD_HEADER_SIZE <= limit) {
@@ -110661,16 +111773,19 @@ function findChild4(view, container2, recType, recInstance) {
   return void 0;
 }
 function findDescendant(view, container2, recType, recInstance) {
-  for (const child27 of iterateChildren(view, container2)) {
+  const stack = [iterateChildren(view, container2)];
+  while (stack.length > 0) {
+    const next = stack[stack.length - 1].next();
+    if (next.done) {
+      stack.pop();
+      continue;
+    }
+    const child27 = next.value;
     if (child27.recType === recType && (recInstance === void 0)) {
       return child27;
     }
-    if (isContainer(child27)) {
-      const found = findDescendant(view, child27, recType, recInstance);
-      if (found) {
-        return found;
-      }
-    }
+    if (isContainer(child27))
+      stack.push(iterateChildren(view, child27));
   }
   return void 0;
 }
@@ -110679,7 +111794,7 @@ function recordBytes(data, rec) {
 }
 var PptParseError, RECORD_HEADER_SIZE;
 var init_legacy_ppt_record_stream = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-record-stream.js"() {
     PptParseError = class extends Error {
       constructor(message) {
         super(message);
@@ -110690,14 +111805,14 @@ var init_legacy_ppt_record_stream = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js
 var init_record_stream = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/record-stream.js"() {
     init_legacy_ppt_record_stream();
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js
 function toHex3(r, g2, b) {
   return [r, g2, b].map((v) => (v & 255).toString(16).padStart(2, "0").toUpperCase()).join("");
 }
@@ -110748,7 +111863,7 @@ function resolveEscherColor(colorRef, scheme) {
 }
 var SCHEME, DEFAULT_SCHEME;
 var init_color_scheme = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/color-scheme.js"() {
     init_record_stream();
     init_record_types();
     SCHEME = {
@@ -110774,7 +111889,7 @@ var init_color_scheme = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js
 function buildColorSchemeAtom(recInstance = 1, colors) {
   const w = new ByteWriter();
   for (const rgb2 of colors?.length === 8 ? colors : DEFAULT_SCHEME) {
@@ -110783,7 +111898,7 @@ function buildColorSchemeAtom(recInstance = 1, colors) {
   return record(RT.ColorSchemeAtom, w.toBytes(), recInstance, false, 0);
 }
 var init_color_scheme_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/color-scheme-writer.js"() {
     init_color_scheme();
     init_record_types();
     init_byte_writer();
@@ -110791,7 +111906,7 @@ var init_color_scheme_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js
 function buildSlideAtomRaw(geom, masterIdRef, notesIdRef, flags) {
   const data = new ByteWriter().i32(geom).bytes(new Uint8Array(8)).u32(masterIdRef).i32(notesIdRef).u16(flags).u16(0).toBytes();
   return record(RT.SlideAtom, data, 0, false, 2);
@@ -110828,7 +111943,7 @@ function buildMainMasterContainer(slideRect, drawingId, hyperlinks, oleEmbeds, m
 }
 var SLIDE_FLAG_MASTER_OBJECTS, SLIDE_FLAG_MASTER_SCHEME, SLIDE_FLAG_MASTER_BACKGROUND, SLIDE_MASTER_ID_SENTINEL, MASTER_FIRST_COLOR_SCHEME_INSTANCE;
 var init_slide_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/slide-writer.js"() {
     init_record_types();
     init_byte_writer();
     init_color_scheme_writer();
@@ -110843,7 +111958,7 @@ var init_slide_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js
 function masterSlideId(index) {
   return MASTER_SLIDE_ID_SENTINEL + index;
 }
@@ -110967,7 +112082,7 @@ function ensureMinimumDocumentStreamSize(contentSizeWithoutPadding, maxPersistId
 }
 var DOC_ID, MASTER_ID;
 var init_document_stream_layout = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/document-stream-layout.js"() {
     init_bstore_writer();
     init_byte_writer();
     init_document_writer();
@@ -110985,15 +112100,15 @@ var init_document_stream_layout = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js
 var RC4_ALG_ID2;
 var init_crypto_constants = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/crypto-constants.js"() {
     RC4_ALG_ID2 = 26625;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js
 function rc4Cipher(key2, data) {
   if (key2.length === 0) {
     throw new Error("RC4 key must not be empty.");
@@ -111024,11 +112139,11 @@ function rc4Cipher(key2, data) {
   return out;
 }
 var init_rc4_cipher = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/rc4-cipher.js"() {
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js
 async function rc4CryptoApiKeyBase(password, salt) {
   return hash("SHA-1", concatArrays(salt, encodePasswordUtf16LE(password)));
 }
@@ -111069,14 +112184,14 @@ async function rc4CryptoApiEncryptVerifier(key0, verifier) {
 }
 var PADDED_40_BIT_KEY_BYTES;
 var init_rc4_cryptoapi_key = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-key.js"() {
     init_ooxml_crypto_primitives();
     init_rc4_cipher();
     PADDED_40_BIT_KEY_BYTES = 16;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js
 function readHeader(bytes) {
   const view = new DataView(bytes.buffer, bytes.byteOffset, RECORD_HEADER_SIZE);
   return {
@@ -111145,7 +112260,7 @@ async function cipherPicturesStream(stream, keyFor3, mode) {
 }
 var UID_SIZE, METAFILE_HEADER_SIZE, BITMAP_TAG_SIZE, METAFILE_BLIPS, BITMAP_BLIPS;
 var init_rc4_cryptoapi_streams = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/rc4-cryptoapi-streams.js"() {
     init_rc4_cipher();
     init_record_stream();
     UID_SIZE = 16;
@@ -111156,7 +112271,7 @@ var init_rc4_cryptoapi_streams = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js
 async function buildCryptSession(password) {
   const salt = new Uint8Array(SALT_SIZE);
   crypto.getRandomValues(salt);
@@ -111184,7 +112299,7 @@ async function encryptPicturesStream(stream, ctx) {
 }
 var CSP_NAME, KEY_SIZE_BITS, SALT_SIZE, VERIFIER_SIZE, VERIFIER_HASH_SIZE, ENCRYPTION_FLAGS;
 var init_encrypt_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/encrypt-writer.js"() {
     init_crypto_constants();
     init_rc4_cryptoapi_key();
     init_rc4_cryptoapi_streams();
@@ -111199,7 +112314,7 @@ var init_encrypt_writer = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js
 function levelsFor(styles, textType) {
   switch (textType) {
     case 0:
@@ -111265,12 +112380,12 @@ function withMasterRelativeRunStyles(deck) {
 }
 var STYLE_KEYS;
 var init_master_relative_runs = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/master-relative-runs.js"() {
     STYLE_KEYS = ["bold", "italic", "underline"];
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js
 function buildPersistDirectoryAtom(entries) {
   const sorted = [...entries].sort((a, b) => a[0] - b[0]);
   const w = new ByteWriter();
@@ -111300,17 +112415,17 @@ function buildEncryptedUserEditAtom(input) {
 }
 var MAX_RUN;
 var init_persist_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/persist-writer.js"() {
     init_record_types();
     init_byte_writer();
     MAX_RUN = 4095;
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js
 var PPT_STORAGE_CLSID;
 var init_ppt_clsid = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/ppt-clsid.js"() {
     PPT_STORAGE_CLSID = new Uint8Array([
       16,
       141,
@@ -111332,7 +112447,7 @@ var init_ppt_clsid = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js
 async function finishUnencrypted(layout, lastSlideId) {
   const w = new ByteWriter().append(layout.bytes);
   const dirAtom = buildPersistDirectoryAtom(layout.offsets);
@@ -111386,7 +112501,7 @@ async function buildPptFile(deck, options = {}) {
   return new Uint8Array(buildOle2(streams2, PPT_STORAGE_CLSID, 0));
 }
 var init_write_ppt = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/writer/write-ppt.js"() {
     init_ole2_parser_write();
     init_byte_writer();
     init_current_user_writer();
@@ -111398,9 +112513,9 @@ var init_write_ppt = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js
 var init_legacy_ppt_writer = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/legacy-ppt-writer.js"() {
     init_write_ppt();
     init_master_style_fonts();
   }
@@ -151283,61 +152398,115 @@ var init_deflate_utils = __esm({
   }
 });
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js
-function parseUserEditAtom(view, offset) {
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js
+function checkedLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1)
+    throw new PptParseError("Invalid persist directory resource limit");
+  return value;
+}
+function boundedAtom(view, offset, type) {
   const rec = readRecordOrThrow(view, offset);
-  if (rec.recType !== RT.UserEditAtom) {
-    throw new PptParseError(`Expected UserEditAtom at offset ${offset}, found recType 0x${rec.recType.toString(16)}`);
+  if (rec.recType !== type || rec.recVer !== 0 || rec.recInstance !== 0) {
+    throw new PptParseError(`Invalid persist atom header at offset ${offset}`);
+  }
+  if (rec.recLen > view.byteLength - rec.dataOffset) {
+    throw new PptParseError(`Persist atom payload out of bounds at offset ${offset}`);
   }
+  return rec;
+}
+function parseUserEditAtom(view, offset) {
+  const rec = boundedAtom(view, offset, RT.UserEditAtom);
   if (rec.recLen !== 28 && rec.recLen !== 32) {
     throw new PptParseError(`UserEditAtom has invalid length ${rec.recLen}`);
   }
   const d = rec.dataOffset;
-  return {
+  const edit = {
     offsetLastEdit: view.getUint32(d + 8, true),
     offsetPersistDirectory: view.getUint32(d + 12, true),
     docPersistIdRef: view.getUint32(d + 16, true),
     encryptSessionPersistIdRef: rec.recLen === 32 ? view.getUint32(d + 28, true) : void 0
   };
-}
-function parsePersistDirectoryAtom(view, offset) {
-  const rec = readRecordOrThrow(view, offset);
-  if (rec.recType !== RT.PersistDirectoryAtom) {
-    throw new PptParseError(`Expected PersistDirectoryAtom at offset ${offset}, found recType 0x${rec.recType.toString(16)}`);
+  if (view.getUint8(d + 6) !== 0 || view.getUint8(d + 7) !== 3) {
+    throw new PptParseError("Unsupported UserEditAtom storage version");
+  }
+  if (edit.offsetLastEdit >= offset || edit.offsetPersistDirectory <= edit.offsetLastEdit || edit.offsetPersistDirectory >= offset) {
+    throw new PptParseError("Invalid UserEditAtom save history offsets");
   }
+  if (edit.docPersistIdRef !== 1)
+    throw new PptParseError("Invalid document persist identifier");
+  return edit;
+}
+function parsePersistDirectoryAtom(view, offset, maxEntries = DEFAULT_MAX_ENTRIES) {
+  checkedLimit(maxEntries);
+  const rec = boundedAtom(view, offset, RT.PersistDirectoryAtom);
   const pairs = [];
   let pos2 = rec.dataOffset;
   const end = rec.dataOffset + rec.recLen;
-  while (pos2 + 4 <= end) {
+  const seen = /* @__PURE__ */ new Set();
+  while (pos2 < end) {
+    if (end - pos2 < 4)
+      throw new PptParseError("Truncated persist directory entry");
     const packed = view.getUint32(pos2, true);
     const persistId = packed & 1048575;
     const cPersist = packed >>> 20 & 4095;
     pos2 += 4;
-    for (let i2 = 0; i2 < cPersist && pos2 + 4 <= end; i2++, pos2 += 4) {
-      pairs.push([persistId + i2, view.getUint32(pos2, true)]);
+    if (persistId > 1048574 || cPersist === 0 || persistId + cPersist - 1 > 1048575) {
+      throw new PptParseError("Invalid persist identifier run");
+    }
+    if (cPersist * 4 > end - pos2)
+      throw new PptParseError("Truncated persist offset run");
+    if (pairs.length + cPersist > maxEntries)
+      throw new PptParseError("Persist directory entry limit exceeded");
+    for (let i2 = 0; i2 < cPersist; i2++, pos2 += 4) {
+      const id = persistId + i2;
+      if (seen.has(id))
+        throw new PptParseError("Duplicate persist identifier");
+      seen.add(id);
+      const objectOffset = view.getUint32(pos2, true);
+      if (objectOffset >= offset || objectOffset + 8 > view.byteLength)
+        throw new PptParseError("Persist object offset out of bounds");
+      pairs.push([id, objectOffset]);
     }
   }
   return pairs;
 }
-function buildPersistDirectory(view, offsetToCurrentEdit) {
+function buildPersistDirectory(view, offsetToCurrentEdit, limits = {}) {
+  const maxEdits = checkedLimit(limits.maxEdits ?? DEFAULT_MAX_EDITS);
+  const maxEntries = checkedLimit(limits.maxEntries ?? DEFAULT_MAX_ENTRIES);
   const edits = [];
+  const editOffsets = [];
   const seen = /* @__PURE__ */ new Set();
   let offset = offsetToCurrentEdit;
   while (offset !== 0) {
+    if (edits.length >= maxEdits)
+      throw new PptParseError("User edit chain limit exceeded");
     if (seen.has(offset)) {
       throw new PptParseError(`Circular UserEditAtom chain at offset ${offset}`);
     }
     seen.add(offset);
     const edit = parseUserEditAtom(view, offset);
     edits.push(edit);
+    editOffsets.push(offset);
     offset = edit.offsetLastEdit;
   }
   if (edits.length === 0) {
     throw new PptParseError("No UserEditAtom found");
   }
   const directory = /* @__PURE__ */ new Map();
+  let entryCount = 0;
   for (let i2 = edits.length - 1; i2 >= 0; i2--) {
-    for (const [id, off] of parsePersistDirectoryAtom(view, edits[i2].offsetPersistDirectory)) {
+    const edit = edits[i2];
+    const dirAtom = boundedAtom(view, edit.offsetPersistDirectory, RT.PersistDirectoryAtom);
+    const editOffset = editOffsets[i2];
+    if (dirAtom.dataOffset + dirAtom.recLen > editOffset)
+      throw new PptParseError("Persist directory overlaps user edit");
+    const entries = parsePersistDirectoryAtom(view, edit.offsetPersistDirectory, maxEntries);
+    entryCount += entries.length;
+    if (entryCount > maxEntries)
+      throw new PptParseError("Save history persist entry limit exceeded");
+    for (const [id, off] of entries) {
+      if (off < edit.offsetLastEdit)
+        throw new PptParseError("Persist object precedes corresponding user edit");
       directory.set(id, off);
     }
   }
@@ -151348,12 +152517,18 @@ function readPersistRecord(view, directory, persistId) {
   if (offset === void 0) {
     return void 0;
   }
-  return readRecordOrThrow(view, offset);
+  const rec = readRecordOrThrow(view, offset);
+  if (rec.recLen > view.byteLength - rec.dataOffset)
+    throw new PptParseError("Persist object payload out of bounds");
+  return rec;
 }
+var DEFAULT_MAX_EDITS, DEFAULT_MAX_ENTRIES;
 var init_persist_directory = __esm({
-  "node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js"() {
+  "node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ppt/persist-directory.js"() {
     init_record_stream();
     init_record_types();
+    DEFAULT_MAX_EDITS = 1e4;
+    DEFAULT_MAX_ENTRIES = 1e6;
   }
 });