ooxml-core 0.12.0 → 0.13.0

package/dist/docx/load/index.mjs

@@ -29,7 +29,7 @@ function isOoxmlCryptoError(error) {
   return code === "password-required" || code === "incorrect-password" || code === "data-integrity";
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
 var OLE_MAGIC = new Uint8Array([208, 207, 17, 224, 161, 177, 26, 225]);
 var ENDOFCHAIN = 4294967294;
 var FREESECT = 4294967295;
@@ -47,10 +47,13 @@ var Ole2ParseError = class extends Error {
   }
 };
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-read.js
 function parseOle2(buffer) {
   const data = new Uint8Array(buffer);
   const view = new DataView(buffer);
+  if (data.length < 512) {
+    throw new Ole2ParseError("Truncated OLE2 compound file header");
+  }
   for (let i = 0; i < OLE_MAGIC.length; i++) {
     if (data[i] !== OLE_MAGIC[i]) {
       throw new Ole2ParseError("Not a valid OLE2 compound file");
@@ -64,8 +67,15 @@ function parseOle2(buffer) {
   }
   const sectorSizePower = view.getUint16(30, true);
   const miniSectorSizePower = view.getUint16(32, true);
+  if (majorVersion !== 3 && majorVersion !== 4 || sectorSizePower !== (majorVersion === 3 ? 9 : 12) || miniSectorSizePower !== 6) {
+    throw new Ole2ParseError("Unsupported OLE2 version or sector size");
+  }
   const sectorSize = 1 << sectorSizePower;
   const miniSectorSize = 1 << miniSectorSizePower;
+  if (data.length < sectorSize || data.length % sectorSize !== 0) {
+    throw new Ole2ParseError("Truncated OLE2 sector");
+  }
+  const sectorCount = data.length / sectorSize - 1;
   const totalFATSectors = view.getUint32(44, true);
   const firstDirectorySector = view.getUint32(48, true);
   const miniStreamCutoff = view.getUint32(56, true);
@@ -73,6 +83,9 @@ function parseOle2(buffer) {
   const totalMiniFATSectors = view.getUint32(64, true);
   const firstDIFATSector = view.getUint32(68, true);
   const totalDIFATSectors = view.getUint32(72, true);
+  if (totalFATSectors > sectorCount || totalMiniFATSectors > sectorCount || totalDIFATSectors > sectorCount) {
+    throw new Ole2ParseError("Allocation table count exceeds file size");
+  }
   function sectorOffset(sector) {
     return (sector + 1) * sectorSize;
   }
@@ -91,7 +104,11 @@ function parseOle2(buffer) {
     }
   }
   let difatSector = firstDIFATSector;
+  const difatSeen = /* @__PURE__ */ new Set();
   for (let d = 0; d < totalDIFATSectors && difatSector <= MAXREGSECT; d++) {
+    if (difatSeen.has(difatSector))
+      throw new Ole2ParseError("Circular DIFAT chain");
+    difatSeen.add(difatSector);
     const difatData = readSector(difatSector);
     const difatView = new DataView(difatData.buffer, difatData.byteOffset, difatData.byteLength);
     const entriesPerSector = (sectorSize - 4) / 4;
@@ -103,11 +120,14 @@ function parseOle2(buffer) {
     }
     difatSector = difatView.getUint32(sectorSize - 4, true);
   }
+  if (difatSeen.size !== totalDIFATSectors || fatSectors.length !== totalFATSectors || new Set(fatSectors).size !== fatSectors.length || fatSectors.some((id) => difatSeen.has(id))) {
+    throw new Ole2ParseError("Invalid DIFAT allocation table");
+  }
   const fatEntries = [];
   for (const fatSector of fatSectors) {
     const fatData = readSector(fatSector);
     const fatView = new DataView(fatData.buffer, fatData.byteOffset, fatData.byteLength);
-    for (let i = 0; i < sectorSize / 4; i++) {
+    for (let i = 0; i < sectorSize / 4 && fatEntries.length < sectorCount; i++) {
       fatEntries.push(fatView.getUint32(i * 4, true));
     }
   }
@@ -121,8 +141,12 @@ function parseOle2(buffer) {
       }
       visited.add(current);
       sectors.push(readSector(current));
-      current = fatEntries[current] ?? ENDOFCHAIN;
+      if (fatEntries[current] === void 0)
+        throw new Ole2ParseError("Missing FAT chain entry");
+      current = fatEntries[current];
     }
+    if (current !== ENDOFCHAIN)
+      throw new Ole2ParseError("Invalid FAT chain terminator");
     const totalLength = sectors.length * sectorSize;
     const result = new Uint8Array(totalLength);
     let offset = 0;
@@ -133,16 +157,14 @@ function parseOle2(buffer) {
     return result;
   }
   function readStream(startSector, size) {
+    if (size === 0)
+      return new Uint8Array(0);
+    if (size > sectorCount * sectorSize)
+      throw new Ole2ParseError("Stream size exceeds file size");
     const raw = readSectorChain(startSector);
-    return raw.subarray(0, Math.min(size, raw.length));
-  }
-  const miniFatEntries = [];
-  if (firstMiniFATSector <= MAXREGSECT && totalMiniFATSectors > 0) {
-    const miniFatRaw = readSectorChain(firstMiniFATSector);
-    const miniFatView = new DataView(miniFatRaw.buffer, miniFatRaw.byteOffset, miniFatRaw.byteLength);
-    for (let i = 0; i < miniFatRaw.length / 4; i++) {
-      miniFatEntries.push(miniFatView.getUint32(i * 4, true));
-    }
+    if (raw.length < size)
+      throw new Ole2ParseError("Truncated stream sector chain");
+    return raw.subarray(0, size);
   }
   const dirRaw = readSectorChain(firstDirectorySector);
   const numEntries = Math.floor(dirRaw.length / DIR_ENTRY_SIZE);
@@ -155,6 +177,9 @@ function parseOle2(buffer) {
     if (objectType === ENTRY_TYPE_EMPTY) {
       continue;
     }
+    if (nameLen < 2 || nameLen > 64 || nameLen % 2 !== 0 || entryView.getUint16(nameLen - 2, true) !== 0) {
+      throw new Ole2ParseError("Invalid directory entry name");
+    }
     const nameBytes = Math.max(0, nameLen - 2);
     let name = "";
     for (let j = 0; j < nameBytes; j += 2) {
@@ -168,8 +193,11 @@ function parseOle2(buffer) {
     const sizeLow = entryView.getUint32(120, true);
     let size = sizeLow;
     if (majorVersion === 4) {
-      entryView.getUint32(124, true);
-      size = sizeLow;
+      const sizeHigh = entryView.getUint32(124, true);
+      size = sizeLow + sizeHigh * 4294967296;
+      if (!Number.isSafeInteger(size) || size > sectorCount * sectorSize) {
+        throw new Ole2ParseError("Stream size exceeds supported file bounds");
+      }
     }
     entries.push({
       name,
@@ -183,11 +211,28 @@ function parseOle2(buffer) {
     });
   }
   const rootEntry = entries.find((e) => e.type === ENTRY_TYPE_ROOT);
+  if (!rootEntry || entries.filter((e) => e.type === ENTRY_TYPE_ROOT).length !== 1) {
+    throw new Ole2ParseError("Invalid root directory entry");
+  }
   let miniStreamData;
   if (rootEntry && rootEntry.startSector <= MAXREGSECT) {
-    miniStreamData = readSectorChain(rootEntry.startSector);
+    miniStreamData = readStream(rootEntry.startSector, rootEntry.size);
+  }
+  const miniFatEntries = [];
+  if (firstMiniFATSector <= MAXREGSECT && totalMiniFATSectors > 0) {
+    const miniFatRaw = readSectorChain(firstMiniFATSector);
+    if (miniFatRaw.length !== totalMiniFATSectors * sectorSize) {
+      throw new Ole2ParseError("Unexpected mini FAT chain length");
+    }
+    const miniFatView = new DataView(miniFatRaw.buffer, miniFatRaw.byteOffset, miniFatRaw.byteLength);
+    const miniCapacity = Math.floor((miniStreamData?.length ?? 0) / miniSectorSize);
+    for (let i = 0; i < miniFatRaw.length / 4 && i < miniCapacity; i++) {
+      miniFatEntries.push(miniFatView.getUint32(i * 4, true));
+    }
   }
   function readMiniStream(startSector, size) {
+    if (size === 0)
+      return new Uint8Array(0);
     if (!miniStreamData) {
       throw new Ole2ParseError("Mini stream container not found");
     }
@@ -200,17 +245,24 @@ function parseOle2(buffer) {
       }
       visited.add(current);
       const offset2 = current * miniSectorSize;
+      if (offset2 + miniSectorSize > miniStreamData.length || miniFatEntries[current] === void 0) {
+        throw new Ole2ParseError("Mini stream sector exceeds allocation bounds");
+      }
       sectors.push(miniStreamData.subarray(offset2, offset2 + miniSectorSize));
-      current = miniFatEntries[current] ?? ENDOFCHAIN;
+      current = miniFatEntries[current];
     }
+    if (current !== ENDOFCHAIN)
+      throw new Ole2ParseError("Invalid mini FAT chain terminator");
     const totalLength = sectors.length * miniSectorSize;
+    if (totalLength < size)
+      throw new Ole2ParseError("Truncated mini stream sector chain");
     const result = new Uint8Array(totalLength);
     let offset = 0;
     for (const sector of sectors) {
       result.set(sector, offset);
       offset += miniSectorSize;
     }
-    return result.subarray(0, Math.min(size, result.length));
+    return result.subarray(0, size);
   }
   function getStream(name) {
     const entry = entries.find((e) => (e.type === ENTRY_TYPE_STREAM || e.type === ENTRY_TYPE_ROOT) && e.name === name);
@@ -225,7 +277,7 @@ function parseOle2(buffer) {
   return { entries, getStream };
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/utils/ooxml-crypto-primitives.js
 function getSubtle() {
   if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle) {
     return globalThis.crypto.subtle;
@@ -1111,13 +1163,16 @@ function isEncryptedOoxmlPackage(input) {
   }
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-helpers.js
 function compareDirEntryNames(a, b) {
+  const ua = a.toUpperCase();
+  const ub = b.toUpperCase();
+  if (ua.length !== a.length || ub.length !== b.length) {
+    throw new Error("CFB stream names with expanding uppercase mappings are unsupported");
+  }
   if (a.length !== b.length) {
     return a.length - b.length;
   }
-  const ua = a.toUpperCase();
-  const ub = b.toUpperCase();
   for (let i = 0; i < ua.length; i++) {
     const diff = ua.charCodeAt(i) - ub.charCodeAt(i);
     if (diff !== 0) {
@@ -1134,9 +1189,27 @@ function encodeName(name) {
   }
   return bytes;
 }
-function writeFatChain(fat, chain) {
-  for (let i = 0; i < chain.sectors.length; i++) {
-    fat[chain.sectors[i]] = i < chain.sectors.length - 1 ? chain.sectors[i + 1] : ENDOFCHAIN;
+function buildDirectoryTree(entryCount) {
+  const links = /* @__PURE__ */ new Map();
+  let redLevel = 0;
+  for (let remaining = entryCount - 2; remaining >= 0; remaining = Math.floor(remaining / 2) - 1)
+    redLevel++;
+  const build = (low, high, level) => {
+    if (low > high)
+      return 4294967295;
+    const id = Math.floor((low + high) / 2);
+    links.set(id, {
+      left: build(low, id - 1, level + 1),
+      right: build(id + 1, high, level + 1),
+      color: level === redLevel ? 0 : 1
+    });
+    return id;
+  };
+  return { root: build(1, entryCount - 1, 0), links };
+}
+function writeFatChain(fat, chain2) {
+  for (let i = 0; i < chain2.sectors.length; i++) {
+    fat[chain2.sectors[i]] = i < chain2.sectors.length - 1 ? chain2.sectors[i + 1] : ENDOFCHAIN;
   }
 }
 function writeFatRun(fat, firstSector, count) {
@@ -1157,7 +1230,7 @@ function writeInt32Sectors(outBytes, int32Data, firstSector, numSectors, sectorS
   }
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write-serialize.js
 function writeHeader(outView, outBytes, params) {
   outBytes.set(OLE_MAGIC, 0);
   outView.setUint16(24, 62, true);
@@ -1215,6 +1288,7 @@ function writeDifatSectors(outView, params) {
 function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
   const dirData = new Uint8Array(numDirSectors * sectorSize);
   const dirView = new DataView(dirData.buffer);
+  const tree = buildDirectoryTree(dirEntries.length);
   for (let i = 0; i < dirEntries.length; i++) {
     const entry = dirEntries[i];
     const entryOffset = i * DIR_ENTRY_SIZE;
@@ -1222,17 +1296,17 @@ function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
     dirData.set(nameBytes.subarray(0, Math.min(nameBytes.length, 64)), entryOffset);
     dirView.setUint16(entryOffset + 64, Math.min((entry.name.length + 1) * 2, 64), true);
     dirData[entryOffset + 66] = entry.type;
-    dirData[entryOffset + 67] = 1;
+    dirData[entryOffset + 67] = i === 0 ? 1 : tree.links.get(i).color;
     if (entry.clsid) {
       dirData.set(entry.clsid.subarray(0, 16), entryOffset + 80);
     }
     if (i === 0) {
       dirView.setUint32(entryOffset + 68, 4294967295, true);
       dirView.setUint32(entryOffset + 72, 4294967295, true);
-      dirView.setUint32(entryOffset + 76, dirEntries.length > 1 ? 1 : 4294967295, true);
+      dirView.setUint32(entryOffset + 76, tree.root, true);
     } else {
-      dirView.setUint32(entryOffset + 68, 4294967295, true);
-      dirView.setUint32(entryOffset + 72, i + 1 < dirEntries.length ? i + 1 : 4294967295, true);
+      dirView.setUint32(entryOffset + 68, tree.links.get(i).left, true);
+      dirView.setUint32(entryOffset + 72, tree.links.get(i).right, true);
       dirView.setUint32(entryOffset + 76, 4294967295, true);
     }
     dirView.setUint32(entryOffset + 116, entry.startSector, true);
@@ -1240,19 +1314,32 @@ function serializeDirectoryEntries(dirEntries, numDirSectors, sectorSize) {
   }
   return dirData;
 }
-function writeStreamSectors(outBytes, streamData, chain, sectorSize) {
-  for (let i = 0; i < chain.sectors.length; i++) {
-    const sectorOffset = (chain.sectors[i] + 1) * sectorSize;
+function writeStreamSectors(outBytes, streamData, chain2, sectorSize) {
+  for (let i = 0; i < chain2.sectors.length; i++) {
+    const sectorOffset = (chain2.sectors[i] + 1) * sectorSize;
     const srcOffset = i * sectorSize;
     const srcEnd = Math.min(srcOffset + sectorSize, streamData.length);
     outBytes.set(streamData.subarray(srcOffset, srcEnd), sectorOffset);
   }
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-parser-write.js
 function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   const sectorSize = 512;
   const miniSectorSize = 64;
+  const names = [...streams2.keys()].sort(compareDirEntryNames);
+  for (let i = 0; i < names.length; i++) {
+    const name = names[i];
+    if (name.toUpperCase().length !== name.length) {
+      throw new Error("CFB stream names with expanding uppercase mappings are unsupported");
+    }
+    if (!name.length || name.length > 31 || /[\x00\\/:!]/.test(name)) {
+      throw new Error("CFB stream names must be 1-31 UTF-16 code units without NUL, \\, /, :, or !");
+    }
+    if (i > 0 && compareDirEntryNames(names[i - 1], name) === 0) {
+      throw new Error("Duplicate CFB stream names");
+    }
+  }
   const regularStreams = [];
   const miniStreams = [];
   for (const [name, data] of streams2) {
@@ -1270,7 +1357,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
     for (let i = 0; i < numSectors; i++) {
       sectors.push(nextSector++);
     }
-    fatChains.set(stream.name, { start: sectors[0] ?? 0, sectors });
+    fatChains.set(stream.name, { start: sectors[0] ?? ENDOFCHAIN, sectors });
   }
   let miniStreamContainer = new Uint8Array(0);
   const miniFatChains = /* @__PURE__ */ new Map();
@@ -1293,7 +1380,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
         miniOffset += miniSectorSize;
       }
       miniFatChains.set(stream.name, {
-        start: miniSectors[0] ?? 0,
+        start: miniSectors[0] ?? ENDOFCHAIN,
         sectors: miniSectors
       });
     }
@@ -1316,20 +1403,20 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
     clsid: rootClsid
   });
   for (const stream of regularStreams) {
-    const chain = fatChains.get(stream.name);
+    const chain2 = fatChains.get(stream.name);
     dirEntries.push({
       name: stream.name,
       type: ENTRY_TYPE_STREAM,
-      startSector: chain.start,
+      startSector: chain2.start,
       size: stream.data.length
     });
   }
   for (const stream of miniStreams) {
-    const chain = miniFatChains.get(stream.name);
+    const chain2 = miniFatChains.get(stream.name);
     dirEntries.push({
       name: stream.name,
       type: ENTRY_TYPE_STREAM,
-      startSector: chain.start,
+      startSector: chain2.start,
       size: stream.data.length
     });
   }
@@ -1341,7 +1428,7 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   nextSector += numDirSectors;
   let firstMiniFATSector = ENDOFCHAIN;
   let numMiniFATSectors = 0;
-  if (miniStreams.length > 0) {
+  if (nextMiniSector > 0) {
     numMiniFATSectors = Math.ceil(nextMiniSector * 4 / sectorSize);
     firstMiniFATSector = nextSector;
     nextSector += numMiniFATSectors;
@@ -1354,8 +1441,8 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   const totalSectors = nextSector;
   const fat = new Int32Array(numFATSectors * (sectorSize / 4));
   fat.fill(-1);
-  for (const [, chain] of fatChains) {
-    writeFatChain(fat, chain);
+  for (const [, chain2] of fatChains) {
+    writeFatChain(fat, chain2);
   }
   writeFatChain(fat, { start: rootSectors[0] ?? 0, sectors: rootSectors });
   writeFatRun(fat, firstDirSector, numDirSectors);
@@ -1372,8 +1459,8 @@ function buildOle2(streams2, rootClsid, miniStreamCutoff = 4096) {
   if (miniStreams.length > 0) {
     miniFat = new Int32Array(numMiniFATSectors * (sectorSize / 4));
     miniFat.fill(-1);
-    for (const [, chain] of miniFatChains) {
-      writeFatChain(miniFat, chain);
+    for (const [, chain2] of miniFatChains) {
+      writeFatChain(miniFat, chain2);
     }
   }
   const fileSize = (totalSectors + 1) * sectorSize;
@@ -9489,7 +9576,7 @@ function createDocument() {
   };
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fib.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fib.js
 var FC_LCB_INDEX = {
   plcfbteChpx: 12,
   plcfbtePapx: 13,
@@ -9503,8 +9590,13 @@ function readDocFib(wordDoc) {
   if (wIdent !== 42476) {
     throw new Error("Not a WordDocument FIB (bad wIdent)");
   }
+  const nFibBase = view.getUint16(2, true);
+  if (![193, 217, 257, 268, 274].includes(nFibBase))
+    throw new Error("Unsupported Word FIB version");
   const flags1Offset = 10;
   const flags1 = view.getUint16(flags1Offset, true);
+  if ((flags1 & 33024) !== 0)
+    throw new Error("Encrypted or obfuscated Word document");
   const fWhichTblStm = flags1 >> 9 & 1;
   const csw = view.getUint16(32, true);
   const fibRgW97Offset = 34;
@@ -9513,6 +9605,21 @@ function readDocFib(wordDoc) {
   const fibRgLw97Offset = cslwOffset + 2;
   const cbRgFcLcbCountOffset = fibRgLw97Offset + cslw * 4;
   const fibRgFcLcbOffset = cbRgFcLcbCountOffset + 2;
+  const fibRgFcLcbCount = view.getUint16(cbRgFcLcbCountOffset, true);
+  if (csw !== 14 || cslw !== 22 || fibRgFcLcbOffset + fibRgFcLcbCount * 8 + 2 > wordDoc.length)
+    throw new Error("Truncated Word FIB arrays");
+  const cswNewOffset = fibRgFcLcbOffset + fibRgFcLcbCount * 8;
+  const cswNew = view.getUint16(cswNewOffset, true);
+  if (cswNewOffset + 2 + cswNew * 2 > wordDoc.length)
+    throw new Error("Truncated Word FIB extension");
+  const nFib = cswNew === 0 ? nFibBase : view.getUint16(cswNewOffset + 2, true);
+  const expectedCounts = /* @__PURE__ */ new Map([[193, 93], [217, 108], [257, 136], [268, 164], [274, 183]]);
+  if (expectedCounts.get(nFib) !== fibRgFcLcbCount || cswNew !== 0 && cswNew !== (nFib === 274 ? 5 : 2))
+    throw new Error("Word FIB version and array counts disagree");
+  const ccpText = view.getInt32(fibRgLw97Offset + 12, true);
+  const otherStories = [4, 5, 7, 8, 9, 10].map((i) => view.getInt32(fibRgLw97Offset + i * 4, true));
+  if (ccpText < 0 || otherStories.some((cp) => cp < 0))
+    throw new Error("Negative Word story length");
   function fcLcbPair(index) {
     const off = fibRgFcLcbOffset + index * 8;
     return { fc: view.getUint32(off, true), lcb: view.getUint32(off + 4, true) };
@@ -9520,18 +9627,22 @@ function readDocFib(wordDoc) {
   const cbMacOffset = fibRgLw97Offset + 0;
   const ccpTextOffset = fibRgLw97Offset + 12;
   return {
+    nFib,
+    nFibBase,
     flags1Offset,
     flags1,
     tableStreamName: fWhichTblStm ? "1Table" : "0Table",
     cbMacOffset,
     cbMac: view.getUint32(cbMacOffset, true),
     ccpTextOffset,
-    ccpText: view.getInt32(ccpTextOffset, true),
+    ccpText,
+    ccpOtherStories: otherStories.reduce((sum, cp) => sum + cp, 0),
     plcfbteChpx: fcLcbPair(FC_LCB_INDEX.plcfbteChpx),
     plcfbtePapx: fcLcbPair(FC_LCB_INDEX.plcfbtePapx),
     sed: fcLcbPair(FC_LCB_INDEX.sed),
     clx: fcLcbPair(FC_LCB_INDEX.clx),
-    fibRgFcLcbOffset
+    fibRgFcLcbOffset,
+    fibRgFcLcbCount
   };
 }
 function fcLcbFieldOffset(fib, key) {
@@ -9539,6 +9650,9 @@ function fcLcbFieldOffset(fib, key) {
 }
 function readFcLcbAt(wordDoc, fib, index) {
   const view = new DataView(wordDoc.buffer, wordDoc.byteOffset, wordDoc.byteLength);
+  const count = view.getUint16(fib.fibRgFcLcbOffset - 2, true);
+  if (!Number.isInteger(index) || index < 0 || index >= count || fib.fibRgFcLcbCount !== void 0 && fib.fibRgFcLcbCount !== count)
+    throw new Error("FIB fc/lcb index outside declared array");
   const off = fib.fibRgFcLcbOffset + index * 8;
   return { fc: view.getUint32(off, true), lcb: view.getUint32(off + 4, true) };
 }
@@ -9558,40 +9672,799 @@ function patchDocFib(wordDoc, fib, patch) {
   view.setUint32(papxOff + 4, patch.plcfbtePapx.lcb, true);
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cfb.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-edit.js
+var END = 4294967294;
+var MAX = 4294967290;
+var NIL = 4294967295;
+var SIZE = 128;
+function chain(table, start, limit) {
+  if (start === END && limit === 0)
+    return [];
+  const out = [], seen = /* @__PURE__ */ new Set();
+  let id = start;
+  while (id !== END) {
+    if (id > MAX || id >= table.length || seen.has(id) || out.length >= limit)
+      throw new Error("Invalid CFB chain");
+    seen.add(id);
+    out.push(id);
+    id = table[id];
+  }
+  if (out.length !== limit)
+    throw new Error("Unexpected CFB chain length");
+  return out;
+}
+function chainToEnd(table, start, max) {
+  if (start === END)
+    return [];
+  const out = [], seen = /* @__PURE__ */ new Set();
+  let id = start;
+  while (id !== END) {
+    if (id > MAX || id >= table.length || seen.has(id) || out.length >= max)
+      throw new Error("Invalid CFB chain");
+    seen.add(id);
+    out.push(id);
+    id = table[id];
+  }
+  return out;
+}
+function processCompoundFileStream(input, path, replacement) {
+  const reject = () => replacement ? input : void 0;
+  try {
+    if (path.length === 0 || path.some((part) => !part) || input.length < 512)
+      return reject();
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const read32 = (offset2) => view.getUint32(offset2, true);
+    if (input[0] !== 208 || input[1] !== 207 || input[2] !== 17 || input[3] !== 224 || input[4] !== 161 || input[5] !== 177 || input[6] !== 26 || input[7] !== 225 || view.getUint16(28, true) !== 65534)
+      return reject();
+    const major = view.getUint16(26, true), shift = view.getUint16(30, true), miniShift = view.getUint16(32, true);
+    if (major !== 3 && major !== 4 || shift !== (major === 3 ? 9 : 12) || miniShift !== 6)
+      return reject();
+    const sectorSize = 1 << shift, miniSize = 1 << miniShift;
+    if (input.length % sectorSize !== 0)
+      return reject();
+    const sectorCount = input.length / sectorSize - 1;
+    const offset = (id) => (id + 1) * sectorSize;
+    const sector = (id) => {
+      if (id > MAX || id >= sectorCount)
+        throw new Error("Invalid sector");
+      return input.subarray(offset(id), offset(id) + sectorSize);
+    };
+    const fatCount = read32(44), difatCount = read32(72), difatStart = read32(68);
+    const fatIds = [];
+    for (let i = 0; i < 109 && fatIds.length < fatCount; i++) {
+      const id = read32(76 + 4 * i);
+      if (id <= MAX)
+        fatIds.push(id);
+    }
+    let difat = difatStart;
+    const difatIds = /* @__PURE__ */ new Set();
+    for (let i = 0; i < difatCount; i++) {
+      if (difatIds.has(difat) || difat > MAX)
+        return reject();
+      difatIds.add(difat);
+      const bytes = sector(difat), dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+      for (let j = 0; j < (sectorSize - 4) / 4 && fatIds.length < fatCount; j++) {
+        const id = dv.getUint32(j * 4, true);
+        if (id <= MAX)
+          fatIds.push(id);
+      }
+      difat = dv.getUint32(sectorSize - 4, true);
+    }
+    if (fatIds.length !== fatCount || new Set(fatIds).size !== fatIds.length || fatIds.some((id) => difatIds.has(id)))
+      return reject();
+    const fat = [];
+    for (const id of fatIds) {
+      const bytes = sector(id), dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+      for (let j = 0; j < sectorSize / 4 && fat.length < sectorCount; j++)
+        fat.push(dv.getUint32(j * 4, true));
+    }
+    const exactChain = (table, start, bytes, unit) => chain(table, start, Math.ceil(bytes / unit));
+    const dirStart = read32(48), dirSectors = chainToEnd(fat, dirStart, sectorCount);
+    const dirBytes = new Uint8Array(dirSectors.length * sectorSize);
+    dirSectors.forEach((id, i) => dirBytes.set(sector(id), i * sectorSize));
+    const dvDir = new DataView(dirBytes.buffer);
+    const entries = [];
+    for (let p = 0, id = 0; p + SIZE <= dirBytes.length; p += SIZE, id++) {
+      const type = dirBytes[p + 66];
+      if (type === 0)
+        continue;
+      const nameLength = dvDir.getUint16(p + 64, true);
+      if (nameLength < 2 || nameLength > 64 || nameLength % 2)
+        return reject();
+      let name = "";
+      for (let i = 0; i < nameLength - 2; i += 2)
+        name += String.fromCharCode(dvDir.getUint16(p + i, true));
+      const sizeLow = dvDir.getUint32(p + 120, true), sizeHigh = dvDir.getUint32(p + 124, true);
+      if (sizeHigh !== 0)
+        return reject();
+      entries.push({
+        id,
+        name,
+        type,
+        left: dvDir.getUint32(p + 68, true),
+        right: dvDir.getUint32(p + 72, true),
+        child: dvDir.getUint32(p + 76, true),
+        start: dvDir.getUint32(p + 116, true),
+        size: sizeLow
+      });
+    }
+    const byId = new Map(entries.map((e) => [e.id, e]));
+    const root = entries.find((e) => e.type === 5);
+    if (!root)
+      return reject();
+    let parent = root, target;
+    for (let partIndex = 0; partIndex < path.length; partIndex++) {
+      const matches = [], seen = /* @__PURE__ */ new Set();
+      const visit = (id) => {
+        if (id === NIL)
+          return;
+        if (seen.has(id))
+          throw new Error("Cyclic directory tree");
+        seen.add(id);
+        const e = byId.get(id);
+        if (!e)
+          throw new Error("Invalid directory ID");
+        visit(e.left);
+        if (e.name.toLocaleLowerCase() === path[partIndex].toLocaleLowerCase())
+          matches.push(e);
+        visit(e.right);
+      };
+      visit(parent.child);
+      if (matches.length !== 1)
+        return reject();
+      target = matches[0];
+      if (partIndex < path.length - 1) {
+        if (target.type !== 1)
+          return reject();
+        parent = target;
+      } else if (target.type !== 2 || replacement && replacement.length !== target.size)
+        return reject();
+    }
+    if (!target)
+      return reject();
+    const names = entries.map((e) => e.name.toLowerCase());
+    if (replacement && (names.includes("encryptioninfo") || names.includes("encryptedpackage")))
+      return reject();
+    for (const name of replacement ? ["book", "workbook"] : []) {
+      if (!names.includes(name))
+        continue;
+      const workbook = readCompoundFileStream(input, [name]);
+      if (!workbook)
+        continue;
+      for (let p = 0; p + 4 <= workbook.length; ) {
+        const record = workbook[p] | workbook[p + 1] << 8;
+        const length = workbook[p + 2] | workbook[p + 3] << 8;
+        if (record === 47)
+          return reject();
+        if (p + 4 + length > workbook.length || record === 10)
+          break;
+        p += 4 + length;
+      }
+    }
+    if (replacement && names.includes("worddocument")) {
+      const word = readCompoundFileStream(input, ["WordDocument"]);
+      if (word && word.length >= 12 && ((word[10] | word[11] << 8) & 256) !== 0)
+        return reject();
+    }
+    const miniCutoff = read32(56), miniFatCount = read32(64), miniFatStart = read32(60);
+    const miniFatSectors = miniFatCount ? chain(fat, miniFatStart, miniFatCount) : [];
+    const metadataSectors = [...fatIds, ...difatIds, ...dirSectors, ...miniFatSectors];
+    if (new Set(metadataSectors).size !== metadataSectors.length)
+      return reject();
+    const miniFat = [];
+    const miniCapacity = Math.floor(Math.min(root.size, sectorCount * sectorSize) / miniSize);
+    for (const id of miniFatSectors) {
+      const bytes = sector(id), dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+      for (let j = 0; j < sectorSize / 4 && miniFat.length < miniCapacity; j++)
+        miniFat.push(dv.getUint32(j * 4, true));
+    }
+    const reserved = /* @__PURE__ */ new Set([...fatIds, ...difatIds, ...dirSectors, ...miniFatSectors]);
+    const regularUsed = new Set(reserved);
+    const rootMini = entries.find((e) => e.type === 5);
+    for (const entry of entries) {
+      if (entry.type !== 2 && entry.type !== 5 || entry.size === 0)
+        continue;
+      if (entry.type === 2 && entry.size < miniCutoff)
+        continue;
+      for (const id of exactChain(fat, entry.start, entry.size, sectorSize)) {
+        sector(id);
+        if (regularUsed.has(id))
+          return reject();
+        regularUsed.add(id);
+      }
+    }
+    const miniUsed = /* @__PURE__ */ new Set();
+    for (const entry of entries) {
+      if (entry.type !== 2 || entry.size === 0 || entry.size >= miniCutoff)
+        continue;
+      const ids = exactChain(miniFat, entry.start, entry.size, miniSize);
+      for (const id of ids) {
+        if ((id + 1) * miniSize > rootMini.size || miniUsed.has(id))
+          return reject();
+        miniUsed.add(id);
+      }
+    }
+    if (!replacement) {
+      if (target.size >= miniCutoff) {
+        const ids2 = exactChain(fat, target.start, target.size, sectorSize);
+        const result2 = new Uint8Array(ids2.length * sectorSize);
+        ids2.forEach((id, i) => result2.set(sector(id), i * sectorSize));
+        return result2.slice(0, target.size);
+      }
+      const ids = exactChain(miniFat, target.start, target.size, miniSize);
+      const rootSectors = exactChain(fat, rootMini.start, rootMini.size, sectorSize);
+      const result = new Uint8Array(ids.length * miniSize);
+      ids.forEach((id, i) => {
+        const start = id * miniSize;
+        if (start + miniSize > rootMini.size)
+          throw new Error("Mini stream out of bounds");
+        const rootSector = rootSectors[Math.floor(start / sectorSize)];
+        const source = sector(rootSector).subarray(start % sectorSize, start % sectorSize + miniSize);
+        result.set(source, i * miniSize);
+      });
+      return result.slice(0, target.size);
+    }
+    if (replacement.length === 0)
+      return input.slice();
+    const output = input.slice();
+    if (target.size >= miniCutoff) {
+      const sectors = exactChain(fat, target.start, target.size, sectorSize);
+      sectors.forEach((id) => sector(id));
+      for (let i = 0; i < sectors.length; i++)
+        output.set(replacement.subarray(i * sectorSize, Math.min((i + 1) * sectorSize, replacement.length)), offset(sectors[i]));
+    } else {
+      if (!miniFat.length)
+        return reject();
+      const miniSectors = exactChain(miniFat, target.start, target.size, miniSize);
+      const rootMini2 = entries.find((e) => e.type === 5);
+      const rootSectors = exactChain(fat, rootMini2.start, rootMini2.size, sectorSize);
+      rootSectors.forEach((id) => sector(id));
+      const rootData = new Uint8Array(rootMini2.size);
+      rootSectors.forEach((id, i) => rootData.set(sector(id).subarray(0, Math.min(sectorSize, rootData.length - i * sectorSize)), i * sectorSize));
+      for (let i = 0; i < replacement.length; i++) {
+        const miniOffset = miniSectors[Math.floor(i / miniSize)] * miniSize + i % miniSize;
+        if (miniOffset >= rootData.length)
+          return reject();
+        const rootSectorIndex = Math.floor(miniOffset / sectorSize);
+        const rootSector = rootSectors[rootSectorIndex];
+        if (rootSector === void 0)
+          return reject();
+        const physical = offset(rootSector) + miniOffset % sectorSize;
+        output[physical] = replacement[i];
+      }
+    }
+    return output;
+  } catch {
+    return reject();
+  }
+}
+function readCompoundFileStream(input, path) {
+  return processCompoundFileStream(input, path);
+}
+function replaceCompoundFileStream(input, path, replacement) {
+  return processCompoundFileStream(input, path, replacement) ?? input;
+}
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-v4.js
+var END2 = 4294967294;
+var FREE = 4294967295;
+var FAT = 4294967293;
+function follow(table, start) {
+  const ids = [], seen = /* @__PURE__ */ new Set();
+  for (let id = start; id !== END2; id = table[id]) {
+    if (id >= table.length || seen.has(id))
+      throw new Error("Invalid allocation chain");
+    seen.add(id);
+    ids.push(id);
+  }
+  return ids;
+}
+function findSlot(slots, path) {
+  let parent = slots.get(0);
+  if (!parent || parent.type !== 5)
+    throw new Error("Invalid root");
+  const parents = /* @__PURE__ */ new Set();
+  for (let part = 0; part < path.length; part++) {
+    if (parents.has(parent.id))
+      throw new Error("Cyclic storage hierarchy");
+    parents.add(parent.id);
+    const stack = [parent.child], seen = /* @__PURE__ */ new Set(), matches = [];
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE)
+        continue;
+      if (seen.has(id))
+        throw new Error("Invalid directory tree");
+      seen.add(id);
+      const slot2 = slots.get(id);
+      if (!slot2)
+        throw new Error("Missing directory slot");
+      if (slot2.name.toLocaleLowerCase() === path[part].toLocaleLowerCase())
+        matches.push(slot2);
+      stack.push(slot2.left, slot2.right);
+    }
+    if (matches.length !== 1)
+      throw new Error("Missing or ambiguous stream");
+    parent = matches[0];
+    if (parent.type !== (part === path.length - 1 ? 2 : 1))
+      throw new Error("Invalid storage path");
+  }
+  return parent;
+}
+function validateHierarchy(slots) {
+  const owners = /* @__PURE__ */ new Set(), storages = [0];
+  while (storages.length) {
+    const storage = slots.get(storages.pop());
+    const stack = [storage.child], names = /* @__PURE__ */ new Set();
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE)
+        continue;
+      const slot2 = slots.get(id);
+      if (!slot2 || slot2.type !== 1 && slot2.type !== 2 || owners.has(id))
+        throw new Error("Ambiguous directory ownership");
+      const name = slot2.name.toLocaleLowerCase();
+      if (names.has(name))
+        throw new Error("Duplicate sibling name");
+      names.add(name);
+      owners.add(id);
+      stack.push(slot2.left, slot2.right);
+      if (slot2.type === 1)
+        storages.push(id);
+    }
+  }
+  if (owners.size !== slots.size - 1)
+    throw new Error("Unreachable directory entries");
+}
+function resizeCompoundFileStreamV4(input, path, replacement) {
+  const fail = (reason) => ({ ok: false, bytes: input, reason });
+  try {
+    if (input.length < 512 || !path.length || path.some((part) => !part))
+      return fail("invalid-or-missing-stream");
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const read = (offset) => view.getUint32(offset, true);
+    const version = view.getUint16(26, true);
+    if (version !== 4)
+      return fail("unsupported-version");
+    const SECTOR3 = 4096, FAT_ENTRIES2 = SECTOR3 / 4, DIRECTORY_ENTRIES = SECTOR3 / 128;
+    if (read(72) !== 0 || read(44) > 109)
+      return fail("unsupported-difat");
+    const cutoff = read(56);
+    if (cutoff !== 0 && cutoff !== 4096)
+      return fail("unsupported-layout");
+    const original = readCompoundFileStream(input, path);
+    if (!original)
+      return fail("invalid-or-missing-stream");
+    const name = path[path.length - 1].toLocaleLowerCase();
+    if (name === "worddocument" && original.length >= 12 && (original[10] | original[11] << 8) & 33024)
+      return fail("unsafe-edit");
+    if (name === "book" || name === "workbook") {
+      for (let offset = 0; offset + 4 <= original.length; ) {
+        const record = original[offset] | original[offset + 1] << 8;
+        const length = original[offset + 2] | original[offset + 3] << 8;
+        if (record === 47)
+          return fail("unsafe-edit");
+        if (record === 10 || offset + 4 + length > original.length)
+          break;
+        offset += 4 + length;
+      }
+    }
+    const validated = replaceCompoundFileStream(input, path, original);
+    if (validated === input)
+      return fail("unsafe-edit");
+    const sameLength = replacement.length === original.length;
+    if (!sameLength && original.length < cutoff)
+      return fail("unsupported-mini-stream");
+    if (!sameLength && replacement.length < cutoff)
+      return fail("unsupported-mini-transition");
+    const sectorCount = input.length / SECTOR3 - 1, fatCount = read(44);
+    if (sectorCount > fatCount * FAT_ENTRIES2)
+      return fail("unsafe-edit");
+    const fatIds = Array.from({ length: fatCount }, (_, i) => read(76 + 4 * i));
+    const fat = [];
+    for (const id of fatIds) {
+      for (let i = 0; i < FAT_ENTRIES2 && fat.length < sectorCount; i++)
+        fat.push(read((id + 1) * SECTOR3 + i * 4));
+    }
+    if (fatIds.some((id) => fat[id] !== FAT))
+      return fail("unsafe-edit");
+    const slots = /* @__PURE__ */ new Map();
+    const directoryChain = follow(fat, read(48));
+    if (read(40) !== directoryChain.length)
+      return fail("unsafe-edit");
+    for (const [block, sector] of directoryChain.entries()) {
+      for (let entry = 0; entry < DIRECTORY_ENTRIES; entry++) {
+        const offset = (sector + 1) * SECTOR3 + entry * 128, type = view.getUint8(offset + 66);
+        if (!type)
+          continue;
+        const nameLength = view.getUint16(offset + 64, true);
+        if (![1, 2, 5].includes(type) || nameLength < 2 || nameLength > 64 || nameLength % 2 || view.getUint16(offset + nameLength - 2, true))
+          return fail("unsafe-edit");
+        let name2 = "";
+        for (let i = 0; i < nameLength - 2; i += 2)
+          name2 += String.fromCharCode(view.getUint16(offset + i, true));
+        if (read(offset + 124) !== 0)
+          return fail("unsafe-edit");
+        const id = block * DIRECTORY_ENTRIES + entry;
+        slots.set(id, { id, name: name2, type, left: read(offset + 68), right: read(offset + 72), child: read(offset + 76), start: read(offset + 116), size: read(offset + 120), offset });
+      }
+    }
+    if ([...slots.values()].filter((slot2) => slot2.type === 5).length !== 1)
+      return fail("unsafe-edit");
+    const target = findSlot(slots, path);
+    validateHierarchy(slots);
+    if (sameLength) {
+      const bytes = replaceCompoundFileStream(input, path, replacement);
+      return bytes === input ? fail("unsafe-edit") : { ok: true, bytes };
+    }
+    const oldChain = follow(fat, target.start);
+    if (target.size !== original.length || oldChain.length !== Math.ceil(target.size / SECTOR3))
+      return fail("unsafe-edit");
+    const payloadSectors = Math.ceil(replacement.length / SECTOR3);
+    let newFatCount = fatCount;
+    while (sectorCount + payloadSectors + newFatCount - fatCount > newFatCount * FAT_ENTRIES2)
+      newFatCount++;
+    if (newFatCount > 109)
+      return fail("allocation-limit");
+    const totalSectors = sectorCount + payloadSectors + newFatCount - fatCount;
+    const output = new Uint8Array((totalSectors + 1) * SECTOR3);
+    output.set(input);
+    output.set(replacement, (sectorCount + 1) * SECTOR3);
+    const outView = new DataView(output.buffer);
+    for (let i = fatCount; i < newFatCount; i++) {
+      const id = sectorCount + payloadSectors + i - fatCount;
+      fatIds.push(id);
+      output.fill(255, (id + 1) * SECTOR3, (id + 2) * SECTOR3);
+      outView.setUint32(76 + i * 4, id, true);
+    }
+    outView.setUint32(44, newFatCount, true);
+    const writeFat = (id, value) => outView.setUint32((fatIds[Math.floor(id / FAT_ENTRIES2)] + 1) * SECTOR3 + id % FAT_ENTRIES2 * 4, value, true);
+    for (const id of oldChain)
+      writeFat(id, FREE);
+    for (let i = 0; i < payloadSectors; i++)
+      writeFat(sectorCount + i, i + 1 === payloadSectors ? END2 : sectorCount + i + 1);
+    for (const id of fatIds)
+      writeFat(id, FAT);
+    outView.setUint32(target.offset + 116, payloadSectors ? sectorCount : END2, true);
+    outView.setUint32(target.offset + 120, replacement.length, true);
+    return { ok: true, bytes: output };
+  } catch {
+    return fail("unsafe-edit");
+  }
+}
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-allocation.js
+function appendCompoundAllocations(input, existingFatIds, payloads, sectorSize = 512) {
+  const sectorCount = input.length / sectorSize - 1;
+  const entriesPerFat = sectorSize / 4;
+  const counts = payloads.map((payload) => Math.ceil(payload.length / sectorSize));
+  const payloadSectors = counts.reduce((sum, count) => sum + count, 0);
+  let fatCount = existingFatIds.length;
+  while (sectorCount + payloadSectors + fatCount - existingFatIds.length > fatCount * entriesPerFat)
+    fatCount++;
+  if (fatCount > 109)
+    return void 0;
+  const totalSectors = sectorCount + payloadSectors + fatCount - existingFatIds.length;
+  const bytes = new Uint8Array((totalSectors + 1) * sectorSize);
+  bytes.set(input);
+  const view = new DataView(bytes.buffer), fatIds = [...existingFatIds];
+  for (let i = existingFatIds.length; i < fatCount; i++) {
+    const id = sectorCount + payloadSectors + i - existingFatIds.length;
+    fatIds.push(id);
+    bytes.fill(255, (id + 1) * sectorSize, (id + 2) * sectorSize);
+    view.setUint32(76 + i * 4, id, true);
+  }
+  view.setUint32(44, fatCount, true);
+  const writeFat = (id, value) => view.setUint32((fatIds[Math.floor(id / entriesPerFat)] + 1) * sectorSize + id % entriesPerFat * 4, value, true);
+  const chains = [];
+  let next = sectorCount;
+  for (let payload = 0; payload < payloads.length; payload++) {
+    bytes.set(payloads[payload], (next + 1) * sectorSize);
+    const chain2 = Array.from({ length: counts[payload] }, (_, i) => next + i);
+    chain2.forEach((id, i) => writeFat(id, chain2[i + 1] ?? 4294967294));
+    chains.push(chain2);
+    next += counts[payload];
+  }
+  for (const id of fatIds)
+    writeFat(id, 4294967293);
+  return { bytes, view, chains, writeFat };
+}
+function followCompoundAllocation(table, start) {
+  const ids = [], seen = /* @__PURE__ */ new Set();
+  for (let id = start; id !== 4294967294; id = table[id]) {
+    if (id >= table.length || seen.has(id))
+      throw new Error("Invalid allocation chain");
+    seen.add(id);
+    ids.push(id);
+  }
+  return ids;
+}
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize-mini.js
+var END3 = 4294967294;
+var FREE2 = 4294967295;
+var SECTOR = 512;
+var MINI = 64;
+function resizeMiniCompoundStream(input, fat, fatIds, root, target, replacement, cutoff) {
+  const inputView = new DataView(input.buffer, input.byteOffset, input.byteLength);
+  const miniFatCount = inputView.getUint32(64, true);
+  const miniFatSectors = miniFatCount ? followCompoundAllocation(fat, inputView.getUint32(60, true)) : [];
+  if (miniFatSectors.length !== miniFatCount)
+    throw new Error("Invalid mini FAT count");
+  const rootSectors = root.size ? followCompoundAllocation(fat, root.start) : [];
+  if (rootSectors.length !== Math.ceil(root.size / SECTOR))
+    throw new Error("Invalid root mini stream");
+  const miniCapacity = Math.floor(root.size / MINI), miniFat = [];
+  for (const id of miniFatSectors) {
+    for (let slot2 = 0; slot2 < SECTOR / 4 && miniFat.length < miniCapacity; slot2++)
+      miniFat.push(inputView.getUint32((id + 1) * SECTOR + slot2 * 4, true));
+  }
+  const wasMini = target.size < cutoff;
+  const oldChain = followCompoundAllocation(wasMini ? miniFat : fat, target.start);
+  if (oldChain.length !== Math.ceil(target.size / (wasMini ? MINI : SECTOR)))
+    throw new Error("Invalid stream allocation");
+  if (!replacement.length) {
+    const bytes = input.slice(), view = new DataView(bytes.buffer);
+    for (const id of oldChain) {
+      const table = wasMini ? miniFatSectors : fatIds;
+      view.setUint32((table[Math.floor(id / 128)] + 1) * SECTOR + id % 128 * 4, FREE2, true);
+    }
+    view.setUint32(target.offset + 116, END3, true);
+    view.setUint32(target.offset + 120, 0, true);
+    return bytes;
+  }
+  if (replacement.length >= cutoff) {
+    const output2 = appendCompoundAllocations(input, fatIds, [replacement]);
+    if (!output2)
+      return void 0;
+    for (const id of oldChain)
+      output2.view.setUint32((miniFatSectors[Math.floor(id / 128)] + 1) * SECTOR + id % 128 * 4, FREE2, true);
+    output2.view.setUint32(target.offset + 116, output2.chains[0][0] ?? END3, true);
+    output2.view.setUint32(target.offset + 120, replacement.length, true);
+    return output2.bytes;
+  }
+  const firstMini = Math.ceil(root.size / MINI), count = Math.ceil(replacement.length / MINI);
+  const newRootSize = count ? (firstMini + count) * MINI : root.size;
+  const newRoot = new Uint8Array(newRootSize);
+  rootSectors.forEach((id, i) => newRoot.set(input.subarray((id + 1) * SECTOR, (id + 1) * SECTOR + Math.min(SECTOR, root.size - i * SECTOR)), i * SECTOR));
+  if (count)
+    newRoot.set(replacement, firstMini * MINI);
+  const newMiniFatCount = Math.max(miniFatCount, Math.ceil((firstMini + count) / 128));
+  const newMiniFat = new Uint8Array(newMiniFatCount * SECTOR).fill(255);
+  miniFatSectors.forEach((id, i) => newMiniFat.set(input.subarray((id + 1) * SECTOR, (id + 2) * SECTOR), i * SECTOR));
+  const miniView = new DataView(newMiniFat.buffer);
+  if (wasMini)
+    for (const id of oldChain)
+      miniView.setUint32(id * 4, FREE2, true);
+  for (let i = 0; i < count; i++)
+    miniView.setUint32((firstMini + i) * 4, i + 1 === count ? END3 : firstMini + i + 1, true);
+  const output = appendCompoundAllocations(input, fatIds, [newRoot, newMiniFat]);
+  if (!output)
+    return void 0;
+  for (const id of [...rootSectors, ...miniFatSectors, ...wasMini ? [] : oldChain])
+    output.writeFat(id, FREE2);
+  output.view.setUint32(root.offset + 116, output.chains[0][0] ?? END3, true);
+  output.view.setUint32(root.offset + 120, newRootSize, true);
+  output.view.setUint32(60, output.chains[1][0] ?? END3, true);
+  output.view.setUint32(64, newMiniFatCount, true);
+  output.view.setUint32(target.offset + 116, count ? firstMini : END3, true);
+  output.view.setUint32(target.offset + 120, replacement.length, true);
+  return output.bytes;
+}
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole2-stream-resize.js
+var END4 = 4294967294;
+var FREE3 = 4294967295;
+var FAT2 = 4294967293;
+var SECTOR2 = 512;
+var FAT_ENTRIES = SECTOR2 / 4;
+function follow2(table, start) {
+  const ids = [], seen = /* @__PURE__ */ new Set();
+  for (let id = start; id !== END4; id = table[id]) {
+    if (id >= table.length || seen.has(id))
+      throw new Error("Invalid allocation chain");
+    seen.add(id);
+    ids.push(id);
+  }
+  return ids;
+}
+function findSlot2(slots, path) {
+  let parent = slots.get(0);
+  if (!parent || parent.type !== 5)
+    throw new Error("Invalid root");
+  const parents = /* @__PURE__ */ new Set();
+  for (let part = 0; part < path.length; part++) {
+    if (parents.has(parent.id))
+      throw new Error("Cyclic storage hierarchy");
+    parents.add(parent.id);
+    const stack = [parent.child], seen = /* @__PURE__ */ new Set(), matches = [];
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE3)
+        continue;
+      if (seen.has(id))
+        throw new Error("Invalid directory tree");
+      seen.add(id);
+      const slot2 = slots.get(id);
+      if (!slot2)
+        throw new Error("Missing directory slot");
+      if (slot2.name.toLocaleLowerCase() === path[part].toLocaleLowerCase())
+        matches.push(slot2);
+      stack.push(slot2.left, slot2.right);
+    }
+    if (matches.length !== 1)
+      throw new Error("Missing or ambiguous stream");
+    parent = matches[0];
+    if (parent.type !== (part === path.length - 1 ? 2 : 1))
+      throw new Error("Invalid storage path");
+  }
+  return parent;
+}
+function validateHierarchy2(slots) {
+  const owners = /* @__PURE__ */ new Set(), storages = [0];
+  while (storages.length) {
+    const storage = slots.get(storages.pop());
+    const stack = [storage.child], names = /* @__PURE__ */ new Set();
+    while (stack.length) {
+      const id = stack.pop();
+      if (id === FREE3)
+        continue;
+      const slot2 = slots.get(id);
+      if (!slot2 || slot2.type !== 1 && slot2.type !== 2 || owners.has(id))
+        throw new Error("Ambiguous directory ownership");
+      const name = slot2.name.toLocaleLowerCase();
+      if (names.has(name))
+        throw new Error("Duplicate sibling name");
+      names.add(name);
+      owners.add(id);
+      stack.push(slot2.left, slot2.right);
+      if (slot2.type === 1)
+        storages.push(id);
+    }
+  }
+  if (owners.size !== slots.size - 1)
+    throw new Error("Unreachable directory entries");
+}
+function resizeCompoundFileStream(input, path, replacement) {
+  if (input.length >= 512 && new DataView(input.buffer, input.byteOffset, input.byteLength).getUint16(26, true) === 4)
+    return resizeCompoundFileStreamV4(input, path, replacement);
+  const fail = (reason) => ({ ok: false, bytes: input, reason });
+  try {
+    if (input.length < SECTOR2 || !path.length || path.some((part) => !part))
+      return fail("invalid-or-missing-stream");
+    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    const read = (offset) => view.getUint32(offset, true);
+    if (view.getUint16(26, true) !== 3)
+      return fail("unsupported-version");
+    if (read(72) !== 0 || read(44) > 109)
+      return fail("unsupported-difat");
+    const cutoff = read(56);
+    if (cutoff !== 0 && cutoff !== 4096)
+      return fail("unsupported-layout");
+    const original = readCompoundFileStream(input, path);
+    if (!original)
+      return fail("invalid-or-missing-stream");
+    const name = path[path.length - 1].toLocaleLowerCase();
+    if (name === "worddocument" && original.length >= 12 && (original[10] | original[11] << 8) & 33024)
+      return fail("unsafe-edit");
+    if (name === "book" || name === "workbook") {
+      for (let offset = 0; offset + 4 <= original.length; ) {
+        const record = original[offset] | original[offset + 1] << 8;
+        const length = original[offset + 2] | original[offset + 3] << 8;
+        if (record === 47)
+          return fail("unsafe-edit");
+        if (record === 10 || offset + 4 + length > original.length)
+          break;
+        offset += 4 + length;
+      }
+    }
+    const validated = replaceCompoundFileStream(input, path, original);
+    if (validated === input)
+      return fail("unsafe-edit");
+    const sameLength = replacement.length === original.length;
+    const sectorCount = input.length / SECTOR2 - 1, fatCount = read(44);
+    if (sectorCount > fatCount * FAT_ENTRIES)
+      return fail("unsafe-edit");
+    const fatIds = Array.from({ length: fatCount }, (_, i) => read(76 + 4 * i));
+    const fat = [];
+    for (const id of fatIds) {
+      for (let i = 0; i < FAT_ENTRIES && fat.length < sectorCount; i++)
+        fat.push(read((id + 1) * SECTOR2 + i * 4));
+    }
+    if (fatIds.some((id) => fat[id] !== FAT2))
+      return fail("unsafe-edit");
+    const slots = /* @__PURE__ */ new Map();
+    for (const [block, sector] of follow2(fat, read(48)).entries()) {
+      for (let entry = 0; entry < 4; entry++) {
+        const offset = (sector + 1) * SECTOR2 + entry * 128, type = view.getUint8(offset + 66);
+        if (!type)
+          continue;
+        const nameLength = view.getUint16(offset + 64, true);
+        if (![1, 2, 5].includes(type) || nameLength < 2 || nameLength > 64 || nameLength % 2 || view.getUint16(offset + nameLength - 2, true))
+          return fail("unsafe-edit");
+        let name2 = "";
+        for (let i = 0; i < nameLength - 2; i += 2)
+          name2 += String.fromCharCode(view.getUint16(offset + i, true));
+        const id = block * 4 + entry;
+        slots.set(id, { id, name: name2, type, left: read(offset + 68), right: read(offset + 72), child: read(offset + 76), start: read(offset + 116), size: read(offset + 120), offset });
+      }
+    }
+    if ([...slots.values()].filter((slot2) => slot2.type === 5).length !== 1)
+      return fail("unsafe-edit");
+    const target = findSlot2(slots, path);
+    validateHierarchy2(slots);
+    if (sameLength) {
+      const bytes = replaceCompoundFileStream(input, path, replacement);
+      return bytes === input ? fail("unsafe-edit") : { ok: true, bytes };
+    }
+    if (original.length < cutoff || replacement.length < cutoff) {
+      const bytes = resizeMiniCompoundStream(input, fat, fatIds, slots.get(0), target, replacement, cutoff);
+      return bytes ? { ok: true, bytes } : fail("allocation-limit");
+    }
+    const oldChain = follow2(fat, target.start);
+    if (target.size !== original.length || oldChain.length !== Math.ceil(target.size / SECTOR2))
+      return fail("unsafe-edit");
+    const output = appendCompoundAllocations(input, fatIds, [replacement]);
+    if (!output)
+      return fail("allocation-limit");
+    for (const id of oldChain)
+      output.writeFat(id, FREE3);
+    output.view.setUint32(target.offset + 116, output.chains[0][0] ?? END4, true);
+    output.view.setUint32(target.offset + 120, replacement.length, true);
+    return { ok: true, bytes: output.bytes };
+  } catch {
+    return fail("unsafe-edit");
+  }
+}
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cfb.js
+var DocCfbRewriteError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DocCfbRewriteError";
+  }
+};
 function unwrapDocBytes(bytes) {
   if (bytes.length < 8 || bytes[0] !== 208 || bytes[1] !== 207 || bytes[2] !== 17 || bytes[3] !== 224 || bytes[4] !== 161 || bytes[5] !== 177 || bytes[6] !== 26 || bytes[7] !== 225) {
     return void 0;
   }
   try {
-    const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-    const ole = parseOle2(buffer);
-    const wordDocBytes = ole.getStream("WordDocument");
+    const wordDocBytes = readCompoundFileStream(bytes, ["WordDocument"]);
     if (!wordDocBytes) {
       return void 0;
     }
     const fib = readDocFib(wordDocBytes);
-    const tableBytes = ole.getStream(fib.tableStreamName);
+    const tableBytes = readCompoundFileStream(bytes, [fib.tableStreamName]);
     if (!tableBytes) {
       return void 0;
     }
-    const rootClsid = ole.entries.find((e) => e.type === ENTRY_TYPE_ROOT)?.clsid;
+    const header = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const cutoff = header.getUint32(56, true);
+    const canRewrite = header.getUint16(26, true) === 3 && header.getUint32(72, true) === 0 && header.getUint32(44, true) <= 109 && (cutoff === 0 || cutoff === 4096) && wordDocBytes.length >= cutoff && tableBytes.length >= cutoff;
     return {
       wordDocBytes,
       tableStreamName: fib.tableStreamName,
       tableBytes,
+      canRewrite,
       rewrap: (editedWordDocBytes, editedTableBytes) => {
-        const streams2 = /* @__PURE__ */ new Map();
-        for (const entry of ole.entries) {
-          if (entry.type !== ENTRY_TYPE_STREAM) {
-            continue;
-          }
-          const data = entry.name === "WordDocument" ? editedWordDocBytes : entry.name === fib.tableStreamName ? editedTableBytes : ole.getStream(entry.name);
-          if (data) {
-            streams2.set(entry.name, data);
-          }
+        if (editedWordDocBytes.length === wordDocBytes.length && editedTableBytes.length === tableBytes.length) {
+          const patchedWord = replaceCompoundFileStream(bytes, ["WordDocument"], editedWordDocBytes);
+          if (patchedWord === bytes)
+            throw new DocCfbRewriteError("Cannot safely patch WordDocument");
+          if (editedTableBytes.every((value, i) => value === tableBytes[i]))
+            return patchedWord;
+          const patchedTable = replaceCompoundFileStream(patchedWord, [fib.tableStreamName], editedTableBytes);
+          if (patchedTable === patchedWord)
+            throw new DocCfbRewriteError("Cannot safely patch DOC table stream");
+          return patchedTable;
         }
-        return new Uint8Array(buildOle2(streams2, rootClsid));
+        const word = resizeCompoundFileStream(bytes, ["WordDocument"], editedWordDocBytes);
+        if (!word.ok)
+          throw new DocCfbRewriteError(`Cannot resize WordDocument: ${word.reason}`);
+        const table = resizeCompoundFileStream(word.bytes, [fib.tableStreamName], editedTableBytes);
+        if (!table.ok)
+          throw new DocCfbRewriteError(`Cannot resize DOC table stream: ${table.reason}`);
+        return table.bytes;
       }
     };
   } catch {
@@ -9599,14 +10472,19 @@ function unwrapDocBytes(bytes) {
   }
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fkp.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fkp.js
 var PAGE_SIZE = 512;
 function parseBteTable(tableStream, at) {
   const view = new DataView(tableStream.buffer, tableStream.byteOffset, tableStream.byteLength);
-  const n = Math.floor((at.lcb - 4) / (4 + 4));
+  if (!Number.isInteger(at.fc) || !Number.isInteger(at.lcb) || at.fc < 0 || at.lcb < 4 || (at.lcb - 4) % 8 !== 0 || at.fc > tableStream.length - at.lcb)
+    throw new Error("Invalid BTE table bounds");
+  const n = (at.lcb - 4) / 8;
   const fcs = [];
   for (let i = 0; i <= n; i++) {
-    fcs.push(view.getInt32(at.fc + i * 4, true));
+    const fc = view.getInt32(at.fc + i * 4, true);
+    if (fc < 0 || i > 0 && fc <= fcs[i - 1])
+      throw new Error("Invalid BTE FC boundaries");
+    fcs.push(fc);
   }
   const pns = [];
   for (let i = 0; i < n; i++) {
@@ -9627,10 +10505,17 @@ function buildBteTableBytes(table) {
   return bytes;
 }
 function findBteRangeIndex(table, fc) {
-  for (let i = 0; i < table.pns.length; i++) {
-    if (fc >= table.fcs[i] && fc < table.fcs[i + 1]) {
-      return i;
-    }
+  let low = 0, high = table.pns.length;
+  while (low < high) {
+    const middle = low + Math.floor((high - low) / 2);
+    if (fc < table.fcs[middle])
+      high = middle;
+    else if (fc >= table.fcs[middle + 1])
+      low = middle + 1;
+    else if (fc >= table.fcs[middle])
+      return middle;
+    else
+      break;
   }
   throw new Error(`FC ${fc} is not covered by any BTE range`);
 }
@@ -9646,7 +10531,11 @@ function extractPapxBlob(wordDoc, papxBte, fc) {
   const rangeIndex = findBteRangeIndex(papxBte, fc);
   const pageOffset = papxBte.pns[rangeIndex] * PAGE_SIZE;
   const page = wordDoc.subarray(pageOffset, pageOffset + PAGE_SIZE);
+  if (page.length !== PAGE_SIZE)
+    throw new Error("Truncated PAPX page");
   const crun = page[PAGE_SIZE - 1];
+  if (crun === 0 || (crun + 1) * 4 + crun * 13 > 511)
+    throw new Error("Invalid PAPX run count");
   const pageView = new DataView(page.buffer, page.byteOffset, page.byteLength);
   const rgbxOffset = (crun + 1) * 4;
   for (let i = 0; i < crun; i++) {
@@ -9654,8 +10543,13 @@ function extractPapxBlob(wordDoc, papxBte, fc) {
     const runFcEnd = pageView.getInt32((i + 1) * 4, true);
     if (fc >= runFcStart && fc < runFcEnd) {
       const bOffsetWord = page[rgbxOffset + i * 13];
+      if (bOffsetWord === 0)
+        return new Uint8Array();
       const blobOffset = bOffsetWord * 2;
-      return page.slice(blobOffset, blobOffset + papxBlobLength(page, blobOffset));
+      const blobLength = papxBlobLength(page, blobOffset);
+      if (blobOffset < rgbxOffset + crun * 13 || !Number.isInteger(blobLength) || blobOffset + blobLength > 511)
+        throw new Error("Invalid PAPX blob bounds");
+      return page.slice(blobOffset, blobOffset + blobLength);
     }
   }
   throw new Error(`FC ${fc} is not covered by any run in PAPX page ${papxBte.pns[rangeIndex]}`);
@@ -9664,7 +10558,11 @@ function extractChpxBlob(wordDoc, chpxBte, fc) {
   const rangeIndex = findBteRangeIndex(chpxBte, fc);
   const pageOffset = chpxBte.pns[rangeIndex] * PAGE_SIZE;
   const page = wordDoc.subarray(pageOffset, pageOffset + PAGE_SIZE);
+  if (page.length !== PAGE_SIZE)
+    throw new Error("Truncated CHPX page");
   const crun = page[PAGE_SIZE - 1];
+  if (crun === 0 || (crun + 1) * 4 + crun > 511)
+    throw new Error("Invalid CHPX run count");
   const pageView = new DataView(page.buffer, page.byteOffset, page.byteLength);
   const rgbOffset = (crun + 1) * 4;
   for (let i = 0; i < crun; i++) {
@@ -9677,6 +10575,8 @@ function extractChpxBlob(wordDoc, chpxBte, fc) {
       }
       const blobOffset = bOffsetWord * 2;
       const cb = page[blobOffset];
+      if (blobOffset < rgbOffset + crun || blobOffset + 1 + cb > 511)
+        throw new Error("Invalid CHPX blob bounds");
       return page.slice(blobOffset, blobOffset + 1 + cb);
     }
   }
@@ -9688,8 +10588,12 @@ function buildSingleRunPapxPage(fcStart, fcEnd, blob) {
   view.setInt32(0, fcStart, true);
   view.setInt32(4, fcEnd, true);
   const blobByteOffset = 22;
-  page[8] = blobByteOffset / 2;
-  page.set(blob, blobByteOffset);
+  if (blob.length > 511 - blobByteOffset)
+    throw new Error("PAPX blob exceeds page capacity");
+  if (blob.length > 0) {
+    page[8] = blobByteOffset / 2;
+    page.set(blob, blobByteOffset);
+  }
   page[PAGE_SIZE - 1] = 1;
   return page;
 }
@@ -9700,6 +10604,8 @@ function buildSingleRunChpxPage(fcStart, fcEnd, blob) {
   view.setInt32(4, fcEnd, true);
   if (blob.length > 0) {
     const blobByteOffset = 10;
+    if (blob.length > 511 - blobByteOffset)
+      throw new Error("CHPX blob exceeds page capacity");
     page[8] = blobByteOffset / 2;
     page.set(blob, blobByteOffset);
   }
@@ -9707,7 +10613,7 @@ function buildSingleRunChpxPage(fcStart, fcEnd, blob) {
   return page;
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cp1252.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-cp1252.js
 var CP1252_HIGH_BLOCK = [
   8364,
   129,
@@ -9775,23 +10681,50 @@ function encodeCp1252(text) {
   return Uint8Array.from(bytes);
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-pieces.js
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-pieces.js
 var CLXT_PRC = 1;
 var CLXT_PCDT = 2;
-function parsePieceTable(tableStream, clx) {
+var DocResourceLimitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DocResourceLimitError";
+  }
+};
+function parseDocClx(tableStream, clx, maxPieces) {
+  if (maxPieces !== void 0 && (!Number.isSafeInteger(maxPieces) || maxPieces < 0))
+    throw new Error("Invalid DOC piece limit");
   const view = new DataView(tableStream.buffer, tableStream.byteOffset, tableStream.byteLength);
+  if (!Number.isInteger(clx.fc) || !Number.isInteger(clx.lcb) || clx.fc < 0 || clx.lcb < 5 || clx.fc > tableStream.length - clx.lcb)
+    throw new Error("Clx is outside the table stream");
   let off = clx.fc;
   const end = clx.fc + clx.lcb;
+  let prcCount = 0;
   while (off < end) {
     const clxt = view.getUint8(off);
     if (clxt === CLXT_PRC) {
+      if (off + 3 > end)
+        throw new Error("Truncated Prc header");
       const cb = view.getUint16(off + 1, true);
+      if (cb > end - off - 3)
+        throw new Error("Prc extends beyond Clx");
       off += 1 + 2 + cb;
+      prcCount++;
       continue;
     }
     if (clxt === CLXT_PCDT) {
+      if (off + 5 > end)
+        throw new Error("Truncated Pcdt header");
       const lcb = view.getInt32(off + 1, true);
-      return parsePlcPcd(view, off + 1 + 4, lcb);
+      if (lcb < 4 || (lcb - 4) % 12 !== 0 || lcb !== end - off - 5)
+        throw new Error("Invalid PlcPcd length");
+      if (maxPieces !== void 0 && (lcb - 4) / 12 > maxPieces)
+        throw new DocResourceLimitError("DOC piece count exceeds the processing limit");
+      const pieces = parsePlcPcd(view, off + 5, lcb);
+      for (const piece of pieces) {
+        if ((piece.prm & 1) !== 0 && piece.prm >>> 1 >= prcCount)
+          throw new Error("Prm1 references a missing Prc");
+      }
+      return { pieces, prcBytes: tableStream.slice(clx.fc, off) };
     }
     throw new Error(`Unrecognised Clx entry type ${clxt} at ${off}`);
   }
@@ -9801,7 +10734,10 @@ function parsePlcPcd(view, plcStart, lcb) {
   const n = Math.floor((lcb - 4) / (4 + 8));
   const cps = [];
   for (let i = 0; i <= n; i++) {
-    cps.push(view.getInt32(plcStart + i * 4, true));
+    const cp = view.getInt32(plcStart + i * 4, true);
+    if (i === 0 && cp !== 0 || i > 0 && cp <= cps[i - 1])
+      throw new Error("Piece CPs must start at zero and increase");
+    cps.push(cp);
   }
   const pcdStart = plcStart + (n + 1) * 4;
   const pieces = [];
@@ -9809,6 +10745,8 @@ function parsePlcPcd(view, plcStart, lcb) {
     const pOff = pcdStart + i * 8;
     const flagsWord = view.getUint16(pOff, true);
     const fcRaw = view.getUint32(pOff + 2, true);
+    if ((fcRaw & 2147483648) !== 0)
+      throw new Error("Reserved FcCompressed bit is set");
     const prm = view.getUint16(pOff + 6, true);
     const compressed = (fcRaw >>> 30 & 1) === 1;
     const fcField = fcRaw & 1073741823;
@@ -9825,6 +10763,9 @@ function parsePlcPcd(view, plcStart, lcb) {
 }
 function decodePieceText(wordDoc, piece) {
   const charLen = piece.cpEnd - piece.cpStart;
+  const byteLen = charLen * (piece.compressed ? 1 : 2);
+  if (!Number.isInteger(charLen) || charLen < 0 || !Number.isInteger(piece.fc) || piece.fc < 0 || piece.fc > wordDoc.length - byteLen)
+    throw new Error("Piece text is outside WordDocument");
   if (piece.compressed) {
     return decodeCp1252(wordDoc.subarray(piece.fc, piece.fc + charLen));
   }
@@ -9835,8 +10776,19 @@ function decodePieceText(wordDoc, piece) {
   }
   return out;
 }
-function decodePiecesText(wordDoc, pieces) {
-  return pieces.map((piece) => decodePieceText(wordDoc, piece)).join("");
+function decodePiecesText(wordDoc, pieces, maxChars) {
+  if (maxChars !== void 0 && (!Number.isInteger(maxChars) || maxChars < 0))
+    throw new Error("Invalid text character limit");
+  const out = [];
+  for (const piece of pieces) {
+    const bytes = (piece.cpEnd - piece.cpStart) * (piece.compressed ? 1 : 2);
+    if (piece.cpEnd < piece.cpStart || piece.fc < 0 || piece.fc > wordDoc.length - bytes)
+      throw new Error("Piece text is outside WordDocument");
+    const end = Math.min(piece.cpEnd, maxChars ?? piece.cpEnd);
+    if (end > piece.cpStart)
+      out.push(decodePieceText(wordDoc, { ...piece, cpEnd: end }));
+  }
+  return out.join("");
 }
 function encodePieceText(text) {
   const compressedBytes = encodeCp1252(text);
@@ -9874,7 +10826,7 @@ function replacePieceRange(pieces, cpStart, cpEnd, newPiece) {
         fc: newPiece.fc,
         compressed: newPiece.compressed,
         flagsWord: newPiece.flagsWord,
-        prm: 0,
+        prm: newPiece.prm ?? 0,
         charLength: newPiece.charLength
       });
       inserted = true;
@@ -9895,7 +10847,7 @@ function replacePieceRange(pieces, cpStart, cpEnd, newPiece) {
       fc: newPiece.fc,
       compressed: newPiece.compressed,
       flagsWord: newPiece.flagsWord,
-      prm: 0,
+      prm: newPiece.prm ?? 0,
       charLength: newPiece.charLength
     });
   }
@@ -9913,7 +10865,7 @@ function replacePieceRange(pieces, cpStart, cpEnd, newPiece) {
     };
   });
 }
-function buildClxBytes(pieces) {
+function buildClxBytes(pieces, prcBytes = new Uint8Array()) {
   const n = pieces.length;
   const plcLcb = (n + 1) * 4 + n * 8;
   const bytes = new Uint8Array(1 + 4 + plcLcb);
@@ -9934,14 +10886,122 @@ function buildClxBytes(pieces) {
     view.setUint16(off + 6, piece.prm, true);
     off += 8;
   }
-  return bytes;
+  const result = new Uint8Array(prcBytes.length + bytes.length);
+  result.set(prcBytes);
+  result.set(bytes, prcBytes.length);
+  parseDocClx(result, { fc: 0, lcb: result.length });
+  return result;
+}
+
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-fields.js
+var UnsupportedDocFieldEditError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnsupportedDocFieldEditError";
+  }
+};
+function checkFieldRanges(markers, editStart, editEnd, maxDepth) {
+  const stack = [];
+  for (const { cp, ch } of markers) {
+    if (ch === 19) {
+      if (stack.length >= maxDepth)
+        throw new DocResourceLimitError("DOC field nesting exceeds the processing limit");
+      stack.push({ start: cp, separated: false });
+    } else if (ch === 20) {
+      const field = stack.at(-1);
+      if (!field || field.separated)
+        throw new Error("Invalid DOC field separator nesting");
+      field.separated = true;
+    } else if (ch === 21) {
+      const field = stack.pop();
+      if (!field)
+        throw new Error("Unmatched DOC field end");
+      if (field.start < editEnd && cp + 1 > editStart)
+        throw new UnsupportedDocFieldEditError("Paragraph overlaps a field code/result range");
+    }
+  }
+  if (stack.length)
+    throw new Error("Unterminated DOC field");
+}
+function* bodyMarkers(body) {
+  for (let cp = 0; cp < body.length; cp++) {
+    const ch = body.charCodeAt(cp);
+    if (ch >= 19 && ch <= 21)
+      yield { cp, ch };
+  }
+}
+function shiftDocMainFieldCps(table, at, body, editStart, editEnd, delta, maxFields) {
+  if (![editStart, editEnd, delta, maxFields].every(Number.isSafeInteger) || editStart < 0 || editEnd <= editStart || editEnd > body.length || maxFields < 0 || body.length + delta < 0)
+    throw new Error("Invalid field edit bounds or budget");
+  checkFieldRanges(bodyMarkers(body), editStart, editEnd, maxFields);
+  if (at.lcb === 0)
+    return void 0;
+  if (!Number.isSafeInteger(at.fc) || at.fc < 0 || at.lcb < 4 || (at.lcb - 4) % 6 !== 0 || at.fc > table.length - at.lcb)
+    throw new Error("Invalid main-story field PLC bounds");
+  const n = (at.lcb - 4) / 6;
+  if (n > maxFields)
+    throw new DocResourceLimitError("DOC field count exceeds the processing limit");
+  const source = table.subarray(at.fc, at.fc + at.lcb);
+  const view = new DataView(source.buffer, source.byteOffset, source.byteLength);
+  const markers = [];
+  let previous = -1;
+  for (let i = 0; i < n; i++) {
+    const cp = view.getInt32(i * 4, true);
+    const ch = source[(n + 1) * 4 + i * 2] & 31;
+    if (cp <= previous || cp >= body.length || ![19, 20, 21].includes(ch) || body.charCodeAt(cp) !== ch)
+      throw new Error("Invalid main-story field marker");
+    markers.push({ cp, ch });
+    previous = cp;
+  }
+  checkFieldRanges(markers, editStart, editEnd, maxFields);
+  const sentinel = view.getInt32(n * 4, true);
+  if (sentinel < 0 || sentinel <= previous)
+    throw new Error("Invalid field PLC sentinel");
+  const result = source.slice();
+  const out = new DataView(result.buffer);
+  let shiftedLast = -1;
+  for (let i = 0; i < n; i++) {
+    const cp = markers[i].cp;
+    const shifted = cp >= editEnd ? cp + delta : cp;
+    if (shifted < 0 || shifted >= body.length + delta || shifted <= shiftedLast)
+      throw new Error("Field position shifts outside the main story");
+    out.setInt32(i * 4, shifted, true);
+    shiftedLast = shifted;
+  }
+  let shiftedSentinel = sentinel >= editEnd ? sentinel + delta : sentinel;
+  if (shiftedSentinel > 2147483647 || shiftedSentinel <= shiftedLast)
+    shiftedSentinel = sentinel;
+  if (shiftedSentinel <= shiftedLast)
+    throw new Error("No representable field PLC sentinel");
+  out.setInt32(n * 4, shiftedSentinel, true);
+  return result;
 }
 
-// node_modules/.bun/@christophervr+ole2@0.4.0/node_modules/@christophervr/ole2/dist/ole-document-doc-editor.js
-var RISKY_PLCF_INDICES = [3, 4, 5, 16, 17, 18, 19, 20];
+// node_modules/.bun/@christophervr+ole2@0.8.0/node_modules/@christophervr/ole2/dist/ole-document-doc-editor.js
+var RISKY_PLCF_INDICES = [2, 3, 4, 5, 17, 18, 19, 20, 40, 41, 42, 43, 46, 47, 48, 54, 55, 56, 57, 58, 59, 75, 76, 89, 90];
 var RISKY_STTB_INDICES = [21, 22, 23];
+var SAFE_EXTENDED_FC_LCB_INDICES = /* @__PURE__ */ new Set([93, 94, 113, 181, 182]);
+var DEFAULT_OLE_DOC_PROCESSING_LIMITS = Object.freeze({ maxCharacters: 16777216, maxPieces: 65536, maxFieldRecords: 65536 });
+function processingLimits(limits) {
+  const resolved = {
+    maxCharacters: DEFAULT_OLE_DOC_PROCESSING_LIMITS.maxCharacters,
+    maxPieces: DEFAULT_OLE_DOC_PROCESSING_LIMITS.maxPieces,
+    maxFieldRecords: DEFAULT_OLE_DOC_PROCESSING_LIMITS.maxFieldRecords
+  };
+  if (!Number.isSafeInteger(resolved.maxCharacters) || resolved.maxCharacters < 0 || !Number.isSafeInteger(resolved.maxPieces) || resolved.maxPieces < 0 || !Number.isSafeInteger(resolved.maxFieldRecords) || resolved.maxFieldRecords < 0)
+    throw new Error("DOC processing limits must be nonnegative safe integers");
+  return resolved;
+}
 function hasUnsupportedFeatures(wordDoc, fib) {
+  if (fib.ccpOtherStories > 0)
+    return true;
+  for (let index = 93; index < fib.fibRgFcLcbCount; index++) {
+    if (!SAFE_EXTENDED_FC_LCB_INDICES.has(index) && readFcLcbAt(wordDoc, fib, index).lcb !== 0)
+      return true;
+  }
   for (const index of RISKY_PLCF_INDICES) {
+    if (index >= fib.fibRgFcLcbCount)
+      continue;
     if (readFcLcbAt(wordDoc, fib, index).lcb > 4) {
       return true;
     }
@@ -9974,15 +11034,30 @@ function paragraphBoundaries(bodyText) {
   }
   return boundaries;
 }
-function readOleDocParagraphs(docBytes) {
+function encodePieceTextUtf16(text) {
+  const bytes = new Uint8Array(text.length * 2);
+  const view = new DataView(bytes.buffer);
+  for (let i = 0; i < text.length; i++)
+    view.setUint16(i * 2, text.charCodeAt(i), true);
+  return bytes;
+}
+function readOleDocParagraphs(docBytes, limits) {
   try {
+    const budget = processingLimits(limits);
     const cfb = unwrapDocBytes(docBytes);
     if (!cfb) {
       return void 0;
     }
     const fib = readDocFib(cfb.wordDocBytes);
-    const pieces = parsePieceTable(cfb.tableBytes, fib.clx);
-    const fullText = decodePiecesText(cfb.wordDocBytes, pieces);
+    if (fib.ccpText > budget.maxCharacters)
+      return void 0;
+    const pieces = parseDocClx(cfb.tableBytes, fib.clx, budget.maxPieces).pieces;
+    const totalCp = pieces.at(-1)?.cpEnd ?? 0;
+    if (totalCp > fib.ccpText + fib.ccpOtherStories + 1)
+      return void 0;
+    const fullText = decodePiecesText(cfb.wordDocBytes, pieces, fib.ccpText);
+    if (fullText.length < fib.ccpText)
+      return void 0;
     const bodyText = fullText.slice(0, fib.ccpText);
     const boundaries = paragraphBoundaries(bodyText);
     let start = 0;
@@ -9999,7 +11074,9 @@ function readOleDocParagraphs(docBytes) {
 }
 function shiftSectionTableCps(tableBytes, sed, editEndCp, delta) {
   const view = new DataView(tableBytes.buffer, tableBytes.byteOffset, tableBytes.byteLength);
-  const n = Math.floor((sed.lcb - 4) / (4 + 12));
+  if (sed.lcb < 4 || (sed.lcb - 4) % 16 !== 0 || sed.fc > tableBytes.length - sed.lcb)
+    throw new Error("Invalid section table");
+  const n = (sed.lcb - 4) / 16;
   for (let i = 0; i <= n; i++) {
     const off = sed.fc + i * 4;
     const cp = view.getInt32(off, true);
@@ -10008,31 +11085,101 @@ function shiftSectionTableCps(tableBytes, sed, editEndCp, delta) {
     }
   }
 }
-function writeOleDocParagraphEdit(docBytes, paragraphIndex, text) {
+function writeOleDocParagraphEdit(docBytes, paragraphIndex, text, limits) {
+  return tryWriteOleDocParagraphEdit(docBytes, paragraphIndex, text, limits).bytes;
+}
+function tryWriteOleDocParagraphEdit(docBytes, paragraphIndex, text, limits) {
+  const rejected = (reason) => ({ status: "rejected", bytes: docBytes, reason });
+  let budget;
+  try {
+    budget = processingLimits(limits);
+  } catch {
+    return rejected("invalid-limits");
+  }
+  if (text.length > budget.maxCharacters)
+    return rejected("resource-limit");
+  if (!Number.isInteger(paragraphIndex) || paragraphIndex < 0)
+    return rejected("invalid-paragraph-index");
+  if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/u.test(text))
+    return rejected("invalid-text");
   try {
     const cfb = unwrapDocBytes(docBytes);
     if (!cfb) {
-      return docBytes;
+      return rejected("invalid-payload");
     }
     const fib = readDocFib(cfb.wordDocBytes);
-    if (hasUnsupportedFeatures(cfb.wordDocBytes, fib)) {
-      return docBytes;
-    }
-    const pieces = parsePieceTable(cfb.tableBytes, fib.clx);
-    const fullText = decodePiecesText(cfb.wordDocBytes, pieces);
+    if (fib.ccpText > budget.maxCharacters)
+      return rejected("resource-limit");
+    const { pieces, prcBytes } = parseDocClx(cfb.tableBytes, fib.clx, budget.maxPieces);
+    const totalCp = pieces.at(-1)?.cpEnd ?? 0;
+    if (totalCp > fib.ccpText + fib.ccpOtherStories + 1)
+      return rejected("invalid-document");
+    const fullText = decodePiecesText(cfb.wordDocBytes, pieces, fib.ccpText);
+    if (fullText.length < fib.ccpText)
+      return rejected("invalid-document");
     const bodyText = fullText.slice(0, fib.ccpText);
     const boundaries = paragraphBoundaries(bodyText);
     const paragraphEndCp = boundaries[paragraphIndex];
     if (paragraphEndCp === void 0) {
-      return docBytes;
+      return rejected("invalid-paragraph-index");
     }
     const paragraphStartCp = paragraphIndex === 0 ? 0 : boundaries[paragraphIndex - 1];
+    if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/u.test(bodyText.slice(paragraphStartCp, paragraphEndCp)))
+      return rejected("unsupported-features");
+    const sanitizedText = text.replaceAll(/[\r\n]+/gu, " ");
+    if (fib.ccpText - (paragraphEndCp - paragraphStartCp) + sanitizedText.length + 1 > budget.maxCharacters)
+      return rejected("resource-limit");
+    if (sanitizedText.length + 1 === paragraphEndCp - paragraphStartCp && bodyText[paragraphEndCp - 1] === "\r") {
+      const replacement = `${sanitizedText}\r`;
+      const patched = cfb.wordDocBytes.slice();
+      let canPatch = true;
+      for (const piece of pieces) {
+        const start = Math.max(paragraphStartCp, piece.cpStart);
+        const end = Math.min(paragraphEndCp, piece.cpEnd);
+        if (start >= end)
+          continue;
+        const part = replacement.slice(start - paragraphStartCp, end - paragraphStartCp);
+        const unit = piece.compressed ? 1 : 2;
+        const fc = piece.fc + (start - piece.cpStart) * unit;
+        const fcEnd = fc + part.length * unit;
+        if (pieces.some((other) => other !== piece && other.fc < fcEnd && other.fc + (other.cpEnd - other.cpStart) * (other.compressed ? 1 : 2) > fc)) {
+          canPatch = false;
+          break;
+        }
+        const encoded = piece.compressed ? encodeCp1252(part) : encodePieceTextUtf16(part);
+        if (!encoded) {
+          canPatch = false;
+          break;
+        }
+        patched.set(encoded, fc);
+      }
+      if (canPatch)
+        return { status: "edited", strategy: "preserved-runs", bytes: cfb.rewrap(patched, cfb.tableBytes) };
+    }
+    if (!cfb.canRewrite)
+      return rejected("unsupported-container");
+    if (hasUnsupportedFeatures(cfb.wordDocBytes, fib))
+      return rejected("unsupported-features");
+    const delta = sanitizedText.length + 1 - (paragraphEndCp - paragraphStartCp);
+    const mainFields = readFcLcbAt(cfb.wordDocBytes, fib, 16);
+    if (mainFields.lcb > 0) {
+      for (let index = 0; index < fib.fibRgFcLcbCount; index++) {
+        if (index === 16 || index === 87)
+          continue;
+        const other = readFcLcbAt(cfb.wordDocBytes, fib, index);
+        if (other.lcb > 0 && other.fc < mainFields.fc + mainFields.lcb && other.fc + other.lcb > mainFields.fc)
+          return rejected("invalid-document");
+      }
+    }
+    const shiftedFields = shiftDocMainFieldCps(cfb.tableBytes, mainFields, bodyText, paragraphStartCp, paragraphEndCp, delta, budget.maxFieldRecords);
     const { piece: startPiece, fc: startFc } = pieceAndFcAtCp(pieces, paragraphStartCp);
+    if (pieces.some((piece) => piece.cpStart < paragraphEndCp && piece.cpEnd > paragraphStartCp && piece.prm !== startPiece.prm))
+      return rejected("unsupported-features");
+    const { fc: paragraphMarkFc } = pieceAndFcAtCp(pieces, paragraphEndCp - 1);
     const papxBte = parseBteTable(cfb.tableBytes, fib.plcfbtePapx);
     const chpxBte = parseBteTable(cfb.tableBytes, fib.plcfbteChpx);
-    const papxBlob = extractPapxBlob(cfb.wordDocBytes, papxBte, startFc);
+    const papxBlob = extractPapxBlob(cfb.wordDocBytes, papxBte, paragraphMarkFc);
     const chpxBlob = extractChpxBlob(cfb.wordDocBytes, chpxBte, startFc);
-    const sanitizedText = text.replaceAll(/[\r\n]+/gu, " ");
     const { bytes: textBytes, compressed } = encodePieceText(`${sanitizedText}\r`);
     const originalLen = cfb.wordDocBytes.length;
     const newTextFc = originalLen;
@@ -10060,15 +11207,19 @@ function writeOleDocParagraphEdit(docBytes, paragraphIndex, text) {
       fc: newTextFc,
       compressed,
       charLength: sanitizedText.length + 1,
-      flagsWord: startPiece.flagsWord
+      flagsWord: startPiece.flagsWord,
+      prm: startPiece.prm
     });
-    const delta = sanitizedText.length + 1 - (paragraphEndCp - paragraphStartCp);
+    if (newPieces.length > budget.maxPieces)
+      return rejected("resource-limit");
     const newCcpText = fib.ccpText + delta;
-    const clxBytes = buildClxBytes(newPieces);
+    const clxBytes = buildClxBytes(newPieces, prcBytes);
     const papxBteBytes = buildBteTableBytes(newPapxBte);
     const chpxBteBytes = buildBteTableBytes(newChpxBte);
     const newTableBytes = new Uint8Array(cfb.tableBytes.length + clxBytes.length + papxBteBytes.length + chpxBteBytes.length);
     newTableBytes.set(cfb.tableBytes, 0);
+    if (shiftedFields)
+      newTableBytes.set(shiftedFields, mainFields.fc);
     let tableOff = cfb.tableBytes.length;
     const newClx = { fc: tableOff, lcb: clxBytes.length };
     newTableBytes.set(clxBytes, tableOff);
@@ -10086,9 +11237,15 @@ function writeOleDocParagraphEdit(docBytes, paragraphIndex, text) {
       plcfbteChpx: newChpxBteFcLcb,
       plcfbtePapx: newPapxBteFcLcb
     });
-    return cfb.rewrap(newWordDoc, newTableBytes);
-  } catch {
-    return docBytes;
+    return { status: "edited", strategy: "piece-append", bytes: cfb.rewrap(newWordDoc, newTableBytes) };
+  } catch (error) {
+    if (error instanceof UnsupportedDocFieldEditError)
+      return rejected("unsupported-features");
+    if (error instanceof DocResourceLimitError)
+      return rejected("resource-limit");
+    if (error instanceof DocCfbRewriteError)
+      return rejected("unsupported-container");
+    return rejected("invalid-document");
   }
 }
 
@@ -10145,6 +11302,7 @@ function makeModel(paragraphs) {
 async function loadLegacyDoc(input) {
   const original = toBytes2(input);
   let streams2 = [];
+  let wordDocument = null;
   try {
     const parsed = parseOle2(
       original.buffer.slice(
@@ -10153,6 +11311,7 @@ async function loadLegacyDoc(input) {
       )
     );
     streams2 = parsed.entries.map((entry) => entry.name);
+    wordDocument = readCompoundFileStream(original, ["WordDocument"]) ?? null;
   } catch (error) {
     throw new LegacyDocError(
       `Invalid or truncated OLE compound file: ${error instanceof Error ? error.message : "parse failed"}`
@@ -10163,9 +11322,13 @@ async function loadLegacyDoc(input) {
       "This is a password-protected .docx, not a legacy .doc: open it with loadDocument and its password."
     );
   }
-  const cfb = unwrapDocBytes(original);
-  if (cfb && (readDocFib(cfb.wordDocBytes).flags1 & 1 << 8) !== 0) {
-    throw new LegacyDocError("Encrypted legacy Word documents are not supported.");
+  if (wordDocument) {
+    try {
+      readDocFib(wordDocument);
+    } catch (error) {
+      if (error instanceof Error && error.message === "Encrypted or obfuscated Word document")
+        throw new LegacyDocError("Encrypted legacy Word documents are not supported.");
+    }
   }
   const paragraphs = readOleDocParagraphs(original);
   if (!paragraphs) {