ooxml-core 1.12.2 → 1.14.0

package/dist/pptx/index.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
-var JSZip17 = require('jszip');
+var JSZip = require('jszip');
 var fastXmlParser = require('fast-xml-parser');
 var xmldom = require('@xmldom/xmldom');
 var mtxDecompressor = require('mtx-decompressor');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
-var JSZip17__default = /*#__PURE__*/_interopDefault(JSZip17);
+var JSZip__default = /*#__PURE__*/_interopDefault(JSZip);
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -3416,11 +3416,11 @@ function normalizeChartContainerChildren(container2, containerLocal, getLocalNam
       }
     }
   }
-  const required = REQUIRED_LEADING_CHILD[containerLocal];
-  if (required) {
-    const present = Object.keys(container2).some((k) => getLocalName2(k) === required.local);
+  const required2 = REQUIRED_LEADING_CHILD[containerLocal];
+  if (required2) {
+    const present = Object.keys(container2).some((k) => getLocalName2(k) === required2.local);
     if (!present) {
-      container2[`c:${required.local}`] = { "@_val": required.val };
+      container2[`c:${required2.local}`] = { "@_val": required2.val };
     }
   }
 }
@@ -4899,6 +4899,14 @@ var init_SlideBuilder = __esm({
     };
   }
 });
+
+// pptx/core/builders/sdk/PresentationBuilder.ts
+var PresentationBuilder_exports = {};
+__export(PresentationBuilder_exports, {
+  PresentationBuilder: () => exports.PresentationBuilder,
+  STANDARD_LAYOUTS: () => STANDARD_LAYOUTS,
+  buildBlankPresentationArchive: () => buildBlankPresentationArchive
+});
 function normalizeSrgbHex(color2) {
   if (!color2) {
     return void 0;
@@ -5206,7 +5214,7 @@ async function buildBlankPresentationArchive(options) {
   const layoutCount = STANDARD_LAYOUTS.length;
   const initialSlideCount = Math.max(0, options?.initialSlideCount ?? 0);
   const blankLayoutIdx = STANDARD_LAYOUTS.findIndex((l) => l.type === "blank") + 1 || 7;
-  const zip = new JSZip17__default.default();
+  const zip = new JSZip__default.default();
   zip.file("[Content_Types].xml", contentTypesXml(layoutCount, initialSlideCount));
   zip.file("_rels/.rels", rootRelsXml());
   zip.file(
@@ -12582,7 +12590,7 @@ function gd16(name, formula) {
   const parts = formula.trim().split(/\s+/);
   return { name, formula, args: parts.slice(1) };
 }
-var FULL_RECT11, rect, roundRect, ellipse, triangle, rtTriangle, parallelogram, trapezoid, diamond, pentagon, hexagon, heptagon, octagon, decagon, dodecagon, pie, pieWedge, chord, arc, donut, noSmoking, blockArc, rightArrow, leftArrow, upArrow, downArrow, wedgeRectCallout, wedgeRoundRectCallout, wedgeEllipseCallout, star4, star5; exports.PRESET_SHAPE_GEOMETRY_TABLE = void 0;
+var FULL_RECT11, rect, roundRect, ellipse, triangle, rtTriangle, parallelogram, trapezoid, diamond, pentagon, hexagon, heptagon, octagon, decagon, dodecagon, pie, pieWedge, chord, arc, donut, noSmoking, blockArc, rightArrow, leftArrow, upArrow, downArrow, wedgePointerGuides, wedgeRectCallout, wedgeRoundRectCallout, wedgeEllipseCallout, star4, star5; exports.PRESET_SHAPE_GEOMETRY_TABLE = void 0;
 var init_preset_shape_definitions_table = __esm({
   "geometry/preset-shape-definitions-table.ts"() {
     init_preset_shape_definitions_action_buttons();
@@ -13376,55 +13384,65 @@ var init_preset_shape_definitions_table = __esm({
         }
       ]
     };
+    wedgePointerGuides = [
+      gd16("dxPos", "*/ w adj1 100000"),
+      gd16("dyPos", "*/ h adj2 100000"),
+      gd16("xPos", "+- hc dxPos 0"),
+      gd16("yPos", "+- vc dyPos 0"),
+      gd16("dx", "+- xPos 0 hc"),
+      gd16("dy", "+- yPos 0 vc"),
+      gd16("dq", "*/ dxPos h w"),
+      gd16("ady", "abs dy"),
+      gd16("adq", "abs dq"),
+      gd16("dz", "+- ady 0 adq"),
+      gd16("xg1", "?: dxPos 7 2"),
+      gd16("xg2", "?: dxPos 10 5"),
+      gd16("x1", "*/ w xg1 12"),
+      gd16("x2", "*/ w xg2 12"),
+      gd16("yg1", "?: dyPos 7 2"),
+      gd16("yg2", "?: dyPos 10 5"),
+      gd16("y1", "*/ h yg1 12"),
+      gd16("y2", "*/ h yg2 12"),
+      gd16("t1", "?: dxPos l xPos"),
+      gd16("xl", "?: dz l t1"),
+      gd16("t2", "?: dyPos x1 xPos"),
+      gd16("xt", "?: dz t2 x1"),
+      gd16("t3", "?: dxPos xPos r"),
+      gd16("xr", "?: dz r t3"),
+      gd16("t4", "?: dyPos xPos x1"),
+      gd16("xb", "?: dz t4 x1"),
+      gd16("t5", "?: dxPos y1 yPos"),
+      gd16("yl", "?: dz y1 t5"),
+      gd16("t6", "?: dyPos t yPos"),
+      gd16("yt", "?: dz t6 t"),
+      gd16("t7", "?: dxPos yPos y1"),
+      gd16("yr", "?: dz y1 t7"),
+      gd16("t8", "?: dyPos yPos b"),
+      gd16("yb", "?: dz t8 b")
+    ];
     wedgeRectCallout = {
       name: "wedgeRectCallout",
       avLst: { adj1: -20833, adj2: 62500 },
-      gdLst: [
-        gd16("dxPos", "*/ w adj1 100000"),
-        gd16("dyPos", "*/ h adj2 100000"),
-        gd16("xPos", "+- hc dxPos 0"),
-        gd16("yPos", "+- vc dyPos 0"),
-        gd16("dx", "+- xPos 0 hc"),
-        gd16("dy", "+- yPos 0 vc"),
-        gd16("dq", "*/ dxPos h w"),
-        gd16("ady", "abs dy"),
-        gd16("adq", "abs dq"),
-        gd16("xg1", "?: dxPos 7 2"),
-        gd16("xg2", "?: dxPos 10 5"),
-        gd16("x1", "*/ w xg1 12"),
-        gd16("x2", "*/ w xg2 12"),
-        gd16("yg1", "?: dyPos 7 2"),
-        gd16("yg2", "?: dyPos 10 5"),
-        gd16("y1", "*/ h yg1 12"),
-        gd16("y2", "*/ h yg2 12"),
-        gd16("t1", "?: dxPos l xPos"),
-        gd16("xl", "?: ady adq t1 l"),
-        gd16("t2", "?: dyPos yPos t"),
-        gd16("yt", "?: ady adq t t2"),
-        gd16("t3", "?: dxPos xPos r"),
-        gd16("xr", "?: ady adq t3 r"),
-        gd16("t4", "?: dyPos b yPos"),
-        gd16("yb", "?: ady adq b t4")
-      ],
+      gdLst: wedgePointerGuides,
       rect: FULL_RECT11,
       pathLst: [
         {
           commands: [
             { kind: "moveTo", x: "l", y: "t" },
             { kind: "lnTo", x: "x1", y: "t" },
-            { kind: "lnTo", x: "xl", y: "yt" },
+            { kind: "lnTo", x: "xt", y: "yt" },
             { kind: "lnTo", x: "x2", y: "t" },
             { kind: "lnTo", x: "r", y: "t" },
             { kind: "lnTo", x: "r", y: "y1" },
-            { kind: "lnTo", x: "xr", y: "yt" },
+            { kind: "lnTo", x: "xr", y: "yr" },
             { kind: "lnTo", x: "r", y: "y2" },
             { kind: "lnTo", x: "r", y: "b" },
             { kind: "lnTo", x: "x2", y: "b" },
-            { kind: "lnTo", x: "xl", y: "yb" },
+            { kind: "lnTo", x: "xb", y: "yb" },
             { kind: "lnTo", x: "x1", y: "b" },
             { kind: "lnTo", x: "l", y: "b" },
             { kind: "lnTo", x: "l", y: "y2" },
-            { kind: "lnTo", x: "xr", y: "yb" },
+            { kind: "lnTo", x: "xl", y: "yl" },
             { kind: "lnTo", x: "l", y: "y1" },
             { kind: "close" }
           ]
@@ -13435,31 +13453,38 @@ var init_preset_shape_definitions_table = __esm({
       name: "wedgeRoundRectCallout",
       avLst: { adj1: -20833, adj2: 62500, adj3: 16667 },
       gdLst: [
-        gd16("dxPos", "*/ w adj1 100000"),
-        gd16("dyPos", "*/ h adj2 100000"),
-        gd16("xPos", "+- hc dxPos 0"),
-        gd16("yPos", "+- vc dyPos 0"),
+        ...wedgePointerGuides,
         gd16("a3", "pin 0 adj3 50000"),
         gd16("rad", "*/ ss a3 100000"),
-        gd16("x1", "+- l rad 0"),
-        gd16("x2", "+- r 0 rad"),
-        gd16("y1", "+- t rad 0"),
-        gd16("y2", "+- b 0 rad")
+        gd16("xc1", "+- l rad 0"),
+        gd16("xc2", "+- r 0 rad"),
+        gd16("yc1", "+- t rad 0"),
+        gd16("yc2", "+- b 0 rad")
       ],
       rect: FULL_RECT11,
       pathLst: [
         {
           commands: [
-            { kind: "moveTo", x: "l", y: "y1" },
+            { kind: "moveTo", x: "l", y: "yc1" },
             { kind: "arcTo", wR: "rad", hR: "rad", stAng: "cd2", swAng: "cd4" },
+            { kind: "lnTo", x: "x1", y: "t" },
+            { kind: "lnTo", x: "xt", y: "yt" },
             { kind: "lnTo", x: "x2", y: "t" },
+            { kind: "lnTo", x: "xc2", y: "t" },
             { kind: "arcTo", wR: "rad", hR: "rad", stAng: "3cd4", swAng: "cd4" },
+            { kind: "lnTo", x: "r", y: "y1" },
+            { kind: "lnTo", x: "xr", y: "yr" },
             { kind: "lnTo", x: "r", y: "y2" },
+            { kind: "lnTo", x: "r", y: "yc2" },
             { kind: "arcTo", wR: "rad", hR: "rad", stAng: "0", swAng: "cd4" },
-            { kind: "lnTo", x: "xPos", y: "b" },
-            { kind: "lnTo", x: "xPos", y: "yPos" },
+            { kind: "lnTo", x: "x2", y: "b" },
+            { kind: "lnTo", x: "xb", y: "yb" },
             { kind: "lnTo", x: "x1", y: "b" },
+            { kind: "lnTo", x: "xc1", y: "b" },
             { kind: "arcTo", wR: "rad", hR: "rad", stAng: "cd4", swAng: "cd4" },
+            { kind: "lnTo", x: "l", y: "y2" },
+            { kind: "lnTo", x: "xl", y: "yl" },
+            { kind: "lnTo", x: "l", y: "y1" },
             { kind: "close" }
           ]
         }
@@ -13474,7 +13499,7 @@ var init_preset_shape_definitions_table = __esm({
         gd16("xPos", "+- hc dxPos 0"),
         gd16("yPos", "+- vc dyPos 0"),
         gd16("sdx", "*/ dxPos hd2 wd2"),
-        gd16("sdy", "val dyPos"),
+        gd16("sdy", "*/ dyPos wd2 hd2"),
         gd16("pang", "at2 sdx sdy"),
         gd16("stAng", "+- pang 660000 0"),
         gd16("enAng", "+- pang 0 660000"),
@@ -13486,17 +13511,15 @@ var init_preset_shape_definitions_table = __esm({
         gd16("dy2", "sin hd2 enAng"),
         gd16("x2", "+- hc dx2 0"),
         gd16("y2", "+- vc dy2 0"),
-        gd16("stAng1", "at2 dx1 dy1"),
-        gd16("enAngFinal", "at2 dx2 dy2"),
-        gd16("swAng1", "+- enAngFinal 0 stAng1"),
-        gd16("swAng", "?: swAng1 swAng1 +- swAng1 21600000 0")
+        // The arc runs the long way round, from the first pointer edge to the second.
+        gd16("swAng", "+- 21600000 0 1320000")
       ],
       rect: FULL_RECT11,
       pathLst: [
         {
           commands: [
             { kind: "moveTo", x: "x1", y: "y1" },
-            { kind: "arcTo", wR: "wd2", hR: "hd2", stAng: "stAng1", swAng: "swAng" },
+            { kind: "arcTo", wR: "wd2", hR: "hd2", stAng: "stAng", swAng: "swAng" },
             { kind: "lnTo", x: "xPos", y: "yPos" },
             { kind: "close" }
           ]
@@ -22855,6 +22878,216 @@ var init_ole_embedded_replace = __esm({
     CONTENTS_STREAM2 = "CONTENTS";
   }
 });
+function isSafePartName(name) {
+  if (name.includes("\0") || name.includes("\\")) return false;
+  if (/^[A-Za-z]:/u.test(name)) return false;
+  const body = name.startsWith("/") ? name.slice(1) : name;
+  if (body.startsWith("/")) return false;
+  return !body.split("/").some((segment) => segment === "..");
+}
+function declaredEntrySize(entry2) {
+  const data = entry2._data;
+  const size = Number(data?.uncompressedSize ?? 0);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+function resolveLimits(limits) {
+  const create = limits.createError;
+  return {
+    maxEntries: limits.maxEntries ?? DEFAULT_ZIP_LIMITS.maxEntries,
+    maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
+    maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
+    label: limits.label ?? "ZIP",
+    fail: (message, limit) => create ? create(message, { limit }) : new ZipLimitError(message, { limit })
+  };
+}
+function inflateEntryGuarded(entry2, alreadyRead, limits) {
+  const r = resolveLimits(limits);
+  const declared = declaredEntrySize(entry2);
+  return new Promise((resolvePromise, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    const stream = entry2.internalStream("uint8array");
+    const abort = (error) => {
+      if (done) return;
+      done = true;
+      stream.pause();
+      chunks.length = 0;
+      reject(error);
+    };
+    stream.on("data", (chunk2) => {
+      if (done) return;
+      size += chunk2.byteLength;
+      if (size > declared || size > r.maxEntryBytes)
+        return abort(
+          r.fail(`${r.label} part ${entry2.name} inflates past its declared size`, r.maxEntryBytes)
+        );
+      if (alreadyRead + size > r.maxTotalBytes)
+        return abort(
+          r.fail(
+            `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
+            r.maxTotalBytes
+          )
+        );
+      chunks.push(chunk2);
+    });
+    stream.on("error", (error) => abort(error));
+    stream.on("end", () => {
+      if (done) return;
+      done = true;
+      if (chunks.length === 1 && chunks[0]) return resolvePromise(chunks[0]);
+      const out = new Uint8Array(size);
+      let offset = 0;
+      for (const chunk2 of chunks) {
+        out.set(chunk2, offset);
+        offset += chunk2.byteLength;
+      }
+      resolvePromise(out);
+    });
+    stream.resume();
+  });
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (let i2 = 0; i2 < bytes.length; i2 += 32768)
+    binary += String.fromCharCode(...bytes.subarray(i2, i2 + 32768));
+  return btoa(binary);
+}
+function guardZip(zip, limits = {}) {
+  const r = resolveLimits(limits);
+  const entries = Object.values(zip.files);
+  if (entries.length > r.maxEntries)
+    throw r.fail(
+      `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
+      r.maxEntries
+    );
+  let declared = 0;
+  for (const entry2 of entries) {
+    const original = entry2.unsafeOriginalName;
+    if (!isSafePartName(entry2.name) || original !== void 0 && !isSafePartName(original))
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+    if (entry2.dir) continue;
+    const size = declaredEntrySize(entry2);
+    if (size > r.maxEntryBytes)
+      throw r.fail(
+        `${r.label} part ${entry2.name} exceeds the uncompressed part size limit`,
+        r.maxEntryBytes
+      );
+    declared += size;
+  }
+  if (declared > r.maxTotalBytes)
+    throw r.fail(
+      `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
+      r.maxTotalBytes
+    );
+  const produced = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const entry2 of entries) {
+    if (entry2.dir) continue;
+    const inflateOriginal = entry2.async.bind(entry2);
+    entry2.async = async (type, onUpdate) => {
+      const previous = produced.get(entry2.name) ?? 0;
+      const bytes = await inflateEntryGuarded(entry2, total - previous, limits);
+      if (bytes.byteLength > previous) {
+        total += bytes.byteLength - previous;
+        produced.set(entry2.name, bytes.byteLength);
+      }
+      switch (type) {
+        case "uint8array":
+          return bytes;
+        case "string":
+        case "text":
+          return new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes);
+        case "arraybuffer":
+          return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+        case "base64":
+          return toBase64(bytes);
+        default:
+          return inflateOriginal(type, onUpdate);
+      }
+    };
+  }
+  return zip;
+}
+async function openZip(input, limits = {}) {
+  const r = resolveLimits(limits);
+  const maxInput = limits.maxInputBytes ?? DEFAULT_ZIP_LIMITS.maxInputBytes;
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  if (bytes.byteLength > maxInput)
+    throw r.fail(
+      `${r.label} package exceeds the ${mib(maxInput)} MiB compressed input limit`,
+      maxInput
+    );
+  return guardZip(await JSZip__default.default.loadAsync(bytes), limits);
+}
+var DEFAULT_ZIP_LIMITS, ZipLimitError, mib;
+var init_zip_limits = __esm({
+  "opc/zip-limits.ts"() {
+    DEFAULT_ZIP_LIMITS = {
+      maxInputBytes: 100 * 1024 * 1024,
+      maxEntries: 1e4,
+      maxEntryBytes: 100 * 1024 * 1024,
+      maxTotalBytes: 100 * 1024 * 1024
+    };
+    ZipLimitError = class extends Error {
+      code = "ZIP_BOMB";
+      limit;
+      constructor(message, details) {
+        super(message);
+        this.name = "ZipLimitError";
+        this.limit = details.limit;
+      }
+    };
+    mib = (bytes) => Math.round(bytes / 1048576);
+  }
+});
+
+// pptx/core/core/types.ts
+exports.DEFAULT_MAX_UNCOMPRESSED_BYTES = void 0; exports.MAX_ZIP_ENTRY_COUNT = void 0; exports.ZipBombError = void 0;
+var init_types2 = __esm({
+  "pptx/core/core/types.ts"() {
+    exports.DEFAULT_MAX_UNCOMPRESSED_BYTES = 500 * 1024 * 1024;
+    exports.MAX_ZIP_ENTRY_COUNT = 65536;
+    exports.ZipBombError = class extends Error {
+      code = "ZIP_BOMB";
+      uncompressedBytes;
+      limit;
+      entryCount;
+      constructor(message, details) {
+        super(message);
+        this.name = "ZipBombError";
+        this.uncompressedBytes = details.uncompressedBytes;
+        this.limit = details.limit;
+        this.entryCount = details.entryCount;
+      }
+    };
+  }
+});
+
+// pptx/core/utils/zip-open.ts
+function openPptxZip(bytes) {
+  return openZip(bytes, {
+    label: "PPTX",
+    maxInputBytes: exports.DEFAULT_MAX_UNCOMPRESSED_BYTES,
+    maxEntries: exports.MAX_ZIP_ENTRY_COUNT,
+    maxEntryBytes: exports.DEFAULT_MAX_UNCOMPRESSED_BYTES,
+    maxTotalBytes: exports.DEFAULT_MAX_UNCOMPRESSED_BYTES,
+    createError
+  });
+}
+function openNestedZip(bytes) {
+  return openZip(bytes, { label: "Embedded", createError });
+}
+var createError;
+var init_zip_open = __esm({
+  "pptx/core/utils/zip-open.ts"() {
+    init_zip_limits();
+    init_types2();
+    createError = (message, details) => new exports.ZipBombError(message, details);
+  }
+});
+
+// pptx/core/utils/ole-payload-kind.ts
 function isZipMagic(bytes) {
   if (bytes.length < 4) {
     return false;
@@ -22867,7 +23100,7 @@ async function detectOlePayloadEditorKind(bytes) {
   }
   if (isZipMagic(bytes)) {
     try {
-      const zip = await JSZip17__default.default.loadAsync(bytes);
+      const zip = await openNestedZip(bytes);
       if (zip.file("xl/workbook.xml")) {
         return "sheet-xlsx";
       }
@@ -22903,6 +23136,7 @@ async function detectOlePayloadEditorKind(bytes) {
 var ZIP_MAGIC;
 var init_ole_payload_kind = __esm({
   "pptx/core/utils/ole-payload-kind.ts"() {
+    init_zip_open();
     init_ole_embedded_extract();
     init_ole2_parser_read2();
     ZIP_MAGIC = [80, 75, 3, 4];
@@ -23357,7 +23591,7 @@ function cellDisplayValue(cell, sharedStrings) {
 }
 async function readOleSheetGrid(xlsxBytes, maxRows = DEFAULT_MAX_ROWS, maxCols = DEFAULT_MAX_COLS) {
   try {
-    const zip = await JSZip17__default.default.loadAsync(xlsxBytes);
+    const zip = await openNestedZip(xlsxBytes);
     const sheetFile = zip.file(FIRST_SHEET_PATH);
     if (!sheetFile) {
       return void 0;
@@ -23416,7 +23650,7 @@ function markFullCalcOnLoad(workbookXml, parser, builder3) {
 }
 async function writeOleSheetCellEdit(xlsxBytes, edit) {
   try {
-    const zip = await JSZip17__default.default.loadAsync(xlsxBytes);
+    const zip = await openNestedZip(xlsxBytes);
     const sheetFile = zip.file(FIRST_SHEET_PATH);
     if (!sheetFile) {
       return xlsxBytes;
@@ -23454,6 +23688,7 @@ async function writeOleSheetCellEdit(xlsxBytes, edit) {
 var FIRST_SHEET_PATH, DEFAULT_MAX_ROWS, DEFAULT_MAX_COLS;
 var init_ole_sheet_xlsx_editor = __esm({
   "pptx/core/utils/ole-sheet-xlsx-editor.ts"() {
+    init_zip_open();
     init_chart_xlsx_cellref();
     init_chart_xlsx_sheet_cells();
     init_xml_access();
@@ -24574,7 +24809,7 @@ function paragraphText(paragraph) {
 }
 async function readOleDocumentParagraphs(docxBytes) {
   try {
-    const zip = await JSZip17__default.default.loadAsync(docxBytes);
+    const zip = await openNestedZip(docxBytes);
     const documentFile = zip.file(DOCUMENT_PART_PATH);
     if (!documentFile) {
       return void 0;
@@ -24592,7 +24827,7 @@ async function readOleDocumentParagraphs(docxBytes) {
 }
 async function writeOleDocumentParagraphEdit(docxBytes, paragraphIndex, text2) {
   try {
-    const zip = await JSZip17__default.default.loadAsync(docxBytes);
+    const zip = await openNestedZip(docxBytes);
     const documentFile = zip.file(DOCUMENT_PART_PATH);
     if (!documentFile) {
       return docxBytes;
@@ -24638,6 +24873,7 @@ async function writeOleDocumentParagraphEdit(docxBytes, paragraphIndex, text2) {
 var DOCUMENT_PART_PATH;
 var init_ole_document_docx_editor = __esm({
   "pptx/core/utils/ole-document-docx-editor.ts"() {
+    init_zip_open();
     init_xml_access();
     DOCUMENT_PART_PATH = "word/document.xml";
   }
@@ -30875,7 +31111,7 @@ function parseStatement(element, state) {
         rules: element.children.filter((c) => c.name === "rule").map((c) => parseRule(c.attrs))
       };
     case "varLst": {
-      const vars = {};
+      const vars = /* @__PURE__ */ Object.create(null);
       for (const entry2 of element.children) {
         vars[entry2.name] = entry2.attrs.val ?? "";
       }
@@ -31085,6 +31321,9 @@ function walk(statements, point2, node, state) {
         }
         state.depth++;
         for (const next of iteratePoints(point2, forEach.iterator)) {
+          if (state.counter >= MAX_NODES) {
+            break;
+          }
           walk(forEach.body, next, node, state);
         }
         state.depth--;
@@ -31127,10 +31366,17 @@ function walk(statements, point2, node, state) {
   }
 }
 function recordedVars(point2, name) {
-  return point2.source?.presLayoutVarsByName?.[name] ?? {};
+  const byName = point2.source?.presLayoutVarsByName;
+  if (!byName || !Object.prototype.hasOwnProperty.call(byName, name)) {
+    return {};
+  }
+  return byName[name] ?? {};
+}
+function variableMap(...sources) {
+  return Object.assign(/* @__PURE__ */ Object.create(null), ...sources);
 }
 function buildNode(def, point2, parent, state) {
-  if (state.depth > MAX_DEPTH) {
+  if (state.depth > MAX_DEPTH || state.counter >= MAX_NODES) {
     return void 0;
   }
   const node = {
@@ -31144,7 +31390,7 @@ function buildNode(def, point2, parent, state) {
     presOfAnchored: false,
     constraints: [],
     rules: [],
-    vars: { ...recordedVars(point2, def.name) },
+    vars: variableMap(recordedVars(point2, def.name)),
     children: [],
     parent,
     order: state.counter++
@@ -31157,12 +31403,13 @@ function buildNode(def, point2, parent, state) {
 function buildPresentationTree(def, doc, options = {}) {
   return buildNode(def.root, doc, void 0, { def, options, counter: 0, depth: 0 });
 }
-var MAX_DEPTH;
+var MAX_DEPTH, MAX_NODES;
 var init_pres_tree = __esm({
   "diagram/engine/pres-tree.ts"() {
     init_axis();
     init_conditions();
     MAX_DEPTH = 96;
+    MAX_NODES = 1e5;
   }
 });
 
@@ -44504,7 +44751,7 @@ var init_smartart_decompose = __esm({
 });
 
 // diagram/types.ts
-var init_types2 = __esm({
+var init_types3 = __esm({
   "diagram/types.ts"() {
   }
 });
@@ -44914,6 +45161,8 @@ var init_namespaces = __esm({
       a: "http://schemas.openxmlformats.org/drawingml/2006/main",
       /** DrawingML chart. */
       c: "http://schemas.openxmlformats.org/drawingml/2006/chart",
+      /** Office 2016 extended charts (waterfall, histogram, funnel...; `cx:chartSpace`). */
+      cx: "http://schemas.microsoft.com/office/drawing/2014/chartex",
       /** Office 2010 chart extensions, including built-in modern chart styles. */
       c14: "http://schemas.microsoft.com/office/drawing/2007/8/2/chart",
       /** DrawingML diagram (SmartArt) main. */
@@ -44971,10 +45220,29 @@ var init_namespaces = __esm({
     };
   }
 });
+function checkXmlLimits(xml, label, limits = {}) {
+  const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
+  const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
+  let depth = 0;
+  let nodes = 0;
+  for (const match of xml.matchAll(MARKUP_RE)) {
+    const [, closing, name, selfClosing] = match;
+    if (name === void 0) continue;
+    if (closing) {
+      depth--;
+      continue;
+    }
+    nodes++;
+    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (!selfClosing && ++depth > maxDepth2)
+      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth2}`);
+  }
+}
 function parseXml(xml, options = {}) {
   const label = options.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
     throw new Error(`${label} XML with DTD or entity declarations is not supported`);
+  checkXmlLimits(xml, label, options.limits);
   let parseError = "";
   let parsed;
   try {
@@ -45000,10 +45268,15 @@ function named(element, local, ns, lenient = true) {
 function attr(element, local, ns, prefix) {
   return element?.getAttributeNS(ns, local) ?? element?.getAttribute(`${prefix}:${local}`) ?? void 0;
 }
-var buildXml, isElement, elements, children2, first, relAttr;
+var DEFAULT_XML_LIMITS, MARKUP_RE, buildXml, isElement, elements, children2, first, relAttr;
 var init_xml = __esm({
   "xml/xml.ts"() {
     init_namespaces();
+    DEFAULT_XML_LIMITS = {
+      maxDepth: 512,
+      maxNodes: 5e6
+    };
+    MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
     buildXml = (node) => new xmldom.XMLSerializer().serializeToString(node);
     isElement = (node) => node.nodeType === 1;
     elements = (parent) => Array.from(parent.childNodes).filter(isElement);
@@ -45115,7 +45388,9 @@ var init_content_types = __esm({
 
 // opc/package.ts
 function attr2(tag, name) {
-  return new RegExp(`${name}="([^"]*)"`).exec(tag)?.[1];
+  const escaped2 = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = new RegExp(`(?<=[\\s<])${escaped2}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`).exec(tag);
+  return match ? match[1] ?? match[2] : void 0;
 }
 async function ensureContentTypeOverride(zip, partName, contentType) {
   const xml = await zip.file(CONTENT_TYPES_PATH)?.async("string") ?? EMPTY_TYPES;
@@ -45211,7 +45486,7 @@ var init_embedded_packages = __esm({
 
 // opc/properties/types.ts
 var CUSTOM_PROPERTIES_FMTID, PROPERTY_CONTENT_TYPES;
-var init_types3 = __esm({
+var init_types4 = __esm({
   "opc/properties/types.ts"() {
     CUSTOM_PROPERTIES_FMTID = "{D5CDD505-2E9C-101B-9397-08002B2CF9AE}";
     PROPERTY_CONTENT_TYPES = {
@@ -45683,7 +45958,7 @@ var escape, isVt, INT32;
 var init_custom = __esm({
   "opc/properties/custom.ts"() {
     init_xml2();
-    init_types3();
+    init_types4();
     escape = (text2, attribute7 = false) => {
       const out = text2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
       return attribute7 ? out.replace(/"/g, "&quot;") : out;
@@ -45725,7 +46000,7 @@ var init_title_groups = __esm({
 // opc/properties/index.ts
 var init_properties = __esm({
   "opc/properties/index.ts"() {
-    init_types3();
+    init_types4();
     init_core();
     init_app();
     init_custom();
@@ -45875,8 +46150,11 @@ async function verifySignatureDigests(signature, getPartContent) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     return "unverified";
   }
+  let checked = 0;
+  let skipped = false;
   for (const ref of signature.references) {
     if (!ref.digestValue || !ref.uri) {
+      skipped = true;
       continue;
     }
     const algo = ref.digestMethod?.toLowerCase() || "";
@@ -45888,23 +46166,24 @@ async function verifySignatureDigests(signature, getPartContent) {
     } else if (algo.includes("sha1") || algo.includes("sha-1")) {
       hashAlgo = "SHA-1";
     } else {
+      skipped = true;
       continue;
     }
     const content2 = await getPartContent(ref.uri);
     if (!content2) {
-      continue;
+      return "invalid";
     }
     try {
       const digest = await crypto.subtle.digest(hashAlgo, content2);
-      const digestBase64 = arrayBufferToBase64(digest);
-      if (digestBase64 !== ref.digestValue) {
+      if (arrayBufferToBase64(digest) !== ref.digestValue) {
         return "invalid";
       }
+      checked++;
     } catch {
       return "unverified";
     }
   }
-  return signature.certificate ? "valid" : "unknownCA";
+  return checked > 0 && !skipped ? "digestsMatch" : "unverified";
 }
 function arrayBufferToBase64(buffer) {
   const bytes = new Uint8Array(buffer);
@@ -45977,32 +46256,61 @@ function extractTagAttribute(xml, tagName, attributeName) {
   const match = xml.match(pattern);
   return match?.groups?.["attributeValue"]?.trim();
 }
+function matchName(xml, lowerXml, from, lname) {
+  let pos2 = from;
+  if (!lowerXml.startsWith(lname, pos2)) {
+    let end = pos2;
+    while (isNameChar2(xml[end])) end++;
+    if (end === pos2 || xml[end] !== ":") return -1;
+    pos2 = end + 1;
+    if (!lowerXml.startsWith(lname, pos2)) return -1;
+  }
+  return pos2 + lname.length;
+}
+function findTagText(xml, lowerXml, lname, from) {
+  let lt = xml.indexOf("<", from);
+  while (lt !== -1) {
+    const afterName = matchName(xml, lowerXml, lt + 1, lname);
+    if (afterName !== -1 && !isWordChar(xml[afterName])) {
+      const gt = xml.indexOf(">", afterName);
+      if (gt === -1) return null;
+      let close = xml.indexOf("</", gt + 1);
+      while (close !== -1) {
+        const closeEnd = matchName(xml, lowerXml, close + 2, lname);
+        if (closeEnd !== -1 && xml[closeEnd] === ">") {
+          return { text: xml.slice(gt + 1, close), end: closeEnd + 1 };
+        }
+        close = xml.indexOf("</", close + 2);
+      }
+      return null;
+    }
+    lt = xml.indexOf("<", lt + 1);
+  }
+  return null;
+}
 function extractFirstTagText(xml, localName29) {
-  const pattern = new RegExp(
-    `<([\\w.-]+:)?${localName29}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName29}>`,
-    "i"
-  );
-  const match = xml.match(pattern);
-  return match?.[2]?.replace(/\s+/g, "").trim() || void 0;
+  const found = findTagText(xml, xml.toLowerCase(), localName29.toLowerCase(), 0);
+  return found?.text.replace(/\s+/g, "").trim() || void 0;
 }
 function extractAllTagText(xml, localName29) {
   const result = [];
-  const regex = new RegExp(
-    `<([\\w.-]+:)?${localName29}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName29}>`,
-    "gi"
-  );
-  let match = regex.exec(xml);
-  while (match) {
-    const value = match[2]?.replace(/\s+/g, "").trim();
+  const lowerXml = xml.toLowerCase();
+  const lname = localName29.toLowerCase();
+  let found = findTagText(xml, lowerXml, lname, 0);
+  while (found) {
+    const value = found.text.replace(/\s+/g, "").trim();
     if (value) {
       result.push(value);
     }
-    match = regex.exec(xml);
+    found = findTagText(xml, lowerXml, lname, found.end);
   }
   return result;
 }
+var isNameChar2, isWordChar;
 var init_xml_utils2 = __esm({
   "opc/signature/xml-utils.ts"() {
+    isNameChar2 = (c) => c !== void 0 && /[\w.-]/.test(c);
+    isWordChar = (c) => c !== void 0 && /\w/.test(c);
   }
 });
 
@@ -46127,6 +46435,7 @@ var init_opc = __esm({
     init_embedded_packages();
     init_properties();
     init_signature();
+    init_zip_limits();
   }
 });
 
@@ -46840,7 +47149,7 @@ var init_rect_path_gradient = __esm({
 // diagram/index.ts
 var init_diagram = __esm({
   "diagram/index.ts"() {
-    init_types2();
+    init_types3();
     init_engine2();
     init_layout();
     init_hierarchy();
@@ -48749,6 +49058,18 @@ var init_ooxml_crypto_primitives = __esm({
   }
 });
 
+// digest/timing-safe.ts
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let difference = 0;
+  for (let i2 = 0; i2 < a.length; i2++) difference |= a[i2] ^ b[i2];
+  return difference === 0;
+}
+var init_timing_safe = __esm({
+  "digest/timing-safe.ts"() {
+  }
+});
+
 // crypto/aes-ecb.ts
 async function aesEcbDecrypt(key2, data) {
   const plain = await aesCbcDecryptRaw(key2, new Uint8Array(BLOCK), data);
@@ -50623,9 +50944,40 @@ var init_digest2 = __esm({
   }
 });
 
+// digest/password-hash.ts
+function isValidSpinCount(spinCount, maxSpinCount = DEFAULT_MAX_SPIN_COUNT) {
+  const limit = Math.min(maxSpinCount, MAX_SPIN_COUNT);
+  return spinCount === void 0 || Number.isInteger(spinCount) && spinCount >= 0 && spinCount <= limit;
+}
+function spinPasswordHash(password, salt, spinCount, digest) {
+  const input = new Uint8Array(salt.length + password.length * 2);
+  input.set(salt);
+  for (let i2 = 0; i2 < password.length; i2++) {
+    const code = password.charCodeAt(i2);
+    input[salt.length + i2 * 2] = code & 255;
+    input[salt.length + i2 * 2 + 1] = code >> 8;
+  }
+  let value = digest(input);
+  const buffer = new Uint8Array(value.length + 4);
+  const view = new DataView(buffer.buffer);
+  for (let i2 = 0; i2 < spinCount; i2++) {
+    buffer.set(value);
+    view.setUint32(value.length, i2, true);
+    value = digest(buffer);
+  }
+  return value;
+}
+var MAX_SPIN_COUNT, DEFAULT_MAX_SPIN_COUNT;
+var init_password_hash = __esm({
+  "digest/password-hash.ts"() {
+    MAX_SPIN_COUNT = 1e7;
+    DEFAULT_MAX_SPIN_COUNT = 1e6;
+  }
+});
+
 // crypto/key-derivation.ts
-async function spinPassword(password, salt, spinCount, hashAlgorithm) {
-  if (!Number.isInteger(spinCount) || spinCount < 0 || spinCount > MAX_SPIN_COUNT) {
+async function spinPassword(password, salt, spinCount, hashAlgorithm, limits = {}) {
+  if (!isValidSpinCount(spinCount, limits.maxSpinCount)) {
     throw new Error(`Unsupported encryption spin count: ${spinCount}.`);
   }
   const passwordBytes = encodePasswordUtf16LE(password);
@@ -50638,6 +50990,9 @@ async function spinPassword(password, salt, spinCount, hashAlgorithm) {
       view.setUint32(0, i2, true);
       buffer.set(h3, 4);
       h3 = digest(buffer);
+      if (i2 % SPIN_CHUNK === SPIN_CHUNK - 1 && i2 + 1 < spinCount) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      }
     }
     return h3;
   }
@@ -50656,8 +51011,8 @@ async function extendKey(h2, hashAlgorithm, keyLength) {
   const x3 = concatArrays(await pad2(54), await pad2(92));
   return x3.subarray(0, keyLength);
 }
-function computeAgileKeyBase(password, salt, spinCount, hashAlgorithm) {
-  return spinPassword(password, salt, spinCount, hashAlgorithm);
+function computeAgileKeyBase(password, salt, spinCount, hashAlgorithm, limits = {}) {
+  return spinPassword(password, salt, spinCount, hashAlgorithm, limits);
 }
 async function deriveAgileKeyFromBase(base, hashAlgorithm, blockKey, keyBits, hashSize) {
   const h2 = await hash(hashAlgorithm, concatArrays(base, blockKey));
@@ -50683,11 +51038,12 @@ async function generateIV(hashAlgorithm, salt, blockKey, blockSize) {
   padded.set(h2);
   return padded;
 }
-var BLOCK_KEYS, MAX_SPIN_COUNT;
+var BLOCK_KEYS, SPIN_CHUNK;
 var init_key_derivation = __esm({
   "crypto/key-derivation.ts"() {
     init_ooxml_crypto_primitives();
     init_digest2();
+    init_password_hash();
     BLOCK_KEYS = {
       verifierHashInput: new Uint8Array([254, 167, 210, 118, 59, 75, 158, 121]),
       verifierHashValue: new Uint8Array([215, 170, 15, 109, 48, 97, 52, 78]),
@@ -50695,14 +51051,92 @@ var init_key_derivation = __esm({
       dataIntegrityHmacKey: new Uint8Array([95, 178, 173, 1, 12, 185, 225, 246]),
       dataIntegrityHmacValue: new Uint8Array([160, 103, 127, 2, 178, 44, 132, 51])
     };
-    MAX_SPIN_COUNT = 1e7;
+    SPIN_CHUNK = 1e5;
+  }
+});
+
+// crypto/validate.ts
+function agileDigestLength(hashAlgorithm) {
+  const name = normalizeDigestAlgorithmName(hashAlgorithm);
+  return name === void 0 ? void 0 : AGILE_DIGEST_LENGTH[name];
+}
+function assertBlock(block, what) {
+  if (block.cipherAlgorithm !== "AES") {
+    throw new Error(`Unsupported ${what} cipherAlgorithm: ${block.cipherAlgorithm}.`);
+  }
+  if (block.cipherChaining !== "ChainingModeCBC") {
+    throw new Error(`Unsupported ${what} cipherChaining: ${block.cipherChaining}.`);
+  }
+  const digestLength = agileDigestLength(block.hashAlgorithm);
+  if (digestLength === void 0) {
+    throw new Error(`Unsupported ${what} hashAlgorithm: ${block.hashAlgorithm}.`);
+  }
+  if (block.hashSize !== digestLength) {
+    throw new Error(
+      `Invalid ${what} hashSize ${block.hashSize}: ${block.hashAlgorithm} produces ${digestLength} bytes.`
+    );
+  }
+  if (!KEY_BITS.has(block.keyBits)) throw new Error(`Invalid ${what} keyBits: ${block.keyBits}.`);
+  if (block.blockSize !== 16) throw new Error(`Invalid ${what} blockSize: ${block.blockSize}.`);
+  if (!Number.isInteger(block.saltSize) || block.saltSize <= 0 || block.saltSize > 64) {
+    throw new Error(`Invalid ${what} saltSize: ${block.saltSize}.`);
+  }
+  if (block.saltValue.length !== block.saltSize) {
+    throw new Error(`The ${what} saltValue does not match its saltSize.`);
+  }
+}
+function assertValidAgileEncryptionInfo(info) {
+  assertBlock(info.keyData, "keyData");
+  const pke = info.passwordKeyEncryptor;
+  assertBlock(pke, "password key encryptor");
+  if (!Number.isInteger(pke.spinCount) || pke.spinCount < 0) {
+    throw new Error(`Invalid spinCount: ${pke.spinCount}.`);
+  }
+  if (pke.saltSize > pke.hashSize) {
+    throw new Error(`Invalid password key encryptor saltSize: ${pke.saltSize}.`);
+  }
+}
+function assertValidStandardEncryptionInfo(info) {
+  if (!KEY_BITS.has(info.header.keySize)) {
+    throw new Error(`Invalid Standard encryption keySize: ${info.header.keySize}.`);
+  }
+  if (info.verifier.salt.length !== 16 || info.verifier.saltSize !== 16) {
+    throw new Error(`Invalid Standard encryption saltSize: ${info.verifier.saltSize}.`);
+  }
+  if (info.verifier.verifierHashSize !== 20) {
+    throw new Error(
+      `Invalid Standard encryption verifierHashSize: ${info.verifier.verifierHashSize}.`
+    );
+  }
+  if (info.verifier.encryptedVerifier.length !== 16 || info.verifier.encryptedVerifierHash.length < 20) {
+    throw new Error("The Standard encryption verifier is truncated.");
+  }
+}
+var AGILE_DIGEST_LENGTH, KEY_BITS;
+var init_validate = __esm({
+  "crypto/validate.ts"() {
+    init_algorithm_names();
+    AGILE_DIGEST_LENGTH = {
+      "SHA-1": 20,
+      "SHA-256": 32,
+      "SHA-384": 48,
+      "SHA-512": 64
+    };
+    KEY_BITS = /* @__PURE__ */ new Set([128, 192, 256]);
   }
 });
 
 // crypto/decrypt.ts
-async function verifyAgilePassword(info, password) {
+async function verifyAgilePassword(info, password, limits = {}) {
+  assertValidAgileEncryptionInfo(info);
   const pke = info.passwordKeyEncryptor;
-  const base = await computeAgileKeyBase(password, pke.saltValue, pke.spinCount, pke.hashAlgorithm);
+  const base = await computeAgileKeyBase(
+    password,
+    pke.saltValue,
+    pke.spinCount,
+    pke.hashAlgorithm,
+    limits
+  );
   const blockKey = (block) => deriveAgileKeyFromBase(base, pke.hashAlgorithm, block, pke.keyBits, pke.hashSize);
   const verifierHashInput = await aesCbcDecryptRaw(
     await blockKey(BLOCK_KEYS.verifierHashInput),
@@ -50715,10 +51149,8 @@ async function verifyAgilePassword(info, password) {
     pke.encryptedVerifierHashValue
   );
   const computedHash = await hash(pke.hashAlgorithm, verifierHashInput.subarray(0, pke.saltSize));
-  if (computedHash.length < pke.hashSize || verifierHashValue.length < pke.hashSize) return null;
-  let difference = 0;
-  for (let i2 = 0; i2 < pke.hashSize; i2++) difference |= verifierHashValue[i2] ^ computedHash[i2];
-  if (difference !== 0) return null;
+  if (computedHash.length !== pke.hashSize || verifierHashValue.length < pke.hashSize) return null;
+  if (!timingSafeEqual(verifierHashValue.subarray(0, pke.hashSize), computedHash)) return null;
   const decryptedKey = await aesCbcDecryptRaw(
     await blockKey(BLOCK_KEYS.encryptedKeyValue),
     pke.saltValue,
@@ -50727,6 +51159,7 @@ async function verifyAgilePassword(info, password) {
   return decryptedKey.subarray(0, info.keyData.keyBits / 8);
 }
 async function verifyStandardPassword(info, password) {
+  assertValidStandardEncryptionInfo(info);
   const key2 = await deriveStandardKey(
     password,
     info.verifier.salt,
@@ -50736,20 +51169,16 @@ async function verifyStandardPassword(info, password) {
   const decryptedVerifier = await aesEcbDecrypt(key2, info.verifier.encryptedVerifier);
   const decryptedHash = await aesEcbDecrypt(key2, info.verifier.encryptedVerifierHash);
   const computedHash = await hash("SHA-1", decryptedVerifier);
-  const hashSize = info.verifier.verifierHashSize;
-  let match = true;
-  for (let i2 = 0; i2 < Math.min(hashSize, 20); i2++) {
-    if (computedHash[i2] !== decryptedHash[i2]) {
-      match = false;
-      break;
-    }
-  }
+  const match = timingSafeEqual(decryptedHash.subarray(0, 20), computedHash);
   return match ? key2 : null;
 }
-async function verifyAgileDataIntegrity(info, key2, encryptedPackage) {
+async function verifyAgileDataIntegrity(info, key2, encryptedPackage, options = {}) {
   const keyData = info.keyData;
   if (!info.dataIntegrity) {
-    return;
+    if (options.allowMissingIntegrity) return;
+    throw new exports.DataIntegrityError(
+      "The encrypted package has no data integrity record, so it cannot be checked for tampering."
+    );
   }
   const hmacKeyIV = await generateIV(
     keyData.hashAlgorithm,
@@ -50776,28 +51205,26 @@ async function verifyAgileDataIntegrity(info, key2, encryptedPackage) {
   );
   const expectedHmac = decryptedHmacValue.subarray(0, keyData.hashSize);
   const computedHmac = await hmac(keyData.hashAlgorithm, hmacKey, encryptedPackage);
-  let match = true;
-  if (computedHmac.length < keyData.hashSize) {
-    match = false;
-  } else {
-    for (let i2 = 0; i2 < keyData.hashSize; i2++) {
-      if (computedHmac[i2] !== expectedHmac[i2]) {
-        match = false;
-        break;
-      }
-    }
-  }
+  const match = timingSafeEqual(computedHmac, expectedHmac);
   if (!match) {
     throw new exports.DataIntegrityError(
       "Data integrity check failed. The encrypted file may be corrupted or tampered with."
     );
   }
 }
+function readOriginalSize(encryptedPackage, wide) {
+  if (encryptedPackage.length < 8) throw new Error("The EncryptedPackage stream is truncated.");
+  const view = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
+  const high = view.getUint32(4, true);
+  return view.getUint32(0, true) + (wide ? high * 4294967296 : 0);
+}
 async function decryptAgilePackage(encryptedPackage, key2, info) {
   const keyData = info.keyData;
-  const sizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
-  const originalSize = sizeView.getUint32(0, true) + sizeView.getUint32(4, true) * 4294967296;
+  const originalSize = readOriginalSize(encryptedPackage, true);
   const encryptedData = encryptedPackage.subarray(8);
+  if (originalSize > encryptedData.length) {
+    throw new Error("The declared package size exceeds the encrypted data.");
+  }
   const segmentSize = 4096;
   const result = new Uint8Array(originalSize);
   let resultOffset = 0;
@@ -50821,18 +51248,22 @@ async function decryptAgilePackage(encryptedPackage, key2, info) {
   return result.buffer;
 }
 async function decryptStandardPackage(encryptedPackage, key2) {
-  const sizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
-  const originalSize = sizeView.getUint32(0, true);
+  const originalSize = readOriginalSize(encryptedPackage, false);
   const encryptedData = encryptedPackage.subarray(8);
+  if (originalSize > encryptedData.length) {
+    throw new Error("The declared package size exceeds the encrypted data.");
+  }
   const decrypted = await aesEcbDecrypt(key2, encryptedData);
   return decrypted.slice(0, originalSize).buffer;
 }
 var init_decrypt = __esm({
   "crypto/decrypt.ts"() {
     init_ooxml_crypto_primitives();
+    init_timing_safe();
     init_aes_ecb();
     init_errors();
     init_key_derivation();
+    init_validate();
   }
 });
 
@@ -51101,59 +51532,95 @@ function parseStandardEncryptionInfo(data) {
     }
   };
 }
-function tagAttribute(xml, tag, attr6) {
-  const tagMatch = xml.match(new RegExp(`<[^>]*${tag}[^>]*>`, "i"));
-  if (!tagMatch) return "";
-  const attrMatch = tagMatch[0].match(new RegExp(`\\b${attr6}="([^"]*)"`, "i"));
-  return attrMatch?.[1] ?? "";
+function childrenNamed2(parent, localName29) {
+  const found = [];
+  for (let node = parent.firstChild; node; node = node.nextSibling) {
+    if (node.nodeType === 1 && node.localName === localName29) {
+      found.push(node);
+    }
+  }
+  return found;
+}
+function singleChild(parent, localName29, mustExist) {
+  const matches = childrenNamed2(parent, localName29);
+  if (matches.length > 1) throw new Error(`The EncryptionInfo has several ${localName29} elements.`);
+  if (matches.length === 0 && mustExist) {
+    throw new Error(`The EncryptionInfo has no ${localName29} element.`);
+  }
+  return matches[0];
 }
-function parseAgileEncryptionInfo(data) {
-  const xml = new TextDecoder("utf-8").decode(data.subarray(8));
-  const keyData = (attr6) => tagAttribute(xml, "keyData", attr6);
-  const integrity = (attr6) => tagAttribute(xml, "dataIntegrity", attr6);
-  const pke = (attr6) => tagAttribute(xml, "encryptedKey", attr6);
-  const int = (value) => parseInt(value, 10);
-  const encryptedHmacKey = integrity("encryptedHmacKey");
+function required(element, attr6) {
+  const value = element.getAttribute(attr6);
+  if (!value) throw new Error(`The EncryptionInfo ${element.localName} has no ${attr6}.`);
+  return value;
+}
+function requiredInt(element, attr6) {
+  const value = required(element, attr6);
+  if (!/^\d{1,10}$/.test(value)) {
+    throw new Error(`The EncryptionInfo ${element.localName} ${attr6} is not a number: ${value}.`);
+  }
+  return Number(value);
+}
+function parseKeyBlock(element) {
   return {
+    saltSize: requiredInt(element, "saltSize"),
+    blockSize: requiredInt(element, "blockSize"),
+    keyBits: requiredInt(element, "keyBits"),
+    hashSize: requiredInt(element, "hashSize"),
+    cipherAlgorithm: required(element, "cipherAlgorithm"),
+    cipherChaining: required(element, "cipherChaining"),
+    hashAlgorithm: required(element, "hashAlgorithm"),
+    saltValue: base64Decode(required(element, "saltValue"))
+  };
+}
+function parseAgileEncryptionInfo(data) {
+  const root = parseXml(new TextDecoder("utf-8").decode(data.subarray(8)), {
+    label: "EncryptionInfo"
+  }).documentElement;
+  if (root.localName !== "encryption") {
+    throw new Error("The EncryptionInfo root element is not <encryption>.");
+  }
+  const keyData = parseKeyBlock(singleChild(root, "keyData", true));
+  const integrity = singleChild(root, "dataIntegrity", false);
+  const encryptors = childrenNamed2(singleChild(root, "keyEncryptors", true), "keyEncryptor");
+  const passwordEncryptors = encryptors.filter(
+    (encryptor) => encryptor.getAttribute("uri") === PASSWORD_KEY_ENCRYPTOR_URI
+  );
+  if (passwordEncryptors.length !== 1) {
+    throw new Error(
+      passwordEncryptors.length === 0 ? "The EncryptionInfo has no password key encryptor." : "The EncryptionInfo has several password key encryptors."
+    );
+  }
+  const pke = singleChild(passwordEncryptors[0], "encryptedKey", true);
+  const info = {
     version: { major: 4, minor: 4 },
     isAgile: true,
-    keyData: {
-      saltSize: int(keyData("saltSize")),
-      blockSize: int(keyData("blockSize")),
-      keyBits: int(keyData("keyBits")),
-      hashSize: int(keyData("hashSize")),
-      cipherAlgorithm: keyData("cipherAlgorithm"),
-      cipherChaining: keyData("cipherChaining"),
-      hashAlgorithm: keyData("hashAlgorithm"),
-      saltValue: base64Decode(keyData("saltValue"))
-    },
-    ...encryptedHmacKey ? {
+    keyData,
+    ...integrity ? {
       dataIntegrity: {
-        encryptedHmacKey: base64Decode(encryptedHmacKey),
-        encryptedHmacValue: base64Decode(integrity("encryptedHmacValue"))
+        encryptedHmacKey: base64Decode(required(integrity, "encryptedHmacKey")),
+        encryptedHmacValue: base64Decode(required(integrity, "encryptedHmacValue"))
       }
     } : {},
     passwordKeyEncryptor: {
-      saltSize: int(pke("saltSize")),
-      blockSize: int(pke("blockSize")),
-      keyBits: int(pke("keyBits")),
-      hashSize: int(pke("hashSize")),
-      cipherAlgorithm: pke("cipherAlgorithm"),
-      cipherChaining: pke("cipherChaining"),
-      hashAlgorithm: pke("hashAlgorithm"),
-      saltValue: base64Decode(pke("saltValue")),
-      spinCount: int(pke("spinCount")),
-      encryptedVerifierHashInput: base64Decode(pke("encryptedVerifierHashInput")),
-      encryptedVerifierHashValue: base64Decode(pke("encryptedVerifierHashValue")),
-      encryptedKeyValue: base64Decode(pke("encryptedKeyValue"))
-    }
-  };
-}
-var RC4_ALG_ID;
+      ...parseKeyBlock(pke),
+      spinCount: requiredInt(pke, "spinCount"),
+      encryptedVerifierHashInput: base64Decode(required(pke, "encryptedVerifierHashInput")),
+      encryptedVerifierHashValue: base64Decode(required(pke, "encryptedVerifierHashValue")),
+      encryptedKeyValue: base64Decode(required(pke, "encryptedKeyValue"))
+    }
+  };
+  assertValidAgileEncryptionInfo(info);
+  return info;
+}
+var RC4_ALG_ID, PASSWORD_KEY_ENCRYPTOR_URI;
 var init_encryption_info = __esm({
   "crypto/encryption-info.ts"() {
     init_ooxml_crypto_primitives();
+    init_xml();
+    init_validate();
     RC4_ALG_ID = 26625;
+    PASSWORD_KEY_ENCRYPTOR_URI = "http://schemas.microsoft.com/office/2006/keyEncryptor/password";
   }
 });
 
@@ -51169,7 +51636,7 @@ function streams(bytes) {
   }
   throw new Error("EncryptedPackage stream not found. The file may be corrupted.");
 }
-async function decryptOoxmlPackage(input, password) {
+async function decryptOoxmlPackage(input, password, options = {}) {
   const { info: infoStream, data } = streams(toBytes(input));
   const info = parseEncryptionInfo(infoStream);
   if (isStandard(info)) {
@@ -51177,21 +51644,21 @@ async function decryptOoxmlPackage(input, password) {
     if (!key3) throw new exports.IncorrectPasswordError();
     return new Uint8Array(await decryptStandardPackage(data, key3));
   }
-  const key2 = await verifyAgilePassword(info, password);
+  const key2 = await verifyAgilePassword(info, password, options);
   if (!key2) throw new exports.IncorrectPasswordError();
-  await verifyAgileDataIntegrity(info, key2, data);
+  await verifyAgileDataIntegrity(info, key2, data, options);
   return new Uint8Array(await decryptAgilePackage(data, key2, info));
 }
 function encryptOoxmlPackage(input, password, options = {}) {
   const bytes = toBytes(input);
   return options.encryptionScheme === "standard" ? encryptStandard(bytes, password, options) : encryptAgile(bytes, password, options);
 }
-async function verifyOoxmlPackagePassword(input, password) {
+async function verifyOoxmlPackagePassword(input, password, options = {}) {
   try {
     const opened = openEncryptedPackage(input);
     if (!opened) return false;
     const info = parseEncryptionInfo(opened.encryptionInfo);
-    const key2 = isStandard(info) ? await verifyStandardPassword(info, password) : await verifyAgilePassword(info, password);
+    const key2 = isStandard(info) ? await verifyStandardPassword(info, password) : await verifyAgilePassword(info, password, options);
     return key2 !== null;
   } catch {
     return false;
@@ -51243,30 +51710,6 @@ var init_ole2_parser = __esm({
   }
 });
 
-// digest/password-hash.ts
-function spinPasswordHash(password, salt, spinCount, digest) {
-  const input = new Uint8Array(salt.length + password.length * 2);
-  input.set(salt);
-  for (let i2 = 0; i2 < password.length; i2++) {
-    const code = password.charCodeAt(i2);
-    input[salt.length + i2 * 2] = code & 255;
-    input[salt.length + i2 * 2 + 1] = code >> 8;
-  }
-  let value = digest(input);
-  const buffer = new Uint8Array(value.length + 4);
-  const view = new DataView(buffer.buffer);
-  for (let i2 = 0; i2 < spinCount; i2++) {
-    buffer.set(value);
-    view.setUint32(value.length, i2, true);
-    value = digest(buffer);
-  }
-  return value;
-}
-var init_password_hash = __esm({
-  "digest/password-hash.ts"() {
-  }
-});
-
 // pptx/core/utils/modify-verifier-codec.ts
 function base64Decode2(str) {
   const normalized = str.replace(/\s+/g, "");
@@ -51293,33 +51736,24 @@ function base64Encode2(bytes) {
 }
 function randomSalt() {
   const salt = new Uint8Array(16);
-  if (typeof globalThis.crypto !== "undefined") {
-    globalThis.crypto.getRandomValues(salt);
-  } else {
-    for (let i2 = 0; i2 < salt.length; i2++) {
-      salt[i2] = Math.floor(Math.random() * 256);
-    }
+  if (typeof globalThis.crypto?.getRandomValues !== "function") {
+    throw new Error(
+      "A secure random source (crypto.getRandomValues) is required to create a salt."
+    );
   }
+  globalThis.crypto.getRandomValues(salt);
   return salt;
 }
 async function iteratedHash(algorithm, salt, password, spinCount) {
+  if (!isValidSpinCount(spinCount)) {
+    throw new Error(`Unsupported verifier spin count: ${spinCount}.`);
+  }
   const digest = digestFunction(algorithm);
   if (!digest) {
     throw new Error(`Unsupported digest algorithm: ${algorithm}`);
   }
   return spinPasswordHash(password, salt, spinCount, digest);
 }
-function bytesEqual2(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  for (let i2 = 0; i2 < a.length; i2++) {
-    if (a[i2] !== b[i2]) {
-      return false;
-    }
-  }
-  return true;
-}
 var init_modify_verifier_codec = __esm({
   "pptx/core/utils/modify-verifier-codec.ts"() {
     init_digest2();
@@ -51348,8 +51782,9 @@ async function verifyModifyPassword(verifier, password) {
   const salt = verifier.saltData ? base64Decode2(verifier.saltData) : new Uint8Array(0);
   const expectedHash = base64Decode2(verifier.hashData);
   const spinCount = verifier.spinValue ?? 1e5;
+  if (!isValidSpinCount(spinCount)) return false;
   const h2 = await iteratedHash(algorithm, salt, password, spinCount);
-  return bytesEqual2(h2, expectedHash);
+  return timingSafeEqual(h2, expectedHash);
 }
 async function createModifyVerifier(password, options) {
   const requestedAlgorithm = options?.algorithmName ?? "SHA-512";
@@ -51389,6 +51824,8 @@ var CRYPT_ALGORITHM_SID_NAMES;
 var init_modify_verifier = __esm({
   "pptx/core/utils/modify-verifier.ts"() {
     init_algorithm_names();
+    init_password_hash();
+    init_timing_safe();
     init_modify_verifier_codec();
     CRYPT_ALGORITHM_SID_NAMES = {
       1: "MD2",
@@ -51444,6 +51881,40 @@ var init_signature_inspection_status = __esm({
   }
 });
 
+// chart/model-analysis.ts
+var KIND_OF_TYPE, TYPE_OF_KIND, chartTrendlineKind, chartTrendlineType, CHART_ERROR_BAR_DIRECTIONS, CHART_ERROR_BAR_TYPES, CHART_ERROR_VALUE_TYPES;
+var init_model_analysis = __esm({
+  "chart/model-analysis.ts"() {
+    KIND_OF_TYPE = {
+      linear: "linear",
+      exp: "exponential",
+      log: "logarithmic",
+      poly: "polynomial",
+      power: "power",
+      movingAvg: "movingAvg"
+    };
+    TYPE_OF_KIND = {
+      linear: "linear",
+      exponential: "exp",
+      logarithmic: "log",
+      polynomial: "poly",
+      power: "power",
+      movingAvg: "movingAvg"
+    };
+    chartTrendlineKind = (type) => type !== void 0 && Object.hasOwn(KIND_OF_TYPE, type) ? KIND_OF_TYPE[type] : void 0;
+    chartTrendlineType = (kind) => TYPE_OF_KIND[kind];
+    CHART_ERROR_BAR_DIRECTIONS = ["x", "y"];
+    CHART_ERROR_BAR_TYPES = ["both", "minus", "plus"];
+    CHART_ERROR_VALUE_TYPES = [
+      "cust",
+      "fixedVal",
+      "percentage",
+      "stdDev",
+      "stdErr"
+    ];
+  }
+});
+
 // chart/manual-layout.ts
 function readChartManualLayoutValues(value) {
   const result = {};
@@ -51700,7 +52171,7 @@ function parseSeriesTrendlines(seriesNode, xmlLookup, colorParser) {
   return trendlineNodes.map((node) => {
     const typeNode = xmlLookup.getChildByLocalName(node, "trendlineType");
     const rawType = String(typeNode?.["@_val"] || "").trim();
-    const trendlineType = TRENDLINE_TYPE_MAP[rawType];
+    const trendlineType = chartTrendlineKind(rawType);
     if (!trendlineType) {
       return void 0;
     }
@@ -51770,13 +52241,13 @@ function parseSeriesErrBars(seriesNode, xmlLookup, extractPointValues, colorPars
     const direction = rawDir === "x" ? "x" : "y";
     const errBarTypeNode = xmlLookup.getChildByLocalName(node, "errBarType");
     const rawBarType = String(errBarTypeNode?.["@_val"] || "both").trim();
-    const barType = ERR_BAR_TYPE_MAP[rawBarType] ?? "both";
+    const barType = isErrBarType(rawBarType) ? rawBarType : "both";
     const errValTypeNode = xmlLookup.getChildByLocalName(node, "errValType");
     const rawValType = String(errValTypeNode?.["@_val"] || "").trim();
-    const valType = ERR_VAL_TYPE_MAP[rawValType];
-    if (!valType) {
+    if (!isErrValType(rawValType)) {
       return void 0;
     }
+    const valType = rawValType;
     const result = { direction, barType, valType };
     const noEndCap = booleanValue2(xmlLookup.getChildByLocalName(node, "noEndCap"));
     if (noEndCap !== void 0) {
@@ -51846,30 +52317,13 @@ function parseLineStyle(container2, elementName, xmlLookup, colorParser) {
   }
   return result;
 }
-var TRENDLINE_TYPE_MAP, ERR_BAR_TYPE_MAP, ERR_VAL_TYPE_MAP;
+var isErrBarType, isErrValType;
 var init_chart_advanced_parser = __esm({
   "pptx/core/utils/chart-advanced-parser.ts"() {
+    init_model_analysis();
     init_chart_trendline_label();
-    TRENDLINE_TYPE_MAP = {
-      linear: "linear",
-      exp: "exponential",
-      log: "logarithmic",
-      poly: "polynomial",
-      power: "power",
-      movingAvg: "movingAvg"
-    };
-    ERR_BAR_TYPE_MAP = {
-      both: "both",
-      minus: "minus",
-      plus: "plus"
-    };
-    ERR_VAL_TYPE_MAP = {
-      cust: "cust",
-      fixedVal: "fixedVal",
-      percentage: "percentage",
-      stdDev: "stdDev",
-      stdErr: "stdErr"
-    };
+    isErrBarType = (value) => CHART_ERROR_BAR_TYPES.includes(value);
+    isErrValType = (value) => CHART_ERROR_VALUE_TYPES.includes(value);
   }
 });
 
@@ -55494,7 +55948,7 @@ function resolveCellValue(cell, sharedStrings) {
 }
 async function parseEmbeddedXlsx(xlsxData) {
   try {
-    const xlsxZip = await JSZip17__default.default.loadAsync(xlsxData);
+    const xlsxZip = await openNestedZip(xlsxData);
     const xmlParser = new fastXmlParser.XMLParser({
       ignoreAttributes: false,
       attributeNamePrefix: "@_",
@@ -55589,6 +56043,7 @@ async function parseEmbeddedXlsx(xlsxData) {
 }
 var init_chart_xlsx_parser = __esm({
   "pptx/core/utils/chart-xlsx-parser.ts"() {
+    init_zip_open();
     init_xml_whitespace();
   }
 });
@@ -56101,34 +56556,34 @@ function isAlternateContentChoiceXmlSupported(requires, branchXml) {
   if (!areNamespacesSupported(requires)) {
     return false;
   }
-  const required = new Set(requires.trim().split(/\s+/).filter(Boolean));
+  const required2 = new Set(requires.trim().split(/\s+/).filter(Boolean));
   const tagPattern = /<(?!\/|\?|!)([A-Za-z_][\w.-]*):([A-Za-z_][\w.-]*)\b/g;
   let match;
   while ((match = tagPattern.exec(branchXml)) !== null) {
-    if (required.has(match[1]) && !isExtensionElementSupported(match[1], match[2])) {
+    if (required2.has(match[1]) && !isExtensionElementSupported(match[1], match[2])) {
       return false;
     }
   }
   return true;
 }
-function hasOnlySupportedExtensionElements(node, required) {
+function hasOnlySupportedExtensionElements(node, required2) {
   if (!node || typeof node !== "object") {
     return true;
   }
   if (Array.isArray(node)) {
-    return node.every((item) => hasOnlySupportedExtensionElements(item, required));
+    return node.every((item) => hasOnlySupportedExtensionElements(item, required2));
   }
   for (const [key2, value] of Object.entries(node)) {
     if (!key2.startsWith("@_")) {
       const separator = key2.indexOf(":");
       if (separator > 0) {
         const prefix = key2.slice(0, separator);
-        if (required.has(prefix) && !isExtensionElementSupported(prefix, key2.slice(separator + 1))) {
+        if (required2.has(prefix) && !isExtensionElementSupported(prefix, key2.slice(separator + 1))) {
           return false;
         }
       }
     }
-    if (!hasOnlySupportedExtensionElements(value, required)) {
+    if (!hasOnlySupportedExtensionElements(value, required2)) {
       return false;
     }
   }
@@ -59599,7 +60054,7 @@ function normalisePath(p) {
 }
 async function tryOpenZip(buffer) {
   try {
-    const zip = await JSZip17__default.default.loadAsync(buffer);
+    const zip = await openPptxZip(buffer);
     return { zip };
   } catch {
     return { error: "Buffer is not a valid ZIP file" };
@@ -59658,6 +60113,7 @@ function relsOwnerDir(relsPath2) {
 }
 var init_pptx_validator_helpers = __esm({
   "pptx/core/utils/pptx-validator-helpers.ts"() {
+    init_zip_open();
     init_xml_entities();
   }
 });
@@ -60561,13 +61017,13 @@ function add6(issues, path2, code, message) {
 }
 function validateRequiredChildren(xml, contract, path2, issues) {
   const children16 = directChildren(xml);
-  for (const required of contract.required ?? []) {
-    if (!children16.includes(required)) {
+  for (const required2 of contract.required ?? []) {
+    if (!children16.includes(required2)) {
       add6(
         issues,
         path2,
         "MISSING_REQUIRED_PART_ELEMENT",
-        `<${contract.root}> must contain <${required}> as a direct child`
+        `<${contract.root}> must contain <${required2}> as a direct child`
       );
     }
   }
@@ -60578,13 +61034,13 @@ function validateThemeElements(xml, path2, issues) {
     return;
   }
   const children16 = directChildren(elements3);
-  for (const required of ["clrScheme", "fontScheme", "fmtScheme"]) {
-    if (!children16.includes(required)) {
+  for (const required2 of ["clrScheme", "fontScheme", "fmtScheme"]) {
+    if (!children16.includes(required2)) {
       add6(
         issues,
         path2,
         "MISSING_REQUIRED_PART_ELEMENT",
-        `<themeElements> must contain <${required}>`
+        `<themeElements> must contain <${required2}>`
       );
     }
   }
@@ -60597,8 +61053,8 @@ function elementStartAttributes(xml, localName29) {
     (match) => match[1]
   );
 }
-function validateRequiredAttributes(attributes2, required, element, path2, issues) {
-  for (const name of required) {
+function validateRequiredAttributes(attributes2, required2, element, path2, issues) {
+  for (const name of required2) {
     if (attributeValue(attributes2, name) === void 0) {
       add6(
         issues,
@@ -60834,13 +61290,13 @@ var init_pptx_validator_types = __esm({
 
 // pptx/core/utils/pptx-validator-checks.ts
 async function validateZipStructure(zip, issues) {
-  for (const required of REQUIRED_PATHS) {
-    if (!zip.file(required)) {
+  for (const required2 of REQUIRED_PATHS) {
+    if (!zip.file(required2)) {
       issues.push({
         severity: "error",
         code: "MISSING_REQUIRED_FILE",
-        message: `Required file "${required}" is missing from the package`,
-        path: required
+        message: `Required file "${required2}" is missing from the package`,
+        path: required2
       });
     }
   }
@@ -80869,7 +81325,7 @@ var init_app_properties_counts = __esm({
 });
 
 // pptx/core/utils/app-properties-word-count.ts
-function isWordChar(char) {
+function isWordChar2(char) {
   return char !== void 0 && WORD_CHAR.test(char) && !IDEOGRAPH_CHAR.test(char);
 }
 function isDigit(char) {
@@ -80880,7 +81336,7 @@ function isJoiner(chars, index) {
   const before = chars[index - 1];
   const after = chars[index + 1];
   if (WORD_JOINERS.has(char)) {
-    return isWordChar(before) && isWordChar(after);
+    return isWordChar2(before) && isWordChar2(after);
   }
   return NUMBER_JOINERS.has(char) && isDigit(before) && isDigit(after);
 }
@@ -106878,28 +107334,6 @@ var init_layout_switch_placeholder_prompts = __esm({
   }
 });
 
-// pptx/core/core/types.ts
-exports.DEFAULT_MAX_UNCOMPRESSED_BYTES = void 0; exports.MAX_ZIP_ENTRY_COUNT = void 0; exports.ZipBombError = void 0;
-var init_types4 = __esm({
-  "pptx/core/core/types.ts"() {
-    exports.DEFAULT_MAX_UNCOMPRESSED_BYTES = 500 * 1024 * 1024;
-    exports.MAX_ZIP_ENTRY_COUNT = 65536;
-    exports.ZipBombError = class extends Error {
-      code = "ZIP_BOMB";
-      uncompressedBytes;
-      limit;
-      entryCount;
-      constructor(message, details) {
-        super(message);
-        this.name = "ZipBombError";
-        this.uncompressedBytes = details.uncompressedBytes;
-        this.limit = details.limit;
-        this.entryCount = details.entryCount;
-      }
-    };
-  }
-});
-
 // pptx/core/core/runtime/bullet-picture-image-enrichment.ts
 async function enrichBulletPictureImages(elements3, slidePath, resolver, depth = 0) {
   if (depth > MAX_GROUP_DEPTH) {
@@ -107483,7 +107917,7 @@ async function writeChartWorkbookUpdates(xlsxBytes, writes, options = {}) {
   }
   let xlsxZip;
   try {
-    xlsxZip = await JSZip17__default.default.loadAsync(xlsxBytes);
+    xlsxZip = await openNestedZip(xlsxBytes);
   } catch {
     if (options.atomic) {
       throw new Error("Chart label replacement requires a readable embedded workbook.");
@@ -107551,6 +107985,7 @@ async function writeChartWorkbookUpdates(xlsxBytes, writes, options = {}) {
 }
 var init_chart_xlsx_writer = __esm({
   "pptx/core/utils/chart-xlsx-writer.ts"() {
+    init_zip_open();
     init_chart_xlsx_cellref();
     init_chart_xlsx_write_validation();
     init_chart_xlsx_sheet_cells();
@@ -107953,9 +108388,33 @@ var init_axis_nice = __esm({
   }
 });
 
-// chart/histogram-binning.ts
-var init_histogram_binning = __esm({
-  "chart/histogram-binning.ts"() {
+// chart/number-format.ts
+var init_number_format = __esm({
+  "chart/number-format.ts"() {
+  }
+});
+
+// chart/auto-title.ts
+var init_auto_title = __esm({
+  "chart/auto-title.ts"() {
+  }
+});
+
+// chart/axis-format.ts
+var init_axis_format = __esm({
+  "chart/axis-format.ts"() {
+  }
+});
+
+// chart/bubble-radius.ts
+var init_bubble_radius = __esm({
+  "chart/bubble-radius.ts"() {
+  }
+});
+
+// chart/stock-candles.ts
+var init_stock_candles = __esm({
+  "chart/stock-candles.ts"() {
   }
 });
 
@@ -107965,12 +108424,65 @@ var init_treemap_squarify = __esm({
   }
 });
 
+// chart/hierarchy.ts
+var init_hierarchy2 = __esm({
+  "chart/hierarchy.ts"() {
+  }
+});
+
+// chart/sunburst-arcs.ts
+var init_sunburst_arcs = __esm({
+  "chart/sunburst-arcs.ts"() {
+  }
+});
+
+// chart/style-palette.ts
+var OFFICE_ACCENTS, DEFAULT_EXTRAS;
+var init_style_palette = __esm({
+  "chart/style-palette.ts"() {
+    OFFICE_ACCENTS = [
+      "#4472C4",
+      "#ED7D31",
+      "#A5A5A5",
+      "#FFC000",
+      "#5B9BD5",
+      "#70AD47"
+    ];
+    DEFAULT_EXTRAS = ["#FF0000", "#00B0F0"];
+    [...OFFICE_ACCENTS, ...DEFAULT_EXTRAS];
+  }
+});
+
+// chart/histogram-binning.ts
+var init_histogram_binning = __esm({
+  "chart/histogram-binning.ts"() {
+  }
+});
+
+// chart/waterfall.ts
+var init_waterfall = __esm({
+  "chart/waterfall.ts"() {
+  }
+});
+
 // chart/trendline-equation.ts
 var init_trendline_equation = __esm({
   "chart/trendline-equation.ts"() {
   }
 });
 
+// chart/trendline-fit.ts
+var init_trendline_fit = __esm({
+  "chart/trendline-fit.ts"() {
+  }
+});
+
+// chart/error-bar-amount.ts
+var init_error_bar_amount = __esm({
+  "chart/error-bar-amount.ts"() {
+  }
+});
+
 // chart/radar-geometry.ts
 var init_radar_geometry = __esm({
   "chart/radar-geometry.ts"() {
@@ -108295,6 +108807,14 @@ function cNumber(context, parent, local) {
   malformed(context, element, raw);
   return void 0;
 }
+function cEnum(context, parent, local, allowed) {
+  const element = cChild(parent, local);
+  const raw = attribute5(element, "val");
+  if (!element || raw === void 0) return void 0;
+  if (allowed.includes(raw)) return raw;
+  malformed(context, element, raw);
+  return void 0;
+}
 function reportUnmodelled(context, element, handled) {
   for (const child30 of elements(element)) {
     if (handled.has(child30.localName)) continue;
@@ -108625,6 +109145,114 @@ var init_parse_chrome = __esm({
   }
 });
 
+// chart/parse-analysis.ts
+function parseTrendlineLabel2(context, element) {
+  if (!element) return void 0;
+  reportUnmodelled(context, element, LABEL2);
+  return assignDefined(
+    {},
+    {
+      layout: manualLayout(element),
+      tx: parseChartText(context, cChild(element, "tx"), false),
+      numberFormat: numberFormat(element),
+      spPr: shapeProperties(element),
+      txPr: textProperties(element),
+      extLst: extensionList(element)
+    }
+  );
+}
+function parseTrendline(context, element) {
+  reportUnmodelled(context, element, TRENDLINE);
+  const name = cChild(element, "name");
+  return assignDefined(
+    {},
+    {
+      name: name ? name.textContent ?? "" : void 0,
+      spPr: shapeProperties(element),
+      trendlineType: cEnum(context, element, "trendlineType", TRENDLINE_TYPES),
+      order: cNumber(context, element, "order"),
+      period: cNumber(context, element, "period"),
+      forward: cNumber(context, element, "forward"),
+      backward: cNumber(context, element, "backward"),
+      intercept: cNumber(context, element, "intercept"),
+      displayRSquared: cBool(context, element, "dispRSqr"),
+      displayEquation: cBool(context, element, "dispEq"),
+      label: parseTrendlineLabel2(context, cChild(element, "trendlineLbl")),
+      extLst: extensionList(element)
+    }
+  );
+}
+function parseErrorBars(context, element) {
+  reportUnmodelled(context, element, ERROR_BARS);
+  return assignDefined(
+    {},
+    {
+      direction: cEnum(context, element, "errDir", CHART_ERROR_BAR_DIRECTIONS),
+      barType: cEnum(context, element, "errBarType", CHART_ERROR_BAR_TYPES),
+      valueType: cEnum(context, element, "errValType", CHART_ERROR_VALUE_TYPES),
+      noEndCap: cBool(context, element, "noEndCap"),
+      plus: parseDataSource(cChild(element, "plus")),
+      minus: parseDataSource(cChild(element, "minus")),
+      value: cNumber(context, element, "val"),
+      spPr: shapeProperties(element),
+      extLst: extensionList(element)
+    }
+  );
+}
+function parseSeriesAnalysis(context, series) {
+  const trendlines = children2(series, "trendline", NS.c).map(
+    (node) => parseTrendline(context, node)
+  );
+  const errorBars = children2(series, "errBars", NS.c).map((node) => parseErrorBars(context, node));
+  return {
+    ...trendlines.length ? { trendlines } : {},
+    ...errorBars.length ? { errorBars } : {}
+  };
+}
+var TRENDLINE_TYPES, LABEL2, TRENDLINE, ERROR_BARS;
+var init_parse_analysis = __esm({
+  "chart/parse-analysis.ts"() {
+    init_xml2();
+    init_model_analysis();
+    init_parse_text();
+    init_parse_util();
+    TRENDLINE_TYPES = [
+      "exp",
+      "linear",
+      "log",
+      "movingAvg",
+      "poly",
+      "power"
+    ];
+    LABEL2 = /* @__PURE__ */ new Set(["layout", "tx", "numFmt", "spPr", "txPr", "extLst"]);
+    TRENDLINE = /* @__PURE__ */ new Set([
+      "name",
+      "spPr",
+      "trendlineType",
+      "order",
+      "period",
+      "forward",
+      "backward",
+      "intercept",
+      "dispRSqr",
+      "dispEq",
+      "trendlineLbl",
+      "extLst"
+    ]);
+    ERROR_BARS = /* @__PURE__ */ new Set([
+      "errDir",
+      "errBarType",
+      "errValType",
+      "noEndCap",
+      "plus",
+      "minus",
+      "val",
+      "spPr",
+      "extLst"
+    ]);
+  }
+});
+
 // chart/parse-series.ts
 function parseMarker2(context, element) {
   if (!element) return void 0;
@@ -108658,7 +109286,10 @@ function parseDataPoint(context, element) {
 function parseSeries(context, element) {
   reportUnmodelled(context, element, SERIES);
   return assignDefined(
-    { dataPoints: children2(element, "dPt", NS.c).map((point2) => parseDataPoint(context, point2)) },
+    {
+      dataPoints: children2(element, "dPt", NS.c).map((point2) => parseDataPoint(context, point2)),
+      ...parseSeriesAnalysis(context, element)
+    },
     {
       index: cNumber(context, element, "idx"),
       order: cNumber(context, element, "order"),
@@ -108684,6 +109315,7 @@ var MARKER, POINT, SERIES;
 var init_parse_series = __esm({
   "chart/parse-series.ts"() {
     init_xml2();
+    init_parse_analysis();
     init_parse_text();
     init_parse_util();
     MARKER = /* @__PURE__ */ new Set(["symbol", "size", "spPr", "extLst"]);
@@ -108704,6 +109336,8 @@ var init_parse_series = __esm({
       "invertIfNegative",
       "dPt",
       "dLbls",
+      "trendline",
+      "errBars",
       "cat",
       "val",
       "xVal",
@@ -109122,6 +109756,12 @@ var init_summary_from_space = __esm({
   }
 });
 
+// chart/render/summary-from-chartex.ts
+var init_summary_from_chartex = __esm({
+  "chart/render/summary-from-chartex.ts"() {
+  }
+});
+
 // text/wrap-styled-runs.ts
 function wrapStyledRuns(runs, maxWidth, measure3, options = {}) {
   const groups = [];
@@ -109202,6 +109842,7 @@ var init_render = __esm({
   "chart/render/index.ts"() {
     init_summary();
     init_summary_from_space();
+    init_summary_from_chartex();
     init_render_space();
   }
 });
@@ -109214,9 +109855,20 @@ var init_chart2 = __esm({
     init_blank_display();
     init_stacked_series();
     init_axis_nice();
+    init_number_format();
+    init_auto_title();
+    init_axis_format();
+    init_bubble_radius();
+    init_stock_candles();
+    init_hierarchy2();
+    init_sunburst_arcs();
+    init_style_palette();
     init_histogram_binning();
+    init_waterfall();
     init_treemap_squarify();
     init_trendline_equation();
+    init_trendline_fit();
+    init_error_bar_amount();
     init_radar_geometry();
     init_pie_best_fit();
     init_pie_label_collision();
@@ -109235,6 +109887,7 @@ var init_chart2 = __esm({
     init_manual_layout();
     init_write_layout_formatting();
     init_model();
+    init_model_analysis();
     init_data_cache();
     init_parse_space();
     init_parse_chrome();
@@ -109528,6 +110181,95 @@ var init_chart_from_neutral_axes = __esm({
   }
 });
 
+// pptx/core/utils/chart-from-neutral-analysis.ts
+function treeLine(node, reader2) {
+  const ln = reader2.xml.getChildByLocalName(reader2.xml.getChildByLocalName(node, "spPr"), "ln");
+  const out = {};
+  const color2 = reader2.parseColor(reader2.xml.getChildByLocalName(ln, "solidFill"));
+  if (color2) out.color = color2;
+  const widthEmu = parseInt(String(ln?.["@_w"]), 10);
+  if (Number.isFinite(widthEmu)) out.width = widthEmu / 12700;
+  const dash = reader2.xml.getChildByLocalName(ln, "prstDash")?.["@_val"];
+  if (dash) out.dash = String(dash);
+  return out;
+}
+function labelFromNeutral(label, node, reader2) {
+  if (!label) return void 0;
+  const result = {};
+  const layout = parseChartManualLayout(
+    reader2.xml.getChildByLocalName(node, "trendlineLbl"),
+    reader2.localName
+  );
+  if (layout) result.layout = layout;
+  if (label.numberFormat) result.numberFormatCode = label.numberFormat.formatCode;
+  if (label.numberFormat?.sourceLinked !== void 0)
+    result.sourceLinked = label.numberFormat.sourceLinked;
+  return result;
+}
+function trendlineFromNeutral(trendline, node, reader2) {
+  const trendlineType = chartTrendlineKind(trendline.trendlineType);
+  if (!trendlineType) return void 0;
+  const result = { trendlineType };
+  if (trendline.name !== void 0) result.name = trendline.name;
+  const { order, period } = trendline;
+  if (order !== void 0 && Number.isInteger(order) && order >= 2 && order <= 6)
+    result.order = order;
+  if (period !== void 0 && Number.isInteger(period) && period >= 2) result.period = period;
+  if (trendline.forward !== void 0) result.forward = trendline.forward;
+  if (trendline.backward !== void 0) result.backward = trendline.backward;
+  if (trendline.intercept !== void 0) result.intercept = trendline.intercept;
+  if (trendline.displayRSquared !== void 0) result.displayRSq = trendline.displayRSquared;
+  if (trendline.displayEquation !== void 0) result.displayEq = trendline.displayEquation;
+  const line2 = treeLine(node, reader2);
+  if (line2.color) result.color = line2.color;
+  if (line2.width !== void 0) result.lineWidth = line2.width;
+  if (line2.dash) result.lineDashStyle = line2.dash;
+  const label = labelFromNeutral(trendline.label, node, reader2);
+  if (label) result.label = label;
+  return result;
+}
+function trendlinesFromNeutral(trendlines, seriesNode, reader2) {
+  if (!trendlines?.length) return [];
+  const nodes = reader2.xml.getChildrenArrayByLocalName(seriesNode, "trendline");
+  return trendlines.map((trendline, index) => trendlineFromNeutral(trendline, nodes[index], reader2)).filter((trendline) => trendline !== void 0);
+}
+function customAmounts(source) {
+  if (source?.kind !== "numRef" && source?.kind !== "numLit") return [];
+  return [...source.cache?.points ?? []].sort((left, right) => (left.index ?? 0) - (right.index ?? 0)).map((point2) => point2.value.trim()).filter((value) => value.length > 0).map((value) => parseFloat(value)).filter((value) => Number.isFinite(value));
+}
+function errBarsFromNeutralOne(bars, node, reader2) {
+  if (!bars.valueType) return void 0;
+  const result = {
+    direction: bars.direction === "x" ? "x" : "y",
+    barType: bars.barType ?? "both",
+    valType: bars.valueType
+  };
+  if (bars.noEndCap !== void 0) result.noEndCap = bars.noEndCap;
+  if (bars.value !== void 0) result.val = bars.value;
+  if (bars.valueType === "cust") {
+    const plus2 = customAmounts(bars.plus);
+    if (plus2.length > 0) result.customPlus = plus2;
+    const minus = customAmounts(bars.minus);
+    if (minus.length > 0) result.customMinus = minus;
+  }
+  const line2 = treeLine(node, reader2);
+  if (line2.color) result.color = line2.color;
+  if (line2.width !== void 0) result.width = line2.width;
+  if (line2.dash) result.dashStyle = line2.dash;
+  return result;
+}
+function errBarsFromNeutral(errorBars, seriesNode, reader2) {
+  if (!errorBars?.length) return [];
+  const nodes = reader2.xml.getChildrenArrayByLocalName(seriesNode, "errBars");
+  return errorBars.map((bars, index) => errBarsFromNeutralOne(bars, nodes[index], reader2)).filter((bars) => bars !== void 0);
+}
+var init_chart_from_neutral_analysis = __esm({
+  "pptx/core/utils/chart-from-neutral-analysis.ts"() {
+    init_chart2();
+    init_chart_layout();
+  }
+});
+
 // pptx/core/utils/chart-from-neutral-data.ts
 function expandCache(cache2, read, declared) {
   if (!cache2 || cache2.points.length === 0) return void 0;
@@ -109661,8 +110403,6 @@ function readSeriesTreeFields(seriesNode, containerChartType, reader2) {
   const line2 = xml.getChildByLocalName(spPr, "ln");
   const color2 = reader2.parseColor(xml.getChildByLocalName(spPr, "solidFill")) ?? (isLineDrawnChartType(containerChartType) ? reader2.parseColor(xml.getChildByLocalName(line2, "solidFill")) : void 0);
   const codec = reader2.colorStyleCodec;
-  const trendlines = parseSeriesTrendlines(seriesNode, xml, colorAdapter);
-  const errBars = parseSeriesErrBars(seriesNode, xml, reader2.extractPointValues, colorAdapter);
   const dataPoints = parseSeriesDataPoints(
     seriesNode,
     xml,
@@ -109685,8 +110425,6 @@ function readSeriesTreeFields(seriesNode, containerChartType, reader2) {
     color: color2,
     ...codec ? seriesGradientFill(spPr, xml, codec) : {},
     ...lineGradientFill ? { lineGradientFill } : {},
-    ...trendlines.length > 0 ? { trendlines } : {},
-    ...errBars.length > 0 ? { errBars } : {},
     ...dataPoints.length > 0 ? { dataPoints } : {},
     ...marker ? { marker } : {},
     ...dataLabels.length > 0 ? { dataLabels } : {},
@@ -109702,7 +110440,6 @@ function readSeriesTreeFields(seriesNode, containerChartType, reader2) {
 var init_chart_series_tree_fields = __esm({
   "pptx/core/utils/chart-series-tree-fields.ts"() {
     init_units2();
-    init_chart_advanced_parser();
     init_chart_container_type_map();
     init_chart_data_label_parser();
     init_chart_datapoint_picture();
@@ -109733,6 +110470,8 @@ function seriesFromNeutral(place, reader2) {
   const dataLabels = pointLabelsFromNeutral(series.dataLabels, tree.dataLabels);
   const shape = containerChartType === "bar3D" ? parseBar3DShapeVal(series.shape?.trim() ?? "") : void 0;
   const name = neutralSeriesName(series.tx);
+  const trendlines = trendlinesFromNeutral(series.trendlines, place.node, reader2);
+  const errBars = errBarsFromNeutral(series.errorBars, place.node, reader2);
   return {
     name: name.trim().length > 0 ? name : `Series ${index + 1}`,
     ...series.index !== void 0 ? { idx: series.index } : {},
@@ -109748,8 +110487,8 @@ function seriesFromNeutral(place, reader2) {
     color: tree.color,
     ...tree.gradientFill ? { gradientFill: tree.gradientFill } : {},
     ...tree.lineGradientFill ? { lineGradientFill: tree.lineGradientFill } : {},
-    ...tree.trendlines ? { trendlines: tree.trendlines } : {},
-    ...tree.errBars ? { errBars: tree.errBars } : {},
+    ...trendlines.length > 0 ? { trendlines } : {},
+    ...errBars.length > 0 ? { errBars } : {},
     ...dataPoints ? { dataPoints } : {},
     ...marker ? { marker } : {},
     ...dataLabels ? { dataLabels } : {},
@@ -109766,6 +110505,7 @@ function seriesFromNeutral(place, reader2) {
 }
 var init_chart_from_neutral_series = __esm({
   "pptx/core/utils/chart-from-neutral-series.ts"() {
+    init_chart_from_neutral_analysis();
     init_chart_from_neutral_labels();
     init_chart_from_neutral_data();
     init_chart_series_tree_fields();
@@ -115133,7 +115873,7 @@ function buildContentTypesXml(overrides28) {
 }
 async function buildMetroBlobPackage(input) {
   const root = ROOT[input.kind];
-  const zip = new JSZip17__default.default();
+  const zip = new JSZip__default.default();
   const overrides28 = new Map([
     [root.path, root.contentType],
     ...input.parts.contentTypes,
@@ -115397,6 +116137,8 @@ var init_metro_blob_xml = __esm({
     ];
   }
 });
+
+// pptx/core/ppt/writer/metro-blob-collect.ts
 function deckNeedsMetroBlobs(slides) {
   const walk3 = (elements3) => elements3.some((el) => METRO_TYPES.has(el.type) || el.type === "group" && walk3(el.children));
   return slides.some((slide) => walk3(slide.elements));
@@ -115449,7 +116191,7 @@ async function buildOne(zip, slidePath, slideXml3, element) {
   });
 }
 async function buildMetroBlobs(pptxBytes, slides) {
-  const zip = await JSZip17__default.default.loadAsync(pptxBytes);
+  const zip = await openPptxZip(pptxBytes);
   const slidePaths = await orderedSlidePaths(zip);
   const out = /* @__PURE__ */ new Map();
   for (let i2 = 0; i2 < slides.length; i2++) {
@@ -115472,6 +116214,7 @@ async function buildMetroBlobs(pptxBytes, slides) {
 var METRO_TYPES;
 var init_metro_blob_collect = __esm({
   "pptx/core/ppt/writer/metro-blob-collect.ts"() {
+    init_zip_open();
     init_metro_blob_model3d();
     init_metro_blob_package();
     init_metro_blob_source();
@@ -118441,7 +119184,7 @@ function withDeclaration(xml) {
 ${body}`;
 }
 async function zipParts(parts) {
-  const zip = new JSZip17__default.default();
+  const zip = new JSZip__default.default();
   for (const [name, text2] of parts) {
     zip.file(name, text2);
   }
@@ -118488,7 +119231,7 @@ async function buildMasterRoundTrip(source) {
   };
 }
 async function buildDeckMasterRoundTripsFromPptx(pptxBytes) {
-  const zip = await JSZip17__default.default.loadAsync(pptxBytes);
+  const zip = await openPptxZip(pptxBytes);
   const slidePaths = await readSlideMasterPaths(zip);
   const masterPaths = [...new Set(slidePaths)];
   if (masterPaths.length === 0) {
@@ -118512,6 +119255,7 @@ async function buildDeckMasterRoundTripsFromPptx(pptxBytes) {
 var XML_DECL2, CT_NS2, REL_NS2, OFFICE_REL, A_NS2, PML_CT;
 var init_master_roundtrip_writer = __esm({
   "pptx/core/ppt/writer/master-roundtrip-writer.ts"() {
+    init_zip_open();
     init_master_roundtrip_source();
     XML_DECL2 = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>';
     CT_NS2 = "http://schemas.openxmlformats.org/package/2006/content-types";
@@ -120168,7 +120912,7 @@ function buildTrendline(existing, t, getLocalName2, resolveColor2) {
   if (spPr) {
     node["c:spPr"] = spPr;
   }
-  node["c:trendlineType"] = { "@_val": TYPE_TO_OOXML[t.trendlineType] };
+  node["c:trendlineType"] = { "@_val": chartTrendlineType(t.trendlineType) };
   if (t.trendlineType === "polynomial") {
     node["c:order"] = { "@_val": String(t.order ?? 2) };
   }
@@ -120236,19 +120980,11 @@ function applySeriesTrendlinesToXml(seriesNode, trendlines, getLocalName2, resol
     seriesNode[k] = v;
   }
 }
-var TYPE_TO_OOXML;
 var init_chart_trendline_serializer = __esm({
   "pptx/core/utils/chart-trendline-serializer.ts"() {
+    init_model_analysis();
     init_chart_shape_props_writer();
     init_chart_trendline_label();
-    TYPE_TO_OOXML = {
-      linear: "linear",
-      exponential: "exp",
-      logarithmic: "log",
-      polynomial: "poly",
-      power: "power",
-      movingAvg: "movingAvg"
-    };
   }
 });
 
@@ -155819,8 +156555,7 @@ var init_PptxHandlerRuntimeChartParsing = __esm({
           parseColor: (node, placeholder) => this.parseColor(node, placeholder),
           resolveTypeface: (raw) => this.resolveThemeTypeface(raw) ?? raw,
           localName: (key2) => this.compatibilityService.getXmlLocalName(key2),
-          ...this.colorStyleCodec ? { colorStyleCodec: this.colorStyleCodec } : {},
-          extractPointValues: (node, preferNumeric) => this.extractChartPointValues(node, preferNumeric)
+          ...this.colorStyleCodec ? { colorStyleCodec: this.colorStyleCodec } : {}
         };
       }
       /**
@@ -156435,10 +157170,11 @@ var init_PptxHandlerRuntimeEmbeddedFonts = __esm({
 var MAX_OLE_EMBEDDING_BYTES, PptxHandlerRuntime98;
 var init_PptxHandlerRuntimeLoadSession = __esm({
   "pptx/core/core/runtime/PptxHandlerRuntimeLoadSession.ts"() {
+    init_zip_limits();
     init_ole_embedded_extract();
     init_ole_utils();
     init_signature_detection();
-    init_types4();
+    init_types2();
     init_authored_slide_background();
     init_bullet_picture_image_enrichment();
     init_PptxHandlerRuntimeEmbeddedFonts();
@@ -156462,8 +157198,22 @@ var init_PptxHandlerRuntimeLoadSession = __esm({
             "Invalid PPTX binary: not a ZIP/OpenXML package. The file is neither an OpenXML archive nor an OLE compound file (which is how legacy .ppt and encrypted presentations arrive), so it is most likely corrupt, truncated, or not a presentation at all."
           );
         }
+        const maxBytes = typeof options.maxUncompressedBytes === "number" && options.maxUncompressedBytes > 0 ? options.maxUncompressedBytes : exports.DEFAULT_MAX_UNCOMPRESSED_BYTES;
+        let loaded;
+        try {
+          loaded = await JSZip__default.default.loadAsync(data);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Unable to read zip container.";
+          throw new Error(`Invalid PPTX package: ${message}`, { cause: error });
+        }
+        this.zip = guardZip(loaded, {
+          label: "PPTX",
+          maxEntries: exports.MAX_ZIP_ENTRY_COUNT,
+          maxEntryBytes: maxBytes,
+          maxTotalBytes: maxBytes,
+          createError: (message, details) => new exports.ZipBombError(message, details)
+        });
         try {
-          this.zip = await JSZip17__default.default.loadAsync(data);
           this.documentPropertiesUpdater = this.dependencyFactory.createDocumentPropertiesUpdater(
             this.zip,
             this.parser,
@@ -156473,29 +157223,6 @@ var init_PptxHandlerRuntimeLoadSession = __esm({
           const message = error instanceof Error ? error.message : "Unable to read zip container.";
           throw new Error(`Invalid PPTX package: ${message}`, { cause: error });
         }
-        const maxBytes = typeof options.maxUncompressedBytes === "number" && options.maxUncompressedBytes > 0 ? options.maxUncompressedBytes : exports.DEFAULT_MAX_UNCOMPRESSED_BYTES;
-        let totalUncompressed = 0;
-        let entryCount = 0;
-        for (const filename of Object.keys(this.zip.files)) {
-          entryCount += 1;
-          if (entryCount > exports.MAX_ZIP_ENTRY_COUNT) {
-            throw new exports.ZipBombError(
-              `PPTX archive contains more than ${exports.MAX_ZIP_ENTRY_COUNT} entries \u2014 refusing to load.`,
-              { limit: exports.MAX_ZIP_ENTRY_COUNT, entryCount }
-            );
-          }
-          const file = this.zip.files[filename];
-          const size = Number(file?._data?.uncompressedSize ?? 0);
-          if (Number.isFinite(size) && size > 0) {
-            totalUncompressed += size;
-            if (totalUncompressed > maxBytes) {
-              throw new exports.ZipBombError(
-                `PPTX archive uncompressed size exceeds ${maxBytes} bytes (zip-bomb guard).`,
-                { uncompressedBytes: totalUncompressed, limit: maxBytes }
-              );
-            }
-          }
-        }
         this.slideRelsMap.clear();
         this.externalRelsMap.clear();
         this.slideMap.clear();
@@ -156900,7 +157627,7 @@ var init_PptxHandlerRuntimeLoadPipeline = __esm({
        * MAX_NODES to bound CPU on pathological trees.
        */
       findMaxElementId(slides) {
-        const MAX_NODES = 1e6;
+        const MAX_NODES2 = 1e6;
         let max = 0;
         const stack = [];
         for (const slide of slides) {
@@ -156908,7 +157635,7 @@ var init_PptxHandlerRuntimeLoadPipeline = __esm({
         }
         let visited = 0;
         while (stack.length > 0) {
-          if (visited++ > MAX_NODES) {
+          if (visited++ > MAX_NODES2) {
             break;
           }
           const node = stack.pop();
@@ -157392,7 +158119,7 @@ var init_PptxHandlerRuntimeImplementation = __esm({
       constructor(dependencyFactory = new exports.PptxRuntimeDependencyFactory()) {
         super();
         this.dependencyFactory = dependencyFactory;
-        this.zip = new JSZip17__default.default();
+        this.zip = new JSZip__default.default();
         this.parser = this.dependencyFactory.createParser();
         this.builder = this.dependencyFactory.createBuilder();
         this.elementXmlBuilder = new exports.PptxElementXmlBuilder({
@@ -157715,7 +158442,7 @@ var init_core2 = __esm({
     init_PptxHandlerRuntime();
     init_builders();
     init_factories();
-    init_types4();
+    init_types2();
     init_table_structural_ops();
     init_table_style_defaults();
     init_auto_number_sequence();
@@ -160567,7 +161294,7 @@ function collectPictureIndexes(slide) {
   return indexes;
 }
 async function buildPptxPackage(deck) {
-  const zip = new JSZip17__default.default();
+  const zip = new JSZip__default.default();
   const usage = { fileNumbers: /* @__PURE__ */ new Map() };
   let mediaCounter = 0;
   for (const slide of deck.slides) {
@@ -163257,6 +163984,7 @@ function addChartUserShapeGroupChild(element, groupPath, child30) {
 }
 
 // pptx/core/builders/sdk/layout-operations.ts
+init_zip_open();
 init_xml_utils();
 init_PptxHandler();
 var EMU_PER_PIXEL4 = 9525;
@@ -163381,7 +164109,7 @@ async function addLayoutContentType(zip, layoutIndex2) {
 }
 async function createLayout(handler, data, definition, masterIndex = 1) {
   const bytes = await handler.save(data.slides);
-  const zip = await JSZip17__default.default.loadAsync(bytes);
+  const zip = await openPptxZip(bytes);
   const existingCount = countExistingLayouts(zip);
   const newIndex = existingCount + 1;
   const layoutPath = `ppt/slideLayouts/slideLayout${newIndex}.xml`;
@@ -163404,7 +164132,7 @@ async function createLayouts(handler, data, definitions, masterIndex = 1) {
     return { layoutPaths: [], handler, data };
   }
   const bytes = await handler.save(data.slides);
-  const zip = await JSZip17__default.default.loadAsync(bytes);
+  const zip = await openPptxZip(bytes);
   const existingCount = countExistingLayouts(zip);
   const layoutPaths = [];
   for (let i2 = 0; i2 < definitions.length; i2++) {
@@ -163506,11 +164234,12 @@ function uniquePrefixedName(existingNames, base) {
 }
 
 // pptx/core/builders/sdk/master-layout-crud-xml.ts
+init_zip_open();
 init_xml_utils();
 init_PptxHandler();
 async function saveToZip(handler, data) {
   const bytes = await handler.save(data.slides);
-  return JSZip17__default.default.loadAsync(bytes);
+  return openPptxZip(bytes);
 }
 async function reload(zip) {
   const buffer = await zip.generateAsync({ type: "arraybuffer" });
@@ -165742,6 +166471,7 @@ function getThemePreset(name) {
 }
 
 // pptx/core/builders/sdk/import-slide-package.ts
+init_zip_open();
 init_PresentationBuilder();
 init_PptxHandler();
 init_clone_part_graph();
@@ -165750,10 +166480,7 @@ init_xml2();
 async function importSlidePackage(destination, source, options = {}) {
   if (options.insertAt !== void 0 && (!Number.isInteger(options.insertAt) || !Number.isFinite(options.insertAt)))
     throw new Error("Insertion point must be a finite integer");
-  const [zip, sourceZip] = await Promise.all([
-    JSZip17__default.default.loadAsync(destination),
-    JSZip17__default.default.loadAsync(source)
-  ]);
+  const [zip, sourceZip] = await Promise.all([openPptxZip(destination), openPptxZip(source)]);
   const presentationPath = "ppt/presentation.xml";
   const sourceDoc = parseXml(await requiredXml(sourceZip, presentationPath));
   const destinationDoc = parseXml(await requiredXml(zip, presentationPath));
@@ -165933,7 +166660,7 @@ function nativeIdAllocator(values, min, max, kind) {
   };
 }
 async function createSlideClipboardPackage(source, slideIndices) {
-  const sourceZip = await JSZip17__default.default.loadAsync(source);
+  const sourceZip = await openPptxZip(source);
   const root = parseXml(await requiredXml(sourceZip, "ppt/presentation.xml")).documentElement;
   const size = first(root, "sldSz", root.namespaceURI ?? "");
   const width = Number(size?.getAttribute("cx")), height = Number(size?.getAttribute("cy"));
@@ -175849,6 +176576,44 @@ async function setPresentationRunText(bytes, slideIndex, elementId, runIndex, te
   element.text = element.textSegments.map((segment) => segment.text).join("");
   return handler.save(data.slides);
 }
+async function createPresentationFromOutline(slides, options = {}) {
+  if (!(slides instanceof Array) || !slides.length || slides.length > 200)
+    throw new Error("A presentation outline has 1 to 200 slides");
+  const { PresentationBuilder: PresentationBuilder2 } = await Promise.resolve().then(() => (init_PresentationBuilder(), PresentationBuilder_exports));
+  const { handler, data, createSlide } = await PresentationBuilder2.create({
+    ...options.title ? { title: options.title } : {}
+  });
+  const plain = (value, max = 2e3) => {
+    if (typeof value !== "string" || value.length > max) throw new Error("Invalid slide text");
+    return value;
+  };
+  slides.forEach((slide, index) => {
+    const bullets = (slide.bullets ?? []).map((item) => plain(item));
+    const cover = index === 0 && !bullets.length;
+    const builder3 = createSlide(cover ? "Title Slide" : "Title and Content").addText(
+      plain(slide.title, 500),
+      cover ? { x: 96, y: 250, width: 1088, height: 160, fontSize: 60, alignment: "center" } : { x: 64, y: 40, width: 1152, height: 110, fontSize: 44 }
+    );
+    if (bullets.length)
+      builder3.addText(bullets.map((text2) => text2.replace(/\n/g, " ")).join("\n"), {
+        x: 64,
+        y: 160,
+        width: 1152,
+        height: 500,
+        fontSize: 28
+      });
+    if (slide.notes) builder3.setNotes(plain(slide.notes, 2e4));
+    const built = builder3.build();
+    const body = bullets.length ? built.elements[built.elements.length - 1] : void 0;
+    if (body?.type === "text") {
+      for (const [i2, segment] of (body.textSegments ?? []).entries())
+        if (!segment.isParagraphBreak && (i2 === 0 || body.textSegments?.[i2 - 1]?.isParagraphBreak))
+          segment.bulletInfo = { char: "\u2022" };
+    }
+    data.slides.push(built);
+  });
+  return handler.save(data.slides);
+}
 
 // pptx/converter/media-context.ts
 var MIME_TO_EXT = {
@@ -179386,6 +180151,7 @@ exports.createLayout = createLayout;
 exports.createLayouts = createLayouts;
 exports.createMediaElement = createMediaElement;
 exports.createModifyVerifier = createModifyVerifier;
+exports.createPresentationFromOutline = createPresentationFromOutline;
 exports.createSaltlessModifyVerifierForTesting = createSaltlessModifyVerifierForTesting;
 exports.createShapeElement = createShapeElement;
 exports.createSlideClipboardPackage = createSlideClipboardPackage;