superdoc-macros 0.7.0 → 0.8.0

package/dist/import/zip.d.ts

@@ -0,0 +1,35 @@
+export declare const ZIP_LIMITS: {
+    readonly maxEntries: 5000;
+    /** Uncompressed size of any single part this reader will inflate. */
+    readonly maxEntryBytes: number;
+    readonly maxNameLength: 1024;
+};
+export interface ZipEntry {
+    readonly name: string;
+    readonly compressedSize: number;
+    readonly uncompressedSize: number;
+}
+export interface ZipReadOptions {
+    /**
+     * Hard ceiling on the bytes this read may produce, defaulting to
+     * `ZIP_LIMITS.maxEntryBytes`. Enforced *during* decompression, so a part
+     * that inflates past it is abandoned rather than buffered and then
+     * rejected. Callers who know a part should be small (a `.rels` file) should
+     * say so — that is the difference between refusing a bomb and hosting it.
+     */
+    maxBytes?: number;
+}
+export interface ZipArchive {
+    readonly entries: readonly ZipEntry[];
+    has(name: string): boolean;
+    /**
+     * The inflated bytes of one entry.
+     *
+     * @throws {VbaParseError} when the entry is absent, encrypted, compressed
+     * with an unsupported method, larger than the cap, or its data runs past
+     * the end of the file.
+     */
+    read(name: string, options?: ZipReadOptions): Promise<Uint8Array>;
+}
+/** Parses the central directory. Reading an entry's data stays lazy. */
+export declare function openZip(bytes: Uint8Array): ZipArchive;

package/dist/import/zip.js

@@ -0,0 +1,253 @@
+/**
+ * A read-only ZIP reader, enough to pull named parts out of an OOXML package.
+ *
+ * A `.docm` is a ZIP whose entries are the document's parts. To reach the
+ * macro project we need two or three specific parts by name, never the whole
+ * archive — so this reader parses the central directory up front (cheap) and
+ * inflates only what a caller asks for.
+ *
+ * Inflation uses the platform's own `DecompressionStream` — Baseline across
+ * browsers since 2023, and present in Node 18+. That keeps the toolkit
+ * dependency-free and puts the decompression itself in audited native code
+ * rather than in a hand-rolled inflater. Where it is genuinely absent, the
+ * reader says so rather than failing obscurely. Nothing else is assumed of the
+ * platform: no `Blob`, no `fetch`, no `Response` — only streams, so this also
+ * runs under jsdom, where a host's tests live.
+ *
+ * Safety posture, because these bytes come from a file someone was sent:
+ *
+ * - Entry count and name length are capped, and the per-part size cap is
+ *   enforced against the bytes decompression actually produces — not against
+ *   the size the archive claims, which a decompression bomb simply lies about.
+ * - Encrypted and ZIP64 entries are refused explicitly rather than guessed at.
+ * - Nothing here writes, and no entry name is ever used as a filesystem path,
+ *   so the classic zip-slip traversal has no surface to attack.
+ */
+import { VbaParseError } from './errors.js';
+export const ZIP_LIMITS = {
+    maxEntries: 5_000,
+    /** Uncompressed size of any single part this reader will inflate. */
+    maxEntryBytes: 64 * 1024 * 1024,
+    maxNameLength: 1_024,
+};
+const EOCD_SIGNATURE = 0x06054b50;
+const CENTRAL_SIGNATURE = 0x02014b50;
+const LOCAL_SIGNATURE = 0x04034b50;
+const ZIP64_LOCATOR_SIGNATURE = 0x07064b50;
+const EOCD_MIN_BYTES = 22;
+/** The trailing comment a ZIP may carry is at most 64 KiB. */
+const MAX_COMMENT_BYTES = 0xffff;
+const ZIP64_MARKER_32 = 0xffffffff;
+const ZIP64_MARKER_16 = 0xffff;
+const METHOD_STORED = 0;
+const METHOD_DEFLATE = 8;
+/** Parses the central directory. Reading an entry's data stays lazy. */
+export function openZip(bytes) {
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const u16 = (offset) => {
+        if (offset < 0 || offset + 2 > bytes.length) {
+            throw new VbaParseError('malformed', 'package: read past the end of the file');
+        }
+        return view.getUint16(offset, true);
+    };
+    const u32 = (offset) => {
+        if (offset < 0 || offset + 4 > bytes.length) {
+            throw new VbaParseError('malformed', 'package: read past the end of the file');
+        }
+        return view.getUint32(offset, true);
+    };
+    if (bytes.length < EOCD_MIN_BYTES) {
+        throw new VbaParseError('malformed', 'package: file is too short to be a ZIP archive');
+    }
+    // The end-of-central-directory record sits at the very end, behind an
+    // optional comment — so it has to be found by scanning backwards.
+    const scanFloor = Math.max(0, bytes.length - EOCD_MIN_BYTES - MAX_COMMENT_BYTES);
+    let eocd = -1;
+    for (let at = bytes.length - EOCD_MIN_BYTES; at >= scanFloor; at -= 1) {
+        if (view.getUint32(at, true) === EOCD_SIGNATURE) {
+            eocd = at;
+            break;
+        }
+    }
+    if (eocd < 0) {
+        throw new VbaParseError('malformed', 'package: not a ZIP archive (no end-of-directory record)');
+    }
+    const entryCount = u16(eocd + 10);
+    const directorySize = u32(eocd + 12);
+    const directoryOffset = u32(eocd + 16);
+    if (entryCount === ZIP64_MARKER_16 ||
+        directoryOffset === ZIP64_MARKER_32 ||
+        directorySize === ZIP64_MARKER_32 ||
+        (eocd >= 20 && view.getUint32(eocd - 20, true) === ZIP64_LOCATOR_SIGNATURE)) {
+        throw new VbaParseError('unsupported', 'package: ZIP64 archives are not supported');
+    }
+    if (entryCount > ZIP_LIMITS.maxEntries) {
+        throw new VbaParseError('too-large', 'package: too many entries');
+    }
+    if (directoryOffset + directorySize > bytes.length) {
+        throw new VbaParseError('malformed', 'package: central directory lies outside the file');
+    }
+    const decoder = new TextDecoder('utf-8');
+    const byName = new Map();
+    const entries = [];
+    const directoryEnd = directoryOffset + directorySize;
+    let at = directoryOffset;
+    for (let i = 0; i < entryCount; i += 1) {
+        // Confined to the region the archive declared for its directory, so a
+        // crafted file cannot have us read "entries" out of arbitrary bytes
+        // elsewhere in the package.
+        if (at + 46 > directoryEnd) {
+            throw new VbaParseError('malformed', 'package: central directory is shorter than it claims');
+        }
+        if (u32(at) !== CENTRAL_SIGNATURE) {
+            throw new VbaParseError('malformed', 'package: damaged central directory');
+        }
+        const flags = u16(at + 8);
+        const method = u16(at + 10);
+        const compressedSize = u32(at + 20);
+        const uncompressedSize = u32(at + 24);
+        const nameLength = u16(at + 28);
+        const extraLength = u16(at + 30);
+        const commentLength = u16(at + 32);
+        const localOffset = u32(at + 42);
+        if (nameLength > ZIP_LIMITS.maxNameLength) {
+            throw new VbaParseError('too-large', 'package: entry name is too long');
+        }
+        if (compressedSize === ZIP64_MARKER_32 || uncompressedSize === ZIP64_MARKER_32) {
+            throw new VbaParseError('unsupported', 'package: ZIP64 entry sizes are not supported');
+        }
+        const nameStart = at + 46;
+        if (nameStart + nameLength > directoryEnd) {
+            throw new VbaParseError('malformed', 'package: entry name lies outside the central directory');
+        }
+        // OOXML part names are ASCII, which UTF-8 and CP437 agree on — so the
+        // flag-11 distinction cannot change the names we look up.
+        const name = decoder.decode(bytes.subarray(nameStart, nameStart + nameLength));
+        const entry = {
+            name,
+            method,
+            compressedSize,
+            uncompressedSize,
+            localOffset,
+            encrypted: (flags & 0x0001) !== 0,
+        };
+        entries.push({ name, compressedSize, uncompressedSize });
+        // First entry wins, so a duplicated name cannot shadow the part that was
+        // already announced in `entries`.
+        if (!byName.has(name))
+            byName.set(name, entry);
+        at = nameStart + nameLength + extraLength + commentLength;
+    }
+    return {
+        entries,
+        has: (name) => byName.has(name),
+        async read(name, options) {
+            const entry = byName.get(name);
+            if (!entry) {
+                throw new VbaParseError('malformed', `package: no such part (${name})`);
+            }
+            if (entry.encrypted) {
+                throw new VbaParseError('unsupported', `package: ${name} is encrypted`);
+            }
+            const requested = options?.maxBytes;
+            const cap = Math.min(typeof requested === 'number' && Number.isFinite(requested) && requested > 0
+                ? Math.floor(requested)
+                : ZIP_LIMITS.maxEntryBytes, ZIP_LIMITS.maxEntryBytes);
+            // The declared size is only a claim, so it is a cheap early rejection
+            // rather than the real defence — the real one is enforced against the
+            // bytes actually produced, below.
+            if (entry.uncompressedSize > cap) {
+                throw new VbaParseError('too-large', `package: ${name} exceeds the part size cap`);
+            }
+            if (u32(entry.localOffset) !== LOCAL_SIGNATURE) {
+                throw new VbaParseError('malformed', `package: ${name} has a damaged local header`);
+            }
+            const localNameLength = u16(entry.localOffset + 26);
+            const localExtraLength = u16(entry.localOffset + 28);
+            const dataStart = entry.localOffset + 30 + localNameLength + localExtraLength;
+            const dataEnd = dataStart + entry.compressedSize;
+            if (dataEnd > bytes.length) {
+                throw new VbaParseError('malformed', `package: ${name} runs past the end of the file`);
+            }
+            const data = bytes.subarray(dataStart, dataEnd);
+            if (entry.method === METHOD_STORED) {
+                // A stored entry's real length is its compressed length; the declared
+                // uncompressed size may disagree, so the cap is applied to what we
+                // would actually return.
+                if (data.length > cap) {
+                    throw new VbaParseError('too-large', `package: ${name} exceeds the part size cap`);
+                }
+                return data.slice();
+            }
+            if (entry.method !== METHOD_DEFLATE) {
+                throw new VbaParseError('unsupported', `package: ${name} uses compression method ${entry.method}`);
+            }
+            return inflateRaw(data, name, cap);
+        },
+    };
+}
+/**
+ * Inflates one entry, enforcing `cap` as the bytes arrive.
+ *
+ * Reading the stream chunk by chunk rather than with `Response.arrayBuffer()`
+ * is the whole point. Buffering first and checking the length afterwards
+ * means a part that declares a kilobyte and expands to a gigabyte has already
+ * been fully materialized by the time the limit is consulted — the classic
+ * decompression bomb. Here the read is abandoned the moment the total would
+ * exceed the cap.
+ */
+async function inflateRaw(data, name, cap) {
+    if (typeof DecompressionStream !== 'function' || typeof ReadableStream !== 'function') {
+        throw new VbaParseError('unsupported', 'package: this environment cannot decompress ZIP entries');
+    }
+    // The bytes are wrapped in a stream directly rather than via
+    // `new Blob([data]).stream()`. Both work in a browser, but `Blob.stream` is
+    // one of the pieces jsdom does not implement — and a host's own test suite
+    // running in jsdom is a place this code has to work, not fall over.
+    // `BufferSource` and not `Uint8Array`: that is what `DecompressionStream`
+    // declares its writable side accepts, and `pipeThrough` matches on it.
+    const source = new ReadableStream({
+        start(controller) {
+            // The cast covers a modelling gap, not a real one: since TypeScript 5.7
+            // a bare `Uint8Array` may be backed by a `SharedArrayBuffer`, which
+            // `BufferSource` excludes. These bytes are a view over the caller's
+            // package, and the stream accepts any array-buffer view at runtime.
+            // Copying to prove it to the compiler would duplicate the whole part.
+            controller.enqueue(data);
+            controller.close();
+        },
+    });
+    const stream = source.pipeThrough(new DecompressionStream('deflate-raw'));
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > cap) {
+                throw new VbaParseError('too-large', `package: ${name} inflates past the part size cap`);
+            }
+            chunks.push(value);
+        }
+    }
+    catch (error) {
+        // Release the decompressor before rethrowing, so an abandoned bomb does
+        // not leave a stream pulling in the background.
+        await reader.cancel().catch(() => undefined);
+        if (error instanceof VbaParseError)
+            throw error;
+        throw new VbaParseError('malformed', `package: ${name} could not be decompressed`);
+    }
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -10,4 +10,14 @@ export { MacroRecorder, replayMacro, type RecorderOptions, type RecordingWarning
 export { renderSnippet, renderSnippetForHost, expandSnippet, usesSelection, type ExpandOptions, type RenderContext, } from './snippets/snippets.js';
 export { AutoText, type AutoTextOptions, type AutoTextExpansion } from './snippets/autotext.js';
 export { parseShortcut, eventMatches, bindShortcuts, shortcutSignatures, hasBindingModifier, isBindableKey, codesForKey, type ParsedShortcut, type ShortcutBinding, type ShortcutTarget, } from './shortcuts.js';
+/**
+ * Reading the VBA macros already inside a `.docm`, for review only. Separate
+ * from `MacroKit` on purpose: extraction touches no saved macro, binds no
+ * shortcut, and executes nothing — see `src/import/vba.ts`.
+ */
+export { extractVbaFromDocx, extractVbaProject, findVbaPart, scanForAutoRunProcedures, VBA_LIMITS, type VbaExtraction, type VbaFailureReason, type VbaModule, type VbaModuleKind, type VbaProcedureRef, type VbaProject, type VbaWarning, } from './import/vba.js';
+export { VbaParseError, isVbaParseError, type VbaParseErrorCode } from './import/errors.js';
+export { readCfb, CFB_LIMITS, type CfbContainer, type CfbEntry, type CfbEntryType } from './import/cfb.js';
+export { openZip, ZIP_LIMITS, type ZipArchive, type ZipEntry } from './import/zip.js';
+export { decompressOvba, OVBA_LIMITS, type DecompressOvbaOptions } from './import/ms-ovba.js';
 export { createLocalStorage, createMemoryStorage, emptyState, parsePersistedState, DEFAULT_STORAGE_KEY, IMPORT_LIMITS, isPersistableState, serializePersistable, type MacroStorage, type PersistedMacroState, } from './storage.js';

package/dist/index.js

@@ -8,4 +8,14 @@ export { MacroRecorder, replayMacro, } from './recorder/recorder.js';
 export { renderSnippet, renderSnippetForHost, expandSnippet, usesSelection, } from './snippets/snippets.js';
 export { AutoText } from './snippets/autotext.js';
 export { parseShortcut, eventMatches, bindShortcuts, shortcutSignatures, hasBindingModifier, isBindableKey, codesForKey, } from './shortcuts.js';
+/**
+ * Reading the VBA macros already inside a `.docm`, for review only. Separate
+ * from `MacroKit` on purpose: extraction touches no saved macro, binds no
+ * shortcut, and executes nothing — see `src/import/vba.ts`.
+ */
+export { extractVbaFromDocx, extractVbaProject, findVbaPart, scanForAutoRunProcedures, VBA_LIMITS, } from './import/vba.js';
+export { VbaParseError, isVbaParseError } from './import/errors.js';
+export { readCfb, CFB_LIMITS } from './import/cfb.js';
+export { openZip, ZIP_LIMITS } from './import/zip.js';
+export { decompressOvba, OVBA_LIMITS } from './import/ms-ovba.js';
 export { createLocalStorage, createMemoryStorage, emptyState, parsePersistedState, DEFAULT_STORAGE_KEY, IMPORT_LIMITS, isPersistableState, serializePersistable, } from './storage.js';

package/dist/manager.d.ts

@@ -108,13 +108,19 @@ export declare class MacroKit {
     runSource(source: string): Promise<MacroRunResult>;
     get isRecording(): boolean;
     get recordedStepCount(): number;
-    startRecording(): void;
+    /**
+     * Starts a fresh recording. Returns false instead of overwriting an active
+     * or stopped-but-unsaved capture, or while another macro is running.
+     */
+    startRecording(): boolean;
     /**
      * Stops and saves. `null` when no step was recorded — there is nothing to
      * save.
      *
      * Throws — with the stopped recording **retained for retry** (call again;
      * `cancelRecording` is the explicit way to drop it) — when:
+     * - `recording-uncapturable`: every action was uncapturable, so even an
+     *   explicitly incomplete save would create an empty macro.
      * - `recording-incomplete`: some actions could not be captured (e.g. an
      *   inserted image, whose payload is the whole file). Saving that as-is
      *   would present a macro that replays less than what the user did, so it

package/dist/manager.js

@@ -223,10 +223,15 @@ export class MacroKit {
     get recordedStepCount() {
         return this.recorder.stepCount;
     }
+    /**
+     * Starts a fresh recording. Returns false instead of overwriting an active
+     * or stopped-but-unsaved capture, or while another macro is running.
+     */
     startRecording() {
-        if (this.running)
-            return;
+        if (this.running || this.recorder.recording || this.recorder.hasPending)
+            return false;
         this.recorder.start();
+        return this.recorder.recording;
     }
     /**
      * Stops and saves. `null` when no step was recorded — there is nothing to
@@ -234,6 +239,8 @@ export class MacroKit {
      *
      * Throws — with the stopped recording **retained for retry** (call again;
      * `cancelRecording` is the explicit way to drop it) — when:
+     * - `recording-uncapturable`: every action was uncapturable, so even an
+     *   explicitly incomplete save would create an empty macro.
      * - `recording-incomplete`: some actions could not be captured (e.g. an
      *   inserted image, whose payload is the whole file). Saving that as-is
      *   would present a macro that replays less than what the user did, so it
@@ -243,19 +250,27 @@ export class MacroKit {
      * - a persistence failure (quota, oversized state).
      */
     stopRecording(name, shortcut, options = {}) {
-        this.requireValidShortcut(shortcut);
-        this.requireItemLimits({ name, shortcut });
-        this.requireRoom(this.state.recordings);
+        // Stop first. Every failure below must leave the recorder inactive and
+        // its snapshot retryable. Checking capacity before stop() used to leave a
+        // manual recording active behind a stopped UI, and could lose an
+        // auto-stopped recording on the next start.
         const pending = this.recorder.stop();
         const { steps, truncated } = splitOversizedSteps(pending.steps);
         if (truncated)
             throw new MacroError(macroMessages().recordingTooLarge, 'recording-too-large');
+        const commandIds = [...new Set(pending.warnings.map((warning) => warning.commandId))].join(', ');
+        if (pending.warnings.length > 0 && steps.length === 0) {
+            const messages = macroMessages();
+            throw new MacroError(messages.recordingUncapturable?.(commandIds) ?? messages.recordingIncomplete(commandIds), 'recording-uncapturable');
+        }
         if (steps.length === 0) {
             this.recorder.discard();
             return null;
         }
+        this.requireValidShortcut(shortcut);
+        this.requireItemLimits({ name, shortcut });
+        this.requireRoom(this.state.recordings);
         if (pending.warnings.length > 0 && !options.allowIncomplete) {
-            const commandIds = [...new Set(pending.warnings.map((warning) => warning.commandId))].join(', ');
             throw new MacroError(macroMessages().recordingIncomplete(commandIds), 'recording-incomplete');
         }
         const recording = {

package/dist/messages.d.ts

@@ -43,6 +43,12 @@ export interface MacroMessages {
     saveFailed: string;
     recordingTooLarge: string;
     recordingIncomplete: (commandIds: string) => string;
+    /**
+     * No usable step was captured; saving with allowIncomplete would create an
+     * empty macro. Optional for source compatibility with existing full locale
+     * objects compiled against 0.7.0.
+     */
+    recordingUncapturable?: (commandIds: string) => string;
     shortcutInvalid: string;
     shortcutNeedsModifier: string;
     shortcutReserved: string;

package/dist/messages.js

@@ -43,6 +43,7 @@ export const ENGLISH_MESSAGES = {
     saveFailed: 'Saving failed — the change was not applied',
     recordingTooLarge: 'The recording is too large to save',
     recordingIncomplete: (commandIds) => `The recording is missing actions that cannot be recorded (${commandIds})`,
+    recordingUncapturable: (commandIds) => `The recording contains only actions that cannot be recorded (${commandIds})`,
     shortcutInvalid: 'Invalid shortcut — use a form like Ctrl+Alt+M',
     shortcutNeedsModifier: 'A shortcut must include Ctrl, Alt or Meta',
     shortcutReserved: 'This shortcut is reserved by the editor',
@@ -83,6 +84,7 @@ export const HEBREW_MESSAGES = {
     saveFailed: 'השמירה נכשלה — השינוי לא הוחל',
     recordingTooLarge: 'ההקלטה גדולה מכדי להישמר',
     recordingIncomplete: (commandIds) => `בהקלטה חסרות פעולות שאינן ניתנות להקלטה (${commandIds})`,
+    recordingUncapturable: (commandIds) => `ההקלטה מכילה רק פעולות שאינן ניתנות להקלטה (${commandIds})`,
     shortcutInvalid: 'קיצור לא תקין — הצורה הנדרשת היא למשל Ctrl+Alt+M',
     shortcutNeedsModifier: 'קיצור חייב לכלול Ctrl,‏ Alt או Meta',
     shortcutReserved: 'הקיצור הזה שמור לעורך',

package/dist/recorder/recorder.d.ts

@@ -80,6 +80,13 @@ export declare class MacroRecorder {
     applyAutoTextExpansion(consumed: number, replacement: string): void;
     private teardown;
     private push;
+    private addWarning;
+    /**
+     * Warnings are part of the stopped snapshot just like steps. Counting both
+     * prevents a warning-only recording from growing without bound while never
+     * reaching the ordinary step cap.
+     */
+    private maybeAutoStop;
     /**
      * Records a programmatic insertion the host will not report as typing —
      * e.g. a snippet expanded from a button or shortcut, which writes through

package/dist/recorder/recorder.js

@@ -146,12 +146,27 @@ export class MacroRecorder {
     }
     push(step) {
         this.steps.push(step);
-        if (this.steps.length >= this.maxSteps) {
-            // The cap stops the *listening*, not the data: the steps stay for
-            // stop() to collect, and the owner is told the recording ended.
-            this.teardown();
-            this.onAutoStop?.();
-        }
+        this.maybeAutoStop();
+    }
+    addWarning(warning) {
+        this.warnings.push(warning);
+        this.maybeAutoStop();
+    }
+    /**
+     * Warnings are part of the stopped snapshot just like steps. Counting both
+     * prevents a warning-only recording from growing without bound while never
+     * reaching the ordinary step cap.
+     */
+    maybeAutoStop() {
+        if (!this.active)
+            return;
+        if (this.steps.length + this.warnings.length < this.maxSteps)
+            return;
+        this.teardown();
+        this.pending = { steps: this.steps, warnings: this.warnings };
+        this.steps = [];
+        this.warnings = [];
+        this.onAutoStop?.();
     }
     /**
      * Records a programmatic insertion the host will not report as typing —
@@ -184,15 +199,15 @@ export class MacroRecorder {
             json = JSON.stringify(payload);
         }
         catch {
-            this.warnings.push({ commandId: id, reason: 'payload-not-serializable' });
+            this.addWarning({ commandId: id, reason: 'payload-not-serializable' });
             return;
         }
         if (typeof json !== 'string') {
-            this.warnings.push({ commandId: id, reason: 'payload-not-serializable' });
+            this.addWarning({ commandId: id, reason: 'payload-not-serializable' });
             return;
         }
         if (json.length > IMPORT_LIMITS.maxPayloadLength) {
-            this.warnings.push({ commandId: id, reason: 'payload-too-large' });
+            this.addWarning({ commandId: id, reason: 'payload-too-large' });
             return;
         }
         this.push({ type: 'command', id, payload: JSON.parse(json) });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "superdoc-macros",
-  "version": "0.7.0",
-  "description": "Macro toolkit for SuperDoc-based editors: sandboxed scripted macros, a Word-style macro recorder, and snippets with auto-text expansion.",
+  "version": "0.8.0",
+  "description": "Macro toolkit for SuperDoc-based editors: sandboxed scripted macros, a Word-style macro recorder, snippets with auto-text expansion, and read-only VBA import from .docm files.",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -34,6 +34,8 @@
     "snippets",
     "autotext",
     "docx",
+    "docm",
+    "vba",
     "editor",
     "otzaria"
   ],