@quillmark/wasm 0.124.0 → 0.126.0

package/CHANGELOG.md

@@ -1,5 +1,401 @@
 # Changelog
 
+## v0.126.0 - 2026-10-16
+
+Upgrade path: [0.125 → 0.126](docs/migrations/0.125-to-0.126.md). Script
+links, runaway YAML expansion, bodies nested past 12 levels and a field named
+`body` are refused, a quill's font collections load and a character no loaded
+font covers warns `typst::missing_glyph`, an acroform quill's field spec is
+`form.yaml`, a Typst quill's plate is `plate.typ` by name and an unknown
+`typst:` key fails the load, a card groups fields under a top-level `object`
+where it declared `sections:`, a `$quill` name may carry a collection, a
+quill's `version` is `MAJOR.MINOR.PATCH` and a `$quill` selector
+`@MAJOR.MINOR` or exact, a document the quill creates pins its `MAJOR.MINOR`,
+`status_report` stores enum ids, a blueprint prints a blank `default:` as no
+default, a WASM trap rejects coded, a text field is `text` or `richtext`, one
+line unless it declares `multiline: true`, and prebuilt `quillmark` binaries
+ship on every GitHub Release.
+
+### Field types
+
+- feat(core)!: **`type: plaintext` is `type: text`, and `text` and `richtext`
+  are one line unless they declare `multiline: true`**, the one line-shape key
+  coercion, `validate`, the editor and acroform all read. `inline:` and
+  `ui.multiline` are retired and fail the load as `quill::field_parse_error`,
+  naming the replacement, and a `richtext` spells `multiline:` either way for
+  this release, so no quill declaring a text field loads on both 0.125 and
+  0.126. `schema()` carries `multiline` where it carried `inline: true` on the
+  opposite fields, and the transform schema a plate reads carries
+  `quillmark:multiline: true` where it carried `quillmark:inline`. The
+  blueprint prints `text<plain>`, `text(multiline)<plain>`,
+  `richtext<markdown>` and `richtext(multiline)<markdown>`, where
+  `richtext<markdown>` named a block field. `validation::not_inline`,
+  `edit::field_not_inline`, `conform::field_not_inline` and
+  `quill::seed_not_inline` end in `not_single_line`, and their `codec` names
+  `text`; a `coercion_failed` `target` reads `text(single_line)`,
+  `richtext(single_line)` or `text`, where it read `plaintext(inline)`,
+  `richtext(inline)` or `plaintext`. In Rust, `FieldType::PlainText { inline }`
+  is `Text { multiline }`, `RichText { inline }` is `RichText { multiline }`,
+  `ValidationError::NotInline` is `NotSingleLine`, `EditError::FieldNotInline`
+  is `FieldNotSingleLine`, `QUILLMARK_INLINE_KEY` is
+  `QUILLMARK_MULTILINE_KEY` and `CODEC_PLAINTEXT` is `CODEC_TEXT`;
+  `UiFieldSchema::multiline` and WASM `QuillFieldUi.multiline` are removed. An
+  acroform text widget binds multiline exactly where its field declares it, so
+  a `richtext` declaring `multiline: true` binds a multiline widget, where a
+  block `richtext` without `ui.multiline` bound a one-line one. (#2217, #2229,
+  #2232)
+- feat(core)!: **`type: string` is retired in favor of `text`**, and a plate
+  that computes with a text value reads its `str` through the new
+  `qm.str(..)`, which returns the value's text with trailing whitespace
+  dropped. A former `string` value reaches the plate as content, with nav and
+  click-to-edit, and still rests as the verbatim string. A matrix added item's
+  `title` is a one-line `text` cell. A stored `string` value holding an
+  interior line break fails `validation::not_single_line` and its render
+  `validation::coercion_failed`; a one-line value ignores trailing whitespace.
+  `FieldType::String` is removed. (#2230, #2232)
+- fix(core)!: **a one-line `text` value ignores its trailing whitespace**, so
+  one written as a YAML `|` block, whose newline the block keeps, validates,
+  renders and conforms to its line, where an `inline: true` `plaintext` failed
+  `validation::not_inline`. Only a line break inside the value fails.
+  `trailingNewline` leaves the `not_single_line` args, and `trailing_newline`
+  leaves `ValidationError::NotSingleLine` and `EditError::FieldNotSingleLine`.
+  (#2234)
+
+### PDF forms
+
+- feat(acroform)!: **an acroform quill's field spec is `form.yaml`**, read as
+  `Quill.yaml` is, where it was `form.json`. JSON is YAML 1.2, so a renamed
+  `form.json` loads unchanged but for the three contents the upgrade guide
+  names: a raw DEL, C1 control, U+FFFE or U+FFFF, a repeated key, and a `rect`
+  value past `f32` range. A quill holding `form.json` fails as
+  `acroform::legacy_form_json`. `acroform::invalid_form_json` is
+  `acroform::invalid_form_spec`, located in `form.yaml`, and
+  `acroform::missing_form_json` is `acroform::missing_form_spec`, its hint
+  adding `form.yaml` at the quill root. (#2210, #2234)
+- fix(cli): **`quillmark validate --no-render` reads an acroform quill's
+  `form.yaml` as `open` does**, binding it against the schema and `form.pdf`'s
+  pages, so a quill holding `form.json`, no spec, or one that does not parse
+  fails there, where it passed and then failed to open.
+  `quillmark::acroform_check_form` is that check. (#2234)
+
+### Blueprint
+
+- feat(core)!: **a blueprint's `$kind: main` line carries `main.title` and
+  `main.description` alone**, where it fell back to `quill.description`, which
+  describes the package and never reaches the blueprint. (#2222)
+- feat(core)!: **a blank `default:` (`""`, `[]`, `{}`) prints in the blueprint
+  as no default does**, an empty cell where it printed `""`, since it renders
+  as one; `0` and `false` print. **A required typed table without a
+  `default:` prints `[]` led by its synthetic row commented out**, the shape
+  `default: []` printed, and an optional one an empty cell,
+  `r: # array<object>?`, under the same commented row, since `[]` answers it;
+  either printed the row live, and an unedited blueprint rendered one blank
+  row. The blank `default:` stays legal, and no diagnostic names it. (#2233)
+
+### Typst plates
+
+- feat(typst)!: **a Typst quill's plate is `plate.typ` at its root, found by
+  name, and `typst:` holds only the keys the backend reads.**
+  `typst.plate_file` stays, as an override. A quill holding `plate.typ` and
+  declaring no `plate_file` renders that plate, where it rendered a blank
+  page, and nothing reports the change; a `plate.typ` there that does not
+  compile fails `open` and `quillmark validate`. A quill holding no
+  `plate.typ` and declaring no `plate_file` fails to open as
+  `typst::plate_missing`, and `quillmark validate` reports it, where it
+  rendered a blank page; a `plate_file` that is not a string, or names no
+  path, fails as `typst::plate_path_invalid`. An unknown key under the
+  backend's section fails the load as `quill::unknown_backend_key`, where a
+  `typst:` key warned `typst::unknown_key` on every render, and a scalar or
+  sequence section fails as `quill::invalid_backend_section`.
+  `quillmark::typst_plate_file` returns the path, not an `Option`. (#2225)
+
+### Grouping
+
+- feat(core)!: **a card groups fields under a top-level `object`, and a card
+  declaring `sections:` fails `quill::invalid_card_schema`**, its hint naming
+  the `object`. `quill::empty_section`, `quill::invalid_section_id`,
+  `quill::mixed_sectioning` and `quill::duplicate_field` are retired;
+  `ui.group` / `ui.groups` load with `quill::deprecated_groups`, which hints
+  the `object` rewrite. The `usaf_memo` fixture declares its fields ungrouped.
+  (#2213)
+
+### Formats that grow
+
+- feat(acroform): **a field spec tagged with a later `0.x` than `0.2`
+  loads**, its unknown keys ignored as before, where any version but `0.2.x`
+  failed as `acroform::invalid_form_json`. A new major still fails. (#2208)
+- feat(core): **`quill.requires: ">=1.3"` names the oldest Quillmark a quill
+  loads on**, and an engine from this release on that is below the floor
+  refuses it with one `quill::engine_too_old` error instead of reporting the
+  keys it has not learned as typos. (#2206)
+
+### Links and untrusted input
+
+- fix(typst)!: **a link whose target's scheme is `javascript:`, `vbscript:`,
+  `data:` or `file:` renders as its text alone**, where it rendered a live link
+  in PDF and SVG. (#2178)
+- fix(typst): **SVG output is well-formed XML when a link's URL holds `&` or
+  `<`**, where its `href` carried them raw and an XML parser refused the file.
+  (#2194)
+- fix(typst): **a link whose URL holds a character XML 1.0 cannot carry, a C0
+  control but tab, LF and CR or U+FFFE or U+FFFF, renders as its text
+  alone**, where its `href` carried it raw and the whole SVG failed to parse.
+  (#2234)
+- fix(core)!: **a card-yaml block's aliases and tags expand within a budget
+  linear in its source**: past twice the block's bytes plus 4 KiB of scalars,
+  or its bytes plus 4 KiB of nodes, the block fails its YAML parse, with a
+  hint. (#2178)
+- fix(pdf): **a PDF's page tree shares ancestor chains, its node cap counts
+  queued kids, and a deep chain drops without recursing.** (#2178)
+- docs: **`SECURITY.md` says how to report a vulnerability and what counts as
+  one**, and Operations states what an integration expects of untrusted input
+  and how to bound an untrusted render. (#2176, #2178)
+
+### Fonts
+
+- fix(typst)!: **a `.ttc` or `.otc` the quill ships loads every face it
+  holds, up to 256**, where the font scan skipped it and naming its family
+  warned `unknown font family`. A collection declaring more faces loads none
+  and warns `typst::font_collection_skipped`, and one whose header declares
+  more faces than the file holds offsets for loads none. A quill whose only
+  fonts are collections renders in them rather than the embedded Roboto, so a
+  plate there naming `Roboto` warns `unknown font family`. (#2167, #2168,
+  #2189, #2234)
+- feat(typst)!: **a character no loaded font covers warns
+  `typst::missing_glyph`**, once per render, naming each character the page
+  draws as an empty box, where Typst drew it and said nothing. `quillmark
+  validate` fails an `example.md` that draws one. (#2179, #2196, #2234)
+
+### Markdown
+
+- fix(content)!: **a body nests at most 12 list items, quotes and elements
+  deep, its marks counting nothing, so every body that imports renders under
+  Typst**, where import took 100 and Typst's show-rule depth refused 16 quotes
+  or 32 lists. A body past the bound fails `parse::body_import` at its `path`,
+  and a stored row holding one fails to load; `ParseError::BodyImport` holds
+  `{ path, message }`. (#2187, #2190, #2234)
+- fix(core)!: **a stored row holding more than 1,000 cards fails to load**,
+  `StorageError::Malformed`, as markdown parse refuses that markdown, where it
+  loaded and its own `to_markdown` failed `parse::too_many_cards`; and placing
+  a 1,001st card refuses as `edit::too_many_cards`, `EditError::TooManyCards`,
+  where the edit landed. (#2234)
+
+### Quill names
+
+- feat(core)!: **a `$quill` name may carry a collection,
+  `$quill: borb.usaf_memo@1.2`**, the host's to resolve; the engine pairs by
+  the name after the `.`. A quill name and a collection name are each
+  `[a-z][a-z0-9_]*`, at most 64 characters, so `$quill` no longer admits a
+  leading `_`. `QuillReference` carries `collection`. (#2198, #2205)
+
+### Versioning
+
+- feat(core)!: **a quill's `version` is `MAJOR.MINOR.PATCH`**: a two-segment
+  `version: "1.2"`, or an unquoted `1.10`, fails `quill::invalid_version`. A
+  bump is ranked by what it costs a stored document: PATCH needs no change,
+  MINOR a mechanical rewrite, MAJOR loses data or function. (#2221, #2224)
+- feat(core)!: **a `$quill` selector is `@MAJOR.MINOR` or
+  `@MAJOR.MINOR.PATCH`**, the compatibility boundary being `MAJOR.MINOR`:
+  `$quill: memo@1` fails `parse::invalid_quill_reference`, where it matched any
+  `1.x.x`, and a stored row holding it fails to load. `VersionSelector::Major`
+  is removed. (#2221, #2224)
+- feat(core)!: **a document the quill creates pins `name@MAJOR.MINOR`**: the
+  seeded, empty and example documents and the blueprint carry
+  `$quill: memo@1.2`, where they carried `memo@1.2.0`, so every patch in the
+  series reads them. (#2221, #2224)
+
+### Quill metadata
+
+- feat(core)!: **`quill.license` names a quill's license as an SPDX expression,
+  and `quill.homepage` where its source or docs live.** Both are optional and
+  surface on `Quill.metadata` and `quillmark info`, absent when undeclared.
+  `QuillConfig` gains the public fields `license` and `homepage`, so Rust code
+  building it with a struct literal fails to compile until it names them. A
+  license is checked against the SPDX license list the engine ships: an id off
+  it, a lowercase operator, `/` for `OR` or any line break fails
+  `quill::invalid_license`, and a deprecated id warns
+  `quill::deprecated_license`. A homepage that is not an absolute `http` or
+  `https` URL naming a host and no user fails `quill::invalid_homepage`.
+  (#2225, #2234)
+
+### Bindings
+
+- fix(wasm)!: **a render that traps rejects as `runtime::backend_trapped`**,
+  the `WebAssembly.RuntimeError` on its `cause`, where it rejected as an
+  uncoded `attempted to take ownership of Rust value while it was borrowed`.
+  `Engine.render` / `open` and `LiveSession.update` / `render` / `paint` are
+  covered; a host routes on the code and discards the realm. (#2176)
+- fix(wasm): **`@quillmark/wasm` declares `engines: { node: ">=22" }`**,
+  where it declared `>=24` and npm on Node 22 resolved 0.103.0, the last
+  release under that floor. The `using` sugar needs Node 24. (#2199, #2234)
+- fix(wasm)!: **a native stack overflow inside a render rejects as
+  `runtime::backend_trapped`** too, the `RangeError` V8 and JavaScriptCore
+  raise for it, or Firefox's `InternalError`, on `cause`, where it rejected as
+  that error, uncoded, though it leaves the build's state as undefined as a
+  trap does. (#2234)
+- fix(python): **`render` releases the GIL while the backend compiles**, and
+  renders a clone of the document, so other threads run and may edit it
+  meanwhile. (#2176)
+
+### Errors and suggestions
+
+- fix(core,typst,quillmark): **first-run errors name the newcomer's mistake**:
+  `---` front matter, a backtick fence holding a `$quill:` line, an indented
+  opener, `quill:` for `$quill`, an enum value off only by case, an unknown
+  field type, and a quill path that is a file. A helper assert locates at the
+  plate line that called it. (#2174)
+- fix(core): **field and quill-name suggestions read as a person would write
+  them**: `validation::unknown_field` suggests within a quarter of the key's
+  length, a tie goes to the longest shared prefix, and a truncated key
+  suggests the field it begins; `quill::invalid_name` suggests `cafe` for
+  `Café` and `my_quill` for `MyQuill`. (#2184)
+- fix(core,typst): **a data key spelled `$path` warns that plate data spells
+  each dictionary's address `$path`**, and a spread failing `unexpected
+  argument: $path` hints a sink parameter such as `..rest`. (#2167)
+- fix(core)!: **a quill declaring a field named `body` fails to load with
+  `quill::reserved_field_name`**, its hint to rename the field, where the
+  field and the card's body shared one path, `main.body` or
+  `cards.<kind>[i].body`. (#2207, #2234)
+- docs(reference): **the diagnostic-codes page lists every code the engine
+  mints**, and a test fails on a code minted but not listed, or listed but
+  minted nowhere. (#2175)
+
+### Fixtures
+
+- fix(fixtures)!: **`status_report`'s `state` stores `on_track`, `at_risk` and
+  `blocked`**, where it stored `on track`, `at risk` and `blocked`, and its
+  `version` is `0.2.0`, so a document pinned `status_report@0.1` fails
+  `quill::version_mismatch`. A document holding the old text fails
+  `validation::enum_violation`; the banner prints the same words. (#2167,
+  #2234)
+- fix(fixtures): **`usaf_memo` sets in TeX Gyre Termes**, so its rendered
+  output changes, and the fixtures crate names each third-party file's
+  license. (#2173)
+- fix(fixtures): **`usaf_memo` renders a list nested six levels deep or
+  more**, numbering past its last format and restarting each such level under
+  a new parent, where it failed `typst::compile` with
+  `dictionary does not contain key "6"`. (#2191, #2234)
+
+### Distribution
+
+- feat(cli): **prebuilt `quillmark` binaries ship on every GitHub Release**,
+  for Linux (musl, x86_64 and aarch64), macOS (arm64 and x86_64) and Windows
+  (x86_64, static C runtime), each archive carrying the NOTICE and
+  `THIRD_PARTY_LICENSES.md`, and `cargo binstall quillmark-cli` installs
+  them. (#2177, #2195)
+- chore(legal): **every package carries the full Apache-2.0 text and a
+  NOTICE**, and the npm package and the wheels ship `THIRD_PARTY_LICENSES.md`,
+  the licenses of the crates they link and the embedded Roboto's OFL.
+  `@quillmark/wasm` declares keywords, author, homepage and bugs, and the
+  library crates their crates.io keywords and categories. (#2173, #2177)
+- build(deps): **the PDF form backend rasters through hayro 0.8.** (#2100)
+- docs: **a quickstart renders one starter quill from the CLI, Python,
+  JavaScript and Rust**, and the README and docs home lead with a rendered
+  memo and link the quillmark-js playground; quillmark.dev is the docs site
+  and the package homepage. (#2172, #2174)
+- docs: **snippets that threw run as written**, and backend statements match
+  the code. (#2171)
+- docs(community): **`CONTRIBUTING.md` says where questions, bugs and
+  proposals go**, with bug and feature issue forms and a PR template. (#2169)
+
+### Release
+
+- ci(release): **`@quillmark/wasm` is built and tested in jobs that cannot
+  publish**, from a committed `package-lock.json`; the tests run against the
+  built tarball, and the publishing job publishes that tarball with a pinned
+  npm. The Pages permissions move to the docs deploy job, and Dependabot
+  proposes a version once it is a week old. Publishing refuses a package
+  without its SBOM. (#2165, #2170)
+
+## v0.125.0 - 2026-10-12
+
+Upgrade path: [0.124 → 0.125](docs/migrations/0.124-to-0.125.md). Every Typst
+plate migrates: the helper is version 0.2.0, imported `as qm`. Stored documents
+load as before, under the same storage tag.
+
+### Regions and the helper
+
+- feat(typst)!: **the helper is a module imported as `qm`, at version 0.2.0**,
+  and every other import fails the render as `typst::helper_import`.
+  `field-region` is `qm.region`, `ink(x).f` and `display(..)` are
+  `qm.ink(x, "f", ..)`, and every other member reads under `qm.`. No
+  dictionary carries `$ink`; `data`, every card and every typed dictionary
+  carry `$path`. (#2157)
+- feat(typst)!: **regions come from three declared producers**: ink the helper
+  generates, a `qm.region` claim and a form widget. A value the plate prints
+  itself, `#data.subject` included, surfaces no region. (#2157)
+- feat(typst)!: **a claim takes the text between its markers that has no
+  source position of its own**, list bullets included, and no header, footer,
+  background, page number, footnote or float it crosses; a claim opened
+  inside one of those takes its ink. `typst::unclosed_field_region` is
+  `typst::unclosed_region`. (#2157, #2163)
+- feat(core,cli,wasm): **`LiveSession::coverage` and `quillmark check
+  --regions` list the filled fields no click reaches**, a printed `0` or
+  `false` included. (#2157, #2160)
+
+### Sections
+
+- feat(core)!: **a card frames its fields in titled panels under
+  `sections:`**, and `ui.group` / `ui.groups` warn `quill::deprecated_groups`.
+  `schema()` still emits `ui.groups`, lists a grouped card's fields in display
+  order, and gives an object alone in its group `ui.layout: flat`. An empty
+  section fails the load. (#2156)
+
+### Validation and typed writes
+
+- feat(core)!: **`Quill::validate` warns `backend::declined_construct`, the
+  render's own diagnostic**, where it warned `validation::declined_construct`,
+  which is gone. (#2147)
+- feat(core,wasm,python)!: **a typed `set` / `setAll` returns the
+  `parse::dropped_construct` of each `richtext` string it writes**, at the
+  string's path, and `addCard` its fields' ahead of its body's. (#2147, #2160)
+- fix(acroform): **a `form@0.1.0` file gets the version message**, not a
+  field-shape error. (#2160)
+
+### Markdown
+
+- fix(core)!: **a backtick line whose info string holds a backtick opens no
+  code fence**, as CommonMark reads it, so a card block under it opens its
+  card. (#2147)
+- fix(content)!: **a newline beside a hard break imports as no space, a line
+  whose content all drops imports as no line, and U+0000 reads as U+FFFD.**
+  Content stored by 0.124 keeps its space. (#2164)
+- fix(content)!: **a raw tag inside a footnote definition warns nothing beside
+  the definition's `footnote`.** (#2160)
+- fix(content): **a replaced line pairs by its word diff whatever its word
+  count.** (#2147)
+
+### Tables
+
+- fix(typst)!: **a placed table aligns its cells as an unplaced one does**
+  under the plate's `table.align` and a vertical `table.cell` rule. (#2147)
+- fix(content)!: **a table's `align`, `widths` or `headless` outside its set
+  rests as written and reads as absent**, where normalization removed it.
+  (#2147)
+- fix(typst): **`keep` holds its run whatever the element registry holds.**
+  (#2147)
+
+### Revise
+
+- refactor(core,wasm)!: **`droppedAnchors` holds `DocumentAnchor`s, `{ id,
+  path, line }`**, matched at the exact address, and an anchor dropped from
+  content stored out of canonical order is named. `DocumentAnchor` exports
+  from the WASM package root. (#2147)
+
+### Rust
+
+- refactor(content)!: **`ImportWarning` is a struct, and
+  `Container::Element` holds a validated `carrier::Element`.** The typed
+  writer's `set` / `set_all` return `Vec<Diagnostic>`, and
+  `SessionHandle::update` takes the session's `QuillConfig`. (#2147)
+
+### CLI and packaging
+
+- feat(typst,cli): **`quillmark --version` names the linked Typst**, 0.15.
+  (#2162)
+- **`@quillmark/wasm` ships a CycloneDX SBOM of its crate graph**, and every
+  CI action is pinned by commit SHA. (#2132)
+
 ## v0.124.0 - 2026-10-10
 
 Upgrade path: [0.123 → 0.124](docs/migrations/0.123-to-0.124.md).

package/LICENSE

@@ -1,13 +1,201 @@
-Copyright (c) 2025 Nibs
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-    http://www.apache.org/licenses/LICENSE-2.0
+   1. Definitions.
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,8 @@
+Quillmark
+Copyright 2025-2026 Nibs
+
+The Typst backend embeds the Roboto typeface, Copyright 2011 The Roboto
+Project Authors, under the SIL Open Font License 1.1. Its license text ships
+as crates/backends/typst/src/fonts/OFL.txt in source, and in
+THIRD_PARTY_LICENSES.md beside this file in the npm package and the Python
+wheels, with the licenses and notices of the third-party crates they link.