@quillmark/wasm 0.125.0 → 0.126.1

package/core/wasm.d.ts

@@ -446,11 +446,10 @@ export interface Resolved {
 /** UI layout hints for a single field. Display order is not a hint: key order
  * in the schema's `fields`/`properties` objects is the ordering contract. */
 export interface QuillFieldUi {
-    /** The id of the card section holding the field, a key of the card's
+    /** The id of the card group holding the field, a key of the card's
      *  `ui.groups`. */
     group?: string;
     compact?: boolean;
-    multiline?: boolean;
     /** Label for an `enum`'s blank option. Absent, the consumer supplies a
      *  conventional label of its own. */
     blank_title?: string;
@@ -464,8 +463,8 @@ export interface QuillFieldUi {
     layout?: "table" | "flat";
 }
 
-/** One section in a card's `ui.groups`: a display-label override for the
- * section id (the map key). An empty object carries no override, and the
+/** One group in a card's `ui.groups`: a display-label override for the
+ * group id (the map key). An empty object carries no override, and the
  * consumer derives the label from the id (`memo_for` → "Memo For"). */
 export interface QuillGroupUi {
     title?: string;
@@ -473,9 +472,9 @@ export interface QuillGroupUi {
 
 /** UI layout hints for a card (main or named card kind). */
 export interface QuillCardUi {
-    /** The card's sections keyed by id, each holding at least one field, which
+    /** The card's groups keyed by id, each holding at least one field, which
      * names it in its `ui.group`. Key order is the display-order contract, as
-     * with `fields`. Absent when the card declares no sections. */
+     * with `fields`. Absent when the card declares no groups. */
     groups?: Record<string, QuillGroupUi>;
 }
 
@@ -485,7 +484,7 @@ export interface QuillCardBody {
     enabled?: boolean;
 }
 
-export type QuillFieldType = "string" | "number" | "integer" | "boolean" | "array" | "object" | "date" | "datetime" | "richtext" | "plaintext" | "enum" | "matrix";
+export type QuillFieldType = "number" | "integer" | "boolean" | "array" | "object" | "date" | "datetime" | "text" | "richtext" | "enum" | "matrix";
 
 /** Schema entry for a single field declared in a quill's `Quill.yaml`.
  *
@@ -530,9 +529,12 @@ export interface QuillFieldSchema {
      *  out on. Valid only on an `array`. Never gates render: a document over
      *  the cap warns `validation::cardinality` and renders. */
     max?: number;
-    /** `true` on a `richtext` or `plaintext` field declared `inline`: the
-     *  single-paragraph, container-free, island-free constraint. */
-    inline?: boolean;
+    /** The line shape of a `text` or `richtext` field, valid nowhere else.
+     *  Absent or `false`, the field is one line (`text`) or one paragraph with
+     *  no container or island (`richtext`); `true` admits line breaks
+     *  (`text`) or block structure (`richtext`). A `richtext` always carries
+     *  it. */
+    multiline?: boolean;
 }
 
 /** Schema entry for the main card or a named card kind. */
@@ -572,6 +574,10 @@ export interface QuillMetadata {
     backend: string;
     author: string;
     description: string;
+    /** An SPDX license expression; absent when the quill declares none. */
+    license?: string;
+    /** An absolute `http(s)` URL; absent when the quill declares none. */
+    homepage?: string;
 }
 
 
@@ -686,7 +692,7 @@ export class Document {
      * `edit::index_out_of_range`.
      *
      * A content field at rest has one stored form per codec: a `richtext` field
-     * holds the canonical content object, a `plaintext` field its literal
+     * holds the canonical content object, a `text` field its literal
      * string. A document from the bound door (`quill.parse` / `quill.conform`)
      * is at rest; one from the transport door may rest as authored until it is
      * conformed, and this read reports what is there. For the `Content` either
@@ -699,8 +705,9 @@ export class Document {
     /**
      * Insert a card: `at` absent appends, a number inserts at that index (in
      * `0..=cards.length`). Accepts any `CardInput`, including a card read back
-     * out of a document. Throws if `card.kind` is not a valid kind name, or if
-     * `at` is out of range.
+     * out of a document. Throws if `card.kind` is not a valid kind name, if
+     * `at` is out of range, or `edit::too_many_cards` if the document holds
+     * 1,000 cards.
      */
     insertCard(card: CardInput, at?: number): void;
     /**
@@ -913,7 +920,7 @@ export class Quill {
      * The quill's example document, `undefined` when the quill has no
      * `example.md` at its root: a filled-in page whose values are made up to show the
      * quill in use, never kept. It comes back pinned to this quill's
-     * `name@version` and conformed as `parse` conforms, its parse and
+     * `name@MAJOR.MINOR` and conformed as `parse` conforms, its parse and
      * `conform::*` warnings on `doc.warnings`. Throws when the file does not
      * parse or its `$quill` is not this quill's bare name.
      */
@@ -928,7 +935,7 @@ export class Quill {
      * Parse `markdown` and conform it against this quill: the primary ingestion
      * path, and the bound twin of the schema-free `Document.fromMarkdown`. The
      * returned document rests at its canonical form (a `richtext` field as a
-     * content object, a `plaintext` field as its literal string), so `getStored`
+     * content object, a `text` field as its literal string), so `getStored`
      * answers by the field's declared codec, not by how the document was built.
      *
      * Parse warnings and the `conform::*` diagnostics both land on
@@ -1039,15 +1046,15 @@ export function formatDocPath(segs: DocPathSeg[]): string;
 export function importMarkdown(markdown: string): Imported;
 
 /**
- * Whether `content` satisfies the `inline` constraint of `richtext` and
- * `plaintext`: one `Para` line, in no container, with no islands. Judged on
+ * Whether `content` satisfies the one-line constraint of `text` and
+ * `richtext`: one `Para` line, in no container, with no islands. Judged on
  * the normalized content, which is what a write stores. Throws if `content` is
  * not canonical content.
  */
 export function isInline(content: Content): boolean;
 
 /**
- * Whether `content` satisfies the `plaintext` constraint: no marks, no
+ * Whether `content` satisfies the `text` constraint: no marks, no
  * islands, every line a `Para` in no container. Judged on the normalized
  * content, which is what a write stores. Throws if `content` is not canonical
  * content.

package/core/wasm.js

@@ -58,7 +58,7 @@ export class Document {
     /**
      * Typed field write at `addr`, resolving the field's schema `type` from
      * `quill`: the stable ABI under the runtime `writer.set`. One verb for every
-     * field type; the schema carries the `inline` constraint, so no type token
+     * field type; the schema carries the one-line constraint, so no type token
      * is passed.
      *
      * A bare string is `Addr` shorthand for `{ field }`. A body address throws,
@@ -67,7 +67,7 @@ export class Document {
      * `edit::unknown_field` rather than falling to the opaque store — use
      * [`storeField`](Document::store_field) for that. Also throws
      * `edit::field_coercion_failed` / `edit::field_decode` /
-     * `edit::field_not_inline` on a typed mismatch,
+     * `edit::field_not_single_line` on a typed mismatch,
      * `edit::invalid_field_name` on a malformed name, and
      * `edit::index_out_of_range` on an out-of-range card.
      *
@@ -273,10 +273,10 @@ export class Document {
      * Revise the content field at `addr` from authored text, typed *and*
      * anchor-preserving: the ABI under `writer.reviseField`. Surviving anchors
      * rebase as in [`revise`](Self::revise), then the diffed result is
-     * schema-conformed, so a `richtext(inline)` field rejects a multi-block
-     * result with `edit::field_not_inline`. Returns the `Revised` receipt, its
+     * schema-conformed, so a one-paragraph `richtext` field rejects a multi-block
+     * result with `edit::field_not_single_line`. Returns the `Revised` receipt, its
      * warnings anchored at the field. The codec is the declared type's:
-     * `richtext` diffs markdown, `plaintext` literal text, which drops nothing.
+     * `richtext` diffs markdown, `text` literal text, which drops nothing.
      *
      * `addr` must name a field; a body address throws, since a body carries no
      * field schema (use [`revise`](Self::revise)). An undeclared name throws
@@ -551,7 +551,7 @@ export class Document {
      * `edit::index_out_of_range`.
      *
      * A content field at rest has one stored form per codec: a `richtext` field
-     * holds the canonical content object, a `plaintext` field its literal
+     * holds the canonical content object, a `text` field its literal
      * string. A document from the bound door (`quill.parse` / `quill.conform`)
      * is at rest; one from the transport door may rest as authored until it is
      * conformed, and this read reports what is there. For the `Content` either
@@ -580,8 +580,9 @@ export class Document {
     /**
      * Insert a card: `at` absent appends, a number inserts at that index (in
      * `0..=cards.length`). Accepts any `CardInput`, including a card read back
-     * out of a document. Throws if `card.kind` is not a valid kind name, or if
-     * `at` is out of range.
+     * out of a document. Throws if `card.kind` is not a valid kind name, if
+     * `at` is out of range, or `edit::too_many_cards` if the document holds
+     * 1,000 cards.
      * @param {CardInput} card
      * @param {number} [at]
      */
@@ -1318,7 +1319,7 @@ export class Quill {
      * The quill's example document, `undefined` when the quill has no
      * `example.md` at its root: a filled-in page whose values are made up to show the
      * quill in use, never kept. It comes back pinned to this quill's
-     * `name@version` and conformed as `parse` conforms, its parse and
+     * `name@MAJOR.MINOR` and conformed as `parse` conforms, its parse and
      * `conform::*` warnings on `doc.warnings`. Throws when the file does not
      * parse or its `$quill` is not this quill's bare name.
      * @returns {Document | undefined}
@@ -1385,7 +1386,7 @@ export class Quill {
      * Parse `markdown` and conform it against this quill: the primary ingestion
      * path, and the bound twin of the schema-free `Document.fromMarkdown`. The
      * returned document rests at its canonical form (a `richtext` field as a
-     * content object, a `plaintext` field as its literal string), so `getStored`
+     * content object, a `text` field as its literal string), so `getStored`
      * answers by the field's declared codec, not by how the document was built.
      *
      * Parse warnings and the `conform::*` diagnostics both land on
@@ -1685,8 +1686,8 @@ export function importMarkdown(markdown) {
 }
 
 /**
- * Whether `content` satisfies the `inline` constraint of `richtext` and
- * `plaintext`: one `Para` line, in no container, with no islands. Judged on
+ * Whether `content` satisfies the one-line constraint of `text` and
+ * `richtext`: one `Para` line, in no container, with no islands. Judged on
  * the normalized content, which is what a write stores. Throws if `content` is
  * not canonical content.
  * @param {Content} content
@@ -1709,7 +1710,7 @@ export function isInline(content) {
 }
 
 /**
- * Whether `content` satisfies the `plaintext` constraint: no marks, no
+ * Whether `content` satisfies the `text` constraint: no marks, no
  * islands, every line a `Para` in no container. Judged on the normalized
  * content, which is what a write stores. Throws if `content` is not canonical
  * content.

package/package.json

@@ -1,11 +1,26 @@
 {
   "name": "@quillmark/wasm",
-  "version": "0.125.0",
+  "version": "0.126.1",
   "description": "WebAssembly bindings for Quillmark, a schema-driven document engine",
   "type": "module",
   "license": "Apache-2.0",
+  "author": "Quillmark Contributors",
+  "homepage": "https://quillmark.dev/",
+  "bugs": {
+    "url": "https://github.com/borb-sh/quillmark/issues"
+  },
+  "keywords": [
+    "markdown",
+    "pdf",
+    "typst",
+    "document",
+    "template",
+    "schema",
+    "forms",
+    "wasm"
+  ],
   "engines": {
-    "node": ">=24"
+    "node": ">=22"
   },
   "repository": {
     "type": "git",
@@ -16,6 +31,8 @@
     "render",
     "runtime",
     "CHANGELOG.md",
+    "NOTICE",
+    "THIRD_PARTY_LICENSES.md",
     "sbom.cdx.json"
   ],
   "main": "./runtime/runtime.js",

package/render/wasm.d.ts

@@ -457,11 +457,10 @@ export interface Resolved {
 /** UI layout hints for a single field. Display order is not a hint: key order
  * in the schema's `fields`/`properties` objects is the ordering contract. */
 export interface QuillFieldUi {
-    /** The id of the card section holding the field, a key of the card's
+    /** The id of the card group holding the field, a key of the card's
      *  `ui.groups`. */
     group?: string;
     compact?: boolean;
-    multiline?: boolean;
     /** Label for an `enum`'s blank option. Absent, the consumer supplies a
      *  conventional label of its own. */
     blank_title?: string;
@@ -475,8 +474,8 @@ export interface QuillFieldUi {
     layout?: "table" | "flat";
 }
 
-/** One section in a card's `ui.groups`: a display-label override for the
- * section id (the map key). An empty object carries no override, and the
+/** One group in a card's `ui.groups`: a display-label override for the
+ * group id (the map key). An empty object carries no override, and the
  * consumer derives the label from the id (`memo_for` → "Memo For"). */
 export interface QuillGroupUi {
     title?: string;
@@ -484,9 +483,9 @@ export interface QuillGroupUi {
 
 /** UI layout hints for a card (main or named card kind). */
 export interface QuillCardUi {
-    /** The card's sections keyed by id, each holding at least one field, which
+    /** The card's groups keyed by id, each holding at least one field, which
      * names it in its `ui.group`. Key order is the display-order contract, as
-     * with `fields`. Absent when the card declares no sections. */
+     * with `fields`. Absent when the card declares no groups. */
     groups?: Record<string, QuillGroupUi>;
 }
 
@@ -496,7 +495,7 @@ export interface QuillCardBody {
     enabled?: boolean;
 }
 
-export type QuillFieldType = "string" | "number" | "integer" | "boolean" | "array" | "object" | "date" | "datetime" | "richtext" | "plaintext" | "enum" | "matrix";
+export type QuillFieldType = "number" | "integer" | "boolean" | "array" | "object" | "date" | "datetime" | "text" | "richtext" | "enum" | "matrix";
 
 /** Schema entry for a single field declared in a quill's `Quill.yaml`.
  *
@@ -541,9 +540,12 @@ export interface QuillFieldSchema {
      *  out on. Valid only on an `array`. Never gates render: a document over
      *  the cap warns `validation::cardinality` and renders. */
     max?: number;
-    /** `true` on a `richtext` or `plaintext` field declared `inline`: the
-     *  single-paragraph, container-free, island-free constraint. */
-    inline?: boolean;
+    /** The line shape of a `text` or `richtext` field, valid nowhere else.
+     *  Absent or `false`, the field is one line (`text`) or one paragraph with
+     *  no container or island (`richtext`); `true` admits line breaks
+     *  (`text`) or block structure (`richtext`). A `richtext` always carries
+     *  it. */
+    multiline?: boolean;
 }
 
 /** Schema entry for the main card or a named card kind. */
@@ -583,6 +585,10 @@ export interface QuillMetadata {
     backend: string;
     author: string;
     description: string;
+    /** An SPDX license expression; absent when the quill declares none. */
+    license?: string;
+    /** An absolute `http(s)` URL; absent when the quill declares none. */
+    homepage?: string;
 }
 
 
@@ -824,7 +830,7 @@ export class Document {
      * `edit::index_out_of_range`.
      *
      * A content field at rest has one stored form per codec: a `richtext` field
-     * holds the canonical content object, a `plaintext` field its literal
+     * holds the canonical content object, a `text` field its literal
      * string. A document from the bound door (`quill.parse` / `quill.conform`)
      * is at rest; one from the transport door may rest as authored until it is
      * conformed, and this read reports what is there. For the `Content` either
@@ -837,8 +843,9 @@ export class Document {
     /**
      * Insert a card: `at` absent appends, a number inserts at that index (in
      * `0..=cards.length`). Accepts any `CardInput`, including a card read back
-     * out of a document. Throws if `card.kind` is not a valid kind name, or if
-     * `at` is out of range.
+     * out of a document. Throws if `card.kind` is not a valid kind name, if
+     * `at` is out of range, or `edit::too_many_cards` if the document holds
+     * 1,000 cards.
      */
     insertCard(card: CardInput, at?: number): void;
     /**
@@ -1172,7 +1179,7 @@ export class Quill {
      * The quill's example document, `undefined` when the quill has no
      * `example.md` at its root: a filled-in page whose values are made up to show the
      * quill in use, never kept. It comes back pinned to this quill's
-     * `name@version` and conformed as `parse` conforms, its parse and
+     * `name@MAJOR.MINOR` and conformed as `parse` conforms, its parse and
      * `conform::*` warnings on `doc.warnings`. Throws when the file does not
      * parse or its `$quill` is not this quill's bare name.
      */
@@ -1187,7 +1194,7 @@ export class Quill {
      * Parse `markdown` and conform it against this quill: the primary ingestion
      * path, and the bound twin of the schema-free `Document.fromMarkdown`. The
      * returned document rests at its canonical form (a `richtext` field as a
-     * content object, a `plaintext` field as its literal string), so `getStored`
+     * content object, a `text` field as its literal string), so `getStored`
      * answers by the field's declared codec, not by how the document was built.
      *
      * Parse warnings and the `conform::*` diagnostics both land on
@@ -1327,15 +1334,15 @@ export function formatDocPath(segs: DocPathSeg[]): string;
 export function importMarkdown(markdown: string): Imported;
 
 /**
- * Whether `content` satisfies the `inline` constraint of `richtext` and
- * `plaintext`: one `Para` line, in no container, with no islands. Judged on
+ * Whether `content` satisfies the one-line constraint of `text` and
+ * `richtext`: one `Para` line, in no container, with no islands. Judged on
  * the normalized content, which is what a write stores. Throws if `content` is
  * not canonical content.
  */
 export function isInline(content: Content): boolean;
 
 /**
- * Whether `content` satisfies the `plaintext` constraint: no marks, no
+ * Whether `content` satisfies the `text` constraint: no marks, no
  * islands, every line a `Para` in no container. Judged on the normalized
  * content, which is what a write stores. Throws if `content` is not canonical
  * content.

package/render/wasm.js

@@ -58,7 +58,7 @@ export class Document {
     /**
      * Typed field write at `addr`, resolving the field's schema `type` from
      * `quill`: the stable ABI under the runtime `writer.set`. One verb for every
-     * field type; the schema carries the `inline` constraint, so no type token
+     * field type; the schema carries the one-line constraint, so no type token
      * is passed.
      *
      * A bare string is `Addr` shorthand for `{ field }`. A body address throws,
@@ -67,7 +67,7 @@ export class Document {
      * `edit::unknown_field` rather than falling to the opaque store — use
      * [`storeField`](Document::store_field) for that. Also throws
      * `edit::field_coercion_failed` / `edit::field_decode` /
-     * `edit::field_not_inline` on a typed mismatch,
+     * `edit::field_not_single_line` on a typed mismatch,
      * `edit::invalid_field_name` on a malformed name, and
      * `edit::index_out_of_range` on an out-of-range card.
      *
@@ -273,10 +273,10 @@ export class Document {
      * Revise the content field at `addr` from authored text, typed *and*
      * anchor-preserving: the ABI under `writer.reviseField`. Surviving anchors
      * rebase as in [`revise`](Self::revise), then the diffed result is
-     * schema-conformed, so a `richtext(inline)` field rejects a multi-block
-     * result with `edit::field_not_inline`. Returns the `Revised` receipt, its
+     * schema-conformed, so a one-paragraph `richtext` field rejects a multi-block
+     * result with `edit::field_not_single_line`. Returns the `Revised` receipt, its
      * warnings anchored at the field. The codec is the declared type's:
-     * `richtext` diffs markdown, `plaintext` literal text, which drops nothing.
+     * `richtext` diffs markdown, `text` literal text, which drops nothing.
      *
      * `addr` must name a field; a body address throws, since a body carries no
      * field schema (use [`revise`](Self::revise)). An undeclared name throws
@@ -551,7 +551,7 @@ export class Document {
      * `edit::index_out_of_range`.
      *
      * A content field at rest has one stored form per codec: a `richtext` field
-     * holds the canonical content object, a `plaintext` field its literal
+     * holds the canonical content object, a `text` field its literal
      * string. A document from the bound door (`quill.parse` / `quill.conform`)
      * is at rest; one from the transport door may rest as authored until it is
      * conformed, and this read reports what is there. For the `Content` either
@@ -580,8 +580,9 @@ export class Document {
     /**
      * Insert a card: `at` absent appends, a number inserts at that index (in
      * `0..=cards.length`). Accepts any `CardInput`, including a card read back
-     * out of a document. Throws if `card.kind` is not a valid kind name, or if
-     * `at` is out of range.
+     * out of a document. Throws if `card.kind` is not a valid kind name, if
+     * `at` is out of range, or `edit::too_many_cards` if the document holds
+     * 1,000 cards.
      * @param {CardInput} card
      * @param {number} [at]
      */
@@ -1662,7 +1663,7 @@ export class Quill {
      * The quill's example document, `undefined` when the quill has no
      * `example.md` at its root: a filled-in page whose values are made up to show the
      * quill in use, never kept. It comes back pinned to this quill's
-     * `name@version` and conformed as `parse` conforms, its parse and
+     * `name@MAJOR.MINOR` and conformed as `parse` conforms, its parse and
      * `conform::*` warnings on `doc.warnings`. Throws when the file does not
      * parse or its `$quill` is not this quill's bare name.
      * @returns {Document | undefined}
@@ -1729,7 +1730,7 @@ export class Quill {
      * Parse `markdown` and conform it against this quill: the primary ingestion
      * path, and the bound twin of the schema-free `Document.fromMarkdown`. The
      * returned document rests at its canonical form (a `richtext` field as a
-     * content object, a `plaintext` field as its literal string), so `getStored`
+     * content object, a `text` field as its literal string), so `getStored`
      * answers by the field's declared codec, not by how the document was built.
      *
      * Parse warnings and the `conform::*` diagnostics both land on
@@ -2134,8 +2135,8 @@ export function importMarkdown(markdown) {
 }
 
 /**
- * Whether `content` satisfies the `inline` constraint of `richtext` and
- * `plaintext`: one `Para` line, in no container, with no islands. Judged on
+ * Whether `content` satisfies the one-line constraint of `text` and
+ * `richtext`: one `Para` line, in no container, with no islands. Judged on
  * the normalized content, which is what a write stores. Throws if `content` is
  * not canonical content.
  * @param {Content} content
@@ -2158,7 +2159,7 @@ export function isInline(content) {
 }
 
 /**
- * Whether `content` satisfies the `plaintext` constraint: no marks, no
+ * Whether `content` satisfies the `text` constraint: no marks, no
  * islands, every line a `Para` in no container. Judged on the normalized
  * content, which is what a write stores. Throws if `content` is not canonical
  * content.

package/runtime/runtime.d.ts

@@ -440,6 +440,13 @@ export declare class Engine {
 	 *
 	 * `today` reads as on {@link open}. An `options` key outside
 	 * {@link RenderOptions} rejects, `today` among them.
+	 *
+	 * A compile that traps (out of memory, a panic) rejects as
+	 * `runtime::backend_trapped`, the `WebAssembly.RuntimeError` on `cause`, as
+	 * does a trap in {@link LiveSession}'s `update` / `render` / `paint`, and a
+	 * `RangeError` or Firefox's `InternalError` for stack or memory exhaustion,
+	 * which engines raise for a stack overflow inside wasm. The build's state is then undefined: discard the
+	 * realm.
 	 */
 	render(quill: Quill, doc: Document, options?: RenderOptions, today?: string): Promise<RenderResult>;
 
@@ -660,12 +667,12 @@ export declare class DocumentWriter {
 	/**
 	 * Revise the content main-card field `name` from authored text: typed *and*
 	 * anchor-preserving. Surviving anchors rebase, then the diffed result is
-	 * schema-conformed (`richtext(inline)` rejects a multi-block result). Throws
+	 * schema-conformed (a one-paragraph `richtext` rejects a multi-block result). Throws
 	 * `UnknownField` for a name the schema does not declare. Returns the
 	 * `Revised` receipt, its warnings at the field.
 	 *
 	 * The codec comes from the declared type: `richtext` diffs markdown, while
-	 * `plaintext` diffs the literal text and never imports markdown, so a
+	 * `text` diffs the literal text and never imports markdown, so a
 	 * byte-identical revise of a value carrying escapes is a byte no-op.
 	 */
 	reviseField(name: string, text: string): Revised;
@@ -734,7 +741,7 @@ export declare class CardWriter {
  * A `Document` bound to its `Quill` for interpreted reads, from
  * {@link Quill.reader}: the read twin of {@link DocumentWriter}. One `get` reads
  * each field by its declared type — a richtext field to its markdown projection,
- * a plaintext field to its literal text, every other type verbatim.
+ * a text field to its literal text, every other type verbatim.
  *
  * The schema authority is the point: unlike the quill-free `Document.getStored`,
  * an undeclared name throws `UnknownField` rather than reading back `undefined`,

package/runtime/runtime.js

@@ -161,6 +161,53 @@ function quillmarkError(code, message, hint) {
 	return err;
 }
 
+/**
+ * `err` as `runtime::backend_trapped` when it is a `WebAssembly.RuntimeError`,
+ * or a `RangeError` (V8, JavaScriptCore) or `InternalError` (SpiderMonkey) for
+ * stack or memory exhaustion, which those engines raise for native stack
+ * overflow inside wasm; else unchanged.
+ * @param {unknown} err
+ * @returns {unknown}
+ */
+function backendTrap(err) {
+	const exhausted =
+		(err instanceof RangeError || (err instanceof Error && err.name === 'InternalError')) &&
+		/Maximum call stack|stack overflow|too much recursion|out of memory/i.test(err.message);
+	if (!(err instanceof WebAssembly.RuntimeError) && !exhausted) return err;
+	return Object.assign(
+		quillmarkError(
+			'runtime::backend_trapped',
+			`The backend build trapped (${err.message}); its state is now undefined.`,
+			'A render ran out of memory or stack, or panicked. Discard the realm before rendering again: terminate the Worker or restart the process. For untrusted input, cap the document size.'
+		),
+		{ cause: err }
+	);
+}
+
+/**
+ * Run `fn` on a transient clone of `docJson` in `mod`'s memory, then free it. A
+ * call that throws can leave the clone borrowed, so its `free()` throws too, and
+ * the error in flight is the one that propagates.
+ * @param {any} mod
+ * @param {string} docJson
+ * @param {(doc: any) => any} fn
+ * @returns {any}
+ */
+function withDocClone(mod, docJson, fn) {
+	const backendDoc = mod.Document.fromStored(docJson);
+	let result;
+	try {
+		result = fn(backendDoc);
+	} catch (err) {
+		try {
+			backendDoc.free();
+		} catch {}
+		throw err;
+	}
+	backendDoc.free();
+	return result;
+}
+
 /**
  * Throw on options that are not a plain object, or on a key of them, or of a
  * null-prototype object they inherit from, outside `known`. The JS twin of the
@@ -568,16 +615,15 @@ export class Engine {
 			? null
 			: quill.toTree();
 		const { mod, engine } = await this.#resolveBackend(backendId);
-		// The doc clone and `fn` share one try so the clone is freed even if a
-		// later step throws; the cached quill clone is intentionally not freed.
-		// `fn` MUST be synchronous: an async one would run against a freed clone.
-		const backendQuill = this.#cachedQuillClone(mod, backendId, quill, quillTree);
-		let backendDoc = null;
+		// The cached quill clone is intentionally not freed. `fn` MUST be
+		// synchronous: an async one would run against a freed doc clone.
 		try {
-			backendDoc = mod.Document.fromStored(docJson);
-			return fn({ mod, engine, quill: backendQuill, doc: backendDoc });
-		} finally {
-			backendDoc?.free();
+			const backendQuill = this.#cachedQuillClone(mod, backendId, quill, quillTree);
+			return withDocClone(mod, docJson, (backendDoc) =>
+				fn({ mod, engine, quill: backendQuill, doc: backendDoc })
+			);
+		} catch (err) {
+			throw backendTrap(err);
 		}
 	}
 
@@ -654,12 +700,11 @@ export class LiveSession {
 	 */
 	update(doc) {
 		requireLocalDoc(doc, 'session.update(doc)');
-		let backendDoc = null;
+		const docJson = doc.toStored();
 		try {
-			backendDoc = this.#mod.Document.fromStored(doc.toStored());
-			return this.#inner.update(backendDoc);
-		} finally {
-			backendDoc?.free();
+			return withDocClone(this.#mod, docJson, (backendDoc) => this.#inner.update(backendDoc));
+		} catch (err) {
+			throw backendTrap(err);
 		}
 	}
 
@@ -675,7 +720,11 @@ export class LiveSession {
 
 	/** @param {object} [options] */
 	render(options) {
-		return this.#inner.render(options ?? undefined);
+		try {
+			return this.#inner.render(options ?? undefined);
+		} catch (err) {
+			throw backendTrap(err);
+		}
 	}
 
 	/**
@@ -742,7 +791,11 @@ export class LiveSession {
 	 * @param {number} scale
 	 */
 	paint(ctx, page, scale) {
-		this.#inner.paint(ctx, page, scale);
+		try {
+			this.#inner.paint(ctx, page, scale);
+		} catch (err) {
+			throw backendTrap(err);
+		}
 	}
 
 	free() {