@richscripts/richtexteditor 2.13.0 → 2.14.1

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "2.13.0",
+  "version": "2.14.1",
   "description": "A full-featured JavaScript rich text editor (WYSIWYG) with toolbar, plugins, i18n support, a built-in AI Toolkit (Ask AI, AI Chat, AI Review drawer, BYOK resolver), structured content APIs (JSON/Markdown), and an optional collaboration / review stack: slash commands, @mentions, human-author Track Changes, threaded comments, revision history, and Yjs-backed presence. Ships first-class React, Vue, Angular and Svelte bindings, a headless \"bring your own UI\" core, and server-safe conversion helpers.",
   "main": "./richtexteditor/rte.js",
   "bin": {

package/richtexteditor/all_plugins.js

@@ -25516,20 +25516,68 @@ function RTE_Plugin_DocumentOutline() {
         var minLevel = Math.max(1, Math.min(6, config.documentOutlineMinLevel || 1));
         var maxLevel = Math.max(minLevel, Math.min(6, config.documentOutlineMaxLevel || 6));
         var headings = editable.querySelectorAll("h1,h2,h3,h4,h5,h6");
-        var counts = {};
         var items = [];
         var i;
+        // 2026-09-24 Ids must be unique in the SAVED document. This used to keep any id a
+        // heading already had, so copying or cutting a heading and pasting it saved the same
+        // id twice (measured on published 2.6.7: <h1 id="hello-world"> x2), and outline
+        // clicks / anchor links went to the first one. Now the FIRST heading in document
+        // order keeps an id and a later duplicate is renamed, so the original's links stay
+        // valid and the pasted copy becomes "slug-2". Ids on non-heading elements are
+        // reserved too, so a heading never takes one. Every heading is checked, including
+        // levels the outline does not display, since they share one id namespace.
+        //
+        // 2026-09-25 ...but only when the core does not own heading ids. With
+        // autoHeadingAnchors on (the default) the core pass gives every heading a unique id
+        // after each change, with the same first-keeps rule, and marks the ids it generated so
+        // they can follow the text. This block ran 80 ms after each change instead: a heading
+        // a person was typing got the slug of its FIRST letter ("Typed heading" -> id="t"),
+        // unmarked, so the core took it for the author's own id and kept it for good. The
+        // outline needs no id to work (it navigates by element), so it now leaves ids to the
+        // core and keeps this pass for integrations that switched core anchors off.
+        if (config.autoHeadingAnchors === false) {
+            var used = {};
+            var withId = editable.querySelectorAll("[id]");
+            for (i = 0; i < withId.length; i++) {
+                if (!/^H[1-6]$/.test(withId[i].nodeName)) used[withId[i].id] = true;
+            }
+            // Headings with text claim ids first. An EMPTY heading is usually the shell a cut
+            // leaves behind, still carrying the moved heading's id; letting it claim first would
+            // hand the moved heading "-2" and break every link to it. So empty headings go last
+            // and simply drop an id that a real heading already holds.
+            var textOf = function (el) {
+                return (el.innerText || el.textContent || "").replace(/\s+/g, " ").replace(/^\s+|\s+$/g, "");
+            };
+            var empties = [];
+            for (i = 0; i < headings.length; i++) {
+                var h = headings[i];
+                var t = textOf(h);
+                if (!t) { empties.push(h); continue; }
+                var base = h.id;
+                if (!base) base = slugifyHeading(t);
+                else if (!used[base]) { used[base] = true; continue; }
+                var unique = base;
+                var n = 2;
+                while (used[unique]) { unique = base + "-" + n; n++; }
+                used[unique] = true;
+                if (h.id !== unique) h.id = unique;
+            }
+            for (i = 0; i < empties.length; i++) {
+                if (!empties[i].id) continue;
+                if (used[empties[i].id]) empties[i].removeAttribute("id");
+                else used[empties[i].id] = true;
+            }
+        }
         for (i = 0; i < headings.length; i++) {
             var heading = headings[i];
             var level = parseInt(heading.nodeName.substring(1), 10);
             if (level < minLevel || level > maxLevel) continue;
             var text = (heading.innerText || heading.textContent || "").replace(/\s+/g, " ").replace(/^\s+|\s+$/g, "");
-            var baseId = heading.id || slugifyHeading(text);
-            counts[baseId] = (counts[baseId] || 0) + 1;
-            var resolvedId = heading.id || (counts[baseId] === 1 ? baseId : (baseId + "-" + counts[baseId]));
-            if (!heading.id) heading.id = resolvedId;
             items.push({
-                id: heading.id,
+                // an empty heading may now have no id; key it internally (never written to
+                // the element) so "" can't match the "no active heading" state and light up
+                // every empty entry at once.
+                id: heading.id || ("__rte-outline-" + items.length),
                 level: level,
                 text: text || ("Heading " + (items.length + 1)),
                 element: heading
@@ -28440,22 +28488,67 @@ function RTE_Plugin_FormattingMarks() {
         // may be deliberate.
         if (parent.nodeName === "CODE" || parent.nodeName === "PRE") return;
 
+        // Replacing the text node moves a caret inside it to the node's old place in its
+        // parent - usually the paragraph start. This runs on every keyup, and the first
+        // space typed at a line end is always a non-breaking one, so with marks on every
+        // later character landed at the start, reversed: " edited" became "detide".
+        // Remember where the selection was inside this node and put it back.
+        var sel = doc.getSelection ? doc.getSelection() : null;
+        var range = sel && sel.rangeCount ? sel.getRangeAt(0) : null;
+        var keepStart = range && range.startContainer === node ? range.startOffset : -1;
+        var keepEnd = range && range.endContainer === node ? range.endOffset : -1;
+
         var frag = doc.createDocumentFragment();
+        var pieces = [];   // in order: { node, marker } - every marker stands for ONE character
         var buf = "";
         for (var i = 0; i < text.length; i++) {
             var def = chars[text[i]];
+            // A space typed at a line end is inserted as a non-breaking placeholder that the
+            // browser turns back into a space when the next character arrives. Wrapped in a
+            // non-editable marker it never could, and saved as a hard &nbsp;. Leave the one
+            // right before the caret alone; it is marked once the caret moves on.
+            if (def && text[i] === " " && i === keepStart - 1 && keepStart === keepEnd) def = null;
             if (!def) { buf += text[i]; continue; }
-            if (buf) { frag.appendChild(doc.createTextNode(buf)); buf = ""; }
+            if (buf) { pieces.push({ node: frag.appendChild(doc.createTextNode(buf)), marker: false }); buf = ""; }
             var span = doc.createElement("span");
             span.setAttribute("data-rte-fm", "1");
             span.setAttribute("data-rte-fm-char", text[i]);
             span.className = def.cls;
             span.setAttribute("contenteditable", "false");
             span.textContent = def.label;
-            frag.appendChild(span);
+            pieces.push({ node: frag.appendChild(span), marker: true });
         }
-        if (buf) frag.appendChild(doc.createTextNode(buf));
+        if (buf) pieces.push({ node: frag.appendChild(doc.createTextNode(buf)), marker: false });
         parent.replaceChild(frag, node);
+
+        if (keepStart < 0 && keepEnd < 0) return;
+        // Offset k in the old text -> a point in the pieces. Inside text where possible;
+        // never inside a marker (it is not editable): just before or after it.
+        function pointAt(k) {
+            var pos = 0;
+            for (var p = 0; p < pieces.length; p++) {
+                var piece = pieces[p];
+                if (piece.marker) {
+                    if (k <= pos) return { node: parent, offset: Array.prototype.indexOf.call(parent.childNodes, piece.node) };
+                    pos += 1;
+                } else {
+                    var len = piece.node.nodeValue.length;
+                    if (k <= pos + len) return { node: piece.node, offset: k - pos };
+                    pos += len;
+                }
+            }
+            var last = pieces[pieces.length - 1].node;
+            return { node: parent, offset: Array.prototype.indexOf.call(parent.childNodes, last) + 1 };
+        }
+        try {
+            var r = doc.createRange();
+            var a = pointAt(keepStart >= 0 ? keepStart : 0);
+            var b = keepEnd >= 0 ? pointAt(keepEnd) : a;
+            if (keepStart < 0) { r.setStart(range.startContainer, range.startOffset); } else r.setStart(a.node, a.offset);
+            if (keepEnd < 0) { r.setEnd(range.endContainer, range.endOffset); } else r.setEnd(b.node, b.offset);
+            sel.removeAllRanges();
+            sel.addRange(r);
+        } catch (e) { /* a selection we cannot restore is no reason to lose the marks */ }
     }
 
     // ---- serialization safety -------------------------------------------
@@ -40240,6 +40333,7 @@ function RTE_Plugin_Sanitizer() {
             }
 
             var attrs = [];
+            var strippedSrc = false;
             for (var a = 0; a < el.attributes.length; a++) attrs.push(el.attributes[a]);
             for (var k = 0; k < attrs.length; k++) {
                 var name = attrs[k].name.toLowerCase();
@@ -40257,7 +40351,11 @@ function RTE_Plugin_Sanitizer() {
                 if (name.indexOf("data-") === 0 || name.indexOf("aria-") === 0) continue;
 
                 if (URL_ATTRS[name]) {
-                    if (!isSafeUrl(value, tag, name)) { note(report.removedAttributes, tag + "[" + name + "]"); el.removeAttribute(attrs[k].name); }
+                    if (!isSafeUrl(value, tag, name)) {
+                        note(report.removedAttributes, tag + "[" + name + "]");
+                        el.removeAttribute(attrs[k].name);
+                        if (name === "src") strippedSrc = true;
+                    }
                     continue;
                 }
                 if (!ALLOWED_ATTRS[name] && !attrExtra(name)) {
@@ -40266,6 +40364,18 @@ function RTE_Plugin_Sanitizer() {
                 }
             }
 
+            // An <img> whose only source was just stripped is an empty box that
+            // saves as <img> with no src -- dragging a page image into the editor
+            // from a page opened on disk did exactly that (its file: src is not a
+            // safe scheme). Drop the element when nothing is left to show. Keep it
+            // when srcset or a lazy-load data-*src still carries an image, and never
+            // touch an <img> that arrived without a src (an app placeholder).
+            if (tag === "img" && strippedSrc && !el.hasAttribute("srcset") && !hasDataSource(el)) {
+                note(report.removedTags, "img");
+                el.parentNode.removeChild(el);
+                continue;
+            }
+
             // A link that opens a new tab without rel="noopener" hands the
             // opener window to the destination.
             if (tag === "a" && (el.getAttribute("target") || "").toLowerCase() === "_blank") {
@@ -40282,6 +40392,12 @@ function RTE_Plugin_Sanitizer() {
         parent.removeChild(el);
     }
     function note(list, what) { if (list.indexOf(what) < 0) list.push(what); }
+    function hasDataSource(el) {
+        for (var i = 0; i < el.attributes.length; i++) {
+            if (/^data-(.*-)?(src|srcset|original)$/i.test(el.attributes[i].name)) return true;
+        }
+        return false;
+    }
 
     function sanitizeHtml(html) {
         var out = html;