autumnnote 1.10.0 → 1.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autumnnote",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "WYSIWYG rich-text editor built with vanilla JavaScript — zero dependencies, no jQuery. Dark mode, @mention, markdown shortcuts, bubble toolbar. React and Vue 3 wrappers included.",
   "main": "dist/autumnnote.umd.js",
   "module": "dist/autumnnote.es.js",

package/src/js/core/markdown.js

@@ -31,6 +31,18 @@ export function htmlToMarkdown(html) {
  * @param {number} [depth=0] - Current nesting depth used to indent nested list items.
  * @returns {string} The Markdown representation of the node subtree.
  */
+/**
+ * Direct child elements matching a tag name. Used instead of the CSS
+ * `:scope > tag` combinator, which this project's jsdom version resolves
+ * incorrectly (matches descendants at any depth, not just direct children).
+ * @param {Element} el
+ * @param {string} tagName
+ * @returns {Element[]}
+ */
+function _directChildren(el, tagName) {
+  return Array.from(el.children).filter((c) => c.tagName === tagName.toUpperCase());
+}
+
 function _domToMd(node, depth = 0) {
   if (node.nodeType === 3) {
     return node.textContent.replace(/\s+/g, ' ');
@@ -60,6 +72,18 @@ function _domToMd(node, depth = 0) {
     case 'strike':   return `~~${inner()}~~`;
     case 'sup':      return `^${inner()}^`;
     case 'sub':      return `~${inner()}~`;
+    case 'u':        return `<u>${inner()}</u>`;
+    case 'span': {
+      // Markdown has no native underline/color/size syntax; pass through as
+      // raw inline HTML for the specific styles the editor's own toolbar
+      // creates (foreColor/backColor/fontSize) — other noise spans (e.g. from
+      // pasted content) are unwrapped to plain text as before.
+      const style = el.getAttribute('style') || '';
+      if (/\b(color|background-color|font-size)\s*:/.test(style)) {
+        return `<span style="${_escAttr(style)}">${inner()}</span>`;
+      }
+      return inner();
+    }
     case 'code': {
       // Inside <pre> we emit raw text; outside we wrap in backticks
       if (el.closest('pre')) return inner();
@@ -73,8 +97,10 @@ function _domToMd(node, depth = 0) {
       return `\n\n\`\`\`${lang}\n${content}\n\`\`\`\n\n`;
     }
     case 'blockquote': {
-      const lines = inner().trim().split('\n');
-      return `\n\n${lines.map((l) => `> ${l}`).join('\n')}\n\n`;
+      const rawLines = inner().trim().split('\n');
+      // Collapse consecutive blank lines (from adjacent <p> blocks) into one.
+      const lines = rawLines.filter((l, idx) => l.trim() !== '' || (rawLines[idx - 1] ?? '').trim() !== '');
+      return `\n\n${lines.map((l) => (l.trim() === '' ? '>' : `> ${l}`)).join('\n')}\n\n`;
     }
     case 'a': {
       const href = el.getAttribute('href') || '';
@@ -86,14 +112,16 @@ function _domToMd(node, depth = 0) {
       return `![${alt}](${src})`;
     }
     case 'ul': {
-      const items = Array.from(el.querySelectorAll(':scope > li'));
+      const items = _directChildren(el, 'li');
       if (!items.length) return inner();
       const indent = '  '.repeat(depth);
       const isChecklist = el.classList.contains('an-checklist');
       const lines = items.map((li) => {
+        const cb = /** @type {HTMLInputElement | undefined} */ (
+          _directChildren(li, 'input').find((c) => c.getAttribute('type') === 'checkbox')
+        );
         let prefix = '- ';
-        if (isChecklist) {
-          const cb = /** @type {HTMLInputElement | null} */ (li.querySelector('input[type="checkbox"]'));
+        if (isChecklist || cb) {
           const checked = cb ? cb.checked : false;
           prefix = checked ? '- [x] ' : '- [ ] ';
         }
@@ -102,7 +130,7 @@ function _domToMd(node, depth = 0) {
       return depth === 0 ? `\n\n${lines}\n\n` : `\n${lines}`;
     }
     case 'ol': {
-      const items = Array.from(el.querySelectorAll(':scope > li'));
+      const items = _directChildren(el, 'li');
       if (!items.length) return inner();
       const indent = '  '.repeat(depth);
       const lines = items.map((li, i) => `${indent}${i + 1}. ${_domToMd(li, depth + 1).trim()}`).join('\n');
@@ -111,17 +139,24 @@ function _domToMd(node, depth = 0) {
     case 'li':  return inner();
     case 'hr':  return '\n\n---\n\n';
     case 'table': {
-      const rows = Array.from(el.querySelectorAll('tr'));
-      if (!rows.length) return inner();
-      const cellTexts = rows.map((tr) =>
+      const allRows = Array.from(el.querySelectorAll('tr'));
+      if (!allRows.length) return inner();
+      const theadEl = _directChildren(el, 'thead')[0];
+      const firstRowIsHeader = !!theadEl || (
+        allRows[0].children.length > 0 &&
+        Array.from(allRows[0].children).every((c) => c.tagName === 'TH')
+      );
+      const cellTexts = allRows.map((tr) =>
         Array.from(tr.querySelectorAll('th, td')).map((c) => c.textContent.trim().replaceAll('|', String.raw`\|`)),
       );
       const cols = Math.max(...cellTexts.map((r) => r.length));
       const padRow = (row) => { const r = [...row]; while (r.length < cols) r.push(''); return r; };
+      const bodyStart = firstRowIsHeader ? 1 : 0;
+      const headerCells = firstRowIsHeader ? padRow(cellTexts[0]) : new Array(cols).fill('');
       let md = '\n\n';
-      md += `| ${padRow(cellTexts[0]).join(' | ')} |\n`;
+      md += `| ${headerCells.join(' | ')} |\n`;
       md += `| ${new Array(cols).fill('---').join(' | ')} |\n`;
-      for (let r = 1; r < cellTexts.length; r++) {
+      for (let r = bodyStart; r < cellTexts.length; r++) {
         md += `| ${padRow(cellTexts[r]).join(' | ')} |\n`;
       }
       return md + '\n';
@@ -139,13 +174,22 @@ function _domToMd(node, depth = 0) {
  * @returns {boolean} `true` if any Markdown-like pattern is present, `false` otherwise.
  */
 export function isMarkdown(text) {
-  return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> [^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text)
+  return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> ?[^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text)
     || /^.+\n=+\s*$/m.test(text)
     || /^.+\n-{2,}\s*$/m.test(text)
     || /^---\s*\n(?:[\s\S]*?\n)?(?:---|\.\.\.)\s*(?:\n|$)/.test(text)
     || /^\|.+\|[ \t]*\n\|[ \t:|-]+\|/m.test(text);
 }
 
+// Blockquote line: optional up-to-3 leading spaces, '>', optional single space, rest of line.
+const BQ_RE = /^ {0,3}>( ?)(.*)$/;
+// Horizontal rule: 3+ of the same character (-, * or _), optionally space-separated.
+const HR_RE = /^ {0,3}([-*_])( *\1){2,}\s*$/;
+// Hard-break marker — placed between paragraph lines that end in a
+// CommonMark hard-break (trailing 2+ spaces or a trailing backslash),
+// restored to <br> after _inline() runs. Distinct from _inline()'s own MARK.
+const HARD_BREAK = String.fromCharCode(1);
+
 /**
  * Converts a Markdown string to an HTML string.
  * @param {string} text
@@ -158,6 +202,17 @@ export function markdownToHTML(text) {
   lines = refs.clean;
   _linkDefs = refs.linkDefs;
   _footnoteIds = refs.footnoteIds;
+  return _parseBlocks(lines);
+}
+
+/**
+ * Parses a line array into block-level HTML. Called recursively for content
+ * nested inside a blockquote so nested quotes and block content (lists,
+ * headings, etc.) inside `>` are parsed the same as top-level content.
+ * @param {string[]} lines
+ * @returns {string}
+ */
+function _parseBlocks(lines) {
   const out = [];
   let i = 0;
 
@@ -181,7 +236,7 @@ export function markdownToHTML(text) {
     }
 
     // ---- Setext headings (Title\n=== or Title\n---) -------------------------
-    if (line.trim() && !/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
+    if (line.trim() && !HR_RE.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
       if (/^=+\s*$/.test(lines[i + 1])) {
         out.push(`<h1>${_inline(line.trim())}</h1>`);
         i += 2;
@@ -194,8 +249,8 @@ export function markdownToHTML(text) {
       }
     }
 
-    // ---- Horizontal rule --- / *** / _________________________________________
-    if (/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line)) {
+    // ---- Horizontal rule --- / *** / ___ / - - - / * * * ----------------------
+    if (HR_RE.test(line)) {
       out.push('<hr>');
       i++;
       continue;
@@ -205,19 +260,22 @@ export function markdownToHTML(text) {
     const hMatch = /^(#{1,6})\s+(.+)$/.exec(line);
     if (hMatch) {
       const level = hMatch[1].length;
-      out.push(`<h${level}>${_inline(hMatch[2])}</h${level}>`);
+      // Strip an optional closing sequence of #'s (e.g. "## Heading ##"),
+      // only when preceded by whitespace — "Heading#" (no space) is untouched.
+      const content = hMatch[2].replace(/(?:^|\s)#+\s*$/, '');
+      out.push(`<h${level}>${_inline(content)}</h${level}>`);
       i++;
       continue;
     }
 
     // ---- Blockquote  > text --------------------------------------------------
-    if (line.startsWith('> ')) {
+    if (BQ_RE.test(line)) {
       const bqLines = [];
-      while (i < lines.length && lines[i].startsWith('> ')) {
-        bqLines.push(lines[i].slice(2));
+      while (i < lines.length && BQ_RE.test(lines[i])) {
+        bqLines.push(BQ_RE.exec(lines[i])[2]);
         i++;
       }
-      out.push(`<blockquote>${bqLines.map(_inline).join('<br>')}</blockquote>`);
+      out.push(`<blockquote>${_parseBlocks(bqLines)}</blockquote>`);
       continue;
     }
 
@@ -273,7 +331,9 @@ export function markdownToHTML(text) {
     while (
       i < lines.length &&
       lines[i].trim() !== '' &&
-      !/^(#{1,6} |> |[-*+] |\d+\. |```|---\s*$|\*{3}\s*$|_{3}\s*$)/.test(lines[i]) &&
+      !/^(#{1,6} |[-*+] |\d+\. |```)/.test(lines[i]) &&
+      !BQ_RE.test(lines[i]) &&
+      !HR_RE.test(lines[i]) &&
       !/^\|.+\|/.test(lines[i]) &&
       !(i + 1 < lines.length && /^=+\s*$/.test(lines[i + 1])) &&
       !(i + 1 < lines.length && /^-{2,}\s*$/.test(lines[i + 1]))
@@ -282,7 +342,7 @@ export function markdownToHTML(text) {
       i++;
     }
     if (paraLines.length) {
-      out.push(`<p>${_inline(paraLines.join(' '))}</p>`);
+      out.push(`<p>${_inline(_joinParagraphLines(paraLines)).replaceAll(HARD_BREAK, '<br>')}</p>`);
     }
   }
 
@@ -356,17 +416,42 @@ function _extractReferenceDefinitions(lines) {
 }
 
 /**
- * Splits a GFM table row string into trimmed cell strings.
- * '| a | b | c |' → ['a', 'b', 'c']
+ * Joins a paragraph's source lines into one string, converting CommonMark
+ * hard-break markers (a trailing backslash, or 2+ trailing spaces) on all
+ * but the last line into a HARD_BREAK placeholder instead of a plain space.
+ * @param {string[]} paraLines
+ * @returns {string}
+ */
+function _joinParagraphLines(paraLines) {
+  let joined = '';
+  for (let idx = 0; idx < paraLines.length; idx++) {
+    const isLast = idx === paraLines.length - 1;
+    const ln = paraLines[idx];
+    if (!isLast && /\\$/.test(ln)) { joined += ln.replace(/\\$/, '') + HARD_BREAK; continue; }
+    if (!isLast && / {2,}$/.test(ln)) { joined += ln.replace(/ {2,}$/, '') + HARD_BREAK; continue; }
+    joined += ln + (isLast ? '' : ' ');
+  }
+  return joined;
+}
+
+/**
+ * Splits a GFM table row string into trimmed cell strings, treating an
+ * escaped pipe (`\|`) as a literal character rather than a cell separator.
+ * '| a | b | c |' → ['a', 'b', 'c']; '| a\|b | c |' → ['a|b', 'c']
  * @param {string} row
  * @returns {string[]}
  */
 function _parseTableRow(row) {
-  return row
-    .replace(/^\|/, '')
-    .replace(/\|$/, '')
-    .split('|')
-    .map((c) => c.trim());
+  const trimmed = row.replace(/^\|/, '').replace(/\|$/, '');
+  const cells = [];
+  let cur = '';
+  for (let i = 0; i < trimmed.length; i++) {
+    if (trimmed[i] === '\\' && trimmed[i + 1] === '|') { cur += '|'; i++; continue; }
+    if (trimmed[i] === '|') { cells.push(cur); cur = ''; continue; }
+    cur += trimmed[i];
+  }
+  cells.push(cur);
+  return cells.map((c) => c.trim());
 }
 
 function _parseListBlock(lines, startIdx) {
@@ -374,11 +459,31 @@ function _parseListBlock(lines, startIdx) {
   const isOL = /^\s*\d+\. /.test(lines[startIdx]);
   const items = [];
   let firstIsCB = null;
+  let loose = false;
+  let pendingBlank = false;
   let i = startIdx;
 
   while (i < lines.length) {
     const line = lines[i];
-    if (line.trim() === '') break;
+
+    if (line.trim() === '') {
+      // A blank line only ends the list if what follows isn't a continuation
+      // of it (another item at the same marker/indent, or indented text
+      // belonging to the current item) — otherwise it marks a "loose" list.
+      const next = lines[i + 1];
+      const nextIndent = next !== undefined ? (next.match(/^(\s*)/)[1]).length : -1;
+      const nextIsSameItem = next !== undefined &&
+        /^\s*(?:[-*+]|\d+\.) /.test(next) &&
+        (/^\s*\d+\. /.test(next) === isOL) &&
+        nextIndent === baseIndent;
+      const nextIsContinuation = next !== undefined && next.trim() !== '' && nextIndent > baseIndent;
+      if (!items.length || (!nextIsSameItem && !nextIsContinuation)) break;
+      loose = true;
+      pendingBlank = true;
+      i++;
+      continue;
+    }
+
     const indent = (line.match(/^(\s*)/)[1]).length;
     if (indent < baseIndent) break;
 
@@ -386,12 +491,18 @@ function _parseListBlock(lines, startIdx) {
       if (!/^\s*(?:[-*+]|\d+\.) /.test(line)) break;
       if (/^\s*\d+\. /.test(line) !== isOL) break;
       const raw = isOL ? line.replace(/^\s*\d+\. /, '') : line.replace(/^\s*[-*+] /, '');
+      // Checklists are intentionally UL-only: sanitise.js's checkbox guard,
+      // the injected checklist CSS, and every checklist-toggle command are
+      // all hardcoded to `ul.an-checklist` with no `ol` equivalent, so an
+      // ordered-list checkbox would be stripped by the sanitiser and get no
+      // styling even if parsed here — "1. [ ] item" intentionally stays plain.
       const isCB = !isOL && /^\[[ xX]\]\s+/.test(raw);
       if (firstIsCB === null) firstIsCB = isCB;
       if (isCB !== firstIsCB) break;
       const checked = isCB && raw[1].toLowerCase() === 'x';
       const text = isCB ? raw.replace(/^\[[ xX]\]\s+/, '') : raw;
-      items.push({ text, isCB, checked, sub: '' });
+      items.push({ paras: [text], isCB, checked, sub: '' });
+      pendingBlank = false;
       i++;
     } else {
       if (!items.length) { i++; continue; }
@@ -399,64 +510,164 @@ function _parseListBlock(lines, startIdx) {
         const nested = _parseListBlock(lines, i);
         items[items.length - 1].sub += nested.html;
         i = nested.endIdx;
+        pendingBlank = false;
+      } else if (pendingBlank) {
+        items[items.length - 1].paras.push(line.trim());
+        pendingBlank = false;
+        i++;
       } else {
-        items[items.length - 1].text += ' ' + line.trim();
+        const paras = items[items.length - 1].paras;
+        paras[paras.length - 1] += ' ' + line.trim();
         i++;
       }
     }
   }
 
   const hasCB = !isOL && (firstIsCB === true);
-  const open = isOL ? '<ol>' : hasCB ? '<ul class="an-checklist">' : '<ul>';
+  const startMatch = isOL ? /^\s*(\d+)\. /.exec(lines[startIdx]) : null;
+  const startNum = startMatch ? Number.parseInt(startMatch[1], 10) : 1;
+  const open = isOL
+    ? (startNum !== 1 ? `<ol start="${startNum}">` : '<ol>')
+    : (hasCB ? '<ul class="an-checklist">' : '<ul>');
   const close = isOL ? '</ol>' : '</ul>';
-  const liHTML = items.map(({ text, isCB, checked, sub }) => {
+  const liHTML = items.map(({ paras, isCB, checked, sub }) => {
     const cbHTML = isCB
       ? `<input type="checkbox" contenteditable="false"${checked ? ' checked' : ''}>`
       : '';
-    return `<li>${cbHTML}${_inline(text)}${sub}</li>`;
+    const body = loose
+      ? paras.map((p, idx) => `<p>${idx === 0 ? cbHTML : ''}${_inline(p)}</p>`).join('')
+      : `${cbHTML}${_inline(paras[0])}`;
+    return `<li>${body}${sub}</li>`;
   }).join('');
   return { html: `${open}${liHTML}${close}`, endIdx: i };
 }
 
-function _inline(text) {
-  // Images before links (they share [] syntax)
+// Backslash-escapable inline punctuation (CommonMark-ish, narrowed to the
+// syntax characters this converter actually uses).
+const ESCAPABLE_RE = /\\([*_`#[\]()>\\~|])/g;
+// Placeholder marker for escaped literals — a NUL character can't appear in
+// real markdown text, so it's safe as a delimiter. Built at runtime (not
+// written as a literal escape) to avoid embedding a raw NUL byte in this file.
+const MARK = String.fromCharCode(0);
+
+/**
+ * Step 0 of _inline(): replaces backslash-escaped punctuation with inert
+ * placeholders so later syntax regexes can't match them.
+ * @param {string} text
+ * @returns {{ text: string, literals: string[] }}
+ */
+function _extractBackslashEscapes(text) {
+  const literals = [];
+  const replaced = text.replace(ESCAPABLE_RE, (_, ch) => {
+    literals.push(ch);
+    return `${MARK}${literals.length - 1}${MARK}`;
+  });
+  return { text: replaced, literals };
+}
+
+/**
+ * Restores placeholders from _extractBackslashEscapes(), HTML-escaping each
+ * literal since it's inserted directly into the output.
+ * @param {string} text
+ * @param {string[]} literals
+ * @returns {string}
+ */
+function _restoreBackslashEscapes(text, literals) {
+  return text.replace(new RegExp(`${MARK}(\\d+)${MARK}`, 'g'), (_, idx) => _esc(literals[Number(idx)]));
+}
+
+/**
+ * Resolves images, inline links, GFM reference-style links (explicit,
+ * shortcut, and bare/implicit forms), and footnote markers. Must run on text
+ * already passed through _esc() — see _inline()'s Step 1 comment.
+ * @param {string} text
+ * @returns {string}
+ */
+function _resolveLinksAndFootnotes(text) {
   text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) =>
-    `<img src="${_escAttr(src)}" alt="${_escAttr(alt)}" class="an-image">`);
-  // Links
+    `<img src="${_escAttrQuotes(src)}" alt="${_escAttrQuotes(alt)}" class="an-image">`);
   text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, href) =>
-    `<a href="${_escAttr(href)}">${_esc(label)}</a>`);
-  // Reference-style links  [text][ref]  and shortcut  [text][]
+    `<a href="${_escAttrQuotes(href)}">${label}</a>`);
   text = text.replace(/\[([^\]]+)\]\[([^\]]*)\]/g, (m, label, ref) => {
-    const def = _linkDefs.get((ref || label).trim().toLowerCase());
+    const def = _linkDefs.get(_unescAmpLtGt(ref || label).trim().toLowerCase());
     if (!def) return m;
     const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : '';
-    return `<a href="${_escAttr(def.href)}"${titleAttr}>${_esc(label)}</a>`;
+    return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
   });
-  // Bare/implicit reference link  [text]  — only when a definition exists
   text = text.replace(/\[([^\]]+)\]/g, (m, label) => {
-    const def = _linkDefs.get(label.trim().toLowerCase());
+    const def = _linkDefs.get(_unescAmpLtGt(label).trim().toLowerCase());
     if (!def) return m;
     const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : '';
-    return `<a href="${_escAttr(def.href)}"${titleAttr}>${_esc(label)}</a>`;
+    return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
+  });
+  text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => (_footnoteIds.has(_unescAmpLtGt(id)) ? `<sup>[${id}]</sup>` : m));
+  return text;
+}
+
+/**
+ * Converts angle-bracket (`<https://...>`) and bare (`https://...`)
+ * autolinks. Runs after _resolveLinksAndFootnotes() so an already-linked URL
+ * isn't reprocessed, and on already-_esc()'d text (see _inline()).
+ * @param {string} text
+ * @returns {string}
+ */
+function _applyAutolinks(text) {
+  text = text.replace(/&lt;(https?:\/\/[^\s&]+?)&gt;/g, (_, url) => `<a href="${_escAttrQuotes(url)}">${url}</a>`);
+  text = text.replace(/(^|[\s(])(https?:\/\/[^\s()]+)/g, (m, pre, rawUrl) => {
+    const trail = /[.,;:!?)]+$/.exec(rawUrl);
+    const url = trail ? rawUrl.slice(0, -trail[0].length) : rawUrl;
+    if (!url) return m;
+    const suffix = trail ? trail[0] : '';
+    return `${pre}<a href="${_escAttrQuotes(url)}">${url}</a>${suffix}`;
   });
-  // Footnote reference marker  [^id]  — run last
-  text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => (_footnoteIds.has(id) ? `<sup>[${_esc(id)}]</sup>` : m));
-  // Bold + italic  ***text***
-  text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-  text = text.replace(/_{3}([^_\n]+?)_{3}/g,   (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-  // Bold  **text**
-  text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${_esc(c)}</strong>`);
-  text = text.replace(/_{2}([^_\n]+?)_{2}/g,   (_, c) => `<strong>${_esc(c)}</strong>`);
-  // Italic  *text*  _text_
-  text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${_esc(c)}</em>`);
-  text = text.replace(/_([^_\n]+?)_/g,   (_, c) => `<em>${_esc(c)}</em>`);
-  // Strikethrough  ~~text~~
-  text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${_esc(c)}</del>`);
-  // Inline code  `code`
-  text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${_esc(c)}</code>`);
   return text;
 }
 
+/**
+ * Applies bold/italic/bold-italic (asterisk and underscore forms — underscore
+ * requires a non-word-character boundary per CommonMark), strikethrough, and
+ * inline code.
+ * @param {string} text
+ * @returns {string}
+ */
+function _applyEmphasisAndCode(text) {
+  text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${c}</em></strong>`);
+  text = text.replace(/(?<!\w)_{3}([^_\n]+?)_{3}(?!\w)/g, (_, c) => `<strong><em>${c}</em></strong>`);
+  text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${c}</strong>`);
+  text = text.replace(/(?<!\w)_{2}([^_\n]+?)_{2}(?!\w)/g, (_, c) => `<strong>${c}</strong>`);
+  text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${c}</em>`);
+  text = text.replace(/(?<!\w)_([^_\n]+?)_(?!\w)/g, (_, c) => `<em>${c}</em>`);
+  text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${c}</del>`);
+  // Double-backtick code spans first (tolerates a single literal ` inside),
+  // then single-backtick spans.
+  text = text.replace(/``([\s\S]*?)``/g, (_, c) => `<code>${c}</code>`);
+  text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${c}</code>`);
+  return text;
+}
+
+function _inline(text) {
+  // Step 0: backslash escapes (\* \_ \` \# \[ \] \( \) \> \\ \~ \|) — replaced
+  // with inert placeholders before any syntax regex below can match them, so
+  // e.g. \*not bold\* never gets treated as emphasis. Restored at the end.
+  const { text: withoutEscapes, literals } = _extractBackslashEscapes(text);
+
+  // Step 1: escape raw &/</> in the plain-text parts of the string exactly
+  // once, up front — none of these are markdown-syntax characters used below,
+  // so this doesn't interfere with matching. Capture-group content in the
+  // steps below is therefore ALREADY escaped and must NOT be re-escaped;
+  // attribute values captured from `text` only need quotes escaped
+  // (_escAttrQuotes), since & < > are already entities. Values that come from
+  // _linkDefs (sourced from the raw, unescaped line array) still need the
+  // full _escAttr/_esc treatment.
+  let result = _esc(withoutEscapes);
+
+  result = _resolveLinksAndFootnotes(result);
+  result = _applyAutolinks(result);
+  result = _applyEmphasisAndCode(result);
+
+  return _restoreBackslashEscapes(result, literals);
+}
+
 function _esc(v) {
   return String(v)
     .replaceAll('&', '&amp;')
@@ -472,3 +683,13 @@ function _escAttr(v) {
     .replaceAll('<', '&lt;')
     .replaceAll('>', '&gt;');
 }
+
+/** Escapes only quote characters — for attribute values already run through _esc(). */
+function _escAttrQuotes(v) {
+  return String(v).replaceAll('"', '&quot;').replaceAll("'", '&#39;');
+}
+
+/** Reverses _esc()'s &amp;/&lt;/&gt; substitutions, for matching against un-escaped _linkDefs/_footnoteIds keys. */
+function _unescAmpLtGt(v) {
+  return String(v).replaceAll('&lt;', '<').replaceAll('&gt;', '>').replaceAll('&amp;', '&');
+}

package/src/js/index.js

@@ -144,7 +144,7 @@ const AutumnNote = {
   buttons,
 
   /** Library version */
-  version: '1.10.0',
+  version: '1.11.0',
 };
 
 // ---------------------------------------------------------------------------

package/src/js/module/Clipboard.js

@@ -194,6 +194,20 @@ export class Clipboard {
     return doc.body.innerHTML;
   }
 
+  /**
+   * Checks whether an HTML payload has no semantic markup beyond plain
+   * wrapper elements (e.g. a bare <div>/<p>). Used to decide whether a
+   * markdown-shaped plain-text paste should win over an accompanying HTML
+   * payload that isn't actually carrying any real rich-text formatting.
+   * @param {string} html
+   * @returns {boolean}
+   */
+  _isTriviallyPlainHtml(html) {
+    const doc = new DOMParser().parseFromString(`<body>${html}</body>`, 'text/html');
+    const SIGNIFICANT = 'a,img,table,ul,ol,li,blockquote,pre,code,h1,h2,h3,h4,h5,h6,strong,b,em,i,u,s,del,strike,hr,br';
+    return !doc.body.querySelector(SIGNIFICANT);
+  }
+
   /**
    * Forces the next paste operation to strip all HTML formatting.
    * Called by Editor when Ctrl+Shift+V is pressed.
@@ -219,6 +233,9 @@ export class Clipboard {
       const size = Math.max(text.length, html.length);
       if (size > maxBytes) {
         event.preventDefault();
+        const message = `Pasted content (${size} bytes) exceeds the ${this.options.maxPasteSize ?? 5} MB paste size limit.`;
+        this.context.triggerEvent('pasteError', { size, maxBytes, message });
+        console.warn(`[AutumnNote] ${message}`);
         return;
       }
     }
@@ -257,13 +274,20 @@ export class Clipboard {
       return;
     }
 
-    // 3. Markdown paste — only when no HTML is on the clipboard (pure text source)
-    if (this.options.markdownPaste !== false && !clipboardData.types.includes('text/html')) {
+    // 3. Markdown paste — when there's no HTML on the clipboard, or the
+    // accompanying HTML has no semantic markup (e.g. some terminal/clipboard
+    // tools put both a markdown-shaped text/plain and a trivial <div>-wrapped
+    // text/html on the clipboard). Real rich-text sources (Word, Docs, etc.)
+    // always have semantic tags after cleaning, so this is unaffected.
+    if (this.options.markdownPaste !== false) {
+      const hasHtml = clipboardData.types.includes('text/html');
+      const html = hasHtml ? clipboardData.getData('text/html') : '';
+      const htmlTriviallyPlain = !hasHtml || this._isTriviallyPlainHtml(html);
       const text = clipboardData.getData('text/plain');
-      if (text && isMarkdown(text)) {
+      if (text && htmlTriviallyPlain && isMarkdown(text)) {
         event.preventDefault();
-        const html = sanitiseHTML(markdownToHTML(text));
-        execCommand('insertHTML', html);
+        const converted = sanitiseHTML(markdownToHTML(text));
+        execCommand('insertHTML', converted);
         this.context.invoke('editor.afterCommand');
         return;
       }
@@ -307,14 +331,48 @@ export class Clipboard {
     if (!dt?.files?.length) return;
 
     const imageFiles = Array.from(dt.files).filter((f) => f.type.startsWith('image/'));
-    if (imageFiles.length === 0) return;
+    if (imageFiles.length > 0) {
+      event.preventDefault();
+      event.stopPropagation();
+      // Place the caret at the drop coordinates before inserting
+      this._placeCaretAtPoint(event.clientX, event.clientY);
+      this._insertImageFiles(imageFiles);
+      return;
+    }
 
-    event.preventDefault();
-    event.stopPropagation();
+    if (this.options.markdownPaste !== false) {
+      const mdFile = Array.from(dt.files).find((f) => /\.md$/i.test(f.name) || f.type === 'text/markdown');
+      if (mdFile) {
+        event.preventDefault();
+        event.stopPropagation();
+        this._placeCaretAtPoint(event.clientX, event.clientY);
+        this._insertMarkdownFile(mdFile);
+      }
+    }
+  }
 
-    // Place the caret at the drop coordinates before inserting
-    this._placeCaretAtPoint(event.clientX, event.clientY);
-    this._insertImageFiles(imageFiles);
+  /**
+   * Reads a dropped `.md` File and inserts it converted to HTML at the
+   * current caret. Skips the isMarkdown() heuristic — an explicit `.md`
+   * extension/MIME type is an unambiguous signal, unlike pasted plain text.
+   * @param {File} file
+   */
+  _insertMarkdownFile(file) {
+    const maxBytes = (this.options.maxPasteSize ?? 5) * 1024 * 1024;
+    if (maxBytes > 0 && file.size > maxBytes) {
+      const message = `Dropped file "${file.name}" (${file.size} bytes) exceeds the ${this.options.maxPasteSize ?? 5} MB paste size limit.`;
+      this.context.triggerEvent('pasteError', { size: file.size, maxBytes, message });
+      console.warn(`[AutumnNote] ${message}`);
+      return;
+    }
+    const reader = new FileReader();
+    reader.onload = (e) => {
+      const html = sanitiseHTML(markdownToHTML(/** @type {string} */ (e.target.result) || ''));
+      execCommand('insertHTML', html);
+      this.context.invoke('editor.afterCommand');
+    };
+    reader.onerror = () => console.warn('[AutumnNote] Failed to read dropped markdown file', file.name);
+    reader.readAsText(file);
   }
 
   // ---------------------------------------------------------------------------