autumnnote 1.10.0 → 1.11.1

package/dist/autumnnote.es.js

@@ -4643,7 +4643,10 @@ var PROHIBITED_TAGS = [
 	"object",
 	"embed",
 	"form",
-	"base"
+	"base",
+	"template",
+	"link",
+	"meta"
 ];
 /** Tags whose element wrapper is stripped but content (child nodes) is preserved. */
 var UNWRAP_TAGS = new Set(["button"]);
@@ -4652,8 +4655,28 @@ var URL_ATTRS = [
 	"href",
 	"src",
 	"action",
-	"formaction"
+	"formaction",
+	"xlink:href"
 ];
+/** Inline style properties the editor's own toolbar/table features persist on saved content. */
+var ALLOWED_STYLE_PROPS = new Set([
+	"color",
+	"background-color",
+	"font-size",
+	"line-height",
+	"text-align",
+	"vertical-align",
+	"width",
+	"min-width",
+	"height",
+	"min-height",
+	"border-width",
+	"border-style",
+	"border-color",
+	"padding"
+]);
+/** Value patterns that are never safe regardless of property. */
+var DANGEROUS_STYLE_VALUE_RE = /url\s*\(|expression\s*\(|@import|javascript:|vbscript:|behavior\s*:|-moz-binding/i;
 /** Trusted hosts for iframe embeds when allowIframes is enabled. */
 var TRUSTED_IFRAME_HOSTS = new Set([
 	"www.youtube.com",
@@ -4694,6 +4717,12 @@ function sanitiseHTML(html, { allowIframes = false } = {}) {
 				el.removeAttribute(attr.name);
 				continue;
 			}
+			if (attr.name === "style") {
+				const cleaned = sanitiseStyleValue(attr.value);
+				if (cleaned) el.setAttribute("style", cleaned);
+				else el.removeAttribute("style");
+				continue;
+			}
 			if (URL_ATTRS.includes(attr.name)) {
 				const val = attr.value.trim();
 				if (/^(javascript|vbscript):/i.test(val)) {
@@ -4722,6 +4751,28 @@ function sanitiseHTML(html, { allowIframes = false } = {}) {
 	return doc.body.innerHTML;
 }
 /**
+* Filters a style attribute value down to an allowlisted set of CSS
+* properties (ALLOWED_STYLE_PROPS), dropping any declaration whose value
+* contains a dangerous construct — url(), expression(), an "import" rule,
+* javascript:/vbscript:, IE behavior/-moz-binding — regardless of property.
+* @param {string} value
+* @returns {string} The filtered declaration list, or '' if nothing survives.
+*/
+function sanitiseStyleValue(value) {
+	const kept = [];
+	for (const decl of (value || "").split(";")) {
+		const idx = decl.indexOf(":");
+		if (idx === -1) continue;
+		const prop = decl.slice(0, idx).trim().toLowerCase();
+		const val = decl.slice(idx + 1).trim();
+		if (!prop || !val) continue;
+		if (!ALLOWED_STYLE_PROPS.has(prop)) continue;
+		if (DANGEROUS_STYLE_VALUE_RE.test(val)) continue;
+		kept.push(`${prop}: ${val}`);
+	}
+	return kept.join("; ");
+}
+/**
 * Returns true if iframe src points to an approved video host.
 * Relative, protocol-relative and invalid URLs are rejected.
 * @param {string} src
@@ -5502,6 +5553,17 @@ function htmlToMarkdown(html) {
 * @param {number} [depth=0] - Current nesting depth used to indent nested list items.
 * @returns {string} The Markdown representation of the node subtree.
 */
+/**
+* Direct child elements matching a tag name. Used instead of the CSS
+* `:scope > tag` combinator, which this project's jsdom version resolves
+* incorrectly (matches descendants at any depth, not just direct children).
+* @param {Element} el
+* @param {string} tagName
+* @returns {Element[]}
+*/
+function _directChildren(el, tagName) {
+	return Array.from(el.children).filter((c) => c.tagName === tagName.toUpperCase());
+}
 function _domToMd(node, depth = 0) {
 	if (node.nodeType === 3) return node.textContent.replace(/\s+/g, " ");
 	if (node.nodeType !== 1) return "";
@@ -5527,6 +5589,12 @@ function _domToMd(node, depth = 0) {
 		case "strike": return `~~${inner()}~~`;
 		case "sup": return `^${inner()}^`;
 		case "sub": return `~${inner()}~`;
+		case "u": return `<u>${inner()}</u>`;
+		case "span": {
+			const style = el.getAttribute("style") || "";
+			if (/\b(color|background-color|font-size)\s*:/.test(style)) return `<span style="${_escAttr(style)}">${inner()}</span>`;
+			return inner();
+		}
 		case "code":
 			if (el.closest("pre")) return inner();
 			return `\`${inner()}\``;
@@ -5535,7 +5603,10 @@ function _domToMd(node, depth = 0) {
 			const langMatch = /language-(\S+)/.exec(codeEl?.className || "");
 			return `\n\n\`\`\`${langMatch ? langMatch[1] : ""}\n${(codeEl || el).textContent || ""}\n\`\`\`\n\n`;
 		}
-		case "blockquote": return `\n\n${inner().trim().split("\n").map((l) => `> ${l}`).join("\n")}\n\n`;
+		case "blockquote": {
+			const rawLines = inner().trim().split("\n");
+			return `\n\n${rawLines.filter((l, idx) => l.trim() !== "" || (rawLines[idx - 1] ?? "").trim() !== "").map((l) => l.trim() === "" ? ">" : `> ${l}`).join("\n")}\n\n`;
+		}
 		case "a": {
 			const href = el.getAttribute("href") || "";
 			return `[${inner()}](${href})`;
@@ -5545,22 +5616,20 @@ function _domToMd(node, depth = 0) {
 			return `![${el.getAttribute("alt") || ""}](${src})`;
 		}
 		case "ul": {
-			const items = Array.from(el.querySelectorAll(":scope > li"));
+			const items = _directChildren(el, "li");
 			if (!items.length) return inner();
 			const indent = "  ".repeat(depth);
 			const isChecklist = el.classList.contains("an-checklist");
 			const lines = items.map((li) => {
+				const cb = _directChildren(li, "input").find((c) => c.getAttribute("type") === "checkbox");
 				let prefix = "- ";
-				if (isChecklist) {
-					const cb = li.querySelector("input[type=\"checkbox\"]");
-					prefix = (cb ? cb.checked : false) ? "- [x] " : "- [ ] ";
-				}
+				if (isChecklist || cb) prefix = (cb ? cb.checked : false) ? "- [x] " : "- [ ] ";
 				return `${indent}${prefix}${_domToMd(li, depth + 1).trim()}`;
 			}).join("\n");
 			return depth === 0 ? `\n\n${lines}\n\n` : `\n${lines}`;
 		}
 		case "ol": {
-			const items = Array.from(el.querySelectorAll(":scope > li"));
+			const items = _directChildren(el, "li");
 			if (!items.length) return inner();
 			const indent = "  ".repeat(depth);
 			const lines = items.map((li, i) => `${indent}${i + 1}. ${_domToMd(li, depth + 1).trim()}`).join("\n");
@@ -5569,19 +5638,22 @@ function _domToMd(node, depth = 0) {
 		case "li": return inner();
 		case "hr": return "\n\n---\n\n";
 		case "table": {
-			const rows = Array.from(el.querySelectorAll("tr"));
-			if (!rows.length) return inner();
-			const cellTexts = rows.map((tr) => Array.from(tr.querySelectorAll("th, td")).map((c) => c.textContent.trim().replaceAll("|", String.raw`\|`)));
+			const allRows = Array.from(el.querySelectorAll("tr"));
+			if (!allRows.length) return inner();
+			const firstRowIsHeader = !!_directChildren(el, "thead")[0] || allRows[0].children.length > 0 && Array.from(allRows[0].children).every((c) => c.tagName === "TH");
+			const cellTexts = allRows.map((tr) => Array.from(tr.querySelectorAll("th, td")).map((c) => c.textContent.trim().replaceAll("|", String.raw`\|`)));
 			const cols = Math.max(...cellTexts.map((r) => r.length));
 			const padRow = (row) => {
 				const r = [...row];
 				while (r.length < cols) r.push("");
 				return r;
 			};
+			const bodyStart = firstRowIsHeader ? 1 : 0;
+			const headerCells = firstRowIsHeader ? padRow(cellTexts[0]) : new Array(cols).fill("");
 			let md = "\n\n";
-			md += `| ${padRow(cellTexts[0]).join(" | ")} |\n`;
+			md += `| ${headerCells.join(" | ")} |\n`;
 			md += `| ${new Array(cols).fill("---").join(" | ")} |\n`;
-			for (let r = 1; r < cellTexts.length; r++) md += `| ${padRow(cellTexts[r]).join(" | ")} |\n`;
+			for (let r = bodyStart; r < cellTexts.length; r++) md += `| ${padRow(cellTexts[r]).join(" | ")} |\n`;
 			return md + "\n";
 		}
 		default: return inner();
@@ -5596,8 +5668,11 @@ function _domToMd(node, depth = 0) {
 * @returns {boolean} `true` if any Markdown-like pattern is present, `false` otherwise.
 */
 function isMarkdown(text) {
-	return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> [^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text) || /^.+\n=+\s*$/m.test(text) || /^.+\n-{2,}\s*$/m.test(text) || /^---\s*\n(?:[\s\S]*?\n)?(?:---|\.\.\.)\s*(?:\n|$)/.test(text) || /^\|.+\|[ \t]*\n\|[ \t:|-]+\|/m.test(text);
+	return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> ?[^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text) || /^.+\n=+\s*$/m.test(text) || /^.+\n-{2,}\s*$/m.test(text) || /^---\s*\n(?:[\s\S]*?\n)?(?:---|\.\.\.)\s*(?:\n|$)/.test(text) || /^\|.+\|[ \t]*\n\|[ \t:|-]+\|/m.test(text);
 }
+var BQ_RE = /^ {0,3}>( ?)(.*)$/;
+var HR_RE = /^ {0,3}([-*_])( *\1){2,}\s*$/;
+var HARD_BREAK = String.fromCharCode(1);
 /**
 * Converts a Markdown string to an HTML string.
 * @param {string} text
@@ -5610,6 +5685,16 @@ function markdownToHTML(text) {
 	lines = refs.clean;
 	_linkDefs = refs.linkDefs;
 	_footnoteIds = refs.footnoteIds;
+	return _parseBlocks(lines);
+}
+/**
+* Parses a line array into block-level HTML. Called recursively for content
+* nested inside a blockquote so nested quotes and block content (lists,
+* headings, etc.) inside `>` are parsed the same as top-level content.
+* @param {string[]} lines
+* @returns {string}
+*/
+function _parseBlocks(lines) {
 	const out = [];
 	let i = 0;
 	while (i < lines.length) {
@@ -5628,7 +5713,7 @@ function markdownToHTML(text) {
 			i++;
 			continue;
 		}
-		if (line.trim() && !/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
+		if (line.trim() && !HR_RE.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
 			if (/^=+\s*$/.test(lines[i + 1])) {
 				out.push(`<h1>${_inline(line.trim())}</h1>`);
 				i += 2;
@@ -5640,7 +5725,7 @@ function markdownToHTML(text) {
 				continue;
 			}
 		}
-		if (/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line)) {
+		if (HR_RE.test(line)) {
 			out.push("<hr>");
 			i++;
 			continue;
@@ -5648,17 +5733,18 @@ function markdownToHTML(text) {
 		const hMatch = /^(#{1,6})\s+(.+)$/.exec(line);
 		if (hMatch) {
 			const level = hMatch[1].length;
-			out.push(`<h${level}>${_inline(hMatch[2])}</h${level}>`);
+			const content = hMatch[2].replace(/(?:^|\s)#+\s*$/, "");
+			out.push(`<h${level}>${_inline(content)}</h${level}>`);
 			i++;
 			continue;
 		}
-		if (line.startsWith("> ")) {
+		if (BQ_RE.test(line)) {
 			const bqLines = [];
-			while (i < lines.length && lines[i].startsWith("> ")) {
-				bqLines.push(lines[i].slice(2));
+			while (i < lines.length && BQ_RE.test(lines[i])) {
+				bqLines.push(BQ_RE.exec(lines[i])[2]);
 				i++;
 			}
-			out.push(`<blockquote>${bqLines.map(_inline).join("<br>")}</blockquote>`);
+			out.push(`<blockquote>${_parseBlocks(bqLines)}</blockquote>`);
 			continue;
 		}
 		if (/^[-*+] /.test(line)) {
@@ -5701,11 +5787,11 @@ function markdownToHTML(text) {
 			continue;
 		}
 		const paraLines = [];
-		while (i < lines.length && lines[i].trim() !== "" && !/^(#{1,6} |> |[-*+] |\d+\. |```|---\s*$|\*{3}\s*$|_{3}\s*$)/.test(lines[i]) && !/^\|.+\|/.test(lines[i]) && !(i + 1 < lines.length && /^=+\s*$/.test(lines[i + 1])) && !(i + 1 < lines.length && /^-{2,}\s*$/.test(lines[i + 1]))) {
+		while (i < lines.length && lines[i].trim() !== "" && !/^(#{1,6} |[-*+] |\d+\. |```)/.test(lines[i]) && !BQ_RE.test(lines[i]) && !HR_RE.test(lines[i]) && !/^\|.+\|/.test(lines[i]) && !(i + 1 < lines.length && /^=+\s*$/.test(lines[i + 1])) && !(i + 1 < lines.length && /^-{2,}\s*$/.test(lines[i + 1]))) {
 			paraLines.push(lines[i]);
 			i++;
 		}
-		if (paraLines.length) out.push(`<p>${_inline(paraLines.join(" "))}</p>`);
+		if (paraLines.length) out.push(`<p>${_inline(_joinParagraphLines(paraLines)).replaceAll(HARD_BREAK, "<br>")}</p>`);
 	}
 	return out.join("");
 }
@@ -5780,23 +5866,77 @@ function _extractReferenceDefinitions(lines) {
 	};
 }
 /**
-* Splits a GFM table row string into trimmed cell strings.
-* '| a | b | c |' → ['a', 'b', 'c']
+* Joins a paragraph's source lines into one string, converting CommonMark
+* hard-break markers (a trailing backslash, or 2+ trailing spaces) on all
+* but the last line into a HARD_BREAK placeholder instead of a plain space.
+* @param {string[]} paraLines
+* @returns {string}
+*/
+function _joinParagraphLines(paraLines) {
+	let joined = "";
+	for (let idx = 0; idx < paraLines.length; idx++) {
+		const isLast = idx === paraLines.length - 1;
+		const ln = paraLines[idx];
+		if (!isLast && /\\$/.test(ln)) {
+			joined += ln.replace(/\\$/, "") + HARD_BREAK;
+			continue;
+		}
+		if (!isLast && / {2,}$/.test(ln)) {
+			joined += ln.replace(/ {2,}$/, "") + HARD_BREAK;
+			continue;
+		}
+		joined += ln + (isLast ? "" : " ");
+	}
+	return joined;
+}
+/**
+* Splits a GFM table row string into trimmed cell strings, treating an
+* escaped pipe (`\|`) as a literal character rather than a cell separator.
+* '| a | b | c |' → ['a', 'b', 'c']; '| a\|b | c |' → ['a|b', 'c']
 * @param {string} row
 * @returns {string[]}
 */
 function _parseTableRow(row) {
-	return row.replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+	const trimmed = row.replace(/^\|/, "").replace(/\|$/, "");
+	const cells = [];
+	let cur = "";
+	for (let i = 0; i < trimmed.length; i++) {
+		if (trimmed[i] === "\\" && trimmed[i + 1] === "|") {
+			cur += "|";
+			i++;
+			continue;
+		}
+		if (trimmed[i] === "|") {
+			cells.push(cur);
+			cur = "";
+			continue;
+		}
+		cur += trimmed[i];
+	}
+	cells.push(cur);
+	return cells.map((c) => c.trim());
 }
 function _parseListBlock(lines, startIdx) {
 	const baseIndent = lines[startIdx].match(/^(\s*)/)[1].length;
 	const isOL = /^\s*\d+\. /.test(lines[startIdx]);
 	const items = [];
 	let firstIsCB = null;
+	let loose = false;
+	let pendingBlank = false;
 	let i = startIdx;
 	while (i < lines.length) {
 		const line = lines[i];
-		if (line.trim() === "") break;
+		if (line.trim() === "") {
+			const next = lines[i + 1];
+			const nextIndent = next !== void 0 ? next.match(/^(\s*)/)[1].length : -1;
+			const nextIsSameItem = next !== void 0 && /^\s*(?:[-*+]|\d+\.) /.test(next) && /^\s*\d+\. /.test(next) === isOL && nextIndent === baseIndent;
+			const nextIsContinuation = next !== void 0 && next.trim() !== "" && nextIndent > baseIndent;
+			if (!items.length || !nextIsSameItem && !nextIsContinuation) break;
+			loose = true;
+			pendingBlank = true;
+			i++;
+			continue;
+		}
 		const indent = line.match(/^(\s*)/)[1].length;
 		if (indent < baseIndent) break;
 		if (indent === baseIndent) {
@@ -5809,11 +5949,12 @@ function _parseListBlock(lines, startIdx) {
 			const checked = isCB && raw[1].toLowerCase() === "x";
 			const text = isCB ? raw.replace(/^\[[ xX]\]\s+/, "") : raw;
 			items.push({
-				text,
+				paras: [text],
 				isCB,
 				checked,
 				sub: ""
 			});
+			pendingBlank = false;
 			i++;
 		} else {
 			if (!items.length) {
@@ -5824,53 +5965,143 @@ function _parseListBlock(lines, startIdx) {
 				const nested = _parseListBlock(lines, i);
 				items[items.length - 1].sub += nested.html;
 				i = nested.endIdx;
+				pendingBlank = false;
+			} else if (pendingBlank) {
+				items[items.length - 1].paras.push(line.trim());
+				pendingBlank = false;
+				i++;
 			} else {
-				items[items.length - 1].text += " " + line.trim();
+				const paras = items[items.length - 1].paras;
+				paras[paras.length - 1] += " " + line.trim();
 				i++;
 			}
 		}
 	}
-	const open = isOL ? "<ol>" : !isOL && firstIsCB === true ? "<ul class=\"an-checklist\">" : "<ul>";
+	const hasCB = !isOL && firstIsCB === true;
+	const startMatch = isOL ? /^\s*(\d+)\. /.exec(lines[startIdx]) : null;
+	const startNum = startMatch ? Number.parseInt(startMatch[1], 10) : 1;
+	const open = isOL ? startNum !== 1 ? `<ol start="${startNum}">` : "<ol>" : hasCB ? "<ul class=\"an-checklist\">" : "<ul>";
 	const close = isOL ? "</ol>" : "</ul>";
 	return {
-		html: `${open}${items.map(({ text, isCB, checked, sub }) => {
-			return `<li>${isCB ? `<input type="checkbox" contenteditable="false"${checked ? " checked" : ""}>` : ""}${_inline(text)}${sub}</li>`;
+		html: `${open}${items.map(({ paras, isCB, checked, sub }) => {
+			const cbHTML = isCB ? `<input type="checkbox" contenteditable="false"${checked ? " checked" : ""}>` : "";
+			return `<li>${loose ? paras.map((p, idx) => `<p>${idx === 0 ? cbHTML : ""}${_inline(p)}</p>`).join("") : `${cbHTML}${_inline(paras[0])}`}${sub}</li>`;
 		}).join("")}${close}`,
 		endIdx: i
 	};
 }
-function _inline(text) {
-	text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) => `<img src="${_escAttr(src)}" alt="${_escAttr(alt)}" class="an-image">`);
-	text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, href) => `<a href="${_escAttr(href)}">${_esc(label)}</a>`);
+var ESCAPABLE_RE = /\\([*_`#[\]()>\\~|])/g;
+var MARK = String.fromCharCode(0);
+/**
+* Step 0 of _inline(): replaces backslash-escaped punctuation with inert
+* placeholders so later syntax regexes can't match them.
+* @param {string} text
+* @returns {{ text: string, literals: string[] }}
+*/
+function _extractBackslashEscapes(text) {
+	const literals = [];
+	return {
+		text: text.replace(ESCAPABLE_RE, (_, ch) => {
+			literals.push(ch);
+			return `${MARK}${literals.length - 1}${MARK}`;
+		}),
+		literals
+	};
+}
+/**
+* Restores placeholders from _extractBackslashEscapes(), HTML-escaping each
+* literal since it's inserted directly into the output.
+* @param {string} text
+* @param {string[]} literals
+* @returns {string}
+*/
+function _restoreBackslashEscapes(text, literals) {
+	return text.replace(new RegExp(`${MARK}(\\d+)${MARK}`, "g"), (_, idx) => _esc(literals[Number(idx)]));
+}
+/**
+* Resolves images, inline links, GFM reference-style links (explicit,
+* shortcut, and bare/implicit forms), and footnote markers. Must run on text
+* already passed through _esc() — see _inline()'s Step 1 comment.
+* @param {string} text
+* @returns {string}
+*/
+function _resolveLinksAndFootnotes(text) {
+	text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) => `<img src="${_escAttrQuotes(src)}" alt="${_escAttrQuotes(alt)}" class="an-image">`);
+	text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, href) => `<a href="${_escAttrQuotes(href)}">${label}</a>`);
 	text = text.replace(/\[([^\]]+)\]\[([^\]]*)\]/g, (m, label, ref) => {
-		const def = _linkDefs.get((ref || label).trim().toLowerCase());
+		const def = _linkDefs.get(_unescAmpLtGt(ref || label).trim().toLowerCase());
 		if (!def) return m;
 		const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : "";
-		return `<a href="${_escAttr(def.href)}"${titleAttr}>${_esc(label)}</a>`;
+		return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
 	});
 	text = text.replace(/\[([^\]]+)\]/g, (m, label) => {
-		const def = _linkDefs.get(label.trim().toLowerCase());
+		const def = _linkDefs.get(_unescAmpLtGt(label).trim().toLowerCase());
 		if (!def) return m;
 		const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : "";
-		return `<a href="${_escAttr(def.href)}"${titleAttr}>${_esc(label)}</a>`;
+		return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
 	});
-	text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => _footnoteIds.has(id) ? `<sup>[${_esc(id)}]</sup>` : m);
-	text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-	text = text.replace(/_{3}([^_\n]+?)_{3}/g, (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-	text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${_esc(c)}</strong>`);
-	text = text.replace(/_{2}([^_\n]+?)_{2}/g, (_, c) => `<strong>${_esc(c)}</strong>`);
-	text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${_esc(c)}</em>`);
-	text = text.replace(/_([^_\n]+?)_/g, (_, c) => `<em>${_esc(c)}</em>`);
-	text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${_esc(c)}</del>`);
-	text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${_esc(c)}</code>`);
+	text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => _footnoteIds.has(_unescAmpLtGt(id)) ? `<sup>[${id}]</sup>` : m);
 	return text;
 }
+/**
+* Converts angle-bracket (`<https://...>`) and bare (`https://...`)
+* autolinks. Runs after _resolveLinksAndFootnotes() so an already-linked URL
+* isn't reprocessed, and on already-_esc()'d text (see _inline()).
+* @param {string} text
+* @returns {string}
+*/
+function _applyAutolinks(text) {
+	text = text.replace(/&lt;(https?:\/\/[^\s&]+?)&gt;/g, (_, url) => `<a href="${_escAttrQuotes(url)}">${url}</a>`);
+	text = text.replace(/(^|[\s(])(https?:\/\/[^\s()]+)/g, (m, pre, rawUrl) => {
+		const trail = /[.,;:!?)]+$/.exec(rawUrl);
+		const url = trail ? rawUrl.slice(0, -trail[0].length) : rawUrl;
+		if (!url) return m;
+		const suffix = trail ? trail[0] : "";
+		return `${pre}<a href="${_escAttrQuotes(url)}">${url}</a>${suffix}`;
+	});
+	return text;
+}
+/**
+* Applies bold/italic/bold-italic (asterisk and underscore forms — underscore
+* requires a non-word-character boundary per CommonMark), strikethrough, and
+* inline code.
+* @param {string} text
+* @returns {string}
+*/
+function _applyEmphasisAndCode(text) {
+	text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${c}</em></strong>`);
+	text = text.replace(/(?<!\w)_{3}([^_\n]+?)_{3}(?!\w)/g, (_, c) => `<strong><em>${c}</em></strong>`);
+	text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${c}</strong>`);
+	text = text.replace(/(?<!\w)_{2}([^_\n]+?)_{2}(?!\w)/g, (_, c) => `<strong>${c}</strong>`);
+	text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${c}</em>`);
+	text = text.replace(/(?<!\w)_([^_\n]+?)_(?!\w)/g, (_, c) => `<em>${c}</em>`);
+	text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${c}</del>`);
+	text = text.replace(/``([\s\S]*?)``/g, (_, c) => `<code>${c}</code>`);
+	text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${c}</code>`);
+	return text;
+}
+function _inline(text) {
+	const { text: withoutEscapes, literals } = _extractBackslashEscapes(text);
+	let result = _esc(withoutEscapes);
+	result = _resolveLinksAndFootnotes(result);
+	result = _applyAutolinks(result);
+	result = _applyEmphasisAndCode(result);
+	return _restoreBackslashEscapes(result, literals);
+}
 function _esc(v) {
 	return String(v).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
 function _escAttr(v) {
 	return String(v).replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
+/** Escapes only quote characters — for attribute values already run through _esc(). */
+function _escAttrQuotes(v) {
+	return String(v).replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+/** Reverses _esc()'s &amp;/&lt;/&gt; substitutions, for matching against un-escaped _linkDefs/_footnoteIds keys. */
+function _unescAmpLtGt(v) {
+	return String(v).replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
 //#endregion
 //#region src/js/core/detectLang.js
 /**
@@ -7426,6 +7657,17 @@ var Clipboard = class {
 		return doc.body.innerHTML;
 	}
 	/**
+	* Checks whether an HTML payload has no semantic markup beyond plain
+	* wrapper elements (e.g. a bare <div>/<p>). Used to decide whether a
+	* markdown-shaped plain-text paste should win over an accompanying HTML
+	* payload that isn't actually carrying any real rich-text formatting.
+	* @param {string} html
+	* @returns {boolean}
+	*/
+	_isTriviallyPlainHtml(html) {
+		return !new DOMParser().parseFromString(`<body>${html}</body>`, "text/html").body.querySelector("a,img,table,ul,ol,li,blockquote,pre,code,h1,h2,h3,h4,h5,h6,strong,b,em,i,u,s,del,strike,hr,br");
+	}
+	/**
 	* Forces the next paste operation to strip all HTML formatting.
 	* Called by Editor when Ctrl+Shift+V is pressed.
 	* @param {boolean} val
@@ -7442,8 +7684,16 @@ var Clipboard = class {
 		if (maxBytes > 0) {
 			const text = clipboardData.getData("text/plain") || "";
 			const html = clipboardData.getData("text/html") || "";
-			if (Math.max(text.length, html.length) > maxBytes) {
+			const size = Math.max(text.length, html.length);
+			if (size > maxBytes) {
 				event.preventDefault();
+				const message = `Pasted content (${size} bytes) exceeds the ${this.options.maxPasteSize ?? 5} MB paste size limit.`;
+				this.context.triggerEvent("pasteError", {
+					size,
+					maxBytes,
+					message
+				});
+				console.warn(`[AutumnNote] ${message}`);
 				return;
 			}
 		}
@@ -7466,9 +7716,12 @@ var Clipboard = class {
 			this.context.invoke("editor.afterCommand");
 			return;
 		}
-		if (this.options.markdownPaste !== false && !clipboardData.types.includes("text/html")) {
+		if (this.options.markdownPaste !== false) {
+			const hasHtml = clipboardData.types.includes("text/html");
+			const html = hasHtml ? clipboardData.getData("text/html") : "";
+			const htmlTriviallyPlain = !hasHtml || this._isTriviallyPlainHtml(html);
 			const text = clipboardData.getData("text/plain");
-			if (text && isMarkdown(text)) {
+			if (text && htmlTriviallyPlain && isMarkdown(text)) {
 				event.preventDefault();
 				execCommand("insertHTML", sanitiseHTML(markdownToHTML(text)));
 				this.context.invoke("editor.afterCommand");
@@ -7501,11 +7754,51 @@ var Clipboard = class {
 		const dt = event.dataTransfer;
 		if (!dt?.files?.length) return;
 		const imageFiles = Array.from(dt.files).filter((f) => f.type.startsWith("image/"));
-		if (imageFiles.length === 0) return;
-		event.preventDefault();
-		event.stopPropagation();
-		this._placeCaretAtPoint(event.clientX, event.clientY);
-		this._insertImageFiles(imageFiles);
+		if (imageFiles.length > 0) {
+			event.preventDefault();
+			event.stopPropagation();
+			this._placeCaretAtPoint(event.clientX, event.clientY);
+			this._insertImageFiles(imageFiles);
+			return;
+		}
+		if (this.options.markdownPaste !== false) {
+			const mdFile = Array.from(dt.files).find((f) => /\.md$/i.test(f.name) || f.type === "text/markdown");
+			if (mdFile) {
+				event.preventDefault();
+				event.stopPropagation();
+				this._placeCaretAtPoint(event.clientX, event.clientY);
+				this._insertMarkdownFile(mdFile);
+			}
+		}
+	}
+	/**
+	* Reads a dropped `.md` File and inserts it converted to HTML at the
+	* current caret. Skips the isMarkdown() heuristic — an explicit `.md`
+	* extension/MIME type is an unambiguous signal, unlike pasted plain text.
+	* @param {File} file
+	*/
+	_insertMarkdownFile(file) {
+		const maxBytes = (this.options.maxPasteSize ?? 5) * 1024 * 1024;
+		if (maxBytes > 0 && file.size > maxBytes) {
+			const message = `Dropped file "${file.name}" (${file.size} bytes) exceeds the ${this.options.maxPasteSize ?? 5} MB paste size limit.`;
+			this.context.triggerEvent("pasteError", {
+				size: file.size,
+				maxBytes,
+				message
+			});
+			console.warn(`[AutumnNote] ${message}`);
+			return;
+		}
+		const reader = new FileReader();
+		reader.onload = (e) => {
+			execCommand("insertHTML", sanitiseHTML(markdownToHTML(
+				/** @type {string} */
+				e.target.result || ""
+			)));
+			this.context.invoke("editor.afterCommand");
+		};
+		reader.onerror = () => console.warn("[AutumnNote] Failed to read dropped markdown file", file.name);
+		reader.readAsText(file);
 	}
 	/**
 	* Inserts one or more image Files into the editor.
@@ -17669,7 +17962,7 @@ var AutumnNote = {
 	/** All pre-built button definitions — accessible in every module format including UMD/CJS. */
 	buttons,
 	/** Library version */
-	version: "1.10.0"
+	version: "1.11.1"
 };
 /**
 * @param {string|Element|NodeList|Element[]} selector