autumnnote 1.10.0 → 1.11.1

package/dist/autumnnote.umd.js

@@ -4356,7 +4356,10 @@
 		"object",
 		"embed",
 		"form",
-		"base"
+		"base",
+		"template",
+		"link",
+		"meta"
 	];
 	/** Tags whose element wrapper is stripped but content (child nodes) is preserved. */
 	var UNWRAP_TAGS = new Set(["button"]);
@@ -4365,8 +4368,28 @@
 		"href",
 		"src",
 		"action",
-		"formaction"
+		"formaction",
+		"xlink:href"
 	];
+	/** Inline style properties the editor's own toolbar/table features persist on saved content. */
+	var ALLOWED_STYLE_PROPS = new Set([
+		"color",
+		"background-color",
+		"font-size",
+		"line-height",
+		"text-align",
+		"vertical-align",
+		"width",
+		"min-width",
+		"height",
+		"min-height",
+		"border-width",
+		"border-style",
+		"border-color",
+		"padding"
+	]);
+	/** Value patterns that are never safe regardless of property. */
+	var DANGEROUS_STYLE_VALUE_RE = /url\s*\(|expression\s*\(|@import|javascript:|vbscript:|behavior\s*:|-moz-binding/i;
 	/** Trusted hosts for iframe embeds when allowIframes is enabled. */
 	var TRUSTED_IFRAME_HOSTS = new Set([
 		"www.youtube.com",
@@ -4407,6 +4430,12 @@
 					el.removeAttribute(attr.name);
 					continue;
 				}
+				if (attr.name === "style") {
+					const cleaned = sanitiseStyleValue(attr.value);
+					if (cleaned) el.setAttribute("style", cleaned);
+					else el.removeAttribute("style");
+					continue;
+				}
 				if (URL_ATTRS.includes(attr.name)) {
 					const val = attr.value.trim();
 					if (/^(javascript|vbscript):/i.test(val)) {
@@ -4435,6 +4464,28 @@
 		return doc.body.innerHTML;
 	}
 	/**
+	* Filters a style attribute value down to an allowlisted set of CSS
+	* properties (ALLOWED_STYLE_PROPS), dropping any declaration whose value
+	* contains a dangerous construct — url(), expression(), an "import" rule,
+	* javascript:/vbscript:, IE behavior/-moz-binding — regardless of property.
+	* @param {string} value
+	* @returns {string} The filtered declaration list, or '' if nothing survives.
+	*/
+	function sanitiseStyleValue(value) {
+		const kept = [];
+		for (const decl of (value || "").split(";")) {
+			const idx = decl.indexOf(":");
+			if (idx === -1) continue;
+			const prop = decl.slice(0, idx).trim().toLowerCase();
+			const val = decl.slice(idx + 1).trim();
+			if (!prop || !val) continue;
+			if (!ALLOWED_STYLE_PROPS.has(prop)) continue;
+			if (DANGEROUS_STYLE_VALUE_RE.test(val)) continue;
+			kept.push(`${prop}: ${val}`);
+		}
+		return kept.join("; ");
+	}
+	/**
 	* Returns true if iframe src points to an approved video host.
 	* Relative, protocol-relative and invalid URLs are rejected.
 	* @param {string} src
@@ -5215,6 +5266,17 @@
 	* @param {number} [depth=0] - Current nesting depth used to indent nested list items.
 	* @returns {string} The Markdown representation of the node subtree.
 	*/
+	/**
+	* Direct child elements matching a tag name. Used instead of the CSS
+	* `:scope > tag` combinator, which this project's jsdom version resolves
+	* incorrectly (matches descendants at any depth, not just direct children).
+	* @param {Element} el
+	* @param {string} tagName
+	* @returns {Element[]}
+	*/
+	function _directChildren(el, tagName) {
+		return Array.from(el.children).filter((c) => c.tagName === tagName.toUpperCase());
+	}
 	function _domToMd(node, depth = 0) {
 		if (node.nodeType === 3) return node.textContent.replace(/\s+/g, " ");
 		if (node.nodeType !== 1) return "";
@@ -5240,6 +5302,12 @@
 			case "strike": return `~~${inner()}~~`;
 			case "sup": return `^${inner()}^`;
 			case "sub": return `~${inner()}~`;
+			case "u": return `<u>${inner()}</u>`;
+			case "span": {
+				const style = el.getAttribute("style") || "";
+				if (/\b(color|background-color|font-size)\s*:/.test(style)) return `<span style="${_escAttr(style)}">${inner()}</span>`;
+				return inner();
+			}
 			case "code":
 				if (el.closest("pre")) return inner();
 				return `\`${inner()}\``;
@@ -5248,7 +5316,10 @@
 				const langMatch = /language-(\S+)/.exec(codeEl?.className || "");
 				return `\n\n\`\`\`${langMatch ? langMatch[1] : ""}\n${(codeEl || el).textContent || ""}\n\`\`\`\n\n`;
 			}
-			case "blockquote": return `\n\n${inner().trim().split("\n").map((l) => `> ${l}`).join("\n")}\n\n`;
+			case "blockquote": {
+				const rawLines = inner().trim().split("\n");
+				return `\n\n${rawLines.filter((l, idx) => l.trim() !== "" || (rawLines[idx - 1] ?? "").trim() !== "").map((l) => l.trim() === "" ? ">" : `> ${l}`).join("\n")}\n\n`;
+			}
 			case "a": {
 				const href = el.getAttribute("href") || "";
 				return `[${inner()}](${href})`;
@@ -5258,22 +5329,20 @@
 				return `![${el.getAttribute("alt") || ""}](${src})`;
 			}
 			case "ul": {
-				const items = Array.from(el.querySelectorAll(":scope > li"));
+				const items = _directChildren(el, "li");
 				if (!items.length) return inner();
 				const indent = "  ".repeat(depth);
 				const isChecklist = el.classList.contains("an-checklist");
 				const lines = items.map((li) => {
+					const cb = _directChildren(li, "input").find((c) => c.getAttribute("type") === "checkbox");
 					let prefix = "- ";
-					if (isChecklist) {
-						const cb = li.querySelector("input[type=\"checkbox\"]");
-						prefix = (cb ? cb.checked : false) ? "- [x] " : "- [ ] ";
-					}
+					if (isChecklist || cb) prefix = (cb ? cb.checked : false) ? "- [x] " : "- [ ] ";
 					return `${indent}${prefix}${_domToMd(li, depth + 1).trim()}`;
 				}).join("\n");
 				return depth === 0 ? `\n\n${lines}\n\n` : `\n${lines}`;
 			}
 			case "ol": {
-				const items = Array.from(el.querySelectorAll(":scope > li"));
+				const items = _directChildren(el, "li");
 				if (!items.length) return inner();
 				const indent = "  ".repeat(depth);
 				const lines = items.map((li, i) => `${indent}${i + 1}. ${_domToMd(li, depth + 1).trim()}`).join("\n");
@@ -5282,19 +5351,22 @@
 			case "li": return inner();
 			case "hr": return "\n\n---\n\n";
 			case "table": {
-				const rows = Array.from(el.querySelectorAll("tr"));
-				if (!rows.length) return inner();
-				const cellTexts = rows.map((tr) => Array.from(tr.querySelectorAll("th, td")).map((c) => c.textContent.trim().replaceAll("|", String.raw`\|`)));
+				const allRows = Array.from(el.querySelectorAll("tr"));
+				if (!allRows.length) return inner();
+				const firstRowIsHeader = !!_directChildren(el, "thead")[0] || allRows[0].children.length > 0 && Array.from(allRows[0].children).every((c) => c.tagName === "TH");
+				const cellTexts = allRows.map((tr) => Array.from(tr.querySelectorAll("th, td")).map((c) => c.textContent.trim().replaceAll("|", String.raw`\|`)));
 				const cols = Math.max(...cellTexts.map((r) => r.length));
 				const padRow = (row) => {
 					const r = [...row];
 					while (r.length < cols) r.push("");
 					return r;
 				};
+				const bodyStart = firstRowIsHeader ? 1 : 0;
+				const headerCells = firstRowIsHeader ? padRow(cellTexts[0]) : new Array(cols).fill("");
 				let md = "\n\n";
-				md += `| ${padRow(cellTexts[0]).join(" | ")} |\n`;
+				md += `| ${headerCells.join(" | ")} |\n`;
 				md += `| ${new Array(cols).fill("---").join(" | ")} |\n`;
-				for (let r = 1; r < cellTexts.length; r++) md += `| ${padRow(cellTexts[r]).join(" | ")} |\n`;
+				for (let r = bodyStart; r < cellTexts.length; r++) md += `| ${padRow(cellTexts[r]).join(" | ")} |\n`;
 				return md + "\n";
 			}
 			default: return inner();
@@ -5309,8 +5381,11 @@
 	* @returns {boolean} `true` if any Markdown-like pattern is present, `false` otherwise.
 	*/
 	function isMarkdown(text) {
-		return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> [^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text) || /^.+\n=+\s*$/m.test(text) || /^.+\n-{2,}\s*$/m.test(text) || /^---\s*\n(?:[\s\S]*?\n)?(?:---|\.\.\.)\s*(?:\n|$)/.test(text) || /^\|.+\|[ \t]*\n\|[ \t:|-]+\|/m.test(text);
+		return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> ?[^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text) || /^.+\n=+\s*$/m.test(text) || /^.+\n-{2,}\s*$/m.test(text) || /^---\s*\n(?:[\s\S]*?\n)?(?:---|\.\.\.)\s*(?:\n|$)/.test(text) || /^\|.+\|[ \t]*\n\|[ \t:|-]+\|/m.test(text);
 	}
+	var BQ_RE = /^ {0,3}>( ?)(.*)$/;
+	var HR_RE = /^ {0,3}([-*_])( *\1){2,}\s*$/;
+	var HARD_BREAK = String.fromCharCode(1);
 	/**
 	* Converts a Markdown string to an HTML string.
 	* @param {string} text
@@ -5323,6 +5398,16 @@
 		lines = refs.clean;
 		_linkDefs = refs.linkDefs;
 		_footnoteIds = refs.footnoteIds;
+		return _parseBlocks(lines);
+	}
+	/**
+	* Parses a line array into block-level HTML. Called recursively for content
+	* nested inside a blockquote so nested quotes and block content (lists,
+	* headings, etc.) inside `>` are parsed the same as top-level content.
+	* @param {string[]} lines
+	* @returns {string}
+	*/
+	function _parseBlocks(lines) {
 		const out = [];
 		let i = 0;
 		while (i < lines.length) {
@@ -5341,7 +5426,7 @@
 				i++;
 				continue;
 			}
-			if (line.trim() && !/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
+			if (line.trim() && !HR_RE.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
 				if (/^=+\s*$/.test(lines[i + 1])) {
 					out.push(`<h1>${_inline(line.trim())}</h1>`);
 					i += 2;
@@ -5353,7 +5438,7 @@
 					continue;
 				}
 			}
-			if (/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line)) {
+			if (HR_RE.test(line)) {
 				out.push("<hr>");
 				i++;
 				continue;
@@ -5361,17 +5446,18 @@
 			const hMatch = /^(#{1,6})\s+(.+)$/.exec(line);
 			if (hMatch) {
 				const level = hMatch[1].length;
-				out.push(`<h${level}>${_inline(hMatch[2])}</h${level}>`);
+				const content = hMatch[2].replace(/(?:^|\s)#+\s*$/, "");
+				out.push(`<h${level}>${_inline(content)}</h${level}>`);
 				i++;
 				continue;
 			}
-			if (line.startsWith("> ")) {
+			if (BQ_RE.test(line)) {
 				const bqLines = [];
-				while (i < lines.length && lines[i].startsWith("> ")) {
-					bqLines.push(lines[i].slice(2));
+				while (i < lines.length && BQ_RE.test(lines[i])) {
+					bqLines.push(BQ_RE.exec(lines[i])[2]);
 					i++;
 				}
-				out.push(`<blockquote>${bqLines.map(_inline).join("<br>")}</blockquote>`);
+				out.push(`<blockquote>${_parseBlocks(bqLines)}</blockquote>`);
 				continue;
 			}
 			if (/^[-*+] /.test(line)) {
@@ -5414,11 +5500,11 @@
 				continue;
 			}
 			const paraLines = [];
-			while (i < lines.length && lines[i].trim() !== "" && !/^(#{1,6} |> |[-*+] |\d+\. |```|---\s*$|\*{3}\s*$|_{3}\s*$)/.test(lines[i]) && !/^\|.+\|/.test(lines[i]) && !(i + 1 < lines.length && /^=+\s*$/.test(lines[i + 1])) && !(i + 1 < lines.length && /^-{2,}\s*$/.test(lines[i + 1]))) {
+			while (i < lines.length && lines[i].trim() !== "" && !/^(#{1,6} |[-*+] |\d+\. |```)/.test(lines[i]) && !BQ_RE.test(lines[i]) && !HR_RE.test(lines[i]) && !/^\|.+\|/.test(lines[i]) && !(i + 1 < lines.length && /^=+\s*$/.test(lines[i + 1])) && !(i + 1 < lines.length && /^-{2,}\s*$/.test(lines[i + 1]))) {
 				paraLines.push(lines[i]);
 				i++;
 			}
-			if (paraLines.length) out.push(`<p>${_inline(paraLines.join(" "))}</p>`);
+			if (paraLines.length) out.push(`<p>${_inline(_joinParagraphLines(paraLines)).replaceAll(HARD_BREAK, "<br>")}</p>`);
 		}
 		return out.join("");
 	}
@@ -5493,23 +5579,77 @@
 		};
 	}
 	/**
-	* Splits a GFM table row string into trimmed cell strings.
-	* '| a | b | c |' → ['a', 'b', 'c']
+	* Joins a paragraph's source lines into one string, converting CommonMark
+	* hard-break markers (a trailing backslash, or 2+ trailing spaces) on all
+	* but the last line into a HARD_BREAK placeholder instead of a plain space.
+	* @param {string[]} paraLines
+	* @returns {string}
+	*/
+	function _joinParagraphLines(paraLines) {
+		let joined = "";
+		for (let idx = 0; idx < paraLines.length; idx++) {
+			const isLast = idx === paraLines.length - 1;
+			const ln = paraLines[idx];
+			if (!isLast && /\\$/.test(ln)) {
+				joined += ln.replace(/\\$/, "") + HARD_BREAK;
+				continue;
+			}
+			if (!isLast && / {2,}$/.test(ln)) {
+				joined += ln.replace(/ {2,}$/, "") + HARD_BREAK;
+				continue;
+			}
+			joined += ln + (isLast ? "" : " ");
+		}
+		return joined;
+	}
+	/**
+	* Splits a GFM table row string into trimmed cell strings, treating an
+	* escaped pipe (`\|`) as a literal character rather than a cell separator.
+	* '| a | b | c |' → ['a', 'b', 'c']; '| a\|b | c |' → ['a|b', 'c']
 	* @param {string} row
 	* @returns {string[]}
 	*/
 	function _parseTableRow(row) {
-		return row.replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+		const trimmed = row.replace(/^\|/, "").replace(/\|$/, "");
+		const cells = [];
+		let cur = "";
+		for (let i = 0; i < trimmed.length; i++) {
+			if (trimmed[i] === "\\" && trimmed[i + 1] === "|") {
+				cur += "|";
+				i++;
+				continue;
+			}
+			if (trimmed[i] === "|") {
+				cells.push(cur);
+				cur = "";
+				continue;
+			}
+			cur += trimmed[i];
+		}
+		cells.push(cur);
+		return cells.map((c) => c.trim());
 	}
 	function _parseListBlock(lines, startIdx) {
 		const baseIndent = lines[startIdx].match(/^(\s*)/)[1].length;
 		const isOL = /^\s*\d+\. /.test(lines[startIdx]);
 		const items = [];
 		let firstIsCB = null;
+		let loose = false;
+		let pendingBlank = false;
 		let i = startIdx;
 		while (i < lines.length) {
 			const line = lines[i];
-			if (line.trim() === "") break;
+			if (line.trim() === "") {
+				const next = lines[i + 1];
+				const nextIndent = next !== void 0 ? next.match(/^(\s*)/)[1].length : -1;
+				const nextIsSameItem = next !== void 0 && /^\s*(?:[-*+]|\d+\.) /.test(next) && /^\s*\d+\. /.test(next) === isOL && nextIndent === baseIndent;
+				const nextIsContinuation = next !== void 0 && next.trim() !== "" && nextIndent > baseIndent;
+				if (!items.length || !nextIsSameItem && !nextIsContinuation) break;
+				loose = true;
+				pendingBlank = true;
+				i++;
+				continue;
+			}
 			const indent = line.match(/^(\s*)/)[1].length;
 			if (indent < baseIndent) break;
 			if (indent === baseIndent) {
@@ -5522,11 +5662,12 @@
 				const checked = isCB && raw[1].toLowerCase() === "x";
 				const text = isCB ? raw.replace(/^\[[ xX]\]\s+/, "") : raw;
 				items.push({
-					text,
+					paras: [text],
 					isCB,
 					checked,
 					sub: ""
 				});
+				pendingBlank = false;
 				i++;
 			} else {
 				if (!items.length) {
@@ -5537,53 +5678,143 @@
 					const nested = _parseListBlock(lines, i);
 					items[items.length - 1].sub += nested.html;
 					i = nested.endIdx;
+					pendingBlank = false;
+				} else if (pendingBlank) {
+					items[items.length - 1].paras.push(line.trim());
+					pendingBlank = false;
+					i++;
 				} else {
-					items[items.length - 1].text += " " + line.trim();
+					const paras = items[items.length - 1].paras;
+					paras[paras.length - 1] += " " + line.trim();
 					i++;
 				}
 			}
 		}
-		const open = isOL ? "<ol>" : !isOL && firstIsCB === true ? "<ul class=\"an-checklist\">" : "<ul>";
+		const hasCB = !isOL && firstIsCB === true;
+		const startMatch = isOL ? /^\s*(\d+)\. /.exec(lines[startIdx]) : null;
+		const startNum = startMatch ? Number.parseInt(startMatch[1], 10) : 1;
+		const open = isOL ? startNum !== 1 ? `<ol start="${startNum}">` : "<ol>" : hasCB ? "<ul class=\"an-checklist\">" : "<ul>";
 		const close = isOL ? "</ol>" : "</ul>";
 		return {
-			html: `${open}${items.map(({ text, isCB, checked, sub }) => {
-				return `<li>${isCB ? `<input type="checkbox" contenteditable="false"${checked ? " checked" : ""}>` : ""}${_inline(text)}${sub}</li>`;
+			html: `${open}${items.map(({ paras, isCB, checked, sub }) => {
+				const cbHTML = isCB ? `<input type="checkbox" contenteditable="false"${checked ? " checked" : ""}>` : "";
+				return `<li>${loose ? paras.map((p, idx) => `<p>${idx === 0 ? cbHTML : ""}${_inline(p)}</p>`).join("") : `${cbHTML}${_inline(paras[0])}`}${sub}</li>`;
 			}).join("")}${close}`,
 			endIdx: i
 		};
 	}
-	function _inline(text) {
-		text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) => `<img src="${_escAttr(src)}" alt="${_escAttr(alt)}" class="an-image">`);
-		text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, href) => `<a href="${_escAttr(href)}">${_esc(label)}</a>`);
+	var ESCAPABLE_RE = /\\([*_`#[\]()>\\~|])/g;
+	var MARK = String.fromCharCode(0);
+	/**
+	* Step 0 of _inline(): replaces backslash-escaped punctuation with inert
+	* placeholders so later syntax regexes can't match them.
+	* @param {string} text
+	* @returns {{ text: string, literals: string[] }}
+	*/
+	function _extractBackslashEscapes(text) {
+		const literals = [];
+		return {
+			text: text.replace(ESCAPABLE_RE, (_, ch) => {
+				literals.push(ch);
+				return `${MARK}${literals.length - 1}${MARK}`;
+			}),
+			literals
+		};
+	}
+	/**
+	* Restores placeholders from _extractBackslashEscapes(), HTML-escaping each
+	* literal since it's inserted directly into the output.
+	* @param {string} text
+	* @param {string[]} literals
+	* @returns {string}
+	*/
+	function _restoreBackslashEscapes(text, literals) {
+		return text.replace(new RegExp(`${MARK}(\\d+)${MARK}`, "g"), (_, idx) => _esc(literals[Number(idx)]));
+	}
+	/**
+	* Resolves images, inline links, GFM reference-style links (explicit,
+	* shortcut, and bare/implicit forms), and footnote markers. Must run on text
+	* already passed through _esc() — see _inline()'s Step 1 comment.
+	* @param {string} text
+	* @returns {string}
+	*/
+	function _resolveLinksAndFootnotes(text) {
+		text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) => `<img src="${_escAttrQuotes(src)}" alt="${_escAttrQuotes(alt)}" class="an-image">`);
+		text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, href) => `<a href="${_escAttrQuotes(href)}">${label}</a>`);
 		text = text.replace(/\[([^\]]+)\]\[([^\]]*)\]/g, (m, label, ref) => {
-			const def = _linkDefs.get((ref || label).trim().toLowerCase());
+			const def = _linkDefs.get(_unescAmpLtGt(ref || label).trim().toLowerCase());
 			if (!def) return m;
 			const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : "";
-			return `<a href="${_escAttr(def.href)}"${titleAttr}>${_esc(label)}</a>`;
+			return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
 		});
 		text = text.replace(/\[([^\]]+)\]/g, (m, label) => {
-			const def = _linkDefs.get(label.trim().toLowerCase());
+			const def = _linkDefs.get(_unescAmpLtGt(label).trim().toLowerCase());
 			if (!def) return m;
 			const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : "";
-			return `<a href="${_escAttr(def.href)}"${titleAttr}>${_esc(label)}</a>`;
+			return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
 		});
-		text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => _footnoteIds.has(id) ? `<sup>[${_esc(id)}]</sup>` : m);
-		text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-		text = text.replace(/_{3}([^_\n]+?)_{3}/g, (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-		text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${_esc(c)}</strong>`);
-		text = text.replace(/_{2}([^_\n]+?)_{2}/g, (_, c) => `<strong>${_esc(c)}</strong>`);
-		text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${_esc(c)}</em>`);
-		text = text.replace(/_([^_\n]+?)_/g, (_, c) => `<em>${_esc(c)}</em>`);
-		text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${_esc(c)}</del>`);
-		text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${_esc(c)}</code>`);
+		text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => _footnoteIds.has(_unescAmpLtGt(id)) ? `<sup>[${id}]</sup>` : m);
 		return text;
 	}
+	/**
+	* Converts angle-bracket (`<https://...>`) and bare (`https://...`)
+	* autolinks. Runs after _resolveLinksAndFootnotes() so an already-linked URL
+	* isn't reprocessed, and on already-_esc()'d text (see _inline()).
+	* @param {string} text
+	* @returns {string}
+	*/
+	function _applyAutolinks(text) {
+		text = text.replace(/&lt;(https?:\/\/[^\s&]+?)&gt;/g, (_, url) => `<a href="${_escAttrQuotes(url)}">${url}</a>`);
+		text = text.replace(/(^|[\s(])(https?:\/\/[^\s()]+)/g, (m, pre, rawUrl) => {
+			const trail = /[.,;:!?)]+$/.exec(rawUrl);
+			const url = trail ? rawUrl.slice(0, -trail[0].length) : rawUrl;
+			if (!url) return m;
+			const suffix = trail ? trail[0] : "";
+			return `${pre}<a href="${_escAttrQuotes(url)}">${url}</a>${suffix}`;
+		});
+		return text;
+	}
+	/**
+	* Applies bold/italic/bold-italic (asterisk and underscore forms — underscore
+	* requires a non-word-character boundary per CommonMark), strikethrough, and
+	* inline code.
+	* @param {string} text
+	* @returns {string}
+	*/
+	function _applyEmphasisAndCode(text) {
+		text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${c}</em></strong>`);
+		text = text.replace(/(?<!\w)_{3}([^_\n]+?)_{3}(?!\w)/g, (_, c) => `<strong><em>${c}</em></strong>`);
+		text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${c}</strong>`);
+		text = text.replace(/(?<!\w)_{2}([^_\n]+?)_{2}(?!\w)/g, (_, c) => `<strong>${c}</strong>`);
+		text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${c}</em>`);
+		text = text.replace(/(?<!\w)_([^_\n]+?)_(?!\w)/g, (_, c) => `<em>${c}</em>`);
+		text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${c}</del>`);
+		text = text.replace(/``([\s\S]*?)``/g, (_, c) => `<code>${c}</code>`);
+		text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${c}</code>`);
+		return text;
+	}
+	function _inline(text) {
+		const { text: withoutEscapes, literals } = _extractBackslashEscapes(text);
+		let result = _esc(withoutEscapes);
+		result = _resolveLinksAndFootnotes(result);
+		result = _applyAutolinks(result);
+		result = _applyEmphasisAndCode(result);
+		return _restoreBackslashEscapes(result, literals);
+	}
 	function _esc(v) {
 		return String(v).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 	}
 	function _escAttr(v) {
 		return String(v).replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 	}
+	/** Escapes only quote characters — for attribute values already run through _esc(). */
+	function _escAttrQuotes(v) {
+		return String(v).replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+	}
+	/** Reverses _esc()'s &amp;/&lt;/&gt; substitutions, for matching against un-escaped _linkDefs/_footnoteIds keys. */
+	function _unescAmpLtGt(v) {
+		return String(v).replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+	}
 	//#endregion
 	//#region src/js/core/detectLang.js
 	/**
@@ -7139,6 +7370,17 @@
 			return doc.body.innerHTML;
 		}
 		/**
+		* Checks whether an HTML payload has no semantic markup beyond plain
+		* wrapper elements (e.g. a bare <div>/<p>). Used to decide whether a
+		* markdown-shaped plain-text paste should win over an accompanying HTML
+		* payload that isn't actually carrying any real rich-text formatting.
+		* @param {string} html
+		* @returns {boolean}
+		*/
+		_isTriviallyPlainHtml(html) {
+			return !new DOMParser().parseFromString(`<body>${html}</body>`, "text/html").body.querySelector("a,img,table,ul,ol,li,blockquote,pre,code,h1,h2,h3,h4,h5,h6,strong,b,em,i,u,s,del,strike,hr,br");
+		}
+		/**
 		* Forces the next paste operation to strip all HTML formatting.
 		* Called by Editor when Ctrl+Shift+V is pressed.
 		* @param {boolean} val
@@ -7155,8 +7397,16 @@
 			if (maxBytes > 0) {
 				const text = clipboardData.getData("text/plain") || "";
 				const html = clipboardData.getData("text/html") || "";
-				if (Math.max(text.length, html.length) > maxBytes) {
+				const size = Math.max(text.length, html.length);
+				if (size > maxBytes) {
 					event.preventDefault();
+					const message = `Pasted content (${size} bytes) exceeds the ${this.options.maxPasteSize ?? 5} MB paste size limit.`;
+					this.context.triggerEvent("pasteError", {
+						size,
+						maxBytes,
+						message
+					});
+					console.warn(`[AutumnNote] ${message}`);
 					return;
 				}
 			}
@@ -7179,9 +7429,12 @@
 				this.context.invoke("editor.afterCommand");
 				return;
 			}
-			if (this.options.markdownPaste !== false && !clipboardData.types.includes("text/html")) {
+			if (this.options.markdownPaste !== false) {
+				const hasHtml = clipboardData.types.includes("text/html");
+				const html = hasHtml ? clipboardData.getData("text/html") : "";
+				const htmlTriviallyPlain = !hasHtml || this._isTriviallyPlainHtml(html);
 				const text = clipboardData.getData("text/plain");
-				if (text && isMarkdown(text)) {
+				if (text && htmlTriviallyPlain && isMarkdown(text)) {
 					event.preventDefault();
 					execCommand("insertHTML", sanitiseHTML(markdownToHTML(text)));
 					this.context.invoke("editor.afterCommand");
@@ -7214,11 +7467,51 @@
 			const dt = event.dataTransfer;
 			if (!dt?.files?.length) return;
 			const imageFiles = Array.from(dt.files).filter((f) => f.type.startsWith("image/"));
-			if (imageFiles.length === 0) return;
-			event.preventDefault();
-			event.stopPropagation();
-			this._placeCaretAtPoint(event.clientX, event.clientY);
-			this._insertImageFiles(imageFiles);
+			if (imageFiles.length > 0) {
+				event.preventDefault();
+				event.stopPropagation();
+				this._placeCaretAtPoint(event.clientX, event.clientY);
+				this._insertImageFiles(imageFiles);
+				return;
+			}
+			if (this.options.markdownPaste !== false) {
+				const mdFile = Array.from(dt.files).find((f) => /\.md$/i.test(f.name) || f.type === "text/markdown");
+				if (mdFile) {
+					event.preventDefault();
+					event.stopPropagation();
+					this._placeCaretAtPoint(event.clientX, event.clientY);
+					this._insertMarkdownFile(mdFile);
+				}
+			}
+		}
+		/**
+		* Reads a dropped `.md` File and inserts it converted to HTML at the
+		* current caret. Skips the isMarkdown() heuristic — an explicit `.md`
+		* extension/MIME type is an unambiguous signal, unlike pasted plain text.
+		* @param {File} file
+		*/
+		_insertMarkdownFile(file) {
+			const maxBytes = (this.options.maxPasteSize ?? 5) * 1024 * 1024;
+			if (maxBytes > 0 && file.size > maxBytes) {
+				const message = `Dropped file "${file.name}" (${file.size} bytes) exceeds the ${this.options.maxPasteSize ?? 5} MB paste size limit.`;
+				this.context.triggerEvent("pasteError", {
+					size: file.size,
+					maxBytes,
+					message
+				});
+				console.warn(`[AutumnNote] ${message}`);
+				return;
+			}
+			const reader = new FileReader();
+			reader.onload = (e) => {
+				execCommand("insertHTML", sanitiseHTML(markdownToHTML(
+					/** @type {string} */
+					e.target.result || ""
+				)));
+				this.context.invoke("editor.afterCommand");
+			};
+			reader.onerror = () => console.warn("[AutumnNote] Failed to read dropped markdown file", file.name);
+			reader.readAsText(file);
 		}
 		/**
 		* Inserts one or more image Files into the editor.
@@ -17256,7 +17549,7 @@
 		/** All pre-built button definitions — accessible in every module format including UMD/CJS. */
 		buttons,
 		/** Library version */
-		version: "1.10.0"
+		version: "1.11.1"
 	};
 	/**
 	* @param {string|Element|NodeList|Element[]} selector