autumnnote 1.9.1 → 1.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autumnnote",
-  "version": "1.9.1",
+  "version": "1.11.0",
   "description": "WYSIWYG rich-text editor built with vanilla JavaScript — zero dependencies, no jQuery. Dark mode, @mention, markdown shortcuts, bubble toolbar. React and Vue 3 wrappers included.",
   "main": "dist/autumnnote.umd.js",
   "module": "dist/autumnnote.es.js",

package/src/js/core/markdown.js

@@ -31,6 +31,18 @@ export function htmlToMarkdown(html) {
  * @param {number} [depth=0] - Current nesting depth used to indent nested list items.
  * @returns {string} The Markdown representation of the node subtree.
  */
+/**
+ * Direct child elements matching a tag name. Used instead of the CSS
+ * `:scope > tag` combinator, which this project's jsdom version resolves
+ * incorrectly (matches descendants at any depth, not just direct children).
+ * @param {Element} el
+ * @param {string} tagName
+ * @returns {Element[]}
+ */
+function _directChildren(el, tagName) {
+  return Array.from(el.children).filter((c) => c.tagName === tagName.toUpperCase());
+}
+
 function _domToMd(node, depth = 0) {
   if (node.nodeType === 3) {
     return node.textContent.replace(/\s+/g, ' ');
@@ -60,6 +72,18 @@ function _domToMd(node, depth = 0) {
     case 'strike':   return `~~${inner()}~~`;
     case 'sup':      return `^${inner()}^`;
     case 'sub':      return `~${inner()}~`;
+    case 'u':        return `<u>${inner()}</u>`;
+    case 'span': {
+      // Markdown has no native underline/color/size syntax; pass through as
+      // raw inline HTML for the specific styles the editor's own toolbar
+      // creates (foreColor/backColor/fontSize) — other noise spans (e.g. from
+      // pasted content) are unwrapped to plain text as before.
+      const style = el.getAttribute('style') || '';
+      if (/\b(color|background-color|font-size)\s*:/.test(style)) {
+        return `<span style="${_escAttr(style)}">${inner()}</span>`;
+      }
+      return inner();
+    }
     case 'code': {
       // Inside <pre> we emit raw text; outside we wrap in backticks
       if (el.closest('pre')) return inner();
@@ -73,8 +97,10 @@ function _domToMd(node, depth = 0) {
       return `\n\n\`\`\`${lang}\n${content}\n\`\`\`\n\n`;
     }
     case 'blockquote': {
-      const lines = inner().trim().split('\n');
-      return `\n\n${lines.map((l) => `> ${l}`).join('\n')}\n\n`;
+      const rawLines = inner().trim().split('\n');
+      // Collapse consecutive blank lines (from adjacent <p> blocks) into one.
+      const lines = rawLines.filter((l, idx) => l.trim() !== '' || (rawLines[idx - 1] ?? '').trim() !== '');
+      return `\n\n${lines.map((l) => (l.trim() === '' ? '>' : `> ${l}`)).join('\n')}\n\n`;
     }
     case 'a': {
       const href = el.getAttribute('href') || '';
@@ -86,14 +112,16 @@ function _domToMd(node, depth = 0) {
       return `![${alt}](${src})`;
     }
     case 'ul': {
-      const items = Array.from(el.querySelectorAll(':scope > li'));
+      const items = _directChildren(el, 'li');
       if (!items.length) return inner();
       const indent = '  '.repeat(depth);
       const isChecklist = el.classList.contains('an-checklist');
       const lines = items.map((li) => {
+        const cb = /** @type {HTMLInputElement | undefined} */ (
+          _directChildren(li, 'input').find((c) => c.getAttribute('type') === 'checkbox')
+        );
         let prefix = '- ';
-        if (isChecklist) {
-          const cb = /** @type {HTMLInputElement | null} */ (li.querySelector('input[type="checkbox"]'));
+        if (isChecklist || cb) {
           const checked = cb ? cb.checked : false;
           prefix = checked ? '- [x] ' : '- [ ] ';
         }
@@ -102,7 +130,7 @@ function _domToMd(node, depth = 0) {
       return depth === 0 ? `\n\n${lines}\n\n` : `\n${lines}`;
     }
     case 'ol': {
-      const items = Array.from(el.querySelectorAll(':scope > li'));
+      const items = _directChildren(el, 'li');
       if (!items.length) return inner();
       const indent = '  '.repeat(depth);
       const lines = items.map((li, i) => `${indent}${i + 1}. ${_domToMd(li, depth + 1).trim()}`).join('\n');
@@ -111,17 +139,24 @@ function _domToMd(node, depth = 0) {
     case 'li':  return inner();
     case 'hr':  return '\n\n---\n\n';
     case 'table': {
-      const rows = Array.from(el.querySelectorAll('tr'));
-      if (!rows.length) return inner();
-      const cellTexts = rows.map((tr) =>
+      const allRows = Array.from(el.querySelectorAll('tr'));
+      if (!allRows.length) return inner();
+      const theadEl = _directChildren(el, 'thead')[0];
+      const firstRowIsHeader = !!theadEl || (
+        allRows[0].children.length > 0 &&
+        Array.from(allRows[0].children).every((c) => c.tagName === 'TH')
+      );
+      const cellTexts = allRows.map((tr) =>
         Array.from(tr.querySelectorAll('th, td')).map((c) => c.textContent.trim().replaceAll('|', String.raw`\|`)),
       );
       const cols = Math.max(...cellTexts.map((r) => r.length));
       const padRow = (row) => { const r = [...row]; while (r.length < cols) r.push(''); return r; };
+      const bodyStart = firstRowIsHeader ? 1 : 0;
+      const headerCells = firstRowIsHeader ? padRow(cellTexts[0]) : new Array(cols).fill('');
       let md = '\n\n';
-      md += `| ${padRow(cellTexts[0]).join(' | ')} |\n`;
+      md += `| ${headerCells.join(' | ')} |\n`;
       md += `| ${new Array(cols).fill('---').join(' | ')} |\n`;
-      for (let r = 1; r < cellTexts.length; r++) {
+      for (let r = bodyStart; r < cellTexts.length; r++) {
         md += `| ${padRow(cellTexts[r]).join(' | ')} |\n`;
       }
       return md + '\n';
@@ -139,18 +174,45 @@ function _domToMd(node, depth = 0) {
  * @returns {boolean} `true` if any Markdown-like pattern is present, `false` otherwise.
  */
 export function isMarkdown(text) {
-  return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> [^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text)
+  return /^#{1,6} [^\s]|^[ \t]*[-*+] [^\s]|^[ \t]*\d+\. [^\s]|^> ?[^\s]|^```|^\*{2}[^*\n]+\*{2}/m.test(text)
     || /^.+\n=+\s*$/m.test(text)
-    || /^.+\n-{2,}\s*$/m.test(text);
+    || /^.+\n-{2,}\s*$/m.test(text)
+    || /^---\s*\n(?:[\s\S]*?\n)?(?:---|\.\.\.)\s*(?:\n|$)/.test(text)
+    || /^\|.+\|[ \t]*\n\|[ \t:|-]+\|/m.test(text);
 }
 
+// Blockquote line: optional up-to-3 leading spaces, '>', optional single space, rest of line.
+const BQ_RE = /^ {0,3}>( ?)(.*)$/;
+// Horizontal rule: 3+ of the same character (-, * or _), optionally space-separated.
+const HR_RE = /^ {0,3}([-*_])( *\1){2,}\s*$/;
+// Hard-break marker — placed between paragraph lines that end in a
+// CommonMark hard-break (trailing 2+ spaces or a trailing backslash),
+// restored to <br> after _inline() runs. Distinct from _inline()'s own MARK.
+const HARD_BREAK = String.fromCharCode(1);
+
 /**
  * Converts a Markdown string to an HTML string.
  * @param {string} text
  * @returns {string}
  */
 export function markdownToHTML(text) {
-  const lines = text.replaceAll('\r\n', '\n').replaceAll('\r', '\n').split('\n');
+  let lines = text.replaceAll('\r\n', '\n').replaceAll('\r', '\n').split('\n');
+  lines = _stripFrontmatter(lines);
+  const refs = _extractReferenceDefinitions(lines);
+  lines = refs.clean;
+  _linkDefs = refs.linkDefs;
+  _footnoteIds = refs.footnoteIds;
+  return _parseBlocks(lines);
+}
+
+/**
+ * Parses a line array into block-level HTML. Called recursively for content
+ * nested inside a blockquote so nested quotes and block content (lists,
+ * headings, etc.) inside `>` are parsed the same as top-level content.
+ * @param {string[]} lines
+ * @returns {string}
+ */
+function _parseBlocks(lines) {
   const out = [];
   let i = 0;
 
@@ -174,7 +236,7 @@ export function markdownToHTML(text) {
     }
 
     // ---- Setext headings (Title\n=== or Title\n---) -------------------------
-    if (line.trim() && !/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
+    if (line.trim() && !HR_RE.test(line) && !/^#{1,6} /.test(line) && i + 1 < lines.length) {
       if (/^=+\s*$/.test(lines[i + 1])) {
         out.push(`<h1>${_inline(line.trim())}</h1>`);
         i += 2;
@@ -187,8 +249,8 @@ export function markdownToHTML(text) {
       }
     }
 
-    // ---- Horizontal rule --- / *** / _________________________________________
-    if (/^(-{3,}|\*{3,}|_{3,})\s*$/.test(line)) {
+    // ---- Horizontal rule --- / *** / ___ / - - - / * * * ----------------------
+    if (HR_RE.test(line)) {
       out.push('<hr>');
       i++;
       continue;
@@ -198,19 +260,22 @@ export function markdownToHTML(text) {
     const hMatch = /^(#{1,6})\s+(.+)$/.exec(line);
     if (hMatch) {
       const level = hMatch[1].length;
-      out.push(`<h${level}>${_inline(hMatch[2])}</h${level}>`);
+      // Strip an optional closing sequence of #'s (e.g. "## Heading ##"),
+      // only when preceded by whitespace — "Heading#" (no space) is untouched.
+      const content = hMatch[2].replace(/(?:^|\s)#+\s*$/, '');
+      out.push(`<h${level}>${_inline(content)}</h${level}>`);
       i++;
       continue;
     }
 
     // ---- Blockquote  > text --------------------------------------------------
-    if (line.startsWith('> ')) {
+    if (BQ_RE.test(line)) {
       const bqLines = [];
-      while (i < lines.length && lines[i].startsWith('> ')) {
-        bqLines.push(lines[i].slice(2));
+      while (i < lines.length && BQ_RE.test(lines[i])) {
+        bqLines.push(BQ_RE.exec(lines[i])[2]);
         i++;
       }
-      out.push(`<blockquote>${bqLines.map(_inline).join('<br>')}</blockquote>`);
+      out.push(`<blockquote>${_parseBlocks(bqLines)}</blockquote>`);
       continue;
     }
 
@@ -266,7 +331,9 @@ export function markdownToHTML(text) {
     while (
       i < lines.length &&
       lines[i].trim() !== '' &&
-      !/^(#{1,6} |> |[-*+] |\d+\. |```|---\s*$|\*{3}\s*$|_{3}\s*$)/.test(lines[i]) &&
+      !/^(#{1,6} |[-*+] |\d+\. |```)/.test(lines[i]) &&
+      !BQ_RE.test(lines[i]) &&
+      !HR_RE.test(lines[i]) &&
       !/^\|.+\|/.test(lines[i]) &&
       !(i + 1 < lines.length && /^=+\s*$/.test(lines[i + 1])) &&
       !(i + 1 < lines.length && /^-{2,}\s*$/.test(lines[i + 1]))
@@ -275,7 +342,7 @@ export function markdownToHTML(text) {
       i++;
     }
     if (paraLines.length) {
-      out.push(`<p>${_inline(paraLines.join(' '))}</p>`);
+      out.push(`<p>${_inline(_joinParagraphLines(paraLines)).replaceAll(HARD_BREAK, '<br>')}</p>`);
     }
   }
 
@@ -286,18 +353,105 @@ export function markdownToHTML(text) {
 // Inline formatting
 // ---------------------------------------------------------------------------
 
+/** Reference-link and footnote definitions collected per markdownToHTML() call. */
+let _linkDefs = new Map();
+let _footnoteIds = new Set();
+
+/**
+ * Strips a leading YAML frontmatter block (--- ... --- or --- ... ...) from
+ * the line array, only when it is the very first line and the enclosed body
+ * looks like YAML (key: value / list items / indented continuations) — this
+ * disambiguates real frontmatter from a horizontal rule followed by prose.
+ * @param {string[]} lines
+ * @returns {string[]}
+ */
+function _stripFrontmatter(lines) {
+  if ((lines[0] || '').trim() !== '---') return lines;
+  let closeIdx = -1;
+  for (let j = 1; j < lines.length; j++) {
+    const t = lines[j].trim();
+    if (t === '---' || t === '...') { closeIdx = j; break; }
+  }
+  if (closeIdx === -1) return lines;
+
+  const body = lines.slice(1, closeIdx);
+  const looksLikeYAML = body.every((l) =>
+    l.trim() === '' ||
+    /^[ \t]*[\w$.-]+\s*:(\s|$)/.test(l) ||
+    /^[ \t]*-\s+\S/.test(l) ||
+    /^[ \t]+\S/.test(l));
+  if (!looksLikeYAML) return lines;
+
+  let start = closeIdx + 1;
+  if (lines[start] !== undefined && lines[start].trim() === '') start++;
+  return lines.slice(start);
+}
+
 /**
- * Splits a GFM table row string into trimmed cell strings.
- * '| a | b | c |' → ['a', 'b', 'c']
+ * Extracts GFM reference-link definitions (`[ref]: url "title"`) and footnote
+ * definitions (`[^id]: text`) from the line array, skipping fenced code
+ * regions. Returns the definition-free line array plus lookup maps.
+ * @param {string[]} lines
+ * @returns {{ clean: string[], linkDefs: Map<string, {href: string, title?: string}>, footnoteIds: Set<string> }}
+ */
+function _extractReferenceDefinitions(lines) {
+  const linkDefs = new Map();
+  const footnoteIds = new Set();
+  const clean = [];
+  let inFence = false;
+  const linkDefRe = /^\[([^\]]+)\]:\s*(\S+)(?:\s+"([^"]*)")?\s*$/;
+  const footnoteDefRe = /^\[\^([^\]]+)\]:\s*(.+)$/;
+
+  for (const line of lines) {
+    if (/^```/.test(line)) { inFence = !inFence; clean.push(line); continue; }
+    if (!inFence) {
+      const fm = footnoteDefRe.exec(line);
+      if (fm) { footnoteIds.add(fm[1]); continue; }
+      const lm = linkDefRe.exec(line);
+      if (lm) { linkDefs.set(lm[1].trim().toLowerCase(), { href: lm[2], title: lm[3] }); continue; }
+    }
+    clean.push(line);
+  }
+  return { clean, linkDefs, footnoteIds };
+}
+
+/**
+ * Joins a paragraph's source lines into one string, converting CommonMark
+ * hard-break markers (a trailing backslash, or 2+ trailing spaces) on all
+ * but the last line into a HARD_BREAK placeholder instead of a plain space.
+ * @param {string[]} paraLines
+ * @returns {string}
+ */
+function _joinParagraphLines(paraLines) {
+  let joined = '';
+  for (let idx = 0; idx < paraLines.length; idx++) {
+    const isLast = idx === paraLines.length - 1;
+    const ln = paraLines[idx];
+    if (!isLast && /\\$/.test(ln)) { joined += ln.replace(/\\$/, '') + HARD_BREAK; continue; }
+    if (!isLast && / {2,}$/.test(ln)) { joined += ln.replace(/ {2,}$/, '') + HARD_BREAK; continue; }
+    joined += ln + (isLast ? '' : ' ');
+  }
+  return joined;
+}
+
+/**
+ * Splits a GFM table row string into trimmed cell strings, treating an
+ * escaped pipe (`\|`) as a literal character rather than a cell separator.
+ * '| a | b | c |' → ['a', 'b', 'c']; '| a\|b | c |' → ['a|b', 'c']
  * @param {string} row
  * @returns {string[]}
  */
 function _parseTableRow(row) {
-  return row
-    .replace(/^\|/, '')
-    .replace(/\|$/, '')
-    .split('|')
-    .map((c) => c.trim());
+  const trimmed = row.replace(/^\|/, '').replace(/\|$/, '');
+  const cells = [];
+  let cur = '';
+  for (let i = 0; i < trimmed.length; i++) {
+    if (trimmed[i] === '\\' && trimmed[i + 1] === '|') { cur += '|'; i++; continue; }
+    if (trimmed[i] === '|') { cells.push(cur); cur = ''; continue; }
+    cur += trimmed[i];
+  }
+  cells.push(cur);
+  return cells.map((c) => c.trim());
 }
 
 function _parseListBlock(lines, startIdx) {
@@ -305,11 +459,31 @@ function _parseListBlock(lines, startIdx) {
   const isOL = /^\s*\d+\. /.test(lines[startIdx]);
   const items = [];
   let firstIsCB = null;
+  let loose = false;
+  let pendingBlank = false;
   let i = startIdx;
 
   while (i < lines.length) {
     const line = lines[i];
-    if (line.trim() === '') break;
+
+    if (line.trim() === '') {
+      // A blank line only ends the list if what follows isn't a continuation
+      // of it (another item at the same marker/indent, or indented text
+      // belonging to the current item) — otherwise it marks a "loose" list.
+      const next = lines[i + 1];
+      const nextIndent = next !== undefined ? (next.match(/^(\s*)/)[1]).length : -1;
+      const nextIsSameItem = next !== undefined &&
+        /^\s*(?:[-*+]|\d+\.) /.test(next) &&
+        (/^\s*\d+\. /.test(next) === isOL) &&
+        nextIndent === baseIndent;
+      const nextIsContinuation = next !== undefined && next.trim() !== '' && nextIndent > baseIndent;
+      if (!items.length || (!nextIsSameItem && !nextIsContinuation)) break;
+      loose = true;
+      pendingBlank = true;
+      i++;
+      continue;
+    }
+
     const indent = (line.match(/^(\s*)/)[1]).length;
     if (indent < baseIndent) break;
 
@@ -317,12 +491,18 @@ function _parseListBlock(lines, startIdx) {
       if (!/^\s*(?:[-*+]|\d+\.) /.test(line)) break;
       if (/^\s*\d+\. /.test(line) !== isOL) break;
       const raw = isOL ? line.replace(/^\s*\d+\. /, '') : line.replace(/^\s*[-*+] /, '');
+      // Checklists are intentionally UL-only: sanitise.js's checkbox guard,
+      // the injected checklist CSS, and every checklist-toggle command are
+      // all hardcoded to `ul.an-checklist` with no `ol` equivalent, so an
+      // ordered-list checkbox would be stripped by the sanitiser and get no
+      // styling even if parsed here — "1. [ ] item" intentionally stays plain.
       const isCB = !isOL && /^\[[ xX]\]\s+/.test(raw);
       if (firstIsCB === null) firstIsCB = isCB;
       if (isCB !== firstIsCB) break;
       const checked = isCB && raw[1].toLowerCase() === 'x';
       const text = isCB ? raw.replace(/^\[[ xX]\]\s+/, '') : raw;
-      items.push({ text, isCB, checked, sub: '' });
+      items.push({ paras: [text], isCB, checked, sub: '' });
+      pendingBlank = false;
       i++;
     } else {
       if (!items.length) { i++; continue; }
@@ -330,48 +510,164 @@ function _parseListBlock(lines, startIdx) {
         const nested = _parseListBlock(lines, i);
         items[items.length - 1].sub += nested.html;
         i = nested.endIdx;
+        pendingBlank = false;
+      } else if (pendingBlank) {
+        items[items.length - 1].paras.push(line.trim());
+        pendingBlank = false;
+        i++;
       } else {
-        items[items.length - 1].text += ' ' + line.trim();
+        const paras = items[items.length - 1].paras;
+        paras[paras.length - 1] += ' ' + line.trim();
         i++;
       }
     }
   }
 
   const hasCB = !isOL && (firstIsCB === true);
-  const open = isOL ? '<ol>' : hasCB ? '<ul class="an-checklist">' : '<ul>';
+  const startMatch = isOL ? /^\s*(\d+)\. /.exec(lines[startIdx]) : null;
+  const startNum = startMatch ? Number.parseInt(startMatch[1], 10) : 1;
+  const open = isOL
+    ? (startNum !== 1 ? `<ol start="${startNum}">` : '<ol>')
+    : (hasCB ? '<ul class="an-checklist">' : '<ul>');
   const close = isOL ? '</ol>' : '</ul>';
-  const liHTML = items.map(({ text, isCB, checked, sub }) => {
+  const liHTML = items.map(({ paras, isCB, checked, sub }) => {
     const cbHTML = isCB
       ? `<input type="checkbox" contenteditable="false"${checked ? ' checked' : ''}>`
       : '';
-    return `<li>${cbHTML}${_inline(text)}${sub}</li>`;
+    const body = loose
+      ? paras.map((p, idx) => `<p>${idx === 0 ? cbHTML : ''}${_inline(p)}</p>`).join('')
+      : `${cbHTML}${_inline(paras[0])}`;
+    return `<li>${body}${sub}</li>`;
   }).join('');
   return { html: `${open}${liHTML}${close}`, endIdx: i };
 }
 
-function _inline(text) {
-  // Images before links (they share [] syntax)
+// Backslash-escapable inline punctuation (CommonMark-ish, narrowed to the
+// syntax characters this converter actually uses).
+const ESCAPABLE_RE = /\\([*_`#[\]()>\\~|])/g;
+// Placeholder marker for escaped literals — a NUL character can't appear in
+// real markdown text, so it's safe as a delimiter. Built at runtime (not
+// written as a literal escape) to avoid embedding a raw NUL byte in this file.
+const MARK = String.fromCharCode(0);
+
+/**
+ * Step 0 of _inline(): replaces backslash-escaped punctuation with inert
+ * placeholders so later syntax regexes can't match them.
+ * @param {string} text
+ * @returns {{ text: string, literals: string[] }}
+ */
+function _extractBackslashEscapes(text) {
+  const literals = [];
+  const replaced = text.replace(ESCAPABLE_RE, (_, ch) => {
+    literals.push(ch);
+    return `${MARK}${literals.length - 1}${MARK}`;
+  });
+  return { text: replaced, literals };
+}
+
+/**
+ * Restores placeholders from _extractBackslashEscapes(), HTML-escaping each
+ * literal since it's inserted directly into the output.
+ * @param {string} text
+ * @param {string[]} literals
+ * @returns {string}
+ */
+function _restoreBackslashEscapes(text, literals) {
+  return text.replace(new RegExp(`${MARK}(\\d+)${MARK}`, 'g'), (_, idx) => _esc(literals[Number(idx)]));
+}
+
+/**
+ * Resolves images, inline links, GFM reference-style links (explicit,
+ * shortcut, and bare/implicit forms), and footnote markers. Must run on text
+ * already passed through _esc() — see _inline()'s Step 1 comment.
+ * @param {string} text
+ * @returns {string}
+ */
+function _resolveLinksAndFootnotes(text) {
   text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_, alt, src) =>
-    `<img src="${_escAttr(src)}" alt="${_escAttr(alt)}" class="an-image">`);
-  // Links
+    `<img src="${_escAttrQuotes(src)}" alt="${_escAttrQuotes(alt)}" class="an-image">`);
   text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, label, href) =>
-    `<a href="${_escAttr(href)}">${_esc(label)}</a>`);
-  // Bold + italic  ***text***
-  text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-  text = text.replace(/_{3}([^_\n]+?)_{3}/g,   (_, c) => `<strong><em>${_esc(c)}</em></strong>`);
-  // Bold  **text**
-  text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${_esc(c)}</strong>`);
-  text = text.replace(/_{2}([^_\n]+?)_{2}/g,   (_, c) => `<strong>${_esc(c)}</strong>`);
-  // Italic  *text*  _text_
-  text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${_esc(c)}</em>`);
-  text = text.replace(/_([^_\n]+?)_/g,   (_, c) => `<em>${_esc(c)}</em>`);
-  // Strikethrough  ~~text~~
-  text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${_esc(c)}</del>`);
-  // Inline code  `code`
-  text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${_esc(c)}</code>`);
+    `<a href="${_escAttrQuotes(href)}">${label}</a>`);
+  text = text.replace(/\[([^\]]+)\]\[([^\]]*)\]/g, (m, label, ref) => {
+    const def = _linkDefs.get(_unescAmpLtGt(ref || label).trim().toLowerCase());
+    if (!def) return m;
+    const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : '';
+    return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
+  });
+  text = text.replace(/\[([^\]]+)\]/g, (m, label) => {
+    const def = _linkDefs.get(_unescAmpLtGt(label).trim().toLowerCase());
+    if (!def) return m;
+    const titleAttr = def.title ? ` title="${_escAttr(def.title)}"` : '';
+    return `<a href="${_escAttr(def.href)}"${titleAttr}>${label}</a>`;
+  });
+  text = text.replace(/\[\^([^\]]+)\]/g, (m, id) => (_footnoteIds.has(_unescAmpLtGt(id)) ? `<sup>[${id}]</sup>` : m));
+  return text;
+}
+
+/**
+ * Converts angle-bracket (`<https://...>`) and bare (`https://...`)
+ * autolinks. Runs after _resolveLinksAndFootnotes() so an already-linked URL
+ * isn't reprocessed, and on already-_esc()'d text (see _inline()).
+ * @param {string} text
+ * @returns {string}
+ */
+function _applyAutolinks(text) {
+  text = text.replace(/&lt;(https?:\/\/[^\s&]+?)&gt;/g, (_, url) => `<a href="${_escAttrQuotes(url)}">${url}</a>`);
+  text = text.replace(/(^|[\s(])(https?:\/\/[^\s()]+)/g, (m, pre, rawUrl) => {
+    const trail = /[.,;:!?)]+$/.exec(rawUrl);
+    const url = trail ? rawUrl.slice(0, -trail[0].length) : rawUrl;
+    if (!url) return m;
+    const suffix = trail ? trail[0] : '';
+    return `${pre}<a href="${_escAttrQuotes(url)}">${url}</a>${suffix}`;
+  });
+  return text;
+}
+
+/**
+ * Applies bold/italic/bold-italic (asterisk and underscore forms — underscore
+ * requires a non-word-character boundary per CommonMark), strikethrough, and
+ * inline code.
+ * @param {string} text
+ * @returns {string}
+ */
+function _applyEmphasisAndCode(text) {
+  text = text.replace(/\*{3}([^*\n]+?)\*{3}/g, (_, c) => `<strong><em>${c}</em></strong>`);
+  text = text.replace(/(?<!\w)_{3}([^_\n]+?)_{3}(?!\w)/g, (_, c) => `<strong><em>${c}</em></strong>`);
+  text = text.replace(/\*{2}([^*\n]+?)\*{2}/g, (_, c) => `<strong>${c}</strong>`);
+  text = text.replace(/(?<!\w)_{2}([^_\n]+?)_{2}(?!\w)/g, (_, c) => `<strong>${c}</strong>`);
+  text = text.replace(/\*([^*\n]+?)\*/g, (_, c) => `<em>${c}</em>`);
+  text = text.replace(/(?<!\w)_([^_\n]+?)_(?!\w)/g, (_, c) => `<em>${c}</em>`);
+  text = text.replace(/~~([^~\n]+?)~~/g, (_, c) => `<del>${c}</del>`);
+  // Double-backtick code spans first (tolerates a single literal ` inside),
+  // then single-backtick spans.
+  text = text.replace(/``([\s\S]*?)``/g, (_, c) => `<code>${c}</code>`);
+  text = text.replace(/`([^`]+)`/g, (_, c) => `<code>${c}</code>`);
   return text;
 }
 
+function _inline(text) {
+  // Step 0: backslash escapes (\* \_ \` \# \[ \] \( \) \> \\ \~ \|) — replaced
+  // with inert placeholders before any syntax regex below can match them, so
+  // e.g. \*not bold\* never gets treated as emphasis. Restored at the end.
+  const { text: withoutEscapes, literals } = _extractBackslashEscapes(text);
+
+  // Step 1: escape raw &/</> in the plain-text parts of the string exactly
+  // once, up front — none of these are markdown-syntax characters used below,
+  // so this doesn't interfere with matching. Capture-group content in the
+  // steps below is therefore ALREADY escaped and must NOT be re-escaped;
+  // attribute values captured from `text` only need quotes escaped
+  // (_escAttrQuotes), since & < > are already entities. Values that come from
+  // _linkDefs (sourced from the raw, unescaped line array) still need the
+  // full _escAttr/_esc treatment.
+  let result = _esc(withoutEscapes);
+
+  result = _resolveLinksAndFootnotes(result);
+  result = _applyAutolinks(result);
+  result = _applyEmphasisAndCode(result);
+
+  return _restoreBackslashEscapes(result, literals);
+}
+
 function _esc(v) {
   return String(v)
     .replaceAll('&', '&amp;')
@@ -387,3 +683,13 @@ function _escAttr(v) {
     .replaceAll('<', '&lt;')
     .replaceAll('>', '&gt;');
 }
+
+/** Escapes only quote characters — for attribute values already run through _esc(). */
+function _escAttrQuotes(v) {
+  return String(v).replaceAll('"', '&quot;').replaceAll("'", '&#39;');
+}
+
+/** Reverses _esc()'s &amp;/&lt;/&gt; substitutions, for matching against un-escaped _linkDefs/_footnoteIds keys. */
+function _unescAmpLtGt(v) {
+  return String(v).replaceAll('&lt;', '<').replaceAll('&gt;', '>').replaceAll('&amp;', '&');
+}

package/src/js/index.js

@@ -144,7 +144,7 @@ const AutumnNote = {
   buttons,
 
   /** Library version */
-  version: '1.9.1',
+  version: '1.11.0',
 };
 
 // ---------------------------------------------------------------------------