malice

export interface UrlPreview {

  href: string;

  display: string;

  hostname: string;

  path: string;

}

const MAX_LINKS = 4;

const MAX_URL_LENGTH = 2048;

const TRAILING_PUNCT = /[.,;:!?'"~…—–-]+$/u;

function countChar(text: string, char: string): number {

  let count = 0;

  for (const c of text) if (c === char) count += 1;

  return count;

}

function trimUrl(raw: string): string {

  let out = raw;

  let changed = true;

  while (changed && out.length > 0) {

    changed = false;

    const stripped = out.replace(TRAILING_PUNCT, '');

    if (stripped !== out) {

      out = stripped;

      changed = true;

    }

    // Strip a trailing closer only when it has no matching opener left in

    // the URL itself, so "(https://x/a_(b))" keeps the inner pair and drops

    // the outer markdown/paren closer.

    const pairs: Array<[string, string]> = [

      ['(', ')'],

      ['[', ']'],

      ['{', '}']

    ];

    for (const [open, close] of pairs) {

      if (out.endsWith(close) && countChar(out, close) > countChar(out, open)) {

        out = out.slice(0, -1);

        changed = true;

      }

    }

    if (out.endsWith('>')) {

      out = out.slice(0, -1);

      changed = true;

    }

  }

  return out;

}

/**

 * Find http(s) URLs in message text without fetching anything: rendering is

 * purely local (hostname/path/link card) so no third-party request can leak

 * reader IPs. Callers MUST NOT auto-fetch link targets.

 */

export function findUrls(text: string): UrlPreview[] {

  if (!text || !text.includes('http')) return [];

  const out: UrlPreview[] = [];

  const seen = new Set<string>();

  const pattern = /https?:\/\/[^\s<>"'`\]]+/gi;

  let match: RegExpExecArray | null;

  while (out.length < MAX_LINKS && (match = pattern.exec(text)) !== null) {

    let candidate = match[0];

    if (candidate.length > MAX_URL_LENGTH) candidate = candidate.slice(0, MAX_URL_LENGTH);

    const trimmed = trimUrl(candidate);

    if (trimmed.length < 8) continue;

    let parsed: URL | null = null;

    try {

      parsed = new URL(trimmed);

    } catch {

      continue;

    }

    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') continue;

    const href = parsed.toString();

    if (seen.has(href)) continue;

    seen.add(href);

    const rest = `${parsed.pathname}${parsed.search}${parsed.hash}`;

    out.push({

      href,

      display: trimmed.length > 72 ? `${trimmed.slice(0, 69)}…` : trimmed,

      hostname: parsed.hostname,

      path: rest && rest !== '/' ? (rest.length > 48 ? `${rest.slice(0, 45)}…` : rest) : ''

    });

  }

  return out;

}