expensify-common 2.0.206 → 2.0.207

package/dist/ExpensiMark.d.ts

@@ -24,7 +24,7 @@ type Extras = {
 export type { Extras };
 type ReplacementFn = (extras: Extras, ...matches: string[]) => string;
 type Replacement = ReplacementFn | string;
-type ProcessFn = (textToProcess: string, replacement: Replacement, shouldKeepRawInput: boolean) => string;
+type ProcessFn = (textToProcess: string, replacement: Replacement, shouldKeepRawInput: boolean, shouldEscapeText: boolean) => string;
 type CommonRule = {
     name: string;
     replacement: Replacement;

package/dist/ExpensiMark.js

@@ -41,6 +41,7 @@ const str_1 = __importDefault(require("./str"));
 const Constants = __importStar(require("./CONST"));
 const UrlPatterns = __importStar(require("./Url"));
 const Logger_1 = __importDefault(require("./Logger"));
+const tlds_1 = __importDefault(require("./tlds"));
 const Utils = __importStar(require("./utils"));
 const EXTRAS_DEFAULT = {};
 // These constants represent the ASCII ranges for digits (0-9) and letters (A-Z, a-z).
@@ -54,6 +55,10 @@ const ASCII_WHITESPACE_END = ' '.charCodeAt(0);
 const NON_BREAKING_SPACE_CODE = 160;
 const URL_PROTOCOLS = ['https://', 'http://', 'ftps://', 'ftp://'];
 const URL_CANDIDATE_PREFIX_CHARACTERS = '@_*~';
+const URL_TLD_LIST = tlds_1.default.toLowerCase().split('|');
+const URL_TLDS = new Set(URL_TLD_LIST);
+// Caps TLD scanning at the longest known TLD so long invalid URL-like text avoids expensive regex work.
+const MAX_URL_TLD_LENGTH = Math.max(...URL_TLD_LIST.map((tld) => tld.length));
 const PROTECTED_TAG_NAMES = new Set(['a', 'code', 'pre', 'video']);
 const MARKDOWN_LINK_REGEX = new RegExp(`\\[((?:[^\\[\\]\\r\\n]*(?:\\[[^\\[\\]\\r\\n]*][^\\[\\]\\r\\n]*)*))]\\(${UrlPatterns.MARKDOWN_URL_REGEX}\\)(?![^<]*(<\\/pre>|<\\/code>))`, 'gi');
 const MARKDOWN_IMAGE_REGEX = new RegExp(`\\!(?:\\[([^\\][]*(?:\\[[^\\][]*][^\\][]*)*)])?\\(${UrlPatterns.MARKDOWN_URL_REGEX}\\)(?![^<]*(<\\/pre>|<\\/code>))`, 'gi');
@@ -99,6 +104,16 @@ function replaceTextWithExtras(text, regexp, extras, replacement) {
     }
     return text.replace(regexp, replacement);
 }
+/**
+ * Returns whether `text` can use optimized candidate scanning instead of full-text parsing.
+ *
+ * @param text - Text to check.
+ * @param shouldEscapeText - Whether HTML characters are escaped before parsing.
+ * @returns Whether candidate scanning can be used safely.
+ */
+function canUseCandidateScanning(text, shouldEscapeText) {
+    return shouldEscapeText || (!text.includes('<') && !text.includes('>'));
+}
 /** Returns whether the character is an ASCII letter or digit. */
 function isAsciiAlphaNumeric(character) {
     if (!character) {
@@ -182,16 +197,81 @@ function getProtocolAt(text, position) {
     }
     return URL_PROTOCOLS.find((protocol) => text.slice(position, position + protocol.length).toLowerCase() === protocol);
 }
-/** Reads the text after the dot in example.com and returns where the hostname ends. */
-function findHostnameEnd(text, hostnameStart, dotPosition) {
-    let hostnameEnd = dotPosition + 1;
-    while (hostnameEnd < text.length && (isAsciiAlphaNumeric(text[hostnameEnd]) || text[hostnameEnd] === '-')) {
-        hostnameEnd++;
+/**
+ * Returns whether one dot-separated hostname label is valid.
+ *
+ * @param text - Candidate URL text containing the label.
+ * @param start - Index of the label's first character.
+ * @param end - Index immediately after the label's last character.
+ */
+function isValidHostnameLabel(text, start, end) {
+    if (start >= end || !isAsciiAlphaNumeric(text[start]) || !isAsciiAlphaNumeric(text[end - 1])) {
+        return false;
     }
-    if (hostnameStart === dotPosition || hostnameEnd === dotPosition + 1) {
-        return undefined;
+    for (let index = start + 1; index < end - 1; index++) {
+        if (!isAsciiAlphaNumeric(text[index]) && text[index] !== '-') {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Finds the first character of a valid hostname before the dot that starts its top-level domain.
+ *
+ * @param text - Candidate URL text containing the hostname.
+ * @param dotPosition - Index of the dot immediately before the top-level domain.
+ * @returns The hostname's first-character index, or undefined when no valid hostname precedes the dot.
+ */
+function findHostnameStart(text, dotPosition) {
+    let hostnameStart = dotPosition;
+    let labelEnd = dotPosition;
+    while (labelEnd > 0) {
+        let rawLabelStart = labelEnd - 1;
+        while (rawLabelStart >= 0 && text[rawLabelStart] !== '.' && isHostnameCharacter(text[rawLabelStart])) {
+            rawLabelStart--;
+        }
+        rawLabelStart++;
+        let labelStart = rawLabelStart;
+        while (labelStart < labelEnd && text[labelStart] === '-') {
+            labelStart++;
+        }
+        if (!isValidHostnameLabel(text, labelStart, labelEnd)) {
+            break;
+        }
+        hostnameStart = labelStart;
+        // A leading hyphen ends the hostname, but the existing URL regex can still match the valid suffix after it.
+        if (labelStart !== rawLabelStart) {
+            break;
+        }
+        const separatorPosition = labelStart - 1;
+        if (separatorPosition < 0 || text[separatorPosition] !== '.') {
+            break;
+        }
+        labelEnd = separatorPosition;
+    }
+    return hostnameStart === dotPosition ? undefined : hostnameStart;
+}
+/**
+ * Finds the end of a known top-level domain after `dotPosition`.
+ *
+ * @param text - Candidate URL text.
+ * @param dotPosition - Index of the dot immediately before the top-level domain.
+ * @returns The index immediately after the top-level domain, or undefined when it is not known.
+ */
+function findKnownTldEnd(text, dotPosition) {
+    const maximumEnd = Math.min(text.length, dotPosition + 1 + MAX_URL_TLD_LENGTH);
+    for (let end = dotPosition + 2; end <= maximumEnd; end++) {
+        const currentCharacter = text[end - 1];
+        if (!isAsciiAlphaNumeric(currentCharacter) && currentCharacter !== '-') {
+            break;
+        }
+        const nextCharacter = text[end];
+        const hasValidBoundary = !nextCharacter || nextCharacter === ':' || nextCharacter === '_' || !isWordCharacter(nextCharacter);
+        if (hasValidBoundary && URL_TLDS.has(text.slice(dotPosition + 1, end).toLowerCase())) {
+            return end;
+        }
     }
-    return hostnameEnd;
+    return undefined;
 }
 /** Expands example.com to include nearby @, *, _, or ~ in any order, plus its path, until whitespace or HTML. */
 function extendUrlCandidateBoundaries(text, start, end) {
@@ -205,25 +285,87 @@ function extendUrlCandidateBoundaries(text, start, end) {
     }
     return { start: candidateStart, end: candidateEnd };
 }
-/** Finds possible URL ranges, skips URL-looking text inside protected tags, and leaves validity to the existing regex. */
+/**
+ * Checks whether lowercase `expected` occurs in `text` at `position`, ignoring letter case in `text`.
+ *
+ * @param text - Text to check.
+ * @param expected - Lowercase string expected at `position`.
+ * @param position - Index where the comparison begins.
+ */
+function startsWithIgnoreCase(text, expected, position) {
+    return text.slice(position, position + expected.length).toLowerCase() === expected;
+}
+/**
+ * Removes candidates that the original full-text URL regex would reject because of later HTML.
+ * It scans right to left so each candidate can use the nearest later HTML boundary without copying a long suffix.
+ *
+ * @param text - Text containing candidate URLs and later HTML boundaries.
+ * @param candidates - URL candidates ordered by their position in `text`.
+ * @returns Candidates that keep candidate-scanning output compatible with full-text parsing.
+ */
+function filterUrlCandidatesBlockedByFollowingHtml(text, candidates) {
+    var _a;
+    if (candidates.length === 0 || (!text.includes('<') && !text.includes('>'))) {
+        return candidates;
+    }
+    const validCandidates = [];
+    let candidateIndex = candidates.length - 1;
+    let nextLessThan = text.length;
+    let nextGreaterThan = text.length;
+    let nextOpeningAnchor = text.length;
+    let nextClosingAnchor = text.length;
+    for (let index = text.length; index >= 0 && candidateIndex >= 0; index--) {
+        if (text[index] === '<') {
+            nextLessThan = index;
+            if (((_a = text[index + 1]) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'a') {
+                nextOpeningAnchor = index;
+            }
+            else if (startsWithIgnoreCase(text, '</a>', index)) {
+                nextClosingAnchor = index;
+            }
+        }
+        else if (text[index] === '>') {
+            nextGreaterThan = index;
+        }
+        while (candidateIndex >= 0 && candidates[candidateIndex].end === index) {
+            // Match the original URL regex when later HTML changes whether this candidate is valid.
+            const firstHtmlBoundaryIsClosingTag = nextLessThan < nextGreaterThan && text.startsWith('</', nextLessThan) && !startsWithIgnoreCase(text, '</h1>', nextLessThan);
+            const firstTagIsProtectedClosingTag = startsWithIgnoreCase(text, '</pre>', nextLessThan) || startsWithIgnoreCase(text, '</code>', nextLessThan);
+            const isBlockedByFollowingHtml = 
+            // Mirrors `(?![^<]*>)`: reject when `>` appears before the next `<`.
+            nextGreaterThan < nextLessThan ||
+                // Mirrors `[^<>]*<\/(?!h1>)`: reject a later closing tag other than `</h1>`.
+                firstHtmlBoundaryIsClosingTag ||
+                // Mirrors `((?:(?!<a).)+)?<\/a>`: reject `</a>` unless another `<a>` appears first.
+                nextClosingAnchor < nextOpeningAnchor ||
+                // Mirrors `[^<]*(<\/pre>|<\/code>)`: reject a later protected closing tag.
+                firstTagIsProtectedClosingTag;
+            if (!isBlockedByFollowingHtml) {
+                validCandidates.push(candidates[candidateIndex]);
+            }
+            candidateIndex--;
+        }
+    }
+    return validCandidates.reverse();
+}
+/** Finds possible URL ranges, skips URL-looking text inside protected tags, and leaves final validity to the existing regex. */
 function findUrlCandidates(text) {
     const candidates = [];
     const protectedTags = [];
     let index = 0;
-    let hostnameRunStart = 0;
     while (index < text.length) {
         if (text[index] === '<') {
             const nextIndex = updateProtectedTagStack(text, index, protectedTags);
             if (nextIndex === undefined) {
-                break;
+                // An incomplete tag is plain text, so skip only `<` and keep scanning for later URLs.
+                index++;
+                continue;
             }
             index = nextIndex;
-            hostnameRunStart = index;
             continue;
         }
         if (protectedTags.length > 0) {
             index++;
-            hostnameRunStart = index;
             continue;
         }
         const matchedProtocol = getProtocolAt(text, index);
@@ -231,29 +373,23 @@ function findUrlCandidates(text) {
             const candidate = extendUrlCandidateBoundaries(text, index, index + matchedProtocol.length);
             candidates.push(candidate);
             index = candidate.end;
-            hostnameRunStart = candidate.end;
-            continue;
-        }
-        if (!isHostnameCharacter(text[index])) {
-            hostnameRunStart = index + 1;
-            index++;
             continue;
         }
         if (text[index] !== '.') {
             index++;
             continue;
         }
-        const hostnameEnd = findHostnameEnd(text, hostnameRunStart, index);
-        if (hostnameEnd === undefined) {
+        const tldEnd = findKnownTldEnd(text, index);
+        const hostnameStart = tldEnd === undefined ? undefined : findHostnameStart(text, index);
+        if (tldEnd === undefined || hostnameStart === undefined) {
             index++;
             continue;
         }
-        const candidate = extendUrlCandidateBoundaries(text, hostnameRunStart, hostnameEnd);
+        const candidate = extendUrlCandidateBoundaries(text, hostnameStart, tldEnd);
         candidates.push(candidate);
         index = candidate.end;
-        hostnameRunStart = candidate.end;
     }
-    return candidates;
+    return filterUrlCandidatesBlockedByFollowingHtml(text, candidates);
 }
 /** Finds possible bold or strikethrough pairs, preserves marker order inside protected tags, and runs the existing regex only on each candidate. */
 function replaceMarkdownCandidates(text, regexp, replacement, marker, canOpen) {
@@ -329,6 +465,22 @@ function replaceMarkdownCandidates(text, regexp, replacement, marker, canOpen) {
     output.push(text.slice(outputStart));
     return output.join('');
 }
+/**
+ * Creates the common processor for bold and strikethrough Markdown rules.
+ *
+ * @param regex - Rule regex used to validate a Markdown candidate.
+ * @param marker - Markdown marker used to find candidate ranges.
+ * @param canOpen - Checks whether a marker can start a Markdown range.
+ * @returns A processor that uses candidate scanning when safe and the original regex otherwise.
+ */
+function processMarkdownRule(regex, marker, canOpen) {
+    return (textToProcess, replacement, _shouldKeepRawInput, shouldEscapeText) => {
+        if (canUseCandidateScanning(textToProcess, shouldEscapeText)) {
+            return replaceMarkdownCandidates(textToProcess, regex, replacement, marker, canOpen);
+        }
+        return replaceTextWithExtras(textToProcess, regex, EXTRAS_DEFAULT, replacement);
+    };
+}
 /**
  * replace block element with '\n' if :
  * 1. We have text within the element.
@@ -789,9 +941,10 @@ class ExpensiMark {
              */
             {
                 name: 'autolink',
-                process: (textToProcess, replacement) => {
+                process: (textToProcess, replacement, _shouldKeepRawInput, shouldEscapeText) => {
                     const regex = new RegExp(`(?![^<]*>|[^<>]*<\\/(?!h1>))([_*~]*?)${UrlPatterns.MARKDOWN_URL_REGEX}\\1(?!((?:(?!<a).)+)?<\\/a>|[^<]*(<\\/pre>|<\\/code>))`, 'gi');
-                    return this.modifyTextForUrlLinks(regex, textToProcess, replacement, true);
+                    // Raw HTML depends on complete-text lookaheads. Text without user-provided HTML can safely use the faster candidate scanner.
+                    return this.modifyTextForUrlLinks(regex, textToProcess, replacement, canUseCandidateScanning(textToProcess, shouldEscapeText));
                 },
                 replacement: (_extras, _match, g1, g2) => {
                     const href = str_1.default.sanitizeURL(g2);
@@ -862,6 +1015,7 @@ class ExpensiMark {
                 regex: new RegExp(`([^\\w'#%+-]|^)${Constants.CONST.REG_EXP.MARKDOWN_EMAIL}(?!((?:(?!<a).)+)?<\\/a>|[^<>]*<\\/(?!em|h1|blockquote))`, 'gim'),
                 replacement: '$1<a href="mailto:$2">$2</a>',
                 rawInputReplacement: '$1<a href="mailto:$2" data-raw-href="$2" data-link-variant="auto">$2</a>',
+                shouldSkipProcessing: (textToCheck) => !textToCheck.includes('@'),
             },
             /**
              * This regex matches a short user mention in a string.
@@ -897,7 +1051,7 @@ class ExpensiMark {
                 // \B will match everything that \b doesn't, so it works
                 // for * and ~: https://www.rexegg.com/regex-boundaries.html#notb
                 name: 'bold',
-                process: (textToProcess, replacement) => replaceMarkdownCandidates(textToProcess, BOLD_MARKDOWN_REGEX, replacement, '*', canOpenBoldMarkdown),
+                process: processMarkdownRule(BOLD_MARKDOWN_REGEX, '*', canOpenBoldMarkdown),
                 replacement: (_extras, match, g1, g2) => {
                     if (g1.includes('_')) {
                         return `${g1}<strong>${g2}</strong>`;
@@ -907,7 +1061,7 @@ class ExpensiMark {
             },
             {
                 name: 'strikethrough',
-                process: (textToProcess, replacement) => replaceMarkdownCandidates(textToProcess, STRIKETHROUGH_MARKDOWN_REGEX, replacement, '~', canOpenStrikethroughMarkdown),
+                process: processMarkdownRule(STRIKETHROUGH_MARKDOWN_REGEX, '~', canOpenStrikethroughMarkdown),
                 replacement: (_extras, match, g1) => (g1.includes('</pre>') || containsNonPairTag(g1) ? match : `<del>${g1}</del>`),
             },
             {
@@ -1330,7 +1484,7 @@ class ExpensiMark {
             }
             const replacement = shouldKeepRawInput && rule.rawInputReplacement ? rule.rawInputReplacement : rule.replacement;
             if ('process' in rule) {
-                replacedText = rule.process(replacedText, replacement, shouldKeepRawInput);
+                replacedText = rule.process(replacedText, replacement, shouldKeepRawInput, shouldEscapeText);
             }
             else {
                 replacedText = replaceTextWithExtras(replacedText, rule.regex, extras, replacement);

package/dist/esm/ExpensiMark.d.ts

@@ -24,7 +24,7 @@ type Extras = {
 export type { Extras };
 type ReplacementFn = (extras: Extras, ...matches: string[]) => string;
 type Replacement = ReplacementFn | string;
-type ProcessFn = (textToProcess: string, replacement: Replacement, shouldKeepRawInput: boolean) => string;
+type ProcessFn = (textToProcess: string, replacement: Replacement, shouldKeepRawInput: boolean, shouldEscapeText: boolean) => string;
 type CommonRule = {
     name: string;
     replacement: Replacement;

package/dist/esm/ExpensiMark.js

@@ -3,6 +3,7 @@ import Str from './str';
 import * as Constants from './CONST';
 import * as UrlPatterns from './Url';
 import Logger from './Logger';
+import TLD_REGEX from './tlds';
 import * as Utils from './utils';
 const EXTRAS_DEFAULT = {};
 // These constants represent the ASCII ranges for digits (0-9) and letters (A-Z, a-z).
@@ -16,6 +17,10 @@ const ASCII_WHITESPACE_END = ' '.charCodeAt(0);
 const NON_BREAKING_SPACE_CODE = 160;
 const URL_PROTOCOLS = ['https://', 'http://', 'ftps://', 'ftp://'];
 const URL_CANDIDATE_PREFIX_CHARACTERS = '@_*~';
+const URL_TLD_LIST = TLD_REGEX.toLowerCase().split('|');
+const URL_TLDS = new Set(URL_TLD_LIST);
+// Caps TLD scanning at the longest known TLD so long invalid URL-like text avoids expensive regex work.
+const MAX_URL_TLD_LENGTH = Math.max(...URL_TLD_LIST.map((tld) => tld.length));
 const PROTECTED_TAG_NAMES = new Set(['a', 'code', 'pre', 'video']);
 const MARKDOWN_LINK_REGEX = new RegExp(`\\[((?:[^\\[\\]\\r\\n]*(?:\\[[^\\[\\]\\r\\n]*][^\\[\\]\\r\\n]*)*))]\\(${UrlPatterns.MARKDOWN_URL_REGEX}\\)(?![^<]*(<\\/pre>|<\\/code>))`, 'gi');
 const MARKDOWN_IMAGE_REGEX = new RegExp(`\\!(?:\\[([^\\][]*(?:\\[[^\\][]*][^\\][]*)*)])?\\(${UrlPatterns.MARKDOWN_URL_REGEX}\\)(?![^<]*(<\\/pre>|<\\/code>))`, 'gi');
@@ -61,6 +66,16 @@ function replaceTextWithExtras(text, regexp, extras, replacement) {
     }
     return text.replace(regexp, replacement);
 }
+/**
+ * Returns whether `text` can use optimized candidate scanning instead of full-text parsing.
+ *
+ * @param text - Text to check.
+ * @param shouldEscapeText - Whether HTML characters are escaped before parsing.
+ * @returns Whether candidate scanning can be used safely.
+ */
+function canUseCandidateScanning(text, shouldEscapeText) {
+    return shouldEscapeText || (!text.includes('<') && !text.includes('>'));
+}
 /** Returns whether the character is an ASCII letter or digit. */
 function isAsciiAlphaNumeric(character) {
     if (!character) {
@@ -144,16 +159,81 @@ function getProtocolAt(text, position) {
     }
     return URL_PROTOCOLS.find((protocol) => text.slice(position, position + protocol.length).toLowerCase() === protocol);
 }
-/** Reads the text after the dot in example.com and returns where the hostname ends. */
-function findHostnameEnd(text, hostnameStart, dotPosition) {
-    let hostnameEnd = dotPosition + 1;
-    while (hostnameEnd < text.length && (isAsciiAlphaNumeric(text[hostnameEnd]) || text[hostnameEnd] === '-')) {
-        hostnameEnd++;
+/**
+ * Returns whether one dot-separated hostname label is valid.
+ *
+ * @param text - Candidate URL text containing the label.
+ * @param start - Index of the label's first character.
+ * @param end - Index immediately after the label's last character.
+ */
+function isValidHostnameLabel(text, start, end) {
+    if (start >= end || !isAsciiAlphaNumeric(text[start]) || !isAsciiAlphaNumeric(text[end - 1])) {
+        return false;
     }
-    if (hostnameStart === dotPosition || hostnameEnd === dotPosition + 1) {
-        return undefined;
+    for (let index = start + 1; index < end - 1; index++) {
+        if (!isAsciiAlphaNumeric(text[index]) && text[index] !== '-') {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Finds the first character of a valid hostname before the dot that starts its top-level domain.
+ *
+ * @param text - Candidate URL text containing the hostname.
+ * @param dotPosition - Index of the dot immediately before the top-level domain.
+ * @returns The hostname's first-character index, or undefined when no valid hostname precedes the dot.
+ */
+function findHostnameStart(text, dotPosition) {
+    let hostnameStart = dotPosition;
+    let labelEnd = dotPosition;
+    while (labelEnd > 0) {
+        let rawLabelStart = labelEnd - 1;
+        while (rawLabelStart >= 0 && text[rawLabelStart] !== '.' && isHostnameCharacter(text[rawLabelStart])) {
+            rawLabelStart--;
+        }
+        rawLabelStart++;
+        let labelStart = rawLabelStart;
+        while (labelStart < labelEnd && text[labelStart] === '-') {
+            labelStart++;
+        }
+        if (!isValidHostnameLabel(text, labelStart, labelEnd)) {
+            break;
+        }
+        hostnameStart = labelStart;
+        // A leading hyphen ends the hostname, but the existing URL regex can still match the valid suffix after it.
+        if (labelStart !== rawLabelStart) {
+            break;
+        }
+        const separatorPosition = labelStart - 1;
+        if (separatorPosition < 0 || text[separatorPosition] !== '.') {
+            break;
+        }
+        labelEnd = separatorPosition;
+    }
+    return hostnameStart === dotPosition ? undefined : hostnameStart;
+}
+/**
+ * Finds the end of a known top-level domain after `dotPosition`.
+ *
+ * @param text - Candidate URL text.
+ * @param dotPosition - Index of the dot immediately before the top-level domain.
+ * @returns The index immediately after the top-level domain, or undefined when it is not known.
+ */
+function findKnownTldEnd(text, dotPosition) {
+    const maximumEnd = Math.min(text.length, dotPosition + 1 + MAX_URL_TLD_LENGTH);
+    for (let end = dotPosition + 2; end <= maximumEnd; end++) {
+        const currentCharacter = text[end - 1];
+        if (!isAsciiAlphaNumeric(currentCharacter) && currentCharacter !== '-') {
+            break;
+        }
+        const nextCharacter = text[end];
+        const hasValidBoundary = !nextCharacter || nextCharacter === ':' || nextCharacter === '_' || !isWordCharacter(nextCharacter);
+        if (hasValidBoundary && URL_TLDS.has(text.slice(dotPosition + 1, end).toLowerCase())) {
+            return end;
+        }
     }
-    return hostnameEnd;
+    return undefined;
 }
 /** Expands example.com to include nearby @, *, _, or ~ in any order, plus its path, until whitespace or HTML. */
 function extendUrlCandidateBoundaries(text, start, end) {
@@ -167,25 +247,87 @@ function extendUrlCandidateBoundaries(text, start, end) {
     }
     return { start: candidateStart, end: candidateEnd };
 }
-/** Finds possible URL ranges, skips URL-looking text inside protected tags, and leaves validity to the existing regex. */
+/**
+ * Checks whether lowercase `expected` occurs in `text` at `position`, ignoring letter case in `text`.
+ *
+ * @param text - Text to check.
+ * @param expected - Lowercase string expected at `position`.
+ * @param position - Index where the comparison begins.
+ */
+function startsWithIgnoreCase(text, expected, position) {
+    return text.slice(position, position + expected.length).toLowerCase() === expected;
+}
+/**
+ * Removes candidates that the original full-text URL regex would reject because of later HTML.
+ * It scans right to left so each candidate can use the nearest later HTML boundary without copying a long suffix.
+ *
+ * @param text - Text containing candidate URLs and later HTML boundaries.
+ * @param candidates - URL candidates ordered by their position in `text`.
+ * @returns Candidates that keep candidate-scanning output compatible with full-text parsing.
+ */
+function filterUrlCandidatesBlockedByFollowingHtml(text, candidates) {
+    var _a;
+    if (candidates.length === 0 || (!text.includes('<') && !text.includes('>'))) {
+        return candidates;
+    }
+    const validCandidates = [];
+    let candidateIndex = candidates.length - 1;
+    let nextLessThan = text.length;
+    let nextGreaterThan = text.length;
+    let nextOpeningAnchor = text.length;
+    let nextClosingAnchor = text.length;
+    for (let index = text.length; index >= 0 && candidateIndex >= 0; index--) {
+        if (text[index] === '<') {
+            nextLessThan = index;
+            if (((_a = text[index + 1]) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'a') {
+                nextOpeningAnchor = index;
+            }
+            else if (startsWithIgnoreCase(text, '</a>', index)) {
+                nextClosingAnchor = index;
+            }
+        }
+        else if (text[index] === '>') {
+            nextGreaterThan = index;
+        }
+        while (candidateIndex >= 0 && candidates[candidateIndex].end === index) {
+            // Match the original URL regex when later HTML changes whether this candidate is valid.
+            const firstHtmlBoundaryIsClosingTag = nextLessThan < nextGreaterThan && text.startsWith('</', nextLessThan) && !startsWithIgnoreCase(text, '</h1>', nextLessThan);
+            const firstTagIsProtectedClosingTag = startsWithIgnoreCase(text, '</pre>', nextLessThan) || startsWithIgnoreCase(text, '</code>', nextLessThan);
+            const isBlockedByFollowingHtml = 
+            // Mirrors `(?![^<]*>)`: reject when `>` appears before the next `<`.
+            nextGreaterThan < nextLessThan ||
+                // Mirrors `[^<>]*<\/(?!h1>)`: reject a later closing tag other than `</h1>`.
+                firstHtmlBoundaryIsClosingTag ||
+                // Mirrors `((?:(?!<a).)+)?<\/a>`: reject `</a>` unless another `<a>` appears first.
+                nextClosingAnchor < nextOpeningAnchor ||
+                // Mirrors `[^<]*(<\/pre>|<\/code>)`: reject a later protected closing tag.
+                firstTagIsProtectedClosingTag;
+            if (!isBlockedByFollowingHtml) {
+                validCandidates.push(candidates[candidateIndex]);
+            }
+            candidateIndex--;
+        }
+    }
+    return validCandidates.reverse();
+}
+/** Finds possible URL ranges, skips URL-looking text inside protected tags, and leaves final validity to the existing regex. */
 function findUrlCandidates(text) {
     const candidates = [];
     const protectedTags = [];
     let index = 0;
-    let hostnameRunStart = 0;
     while (index < text.length) {
         if (text[index] === '<') {
             const nextIndex = updateProtectedTagStack(text, index, protectedTags);
             if (nextIndex === undefined) {
-                break;
+                // An incomplete tag is plain text, so skip only `<` and keep scanning for later URLs.
+                index++;
+                continue;
             }
             index = nextIndex;
-            hostnameRunStart = index;
             continue;
         }
         if (protectedTags.length > 0) {
             index++;
-            hostnameRunStart = index;
             continue;
         }
         const matchedProtocol = getProtocolAt(text, index);
@@ -193,29 +335,23 @@ function findUrlCandidates(text) {
             const candidate = extendUrlCandidateBoundaries(text, index, index + matchedProtocol.length);
             candidates.push(candidate);
             index = candidate.end;
-            hostnameRunStart = candidate.end;
-            continue;
-        }
-        if (!isHostnameCharacter(text[index])) {
-            hostnameRunStart = index + 1;
-            index++;
             continue;
         }
         if (text[index] !== '.') {
             index++;
             continue;
         }
-        const hostnameEnd = findHostnameEnd(text, hostnameRunStart, index);
-        if (hostnameEnd === undefined) {
+        const tldEnd = findKnownTldEnd(text, index);
+        const hostnameStart = tldEnd === undefined ? undefined : findHostnameStart(text, index);
+        if (tldEnd === undefined || hostnameStart === undefined) {
             index++;
             continue;
         }
-        const candidate = extendUrlCandidateBoundaries(text, hostnameRunStart, hostnameEnd);
+        const candidate = extendUrlCandidateBoundaries(text, hostnameStart, tldEnd);
         candidates.push(candidate);
         index = candidate.end;
-        hostnameRunStart = candidate.end;
     }
-    return candidates;
+    return filterUrlCandidatesBlockedByFollowingHtml(text, candidates);
 }
 /** Finds possible bold or strikethrough pairs, preserves marker order inside protected tags, and runs the existing regex only on each candidate. */
 function replaceMarkdownCandidates(text, regexp, replacement, marker, canOpen) {
@@ -291,6 +427,22 @@ function replaceMarkdownCandidates(text, regexp, replacement, marker, canOpen) {
     output.push(text.slice(outputStart));
     return output.join('');
 }
+/**
+ * Creates the common processor for bold and strikethrough Markdown rules.
+ *
+ * @param regex - Rule regex used to validate a Markdown candidate.
+ * @param marker - Markdown marker used to find candidate ranges.
+ * @param canOpen - Checks whether a marker can start a Markdown range.
+ * @returns A processor that uses candidate scanning when safe and the original regex otherwise.
+ */
+function processMarkdownRule(regex, marker, canOpen) {
+    return (textToProcess, replacement, _shouldKeepRawInput, shouldEscapeText) => {
+        if (canUseCandidateScanning(textToProcess, shouldEscapeText)) {
+            return replaceMarkdownCandidates(textToProcess, regex, replacement, marker, canOpen);
+        }
+        return replaceTextWithExtras(textToProcess, regex, EXTRAS_DEFAULT, replacement);
+    };
+}
 /**
  * replace block element with '\n' if :
  * 1. We have text within the element.
@@ -751,9 +903,10 @@ class ExpensiMark {
              */
             {
                 name: 'autolink',
-                process: (textToProcess, replacement) => {
+                process: (textToProcess, replacement, _shouldKeepRawInput, shouldEscapeText) => {
                     const regex = new RegExp(`(?![^<]*>|[^<>]*<\\/(?!h1>))([_*~]*?)${UrlPatterns.MARKDOWN_URL_REGEX}\\1(?!((?:(?!<a).)+)?<\\/a>|[^<]*(<\\/pre>|<\\/code>))`, 'gi');
-                    return this.modifyTextForUrlLinks(regex, textToProcess, replacement, true);
+                    // Raw HTML depends on complete-text lookaheads. Text without user-provided HTML can safely use the faster candidate scanner.
+                    return this.modifyTextForUrlLinks(regex, textToProcess, replacement, canUseCandidateScanning(textToProcess, shouldEscapeText));
                 },
                 replacement: (_extras, _match, g1, g2) => {
                     const href = Str.sanitizeURL(g2);
@@ -824,6 +977,7 @@ class ExpensiMark {
                 regex: new RegExp(`([^\\w'#%+-]|^)${Constants.CONST.REG_EXP.MARKDOWN_EMAIL}(?!((?:(?!<a).)+)?<\\/a>|[^<>]*<\\/(?!em|h1|blockquote))`, 'gim'),
                 replacement: '$1<a href="mailto:$2">$2</a>',
                 rawInputReplacement: '$1<a href="mailto:$2" data-raw-href="$2" data-link-variant="auto">$2</a>',
+                shouldSkipProcessing: (textToCheck) => !textToCheck.includes('@'),
             },
             /**
              * This regex matches a short user mention in a string.
@@ -859,7 +1013,7 @@ class ExpensiMark {
                 // \B will match everything that \b doesn't, so it works
                 // for * and ~: https://www.rexegg.com/regex-boundaries.html#notb
                 name: 'bold',
-                process: (textToProcess, replacement) => replaceMarkdownCandidates(textToProcess, BOLD_MARKDOWN_REGEX, replacement, '*', canOpenBoldMarkdown),
+                process: processMarkdownRule(BOLD_MARKDOWN_REGEX, '*', canOpenBoldMarkdown),
                 replacement: (_extras, match, g1, g2) => {
                     if (g1.includes('_')) {
                         return `${g1}<strong>${g2}</strong>`;
@@ -869,7 +1023,7 @@ class ExpensiMark {
             },
             {
                 name: 'strikethrough',
-                process: (textToProcess, replacement) => replaceMarkdownCandidates(textToProcess, STRIKETHROUGH_MARKDOWN_REGEX, replacement, '~', canOpenStrikethroughMarkdown),
+                process: processMarkdownRule(STRIKETHROUGH_MARKDOWN_REGEX, '~', canOpenStrikethroughMarkdown),
                 replacement: (_extras, match, g1) => (g1.includes('</pre>') || containsNonPairTag(g1) ? match : `<del>${g1}</del>`),
             },
             {
@@ -1292,7 +1446,7 @@ class ExpensiMark {
             }
             const replacement = shouldKeepRawInput && rule.rawInputReplacement ? rule.rawInputReplacement : rule.replacement;
             if ('process' in rule) {
-                replacedText = rule.process(replacedText, replacement, shouldKeepRawInput);
+                replacedText = rule.process(replacedText, replacement, shouldKeepRawInput, shouldEscapeText);
             }
             else {
                 replacedText = replaceTextWithExtras(replacedText, rule.regex, extras, replacement);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expensify-common",
-  "version": "2.0.206",
+  "version": "2.0.207",
   "author": "Expensify, Inc.",
   "description": "Expensify libraries and components shared across different repos",
   "homepage": "https://expensify.com",