From 0af13191df532c1da7b3adf2accb7bc2e1581871 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@example.local>
Date: Sat, 20 Jun 2026 11:12:21 +1000
Subject: [PATCH] feat: resolve private shortlink redirects

---
 tests/private-redirect.test.ts    | 439 ++++++++++++++++++++++++++++++
 worker/index.ts                   |   5 +
 worker/lib/custom-link.ts         |  49 ++++
 worker/lib/responses.ts           |  17 ++
 worker/routes/private-redirect.ts | 118 ++++++++
 worker/routes/redirect.ts         |  50 +---
 6 files changed, 632 insertions(+), 46 deletions(-)
 create mode 100644 tests/private-redirect.test.ts
 create mode 100644 worker/lib/custom-link.ts
 create mode 100644 worker/routes/private-redirect.ts

diff --git a/tests/private-redirect.test.ts b/tests/private-redirect.test.ts
new file mode 100644
index 0000000..2681f1f
--- /dev/null
+++ b/tests/private-redirect.test.ts
@@ -0,0 +1,439 @@
+import { describe, expect, it } from 'vitest';
+import worker from '../worker/index';
+import { AUTH_SESSION_COOKIE_NAME, hashSessionToken } from '../worker/auth';
+
+type LinkRow = {
+  id: string;
+  alias: string;
+  scope: 'public' | 'private';
+  status: 'active' | 'archived' | 'deleted';
+  link_type: 'redirect' | 'custom';
+  target_url: string | null;
+  content_markdown: string | null;
+  click_count: number;
+  owner_user_id?: string;
+};
+
+type SessionRow = {
+  id: string;
+  email: string | null;
+  name: string | null;
+  image_url: string | null;
+  role: 'user' | 'admin';
+  expires_at: string;
+  session_token_hash: string;
+};
+
+type RunCall = {
+  sql: string;
+  params: unknown[];
+};
+
+class FakeD1Database {
+  readonly preparedSql: string[] = [];
+  readonly runCalls: RunCall[] = [];
+
+  constructor(
+    private readonly links: LinkRow[],
+    private readonly sessions: SessionRow[],
+  ) {}
+
+  prepare(sql: string): FakeD1PreparedStatement {
+    this.preparedSql.push(sql);
+    return new FakeD1PreparedStatement(this, sql);
+  }
+
+  findSession(hash: string): SessionRow | null {
+    return this.sessions.find((candidate) => candidate.session_token_hash === hash) ?? null;
+  }
+
+  findPrivateActive(ownerUserId: string, alias: string): Omit<LinkRow, 'scope' | 'status' | 'owner_user_id'> | null {
+    const row = this.links.find((candidate) => {
+      return (
+        candidate.scope === 'private' &&
+        candidate.status === 'active' &&
+        candidate.owner_user_id === ownerUserId &&
+        candidate.alias === alias
+      );
+    });
+
+    if (!row) {
+      return null;
+    }
+
+    return {
+      id: row.id,
+      alias: row.alias,
+      link_type: row.link_type,
+      target_url: row.target_url,
+      content_markdown: row.content_markdown,
+      click_count: row.click_count,
+    };
+  }
+}
+
+class FakeD1PreparedStatement {
+  private params: unknown[] = [];
+
+  constructor(
+    private readonly db: FakeD1Database,
+    private readonly sql: string,
+    params: unknown[] = [],
+  ) {
+    this.params = params;
+  }
+
+  bind(...params: unknown[]): FakeD1PreparedStatement {
+    return new FakeD1PreparedStatement(this.db, this.sql, params);
+  }
+
+  async first<T>(): Promise<T | null> {
+    if (this.sql.includes('session_token_hash')) {
+      const hash = String(this.params[0]);
+      const row = this.db.findSession(hash);
+      if (!row) {
+        return null;
+      }
+      return {
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        image_url: row.image_url,
+        role: row.role,
+        expires_at: row.expires_at,
+      } as T;
+    }
+
+    if (this.sql.includes("scope='private'")) {
+      expect(this.sql).toContain("status='active'");
+      expect(this.sql).toContain('owner_user_id=?');
+      expect(this.sql).toContain('alias=?');
+      expect(this.sql).toContain('LIMIT 1');
+
+      const ownerUserId = String(this.params[0]);
+      const alias = String(this.params[1]);
+      return this.db.findPrivateActive(ownerUserId, alias) as T;
+    }
+
+    return null;
+  }
+
+  async run(): Promise<D1Result> {
+    this.db.runCalls.push({ sql: this.sql, params: this.params });
+    return { success: true, meta: {} } as D1Result;
+  }
+}
+
+class FakeExecutionContext {
+  readonly promises: Promise<unknown>[] = [];
+
+  waitUntil(promise: Promise<unknown>): void {
+    this.promises.push(promise);
+  }
+
+  passThroughOnException(): void {}
+}
+
+function futureIso(): string {
+  return new Date(Date.now() + 60 * 60 * 1000).toISOString();
+}
+
+type EnvBundle = {
+  env: { DB: D1Database };
+  db: FakeD1Database;
+  ctx: FakeExecutionContext;
+};
+
+function makeEnv(links: LinkRow[] = [], sessions: SessionRow[] = []): EnvBundle {
+  const db = new FakeD1Database(links, sessions);
+  return {
+    env: { DB: db as unknown as D1Database },
+    db,
+    ctx: new FakeExecutionContext(),
+  };
+}
+
+async function sessionCookie(token: string): Promise<string> {
+  return `${AUTH_SESSION_COOKIE_NAME}=${token}`;
+}
+
+async function fetchWorker(
+  url: string,
+  opts: { links?: LinkRow[]; sessions?: SessionRow[]; cookie?: string } = {},
+) {
+  const { env, db, ctx } = makeEnv(opts.links ?? [], opts.sessions ?? []);
+  const headers = new Headers();
+  if (opts.cookie) {
+    headers.set('cookie', opts.cookie);
+  }
+  const response = await worker.fetch(
+    new Request(url, { headers }) as unknown as Parameters<typeof worker.fetch>[0],
+    env as unknown as Parameters<typeof worker.fetch>[1],
+    ctx as unknown as Parameters<typeof worker.fetch>[2],
+  );
+  return { response, db, ctx };
+}
+
+async function userSession(token: string, userId: string): Promise<SessionRow> {
+  const hash = await hashSessionToken(token);
+  return {
+    id: userId,
+    email: `${userId}@heygo.cc`,
+    name: userId,
+    image_url: null,
+    role: 'user',
+    expires_at: futureIso(),
+    session_token_hash: hash,
+  };
+}
+
+describe('my.heygo.cc private shortlinks', () => {
+  it('returns 404 with a login link when unauthenticated', async () => {
+    const { response, db } = await fetchWorker('https://my.heygo.cc/foo', {
+      links: [
+        {
+          id: 'link_1',
+          alias: 'foo',
+          scope: 'private',
+          status: 'active',
+          link_type: 'redirect',
+          target_url: 'https://example.com/foo',
+          content_markdown: null,
+          click_count: 0,
+          owner_user_id: 'userA',
+        },
+      ],
+    });
+
+    expect(response.status).toBe(404);
+    expect(response.headers.get('content-type')).toContain('text/html');
+    const body = await response.text();
+    expect(body).toContain('Login to use your private links');
+    expect(body).toContain('https://heygo.cc/app/login');
+    // No private alias lookup should happen without a session.
+    expect(db.preparedSql.filter((sql) => sql.includes("scope='private'"))).toHaveLength(0);
+  });
+
+  it('resolves the authenticated user private redirect', async () => {
+    const cookie = await sessionCookie('token-a');
+    const session = await userSession('token-a', 'userA');
+    const { response, ctx, db } = await fetchWorker('https://my.heygo.cc/foo', {
+      cookie,
+      sessions: [session],
+      links: [
+        {
+          id: 'link_a',
+          alias: 'foo',
+          scope: 'private',
+          status: 'active',
+          link_type: 'redirect',
+          target_url: 'https://example.com/foo-a',
+          content_markdown: null,
+          click_count: 0,
+          owner_user_id: 'userA',
+        },
+      ],
+    });
+
+    expect(response.status).toBe(302);
+    expect(response.headers.get('location')).toBe('https://example.com/foo-a');
+    expect(ctx.promises).toHaveLength(1);
+    await Promise.all(ctx.promises);
+    expect(db.runCalls).toHaveLength(1);
+    expect(db.runCalls[0].sql).toContain('click_count = click_count + 1');
+    expect(db.runCalls[0].params).toEqual(['link_a']);
+  });
+
+  it('isolates private aliases per user (user B resolves own link, not user A)', async () => {
+    const cookieA = await sessionCookie('token-a');
+    const cookieB = await sessionCookie('token-b');
+    const sessionA = await userSession('token-a', 'userA');
+    const sessionB = await userSession('token-b', 'userB');
+
+    const links: LinkRow[] = [
+      {
+        id: 'link_a',
+        alias: 'shared',
+        scope: 'private',
+        status: 'active',
+        link_type: 'redirect',
+        target_url: 'https://example.com/a-shared',
+        content_markdown: null,
+        click_count: 0,
+        owner_user_id: 'userA',
+      },
+      {
+        id: 'link_b',
+        alias: 'shared',
+        scope: 'private',
+        status: 'active',
+        link_type: 'redirect',
+        target_url: 'https://example.com/b-shared',
+        content_markdown: null,
+        click_count: 0,
+        owner_user_id: 'userB',
+      },
+    ];
+
+    const resA = await fetchWorker('https://my.heygo.cc/shared', {
+      cookie: cookieA,
+      sessions: [sessionA, sessionB],
+      links,
+    });
+    expect(resA.response.status).toBe(302);
+    expect(resA.response.headers.get('location')).toBe('https://example.com/a-shared');
+
+    const resB = await fetchWorker('https://my.heygo.cc/shared', {
+      cookie: cookieB,
+      sessions: [sessionA, sessionB],
+      links,
+    });
+    expect(resB.response.status).toBe(302);
+    expect(resB.response.headers.get('location')).toBe('https://example.com/b-shared');
+  });
+
+  it('returns 404 for an authenticated user who does not own the alias (no public fallback)', async () => {
+    const cookie = await sessionCookie('token-b');
+    const sessionB = await userSession('token-b', 'userB');
+    const { response, db } = await fetchWorker('https://my.heygo.cc/only-public', {
+      cookie,
+      sessions: [sessionB],
+      links: [
+        {
+          id: 'public_link',
+          alias: 'only-public',
+          scope: 'public',
+          status: 'active',
+          link_type: 'redirect',
+          target_url: 'https://example.com/public',
+          content_markdown: null,
+          click_count: 0,
+        },
+        {
+          id: 'link_a',
+          alias: 'only-public',
+          scope: 'private',
+          status: 'active',
+          link_type: 'redirect',
+          target_url: 'https://example.com/a-only',
+          content_markdown: null,
+          click_count: 0,
+          owner_user_id: 'userA',
+        },
+      ],
+    });
+
+    expect(response.status).toBe(404);
+    const body = await response.text();
+    expect(body).toContain('Create this private link');
+    // Must never query the public scope on my.heygo.cc.
+    expect(db.preparedSql.filter((sql) => sql.includes("scope='public'"))).toHaveLength(0);
+  });
+
+  it('renders an authenticated private custom link as escaped HTML', async () => {
+    const cookie = await sessionCookie('token-a');
+    const session = await userSession('token-a', 'userA');
+    const { response } = await fetchWorker('https://my.heygo.cc/note', {
+      cookie,
+      sessions: [session],
+      links: [
+        {
+          id: 'link_custom',
+          alias: 'note',
+          scope: 'private',
+          status: 'active',
+          link_type: 'custom',
+          target_url: null,
+          content_markdown: '# Private Note\n<script>alert("x")</script>',
+          click_count: 0,
+          owner_user_id: 'userA',
+        },
+      ],
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('content-type')).toContain('text/html');
+    const html = await response.text();
+    expect(html).toContain('Private Note');
+    expect(html).not.toContain('<script>');
+    expect(html).toContain('&lt;script&gt;');
+  });
+
+  it('returns 404 with Create this private link when the alias is missing for the user', async () => {
+    const cookie = await sessionCookie('token-a');
+    const session = await userSession('token-a', 'userA');
+    const { response } = await fetchWorker('https://my.heygo.cc/does-not-exist', {
+      cookie,
+      sessions: [session],
+    });
+
+    expect(response.status).toBe(404);
+    expect(response.headers.get('content-type')).toContain('text/html');
+    const body = await response.text();
+    expect(body).toContain('Create this private link');
+  });
+
+  it('handles the root path: unauthenticated 404 + login, authenticated 302 to app/private', async () => {
+    const unauth = await fetchWorker('https://my.heygo.cc/');
+    expect(unauth.response.status).toBe(404);
+    expect(await unauth.response.text()).toContain('Login to use your private links');
+
+    const cookie = await sessionCookie('token-a');
+    const session = await userSession('token-a', 'userA');
+    const auth = await fetchWorker('https://my.heygo.cc/', {
+      cookie,
+      sessions: [session],
+    });
+    expect(auth.response.status).toBe(302);
+    expect(auth.response.headers.get('location')).toBe('https://heygo.cc/app/private');
+  });
+
+  it('does not trigger D1 private alias lookup for reserved paths', async () => {
+    const cookie = await sessionCookie('token-a');
+    const session = await userSession('token-a', 'userA');
+    const links: LinkRow[] = [
+      {
+        id: 'link_api',
+        alias: 'api',
+        scope: 'private',
+        status: 'active',
+        link_type: 'redirect',
+        target_url: 'https://example.com/api',
+        content_markdown: null,
+        click_count: 0,
+        owner_user_id: 'userA',
+      },
+      {
+        id: 'link_app',
+        alias: 'app',
+        scope: 'private',
+        status: 'active',
+        link_type: 'redirect',
+        target_url: 'https://example.com/app',
+        content_markdown: null,
+        click_count: 0,
+        owner_user_id: 'userA',
+      },
+      {
+        id: 'link_admin',
+        alias: 'admin',
+        scope: 'private',
+        status: 'active',
+        link_type: 'redirect',
+        target_url: 'https://example.com/admin',
+        content_markdown: null,
+        click_count: 0,
+        owner_user_id: 'userA',
+      },
+    ];
+
+    for (const path of ['/api/foo', '/app/foo', '/admin/foo']) {
+      const { db } = await fetchWorker(`https://my.heygo.cc${path}`, {
+        cookie,
+        sessions: [session],
+        links,
+      });
+      expect(db.preparedSql.filter((sql) => sql.includes("scope='private'"))).toHaveLength(0);
+    }
+  });
+});
diff --git a/worker/index.ts b/worker/index.ts
index bc2f9ac..b6d7578 100644
--- a/worker/index.ts
+++ b/worker/index.ts
@@ -1,4 +1,5 @@
 import type { Env } from './env';
+import { handlePrivateShortlink, isHeygoPrivateHost } from './routes/private-redirect';
 import { handlePublicShortlink, isHeygoPublicHost, isReservedPublicPath } from './routes/redirect';
 
 export type { Env } from './env';
@@ -33,6 +34,10 @@ export default {
       return handlePublicShortlink(request, env, ctx);
     }
 
+    if (isHeygoPrivateHost(url) && !isReservedPublicPath(url.pathname)) {
+      return handlePrivateShortlink(request, env, ctx);
+    }
+
     return json({ error: 'Not found' }, { status: 404 });
   },
 } satisfies ExportedHandler<Env>;
diff --git a/worker/lib/custom-link.ts b/worker/lib/custom-link.ts
new file mode 100644
index 0000000..c94bff9
--- /dev/null
+++ b/worker/lib/custom-link.ts
@@ -0,0 +1,49 @@
+import { escapeHtml } from './responses';
+
+export type CustomLinkLike = {
+  alias: string;
+  content_markdown: string | null;
+};
+
+export function renderCustomLinkHtml(link: CustomLinkLike): string {
+  const content = renderMarkdown(link.content_markdown ?? '');
+  const title = escapeHtml(link.alias);
+
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title></head><body><main>${content}</main></body></html>`;
+}
+
+function renderMarkdown(markdown: string): string {
+  const lines = markdown.replace(/\r\n?/g, '\n').split('\n');
+  const rendered: string[] = [];
+  let paragraph: string[] = [];
+
+  const flushParagraph = () => {
+    if (paragraph.length > 0) {
+      rendered.push(`<p>${paragraph.join('<br>')}</p>`);
+      paragraph = [];
+    }
+  };
+
+  for (const line of lines) {
+    const escaped = escapeHtml(line);
+    const heading = escaped.match(/^(#{1,6})\s+(.*)$/);
+
+    if (heading) {
+      flushParagraph();
+      const level = heading[1].length;
+      rendered.push(`<h${level}>${heading[2]}</h${level}>`);
+      continue;
+    }
+
+    if (escaped.trim() === '') {
+      flushParagraph();
+      continue;
+    }
+
+    paragraph.push(escaped);
+  }
+
+  flushParagraph();
+
+  return rendered.join('\n');
+}
\ No newline at end of file
diff --git a/worker/lib/responses.ts b/worker/lib/responses.ts
index 069c39a..db673c2 100644
--- a/worker/lib/responses.ts
+++ b/worker/lib/responses.ts
@@ -22,6 +22,23 @@ export function publicBadRequestResponse(message = 'Invalid short link'): Respon
   );
 }
 
+export const PRIVATE_LOGIN_URL = 'https://heygo.cc/app/login';
+export const PRIVATE_APP_URL = 'https://heygo.cc/app/private';
+
+export function privateLoginRequiredResponse(): Response {
+  return htmlResponse(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Login required</title></head><body><h1>Not found</h1><p><a href="${PRIVATE_LOGIN_URL}">Login to use your private links</a>.</p></body></html>`,
+    { status: 404 },
+  );
+}
+
+export function privateAliasNotFoundResponse(): Response {
+  return htmlResponse(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Not found</title></head><body><h1>Not found</h1><p>This private link does not exist.</p><p><a href="${PRIVATE_APP_URL}">Create this private link</a>.</p></body></html>`,
+    { status: 404 },
+  );
+}
+
 export function escapeHtml(value: string): string {
   return value
     .replace(/&/g, '&amp;')
diff --git a/worker/routes/private-redirect.ts b/worker/routes/private-redirect.ts
new file mode 100644
index 0000000..649734e
--- /dev/null
+++ b/worker/routes/private-redirect.ts
@@ -0,0 +1,118 @@
+import type { Env } from '../env';
+import { getCurrentUser } from '../auth';
+import { validateAlias } from '../lib/aliases';
+import { renderCustomLinkHtml } from '../lib/custom-link';
+import {
+  PRIVATE_APP_URL,
+  htmlResponse,
+  privateAliasNotFoundResponse,
+  privateLoginRequiredResponse,
+  publicBadRequestResponse,
+} from '../lib/responses';
+import { resolveTemplateUrl, TemplateResolutionError } from '../lib/templates';
+import { parseAliasPath } from './redirect';
+
+type PrivateLinkRow = {
+  id: string;
+  alias: string;
+  link_type: 'redirect' | 'custom';
+  target_url: string | null;
+  content_markdown: string | null;
+  click_count: number;
+};
+
+const PRIVATE_LINK_QUERY = `SELECT id, alias, link_type, target_url, content_markdown, click_count
+FROM links
+WHERE scope='private' AND status='active' AND owner_user_id=? AND alias=?
+LIMIT 1`;
+
+const CLICK_COUNT_UPDATE = `UPDATE links SET click_count = click_count + 1, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id=?`;
+
+export function isHeygoPrivateHost(url: URL): boolean {
+  return url.hostname === 'my.heygo.cc';
+}
+
+export async function handlePrivateShortlink(
+  request: Request,
+  env: Env,
+  ctx: Pick<ExecutionContext, 'waitUntil'>,
+): Promise<Response> {
+  const url = new URL(request.url);
+
+  // Root: authenticated users go to the private links app; everyone else gets a login prompt.
+  if (url.pathname === '/') {
+    const user = await getCurrentUser(request, env);
+    if (!user) {
+      return privateLoginRequiredResponse();
+    }
+    return Response.redirect(PRIVATE_APP_URL, 302);
+  }
+
+  const pathParts = parseAliasPath(url.pathname);
+  if (!pathParts) {
+    return privateNotFoundOrLogin(request, env);
+  }
+
+  const aliasValidation = validateAlias(pathParts.alias);
+  if (!aliasValidation.ok || aliasValidation.value !== pathParts.alias.toLowerCase()) {
+    return privateNotFoundOrLogin(request, env);
+  }
+
+  const user = await getCurrentUser(request, env);
+  if (!user) {
+    return privateLoginRequiredResponse();
+  }
+
+  const link = await env.DB.prepare(PRIVATE_LINK_QUERY)
+    .bind(user.id, aliasValidation.value)
+    .first<PrivateLinkRow>();
+  if (!link) {
+    return privateAliasNotFoundResponse();
+  }
+
+  ctx.waitUntil(recordClick(env.DB, link.id));
+
+  if (link.link_type === 'redirect') {
+    if (!link.target_url) {
+      return privateAliasNotFoundResponse();
+    }
+
+    try {
+      const location = resolveTemplateUrl({
+        targetUrl: link.target_url,
+        pathParam: pathParts.pathParam,
+        query: url.searchParams,
+      });
+
+      return Response.redirect(location, 302);
+    } catch (error) {
+      if (error instanceof TemplateResolutionError) {
+        return publicBadRequestResponse(error.message);
+      }
+
+      throw error;
+    }
+  }
+
+  if (link.link_type === 'custom') {
+    return htmlResponse(renderCustomLinkHtml(link), { status: 200 });
+  }
+
+  return privateAliasNotFoundResponse();
+}
+
+async function privateNotFoundOrLogin(request: Request, env: Env): Promise<Response> {
+  const user = await getCurrentUser(request, env);
+  if (!user) {
+    return privateLoginRequiredResponse();
+  }
+  return privateAliasNotFoundResponse();
+}
+
+async function recordClick(db: D1Database, linkId: string): Promise<void> {
+  try {
+    await db.prepare(CLICK_COUNT_UPDATE).bind(linkId).run();
+  } catch {
+    // Analytics must never block or break a private redirect/render.
+  }
+}
\ No newline at end of file
diff --git a/worker/routes/redirect.ts b/worker/routes/redirect.ts
index c65c6cf..2de2ce5 100644
--- a/worker/routes/redirect.ts
+++ b/worker/routes/redirect.ts
@@ -1,6 +1,7 @@
 import type { Env } from '../env';
 import { validateAlias } from '../lib/aliases';
-import { escapeHtml, htmlResponse, publicBadRequestResponse, publicNotFoundResponse } from '../lib/responses';
+import { renderCustomLinkHtml } from '../lib/custom-link';
+import { htmlResponse, publicBadRequestResponse, publicNotFoundResponse } from '../lib/responses';
 import { resolveTemplateUrl, TemplateResolutionError } from '../lib/templates';
 
 type PublicLinkRow = {
@@ -76,7 +77,7 @@ export async function handlePublicShortlink(
   }
 
   if (link.link_type === 'custom') {
-    return htmlResponse(renderCustomLink(link), { status: 200 });
+    return htmlResponse(renderCustomLinkHtml(link), { status: 200 });
   }
 
   return publicNotFoundResponse();
@@ -87,7 +88,7 @@ type ParsedAliasPath = {
   pathParam?: string;
 };
 
-function parseAliasPath(pathname: string): ParsedAliasPath | null {
+export function parseAliasPath(pathname: string): ParsedAliasPath | null {
   const rawSegments = pathname.split('/').slice(1);
 
   if (rawSegments.length === 0 || rawSegments.length > 2 || rawSegments[0] === '') {
@@ -114,46 +115,3 @@ async function recordClick(db: D1Database, linkId: string): Promise<void> {
     // Analytics must never block or break a public redirect/render.
   }
 }
-
-function renderCustomLink(link: PublicLinkRow): string {
-  const content = renderMarkdown(link.content_markdown ?? '');
-  const title = escapeHtml(link.alias);
-
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title}</title></head><body><main>${content}</main></body></html>`;
-}
-
-function renderMarkdown(markdown: string): string {
-  const lines = markdown.replace(/\r\n?/g, '\n').split('\n');
-  const rendered: string[] = [];
-  let paragraph: string[] = [];
-
-  const flushParagraph = () => {
-    if (paragraph.length > 0) {
-      rendered.push(`<p>${paragraph.join('<br>')}</p>`);
-      paragraph = [];
-    }
-  };
-
-  for (const line of lines) {
-    const escaped = escapeHtml(line);
-    const heading = escaped.match(/^(#{1,6})\s+(.*)$/);
-
-    if (heading) {
-      flushParagraph();
-      const level = heading[1].length;
-      rendered.push(`<h${level}>${heading[2]}</h${level}>`);
-      continue;
-    }
-
-    if (escaped.trim() === '') {
-      flushParagraph();
-      continue;
-    }
-
-    paragraph.push(escaped);
-  }
-
-  flushParagraph();
-
-  return rendered.join('\n');
-}