From e7c15aad3066f20ba47a6cad84cba8692d8f8dc5 Mon Sep 17 00:00:00 2001
From: biast12 <53872542+biast12@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:45:31 +0200
Subject: [PATCH] Overhaul Discord markdown rendering

Replace the basic markdown parser with feature-complete frontend and email renderers supporting lists, paragraphs, timestamps, ANSI code blocks, Unicode and custom emoji, Discord links, mentions, navigation tags, entity-aware previews, and safer URL handling.
---
 backend/email/markdown.go                     |  781 ++------
 backend/email/markdown_legacy_url.go          |  188 ++
 backend/email/markdown_links.go               |  497 +++++
 backend/email/markdown_parse.go               | 1721 +++++++++++++++++
 backend/email/markdown_url.go                 |  827 ++++++++
 backend/go.mod                                |    2 +-
 frontend/package-lock.json                    |   10 +
 frontend/package.json                         |    1 +
 frontend/src/components/EmbedPreview.tsx      |   26 +-
 frontend/src/components/FormInputRow.tsx      |    4 +
 frontend/src/components/PanelPreview.tsx      |   28 +-
 .../src/components/discord/DiscordContent.tsx |  392 +++-
 .../src/components/discord/DiscordEmbed.tsx   |   16 +-
 .../src/components/discord/DiscordMessage.tsx |   17 +-
 .../src/components/discord/DiscordText.tsx    |   23 +-
 .../discord/container/Container.tsx           |    1 +
 .../components/discord/container/Section.tsx  |    1 +
 .../src/components/discord/discord-markup.css |  195 ++
 frontend/src/components/discord/types.ts      |    5 +
 .../gallery/GalleryListingPreview.tsx         |   75 +-
 .../components/modals/GalleryPreviewModal.tsx |    5 +-
 .../src/components/modals/TagEditorModal.tsx  |    6 +
 frontend/src/hooks/usePreviewEntities.ts      |   20 +
 frontend/src/lib/discord-ansi.ts              |   43 +
 frontend/src/lib/discord-emoji/index.ts       |   39 +
 frontend/src/lib/discord-emoji/table.ts       |   79 +
 frontend/src/lib/discord-markdown.ts          |  312 ---
 frontend/src/lib/discord-markdown/engine.ts   |  162 ++
 frontend/src/lib/discord-markdown/index.ts    |  148 ++
 .../src/lib/discord-markdown/legacy-url.ts    |  121 ++
 frontend/src/lib/discord-markdown/links.ts    |  414 ++++
 frontend/src/lib/discord-markdown/rules.ts    |  792 ++++++++
 frontend/src/lib/discord-markdown/types.ts    |   41 +
 frontend/src/lib/discord-time.ts              |  119 ++
 frontend/src/pages/Notifications.tsx          |    6 +-
 frontend/src/pages/manage/tickets/view.tsx    |   14 +-
 .../src/pages/manage/transcripts/view.tsx     |    4 +-
 37 files changed, 6125 insertions(+), 1010 deletions(-)
 create mode 100644 backend/email/markdown_legacy_url.go
 create mode 100644 backend/email/markdown_links.go
 create mode 100644 backend/email/markdown_parse.go
 create mode 100644 backend/email/markdown_url.go
 create mode 100644 frontend/src/components/discord/discord-markup.css
 create mode 100644 frontend/src/hooks/usePreviewEntities.ts
 create mode 100644 frontend/src/lib/discord-ansi.ts
 create mode 100644 frontend/src/lib/discord-emoji/index.ts
 create mode 100644 frontend/src/lib/discord-emoji/table.ts
 delete mode 100644 frontend/src/lib/discord-markdown.ts
 create mode 100644 frontend/src/lib/discord-markdown/engine.ts
 create mode 100644 frontend/src/lib/discord-markdown/index.ts
 create mode 100644 frontend/src/lib/discord-markdown/legacy-url.ts
 create mode 100644 frontend/src/lib/discord-markdown/links.ts
 create mode 100644 frontend/src/lib/discord-markdown/rules.ts
 create mode 100644 frontend/src/lib/discord-markdown/types.ts
 create mode 100644 frontend/src/lib/discord-time.ts

diff --git a/backend/email/markdown.go b/backend/email/markdown.go
index 20e47e5f..02845f74 100644
--- a/backend/email/markdown.go
+++ b/backend/email/markdown.go
@@ -1,71 +1,14 @@
 package email
 
-// Renders Discord message formatting as HTML or plain text.
-//
-// Go's regexp has no lookahead, so the paired-delimiter rules are hand-scanned
-// rather than matched. Input is not escaped before parsing — that would turn
-// `<@123>` into `&lt;@123&gt;` and break every `<` rule; the emitters escape leaves
-// and attributes instead.
-
 import (
 	"fmt"
 	"html"
-	"net/url"
 	"regexp"
 	"strconv"
 	"strings"
 	"time"
 )
 
-type mdKind int
-
-const (
-	kindText mdKind = iota
-	kindCode
-	kindCodeBlock
-	kindUserMention
-	kindRoleMention
-	kindChannelMention
-	kindGlobalMention
-	kindEmoji
-	kindTimestamp
-	kindMark
-	kindLink
-	kindHeading
-	kindSubtext
-	kindQuote
-)
-
-type mdMark int
-
-const (
-	markBold mdMark = iota
-	markItalic
-	markUnderline
-	markStrike
-	markSpoiler
-)
-
-type mdNode struct {
-	kind     mdKind
-	value    string // text, code, mention id, emoji name, "everyone"/"here"
-	lang     string // codeBlock
-	mark     mdMark // mark
-	url      string // link
-	level    int    // heading, 1-3
-	unix     int64  // timestamp
-	animated bool   // emoji
-	children []mdNode
-}
-
-func textNode(value string) mdNode {
-	return mdNode{kind: kindText, value: value}
-}
-
-func markNode(m mdMark, body string) mdNode {
-	return mdNode{kind: kindMark, mark: m, children: parseInline(body)}
-}
-
 func RenderDiscordMarkdown(src string) string {
 	var sb strings.Builder
 	renderHTML(parseDiscordMarkdown(src), &sb)
@@ -78,473 +21,14 @@ func RenderDiscordMarkdownText(src string) string {
 	return strings.TrimSpace(sb.String())
 }
 
-func parseDiscordMarkdown(input string) []mdNode {
-	if input == "" {
-		return nil
-	}
-	return parseBlocks(reCarriageReturn.ReplaceAllString(input, "\n"), true)
-}
-
-var (
-	reCarriageReturn = regexp.MustCompile(`\r\n?`)
-	reTripleQuote    = regexp.MustCompile("(?:^|\n) *>>> ")
-	reFence          = regexp.MustCompile("(?s)```(?:([A-Za-z0-9+#._-]*)\n)?(.*?)```\n?")
-	reHeading        = regexp.MustCompile(`^ {0,3}(#{1,3}) (.*)$`)
-	reSubtext        = regexp.MustCompile(`^ {0,3}-# (.*)$`)
-)
-
-func parseBlocks(src string, allowTriple bool) []mdNode {
-	// `>>> ` quotes everything after it, fences included, so it runs first. A nested
-	// `>>>` is literal, which is what allowTriple=false on the recursion gives.
-	if allowTriple {
-		if loc := reTripleQuote.FindStringIndex(src); loc != nil {
-			var out []mdNode
-			if head := src[:loc[0]]; head != "" {
-				out = parseBlocks(head, false)
-			}
-			return append(out, mdNode{kind: kindQuote, children: parseBlocks(src[loc[1]:], false)})
-		}
-	}
-
-	var out []mdNode
-	last := 0
-
-	for _, m := range reFence.FindAllStringSubmatchIndex(src, -1) {
-		if m[0] > last {
-			// Drop the newline that ended the preceding text run.
-			out = append(out, parseLines(strings.TrimSuffix(src[last:m[0]], "\n"))...)
-		}
-
-		var lang, code string
-		if m[2] >= 0 {
-			lang = src[m[2]:m[3]]
-		}
-		if m[4] >= 0 {
-			code = src[m[4]:m[5]]
-		}
-		// One trailing newline only; trimming all whitespace would eat indentation.
-		out = append(out, mdNode{kind: kindCodeBlock, lang: lang, value: strings.TrimSuffix(code, "\n")})
-		last = m[1]
-	}
-
-	if last < len(src) {
-		out = append(out, parseLines(src[last:])...)
-	}
-	return out
-}
-
-func parseLines(src string) []mdNode {
-	if src == "" {
-		return nil
-	}
-
-	var out []mdNode
-	var buf []string
-	lines := strings.Split(src, "\n")
-
-	flush := func() {
-		if len(buf) > 0 {
-			out = append(out, parseInline(strings.Join(buf, "\n"))...)
-			buf = nil
-		}
-	}
-
-	for i := 0; i < len(lines); i++ {
-		line := lines[i]
-
-		if m := reHeading.FindStringSubmatch(line); m != nil {
-			flush()
-			out = append(out, mdNode{kind: kindHeading, level: len(m[1]), children: parseInline(m[2])})
-			continue
-		}
-
-		if m := reSubtext.FindStringSubmatch(line); m != nil {
-			flush()
-			out = append(out, mdNode{kind: kindSubtext, children: parseInline(m[1])})
-			continue
-		}
-
-		if quoted, ok := matchQuoteLine(line); ok {
-			flush()
-			body := []string{quoted}
-			// Stops at the first non-quote line, so `> a\n\n> b` is two quotes.
-			for i+1 < len(lines) {
-				ahead, ok := matchQuoteLine(lines[i+1])
-				if !ok {
-					break
-				}
-				body = append(body, ahead)
-				i++
-			}
-			out = append(out, mdNode{kind: kindQuote, children: parseInline(strings.Join(body, "\n"))})
-			continue
-		}
-
-		buf = append(buf, line)
-	}
-
-	flush()
-	return out
-}
-
-func matchQuoteLine(line string) (string, bool) {
-	i := 0
-	for i < 3 && i < len(line) && line[i] == ' ' {
-		i++
-	}
-	if i >= len(line) || line[i] != '>' {
-		return "", false
-	}
-	i++
-
-	// `>>> ` is the triple quote, handled in parseBlocks.
-	if strings.HasPrefix(line[i:], ">>") {
-		return "", false
-	}
-
-	start := i
-	for i < len(line) && line[i] == ' ' {
-		i++
-	}
-	if i == start {
-		return "", false
-	}
-	return line[i:], true
-}
-
-type inlineRule func(src string, at int) (mdNode, int, bool)
-
-var (
-	// Populated in init rather than inline: the rules call parseInline, which reads
-	// this map back, and Go rejects that as an initialization cycle.
-	inlineRules map[byte][]inlineRule
-
-	// First character of every rule above, plus the escape marker.
-	triggers [256]bool
-)
-
-func init() {
-	// Rules under different keys can't collide, so only the order within a key
-	// matters: `**` before `*`, `__` before `_`, role mentions before user mentions.
-	inlineRules = map[byte][]inlineRule{
-		'`': {matchCodeSpan},
-		'|': {matchSpoiler},
-		'*': {matchBold, matchItalicStar},
-		'_': {matchUnderline, matchItalicUnderscore},
-		'~': {matchStrike},
-		'<': {matchEmoji, matchTimestamp, matchRoleMention, matchUserMention, matchChannelMention, matchAngleLink},
-		'@': {matchGlobalMention},
-		'[': {matchMaskedLink},
-		'h': {matchBareLink},
-	}
-
-	triggers['\\'] = true
-	for c := range inlineRules {
-		triggers[c] = true
-	}
-}
-
-var reEscape = regexp.MustCompile(`^\\([^0-9A-Za-z\s])`)
-
-func parseInline(src string) []mdNode {
-	var out []mdNode
-	var buf strings.Builder
-	cursor := 0
-
-	flush := func() {
-		if buf.Len() > 0 {
-			out = append(out, textNode(buf.String()))
-			buf.Reset()
-		}
-	}
-
-	for cursor < len(src) {
-		c := src[cursor]
-
-		if c == '\\' {
-			if m := reEscape.FindStringSubmatch(src[cursor:]); m != nil {
-				buf.WriteString(m[1])
-				cursor += len(m[0])
-				continue
-			}
-		}
-
-		matched := false
-		for _, rule := range inlineRules[c] {
-			node, end, ok := rule(src, cursor)
-			// Require forward progress; a zero-length match would spin forever.
-			if !ok || end <= cursor {
-				continue
-			}
-			flush() // before the append, or text comes out in the wrong order
-			out = append(out, node)
-			cursor = end
-			matched = true
-			break
-		}
-		if matched {
-			continue
-		}
-
-		next := cursor + 1
-		for next < len(src) && !triggers[src[next]] {
-			next++
-		}
-		buf.WriteString(src[cursor:next])
-		cursor = next
-	}
-
-	flush()
-	return out
-}
-
-// matchPair handles the delimiters whose body is any run of characters. guard rejects
-// a closing run followed by another delimiter character; strike and spoiler skip it
-// because Discord allows a stray `~`, making `~~~a~~~` render as <s>~a</s>~.
-func matchPair(src string, at int, delim string, m mdMark, guard bool) (mdNode, int, bool) {
-	if !strings.HasPrefix(src[at:], delim) {
-		return mdNode{}, 0, false
-	}
-
-	n := len(delim)
-	// The body needs at least one character, hence the extra +1.
-	for i := at + n + 1; i+n <= len(src); i++ {
-		if !strings.HasPrefix(src[i:], delim) {
-			continue
-		}
-		if guard && i+n < len(src) && src[i+n] == delim[0] {
-			continue
-		}
-		return markNode(m, src[at+n:i]), i + n, true
-	}
-	return mdNode{}, 0, false
-}
-
-func matchBold(src string, at int) (mdNode, int, bool) {
-	return matchPair(src, at, "**", markBold, true)
-}
-
-func matchUnderline(src string, at int) (mdNode, int, bool) {
-	return matchPair(src, at, "__", markUnderline, true)
-}
-
-func matchStrike(src string, at int) (mdNode, int, bool) {
-	return matchPair(src, at, "~~", markStrike, false)
-}
-
-func matchSpoiler(src string, at int) (mdNode, int, bool) {
-	return matchPair(src, at, "||", markSpoiler, false)
-}
-
-// The opening guard is what keeps `5 * 3 = 15` from italicising.
-func matchItalicStar(src string, at int) (mdNode, int, bool) {
-	if at+1 >= len(src) || src[at+1] == '*' || isSpaceByte(src[at+1]) {
-		return mdNode{}, 0, false
-	}
-
-	for i := at + 1; i < len(src); i++ {
-		if src[i] != '*' {
-			continue
-		}
-		if i+1 < len(src) && src[i+1] == '*' {
-			// Part of the body, not a closing delimiter.
-			i++
-			continue
-		}
-		return markNode(markItalic, src[at+1:i]), i + 1, true
-	}
-	return mdNode{}, 0, false
-}
-
-// The word-character guards are what keep snake_case_words plain. A lone `_` can't
-// appear in the body, so a failed closing guard fails the whole match.
-func matchItalicUnderscore(src string, at int) (mdNode, int, bool) {
-	if at > 0 && isWordByte(src[at-1]) {
-		return mdNode{}, 0, false
-	}
-
-	for i := at + 1; i < len(src); i++ {
-		if src[i] != '_' {
-			continue
-		}
-		if i+1 < len(src) && src[i+1] == '_' {
-			i++
-			continue
-		}
-		if i == at+1 {
-			return mdNode{}, 0, false
-		}
-		if i+1 < len(src) && isWordByte(src[i+1]) {
-			return mdNode{}, 0, false
-		}
-		return markNode(markItalic, src[at+1:i]), i + 1, true
-	}
-	return mdNode{}, 0, false
-}
-
-// Contents are terminal and never re-parsed. Requiring a non-backtick before the
-// close, and rejecting one followed by a backtick, is what stops an unclosed ```
-// fence being eaten as a one-backtick span.
-func matchCodeSpan(src string, at int) (mdNode, int, bool) {
-	n := 1
-	if at+1 < len(src) && src[at+1] == '`' {
-		n = 2
-	}
-	delim := src[at : at+n]
-
-	for i := at + n + 1; i+n <= len(src); i++ {
-		if !strings.HasPrefix(src[i:], delim) {
-			continue
-		}
-		if src[i-1] == '`' {
-			continue
-		}
-		if i+n < len(src) && src[i+n] == '`' {
-			continue
-		}
-		return mdNode{kind: kindCode, value: src[at+n : i]}, i + n, true
-	}
-	return mdNode{}, 0, false
-}
-
-var (
-	reEmoji          = regexp.MustCompile(`^<(a)?:(\w+):(\d+)>`)
-	reTimestamp      = regexp.MustCompile(`^<t:(-?\d+)(?::([tTdDfFR]))?>`)
-	reRoleMention    = regexp.MustCompile(`^<@&(\d+)>`)
-	reUserMention    = regexp.MustCompile(`^<@!?(\d+)>`)
-	reChannelMention = regexp.MustCompile(`^<#(\d+)>`)
-	reAngleLink      = regexp.MustCompile(`^<(https?://[^\s<>]+)>`)
-	reGlobalMention  = regexp.MustCompile(`^@(everyone|here)\b`)
-	reMaskedLink = regexp.MustCompile(`^\[((?:[^\][]|\[[^\]]*\])+)\]\((?:<(https?://[^\s<>]+)>|((?:[^()\s]|\([^()\s]*\))+))\)`)
-	// The final class excludes trailing punctuation, so `(https://example.com/x.)`
-	// keeps the `.)`.
-	reBareLink = regexp.MustCompile(`^https?://[^\s<]*[^<.,:;"')\]\s]`)
-)
-
-func matchEmoji(src string, at int) (mdNode, int, bool) {
-	m := reEmoji.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	return mdNode{kind: kindEmoji, value: m[2], url: m[3], animated: m[1] == "a"}, at + len(m[0]), true
-}
-
-// Past this a formatted date is nonsense, so the tag is left literal.
-const maxTimestampSeconds = 8.64e12
-
-func matchTimestamp(src string, at int) (mdNode, int, bool) {
-	m := reTimestamp.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-
-	unix, err := strconv.ParseInt(m[1], 10, 64)
-	if err != nil || unix > maxTimestampSeconds || unix < -maxTimestampSeconds {
-		return textNode(m[0]), at + len(m[0]), true
-	}
-	return mdNode{kind: kindTimestamp, unix: unix}, at + len(m[0]), true
-}
-
-func matchRoleMention(src string, at int) (mdNode, int, bool) {
-	m := reRoleMention.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	return mdNode{kind: kindRoleMention, value: m[1]}, at + len(m[0]), true
-}
-
-func matchUserMention(src string, at int) (mdNode, int, bool) {
-	m := reUserMention.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	return mdNode{kind: kindUserMention, value: m[1]}, at + len(m[0]), true
-}
-
-func matchChannelMention(src string, at int) (mdNode, int, bool) {
-	m := reChannelMention.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	return mdNode{kind: kindChannelMention, value: m[1]}, at + len(m[0]), true
-}
-
-func matchAngleLink(src string, at int) (mdNode, int, bool) {
-	m := reAngleLink.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	return buildLink(m[1], m[0], nil), at + len(m[0]), true
-}
-
-// The left guard stops support@here.example.com growing an @here pill.
-func matchGlobalMention(src string, at int) (mdNode, int, bool) {
-	if at > 0 && (isWordByte(src[at-1]) || src[at-1] == '@') {
-		return mdNode{}, 0, false
-	}
-	m := reGlobalMention.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	return mdNode{kind: kindGlobalMention, value: m[1]}, at + len(m[0]), true
-}
-
-func matchMaskedLink(src string, at int) (mdNode, int, bool) {
-	m := reMaskedLink.FindStringSubmatch(src[at:])
-	if m == nil {
-		return mdNode{}, 0, false
-	}
-	rawURL := m[2]
-	if rawURL == "" {
-		rawURL = m[3]
-	}
-	return buildLink(rawURL, m[0], &m[1]), at + len(m[0]), true
-}
-
-func matchBareLink(src string, at int) (mdNode, int, bool) {
-	m := reBareLink.FindString(src[at:])
-	if m == "" {
-		return mdNode{}, 0, false
-	}
-	return buildLink(m, m, nil), at + len(m), true
-}
-
-// buildLink falls back to the raw source for unsafe URLs, so the text stays visible.
-func buildLink(rawURL, raw string, label *string) mdNode {
-	if !isSafeURL(rawURL) {
-		return textNode(raw)
-	}
-
-	children := []mdNode{textNode(rawURL)}
-	if label != nil {
-		children = parseInline(*label)
-	}
-	return mdNode{kind: kindLink, url: rawURL, children: children}
-}
-
-// url.Parse accepts "/foo" with an empty scheme, so a host is required too.
-func isSafeURL(raw string) bool {
-	u, err := url.Parse(raw)
-	if err != nil {
-		return false
-	}
-	return (u.Scheme == "http" || u.Scheme == "https") && u.Host != ""
-}
-
-func isWordByte(c byte) bool {
-	return c == '_' || (c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
-}
-
-func isSpaceByte(c byte) bool {
-	return c == ' ' || c == '\t' || c == '\n' || c == '\r' || c == '\f' || c == '\v'
-}
-
-// Inline styles throughout, since email clients strip <style> blocks.
 const (
 	styleCode      = `background-color:#111827;color:#e5e7eb;padding:2px 6px;border-radius:4px;font-family:'SFMono-Regular',Consolas,'Liberation Mono',Menlo,monospace;font-size:13px;`
 	stylePre       = `background-color:#111827;border:1px solid #374151;border-radius:6px;padding:12px;margin:8px 0;overflow-x:auto;`
 	stylePreCode   = `color:#e5e7eb;font-family:'SFMono-Regular',Consolas,'Liberation Mono',Menlo,monospace;font-size:13px;`
 	styleSubtext   = `font-size:12px;line-height:1.5;color:#9ca3af;`
+	styleParagraph = `margin:0 0 8px 0;`
+	styleList      = `margin:4px 0;padding-left:24px;`
+	styleListItem  = `margin:2px 0;`
 	styleLink      = `color:#60a5fa;text-decoration:underline;`
 	styleUserPill  = `background-color:#1e3a5f;color:#93c5fd;padding:0 4px;border-radius:3px;`
 	styleRolePill  = `background-color:#33363b;color:#b9bbbe;padding:0 4px;border-radius:3px;font-weight:500;`
@@ -560,30 +44,68 @@ var headingStyles = map[int]string{
 	3: `font-size:17px;font-weight:700;color:#ffffff;margin:8px 0 4px 0;`,
 }
 
+var guildNavLabels = map[string]string{
+	"home":         "Server Guide",
+	"guide":        "Server Guide",
+	"browse":       "Browse Channels",
+	"customize":    "Channels & Roles",
+	"linked-roles": "Linked Roles",
+}
+
+var reANSIEscape = regexp.MustCompile("\x1b\\[[0-9;]*m")
+
+func codeBlockText(n mdNode) string {
+	if strings.EqualFold(n.lang, "ansi") {
+		return reANSIEscape.ReplaceAllString(n.text, "")
+	}
+	return n.text
+}
+
+func linkHref(url string) (string, bool) {
+	scheme, _, ok := strings.Cut(url, ":")
+	if !ok || strings.ContainsFunc(url, func(r rune) bool { return r <= ' ' || r == 0x7f }) {
+		return "", false
+	}
+	switch strings.ToLower(scheme) {
+	case "http", "https", "mailto", "tel", "sms":
+		return url, true
+	}
+	return "", false
+}
+
+func dropNewlineAfterCodeBlock(nodes []mdNode, i int) mdNode {
+	n := nodes[i]
+	if n.kind == mdText && i > 0 && nodes[i-1].kind == mdCodeBlock {
+		n.text = strings.TrimPrefix(n.text, "\n")
+	}
+	return n
+}
+
 func renderHTML(nodes []mdNode, sb *strings.Builder) {
-	for _, n := range nodes {
-		renderNodeHTML(n, sb)
+	for i := range nodes {
+		renderNodeHTML(dropNewlineAfterCodeBlock(nodes, i), sb)
 	}
 }
 
 func renderNodeHTML(n mdNode, sb *strings.Builder) {
 	switch n.kind {
-	case kindText:
-		// Email clients don't reliably honour white-space, so newlines become <br>.
-		sb.WriteString(strings.ReplaceAll(html.EscapeString(n.value), "\n", "<br>"))
+	case mdText:
+		sb.WriteString(strings.ReplaceAll(html.EscapeString(n.text), "\n", "<br>"))
+
+	case mdBr:
+		sb.WriteString("<br>")
 
-	case kindCode:
-		fmt.Fprintf(sb, `<code style="%s">%s</code>`, styleCode, html.EscapeString(n.value))
+	case mdCode:
+		fmt.Fprintf(sb, `<code style="%s">%s</code>`, styleCode, html.EscapeString(n.text))
 
-	case kindCodeBlock:
-		// Newlines inside <pre> are significant, so no <br> substitution here.
+	case mdCodeBlock:
 		fmt.Fprintf(sb, `<pre style="%s"><code style="%s">%s</code></pre>`,
-			stylePre, stylePreCode, html.EscapeString(n.value))
+			stylePre, stylePreCode, html.EscapeString(codeBlockText(n)))
 
-	case kindMark:
+	case mdMark:
 		renderMarkHTML(n, sb)
 
-	case kindHeading:
+	case mdHeading:
 		style, ok := headingStyles[n.level]
 		if !ok {
 			style = headingStyles[3]
@@ -592,12 +114,17 @@ func renderNodeHTML(n mdNode, sb *strings.Builder) {
 		renderHTML(n.children, sb)
 		sb.WriteString(`</div>`)
 
-	case kindSubtext:
+	case mdSubtext:
 		fmt.Fprintf(sb, `<div style="%s">`, styleSubtext)
 		renderHTML(n.children, sb)
 		sb.WriteString(`</div>`)
 
-	case kindQuote:
+	case mdParagraph:
+		fmt.Fprintf(sb, `<div style="%s">`, styleParagraph)
+		renderHTML(n.children, sb)
+		sb.WriteString(`</div>`)
+
+	case mdQuote:
 		// A table rather than border-left: Outlook drops borders on divs.
 		sb.WriteString(`<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:6px 0;"><tr>` +
 			`<td width="3" style="width:3px;background-color:#4b5563;font-size:1px;line-height:1px;">&nbsp;</td>` +
@@ -605,30 +132,66 @@ func renderNodeHTML(n mdNode, sb *strings.Builder) {
 		renderHTML(n.children, sb)
 		sb.WriteString(`</td></tr></table>`)
 
-	case kindLink:
-		fmt.Fprintf(sb, `<a href="%s" target="_blank" style="%s">`, html.EscapeString(n.url), styleLink)
+	case mdList:
+		tag := "ul"
+		if n.ordered {
+			tag = "ol"
+		}
+		fmt.Fprintf(sb, `<%s`, tag)
+		if n.ordered && n.start != 1 {
+			fmt.Fprintf(sb, ` start="%d"`, n.start)
+		}
+		fmt.Fprintf(sb, ` style="%s">`, styleList)
+		for _, item := range n.items {
+			fmt.Fprintf(sb, `<li style="%s">`, styleListItem)
+			renderHTML(item, sb)
+			sb.WriteString(`</li>`)
+		}
+		fmt.Fprintf(sb, `</%s>`, tag)
+
+	case mdLink:
+		href, ok := linkHref(n.url)
+		if !ok {
+			renderHTML(n.children, sb)
+			return
+		}
+		fmt.Fprintf(sb, `<a href="%s" target="_blank" rel="noopener noreferrer" style="%s"`, html.EscapeString(href), styleLink)
+		if n.title != "" {
+			fmt.Fprintf(sb, ` title="%s"`, html.EscapeString(n.title))
+		}
+		sb.WriteString(`>`)
 		renderHTML(n.children, sb)
 		sb.WriteString(`</a>`)
 
-	// There are no names to resolve here, so mentions keep their raw form.
-	case kindUserMention:
-		fmt.Fprintf(sb, `<span style="%s">&lt;@%s&gt;</span>`, styleUserPill, html.EscapeString(n.value))
+	case mdUserMention:
+		fmt.Fprintf(sb, `<span style="%s">&lt;@%s&gt;</span>`, styleUserPill, html.EscapeString(n.id))
 
-	case kindRoleMention:
-		fmt.Fprintf(sb, `<span style="%s">&lt;@&amp;%s&gt;</span>`, styleRolePill, html.EscapeString(n.value))
+	case mdRoleMention:
+		fmt.Fprintf(sb, `<span style="%s">&lt;@&amp;%s&gt;</span>`, styleRolePill, html.EscapeString(n.id))
 
-	case kindChannelMention:
+	case mdChannelMention:
+		if href, ok := linkHref(n.url); ok {
+			escaped := html.EscapeString(href)
+			fmt.Fprintf(sb, `<a href="%s" target="_blank" rel="noopener noreferrer" style="%s">%s</a>`, escaped, styleLink, escaped)
+			return
+		}
 		fmt.Fprintf(sb, `<span style="%s">#channel</span>`, styleChanPill)
 
-	case kindGlobalMention:
-		fmt.Fprintf(sb, `<span style="%s">@%s</span>`, styleUserPill, html.EscapeString(n.value))
+	case mdGlobalMention:
+		fmt.Fprintf(sb, `<span style="%s">@%s</span>`, styleUserPill, html.EscapeString(n.name))
+
+	case mdCommandMention:
+		fmt.Fprintf(sb, `<span style="%s">/%s</span>`, styleUserPill, html.EscapeString(n.name))
 
-	case kindEmoji:
+	case mdGuildNav:
+		fmt.Fprintf(sb, `<span style="%s">%s</span>`, styleChanPill, html.EscapeString(guildNavLabels[n.name]))
+
+	case mdEmoji:
 		fmt.Fprintf(sb, `<img src="%s" alt=":%s:" title=":%s:" width="20" height="20" style="display:inline-block;vertical-align:-4px;">`,
-			html.EscapeString(emojiURL(n.url, n.animated)), html.EscapeString(n.value), html.EscapeString(n.value))
+			html.EscapeString(emojiURL(n.id, n.animated)), html.EscapeString(n.name), html.EscapeString(n.name))
 
-	case kindTimestamp:
-		fmt.Fprintf(sb, `<span style="%s">%s</span>`, styleTimestamp, html.EscapeString(formatTimestamp(n.unix)))
+	case mdTimestamp:
+		fmt.Fprintf(sb, `<span style="%s">%s</span>`, styleTimestamp, html.EscapeString(formatTimestamp(n.unix, n.style)))
 	}
 }
 
@@ -660,48 +223,86 @@ func emojiURL(id string, animated bool) string {
 	return fmt.Sprintf("https://cdn.discordapp.com/emojis/%s.%s", id, ext)
 }
 
-// UTC, since there is no recipient timezone to render in.
-func formatTimestamp(unix int64) string {
-	return time.Unix(unix, 0).UTC().Format("2 Jan 2006, 15:04") + " UTC"
+var timestampLayouts = map[byte]string{
+	't': "15:04",
+	'T': "15:04:05",
+	'd': "02/01/2006",
+	'D': "2 January 2006",
+	'f': "2 January 2006 15:04",
+	'F': "Monday, 2 January 2006 15:04",
+	's': "02/01/2006 15:04",
+	'S': "02/01/2006 15:04:05",
+	// Emails are read later, so relative times are shown in full.
+	'R': "2 January 2006 15:04",
+}
+
+func formatTimestamp(unix int64, style byte) string {
+	layout, ok := timestampLayouts[style]
+	if !ok {
+		layout = timestampLayouts['f']
+	}
+	return time.Unix(unix, 0).UTC().Format(layout) + " UTC"
 }
 
 func renderText(nodes []mdNode, sb *strings.Builder) {
-	for _, n := range nodes {
-		renderNodeText(n, sb)
+	for i := range nodes {
+		renderNodeText(dropNewlineAfterCodeBlock(nodes, i), sb)
+	}
+}
+
+func startLine(sb *strings.Builder) {
+	if s := sb.String(); s != "" && !strings.HasSuffix(s, "\n") {
+		sb.WriteByte('\n')
+	}
+}
+
+func writeLines(sb *strings.Builder, nodes []mdNode, first, rest string) {
+	var inner strings.Builder
+	renderText(nodes, &inner)
+	for i, line := range strings.Split(strings.TrimRight(inner.String(), "\n"), "\n") {
+		prefix := rest
+		if i == 0 {
+			prefix = first
+		}
+		sb.WriteString(strings.TrimRight(prefix+line, " ") + "\n")
 	}
 }
 
 func renderNodeText(n mdNode, sb *strings.Builder) {
 	switch n.kind {
-	case kindText:
-		sb.WriteString(n.value)
+	case mdText, mdCode:
+		sb.WriteString(n.text)
 
-	case kindCode:
-		sb.WriteString(n.value)
+	case mdBr:
+		sb.WriteString("\n")
 
-	case kindCodeBlock:
-		sb.WriteString("\n\n" + n.value + "\n\n")
+	case mdCodeBlock:
+		startLine(sb)
+		sb.WriteString("```\n" + strings.TrimSuffix(codeBlockText(n), "\n") + "\n```\n")
 
-	case kindMark:
+	case mdMark:
 		renderText(n.children, sb)
 
-	case kindHeading:
-		sb.WriteString("\n")
+	case mdHeading, mdSubtext, mdParagraph:
+		startLine(sb)
 		renderText(n.children, sb)
-		sb.WriteString("\n")
-
-	case kindSubtext:
-		renderText(n.children, sb)
-		sb.WriteString("\n")
-
-	case kindQuote:
-		var inner strings.Builder
-		renderText(n.children, &inner)
-		for line := range strings.SplitSeq(strings.TrimRight(inner.String(), "\n"), "\n") {
-			sb.WriteString("> " + line + "\n")
+		startLine(sb)
+
+	case mdQuote:
+		startLine(sb)
+		writeLines(sb, n.children, "> ", "> ")
+
+	case mdList:
+		startLine(sb)
+		for i, item := range n.items {
+			marker := "- "
+			if n.ordered {
+				marker = strconv.Itoa(n.start+i) + ". "
+			}
+			writeLines(sb, item, marker, "  ")
 		}
 
-	case kindLink:
+	case mdLink:
 		var label strings.Builder
 		renderText(n.children, &label)
 		if label.String() == n.url {
@@ -710,22 +311,32 @@ func renderNodeText(n mdNode, sb *strings.Builder) {
 			fmt.Fprintf(sb, "%s (%s)", label.String(), n.url)
 		}
 
-	case kindUserMention:
-		fmt.Fprintf(sb, "<@%s>", n.value)
+	case mdUserMention:
+		fmt.Fprintf(sb, "<@%s>", n.id)
+
+	case mdRoleMention:
+		fmt.Fprintf(sb, "<@&%s>", n.id)
+
+	case mdChannelMention:
+		if n.url != "" {
+			sb.WriteString(n.url)
+		} else {
+			sb.WriteString("#channel")
+		}
 
-	case kindRoleMention:
-		fmt.Fprintf(sb, "<@&%s>", n.value)
+	case mdGlobalMention:
+		sb.WriteString("@" + n.name)
 
-	case kindChannelMention:
-		sb.WriteString("#channel")
+	case mdCommandMention:
+		sb.WriteString("/" + n.name)
 
-	case kindGlobalMention:
-		sb.WriteString("@" + n.value)
+	case mdGuildNav:
+		sb.WriteString(guildNavLabels[n.name])
 
-	case kindEmoji:
-		fmt.Fprintf(sb, ":%s:", n.value)
+	case mdEmoji:
+		fmt.Fprintf(sb, ":%s:", n.name)
 
-	case kindTimestamp:
-		sb.WriteString(formatTimestamp(n.unix))
+	case mdTimestamp:
+		sb.WriteString(formatTimestamp(n.unix, n.style))
 	}
 }
diff --git a/backend/email/markdown_legacy_url.go b/backend/email/markdown_legacy_url.go
new file mode 100644
index 00000000..7e8236dc
--- /dev/null
+++ b/backend/email/markdown_legacy_url.go
@@ -0,0 +1,188 @@
+package email
+
+// The `url` package's legacy parse that Discord's link finder runs.
+
+import (
+	"regexp"
+	"slices"
+	"strings"
+	"unicode/utf16"
+)
+
+type legacyURL struct {
+	protocol string
+	host     string
+	pathname string
+	query    string
+}
+
+var (
+	reSlashedAuth    = regexp.MustCompile(`^//[^@/]+@[^@/]+`)
+	slashedProtocols = []string{"http:", "https:", "ftp:", "gopher:", "file:"}
+	// punycode.toASCII's encoding is skipped, as hosts are only compared with ASCII ones.
+	idnSeparators = strings.NewReplacer("\u3002", ".", "\uff0e", ".", "\uff61", ".")
+	autoEscaper   = strings.NewReplacer(
+		"'", "%27", "{", "%7B", "}", "%7D", "|", "%7C", `\`, "%5C", "^", "%5E", "`", "%60",
+		"<", "%3C", ">", "%3E", `"`, "%22", " ", "%20", "\r", "%0D", "\n", "%0A", "\t", "%09",
+	)
+)
+
+const nonHostChars = "%/?;#'{}|\\^`<>\" \r\n\t"
+
+func legacyParse(value string) (u legacyURL, ok bool) {
+	splitter := "#"
+	if q := strings.IndexByte(value, '?'); q >= 0 && q < strings.IndexByte(value, '#') {
+		splitter = "?"
+	}
+	head, tail, found := strings.Cut(value, splitter)
+	value = strings.ReplaceAll(head, `\`, "/")
+	if found {
+		value += splitter + tail
+	}
+	rest := jsTrim(value)
+
+	if !strings.Contains(value, "#") && isSimplePath(rest) {
+		u.pathname, u.query, _ = strings.Cut(rest, "?")
+		return u, true
+	}
+
+	// The package looks the protocol up as typed, so "HTTP:" isn't a slashed protocol.
+	protocol := ""
+	if n := protocolLen(rest); n > 0 {
+		protocol = rest[:n]
+		u.protocol = strings.ToLower(protocol)
+		rest = rest[n:]
+	}
+	hostless := protocol == "javascript:"
+	slashes := false
+	if protocol != "" || reSlashedAuth.MatchString(rest) {
+		slashes = strings.HasPrefix(rest, "//")
+		if slashes && !hostless {
+			rest = rest[2:]
+		}
+	}
+
+	hostname := ""
+	if !hostless && (slashes || protocol != "" && !slices.Contains(slashedProtocols, protocol)) {
+		at := strings.LastIndexByte(rest, '@')
+		if hostEnd := strings.IndexAny(rest, "/?#"); hostEnd >= 0 {
+			at = strings.LastIndexByte(rest[:hostEnd], '@')
+		}
+		if at >= 0 {
+			if _, ok := decodeURIComponent(rest[:at]); !ok {
+				return legacyURL{}, false
+			}
+			rest = rest[at+1:]
+		}
+		end := strings.IndexAny(rest, nonHostChars)
+		if end < 0 {
+			end = len(rest)
+		}
+		hostname, rest = rest[:end], rest[end:]
+		port := ""
+		if i := strings.LastIndexByte(hostname, ':'); i >= 0 && isAllDigits(hostname[i+1:]) {
+			hostname, port = hostname[:i], hostname[i+1:]
+		}
+
+		ipv6 := strings.HasPrefix(hostname, "[") && strings.HasSuffix(hostname, "]")
+		if !ipv6 {
+			hostname, rest = trimInvalidLabels(hostname, rest)
+		}
+		if utf16Len(hostname) > 255 {
+			hostname = ""
+		} else {
+			// Not strings.ToLower alone: Go folds U+0130 to a plain i, JS keeps a combining dot.
+			hostname = strings.ToLower(strings.ReplaceAll(hostname, "\u0130", "i\u0307"))
+		}
+		if !ipv6 {
+			hostname = idnSeparators.Replace(hostname)
+		}
+		u.host = hostname
+		if port != "" {
+			u.host += ":" + port
+		}
+		if ipv6 && !strings.HasPrefix(rest, "/") {
+			rest = "/" + rest
+		}
+	}
+
+	if u.protocol != "javascript:" {
+		rest = autoEscaper.Replace(rest)
+	}
+	rest, _, _ = strings.Cut(rest, "#")
+	u.pathname, u.query, _ = strings.Cut(rest, "?")
+	if u.pathname == "" && hostname != "" && slices.Contains(slashedProtocols, u.protocol) {
+		u.pathname = "/"
+	}
+	return u, true
+}
+
+func isSimplePath(s string) bool {
+	return strings.HasPrefix(s, "/") && !strings.HasPrefix(s, "///") && !strings.ContainsFunc(s, isJSSpace)
+}
+
+func protocolLen(s string) int {
+	n := 0
+	for n < len(s) && (isASCIIAlnum(rune(s[n])) || strings.IndexByte(".+-", s[n]) >= 0) {
+		n++
+	}
+	if n == 0 || n == len(s) || s[n] != ':' {
+		return 0
+	}
+	return n + 1
+}
+
+func trimInvalidLabels(hostname, rest string) (string, string) {
+	labels := strings.Split(hostname, ".")
+	for i, label := range labels {
+		if label == "" || isHostLabel(label) {
+			continue
+		}
+		valid, notHost := slices.Clone(labels[:i]), slices.Clone(labels[i+1:])
+		if head, tail, ok := splitHostLabel(label); ok {
+			valid = append(valid, head)
+			notHost = append([]string{tail}, notHost...)
+		}
+		if len(notHost) > 0 {
+			rest = "/" + strings.Join(notHost, ".") + rest
+		}
+		return strings.Join(valid, "."), rest
+	}
+	return hostname, rest
+}
+
+// The package swaps each non-ASCII UTF-16 unit for an x before testing a label.
+func isHostLabel(label string) bool {
+	units := 0
+	for _, r := range label {
+		if r < 0x80 && !isHostLabelByte(byte(r)) {
+			return false
+		}
+		units += utf16.RuneLen(r)
+	}
+	return units <= 63
+}
+
+// The package's regex fails on a line terminator, which JS's dot doesn't match.
+func splitHostLabel(label string) (head, tail string, ok bool) {
+	if strings.ContainsFunc(label, isJSLineTerminator) {
+		return "", "", false
+	}
+	n := 0
+	for n < len(label) && n < 63 && isHostLabelByte(label[n]) {
+		n++
+	}
+	return label[:n], label[n:], true
+}
+
+func isHostLabelByte(c byte) bool {
+	return isWordByte(c) || c == '+' || c == '-'
+}
+
+func utf16Len(s string) int {
+	n := 0
+	for _, r := range s {
+		n += utf16.RuneLen(r)
+	}
+	return n
+}
diff --git a/backend/email/markdown_links.go b/backend/email/markdown_links.go
new file mode 100644
index 00000000..c5b24639
--- /dev/null
+++ b/backend/email/markdown_links.go
@@ -0,0 +1,497 @@
+package email
+
+import (
+	"regexp"
+	"slices"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+var linkProtocols = []string{"http", "https", "discord", "tel", "sms", "mailto"}
+
+func isInvisible(r rune) bool {
+	switch r {
+	case '\n', ' ':
+		return false
+	case 0x034f, 0x17b4, 0x17b5, 0x1160, 0x3164, 0xffa0:
+		return true
+	}
+	return unicode.In(r, unicode.Cf, unicode.Zl, unicode.Zp, unicode.Cc, unicode.Zs)
+}
+
+func sanitizeWhitespace(s string) string {
+	if strings.IndexFunc(s, isInvisible) < 0 {
+		return s
+	}
+	return strings.Map(func(r rune) rune {
+		if isInvisible(r) {
+			return -1
+		}
+		return r
+	}, s)
+}
+
+var homoglyphs = func() map[rune]rune {
+	table := []struct {
+		ascii      rune
+		lookalikes []rune
+	}{
+		{'h', []rune{'H', 0x04bb, 0x0570, 0x13c2, 0x210e, 0x1d421, 0x1d489, 0x1d4bd, 0x1d4f1, 0x1d525, 0x1d559, 0x1d58d, 0x1d5c1, 0x1d5f5, 0x1d629, 0x1d65d, 0x1d691, 0xff48}},
+		{'t', []rune{'T', 0x1d42d, 0x1d461, 0x1d495, 0x1d4c9, 0x1d4fd, 0x1d531, 0x1d565, 0x1d599, 0x1d5cd, 0x1d601, 0x1d635, 0x1d669, 0x1d69d}},
+		{'p', []rune{'P', 0x03c1, 0x03f1, 0x0440, 0x2374, 0x2ca3, 0x1d429, 0x1d45d, 0x1d491, 0x1d4c5, 0x1d4f9, 0x1d52d, 0x1d561, 0x1d595, 0x1d5c9, 0x1d5fd, 0x1d631, 0x1d665, 0x1d699, 0x1d6d2, 0x1d6e0, 0x1d70c, 0x1d71a, 0x1d746, 0x1d754, 0x1d780, 0x1d78e, 0x1d7ba, 0x1d7c8, 0xff50, 0x048f}},
+		{'s', []rune{'S', 0x01bd, 0x0455, 0xa731, 0xabaa, 0x10448, 0x118c1, 0x1d42c, 0x1d460, 0x1d494, 0x1d4c8, 0x1d4fc, 0x1d530, 0x1d564, 0x1d598, 0x1d5cc, 0x1d600, 0x1d634, 0x1d668, 0x1d69c, 0xff53}},
+		{':', []rune{0x02d0, 0x02f8, 0x0589, 0x05c3, 0x0703, 0x0704, 0x0903, 0x0a83, 0x16ec, 0x1803, 0x1809, 0x205a, 0x2236, 0xa4fd, 0xa789, 0xfe30, 0xff1a, ';', 0x037e}},
+		{'/', []rune{0x1735, 0x2041, 0x2044, 0x2215, 0x2571, 0x27cb, 0x29f8, 0x2cc6, 0x2f03, 0x3033, 0x30ce, 0x31d3, 0x4e3f, 0x1d23a}},
+	}
+	out := map[rune]rune{}
+	for _, row := range table {
+		for _, r := range row.lookalikes {
+			if _, seen := out[r]; !seen {
+				out[r] = row.ascii
+			}
+		}
+	}
+	return out
+}()
+
+func foldHomoglyphs(s string) string {
+	return strings.Map(func(r rune) rune {
+		if ascii, ok := homoglyphs[r]; ok {
+			return ascii
+		}
+		return r
+	}, s)
+}
+
+func sanitizeFully(s string) string {
+	return foldHomoglyphs(sanitizeWhitespace(s))
+}
+
+func unescapeURL(s string) string {
+	if !strings.Contains(s, `\`) {
+		return s
+	}
+	var b strings.Builder
+	for i := 0; i < len(s); {
+		if s[i] == '\\' && i+1 < len(s) {
+			if r, size := utf8.DecodeRuneInString(s[i+1:]); !isASCIIAlnum(r) && !isJSSpace(r) {
+				b.WriteString(s[i+1 : i+1+size])
+				i += 1 + size
+				continue
+			}
+		}
+		b.WriteByte(s[i])
+		i++
+	}
+	return b.String()
+}
+
+func decodeURIComponent(s string) (string, bool) {
+	if !strings.Contains(s, "%") {
+		return s, true
+	}
+	var b strings.Builder
+	for i := 0; i < len(s); {
+		if s[i] != '%' {
+			b.WriteByte(s[i])
+			i++
+			continue
+		}
+		first, ok := decodeEscape(s, i)
+		if !ok {
+			return "", false
+		}
+		i += 3
+		if first < 0x80 {
+			b.WriteByte(first)
+			continue
+		}
+		n := 0
+		for mask := byte(0x80); first&mask != 0; mask >>= 1 {
+			n++
+		}
+		if n == 1 || n > 4 {
+			return "", false
+		}
+		seq := []byte{first}
+		for k := 1; k < n; k++ {
+			next, ok := decodeEscape(s, i)
+			if !ok || next&0xc0 != 0x80 {
+				return "", false
+			}
+			seq = append(seq, next)
+			i += 3
+		}
+		if r, size := utf8.DecodeRune(seq); r == utf8.RuneError && size <= 1 {
+			return "", false
+		}
+		b.Write(seq)
+	}
+	return b.String(), true
+}
+
+func decodeEscape(s string, i int) (byte, bool) {
+	if i+2 >= len(s) || s[i] != '%' {
+		return 0, false
+	}
+	hi, ok1 := hexValue(s[i+1])
+	lo, ok2 := hexValue(s[i+2])
+	return hi<<4 | lo, ok1 && ok2
+}
+
+func encodeURIComponent(r rune) string {
+	if isASCIIAlnum(r) || strings.ContainsRune("-_.!~*'()", r) {
+		return string(r)
+	}
+	return percentEncode(r, func(rune) bool { return true })
+}
+
+func isSuspiciousURL(value string) bool {
+	if hasEscapedInvite(value) || sanitizeWhitespace(value) != value {
+		return true
+	}
+	u, ok := parseWebURL(value)
+	if !ok {
+		return true
+	}
+	if u.scheme != "http" && u.scheme != "https" {
+		return false
+	}
+	parts := strings.Split(value, "/")
+	if len(parts) < 3 || parts[1] != "" {
+		return true
+	}
+	decoded, ok := decodeURIComponent(parts[2])
+	return !ok || decoded != parts[2]
+}
+
+func keepsEncoding(r rune) bool {
+	if r < 0x80 {
+		return !(isASCIIAlnum(r) || strings.ContainsRune(`"-<>_~`, r))
+	}
+	switch r {
+	case 0x200e, 0x200f, 0x202a, 0x202b, 0x202c, 0x202d, 0x202e, 0x061c, 0x2066, 0x2067, 0x2068, 0x2069,
+		0x1f50f, 0x1f510, 0x1f512, 0x1f513, 0x85, 0xa0, 0x1680, 0x2000, 0x2001, 0x2002, 0x2003, 0x2004,
+		0x2005, 0x2006, 0x2007, 0x2008, 0x2009, 0x200a, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000, 0x2800,
+		0xad, 0x34f, 0x6dd, 0x70f, 0x8e2, 0x115f, 0x1160, 0x17b4, 0x17b5, 0x180b, 0x180c, 0x180d, 0x180e,
+		0x200b, 0x200c, 0x200d, 0x2060, 0x2061, 0x2062, 0x2063, 0x2064, 0x2065, 0x3164, 0xfeff, 0xffa0,
+		0xfff9, 0xfffa, 0xfffb, 0x110bd, 0x110cd:
+		return true
+	}
+	return (r >= 0x600 && r <= 0x605) ||
+		(r >= 0x206a && r <= 0x206f) ||
+		(r >= 0xfff0 && r <= 0xfff8) ||
+		(r >= 0xfe00 && r <= 0xfe0f) ||
+		(r >= 0x13430 && r <= 0x13438) ||
+		(r >= 0x1bca0 && r <= 0x1bca3) ||
+		(r >= 0x1d173 && r <= 0x1d17a) ||
+		(r >= 0xe0000 && r <= 0xe0fff)
+}
+
+// Mirrors the client's walk, desyncs included; ok is false where it throws.
+func decodeForDisplay(value string) (string, bool) {
+	plain, ok := decodeURIComponent(value)
+	if !ok {
+		return value, true
+	}
+	var out strings.Builder
+	raw := value
+	for raw != "" {
+		if plain == "" {
+			return "", false
+		}
+		rawCode, rawSize := utf8.DecodeRuneInString(raw)
+		plainCode, plainSize := utf8.DecodeRuneInString(plain)
+		if rawCode == plainCode {
+			out.WriteString(raw[:rawSize])
+			raw, plain = raw[rawSize:], plain[plainSize:]
+			continue
+		}
+		encoded := encodeURIComponent(plainCode)
+		rawLength := len(encoded)
+		if encoded == string(plainCode) {
+			rawLength = 3
+		}
+		if keepsEncoding(plainCode) {
+			out.WriteString(encoded)
+		} else {
+			out.WriteString(plain[:plainSize])
+		}
+		raw = raw[min(rawLength, len(raw)):]
+		plain = plain[plainSize:]
+	}
+	return out.String(), true
+}
+
+func formatURL(u *webURL, credentials bool) (string, bool) {
+	var origin string
+	path := u.pathname()
+	if !isSpecialScheme(u.scheme) && strings.HasPrefix(path, "//") {
+		origin = u.protocol()
+	} else {
+		auth := ""
+		if credentials {
+			auth = u.username
+			if u.password != "" {
+				auth += ":" + u.password
+			}
+			if auth != "" {
+				auth += "@"
+			}
+		}
+		slashes := ""
+		if u.hasHost {
+			slashes = "//"
+		}
+		origin = u.protocol() + slashes + auth + u.hostPort()
+	}
+	out := origin
+	for _, part := range []string{path, u.search(), u.hash()} {
+		decoded, ok := decodeForDisplay(part)
+		if !ok {
+			return "", false
+		}
+		out += decoded
+	}
+	return out, true
+}
+
+func normalizeLink(value string) (target, display string, ok bool) {
+	if isSuspiciousURL(value) {
+		return "", "", false
+	}
+	u, ok := parseWebURL(value)
+	if !ok || !slices.Contains(linkProtocols, u.scheme) {
+		return "", "", false
+	}
+	if (u.scheme == "http" || u.scheme == "https") && u.host == "" {
+		return "", "", false
+	}
+	if target, ok = formatURL(u, true); !ok {
+		return "", "", false
+	}
+	if display, ok = formatURL(u, false); !ok {
+		return "", "", false
+	}
+	return target, display, true
+}
+
+const (
+	inviteHost   = "discord.gg"
+	templateHost = "discord.new"
+)
+
+var primaryHosts = []string{"discord.com", "canary.discord.com", "ptb.discord.com", "discordapp.com"}
+
+var (
+	reBareDiscordHost = regexp.MustCompile(`((https?://[^ ]*)|^|[` + jsSpaceClass + `])(discord\.gg|discord\.new|discord\.com|discordapp\.com)`)
+	reIPv4            = `(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])){3}`
+	// [hH] not (?i), which folds non-ASCII too; JS counts UTF-16 units, so one astral rune is a long enough TLD.
+	reURLLike = regexp.MustCompile(`(?:(?:(?:[hH][tT][tT][pP][sS]?:)?//)|[wW][wW][wW]\.)` +
+		`(?:[^` + jsSpaceClass + `:@]+(?::[^` + jsSpaceClass + `@]*)?@)?` +
+		`(?:[lL][oO][cC][aA][lL][hH][oO][sS][tT]|` + reIPv4 +
+		`|(?:[a-zA-Z\x{a1}-\x{10ffff}0-9\-_]+\.)+(?:[a-zA-Z\x{a1}-\x{10ffff}]{2,}|[\x{10000}-\x{10ffff}]))` +
+		`(?::[0-9]{2,5})?(?:[/?#][^` + jsSpaceClass + `"()\[\]<>]*)?`)
+
+	reDevLink = regexp.MustCompile(`[dD][eE][vV]://[\w.~:/?#\[\]@!$&'()*+,;=%-]+`)
+
+	reSingleSegment    = regexp.MustCompile(`^/([a-zA-Z0-9-]+)$`)
+	reInviteOrTemplate = regexp.MustCompile(`^/(invite|template)/([a-zA-Z0-9-]+)/?\.?$`)
+	reEvent            = regexp.MustCompile(`^/events/([0-9]+)/([0-9]+)?(/([0-9]+))?`)
+	reGameShop         = regexp.MustCompile(`^(?:/game-shop/([0-9]+)|/channels/([0-9]+)/game-shop/(?:[0-9]+))(?:/([0-9]+)(?:/([^/]+))?)?/?$`)
+	rePrimaryPaths     = []*regexp.Regexp{
+		regexp.MustCompile(`^/channels/([0-9]+|@me)/([0-9]+)$`),
+		regexp.MustCompile(`^/(application-directory|discovery/applications)/([0-9-]+)/?((about|images|privacy)/?)?$`),
+		regexp.MustCompile(`^/(application-directory|discovery/applications)/([0-9-]+)/store/?([0-9-]+)?/?$`),
+		regexp.MustCompile(`^/activities/([0-9-]+)/?$`),
+		regexp.MustCompile(`^/channels/([0-9]+)/shop/([0-9]+)$`),
+		regexp.MustCompile(`^/channels/([0-9]+)/shop$`),
+		regexp.MustCompile(`^/quests/([0-9-]+)/?$`),
+		regexp.MustCompile(`^/games/([0-9]+)(?:/[A-Za-z0-9-]*)?/?$`),
+		regexp.MustCompile(`^/game-servers/share/([A-Za-z0-9_-]+)$`),
+		regexp.MustCompile(`^/game-organizations/invite/([A-Za-z0-9_-]+)/?$`),
+		regexp.MustCompile(`^/users/([0-9]+)/?$`),
+		regexp.MustCompile(`^/shop$`),
+	}
+
+	// JS's toUpperCase also expands ligatures, and only U+FB01 and U+FB03 can help spell INVITE.
+	jsUpperLigatures = strings.NewReplacer("\ufb01", "FI", "\ufb03", "FFI")
+)
+
+func stripWWW(host string) string {
+	if len(host) >= 4 && strings.EqualFold(host[:4], "www.") {
+		return host[4:]
+	}
+	return host
+}
+
+func bracketParam(query, name string) (value string, list bool) {
+	seen := false
+	for pair := range strings.SplitSeq(strings.TrimPrefix(query, "?"), "&") {
+		key, item, _ := strings.Cut(pair, "=")
+		switch formDecode(key) {
+		case name:
+			value, list, seen = formDecode(item), false, true
+		case name + "[]":
+			if !seen {
+				value = formDecode(item)
+			}
+			list, seen = true, true
+		}
+	}
+	return value, list
+}
+
+func authorizesCommandsOnly(query string) bool {
+	if clientID, list := bracketParam(query, "client_id"); clientID == "" && !list {
+		return false
+	}
+	scope, _ := bracketParam(query, "scope")
+	for s := range strings.FieldsFuncSeq(scope, func(r rune) bool { return r == ' ' || r == '+' }) {
+		if s != "applications.commands" {
+			return false
+		}
+	}
+	return true
+}
+
+func hasSkuID(query string) bool {
+	for pair := range strings.SplitSeq(strings.TrimPrefix(query, "?"), "&") {
+		key, ids, _ := strings.Cut(pair, "=")
+		if formDecode(key) != "skuIds" {
+			continue
+		}
+		for id := range strings.SplitSeq(formDecode(ids), ",") {
+			if id != "" && isAllDigits(id) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func isCodedLink(candidate string) bool {
+	u, ok := legacyParse(candidate)
+	if !ok || u.pathname == "" {
+		return false
+	}
+	path := u.pathname
+	// Unlike every other kind, event links count on any host.
+	if m := reEvent.FindStringSubmatch(path); m != nil && m[2] != "" {
+		return true
+	}
+	host := stripWWW(u.host)
+	switch {
+	case host == inviteHost:
+		web := u.protocol == "http:" || u.protocol == "https:"
+		return web && reSingleSegment.MatchString(path) && !strings.Contains(candidate, `\`)
+	case host == templateHost:
+		return reSingleSegment.MatchString(path)
+	case !slices.Contains(primaryHosts, host):
+		return false
+	}
+	query := u.query
+	if utf16Len(query) > 1000 {
+		query = ""
+	}
+	if m := reInviteOrTemplate.FindStringSubmatch(path); m != nil {
+		return m[1] == "template" || !strings.Contains(candidate, `\`)
+	}
+	if strings.HasPrefix(path, "/oauth2/authorize") && authorizesCommandsOnly(query) {
+		return true
+	}
+	if m := reGameShop.FindStringSubmatch(path); m != nil && (m[3] != "" || hasSkuID(query)) {
+		return true
+	}
+	return slices.ContainsFunc(rePrimaryPaths, func(re *regexp.Regexp) bool { return re.MatchString(path) })
+}
+
+func containsDiscordLink(value string) bool {
+	var b strings.Builder
+	last := 0
+	for _, m := range reBareDiscordHost.FindAllStringSubmatchIndex(value, -1) {
+		if m[4] >= 0 {
+			continue
+		}
+		b.WriteString(value[last:m[0]])
+		b.WriteString(value[m[2]:m[3]])
+		b.WriteString("http://")
+		b.WriteString(value[m[6]:m[7]])
+		last = m[1]
+	}
+	b.WriteString(value[last:])
+	prefixed := b.String()
+
+	candidates := reURLLike.FindAllString(replaceCodeSpans(prefixed), -1)
+	for i, candidate := range candidates {
+		candidates[i] = strings.TrimRight(candidate, ".,;:?'*_~|")
+	}
+	// Only the first dev:// link counts, and code spans don't hide it.
+	if devLink := reDevLink.FindString(prefixed); devLink != "" {
+		candidates = append(candidates, devLink)
+	}
+	return slices.ContainsFunc(candidates, isCodedLink)
+}
+
+func replaceCodeSpans(s string) string {
+	if !strings.Contains(s, "`") {
+		return s
+	}
+	var b strings.Builder
+	last := 0
+	for i := 0; i < len(s); {
+		if s[i] != '`' {
+			i++
+			continue
+		}
+		end, ok := codeSpanAt(s, i)
+		if !ok {
+			i++
+			continue
+		}
+		b.WriteString(s[last:i])
+		b.WriteByte(' ')
+		last, i = end, end
+	}
+	b.WriteString(s[last:])
+	return b.String()
+}
+
+func codeSpanAt(s string, i int) (int, bool) {
+	run := countByte(s, i, '`')
+	if run >= 3 {
+		for j := i + run; j < len(s); j++ {
+			if n := countByte(s, j, '`'); n >= 3 {
+				return j + n, true
+			}
+		}
+		return len(s), true
+	}
+	for n := run; n >= 1; n-- {
+		k := i + n
+		m := k
+		for m < len(s) && s[m] != '`' {
+			m++
+		}
+		if m > k && countByte(s, m, '`') == n {
+			return m + n, true
+		}
+	}
+	return 0, false
+}
+
+func hasEscapedInvite(value string) bool {
+	if !strings.Contains(value, `\`) {
+		return false
+	}
+	u, ok := legacyParse(value)
+	if !ok {
+		return false
+	}
+	host := stripWWW(u.host)
+	if host == inviteHost {
+		return true
+	}
+	return slices.Contains(primaryHosts, host) && strings.Contains(strings.ToUpper(jsUpperLigatures.Replace(u.pathname)), "INVITE")
+}
diff --git a/backend/email/markdown_parse.go b/backend/email/markdown_parse.go
new file mode 100644
index 00000000..bd9b10df
--- /dev/null
+++ b/backend/email/markdown_parse.go
@@ -0,0 +1,1721 @@
+package email
+
+import (
+	"cmp"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+type mdKind uint8
+
+const (
+	mdText mdKind = iota
+	mdBr
+	mdCode
+	mdCodeBlock
+	mdUserMention
+	mdRoleMention
+	mdChannelMention
+	mdGlobalMention
+	mdCommandMention
+	mdGuildNav
+	mdEmoji
+	mdTimestamp
+	mdMark
+	mdLink
+	mdHeading
+	mdSubtext
+	mdQuote
+	mdParagraph
+	mdList
+)
+
+type markType uint8
+
+const (
+	markBold markType = iota
+	markItalic
+	markUnderline
+	markStrike
+	markSpoiler
+)
+
+type mdNode struct {
+	kind     mdKind
+	text     string
+	lang     string
+	url      string
+	title    string
+	id       string
+	name     string
+	mark     markType
+	level    int
+	ordered  bool
+	start    int
+	animated bool
+	unix     int64
+	style    byte
+	children []mdNode
+	items    [][]mdNode
+
+	codeContent  []mdNode
+	blockNewline bool
+}
+
+func textNode(value string) mdNode {
+	return mdNode{kind: mdText, text: value}
+}
+
+func (n *mdNode) hasChildren() bool {
+	switch n.kind {
+	case mdMark, mdLink, mdHeading, mdSubtext, mdQuote, mdParagraph:
+		return true
+	}
+	return false
+}
+
+type mdCapture struct {
+	all    string
+	groups [5]string
+	set    [5]bool
+	astral bool
+}
+
+type mdState struct {
+	inline       bool
+	prev         string
+	depth        int
+	listLevel    int
+	inQuote      bool
+	allowHeading bool
+	noSubtext    bool
+	noEscape     bool
+	codeContent  bool
+	validation   *linkValidation
+}
+
+type linkValidation struct {
+	nestedLink bool
+}
+
+type mdRule struct {
+	name    string
+	order   float64
+	first   string
+	quality func(c *mdCapture) float64
+	match   func(src string, st *mdState) *mdCapture
+	parse   func(p *mdParser, c *mdCapture, st *mdState) []mdNode
+}
+
+type mdParser struct {
+	byFirst  map[rune][]*mdRule
+	anywhere []*mdRule
+	label    *mdParser
+}
+
+const (
+	mdMaxParseDepth = 1000
+	mdMaxListLevel  = 11
+	mdNodeLimit     = 200
+)
+
+func newMdParser(rules []*mdRule) *mdParser {
+	sorted := slices.Clone(rules)
+	slices.SortFunc(sorted, func(a, b *mdRule) int {
+		if a.order != b.order {
+			return cmp.Compare(a.order, b.order)
+		}
+		if (a.quality == nil) != (b.quality == nil) {
+			if a.quality != nil {
+				return -1
+			}
+			return 1
+		}
+		return strings.Compare(a.name, b.name)
+	})
+
+	p := &mdParser{byFirst: map[rune][]*mdRule{}}
+	for _, rule := range sorted {
+		if rule.first == "" {
+			p.anywhere = append(p.anywhere, rule)
+			continue
+		}
+		for _, c := range rule.first {
+			p.byFirst[c] = append(p.byFirst[c], rule)
+		}
+	}
+	return p
+}
+
+func (p *mdParser) nested(src string, parent mdState) []mdNode {
+	var out []mdNode
+	st := parent
+	st.depth++
+	if st.depth > mdMaxParseDepth {
+		if src != "" {
+			out = append(out, textNode(src))
+		}
+		return out
+	}
+
+	lowSurrogate := false
+	for src != "" {
+		if lowSurrogate {
+			// The client's escape took only this character's high surrogate; its text rule resumes at the low one.
+			lowSurrogate = false
+			n := textEnd(src, 0)
+			out = append(out, textNode(src[:n]))
+			st.prev = string(utf8.RuneError) + src[:n]
+			src = src[n:]
+			continue
+		}
+
+		var best *mdRule
+		var capture *mdCapture
+		bestOrder, bestQuality := 1e5, -1e5
+		first, _ := utf8.DecodeRuneInString(src)
+		for _, list := range [2][]*mdRule{p.byFirst[first], p.anywhere} {
+			for _, rule := range list {
+				if rule.order > bestOrder {
+					break
+				}
+				c := rule.match(src, &st)
+				if c == nil {
+					continue
+				}
+				quality := 0.0
+				if rule.quality != nil {
+					quality = rule.quality(c)
+				}
+				if rule.order < bestOrder || quality > bestQuality {
+					best, capture, bestOrder, bestQuality = rule, c, rule.order, quality
+				}
+			}
+		}
+
+		if best == nil || capture.all == "" {
+			out = append(out, textNode(src))
+			break
+		}
+
+		out = append(out, best.parse(p, capture, &st)...)
+		st.prev = capture.all
+		src = src[len(capture.all):]
+		lowSurrogate = capture.astral
+	}
+	return out
+}
+
+func mdPreprocess(src string) string {
+	src = strings.ReplaceAll(src, "\r\n", "\n")
+	src = strings.ReplaceAll(src, "\r", "\n")
+	src = strings.ReplaceAll(src, "\f", "")
+	return strings.ReplaceAll(src, "\t", "    ")
+}
+
+func parseDiscordMarkdown(src string) []mdNode {
+	if src == "" {
+		return nil
+	}
+	st := mdState{inline: true, allowHeading: true}
+	nodes := markdownParser.nested(mdPreprocess(strings.ToValidUTF8(src, string(utf8.RuneError))), st)
+	remaining := mdNodeLimit
+	// Unlike message content, a Text Display keeps the tree cut at the limit.
+	return limitNodes(postProcess(nodes, nil), &remaining)
+}
+
+func sameType(parent, n *mdNode) bool {
+	return parent.kind == n.kind && (n.kind != mdMark || parent.mark == n.mark)
+}
+
+func postProcess(nodes []mdNode, parent *mdNode) []mdNode {
+	var out []mdNode
+	for _, node := range nodes {
+		if node.hasChildren() {
+			node.children = postProcess(node.children, &node)
+		}
+		if node.kind == mdList {
+			items := make([][]mdNode, len(node.items))
+			for i, item := range node.items {
+				items[i] = postProcess(item, nil)
+			}
+			node.items = items
+		}
+
+		parts := []mdNode{node}
+		if parent != nil && node.hasChildren() && sameType(parent, &node) {
+			parts = node.children
+		}
+		for _, part := range parts {
+			if last := len(out) - 1; part.kind == mdText && last >= 0 && out[last].kind == mdText {
+				out[last] = textNode(out[last].text + part.text)
+			} else {
+				out = append(out, part)
+			}
+		}
+	}
+	return slices.DeleteFunc(out, func(n mdNode) bool { return n.kind == mdText && n.text == "" })
+}
+
+func limitNodes(nodes []mdNode, remaining *int) []mdNode {
+	var out []mdNode
+	for _, node := range nodes {
+		if node.kind == mdText {
+			out = append(out, node)
+			continue
+		}
+		if *remaining--; *remaining <= 0 {
+			break
+		}
+		// Discord's channel mentions hide a channel node inside, which its limit counts too.
+		if node.kind == mdChannelMention {
+			*remaining--
+		}
+		switch {
+		case node.hasChildren():
+			node.children = limitNodes(node.children, remaining)
+		case node.kind == mdList:
+			items := make([][]mdNode, len(node.items))
+			for i, item := range node.items {
+				items[i] = limitNodes(item, remaining)
+			}
+			node.items = items
+		}
+		out = append(out, node)
+	}
+	return out
+}
+
+const jsSpaceClass = `\t\n\v\f\r \x{a0}\x{1680}\x{2000}-\x{200a}\x{2028}\x{2029}\x{202f}\x{205f}\x{3000}\x{feff}`
+
+func isJSSpace(r rune) bool {
+	switch r {
+	case '\t', '\n', '\v', '\f', '\r', ' ', 0xa0, 0x1680, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000, 0xfeff:
+		return true
+	}
+	return r >= 0x2000 && r <= 0x200a
+}
+
+func isJSLineTerminator(r rune) bool {
+	return r == '\n' || r == '\r' || r == 0x2028 || r == 0x2029
+}
+
+func jsTrim(s string) string {
+	return strings.TrimFunc(s, isJSSpace)
+}
+
+func jsSpaceEnd(s string, i int) int {
+	for i < len(s) {
+		r, size := utf8.DecodeRuneInString(s[i:])
+		if !isJSSpace(r) {
+			break
+		}
+		i += size
+	}
+	return i
+}
+
+func isASCIIAlnum(r rune) bool {
+	return isASCIIAlpha(r) || isASCIIDigit(r)
+}
+
+func isWordByte(c byte) bool {
+	return c == '_' || isASCIIAlnum(rune(c))
+}
+
+func countByte(s string, i int, c byte) int {
+	n := 0
+	for i+n < len(s) && s[i+n] == c {
+		n++
+	}
+	return n
+}
+
+func lineEnd(s string, i int) int {
+	if j := strings.IndexByte(s[i:], '\n'); j >= 0 {
+		return i + j
+	}
+	return len(s)
+}
+
+func newCapture(all string, groups ...string) *mdCapture {
+	c := &mdCapture{all: all}
+	for i, g := range groups {
+		c.groups[i+1], c.set[i+1] = g, true
+	}
+	return c
+}
+
+func regexCapture(re *regexp.Regexp, src string) *mdCapture {
+	m := re.FindStringSubmatchIndex(src)
+	if m == nil {
+		return nil
+	}
+	c := &mdCapture{all: src[:m[1]]}
+	for i := 1; i < len(m)/2; i++ {
+		if m[2*i] >= 0 {
+			c.groups[i], c.set[i] = src[m[2*i]:m[2*i+1]], true
+		}
+	}
+	return c
+}
+
+func inlineRegex(re *regexp.Regexp) func(string, *mdState) *mdCapture {
+	return func(src string, st *mdState) *mdCapture {
+		if !st.inline {
+			return nil
+		}
+		return regexCapture(re, src)
+	}
+}
+
+func anyScopeRegex(re *regexp.Regexp) func(string, *mdState) *mdCapture {
+	return func(src string, _ *mdState) *mdCapture {
+		return regexCapture(re, src)
+	}
+}
+
+func atLineStart(prev string) bool {
+	return prev == "" || strings.HasSuffix(strings.TrimRight(prev, " "), "\n")
+}
+
+func inlineParse(p *mdParser, src string, st *mdState) []mdNode {
+	inner := *st
+	inner.inline = true
+	return p.nested(src, inner)
+}
+
+func linkNode(target, display string) mdNode {
+	return mdNode{kind: mdLink, url: target, children: []mdNode{textNode(display)}}
+}
+
+func autolinkNode(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	if target, display, ok := normalizeLink(c.groups[1]); ok {
+		return []mdNode{linkNode(target, display)}
+	}
+	return []mdNode{textNode(c.groups[1])}
+}
+
+const (
+	orderHeading    = 0
+	orderCodeBlock  = 4
+	orderBlockQuote = 6
+	orderList       = 7
+	orderNewline    = 10
+	orderParagraph  = 11
+	orderEscape     = 12
+	orderAutolink   = 14
+	orderMailto     = 15
+	orderURL        = 16
+	orderLink       = 17
+	orderEm         = 21
+	orderInlineCode = 23
+	orderBr         = 24
+	orderText       = 25
+)
+
+var labelRuleNames = []string{"text", "u", "strong", "em", "s", "inlineCode", "spoiler", "br", "timestamp"}
+
+var markdownParser = func() *mdParser {
+	rules := markdownRules()
+	p := newMdParser(rules)
+	var labelRules []*mdRule
+	for _, rule := range rules {
+		if slices.Contains(labelRuleNames, rule.name) {
+			labelRules = append(labelRules, rule)
+		}
+	}
+	p.label = newMdParser(labelRules)
+	return p
+}()
+
+func markdownRules() []*mdRule {
+	emQuality := func(c *mdCapture) float64 { return float64(len(c.all)) + 0.2 }
+	return []*mdRule{
+		{name: "heading", order: orderHeading, first: " #", match: matchHeading, parse: parseHeading},
+		{name: "subtext", order: orderHeading, first: "-", match: matchSubtext, parse: parseSubtext},
+		{name: "codeBlock", order: orderCodeBlock, first: "`", match: anyScopeRegex(reCodeBlock), parse: parseCodeBlock},
+		{name: "customEmoji", order: orderCodeBlock, first: "<", match: anyScopeRegex(reCustomEmoji), parse: parseCustomEmoji},
+		{name: "blockQuote", order: orderBlockQuote, first: " >", match: matchBlockQuote, parse: parseBlockQuote},
+		{name: "list", order: orderList, first: "\n *-0123456789", match: matchList, parse: parseList},
+		{name: "newline", order: orderNewline, first: "\n", match: matchNewline, parse: parseNewline},
+		{name: "paragraph", order: orderParagraph, match: matchParagraph, parse: parseParagraph},
+		{name: "escape", order: orderEscape, first: `\`, match: matchEscape, parse: parseEscape},
+		{name: "autolink", order: orderAutolink, first: "<", match: matchAutolink, parse: autolinkNode},
+		{name: "mailto", order: orderMailto, first: "<", match: inlineRegex(reMailto), parse: parseMailto},
+		{name: "tel", order: orderMailto, first: "<", match: inlineRegex(reTel), parse: parseTel},
+		{name: "channelOrMessageUrl", order: orderURL - 0.5, first: "h", match: matchChannelURL, parse: parseChannelURL},
+		{name: "mediaPostLink", order: orderURL - 0.5, first: "h", match: anyScopeRegex(reThreadMessageURL), parse: parseMediaPostLink},
+		{name: "url", order: orderURL, first: "hs", match: matchURL, parse: autolinkNode},
+		{name: "link", order: orderLink, first: "[", match: matchLink, parse: parseLink},
+		{name: "em", order: orderEm, quality: emQuality, match: matchEm, parse: parseEm},
+		{name: "looseEm", order: orderEm, quality: emQuality, match: matchLooseEm, parse: parseEm},
+		{name: "strong", order: orderEm, first: "*", quality: func(c *mdCapture) float64 { return float64(len(c.all)) + 0.1 },
+			match: matchStrong, parse: markParser(markBold)},
+		{name: "u", order: orderEm, first: "_", quality: func(c *mdCapture) float64 { return float64(len(c.all)) },
+			match: matchUnderline, parse: markParser(markUnderline)},
+		{name: "s", order: orderEm, first: "~", match: matchStrike, parse: markParser(markStrike)},
+		{name: "inlineCode", order: orderInlineCode, first: "`", match: matchInlineCodeRule, parse: parseInlineCode},
+		{name: "br", order: orderBr, first: " ", match: matchBr, parse: parseBr},
+		{name: "timestamp", order: orderText - 1, first: "<", match: anyScopeRegex(reTimestamp), parse: parseTimestamp},
+		{name: "text", order: orderText, match: matchText, parse: parseText},
+		// Kept as text so the escape rule can't eat its backslash.
+		{name: "emoticon", order: orderText, first: "¯", match: matchEmoticon, parse: parseEscape},
+		{name: "roleMention", order: orderText, first: "<", match: anyScopeRegex(reRoleMention), parse: parseRoleMention},
+		{name: "mention", order: orderText, first: "<@", match: anyScopeRegex(reMention), parse: parseMention},
+		{name: "channelMention", order: orderText, first: "<", match: anyScopeRegex(reChannelMention), parse: parseChannelMention},
+		{name: "commandMention", order: orderText, first: "<", match: anyScopeRegex(reCommandMention), parse: parseCommandMention},
+		{name: "spoiler", order: orderText, first: "|", match: matchSpoiler, parse: parseSpoiler},
+		{name: "staticRouteLink", order: orderText, first: "<", match: anyScopeRegex(reStaticRouteLink), parse: parseStaticRouteLink},
+	}
+}
+
+var (
+	reCodeBlock   = regexp.MustCompile("^```(?:([a-zA-Z0-9_+\\-.#]+?)\\n)?\\n*([^\\n](?s:.)*?)\\n*```")
+	reCustomEmoji = regexp.MustCompile(`^<(a)?:(\w+):([0-9]+)>`)
+	reMailto      = regexp.MustCompile(`^<([^` + jsSpaceClass + `<>@]+@[^` + jsSpaceClass + `<>@]+\.[^` + jsSpaceClass + `<>@]+)>`)
+	reTel         = regexp.MustCompile(`^<((?:(?:tel|sms):\+?|\+)(?:[0-9]|\([0-9]+\))(?:[- ./]?(?:[0-9]|\([0-9]+\)))+)>`)
+	reTelSpaces   = regexp.MustCompile(`[ /]+`)
+	// The client's unescaped "." before "com": one UTF-16 unit other than a line terminator.
+	discordHost        = `(?:(?:canary\.|ptb\.)?discord(?:app)?[^\n\r\x{2028}\x{2029}\x{10000}-\x{10ffff}]com|staging\.discord\.co)`
+	reChannelURL       = regexp.MustCompile(`^https://` + discordHost + `/channels/([0-9]+|@me)(?:/([0-9]+|[a-zA-Z-]+))?(?:/([0-9]+|[a-zA-Z-]+))?`)
+	reThreadMessageURL = regexp.MustCompile(`^https://` + discordHost + `/channels/([0-9]+)/([0-9]+)/threads/([0-9]+)/([0-9]+)`)
+	// The client counts UTF-16 units, so one astral character is a long enough tail.
+	reURL             = regexp.MustCompile(`^((?:https?|steam)://(?:[^` + jsSpaceClass + `<]+[^<.,:;"'\]` + jsSpaceClass + `]|[\x{10000}-\x{10ffff}]))`)
+	reTimestamp       = regexp.MustCompile(`^<t:(-?[0-9]{1,17})(?::([tTdDfFsSR]))?>`)
+	reRoleMention     = regexp.MustCompile(`^<@&([0-9]+)>`)
+	reMention         = regexp.MustCompile(`^(?:<@!?([0-9]+)>|(@(?:everyone|here)))`)
+	reChannelMention  = regexp.MustCompile(`^<#([0-9]+)>`)
+	commandWord       = `[-_\p{L}\p{N}\p{Devanagari}\p{Thai}]{1,32}`
+	reCommandMention  = regexp.MustCompile(`^</(` + commandWord + `(?: ` + commandWord + `)?(?: ` + commandWord + `)?):([0-9]+)>`)
+	reStaticRouteLink = regexp.MustCompile(`^<id:(home|browse|customize|guide|linked-roles)(?::([0-9]+))?>`)
+)
+
+func matchHeading(src string, st *mdState) *mdCapture {
+	if !st.allowHeading || !(st.prev == "" || strings.HasSuffix(st.prev, "\n")) {
+		return nil
+	}
+	i := countByte(src, 0, ' ')
+	hashes := countByte(src, i, '#')
+	if hashes < 1 || hashes > 3 {
+		return nil
+	}
+	p := i + hashes
+	w := jsSpaceEnd(src, p)
+	// The lookahead skips the same whitespace wherever \s+ stops, so it holds for all of them or none.
+	if w == p || hashesThenSpace(src, w) {
+		return nil
+	}
+	for q := w; q > p; {
+		if end, e, ok := headingContent(src, q); ok {
+			return newCapture(src[:end], src[i:p], src[q:e])
+		}
+		_, size := utf8.DecodeLastRuneInString(src[:q])
+		q -= size
+	}
+	return nil
+}
+
+func hashesThenSpace(src string, i int) bool {
+	n := countByte(src, i, '#')
+	if n < 1 || n > 3 || i+n >= len(src) {
+		return false
+	}
+	r, _ := utf8.DecodeRuneInString(src[i+n:])
+	return isJSSpace(r)
+}
+
+func headingContent(src string, q int) (end, e int, ok bool) {
+	if q >= len(src) || src[q] == '\n' {
+		return 0, 0, false
+	}
+	_, size := utf8.DecodeRuneInString(src[q:])
+	for e = q + size; ; {
+		x := e + countByte(src, e, '#')
+		y := jsSpaceEnd(src, x)
+		if y == len(src) {
+			return y, e, true
+		}
+		if nl := strings.LastIndexByte(src[x:y], '\n'); nl >= 0 {
+			return x + nl + 1, e, true
+		}
+		if e >= len(src) || src[e] == '\n' {
+			return 0, 0, false
+		}
+		_, size = utf8.DecodeRuneInString(src[e:])
+		e += size
+	}
+}
+
+func parseHeading(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	return []mdNode{{kind: mdHeading, level: len(c.groups[1]), children: inlineParse(p, jsTrim(c.groups[2]), st)}}
+}
+
+func matchSubtext(src string, st *mdState) *mdCapture {
+	if st.noSubtext || !(st.prev == "" || strings.HasSuffix(st.prev, "\n")) {
+		return nil
+	}
+	i := countByte(src, 0, ' ')
+	if !strings.HasPrefix(src[i:], "-#") {
+		return nil
+	}
+	i += 2
+	spaces := countByte(src, i, ' ')
+	if spaces == 0 {
+		return nil
+	}
+	start := i + spaces
+	if start == len(src) || src[start] == '\n' || strings.HasPrefix(src[start:], "-#") {
+		// Backtracking gives the content one of the spaces.
+		if spaces < 2 {
+			return nil
+		}
+		start--
+	}
+	e := lineEnd(src, start)
+	end := e
+	if end < len(src) {
+		end++
+	}
+	return newCapture(src[:end], src[start:e])
+}
+
+func parseSubtext(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	inner := *st
+	inner.noSubtext = true
+	return []mdNode{{kind: mdSubtext, children: inlineParse(p, jsTrim(c.groups[1]), &inner)}}
+}
+
+func parseCodeBlock(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdCodeBlock, lang: c.groups[1], text: c.groups[2]}}
+}
+
+func parseCustomEmoji(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdEmoji, name: c.groups[2], id: c.groups[3], animated: c.groups[1] == "a"}}
+}
+
+func matchBlockQuote(src string, st *mdState) *mdCapture {
+	if st.inQuote || !atLineStart(st.prev) {
+		return nil
+	}
+	i := countByte(src, 0, ' ')
+	if strings.HasPrefix(src[i:], ">>>") && countByte(src, i+3, ' ') > 0 {
+		return newCapture(src)
+	}
+	end, ok := quoteLine(src, 0)
+	if !ok {
+		return nil
+	}
+	for end < len(src) {
+		next, ok := quoteLine(src, end+1)
+		if !ok {
+			break
+		}
+		end = next
+	}
+	if end < len(src) {
+		end++
+	}
+	return newCapture(src[:end])
+}
+
+func quoteLine(src string, i int) (int, bool) {
+	i += countByte(src, i, ' ')
+	if i >= len(src) || src[i] != '>' || strings.HasPrefix(src[i+1:], ">>") {
+		return 0, false
+	}
+	n := countByte(src, i+1, ' ')
+	if n == 0 {
+		return 0, false
+	}
+	return lineEnd(src, i+1+n), true
+}
+
+func parseBlockQuote(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	inner := *st
+	inner.inQuote = true
+	var content string
+	if i := countByte(c.all, 0, ' '); strings.HasPrefix(c.all[i:], ">>>") {
+		i += 3
+		if i < len(c.all) && c.all[i] == ' ' {
+			i++
+		}
+		content = c.all[i:]
+	} else {
+		content = stripQuoteMarkers(c.all)
+		inner.inline = true
+	}
+	children := p.nested(content, inner)
+	if len(children) == 0 {
+		children = []mdNode{textNode(" ")}
+	}
+	return []mdNode{{kind: mdQuote, children: children}}
+}
+
+func isLineStart(s string, i int) bool {
+	if i == 0 {
+		return true
+	}
+	r, _ := utf8.DecodeLastRuneInString(s[:i])
+	return isJSLineTerminator(r)
+}
+
+func stripQuoteMarkers(s string) string {
+	var b strings.Builder
+	for i := 0; i < len(s); {
+		if isLineStart(s, i) {
+			if n := countByte(s, i, ' '); i+n < len(s) && s[i+n] == '>' {
+				i += n + 1
+				if i < len(s) && s[i] == ' ' {
+					i++
+				}
+				if i >= len(s) {
+					break
+				}
+			}
+		}
+		_, size := utf8.DecodeRuneInString(s[i:])
+		b.WriteString(s[i : i+size])
+		i += size
+	}
+	return b.String()
+}
+
+func matchList(src string, st *mdState) *mdCapture {
+	if st.listLevel >= mdMaxListLevel {
+		return nil
+	}
+	if src[0] == '\n' {
+		if atLineStart(st.prev) {
+			return nil
+		}
+		return matchListAt(src, 1)
+	}
+	if !atLineStart(st.prev) {
+		return nil
+	}
+	return matchListAt(src, 0)
+}
+
+func matchListAt(src string, off int) *mdCapture {
+	i := off + countByte(src, off, ' ')
+	b, ok := bulletEnd(src, i)
+	if !ok || b+1 >= len(src) || src[b] != ' ' {
+		return nil
+	}
+	indent := src[off:i]
+	_, size := utf8.DecodeRuneInString(src[b+1:])
+	for e := b + 1 + size; ; {
+		if e == len(src) {
+			return newCapture(src, indent, src[i:b])
+		}
+		if src[e] == '\n' && endsList(src, e+1, indent) {
+			return newCapture(src[:e+1], indent, src[i:b])
+		}
+		_, size = utf8.DecodeRuneInString(src[e:])
+		e += size
+	}
+}
+
+func endsList(src string, k int, indent string) bool {
+	if k < len(src) && src[k] == ' ' {
+		return false
+	}
+	if strings.HasPrefix(src[k:], indent) {
+		if b, ok := bulletEnd(src, k+len(indent)); ok && b < len(src) && src[b] == ' ' {
+			return false
+		}
+	}
+	return true
+}
+
+func bulletEnd(s string, i int) (int, bool) {
+	if i >= len(s) {
+		return 0, false
+	}
+	if s[i] == '*' || s[i] == '-' {
+		return i + 1, true
+	}
+	d := i
+	for d < len(s) && isASCIIDigit(rune(s[d])) {
+		d++
+	}
+	if d > i && d < len(s) && s[d] == '.' {
+		return d + 1, true
+	}
+	return 0, false
+}
+
+func itemPrefix(s string) (width, indent int) {
+	indent = countByte(s, 0, ' ')
+	b, ok := bulletEnd(s, indent)
+	if !ok {
+		return 0, 0
+	}
+	n := countByte(s, b, ' ')
+	if n == 0 {
+		return 0, 0
+	}
+	return b + n, indent
+}
+
+func itemStarts(s string, i, indent int) bool {
+	n := countByte(s, i, ' ')
+	if n != indent && n != indent+1 {
+		return false
+	}
+	b, ok := bulletEnd(s, i+n)
+	return ok && b < len(s) && s[b] == ' '
+}
+
+func splitListItems(body string, indent int) []string {
+	var items []string
+	for pos := 0; pos < len(body); {
+		start := -1
+		for s := pos; s < len(body); s++ {
+			if itemStarts(body, s, indent) {
+				start = s
+				break
+			}
+		}
+		if start < 0 {
+			break
+		}
+		e := lineEnd(body, start)
+		for e < len(body) && !itemStarts(body, e+1, indent) {
+			e = lineEnd(body, e+1)
+		}
+		if e < len(body) {
+			e++
+		}
+		items = append(items, body[start:e])
+		pos = e
+	}
+	return items
+}
+
+func unindentLines(s string, width int) string {
+	var b strings.Builder
+	for i := 0; i < len(s); {
+		if isLineStart(s, i) {
+			if n := min(countByte(s, i, ' '), width); n > 0 {
+				i += n
+				if i >= len(s) {
+					break
+				}
+			}
+		}
+		_, size := utf8.DecodeRuneInString(s[i:])
+		b.WriteString(s[i : i+size])
+		i += size
+	}
+	return b.String()
+}
+
+func replaceTrailingNewline(s, repl string) string {
+	if !strings.HasSuffix(s, "\n") {
+		return s
+	}
+	k := len(s) - 1
+	for k > 0 && s[k-1] == ' ' {
+		k--
+	}
+	return s[:k] + repl
+}
+
+func trimItemText(s string) string {
+	end := len(s)
+	for end > 0 {
+		r, size := utf8.DecodeLastRuneInString(s[:end])
+		if !isJSSpace(r) {
+			break
+		}
+		end -= size
+	}
+	if i := strings.IndexByte(s[end:], '\n'); i >= 0 {
+		return s[:end+i]
+	}
+	return s
+}
+
+func listStart(digits string) int {
+	digits = strings.TrimLeft(digits, "0")
+	if len(digits) > 10 {
+		return 1e9
+	}
+	n, _ := strconv.ParseInt(digits, 10, 64)
+	return int(min(1e9, max(1, n)))
+}
+
+func parseList(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	bullet := c.groups[2]
+	list := mdNode{kind: mdList, ordered: len(bullet) > 1, start: 1}
+	if list.ordered {
+		list.start = listStart(bullet[:len(bullet)-1])
+	}
+
+	body := strings.TrimPrefix(c.all, "\n")
+	if trimmed := strings.TrimRight(body, "\n"); len(body)-len(trimmed) >= 2 {
+		body = trimmed + "\n"
+	}
+	prefixWidth, indent := itemPrefix(body)
+	rawItems := splitListItems(body, indent)
+
+	lastWasLoose := false
+	for index, item := range rawItems {
+		width, _ := itemPrefix(item)
+		content := unindentLines(item[width:], prefixWidth)
+		loose := strings.Contains(content, "\n\n") || (index == len(rawItems)-1 && lastWasLoose)
+		lastWasLoose = loose
+
+		inner := *st
+		inner.listLevel++
+		inner.inline = !loose
+		inner.allowHeading = false
+		source := replaceTrailingNewline(content, "")
+		if loose {
+			source = replaceTrailingNewline(content, "\n\n")
+		}
+		nodes := p.nested(source, inner)
+		for i := range nodes {
+			if nodes[i].kind == mdText && !nodes[i].blockNewline {
+				nodes[i] = textNode(trimItemText(nodes[i].text))
+			}
+		}
+		list.items = append(list.items, nodes)
+	}
+	return []mdNode{list}
+}
+
+func matchNewline(src string, st *mdState) *mdCapture {
+	if st.inline || src[0] != '\n' {
+		return nil
+	}
+	end := 0
+	for i := 0; i < len(src) && (src[i] == '\n' || src[i] == ' '); i++ {
+		if src[i] == '\n' {
+			end = i + 1
+		}
+	}
+	if end == 0 {
+		return nil
+	}
+	return newCapture(src[:end])
+}
+
+func parseNewline(*mdParser, *mdCapture, *mdState) []mdNode {
+	return []mdNode{{kind: mdText, text: "\n", blockNewline: true}}
+}
+
+func matchParagraph(src string, st *mdState) *mdCapture {
+	if st.inline {
+		return nil
+	}
+	p := 0
+	for p < len(src) && !(src[p] == '\n' && blankLineAt(src, p+1)) {
+		p++
+	}
+	if p == 0 || p == len(src) {
+		return nil
+	}
+	end := p
+	for i := p; i < len(src) && (src[i] == '\n' || src[i] == ' '); i++ {
+		if src[i] == '\n' {
+			end = i + 1
+		}
+	}
+	return newCapture(src[:end], src[:p])
+}
+
+func blankLineAt(s string, i int) bool {
+	i += countByte(s, i, ' ')
+	return i < len(s) && s[i] == '\n'
+}
+
+func parseParagraph(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	return []mdNode{{kind: mdParagraph, children: inlineParse(p, c.groups[1], st)}}
+}
+
+func matchEscape(src string, st *mdState) *mdCapture {
+	if st.noEscape || !st.inline || len(src) < 2 {
+		return nil
+	}
+	r, size := utf8.DecodeRuneInString(src[1:])
+	if isASCIIAlnum(r) || isJSSpace(r) {
+		return nil
+	}
+	c := newCapture(src[:1+size], src[1:1+size])
+	c.astral = r > 0xffff
+	return c
+}
+
+func parseEscape(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{textNode(c.groups[1])}
+}
+
+// By hand: on a run of "<" every attempt reads to the end, slowly in Go's regexp.
+func matchAutolink(src string, st *mdState) *mdCapture {
+	if !st.inline {
+		return nil
+	}
+	j := 1
+	for j < len(src) && src[j] != ':' && src[j] != ' ' && src[j] != '>' {
+		j++
+	}
+	if j == 1 || j+1 >= len(src) || src[j] != ':' || src[j+1] != '/' {
+		return nil
+	}
+	k := j + 2
+	for k < len(src) && src[k] != ' ' && src[k] != '>' {
+		k++
+	}
+	if k == j+2 || k >= len(src) || src[k] != '>' {
+		return nil
+	}
+	return newCapture(src[:k+1], src[1:k])
+}
+
+func parseMailto(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	address := c.groups[1]
+	target := address
+	if !strings.HasPrefix(address, "mailto:") {
+		target = "mailto:" + address
+	}
+	return []mdNode{linkNode(target, address)}
+}
+
+func parseTel(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	number := c.groups[1]
+	target := reTelSpaces.ReplaceAllString(number, "-")
+	if !strings.HasPrefix(target, "tel:") && !strings.HasPrefix(target, "sms:") {
+		target = "tel:" + target
+	}
+	return []mdNode{linkNode(target, number)}
+}
+
+func isAllDigits(s string) bool {
+	return strings.Trim(s, "0123456789") == ""
+}
+
+func matchChannelURL(src string, _ *mdState) *mdCapture {
+	c := regexCapture(reChannelURL, src)
+	if c == nil || (c.set[2] && !isAllDigits(c.groups[2])) || (c.set[3] && !isAllDigits(c.groups[3])) {
+		return nil
+	}
+	return c
+}
+
+func parseChannelURL(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	if !c.set[2] {
+		return []mdNode{linkNode(c.all, c.all)}
+	}
+	return []mdNode{{kind: mdChannelMention, id: c.groups[2], url: c.all}}
+}
+
+func parseMediaPostLink(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdChannelMention, id: c.groups[2], url: c.all}}
+}
+
+func matchURL(src string, st *mdState) *mdCapture {
+	if !st.inline {
+		return nil
+	}
+	c := regexCapture(reURL, src)
+	if c == nil {
+		return nil
+	}
+	// Only one unmatched trailing ")" is ever dropped.
+	value := c.all
+	searchFrom := 0
+	for i := len(value) - 1; i >= 0 && value[i] == ')'; i-- {
+		open := strings.IndexByte(value[searchFrom:], '(')
+		if open < 0 {
+			value = value[:len(value)-1]
+			break
+		}
+		searchFrom += open + 1
+	}
+	c.all, c.groups[1] = value, value
+	return c
+}
+
+// Astral characters count twice: the client's counters run over UTF-16 units.
+func tooManyBrackets(s string) bool {
+	depth, sinceParen, deep := 0, 0, 0
+	for _, r := range s {
+		units := 1
+		if r > 0xffff {
+			units = 2
+		}
+		for ; units > 0; units-- {
+			if depth >= 2 {
+				if deep++; deep > 100 {
+					return true
+				}
+			} else {
+				deep = 0
+			}
+		}
+		switch r {
+		case ')':
+			sinceParen = 0
+			continue
+		case '[':
+			if depth++; depth > 10 {
+				return true
+			}
+		case ']':
+			if depth > 0 {
+				depth--
+			}
+		case '(':
+		default:
+			continue
+		}
+		if sinceParen++; sinceParen > 200 {
+			return true
+		}
+	}
+	return false
+}
+
+func matchLink(src string, st *mdState) *mdCapture {
+	if !st.inline || !strings.Contains(src, "](") || tooManyBrackets(src) {
+		return nil
+	}
+	bounds := linkLabelBounds(src)
+	for i := len(bounds) - 1; i >= 0; i-- {
+		b := bounds[i]
+		if !strings.HasPrefix(src[b:], "](") {
+			continue
+		}
+		if c := matchLinkHref(src, b+2); c != nil {
+			c.groups[1], c.set[1] = src[1:b], true
+			return c
+		}
+	}
+	return nil
+}
+
+func linkLabelBounds(src string) []int {
+	bounds := []int{1}
+	for p := 1; p < len(src); {
+		switch src[p] {
+		case '[':
+			j := strings.IndexByte(src[p+1:], ']')
+			if j < 0 {
+				return bounds
+			}
+			p += j + 2
+		case ']':
+			if j := strings.IndexAny(src[p+1:], "[]"); j < 0 || src[p+1+j] != ']' {
+				return bounds
+			}
+			p++
+		default:
+			_, size := utf8.DecodeRuneInString(src[p:])
+			p += size
+		}
+		bounds = append(bounds, p)
+	}
+	return bounds
+}
+
+func matchLinkHref(src string, p int) *mdCapture {
+	for k := jsSpaceEnd(src, p); ; {
+		starts := []int{k}
+		if k < len(src) && src[k] == '<' {
+			starts = []int{k + 1, k}
+		}
+		for _, u0 := range starts {
+			for u := u0; ; {
+				if c := matchLinkTail(src, u); c != nil {
+					c.groups[2], c.set[2] = src[u0:u], true
+					return c
+				}
+				next, ok := linkURLToken(src, u)
+				if !ok {
+					break
+				}
+				u = next
+			}
+		}
+		if k == p {
+			return nil
+		}
+		_, size := utf8.DecodeLastRuneInString(src[:k])
+		k -= size
+	}
+}
+
+func linkURLToken(src string, u int) (int, bool) {
+	if u >= len(src) {
+		return 0, false
+	}
+	switch src[u] {
+	case '(':
+		if j := strings.IndexByte(src[u+1:], ')'); j >= 0 {
+			return u + j + 2, true
+		}
+		return 0, false
+	case ')':
+		return 0, false
+	case '\\':
+		if u+1 < len(src) {
+			if r, size := utf8.DecodeRuneInString(src[u+1:]); !isJSLineTerminator(r) {
+				return u + 1 + size, true
+			}
+		}
+		return 0, false
+	}
+	r, size := utf8.DecodeRuneInString(src[u:])
+	if isJSSpace(r) {
+		return 0, false
+	}
+	return u + size, true
+}
+
+func matchLinkTail(src string, u int) *mdCapture {
+	starts := []int{u}
+	if u < len(src) && src[u] == '>' {
+		starts = []int{u + 1, u}
+	}
+	for _, v := range starts {
+		if x := jsSpaceEnd(src, v); x > v && x < len(src) && (src[x] == '"' || src[x] == '\'') {
+			for t := x + 1; t < len(src); t++ {
+				if src[t] != '"' && src[t] != '\'' {
+					continue
+				}
+				if y := jsSpaceEnd(src, t+1); y < len(src) && src[y] == ')' {
+					c := &mdCapture{all: src[:y+1]}
+					c.groups[3], c.set[3] = src[x+1:t], true
+					return c
+				}
+			}
+		}
+		if y := jsSpaceEnd(src, v); y < len(src) && src[y] == ')' {
+			return &mdCapture{all: src[:y+1]}
+		}
+	}
+	return nil
+}
+
+type labelKind uint16
+
+const (
+	kindText labelKind = 1 << iota
+	kindUnderline
+	kindBold
+	kindItalic
+	kindStrike
+	kindCode
+	kindSpoiler
+	kindBr
+	kindTimestamp
+	kindEmoji
+	kindList
+	kindHeading
+	kindQuote
+	kindSubtext
+
+	labelKinds = kindText | kindUnderline | kindBold | kindItalic | kindStrike | kindCode | kindSpoiler | kindBr | kindTimestamp
+	blockKinds = kindList | kindHeading | kindQuote | kindSubtext
+	titleKinds = labelKinds | kindEmoji | blockKinds
+)
+
+func (n *mdNode) labelKind() labelKind {
+	switch n.kind {
+	case mdMark:
+		return [...]labelKind{markBold: kindBold, markItalic: kindItalic, markUnderline: kindUnderline,
+			markStrike: kindStrike, markSpoiler: kindSpoiler}[n.mark]
+	case mdText:
+		return kindText
+	case mdCode:
+		return kindCode
+	case mdBr:
+		return kindBr
+	case mdTimestamp:
+		return kindTimestamp
+	case mdEmoji:
+		return kindEmoji
+	case mdList:
+		return kindList
+	case mdHeading:
+		return kindHeading
+	case mdQuote:
+		return kindQuote
+	case mdSubtext:
+		return kindSubtext
+	}
+	return 0
+}
+
+func nodesAllowed(nodes []mdNode, kinds labelKind) bool {
+	for i := range nodes {
+		n := &nodes[i]
+		if n.labelKind()&kinds == 0 {
+			return false
+		}
+		if n.kind == mdCode && !nodesAllowed(n.codeContent, kinds) {
+			return false
+		}
+		if n.hasChildren() && !nodesAllowed(n.children, kinds) {
+			return false
+		}
+	}
+	return true
+}
+
+func flattenLabel(nodes []mdNode) string {
+	var b strings.Builder
+	for _, n := range nodes {
+		switch n.kind {
+		case mdText, mdCode:
+			b.WriteString(n.text)
+		case mdEmoji:
+			b.WriteString(":" + n.name + ":")
+		case mdBr:
+			b.WriteString("\n")
+		case mdMark:
+			b.WriteString(flattenLabel(n.children))
+		case mdTimestamp:
+			b.WriteString("<timestamp>")
+		case mdQuote:
+			b.WriteString("<quoteContent>")
+		case mdList:
+			b.WriteString("<listContent>")
+		case mdHeading:
+			b.WriteString("<headingContent>")
+		case mdSubtext:
+			b.WriteString("<subtextContent>")
+		}
+	}
+	return b.String()
+}
+
+func parseLink(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	rawLabel, rawURL, rawTitle, hasTitle := c.groups[1], c.groups[2], c.groups[3], c.set[3]
+	asText := []mdNode{textNode(c.all)}
+
+	if st.validation != nil {
+		st.validation.nestedLink = true
+		return asText
+	}
+	if isSuspiciousURL(rawURL) {
+		return asText
+	}
+	label := sanitizeFully(rawLabel)
+	if jsTrim(sanitizeWhitespace(rawURL)) == "" || jsTrim(label) == "" {
+		return asText
+	}
+	target, _, ok := normalizeLink(unescapeURL(rawURL))
+	if !ok || (hasTitle && containsDiscordLink(foldHomoglyphs(rawTitle))) {
+		return asText
+	}
+
+	labelState := *st
+	labelState.noEscape = true
+	labelState.codeContent = true
+	validation := &linkValidation{}
+	validationState := labelState
+	validationState.validation = validation
+	allowed := labelKinds | blockKinds
+
+	labelNodes := p.nested(label, validationState)
+	if validation.nestedLink || !nodesAllowed(labelNodes, allowed) {
+		return asText
+	}
+	titleNodes := p.nested(sanitizeFully(rawTitle), validationState)
+	if validation.nestedLink || !nodesAllowed(titleNodes, titleKinds) {
+		return asText
+	}
+	flat := flattenLabel(labelNodes)
+	if jsTrim(flat) == "" || containsDiscordLink(flat) {
+		return asText
+	}
+	if flat != label {
+		if containsDiscordLink(label) {
+			return asText
+		}
+		reparsed := p.nested(flat, validationState)
+		if validation.nestedLink || !nodesAllowed(reparsed, allowed) {
+			return asText
+		}
+	}
+
+	labelState.prev = ""
+	children := p.label.nested(mdPreprocess(sanitizeWhitespace(rawLabel)), labelState)
+	return []mdNode{{kind: mdLink, url: target, title: sanitizeWhitespace(rawTitle), children: children}}
+}
+
+func matchEmUnderscore(src string) *mdCapture {
+	p := 1
+	for first := true; ; first = false {
+		if !first && p < len(src) && src[p] == '_' && (p+1 == len(src) || !isWordByte(src[p+1])) {
+			return newCapture(src[:p+1], src[1:p])
+		}
+		if p >= len(src) {
+			return nil
+		}
+		switch src[p] {
+		case '_':
+			if p+1 >= len(src) || src[p+1] != '_' {
+				return nil
+			}
+			p += 2
+		case '\\':
+			if p+1 >= len(src) {
+				return nil
+			}
+			_, size := utf8.DecodeRuneInString(src[p+1:])
+			p += 1 + size
+		default:
+			_, size := utf8.DecodeRuneInString(src[p:])
+			p += size
+		}
+	}
+}
+
+func matchEmStar(src string, loose bool) *mdCapture {
+	if len(src) < 2 {
+		return nil
+	}
+	if r, _ := utf8.DecodeRuneInString(src[1:]); isJSSpace(r) {
+		return nil
+	}
+	closes := func(i int) bool { return i < len(src) && src[i] == '*' && (i+1 == len(src) || src[i+1] != '*') }
+	p := 1
+	for first := true; ; first = false {
+		if !first {
+			if !loose && closes(p) {
+				return newCapture(src[:p+1], src[1:p])
+			}
+			if loose && p < len(src) && src[p] == ' ' {
+				if p+1 < len(src) && src[p+1] == ' ' && closes(p+2) {
+					return newCapture(src[:p+3], src[1:p])
+				}
+				if closes(p + 1) {
+					return newCapture(src[:p+2], src[1:p])
+				}
+			}
+		}
+		next, ok := emStarToken(src, p)
+		if !ok {
+			return nil
+		}
+		p = next
+	}
+}
+
+func emStarToken(src string, p int) (int, bool) {
+	if p >= len(src) {
+		return 0, false
+	}
+	if r, _ := utf8.DecodeRuneInString(src[p:]); isJSSpace(r) {
+		p = jsSpaceEnd(src, p)
+		if p >= len(src) {
+			return 0, false
+		}
+	}
+	switch src[p] {
+	case '*':
+		if p+1 < len(src) && src[p+1] == '*' {
+			return p + 2, true
+		}
+		return 0, false
+	case '\\':
+		if p+1 >= len(src) {
+			return 0, false
+		}
+		_, size := utf8.DecodeRuneInString(src[p+1:])
+		return p + 1 + size, true
+	}
+	_, size := utf8.DecodeRuneInString(src[p:])
+	return p + size, true
+}
+
+func matchEm(src string, st *mdState) *mdCapture {
+	if !st.inline {
+		return nil
+	}
+	switch src[0] {
+	case '_':
+		return matchEmUnderscore(src)
+	case '*':
+		return matchEmStar(src, false)
+	}
+	return nil
+}
+
+func matchLooseEm(src string, st *mdState) *mdCapture {
+	if !st.inline || src[0] != '*' {
+		return nil
+	}
+	return matchEmStar(src, true)
+}
+
+func parseEm(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	return []mdNode{{kind: mdMark, mark: markItalic, children: p.nested(c.groups[1], *st)}}
+}
+
+func matchDoubled(src string, d byte) *mdCapture {
+	if len(src) < 2 || src[0] != d || src[1] != d {
+		return nil
+	}
+	p := 2
+	for first := true; ; first = false {
+		if !first && p+1 < len(src) && src[p] == d && src[p+1] == d && (p+2 == len(src) || src[p+2] != d) {
+			return newCapture(src[:p+2], src[2:p])
+		}
+		if p >= len(src) {
+			return nil
+		}
+		if src[p] == '\\' {
+			if p+1 >= len(src) {
+				return nil
+			}
+			p++
+		}
+		_, size := utf8.DecodeRuneInString(src[p:])
+		p += size
+	}
+}
+
+func matchStrong(src string, st *mdState) *mdCapture {
+	if !st.inline {
+		return nil
+	}
+	return matchDoubled(src, '*')
+}
+
+func matchUnderline(src string, st *mdState) *mdCapture {
+	if !st.inline {
+		return nil
+	}
+	return matchDoubled(src, '_')
+}
+
+func matchStrike(src string, st *mdState) *mdCapture {
+	if !st.inline || len(src) < 3 || !strings.HasPrefix(src, "~~") {
+		return nil
+	}
+	_, size := utf8.DecodeRuneInString(src[2:])
+	for p := 2 + size; p+1 < len(src); p++ {
+		if src[p] == '~' && src[p+1] == '~' && (p+2 == len(src) || src[p+2] != '_') {
+			return newCapture(src[:p+2], src[2:p])
+		}
+	}
+	return nil
+}
+
+func markParser(mark markType) func(*mdParser, *mdCapture, *mdState) []mdNode {
+	return func(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+		return []mdNode{{kind: mdMark, mark: mark, children: inlineParse(p, c.groups[1], st)}}
+	}
+}
+
+// Same result as the client's regex, without its cubic backtracking.
+func matchInlineCode(src string) *mdCapture {
+	open := countByte(src, 0, '`')
+	if open == 0 || !strings.Contains(src[open:], "`") {
+		return nil
+	}
+	type run struct{ start, length int }
+	var runs []run
+	for i := open; i < len(src); {
+		if src[i] != '`' {
+			i++
+			continue
+		}
+		n := countByte(src, i, '`')
+		runs = append(runs, run{i, n})
+		i += n
+	}
+	for size := open; size >= 1; size-- {
+		for _, r := range runs {
+			if r.length == size {
+				return newCapture(src[:r.start+size], src[:size], src[size:r.start])
+			}
+		}
+	}
+	return nil
+}
+
+func matchInlineCodeRule(src string, st *mdState) *mdCapture {
+	if !st.inline {
+		return nil
+	}
+	return matchInlineCode(src)
+}
+
+func trimCodeSpaces(code string) string {
+	lead := strings.HasPrefix(code, " ") && strings.HasPrefix(strings.TrimLeft(code[1:], " "), "`")
+	trail := strings.HasSuffix(code, " ") && strings.HasSuffix(strings.TrimRight(code, " "), "`")
+	if trail {
+		code = code[:len(code)-1]
+	}
+	if lead {
+		code = code[1:]
+	}
+	return code
+}
+
+func parseInlineCode(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	node := mdNode{kind: mdCode, text: trimCodeSpaces(c.groups[2])}
+	if st.codeContent && st.validation != nil {
+		node.codeContent = p.nested(node.text, *st)
+	}
+	return []mdNode{node}
+}
+
+func matchBr(src string, _ *mdState) *mdCapture {
+	n := countByte(src, 0, ' ')
+	if n < 2 || n >= len(src) || src[n] != '\n' {
+		return nil
+	}
+	return newCapture(src[:n+1])
+}
+
+func parseBr(*mdParser, *mdCapture, *mdState) []mdNode {
+	return []mdNode{{kind: mdBr}}
+}
+
+// Past this, Date can't represent the time and the client leaves the tag as text.
+const maxTimestampSeconds = 8.64e12
+
+func parseTimestamp(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	unix, err := strconv.ParseInt(c.groups[1], 10, 64)
+	if err != nil || unix > maxTimestampSeconds || unix < -maxTimestampSeconds {
+		return []mdNode{textNode(c.all)}
+	}
+	style := byte('f')
+	if c.set[2] {
+		style = c.groups[2][0]
+	}
+	return []mdNode{{kind: mdTimestamp, unix: unix, style: style}}
+}
+
+func matchText(src string, _ *mdState) *mdCapture {
+	_, size := utf8.DecodeRuneInString(src)
+	return newCapture(src[:textEnd(src, size)])
+}
+
+// Astral characters never end text: to the client they are surrogates, in U+00C0-U+FFFF.
+func textEnd(src string, from int) int {
+	spaceEnd, wordEnd, digitEnd := -1, -1, -1
+	wordStop, digitStop := false, false
+	for i := from; i < len(src); i++ {
+		c := src[i]
+		if c >= utf8.RuneSelf {
+			r, size := utf8.DecodeRuneInString(src[i:])
+			if r < 0xc0 && r != 0xa0 {
+				return i
+			}
+			i += size - 1
+			continue
+		}
+		switch {
+		case c == ' ':
+			if i >= spaceEnd {
+				spaceEnd = i + countByte(src, i, ' ')
+			}
+			if spaceEnd-i >= 2 && spaceEnd < len(src) && src[spaceEnd] == '\n' {
+				return i
+			}
+		case c == '\n':
+			if i+1 < len(src) && src[i+1] == '\n' {
+				return i
+			}
+		case c == '\t' || c == '\v' || c == '\f' || c == '\r':
+		case isASCIIAlnum(rune(c)):
+			if i >= wordEnd {
+				wordEnd = i + 1
+				for wordEnd < len(src) && isWordByte(src[wordEnd]) {
+					wordEnd++
+				}
+				wordStop = false
+				if wordEnd+1 < len(src) && src[wordEnd] == ':' {
+					r, _ := utf8.DecodeRuneInString(src[wordEnd+1:])
+					wordStop = !isJSSpace(r)
+				}
+			}
+			if wordStop {
+				return i
+			}
+			if isASCIIDigit(rune(c)) {
+				if i >= digitEnd {
+					digitEnd = i + countDigits(src, i)
+					digitStop = digitEnd < len(src) && src[digitEnd] == '.'
+				}
+				if digitStop {
+					return i
+				}
+			}
+		default:
+			return i
+		}
+	}
+	return len(src)
+}
+
+func countDigits(s string, i int) int {
+	n := 0
+	for i+n < len(s) && isASCIIDigit(rune(s[i+n])) {
+		n++
+	}
+	return n
+}
+
+func parseText(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{textNode(c.all)}
+}
+
+const emoticonShrug = `¯\_(ツ)_/¯`
+
+func matchEmoticon(src string, _ *mdState) *mdCapture {
+	if !strings.HasPrefix(src, emoticonShrug) {
+		return nil
+	}
+	return newCapture(emoticonShrug, emoticonShrug)
+}
+
+func parseRoleMention(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdRoleMention, id: c.groups[1]}}
+}
+
+func parseMention(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	if c.set[1] {
+		return []mdNode{{kind: mdUserMention, id: c.groups[1]}}
+	}
+	return []mdNode{{kind: mdGlobalMention, name: strings.TrimPrefix(c.groups[2], "@")}}
+}
+
+func parseChannelMention(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdChannelMention, id: c.groups[1]}}
+}
+
+func parseCommandMention(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdCommandMention, name: c.groups[1], id: c.groups[2]}}
+}
+
+func matchSpoiler(src string, _ *mdState) *mdCapture {
+	if len(src) < 3 || !strings.HasPrefix(src, "||") {
+		return nil
+	}
+	i := strings.Index(src[3:], "||")
+	if i < 0 {
+		return nil
+	}
+	return newCapture(src[:i+5], src[2:i+3])
+}
+
+func parseSpoiler(p *mdParser, c *mdCapture, st *mdState) []mdNode {
+	return []mdNode{{kind: mdMark, mark: markSpoiler, children: p.nested(c.groups[1], *st)}}
+}
+
+func parseStaticRouteLink(_ *mdParser, c *mdCapture, _ *mdState) []mdNode {
+	return []mdNode{{kind: mdGuildNav, name: c.groups[1]}}
+}
diff --git a/backend/email/markdown_url.go b/backend/email/markdown_url.go
new file mode 100644
index 00000000..d8a3159b
--- /dev/null
+++ b/backend/email/markdown_url.go
@@ -0,0 +1,827 @@
+package email
+
+// The parts of the WHATWG URL Standard (`new URL()`, no base) that Discord's link rules read.
+
+import (
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"golang.org/x/net/idna"
+)
+
+type webURL struct {
+	scheme     string
+	username   string
+	password   string
+	host       string
+	hasHost    bool
+	port       int
+	path       []string
+	opaque     bool
+	opaquePath string
+	query      string
+	fragment   string
+}
+
+var specialSchemePorts = map[string]int{"ftp": 21, "file": -1, "http": 80, "https": 443, "ws": 80, "wss": 443}
+
+func isSpecialScheme(scheme string) bool {
+	_, ok := specialSchemePorts[scheme]
+	return ok
+}
+
+func (u *webURL) protocol() string {
+	return u.scheme + ":"
+}
+
+func (u *webURL) hostPort() string {
+	if !u.hasHost {
+		return ""
+	}
+	if u.port < 0 {
+		return u.host
+	}
+	return u.host + ":" + strconv.Itoa(u.port)
+}
+
+func (u *webURL) pathname() string {
+	if u.opaque {
+		return u.opaquePath
+	}
+	var b strings.Builder
+	for _, segment := range u.path {
+		b.WriteByte('/')
+		b.WriteString(segment)
+	}
+	return b.String()
+}
+
+func (u *webURL) search() string {
+	if u.query == "" {
+		return ""
+	}
+	return "?" + u.query
+}
+
+func (u *webURL) hash() string {
+	if u.fragment == "" {
+		return ""
+	}
+	return "#" + u.fragment
+}
+
+func formDecode(s string) string {
+	return decodeUTF8Lossy(percentDecode(strings.ReplaceAll(s, "+", " ")))
+}
+
+type urlState int
+
+const (
+	urlSchemeStart urlState = iota
+	urlScheme
+	urlSpecialAuthoritySlashes
+	urlSpecialAuthorityIgnoreSlashes
+	urlPathOrAuthority
+	urlAuthority
+	urlHost
+	urlPort
+	urlPathStart
+	urlPath
+	urlOpaquePath
+	urlQuery
+	urlFragment
+)
+
+const urlEOF rune = -1
+
+func parseWebURL(input string) (*webURL, bool) {
+	input = strings.TrimFunc(input, func(r rune) bool { return r <= ' ' })
+	input = strings.Map(func(r rune) rune {
+		if r == '\t' || r == '\n' || r == '\r' {
+			return -1
+		}
+		return r
+	}, input)
+
+	in := []rune(input)
+	u := &webURL{port: -1}
+	state := urlSchemeStart
+	special := false
+	var buf []rune
+	var segment, query strings.Builder
+	var queryBuf []rune
+	atSignSeen, insideBrackets, passwordTokenSeen := false, false, false
+
+	for p := 0; ; p++ {
+		c := urlEOF
+		if p < len(in) {
+			c = in[p]
+		}
+		ends := c == urlEOF || c == '/' || c == '?' || c == '#' || (special && c == '\\')
+
+		switch state {
+		case urlSchemeStart:
+			if !isASCIIAlpha(c) {
+				return nil, false
+			}
+			buf = append(buf, toLowerASCII(c))
+			state = urlScheme
+
+		case urlScheme:
+			switch {
+			case isASCIIAlpha(c) || isASCIIDigit(c) || c == '+' || c == '-' || c == '.':
+				buf = append(buf, toLowerASCII(c))
+			case c == ':':
+				u.scheme = string(buf)
+				buf = buf[:0]
+				special = isSpecialScheme(u.scheme)
+				switch {
+				case u.scheme == "file":
+					// No Discord link rule can link a file: URL, so its details never matter.
+					return u, true
+				case special:
+					state = urlSpecialAuthoritySlashes
+				case p+1 < len(in) && in[p+1] == '/':
+					state = urlPathOrAuthority
+					p++
+				default:
+					u.opaque = true
+					state = urlOpaquePath
+				}
+			default:
+				return nil, false
+			}
+
+		case urlSpecialAuthoritySlashes:
+			state = urlSpecialAuthorityIgnoreSlashes
+			if c == '/' && p+1 < len(in) && in[p+1] == '/' {
+				p++
+			} else {
+				p--
+			}
+
+		case urlSpecialAuthorityIgnoreSlashes:
+			if c != '/' && c != '\\' {
+				state = urlAuthority
+				p--
+			}
+
+		case urlPathOrAuthority:
+			if c == '/' {
+				state = urlAuthority
+			} else {
+				state = urlPath
+				p--
+			}
+
+		case urlAuthority:
+			switch {
+			case c == '@':
+				if atSignSeen {
+					buf = append([]rune("%40"), buf...)
+				}
+				atSignSeen = true
+				for _, r := range buf {
+					if r == ':' && !passwordTokenSeen {
+						passwordTokenSeen = true
+						continue
+					}
+					if passwordTokenSeen {
+						u.password += percentEncode(r, inUserinfoSet)
+					} else {
+						u.username += percentEncode(r, inUserinfoSet)
+					}
+				}
+				buf = buf[:0]
+			case ends:
+				if atSignSeen && len(buf) == 0 {
+					return nil, false
+				}
+				p -= len(buf) + 1
+				buf = buf[:0]
+				state = urlHost
+			default:
+				buf = append(buf, c)
+			}
+
+		case urlHost:
+			switch {
+			case c == ':' && !insideBrackets:
+				if len(buf) == 0 {
+					return nil, false
+				}
+				host, ok := parseURLHost(string(buf), !special)
+				if !ok {
+					return nil, false
+				}
+				u.host, u.hasHost = host, true
+				buf = buf[:0]
+				state = urlPort
+			case ends:
+				p--
+				if special && len(buf) == 0 {
+					return nil, false
+				}
+				host, ok := parseURLHost(string(buf), !special)
+				if !ok {
+					return nil, false
+				}
+				u.host, u.hasHost = host, true
+				buf = buf[:0]
+				state = urlPathStart
+			default:
+				if c == '[' {
+					insideBrackets = true
+				} else if c == ']' {
+					insideBrackets = false
+				}
+				buf = append(buf, c)
+			}
+
+		case urlPort:
+			switch {
+			case isASCIIDigit(c):
+				buf = append(buf, c)
+			case ends:
+				if len(buf) > 0 {
+					port := 0
+					for _, d := range buf {
+						if port = port*10 + int(d-'0'); port > 65535 {
+							return nil, false
+						}
+					}
+					if def, ok := specialSchemePorts[u.scheme]; ok && def == port {
+						u.port = -1
+					} else {
+						u.port = port
+					}
+					buf = buf[:0]
+				}
+				state = urlPathStart
+				p--
+			default:
+				return nil, false
+			}
+
+		case urlPathStart:
+			switch {
+			case special:
+				state = urlPath
+				if c != '/' && c != '\\' {
+					p--
+				}
+			case c == '?':
+				state = urlQuery
+			case c == '#':
+				state = urlFragment
+			case c != urlEOF:
+				state = urlPath
+				if c != '/' {
+					p--
+				}
+			}
+
+		case urlPath:
+			if ends {
+				value := segment.String()
+				slash := c == '/' || (special && c == '\\')
+				switch {
+				case isDoubleDotSegment(value):
+					if len(u.path) > 0 {
+						u.path = u.path[:len(u.path)-1]
+					}
+					if !slash {
+						u.path = append(u.path, "")
+					}
+				case isSingleDotSegment(value):
+					if !slash {
+						u.path = append(u.path, "")
+					}
+				default:
+					u.path = append(u.path, value)
+				}
+				segment.Reset()
+				if c == '?' {
+					state = urlQuery
+				} else if c == '#' {
+					state = urlFragment
+				}
+			} else {
+				segment.WriteString(percentEncode(c, inPathSet))
+			}
+
+		case urlOpaquePath:
+			switch {
+			case c == '?':
+				state = urlQuery
+			case c == '#':
+				state = urlFragment
+			case c == ' ':
+				if p+1 < len(in) && (in[p+1] == '?' || in[p+1] == '#') {
+					u.opaquePath += "%20"
+				} else {
+					u.opaquePath += " "
+				}
+			case c != urlEOF:
+				u.opaquePath += percentEncode(c, inC0ControlSet)
+			}
+
+		case urlQuery:
+			if c == urlEOF || c == '#' {
+				set := inQuerySet
+				if special {
+					set = inSpecialQuerySet
+				}
+				for _, r := range queryBuf {
+					query.WriteString(percentEncode(r, set))
+				}
+				queryBuf = queryBuf[:0]
+				if c == '#' {
+					state = urlFragment
+				}
+			} else {
+				queryBuf = append(queryBuf, c)
+			}
+
+		case urlFragment:
+			if c != urlEOF {
+				u.fragment += percentEncode(c, inFragmentSet)
+			}
+		}
+
+		if p >= len(in) {
+			break
+		}
+	}
+	u.query = query.String()
+	return u, true
+}
+
+func isSingleDotSegment(s string) bool {
+	return s == "." || strings.EqualFold(s, "%2e")
+}
+
+func isDoubleDotSegment(s string) bool {
+	switch strings.ToLower(s) {
+	case "..", ".%2e", "%2e.", "%2e%2e":
+		return true
+	}
+	return false
+}
+
+func inC0ControlSet(r rune) bool {
+	return r < 0x20 || r > 0x7e
+}
+
+func inFragmentSet(r rune) bool {
+	return inC0ControlSet(r) || r == ' ' || r == '"' || r == '<' || r == '>' || r == '`'
+}
+
+func inQuerySet(r rune) bool {
+	return inC0ControlSet(r) || r == ' ' || r == '"' || r == '#' || r == '<' || r == '>'
+}
+
+func inSpecialQuerySet(r rune) bool {
+	return inQuerySet(r) || r == '\''
+}
+
+func inPathSet(r rune) bool {
+	return inQuerySet(r) || r == '?' || r == '^' || r == '`' || r == '{' || r == '}'
+}
+
+func inUserinfoSet(r rune) bool {
+	return inPathSet(r) || r == '/' || r == ':' || r == ';' || r == '=' || r == '@' || (r >= '[' && r <= '^') || r == '|'
+}
+
+const upperHex = "0123456789ABCDEF"
+
+func percentEncode(r rune, set func(rune) bool) string {
+	if !set(r) {
+		return string(r)
+	}
+	var b strings.Builder
+	for _, c := range []byte(string(r)) {
+		b.WriteByte('%')
+		b.WriteByte(upperHex[c>>4])
+		b.WriteByte(upperHex[c&15])
+	}
+	return b.String()
+}
+
+func hexValue(c byte) (byte, bool) {
+	switch {
+	case c >= '0' && c <= '9':
+		return c - '0', true
+	case c >= 'a' && c <= 'f':
+		return c - 'a' + 10, true
+	case c >= 'A' && c <= 'F':
+		return c - 'A' + 10, true
+	}
+	return 0, false
+}
+
+func percentDecode(s string) []byte {
+	out := make([]byte, 0, len(s))
+	for i := 0; i < len(s); i++ {
+		if s[i] == '%' && i+2 < len(s) {
+			hi, ok1 := hexValue(s[i+1])
+			lo, ok2 := hexValue(s[i+2])
+			if ok1 && ok2 {
+				out = append(out, hi<<4|lo)
+				i += 2
+				continue
+			}
+		}
+		out = append(out, s[i])
+	}
+	return out
+}
+
+func decodeUTF8Lossy(b []byte) string {
+	if utf8.Valid(b) {
+		return string(b)
+	}
+	var out strings.Builder
+	for len(b) > 0 {
+		r, size := utf8.DecodeRune(b)
+		out.WriteRune(r)
+		b = b[size:]
+	}
+	return out.String()
+}
+
+func isForbiddenHostCodePoint(r rune) bool {
+	switch r {
+	case 0, '\t', '\n', '\r', ' ', '#', '/', ':', '<', '>', '?', '@', '[', '\\', ']', '^', '|':
+		return true
+	}
+	return false
+}
+
+func isForbiddenDomainCodePoint(r rune) bool {
+	return isForbiddenHostCodePoint(r) || r <= 0x1f || r == '%' || r == 0x7f
+}
+
+func parseURLHost(input string, opaque bool) (string, bool) {
+	if strings.HasPrefix(input, "[") {
+		if !strings.HasSuffix(input, "]") {
+			return "", false
+		}
+		address, ok := parseIPv6(input[1 : len(input)-1])
+		if !ok {
+			return "", false
+		}
+		return "[" + serializeIPv6(address) + "]", true
+	}
+	if opaque {
+		if strings.ContainsFunc(input, isForbiddenHostCodePoint) {
+			return "", false
+		}
+		var b strings.Builder
+		for _, r := range input {
+			b.WriteString(percentEncode(r, inC0ControlSet))
+		}
+		return b.String(), true
+	}
+
+	domain, ok := domainToASCII(decodeUTF8Lossy(percentDecode(input)))
+	if !ok || strings.ContainsFunc(domain, isForbiddenDomainCodePoint) {
+		return "", false
+	}
+	if endsInNumber(domain) {
+		address, ok := parseIPv4(domain)
+		if !ok {
+			return "", false
+		}
+		return serializeIPv4(address), true
+	}
+	return domain, true
+}
+
+var whatwgIDNA = idna.New(
+	idna.MapForLookup(),
+	idna.BidiRule(),
+	idna.Transitional(false),
+	idna.StrictDomainName(false),
+	idna.CheckHyphens(false),
+	idna.VerifyDNSLength(false),
+)
+
+func domainToASCII(domain string) (string, bool) {
+	// Node validates xn-- labels only in non-ASCII domains, so an ASCII one is just lowercased.
+	if isASCII(domain) {
+		return strings.ToLower(domain), true
+	}
+	var labels []string
+	start := 0
+	for i, r := range domain {
+		if r == '.' || r == 0x3002 || r == 0xff0e || r == 0xff61 {
+			labels = append(labels, domain[start:i])
+			start = i + utf8.RuneLen(r)
+		}
+	}
+	labels = append(labels, domain[start:])
+
+	for i, label := range labels {
+		if isASCII(label) && !hasPunycodePrefix(label) {
+			labels[i] = strings.ToLower(label)
+			continue
+		}
+		mapped := idnaMap(label)
+		if hasPunycodePrefix(mapped) {
+			// A punycode label is kept as written rather than re-encoded.
+			if len(mapped) == 4 || !isASCII(mapped) {
+				return "", false
+			}
+			if _, err := whatwgIDNA.ToASCII(mapped); err != nil {
+				return "", false
+			}
+			labels[i] = mapped
+			continue
+		}
+		// x/net/idna reads Bidi classes from unmapped runes, so U+2135-2138 (L, mapping to Hebrew R) would skip the Bidi rule.
+		out, err := whatwgIDNA.ToASCII(mapped)
+		if err != nil {
+			return "", false
+		}
+		labels[i] = out
+	}
+	result := strings.Join(labels, ".")
+	return result, result != ""
+}
+
+func hasPunycodePrefix(label string) bool {
+	return len(label) >= 4 && strings.EqualFold(label[:4], "xn--")
+}
+
+var idnaMapping = idna.New(idna.MapForLookup(), idna.ValidateLabels(false), idna.StrictDomainName(false), idna.Transitional(false))
+
+func idnaMap(label string) string {
+	var b strings.Builder
+	for _, r := range label {
+		if r < utf8.RuneSelf {
+			b.WriteRune(toLowerASCII(r))
+			continue
+		}
+		mapped, _ := idnaMapping.ToUnicode(string(r))
+		b.WriteString(mapped)
+	}
+	return b.String()
+}
+
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] >= utf8.RuneSelf {
+			return false
+		}
+	}
+	return true
+}
+
+func endsInNumber(host string) bool {
+	parts := strings.Split(host, ".")
+	if parts[len(parts)-1] == "" {
+		if len(parts) == 1 {
+			return false
+		}
+		parts = parts[:len(parts)-1]
+	}
+	last := parts[len(parts)-1]
+	if last != "" && strings.Trim(last, "0123456789") == "" {
+		return true
+	}
+	_, ok := parseIPv4Number(last)
+	return ok
+}
+
+// Values past 2^32 only need to compare as too big, so they saturate.
+const ipv4Overflow = 1 << 40
+
+func parseIPv4Number(s string) (uint64, bool) {
+	if s == "" {
+		return 0, false
+	}
+	radix := uint64(10)
+	if len(s) >= 2 && (s[:2] == "0x" || s[:2] == "0X") {
+		s, radix = s[2:], 16
+	} else if len(s) >= 2 && s[0] == '0' {
+		s, radix = s[1:], 8
+	}
+	var n uint64
+	for i := 0; i < len(s); i++ {
+		d, ok := hexValue(s[i])
+		if !ok || uint64(d) >= radix {
+			return 0, false
+		}
+		if n = n*radix + uint64(d); n > ipv4Overflow {
+			n = ipv4Overflow
+		}
+	}
+	return n, true
+}
+
+func parseIPv4(host string) (uint32, bool) {
+	parts := strings.Split(host, ".")
+	if parts[len(parts)-1] == "" && len(parts) > 1 {
+		parts = parts[:len(parts)-1]
+	}
+	if len(parts) > 4 {
+		return 0, false
+	}
+	numbers := make([]uint64, len(parts))
+	for i, part := range parts {
+		n, ok := parseIPv4Number(part)
+		if !ok {
+			return 0, false
+		}
+		numbers[i] = n
+	}
+	for _, n := range numbers[:len(numbers)-1] {
+		if n > 255 {
+			return 0, false
+		}
+	}
+	last := numbers[len(numbers)-1]
+	if last >= uint64(1)<<(8*(5-len(numbers))) {
+		return 0, false
+	}
+	address := last
+	for i, n := range numbers[:len(numbers)-1] {
+		address += n << (8 * (3 - i))
+	}
+	return uint32(address), true
+}
+
+func serializeIPv4(address uint32) string {
+	return strconv.Itoa(int(address>>24)) + "." + strconv.Itoa(int(address>>16&255)) + "." +
+		strconv.Itoa(int(address>>8&255)) + "." + strconv.Itoa(int(address&255))
+}
+
+func parseIPv6(input string) ([8]uint16, bool) {
+	var address [8]uint16
+	pieceIndex, compress := 0, -1
+	p := 0
+	at := func(i int) byte {
+		if i < len(input) {
+			return input[i]
+		}
+		return 0
+	}
+
+	if at(p) == ':' {
+		if at(p+1) != ':' {
+			return address, false
+		}
+		p += 2
+		pieceIndex++
+		compress = pieceIndex
+	}
+	for p < len(input) {
+		if pieceIndex == 8 {
+			return address, false
+		}
+		if input[p] == ':' {
+			if compress >= 0 {
+				return address, false
+			}
+			p++
+			pieceIndex++
+			compress = pieceIndex
+			continue
+		}
+		value, length := 0, 0
+		for length < 4 {
+			d, ok := hexValue(at(p))
+			if !ok {
+				break
+			}
+			value = value*16 + int(d)
+			p++
+			length++
+		}
+		if at(p) == '.' {
+			if length == 0 {
+				return address, false
+			}
+			p -= length
+			if pieceIndex > 6 {
+				return address, false
+			}
+			numbersSeen := 0
+			for p < len(input) {
+				piece := -1
+				if numbersSeen > 0 {
+					if input[p] != '.' || numbersSeen >= 4 {
+						return address, false
+					}
+					p++
+				}
+				if !isASCIIDigit(rune(at(p))) {
+					return address, false
+				}
+				for isASCIIDigit(rune(at(p))) {
+					n := int(input[p] - '0')
+					switch piece {
+					case -1:
+						piece = n
+					case 0:
+						return address, false
+					default:
+						piece = piece*10 + n
+					}
+					if piece > 255 {
+						return address, false
+					}
+					p++
+				}
+				address[pieceIndex] = address[pieceIndex]*0x100 + uint16(piece)
+				numbersSeen++
+				if numbersSeen == 2 || numbersSeen == 4 {
+					pieceIndex++
+				}
+			}
+			if numbersSeen != 4 {
+				return address, false
+			}
+			break
+		} else if at(p) == ':' {
+			p++
+			if p >= len(input) {
+				return address, false
+			}
+		} else if p < len(input) {
+			return address, false
+		}
+		address[pieceIndex] = uint16(value)
+		pieceIndex++
+	}
+	if compress >= 0 {
+		swaps := pieceIndex - compress
+		pieceIndex = 7
+		for pieceIndex != 0 && swaps > 0 {
+			address[pieceIndex], address[compress+swaps-1] = address[compress+swaps-1], address[pieceIndex]
+			pieceIndex--
+			swaps--
+		}
+	} else if pieceIndex != 8 {
+		return address, false
+	}
+	return address, true
+}
+
+func serializeIPv6(address [8]uint16) string {
+	compress, bestLen := -1, 1
+	for i := 0; i < 8; {
+		if address[i] != 0 {
+			i++
+			continue
+		}
+		j := i
+		for j < 8 && address[j] == 0 {
+			j++
+		}
+		if j-i > bestLen {
+			compress, bestLen = i, j-i
+		}
+		i = j
+	}
+
+	var b strings.Builder
+	ignoreZero := false
+	for i := 0; i < 8; i++ {
+		if ignoreZero && address[i] == 0 {
+			continue
+		}
+		ignoreZero = false
+		if i == compress {
+			if i == 0 {
+				b.WriteString("::")
+			} else {
+				b.WriteByte(':')
+			}
+			ignoreZero = true
+			continue
+		}
+		b.WriteString(strconv.FormatUint(uint64(address[i]), 16))
+		if i != 7 {
+			b.WriteByte(':')
+		}
+	}
+	return b.String()
+}
+
+func isASCIIAlpha(r rune) bool {
+	return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z')
+}
+
+func isASCIIDigit(r rune) bool {
+	return r >= '0' && r <= '9'
+}
+
+func toLowerASCII(r rune) rune {
+	if r >= 'A' && r <= 'Z' {
+		return r + 'a' - 'A'
+	}
+	return r
+}
diff --git a/backend/go.mod b/backend/go.mod
index 55af17fb..5d3ed205 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -46,6 +46,7 @@ require (
 	github.com/stretchr/testify v1.12.1
 	github.com/weppos/publicsuffix-go v0.20.0
 	go.uber.org/zap v1.28.0
+	golang.org/x/net v0.58.0
 	golang.org/x/sync v0.23.0
 )
 
@@ -126,7 +127,6 @@ require (
 	golang.org/x/arch v0.17.0 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa // indirect
-	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/term v0.46.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b482fa35..81519613 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -8,6 +8,7 @@
       "name": "tickets-dashboard",
       "version": "0.0.0",
       "dependencies": {
+        "@emoji-platform-data/discord": "^0.7.0",
         "@fortawesome/fontawesome-svg-core": "^7.2.0",
         "@fortawesome/free-solid-svg-icons": "^7.2.0",
         "@fortawesome/react-fontawesome": "^3.2.0",
@@ -338,6 +339,15 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@emoji-platform-data/discord": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@emoji-platform-data/discord/-/discord-0.7.0.tgz",
+      "integrity": "sha512-B71/yyYwxy+5pSANCLUir8aRcPXGEjySZrfI7mYzWEFd1X2OVRyJtSD7PcbACT7R1IrTqyAjWRAZAyqJsm87eA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=24"
+      }
+    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.27.7",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index b97e870a..f68d8714 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -13,6 +13,7 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@emoji-platform-data/discord": "^0.7.0",
     "@fortawesome/fontawesome-svg-core": "^7.2.0",
     "@fortawesome/free-solid-svg-icons": "^7.2.0",
     "@fortawesome/react-fontawesome": "^3.2.0",
diff --git a/frontend/src/components/EmbedPreview.tsx b/frontend/src/components/EmbedPreview.tsx
index 983871de..16656ed8 100644
--- a/frontend/src/components/EmbedPreview.tsx
+++ b/frontend/src/components/EmbedPreview.tsx
@@ -3,6 +3,7 @@ import { isSafeUrl } from "@/lib/url";
 import { formatEmbedTimestampForDisplay } from "@/lib/embed-timestamp";
 import DiscordText from "@/components/discord/DiscordText";
 import { previewAvatarUrl } from "@/lib/embed-avatar";
+import { usePreviewEntities } from "@/hooks/usePreviewEntities";
 
 interface EmbedField {
   name: string;
@@ -29,6 +30,7 @@ interface EmbedPreviewProps {
 }
 
 const EmbedPreview: FC<EmbedPreviewProps> = ({ embed, raw = false }) => {
+  const entities = usePreviewEntities();
   const borderColor = `#${(embed.colour || 0x5865f2).toString(16).padStart(6, "0")}`;
   const footerTimestamp = formatEmbedTimestampForDisplay(embed.timestamp);
   const thumbnailUrl = previewAvatarUrl(embed.thumbnail_url);
@@ -37,6 +39,8 @@ const EmbedPreview: FC<EmbedPreviewProps> = ({ embed, raw = false }) => {
   const authorUrl = previewAvatarUrl(embed.author?.url);
   const footerIconUrl = previewAvatarUrl(embed.footer?.icon_url);
   const titleUrl = previewAvatarUrl(embed.url);
+  // An embed with a url drops link rules from its title and field names.
+  const titleProfile = embed.url ? "embedTitleNoLinks" : "embedTitle";
 
   // Group fields into rows: inline fields share a row (max 3), non-inline get their own
   const fieldRows: EmbedField[][] = [];
@@ -96,14 +100,28 @@ const EmbedPreview: FC<EmbedPreviewProps> = ({ embed, raw = false }) => {
               <DiscordText
                 raw={raw}
                 content={embed.title}
+                profile={titleProfile}
+                entities={entities}
                 className="text-sm font-bold text-[#00a8fc] hover:underline"
               />
             </a>
           ) : (
-            <DiscordText raw={raw} content={embed.title || ""} className="text-sm font-bold" />
+            <DiscordText
+              raw={raw}
+              content={embed.title || ""}
+              profile={titleProfile}
+              entities={entities}
+              className="text-sm font-bold"
+            />
           )}
           {embed.description && (
-            <DiscordText raw={raw} content={embed.description} className="text-sm pt-2" />
+            <DiscordText
+              raw={raw}
+              content={embed.description}
+              profile="embedDescription"
+              entities={entities}
+              className="text-sm pt-2"
+            />
           )}
           {fieldRows.length > 0 && (
             <div className="mt-2 flex flex-col gap-2">
@@ -120,11 +138,15 @@ const EmbedPreview: FC<EmbedPreviewProps> = ({ embed, raw = false }) => {
                       <DiscordText
                         raw={raw}
                         content={field.name}
+                        profile={titleProfile}
+                        entities={entities}
                         className="text-xs font-semibold"
                       />
                       <DiscordText
                         raw={raw}
                         content={field.value}
+                        profile="embedFieldValue"
+                        entities={entities}
                         className="text-xs text-gray-300"
                       />
                     </div>
diff --git a/frontend/src/components/FormInputRow.tsx b/frontend/src/components/FormInputRow.tsx
index f95e0ed8..3d433623 100644
--- a/frontend/src/components/FormInputRow.tsx
+++ b/frontend/src/components/FormInputRow.tsx
@@ -7,6 +7,7 @@ import RangeSlider from "./RangeSlider";
 import NumberInput from "./NumberInput";
 import Textarea from "./Textarea";
 import DiscordContent from "./discord/DiscordContent";
+import { usePreviewEntities } from "@/hooks/usePreviewEntities";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { faChevronUp, faChevronDown, faTrash, faPlus } from "@fortawesome/free-solid-svg-icons";
 import Slider from "./Slider";
@@ -104,6 +105,7 @@ const FormInputRow: FC<FormInputRowProps> = ({
   onChange,
   onValidationChange,
 }) => {
+  const previewEntities = usePreviewEntities();
   const [input, setInput] = useState(data);
   const [isApiSelect, setIsApiSelect] = useState(input.api_config !== undefined);
   const [useCustomBody, setUseCustomBody] = useState(!!input.api_config?.body_template?.trim());
@@ -392,6 +394,8 @@ const FormInputRow: FC<FormInputRowProps> = ({
               <span className="text-sm font-medium text-gray-300">Preview</span>
               <DiscordContent
                 content={input.content}
+                profile="textDisplay"
+                entities={previewEntities}
                 className="mt-2 text-sm bg-[#242429] rounded p-3"
               />
             </div>
diff --git a/frontend/src/components/PanelPreview.tsx b/frontend/src/components/PanelPreview.tsx
index a030b02a..125a1c66 100644
--- a/frontend/src/components/PanelPreview.tsx
+++ b/frontend/src/components/PanelPreview.tsx
@@ -7,6 +7,7 @@ import { BRANDING_FOOTER_ICON, BRANDING_FOOTER_TEXT } from "@/lib/constants";
 import { formatEmbedTimestampForDisplay } from "@/lib/embed-timestamp";
 import { isSafeUrl } from "@/lib/url";
 import { previewAvatarUrl } from "@/lib/embed-avatar";
+import { usePreviewEntities } from "@/hooks/usePreviewEntities";
 
 function resolveEmoteName(emote: Panel["emote"] | undefined): string {
   if (typeof emote === "string") return emote;
@@ -30,6 +31,7 @@ interface PanelPreviewProps {
 
 const PanelPreview: FC<PanelPreviewProps> = ({ type, data, brandingFooter }) => {
   const { panel, buttons } = data;
+  const entities = usePreviewEntities();
 
   if (type === "panel") {
     const p = panel as Panel;
@@ -43,9 +45,16 @@ const PanelPreview: FC<PanelPreviewProps> = ({ type, data, brandingFooter }) =>
         >
           <div className="flex">
             <div className="flex-1 min-w-0">
-              <DiscordContent content={p.title} className="text-base font-semibold text-white" />
+              <DiscordContent
+                content={p.title}
+                profile="embedTitle"
+                entities={entities}
+                className="text-base font-semibold text-white"
+              />
               <DiscordContent
                 content={p.content}
+                profile="embedDescription"
+                entities={entities}
                 className="text-sm mt-1 text-[#dbdee1] leading-snug"
               />
             </div>
@@ -149,6 +158,8 @@ const PanelPreview: FC<PanelPreviewProps> = ({ type, data, brandingFooter }) =>
   const authorIconUrl = resolveTicketAvatar(embedData?.author?.icon_url);
   const authorUrl = resolveTicketAvatar(embedData?.author?.url);
   const titleUrl = resolveTicketAvatar(embedData?.url);
+  // An embed with a url drops link rules from its title and field names.
+  const titleProfile = embedData?.url ? "embedTitleNoLinks" : "embedTitle";
 
   return (
     <>
@@ -187,18 +198,24 @@ const PanelPreview: FC<PanelPreviewProps> = ({ type, data, brandingFooter }) =>
                 <a href={titleUrl} target="_blank" rel="noopener noreferrer">
                   <DiscordContent
                     content={embedData.title}
+                    profile={titleProfile}
+                    entities={entities}
                     className="text-base font-semibold text-[#00a8fc] hover:underline"
                   />
                 </a>
               ) : (
                 <DiscordContent
                   content={embedData.title}
+                  profile={titleProfile}
+                  entities={entities}
                   className="text-base font-semibold text-white"
                 />
               ))}
             {embedData?.description && (
               <DiscordContent
                 content={embedData.description}
+                profile="embedDescription"
+                entities={entities}
                 className="text-sm mt-1 text-[#dbdee1] leading-snug"
               />
             )}
@@ -216,9 +233,16 @@ const PanelPreview: FC<PanelPreviewProps> = ({ type, data, brandingFooter }) =>
                       <div key={fi} className="min-w-0">
                         <DiscordContent
                           content={field.name}
+                          profile={titleProfile}
+                          entities={entities}
                           className="text-xs font-semibold text-white"
                         />
-                        <DiscordContent content={field.value} className="text-xs text-[#dbdee1]" />
+                        <DiscordContent
+                          content={field.value}
+                          profile="embedFieldValue"
+                          entities={entities}
+                          className="text-xs text-[#dbdee1]"
+                        />
                       </div>
                     ))}
                   </div>
diff --git a/frontend/src/components/discord/DiscordContent.tsx b/frontend/src/components/discord/DiscordContent.tsx
index 8d02bb65..0b7d3745 100644
--- a/frontend/src/components/discord/DiscordContent.tsx
+++ b/frontend/src/components/discord/DiscordContent.tsx
@@ -1,40 +1,117 @@
-import { useMemo, useState } from "react";
-import type { FC, ReactNode } from "react";
+import { createContext, useContext, useEffect, useMemo, useState } from "react";
+import type { CSSProperties, FC, ReactNode } from "react";
+import type { IconDefinition } from "@fortawesome/fontawesome-svg-core";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import {
+  faBullhorn,
+  faComments,
+  faHashtag,
+  faImage,
+  faMessage,
+  faTowerBroadcast,
+  faVolumeHigh,
+} from "@fortawesome/free-solid-svg-icons";
 import type { DiscordContentProps } from "./types";
-import type { MdMark, MdNode } from "@/lib/discord-markdown";
-import { parseDiscordMarkdown } from "@/lib/discord-markdown";
+import type { MdGuildNav, MdNode, MdProfile, MdTimestampStyle } from "@/lib/discord-markdown";
+import { isJumboEmoji, parseDiscordMarkdown } from "@/lib/discord-markdown";
+import { useDiscordEmoji } from "@/lib/discord-emoji";
 import { emojiUrl } from "@/lib/discord-cdn";
+import { parseAnsi } from "@/lib/discord-ansi";
+import {
+  formatDiscordTimestamp,
+  formatTimestampTooltip,
+  relativeRefreshMs,
+} from "@/lib/discord-time";
+import "./discord-markup.css";
 
 type Entities = DiscordContentProps["entities"];
 
 const MENTION_PILL =
   "bg-blue-600/20 text-blue-300 px-1 rounded hover:bg-blue-600/30 cursor-pointer";
+const CHANNEL_PILL =
+  "bg-gray-600/20 text-gray-300 px-1 rounded hover:bg-gray-600/30 cursor-pointer";
 
 const MARK_TAGS = {
   bold: "strong",
   italic: "em",
-  underline: "span",
-  strike: "span",
-} as const satisfies Record<Exclude<MdMark, "spoiler">, "strong" | "em" | "span">;
-
-const MARK_CLASSES = {
-  bold: "font-bold",
-  italic: "italic",
-  underline: "underline",
-  strike: "line-through",
-} as const satisfies Record<Exclude<MdMark, "spoiler">, string>;
-
-const HEADING_CLASSES = {
-  1: "text-2xl font-bold mt-2 mb-1",
-  2: "text-xl font-bold mt-2 mb-1",
-  3: "text-lg font-bold mt-2 mb-1",
-} as const satisfies Record<1 | 2 | 3, string>;
-
-const Spoiler: FC<{ children: ReactNode }> = ({ children }) => {
+  underline: "u",
+  strike: "s",
+} as const;
+
+const EMBED_PROFILES = new Set<MdProfile>([
+  "embedDescription",
+  "embedFieldValue",
+  "embedTitle",
+  "embedTitleNoLinks",
+]);
+
+const NAV_LABELS: Record<MdGuildNav, string> = {
+  home: "Server Guide",
+  guide: "Server Guide",
+  browse: "Browse Channels",
+  customize: "Channels & Roles",
+  "linked-roles": "Linked Roles",
+};
+
+const UNMENTIONABLE_CHANNEL_TYPES = new Set([4, 14]);
+
+const CHANNEL_ICONS: Record<number, IconDefinition> = {
+  2: faVolumeHigh,
+  5: faBullhorn,
+  10: faMessage,
+  11: faMessage,
+  12: faMessage,
+  13: faTowerBroadcast,
+  15: faComments,
+  16: faImage,
+};
+
+const TEXT_EMOJI = new Set([
+  "\u00a9",
+  "\u00a9\ufe0f",
+  "\u00ae",
+  "\u00ae\ufe0f",
+  "\u2122",
+  "\u2122\ufe0f",
+]);
+
+const LINK_PROTOCOLS = new Set(["http:", "https:", "mailto:", "tel:", "sms:"]);
+
+function linkHref(url: string): string | undefined {
+  try {
+    return LINK_PROTOCOLS.has(new URL(url).protocol) ? url : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const LinksAllowed = createContext(true);
+
+const BLOCK_NODES = new Set<MdNode["type"]>([
+  "codeBlock",
+  "quote",
+  "list",
+  "heading",
+  "subtext",
+  "paragraph",
+]);
+
+const containsBlock = (nodes: MdNode[]): boolean =>
+  nodes.some(
+    (node) => BLOCK_NODES.has(node.type) || ("children" in node && containsBlock(node.children)),
+  );
+
+const Spoiler: FC<{ block: boolean; children: ReactNode }> = ({ block, children }) => {
   const [revealed, setRevealed] = useState(false);
+  const display = block ? "block" : "";
 
   if (revealed) {
-    return <span className="bg-gray-700/40 rounded px-0.5">{children}</span>;
+    // Still focusable, so revealing with the keyboard doesn't drop focus to <body>.
+    return (
+      <span tabIndex={-1} className={`bg-gray-700/40 rounded px-0.5 ${display}`}>
+        {children}
+      </span>
+    );
   }
 
   return (
@@ -42,8 +119,13 @@ const Spoiler: FC<{ children: ReactNode }> = ({ children }) => {
       role="button"
       tabIndex={0}
       aria-label="Reveal spoiler"
-      className="bg-gray-700 text-transparent rounded px-0.5 cursor-pointer select-none"
-      onClick={() => setRevealed(true)}
+      className={`bg-gray-700 rounded px-0.5 cursor-pointer select-none ${display}`}
+      onClick={(event) => {
+        // A spoiler inside a masked link reveals without opening the link.
+        event.preventDefault();
+        event.stopPropagation();
+        setRevealed(true);
+      }}
       onKeyDown={(event) => {
         if (event.key === "Enter" || event.key === " ") {
           event.preventDefault();
@@ -51,11 +133,48 @@ const Spoiler: FC<{ children: ReactNode }> = ({ children }) => {
         }
       }}
     >
-      {children}
+      <span className="invisible">{children}</span>
     </span>
   );
 };
 
+const Timestamp: FC<{ unix: number; style: MdTimestampStyle }> = ({ unix, style }) => {
+  const [now, setNow] = useState(() => new Date());
+
+  useEffect(() => {
+    if (style !== "R") return;
+    const interval = setInterval(
+      () => setNow(new Date()),
+      relativeRefreshMs(new Date(unix * 1000), new Date()),
+    );
+    return () => clearInterval(interval);
+  }, [unix, style]);
+
+  return (
+    <span className="dm-timestamp" title={formatTimestampTooltip(unix)}>
+      {formatDiscordTimestamp(unix, style, now)}
+    </span>
+  );
+};
+
+const AnsiCode: FC<{ code: string }> = ({ code }) => (
+  <>
+    {parseAnsi(code).map((span, index) => (
+      <span
+        key={index}
+        style={{
+          color: span.color,
+          backgroundColor: span.background,
+          fontWeight: span.bold ? 700 : undefined,
+          textDecoration: span.underline ? "underline" : undefined,
+        }}
+      >
+        {span.text}
+      </span>
+    ))}
+  </>
+);
+
 function MdNodes({ nodes, entities }: { nodes: MdNode[]; entities: Entities }) {
   return (
     <>
@@ -66,74 +185,161 @@ function MdNodes({ nodes, entities }: { nodes: MdNode[]; entities: Entities }) {
   );
 }
 
+// An empty map means the page never loaded that data, not that nothing exists.
+function hasEntries(record: Record<string, unknown> | undefined): boolean {
+  return record !== undefined && Object.keys(record).length > 0;
+}
+
+function ChannelPill({
+  id,
+  messageId,
+  url,
+  entities,
+}: {
+  id: string;
+  messageId?: string;
+  url?: string;
+  entities: Entities;
+}) {
+  const linksAllowed = useContext(LinksAllowed);
+  const channel = entities?.channels[id];
+  if (!channel) {
+    if (url && linksAllowed) {
+      return (
+        <a href={linkHref(url)} target="_blank" rel="noopener noreferrer">
+          {url}
+        </a>
+      );
+    }
+    if (!hasEntries(entities?.channels)) return <span className={CHANNEL_PILL}>#channel</span>;
+  }
+  if (channel && UNMENTIONABLE_CHANNEL_TYPES.has(channel.type)) return <>#{channel.name}</>;
+
+  return (
+    <span className={CHANNEL_PILL}>
+      <FontAwesomeIcon
+        icon={(channel && CHANNEL_ICONS[channel.type]) ?? faHashtag}
+        className="mr-0.5 text-[0.8em]"
+      />
+      {channel ? channel.name : <em>unknown</em>}
+      {messageId && (
+        <>
+          {" › "}
+          <FontAwesomeIcon icon={faMessage} className="text-[0.8em]" />
+        </>
+      )}
+    </span>
+  );
+}
+
+function MdLink({
+  url,
+  title,
+  nodes,
+  entities,
+}: {
+  url: string;
+  title?: string;
+  nodes: MdNode[];
+  entities: Entities;
+}) {
+  const linksAllowed = useContext(LinksAllowed);
+  const children = <MdNodes nodes={nodes} entities={entities} />;
+  if (!linksAllowed) return children;
+  return (
+    <a href={linkHref(url)} title={title} target="_blank" rel="noopener noreferrer">
+      {children}
+    </a>
+  );
+}
+
 function MdNodeView({ node, entities }: { node: MdNode; entities: Entities }) {
   switch (node.type) {
     case "text":
       return <>{node.value}</>;
 
+    case "br":
+      return <br />;
+
     case "code":
-      return (
-        <code className="bg-gray-800 text-gray-200 px-1.5 py-0.5 rounded text-sm font-mono">
-          {node.code}
-        </code>
-      );
+      return <code className="dm-inline-code">{node.code}</code>;
 
     case "codeBlock":
       return (
-        <pre className="bg-gray-900 border border-gray-700 rounded p-3 mt-1 mb-1 overflow-x-auto">
-          <code className="text-sm font-mono text-gray-200">{node.code}</code>
+        <pre>
+          <code>
+            {node.lang?.toLowerCase() === "ansi" ? <AnsiCode code={node.code} /> : node.code}
+          </code>
         </pre>
       );
 
     case "mark": {
       if (node.mark === "spoiler") {
         return (
-          <Spoiler>
+          <Spoiler block={containsBlock(node.children)}>
             <MdNodes nodes={node.children} entities={entities} />
           </Spoiler>
         );
       }
       const Tag = MARK_TAGS[node.mark];
       return (
-        <Tag className={MARK_CLASSES[node.mark]}>
+        <Tag>
           <MdNodes nodes={node.children} entities={entities} />
         </Tag>
       );
     }
 
-    case "heading":
+    case "heading": {
+      const Tag = `h${node.level}` as const;
       return (
-        <div className={HEADING_CLASSES[node.level]}>
+        <Tag>
           <MdNodes nodes={node.children} entities={entities} />
-        </div>
+        </Tag>
       );
+    }
 
     case "subtext":
       return (
-        <div className="text-xs text-gray-400">
+        <small>
           <MdNodes nodes={node.children} entities={entities} />
-        </div>
+        </small>
       );
 
     case "quote":
       return (
-        <div className="border-l-4 border-gray-600 pl-3 my-1">
-          <MdNodes nodes={node.children} entities={entities} />
+        <div className="dm-quote">
+          <div className="dm-quote-divider" />
+          <blockquote>
+            <MdNodes nodes={node.children} entities={entities} />
+          </blockquote>
         </div>
       );
 
-    case "link":
+    case "paragraph":
       return (
-        <a
-          href={node.url}
-          target="_blank"
-          rel="noopener noreferrer"
-          className="text-blue-400 underline hover:text-blue-300"
-        >
+        <p>
           <MdNodes nodes={node.children} entities={entities} />
-        </a>
+        </p>
       );
 
+    case "list": {
+      const items = node.items.map((item, index) => (
+        <li key={index}>
+          <MdNodes nodes={item} entities={entities} />
+        </li>
+      ));
+      if (!node.ordered) return <ul>{items}</ul>;
+      const digits = String(node.start + node.items.length - 1).length;
+      return (
+        <ol start={node.start} style={{ "--dm-ol-digits": digits } as CSSProperties}>
+          {items}
+        </ol>
+      );
+    }
+
+    case "link":
+      return <MdLink url={node.url} title={node.title} nodes={node.children} entities={entities} />;
+
     case "userMention": {
       const user = entities?.users[node.id];
       return <span className={MENTION_PILL}>{user ? `@${user.username}` : `<@${node.id}>`}</span>;
@@ -141,64 +347,104 @@ function MdNodeView({ node, entities }: { node: MdNode; entities: Entities }) {
 
     case "roleMention": {
       const role = entities?.roles[node.id];
-      const colorHex = role?.color ? `#${role.color.toString(16).padStart(6, "0")}` : null;
+      if (!role) {
+        return hasEntries(entities?.roles) ? (
+          <>@unknown-role</>
+        ) : (
+          <span className="px-1 rounded cursor-pointer font-medium text-[#b9bbbe] bg-[rgba(185,187,190,0.1)]">
+            {`<@&${node.id}>`}
+          </span>
+        );
+      }
+      if (!role.color) return <span className={MENTION_PILL}>@{role.name}</span>;
+      const colorHex = `#${role.color.toString(16).padStart(6, "0")}`;
       return (
         <span
           className="px-1 rounded cursor-pointer font-medium"
-          style={
-            colorHex
-              ? { color: colorHex, backgroundColor: `${colorHex}26` }
-              : { color: "#b9bbbe", backgroundColor: "rgba(185,187,190,0.1)" }
-          }
+          style={{ color: colorHex, backgroundColor: `${colorHex}26` }}
         >
-          {role ? `@${role.name}` : `<@&${node.id}>`}
+          @{role.name}
         </span>
       );
     }
 
     case "channelMention":
       return (
-        <span className="bg-gray-600/20 text-gray-300 px-1 rounded hover:bg-gray-600/30 cursor-pointer">
-          #{entities?.channels[node.id]?.name || "channel"}
-        </span>
+        <ChannelPill id={node.id} messageId={node.messageId} url={node.url} entities={entities} />
       );
 
     case "globalMention":
       return <span className={MENTION_PILL}>@{node.name}</span>;
 
+    case "commandMention":
+      return <span className={MENTION_PILL}>/{node.name}</span>;
+
+    case "guildNav":
+      return <span className={CHANNEL_PILL}>{NAV_LABELS[node.nav]}</span>;
+
     case "emoji":
       return (
         <img
           src={emojiUrl(node.id, node.animated)}
           alt={`:${node.name}:`}
           title={`:${node.name}:`}
-          className="inline-block w-5 h-5 align-[-0.25em]"
+          className="dm-emoji"
+          draggable={false}
         />
       );
 
-    // Every style renders as an absolute date for now; `style` is kept on the
-    // node so the relative format can be added without touching the parser.
-    case "timestamp":
+    case "unicodeEmoji": {
+      if (TEXT_EMOJI.has(node.surrogate)) return <>{node.surrogate}</>;
+      const label = `:${node.name}:`;
       return (
-        <span className="bg-gray-600/30 rounded px-1">
-          {new Date(node.unix * 1000).toLocaleString()}
+        <span className="dm-emoji-glyph" role="img" aria-label={label} title={label}>
+          {node.surrogate}
         </span>
       );
+    }
+
+    case "timestamp":
+      // Keyed so an edited timestamp starts from a fresh clock.
+      return <Timestamp key={`${node.unix}:${node.style}`} unix={node.unix} style={node.style} />;
   }
 }
 
-const DiscordContent: FC<DiscordContentProps> = ({ content, entities, className = "" }) => {
-  const nodes = useMemo(() => parseDiscordMarkdown(content), [content]);
+const DiscordContent: FC<DiscordContentProps> = ({
+  content,
+  entities,
+  profile = "content",
+  legacy = false,
+  webhook = false,
+  className = "",
+}) => {
+  const emoji = useDiscordEmoji();
+  const embed = EMBED_PROFILES.has(profile);
+  const source = embed ? content.trim() : content;
+  const nodes = useMemo((): MdNode[] => {
+    try {
+      return parseDiscordMarkdown(source, profile, { emoji, legacy, webhook });
+    } catch (error) {
+      console.error("Failed to parse Discord markdown", error);
+      return [{ type: "text", value: source }];
+    }
+  }, [source, profile, emoji, legacy, webhook]);
 
-  if (!content.trim()) {
+  if (!source.trim()) {
     return null;
   }
 
+  const classes = [
+    "discord-markup text-gray-200 leading-[1.375]",
+    embed && "discord-markup--embed",
+    profile === "content" && isJumboEmoji(nodes) && "discord-markup--jumbo",
+    className,
+  ];
+
   return (
-    <div
-      className={`text-gray-200 leading-relaxed whitespace-pre-wrap wrap-break-word ${className}`}
-    >
-      <MdNodes nodes={nodes} entities={entities} />
+    <div className={classes.filter(Boolean).join(" ")}>
+      <LinksAllowed.Provider value={profile !== "embedTitleNoLinks"}>
+        <MdNodes nodes={nodes} entities={entities} />
+      </LinksAllowed.Provider>
     </div>
   );
 };
diff --git a/frontend/src/components/discord/DiscordEmbed.tsx b/frontend/src/components/discord/DiscordEmbed.tsx
index 86979495..5fe7f34d 100644
--- a/frontend/src/components/discord/DiscordEmbed.tsx
+++ b/frontend/src/components/discord/DiscordEmbed.tsx
@@ -4,7 +4,14 @@ import type { DiscordEmbedProps } from "./types";
 import { isSafeUrl } from "@/lib/url";
 import DiscordContent from "./DiscordContent";
 
-const DiscordEmbedComponent: FC<DiscordEmbedProps> = ({ embed, entities, className = "" }) => {
+const DiscordEmbedComponent: FC<DiscordEmbedProps> = ({
+  embed,
+  entities,
+  legacy = false,
+  className = "",
+}) => {
+  // An embed with a url drops link rules from its title and field names.
+  const titleProfile = embed.url ? "embedTitleNoLinks" : "embedTitle";
   const formatTimestamp = (timestamp: string): string => {
     return new Date(timestamp).toLocaleDateString([], {
       year: "numeric",
@@ -51,6 +58,7 @@ const DiscordEmbedComponent: FC<DiscordEmbedProps> = ({ embed, entities, classNa
               <DiscordContent
                 content={embed.title}
                 entities={entities}
+                profile={titleProfile}
                 className="text-blue-400! hover:underline font-semibold text-lg"
               />
             </a>
@@ -58,6 +66,7 @@ const DiscordEmbedComponent: FC<DiscordEmbedProps> = ({ embed, entities, classNa
             <DiscordContent
               content={embed.title}
               entities={entities}
+              profile={titleProfile}
               className="text-white font-semibold text-lg"
             />
           )}
@@ -68,6 +77,8 @@ const DiscordEmbedComponent: FC<DiscordEmbedProps> = ({ embed, entities, classNa
         <DiscordContent
           content={embed.description}
           entities={entities}
+          profile="embedDescription"
+          legacy={legacy}
           className="text-gray-300 text-sm mb-3"
         />
       )}
@@ -82,11 +93,14 @@ const DiscordEmbedComponent: FC<DiscordEmbedProps> = ({ embed, entities, classNa
               <DiscordContent
                 content={field.name}
                 entities={entities}
+                profile={titleProfile}
                 className="text-white font-semibold text-sm mb-1"
               />
               <DiscordContent
                 content={field.value}
                 entities={entities}
+                profile="embedFieldValue"
+                legacy={legacy}
                 className="text-gray-300 text-sm"
               />
             </div>
diff --git a/frontend/src/components/discord/DiscordMessage.tsx b/frontend/src/components/discord/DiscordMessage.tsx
index db44f1c8..a6dfcc6d 100644
--- a/frontend/src/components/discord/DiscordMessage.tsx
+++ b/frontend/src/components/discord/DiscordMessage.tsx
@@ -5,6 +5,7 @@ import DiscordAuthor from "./DiscordAuthor";
 import DiscordContent from "./DiscordContent";
 import DiscordEmbed from "./DiscordEmbed";
 import DiscordComponents from "./DiscordComponents";
+import { isLegacyMarkdown } from "@/lib/discord-markdown";
 
 const DiscordMessageComponent: FC<DiscordMessageProps> = ({
   message,
@@ -17,6 +18,7 @@ const DiscordMessageComponent: FC<DiscordMessageProps> = ({
   const hasEmbeds = message.embeds && message.embeds.length > 0;
   const hasComponents = message.components && message.components.length > 0;
   const hasAttachments = message.attachments && message.attachments.length > 0;
+  const legacy = isLegacyMarkdown(message.timestamp);
 
   const resolvedUser = entities?.users[message.author] ?? {
     id: message.author,
@@ -46,11 +48,16 @@ const DiscordMessageComponent: FC<DiscordMessageProps> = ({
             compact={true}
           />
           {hasContent && (
-            <DiscordContent entities={entities} content={message.content} className="mt-1" />
+            <DiscordContent
+              entities={entities}
+              content={message.content}
+              legacy={legacy}
+              className="mt-1"
+            />
           )}
           {hasEmbeds &&
             message.embeds.map((embed, index) => (
-              <DiscordEmbed key={index} embed={embed} entities={entities} />
+              <DiscordEmbed key={index} embed={embed} entities={entities} legacy={legacy} />
             ))}
           {hasComponents && (
             <DiscordComponents entities={entities} components={message.components || []} />
@@ -98,10 +105,12 @@ const DiscordMessageComponent: FC<DiscordMessageProps> = ({
         compact={false}
       />
       <div className="ml-14 -mt-4">
-        {hasContent && <DiscordContent entities={entities} content={message.content} />}
+        {hasContent && (
+          <DiscordContent entities={entities} content={message.content} legacy={legacy} />
+        )}
         {hasEmbeds &&
           message.embeds.map((embed, index) => (
-            <DiscordEmbed key={index} embed={embed} entities={entities} />
+            <DiscordEmbed key={index} embed={embed} entities={entities} legacy={legacy} />
           ))}
         {hasComponents && (
           <DiscordComponents entities={entities} components={message.components || []} />
diff --git a/frontend/src/components/discord/DiscordText.tsx b/frontend/src/components/discord/DiscordText.tsx
index 2357d495..de5efd34 100644
--- a/frontend/src/components/discord/DiscordText.tsx
+++ b/frontend/src/components/discord/DiscordText.tsx
@@ -1,15 +1,34 @@
 import type { FC } from "react";
 import DiscordContent from "./DiscordContent";
+import type { DiscordContentProps } from "./types";
 
 interface DiscordTextProps {
   content: string;
   raw?: boolean;
+  profile?: DiscordContentProps["profile"];
+  entities?: DiscordContentProps["entities"];
+  webhook?: boolean;
   className?: string;
 }
 
-const DiscordText: FC<DiscordTextProps> = ({ content, raw = false, className = "" }) => {
+const DiscordText: FC<DiscordTextProps> = ({
+  content,
+  raw = false,
+  profile,
+  entities,
+  webhook,
+  className = "",
+}) => {
   if (!raw) {
-    return <DiscordContent content={content} className={className} />;
+    return (
+      <DiscordContent
+        content={content}
+        profile={profile}
+        entities={entities}
+        webhook={webhook}
+        className={className}
+      />
+    );
   }
 
   if (!content.trim()) {
diff --git a/frontend/src/components/discord/container/Container.tsx b/frontend/src/components/discord/container/Container.tsx
index 49d371ae..0b430941 100644
--- a/frontend/src/components/discord/container/Container.tsx
+++ b/frontend/src/components/discord/container/Container.tsx
@@ -103,6 +103,7 @@ export default function Container({ component = {}, entities }: ContainerProps)
                   key={index}
                   content={subcomponent.content || ""}
                   entities={entities}
+                  profile="textDisplay"
                 />
               );
             } else if (subcomponent.type === 12) {
diff --git a/frontend/src/components/discord/container/Section.tsx b/frontend/src/components/discord/container/Section.tsx
index 63c68e60..15927354 100644
--- a/frontend/src/components/discord/container/Section.tsx
+++ b/frontend/src/components/discord/container/Section.tsx
@@ -33,6 +33,7 @@ export default function Section({ textComponents = [], accessory = null, entitie
             key={index}
             content={textComp.content}
             entities={entities}
+            profile="textDisplay"
             className="text-[15px]"
           />
         ))}
diff --git a/frontend/src/components/discord/discord-markup.css b/frontend/src/components/discord/discord-markup.css
new file mode 100644
index 00000000..554951ea
--- /dev/null
+++ b/frontend/src/components/discord/discord-markup.css
@@ -0,0 +1,195 @@
+/* Unlayered on purpose: inside a layer, App.css's unlayered rules would win. */
+
+.discord-markup {
+  --dm-text-strong: #f2f3f5;
+  --dm-text-subtle: #949ba4;
+  --dm-spine: #4e5058;
+  --dm-code-bg: #2b2d31;
+  --dm-code-border: #3f4147;
+  --dm-code-text: #dbdee1;
+  --dm-timestamp-bg: rgba(78, 80, 88, 0.3);
+  --dm-link: #00a8fc;
+  white-space: break-spaces;
+  overflow-wrap: break-word;
+}
+
+.discord-markup h1,
+.discord-markup h2,
+.discord-markup h3 {
+  color: var(--dm-text-strong);
+  font-weight: 700;
+  line-height: 1.375em;
+  margin: 16px 0 8px;
+}
+.discord-markup h1 {
+  font-size: 1.5rem;
+}
+.discord-markup h2 {
+  font-size: 1.25rem;
+}
+.discord-markup h3 {
+  font-size: 1rem;
+}
+.discord-markup h1:first-child,
+.discord-markup h2:first-child {
+  margin-top: 8px;
+}
+.discord-markup h3:first-child {
+  margin-top: 4px;
+}
+
+.discord-markup small {
+  color: var(--dm-text-subtle);
+  display: block;
+  font-size: 0.875em;
+  line-height: 1.375;
+}
+
+.discord-markup strong {
+  font-weight: 700;
+}
+
+.discord-markup ul,
+.discord-markup ol {
+  list-style-position: outside;
+  margin: 4px 0 0 16px;
+  padding: 0;
+}
+.discord-markup ul {
+  list-style-type: disc;
+}
+.discord-markup ol {
+  list-style-type: decimal;
+  margin-inline-start: calc(0.4em + var(--dm-ol-digits, 1) * 0.6em);
+}
+.discord-markup ol ul,
+.discord-markup ul ul {
+  list-style-type: circle;
+  margin-bottom: 0;
+}
+.discord-markup ol ol,
+.discord-markup ul ol {
+  margin-bottom: 0;
+}
+.discord-markup li {
+  margin-bottom: 4px;
+  white-space: break-spaces;
+}
+
+.discord-markup .dm-quote {
+  display: flex;
+  margin: 4px 0;
+}
+.discord-markup .dm-quote-divider {
+  background: var(--dm-spine);
+  border-radius: 4px;
+  flex-shrink: 0;
+  width: 4px;
+}
+.discord-markup blockquote {
+  box-sizing: border-box;
+  color: var(--dm-text-subtle);
+  margin: 0;
+  max-width: 90%;
+  padding: 0 8px 0 12px;
+}
+
+.discord-markup pre {
+  border-radius: 4px;
+  box-sizing: border-box;
+  font-size: 0.75rem;
+  line-height: 1rem;
+  margin: 6px 0 0;
+  max-width: 90%;
+  padding: 0;
+  white-space: pre-wrap;
+}
+.discord-markup blockquote pre {
+  max-width: 100%;
+}
+/* Overrides the app-wide pink `code` colour in App.css. */
+.discord-markup code {
+  background: var(--dm-code-bg);
+  border: 1px solid var(--dm-code-border);
+  color: inherit;
+  font-family: ui-monospace, SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace;
+  font-size: 0.875rem;
+  line-height: 1.125rem;
+  white-space: pre-wrap;
+}
+.discord-markup pre code {
+  border-radius: 4px;
+  color: var(--dm-code-text);
+  display: block;
+  padding: 0.5em;
+}
+.discord-markup code.dm-inline-code {
+  border-radius: 4px;
+  font-size: 85%;
+  margin: -0.2em 0;
+  padding: 0 0.2em;
+}
+
+.discord-markup img.dm-emoji {
+  display: inline-block;
+  height: 1.375em;
+  max-width: none;
+  object-fit: contain;
+  vertical-align: bottom;
+  width: 1.375em;
+}
+.discord-markup .dm-emoji-glyph {
+  font-size: 1.375em;
+  line-height: 1;
+  vertical-align: bottom;
+}
+
+.discord-markup .dm-timestamp {
+  background: var(--dm-timestamp-bg);
+  border-radius: 3px;
+  padding: 0 2px;
+}
+
+.discord-markup a {
+  color: var(--dm-link);
+  text-decoration: none;
+}
+.discord-markup a:hover {
+  text-decoration: underline;
+}
+.discord-markup--underline-links a {
+  text-decoration: underline;
+}
+
+.discord-markup--embed img.dm-emoji {
+  height: 18px;
+  width: 18px;
+}
+.discord-markup--embed .dm-emoji-glyph {
+  font-size: 18px;
+}
+.discord-markup--embed :is(h1, h2, h3) img.dm-emoji {
+  height: 1.375em;
+  width: 1.375em;
+}
+.discord-markup--embed :is(h1, h2, h3) .dm-emoji-glyph {
+  font-size: 1.375em;
+}
+.discord-markup--embed pre,
+.discord-markup--embed blockquote {
+  max-width: 100%;
+}
+.discord-markup--embed pre code {
+  border: none;
+}
+.discord-markup--embed small {
+  font-size: 1em;
+}
+
+.discord-markup--jumbo img.dm-emoji {
+  height: 3rem;
+  width: 3rem;
+}
+.discord-markup--jumbo .dm-emoji-glyph {
+  font-size: 3rem;
+}
diff --git a/frontend/src/components/discord/types.ts b/frontend/src/components/discord/types.ts
index d07a33d4..d8fa431b 100644
--- a/frontend/src/components/discord/types.ts
+++ b/frontend/src/components/discord/types.ts
@@ -1,5 +1,6 @@
 import type { GuildChannel, GuildRole, Message, User } from "@/types";
 import type { APIEmbed, ButtonStyle } from "discord-api-types/v10";
+import type { MdProfile } from "@/lib/discord-markdown";
 
 export interface DiscordMessageProps {
   message: Message;
@@ -27,6 +28,7 @@ export interface DiscordEmbedProps {
     channels: Record<string, GuildChannel>;
     roles: Record<string, GuildRole>;
   };
+  legacy?: boolean;
   className?: string;
 }
 
@@ -37,6 +39,9 @@ export interface DiscordContentProps {
     channels: Record<string, GuildChannel>;
     roles: Record<string, GuildRole>;
   };
+  profile?: MdProfile;
+  legacy?: boolean;
+  webhook?: boolean;
   className?: string;
 }
 
diff --git a/frontend/src/components/gallery/GalleryListingPreview.tsx b/frontend/src/components/gallery/GalleryListingPreview.tsx
index 4b5493c5..38beed44 100644
--- a/frontend/src/components/gallery/GalleryListingPreview.tsx
+++ b/frontend/src/components/gallery/GalleryListingPreview.tsx
@@ -1,6 +1,8 @@
 import type { FC, ReactNode } from "react";
 import DiscordText from "@/components/discord/DiscordText";
 import { parseDiscordMarkdown } from "@/lib/discord-markdown";
+import type { MdProfile } from "@/lib/discord-markdown";
+import type { DiscordEmojiTable } from "@/lib/discord-emoji";
 import EmbedPreview from "@/components/EmbedPreview";
 import DiscordButton from "@/components/discord/container/Button";
 import type {
@@ -47,54 +49,75 @@ export const GALLERY_TYPE_OPTIONS = Object.entries(GALLERY_TYPE_BADGES).map(([ke
   color: badge.dot,
 }));
 
-// Anything the parser leaves as plain text renders identically either way.
-function hasMarkdown(content: string | undefined): boolean {
+type MarkdownField = [content: string | undefined, profile: MdProfile, webhook?: boolean];
+
+// Only output differing from the source counts: a typed emoji is plain text, a :shortcode: isn't.
+function hasMarkdown(
+  [content, profile, webhook]: MarkdownField,
+  emoji: DiscordEmojiTable | null,
+): boolean {
   if (!content) return false;
 
   const source = content.replace(/\r\n?/g, "\n");
   let plain = "";
-  for (const node of parseDiscordMarkdown(source)) {
-    if (node.type !== "text") return true;
-    plain += node.value;
+  for (const node of parseDiscordMarkdown(source, profile, { emoji, webhook })) {
+    if (node.type === "text") plain += node.value;
+    else if (node.type === "unicodeEmoji") plain += node.surrogate;
+    else return true;
   }
   return plain !== source;
 }
 
+function embedFields(
+  embed:
+    | {
+        title?: string;
+        description?: string;
+        url?: string;
+        fields?: { name: string; value: string }[];
+      }
+    | undefined,
+): MarkdownField[] {
+  const titleProfile: MdProfile = embed?.url ? "embedTitleNoLinks" : "embedTitle";
+  return [
+    [embed?.title, titleProfile],
+    [embed?.description, "embedDescription"],
+    ...(embed?.fields ?? []).flatMap((field): MarkdownField[] => [
+      [field.name, titleProfile],
+      [field.value, "embedFieldValue"],
+    ]),
+  ];
+}
+
 // Only the text EmbedPreview, TagListingPreview and form Text Display fields pass through
 // DiscordText. Form labels and placeholders are not markdown surfaces in Discord.
-function markdownFields(listing: GalleryListing): (string | undefined)[] {
+function markdownFields(listing: GalleryListing): MarkdownField[] {
   const listingType = listing.listing_type || "panel";
 
   if (listingType === "form") {
     const snapshot = listing.snapshot_data as GalleryFormSnapshot | undefined;
     return (snapshot?.inputs ?? [])
       .filter((input) => input.type === 10)
-      .map((input) => input.content);
+      .map((input): MarkdownField => [input.content, "textDisplay"]);
   }
 
   if (listingType === "tag") {
     const snapshot = listing.snapshot_data as GalleryTagSnapshot | undefined;
-    const embed = snapshot?.embed;
-    return [
-      snapshot?.content,
-      embed?.title,
-      embed?.description,
-      ...(embed?.fields ?? []).flatMap((field) => [field.name, field.value]),
-    ];
+    return [[snapshot?.content, "content", true], ...embedFields(snapshot?.embed)];
   }
 
-  const welcomeMessage = listing.welcome_message;
   return [
-    listing.title,
-    listing.content,
-    welcomeMessage?.title,
-    welcomeMessage?.description,
-    ...(welcomeMessage?.fields ?? []).flatMap((field) => [field.name, field.value]),
+    [listing.title, "embedTitle"],
+    [listing.content, "embedDescription"],
+    ...embedFields(listing.welcome_message),
   ];
 }
 
-export function listingHasMarkdown(listing: GalleryListing): boolean {
-  return markdownFields(listing).some(hasMarkdown);
+export function listingHasMarkdown(
+  listing: GalleryListing,
+  emoji: DiscordEmojiTable | null,
+): boolean {
+  return markdownFields(listing).some((field) => hasMarkdown(field, emoji));
 }
 
 const PreviewSection: FC<{ title: string; children: ReactNode }> = ({ title, children }) => (
@@ -161,6 +184,7 @@ const TagListingPreview: FC<{ listing: GalleryListing; raw: boolean }> = ({ list
         <DiscordText
           raw={raw}
           content={snapshot.content}
+          webhook
           className="text-gray-300 text-sm mb-4 bg-gray-900 rounded p-3"
         />
       )}
@@ -195,7 +219,12 @@ const FormInputPreviewRow: FC<{ input: GalleryFormInputSnapshot; raw: boolean }>
         </div>
       </div>
       {isTextDisplay && input.content && (
-        <DiscordText raw={raw} content={input.content} className="text-gray-300 text-sm" />
+        <DiscordText
+          raw={raw}
+          content={input.content}
+          profile="textDisplay"
+          className="text-gray-300 text-sm"
+        />
       )}
       {input.description && <p className="text-gray-400 text-xs mt-1">{input.description}</p>}
       {input.placeholder && (
diff --git a/frontend/src/components/modals/GalleryPreviewModal.tsx b/frontend/src/components/modals/GalleryPreviewModal.tsx
index 0a0034c2..8f5f4994 100644
--- a/frontend/src/components/modals/GalleryPreviewModal.tsx
+++ b/frontend/src/components/modals/GalleryPreviewModal.tsx
@@ -6,6 +6,7 @@ import GalleryListingPreview, {
   listingHasMarkdown,
 } from "@/components/gallery/GalleryListingPreview";
 import { userAvatarUrl } from "@/lib/discord-cdn";
+import { useDiscordEmoji } from "@/lib/discord-emoji";
 import type { GallerySubmission } from "@/types";
 
 type PreviewView = "rendered" | "raw";
@@ -20,7 +21,9 @@ const PreviewBody: FC<{
   view: PreviewView;
   onViewChange: (view: PreviewView) => void;
 }> = ({ listing, view, onViewChange }) => {
-  if (!listingHasMarkdown(listing)) {
+  const emoji = useDiscordEmoji();
+
+  if (!listingHasMarkdown(listing, emoji)) {
     return (
       <div className="space-y-6">
         <GalleryListingPreview listing={listing} />
diff --git a/frontend/src/components/modals/TagEditorModal.tsx b/frontend/src/components/modals/TagEditorModal.tsx
index 9ccc0d11..14913558 100644
--- a/frontend/src/components/modals/TagEditorModal.tsx
+++ b/frontend/src/components/modals/TagEditorModal.tsx
@@ -12,6 +12,7 @@ import EmbedPreview from "@/components/EmbedPreview";
 import DiscordContent from "@/components/discord/DiscordContent";
 import DateTimePicker from "@/components/DateTimePicker";
 import { useKBArticles } from "@/hooks/queries/useKB";
+import { usePreviewEntities } from "@/hooks/usePreviewEntities";
 import { parseEmbedTimestamp, serializeEmbedTimestamp } from "@/lib/embed-timestamp";
 import { embedUrlError } from "@/lib/embed-url";
 import type { Tag, TagEmbed } from "@/types";
@@ -52,6 +53,7 @@ const TagEditorModal: FC<TagEditorModalProps> = ({
   onSave,
   onClose,
 }) => {
+  const previewEntities = usePreviewEntities();
   const [id, setId] = useState("");
   const [useGuildCommand, setUseGuildCommand] = useState(false);
   const [content, setContent] = useState("");
@@ -433,6 +435,8 @@ const TagEditorModal: FC<TagEditorModalProps> = ({
                 {hasArticlePreview && (
                   <DiscordContent
                     content={linkedArticle.content ?? ""}
+                    entities={previewEntities}
+                    webhook
                     className="text-sm bg-[#242429] rounded p-3"
                   />
                 )}
@@ -447,6 +451,8 @@ const TagEditorModal: FC<TagEditorModalProps> = ({
                 {hasContentPreview && (
                   <DiscordContent
                     content={content}
+                    entities={previewEntities}
+                    webhook
                     className="mt-4 text-sm bg-[#242429] rounded p-3"
                   />
                 )}
diff --git a/frontend/src/hooks/usePreviewEntities.ts b/frontend/src/hooks/usePreviewEntities.ts
new file mode 100644
index 00000000..8ee24f07
--- /dev/null
+++ b/frontend/src/hooks/usePreviewEntities.ts
@@ -0,0 +1,20 @@
+import { useContext, useMemo } from "react";
+import { GuildContext } from "@/state/context";
+import type { DiscordContentProps } from "@/components/discord/types";
+
+export function usePreviewEntities(): DiscordContentProps["entities"] {
+  const guild = useContext(GuildContext);
+  const channels = guild?.channels;
+  const roles = guild?.roles;
+
+  return useMemo(() => {
+    if (!channels && !roles) return undefined;
+    return {
+      users: {},
+      channels: Object.fromEntries(
+        (channels ?? []).map((channel) => [String(channel.id), channel]),
+      ),
+      roles: Object.fromEntries((roles ?? []).map((role) => [String(role.id), role])),
+    };
+  }, [channels, roles]);
+}
diff --git a/frontend/src/lib/discord-ansi.ts b/frontend/src/lib/discord-ansi.ts
new file mode 100644
index 00000000..03623306
--- /dev/null
+++ b/frontend/src/lib/discord-ansi.ts
@@ -0,0 +1,43 @@
+const PALETTE = [
+  "hsl(0 0% 0%)",
+  "hsl(0.863 78.531% 65.294%)",
+  "hsl(141.064 40.517% 45.49%)",
+  "hsl(37.573 100% 40.392%)",
+  "hsl(212.695 81.463% 59.804%)",
+  "hsl(315.349 89.583% 62.353%)",
+  "hsl(183.976 95.402% 34.118%)",
+  "hsl(230 4.286% 72.549%)",
+];
+
+export interface AnsiSpan {
+  text: string;
+  color?: string;
+  background?: string;
+  bold?: boolean;
+  underline?: boolean;
+}
+
+const SGR = new RegExp(`${String.fromCharCode(27)}\\[(\\d+(?:[:;]\\d+)*)m`, "g");
+
+export function parseAnsi(code: string): AnsiSpan[] {
+  const spans: AnsiSpan[] = [];
+  let style: Omit<AnsiSpan, "text"> = {};
+  let last = 0;
+
+  for (const match of code.matchAll(SGR)) {
+    if (match.index > last) spans.push({ ...style, text: code.slice(last, match.index) });
+    last = match.index + match[0].length;
+    // Discord's grammar compares raw parameters, so "01" isn't bold and `ESC[m` stays text.
+    for (const part of match[1]!.split(";")) {
+      if (part === "0") style = {};
+      else if (part === "1") style = { ...style, bold: true };
+      else if (part === "4") style = { ...style, underline: true };
+      else if (/^3[0-7]$/.test(part)) style = { ...style, color: PALETTE[Number(part) - 30] };
+      else if (/^4[0-7]$/.test(part)) style = { ...style, background: PALETTE[Number(part) - 40] };
+      else if (part === "38" || part === "39") style = { ...style, color: undefined };
+      else if (part === "48" || part === "49") style = { ...style, background: undefined };
+    }
+  }
+  if (last < code.length) spans.push({ ...style, text: code.slice(last) });
+  return spans;
+}
diff --git a/frontend/src/lib/discord-emoji/index.ts b/frontend/src/lib/discord-emoji/index.ts
new file mode 100644
index 00000000..8b7a0757
--- /dev/null
+++ b/frontend/src/lib/discord-emoji/index.ts
@@ -0,0 +1,39 @@
+import { useEffect, useState } from "react";
+import { buildEmojiTable } from "./table";
+import type { DiscordEmojiTable } from "./table";
+
+export type { DiscordEmojiTable } from "./table";
+
+let table: DiscordEmojiTable | null = null;
+let loading: Promise<DiscordEmojiTable> | null = null;
+
+function loadDiscordEmoji(): Promise<DiscordEmojiTable> {
+  loading ??= import("@emoji-platform-data/discord")
+    .then(({ byEmoji }) => (table = buildEmojiTable(byEmoji)))
+    .catch((error: unknown) => {
+      loading = null;
+      throw error;
+    });
+  return loading;
+}
+
+export function useDiscordEmoji(): DiscordEmojiTable | null {
+  const [loaded, setLoaded] = useState(table);
+
+  useEffect(() => {
+    if (loaded) return;
+    let cancelled = false;
+    loadDiscordEmoji()
+      .then((result) => {
+        if (!cancelled) setLoaded(result);
+      })
+      .catch(() => {
+        // Non-fatal: emoji stay plain text; the next mount retries.
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [loaded]);
+
+  return loaded;
+}
diff --git a/frontend/src/lib/discord-emoji/table.ts b/frontend/src/lib/discord-emoji/table.ts
new file mode 100644
index 00000000..f89e5027
--- /dev/null
+++ b/frontend/src/lib/discord-emoji/table.ts
@@ -0,0 +1,79 @@
+import type { DiscordItem } from "@emoji-platform-data/discord";
+
+export interface DiscordEmojiTable {
+  names: Map<string, string>;
+  glyphs: Map<string, string>;
+}
+
+const ZWJ = String.fromCodePoint(0x200d);
+const VS16 = String.fromCodePoint(0xfe0f);
+
+export function buildEmojiTable(byEmoji: Record<string, DiscordItem>): DiscordEmojiTable {
+  const names = new Map<string, string>();
+  const glyphs = new Map<string, string>();
+  for (const [glyph, item] of Object.entries(byEmoji)) {
+    // Discord leaves over-qualified and unqualified-ZWJ spellings as text.
+    if (glyph === item.emoji || (!glyph.includes(ZWJ) && !glyph.endsWith(VS16))) {
+      glyphs.set(glyph, item.name);
+    }
+    // The bundled Twemoji font stops at Emoji 15.0.
+    if (item.unicodeVersion > 15) continue;
+    for (const name of [item.name, ...item.aliases]) names.set(name, item.emoji);
+  }
+  return { names, glyphs };
+}
+
+export type EmojiSplitPart =
+  | { emoji: false; text: string }
+  | { emoji: true; surrogate: string; name: string };
+
+const CANDIDATE =
+  // eslint-disable-next-line no-misleading-character-class
+  /[\u200d\ud800-\udfff\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff\ufe0e\ufe0f\u270b\u2b50\u2728\u26a1\u26c5\u26c4\u2614\u2615\u26bd\u26be\u26f3\u26f5\u2693\u26fd\u26f2\u26fa\u26ea\u231a\u23f0\u231b\u23f3\u26ce\u2648-\u2653\u270a\u274c\u2b55\u26d4\u2757\u2755\u2753\u2754\u2705\u274e\u267f\u23e9-\u23ec\u2795-\u2797\u27b0\u27bf\u26aa\u26ab\u25fe\u25fd\u2b1b\u2b1c\u26a7]/;
+
+const TOKEN =
+  /\ud83c[\udffb-\udfff](?=\ud83c[\udffb-\udfff])|(?:[^\ud800-\udfff][\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff]?|[\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff]|(?:\ud83c[\udde6-\uddff]){2}|[\ud800-\udbff][\udc00-\udfff]|[\ud800-\udfff])[\ufe0e\ufe0f]?(?:[\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff]|\ud83c[\udffb-\udfff])?(?:\u200d(?:[^\ud800-\udfff]|(?:\ud83c[\udde6-\uddff]){2}|[\ud800-\udbff][\udc00-\udfff])[\ufe0e\ufe0f]?(?:[\u0300-\u036f\ufe20-\ufe2f\u20d0-\u20ff]|\ud83c[\udffb-\udfff])?)*/g;
+
+const BLACK_FLAG = String.fromCodePoint(0x1f3f4);
+const CANCEL_TAG = String.fromCodePoint(0xe007f);
+const TAG_LETTER = /^[\u{e0061}-\u{e007a}]$/u;
+
+export function splitUnicodeEmoji(value: string, table: DiscordEmojiTable): EmojiSplitPart[] {
+  if (!CANDIDATE.test(value)) return [{ emoji: false, text: value }];
+
+  const toPart = (token: string): EmojiSplitPart => {
+    const name = table.glyphs.get(token);
+    return name === undefined
+      ? { emoji: false, text: token }
+      : { emoji: true, surrogate: token, name };
+  };
+
+  const out: EmojiSplitPart[] = [];
+  const push = (part: EmojiSplitPart) => {
+    const last = out[out.length - 1];
+    if (!part.emoji && last && !last.emoji) last.text += part.text;
+    else out.push(part);
+  };
+
+  let flag = "";
+  for (let token of value.match(TOKEN) ?? []) {
+    if (flag) {
+      if (token === CANCEL_TAG) {
+        token = flag + token;
+        flag = "";
+      } else if (TAG_LETTER.test(token)) {
+        flag += token;
+        continue;
+      } else {
+        out.push(toPart(flag));
+        flag = "";
+      }
+    } else if (token === BLACK_FLAG) {
+      flag = token;
+      continue;
+    }
+    push(toPart(token));
+  }
+  if (flag) out.push(toPart(flag));
+  return out;
+}
diff --git a/frontend/src/lib/discord-markdown.ts b/frontend/src/lib/discord-markdown.ts
deleted file mode 100644
index a7f1706c..00000000
--- a/frontend/src/lib/discord-markdown.ts
+++ /dev/null
@@ -1,312 +0,0 @@
-/**
- * Discord markdown tokenizer for DiscordContent.
- *
- * Blocks are parsed before inline markup so fenced code keeps its contents
- * literal. Two things worth knowing before editing:
- *
- * - The inline scanner uses sticky regexes against the full string instead of
- *   slicing, because the `_italic_` rule needs `\b` to see the character before
- *   the cursor. On a slice it always matches and `my_file_name.txt` italicises.
- * - No lookbehind anywhere. It's a parse-time SyntaxError on Safari < 16.4,
- *   which would break the whole bundle rather than just markdown.
- */
-
-import { isSafeUrl } from "./url";
-
-export type MdMark = "bold" | "italic" | "underline" | "strike" | "spoiler";
-export type MdTimestampStyle = "t" | "T" | "d" | "D" | "f" | "F" | "R";
-
-export type MdNode =
-  // Leaves
-  | { type: "text"; value: string }
-  | { type: "code"; code: string }
-  | { type: "codeBlock"; lang: string | null; code: string }
-  | { type: "userMention"; id: string }
-  | { type: "roleMention"; id: string }
-  | { type: "channelMention"; id: string }
-  | { type: "globalMention"; name: "everyone" | "here" }
-  | { type: "emoji"; name: string; id: string; animated: boolean }
-  | { type: "timestamp"; unix: number; style: MdTimestampStyle }
-  // Containers
-  | { type: "mark"; mark: MdMark; children: MdNode[] }
-  | { type: "link"; url: string; children: MdNode[] }
-  | { type: "heading"; level: 1 | 2 | 3; children: MdNode[] }
-  | { type: "subtext"; children: MdNode[] }
-  | { type: "quote"; children: MdNode[] };
-
-const text = (value: string): MdNode => ({ type: "text", value });
-
-const mark = (m: MdMark, body: string): MdNode => ({
-  type: "mark",
-  mark: m,
-  children: parseInline(body),
-});
-
-/** Largest value a Date can hold, in ms. */
-const MAX_DATE_MS = 8.64e15;
-
-function buildTimestamp(match: RegExpExecArray): MdNode {
-  const unix = Number(match[1]);
-  const ms = unix * 1000;
-  // Out-of-range values would render as "Invalid Date".
-  if (!Number.isFinite(ms) || Math.abs(ms) > MAX_DATE_MS) return text(match[0]);
-  return { type: "timestamp", unix, style: (match[2] as MdTimestampStyle) || "f" };
-}
-
-/** Unsafe URLs fall back to the raw source, so the text stays visible. */
-function buildLink(url: string, raw: string, label?: string): MdNode {
-  if (!isSafeUrl(url)) return text(raw);
-  return { type: "link", url, children: label === undefined ? [text(url)] : parseInline(label) };
-}
-
-interface InlineRule {
-  re: RegExp;
-  /** Left-context check, since we can't use lookbehind. */
-  leftGuard?: (src: string, at: number) => boolean;
-  build: (match: RegExpExecArray) => MdNode;
-}
-
-const RE_ESCAPE = /\\([^0-9A-Za-z\s])/y;
-
-/**
- * Keyed by the character that triggers the rule. Rules under different keys
- * can't collide, so only the order *within* a key matters. Don't merge keys
- * either — folding role and user mentions together loses role colouring.
- */
-const INLINE_RULES: Record<string, InlineRule[]> = {
-  // Terminal, contents are never re-parsed. The `[^`]` tail and `(?!`)` are
-  // what stop an unclosed ``` fence being eaten as a one-backtick code span.
-  "`": [{ re: /(`{1,2})([\s\S]*?[^`])\1(?!`)/y, build: (m) => ({ type: "code", code: m[2] }) }],
-
-  "|": [{ re: /\|\|([\s\S]+?)\|\|/y, build: (m) => mark("spoiler", m[1]) }],
-
-  // `**` has to come first. Its `(?!\*)` also covers `***bold italic***` — the
-  // body backtracks to `*a*` and recursion picks up the italic. The italic body
-  // is `(?:\*\*|[^*])+?` so `*a **b** c*` doesn't stop at the inner `**`, and
-  // the `(?=[^\s*])` keeps `5 * 3 = 15` from italicising.
-  "*": [
-    { re: /\*\*([\s\S]+?)\*\*(?!\*)/y, build: (m) => mark("bold", m[1]) },
-    { re: /\*(?=[^\s*])((?:\*\*|[^*])+?)\*(?!\*)/y, build: (m) => mark("italic", m[1]) },
-  ],
-
-  // `__` first, same as above. The `\b…\b` is what keeps snake_case_words plain.
-  _: [
-    { re: /__([\s\S]+?)__(?!_)/y, build: (m) => mark("underline", m[1]) },
-    { re: /\b_((?:__|[^_])+?)_\b/y, build: (m) => mark("italic", m[1]) },
-  ],
-
-  // No closing guard here, unlike ** and __ above. Discord allows a stray `~`
-  // in the body, so `~~~a~~~` is <s>~a</s>~ — please don't "fix" it.
-  "~": [{ re: /~~([\s\S]+?)~~/y, build: (m) => mark("strike", m[1]) }],
-
-  // These differ on the character after `<`, so order doesn't matter. IDs stay
-  // `\d+` rather than a snowflake length — dev fixtures use short ones.
-  "<": [
-    {
-      re: /<(a)?:(\w+):(\d+)>/y,
-      build: (m) => ({ type: "emoji", name: m[2], id: m[3], animated: m[1] === "a" }),
-    },
-    { re: /<t:(-?\d+)(?::([tTdDfFR]))?>/y, build: buildTimestamp },
-    { re: /<@&(\d+)>/y, build: (m) => ({ type: "roleMention", id: m[1] }) },
-    { re: /<@!?(\d+)>/y, build: (m) => ({ type: "userMention", id: m[1] }) },
-    { re: /<#(\d+)>/y, build: (m) => ({ type: "channelMention", id: m[1] }) },
-    { re: /<(https?:\/\/[^\s<>]+)>/y, build: (m) => buildLink(m[1], m[0]) },
-  ],
-
-  // The guard stops support@here.example.com growing an @here pill.
-  "@": [
-    {
-      re: /@(everyone|here)\b/y,
-      leftGuard: (src, at) => at === 0 || !/[\w@]/.test(src[at - 1]),
-      build: (m) => ({ type: "globalMention", name: m[1] as "everyone" | "here" }),
-    },
-  ],
-
-  // The url group balances one paren level so `…/Foo_(bar)` survives.
-  "[": [
-    {
-      re: /\[((?:[^\][]|\[[^\]]*\])+)\]\((?:<(https?:\/\/[^\s<>]+)>|((?:[^()\s]|\([^()\s]*\))+))\)/y,
-      build: (m) => buildLink(m[2] ?? m[3], m[0], m[1]),
-    },
-  ],
-
-  // Excludes trailing punctuation via the last character class rather than
-  // stripping it afterwards, so `(https://example.com/path.)` keeps the `.)`.
-  h: [{ re: /https?:\/\/[^\s<]*[^<.,:;"')\]\s]/y, build: (m) => buildLink(m[0], m[0]) }],
-};
-
-/** First character of every rule above. */
-const TRIGGERS = new Set(["\\", "`", "|", "*", "_", "~", "<", "@", "[", "h"]);
-
-function parseInline(src: string): MdNode[] {
-  const out: MdNode[] = [];
-  let buf = "";
-  let cursor = 0;
-
-  const flush = () => {
-    if (buf) {
-      out.push(text(buf));
-      buf = "";
-    }
-  };
-
-  while (cursor < src.length) {
-    const char = src[cursor];
-
-    if (char === "\\") {
-      RE_ESCAPE.lastIndex = cursor;
-      const escaped = RE_ESCAPE.exec(src);
-      if (escaped) {
-        // Appended rather than flushed, so `a\*b` stays a single text node.
-        buf += escaped[1];
-        cursor = RE_ESCAPE.lastIndex;
-        continue;
-      }
-    }
-
-    let matched = false;
-    for (const rule of INLINE_RULES[char] ?? []) {
-      if (rule.leftGuard && !rule.leftGuard(src, cursor)) continue;
-      rule.re.lastIndex = cursor;
-      const match = rule.re.exec(src);
-      // Require forward progress; a zero-length match would spin forever.
-      if (!match || rule.re.lastIndex <= cursor) continue;
-
-      // Read this before build(), which may recurse and reset lastIndex.
-      const end = rule.re.lastIndex;
-      const node = rule.build(match);
-      flush(); // before the push, or text comes out in the wrong order
-      out.push(node);
-      cursor = end;
-      matched = true;
-      break;
-    }
-    if (matched) continue;
-
-    // Skip to the next trigger rather than retrying every rule per character.
-    let next = cursor + 1;
-    while (next < src.length && !TRIGGERS.has(src[next])) next++;
-    buf += src.slice(cursor, next);
-    cursor = next;
-  }
-
-  flush();
-  return out;
-}
-
-const RE_TRIPLE_QUOTE = /(?:^|\n) *>>> /;
-const RE_FENCE = /```(?:([A-Za-z0-9+#._-]*)\n)?([\s\S]*?)```\n?/g;
-const RE_HEADING = /^ {0,3}(#{1,3}) (.*)$/;
-const RE_SUBTEXT = /^ {0,3}-# (.*)$/;
-const RE_QUOTE_LINE = /^ {0,3}>(?!>>) +(.*)$/;
-
-/**
- * Emits block nodes for heading/subtext/quote lines and passes runs of plain
- * lines to the inline scanner together. Only plain runs get rejoined with "\n",
- * so the newline next to a block never becomes a token.
- */
-function parseLines(src: string): MdNode[] {
-  if (!src) return [];
-
-  const out: MdNode[] = [];
-  const lines = src.split("\n");
-  let buf: string[] = [];
-
-  const flush = () => {
-    if (buf.length) {
-      out.push(...parseInline(buf.join("\n")));
-      buf = [];
-    }
-  };
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-
-    // The space after the hashes is required, which is what keeps `#hashtag`
-    // literal, and has to be a literal space since `\s` would match a newline.
-    const heading = RE_HEADING.exec(line);
-    if (heading) {
-      flush();
-      out.push({
-        type: "heading",
-        level: heading[1].length as 1 | 2 | 3,
-        children: parseInline(heading[2]),
-      });
-      continue;
-    }
-
-    const subtext = RE_SUBTEXT.exec(line);
-    if (subtext) {
-      flush();
-      out.push({ type: "subtext", children: parseInline(subtext[1]) });
-      continue;
-    }
-
-    const quote = RE_QUOTE_LINE.exec(line);
-    if (quote) {
-      flush();
-      const quoted = [quote[1]];
-      // Stops at the first non-quote line, so `> a\n\n> b` is two quotes.
-      let ahead: RegExpExecArray | null;
-      while (i + 1 < lines.length && (ahead = RE_QUOTE_LINE.exec(lines[i + 1]))) {
-        quoted.push(ahead[1]);
-        i++;
-      }
-      out.push({ type: "quote", children: parseInline(quoted.join("\n")) });
-      continue;
-    }
-
-    buf.push(line);
-  }
-
-  flush();
-  return out;
-}
-
-function parseBlocks(src: string, allowTriple: boolean): MdNode[] {
-  // `>>> ` quotes everything after it, fences included, so it runs first.
-  // Recursing with allowTriple=false terminates and matches Discord, where a
-  // nested `>>>` is literal.
-  if (allowTriple) {
-    const triple = RE_TRIPLE_QUOTE.exec(src);
-    if (triple) {
-      const head = src.slice(0, triple.index);
-      const rest = src.slice(triple.index + triple[0].length);
-      const out = head ? parseBlocks(head, false) : [];
-      out.push({ type: "quote", children: parseBlocks(rest, false) });
-      return out;
-    }
-  }
-
-  const out: MdNode[] = [];
-  let last = 0;
-
-  // matchAll clones the regex, so the recursion above can't touch lastIndex.
-  for (const fence of src.matchAll(RE_FENCE)) {
-    if (fence.index > last) {
-      // Drop the newline that ended the preceding text run.
-      out.push(...parseLines(src.slice(last, fence.index).replace(/\n$/, "")));
-    }
-    out.push({
-      type: "codeBlock",
-      lang: fence[1] || null,
-      // One trailing newline only; trim() would eat leading indentation.
-      code: fence[2].replace(/\n$/, ""),
-    });
-    last = fence.index + fence[0].length;
-  }
-
-  if (last < src.length) out.push(...parseLines(src.slice(last)));
-  return out;
-}
-
-/**
- * These match Discord and are intentional: blocks win over inline markup (so a
- * code span split across a quote line stays literal), lists aren't supported,
- * and unclosed delimiters render as typed.
- */
-export function parseDiscordMarkdown(input: string): MdNode[] {
-  if (!input) return [];
-  // Normalised here so nothing downstream has to deal with "\r".
-  return parseBlocks(input.replace(/\r\n?/g, "\n"), true);
-}
diff --git a/frontend/src/lib/discord-markdown/engine.ts b/frontend/src/lib/discord-markdown/engine.ts
new file mode 100644
index 00000000..e0791368
--- /dev/null
+++ b/frontend/src/lib/discord-markdown/engine.ts
@@ -0,0 +1,162 @@
+import type { DiscordEmojiTable } from "../discord-emoji/table";
+import type { MdNode } from "./types";
+
+export type Capture = { 0: string; [group: number]: string | undefined; length: number };
+
+export interface ParseState {
+  inline: boolean;
+  prevCapture: Capture | null;
+  emoji: DiscordEmojiTable | null;
+  _parseDepth?: number;
+  _listLevel?: number;
+  inQuote?: boolean;
+  allowHeading?: boolean;
+  allowList?: boolean;
+  allowSubtext?: boolean;
+  allowLinks?: boolean;
+  allowEmojiLinks?: boolean;
+  allowEscape?: boolean;
+  parseInlineCodeChildContent?: boolean;
+  maskedLinkValidation?: { foundNestedMaskedLink: boolean };
+}
+
+export type NestedParse = ((source: string, state: ParseState) => MdNode[]) & { rules: RuleSet };
+
+export interface Rule {
+  order: number;
+  first?: string;
+  quality?: (capture: Capture) => number;
+  match: (source: string, state: ParseState, prev: string) => Capture | null;
+  parse: (capture: Capture, parse: NestedParse, state: ParseState) => MdNode | MdNode[];
+}
+
+export type RuleSet = Record<string, Rule>;
+
+const MAX_PARSE_DEPTH = 1000;
+
+export const text = (value: string): MdNode => ({ type: "text", value });
+
+export function preprocess(source: string): string {
+  return source.replace(/\r\n?/g, "\n").replace(/\f/g, "").replace(/\t/g, "    ");
+}
+
+export const inlineRegex =
+  (re: RegExp) =>
+  (source: string, state: ParseState): Capture | null =>
+    state.inline ? re.exec(source) : null;
+
+export const blockRegex =
+  (re: RegExp) =>
+  (source: string, state: ParseState): Capture | null =>
+    state.inline ? null : re.exec(source);
+
+export const anyScopeRegex =
+  (re: RegExp) =>
+  (source: string): Capture | null =>
+    re.exec(source);
+
+export function parseInline(parse: NestedParse, content: string, state: ParseState): MdNode[] {
+  const wasInline = state.inline;
+  state.inline = true;
+  const result = parse(content, state);
+  state.inline = wasInline;
+  return result;
+}
+
+export interface Parser {
+  parse: (source: string, state: ParseState) => MdNode[];
+}
+
+export function parserFor(rules: RuleSet): Parser {
+  const names = Object.keys(rules).sort((a, b) => {
+    const ra = rules[a];
+    const rb = rules[b];
+    if (ra.order !== rb.order) return ra.order - rb.order;
+    const qa = ra.quality ? 0 : 1;
+    const qb = rb.quality ? 0 : 1;
+    if (qa !== qb) return qa - qb;
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+
+  const byFirst = new Map<number, Rule[]>();
+  const anywhere: Rule[] = [];
+  for (const name of names) {
+    const rule = rules[name];
+    if (rule.first === undefined) {
+      anywhere.push(rule);
+      continue;
+    }
+    for (const char of rule.first) {
+      const code = char.charCodeAt(0);
+      const list = byFirst.get(code);
+      if (list) list.push(rule);
+      else byFirst.set(code, [rule]);
+    }
+  }
+
+  const nested = ((source: string, parentState: ParseState): MdNode[] => {
+    const out: MdNode[] = [];
+    const depth = (parentState._parseDepth ?? 0) + 1;
+    if (depth > MAX_PARSE_DEPTH) {
+      if (source) out.push(text(source));
+      return out;
+    }
+    const state: ParseState = { ...parentState, _parseDepth: depth };
+
+    while (source) {
+      let best: Rule | null = null;
+      let bestCapture: Capture | null = null;
+      let bestOrder = 1e5;
+      let bestQuality = -1e5;
+      const prev = state.prevCapture == null ? "" : state.prevCapture[0];
+
+      for (const list of [byFirst.get(source.charCodeAt(0)), anywhere]) {
+        if (!list) continue;
+        for (const rule of list) {
+          if (rule.order > bestOrder) break;
+          const capture = rule.match(source, state, prev);
+          if (!capture) continue;
+          const quality = rule.quality ? rule.quality(capture) : 0;
+          if (rule.order < bestOrder || quality > bestQuality) {
+            best = rule;
+            bestCapture = capture;
+            bestOrder = rule.order;
+            bestQuality = quality;
+          }
+        }
+      }
+
+      if (!best || !bestCapture || bestCapture[0].length === 0) {
+        out.push(text(source));
+        break;
+      }
+
+      const parsed = best.parse(bestCapture, nested, state);
+      if (Array.isArray(parsed)) out.push(...parsed);
+      else out.push(parsed);
+      state.prevCapture = bestCapture;
+      source = source.substring(bestCapture[0].length);
+    }
+    return out;
+  }) as NestedParse;
+  nested.rules = rules;
+
+  return {
+    parse: (source, state) => {
+      state.prevCapture = null;
+      return nested(preprocess(source), state);
+    },
+  };
+}
+
+export function pickRules(rules: RuleSet, names: readonly string[]): RuleSet {
+  const out: RuleSet = {};
+  for (const name of names) if (rules[name]) out[name] = rules[name];
+  return out;
+}
+
+export function omitRules(rules: RuleSet, names: readonly string[]): RuleSet {
+  const out: RuleSet = { ...rules };
+  for (const name of names) delete out[name];
+  return out;
+}
diff --git a/frontend/src/lib/discord-markdown/index.ts b/frontend/src/lib/discord-markdown/index.ts
new file mode 100644
index 00000000..aa73395d
--- /dev/null
+++ b/frontend/src/lib/discord-markdown/index.ts
@@ -0,0 +1,148 @@
+import { parserFor, text } from "./engine";
+import type { ParseState } from "./engine";
+import { EMBED_TITLE_NO_LINK_RULES, EMBED_TITLE_RULES, RULES } from "./rules";
+import type { MdNode, MdProfile, ParseOptions } from "./types";
+
+export type * from "./types";
+
+const PARSERS = {
+  full: parserFor(RULES),
+  title: parserFor(EMBED_TITLE_RULES),
+  titleNoLinks: parserFor(EMBED_TITLE_NO_LINK_RULES),
+};
+
+const NODE_LIMIT = 200;
+const MAX_JUMBO_EMOJI = 30;
+
+function stateFor(profile: MdProfile, options: ParseOptions): ParseState {
+  const base: ParseState = { inline: true, prevCapture: null, emoji: options.emoji ?? null };
+  const blocks = !options.legacy;
+  switch (profile) {
+    case "content":
+      return {
+        ...base,
+        allowLinks: true,
+        allowEmojiLinks: options.webhook,
+        allowHeading: blocks,
+        allowList: blocks,
+      };
+    case "textDisplay":
+      return {
+        ...base,
+        allowLinks: true,
+        allowEmojiLinks: options.webhook,
+        allowHeading: true,
+        allowList: true,
+      };
+    case "embedDescription":
+      return {
+        ...base,
+        allowLinks: true,
+        allowEmojiLinks: true,
+        allowHeading: blocks,
+        allowList: blocks,
+      };
+    case "embedFieldValue":
+      return {
+        ...base,
+        allowLinks: true,
+        allowEmojiLinks: true,
+        allowHeading: false,
+        allowList: blocks,
+      };
+    case "embedTitle":
+    case "embedTitleNoLinks":
+      return base;
+  }
+}
+
+function sameType(parent: MdNode, node: MdNode): boolean {
+  if (parent.type !== node.type) return false;
+  return parent.type !== "mark" || (node.type === "mark" && parent.mark === node.mark);
+}
+
+function postProcess(nodes: MdNode[], parent: MdNode | null): MdNode[] {
+  const out: MdNode[] = [];
+  for (const original of nodes) {
+    let node = original;
+    if ("children" in node) node = { ...node, children: postProcess(node.children, node) };
+    if (node.type === "list")
+      node = { ...node, items: node.items.map((item) => postProcess(item, null)) };
+
+    const flattened =
+      parent && "children" in node && sameType(parent, node) ? node.children : [node];
+    for (const part of flattened) {
+      const last = out[out.length - 1];
+      if (part.type === "text" && last?.type === "text")
+        out[out.length - 1] = text(last.value + part.value);
+      else out.push(part);
+    }
+  }
+  return out.filter((node) => node.type !== "text" || node.value !== "");
+}
+
+interface LimitState {
+  remaining: number;
+  bailed: boolean;
+}
+
+function limitNodes(nodes: MdNode[], state: LimitState): MdNode[] {
+  const out: MdNode[] = [];
+  for (const node of nodes) {
+    if (node.type === "text") {
+      out.push(node);
+      continue;
+    }
+    state.remaining -= 1;
+    if (state.remaining <= 0) {
+      state.bailed = true;
+      break;
+    }
+    // Discord's channel mentions hide a channel node inside, which its limit counts too.
+    if (node.type === "channelMention" && --state.remaining <= 0) state.bailed = true;
+    if ("children" in node) out.push({ ...node, children: limitNodes(node.children, state) });
+    else if (node.type === "list")
+      out.push({ ...node, items: node.items.map((item) => limitNodes(item, state)) });
+    else out.push(node);
+  }
+  return out;
+}
+
+export function parseDiscordMarkdown(
+  input: string,
+  profile: MdProfile = "content",
+  options: ParseOptions = {},
+): MdNode[] {
+  if (!input) return [];
+  const parser =
+    profile === "embedTitle"
+      ? PARSERS.title
+      : profile === "embedTitleNoLinks"
+        ? PARSERS.titleNoLinks
+        : PARSERS.full;
+  const limit: LimitState = { remaining: NODE_LIMIT, bailed: false };
+  const nodes = limitNodes(
+    postProcess(parser.parse(input, stateFor(profile, options)), null),
+    limit,
+  );
+  if (limit.bailed && profile === "content") return [text(input.replace(/\r\n?/g, "\n"))];
+  return nodes;
+}
+
+const MARKDOWN_UPDATE_MS = Date.parse("2023-03-22T21:44:40.935Z");
+
+export function isLegacyMarkdown(timestamp: string | undefined): boolean {
+  const ms = timestamp ? Date.parse(timestamp) : NaN;
+  return Number.isFinite(ms) && ms < MARKDOWN_UPDATE_MS;
+}
+
+export function isJumboEmoji(nodes: MdNode[]): boolean {
+  let count = 0;
+  for (const node of nodes) {
+    if (node.type === "emoji" || node.type === "unicodeEmoji") count++;
+    else if (node.type === "code" || node.type === "codeBlock") {
+      if (node.code.trim() !== "") return false;
+    } else if (node.type !== "text" || node.value.trim() !== "") return false;
+  }
+  return count <= MAX_JUMBO_EMOJI;
+}
diff --git a/frontend/src/lib/discord-markdown/legacy-url.ts b/frontend/src/lib/discord-markdown/legacy-url.ts
new file mode 100644
index 00000000..b0d83e94
--- /dev/null
+++ b/frontend/src/lib/discord-markdown/legacy-url.ts
@@ -0,0 +1,121 @@
+// The `url` package's legacy parse that Discord's link finder runs.
+
+export interface LegacyUrl {
+  protocol: string | null;
+  host: string | null;
+  pathname: string | null;
+  query: string | null;
+}
+
+const SIMPLE_PATH = /^(\/\/?(?!\/)[^?\s]*)(\?[^\s]*)?$/;
+const PROTOCOL = /^[a-z0-9.+-]+:/i;
+const SLASHED_AUTH = /^\/\/[^@/]+@[^@/]+/;
+const SLASHED_PROTOCOLS = ["http:", "https:", "ftp:", "gopher:", "file:"];
+const HOST_ENDING = /[/?#]/;
+const NON_HOST = /[%/?;#'{}|\\^`<>" \r\n\t]/;
+const PORT = /:[0-9]*$/;
+const HOST_LABEL = /^[+a-z0-9A-Z_-]{0,63}$/;
+const HOST_LABEL_START = /^([+a-z0-9A-Z_-]{0,63})(.*)$/;
+const NON_ASCII_UNIT = /[\u0080-\uffff]/g;
+// Punycode encoding is skipped: hosts are only compared with ASCII ones.
+const IDN_SEPARATORS = /[\u3002\uff0e\uff61]/g;
+const AUTO_ESCAPE = /['{}|\\^`<>" \r\n\t]/g;
+
+function isCodableUserinfo(auth: string): boolean {
+  try {
+    encodeURIComponent(decodeURIComponent(auth));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function legacyParse(input: string): LegacyUrl | null {
+  const url: LegacyUrl = { protocol: null, host: null, pathname: null, query: null };
+  const queryStart = input.indexOf("?");
+  const splitter = queryStart !== -1 && queryStart < input.indexOf("#") ? "?" : "#";
+  const parts = input.split(splitter);
+  parts[0] = parts[0].replace(/\\/g, "/");
+  const slashed = parts.join(splitter);
+  let rest = slashed.trim();
+
+  if (!slashed.includes("#")) {
+    const simple = SIMPLE_PATH.exec(rest);
+    if (simple) {
+      url.pathname = simple[1];
+      if (simple[2]) url.query = simple[2].substring(1);
+      return url;
+    }
+  }
+
+  // Lookups use the protocol as typed, so "HTTP:" isn't a slashed protocol.
+  const protocol = PROTOCOL.exec(rest)?.[0];
+  if (protocol) {
+    url.protocol = protocol.toLowerCase();
+    rest = rest.substring(protocol.length);
+  }
+  const hostless = protocol === "javascript:";
+  let slashes = false;
+  if (protocol || SLASHED_AUTH.test(rest)) {
+    slashes = rest.startsWith("//");
+    if (slashes && !hostless) rest = rest.substring(2);
+  }
+
+  let hostname = "";
+  if (!hostless && (slashes || (protocol && !SLASHED_PROTOCOLS.includes(protocol)))) {
+    const hostEnd = rest.search(HOST_ENDING);
+    const at = hostEnd === -1 ? rest.lastIndexOf("@") : rest.lastIndexOf("@", hostEnd);
+    if (at !== -1) {
+      if (!isCodableUserinfo(rest.slice(0, at))) return null;
+      rest = rest.slice(at + 1);
+    }
+    const nonHost = rest.search(NON_HOST);
+    hostname = nonHost === -1 ? rest : rest.slice(0, nonHost);
+    rest = rest.slice(hostname.length);
+    let port = "";
+    const portMatch = PORT.exec(hostname);
+    if (portMatch) {
+      port = portMatch[0].substring(1);
+      hostname = hostname.slice(0, portMatch.index);
+    }
+
+    const ipv6 = hostname.startsWith("[") && hostname.endsWith("]");
+    if (!ipv6) {
+      const labels = hostname.split(".");
+      for (let i = 0; i < labels.length; i++) {
+        const label = labels[i];
+        if (!label || HOST_LABEL.test(label.replace(NON_ASCII_UNIT, "x"))) continue;
+        const valid = labels.slice(0, i);
+        const notHost = labels.slice(i + 1);
+        const start = HOST_LABEL_START.exec(label);
+        if (start) {
+          valid.push(start[1]);
+          notHost.unshift(start[2]);
+        }
+        if (notHost.length) rest = `/${notHost.join(".")}${rest}`;
+        hostname = valid.join(".");
+        break;
+      }
+    }
+    hostname = hostname.length > 255 ? "" : hostname.toLowerCase();
+    if (!ipv6) hostname = hostname.replace(IDN_SEPARATORS, ".");
+    url.host = port ? `${hostname}:${port}` : hostname;
+    if (ipv6 && !rest.startsWith("/")) rest = `/${rest}`;
+  }
+
+  if (url.protocol !== "javascript:") {
+    rest = rest.replace(AUTO_ESCAPE, (char) => (char === "'" ? "%27" : encodeURIComponent(char)));
+  }
+  const hash = rest.indexOf("#");
+  if (hash !== -1) rest = rest.slice(0, hash);
+  const queryIndex = rest.indexOf("?");
+  if (queryIndex !== -1) {
+    url.query = rest.slice(queryIndex + 1);
+    rest = rest.slice(0, queryIndex);
+  }
+  if (rest) url.pathname = rest;
+  if (url.protocol && SLASHED_PROTOCOLS.includes(url.protocol) && hostname && !url.pathname) {
+    url.pathname = "/";
+  }
+  return url;
+}
diff --git a/frontend/src/lib/discord-markdown/links.ts b/frontend/src/lib/discord-markdown/links.ts
new file mode 100644
index 00000000..3ab822f3
--- /dev/null
+++ b/frontend/src/lib/discord-markdown/links.ts
@@ -0,0 +1,414 @@
+import { legacyParse } from "./legacy-url";
+
+const LINK_PROTOCOLS = ["http:", "https:", "discord:", "tel:", "sms:", "mailto:"];
+
+const FILLER_CHARS = ["\u034f", "\u17b4", "\u17b5", "\u1160", "\u3164", "\uffa0"];
+const INVISIBLE = new RegExp(
+  `${/\p{Cf}|\p{Zl}|\p{Zp}|[^\P{Cc}\n]|[^\P{Zs} ]/u.source}|${FILLER_CHARS.join("|")}`,
+  "gu",
+);
+
+export function sanitizeWhitespace(value: string): string {
+  return value.replace(INVISIBLE, "");
+}
+
+const HOMOGLYPHS: [string, string[]][] = [
+  [
+    "h",
+    [
+      "H",
+      "\u04bb",
+      "\u0570",
+      "\u13c2",
+      "\u210e",
+      "\u{1D421}",
+      "\u{1D489}",
+      "\u{1D4BD}",
+      "\u{1D4F1}",
+      "\u{1D525}",
+      "\u{1D559}",
+      "\u{1D58D}",
+      "\u{1D5C1}",
+      "\u{1D5F5}",
+      "\u{1D629}",
+      "\u{1D65D}",
+      "\u{1D691}",
+      "\uff48",
+    ],
+  ],
+  [
+    "t",
+    [
+      "T",
+      "\u{1D42D}",
+      "\u{1D461}",
+      "\u{1D495}",
+      "\u{1D4C9}",
+      "\u{1D4FD}",
+      "\u{1D531}",
+      "\u{1D565}",
+      "\u{1D599}",
+      "\u{1D5CD}",
+      "\u{1D601}",
+      "\u{1D635}",
+      "\u{1D669}",
+      "\u{1D69D}",
+    ],
+  ],
+  [
+    "p",
+    [
+      "P",
+      "\u03c1",
+      "\u03f1",
+      "\u0440",
+      "\u2374",
+      "\u2ca3",
+      "\u{1D429}",
+      "\u{1D45D}",
+      "\u{1D491}",
+      "\u{1D4C5}",
+      "\u{1D4F9}",
+      "\u{1D52D}",
+      "\u{1D561}",
+      "\u{1D595}",
+      "\u{1D5C9}",
+      "\u{1D5FD}",
+      "\u{1D631}",
+      "\u{1D665}",
+      "\u{1D699}",
+      "\u{1D6D2}",
+      "\u{1D6E0}",
+      "\u{1D70C}",
+      "\u{1D71A}",
+      "\u{1D746}",
+      "\u{1D754}",
+      "\u{1D780}",
+      "\u{1D78E}",
+      "\u{1D7BA}",
+      "\u{1D7C8}",
+      "\uff50",
+      "\u048f",
+    ],
+  ],
+  [
+    "s",
+    [
+      "S",
+      "\u01bd",
+      "\u0455",
+      "\ua731",
+      "\uabaa",
+      "\u{10448}",
+      "\u{118C1}",
+      "\u{1D42C}",
+      "\u{1D460}",
+      "\u{1D494}",
+      "\u{1D4C8}",
+      "\u{1D4FC}",
+      "\u{1D530}",
+      "\u{1D564}",
+      "\u{1D598}",
+      "\u{1D5CC}",
+      "\u{1D600}",
+      "\u{1D634}",
+      "\u{1D668}",
+      "\u{1D69C}",
+      "\uff53",
+    ],
+  ],
+  [
+    ":",
+    [
+      "\u02d0",
+      "\u02f8",
+      "\u0589",
+      "\u05c3",
+      "\u0703",
+      "\u0704",
+      "\u0903",
+      "\u0a83",
+      "\u16ec",
+      "\u1803",
+      "\u1809",
+      "\u205a",
+      "\u2236",
+      "\ua4fd",
+      "\ua789",
+      "\ufe30",
+      "\uff1a",
+      ";",
+      "\u037e",
+    ],
+  ],
+  [
+    "/",
+    [
+      "\u1735",
+      "\u2041",
+      "\u2044",
+      "\u2215",
+      "\u2571",
+      "\u27cb",
+      "\u29f8",
+      "\u2cc6",
+      "\u2f03",
+      "\u3033",
+      "\u30ce",
+      "\u31d3",
+      "\u4e3f",
+      "\u{1D23A}",
+    ],
+  ],
+];
+const HOMOGLYPH_MATCHERS = HOMOGLYPHS.map(
+  ([ascii, lookalikes]) => [ascii, new RegExp(lookalikes.join("|"), "gu")] as const,
+);
+
+export function foldHomoglyphs(value: string): string {
+  let out = value;
+  for (const [ascii, matcher] of HOMOGLYPH_MATCHERS) out = out.replace(matcher, ascii);
+  return out;
+}
+
+export function sanitizeFully(value: string): string {
+  return foldHomoglyphs(sanitizeWhitespace(value));
+}
+
+export function unescapeUrl(value: string): string {
+  return value.replace(/\\([^0-9A-Za-z\s])/g, "$1");
+}
+
+function tryUrl(value: string): URL | null {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+
+function safeDecode(value: string): string | null {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+
+export function isSuspiciousUrl(value: string): boolean {
+  if (hasEscapedInvite(value) || sanitizeWhitespace(value) !== value) return true;
+  const url = tryUrl(value);
+  if (!url) return true;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  const parts = value.split("/");
+  return parts.length < 3 || parts[1] !== "" || safeDecode(parts[2]) !== parts[2];
+}
+
+const DISPLAY_SAFE_ASCII = new Set(
+  '"-0123456789<>ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz~',
+);
+const KEEP_ENCODED = new Set([
+  0x200e, 0x200f, 0x202a, 0x202b, 0x202c, 0x202d, 0x202e, 0x061c, 0x2066, 0x2067, 0x2068, 0x2069,
+  0x1f50f, 0x1f510, 0x1f512, 0x1f513, 0x85, 0xa0, 0x1680, 0x2000, 0x2001, 0x2002, 0x2003, 0x2004,
+  0x2005, 0x2006, 0x2007, 0x2008, 0x2009, 0x200a, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000, 0x2800,
+  0xad, 0x34f, 0x6dd, 0x70f, 0x8e2, 0x115f, 0x1160, 0x17b4, 0x17b5, 0x180b, 0x180c, 0x180d, 0x180e,
+  0x200b, 0x200c, 0x200d, 0x2060, 0x2061, 0x2062, 0x2063, 0x2064, 0x2065, 0x3164, 0xfeff, 0xffa0,
+  0xfff9, 0xfffa, 0xfffb, 0x110bd, 0x110cd,
+]);
+
+function keepsEncoding(code: number): boolean {
+  if (code < 128) return !DISPLAY_SAFE_ASCII.has(String.fromCharCode(code));
+  return (
+    KEEP_ENCODED.has(code) ||
+    (code >= 0x600 && code <= 0x605) ||
+    (code >= 0x206a && code <= 0x206f) ||
+    (code >= 0xfff0 && code <= 0xfff8) ||
+    (code >= 0xfe00 && code <= 0xfe0f) ||
+    (code >= 0x13430 && code <= 0x13438) ||
+    (code >= 0x1bca0 && code <= 0x1bca3) ||
+    (code >= 0x1d173 && code <= 0x1d17a) ||
+    (code >= 0xe0000 && code <= 0xe0fff)
+  );
+}
+
+function decodeForDisplay(value: string): string {
+  const decoded = safeDecode(value);
+  if (decoded === null) return value;
+
+  let out = "";
+  let raw = value;
+  let plain = decoded;
+  while (raw.length > 0) {
+    const rawCode = raw.codePointAt(0)!;
+    const plainCode = plain.codePointAt(0)!;
+    if (rawCode === plainCode) {
+      const char = String.fromCodePoint(rawCode);
+      out += char;
+      raw = raw.substring(char.length);
+      plain = plain.substring(char.length);
+      continue;
+    }
+    const char = String.fromCodePoint(plainCode);
+    const encoded = encodeURIComponent(char);
+    const rawLength = encoded === char ? 3 : encoded.length;
+    out += keepsEncoding(plainCode) ? encoded : char;
+    raw = raw.substring(rawLength);
+    plain = plain.substring(char.length);
+  }
+  return out;
+}
+
+function formatUrl(url: URL): string {
+  let origin: string;
+  if (url.origin === "null" && url.pathname.startsWith("//")) {
+    origin = url.protocol;
+  } else {
+    let auth = url.username;
+    if (url.password) auth += `:${url.password}`;
+    if (auth) auth += "@";
+    const slashes = url.href.substring(url.protocol.length, url.protocol.length + 2) === "//";
+    origin = `${url.protocol}${slashes ? "//" : ""}${auth}${url.host}`;
+  }
+  return (
+    origin +
+    decodeForDisplay(url.pathname) +
+    decodeForDisplay(url.search) +
+    decodeForDisplay(url.hash)
+  );
+}
+
+export interface NormalizedLink {
+  target: string;
+  display: string;
+}
+
+export function normalizeLink(value: string): NormalizedLink | null {
+  if (isSuspiciousUrl(value)) return null;
+  const url = tryUrl(value);
+  if (!url) return null;
+  const protocol = url.protocol.toLowerCase();
+  if (!LINK_PROTOCOLS.includes(protocol)) return null;
+  if ((protocol === "http:" || protocol === "https:") && !url.hostname) return null;
+  // decodeForDisplay throws on some escapes (a trailing %25); the client also shows those as text.
+  try {
+    const target = formatUrl(url);
+    url.username = "";
+    url.password = "";
+    return { target, display: formatUrl(url) };
+  } catch {
+    return null;
+  }
+}
+
+const INVITE_HOST = "discord.gg";
+const TEMPLATE_HOST = "discord.new";
+const PRIMARY_HOSTS = ["discord.com", "canary.discord.com", "ptb.discord.com", "discordapp.com"];
+
+const BARE_DISCORD_HOST =
+  /((https?:\/\/[^ ]*)|^|\s)(discord\.gg|discord\.new|discord\.com|discordapp\.com)/g;
+const CODE_SPANS = /`{3,}[\s\S]*?(?:`{3,}|$)|(`{1,2})[^`]+\1(?!`)/g;
+const IPV4 =
+  "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)){3}";
+const URL_LIKE = new RegExp(
+  `(?:(?:(?:https?:)?//)|www\\.)(?:[^\\s:@]+(?::[^\\s@]*)?@)?(?:localhost|${IPV4}|(?:[a-z\\u00a1-\\uffff0-9-_]+\\.)+(?:(?:[a-z\\u00a1-\\uffff]{2,})))(?::\\d{2,5})?(?:[/?#][^\\s"()\\[\\]<>]*)?`,
+  "ig",
+);
+const TRAILING_PUNCTUATION = /[.,;:?'*_~|]+$/;
+const DEV_LINK = /dev:\/\/[\w.~:/?#[\]@!$&'()*+,;=%-]+/i;
+
+const SINGLE_SEGMENT = /^\/([a-zA-Z0-9-]+)$/;
+const INVITE_OR_TEMPLATE = /^\/(invite|template)\/([a-zA-Z0-9-]+)\/?\.?$/;
+const EVENT = /^\/events\/(\d+)\/(\d+)?(\/(\d+))?/;
+const GAME_SHOP =
+  /^(?:\/game-shop\/([0-9]+)|\/channels\/([0-9]+)\/game-shop\/(?:[0-9]+))(?:\/([0-9]+)(?:\/([^/]+))?)?\/?$/;
+const PRIMARY_PATHS = [
+  /^\/channels\/([0-9]+|@me)\/([0-9]+)$/,
+  /^\/(application-directory|discovery\/applications)\/([0-9-]+)\/?((about|images|privacy)\/?)?$/,
+  /^\/(application-directory|discovery\/applications)\/([0-9-]+)\/store\/?([0-9-]+)?\/?$/,
+  /^\/activities\/([0-9-]+)\/?$/,
+  /^\/channels\/([0-9]+)\/shop\/([0-9]+)$/,
+  /^\/channels\/([0-9]+)\/shop$/,
+  /^\/quests\/([0-9-]+)\/?$/,
+  /^\/games\/([0-9]+)(?:\/[A-Za-z0-9-]*)?\/?$/,
+  /^\/game-servers\/share\/([A-Za-z0-9_-]+)$/,
+  /^\/game-organizations\/invite\/([A-Za-z0-9_-]+)\/?$/,
+  /^\/users\/([0-9]+)\/?$/,
+  /^\/shop$/,
+];
+const SKU_ID = /^[0-9]+$/;
+
+function stripWww(host: string): string {
+  return host.replace(/^www[.]/i, "");
+}
+
+function bracketParam(params: URLSearchParams, name: string): string | string[] | undefined {
+  let value: string | string[] | undefined;
+  for (const [key, item] of params) {
+    if (key === name) value = item;
+    else if (key === `${name}[]`) value = value === undefined ? [item] : [value, item].flat();
+  }
+  return value;
+}
+
+function authorizesCommandsOnly(query: string): boolean {
+  const params = new URLSearchParams(query);
+  const scope = bracketParam(params, "scope");
+  const scopes = ((Array.isArray(scope) ? scope[0] : scope) ?? "").replace(/\+/g, " ").split(" ");
+  return (
+    Boolean(bracketParam(params, "client_id")) &&
+    scopes.every((s) => s === "" || s === "applications.commands")
+  );
+}
+
+function hasSkuId(query: string): boolean {
+  return new URLSearchParams(query)
+    .getAll("skuIds")
+    .some((ids) => ids.split(",").some((id) => SKU_ID.test(id)));
+}
+
+function isCodedLink(candidate: string): boolean {
+  const url = legacyParse(candidate);
+  const path = url?.pathname;
+  if (url == null || path == null) return false;
+  // Unlike every other kind, event links count on any host.
+  if (EVENT.exec(path)?.[2] != null) return true;
+  const host = stripWww(url.host ?? "");
+  if (host === INVITE_HOST) {
+    const web = url.protocol === "http:" || url.protocol === "https:";
+    return web && SINGLE_SEGMENT.test(path) && !candidate.includes("\\");
+  }
+  if (host === TEMPLATE_HOST) return SINGLE_SEGMENT.test(path);
+  if (!PRIMARY_HOSTS.includes(host)) return false;
+  const query = url.query != null && url.query.length <= 1000 ? url.query : null;
+  const inviteOrTemplate = INVITE_OR_TEMPLATE.exec(path);
+  if (inviteOrTemplate) return inviteOrTemplate[1] === "template" || !candidate.includes("\\");
+  if (path.startsWith("/oauth2/authorize") && query != null && authorizesCommandsOnly(query)) {
+    return true;
+  }
+  const gameShop = GAME_SHOP.exec(path);
+  if (gameShop && (gameShop[3] != null || (query != null && hasSkuId(query)))) return true;
+  return PRIMARY_PATHS.some((re) => re.test(path));
+}
+
+export function containsDiscordLink(value: string): boolean {
+  const prefixed = value.replace(
+    BARE_DISCORD_HOST,
+    (match, lead: string, url: string | undefined, host: string) =>
+      url == null ? `${lead}http://${host}` : match,
+  );
+  const candidates = (prefixed.replaceAll(CODE_SPANS, " ").match(URL_LIKE) ?? []).map((candidate) =>
+    candidate.replace(TRAILING_PUNCTUATION, ""),
+  );
+  // Only the first dev:// link counts, and code spans don't hide it.
+  const devLink = DEV_LINK.exec(prefixed);
+  if (devLink) candidates.push(devLink[0]);
+  return candidates.some(isCodedLink);
+}
+
+function hasEscapedInvite(value: string): boolean {
+  if (!value.includes("\\")) return false;
+  const url = legacyParse(value);
+  const host = stripWww(url?.host ?? "");
+  if (host === INVITE_HOST) return true;
+  return PRIMARY_HOSTS.includes(host) && (url?.pathname?.toUpperCase().includes("INVITE") ?? false);
+}
diff --git a/frontend/src/lib/discord-markdown/rules.ts b/frontend/src/lib/discord-markdown/rules.ts
new file mode 100644
index 00000000..7317bc6f
--- /dev/null
+++ b/frontend/src/lib/discord-markdown/rules.ts
@@ -0,0 +1,792 @@
+import { splitUnicodeEmoji } from "../discord-emoji/table";
+import {
+  anyScopeRegex,
+  blockRegex,
+  inlineRegex,
+  omitRules,
+  parseInline,
+  parserFor,
+  pickRules,
+  text,
+} from "./engine";
+import type { Capture, ParseState, Parser, Rule, RuleSet } from "./engine";
+import {
+  containsDiscordLink,
+  foldHomoglyphs,
+  isSuspiciousUrl,
+  normalizeLink,
+  sanitizeFully,
+  sanitizeWhitespace,
+  unescapeUrl,
+} from "./links";
+import type { MdGuildNav, MdNode, MdTimestampStyle } from "./types";
+
+const ORDER = {
+  heading: 0,
+  codeBlock: 4,
+  blockQuote: 6,
+  list: 7,
+  newline: 10,
+  paragraph: 11,
+  escape: 12,
+  autolink: 14,
+  mailto: 15,
+  url: 16,
+  link: 17,
+  em: 21,
+  inlineCode: 23,
+  br: 24,
+  text: 25,
+};
+
+const LINE_START = /\n$/;
+
+function linkNode(target: string, display: string, title?: string): MdNode {
+  return { type: "link", url: target, title, children: [text(display)] };
+}
+
+function autolinkNode(capture: Capture): MdNode {
+  const link = normalizeLink(capture[1]!);
+  return link ? linkNode(link.target, link.display) : text(capture[1]!);
+}
+
+const HEADING_RE = /^ *(#{1,3})(?:\s+)((?!\s*#{1,3}\s)[^\n]+?)#*\s*(?:\n|$)/;
+const SUBTEXT_RE = /^ *-# +((?!-#)[^\n]+)(?:\n|$)/;
+const CODE_BLOCK_RE = /^```(?:([a-z0-9_+\-.#]+?)\n)?\n*([^\n][^]*?)\n*```/i;
+const QUOTE_RE = /^( *>>> +([\s\S]*))|^( *>(?!>>) +[^\n]*(\n *>(?!>>) +[^\n]*)*\n?)/;
+const QUOTE_PREV = /^$|\n *$/;
+const TRIPLE_QUOTE_MARKER = /^ *>>> ?/;
+const QUOTE_MARKER = /^ *> ?/gm;
+
+const heading: Rule = {
+  order: ORDER.heading,
+  first: " #",
+  match: (source, state, prev) =>
+    state.allowHeading && (prev === "" || LINE_START.test(prev)) ? HEADING_RE.exec(source) : null,
+  parse: (capture, parse, state) => ({
+    type: "heading",
+    level: capture[1]!.length as 1 | 2 | 3,
+    children: parseInline(parse, capture[2]!.trim(), state),
+  }),
+};
+
+const subtext: Rule = {
+  order: ORDER.heading,
+  first: "-",
+  match: (source, state, prev) =>
+    state.allowSubtext !== false && (prev === "" || LINE_START.test(prev))
+      ? SUBTEXT_RE.exec(source)
+      : null,
+  parse: (capture, parse, state) => ({
+    type: "subtext",
+    children: parseInline(parse, capture[1]!.trim(), { ...state, allowSubtext: false }),
+  }),
+};
+
+const codeBlock: Rule = {
+  order: ORDER.codeBlock,
+  first: "`",
+  match: anyScopeRegex(CODE_BLOCK_RE),
+  parse: (capture) => ({ type: "codeBlock", lang: capture[1] || null, code: capture[2] ?? "" }),
+};
+
+const blockQuote: Rule = {
+  order: ORDER.blockQuote,
+  first: " >",
+  match: (source, state) => {
+    if (state.inQuote) return null;
+    if (state.prevCapture == null || QUOTE_PREV.test(state.prevCapture[0]))
+      return QUOTE_RE.exec(source);
+    return null;
+  },
+  parse: (capture, parse, state) => {
+    const triple = TRIPLE_QUOTE_MARKER.test(capture[0]);
+    const content = capture[0].replace(triple ? TRIPLE_QUOTE_MARKER : QUOTE_MARKER, "");
+    const wasInQuote = state.inQuote ?? false;
+    const wasInline = state.inline;
+    state.inQuote = true;
+    if (!triple) state.inline = true;
+    const children = parse(content, state);
+    state.inQuote = wasInQuote;
+    state.inline = wasInline;
+    if (children.length === 0) children.push(text(" "));
+    return { type: "quote", children };
+  },
+};
+
+const BULLET = "(?:[*-]|\\d+\\.)";
+const ITEM_PREFIX = (indent: string) => `(${indent})(${BULLET}) +`;
+const ITEM_PREFIX_RE = new RegExp("^" + ITEM_PREFIX(" *"));
+const LIST_SOURCE = `^( *)(${BULLET}) [\\s\\S]+?(?:\\n(?! )(?!\\1${BULLET} )|$)`;
+const LIST_RE = new RegExp(LIST_SOURCE);
+const LIST_AFTER_NEWLINE_RE = new RegExp("^\\n" + LIST_SOURCE.slice(1));
+const LIST_PREV = /(?:^|\n)( *)$/;
+const LIST_PREV_ENDS_LINE = /\n *$/;
+const HORIZONTAL_SPACE_ONLY =
+  /^[ \t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+$/;
+const MAX_LIST_LEVEL = 11;
+
+const list: Rule = {
+  order: ORDER.list,
+  first: "\n *-0123456789",
+  match: (source, state) => {
+    if (!state.allowList || (state._listLevel ?? 0) >= MAX_LIST_LEVEL) return null;
+    const prev = state.prevCapture == null ? "" : state.prevCapture[0];
+    if (source.charCodeAt(0) === 10) {
+      return prev === "" || LIST_PREV_ENDS_LINE.test(prev)
+        ? null
+        : LIST_AFTER_NEWLINE_RE.exec(source);
+    }
+    const lineStart = LIST_PREV.exec(prev);
+    return lineStart == null || HORIZONTAL_SPACE_ONLY.test(lineStart[0])
+      ? null
+      : LIST_RE.exec(source);
+  },
+  parse: (capture, parse, state) => {
+    const bullet = capture[2]!;
+    const ordered = bullet.length > 1;
+    const start = ordered ? Math.min(1e9, Math.max(1, Number(bullet.slice(0, -1)))) : 1;
+    const body = capture[0].replace(/^\n/, "").replace(/\n{2,}$/, "\n");
+    const prefix = ITEM_PREFIX_RE.exec(body);
+    const prefixWidth = prefix ? prefix[0].length : 0;
+    const indent = prefix ? prefix[1]!.length : 0;
+    // Bullets indented one extra space are siblings; two or more nest.
+    const itemRe = new RegExp(
+      ITEM_PREFIX(` {${indent},${indent + 1}}`) +
+        `[^\\n]*(?:\\n(?! {${indent},${indent + 1}}${BULLET} )[^\\n]*)*(\n|$)`,
+      "gm",
+    );
+    const unindent = new RegExp(`^ {1,${prefixWidth}}`, "gm");
+    const rawItems = body.match(itemRe) ?? [];
+
+    let lastWasLoose = false;
+    const items = rawItems.map((item, index) => {
+      const content = item.replace(ITEM_PREFIX_RE, "").replace(unindent, "");
+      const loose = content.includes("\n\n") || (index === rawItems.length - 1 && lastWasLoose);
+      lastWasLoose = loose;
+
+      const was = { inline: state.inline, level: state._listLevel };
+      state._listLevel = (was.level ?? 0) + 1;
+      state.inline = !loose;
+      const source = loose ? content.replace(/ *\n$/, "\n\n") : content.replace(/ *\n$/, "");
+      const nodes = parse(source, { ...state, allowHeading: false }).map((node) =>
+        node.type === "text" && !blockNewlines.has(node)
+          ? text(node.value.replace(/\n+\s*$/, ""))
+          : node,
+      );
+      state.inline = was.inline;
+      state._listLevel = was.level;
+      return nodes;
+    });
+
+    return { type: "list", ordered, start, items };
+  },
+};
+
+const blockNewlines = new WeakSet<MdNode>();
+
+const newline: Rule = {
+  order: ORDER.newline,
+  first: "\n",
+  match: blockRegex(/^(?:\n *)*\n/),
+  parse: () => {
+    const node = text("\n");
+    blockNewlines.add(node);
+    return node;
+  },
+};
+
+const paragraph: Rule = {
+  order: ORDER.paragraph,
+  match: blockRegex(/^((?:[^\n]|\n(?! *\n))+)(?:\n *)+\n/),
+  parse: (capture, parse, state) => ({
+    type: "paragraph",
+    children: parseInline(parse, capture[1]!, state),
+  }),
+};
+
+const escape: Rule = {
+  order: ORDER.escape,
+  first: "\\",
+  match: (source, state) =>
+    state.allowEscape === false ? null : inlineRegex(/^\\([^0-9A-Za-z\s])/)(source, state),
+  parse: (capture) => text(capture[1]!),
+};
+
+const autolink: Rule = {
+  order: ORDER.autolink,
+  first: "<",
+  match: inlineRegex(/^<([^: >]+:\/[^ >]+)>/),
+  parse: autolinkNode,
+};
+
+const mailto: Rule = {
+  order: ORDER.mailto,
+  first: "<",
+  match: inlineRegex(/^<([^\s<>@]+@[^\s<>@]+\.[^\s<>@]+)>/),
+  parse: (capture) => {
+    const address = capture[1]!;
+    return linkNode(address.startsWith("mailto:") ? address : `mailto:${address}`, address);
+  },
+};
+
+const tel: Rule = {
+  order: ORDER.mailto,
+  first: "<",
+  match: inlineRegex(
+    /^<((?:(?:tel|sms):\+?|\+)(?:(?:[0-9]|\([0-9]+\)))(?:[- ./]?(?:[0-9]|\([0-9]+\)))+)>/,
+  ),
+  parse: (capture) => {
+    const number = capture[1]!;
+    const target = number.replaceAll(/[ /]+/g, "-");
+    return linkNode(
+      target.startsWith("tel:") || target.startsWith("sms:") ? target : `tel:${target}`,
+      number,
+    );
+  },
+};
+
+// `discord(?:app)?.com`'s unescaped dot is in the client's regex too.
+const CHANNEL_URL_RE =
+  /^https:\/\/(?:(?:canary\.|ptb\.)?discord(?:app)?.com|staging\.discord\.co)\/channels\/(\d+|@me)(?:\/(\d+|[a-zA-Z-]+))?(?:\/(\d+|[a-zA-Z-]+))?/;
+const THREAD_MESSAGE_URL_RE =
+  /^https:\/\/(?:(?:canary\.|ptb\.)?discord(?:app)?.com|staging\.discord\.co)\/channels\/(\d+)(?:\/)(\d+)(?:\/threads\/)(\d+)(?:\/)(\d+)/;
+
+const channelOrMessageUrl: Rule = {
+  order: ORDER.url - 0.5,
+  first: "h",
+  match: (source) => {
+    const capture = CHANNEL_URL_RE.exec(source);
+    if (!capture) return null;
+    if (
+      (capture[2] != null && /\D/.test(capture[2])) ||
+      (capture[3] != null && /\D/.test(capture[3]))
+    )
+      return null;
+    return capture;
+  },
+  parse: (capture) =>
+    capture[2] == null
+      ? linkNode(capture[0], capture[0])
+      : { type: "channelMention", id: capture[2], messageId: capture[3], url: capture[0] },
+};
+
+const mediaPostLink: Rule = {
+  order: ORDER.url - 0.5,
+  first: "h",
+  match: anyScopeRegex(THREAD_MESSAGE_URL_RE),
+  // id is the parent channel on purpose: previews don't know threads.
+  parse: (capture) => ({
+    type: "channelMention",
+    id: capture[2]!,
+    messageId: capture[4],
+    url: capture[0],
+  }),
+};
+
+const URL_RE = /^((?:https?|steam):\/\/[^\s<]+[^<.,:;"'\]\s])/;
+
+const url: Rule = {
+  order: ORDER.url,
+  first: "hs",
+  match: (source, state) => {
+    if (!state.inline) return null;
+    const capture = URL_RE.exec(source);
+    if (!capture) return null;
+    // Only one unmatched trailing ")" is ever dropped.
+    let value = capture[0];
+    let searchFrom = 0;
+    for (let i = value.length - 1; i >= 0 && value[i] === ")"; i--) {
+      const open = value.indexOf("(", searchFrom);
+      if (open === -1) {
+        value = value.slice(0, -1);
+        break;
+      }
+      searchFrom = open + 1;
+    }
+    capture[0] = capture[1] = value;
+    return capture;
+  },
+  parse: autolinkNode,
+};
+
+const LINK_LABEL = "(?:\\[[^\\]]*\\]|[^\\[\\]]|\\](?=[^\\[]*\\]))*";
+const LINK_HREF =
+  "\\s*<?((?:\\([^)]*\\)|[^\\s\\\\()]|\\\\.)*?)>?(?:\\s+['\"]([\\s\\S]*?)['\"])?\\s*";
+const LINK_RE = new RegExp("^\\[(" + LINK_LABEL + ")\\]\\(" + LINK_HREF + "\\)");
+
+type NodeKind = string;
+
+const LABEL_KINDS: NodeKind[] = [
+  "text",
+  "underline",
+  "bold",
+  "italic",
+  "strike",
+  "code",
+  "spoiler",
+  "br",
+  "timestamp",
+];
+const LABEL_KINDS_WITH_EMOJI: NodeKind[] = [...LABEL_KINDS, "unicodeEmoji", "emoji"];
+const BLOCK_KINDS: NodeKind[] = ["list", "heading", "quote", "subtext"];
+const TITLE_KINDS: NodeKind[] = [
+  "text",
+  "underline",
+  "bold",
+  "italic",
+  "strike",
+  "code",
+  "spoiler",
+  "br",
+  "timestamp",
+  "unicodeEmoji",
+  "emoji",
+  ...BLOCK_KINDS,
+];
+
+const LABEL_RULES = ["text", "u", "strong", "em", "s", "inlineCode", "spoiler", "br", "timestamp"];
+const LABEL_RULES_WITH_EMOJI = [...LABEL_RULES, "emoji", "customEmoji"];
+
+const kindOf = (node: MdNode): NodeKind => (node.type === "mark" ? node.mark : node.type);
+
+const codeContent = new WeakMap<MdNode, MdNode[]>();
+
+function nodesAllowed(nodes: MdNode[], kinds: NodeKind[], codeExtra: NodeKind[] = []): boolean {
+  for (const node of nodes) {
+    if (!kinds.includes(kindOf(node))) return false;
+    if (node.type === "code") {
+      const inner = codeContent.get(node);
+      if (inner && !nodesAllowed(inner, [...kinds, ...codeExtra])) return false;
+    }
+    if ("children" in node && !nodesAllowed(node.children, kinds)) return false;
+  }
+  return true;
+}
+
+function flattenLabel(nodes: MdNode[]): string {
+  let out = "";
+  for (const node of nodes) {
+    switch (node.type) {
+      case "text":
+        out += node.value;
+        break;
+      case "code":
+        out += node.code;
+        break;
+      case "emoji":
+        out += `:${node.name}:`;
+        break;
+      case "unicodeEmoji":
+        out += node.surrogate;
+        break;
+      case "br":
+        out += "\n";
+        break;
+      case "mark":
+        out += flattenLabel(node.children);
+        break;
+      case "timestamp":
+        out += "<timestamp>";
+        break;
+      case "quote":
+      case "list":
+      case "heading":
+      case "subtext":
+        out += `<${node.type}Content>`;
+        break;
+    }
+  }
+  return out;
+}
+
+const labelParsers = new WeakMap<RuleSet, Map<boolean, Parser>>();
+
+function labelParser(rules: RuleSet, withEmoji: boolean): Parser {
+  let byEmoji = labelParsers.get(rules);
+  if (!byEmoji) labelParsers.set(rules, (byEmoji = new Map()));
+  let parser = byEmoji.get(withEmoji);
+  if (!parser) {
+    parser = parserFor(pickRules(rules, withEmoji ? LABEL_RULES_WITH_EMOJI : LABEL_RULES));
+    byEmoji.set(withEmoji, parser);
+  }
+  return parser;
+}
+
+function tooManyBrackets(source: string): boolean {
+  let depth = 0;
+  let sinceParen = 0;
+  let deep = 0;
+  for (let i = 0; i < source.length; i++) {
+    const char = source[i];
+    if (depth >= 2) {
+      if (++deep > 100) return true;
+    } else {
+      deep = 0;
+    }
+    if (char === ")") {
+      sinceParen = 0;
+      continue;
+    }
+    if (char === "[") {
+      if (++depth > 10) return true;
+    } else if (char === "]") {
+      if (depth > 0) depth--;
+    } else if (char !== "(") {
+      continue;
+    }
+    if (++sinceParen > 200) return true;
+  }
+  return false;
+}
+
+const link: Rule = {
+  order: ORDER.link,
+  first: "[",
+  match: (source, state) => {
+    if (!state.allowLinks || !source.includes("](") || tooManyBrackets(source)) return null;
+    return inlineRegex(LINK_RE)(source, state);
+  },
+  parse: (capture, parse, state) => {
+    const [all, rawLabel = "", rawUrl = "", rawTitle] = capture as unknown as string[];
+    const asText = () => text(all);
+
+    if (state.maskedLinkValidation) {
+      state.maskedLinkValidation.foundNestedMaskedLink = true;
+      return asText();
+    }
+    if (isSuspiciousUrl(rawUrl)) return asText();
+
+    const urlClean = sanitizeWhitespace(rawUrl);
+    const labelClean = sanitizeWhitespace(rawLabel);
+    const label = sanitizeFully(rawLabel);
+    const title = sanitizeFully(rawTitle ?? "");
+    if (!urlClean.trim() || !label.trim()) return asText();
+
+    const normalized = normalizeLink(unescapeUrl(rawUrl));
+    if (!normalized || (rawTitle != null && containsDiscordLink(foldHomoglyphs(rawTitle))))
+      return asText();
+
+    const labelState: ParseState = {
+      ...state,
+      allowEscape: false,
+      parseInlineCodeChildContent: true,
+    };
+    const validation = { foundNestedMaskedLink: false };
+    const validationState: ParseState = { ...labelState, maskedLinkValidation: validation };
+    const kinds = state.allowEmojiLinks ? LABEL_KINDS_WITH_EMOJI : LABEL_KINDS;
+    const allowed = [...kinds, ...BLOCK_KINDS];
+
+    const labelNodes = parse(label, validationState);
+    if (validation.foundNestedMaskedLink || !nodesAllowed(labelNodes, allowed, ["unicodeEmoji"])) {
+      return asText();
+    }
+    const titleNodes = parse(title, validationState);
+    if (validation.foundNestedMaskedLink || !nodesAllowed(titleNodes, TITLE_KINDS)) return asText();
+
+    const flat = flattenLabel(labelNodes);
+    if (!flat.trim() || containsDiscordLink(flat)) return asText();
+    if (flat !== label) {
+      if (containsDiscordLink(label)) return asText();
+      const reparsed = parse(flat, validationState);
+      if (
+        validation.foundNestedMaskedLink ||
+        !nodesAllowed(reparsed, [...allowed, "unicodeEmoji"])
+      ) {
+        return asText();
+      }
+    }
+
+    const children = labelParser(parse.rules, !!state.allowEmojiLinks).parse(
+      labelClean,
+      labelState,
+    );
+    const shownTitle = sanitizeWhitespace(rawTitle ?? "");
+    return { type: "link", url: normalized.target, title: shownTitle || undefined, children };
+  },
+};
+
+const EM_RE =
+  /^\b_((?:__|\\[\s\S]|[^\\_])+?)_\b|^\*(?=\S)((?:\*\*|\\[\s\S]|\s+(?:\\[\s\S]|[^\s*\\]|\*\*)|[^\s*\\])+?)\*(?!\*)/;
+const LOOSE_EM_RE =
+  /^\*(?=\S)((?:\*\*|\\[\s\S]|\s+(?:\\[\s\S]|[^\s*\\]|\*\*)|[^\s*\\])+?) {1,2}\*(?!\*)/;
+
+const em: Rule = {
+  order: ORDER.em,
+  quality: (capture) => capture[0].length + 0.2,
+  match: inlineRegex(EM_RE),
+  parse: (capture, parse, state) => ({
+    type: "mark",
+    mark: "italic",
+    children: parse(capture[2] || capture[1]!, state),
+  }),
+};
+
+const looseEm: Rule = {
+  order: ORDER.em,
+  quality: (capture) => capture[0].length + 0.2,
+  match: inlineRegex(LOOSE_EM_RE),
+  parse: (capture, parse, state) => ({
+    type: "mark",
+    mark: "italic",
+    children: parse(capture[1]!, state),
+  }),
+};
+
+const strong: Rule = {
+  order: ORDER.em,
+  first: "*",
+  quality: (capture) => capture[0].length + 0.1,
+  match: inlineRegex(/^\*\*((?:\\[\s\S]|[^\\])+?)\*\*(?!\*)/),
+  parse: (capture, parse, state) => ({
+    type: "mark",
+    mark: "bold",
+    children: parseInline(parse, capture[1]!, state),
+  }),
+};
+
+const u: Rule = {
+  order: ORDER.em,
+  first: "_",
+  quality: (capture) => capture[0].length,
+  match: inlineRegex(/^__((?:\\[\s\S]|[^\\])+?)__(?!_)/),
+  parse: (capture, parse, state) => ({
+    type: "mark",
+    mark: "underline",
+    children: parseInline(parse, capture[1]!, state),
+  }),
+};
+
+const s: Rule = {
+  order: ORDER.em,
+  first: "~",
+  match: inlineRegex(/^~~([\s\S]+?)~~(?!_)/),
+  parse: (capture, parse, state) => ({
+    type: "mark",
+    mark: "strike",
+    children: parseInline(parse, capture[1]!, state),
+  }),
+};
+
+const BACKTICK = 96;
+
+// Hand-written: the equivalent regex backtracks cubically on long backtick runs.
+function matchInlineCode(source: string): Capture | null {
+  let open = 0;
+  while (source.charCodeAt(open) === BACKTICK) open++;
+  if (open === 0 || source.indexOf("`", open) === -1) return null;
+
+  const runs: [start: number, length: number][] = [];
+  for (let i = open; i < source.length; ) {
+    if (source.charCodeAt(i) !== BACKTICK) {
+      i++;
+      continue;
+    }
+    let end = i;
+    while (source.charCodeAt(end) === BACKTICK) end++;
+    runs.push([i, end - i]);
+    i = end;
+  }
+
+  for (let size = open; size >= 1; size--) {
+    const closer = runs.find(([, length]) => length === size);
+    if (closer) {
+      const [start] = closer;
+      return [source.slice(0, start + size), source.slice(0, size), source.slice(size, start)];
+    }
+  }
+  return null;
+}
+
+const inlineCode: Rule = {
+  order: ORDER.inlineCode,
+  first: "`",
+  match: (source, state) => (state.inline ? matchInlineCode(source) : null),
+  parse: (capture, parse, state) => {
+    const node: MdNode = { type: "code", code: capture[2]!.replace(/^ (?= *`)|(` *) $/g, "$1") };
+    if (state.parseInlineCodeChildContent) codeContent.set(node, parse(node.code, state));
+    return node;
+  },
+};
+
+const br: Rule = {
+  order: ORDER.br,
+  first: " ",
+  match: anyScopeRegex(/^ {2,}\n/),
+  parse: () => ({ type: "br" }),
+};
+
+const MAX_DATE_MS = 8.64e15;
+const TIMESTAMP_RE = /^<t:(-?\d{1,17})(?::(t|T|d|D|f|F|s|S|R))?>/;
+
+const timestamp: Rule = {
+  order: ORDER.text - 1,
+  first: "<",
+  match: anyScopeRegex(TIMESTAMP_RE),
+  parse: (capture) => {
+    const unix = Number(capture[1]);
+    if (!Number.isFinite(unix * 1000) || Math.abs(unix * 1000) > MAX_DATE_MS)
+      return text(capture[0]);
+    return { type: "timestamp", unix, style: (capture[2] as MdTimestampStyle | undefined) ?? "f" };
+  },
+};
+
+const TEXT_RE = /^[\s\S]+?(?=[^0-9A-Za-z\s\u00c0-\uffff]|\n\n| {2,}\n|\w+:\S|[0-9]+\.|$)/;
+
+const textRule: Rule = {
+  order: ORDER.text,
+  match: anyScopeRegex(TEXT_RE),
+  parse: (capture, _parse, state) => {
+    if (!state.emoji) return text(capture[0]);
+    return splitUnicodeEmoji(capture[0], state.emoji).map(
+      (part): MdNode =>
+        part.emoji
+          ? { type: "unicodeEmoji", surrogate: part.surrogate, name: part.name }
+          : text(part.text),
+    );
+  },
+};
+
+const EMOJI_NAME_RE = /^:([^\s:]+?(?:::skin-tone-\d)?):/;
+
+const emoji: Rule = {
+  order: ORDER.text,
+  first: ":",
+  match: (source, state) => {
+    if (!state.emoji) return null;
+    const capture = EMOJI_NAME_RE.exec(source);
+    return capture && state.emoji.names.has(capture[1]!) ? capture : null;
+  },
+  parse: (capture, _parse, state) => ({
+    type: "unicodeEmoji",
+    surrogate: state.emoji!.names.get(capture[1]!)!,
+    name: capture[1]!,
+  }),
+};
+
+const customEmoji: Rule = {
+  order: ORDER.codeBlock,
+  first: "<",
+  match: anyScopeRegex(/^<(a)?:(\w+):(\d+)>/),
+  parse: (capture) => ({
+    type: "emoji",
+    name: capture[2]!,
+    id: capture[3]!,
+    animated: capture[1] === "a",
+  }),
+};
+
+// Kept as text so the escape rule can't eat its backslash.
+const emoticon: Rule = {
+  order: ORDER.text,
+  first: "\u00af",
+  match: anyScopeRegex(/^(\u00af\\_\(\u30c4\)_\/\u00af)/),
+  parse: (capture) => text(capture[1]!),
+};
+
+const roleMention: Rule = {
+  order: ORDER.text,
+  first: "<",
+  match: anyScopeRegex(/^<@&(\d+)>/),
+  parse: (capture) => ({ type: "roleMention", id: capture[1]! }),
+};
+
+const mention: Rule = {
+  order: ORDER.text,
+  first: "<@",
+  match: anyScopeRegex(/^<@!?(\d+)>|^(@(?:everyone|here))/),
+  parse: (capture) =>
+    capture[1] != null
+      ? { type: "userMention", id: capture[1] }
+      : { type: "globalMention", name: capture[2] === "@everyone" ? "everyone" : "here" },
+};
+
+const channelMention: Rule = {
+  order: ORDER.text,
+  first: "<",
+  match: anyScopeRegex(/^<#(\d+)>/),
+  parse: (capture) => ({ type: "channelMention", id: capture[1]! }),
+};
+
+const COMMAND_WORD = "[-_\\p{Letter}\\p{Number}\\p{sc=Deva}\\p{sc=Thai}]{1,32}";
+const COMMAND_RE = new RegExp(
+  `^<\\/(${COMMAND_WORD}(?: ${COMMAND_WORD})?(?: ${COMMAND_WORD})?):(\\d+)>`,
+  "u",
+);
+
+const commandMention: Rule = {
+  order: ORDER.text,
+  first: "<",
+  match: anyScopeRegex(COMMAND_RE),
+  parse: (capture) => ({ type: "commandMention", name: capture[1]!, id: capture[2]! }),
+};
+
+const spoiler: Rule = {
+  order: ORDER.text,
+  first: "|",
+  match: anyScopeRegex(/^\|\|([\s\S]+?)\|\|/),
+  parse: (capture, parse, state) => ({
+    type: "mark",
+    mark: "spoiler",
+    children: parse(capture[1]!, state),
+  }),
+};
+
+const staticRouteLink: Rule = {
+  order: ORDER.text,
+  first: "<",
+  match: anyScopeRegex(/^<id:(home|browse|customize|guide|linked-roles)(?::(\d+))?>/),
+  parse: (capture) => ({ type: "guildNav", nav: capture[1] as MdGuildNav }),
+};
+
+export const RULES: RuleSet = {
+  heading,
+  subtext,
+  codeBlock,
+  customEmoji,
+  blockQuote,
+  list,
+  newline,
+  paragraph,
+  escape,
+  autolink,
+  mailto,
+  tel,
+  channelOrMessageUrl,
+  mediaPostLink,
+  url,
+  link,
+  em,
+  looseEm,
+  strong,
+  u,
+  s,
+  inlineCode,
+  br,
+  timestamp,
+  text: textRule,
+  emoji,
+  emoticon,
+  roleMention,
+  mention,
+  channelMention,
+  commandMention,
+  spoiler,
+  staticRouteLink,
+};
+
+export const EMBED_TITLE_RULES = omitRules(RULES, [
+  "codeBlock",
+  "br",
+  "mention",
+  "roleMention",
+  "subtext",
+]);
+
+export const EMBED_TITLE_NO_LINK_RULES = omitRules(EMBED_TITLE_RULES, [
+  "url",
+  "autolink",
+  "link",
+  "mailto",
+  "tel",
+]);
diff --git a/frontend/src/lib/discord-markdown/types.ts b/frontend/src/lib/discord-markdown/types.ts
new file mode 100644
index 00000000..4f7c3c88
--- /dev/null
+++ b/frontend/src/lib/discord-markdown/types.ts
@@ -0,0 +1,41 @@
+import type { DiscordEmojiTable } from "../discord-emoji/table";
+
+export type MdMark = "bold" | "italic" | "underline" | "strike" | "spoiler";
+export type MdTimestampStyle = "t" | "T" | "d" | "D" | "f" | "F" | "s" | "S" | "R";
+export type MdGuildNav = "home" | "browse" | "customize" | "guide" | "linked-roles";
+
+export type MdNode =
+  | { type: "text"; value: string }
+  | { type: "br" }
+  | { type: "code"; code: string }
+  | { type: "codeBlock"; lang: string | null; code: string }
+  | { type: "userMention"; id: string }
+  | { type: "roleMention"; id: string }
+  | { type: "channelMention"; id: string; messageId?: string; url?: string }
+  | { type: "globalMention"; name: "everyone" | "here" }
+  | { type: "commandMention"; name: string; id: string }
+  | { type: "guildNav"; nav: MdGuildNav }
+  | { type: "emoji"; name: string; id: string; animated: boolean }
+  | { type: "unicodeEmoji"; surrogate: string; name: string }
+  | { type: "timestamp"; unix: number; style: MdTimestampStyle }
+  | { type: "mark"; mark: MdMark; children: MdNode[] }
+  | { type: "link"; url: string; title?: string; children: MdNode[] }
+  | { type: "heading"; level: 1 | 2 | 3; children: MdNode[] }
+  | { type: "subtext"; children: MdNode[] }
+  | { type: "quote"; children: MdNode[] }
+  | { type: "paragraph"; children: MdNode[] }
+  | { type: "list"; ordered: boolean; start: number; items: MdNode[][] };
+
+export type MdProfile =
+  | "content"
+  | "textDisplay"
+  | "embedDescription"
+  | "embedFieldValue"
+  | "embedTitle"
+  | "embedTitleNoLinks";
+
+export interface ParseOptions {
+  emoji?: DiscordEmojiTable | null;
+  legacy?: boolean;
+  webhook?: boolean;
+}
diff --git a/frontend/src/lib/discord-time.ts b/frontend/src/lib/discord-time.ts
new file mode 100644
index 00000000..8840ca19
--- /dev/null
+++ b/frontend/src/lib/discord-time.ts
@@ -0,0 +1,119 @@
+import type { MdTimestampStyle } from "./discord-markdown";
+
+const STYLE_OPTIONS: Record<Exclude<MdTimestampStyle, "R">, Intl.DateTimeFormatOptions> = {
+  t: { timeStyle: "short" },
+  T: { timeStyle: "medium" },
+  d: { dateStyle: "short" },
+  D: { dateStyle: "long" },
+  f: { dateStyle: "long", timeStyle: "short" },
+  F: { dateStyle: "full", timeStyle: "short" },
+  s: { dateStyle: "short", timeStyle: "short" },
+  S: { dateStyle: "short", timeStyle: "medium" },
+};
+
+const format = (date: Date, style: Intl.DateTimeFormatOptions) =>
+  new Intl.DateTimeFormat(undefined, style).format(date);
+
+export function formatDiscordTimestamp(
+  unix: number,
+  style: MdTimestampStyle,
+  now: Date = new Date(),
+): string {
+  const date = new Date(unix * 1000);
+  return style === "R" ? relativeTime(date, now) : format(date, STYLE_OPTIONS[style]);
+}
+
+export function formatTimestampTooltip(unix: number): string {
+  return format(new Date(unix * 1000), STYLE_OPTIONS.F);
+}
+
+const daysInMonth = (year: number, month: number) => new Date(year, month + 1, 0).getDate();
+
+function addMonths(date: Date, months: number): Date {
+  const result = new Date(date.getTime());
+  // Skip setMonth for 0: it would move a time in the repeated DST hour to its first occurrence.
+  if (!months) return result;
+  const target = date.getMonth() + months;
+  const day = date.getDate();
+  result.setMonth(target, day < 29 ? day : Math.min(day, daysInMonth(date.getFullYear(), target)));
+  return result;
+}
+
+function positiveDifference(base: Date, other: Date): { months: number; ms: number } {
+  let months = other.getMonth() - base.getMonth() + (other.getFullYear() - base.getFullYear()) * 12;
+  if (addMonths(base, months).getTime() > other.getTime()) months--;
+  return { months, ms: other.getTime() - addMonths(base, months).getTime() };
+}
+
+const RELATIVE: Record<string, string> = {
+  ss: "%d seconds",
+  m: "a minute",
+  mm: "%d minutes",
+  h: "an hour",
+  hh: "%d hours",
+  d: "a day",
+  dd: "%d days",
+  M: "a month",
+  MM: "%d months",
+  y: "a year",
+  yy: "%d years",
+};
+
+// moment quirks are deliberate, e.g. "1 seconds ago" at zero.
+function relativeTime(target: Date, now: Date): string {
+  const future = now.getTime() < target.getTime();
+  const diff = future ? positiveDifference(now, target) : positiveDifference(target, now);
+  const sign = future ? 1 : -1;
+  const signedValue =
+    sign * diff.ms +
+    ((sign * diff.months) % 12) * 2592e6 +
+    Math.trunc((sign * diff.months) / 12) * 31536e6;
+
+  const monthDays = Math.round((diff.months * 146097) / 4800);
+  const seconds = Math.round(monthDays * 86400 + diff.ms / 1000);
+  const minutes = Math.round(monthDays * 1440 + diff.ms / 6e4);
+  const hours = Math.round(monthDays * 24 + diff.ms / 36e5);
+  const days = Math.round(monthDays + diff.ms / 864e5);
+  const exactMonths = diff.months + ((diff.ms / 864e5) * 4800) / 146097;
+  const months = Math.round(exactMonths);
+  const years = Math.round(exactMonths / 12);
+
+  const [key, count = 0] =
+    seconds < 60
+      ? ["ss", seconds]
+      : minutes <= 1
+        ? ["m"]
+        : minutes < 60
+          ? ["mm", minutes]
+          : hours <= 1
+            ? ["h"]
+            : hours < 22
+              ? ["hh", hours]
+              : days <= 1
+                ? ["d"]
+                : days < 26
+                  ? ["dd", days]
+                  : months <= 1
+                    ? ["M"]
+                    : months < 11
+                      ? ["MM", months]
+                      : years <= 1
+                        ? ["y"]
+                        : ["yy", years];
+
+  const phrase = RELATIVE[key].replace("%d", String(count || 1));
+  return signedValue > 0 ? `in ${phrase}` : `${phrase} ago`;
+}
+
+const SECOND = 1000;
+const MINUTE = 60 * SECOND;
+const HOUR = 60 * MINUTE;
+
+export function relativeRefreshMs(target: Date, now: Date): number {
+  const distance = Math.abs(target.getTime() - now.getTime());
+  if (distance < 2 * MINUTE) return SECOND;
+  if (distance < 5 * MINUTE) return MINUTE;
+  if (distance < 45 * MINUTE) return 2 * MINUTE;
+  if (distance < 21 * HOUR) return 5 * MINUTE;
+  return 2 * HOUR;
+}
diff --git a/frontend/src/pages/Notifications.tsx b/frontend/src/pages/Notifications.tsx
index 0deb798e..d7e36907 100644
--- a/frontend/src/pages/Notifications.tsx
+++ b/frontend/src/pages/Notifications.tsx
@@ -354,7 +354,11 @@ function NotificationCard({
           </div>
 
           {/* Body */}
-          <DiscordContent content={notification.body} className="text-sm text-gray-300" />
+          <DiscordContent
+            content={notification.body}
+            profile="textDisplay"
+            className="text-sm text-gray-300 discord-markup--underline-links"
+          />
         </div>
 
         {/* Right side: timestamp, unread dot, and mark-read button */}
diff --git a/frontend/src/pages/manage/tickets/view.tsx b/frontend/src/pages/manage/tickets/view.tsx
index 73ae20a0..057a3650 100644
--- a/frontend/src/pages/manage/tickets/view.tsx
+++ b/frontend/src/pages/manage/tickets/view.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useRef, useState, type FC } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState, type FC } from "react";
 import { apiClient } from "@/lib/api";
 import { Navigate, useParams, useNavigate } from "react-router";
 
@@ -31,6 +31,7 @@ import { faEyeSlash, faLinkSlash } from "@fortawesome/free-solid-svg-icons";
 import Skeleton from "react-loading-skeleton";
 import { showApiErrorToast } from "@/lib/api-error";
 import { useGuildPremium } from "@/hooks/queries/useGuild";
+import { usePreviewEntities } from "@/hooks/usePreviewEntities";
 
 function authorToUser(author: StrippedMessage["author"]): User {
   return {
@@ -152,6 +153,15 @@ const TicketViewPage: FC = () => {
     channels: {},
     roles: {},
   });
+  const guildEntities = usePreviewEntities();
+  const messageEntities = useMemo(
+    () => ({
+      ...entities,
+      channels: { ...guildEntities?.channels, ...entities.channels },
+      roles: { ...guildEntities?.roles, ...entities.roles },
+    }),
+    [entities, guildEntities],
+  );
   const [messages, setMessages] = useState<Message[]>([]);
   const [loading, setLoading] = useState(true);
   const [unavailable, setUnavailable] = useState(false);
@@ -719,7 +729,7 @@ const TicketViewPage: FC = () => {
               <DiscordMessage
                 key={msg.id}
                 message={msg}
-                entities={entities}
+                entities={messageEntities}
                 compact={false}
                 showTimestamp={true}
                 className="mb-2"
diff --git a/frontend/src/pages/manage/transcripts/view.tsx b/frontend/src/pages/manage/transcripts/view.tsx
index 6926afa0..4322a6af 100644
--- a/frontend/src/pages/manage/transcripts/view.tsx
+++ b/frontend/src/pages/manage/transcripts/view.tsx
@@ -92,11 +92,13 @@ const TranscriptsView: FC = () => {
   const entities = useMemo(() => {
     if (!transcript) return null;
     const guildRoles = Object.fromEntries((guild?.roles ?? []).map((r) => [r.id, r]));
+    const guildChannels = Object.fromEntries((guild?.channels ?? []).map((c) => [String(c.id), c]));
     return {
       ...transcript.entities,
+      channels: { ...guildChannels, ...transcript.entities.channels },
       roles: { ...transcript.entities.roles, ...guildRoles },
     };
-  }, [transcript, guild?.roles]);
+  }, [transcript, guild?.roles, guild?.channels]);
 
   return (
     <MainLayout title={`Transcript #${transcriptId}`}>