Fix comments iframe collapsing to preloader height on load

On mount ConnectedRoot immediately reported the iframe height to the parent page while the app was still showing the global preloader, so the parent shrank the iframe from its initial size to ~63px and then grew it back step by step as content rendered. On pages with many comments this reads as the widget blinking several times before loading (reported for radio-t.com). The June frontend dependency refresh (#2091) shifted render/effect timing enough to make the premature measurement happen on every load rather than only on slow connections. Move the height reporting into Root and start it in the setState callback that replaces the preloader with real content: the first height message now always describes rendered content, the iframe never shrinks below it, and subsequent ResizeObserver updates only grow the frame as comments arrive. Also adds the previously missing observer disconnect on unmount. Verified by instrumenting the embed with a height-message listener: master sent 63px then 316px on an empty test page (v1.16.1 sent a single 316px); with this fix the first message is 316px again.
fix(trusted-proxy): warn on catch-all, cover more cases, trim wording
2026-07-09 17:28:40 -05:00 · 2026-07-09 15:05:05 -05:00 · 2026-07-05 17:47:19 -05:00 · 2026-07-05 17:28:01 -05:00 · 2026-07-03 15:40:31 -05:00 · 2026-07-03 15:40:10 -05:00
421 changed files with 40867 additions and 30077 deletions
@@ -25,7 +25,7 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          persist-credentials: false

@@ -23,7 +23,7 @@ jobs:
      contents: read

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          persist-credentials: false

@@ -31,7 +31,7 @@ jobs:
        uses: docker/setup-buildx-action@v4

      - name: expose GitHub Actions cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -22,18 +22,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [ 16 ]
+        node: [ 20 ]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -58,18 +58,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [ 16 ]
+        node: [ 20 ]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -94,18 +94,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [ 16 ]
+        node: [ 20 ]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -124,7 +124,7 @@ jobs:
        working-directory: ./frontend

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          working-directory: ./frontend
@@ -22,18 +22,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [16]
+        node: [20]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -58,18 +58,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [16]
+        node: [20]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -94,18 +94,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [16]
+        node: [20]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -134,14 +134,14 @@ jobs:
      CI_JOB_NUMBER: 1
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Check bundle size
@@ -158,18 +158,18 @@ jobs:
      contents: read
    strategy:
      matrix:
-        node: [16]
+        node: [20]

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: Install node
@@ -188,7 +188,7 @@ jobs:
        working-directory: ./frontend/apps/remark42

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          working-directory: ./frontend/apps/remark42
@@ -39,7 +39,7 @@ jobs:

    steps:
      - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

@@ -34,7 +34,7 @@ jobs:

    steps:
      - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          persist-credentials: false
@@ -26,7 +26,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          persist-credentials: false

@@ -24,7 +24,7 @@ jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -36,15 +36,15 @@ jobs:
          cache-dependency-path: backend/go.sum

      - name: install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: install node
        uses: actions/setup-node@v6
        with:
-          node-version: 16
+          node-version: 20
          cache: "pnpm"
          cache-dependency-path: frontend/pnpm-lock.yaml

@@ -74,7 +74,7 @@ jobs:
        run: |
          pnpm lint
          pnpm type-check
-          pnpm test -- --runInBand
+          pnpm test --runInBand
        working-directory: frontend/apps/remark42
        env:
          CI: "true"
@@ -99,7 +99,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -111,15 +111,15 @@ jobs:
          cache-dependency-path: backend/go.sum

      - name: install pnpm
-        uses: pnpm/action-setup@v6.0.4
+        uses: pnpm/action-setup@v6.0.9
        with:
-          version: 8
+          version: 10.10.0
          run_install: false

      - name: install node
        uses: actions/setup-node@v6
        with:
-          node-version: 16
+          node-version: 20
          cache: "pnpm"
          cache-dependency-path: frontend/pnpm-lock.yaml

@@ -48,7 +48,7 @@ For local artifact runs, install GoReleaser, Go 1.25, Node 16+, PNPM 8, and Perl
 - **CSS**: All components use CSS Modules (`component.module.css`). Class naming: BEM block = `.root`, elements = camelCase, modifiers = camelCase. Use `clsx` for conditional class composition. `raw-content.css` is the only global CSS file (syntax highlighting utility). Root wrapper keeps bare `.dark`/`.light` theme class — 8+ module CSS files depend on `:global(.dark)` ancestor. `comment_highlighting` uses `:global()` for imperative `classList` usage in root.tsx

 ## Key Backend Packages
- **Web/API**: `github.com/go-chi/chi/v5`, `github.com/go-pkgz/rest`
+- **Web/API**: `github.com/go-pkgz/routegroup`, `github.com/go-pkgz/rest`
 - **Auth**: `github.com/go-pkgz/auth/v2`
 - **Logging**: `github.com/go-pkgz/lgr`
 - **Testing**: `github.com/stretchr/testify`
@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM node:16.20-alpine AS frontend-deps
+FROM --platform=$BUILDPLATFORM node:20-alpine AS frontend-deps

 ARG SKIP_FRONTEND_TEST
 ARG SKIP_FRONTEND_BUILD
@@ -11,7 +11,7 @@ COPY ./frontend/apps/remark42/package.json /srv/frontend/apps/remark42/
 RUN \
  if [[ -z "$SKIP_FRONTEND_BUILD" || -z "$SKIP_FRONTEND_TEST" ]]; then \
    apk add --no-cache --update git && \
-    npm i -g pnpm@8; \
+    npm i -g pnpm@10.10.0; \
  fi

 RUN --mount=type=cache,id=pnpm,target=/root/.pnpm-store/v3 \
@@ -13,12 +13,12 @@ require (
 require (
 	github.com/Depado/bfchroma/v2 v2.0.0 // indirect
 	github.com/PuerkitoBio/goquery v1.12.0 // indirect
-	github.com/alecthomas/chroma/v2 v2.24.1 // indirect
-	github.com/andybalholm/cascadia v1.3.3 // indirect
+	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
+	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dlclark/regexp2 v1.12.0 // indirect
-	github.com/go-pkgz/rest v1.21.0 // indirect
+	github.com/dlclark/regexp2/v2 v2.2.2 // indirect
+	github.com/go-pkgz/rest v1.22.0 // indirect
 	github.com/go-pkgz/routegroup v1.6.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -29,11 +29,11 @@ require (
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	go.etcd.io/bbolt v1.4.3 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/image v0.40.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	go.etcd.io/bbolt v1.5.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/image v0.43.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

@@ -4,28 +4,27 @@ github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO
 github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
-github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
-github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
+github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
+github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
-github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2/v2 v2.2.2 h1:MYWvNYw8okuqNhwTYO587EZMiDruVa2vhV6fsGpfya0=
+github.com/dlclark/regexp2/v2 v2.2.2/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/go-pkgz/jrpc v0.4.0 h1:oD7xiGrzDkndkuCjeHGugQXxbggLSV7O1QmHhoc5pYY=
 github.com/go-pkgz/jrpc v0.4.0/go.mod h1:JFoY3bRjRyx4M3CbEVDFQStMB1m2gmQ7OjqFK7q3kOo=
 github.com/go-pkgz/lgr v0.12.3 h1:QDug7kRkEsuQtruT9fNF5PVT2kZUqCDPc4GmsgS3fP8=
 github.com/go-pkgz/lgr v0.12.3/go.mod h1:lpCDgVvCIxBHZp8+sGCj9MPctIzKZyZ3QdE19ddqd54=
-github.com/go-pkgz/rest v1.21.0 h1:Y/C4d/TpclJJDxqnH1RAcS6Hmox0RIReAlkwMcUWXK4=
-github.com/go-pkgz/rest v1.21.0/go.mod h1:+AHzjHazq7Z3Tk/kRWOhbbAz/YZlUV40feC1Hf4NtbE=
+github.com/go-pkgz/rest v1.22.0 h1:d3XFKlmAGBiU9MQER9/n46iXpyUr8IQUtfjU8JlqkkY=
+github.com/go-pkgz/rest v1.22.0/go.mod h1:+AHzjHazq7Z3Tk/kRWOhbbAz/YZlUV40feC1Hf4NtbE=
 github.com/go-pkgz/routegroup v1.6.0 h1:44XHZgF6JIIldRlv+zjg6SygULASmjifnfIQjwCT0e4=
 github.com/go-pkgz/routegroup v1.6.0/go.mod h1:Pmu04fhgWhRtBMIJ8HXppnnzOPjnL/IEPBIdO2zmeqg=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -53,82 +52,18 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
-go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
-golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"

-	"github.com/go-chi/chi/v5"
 	"github.com/jessevdk/go-flags"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -58,7 +57,7 @@ func TestCleanup_IsSpam(t *testing.T) {
 }

 func TestCleanup_postsInRange(t *testing.T) {
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, nil)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -81,7 +80,7 @@ func TestCleanup_postsInRange(t *testing.T) {
 }

 func TestCleanup_listComments(t *testing.T) {
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, nil)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -107,7 +106,7 @@ func TestCleanup_listComments(t *testing.T) {

 func TestCleanup_ExecuteSpam(t *testing.T) {
 	cleaned := cleanedComments{}
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, &cleaned)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -126,7 +125,7 @@ func TestCleanup_ExecuteSpam(t *testing.T) {

 func TestCleanup_ExecuteTitle(t *testing.T) {
 	titledComments := cleanedComments{}
-	r := chi.NewRouter()
+	r := http.NewServeMux()
 	cleanupRoutes(t, r, &titledComments)
 	ts := httptest.NewServer(r)
 	defer ts.Close()
@@ -142,7 +141,7 @@ func TestCleanup_ExecuteTitle(t *testing.T) {
 	assert.Equal(t, []string{"/api/v1/admin/title/1", "/api/v1/admin/title/2", "/api/v1/admin/title/3", "/api/v1/admin/title/11"}, titledComments.ids)
 }

-func cleanupRoutes(t *testing.T, r *chi.Mux, c *cleanedComments) {
+func cleanupRoutes(t *testing.T, r *http.ServeMux, c *cleanedComments) {
 	r.HandleFunc("/api/v1/list", func(w http.ResponseWriter, r *http.Request) {
 		require.Equal(t, "GET", r.Method)
 		require.Equal(t, "site=remark&limit=10000", r.URL.RawQuery)
@@ -85,6 +85,7 @@ type ServerCommand struct {
 	Address                    string        `long:"address" env:"REMARK_ADDRESS" default:"" description:"listening address"`
 	WebRoot                    string        `long:"web-root" env:"REMARK_WEB_ROOT" default:"./web" description:"web root directory"`
 	UpdateLimit                float64       `long:"update-limit" env:"UPDATE_LIMIT" default:"0.5" description:"updates/sec limit"`
+	TrustedProxies             []string      `long:"trusted-proxy" env:"TRUSTED_PROXY" description:"reverse-proxy networks (CIDR or IP) trusted to set the client IP; if unset, trusted from any client (see docs)" env-delim:","`
 	RestrictedWords            []string      `long:"restricted-words" env:"RESTRICTED_WORDS" description:"words prohibited to use in comments" env-delim:","`
 	RestrictedNames            []string      `long:"restricted-names" env:"RESTRICTED_NAMES" description:"names prohibited to use by user" env-delim:","`
 	EnableEmoji                bool          `long:"emoji" env:"EMOJI" description:"enable emoji"`
@@ -596,6 +597,18 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 	}
 	log.Printf("[INFO] root url=%s", s.RemarkURL)

+	// parse trusted proxies up front so a bad CIDR fails before any resource is allocated
+	trustedProxies, err := api.ParseTrustedProxies(s.TrustedProxies)
+	if err != nil {
+		return nil, fmt.Errorf("invalid --trusted-proxy: %w", err)
+	}
+	switch {
+	case len(trustedProxies) == 0:
+		log.Printf("[WARN] --trusted-proxy not set: forwarding headers are trusted from any client and can be spoofed to bypass rate limiting / vote dedup; set it behind a reverse proxy (see docs)")
+	case api.TrustsAnyPeer(trustedProxies):
+		log.Printf("[WARN] --trusted-proxy has a catch-all (0.0.0.0/0 or ::/0): forwarding headers are trusted from any client, re-opening the spoofing bypass; scope it to your proxy network")
+	}
+
 	storeEngine, err := s.makeDataStore()
 	if err != nil {
 		return nil, fmt.Errorf("failed to make data store engine: %w", err)
@@ -703,6 +716,7 @@ func (s *ServerCommand) newServerApp(ctx context.Context) (*serverApp, error) {
 		Migrator:                   migr,
 		ReadOnlyAge:                s.ReadOnlyAge,
 		SharedSecret:               s.SharedSecret,
+		TrustedProxies:             trustedProxies,
 		Authenticator:              authenticator,
 		Cache:                      loadingCache,
 		NotifyService:              notifyService,
@@ -377,6 +377,16 @@ func TestServerApp_Failed(t *testing.T) {
 	assert.EqualError(t, err, "invalid remark42 url demo.remark42.com")
 	t.Log(err)

+	// invalid trusted proxy CIDR fails fast, before any resource is created
+	opts = ServerCommand{}
+	opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
+	p = flags.NewParser(&opts, flags.Default)
+	_, err = p.ParseArgs([]string{"--backup=/tmp", "--trusted-proxy=nonsense"})
+	assert.NoError(t, err)
+	_, err = opts.newServerApp(context.Background())
+	assert.EqualError(t, err, `invalid --trusted-proxy: invalid trusted proxy "nonsense"`)
+	t.Log(err)
+
 	// wrong store type
 	opts = ServerCommand{}
 	opts.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
@@ -548,6 +558,34 @@ func TestServerApp_MainSignal(t *testing.T) {
 	assert.True(t, time.Since(st).Seconds() < 5, "should take under five sec", time.Since(st).Seconds())
 }

+func TestServerApp_RunCanceledBeforeRESTStart(t *testing.T) {
+	port := chooseRandomUnusedPort()
+	app, ctx, cancel := prepServerApp(t, func(o ServerCommand) ServerCommand {
+		o.Port = port
+		return o
+	})
+	cancel()
+
+	errCh := make(chan error, 1)
+	go func() { errCh <- app.run(ctx) }()
+
+	select {
+	case err := <-errCh:
+		require.NoError(t, err)
+		app.Wait()
+	case <-time.After(time.Second):
+		waitForHTTPServerStart(port)
+		app.restSrv.Shutdown()
+		select {
+		case <-errCh:
+			app.Wait()
+		case <-time.After(time.Second):
+			t.Fatal("server app did not stop after forced REST shutdown")
+		}
+		t.Fatal("server app should exit when context is canceled before REST server starts")
+	}
+}
+
 func TestServerApp_DeprecatedArgs(t *testing.T) {
 	s := ServerCommand{}
 	s.SetCommon(CommonOpts{RemarkURL: "https://demo.remark42.com", SharedSecret: "123456"})
@@ -4,14 +4,15 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"html/template"
 	"net/url"
-	"text/template"
 	"time"

 	log "github.com/go-pkgz/lgr"
 	ntf "github.com/go-pkgz/notify"
 	"github.com/go-pkgz/repeater/v2"
 	"github.com/hashicorp/go-multierror"
+	"github.com/microcosm-cc/bluemonday"

 	"github.com/umputun/remark42/backend/app/templates"
 )
@@ -42,12 +43,12 @@ type Email struct {
 type msgTmplData struct {
 	UserName          string
 	UserPicture       string
-	CommentText       string
+	CommentText       template.HTML
 	CommentLink       string
 	CommentDate       time.Time
 	ParentUserName    string
 	ParentUserPicture string
-	ParentCommentText string
+	ParentCommentText template.HTML
 	ParentCommentLink string
 	ParentCommentDate time.Time
 	PostTitle         string
@@ -56,6 +57,30 @@ type msgTmplData struct {
 	ForAdmin          bool
 }

+// emailCommentPolicy sanitizes comment HTML for inclusion in notification emails.
+// It is intentionally stricter than the store-level UGC policy used for web rendering:
+// links (<a>) and images (<img>) are dropped so a comment can't smuggle phishing links
+// or remote tracking pixels into an email sent from the legitimate remark42 address,
+// while basic inline and block text formatting is preserved.
+var emailCommentPolicy = func() *bluemonday.Policy {
+	p := bluemonday.NewPolicy()
+	p.AllowElements(
+		"p", "br", "hr", "div", "span",
+		"b", "strong", "i", "em", "u", "s", "strike", "del", "ins", "sub", "sup", "mark", "small",
+		"blockquote", "q", "cite",
+		"code", "pre", "kbd", "samp", "var",
+		"ul", "ol", "li", "dl", "dt", "dd",
+		"h1", "h2", "h3", "h4", "h5", "h6",
+	)
+	return p
+}()
+
+// emailSafeHTML strips links and images from pre-rendered comment HTML and returns
+// it as template.HTML so html/template renders the remaining safe formatting as-is.
+func emailSafeHTML(commentHTML string) template.HTML {
+	return template.HTML(emailCommentPolicy.Sanitize(commentHTML)) //nolint:gosec // sanitized above: <a>/<img> dropped, only formatting tags survive
+}
+
 // verifyTmplData store data for verification message template execution
 type verifyTmplData struct {
 	User         string
@@ -257,7 +282,7 @@ func (e *Email) buildMessageFromRequest(req Request, email string, forAdmin bool
 	tmplData := msgTmplData{
 		UserName:        req.Comment.User.Name,
 		UserPicture:     req.Comment.User.Picture,
-		CommentText:     req.Comment.Text,
+		CommentText:     emailSafeHTML(req.Comment.Text),
 		CommentLink:     commentURLPrefix + req.Comment.ID,
 		CommentDate:     req.Comment.Timestamp,
 		PostTitle:       req.Comment.PostTitle,
@@ -269,7 +294,7 @@ func (e *Email) buildMessageFromRequest(req Request, email string, forAdmin bool
 	if req.Comment.ParentID != "" {
 		tmplData.ParentUserName = req.parent.User.Name
 		tmplData.ParentUserPicture = req.parent.User.Picture
-		tmplData.ParentCommentText = req.parent.Text
+		tmplData.ParentCommentText = emailSafeHTML(req.parent.Text)
 		tmplData.ParentCommentLink = commentURLPrefix + req.parent.ID
 		tmplData.ParentCommentDate = req.parent.Timestamp
 	}
@@ -3,8 +3,8 @@ package notify
 import (
 	"context"
 	"fmt"
+	"html/template"
 	"testing"
-	"text/template"

 	ntf "github.com/go-pkgz/notify"
 	"github.com/stretchr/testify/assert"
@@ -164,7 +164,7 @@ User: test_user
 01.01.0001 at 00:00
 Comment: 
 test@example.org  for parent_user
-Unsubscribe link: https://remark42.com/api/v1/email/unsubscribe?site=&tkn=token
+Unsubscribe link: https://remark42.com/api/v1/email/unsubscribe?site=&amp;tkn=token
 `, msg.body)
 	assert.Equal(t, "https://remark42.com/api/v1/email/unsubscribe?site=&tkn=token", msg.unsubscribeLink)
 	assert.Equal(t, `New reply to your comment for "test_title"`, msg.subject)
@@ -190,6 +190,50 @@ admin@example.org
 	assert.Empty(t, msg.unsubscribeLink)
 }

+func TestEmail_CommentTextSanitizedForEmail(t *testing.T) {
+	// comment HTML reaching the email path is sanitized by the store-level UGC policy,
+	// which permits <a> and <img>. The email must drop both so a comment can't inject
+	// phishing links or remote tracking pixels into a notification (GHSA-74pc-3r2m-ppx3).
+	email, err := NewEmail(EmailParams{
+		From:            "from@example.org",
+		MsgTemplatePath: "testdata/msg.html.tmpl",
+	}, ntf.SMTPParams{})
+	require.NoError(t, err)
+	email.TokenGenFn = TokenGenFn
+
+	malicious := `hello <a href="https://phishing.example/verify">click to verify</a>` +
+		` <img src="https://attacker.example/track.png" width="1" height="1"> <b>kept</b>`
+	req := Request{
+		Comment: store.Comment{ID: "999", User: store.User{ID: "1", Name: "test_user"}, PostTitle: "test_title", Text: malicious},
+		Emails:  []string{"test@example.org"},
+	}
+	msg, err := email.buildMessageFromRequest(req, req.Emails[0], false)
+	require.NoError(t, err)
+
+	assert.NotContains(t, msg.body, "phishing.example", "phishing link must be stripped")
+	assert.NotContains(t, msg.body, "attacker.example", "tracking pixel must be stripped")
+	assert.NotContains(t, msg.body, "<img", "no image tags in email body")
+	assert.NotContains(t, msg.body, "<a ", "no anchor tags in email body")
+	assert.Contains(t, msg.body, "click to verify", "anchor text is preserved, only the link is dropped")
+	assert.Contains(t, msg.body, "<b>kept</b>", "basic formatting is preserved")
+}
+
+// emailSafeHTML drops links/images while keeping inline/block formatting and escaping nothing extra.
+func TestEmailSafeHTML(t *testing.T) {
+	tbl := []struct{ name, in, want string }{
+		{"strips anchor keeps text", `<a href="http://evil">x</a>`, "x"},
+		{"strips image entirely", `a<img src="http://evil/t.png">b`, "ab"},
+		{"keeps bold/italic/code", `<b>b</b><i>i</i><code>c</code>`, `<b>b</b><i>i</i><code>c</code>`},
+		{"keeps blockquote and lists", `<blockquote>q</blockquote><ul><li>x</li></ul>`, `<blockquote>q</blockquote><ul><li>x</li></ul>`},
+		{"drops onclick handlers", `<span onclick="alert(1)">s</span>`, `<span>s</span>`},
+	}
+	for _, tt := range tbl {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, string(emailSafeHTML(tt.in)))
+		})
+	}
+}
+
 func TestEmail_SendVerification(t *testing.T) {
 	email, err := NewEmail(EmailParams{
 		From:                     "from@example.org",
@@ -1,13 +1,15 @@
 package api

 import (
+	"errors"
 	"fmt"
 	"net/http"
 	"path"
+	"strings"
 	"time"

-	"github.com/go-chi/chi/v5"
 	"github.com/go-pkgz/auth/v2"
+	"github.com/go-pkgz/auth/v2/avatar"
 	cache "github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
@@ -43,7 +45,7 @@ type adminStore interface {

 // DELETE /comment/{id}?site=siteID&url=post-url - removes comment
 func (a *admin) deleteCommentCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
 	log.Printf("[INFO] delete comment %s", id)

@@ -58,7 +60,7 @@ func (a *admin) deleteCommentCtrl(w http.ResponseWriter, r *http.Request) {

 // DELETE /user/{userid}?site=side-id - delete all user comments for requested userid
 func (a *admin) deleteUserCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	log.Printf("[INFO] delete all user comments for %s, site %s", userID, siteID)

@@ -72,7 +74,7 @@ func (a *admin) deleteUserCtrl(w http.ResponseWriter, r *http.Request) {

 // GET /user/{userid}?site=side-id - get user info for requested userid
 func (a *admin) getUserInfoCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	log.Printf("[INFO] get user info for %s, site %s", userID, siteID)

@@ -123,10 +125,15 @@ func (a *admin) deleteMeRequestCtrl(w http.ResponseWriter, r *http.Request) {
 	}

 	if claims.User.Picture != "" && a.authenticator.AvatarProxy() != nil {
-		avatarStore := a.authenticator.AvatarProxy().Store
-		if err = avatarStore.Remove(path.Base(claims.User.Picture)); err != nil {
-			rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't delete user's avatar", rest.ErrInternal)
-			return
+		if avatarID := avatarIDFromPicture(claims.User.Picture); avatarID != "" {
+			// an already-removed avatar is fine (a repeated request stays idempotent), but a genuine
+			// store failure is surfaced now that avatar.ErrNotFound lets us tell the two apart
+			if err = a.authenticator.AvatarProxy().Store.Remove(avatarID); err != nil && !errors.Is(err, avatar.ErrNotFound) {
+				rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't delete user's avatar", rest.ErrInternal)
+				return
+			}
+		} else {
+			log.Printf("[WARN] unexpected avatar picture %q for user %s on site %s, skipping removal", claims.User.Picture, claims.User.ID, audience)
 		}
 	}

@@ -134,9 +141,20 @@ func (a *admin) deleteMeRequestCtrl(w http.ResponseWriter, r *http.Request) {
 	R.RenderJSON(w, R.JSON{"user_id": claims.User.ID, "site_id": claims.Audience})
 }

+// avatarIDFromPicture returns the avatar-store object id for a user picture, or "" if the picture
+// does not resolve to a well-formed id (the store names its objects "<hash>.image"). Guarding on the
+// id shape keeps a malformed picture, e.g. a path sentinel, from making a filesystem-backed store
+// target an unexpected path.
+func avatarIDFromPicture(picture string) string {
+	if id := path.Base(picture); strings.HasSuffix(id, ".image") {
+		return id
+	}
+	return ""
+}
+
 // PUT /user/{userid}?site=side-id&block=1&ttl=7d - block or unblock user
 func (a *admin) setBlockCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	blockStatus := r.URL.Query().Get("block") == "1"

@@ -202,7 +220,7 @@ func (a *admin) setReadOnlyCtrl(w http.ResponseWriter, r *http.Request) {

 // PUT /title/{id}?site=siteID&url=post-url - set comment PostTitle to page's title
 func (a *admin) setTitleCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}

 	c, err := a.dataService.SetTitle(locator, id)
@@ -216,9 +234,9 @@ func (a *admin) setTitleCtrl(w http.ResponseWriter, r *http.Request) {
 	R.RenderJSON(w, R.JSON{"id": id, "locator": locator})
 }

-// PUT /verify?site=siteID&url=post-url&ro=1 - set or reset read-only status for the post
+// PUT /verify/{userid}?site=siteID&verified=1 - set or reset verified status for the user
 func (a *admin) setVerifyCtrl(w http.ResponseWriter, r *http.Request) {
-	userID := chi.URLParam(r, "userid")
+	userID := r.PathValue("userid")
 	siteID := r.URL.Query().Get("site")
 	verifyStatus := r.URL.Query().Get("verified") == "1"

@@ -233,7 +251,7 @@ func (a *admin) setVerifyCtrl(w http.ResponseWriter, r *http.Request) {
 // PUT /pin/{id}?site=siteID&url=post-url&pin=1
 // mark/unmark comment as a special
 func (a *admin) setPinCtrl(w http.ResponseWriter, r *http.Request) {
-	commentID := chi.URLParam(r, "id")
+	commentID := r.PathValue("id")
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
 	pinStatus := r.URL.Query().Get("pin") == "1"

@@ -717,7 +717,7 @@ func TestAdmin_DeleteMeRequest(t *testing.T) {
 		},
 		User: &token.User{
 			ID:      "user1",
-			Picture: "pic.image",
+			Picture: "https://demo.remark42.com/api/v1/avatar/pic.image", // production-shaped URL: removal must path.Base it to the avatar id
 			Attributes: map[string]any{
 				"delete_me": true,
 			},
@@ -747,6 +747,124 @@ func TestAdmin_DeleteMeRequest(t *testing.T) {
 	email, err = srv.DataService.GetUserEmail("remark42", "user1")
 	assert.NoError(t, err)
 	assert.Empty(t, email, "user1 email was deleted")
+
+	assert.NoFileExists(t, os.TempDir()+"/ava-remark42/42/pic.image", "user's avatar should be removed on deleteme")
+}
+
+// a delete_me request whose token carries a picture must still succeed when the avatar is
+// already gone from the store: the user data is deleted and a missing avatar is tolerated
+func TestAdmin_DeleteMeRequestMissingAvatar(t *testing.T) {
+	ts, srv, teardown := startupT(t)
+	defer teardown()
+
+	c1 := store.Comment{Text: "test test #1", Locator: store.Locator{SiteID: "remark42",
+		URL: "https://radio-t.com/blah"}, User: store.User{Name: "user3 name", ID: "user3"}}
+	_, err := srv.DataService.Create(c1)
+	require.NoError(t, err)
+
+	claims := token.Claims{
+		SessionOnly: true,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ID:        "2345678",
+			Issuer:    "remark42",
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
+		},
+		User: &token.User{
+			ID:      "user3",
+			Picture: "missing.image", // no avatar file exists for this picture in the store
+			Attributes: map[string]any{
+				"delete_me": true,
+			},
+		},
+	}
+
+	tkn, err := srv.Authenticator.TokenService().Token(claims)
+	require.NoError(t, err)
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
+	require.NoError(t, err)
+	req.SetBasicAuth("admin", "password")
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusOK, resp.StatusCode, "a missing avatar must not fail the deletion")
+
+	_, err = srv.DataService.User("remark42", "user3", 0, 0, store.User{})
+	assert.EqualError(t, err, "no comments for user user3 in store", "user3 comments should be deleted")
+}
+
+// a genuine (non not-found) avatar-store failure must now surface, not be silently swallowed:
+// avatar.ErrNotFound lets deleteMeRequestCtrl tell an already-gone avatar from a real error
+func TestAdmin_DeleteMeRequestAvatarRemoveError(t *testing.T) {
+	ts, srv, teardown := startupT(t)
+	defer teardown()
+
+	c1 := store.Comment{Text: "test test #1", Locator: store.Locator{SiteID: "remark42",
+		URL: "https://radio-t.com/blah"}, User: store.User{Name: "user5 name", ID: "user5"}}
+	_, err := srv.DataService.Create(c1)
+	require.NoError(t, err)
+
+	// put a non-empty directory where the avatar file is expected, so Store.Remove fails with a real
+	// error (directory not empty), not os.ErrNotExist - "pic" hashes to partition 42
+	require.NoError(t, os.MkdirAll(os.TempDir()+"/ava-remark42/42/pic.image", 0o700))
+	require.NoError(t, os.WriteFile(os.TempDir()+"/ava-remark42/42/pic.image/child", []byte("x"), 0o600))
+
+	claims := token.Claims{
+		SessionOnly: true,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Audience:  jwt.ClaimStrings{"remark42"},
+			ID:        "4567890",
+			Issuer:    "remark42",
+			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(30 * time.Minute)),
+		},
+		User: &token.User{
+			ID:      "user5",
+			Picture: "https://demo.remark42.com/api/v1/avatar/pic.image",
+			Attributes: map[string]any{
+				"delete_me": true,
+			},
+		},
+	}
+
+	tkn, err := srv.Authenticator.TokenService().Token(claims)
+	require.NoError(t, err)
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/api/v1/admin/deleteme?token=%s", ts.URL, tkn), http.NoBody)
+	require.NoError(t, err)
+	req.SetBasicAuth("admin", "password")
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode, "a real avatar-store failure must surface, not be swallowed")
+}
+
+func TestAvatarIDFromPicture(t *testing.T) {
+	tbl := []struct {
+		name    string
+		picture string
+		want    string
+	}{
+		{"local avatar url", "https://demo.remark42.com/api/v1/avatar/cb42ff493ade696d88a3a590f136ae9e34de7c1b.image", "cb42ff493ade696d88a3a590f136ae9e34de7c1b.image"},
+		{"bare avatar id", "pic.image", "pic.image"},
+		{"parent sentinel", "https://demo.remark42.com/api/v1/avatar/..", ""},
+		{"trailing slash", "https://demo.remark42.com/api/v1/avatar/", ""},
+		{"root", "/", ""},
+		{"dotdot", "..", ""},
+		{"empty", "", ""},
+		{"provider url without image suffix", "https://example.com/pic.png", ""},
+	}
+	for _, tc := range tbl {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, avatarIDFromPicture(tc.picture))
+		})
+	}
 }

 func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
@@ -802,7 +920,8 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
 	assert.NoError(t, resp.Body.Close())
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)

-	// try bad user
+	// unknown user: deletion is idempotent, so a valid (signed) delete_me token for a user with
+	// no stored data is a no-op success rather than an error
 	badClaimsUser := claims
 	badClaimsUser.User.ID = "no-such-id"
 	tkn, err = srv.Authenticator.TokenService().Token(badClaimsUser)
@@ -813,7 +932,7 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) {
 	resp, err = client.Do(req)
 	assert.NoError(t, err)
 	assert.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusBadRequest, resp.StatusCode, resp.Status)
+	assert.Equal(t, http.StatusOK, resp.StatusCode, resp.Status)
 	badClaimsUser.User.ID = "provider1_user1"

 	// try without deleteme flag
@@ -0,0 +1,353 @@
+// Package api middleware: request-scoped HTTP middlewares used by the REST router.
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/mail"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/didip/tollbooth/v8"
+	"github.com/didip/tollbooth/v8/limiter"
+	log "github.com/go-pkgz/lgr"
+	R "github.com/go-pkgz/rest"
+	"github.com/umputun/remark42/backend/app/rest"
+	"github.com/umputun/remark42/backend/app/store"
+)
+
+// ipForwardingHeaders are the request headers R.RealIP derives the client IP from.
+var ipForwardingHeaders = []string{"X-Real-IP", "X-Forwarded-For", "CF-Connecting-IP"}
+
+// realIPMiddleware derives the client IP from forwarding headers (X-Real-IP / X-Forwarded-For /
+// CF-Connecting-IP) via R.RealIP, but honors those headers only for requests whose direct peer
+// is one of the trusted proxies. For any other peer it drops those headers and pins RemoteAddr to
+// the real socket IP, so an untrusted client can't spoof the IP that per-IP controls (rate limiting,
+// vote dedup, comment IP, anonymous id) and the request log key on.
+//
+// With no trusted proxies configured it falls back to trusting the headers from any client (the
+// historical behavior). That is spoofable by design, so operators running behind a reverse proxy
+// should set --trusted-proxy to the proxy's network — see the "trusted proxy" docs.
+func realIPMiddleware(trustedProxies []*net.IPNet) func(http.Handler) http.Handler {
+	if len(trustedProxies) == 0 {
+		return R.RealIP
+	}
+	return func(next http.Handler) http.Handler {
+		fromTrusted := R.RealIP(next) // rewrites RemoteAddr from the forwarding headers
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			peer := directPeerIP(r.RemoteAddr)
+			if peer != nil && cidrsContain(trustedProxies, peer) {
+				fromTrusted.ServeHTTP(w, r) // trusted proxy: honor the forwarding headers
+				return
+			}
+			// untrusted peer: drop the forwarding headers and pin RemoteAddr to the real socket IP,
+			// so nothing downstream can be fooled by a spoofed header (R.RealIP normalizes
+			// RemoteAddr to a bare IP for trusted peers; do the same here for consistency)
+			for _, h := range ipForwardingHeaders {
+				r.Header.Del(h)
+			}
+			if peer != nil {
+				r.RemoteAddr = peer.String()
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// directPeerIP extracts the IP from a "host:port" (or bare host) RemoteAddr, or nil if unparseable.
+func directPeerIP(remoteAddr string) net.IP {
+	host, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		host = remoteAddr // may already be a bare IP with no port
+	}
+	return net.ParseIP(host)
+}
+
+// TrustsAnyPeer reports whether the trusted-proxy list contains a catch-all (0.0.0.0/0 or ::/0),
+// which trusts forwarding headers from every client and re-opens the IP-spoofing bypass.
+func TrustsAnyPeer(cidrs []*net.IPNet) bool {
+	for _, c := range cidrs {
+		if ones, _ := c.Mask.Size(); ones == 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// cidrsContain reports whether ip falls within any of the CIDRs.
+func cidrsContain(cidrs []*net.IPNet, ip net.IP) bool {
+	for _, c := range cidrs {
+		if c.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseTrustedProxies parses a list of trusted-proxy entries into CIDRs. Each entry may be a CIDR
+// (e.g. 172.16.0.0/12) or a bare IP (treated as a single host). Blank entries are skipped; a
+// malformed entry is a hard error so a typo can't silently disable proxy trust.
+func ParseTrustedProxies(entries []string) ([]*net.IPNet, error) {
+	var out []*net.IPNet
+	for _, e := range entries {
+		e = strings.TrimSpace(e)
+		if e == "" {
+			continue
+		}
+		if !strings.Contains(e, "/") { // bare IP -> single-host CIDR
+			ip := net.ParseIP(e)
+			if ip == nil {
+				return nil, fmt.Errorf("invalid trusted proxy %q", e)
+			}
+			// build the network from the normalized IP so a v4-mapped IPv6 (e.g. ::ffff:10.0.0.1)
+			// yields the intended /32 host, not a huge ::/32 range
+			bits := 128
+			if v4 := ip.To4(); v4 != nil {
+				ip, bits = v4, 32
+			}
+			out = append(out, &net.IPNet{IP: ip, Mask: net.CIDRMask(bits, bits)})
+			continue
+		}
+		_, network, err := net.ParseCIDR(e)
+		if err != nil {
+			return nil, fmt.Errorf("invalid trusted proxy CIDR %q: %w", e, err)
+		}
+		out = append(out, network)
+	}
+	return out, nil
+}
+
+// corsMiddleware builds the CORS middleware for the public API. With AllowedOrigins
+// "*" and credentials enabled, rest.CORS reflects the request Origin into
+// Access-Control-Allow-Origin (rather than a literal "*"), which browsers require
+// for credentialed cross-origin requests.
+func corsMiddleware() func(http.Handler) http.Handler {
+	return R.CORS(
+		R.CorsAllowedOrigins("*"),
+		R.CorsAllowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS"),
+		R.CorsAllowedHeaders("Accept", "Authorization", "Content-Type", "X-XSRF-Token", "X-JWT"),
+		R.CorsExposedHeaders("Authorization"),
+		R.CorsAllowCredentials(true),
+		R.CorsMaxAge(300),
+	)
+}
+
+// rejectHead rejects HEAD requests with 405, advertising the given allowed methods in
+// the Allow header. net/http.ServeMux routes HEAD to a "GET ..." handler, but per RFC
+// 9110 GET/HEAD are safe methods; this guard is applied to the few GET routes whose
+// handlers mutate state so they cannot be triggered by a (nominally side-effect-free)
+// HEAD, preserving the pre-routegroup behavior. allow lists every method the resource
+// supports (e.g. "GET" or "GET, POST") so the 405 Allow header is accurate.
+func rejectHead(allow string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.Method == http.MethodHead {
+				w.Header().Set("Allow", allow)
+				http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// rejectAnonUser is a middleware rejecting anonymous users
+func rejectAnonUser(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		user, err := rest.GetUserInfo(r)
+		if err != nil {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		if strings.HasPrefix(user.ID, "anonymous_") {
+			http.Error(w, "Access denied", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	}
+	return http.HandlerFunc(fn)
+}
+
+// matchSiteID is a middleware rejecting users with mismatch between site param and and User.SiteID
+func matchSiteID(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		user, err := rest.GetUserInfo(r)
+		if err != nil {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		// skip for basic auth user
+		if user.Name == "admin" && user.ID == "admin" {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		siteID := r.URL.Query().Get("site")
+		// require an explicit site so the user.SiteID check below cannot be bypassed
+		// by simply omitting the query parameter
+		if siteID == "" || user.SiteID != siteID {
+			http.Error(w, "Access denied", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	}
+	return http.HandlerFunc(fn)
+}
+
+// cacheControl is a middleware setting cache expiration. Using url+version as etag
+func cacheControl(expiration time.Duration, version string) func(http.Handler) http.Handler {
+	etag := func(r *http.Request, version string) string {
+		s := version + ":" + r.URL.String()
+		return store.EncodeID(s)
+	}
+
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			e := `"` + etag(r, version) + `"`
+			w.Header().Set("Etag", e)
+			w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d, no-cache", int(expiration.Seconds())))
+
+			if match := r.Header.Get("If-None-Match"); match != "" {
+				if strings.Contains(match, e) {
+					w.WriteHeader(http.StatusNotModified)
+					return
+				}
+			}
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+// apiCSPMiddleware overrides the global Content-Security-Policy on /api/v1 routes
+// with a strict, default-deny policy. The global CSP (securityHeadersMiddleware) keeps
+// 'self' 'unsafe-inline' for script-src/style-src because the widget HTML pages
+// (/web/*.html) need inline bootstrap blocks. API responses serve JSON, XML/RSS, or
+// images — none of those should ever execute scripts when rendered, so they get the
+// strictest policy available as defense-in-depth against future trust-boundary bugs.
+//
+// Image-serving handlers (/api/v1/img, /api/v1/picture/{user}/{id}) re-apply the same
+// rest.StrictImageCSP value at the handler level and additionally set Content-Disposition:
+// inline; filename="image" (framing the response as a file rather than a renderable
+// document) and X-Content-Type-Options: nosniff. The CSP re-apply is intentional belt-and-
+// braces: if a future route refactor bypasses this middleware, the image handlers still
+// emit the policy.
+func apiCSPMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Security-Policy", rest.StrictImageCSP)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// securityHeadersMiddleware sets security-related headers:
+//   - Content-Security-Policy: controls which resources the browser is allowed to load
+//   - Permissions-Policy: disables browser features (camera, mic, etc.) not needed by a comment widget
+//   - X-Content-Type-Options: prevents browsers from MIME-sniffing responses away from the declared type,
+//     stopping e.g. a user-uploaded image from being reinterpreted as executable HTML/JS
+//   - Referrer-Policy: controls how much URL information leaks in the Referer header on cross-origin
+//     requests; "strict-origin-when-cross-origin" sends only the origin (no path) to other domains
+//     and nothing at all on HTTPS→HTTP downgrades
+func securityHeadersMiddleware(imageProxyEnabled bool, allowedAncestors []string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			imgSrc := "*"
+			if imageProxyEnabled {
+				imgSrc = "'self'"
+			}
+			frameAncestors := "*"
+			if len(allowedAncestors) > 0 {
+				frameAncestors = strings.Join(allowedAncestors, " ")
+			}
+			// font-src is set to 'none' (no @font-face / no base64 fonts in the bundle).
+			w.Header().Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; base-uri 'none'; form-action 'none'; connect-src 'self'; frame-src 'self' mailto:; img-src %s; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'none'; object-src 'none'; frame-ancestors %s;", imgSrc, frameAncestors))
+			w.Header().Set("Permissions-Policy", "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=(), window-management=()")
+			w.Header().Set("X-Content-Type-Options", "nosniff")
+			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// subscribersOnly is a middleware rejecting non-paid_sub users
+func subscribersOnly(enable bool) func(http.Handler) http.Handler {
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			if enable {
+				user, err := rest.GetUserInfo(r)
+				if err != nil {
+					http.Error(w, "Unauthorized", http.StatusUnauthorized)
+					return
+				}
+				if !user.PaidSub {
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+// validEmailAuth is a middleware for auth endpoints for email method.
+// it rejects login request if user, site or email are suspicious
+func validEmailAuth() func(http.Handler) http.Handler {
+
+	reUser := regexp.MustCompile(`^[\p{L}\d\s_]{4,64}$`) // matches ui side validation, adding min/max limitation
+	reSite := regexp.MustCompile(`^[a-zA-Z\d\s_.-]{1,64}$`)
+
+	return func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+
+			if r.URL.Path != "/auth/email/login" {
+				// not email login, skip the check
+				h.ServeHTTP(w, r)
+				return
+			}
+
+			if u := r.URL.Query().Get("user"); u != "" {
+				if !reUser.MatchString(u) {
+					log.Printf("[WARN] suspicious user rejected: %s", u)
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+
+			if a := r.URL.Query().Get("address"); a != "" {
+				if _, err := mail.ParseAddress(a); err != nil {
+					log.Printf("[WARN] suspicious address rejected: %s", a)
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+
+			if s := r.URL.Query().Get("site"); s != "" {
+				if !reSite.MatchString(s) {
+					log.Printf("[WARN] suspicious site rejected: %s", s)
+					http.Error(w, "Access denied", http.StatusForbidden)
+					return
+				}
+			}
+
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+}
+
+// rateLimiter creates a rate limiting middleware with proper IP lookup configuration.
+// tollbooth v8 requires explicit IP lookup method to be set.
+// keys on RemoteAddr, which realIPMiddleware sets to the client IP (from the forwarding
+// headers for trusted proxies, otherwise the real socket IP).
+func rateLimiter(maxReq float64) func(http.Handler) http.Handler {
+	lmt := tollbooth.NewLimiter(maxReq, nil)
+	lmt.SetIPLookup(limiter.IPLookup{
+		Name:           "RemoteAddr",
+		IndexFromRight: 0,
+	})
+	return tollbooth.HTTPMiddleware(lmt)
+}
@@ -0,0 +1,406 @@
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/go-pkgz/auth/v2/token"
+	R "github.com/go-pkgz/rest"
+	"github.com/go-pkgz/routegroup"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/umputun/remark42/backend/app/rest"
+	"github.com/umputun/remark42/backend/app/store"
+)
+
+// routes() wraps bounded routes with the enforcing rest.Timeout and deliberately leaves the
+// streaming/long-polling routes (GET /export, /userdata, /wait) without it. This checks that
+// contract holds against the vendored middleware: a slow handler under R.Timeout is aborted with
+// 504 at the deadline, while a route left without it runs to completion.
+func TestRouteTimeout(t *testing.T) {
+	slow := func(d time.Duration) http.HandlerFunc {
+		return func(w http.ResponseWriter, r *http.Request) {
+			select {
+			case <-r.Context().Done(): // return promptly once the enforcing timeout cancels the context
+			case <-time.After(d):
+			}
+			w.WriteHeader(http.StatusOK)
+		}
+	}
+
+	router := routegroup.New(http.NewServeMux())
+	router.With(R.Timeout(20*time.Millisecond)).HandleFunc("GET /bounded", slow(time.Second))
+	router.HandleFunc("GET /streaming", slow(30*time.Millisecond)) // no timeout, like /export and /wait
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL + "/bounded")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusGatewayTimeout, resp.StatusCode, "route under R.Timeout is aborted at the deadline")
+
+	resp, err = http.Get(ts.URL + "/streaming")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusOK, resp.StatusCode, "route without R.Timeout runs to completion")
+}
+
+func TestRealIPMiddleware(t *testing.T) {
+	// call runs mw with the given peer and (optional) X-Real-IP header and returns what the
+	// downstream handler observes; state is per-call, so subtests don't share closure locals.
+	call := func(mw func(http.Handler) http.Handler, remoteAddr, xRealIP string) (addr, hdr string) {
+		next := http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+			addr, hdr = r.RemoteAddr, r.Header.Get("X-Real-IP")
+		})
+		req := httptest.NewRequest(http.MethodGet, "/", http.NoBody)
+		req.RemoteAddr = remoteAddr
+		if xRealIP != "" {
+			req.Header.Set("X-Real-IP", xRealIP)
+		}
+		mw(next).ServeHTTP(httptest.NewRecorder(), req)
+		return addr, hdr
+	}
+
+	trusted, err := ParseTrustedProxies([]string{"172.16.0.0/12", "2001:db8::/32"})
+	require.NoError(t, err)
+
+	t.Run("no trusted proxies trusts the header from anyone (legacy)", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(nil), "203.0.113.9:1234", "8.8.8.8")
+		assert.Equal(t, "8.8.8.8", addr)
+	})
+	t.Run("trusted v4 peer: forwarding header sets the client IP", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(trusted), "172.18.0.5:5555", "8.8.8.8")
+		assert.Equal(t, "8.8.8.8", addr)
+	})
+	t.Run("trusted v6 peer: forwarding header honored", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(trusted), "[2001:db8::5]:5555", "8.8.8.8")
+		assert.Equal(t, "8.8.8.8", addr)
+	})
+	t.Run("trusted peer without a forwarding header falls back to the socket IP", func(t *testing.T) {
+		addr, _ := call(realIPMiddleware(trusted), "172.18.0.5:5555", "")
+		assert.Equal(t, "172.18.0.5", addr, "no header to honor, so the bare socket IP is used")
+	})
+	t.Run("untrusted peer: header stripped, RemoteAddr pinned to bare socket IP", func(t *testing.T) {
+		addr, hdr := call(realIPMiddleware(trusted), "203.0.113.9:1234", "8.8.8.8")
+		assert.Equal(t, "203.0.113.9", addr, "real socket IP with the port stripped")
+		assert.Empty(t, hdr, "spoofed forwarding header removed so nothing downstream can read it")
+	})
+	t.Run("unparseable RemoteAddr is treated as untrusted, header stripped", func(t *testing.T) {
+		addr, hdr := call(realIPMiddleware(trusted), "garbage", "8.8.8.8")
+		assert.Equal(t, "garbage", addr, "unparseable peer left as-is, not overwritten")
+		assert.Empty(t, hdr, "forwarding header still stripped for a non-trusted peer")
+	})
+}
+
+func TestParseTrustedProxies(t *testing.T) {
+	t.Run("cidr, bare v4, bare v6, blanks", func(t *testing.T) {
+		got, err := ParseTrustedProxies([]string{"172.16.0.0/12", " 10.0.0.1 ", "", "2001:db8::/32"})
+		require.NoError(t, err)
+		require.Len(t, got, 3)
+		assert.True(t, got[0].Contains(net.ParseIP("172.18.0.5")))
+		assert.True(t, got[1].Contains(net.ParseIP("10.0.0.1")))
+		assert.False(t, got[1].Contains(net.ParseIP("10.0.0.2")), "a bare IP is a single host")
+		assert.True(t, got[2].Contains(net.ParseIP("2001:db8::1")))
+	})
+	t.Run("v4-mapped IPv6 bare entry resolves to the v4 host", func(t *testing.T) {
+		got, err := ParseTrustedProxies([]string{"::ffff:10.0.0.1"})
+		require.NoError(t, err)
+		require.Len(t, got, 1)
+		assert.True(t, got[0].Contains(net.ParseIP("10.0.0.1")), "the intended /32 host")
+		assert.False(t, got[0].Contains(net.ParseIP("10.0.0.2")), "not a wider range")
+	})
+	t.Run("malformed entry is a hard error", func(t *testing.T) {
+		_, err := ParseTrustedProxies([]string{"172.16.0.0/12", "nonsense"})
+		require.Error(t, err)
+		_, err = ParseTrustedProxies([]string{"10.0.0.0/999"})
+		require.Error(t, err)
+	})
+	t.Run("all blank yields nil", func(t *testing.T) {
+		got, err := ParseTrustedProxies([]string{"", "  "})
+		require.NoError(t, err)
+		assert.Empty(t, got)
+	})
+}
+
+func TestTrustsAnyPeer(t *testing.T) {
+	catchAll := func(entries ...string) bool {
+		cidrs, err := ParseTrustedProxies(entries)
+		require.NoError(t, err)
+		return TrustsAnyPeer(cidrs)
+	}
+	assert.True(t, catchAll("10.0.0.0/8", "0.0.0.0/0"), "v4 catch-all")
+	assert.True(t, catchAll("::/0"), "v6 catch-all")
+	assert.False(t, catchAll("172.16.0.0/12", "10.0.0.5"), "scoped ranges are not catch-all")
+	assert.False(t, catchAll(), "empty is not catch-all")
+}
+
+func TestRest_rejectAnonUser(t *testing.T) {
+	ts := httptest.NewServer(fakeAuth(rejectAnonUser(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		fmt.Fprintln(w, "Hello")
+	}))))
+	defer ts.Close()
+
+	resp, err := http.Get(ts.URL)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "use not logged in")
+
+	resp, err = http.Get(ts.URL + "?fake_id=anonymous_user123&fake_name=test")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode, "anon rejected")
+
+	resp, err = http.Get(ts.URL + "?fake_id=real_user123&fake_name=test")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusOK, resp.StatusCode, "real user")
+}
+
+func TestRest_cacheControl(t *testing.T) {
+	tbl := []struct {
+		url     string
+		version string
+		exp     time.Duration
+		etag    string
+		maxAge  int
+	}{
+		{"http://example.com/foo", "v1", time.Hour, "b433be1ea19edaee9dc92ca4b895b6bdf3c058cb", 3600},
+		{"http://example.com/foo2", "v1", 10 * time.Hour, "6d8466aef3246c1057452561acddf7ad9d0d99e0", 36000},
+		{"http://example.com/foo", "v2", time.Hour, "481700c52aab0dfbca99f3ffc2a4fbb27884c114", 3600},
+		{"https://example.com/foo", "v2", time.Hour, "bebd4f1b87f474792c4e75e5affe31fbf67f5778", 3600},
+	}
+
+	for i, tt := range tbl {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.url, http.NoBody)
+			w := httptest.NewRecorder()
+
+			h := cacheControl(tt.exp, tt.version)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+			h.ServeHTTP(w, req)
+			resp := w.Result()
+			assert.Equal(t, http.StatusOK, resp.StatusCode)
+			assert.NoError(t, resp.Body.Close())
+			t.Logf("%+v", resp.Header)
+			assert.Equal(t, `"`+tt.etag+`"`, resp.Header.Get("Etag"))
+			assert.Equal(t, `max-age=`+strconv.Itoa(int(tt.exp.Seconds()))+", no-cache", resp.Header.Get("Cache-Control"))
+		})
+	}
+}
+
+// TestRest_apiCSP locks in that /api/v1/* responses get a strict default-src 'none'
+// override regardless of what the global CSP allows. The widget HTML pages
+// (/web/*.html) still get the global CSP (with 'unsafe-inline' for bootstrap),
+// so the test asserts the two policies diverge across origins.
+func TestRest_apiCSP(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+	client := http.Client{}
+
+	// JSON API endpoint — must carry the strict policy
+	resp, err := client.Get(ts.URL + "/api/v1/config")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	csp := resp.Header.Get("Content-Security-Policy")
+	assert.Contains(t, csp, "default-src 'none'",
+		"API responses must override the global CSP with default-src 'none'; got %q", csp)
+	assert.Contains(t, csp, "sandbox", "API CSP must include sandbox; got %q", csp)
+	assert.NotContains(t, csp, "'unsafe-inline'",
+		"API CSP must not allow inline scripts/styles; got %q", csp)
+
+	// RSS/XML endpoint — same strict policy, and the XML response itself must still be served
+	respRSS, err := client.Get(ts.URL + "/api/v1/rss/site?site=remark42")
+	require.NoError(t, err)
+	defer respRSS.Body.Close()
+	assert.Equal(t, http.StatusOK, respRSS.StatusCode, "RSS must still respond OK under strict CSP")
+	cspRSS := respRSS.Header.Get("Content-Security-Policy")
+	assert.Contains(t, cspRSS, "default-src 'none'", "RSS responses must carry the strict API CSP")
+	assert.Contains(t, cspRSS, "sandbox", "RSS CSP must include sandbox")
+
+	// widget HTML — must keep the global CSP (unchanged, lax to support inline bootstrap)
+	resp2, err := client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp2.Body.Close()
+	csp2 := resp2.Header.Get("Content-Security-Policy")
+	assert.Contains(t, csp2, "'unsafe-inline'",
+		"widget HTML CSP must keep unsafe-inline for bootstrap; got %q", csp2)
+}
+
+// check CSP, img-src should be 'self' with proxy enabled and * without it
+func TestRest_securityHeaders(t *testing.T) {
+	ts, _, teardown := startupT(t)
+
+	// with proxy disabled
+	client := http.Client{}
+	resp, err := client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "img-src *;")
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Equal(t, "strict-origin-when-cross-origin", resp.Header.Get("Referrer-Policy"))
+	teardown()
+
+	// check CSP with proxy enabled
+	ts, _, teardown = startupT(t, func(srv *Rest) {
+		srv.ExternalImageProxy = true
+	})
+	defer teardown()
+	resp, err = client.Get(ts.URL + "/web/index.html")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "img-src 'self';")
+	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
+	assert.Equal(t, "strict-origin-when-cross-origin", resp.Header.Get("Referrer-Policy"))
+}
+
+func TestRest_subscribersOnly(t *testing.T) {
+	paidSubUser := &token.User{}
+	paidSubUser.SetPaidSub(true)
+
+	tbl := []struct {
+		subsOnly bool
+		user     token.User
+		setUser  bool
+		status   int
+	}{
+		{true, token.User{}, false, http.StatusUnauthorized},
+		{true, token.User{}, true, http.StatusForbidden},
+		{false, token.User{}, false, http.StatusOK},
+		{false, token.User{}, true, http.StatusOK},
+		{true, *paidSubUser, true, http.StatusOK},
+	}
+
+	for i, tt := range tbl {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com", http.NoBody)
+			if tt.setUser {
+				req = token.SetUserInfo(req, tt.user)
+			}
+			w := httptest.NewRecorder()
+			h := subscribersOnly(tt.subsOnly)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+			h.ServeHTTP(w, req)
+			resp := w.Result()
+			assert.Equal(t, tt.status, resp.StatusCode)
+			assert.NoError(t, resp.Body.Close())
+		})
+	}
+}
+
+func Test_validEmailAuth(t *testing.T) {
+	tbl := []struct {
+		req    string
+		status int
+	}{
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone", http.StatusOK},
+		{"/auth/email/login?site=site-with-dash_and_underscore-and.dot&address=umputun%example.com&user=someone", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone+blah", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=Евгений+Умпутун", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=12", http.StatusForbidden},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusForbidden},
+		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someonelooong+loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong", http.StatusForbidden},
+		{"/auth/twitter/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun%example.com", http.StatusOK},
+		{"/auth/email/login?site=remark42&address=umputun+example.com&user=someone", http.StatusForbidden},
+		{"/auth/email/login?site=bad!site&address=umputun%example.com&user=someone", http.StatusForbidden},
+		{"/auth/email/login?site=loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooongsite&address=umputun%example.com&user=someone", http.StatusForbidden},
+	}
+
+	for i, tt := range tbl {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			req := httptest.NewRequest("GET", "http://example.com"+tt.req, http.NoBody)
+			w := httptest.NewRecorder()
+			h := validEmailAuth()(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+			h.ServeHTTP(w, req)
+			resp := w.Result()
+			assert.Equal(t, tt.status, resp.StatusCode)
+			assert.NoError(t, resp.Body.Close())
+		})
+	}
+}
+
+// TestRest_matchSiteID reproduces the multi-tenant isolation gap in the matchSiteID
+// middleware. Before the fix, the check `if siteID != "" && user.SiteID != siteID`
+// silently allowed any authenticated request that omitted the ?site= query param.
+// On admin and user-mutation routes this meant the cross-site check was bypassable
+// just by dropping the parameter. The fix requires ?site= to be present and to match
+// the user's bound site.
+func TestRest_matchSiteID(t *testing.T) {
+	wrapped := matchSiteID(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	}))
+
+	cases := []struct {
+		name     string
+		userSite string
+		query    string
+		want     int
+	}{
+		{name: "matching site allowed", userSite: "site-a", query: "?site=site-a", want: http.StatusOK},
+		{name: "mismatched site forbidden", userSite: "site-a", query: "?site=site-b", want: http.StatusForbidden},
+		{name: "missing site param rejected", userSite: "site-a", query: "", want: http.StatusForbidden},
+		{name: "empty site param rejected", userSite: "site-a", query: "?site=", want: http.StatusForbidden},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				r = rest.SetUserInfo(r, store.User{ID: "u", Name: "u", SiteID: c.userSite})
+				wrapped.ServeHTTP(w, r)
+			})
+			ts := httptest.NewServer(h)
+			defer ts.Close()
+			resp, err := http.Get(ts.URL + c.query)
+			require.NoError(t, err)
+			require.NoError(t, resp.Body.Close())
+			assert.Equal(t, c.want, resp.StatusCode)
+		})
+	}
+}
+
+func TestCorsMiddleware(t *testing.T) {
+	h := corsMiddleware()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	t.Run("credentialed cross-origin reflects the request origin", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/", http.NoBody)
+		req.Header.Set("Origin", "https://example.com")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		// AllowedOrigins "*" with credentials must reflect the origin, never a literal "*"
+		assert.Equal(t, "https://example.com", rec.Header().Get("Access-Control-Allow-Origin"))
+		assert.Equal(t, "true", rec.Header().Get("Access-Control-Allow-Credentials"))
+		assert.Equal(t, "Authorization", rec.Header().Get("Access-Control-Expose-Headers"))
+	})
+
+	t.Run("preflight advertises configured methods, headers and max-age", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodOptions, "/", http.NoBody)
+		req.Header.Set("Origin", "https://example.com")
+		req.Header.Set("Access-Control-Request-Method", "POST")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusNoContent, rec.Code)
+		assert.Contains(t, rec.Header().Get("Access-Control-Allow-Methods"), "POST")
+		assert.Contains(t, rec.Header().Get("Access-Control-Allow-Headers"), "X-JWT")
+		assert.Equal(t, "300", rec.Header().Get("Access-Control-Max-Age"))
+		// preflight responses must vary on origin and the request method/headers so caches
+		// don't reuse one preflight across different requests
+		vary := rec.Header().Values("Vary")
+		assert.Contains(t, vary, "Origin")
+		assert.Contains(t, vary, "Access-Control-Request-Method")
+		assert.Contains(t, vary, "Access-Control-Request-Headers")
+	})
+
+	t.Run("same-origin request (no Origin) gets no CORS headers", func(t *testing.T) {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/", http.NoBody))
+		assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"))
+	})
+}
@@ -74,21 +74,40 @@ func (m *Migrator) importFormCtrl(w http.ResponseWriter, r *http.Request) {
 	}

 	r.Body = http.MaxBytesReader(w, r.Body, 256*1024*1024) // hard cap on upload to prevent memory exhaustion
-	if err := r.ParseMultipartForm(20 * 1024 * 1024); err != nil { // 20M max memory, if bigger will make a file
+	reader, err := r.MultipartReader()
+	if err != nil {
 		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't parse multipart form", rest.ErrDecode)
 		return
 	}

-	file, _, err := r.FormFile("file")
-	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't get import file from the request", rest.ErrInternal)
-		return
-	}
-	defer func() { _ = file.Close() }()
+	tmpfile := ""
+	for {
+		part, err := reader.NextPart()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't parse multipart form", rest.ErrDecode)
+			return
+		}
+		if part.FormName() != "file" {
+			_ = part.Close()
+			continue
+		}

-	tmpfile, err := m.saveTemp(file)
-	if err != nil {
-		rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't save request to temp file", rest.ErrInternal)
+		tmpfile, err = m.saveTemp(part)
+		if closeErr := part.Close(); err == nil && closeErr != nil {
+			err = closeErr
+		}
+		if err != nil {
+			rest.SendErrorJSON(w, r, http.StatusInternalServerError, err, "can't save request to temp file", rest.ErrInternal)
+			return
+		}
+		break
+	}
+	if tmpfile == "" {
+		rest.SendErrorJSON(w, r, http.StatusInternalServerError, fmt.Errorf("file field missing"),
+			"can't get import file from the request", rest.ErrInternal)
 		return
 	}

@@ -7,24 +7,19 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/fs"
+	"net"
 	"net/http"
-	"net/mail"
 	"os"
-	"regexp"
 	"strings"
 	"sync"
 	"time"

-	"github.com/didip/tollbooth/v8"
-	"github.com/didip/tollbooth/v8/limiter"
-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
-	"github.com/go-chi/cors"
 	"github.com/go-pkgz/auth/v2"
 	"github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
 	"github.com/go-pkgz/rest/logger"
+	"github.com/go-pkgz/routegroup"

 	"github.com/umputun/remark42/backend/app/notify"
 	"github.com/umputun/remark42/backend/app/rest"
@@ -54,6 +49,7 @@ type Rest struct {
 	RemarkURL       string
 	ReadOnlyAge     int
 	SharedSecret    string
+	TrustedProxies  []*net.IPNet // reverse-proxy networks whose forwarding headers (X-Real-IP, X-Forwarded-For, ...) are trusted
 	ScoreThresholds struct {
 		Low      int
 		Critical int
@@ -71,10 +67,11 @@ type Rest struct {
 	DisableFancyTextFormatting bool // disables SmartyPants in the comment text rendering of the posted comments
 	ExternalImageProxy         bool

-	SSLConfig   SSLConfig
-	httpsServer *http.Server
-	httpServer  *http.Server
-	lock        sync.Mutex
+	SSLConfig         SSLConfig
+	httpsServer       *http.Server
+	httpServer        *http.Server
+	shutdownRequested bool
+	lock              sync.Mutex

 	pubRest          public
 	privRest         private
@@ -117,6 +114,11 @@ func (s *Rest) Run(address string, port int) {
 		s.lock.Lock()
 		s.httpServer = s.makeHTTPServer(address, port, s.routes())
 		s.httpServer.ErrorLog = log.ToStdLogger(log.Default(), "WARN")
+		if s.shutdownRequested {
+			s.lock.Unlock()
+			log.Print("[WARN] rest server start canceled")
+			return
+		}
 		s.lock.Unlock()

 		err := s.httpServer.ListenAndServe()
@@ -130,6 +132,11 @@ func (s *Rest) Run(address string, port int) {

 		s.httpServer = s.makeHTTPServer(address, port, s.httpToHTTPSRouter())
 		s.httpServer.ErrorLog = log.ToStdLogger(log.Default(), "WARN")
+		if s.shutdownRequested {
+			s.lock.Unlock()
+			log.Print("[WARN] rest server start canceled")
+			return
+		}
 		s.lock.Unlock()

 		go func() {
@@ -150,6 +157,11 @@ func (s *Rest) Run(address string, port int) {

 		s.httpServer = s.makeHTTPServer(address, port, s.httpChallengeRouter(m))
 		s.httpServer.ErrorLog = log.ToStdLogger(log.Default(), "WARN")
+		if s.shutdownRequested {
+			s.lock.Unlock()
+			log.Print("[WARN] rest server start canceled")
+			return
+		}

 		s.lock.Unlock()

@@ -171,6 +183,7 @@ func (s *Rest) Shutdown() {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
 	s.lock.Lock()
+	s.shutdownRequested = true
 	if s.httpServer != nil {
 		if err := s.httpServer.Shutdown(ctx); err != nil {
 			log.Printf("[DEBUG] http shutdown error, %s", err)
@@ -198,13 +211,13 @@ func (s *Rest) makeHTTPServer(address string, port int, router http.Handler) *ht
 	}
 }

-func (s *Rest) routes() chi.Router {
+func (s *Rest) routes() http.Handler {
 	if s.openRouteLimiter == 0 {
 		// set the default open route limiter. Just a safety measure as it should be set by Run method anyway
 		s.openRouteLimiter = openRouteLimiter
 	}
-	router := chi.NewRouter()
-	router.Use(middleware.Throttle(1000), middleware.RealIP, R.Recoverer(log.Default()))
+	router := routegroup.New(http.NewServeMux())
+	router.Use(R.Throttle(1000), realIPMiddleware(s.TrustedProxies), R.Recoverer(log.Default()))
 	router.Use(securityHeadersMiddleware(s.ExternalImageProxy, s.AllowedAncestors))
 	if !s.DisableSignature {
 		router.Use(R.AppInfo("remark42", "umputun", s.Version))
@@ -216,15 +229,7 @@ func (s *Rest) routes() chi.Router {
 	if s.ProxyCORS {
 		log.Printf("[WARN] internal CORS disabled")
 	} else {
-		corsMiddleware := cors.New(cors.Options{
-			AllowedOrigins:   []string{"*"},
-			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-			AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-XSRF-Token", "X-JWT"},
-			ExposedHeaders:   []string{"Authorization"},
-			AllowCredentials: true,
-			MaxAge:           300,
-		})
-		router.Use(corsMiddleware.Handler)
+		router.Use(corsMiddleware())
 	}

 	ipFn := func(ip string) string { return store.HashValue(ip, s.SharedSecret)[:12] } // logger uses it for anonymization
@@ -232,139 +237,152 @@ func (s *Rest) routes() chi.Router {

 	authHandler, avatarHandler := s.Authenticator.Handlers()

-	router.Group(func(r chi.Router) {
-		r.Use(middleware.Timeout(5 * time.Second))
-		r.Use(logInfoWithBody, rateLimiter(2), middleware.NoCache)
+	router.Route(func(r *routegroup.Bundle) {
+		r.Use(R.Timeout(5 * time.Second))
+		r.Use(logInfoWithBody, rateLimiter(2), R.NoCache)
 		r.Use(validEmailAuth()) // reject suspicious email logins
-		r.Mount("/auth", authHandler)
+		r.Handle("/auth/", authHandler)
 	})

-	router.Group(func(r chi.Router) {
-		r.Use(middleware.Timeout(5 * time.Second))
+	router.Route(func(r *routegroup.Bundle) {
+		r.Use(R.Timeout(5 * time.Second))
 		r.Use(rateLimiter(100))
-		r.Mount("/avatar", avatarHandler)
+		r.Handle("/avatar/", avatarHandler)
 	})

 	authMiddleware := s.Authenticator.Middleware()

 	// api routes
-	router.Route("/api/v1", func(rapi chi.Router) {
-		rapi.Use(apiCSPMiddleware)
-		rapi.Group(func(rava chi.Router) {
-			rava.Use(middleware.Timeout(5 * time.Second))
-			rava.Use(rateLimiter(100))
-			rava.Mount("/avatar", avatarHandler)
-		})
+	rapi := router.Mount("/api/v1")
+	rapi.Use(apiCSPMiddleware)

-		// open routes
-		rapi.Group(func(ropen chi.Router) {
-			ropen.Use(middleware.Timeout(30 * time.Second))
-			ropen.Use(rateLimiter(s.openRouteLimiter))
-			ropen.Use(authMiddleware.Trace, middleware.NoCache, logInfoWithBody)
-			ropen.Get("/config", s.configCtrl)
-			ropen.Get("/find", s.pubRest.findCommentsCtrl)
-			ropen.Get("/id/{id}", s.pubRest.commentByIDCtrl)
-			ropen.Get("/comments", s.pubRest.findUserCommentsCtrl)
-			ropen.Get("/last/{limit}", s.pubRest.lastCommentsCtrl)
-			ropen.Get("/count", s.pubRest.countCtrl)
-			ropen.Post("/counts", s.pubRest.countMultiCtrl)
-			ropen.Get("/list", s.pubRest.listCtrl)
-			ropen.Get("/info", s.pubRest.infoCtrl)
+	rapi.Group().Route(func(rava *routegroup.Bundle) {
+		rava.Use(R.Timeout(5 * time.Second))
+		rava.Use(rateLimiter(100))
+		rava.Handle("/avatar/", avatarHandler)
+	})

-			ropen.Route("/rss", func(rrss chi.Router) {
-				rrss.Get("/post", s.rssRest.postCommentsCtrl)
-				rrss.Get("/site", s.rssRest.siteCommentsCtrl)
-				rrss.Get("/reply", s.rssRest.repliesCtrl)
-			})
-		})
+	// open routes
+	rapi.Group().Route(func(ropen *routegroup.Bundle) {
+		ropen.Use(R.Timeout(30 * time.Second))
+		ropen.Use(rateLimiter(s.openRouteLimiter))
+		ropen.Use(authMiddleware.Trace, R.NoCache, logInfoWithBody)
+		ropen.HandleFunc("GET /config", s.configCtrl)
+		ropen.HandleFunc("GET /find", s.pubRest.findCommentsCtrl)
+		ropen.HandleFunc("GET /id/{id}", s.pubRest.commentByIDCtrl)
+		ropen.HandleFunc("GET /comments", s.pubRest.findUserCommentsCtrl)
+		ropen.HandleFunc("GET /last/{limit}", s.pubRest.lastCommentsCtrl)
+		ropen.HandleFunc("GET /count", s.pubRest.countCtrl)
+		ropen.HandleFunc("POST /counts", s.pubRest.countMultiCtrl)
+		ropen.HandleFunc("GET /list", s.pubRest.listCtrl)
+		ropen.HandleFunc("GET /info", s.pubRest.infoCtrl)

-		// open routes, cached. /img lives here (not in the NoCache group above) because
-		// middleware.NoCache strips If-None-Match from incoming requests, which would
-		// defeat the proxy handler's 304 short-circuit. The handler sets a 30-day
-		// max-age on validated success responses (with a versioned etag for cache
-		// invalidation on revalidation); error responses get Cache-Control: no-store
-		// so transient failures aren't pinned in the cache.
-		rapi.Group(func(ropen chi.Router) {
-			ropen.Use(middleware.Timeout(30 * time.Second))
-			ropen.Use(rateLimiter(10))
-			ropen.Use(authMiddleware.Trace, logInfoWithBody)
-			ropen.Get("/img", s.ImageProxy.Handler)
-			ropen.Get("/picture/{user}/{id}", s.pubRest.loadPictureCtrl)
-			ropen.Get("/qr/telegram", s.pubRest.telegramQrCtrl)
-		})
-
-		// protected routes, require auth
-		rapi.Group(func(rauth chi.Router) {
-			rauth.Use(middleware.Timeout(30 * time.Second))
-			rauth.Use(rateLimiter(10))
-			rauth.Use(authMiddleware.Auth, matchSiteID, middleware.NoCache, logInfoWithBody)
-			rauth.Get("/user", s.privRest.userInfoCtrl)
-			rauth.Get("/userdata", s.privRest.userAllDataCtrl)
-		})
-
-		// admin routes, require auth and admin users only
-		rapi.Route("/admin", func(radmin chi.Router) {
-			radmin.Use(middleware.Timeout(30 * time.Second))
-			radmin.Use(rateLimiter(10))
-			radmin.Use(authMiddleware.Auth, authMiddleware.AdminOnly, matchSiteID)
-			radmin.Use(middleware.NoCache, logInfoWithBody)
-
-			radmin.Delete("/comment/{id}", s.adminRest.deleteCommentCtrl)
-			radmin.Put("/user/{userid}", s.adminRest.setBlockCtrl)
-			radmin.Delete("/user/{userid}", s.adminRest.deleteUserCtrl)
-			radmin.Get("/user/{userid}", s.adminRest.getUserInfoCtrl)
-			radmin.Get("/deleteme", s.adminRest.deleteMeRequestCtrl)
-			radmin.Put("/verify/{userid}", s.adminRest.setVerifyCtrl)
-			radmin.Put("/pin/{id}", s.adminRest.setPinCtrl)
-			radmin.Get("/blocked", s.adminRest.blockedUsersCtrl)
-			radmin.Put("/readonly", s.adminRest.setReadOnlyCtrl)
-			radmin.Put("/title/{id}", s.adminRest.setTitleCtrl)
-
-			// migrator
-			radmin.Get("/export", s.adminRest.migrator.exportCtrl)
-			radmin.Post("/import", s.adminRest.migrator.importCtrl)
-			radmin.Post("/import/form", s.adminRest.migrator.importFormCtrl)
-			radmin.Post("/remap", s.adminRest.migrator.remapCtrl)
-			radmin.Get("/wait", s.adminRest.migrator.waitCtrl)
-		})
-
-		// protected routes, throttled to 10/s by default, controlled by external UpdateLimiter param
-		rapi.Group(func(rauth chi.Router) {
-			rauth.Use(middleware.Timeout(10 * time.Second))
-			rauth.Use(rateLimiter(s.updateLimiter()))
-			rauth.Use(authMiddleware.Auth, matchSiteID, subscribersOnly(s.SubscribersOnly))
-			rauth.Use(middleware.NoCache, logInfoWithBody)
-
-			rauth.Put("/comment/{id}", s.privRest.updateCommentCtrl)
-			rauth.Post("/preview", s.privRest.previewCommentCtrl)
-			rauth.Post("/comment", s.privRest.createCommentCtrl)
-			rauth.Put("/vote/{id}", s.privRest.voteCtrl)
-			rauth.With(rejectAnonUser).Post("/deleteme", s.privRest.deleteMeCtrl)
-			rauth.With(rejectAnonUser).Get("/email", s.privRest.getEmailCtrl)
-			rauth.With(rejectAnonUser).Post("/email/subscribe", s.privRest.sendEmailConfirmationCtrl)
-			rauth.With(rejectAnonUser).Post("/email/confirm", s.privRest.setConfirmedEmailCtrl)
-			rauth.With(rejectAnonUser).Delete("/email", s.privRest.deleteEmailCtrl)
-			rauth.With(rejectAnonUser).Get("/telegram/subscribe", s.privRest.telegramSubscribeCtrl)
-			rauth.With(rejectAnonUser).Delete("/telegram", s.privRest.deleteTelegramCtrl)
-		})
-
-		// protected routes, anonymous rejected
-		rapi.Group(func(rauth chi.Router) {
-			rauth.Use(middleware.Timeout(10 * time.Second))
-			rauth.Use(rateLimiter(s.updateLimiter()))
-			rauth.Use(authMiddleware.Auth, rejectAnonUser, matchSiteID)
-			rauth.Use(logger.New(logger.Log(log.Default()), logger.Prefix("[DEBUG]"), logger.IPfn(ipFn)).Handler)
-			rauth.Post("/picture", s.privRest.savePictureCtrl)
+		ropen.Mount("/rss").Route(func(rrss *routegroup.Bundle) {
+			rrss.HandleFunc("GET /post", s.rssRest.postCommentsCtrl)
+			rrss.HandleFunc("GET /site", s.rssRest.siteCommentsCtrl)
+			rrss.HandleFunc("GET /reply", s.rssRest.repliesCtrl)
 		})
 	})

+	// open routes, cached. /img lives here (not in the NoCache group above) because
+	// R.NoCache strips If-None-Match from incoming requests, which would
+	// defeat the proxy handler's 304 short-circuit. The handler sets a 30-day
+	// max-age on validated success responses (with a versioned etag for cache
+	// invalidation on revalidation); error responses get Cache-Control: no-store
+	// so transient failures aren't pinned in the cache.
+	rapi.Group().Route(func(ropen *routegroup.Bundle) {
+		ropen.Use(R.Timeout(30 * time.Second))
+		ropen.Use(rateLimiter(10))
+		ropen.Use(authMiddleware.Trace, logInfoWithBody)
+		ropen.HandleFunc("GET /img", s.ImageProxy.Handler)
+		ropen.HandleFunc("GET /picture/{user}/{id}", s.pubRest.loadPictureCtrl)
+		ropen.HandleFunc("GET /qr/telegram", s.pubRest.telegramQrCtrl)
+	})
+
+	// protected routes, require auth
+	rapi.Group().Route(func(rauth *routegroup.Bundle) {
+		rauth.Use(rateLimiter(10))
+		rauth.Use(authMiddleware.Auth, matchSiteID, R.NoCache, logInfoWithBody)
+
+		// GET /userdata streams a gzipped export of the user's data straight to the client, so it
+		// deliberately runs without R.Timeout: that middleware buffers the whole response in memory
+		// before sending and aborts at the deadline, which would hold a full export in RAM and truncate it.
+		rauth.HandleFunc("GET /userdata", s.privRest.userAllDataCtrl)
+
+		rauth.Group().Route(func(r *routegroup.Bundle) {
+			r.Use(R.Timeout(30 * time.Second))
+			r.HandleFunc("GET /user", s.privRest.userInfoCtrl)
+		})
+	})
+
+	// admin routes, require auth and admin users only
+	rapi.Mount("/admin").Route(func(radmin *routegroup.Bundle) {
+		radmin.Use(rateLimiter(10))
+		radmin.Use(authMiddleware.Auth, authMiddleware.AdminOnly, matchSiteID)
+		radmin.Use(R.NoCache, logInfoWithBody)
+
+		// bounded admin operations return small responses and get the enforcing request timeout
+		radmin.Group().Route(func(r *routegroup.Bundle) {
+			r.Use(R.Timeout(30 * time.Second))
+			r.HandleFunc("DELETE /comment/{id}", s.adminRest.deleteCommentCtrl)
+			r.HandleFunc("PUT /user/{userid}", s.adminRest.setBlockCtrl)
+			r.HandleFunc("DELETE /user/{userid}", s.adminRest.deleteUserCtrl)
+			r.HandleFunc("GET /user/{userid}", s.adminRest.getUserInfoCtrl)
+			r.With(rejectHead("GET")).HandleFunc("GET /deleteme", s.adminRest.deleteMeRequestCtrl)
+			r.HandleFunc("PUT /verify/{userid}", s.adminRest.setVerifyCtrl)
+			r.HandleFunc("PUT /pin/{id}", s.adminRest.setPinCtrl)
+			r.HandleFunc("GET /blocked", s.adminRest.blockedUsersCtrl)
+			r.HandleFunc("PUT /readonly", s.adminRest.setReadOnlyCtrl)
+			r.HandleFunc("PUT /title/{id}", s.adminRest.setTitleCtrl)
+		})
+
+		// migrator routes deliberately run without R.Timeout: GET /export streams a full-site
+		// backup, GET /wait long-polls for up to 15m, and import/remap ingest large uploads. The
+		// enforcing timeout buffers the whole response and aborts at the deadline, which would
+		// truncate backups, break waiting, and reject large imports.
+		radmin.HandleFunc("GET /export", s.adminRest.migrator.exportCtrl)
+		radmin.HandleFunc("POST /import", s.adminRest.migrator.importCtrl)
+		radmin.HandleFunc("POST /import/form", s.adminRest.migrator.importFormCtrl)
+		radmin.HandleFunc("POST /remap", s.adminRest.migrator.remapCtrl)
+		radmin.HandleFunc("GET /wait", s.adminRest.migrator.waitCtrl)
+	})
+
+	// protected routes, throttled to 10/s by default, controlled by external UpdateLimiter param
+	rapi.Group().Route(func(rauth *routegroup.Bundle) {
+		rauth.Use(R.Timeout(10 * time.Second))
+		rauth.Use(rateLimiter(s.updateLimiter()))
+		rauth.Use(authMiddleware.Auth, matchSiteID, subscribersOnly(s.SubscribersOnly))
+		rauth.Use(R.NoCache, logInfoWithBody)
+
+		rauth.HandleFunc("PUT /comment/{id}", s.privRest.updateCommentCtrl)
+		rauth.HandleFunc("POST /preview", s.privRest.previewCommentCtrl)
+		rauth.HandleFunc("POST /comment", s.privRest.createCommentCtrl)
+		rauth.HandleFunc("PUT /vote/{id}", s.privRest.voteCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("POST /deleteme", s.privRest.deleteMeCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("GET /email", s.privRest.getEmailCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("POST /email/subscribe", s.privRest.sendEmailConfirmationCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("POST /email/confirm", s.privRest.setConfirmedEmailCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("DELETE /email", s.privRest.deleteEmailCtrl)
+		rauth.With(rejectAnonUser, rejectHead("GET")).HandleFunc("GET /telegram/subscribe", s.privRest.telegramSubscribeCtrl)
+		rauth.With(rejectAnonUser).HandleFunc("DELETE /telegram", s.privRest.deleteTelegramCtrl)
+	})
+
+	// protected routes, anonymous rejected
+	rapi.Group().Route(func(rauth *routegroup.Bundle) {
+		rauth.Use(R.Timeout(10 * time.Second))
+		rauth.Use(rateLimiter(s.updateLimiter()))
+		rauth.Use(authMiddleware.Auth, rejectAnonUser, matchSiteID)
+		rauth.Use(logger.New(logger.Log(log.Default()), logger.Prefix("[DEBUG]"), logger.IPfn(ipFn)).Handler)
+		rauth.HandleFunc("POST /picture", s.privRest.savePictureCtrl)
+	})
+
 	// open routes on root level
-	router.Group(func(rroot chi.Router) {
-		rroot.Use(middleware.Timeout(10 * time.Second))
+	router.Route(func(rroot *routegroup.Bundle) {
+		rroot.Use(R.Timeout(10 * time.Second))
 		rroot.Use(rateLimiter(50))
-		rroot.Get("/robots.txt", s.pubRest.robotsCtrl)
-		rroot.Get("/email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
-		rroot.Post("/email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
+		rroot.HandleFunc("GET /robots.txt", s.pubRest.robotsCtrl)
+		rroot.With(rejectHead("GET, POST")).HandleFunc("GET /email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
+		rroot.HandleFunc("POST /email/unsubscribe.html", s.privRest.emailUnsubscribeCtrl)
 	})

 	// file server for static content from s.WebRoot on path /web
@@ -482,7 +500,7 @@ func (s *Rest) configCtrl(w http.ResponseWriter, r *http.Request) {
 }

 // serves static files from the webRoot directory or files embedded into the compiled binary if that directory is absent
-func addFileServer(r chi.Router, embedFS embed.FS, webRoot, version string) {
+func addFileServer(r *routegroup.Bundle, embedFS embed.FS, webRoot, version string) {
 	var webFS http.Handler

 	if _, err := os.Stat(webRoot); err == nil {
@@ -495,12 +513,12 @@ func addFileServer(r chi.Router, embedFS embed.FS, webRoot, version string) {
 	}

 	webFS = http.StripPrefix("/web", webFS)
-	r.Get("/web", http.RedirectHandler("/web/", http.StatusMovedPermanently).ServeHTTP)
+	r.HandleFunc("GET /web", http.RedirectHandler("/web/", http.StatusMovedPermanently).ServeHTTP)

 	r.With(rateLimiter(20),
-		middleware.Timeout(10*time.Second),
+		R.Timeout(10*time.Second),
 		cacheControl(time.Hour, version),
-	).Get("/web/*", func(w http.ResponseWriter, r *http.Request) {
+	).HandleFunc("GET /web/", func(w http.ResponseWriter, r *http.Request) {
 		// don't show dirs, just serve files
 		if strings.HasSuffix(r.URL.Path, "/") && len(r.URL.Path) > 1 && r.URL.Path != ("/web/") {
 			http.NotFound(w, r)
@@ -556,192 +574,6 @@ func URLKeyWithUser(r *http.Request) string {
 	return key
 }

-// rejectAnonUser is a middleware rejecting anonymous users
-func rejectAnonUser(next http.Handler) http.Handler {
-	fn := func(w http.ResponseWriter, r *http.Request) {
-		user, err := rest.GetUserInfo(r)
-		if err != nil {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-
-		if strings.HasPrefix(user.ID, "anonymous_") {
-			http.Error(w, "Access denied", http.StatusForbidden)
-			return
-		}
-		next.ServeHTTP(w, r)
-	}
-	return http.HandlerFunc(fn)
-}
-
-// matchSiteID is a middleware rejecting users with mismatch between site param and and User.SiteID
-func matchSiteID(next http.Handler) http.Handler {
-	fn := func(w http.ResponseWriter, r *http.Request) {
-		user, err := rest.GetUserInfo(r)
-		if err != nil {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-
-		// skip for basic auth user
-		if user.Name == "admin" && user.ID == "admin" {
-			next.ServeHTTP(w, r)
-			return
-		}
-
-		siteID := r.URL.Query().Get("site")
-		// require an explicit site so the user.SiteID check below cannot be bypassed
-		// by simply omitting the query parameter
-		if siteID == "" || user.SiteID != siteID {
-			http.Error(w, "Access denied", http.StatusForbidden)
-			return
-		}
-		next.ServeHTTP(w, r)
-	}
-	return http.HandlerFunc(fn)
-}
-
-// cacheControl is a middleware setting cache expiration. Using url+version as etag
-func cacheControl(expiration time.Duration, version string) func(http.Handler) http.Handler {
-	etag := func(r *http.Request, version string) string {
-		s := version + ":" + r.URL.String()
-		return store.EncodeID(s)
-	}
-
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-			e := `"` + etag(r, version) + `"`
-			w.Header().Set("Etag", e)
-			w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d, no-cache", int(expiration.Seconds())))
-
-			if match := r.Header.Get("If-None-Match"); match != "" {
-				if strings.Contains(match, e) {
-					w.WriteHeader(http.StatusNotModified)
-					return
-				}
-			}
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
-// apiCSPMiddleware overrides the global Content-Security-Policy on /api/v1 routes
-// with a strict, default-deny policy. The global CSP (securityHeadersMiddleware) keeps
-// 'self' 'unsafe-inline' for script-src/style-src because the widget HTML pages
-// (/web/*.html) need inline bootstrap blocks. API responses serve JSON, XML/RSS, or
-// images — none of those should ever execute scripts when rendered, so they get the
-// strictest policy available as defense-in-depth against future trust-boundary bugs.
-//
-// Image-serving handlers (/api/v1/img, /api/v1/picture/{user}/{id}) re-apply the same
-// rest.StrictImageCSP value at the handler level and additionally set Content-Disposition:
-// inline; filename="image" (framing the response as a file rather than a renderable
-// document) and X-Content-Type-Options: nosniff. The CSP re-apply is intentional belt-and-
-// braces: if a future route refactor bypasses this middleware, the image handlers still
-// emit the policy.
-func apiCSPMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Security-Policy", rest.StrictImageCSP)
-		next.ServeHTTP(w, r)
-	})
-}
-
-// securityHeadersMiddleware sets security-related headers:
-//   - Content-Security-Policy: controls which resources the browser is allowed to load
-//   - Permissions-Policy: disables browser features (camera, mic, etc.) not needed by a comment widget
-//   - X-Content-Type-Options: prevents browsers from MIME-sniffing responses away from the declared type,
-//     stopping e.g. a user-uploaded image from being reinterpreted as executable HTML/JS
-//   - Referrer-Policy: controls how much URL information leaks in the Referer header on cross-origin
-//     requests; "strict-origin-when-cross-origin" sends only the origin (no path) to other domains
-//     and nothing at all on HTTPS→HTTP downgrades
-func securityHeadersMiddleware(imageProxyEnabled bool, allowedAncestors []string) func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			imgSrc := "*"
-			if imageProxyEnabled {
-				imgSrc = "'self'"
-			}
-			frameAncestors := "*"
-			if len(allowedAncestors) > 0 {
-				frameAncestors = strings.Join(allowedAncestors, " ")
-			}
-			// font-src is set to 'none' (no @font-face / no base64 fonts in the bundle).
-			w.Header().Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; base-uri 'none'; form-action 'none'; connect-src 'self'; frame-src 'self' mailto:; img-src %s; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'none'; object-src 'none'; frame-ancestors %s;", imgSrc, frameAncestors))
-			w.Header().Set("Permissions-Policy", "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=(), window-management=()")
-			w.Header().Set("X-Content-Type-Options", "nosniff")
-			w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
-			next.ServeHTTP(w, r)
-		})
-	}
-}
-
-// subscribersOnly is a middleware rejecting non-paid_sub users
-func subscribersOnly(enable bool) func(http.Handler) http.Handler {
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-			if enable {
-				user, err := rest.GetUserInfo(r)
-				if err != nil {
-					http.Error(w, "Unauthorized", http.StatusUnauthorized)
-					return
-				}
-				if !user.PaidSub {
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
-// validEmailAuth is a middleware for auth endpoints for email method.
-// it rejects login request if user, site or email are suspicious
-func validEmailAuth() func(http.Handler) http.Handler {
-
-	reUser := regexp.MustCompile(`^[\p{L}\d\s_]{4,64}$`) // matches ui side validation, adding min/max limitation
-	reSite := regexp.MustCompile(`^[a-zA-Z\d\s_.-]{1,64}$`)
-
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-
-			if r.URL.Path != "/auth/email/login" {
-				// not email login, skip the check
-				h.ServeHTTP(w, r)
-				return
-			}
-
-			if u := r.URL.Query().Get("user"); u != "" {
-				if !reUser.MatchString(u) {
-					log.Printf("[WARN] suspicious user rejected: %s", u)
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-
-			if a := r.URL.Query().Get("address"); a != "" {
-				if _, err := mail.ParseAddress(a); err != nil {
-					log.Printf("[WARN] suspicious address rejected: %s", a)
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-
-			if s := r.URL.Query().Get("site"); s != "" {
-				if !reSite.MatchString(s) {
-					log.Printf("[WARN] suspicious site rejected: %s", s)
-					http.Error(w, "Access denied", http.StatusForbidden)
-					return
-				}
-			}
-
-			h.ServeHTTP(w, r)
-		}
-		return http.HandlerFunc(fn)
-	}
-}
-
 func parseError(err error, defaultCode int) (code int) {
 	code = defaultCode

@@ -765,16 +597,3 @@ func parseError(err error, defaultCode int) (code int) {

 	return code
 }
-
-// rateLimiter creates a rate limiting middleware with proper IP lookup configuration.
-// tollbooth v8 requires explicit IP lookup method to be set.
-// uses RemoteAddr which is set by chi's middleware.RealIP to the real client IP
-// from X-Forwarded-For, X-Real-IP, or True-Client-IP headers.
-func rateLimiter(maxReq float64) func(http.Handler) http.Handler {
-	lmt := tollbooth.NewLimiter(maxReq, nil)
-	lmt.SetIPLookup(limiter.IPLookup{
-		Name:           "RemoteAddr",
-		IndexFromRight: 0,
-	})
-	return tollbooth.HTTPMiddleware(lmt)
-}
@@ -15,7 +15,6 @@ import (
 	"strings"
 	"time"

-	"github.com/go-chi/chi/v5"
 	"github.com/go-pkgz/auth/v2"
 	"github.com/go-pkgz/auth/v2/token"
 	cache "github.com/go-pkgz/lcw/v2"
@@ -193,7 +192,7 @@ func (s *private) updateCommentCtrl(w http.ResponseWriter, r *http.Request) {

 	user := rest.MustGetUserInfo(r)
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")

 	log.Printf("[DEBUG] update comment %s", id)

@@ -260,7 +259,7 @@ func (s *private) voteCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")}
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	log.Printf("[DEBUG] vote for comment %s", id)

 	vote := r.URL.Query().Get("vote") == "1"
@@ -709,8 +708,9 @@ func (s *private) deleteMeCtrl(w http.ResponseWriter, r *http.Request) {
 			NotBefore: jwt.NewNumericDate(time.Now().Add(-1 * time.Minute)),
 		},
 		User: &token.User{
-			ID:   user.ID,
-			Name: user.Name,
+			ID:      user.ID,
+			Name:    user.Name,
+			Picture: user.Picture, // carried so the avatar can be removed when the request is processed
 			Attributes: map[string]any{
 				"delete_me": true, // prevents this token from being used for login
 			},
@@ -912,6 +912,9 @@ func TestRest_EmailAndTelegram(t *testing.T) {
 		{description: "delete user telegram", url: "/api/v1/telegram?site=remark42", method: http.MethodDelete, responseCode: http.StatusOK},
 		{description: "send another confirmation", url: "/api/v1/telegram/subscribe?site=remark42", method: http.MethodGet, responseCode: http.StatusOK},
 		{description: "set user telegram, token is good", url: "/api/v1/telegram/subscribe?site=remark42&tkn=good_token", method: http.MethodGet, responseCode: http.StatusOK},
+		// telegramSubscribeCtrl mutates state, so HEAD (which stdlib ServeMux would route to the
+		// GET handler) must be rejected by rejectHead before it runs
+		{description: "HEAD is rejected on telegram subscribe", url: "/api/v1/telegram/subscribe?site=remark42", method: http.MethodHead, responseCode: http.StatusMethodNotAllowed},
 	}
 	client := http.Client{}
 	defer client.CloseIdleConnections()
@@ -1509,6 +1512,8 @@ func TestRest_DeleteMe(t *testing.T) {
 	claims, err := srv.Authenticator.TokenService().Parse(tkn)
 	assert.NoError(t, err)
 	assert.Equal(t, "provider1_dev", claims.User.ID)
+	assert.Equal(t, "http://example.com/pic.png", claims.User.Picture,
+		"delete_me token must carry the user's picture so the avatar can be removed when the request is processed")
 	assert.Equal(t, "https://demo.remark42.com/web/deleteme.html?token="+tkn, m["link"])

 	req, err = http.NewRequest(http.MethodPost, fmt.Sprintf("%s/api/v1/deleteme?site=remark42", ts.URL), http.NoBody)
@@ -13,7 +13,6 @@ import (
 	"time"
 	"unicode"

-	"github.com/go-chi/chi/v5"
 	cache "github.com/go-pkgz/lcw/v2"
 	log "github.com/go-pkgz/lgr"
 	R "github.com/go-pkgz/rest"
@@ -188,7 +187,7 @@ func (s *public) lastCommentsCtrl(w http.ResponseWriter, r *http.Request) {
 	siteID := r.URL.Query().Get("site")
 	log.Printf("[DEBUG] get last comments for %s", siteID)

-	limit, err := strconv.Atoi(chi.URLParam(r, "limit"))
+	limit, err := strconv.Atoi(r.PathValue("limit"))
 	if err != nil {
 		limit = 0
 	}
@@ -222,7 +221,7 @@ func (s *public) lastCommentsCtrl(w http.ResponseWriter, r *http.Request) {

 // GET /id/{id}?site=siteID&url=post-url - gets a comment by id
 func (s *public) commentByIDCtrl(w http.ResponseWriter, r *http.Request) {
-	id := chi.URLParam(r, "id")
+	id := r.PathValue("id")
 	siteID := r.URL.Query().Get("site")
 	url := r.URL.Query().Get("url")

@@ -402,7 +401,7 @@ func sendPictureError(w http.ResponseWriter, r *http.Request, status int, err er
 func (s *public) loadPictureCtrl(w http.ResponseWriter, r *http.Request) {
 	rest.SetImageDefenseHeaders(w)

-	user, imgID := chi.URLParam(r, "user"), chi.URLParam(r, "id")
+	user, imgID := r.PathValue("user"), r.PathValue("id")
 	if user == "" || imgID == "" || !safePictureSegment(user) || !safePictureSegment(imgID) {
 		log.Printf("[WARN] rejected picture request with unsafe id segments user=%q id=%q", user, imgID)
 		sendPictureError(w, r, http.StatusBadRequest, fmt.Errorf("invalid picture id"), "invalid picture id", rest.ErrAssetNotFound)
@@ -14,9 +14,9 @@ import (
 	"testing"
 	"time"

-	"github.com/go-chi/chi/v5"
 	cache "github.com/go-pkgz/lcw/v2"
 	R "github.com/go-pkgz/rest"
+	"github.com/go-pkgz/routegroup"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -1044,12 +1044,20 @@ func TestRest_LoadPictureRejectsPathTraversal(t *testing.T) {
 	defer teardown()

 	cases := []struct {
-		name string
-		path string
+		name       string
+		path       string
+		wantStatus int
 	}{
-		{name: "dotdot in user segment", path: "/api/v1/picture/../remark.db"},
-		{name: "dotdot in id segment", path: "/api/v1/picture/dev_user/..%2Fremark.db"},
-		{name: "encoded dotdot in user segment", path: "/api/v1/picture/%2E%2E/remark.db"},
+		// A literal ".." is normalized away by net/http.ServeMux before routing: the request
+		// is redirected to the cleaned path, which matches no picture route, so it never reaches
+		// loadPictureCtrl and resolves to 404. The traversal is neutralized at the router level
+		// (the cleaned path can only ever reach defined routes or the webRoot-bounded file server),
+		// so nothing is served either way.
+		{name: "dotdot in user segment", path: "/api/v1/picture/../remark.db", wantStatus: http.StatusNotFound},
+		// Encoded traversal is not cleaned by the router, so the handler's safePictureSegment
+		// validation is what rejects it, with 400.
+		{name: "dotdot in id segment", path: "/api/v1/picture/dev_user/..%2Fremark.db", wantStatus: http.StatusBadRequest},
+		{name: "encoded dotdot in user segment", path: "/api/v1/picture/%2E%2E/remark.db", wantStatus: http.StatusBadRequest},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -1059,7 +1067,7 @@ func TestRest_LoadPictureRejectsPathTraversal(t *testing.T) {
 			require.NoError(t, err)
 			defer func() { _ = resp.Body.Close() }()

-			assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
+			assert.Equal(t, c.wantStatus, resp.StatusCode)
 			body, err := io.ReadAll(resp.Body)
 			require.NoError(t, err)
 			s := string(body)
@@ -1193,8 +1201,8 @@ func TestRest_LoadPictureRejectsNonImage(t *testing.T) {
 	// (other fields like dataService, cache, commentFormatter are not touched here).
 	p := &public{imageService: image.NewService(&imageStore, image.ServiceParams{})}

-	router := chi.NewRouter()
-	router.Get("/api/v1/picture/{user}/{id}", p.loadPictureCtrl)
+	router := routegroup.New(http.NewServeMux())
+	router.HandleFunc("GET /api/v1/picture/{user}/{id}", p.loadPictureCtrl)
 	ts := httptest.NewServer(router)
 	defer ts.Close()

@@ -68,6 +68,122 @@ func TestRest_FileServer(t *testing.T) {
 	_ = os.Remove(testHTMLFile)
 }

+// TestRest_FileServerStaticAssets covers the static file server behaviors that are
+// sensitive to the router: the bare /web -> /web/ redirect, cache headers applied to
+// served assets, 404 for missing files, and the directory-listing block.
+func TestRest_FileServerStaticAssets(t *testing.T) {
+	ts, srv, teardown := startupT(t)
+	defer teardown()
+
+	require.NoError(t, os.WriteFile(srv.WebRoot+"/asset-test.html", []byte("static body"), 0o600))
+	require.NoError(t, os.MkdirAll(srv.WebRoot+"/subdir-test", 0o700))
+	defer func() {
+		_ = os.Remove(srv.WebRoot + "/asset-test.html")
+		_ = os.RemoveAll(srv.WebRoot + "/subdir-test")
+	}()
+
+	noRedirect := http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	defer noRedirect.CloseIdleConnections()
+
+	t.Run("bare /web redirects to /web/", func(t *testing.T) {
+		resp, err := noRedirect.Get(ts.URL + "/web")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMovedPermanently, resp.StatusCode)
+		assert.Equal(t, "/web/", resp.Header.Get("Location"))
+	})
+
+	t.Run("serves an existing asset with cache headers", func(t *testing.T) {
+		resp, err := noRedirect.Get(ts.URL + "/web/asset-test.html")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		body, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, resp.StatusCode)
+		assert.Equal(t, "static body", string(body))
+		assert.NotEmpty(t, resp.Header.Get("Etag"), "cacheControl must set an Etag on served assets")
+		assert.Contains(t, resp.Header.Get("Cache-Control"), "max-age", "cacheControl must set max-age on served assets")
+	})
+
+	t.Run("missing asset returns 404", func(t *testing.T) {
+		_, code := get(t, ts.URL+"/web/does-not-exist.html")
+		assert.Equal(t, http.StatusNotFound, code)
+	})
+
+	t.Run("directory listing is blocked", func(t *testing.T) {
+		resp, err := noRedirect.Get(ts.URL + "/web/subdir-test/")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusNotFound, resp.StatusCode, "directory listings must be blocked")
+	})
+}
+
+// TestRest_RejectHeadOnDestructiveGET verifies that HEAD is blocked on the state-mutating
+// GET routes (which stdlib http.ServeMux would otherwise route to the GET handler) while
+// still being served for safe, read-only routes.
+func TestRest_RejectHeadOnDestructiveGET(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	client := http.Client{}
+	defer client.CloseIdleConnections()
+
+	t.Run("HEAD is rejected on a destructive GET route", func(t *testing.T) {
+		req, err := http.NewRequest(http.MethodHead, ts.URL+"/api/v1/admin/deleteme?site=remark42", http.NoBody)
+		require.NoError(t, err)
+		req.SetBasicAuth("admin", "password")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, "HEAD must not reach a state-mutating GET handler")
+		assert.Equal(t, "GET", resp.Header.Get("Allow"), "405 must carry an Allow header")
+	})
+
+	t.Run("HEAD is rejected on the email unsubscribe route", func(t *testing.T) {
+		// emailUnsubscribeCtrl deletes the user's email subscription on GET, so HEAD (which
+		// ServeMux would route to the GET handler) must be rejected before it runs
+		resp, err := client.Head(ts.URL + "/email/unsubscribe.html?site=remark42")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, "HEAD must not reach the email-unsubscribe handler")
+		assert.Equal(t, "GET, POST", resp.Header.Get("Allow"), "Allow must list every method the resource supports")
+	})
+
+	t.Run("HEAD still works on a safe read-only route", func(t *testing.T) {
+		resp, err := client.Head(ts.URL + "/api/v1/config?site=remark42")
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD must still be served for safe read-only routes")
+	})
+
+	t.Run("wrong method on a known route returns 405 with Allow", func(t *testing.T) {
+		// method-in-pattern is new under ServeMux; a wrong method on a known route must
+		// still yield 405 with the allowed methods advertised
+		resp, err := client.Post(ts.URL+"/api/v1/config?site=remark42", "application/json", http.NoBody)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		assert.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode)
+		assert.Contains(t, resp.Header.Get("Allow"), "GET", "405 must advertise the allowed methods")
+	})
+}
+
+// TestRest_AvatarMounts verifies both avatar mounts (root /avatar/ and /api/v1/avatar/)
+// still route to the avatar handler after the chi Mount -> ServeMux Handle rewiring,
+// rather than falling through to a router 404.
+func TestRest_AvatarMounts(t *testing.T) {
+	ts, _, teardown := startupT(t)
+	defer teardown()
+
+	for _, path := range []string{"/api/v1/avatar/nonexistent.image", "/avatar/nonexistent.image"} {
+		t.Run(path, func(t *testing.T) {
+			body, code := get(t, ts.URL+path)
+			// the avatar handler responds (403 "can't load avatar"), not a router 404
+			assert.Equal(t, http.StatusForbidden, code, "avatar mount must reach the avatar handler")
+			assert.Contains(t, body, "can't load avatar", "request must reach the avatar handler, not a routing 404")
+		})
+	}
+}
+
 func TestRest_Shutdown(t *testing.T) {
 	srv := Rest{Authenticator: &auth.Service{}, ImageProxy: &proxy.Image{}}
 	done := make(chan bool)
@@ -193,28 +309,6 @@ func TestRest_RunAutocertModeHTTPOnly(t *testing.T) {
 	srv.Shutdown()
 }

-func TestRest_rejectAnonUser(t *testing.T) {
-	ts := httptest.NewServer(fakeAuth(rejectAnonUser(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		fmt.Fprintln(w, "Hello")
-	}))))
-	defer ts.Close()
-
-	resp, err := http.Get(ts.URL)
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode, "use not logged in")
-
-	resp, err = http.Get(ts.URL + "?fake_id=anonymous_user123&fake_name=test")
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusForbidden, resp.StatusCode, "anon rejected")
-
-	resp, err = http.Get(ts.URL + "?fake_id=real_user123&fake_name=test")
-	require.NoError(t, err)
-	require.NoError(t, resp.Body.Close())
-	assert.Equal(t, http.StatusOK, resp.StatusCode, "real user")
-}
-
 func Test_URLKey(t *testing.T) {
 	tbl := []struct {
 		url  string
@@ -284,37 +378,6 @@ func TestRest_parseError(t *testing.T) {
 	}
 }

-func TestRest_cacheControl(t *testing.T) {
-	tbl := []struct {
-		url     string
-		version string
-		exp     time.Duration
-		etag    string
-		maxAge  int
-	}{
-		{"http://example.com/foo", "v1", time.Hour, "b433be1ea19edaee9dc92ca4b895b6bdf3c058cb", 3600},
-		{"http://example.com/foo2", "v1", 10 * time.Hour, "6d8466aef3246c1057452561acddf7ad9d0d99e0", 36000},
-		{"http://example.com/foo", "v2", time.Hour, "481700c52aab0dfbca99f3ffc2a4fbb27884c114", 3600},
-		{"https://example.com/foo", "v2", time.Hour, "bebd4f1b87f474792c4e75e5affe31fbf67f5778", 3600},
-	}
-
-	for i, tt := range tbl {
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", tt.url, http.NoBody)
-			w := httptest.NewRecorder()
-
-			h := cacheControl(tt.exp, tt.version)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, http.StatusOK, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-			t.Logf("%+v", resp.Header)
-			assert.Equal(t, `"`+tt.etag+`"`, resp.Header.Get("Etag"))
-			assert.Equal(t, `max-age=`+strconv.Itoa(int(tt.exp.Seconds()))+", no-cache", resp.Header.Get("Cache-Control"))
-		})
-	}
-}
-
 func TestRest_frameAncestors(t *testing.T) {
 	ts, _, teardown := startupT(t, func(o *Rest) {
 		o.AllowedAncestors = []string{"'self'", "https://example.com"}
@@ -341,138 +404,6 @@ func TestRest_frameAncestors(t *testing.T) {
 	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "frame-ancestors *;")
 }

-// TestRest_apiCSP locks in that /api/v1/* responses get a strict default-src 'none'
-// override regardless of what the global CSP allows. The widget HTML pages
-// (/web/*.html) still get the global CSP (with 'unsafe-inline' for bootstrap),
-// so the test asserts the two policies diverge across origins.
-func TestRest_apiCSP(t *testing.T) {
-	ts, _, teardown := startupT(t)
-	defer teardown()
-	client := http.Client{}
-
-	// JSON API endpoint — must carry the strict policy
-	resp, err := client.Get(ts.URL + "/api/v1/config")
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	csp := resp.Header.Get("Content-Security-Policy")
-	assert.Contains(t, csp, "default-src 'none'",
-		"API responses must override the global CSP with default-src 'none'; got %q", csp)
-	assert.Contains(t, csp, "sandbox", "API CSP must include sandbox; got %q", csp)
-	assert.NotContains(t, csp, "'unsafe-inline'",
-		"API CSP must not allow inline scripts/styles; got %q", csp)
-
-	// RSS/XML endpoint — same strict policy, and the XML response itself must still be served
-	respRSS, err := client.Get(ts.URL + "/api/v1/rss/site?site=remark42")
-	require.NoError(t, err)
-	defer respRSS.Body.Close()
-	assert.Equal(t, http.StatusOK, respRSS.StatusCode, "RSS must still respond OK under strict CSP")
-	cspRSS := respRSS.Header.Get("Content-Security-Policy")
-	assert.Contains(t, cspRSS, "default-src 'none'", "RSS responses must carry the strict API CSP")
-	assert.Contains(t, cspRSS, "sandbox", "RSS CSP must include sandbox")
-
-	// widget HTML — must keep the global CSP (unchanged, lax to support inline bootstrap)
-	resp2, err := client.Get(ts.URL + "/web/index.html")
-	require.NoError(t, err)
-	defer resp2.Body.Close()
-	csp2 := resp2.Header.Get("Content-Security-Policy")
-	assert.Contains(t, csp2, "'unsafe-inline'",
-		"widget HTML CSP must keep unsafe-inline for bootstrap; got %q", csp2)
-}
-
-// check CSP, img-src should be 'self' with proxy enabled and * without it
-func TestRest_securityHeaders(t *testing.T) {
-	ts, _, teardown := startupT(t)
-
-	// with proxy disabled
-	client := http.Client{}
-	resp, err := client.Get(ts.URL + "/web/index.html")
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "img-src *;")
-	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
-	assert.Equal(t, "strict-origin-when-cross-origin", resp.Header.Get("Referrer-Policy"))
-	teardown()
-
-	// check CSP with proxy enabled
-	ts, _, teardown = startupT(t, func(srv *Rest) {
-		srv.ExternalImageProxy = true
-	})
-	defer teardown()
-	resp, err = client.Get(ts.URL + "/web/index.html")
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	assert.Equal(t, http.StatusOK, resp.StatusCode)
-	assert.Contains(t, resp.Header.Get("Content-Security-Policy"), "img-src 'self';")
-	assert.Equal(t, "nosniff", resp.Header.Get("X-Content-Type-Options"))
-	assert.Equal(t, "strict-origin-when-cross-origin", resp.Header.Get("Referrer-Policy"))
-}
-
-func TestRest_subscribersOnly(t *testing.T) {
-	paidSubUser := &token.User{}
-	paidSubUser.SetPaidSub(true)
-
-	tbl := []struct {
-		subsOnly bool
-		user     token.User
-		setUser  bool
-		status   int
-	}{
-		{true, token.User{}, false, http.StatusUnauthorized},
-		{true, token.User{}, true, http.StatusForbidden},
-		{false, token.User{}, false, http.StatusOK},
-		{false, token.User{}, true, http.StatusOK},
-		{true, *paidSubUser, true, http.StatusOK},
-	}
-
-	for i, tt := range tbl {
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", "http://example.com", http.NoBody)
-			if tt.setUser {
-				req = token.SetUserInfo(req, tt.user)
-			}
-			w := httptest.NewRecorder()
-			h := subscribersOnly(tt.subsOnly)(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, tt.status, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-		})
-	}
-}
-
-func Test_validEmailAuth(t *testing.T) {
-	tbl := []struct {
-		req    string
-		status int
-	}{
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone", http.StatusOK},
-		{"/auth/email/login?site=site-with-dash_and_underscore-and.dot&address=umputun%example.com&user=someone", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someone+blah", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=Евгений+Умпутун", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=12", http.StatusForbidden},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusForbidden},
-		{"/auth/email/login?site=remark42&address=umputun%example.com&user=someonelooong+loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong", http.StatusForbidden},
-		{"/auth/twitter/login?site=remark42&address=umputun%example.com&user=..blah+blah", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun%example.com", http.StatusOK},
-		{"/auth/email/login?site=remark42&address=umputun+example.com&user=someone", http.StatusForbidden},
-		{"/auth/email/login?site=bad!site&address=umputun%example.com&user=someone", http.StatusForbidden},
-		{"/auth/email/login?site=loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooongsite&address=umputun%example.com&user=someone", http.StatusForbidden},
-	}
-
-	for i, tt := range tbl {
-		t.Run(strconv.Itoa(i), func(t *testing.T) {
-			req := httptest.NewRequest("GET", "http://example.com"+tt.req, http.NoBody)
-			w := httptest.NewRecorder()
-			h := validEmailAuth()(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
-			h.ServeHTTP(w, req)
-			resp := w.Result()
-			assert.Equal(t, tt.status, resp.StatusCode)
-			assert.NoError(t, resp.Body.Close())
-		})
-	}
-}
-
 // randomPath pick a file or folder name which is not in use for sure
 func randomPath(tempDir, basename, suffix string) (string, error) {
 	for range 10 {
@@ -738,43 +669,3 @@ func TestMain(m *testing.M) {
 		goleak.IgnoreTopFunction("github.com/hashicorp/golang-lru/v2/expirable.NewLRU[...].func1"),
 	)
 }
-
-// TestRest_matchSiteID reproduces the multi-tenant isolation gap in the matchSiteID
-// middleware. Before the fix, the check `if siteID != "" && user.SiteID != siteID`
-// silently allowed any authenticated request that omitted the ?site= query param.
-// On admin and user-mutation routes this meant the cross-site check was bypassable
-// just by dropping the parameter. The fix requires ?site= to be present and to match
-// the user's bound site.
-func TestRest_matchSiteID(t *testing.T) {
-	wrapped := matchSiteID(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("ok"))
-	}))
-
-	cases := []struct {
-		name     string
-		userSite string
-		query    string
-		want     int
-	}{
-		{name: "matching site allowed", userSite: "site-a", query: "?site=site-a", want: http.StatusOK},
-		{name: "mismatched site forbidden", userSite: "site-a", query: "?site=site-b", want: http.StatusForbidden},
-		{name: "missing site param rejected", userSite: "site-a", query: "", want: http.StatusForbidden},
-		{name: "empty site param rejected", userSite: "site-a", query: "?site=", want: http.StatusForbidden},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				r = rest.SetUserInfo(r, store.User{ID: "u", Name: "u", SiteID: c.userSite})
-				wrapped.ServeHTTP(w, r)
-			})
-			ts := httptest.NewServer(h)
-			defer ts.Close()
-			resp, err := http.Get(ts.URL + c.query)
-			require.NoError(t, err)
-			require.NoError(t, resp.Body.Close())
-			assert.Equal(t, c.want, resp.StatusCode)
-		})
-	}
-}
@@ -2,16 +2,16 @@ package api

 import (
 	"crypto/tls"
+	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"

-	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/v5/middleware"
 	log "github.com/go-pkgz/lgr"
-	"golang.org/x/crypto/acme/autocert"
-
 	R "github.com/go-pkgz/rest"
+	"github.com/go-pkgz/routegroup"
+	"golang.org/x/crypto/acme/autocert"
 )

 // sslMode defines ssl mode for rest server
@@ -40,13 +40,13 @@ type SSLConfig struct {

 // httpToHTTPSRouter creates new router which does redirect from http to https server
 // with default middlewares. Used in 'static' ssl mode.
-func (s *Rest) httpToHTTPSRouter() chi.Router {
-	log.Printf("[DEBUG] create https-to-http redirect routes")
-	router := chi.NewRouter()
-	router.Use(middleware.RealIP, R.Recoverer(log.Default()))
-	router.Use(middleware.Throttle(1000), middleware.Timeout(60*time.Second))
+func (s *Rest) httpToHTTPSRouter() http.Handler {
+	log.Printf("[DEBUG] create http-to-https redirect routes")
+	router := routegroup.New(http.NewServeMux())
+	router.Use(R.Recoverer(log.Default()))
+	router.Use(R.Throttle(1000), R.Timeout(60*time.Second))

-	router.Handle("/*", s.redirectHandler())
+	router.Handle("/", s.redirectHandler())
 	return router
 }

@@ -54,26 +54,45 @@ func (s *Rest) httpToHTTPSRouter() chi.Router {
 // with default middlewares. This part is necessary to obtain certificate from LE.
 // If it receives not a acme challenge it performs redirect to https server.
 // Used in 'auto' ssl mode.
-func (s *Rest) httpChallengeRouter(m *autocert.Manager) chi.Router {
+func (s *Rest) httpChallengeRouter(m *autocert.Manager) http.Handler {
 	log.Printf("[DEBUG] create http-challenge routes")
-	router := chi.NewRouter()
-	router.Use(middleware.RealIP, R.Recoverer(log.Default()))
-	router.Use(middleware.Throttle(1000), middleware.Timeout(60*time.Second))
+	router := routegroup.New(http.NewServeMux())
+	router.Use(R.Recoverer(log.Default()))
+	router.Use(R.Throttle(1000), R.Timeout(60*time.Second))

-	router.Handle("/*", m.HTTPHandler(s.redirectHandler()))
+	router.Handle("/", m.HTTPHandler(s.redirectHandler()))
 	return router
 }

 func (s *Rest) redirectHandler() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		newURL := s.RemarkURL + r.URL.Path
-		if r.URL.RawQuery != "" {
-			newURL += "?" + r.URL.RawQuery
+		newURL, err := s.redirectURL(r)
+		if err != nil {
+			log.Printf("[WARN] failed to build redirect URL, %s", err)
+			http.Error(w, "invalid redirect URL", http.StatusInternalServerError)
+			return
 		}
 		http.Redirect(w, r, newURL, http.StatusTemporaryRedirect)
 	})
 }

+func (s *Rest) redirectURL(r *http.Request) (string, error) {
+	baseURL, err := url.Parse(s.RemarkURL)
+	if err != nil {
+		return "", fmt.Errorf("parse remark URL: %w", err)
+	}
+	if baseURL.Scheme != "http" && baseURL.Scheme != "https" || baseURL.Host == "" {
+		return "", fmt.Errorf("remark URL must be absolute HTTP(S) URL")
+	}
+
+	basePath := strings.TrimRight(baseURL.Path, "/")
+	requestPath := "/" + strings.TrimLeft(r.URL.Path, "/")
+	baseURL.Path = basePath + requestPath
+	baseURL.RawQuery = r.URL.RawQuery
+	baseURL.Fragment = ""
+	return baseURL.String(), nil
+}
+
 func (s *Rest) makeAutocertManager() *autocert.Manager {
 	return &autocert.Manager{
 		Prompt:     autocert.AcceptTOS,
@@ -40,6 +40,16 @@ func TestSSL_Redirect(t *testing.T) {
 	assert.Equal(t, "https://localhost:443/blah?param=1", resp.Header.Get("Location"))
 }

+func TestSSL_RedirectURLKeepsConfiguredHost(t *testing.T) {
+	rest := Rest{RemarkURL: "https://localhost:443/base"}
+	req, err := http.NewRequest("GET", "http://example.com//evil.test/path?next=//evil.test", http.NoBody)
+	require.NoError(t, err)
+
+	redirectURL, err := rest.redirectURL(req)
+	require.NoError(t, err)
+	assert.Equal(t, "https://localhost:443/base/evil.test/path?next=//evil.test", redirectURL)
+}
+
 func TestSSL_ACME_HTTPChallengeRouter(t *testing.T) {
 	rest := Rest{
 		RemarkURL: "https://localhost:443",
@@ -3,6 +3,7 @@ package engine
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -10,6 +11,7 @@ import (
 	log "github.com/go-pkgz/lgr"
 	"github.com/hashicorp/go-multierror"
 	bolt "go.etcd.io/bbolt"
+	berrors "go.etcd.io/bbolt/errors"

 	"github.com/umputun/remark42/backend/app/store"
 )
@@ -893,31 +895,26 @@ func (b *BoltDB) deleteUser(bdb *bolt.DB, siteID, userID string, mode store.Dele
 	// delete collected comments
 	for _, ci := range comments {
 		if e := b.deleteComment(bdb, ci.locator, ci.commentID, mode); e != nil {
-			return fmt.Errorf("failed to delete comment %+v: %w", ci, err)
+			return fmt.Errorf("failed to delete comment %+v: %w", ci, e)
 		}
 	}

-	// delete user bucket in hard mode
+	// delete the user's bucket in hard mode. A user who only logged in but never commented has
+	// no per-user bucket, so tolerate ErrBucketNotFound; the top-level users bucket is created
+	// by NewBoltDB and is always present.
 	if mode == store.HardDelete {
 		err = bdb.Update(func(tx *bolt.Tx) error {
 			usersBkt := tx.Bucket([]byte(userBucketName))
-			if usersBkt != nil {
-				if e := usersBkt.DeleteBucket([]byte(userID)); e != nil {
-					return fmt.Errorf("failed to delete user bucket for %s: %w", userID, err)
-				}
+			if e := usersBkt.DeleteBucket([]byte(userID)); e != nil && !errors.Is(e, berrors.ErrBucketNotFound) {
+				return fmt.Errorf("failed to delete user bucket for %s: %w", userID, e)
 			}
 			return nil
 		})
-
 		if err != nil {
 			return fmt.Errorf("can't delete user meta: %w", err)
 		}
 	}

-	if len(comments) == 0 {
-		return fmt.Errorf("unknown user %s", userID)
-	}
-
 	return b.deleteUserDetail(bdb, userID, AllUserDetails)
 }

@@ -843,6 +843,63 @@ func TestBoltAdmin_DeleteUserHard(t *testing.T) {
 	assert.EqualError(t, err, `site "radio-t-bad" not found`)
 }

+// TestBoltAdmin_DeleteUserHard_NoComments covers hard-deleting a user who has no comments
+// (and therefore no user bucket) — e.g. one who only logged in. This must succeed rather than
+// fail on the missing bucket, and must still remove any stored user details.
+func TestBoltAdmin_DeleteUserHard_NoComments(t *testing.T) {
+	b, teardown := prep(t)
+	defer teardown()
+
+	t.Run("login-only user with a detail but no comments", func(t *testing.T) {
+		const userID = "login-only-user"
+		loc := store.Locator{SiteID: "radio-t"}
+
+		// user logged in and has a stored detail, but never commented (no user bucket)
+		_, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail, Update: "user@example.com"})
+		require.NoError(t, err)
+
+		err = b.Delete(DeleteRequest{Locator: loc, UserID: userID, DeleteMode: store.HardDelete})
+		require.NoError(t, err, "hard delete must not fail on a missing user bucket")
+
+		details, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail})
+		require.NoError(t, err)
+		assert.Empty(t, details, "stored user detail must be removed on hard delete")
+	})
+
+	t.Run("unknown user is a no-op", func(t *testing.T) {
+		err := b.Delete(DeleteRequest{Locator: store.Locator{SiteID: "radio-t"}, UserID: "never-seen-user", DeleteMode: store.HardDelete})
+		assert.NoError(t, err, "hard-deleting an unknown user must not error")
+	})
+}
+
+// TestBoltAdmin_DeleteUserSoft_NoComments covers soft-deleting a user with no comments. As with the
+// hard path (and the existing soft path for users who do have comments) it cleans stored user
+// details and is a no-op for an unknown user.
+func TestBoltAdmin_DeleteUserSoft_NoComments(t *testing.T) {
+	b, teardown := prep(t)
+	defer teardown()
+
+	t.Run("login-only user with a detail but no comments", func(t *testing.T) {
+		const userID = "login-only-soft"
+		loc := store.Locator{SiteID: "radio-t"}
+
+		_, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail, Update: "user@example.com"})
+		require.NoError(t, err)
+
+		err = b.Delete(DeleteRequest{Locator: loc, UserID: userID, DeleteMode: store.SoftDelete})
+		require.NoError(t, err)
+
+		details, err := b.UserDetail(UserDetailRequest{Locator: loc, UserID: userID, Detail: UserEmail})
+		require.NoError(t, err)
+		assert.Empty(t, details, "soft delete cleans stored user details, consistent with the has-comments path")
+	})
+
+	t.Run("unknown user is a no-op", func(t *testing.T) {
+		err := b.Delete(DeleteRequest{Locator: store.Locator{SiteID: "radio-t"}, UserID: "never-seen-soft", DeleteMode: store.SoftDelete})
+		assert.NoError(t, err, "soft-deleting an unknown user must not error")
+	})
+}
+
 func TestBoltAdmin_DeleteUserSoft(t *testing.T) {
 	b, teardown := prep(t)
 	defer teardown()
@@ -5,17 +5,16 @@ go 1.25.0
 require (
 	github.com/Depado/bfchroma/v2 v2.0.0
 	github.com/PuerkitoBio/goquery v1.12.0
-	github.com/alecthomas/chroma/v2 v2.24.1
+	github.com/alecthomas/chroma/v2 v2.27.0
 	github.com/didip/tollbooth/v8 v8.0.1
-	github.com/go-chi/chi/v5 v5.2.5
-	github.com/go-chi/cors v1.2.2
-	github.com/go-pkgz/auth/v2 v2.1.4
+	github.com/go-pkgz/auth/v2 v2.1.5
 	github.com/go-pkgz/jrpc v0.4.0
 	github.com/go-pkgz/lcw/v2 v2.0.0
 	github.com/go-pkgz/lgr v0.12.3
 	github.com/go-pkgz/notify v1.3.0
 	github.com/go-pkgz/repeater/v2 v2.2.0
-	github.com/go-pkgz/rest v1.21.0
+	github.com/go-pkgz/rest v1.22.0
+	github.com/go-pkgz/routegroup v1.6.0
 	github.com/go-pkgz/syncs v1.3.2
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
@@ -28,46 +27,45 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stretchr/testify v1.11.1
-	go.etcd.io/bbolt v1.4.3
+	go.etcd.io/bbolt v1.5.0
 	go.uber.org/goleak v1.3.0
-	golang.org/x/crypto v0.51.0
-	golang.org/x/image v0.40.0
-	golang.org/x/net v0.54.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/image v0.43.0
+	golang.org/x/net v0.56.0
 	golang.org/x/oauth2 v0.36.0
 )

 require (
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	github.com/andybalholm/cascadia v1.3.3 // indirect
+	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dghubble/oauth1 v0.7.3 // indirect
-	github.com/dlclark/regexp2 v1.12.0 // indirect
+	github.com/dlclark/regexp2/v2 v2.2.2 // indirect
 	github.com/go-oauth2/oauth2/v4 v4.5.4 // indirect
 	github.com/go-pkgz/email v0.6.0 // indirect
 	github.com/go-pkgz/expirable-cache/v3 v3.1.0 // indirect
 	github.com/go-pkgz/repeater v1.2.0 // indirect
-	github.com/go-pkgz/routegroup v1.6.0 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/montanaflynn/stats v0.9.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/redis/go-redis/v9 v9.19.0 // indirect
+	github.com/redis/go-redis/v9 v9.21.0 // indirect
 	github.com/rrivera/identicon v0.0.0-20240116195454-d5ba35832c0d // indirect
-	github.com/slack-go/slack v0.23.1 // indirect
+	github.com/slack-go/slack v0.27.0 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
 	github.com/xdg-go/scram v1.2.0 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -8,8 +8,8 @@ github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
 github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
-github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO85qeSydJtItA4T55Pw6BtAejd0APRJOCE=
@@ -18,8 +18,8 @@ github.com/alicebob/miniredis/v2 v2.31.1 h1:7XAt0uUg3DtwEKW5ZAGa+K7FZV2DdKQo5K/6
 github.com/alicebob/miniredis/v2 v2.31.1/go.mod h1:UB/T2Uztp7MlFSDakaX1sTXUv5CASoprx0wulRT6HBg=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
-github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kktS1LM=
-github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
+github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
+github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -34,20 +34,16 @@ github.com/dghubble/oauth1 v0.7.3 h1:EkEM/zMDMp3zOsX2DC/ZQ2vnEX3ELK0/l9kb+vs4ptE
 github.com/dghubble/oauth1 v0.7.3/go.mod h1:oxTe+az9NSMIucDPDCCtzJGsPhciJV33xocHfcR2sVY=
 github.com/didip/tollbooth/v8 v8.0.1 h1:VAAapTo1t4Bn6bbpcHjuovwoa9u3JH++wgjbpWv+rB8=
 github.com/didip/tollbooth/v8 v8.0.1/go.mod h1:oEd9l+ep373d7DmvKLc0a5gasPOev2mTewi6KPQBGJ4=
-github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
-github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2/v2 v2.2.2 h1:MYWvNYw8okuqNhwTYO587EZMiDruVa2vhV6fsGpfya0=
+github.com/dlclark/regexp2/v2 v2.2.2/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/gavv/httpexpect v2.0.0+incompatible h1:1X9kcRshkSKEjNJJxX9Y9mQ5BRfbxU5kORdjhlA1yX8=
 github.com/gavv/httpexpect v2.0.0+incompatible/go.mod h1:x+9tiU1YnrOvnB725RkpoLv1M62hOWzwo5OXotisrKc=
-github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
-github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
-github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
-github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-oauth2/oauth2/v4 v4.5.4 h1:YjI0tmGW8oxVhn9QSBIxlr641QugWrJY5UWa6XmLcW0=
 github.com/go-oauth2/oauth2/v4 v4.5.4/go.mod h1:BXiOY+QZtZy2ewbsGk2B5P8TWmtz/Rf7ES5ZttQFxfQ=
-github.com/go-pkgz/auth/v2 v2.1.4 h1:bCF0vMscOrShF2gelcvKPgskpwQNGCk6AQcoXOf2kbE=
-github.com/go-pkgz/auth/v2 v2.1.4/go.mod h1:IvxxhJIrwd1hKqFwQgBF9i+sMTmGfzAw66wmhw1zfJc=
+github.com/go-pkgz/auth/v2 v2.1.5 h1:CFL7XxRMNPga0S0YCnAnlvO61OHHEYvVEGrIZXuA98Y=
+github.com/go-pkgz/auth/v2 v2.1.5/go.mod h1:IvxxhJIrwd1hKqFwQgBF9i+sMTmGfzAw66wmhw1zfJc=
 github.com/go-pkgz/email v0.6.0 h1:snZnXldjeF4PgKSjnx9Fa25mtOgFpAOEeWvnQvrxjLE=
 github.com/go-pkgz/email v0.6.0/go.mod h1:+wgi4x7S33IuCzfcCM5euN0GwQG6XvO/PBLxrNffYLI=
 github.com/go-pkgz/expirable-cache/v3 v3.1.0 h1:s05P851/O6QJ6Mc+7o2bh9aGtD3romB1SxDTXifdoqc=
@@ -64,8 +60,8 @@ github.com/go-pkgz/repeater v1.2.0 h1:oJFvjyKdTDd5RCzpzxlzYIZFFj6Zfl17rE1aUfu6Uj
 github.com/go-pkgz/repeater v1.2.0/go.mod h1:vypP6xamA53MFmafnGUucqOmALKk36xgKu2hSG73LHM=
 github.com/go-pkgz/repeater/v2 v2.2.0 h1:8nZR/NaknmLfx2YMHbr78u9OL4Xj+8+romm9dz4FpMg=
 github.com/go-pkgz/repeater/v2 v2.2.0/go.mod h1:RgX5vUbLKq7PV82QUDP5pFbQS1os4Z+U9XzKymK23A8=
-github.com/go-pkgz/rest v1.21.0 h1:Y/C4d/TpclJJDxqnH1RAcS6Hmox0RIReAlkwMcUWXK4=
-github.com/go-pkgz/rest v1.21.0/go.mod h1:+AHzjHazq7Z3Tk/kRWOhbbAz/YZlUV40feC1Hf4NtbE=
+github.com/go-pkgz/rest v1.22.0 h1:d3XFKlmAGBiU9MQER9/n46iXpyUr8IQUtfjU8JlqkkY=
+github.com/go-pkgz/rest v1.22.0/go.mod h1:+AHzjHazq7Z3Tk/kRWOhbbAz/YZlUV40feC1Hf4NtbE=
 github.com/go-pkgz/routegroup v1.6.0 h1:44XHZgF6JIIldRlv+zjg6SygULASmjifnfIQjwCT0e4=
 github.com/go-pkgz/routegroup v1.6.0/go.mod h1:Pmu04fhgWhRtBMIJ8HXppnnzOPjnL/IEPBIdO2zmeqg=
 github.com/go-pkgz/syncs v1.3.2 h1:gmioASlJNy3gNosPlgvWOM2QP0Hdjzn2u+/sUShgd8E=
@@ -76,7 +72,6 @@ github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63Y
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
 github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
@@ -106,8 +101,8 @@ github.com/jessevdk/go-flags v1.6.1 h1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bB
 github.com/jessevdk/go-flags v1.6.1/go.mod h1:Mk8T1hIAWpOiJiHa9rJASDK2UGWji0EuPGBnNLMooyc=
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -124,8 +119,8 @@ github.com/moul/http2curl v1.0.0 h1:dRMWoAtb+ePxMlLkrCbAqh4TlPHXvoGUSQ323/9Zahs=
 github.com/moul/http2curl v1.0.0/go.mod h1:8UbvGypXm98wA/IqH45anm5Y2Z6ep6O31QGOAZ3H0fQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/redis/go-redis/v9 v9.19.0 h1:XPVaaPSnG6RhYf7p+rmSa9zZfeVAnWsH5h3lxthOm/k=
-github.com/redis/go-redis/v9 v9.19.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=
+github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rrivera/identicon v0.0.0-20240116195454-d5ba35832c0d h1:l3+2LWCbVxn5itfvXAfH9n4YL9jh8l1g5zcncbIc1cs=
@@ -138,8 +133,8 @@ github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
-github.com/slack-go/slack v0.23.1 h1:ZS5B96wxxYQRwvJ3/vJFtqtUZi3tXhsZCyT44Nv7M80=
-github.com/slack-go/slack v0.23.1/go.mod h1:H0yR/YBuRJ39RkE+JpV/d/oEsbanzTRowR82bCN0cEs=
+github.com/slack-go/slack v0.27.0 h1:VWOpUzOK6UAPCCQlFxl79jhv8a/b+GOSJMnWziDJ8B8=
+github.com/slack-go/slack v0.27.0/go.mod h1:UEe+jmo9WLlwHB04qsOrTDvqM7Aa4rQL3O5wF3n0hx4=
 github.com/smartystreets/assertions v1.1.0 h1:MkTeG1DMwsrdH7QtLXy5W+fUxWq+vmb6cLmyJ7aRtF0=
 github.com/smartystreets/assertions v1.1.0/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
 github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
@@ -191,8 +186,8 @@ github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
-go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
 go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
 go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
@@ -201,81 +196,40 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
-golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -1,89 +1,122 @@
+version: "2"
 run:
  tests: true
-
 output:
-  print-issued-lines: false
-
+  show-stats: false
+  formats:
+    text:
+      print-issued-lines: false
+      colors: true
 linters:
-  enable-all: true
+  default: all
  disable:
-    - lll
-    - gocyclo
-    - dupl
-    - gochecknoglobals
-    - funlen
-    - godox
-    - wsl
-    - gocognit
-    - nolintlint
-    - testpackage
-    - godot
-    - nestif
-    - paralleltest
-    - nlreturn
-    - cyclop
-    - gci
-    - gofumpt
-    - errorlint
    - exhaustive
-    - wrapcheck
-    - stylecheck
-    - thelper
-    - nonamedreturns
-    - revive
-    - dupword
-    - exhaustruct
-    - varnamelen
-    - forcetypeassert
-    - ireturn
-    - maintidx
-    - govet
-    - testableexamples
-    - musttag
+    - prealloc
+    - dupl
+    - godoclint
+    - cyclop
    - depguard
-    - goconst
-    - perfsprint
+    - dupword
+    - err113
+    - errname
+    - errorlint
+    - exhaustruct
+    - forbidigo
+    - forcetypeassert
+    - funlen
+    - gochecknoglobals
+    - gocognit
+    - gocritic
+    - gocyclo
+    - godot
+    - godox
+    - gomoddirectives
+    - ireturn
+    - lll
+    - maintidx
    - mnd
+    - nakedret
+    - nestif
+    - nilnil
+    - nlreturn
+    - nolintlint
+    - nonamedreturns
+    - paralleltest
+    - perfsprint
    - predeclared
    - recvcheck
-    - tenv
-    - err113
-
-linters-settings:
-  gocyclo:
-    min-complexity: 10
-  dupl:
-    threshold: 100
-  goconst:
-    min-len: 8
-    min-occurrences: 3
-  forbidigo:
-    #forbid:
-    #  - (Must)?NewLexer$
-    exclude_godoc_examples: false
-
-
+    - revive
+    - testpackage
+    - varnamelen
+    - wastedassign
+    - whitespace
+    - wsl
+    - wsl_v5
+    - funcorder
+    - noinlineerr
+    - tagalign
+    - goconst
+    - gochecknoinits
+    - durationcheck
+    - embeddedstructfieldcheck
+    - wrapcheck
+    - gomodguard
+  settings:
+    dupl:
+      threshold: 100
+    exhaustive:
+      default-signifies-exhaustive: true
+    goconst:
+      min-len: 8
+      min-occurrences: 3
+    gocyclo:
+      min-complexity: 10
+    wrapcheck:
+      report-internal-errors: false
+      ignore-package-globs:
+        - github.com/alecthomas/errors
+  exclusions:
+    generated: lax
+    rules:
+      - path: (.+)\.go$
+        text: "^(G104|G204|G307|G304):"
+      - path: (.+)\.go$
+        text: Error return value of .(.*\.Help|.*\.MarkFlagRequired|(os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*printf?|os\.(Un)?Setenv). is not checked
+      - path: (.+)\.go$
+        text: exported method `(.*\.MarshalJSON|.*\.UnmarshalJSON|.*\.EntityURN|.*\.GoString|.*\.Pos)` should have comment or be unexported
+      - path: (.+)\.go$
+        text: uses unkeyed fields
+      - path: (.+)\.go$
+        text: declaration of "err" shadows declaration
+      - path: (.+)\.go$
+        text: bad syntax for struct tag key
+      - path: (.+)\.go$
+        text: bad syntax for struct tag pair
+      - path: (.+)\.go$
+        text: ^ST1012
+      - path: (.+)\.go$
+        text: log/slog.Logger.*must not be called
+      - path: (.+)_test\.go$
+        text: error returned from external package is unwrapped
+      - linters: [staticcheck]
+        text: QF1008
+      - text: "Error return value of `.*.Write` is not checked"
+        linters: [errcheck]
+        path: (.+)_test\.go$
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  exclude-dirs:
-    - _examples
-  max-per-linter: 0
-  max-same: 0
-  exclude-use-default: false
-  exclude:
-    # Captured by errcheck.
-    - '^(G104|G204):'
-    # Very commonly not checked.
-    - 'Error return value of .(.*\.Help|.*\.MarkFlagRequired|(os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*printf?|os\.(Un)?Setenv). is not checked'
-    - 'exported method (.*\.MarshalJSON|.*\.UnmarshalJSON|.*\.EntityURN|.*\.GoString|.*\.Pos) should have comment or be unexported'
-    - 'composite literal uses unkeyed fields'
-    - 'declaration of "err" shadows declaration'
-    - 'should not use dot imports'
-    - 'Potential file inclusion via variable'
-    - 'should have comment or be unexported'
-    - 'comment on exported var .* should be of the form'
-    - 'at least one file in a package should have a package comment'
-    - 'string literal contains the Unicode'
-    - 'methods on the same type should have the same receiver name'
-    - '_TokenType_name should be _TokenTypeName'
-    - '`_TokenType_map` should be `_TokenTypeMap`'
-    - 'rewrite if-else to switch statement'
+  max-issues-per-linter: 0
+  max-same-issues: 0
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
@@ -1,6 +1,6 @@
 Chroma is a syntax highlighting library, tool and web playground for Go. It is based on Pygments and includes importers for it, so most of the same concepts from Pygments apply to Chroma.

-This project is written in Go, uses Hermit to manage tooling, and Just for helper commands. Helper scripts are in ./scripts.
+This project is written in Go, uses Hermit to manage tooling, and Just for helper commands. Helper tooling is primarily in ./_tools.

 Language definitions are XML files defined in ./lexers/embedded/*.xml.

@@ -0,0 +1,93 @@
+let version = exec("git describe --tags --dirty --always") | trim
+# TinyGo's installation root; used to source `wasm_exec.js`.
+let tinygoroot = exec("tinygo env TINYGOROOT") | trim
+
+
+# Generate tokentype_enumer.go from types.go via `//go:generate`.
+tokentype = go.generate {
+  package = "."
+  inputs = ["types.go"]
+  outputs = ["tokentype_enumer.go"]
+}
+
+# Regenerate the lexer table in README.md by invoking the host `chroma` binary.
+# GOOS/GOARCH are cleared so cross-compile env vars don't break the local run.
+protected readme = exec {
+  command = "./table.py"
+  inputs = ["table.py", "lexers/**/*.go", "lexers/**/*.xml"]
+  output = "README.md"
+}
+
+# Format frontend JS sources in place. Runs as a sub-step of `index-min-js`,
+# so bundling always sees formatted sources.
+format-js = exec {
+  command = "biome format --write cmd/chromad/static/index.js cmd/chromad/static/chroma.js"
+  inputs = ["biome.js", "cmd/chromad/static/index.js", "cmd/chromad/static/chroma.js"]
+}
+
+# Copy TinyGo's wasm_exec.js into the chromad static assets.
+wasm-exec = exec {
+  command = "install -m644 '#{tinygoroot}/targets/wasm_exec.js' cmd/chromad/static/wasm_exec.js"
+  resolve = "sha256 '#{tinygoroot}/targets/wasm_exec.js'"
+  output = "cmd/chromad/static/wasm_exec.js"
+}
+
+# Build the chroma WASM module via tinygo (installed via hermit) for the
+# smaller output binary.
+chroma-wasm = exec {
+  command = "tinygo build -no-debug -target wasm -o cmd/chromad/static/chroma.wasm cmd/libchromawasm/main.go"
+  inputs = ["cmd/libchromawasm/**/*.go", "*.go", "lexers/**/*.go", "lexers/**/*.xml", "formatters/**/*.go", "styles/**/*.go"]
+  output = "cmd/chromad/static/chroma.wasm"
+}
+
+# Bundle and minify the frontend JS. Depends on `format-js` so the bundle
+# always reflects formatted sources.
+index-min-js = exec {
+  command = "esbuild --platform=browser --format=esm --bundle cmd/chromad/static/index.js --minify --external:./wasm_exec.js --outfile=cmd/chromad/static/index.min.js"
+  inputs = ["cmd/chromad/static/index.js", "cmd/chromad/static/chroma.js"]
+  output = "cmd/chromad/static/index.min.js"
+  depends_on = [format-js]
+}
+
+# Bundle and minify the frontend CSS.
+index-min-css = exec {
+  command = "esbuild --bundle cmd/chromad/static/index.css --minify --outfile=cmd/chromad/static/index.min.css"
+  inputs = ["cmd/chromad/static/index.css", "cmd/chromad/static/bulma.css"]
+  output = "cmd/chromad/static/index.min.css"
+}
+
+# Build the chromad server binary. cmd/chromad is a separate Go module, so
+# `dir` puts the build in there and `package = "."` resolves against that
+# module. `output` stays project-root-relative; bit absolutises it before
+# passing to `go build -o`. Defaults to linux/amd64 to match the deploy
+# target; override with GOOS/GOARCH env vars for local builds.
+chromad = go.exe {
+  dir = "cmd/chromad"
+  package = "."
+  output = "build/chromad"
+  flags = ["-ldflags", "-X 'main.version=#{version}'"]
+  goos = env("GOOS", "linux")
+  goarch = env("GOARCH", "amd64")
+  cgo = false
+  depends_on = [wasm-exec, chroma-wasm, index-min-js, index-min-css, test]
+}
+
+pre format-go = go.fmt {
+	package = "./..."
+}
+
+# Run Go tests.
+test = go.test {
+	package = "./..."
+}
+
+# Deploy chromad to swapoff.org. Must be explicitly selected.
+explicit upload = exec {
+  command = <<-EOF
+    scp #{chromad.path} root@swapoff.org:
+    ssh root@swapoff.org 'install -m755 ./chromad /srv/http/swapoff.org/bin && service chromad restart'
+  EOF
+  depends_on = [chromad]
+}
+
+target default = [test, chromad, readme, tokentype]
@@ -1,24 +0,0 @@
-VERSION = %(git describe --tags --dirty  --always)%
-export CGOENABLED = 0
-
-tokentype_enumer.go: types.go
-  build: go generate
-
-# Regenerate the list of lexers in the README
-README.md: lexers/*.go lexers/*/*.xml table.py
-  build: ./table.py
-  -clean
-
-implicit %{1}%{2}.min.%{3}: **/*.{css,js}
-  build: esbuild --bundle %{IN} --minify --outfile=%{OUT}
-
-implicit build/%{1}: cmd/*
-  cd cmd/%{1}
-  inputs: cmd/%{1}/**/* **/*.go
-  build: go build -ldflags="-X 'main.version=%{VERSION}'" -o ../../build/%{1} .
-
-#upload: chromad
-#  build:
-#    scp chromad root@swapoff.org:
-#    ssh root@swapoff.org 'install -m755 ./chromad /srv/http/swapoff.org/bin && service chromad restart'
-#    touch upload
@@ -28,7 +28,7 @@ ENV GOARCH=amd64
 RUN just chromad

 # Runtime stage
-FROM alpine:3.23 AS runtime
+FROM alpine:3.24 AS runtime

 # Install ca-certificates for HTTPS requests
 RUN apk --no-cache add ca-certificates curl
@@ -1,4 +1,4 @@
-set positional-arguments := true
+set positional-arguments
 set shell := ["bash", "-c"]

 version := `git describe --tags --dirty --always`
@@ -21,6 +21,10 @@ tokentype-string:
 format-js:
    biome format --write cmd/chromad/static/index.js cmd/chromad/static/chroma.js

+# Tidy Go modules
+tidy:
+    find . -name 'go.mod' -execdir go mod tidy \;
+
 # Build chromad binary
 chromad: wasm-exec chroma-wasm
    #!/usr/bin/env bash
@@ -36,25 +36,25 @@ translators for Pygments lexers and styles.

 | Prefix | Language
 | :----: | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-|   A    | ABAP, ABNF, ActionScript, ActionScript 3, Ada, Agda, AL, Alloy, AMPL, Angular2, ANTLR, ApacheConf, APL, AppleScript, ArangoDB AQL, Arduino, ArmAsm, ATL, AutoHotkey, AutoIt, Awk
+|   A    | ABAP, ABNF, ActionScript, ActionScript 3, Ada, Agda, AL, Alloy, AMPL, Angular2, ANTLR, ApacheConf, APL, AppleScript, ArangoDB AQL, Arduino, ArmAsm, Arturo, ATL, AutoHotkey, AutoIt, Awk
 |   B    | Ballerina, Bash, Bash Session, Batchfile, Beef, BibTeX, Bicep, BlitzBasic, BNF, BQN, Brainfuck
 |   C    | C, C#, C++, C3, Caddyfile, Caddyfile Directives, Cap'n Proto, Cassandra CQL, Ceylon, CFEngine3, cfstatement, ChaiScript, Chapel, Cheetah, Clojure, CMake, COBOL, CoffeeScript, Common Lisp, Coq, Core, Crystal, CSS, CSV, CUE, Cython
-|   D    | D, Dart, Dax, Desktop file, Diff, Django/Jinja, dns, Docker, DTD, Dylan
-|   E    | EBNF, Elixir, Elm, EmacsLisp, Erlang
+|   D    | D, Dart, Dax, Desktop file, Devicetree, Diff, Django/Jinja, dns, Docker, DTD, Dylan
+|   E    | EBNF, Elixir, Elm, EmacsLisp, ERB, Erlang
 |   F    | Factor, Fennel, Fish, Forth, Fortran, FortranFixed, FSharp
 |   G    | GAS, GDScript, GDScript3, Gemtext, Genshi, Genshi HTML, Genshi Text, Gettext, Gherkin, Gleam, GLSL, Gnuplot, Go, Go HTML Template, Go Template, Go Text Template, GraphQL, Groff, Groovy
 |   H    | Handlebars, Hare, Haskell, Haxe, HCL, Hexdump, HLB, HLSL, HolyC, HTML, HTTP, Hy
 |   I    | Idris, Igor, INI, Io, ISCdhcpd
 |   J    | J, Janet, Java, JavaScript, JSON, JSONata, Jsonnet, Julia, Jungle
-|   K    | Kakoune, Kotlin
-|   L    | Lean4, Lighttpd configuration file, LLVM, lox, Lua, Luau
-|   M    | Makefile, Mako, markdown, Markless, Mason, Materialize SQL dialect, Mathematica, Matlab, MCFunction, Meson, Metal, MiniZinc, MLIR, Modelica, Modula-2, Mojo, MonkeyC, MoonScript, MorrowindScript, Myghty, MySQL
+|   K    | Kakoune, KDL, Kotlin
+|   L    | Lateralus, Lean4, Lighttpd configuration file, LilyPond, LLVM, lox, Lua, Luau
+|   M    | Makefile, Mako, markdown, Markless, Mason, Materialize SQL dialect, Mathematica, Matlab, MCFunction, Meson, Metal, microcad, MiniZinc, MLIR, Modelica, Modula-2, Mojo, MonkeyC, MoonBit, MoonScript, MorrowindScript, Myghty, MySQL
 |   N    | NASM, Natural, NDISASM, Newspeak, Nginx configuration file, Nim, Nix, NSIS, Nu
 |   O    | Objective-C, ObjectPascal, OCaml, Octave, Odin, OnesEnterprise, OpenEdge ABL, OpenSCAD, Org Mode
 |   P    | PacmanConf, Perl, PHP, PHTML, Pig, PkgConfig, PL/pgSQL, plaintext, Plutus Core, Pony, PostgreSQL SQL dialect, PostScript, POVRay, PowerQuery, PowerShell, Prolog, Promela, PromQL, properties, Protocol Buffer, Protocol Buffer Text Format, PRQL, PSL, Puppet, Python, Python 2
 |   Q    | QBasic, QML
 |   R    | R, Racket, Ragel, Raku, react, ReasonML, reg, Rego, reStructuredText, Rexx, RGBDS Assembly, Ring, RPGLE, RPMSpec, Ruby, Rust
-|   S    | SAS, Sass, Scala, Scheme, Scilab, SCSS, Sed, Sieve, Smali, Smalltalk, Smarty, SNBT, Snobol, Solidity, SourcePawn, Spade, SPARQL, SQL, SquidConf, Standard ML, stas, Stylus, Svelte, Swift, SYSTEMD, systemverilog
+|   S    | SAS, Sass, Scala, scdoc, Scheme, Scilab, SCSS, Sed, Sieve, Smali, Smalltalk, Smarty, SNBT, Snobol, Solidity, SourcePawn, Spade, SPARQL, SQL, SquidConf, Standard ML, stas, Stylus, Svelte, Swift, SYSTEMD, systemverilog
 |   T    | TableGen, Tal, TASM, Tcl, Tcsh, Termcap, Terminfo, Terraform, TeX, Thrift, TOML, TradingView, Transact-SQL, Turing, Turtle, Twig, TypeScript, TypoScript, TypoScriptCssData, TypoScriptHtmlData, Typst
 |   U    | ucode
 |   V    | V, V shell, Vala, VB.net, verilog, VHDL, VHS, VimL, vue
@@ -276,6 +276,8 @@ for that setup the `chroma` executable can be just symlinked to `~/.lessfilter`.
  its input using Chroma
 * [Hugo](https://gohugo.io/) is a static site generator that [uses Chroma for syntax
  highlighting code examples](https://gohugo.io/content-management/syntax-highlighting/)
+* [f4](https://github.com/unxed/f4) is asynchronious cross platform Far Manager clone in Go
+  that uses Chroma for syntax highlighting in built-in editor

 ## Testing lexers

@@ -52,7 +52,7 @@ type Colour int32

 // NewColour creates a Colour directly from RGB values.
 func NewColour(r, g, b uint8) Colour {
-	return ParseColour(fmt.Sprintf("%02x%02x%02x", r, g, b))
+	return Colour(int32(r)<<16|int32(g)<<8|int32(b)) + 1
 }

 // Distance between this colour and another.
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"html"
 	"io"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -83,6 +84,11 @@ func WithPreWrapper(wrapper PreWrapper) Option {
 	}
 }

+// WithModeClasses adds the style's mode (eg. "light" or "dark") as a CSS
+// class on wrapper elements and scopes WriteCSS rules by mode. This enables
+// combining light and dark stylesheets and switching themes at runtime.
+func WithModeClasses(b bool) Option { return func(f *Formatter) { f.modeClasses = b } }
+
 // WrapLongLines wraps long lines.
 func WrapLongLines(b bool) Option {
 	return func(f *Formatter) {
@@ -206,6 +212,7 @@ type Formatter struct {
 	inlineCode            bool
 	preventSurroundingPre bool
 	tabWidth              int
+	modeClasses           bool
 	wrapLongLines         bool
 	lineNumbers           bool
 	lineNumbersInTable    bool
@@ -241,7 +248,7 @@ func (f *Formatter) writeHTML(w io.Writer, style *chroma.Style, tokens []chroma.
 			fmt.Fprintf(w, "body { %s; }\n", css[chroma.Background])
 			fmt.Fprint(w, "</style>")
 		}
-		fmt.Fprintf(w, "<body%s>\n", f.styleAttr(css, chroma.Background))
+		fmt.Fprintf(w, "<body%s>\n", f.styleAttrWithMode(css, chroma.Background, style))
 	}

 	wrapInTable := f.lineNumbers && f.lineNumbersInTable
@@ -252,10 +259,10 @@ func (f *Formatter) writeHTML(w io.Writer, style *chroma.Style, tokens []chroma.

 	if wrapInTable {
 		// List line numbers in its own <td>
-		fmt.Fprintf(w, "<div%s>\n", f.styleAttr(css, chroma.PreWrapper))
+		fmt.Fprintf(w, "<div%s>\n", f.styleAttrWithMode(css, chroma.PreWrapper, style))
 		fmt.Fprintf(w, "<table%s><tr>", f.styleAttr(css, chroma.LineTable))
 		fmt.Fprintf(w, "<td%s>\n", f.styleAttr(css, chroma.LineTableTD))
-		fmt.Fprintf(w, "%s", f.preWrapper.Start(false, f.styleAttr(css, chroma.PreWrapper)))
+		fmt.Fprintf(w, "%s", f.preWrapper.Start(false, f.styleAttrWithMode(css, chroma.PreWrapper, style)))
 		for index := range lines {
 			line := f.baseLineNumber + index
 			highlight, next := f.shouldHighlight(highlightIndex, line)
@@ -277,7 +284,7 @@ func (f *Formatter) writeHTML(w io.Writer, style *chroma.Style, tokens []chroma.
 		fmt.Fprintf(w, "<td%s>\n", f.styleAttr(css, chroma.LineTableTD, "width:100%"))
 	}

-	fmt.Fprintf(w, "%s", f.preWrapper.Start(true, f.styleAttr(css, chroma.PreWrapper)))
+	fmt.Fprintf(w, "%s", f.preWrapper.Start(true, f.styleAttrWithMode(css, chroma.PreWrapper, style)))

 	highlightIndex = 0
 	for index, tokens := range lines {
@@ -288,7 +295,7 @@ func (f *Formatter) writeHTML(w io.Writer, style *chroma.Style, tokens []chroma.
 			highlightIndex++
 		}

-		if !(f.preventSurroundingPre || f.inlineCode) {
+		if !f.preventSurroundingPre && !f.inlineCode {
 			// Start of Line
 			fmt.Fprint(w, `<span`)

@@ -321,7 +328,7 @@ func (f *Formatter) writeHTML(w io.Writer, style *chroma.Style, tokens []chroma.
 			fmt.Fprint(w, html)
 		}

-		if !(f.preventSurroundingPre || f.inlineCode) {
+		if !f.preventSurroundingPre && !f.inlineCode {
 			fmt.Fprint(w, `</span>`) // End of CodeLine

 			fmt.Fprint(w, `</span>`) // End of Line
@@ -414,6 +421,26 @@ func (f *Formatter) styleAttr(styles map[chroma.TokenType]string, tt chroma.Toke
 	return fmt.Sprintf(` style="%s"`, strings.Join(css, ";"))
 }

+// modeClass returns the CSS class corresponding to the style's mode (eg.
+// "light" or "dark"), with the formatter's class prefix applied.
+func (f *Formatter) modeClass(style *chroma.Style) string {
+	return f.prefix + style.Mode().String()
+}
+
+// styleAttrWithMode is like styleAttr but, in classes mode, appends the
+// style's mode class alongside the existing class. Used for the outer
+// wrapper and standalone <body> so external CSS can target the mode.
+func (f *Formatter) styleAttrWithMode(styles map[chroma.TokenType]string, tt chroma.TokenType, style *chroma.Style) string {
+	if !f.Classes || !f.modeClasses {
+		return f.styleAttr(styles, tt)
+	}
+	cls := f.class(tt)
+	if cls == "" {
+		return ""
+	}
+	return fmt.Sprintf(` class="%s %s"`, cls, f.modeClass(style))
+}
+
 func (f *Formatter) tabWidthStyle() string {
 	if f.tabWidth != 0 && f.tabWidth != 8 {
 		return fmt.Sprintf("-moz-tab-size: %[1]d; -o-tab-size: %[1]d; tab-size: %[1]d;", f.tabWidth)
@@ -437,20 +464,38 @@ func (f *Formatter) writeCSSRule(w io.Writer, comment string, selector string, s
 }

 // WriteCSS writes CSS style definitions (without any surrounding HTML).
+//
+// Rules are scoped by the style's mode (eg. ".chroma.dark") so that CSS
+// generated from a light and dark style can be combined without conflict.
+// To support dynamic theme switching, call WriteCSS with both styles,
+// concatenate the output, and toggle the wrapper's mode class (added
+// automatically by Format) at runtime. Tokens that one theme leaves
+// unstyled fall back to that theme's ".chroma.<mode>" text/background
+// via the CSS cascade; pass WithAllClasses(true) if you need every
+// token's rule materialised explicitly for both themes.
 func (f *Formatter) WriteCSS(w io.Writer, style *chroma.Style) error {
 	css := f.styleCache.get(style, false)
+	var chromaSel, bgSel string
+	if f.modeClasses {
+		modeCls := f.modeClass(style)
+		chromaSel = fmt.Sprintf(".%schroma.%s", f.prefix, modeCls)
+		bgSel = fmt.Sprintf(".%sbg.%s", f.prefix, modeCls)
+	} else {
+		chromaSel = fmt.Sprintf(".%schroma", f.prefix)
+		bgSel = fmt.Sprintf(".%sbg", f.prefix)
+	}

 	// Special-case background as it is mapped to the outer ".chroma" class.
-	if err := f.writeCSSRule(w, chroma.Background.String(), fmt.Sprintf(".%sbg", f.prefix), css[chroma.Background]); err != nil {
+	if err := f.writeCSSRule(w, chroma.Background.String(), bgSel, css[chroma.Background]); err != nil {
 		return err
 	}
 	// Special-case PreWrapper as it is the ".chroma" class.
-	if err := f.writeCSSRule(w, chroma.PreWrapper.String(), fmt.Sprintf(".%schroma", f.prefix), css[chroma.PreWrapper]); err != nil {
+	if err := f.writeCSSRule(w, chroma.PreWrapper.String(), chromaSel, css[chroma.PreWrapper]); err != nil {
 		return err
 	}
 	// Special-case code column of table to expand width.
 	if f.lineNumbers && f.lineNumbersInTable {
-		selector := fmt.Sprintf(".%schroma .%s:last-child", f.prefix, f.class(chroma.LineTableTD))
+		selector := fmt.Sprintf("%s .%s:last-child", chromaSel, f.class(chroma.LineTableTD))
 		if err := f.writeCSSRule(w, chroma.LineTableTD.String(), selector, "width: 100%;"); err != nil {
 			return err
 		}
@@ -460,7 +505,7 @@ func (f *Formatter) WriteCSS(w io.Writer, style *chroma.Style) error {
 		targetedLineCSS := StyleEntryToCSS(style.Get(chroma.LineHighlight))
 		for _, tt := range []chroma.TokenType{chroma.LineNumbers, chroma.LineNumbersTable} {
 			comment := fmt.Sprintf("%s targeted by URL anchor", tt)
-			selector := fmt.Sprintf(".%schroma .%s:target", f.prefix, f.class(tt))
+			selector := fmt.Sprintf("%s .%s:target", chromaSel, f.class(tt))
 			if err := f.writeCSSRule(w, comment, selector, targetedLineCSS); err != nil {
 				return err
 			}
@@ -481,7 +526,7 @@ func (f *Formatter) WriteCSS(w io.Writer, style *chroma.Style) error {
 		if class == "" {
 			continue
 		}
-		if err := f.writeCSSRule(w, tt.String(), fmt.Sprintf(".%schroma .%s", f.prefix, class), css[tt]); err != nil {
+		if err := f.writeCSSRule(w, tt.String(), fmt.Sprintf("%s .%s", chromaSel, class), css[tt]); err != nil {
 			return err
 		}
 	}
@@ -613,8 +658,7 @@ func (l *styleCache) get(style *chroma.Style, compress bool) map[chroma.TokenTyp
 	defer l.mu.Unlock()

 	// Look for an existing entry.
-	for i := len(l.cache) - 1; i >= 0; i-- {
-		entry := l.cache[i]
+	for i, entry := range slices.Backward(l.cache) {
 		if entry.style == style && entry.compressed == compress {
 			// Top of the cache, no need to adjust the order.
 			if i == len(l.cache)-1 {
@@ -0,0 +1,119 @@
+
+<lexer>
+  <config>
+    <name>Arturo</name>
+    <alias>arturo</alias>
+    <alias>art</alias>
+    <filename>*.art</filename>
+  </config>
+  <rules>
+    <state name="root">
+      <rule pattern=";.*?$"><token type="CommentSingle"/></rule>
+      <rule pattern="^((\s#!)|(#!)).*?$"><token type="CommentHashbang"/></rule>
+      <rule pattern="(false|true|maybe)\b"><token type="NameConstant"/></rule>
+      <rule pattern="\b(this|init)\b\??:?"><token type="NameBuiltinPseudo"/></rule>
+      <rule pattern="`.`"><token type="LiteralStringChar"/></rule>
+      <rule pattern="\\\w+\b\??:?"><token type="NameProperty"/></rule>
+      <rule pattern="#\w+"><token type="NameConstant"/></rule>
+      <rule pattern="\b[0-9]+\.[0-9]+"><token type="LiteralNumberFloat"/></rule>
+      <rule pattern="\b[0-9]+"><token type="LiteralNumberInteger"/></rule>
+      <rule pattern="\w+\b\??:"><token type="NameLabel"/></rule>
+      <rule pattern="\&#x27;(?:\w+\b\??:?)"><token type="KeywordDeclaration"/></rule>
+      <rule pattern="\:\w+"><token type="KeywordType"/></rule>
+      <rule pattern="\.\w+\??:?"><token type="NameAttribute"/></rule>
+      <rule pattern="(\()(.*?)(\)\?)"><bygroups><token type="Punctuation"/><usingself state="root"/><token type="Punctuation"/></bygroups></rule>
+      <rule pattern="&quot;"><token type="LiteralStringDouble"/><push state="inside-simple-string"/></rule>
+      <rule pattern="»"><token type="LiteralStringSingle"/><push state="inside-smart-string"/></rule>
+      <rule pattern="«««"><token type="LiteralStringDouble"/><push state="inside-safe-string"/></rule>
+      <rule pattern="\{\/"><token type="LiteralStringSingle"/><push state="inside-regex-string"/></rule>
+      <rule pattern="\{\:"><token type="LiteralStringDouble"/><push state="inside-curly-verb-string"/></rule>
+      <rule pattern="(\{)(\!)(\w+)(\s|\n)([\w\W]*?)(^\})">
+        <usingbygroup>
+          <sublexer_name_group>3</sublexer_name_group>
+          <code_group>5</code_group>
+          <emitters>
+            <token type="LiteralStringDouble"/>
+            <token type="LiteralStringInterpol"/>
+            <token type="LiteralStringInterpol"/>
+            <token type="TextWhitespace"/>
+            <token type="LiteralString"/>
+            <token type="LiteralStringDouble"/>
+          </emitters>
+        </usingbygroup>
+      </rule>
+      <rule pattern="\{"><token type="LiteralStringSingle"/><push state="inside-curly-string"/></rule>
+      <rule pattern="\-{3,}"><token type="LiteralStringSingle"/><push state="inside-eof-string"/></rule>
+      <rule><include state="builtin-functions"/></rule>
+      <rule pattern="[()[\],]"><token type="Punctuation"/></rule>
+      <rule pattern="(\-&gt;|==&gt;|\||::|@|\#|\$|\&amp;|!|!!|\./)"><token type="NameDecorator"/></rule>
+      <rule pattern="(&lt;:|:&gt;|:&lt;|&gt;:|&lt;\\|&lt;&gt;|&lt;|&gt;|ø|∞|\+|\-|\*|\~|=|\^|%|/|//|==&gt;|&lt;=&gt;|&lt;==&gt;|=&gt;&gt;|&lt;&lt;=&gt;&gt;|&lt;&lt;==&gt;&gt;|\-\-&gt;|&lt;\-&gt;|&lt;\-\-&gt;|=\||\|=|\-:|:\-|_|\.|\.\.|\\)"><token type="Operator"/></rule>
+      <rule pattern="\b\w+"><token type="Name"/></rule>
+      <rule pattern="\s+"><token type="TextWhitespace"/></rule>
+      <rule pattern=".+$"><token type="Error"/></rule>
+    </state>
+    <state name="inside-interpol">
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><pop depth="1"/></rule>
+      <rule pattern="[^|]+"><usingself state="root"/></rule>
+    </state>
+    <state name="inside-template">
+      <rule pattern="\|\|\&gt;"><token type="LiteralStringInterpol"/><pop depth="1"/></rule>
+      <rule pattern="[^|]+"><usingself state="root"/></rule>
+    </state>
+    <state name="string-escape">
+      <rule pattern="(\\\\|\\n|\\t|\\&quot;)"><token type="LiteralStringEscape"/></rule>
+    </state>
+    <state name="inside-simple-string">
+      <rule><include state="string-escape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="&quot;"><token type="LiteralStringDouble"/><pop depth="1"/></rule>
+      <rule pattern="[^|&quot;]+"><token type="LiteralString"/></rule>
+    </state>
+    <state name="inside-smart-string">
+      <rule><include state="string-escape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="\n"><token type="LiteralStringSingle"/><pop depth="1"/></rule>
+      <rule pattern="[^|\n]+"><token type="LiteralString"/></rule>
+    </state>
+    <state name="inside-safe-string">
+      <rule><include state="string-escape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="»»»"><token type="LiteralStringDouble"/><pop depth="1"/></rule>
+      <rule pattern="[^|»]+"><token type="LiteralString"/></rule>
+    </state>
+    <state name="inside-regex-string">
+      <rule pattern="\\[sSwWdDbBZApPxucItnvfr0]+"><token type="LiteralStringEscape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="\/\}"><token type="LiteralStringSingle"/><pop depth="1"/></rule>
+      <rule pattern="[^|\/]+"><token type="LiteralStringRegex"/></rule>
+    </state>
+    <state name="inside-curly-verb-string">
+      <rule><include state="string-escape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="\:\}"><token type="LiteralStringDouble"/><pop depth="1"/></rule>
+      <rule pattern="[^|&lt;:]+"><token type="LiteralString"/></rule>
+    </state>
+    <state name="inside-curly-string">
+      <rule><include state="string-escape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="\}"><token type="LiteralStringSingle"/><pop depth="1"/></rule>
+      <rule pattern="[^|&lt;}]+"><token type="LiteralString"/></rule>
+    </state>
+    <state name="inside-eof-string">
+      <rule><include state="string-escape"/></rule>
+      <rule pattern="\|"><token type="LiteralStringInterpol"/><push state="inside-interpol"/></rule>
+      <rule pattern="\&lt;\|\|"><token type="LiteralStringInterpol"/><push state="inside-template"/></rule>
+      <rule pattern="\Z"><token type="LiteralStringSingle"/><pop depth="1"/></rule>
+      <rule pattern="[^|&lt;]+"><token type="LiteralString"/></rule>
+    </state>
+    <state name="builtin-functions">
+      <rule pattern="\b(all|and|any|ascii|attr|attribute|attributeLabel|binary|blockchar|contains|database|date|dictionary|empty|equal|even|every|exists|false|floatin|function|greater|greaterOrEqual|if|in|inline|integer|is|key|label|leap|less|lessOrEqual|literal|logical|lower|nand|negative|nor|not|notEqual|null|numeric|odd|or|path|pathLabel|positive|prefix|prime|set|some|sorted|standalone|string|subset|suffix|superset|ymbol|true|try|type|unless|upper|when|whitespace|word|xnor|xor|zero)\b\?"><token type="NameBuiltin"/></rule>
+      <rule pattern="\b(abs|acos|acosh|acsec|acsech|actan|actanh|add|after|alphabet|and|angle|append|arg|args|arity|array|as|asec|asech|asin|asinh|atan|atan2|atanh|attr|attrs|average|before|benchmark|blend|break|builtins1|builtins2|call|capitalize|case|ceil|chop|chunk|clear|close|cluster|color|combine|conj|continue|copy|cos|cosh|couple|csec|csech|ctan|ctanh|cursor|darken|dec|decode|decouple|define|delete|desaturate|deviation|dictionary|difference|digest|digits|div|do|download|drop|dup|e|else|empty|encode|ensure|env|epsilon|escape|execute|exit|exp|extend|extract|factors|false|fdiv|filter|first|flatten|floor|fold|from|function|gamma|gcd|get|goto|hash|help|hypot|if|in|inc|indent|index|infinity|info|input|insert|inspect|intersection|invert|join|keys|kurtosis|last|let|levenshtein|lighten|list|ln|log|loop|lower|mail|map|match|max|maybe|median|min|mod|module|mul|nand|neg|new|nor|normalize|not|now|null|open|or|outdent|pad|panic|path|pause|permissions|permutate|pi|pop|pow|powerset|powmod|prefix|print|prints|process|product|query|random|range|read|relative|remove|rename|render|repeat|replace|request|return|reverse|round|sample|saturate|script|sec|sech|select|serve|set|shl|shr|shuffle|sin|sinh|size|skewness|slice|sort|split|sqrt|squeeze|stack|strip|sub|suffix|sum|switch|symbols|symlink|sys|take|tan|tanh|terminal|to|true|truncate|try|type|union|unique|unless|until|unzip|upper|values|var|variance|volume|webview|while|with|wordwrap|write|xnor|xor|zip)\b"><token type="NameBuiltin"/></rule>
+    </state>
+  </rules>
+</lexer>
@@ -81,7 +81,7 @@
      <rule pattern="[^\S\n]+">
        <token type="Text"/>
      </rule>
-      <rule pattern="//.*?\n">
+      <rule pattern="//[^\n]*\n?">
        <token type="CommentSingle"/>
      </rule>
      <rule pattern="/\*.*?\*/">
@@ -0,0 +1,81 @@
+<lexer>
+  <config>
+    <name>Gemfile.lock</name>
+    <alias>gemfile-lock</alias>
+    <alias>gemfilelock</alias>
+    <filename>Gemfile.lock</filename>
+    <filename>*.gemfile.lock</filename>
+  </config>
+  <rules>
+    <state name="root">
+      <rule pattern="^(GIT|PATH|GEM|PLUGIN SOURCE|PLATFORMS|DEPENDENCIES|BUNDLED WITH|RUBY VERSION|CHECKSUMS)$">
+        <token type="Keyword"/>
+      </rule>
+      <rule pattern="^([ \t]+)(remote|revision|ref|branch|tag|submodules|specs|glob)(:)">
+        <bygroups>
+          <token type="Text"/>
+          <token type="NameAttribute"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="\(">
+        <token type="Punctuation"/>
+        <push state="version"/>
+      </rule>
+      <rule pattern="!">
+        <token type="Operator"/>
+      </rule>
+      <rule pattern="https?://\S+">
+        <token type="LiteralStringSymbol"/>
+      </rule>
+      <rule pattern="git@\S+">
+        <token type="LiteralStringSymbol"/>
+      </rule>
+      <rule pattern="sha\d+=[A-Fa-f0-9]+">
+        <token type="LiteralNumberHex"/>
+      </rule>
+      <rule pattern="\b[a-f0-9]{7,40}\b">
+        <token type="LiteralNumberHex"/>
+      </rule>
+      <rule pattern="\b\d[\w.]*">
+        <token type="LiteralNumber"/>
+      </rule>
+      <rule pattern="[A-Za-z_][A-Za-z0-9_.-]*">
+        <token type="Name"/>
+      </rule>
+      <rule pattern="\n">
+        <token type="Text"/>
+      </rule>
+      <rule pattern="[ \t]+">
+        <token type="Text"/>
+      </rule>
+      <rule pattern=".">
+        <token type="Text"/>
+      </rule>
+    </state>
+    <state name="version">
+      <rule pattern="\)">
+        <token type="Punctuation"/>
+        <pop depth="1"/>
+      </rule>
+      <rule pattern="(~&gt;|&gt;=|&lt;=|!=|=|&lt;|&gt;)">
+        <token type="Operator"/>
+      </rule>
+      <rule pattern="[0-9][\w.]*">
+        <token type="LiteralNumber"/>
+      </rule>
+      <rule pattern="[A-Za-z][\w.-]*">
+        <token type="Name"/>
+      </rule>
+      <rule pattern=",">
+        <token type="Punctuation"/>
+      </rule>
+      <rule pattern="\s+">
+        <token type="Text"/>
+      </rule>
+      <rule pattern=".">
+        <token type="Text"/>
+      </rule>
+    </state>
+  </rules>
+</lexer>
@@ -32,7 +32,7 @@
        pattern="(assert|break|case|catch|continue|default|do|else|finally|for|if|goto|instanceof|new|return|switch|this|throw|try|while)\b">
        <token type="Keyword" />
      </rule>
-      <rule pattern="((?:(?:[^\W\d]|\$)[\w.\[\]$&lt;&gt;]*\s+)+?)((?:[^\W\d]|\$)[\w$]*)(\s*)(\()">
+      <rule pattern="((?:(?:[^\W\d]|\$)[\w.\[\]$&lt;&gt;?]*\s+)+?)((?:[^\W\d]|\$)[\w$]*)(\s*)(\()">
        <bygroups>
          <usingself state="root" />
          <token type="NameFunction" />
@@ -44,7 +44,7 @@
        <token type="NameDecorator" />
      </rule>
      <rule
-        pattern="(abstract|const|enum|extends|final|implements|native|private|protected|public|sealed|static|strictfp|super|synchronized|throws|transient|volatile|yield)\b">
+        pattern="(abstract|const|enum|exports|extends|final|implements|native|non-sealed|open|opens|permits|private|protected|provides|public|requires|sealed|static|strictfp|super|synchronized|throws|to|transient|transitive|uses|volatile|with|yield)\b">
        <token type="KeywordDeclaration" />
      </rule>
      <rule pattern="(boolean|byte|char|double|float|int|long|short|void)\b">
@@ -64,6 +64,10 @@
        <token type="KeywordDeclaration" />
        <push state="class" />
      </rule>
+      <rule pattern="(module)\b">
+        <token type="KeywordDeclaration" />
+        <push state="module" />
+      </rule>
      <rule pattern="(var)(\s+)">
        <bygroups>
          <token type="KeywordDeclaration" />
@@ -71,7 +75,7 @@
        </bygroups>
        <push state="var" />
      </rule>
-      <rule pattern="(import(?:\s+static)?)(\s+)">
+      <rule pattern="(import(?:\s+(?:static|module))?)(\s+)">
        <bygroups>
          <token type="KeywordNamespace" />
          <token type="TextWhitespace" />
@@ -147,6 +151,15 @@
        <pop depth="1" />
      </rule>
    </state>
+    <state name="module">
+      <rule pattern="\s+">
+        <token type="Text" />
+      </rule>
+      <rule pattern="([^\W\d]|\$)[\w$]*">
+        <token type="NameClass" />
+        <pop depth="1" />
+      </rule>
+    </state>
    <state name="var">
      <rule pattern="([^\W\d]|\$)[\w$]*">
        <token type="Name" />
@@ -2,12 +2,15 @@
  <config>
    <name>JSON</name>
    <alias>json</alias>
+    <alias>jsonl</alias>
    <filename>*.json</filename>
+    <filename>*.jsonl</filename>
    <filename>*.jsonc</filename>
    <filename>*.json5</filename>
    <filename>*.avsc</filename>
    <filename>.luaurc</filename>
    <mime_type>application/json</mime_type>
+    <mime_type>application/jsonl</mime_type>
    <dot_all>true</dot_all>
    <not_multiline>true</not_multiline>
  </config>
@@ -3,7 +3,12 @@
    <name>Nu</name>
    <alias>nu</alias>
    <filename>*.nu</filename>
+    <mime_type>application/x-shellscript</mime_type>
    <mime_type>text/plain</mime_type>
+    <mime_type>text/x-shellscript</mime_type>
+    <analyse first="true" >
+      <regex pattern="(?m)^#!.*/bin/(?:env(?: -[a-zA-Z0-9]+)*(?: --[a-zA-Z0-9-=]+)* |)nu" score="1.0" />
+    </analyse>
  </config>
  <rules>
    <state name="root">
@@ -118,4 +123,4 @@
      <rule><include state="root" /></rule>
    </state>
  </rules>
-</lexer>
+</lexer>
@@ -5,6 +5,10 @@
    <alias>postscr</alias>
    <filename>*.ps</filename>
    <filename>*.eps</filename>
+    <filename>*.epsf</filename>
+    <filename>*.epsi</filename>
+    <filename>*.pfa</filename>
+    <filename>*.t42</filename>
    <mime_type>application/postscript</mime_type>
  </config>
  <rules>
@@ -86,4 +90,4 @@
      </rule>
    </state>
  </rules>
-</lexer>
+</lexer>
@@ -7,7 +7,7 @@
  </config>
  <rules>
    <state name="package">
-      <rule pattern="[a-zA-Z_]\w*">
+      <rule pattern="[a-zA-Z_][\w.]*">
        <token type="NameNamespace"/>
        <pop depth="1"/>
      </rule>
@@ -16,7 +16,7 @@
      </rule>
    </state>
    <state name="message">
-      <rule pattern="[a-zA-Z_]\w*">
+      <rule pattern="[a-zA-Z_][\w.]*">
        <token type="NameClass"/>
        <pop depth="1"/>
      </rule>
@@ -34,7 +34,7 @@
      </rule>
    </state>
    <state name="root">
-      <rule pattern="[ \t]+">
+      <rule pattern="\s+">
        <token type="Text"/>
      </rule>
      <rule pattern="[,;{}\[\]()&lt;&gt;]">
@@ -46,9 +46,12 @@
      <rule pattern="/(\\\n)?\*(.|\n)*?\*(\\\n)?/">
        <token type="CommentMultiline"/>
      </rule>
-      <rule pattern="\b(extensions|required|repeated|optional|returns|default|option|packed|import|ctype|oneof|max|rpc|to)\b">
+      <rule pattern="\b(ctype|default|edition|export|local|max|option|optional|packed|public|repeated|required|reserved|returns|stream|syntax|to|weak)\b">
        <token type="Keyword"/>
      </rule>
+      <rule pattern="\b(extensions|map)\b">
+        <token type="KeywordDeclaration"/>
+      </rule>
      <rule pattern="(sfixed32|sfixed64|fixed32|fixed64|sint32|sint64|double|string|uint32|uint64|int32|float|int64|bytes|bool)\b">
        <token type="KeywordType"/>
      </rule>
@@ -62,6 +65,9 @@
        </bygroups>
        <push state="package"/>
      </rule>
+      <rule pattern="import\b">
+        <token type="KeywordNamespace"/>
+      </rule>
      <rule pattern="(message|extend)(\s+)">
        <bygroups>
          <token type="KeywordDeclaration"/>
@@ -69,7 +75,7 @@
        </bygroups>
        <push state="message"/>
      </rule>
-      <rule pattern="(enum|group|service)(\s+)">
+      <rule pattern="(enum|group|oneof|rpc|service)(\s+)">
        <bygroups>
          <token type="KeywordDeclaration"/>
          <token type="Text"/>
@@ -115,4 +121,4 @@
      </rule>
    </state>
  </rules>
-</lexer>
+</lexer>
@@ -12,7 +12,11 @@
    <filename>*.rbx</filename>
    <filename>*.duby</filename>
    <filename>Gemfile</filename>
+    <filename>*.gemfile</filename>
    <filename>Vagrantfile</filename>
+    <filename>Appraisals</filename>
+    <filename>.pryrc</filename>
+    <filename>*.json.jbuilder</filename>
    <mime_type>text/x-ruby</mime_type>
    <mime_type>application/x-ruby</mime_type>
    <dot_all>true</dot_all>
@@ -0,0 +1,315 @@
+<lexer>
+  <config>
+    <name>Templ</name>
+    <alias>templ</alias>
+    <filename>*.templ</filename>
+    <mime_type>text/x-templ</mime_type>
+    <dot_all>true</dot_all>
+    <analyse>
+      <regex pattern="(?m)^\s*templ\s+[A-Za-z_]\w*\s*\(" score="0.7"/>
+      <regex pattern="(?m)^\s*package\s+\w+[\s\S]*^\s*templ\s+" score="0.5"/>
+    </analyse>
+  </config>
+  <rules>
+    <state name="root">
+      <rule pattern="//[^\n\r]*">
+        <token type="CommentSingle"/>
+      </rule>
+      <rule pattern="/\*(?:.|\n)*?\*/">
+        <token type="CommentMultiline"/>
+      </rule>
+      <rule pattern="(?m)^(\s*)(package|import|const|type|func)([^\n]*)">
+        <bygroups>
+          <token type="TextWhitespace"/>
+          <using lexer="Go"/>
+          <using lexer="Go"/>
+        </bygroups>
+      </rule>
+      <rule pattern="\b(templ|css|script)(\s+)([A-Za-z_]\w*)(\s*)(\([^{}]*\))(\s*)({)">
+        <bygroups>
+          <token type="KeywordDeclaration"/>
+          <token type="TextWhitespace"/>
+          <token type="NameFunction"/>
+          <token type="TextWhitespace"/>
+          <using lexer="Go"/>
+          <token type="TextWhitespace"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="@[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*(?:\([^{}()\r\n]*(?:\([^{}()\r\n]*\)[^{}()\r\n]*)*\))?(?:[ \t]*{)?">
+        <token type="NameFunction"/>
+      </rule>
+      <rule pattern="(?m)^(\s*)(if|for|switch|select)(\s+)([^{}\n]*)(\s*)({)">
+        <bygroups>
+          <token type="TextWhitespace"/>
+          <token type="Keyword"/>
+          <token type="TextWhitespace"/>
+          <using lexer="Go"/>
+          <token type="TextWhitespace"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="(?m)^(\s*)(else)(\s*)(if)?(\s*)([^{}\n]*)(\s*)({)?">
+        <bygroups>
+          <token type="TextWhitespace"/>
+          <token type="Keyword"/>
+          <token type="TextWhitespace"/>
+          <token type="Keyword"/>
+          <token type="TextWhitespace"/>
+          <using lexer="Go"/>
+          <token type="TextWhitespace"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="(})(\s*)(else)(\s*)(if)?(\s*)([^{}\n]*)(\s*)({)?">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="TextWhitespace"/>
+          <token type="Keyword"/>
+          <token type="TextWhitespace"/>
+          <token type="Keyword"/>
+          <token type="TextWhitespace"/>
+          <using lexer="Go"/>
+          <token type="TextWhitespace"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="({)([^{}\n]*)(})">
+        <bygroups>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="}">
+        <token type="Punctuation"/>
+      </rule>
+      <rule pattern="`(?:.|\n)*?`">
+        <token type="LiteralStringBacktick"/>
+      </rule>
+      <rule pattern="\s+">
+        <token type="TextWhitespace"/>
+      </rule>
+      <rule pattern="[^&lt;&amp;@{}`\s]+">
+        <token type="Text"/>
+      </rule>
+      <rule pattern="&amp;\S*?;">
+        <token type="NameEntity"/>
+      </rule>
+      <rule pattern="\&lt;\!\[CDATA\[.*?\]\]\&gt;">
+        <token type="CommentPreproc"/>
+      </rule>
+      <rule pattern="&lt;!--">
+        <token type="Comment"/>
+        <push state="comment"/>
+      </rule>
+      <rule pattern="&lt;\?.*?\?&gt;">
+        <token type="CommentPreproc"/>
+      </rule>
+      <rule pattern="&lt;![^&gt;]*&gt;">
+        <token type="CommentPreproc"/>
+      </rule>
+      <rule pattern="(&lt;)(script)(\s*)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="NameTag"/>
+          <token type="Text"/>
+        </bygroups>
+        <push state="script-content" state="tag"/>
+      </rule>
+      <rule pattern="(&lt;)(style)(\s*)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="NameTag"/>
+          <token type="Text"/>
+        </bygroups>
+        <push state="style-content" state="tag"/>
+      </rule>
+      <rule pattern="(&lt;)([A-Za-z][\w:.-]*)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="NameTag"/>
+        </bygroups>
+        <push state="tag"/>
+      </rule>
+      <rule pattern="(&lt;/)([A-Za-z][\w:.-]*)(\s*)(&gt;)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="NameTag"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="[@{}&lt;&amp;]">
+        <token type="Punctuation"/>
+      </rule>
+    </state>
+    <state name="script-content">
+      <rule pattern="(&lt;)(\s*)(/)(\s*)(script)(\s*)(&gt;)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+          <token type="Text"/>
+          <token type="NameTag"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+        </bygroups>
+        <pop depth="1"/>
+      </rule>
+      <rule pattern="\s*[^\r\n]*\{\{.*?\}\}[^\r\n]*">
+        <token type="Other"/>
+      </rule>
+      <rule pattern=".+?(?=&lt;\s*/\s*script\s*&gt;)">
+        <token type="Other"/>
+      </rule>
+    </state>
+    <state name="style-content">
+      <rule pattern="(&lt;)(\s*)(/)(\s*)(style)(\s*)(&gt;)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+          <token type="Text"/>
+          <token type="NameTag"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+        </bygroups>
+        <pop depth="1"/>
+      </rule>
+      <rule pattern=".+?(?=&lt;\s*/\s*style\s*&gt;)">
+        <using lexer="CSS"/>
+      </rule>
+    </state>
+    <state name="comment">
+      <rule pattern="[^-]+">
+        <token type="Comment"/>
+      </rule>
+      <rule pattern="--&gt;">
+        <token type="Comment"/>
+        <pop depth="1"/>
+      </rule>
+      <rule pattern="-">
+        <token type="Comment"/>
+      </rule>
+    </state>
+    <state name="tag">
+      <rule pattern="\s+">
+        <token type="Text"/>
+      </rule>
+      <rule pattern="//[^\n\r]*">
+        <token type="CommentSingle"/>
+      </rule>
+      <rule pattern="/\*(?:.|\n)*?\*/">
+        <token type="CommentMultiline"/>
+      </rule>
+      <rule pattern="\b(if|for|switch|select)(\s+)([^{}]*)(\s*)({)">
+        <bygroups>
+          <token type="Keyword"/>
+          <token type="Text"/>
+          <using lexer="Go"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="\b(else)(\s*)(if)?(\s*)([^{}]*)(\s*)({)?">
+        <bygroups>
+          <token type="Keyword"/>
+          <token type="Text"/>
+          <token type="Keyword"/>
+          <token type="Text"/>
+          <using lexer="Go"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="}">
+        <token type="Punctuation"/>
+      </rule>
+      <rule pattern="({)([^{}]*)(})(\??)(\s*)(=)(\s*)({)([^{}]*)(})">
+        <bygroups>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+          <token type="Operator"/>
+          <token type="Text"/>
+          <token type="Operator"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="({)([^{}]*)(})(\??)(\s*)(=)(\s*)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+          <token type="Operator"/>
+          <token type="Text"/>
+          <token type="Operator"/>
+          <token type="Text"/>
+        </bygroups>
+        <push state="attr"/>
+      </rule>
+      <rule pattern="({)([^{}]*)(})(\??)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+          <token type="Operator"/>
+        </bygroups>
+      </rule>
+      <rule pattern="({)([^{}]*)(})">
+        <bygroups>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="((?:[@#.][\w:.*-]+|\[[^\]\s=]+\]|[\w:.*-]+\??)\s*)(=)(\s*)({)([^{}]*)(})">
+        <bygroups>
+          <token type="NameAttribute"/>
+          <token type="Operator"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+          <using lexer="Go"/>
+          <token type="Punctuation"/>
+        </bygroups>
+      </rule>
+      <rule pattern="((?:[@#.][\w:.*-]+|\[[^\]\s=]+\]|[\w:.*-]+\??)\s*)(=)(\s*)">
+        <bygroups>
+          <token type="NameAttribute"/>
+          <token type="Operator"/>
+          <token type="Text"/>
+        </bygroups>
+        <push state="attr"/>
+      </rule>
+      <rule pattern="(?:[@#.][\w:.*-]+|\[[^\]\s=]+\]|[\w:.*-]+\??)">
+        <token type="NameAttribute"/>
+      </rule>
+      <rule pattern="(/?)(\s*)(&gt;)">
+        <bygroups>
+          <token type="Punctuation"/>
+          <token type="Text"/>
+          <token type="Punctuation"/>
+        </bygroups>
+        <pop depth="1"/>
+      </rule>
+    </state>
+    <state name="attr">
+      <rule pattern="&#34;.*?&#34;">
+        <token type="LiteralString"/>
+        <pop depth="1"/>
+      </rule>
+      <rule pattern="&#39;.*?&#39;">
+        <token type="LiteralString"/>
+        <pop depth="1"/>
+      </rule>
+      <rule pattern="[^\s&gt;]+">
+        <token type="LiteralString"/>
+        <pop depth="1"/>
+      </rule>
+    </state>
+  </rules>
+</lexer>
@@ -23,6 +23,9 @@
      <rule pattern="#.*$">
        <token type="Comment"/>
      </rule>
+      <rule pattern="//.*$">
+        <token type="Comment"/>
+      </rule>
      <rule pattern="!![^\s]+">
        <token type="CommentPreproc"/>
      </rule>
@@ -78,15 +81,22 @@
          <token type="Comment"/>
        </bygroups>
      </rule>
+      <rule pattern="([^\{\}\[\]\?,\:\!\-\*&amp;\@].*)( )+(//.*)">
+        <bygroups>
+          <token type="Literal"/>
+          <token type="TextWhitespace"/>
+          <token type="Comment"/>
+        </bygroups>
+      </rule>
      <rule pattern="[^\{\}\[\]\?,\:\!\-\*&amp;\@].*">
        <token type="Literal"/>
      </rule>
    </state>
    <state name="key">
-      <rule pattern="&#34;[^&#34;\n].*&#34;: ">
+      <rule pattern="&#34;[^&#34;\n#].*&#34;: ">
        <token type="NameTag"/>
      </rule>
-      <rule pattern="(-)( )([^&#34;\n{]*)(:)( )">
+      <rule pattern="(-)( )((?:(?!//)[^&#34;\n{#])*?)(:)( )">
        <bygroups>
          <token type="Punctuation"/>
          <token type="TextWhitespace"/>
@@ -95,14 +105,14 @@
          <token type="TextWhitespace"/>
        </bygroups>
      </rule>
-      <rule pattern="([^&#34;\n{]*)(:)( )">
+      <rule pattern="((?:(?!//)[^&#34;\n{#])*?)(:)( )">
        <bygroups>
          <token type="NameTag"/>
          <token type="Punctuation"/>
          <token type="TextWhitespace"/>
        </bygroups>
      </rule>
-      <rule pattern="([^&#34;\n{]*)(:)(\n)">
+      <rule pattern="((?:(?!//)[^&#34;\n{#])*?)(:)(\n)">
        <bygroups>
          <token type="NameTag"/>
          <token type="Punctuation"/>
@@ -30,8 +30,8 @@ func goRules() Rules {
 		"root": {
 			{`\n`, TextWhitespace, nil},
 			{`\s+`, TextWhitespace, nil},
-			{`//[^\s][^\n\r]*`, CommentPreproc, nil},
-			{`//\s+[^\n\r]*`, CommentSingle, nil},
+			{`//[^\s\n\r][^\n\r]*`, CommentPreproc, nil},
+			{`//[^\n\r]*`, CommentSingle, nil},
 			{`/(\\\n)?[*](.|\n)*?[*](\\\n)?/`, CommentMultiline, nil},
 			{`(import|package)\b`, KeywordNamespace, nil},
 			{`(var|func|struct|map|chan|type|interface|const)\b`, KeywordDeclaration, nil},
@@ -122,7 +122,7 @@ func (d *httpBodyContentTyper) Tokenise(options *TokeniseOptions, text string) (
 					if err != nil {
 						panic(err)
 					}
-					return EOF
+					return subIterator()
 				}
 			}
 		}
@@ -1,11 +1,13 @@
 package lexers

 import (
+	"strings"
+
 	. "github.com/alecthomas/chroma/v2" // nolint
 )

-// Markdown lexer.
-var Markdown = Register(MustNewLexer(
+// Markdown lexer with YAML frontmatter and HTML comment support.
+var Markdown = Register(&markdownLexer{Lexer: MustNewLexer(
 	&Config{
 		Name:      "markdown",
 		Aliases:   []string{"md", "mkd"},
@@ -13,11 +15,69 @@ var Markdown = Register(MustNewLexer(
 		MimeTypes: []string{"text/x-markdown"},
 	},
 	markdownRules,
-))
+)})
+
+// markdownLexer wraps the base Markdown lexer to highlight top-of-file YAML frontmatter.
+type markdownLexer struct {
+	Lexer
+}
+
+// Lexes Markdown, highlighting a leading YAML frontmatter block before delegating to Markdown rules.
+func (m *markdownLexer) Tokenise(options *TokeniseOptions, text string) (Iterator, error) {
+	frontmatter, rest, ok := splitFrontmatter(text)
+	if !ok {
+		return m.Lexer.Tokenise(options, text)
+	}
+
+	yamlLexer := Get("YAML")
+	if yamlLexer == nil {
+		return m.Lexer.Tokenise(options, text)
+	}
+
+	yamlTokens, err := yamlLexer.Tokenise(options, frontmatter)
+	if err != nil {
+		return nil, err
+	}
+	markdownTokens, err := m.Lexer.Tokenise(options, rest)
+	if err != nil {
+		return nil, err
+	}
+	return Concaterator(yamlTokens, markdownTokens), nil
+}
+
+// Extracts a leading YAML frontmatter block if the document starts with one.
+func splitFrontmatter(text string) (frontmatter string, rest string, ok bool) {
+	if !strings.HasPrefix(text, "---\n") && !strings.HasPrefix(text, "---\r\n") {
+		return "", text, false
+	}
+
+	lineEnd := strings.IndexByte(text, '\n')
+	if lineEnd < 0 {
+		return "", text, false
+	}
+	if strings.TrimSuffix(text[:lineEnd], "\r") != "---" {
+		return "", text, false
+	}
+
+	for pos := lineEnd + 1; pos < len(text); {
+		next := strings.IndexByte(text[pos:], '\n')
+		if next < 0 {
+			break
+		}
+		lineEnd = pos + next
+		line := strings.TrimSuffix(text[pos:lineEnd], "\r")
+		if line == "---" {
+			return text[:lineEnd+1], text[lineEnd+1:], true
+		}
+		pos = lineEnd + 1
+	}
+	return "", text, false
+}

 func markdownRules() Rules {
 	return Rules{
 		"root": {
+			{`<!--[\w\W]*?-->`, CommentMultiline, nil},
 			{`^(#[^#].+\n)`, ByGroups(GenericHeading), nil},
 			{`^(#{2,6}.+\n)`, ByGroups(GenericSubheading), nil},
 			{`^(\s*)([*-] )(\[[ xX]\])( .+\n)`, ByGroups(Text, Keyword, Keyword, UsingSelf("inline")), nil},
@@ -33,6 +93,7 @@ func markdownRules() Rules {
 			Include("inline"),
 		},
 		"inline": {
+			{`<!--[\w\W]*?-->`, CommentMultiline, nil},
 			{`\\.`, Text, nil},
 			{`(\s)(\*|_)((?:(?!\2).)*)(\2)((?=\W|\n))`, ByGroups(Text, GenericEmph, GenericEmph, GenericEmph, Text), nil},
 			{`(\s)((\*\*|__).*?)\3((?=\W|\n))`, ByGroups(Text, GenericStrong, GenericStrong, Text), nil},
@@ -70,14 +70,14 @@ func marklessRules() Rules {
 			{`(! )([^ ]+)(.+?)$`, ByGroups(Keyword, NameFunction, NameVariable), nil},
 		},
 		"embed": {
-			{`(\[ )([^ ]+)( )([^,]+)`, ByGroups(Keyword, NameFunction, TextWhitespace, String), Push("embed-options")},
+			{`(\[ )([^ ]+)( )([^,\]\n]+)`, ByGroups(Keyword, NameFunction, TextWhitespace, String), Push("embed-options")},
 		},
 		"embed-options": {
 			{`\\.`, Text, nil},
 			{`,`, Punctuation, nil},
 			{`\]?$`, Keyword, Pop(1)},
 			// Generic key or key/value pair
-			{`( *)([^, \]]+)([^,\]]+)?`, ByGroups(TextWhitespace, NameFunction, String), nil},
+			{`( *)([^, \]\n]+)([^,\]\n]+)?`, ByGroups(TextWhitespace, NameFunction, String), nil},
 			{`.`, Text, nil},
 		},
 		"footnote": {
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"unicode/utf8"

-	"github.com/dlclark/regexp2"
+	"github.com/dlclark/regexp2/v2"

 	. "github.com/alecthomas/chroma/v2" // nolint
 )
@@ -458,8 +458,7 @@ func rakuRules() Rules {
 				var podRegex *regexp2.Regexp
 				if tokenClass == rakuPod {
 					podRegex = regexp2.MustCompile(
-						state.NamedGroups[`ws`]+`=end`+`\s+`+regexp2.Escape(state.NamedGroups[`name`]),
-						0,
+						state.NamedGroups[`ws`] + `=end` + `\s+` + regexp2.Escape(state.NamedGroups[`name`]),
 					)
 				} else {
 					closingChars = []rune(strings.Repeat(string(closingChar), nChars))
@@ -478,7 +477,7 @@ func rakuRules() Rules {
 						match, err := podRegex.FindRunesMatchStartingAt(text, searchPos+nChars)
 						if err == nil {
 							closingChars = match.Runes()
-							nextClosePos = match.Index
+							nextClosePos = match.RuneIndex
 						} else {
 							nextClosePos = -1
 						}
@@ -1599,8 +1598,7 @@ func quote(groups []string, state *LexerState) Iterator {
 	var tokenStates []string

 	// Set tokenStates based on adverbs
-	adverbs := strings.Split(adverbsStr, ":")
-	for _, adverb := range adverbs {
+	for adverb := range strings.SplitSeq(adverbsStr, ":") {
 		switch adverb {
 		case "c", "closure":
 			tokenStates = append(tokenStates, "Q-closure")
@@ -0,0 +1,20 @@
+package lexers
+
+import (
+	. "github.com/alecthomas/chroma/v2" // nolint
+)
+
+// YAML+Jinja is YAML with Jinja templating embedded. Used by Ansible playbooks
+// and Salt SLS files.
+var YAMLJinja = Register(DelegatingLexer(
+	MustNewXMLLexer(embedded, "embedded/yaml.xml"),
+	MustNewXMLLexer(embedded, "embedded/django_jinja.xml").SetConfig(
+		&Config{
+			Name:      "YAML+Jinja",
+			Aliases:   []string{"yaml+jinja", "salt", "sls", "ansible"},
+			Filenames: []string{"*.sls"},
+			MimeTypes: []string{"text/x-yaml+jinja", "text/x-sls"},
+			DotAll:    true,
+		},
+	),
+))
@@ -3,6 +3,7 @@ package chroma
 import (
 	"encoding/json"
 	"fmt"
+	"maps"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -12,7 +13,7 @@ import (
 	"time"
 	"unicode/utf8"

-	"github.com/dlclark/regexp2"
+	"github.com/dlclark/regexp2/v2"
 )

 // A Rule is the fundamental matching unit of the Regex lexer state machine.
@@ -70,9 +71,7 @@ func (r Rules) Clone() Rules {
 // Merge creates a clone of "r" then merges "rules" into the clone.
 func (r Rules) Merge(rules Rules) Rules {
 	out := r.Clone()
-	for k, v := range rules.Clone() {
-		out[k] = v
-	}
+	maps.Copy(out, rules.Clone())
 	return out
 }

@@ -177,19 +176,19 @@ type LexerState struct {
 	// Named Group matches.
 	NamedGroups map[string]string
 	// Custum context for mutators.
-	MutatorContext map[interface{}]interface{}
+	MutatorContext map[any]any
 	iteratorStack  []Iterator
 	options        *TokeniseOptions
 	newlineAdded   bool
 }

 // Set mutator context.
-func (l *LexerState) Set(key interface{}, value interface{}) {
+func (l *LexerState) Set(key any, value any) {
 	l.MutatorContext[key] = value
 }

 // Get mutator context.
-func (l *LexerState) Get(key interface{}) interface{} {
+func (l *LexerState) Get(key any) any {
 	return l.MutatorContext[key]
 }

@@ -369,7 +368,7 @@ func (r *RegexLexer) maybeCompile() (err error) {
 					pattern = "(?" + rule.flags + ")" + pattern
 				}
 				pattern = `\G` + pattern
-				rule.Regexp, err = regexp2.Compile(pattern, 0)
+				rule.Regexp, err = regexp2.Compile(pattern)
 				if err != nil {
 					return fmt.Errorf("failed to compile rule %s.%d: %s", state, i, err)
 				}
@@ -484,7 +483,7 @@ func (r *RegexLexer) Tokenise(options *TokeniseOptions, text string) (Iterator,
 		Text:           []rune(text),
 		Stack:          []string{options.State},
 		Rules:          r.rules,
-		MutatorContext: map[interface{}]interface{}{},
+		MutatorContext: map[any]any{},
 	}
 	return state.Iterator, nil
 }
@@ -501,7 +500,7 @@ func (r *RegexLexer) MustRules() Rules {
 func matchRules(text []rune, pos int, rules []*CompiledRule) (int, *CompiledRule, []string, map[string]string) {
 	for i, rule := range rules {
 		match, err := rule.Regexp.FindRunesMatchStartingAt(text, pos)
-		if match != nil && err == nil && match.Index == pos {
+		if match != nil && err == nil && match.RuneIndex == pos {
 			groups := []string{}
 			namedGroups := make(map[string]string)
 			for _, g := range match.Groups() {
@@ -9,6 +9,7 @@
 		"schedule:earlyMondays", // Run once a week.
 		'helpers:pinGitHubActionDigests',
 	],
+	"postUpdateOptions": ["gomodTidy"],
 	"packageRules": [
 		{
 			"matchPackageNames": ["golangci-lint"],
@@ -13,7 +13,7 @@ import (
 	"regexp"
 	"strings"

-	"github.com/dlclark/regexp2"
+	"github.com/dlclark/regexp2/v2"
 )

 // Serialisation of Chroma rules to XML. The format is:
@@ -440,14 +440,14 @@ func (t TokenType) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 }

 // This hijinks is a bit unfortunate but without it we can't deserialise into TokenType.
-func newFromTemplate(template interface{}) (value func() interface{}, target interface{}) {
+func newFromTemplate(template any) (value func() any, target any) {
 	t := reflect.TypeOf(template)
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		v := reflect.New(t.Elem())
 		return v.Interface, v.Interface()
 	}
 	v := reflect.New(t)
-	return func() interface{} { return v.Elem().Interface() }, v.Interface()
+	return func() any { return v.Elem().Interface() }, v.Interface()
 }

 func (b *Emitters) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
@@ -4,7 +4,8 @@ import (
 	"encoding/xml"
 	"fmt"
 	"io"
-	"sort"
+	"maps"
+	"slices"
 	"strings"
 )

@@ -18,6 +19,24 @@ const (
 	No
 )

+// Mode indicates whether a style is intended for a light or dark background.
+type Mode uint8
+
+// Mode values.
+const (
+	Light Mode = iota
+	Dark
+)
+
+func (m Mode) String() string {
+	switch m {
+	case Dark:
+		return "dark"
+	default:
+		return "light"
+	}
+}
+
 func (t Trilean) String() string {
 	switch t {
 	case Yes:
@@ -31,12 +50,14 @@ func (t Trilean) String() string {

 // Prefix returns s with "no" as a prefix if Trilean is no.
 func (t Trilean) Prefix(s string) string {
-	if t == Yes {
+	switch t {
+	case Yes:
 		return s
-	} else if t == No {
+	case No:
 		return "no" + s
+	default:
+		return ""
 	}
-	return ""
 }

 // A StyleEntry in the Style map.
@@ -111,11 +132,10 @@ func (s StyleEntry) Sub(e StyleEntry) StyleEntry {
 // Ancestors should be provided from oldest to newest.
 func (s StyleEntry) Inherit(ancestors ...StyleEntry) StyleEntry {
 	out := s
-	for i := len(ancestors) - 1; i >= 0; i-- {
+	for _, ancestor := range slices.Backward(ancestors) {
 		if out.NoInherit {
 			return out
 		}
-		ancestor := ancestors[i]
 		if !out.Colour.IsSet() {
 			out.Colour = ancestor.Colour
 		}
@@ -147,19 +167,24 @@ func (s StyleEntry) IsZero() bool {
 //
 // Once built, a Style is immutable.
 type StyleBuilder struct {
-	entries map[TokenType]string
-	name    string
-	parent  *Style
+	entries     map[TokenType]string
+	name        string
+	counterpart string
+	parent      *Style
 }

 func NewStyleBuilder(name string) *StyleBuilder {
 	return &StyleBuilder{name: name, entries: map[TokenType]string{}}
 }

+// Counterpart sets the lowercase name of the opposite-mode style.
+func (s *StyleBuilder) Counterpart(name string) *StyleBuilder {
+	s.counterpart = strings.ToLower(name)
+	return s
+}
+
 func (s *StyleBuilder) AddAll(entries StyleEntries) *StyleBuilder {
-	for ttype, entry := range entries {
-		s.entries[ttype] = entry
-	}
+	maps.Copy(s.entries, entries)
 	return s
 }

@@ -205,10 +230,15 @@ func (s *StyleBuilder) Transform(transform func(StyleEntry) StyleEntry) *StyleBu
 }

 func (s *StyleBuilder) Build() (*Style, error) {
+	counterpart := s.counterpart
+	if counterpart == "" && s.parent != nil {
+		counterpart = s.parent.Counterpart
+	}
 	style := &Style{
-		Name:    s.name,
-		entries: map[TokenType]StyleEntry{},
-		parent:  s.parent,
+		Name:        s.name,
+		Counterpart: counterpart,
+		entries:     map[TokenType]StyleEntry{},
+		parent:      s.parent,
 	}
 	for ttype, descriptor := range s.entries {
 		entry, err := ParseStyleEntry(descriptor)
@@ -257,9 +287,23 @@ func MustNewStyle(name string, entries StyleEntries) *Style {
 //
 // See http://pygments.org/docs/styles/ for details. Semantics are intended to be identical.
 type Style struct {
-	Name    string
-	entries map[TokenType]StyleEntry
-	parent  *Style
+	Name string
+	// Counterpart is the lowercase name of the style intended as this style's
+	// opposite-mode pair (eg. "github-dark" for "github"). Resolved via
+	// styles.GetForMode. May be empty.
+	Counterpart string
+	entries     map[TokenType]StyleEntry
+	parent      *Style
+}
+
+// Mode returns Light or Dark based on the brightness of the Background entry's
+// background colour. Styles with an unset Background default to Light.
+func (s *Style) Mode() Mode {
+	bg := s.get(Background).Background
+	if bg.IsSet() && bg.Brightness() < 0.5 {
+		return Dark
+	}
+	return Light
 }

 func (s *Style) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
@@ -268,6 +312,9 @@ func (s *Style) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	}
 	start.Name = xml.Name{Local: "style"}
 	start.Attr = []xml.Attr{{Name: xml.Name{Local: "name"}, Value: s.Name}}
+	if s.Counterpart != "" {
+		start.Attr = append(start.Attr, xml.Attr{Name: xml.Name{Local: "counterpart"}, Value: s.Counterpart})
+	}
 	if err := e.EncodeToken(start); err != nil {
 		return err
 	}
@@ -275,7 +322,7 @@ func (s *Style) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	for ttype := range s.entries {
 		sorted = append(sorted, ttype)
 	}
-	sort.Slice(sorted, func(i, j int) bool { return sorted[i] < sorted[j] })
+	slices.Sort(sorted)
 	for _, ttype := range sorted {
 		entry := s.entries[ttype]
 		el := xml.StartElement{Name: xml.Name{Local: "entry"}}
@@ -295,9 +342,12 @@ func (s *Style) MarshalXML(e *xml.Encoder, start xml.StartElement) error {

 func (s *Style) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
 	for _, attr := range start.Attr {
-		if attr.Name.Local == "name" {
+		switch attr.Name.Local {
+		case "name":
 			s.Name = attr.Value
-		} else {
+		case "counterpart":
+			s.Counterpart = strings.ToLower(attr.Value)
+		default:
 			return fmt.Errorf("unexpected attribute %s", attr.Name.Local)
 		}
 	}
@@ -437,8 +487,7 @@ func MustParseStyleEntry(entry string) StyleEntry {
 // ParseStyleEntry parses a Pygments style entry.
 func ParseStyleEntry(entry string) (StyleEntry, error) { // nolint: gocyclo
 	out := StyleEntry{}
-	parts := strings.Fields(entry)
-	for _, part := range parts {
+	for part := range strings.FieldsSeq(entry) {
 		switch {
 		case part == "italic":
 			out.Italic = Yes
@@ -64,3 +64,32 @@ func Get(name string) *chroma.Style {
 	}
 	return Fallback
 }
+
+// GetForMode returns the named style if it already matches mode, otherwise its
+// registered counterpart if one exists and matches mode. If neither matches,
+// the originally-requested style is returned (or Fallback if the name is
+// unknown), so callers always get something usable.
+func GetForMode(name string, mode chroma.Mode) *chroma.Style {
+	style := Get(name)
+	if style.Mode() == mode {
+		return style
+	}
+	if style.Counterpart == "" {
+		return style
+	}
+	counterpart, ok := Registry[style.Counterpart]
+	if !ok || counterpart.Mode() != mode {
+		return style
+	}
+	return counterpart
+}
+
+// RegisterPair links two styles as light/dark counterparts of each other.
+//
+// Both styles are also registered if they are not already present.
+func RegisterPair(a, b *chroma.Style) {
+	Register(a)
+	Register(b)
+	a.Counterpart = strings.ToLower(b.Name)
+	b.Counterpart = strings.ToLower(a.Name)
+}
@@ -1,4 +1,4 @@
-<style name="catppuccin-latte">
+<style name="catppuccin-latte" counterpart="catppuccin-mocha">
  <entry type="Background" style="bg:#eff1f5 #4c4f69"/>
  <entry type="CodeLine" style="#4c4f69"/>
  <entry type="Error" style="#d20f39"/>
@@ -1,4 +1,4 @@
-<style name="catppuccin-mocha">
+<style name="catppuccin-mocha" counterpart="catppuccin-latte">
  <entry type="Background" style="bg:#1e1e2e #cdd6f4"/>
  <entry type="CodeLine" style="#cdd6f4"/>
  <entry type="Error" style="#f38ba8"/>
@@ -1,4 +1,4 @@
-<style name="github-dark">
+<style name="github-dark" counterpart="github">
  <entry type="Error" style="#f85149"/>
  <entry type="LineHighlight" style="bg:#6e7681"/>
  <entry type="LineNumbers" style="#6e7681"/>
@@ -1,4 +1,4 @@
-<style name="github">
+<style name="github" counterpart="github-dark">
  <entry type="Error" style="#f6f8fa bg:#82071e"/>
  <entry type="Background" style="bg:#f7f7f7"/>
  <entry type="Keyword" style="#cf222e"/>
@@ -1,4 +1,4 @@
-<style name="gruvbox-light">
+<style name="gruvbox-light" counterpart="gruvbox">
  <entry type="Background" style="noinherit #3c3836 bg:#fbf1c7"/>
  <entry type="Keyword" style="noinherit #af3a03"/>
  <entry type="KeywordType" style="noinherit #b57614"/>
@@ -10,6 +10,7 @@
  <entry type="NameException" style="noinherit #fb4934"/>
  <entry type="NameFunction" style="#b57614"/>
  <entry type="NameLabel" style="noinherit #9d0006"/>
+  <entry type="NameNamespace" style="noinherit #79740e"/>
  <entry type="NameTag" style="noinherit #9d0006"/>
  <entry type="NameVariable" style="noinherit #3c3836"/>
  <entry type="LiteralString" style="noinherit #79740e"/>
@@ -1,4 +1,4 @@
-<style name="gruvbox">
+<style name="gruvbox" counterpart="gruvbox-light">
  <entry type="Background" style="noinherit #ebdbb2 bg:#282828"/>
  <entry type="Keyword" style="noinherit #fe8019"/>
  <entry type="KeywordType" style="noinherit #fabd2f"/>
@@ -11,6 +11,7 @@
  <entry type="NameFunction" style="#fabd2f"/>
  <entry type="NameLabel" style="noinherit #fb4934"/>
  <entry type="NameTag" style="noinherit #fb4934"/>
+  <entry type="NameNamespace" style="noinherit #b8bb26"/>
  <entry type="NameVariable" style="noinherit #ebdbb2"/>
  <entry type="LiteralString" style="noinherit #b8bb26"/>
  <entry type="LiteralStringSymbol" style="#83a598"/>
@@ -1,4 +1,4 @@
-<style name="kanagawa-lotus">
+<style name="kanagawa-lotus" counterpart="kanagawa-wave">
  <entry type="Background" style="bg:#f2ecbc #545464" />
  <entry type="CodeLine" style="#545464" />
  <entry type="Error" style="#e82424" />
@@ -1,4 +1,4 @@
-<style name="kanagawa-wave">
+<style name="kanagawa-wave" counterpart="kanagawa-lotus">
  <entry type="Background" style="bg:#1f1f28 #dcd7ba" />
  <entry type="CodeLine" style="#dcd7ba" />
  <entry type="Error" style="#e82424" />
@@ -1,4 +1,4 @@
-<style name="modus-operandi">
+<style name="modus-operandi" counterpart="modus-vivendi">
  <entry type="Background" style="#000000 bg:#ffffff"/>
  <entry type="Keyword" style="#5317ac"/>
  <entry type="KeywordConstant" style="#0000c0"/>
@@ -1,4 +1,4 @@
-<style name="modus-vivendi">
+<style name="modus-vivendi" counterpart="modus-operandi">
  <entry type="Background" style="#ffffff bg:#000000"/>
  <entry type="Keyword" style="#b6a0ff"/>
  <entry type="KeywordConstant" style="#00bcff"/>
@@ -1,4 +1,4 @@
-<style name="monokai">
+<style name="monokai" counterpart="monokailight">
  <entry type="Error" style="#960050 bg:#1e0010"/>
  <entry type="Background" style="bg:#272822"/>
  <entry type="Keyword" style="#66d9ef"/>
@@ -1,4 +1,4 @@
-<style name="monokailight">
+<style name="monokailight" counterpart="monokai">
  <entry type="Error" style="#960050 bg:#1e0010"/>
  <entry type="Background" style="bg:#fafafa"/>
  <entry type="Keyword" style="#00a8c8"/>
@@ -1,4 +1,4 @@
-<style name="paraiso-dark">
+<style name="paraiso-dark" counterpart="paraiso-light">
  <entry type="Error" style="#ef6155"/>
  <entry type="Background" style="bg:#2f1e2e"/>
  <entry type="Keyword" style="#815ba4"/>
@@ -1,4 +1,4 @@
-<style name="paraiso-light">
+<style name="paraiso-light" counterpart="paraiso-dark">
  <entry type="Error" style="#ef6155"/>
  <entry type="Background" style="bg:#e7e9db"/>
  <entry type="Keyword" style="#815ba4"/>
@@ -1,4 +1,4 @@
-<style name="rose-pine-dawn">
+<style name="rose-pine-dawn" counterpart="rose-pine">
  <entry type="Error" style="#b4637a"/>
  <entry type="Background" style="bg:#faf4ed"/>
  <entry type="Keyword" style="#286983"/>
@@ -1,4 +1,4 @@
-<style name="rose-pine">
+<style name="rose-pine" counterpart="rose-pine-dawn">
  <entry type="Error" style="#eb6f92"/>
  <entry type="Background" style="bg:#191724"/>
  <entry type="Keyword" style="#31748f"/>
@@ -1,4 +1,4 @@
-<style name="solarized-dark">
+<style name="solarized-dark" counterpart="solarized-light">
  <entry type="Other" style="#cb4b16"/>
  <entry type="Background" style="#93a1a1 bg:#002b36"/>
  <entry type="Keyword" style="#719e07"/>
@@ -1,4 +1,4 @@
-<style name="solarized-light">
+<style name="solarized-light" counterpart="solarized-dark">
  <entry type="Background" style="bg:#fdf6e3"/>
  <entry type="Keyword" style="#859900"/>
  <entry type="KeywordConstant" style="bold"/>
@@ -1,4 +1,4 @@
-<style name="tokyonight-day">
+<style name="tokyonight-day" counterpart="tokyonight-night">
  <entry type="Background" style="bg:#e1e2e7 #3760bf"/>
  <entry type="CodeLine" style="#3760bf"/>
  <entry type="Error" style="#c64343"/>
@@ -1,4 +1,4 @@
-<style name="tokyonight-night">
+<style name="tokyonight-night" counterpart="tokyonight-day">
  <entry type="Background" style="bg:#1a1b26 #c0caf5"/>
  <entry type="CodeLine" style="#c0caf5"/>
  <entry type="Error" style="#db4b4b"/>
@@ -1,4 +1,4 @@
-<style name="xcode-dark">
+<style name="xcode-dark" counterpart="xcode">
  <entry type="Error" style="#960050"/>
  <entry type="Background" style="#ffffff bg:#1f1f24"/>
  <entry type="Keyword" style="#fc5fa3"/>
@@ -1,4 +1,4 @@
-<style name="xcode">
+<style name="xcode" counterpart="xcode-dark">
  <entry type="Error" style="#000000"/>
  <entry type="Background" style="bg:#ffffff"/>
  <entry type="Keyword" style="#a90d91"/>
@@ -0,0 +1,2 @@
+{"name": "Alice"}
+{"name": "Bob"}
@@ -48,7 +48,7 @@ func (s relativePseudoClassSelector) Match(n *html.Node) bool {
 }

 // hasChildMatch returns whether n has any child that matches a.
-func hasChildMatch(n *html.Node, a Matcher) bool {
+func hasChildMatch(n *html.Node, a SelectorGroup) bool {
 	for c := n.FirstChild; c != nil; c = c.NextSibling {
 		if a.Match(c) {
 			return true
@@ -60,7 +60,7 @@ func hasChildMatch(n *html.Node, a Matcher) bool {
 // hasDescendantMatch performs a depth-first search of n's descendants,
 // testing whether any of them match a. It returns true as soon as a match is
 // found, or false if no match is found.
-func hasDescendantMatch(n *html.Node, a Matcher) bool {
+func hasDescendantMatch(n *html.Node, a SelectorGroup) bool {
 	for c := n.FirstChild; c != nil; c = c.NextSibling {
 		if a.Match(c) || (c.Type == html.ElementNode && hasDescendantMatch(c, a)) {
 			return true
@@ -327,7 +327,7 @@ func (s emptyElementPseudoClassSelector) Match(n *html.Node) bool {
 		case html.ElementNode:
 			return false
 		case html.TextNode:
-			if strings.TrimSpace(nodeText(c)) == "" {
+			if strings.TrimSpace(c.Data) == "" {
 				continue
 			} else {
 				return false
@@ -1,7 +0,0 @@
-language: go
-arch:
-  - AMD64
-  - ppc64le
-go:
-  - 1.9
-  - tip
@@ -1,174 +0,0 @@
-# regexp2 - full featured regular expressions for Go
-Regexp2 is a feature-rich RegExp engine for Go.  It doesn't have constant time guarantees like the built-in `regexp` package, but it allows backtracking and is compatible with Perl5 and .NET.  You'll likely be better off with the RE2 engine from the `regexp` package and should only use this if you need to write very complex patterns or require compatibility with .NET.
-
-## Basis of the engine
-The engine is ported from the .NET framework's System.Text.RegularExpressions.Regex engine.  That engine was open sourced in 2015 under the MIT license.  There are some fundamental differences between .NET strings and Go strings that required a bit of borrowing from the Go framework regex engine as well.  I cleaned up a couple of the dirtier bits during the port (regexcharclass.cs was terrible), but the parse tree, code emmitted, and therefore patterns matched should be identical.
-
-## New Code Generation
-For extra performance use `regexp2` with [`regexp2cg`](https://github.com/dlclark/regexp2cg). It is a code generation utility for `regexp2` and you can likely improve your regexp runtime performance by 3-10x in hot code paths. As always you should benchmark your specifics to confirm the results. Give it a try!
-
-## Installing
-This is a go-gettable library, so install is easy:
-
-    go get github.com/dlclark/regexp2
-
-To use the new Code Generation (while it's in beta) you'll need to use the `code_gen` branch:
-
-    go get github.com/dlclark/regexp2@code_gen
-
-## Usage
-Usage is similar to the Go `regexp` package.  Just like in `regexp`, you start by converting a regex into a state machine via the `Compile` or `MustCompile` methods.  They ultimately do the same thing, but `MustCompile` will panic if the regex is invalid.  You can then use the provided `Regexp` struct to find matches repeatedly.  A `Regexp` struct is safe to use across goroutines.
-
-```go
-re := regexp2.MustCompile(`Your pattern`, 0)
-if isMatch, _ := re.MatchString(`Something to match`); isMatch {
-    //do something
-}
-```
-
-The only error that the `*Match*` methods *should* return is a Timeout if you set the `re.MatchTimeout` field.  Any other error is a bug in the `regexp2` package.  If you need more details about capture groups in a match then use the `FindStringMatch` method, like so:
-
-```go
-if m, _ := re.FindStringMatch(`Something to match`); m != nil {
-    // the whole match is always group 0
-    fmt.Printf("Group 0: %v\n", m.String())
-
-    // you can get all the groups too
-    gps := m.Groups()
-
-    // a group can be captured multiple times, so each cap is separately addressable
-    fmt.Printf("Group 1, first capture", gps[1].Captures[0].String())
-    fmt.Printf("Group 1, second capture", gps[1].Captures[1].String())
-}
-```
-
-Group 0 is embedded in the Match.  Group 0 is an automatically-assigned group that encompasses the whole pattern.  This means that `m.String()` is the same as `m.Group.String()` and `m.Groups()[0].String()`
-
-The __last__ capture is embedded in each group, so `g.String()` will return the same thing as `g.Capture.String()` and  `g.Captures[len(g.Captures)-1].String()`.
-
-If you want to find multiple matches from a single input string you should use the `FindNextMatch` method.  For example, to implement a function similar to `regexp.FindAllString`:
-
-```go
-func regexp2FindAllString(re *regexp2.Regexp, s string) []string {
-	var matches []string
-	m, _ := re.FindStringMatch(s)
-	for m != nil {
-		matches = append(matches, m.String())
-		m, _ = re.FindNextMatch(m)
-	}
-	return matches
-}
-```
-
-`FindNextMatch` is optmized so that it re-uses the underlying string/rune slice.
-
-The internals of `regexp2` always operate on `[]rune` so `Index` and `Length` data in a `Match` always reference a position in `rune`s rather than `byte`s (even if the input was given as a string). This is a dramatic difference between `regexp` and `regexp2`.  It's advisable to use the provided `String()` methods to avoid having to work with indices.
-
-## Compare `regexp` and `regexp2`
-| Category | regexp | regexp2 |
-| --- | --- | --- |
-| Catastrophic backtracking possible | no, constant execution time guarantees | yes, if your pattern is at risk you can use the `re.MatchTimeout` field |
-| Python-style capture groups `(?P<name>re)` | yes | no (yes in RE2 compat mode) |
-| .NET-style capture groups `(?<name>re)` or `(?'name're)` | yes | yes |
-| comments `(?#comment)` | no | yes |
-| branch numbering reset `(?\|a\|b)` | no | no |
-| possessive match `(?>re)` | no | yes |
-| positive lookahead `(?=re)` | no | yes |
-| negative lookahead `(?!re)` | no | yes |
-| positive lookbehind `(?<=re)` | no | yes |
-| negative lookbehind `(?<!re)` | no | yes |
-| back reference `\1` | no | yes |
-| named back reference `\k'name'` | no | yes |
-| named ascii character class `[[:foo:]]`| yes | no (yes in RE2 compat mode) |
-| conditionals `(?(expr)yes\|no)` | no | yes |
-
-## RE2 compatibility mode
-The default behavior of `regexp2` is to match the .NET regexp engine, however the `RE2` option is provided to change the parsing to increase compatibility with RE2.  Using the `RE2` option when compiling a regexp will not take away any features, but will change the following behaviors:
-* add support for named ascii character classes (e.g. `[[:foo:]]`)
-* add support for python-style capture groups (e.g. `(P<name>re)`)
-* change singleline behavior for `$` to only match end of string (like RE2) (see [#24](https://github.com/dlclark/regexp2/issues/24))
-* change the character classes `\d` `\s` and `\w` to match the same characters as RE2. NOTE: if you also use the `ECMAScript` option then this will change the `\s` character class to match ECMAScript instead of RE2.  ECMAScript allows more whitespace characters in `\s` than RE2 (but still fewer than the the default behavior).
-* allow character escape sequences to have defaults. For example, by default `\_` isn't a known character escape and will fail to compile, but in RE2 mode it will match the literal character `_`
- 
-```go
-re := regexp2.MustCompile(`Your RE2-compatible pattern`, regexp2.RE2)
-if isMatch, _ := re.MatchString(`Something to match`); isMatch {
-    //do something
-}
-```
-
-This feature is a work in progress and I'm open to ideas for more things to put here (maybe more relaxed character escaping rules?).
-
-## Catastrophic Backtracking and Timeouts
-
-`regexp2` supports features that can lead to catastrophic backtracking.
-`Regexp.MatchTimeout` can be set to to limit the impact of such behavior; the
-match will fail with an error after approximately MatchTimeout. No timeout
-checks are done by default.
-
-Timeout checking is not free. The current timeout checking implementation starts
-a background worker that updates a clock value approximately once every 100
-milliseconds. The matching code compares this value against the precomputed
-deadline for the match. The performance impact is as follows.
-
-1.  A match with a timeout runs almost as fast as a match without a timeout.
-2.  If any live matches have a timeout, there will be a background CPU load
-    (`~0.15%` currently on a modern machine). This load will remain constant
-    regardless of the number of matches done including matches done in parallel.
-3.  If no live matches are using a timeout, the background load will remain
-    until the longest deadline (match timeout + the time when the match started)
-    is reached. E.g., if you set a timeout of one minute the load will persist
-    for approximately a minute even if the match finishes quickly.
-
-See [PR #58](https://github.com/dlclark/regexp2/pull/58) for more details and 
-alternatives considered.
-
-## Goroutine leak error
-If you're using a library during unit tests (e.g. https://github.com/uber-go/goleak) that validates all goroutines are exited then you'll likely get an error if you or any of your dependencies use regex's with a MatchTimeout. 
-To remedy the problem you'll need to tell the unit test to wait until the backgroup timeout goroutine is exited.
-
-```go
-func TestSomething(t *testing.T) {
-    defer goleak.VerifyNone(t)
-    defer regexp2.StopTimeoutClock()
-
-    // ... test
-}
-
-//or
-
-func TestMain(m *testing.M) {
-    // setup
-    // ...
-
-    // run 
-    m.Run()
-
-    //tear down
-    regexp2.StopTimeoutClock()
-    goleak.VerifyNone(t)
-}
-```
-
-This will add ~100ms runtime to each test (or TestMain). If that's too much time you can set the clock cycle rate of the timeout goroutine in an init function in a test file. `regexp2.SetTimeoutCheckPeriod` isn't threadsafe so it must be setup before starting any regex's with Timeouts.
-
-```go
-func init() {
-	//speed up testing by making the timeout clock 1ms
-	regexp2.SetTimeoutCheckPeriod(time.Millisecond)
-}
-```
-
-## ECMAScript compatibility mode
-In this mode the engine provides compatibility with the [regex engine](https://tc39.es/ecma262/multipage/text-processing.html#sec-regexp-regular-expression-objects) described in the ECMAScript specification.
-
-Additionally a Unicode mode is provided which allows parsing of `\u{CodePoint}` syntax that is only when both are provided.
-
-## Library features that I'm still working on
- Regex split
-
-## Potential bugs
-I've run a battery of tests against regexp2 from various sources and found the debug output matches the .NET engine, but .NET and Go handle strings very differently.  I've attempted to handle these differences, but most of my testing deals with basic ASCII with a little bit of multi-byte Unicode.  There's a chance that there are bugs in the string handling related to character sets with supplementary Unicode chars.  Right-to-Left support is coded, but not well tested either.
-
-## Find a bug?
-I'm open to new issues and pull requests with tests if you find something odd!
@@ -1,395 +0,0 @@
-/*
-Package regexp2 is a regexp package that has an interface similar to Go's framework regexp engine but uses a
-more feature full regex engine behind the scenes.
-
-It doesn't have constant time guarantees, but it allows backtracking and is compatible with Perl5 and .NET.
-You'll likely be better off with the RE2 engine from the regexp package and should only use this if you
-need to write very complex patterns or require compatibility with .NET.
-*/
-package regexp2
-
-import (
-	"errors"
-	"math"
-	"strconv"
-	"sync"
-	"time"
-
-	"github.com/dlclark/regexp2/syntax"
-)
-
-var (
-	// DefaultMatchTimeout used when running regexp matches -- "forever"
-	DefaultMatchTimeout = time.Duration(math.MaxInt64)
-	// DefaultUnmarshalOptions used when unmarshaling a regex from text
-	DefaultUnmarshalOptions = None
-)
-
-// Regexp is the representation of a compiled regular expression.
-// A Regexp is safe for concurrent use by multiple goroutines.
-type Regexp struct {
-	// A match will time out if it takes (approximately) more than
-	// MatchTimeout. This is a safety check in case the match
-	// encounters catastrophic backtracking.  The default value
-	// (DefaultMatchTimeout) causes all time out checking to be
-	// suppressed.
-	MatchTimeout time.Duration
-
-	// read-only after Compile
-	pattern string       // as passed to Compile
-	options RegexOptions // options
-
-	caps     map[int]int    // capnum->index
-	capnames map[string]int //capture group name -> index
-	capslist []string       //sorted list of capture group names
-	capsize  int            // size of the capture array
-
-	code *syntax.Code // compiled program
-
-	// cache of machines for running regexp
-	muRun  *sync.Mutex
-	runner []*runner
-}
-
-// Compile parses a regular expression and returns, if successful,
-// a Regexp object that can be used to match against text.
-func Compile(expr string, opt RegexOptions) (*Regexp, error) {
-	// parse it
-	tree, err := syntax.Parse(expr, syntax.RegexOptions(opt))
-	if err != nil {
-		return nil, err
-	}
-
-	// translate it to code
-	code, err := syntax.Write(tree)
-	if err != nil {
-		return nil, err
-	}
-
-	// return it
-	return &Regexp{
-		pattern:      expr,
-		options:      opt,
-		caps:         code.Caps,
-		capnames:     tree.Capnames,
-		capslist:     tree.Caplist,
-		capsize:      code.Capsize,
-		code:         code,
-		MatchTimeout: DefaultMatchTimeout,
-		muRun:        &sync.Mutex{},
-	}, nil
-}
-
-// MustCompile is like Compile but panics if the expression cannot be parsed.
-// It simplifies safe initialization of global variables holding compiled regular
-// expressions.
-func MustCompile(str string, opt RegexOptions) *Regexp {
-	regexp, error := Compile(str, opt)
-	if error != nil {
-		panic(`regexp2: Compile(` + quote(str) + `): ` + error.Error())
-	}
-	return regexp
-}
-
-// Escape adds backslashes to any special characters in the input string
-func Escape(input string) string {
-	return syntax.Escape(input)
-}
-
-// Unescape removes any backslashes from previously-escaped special characters in the input string
-func Unescape(input string) (string, error) {
-	return syntax.Unescape(input)
-}
-
-// SetTimeoutPeriod is a debug function that sets the frequency of the timeout goroutine's sleep cycle.
-// Defaults to 100ms. The only benefit of setting this lower is that the 1 background goroutine that manages
-// timeouts may exit slightly sooner after all the timeouts have expired. See Github issue #63
-func SetTimeoutCheckPeriod(d time.Duration) {
-	clockPeriod = d
-}
-
-// StopTimeoutClock should only be used in unit tests to prevent the timeout clock goroutine
-// from appearing like a leaking goroutine
-func StopTimeoutClock() {
-	stopClock()
-}
-
-// String returns the source text used to compile the regular expression.
-func (re *Regexp) String() string {
-	return re.pattern
-}
-
-func quote(s string) string {
-	if strconv.CanBackquote(s) {
-		return "`" + s + "`"
-	}
-	return strconv.Quote(s)
-}
-
-// RegexOptions impact the runtime and parsing behavior
-// for each specific regex.  They are setable in code as well
-// as in the regex pattern itself.
-type RegexOptions int32
-
-const (
-	None                    RegexOptions = 0x0
-	IgnoreCase                           = 0x0001 // "i"
-	Multiline                            = 0x0002 // "m"
-	ExplicitCapture                      = 0x0004 // "n"
-	Compiled                             = 0x0008 // "c"
-	Singleline                           = 0x0010 // "s"
-	IgnorePatternWhitespace              = 0x0020 // "x"
-	RightToLeft                          = 0x0040 // "r"
-	Debug                                = 0x0080 // "d"
-	ECMAScript                           = 0x0100 // "e"
-	RE2                                  = 0x0200 // RE2 (regexp package) compatibility mode
-	Unicode                              = 0x0400 // "u"
-)
-
-func (re *Regexp) RightToLeft() bool {
-	return re.options&RightToLeft != 0
-}
-
-func (re *Regexp) Debug() bool {
-	return re.options&Debug != 0
-}
-
-// Replace searches the input string and replaces each match found with the replacement text.
-// Count will limit the number of matches attempted and startAt will allow
-// us to skip past possible matches at the start of the input (left or right depending on RightToLeft option).
-// Set startAt and count to -1 to go through the whole string
-func (re *Regexp) Replace(input, replacement string, startAt, count int) (string, error) {
-	data, err := syntax.NewReplacerData(replacement, re.caps, re.capsize, re.capnames, syntax.RegexOptions(re.options))
-	if err != nil {
-		return "", err
-	}
-	//TODO: cache ReplacerData
-
-	return replace(re, data, nil, input, startAt, count)
-}
-
-// ReplaceFunc searches the input string and replaces each match found using the string from the evaluator
-// Count will limit the number of matches attempted and startAt will allow
-// us to skip past possible matches at the start of the input (left or right depending on RightToLeft option).
-// Set startAt and count to -1 to go through the whole string.
-func (re *Regexp) ReplaceFunc(input string, evaluator MatchEvaluator, startAt, count int) (string, error) {
-	return replace(re, nil, evaluator, input, startAt, count)
-}
-
-// FindStringMatch searches the input string for a Regexp match
-func (re *Regexp) FindStringMatch(s string) (*Match, error) {
-	// convert string to runes
-	return re.run(false, -1, getRunes(s))
-}
-
-// FindRunesMatch searches the input rune slice for a Regexp match
-func (re *Regexp) FindRunesMatch(r []rune) (*Match, error) {
-	return re.run(false, -1, r)
-}
-
-// FindStringMatchStartingAt searches the input string for a Regexp match starting at the startAt index
-func (re *Regexp) FindStringMatchStartingAt(s string, startAt int) (*Match, error) {
-	if startAt > len(s) {
-		return nil, errors.New("startAt must be less than the length of the input string")
-	}
-	r, startAt := re.getRunesAndStart(s, startAt)
-	if startAt == -1 {
-		// we didn't find our start index in the string -- that's a problem
-		return nil, errors.New("startAt must align to the start of a valid rune in the input string")
-	}
-
-	return re.run(false, startAt, r)
-}
-
-// FindRunesMatchStartingAt searches the input rune slice for a Regexp match starting at the startAt index
-func (re *Regexp) FindRunesMatchStartingAt(r []rune, startAt int) (*Match, error) {
-	return re.run(false, startAt, r)
-}
-
-// FindNextMatch returns the next match in the same input string as the match parameter.
-// Will return nil if there is no next match or if given a nil match.
-func (re *Regexp) FindNextMatch(m *Match) (*Match, error) {
-	if m == nil {
-		return nil, nil
-	}
-
-	// If previous match was empty, advance by one before matching to prevent
-	// infinite loop
-	startAt := m.textpos
-	if m.Length == 0 {
-		if m.textpos == len(m.text) {
-			return nil, nil
-		}
-
-		if re.RightToLeft() {
-			startAt--
-		} else {
-			startAt++
-		}
-	}
-	return re.run(false, startAt, m.text)
-}
-
-// MatchString return true if the string matches the regex
-// error will be set if a timeout occurs
-func (re *Regexp) MatchString(s string) (bool, error) {
-	m, err := re.run(true, -1, getRunes(s))
-	if err != nil {
-		return false, err
-	}
-	return m != nil, nil
-}
-
-func (re *Regexp) getRunesAndStart(s string, startAt int) ([]rune, int) {
-	if startAt < 0 {
-		if re.RightToLeft() {
-			r := getRunes(s)
-			return r, len(r)
-		}
-		return getRunes(s), 0
-	}
-	ret := make([]rune, len(s))
-	i := 0
-	runeIdx := -1
-	for strIdx, r := range s {
-		if strIdx == startAt {
-			runeIdx = i
-		}
-		ret[i] = r
-		i++
-	}
-	if startAt == len(s) {
-		runeIdx = i
-	}
-	return ret[:i], runeIdx
-}
-
-func getRunes(s string) []rune {
-	return []rune(s)
-}
-
-// MatchRunes return true if the runes matches the regex
-// error will be set if a timeout occurs
-func (re *Regexp) MatchRunes(r []rune) (bool, error) {
-	m, err := re.run(true, -1, r)
-	if err != nil {
-		return false, err
-	}
-	return m != nil, nil
-}
-
-// GetGroupNames Returns the set of strings used to name capturing groups in the expression.
-func (re *Regexp) GetGroupNames() []string {
-	var result []string
-
-	if re.capslist == nil {
-		result = make([]string, re.capsize)
-
-		for i := 0; i < len(result); i++ {
-			result[i] = strconv.Itoa(i)
-		}
-	} else {
-		result = make([]string, len(re.capslist))
-		copy(result, re.capslist)
-	}
-
-	return result
-}
-
-// GetGroupNumbers returns the integer group numbers corresponding to a group name.
-func (re *Regexp) GetGroupNumbers() []int {
-	var result []int
-
-	if re.caps == nil {
-		result = make([]int, re.capsize)
-
-		for i := 0; i < len(result); i++ {
-			result[i] = i
-		}
-	} else {
-		result = make([]int, len(re.caps))
-
-		for k, v := range re.caps {
-			result[v] = k
-		}
-	}
-
-	return result
-}
-
-// GroupNameFromNumber retrieves a group name that corresponds to a group number.
-// It will return "" for and unknown group number.  Unnamed groups automatically
-// receive a name that is the decimal string equivalent of its number.
-func (re *Regexp) GroupNameFromNumber(i int) string {
-	if re.capslist == nil {
-		if i >= 0 && i < re.capsize {
-			return strconv.Itoa(i)
-		}
-
-		return ""
-	}
-
-	if re.caps != nil {
-		var ok bool
-		if i, ok = re.caps[i]; !ok {
-			return ""
-		}
-	}
-
-	if i >= 0 && i < len(re.capslist) {
-		return re.capslist[i]
-	}
-
-	return ""
-}
-
-// GroupNumberFromName returns a group number that corresponds to a group name.
-// Returns -1 if the name is not a recognized group name.  Numbered groups
-// automatically get a group name that is the decimal string equivalent of its number.
-func (re *Regexp) GroupNumberFromName(name string) int {
-	// look up name if we have a hashtable of names
-	if re.capnames != nil {
-		if k, ok := re.capnames[name]; ok {
-			return k
-		}
-
-		return -1
-	}
-
-	// convert to an int if it looks like a number
-	result := 0
-	for i := 0; i < len(name); i++ {
-		ch := name[i]
-
-		if ch > '9' || ch < '0' {
-			return -1
-		}
-
-		result *= 10
-		result += int(ch - '0')
-	}
-
-	// return int if it's in range
-	if result >= 0 && result < re.capsize {
-		return result
-	}
-
-	return -1
-}
-
-// MarshalText implements [encoding.TextMarshaler]. The output
-// matches that of calling the [Regexp.String] method.
-func (re *Regexp) MarshalText() ([]byte, error) {
-	return []byte(re.String()), nil
-}
-
-// UnmarshalText implements [encoding.TextUnmarshaler] by calling
-// [Compile] on the encoded value.
-func (re *Regexp) UnmarshalText(text []byte) error {
-	newRE, err := Compile(string(text), DefaultUnmarshalOptions)
-	if err != nil {
-		return err
-	}
-	*re = *newRE
-	return nil
-}
@@ -1,177 +0,0 @@
-package regexp2
-
-import (
-	"bytes"
-	"errors"
-
-	"github.com/dlclark/regexp2/syntax"
-)
-
-const (
-	replaceSpecials     = 4
-	replaceLeftPortion  = -1
-	replaceRightPortion = -2
-	replaceLastGroup    = -3
-	replaceWholeString  = -4
-)
-
-// MatchEvaluator is a function that takes a match and returns a replacement string to be used
-type MatchEvaluator func(Match) string
-
-// Three very similar algorithms appear below: replace (pattern),
-// replace (evaluator), and split.
-
-// Replace Replaces all occurrences of the regex in the string with the
-// replacement pattern.
-//
-// Note that the special case of no matches is handled on its own:
-// with no matches, the input string is returned unchanged.
-// The right-to-left case is split out because StringBuilder
-// doesn't handle right-to-left string building directly very well.
-func replace(regex *Regexp, data *syntax.ReplacerData, evaluator MatchEvaluator, input string, startAt, count int) (string, error) {
-	if count < -1 {
-		return "", errors.New("Count too small")
-	}
-	if count == 0 {
-		return "", nil
-	}
-
-	m, err := regex.FindStringMatchStartingAt(input, startAt)
-
-	if err != nil {
-		return "", err
-	}
-	if m == nil {
-		return input, nil
-	}
-
-	buf := &bytes.Buffer{}
-	text := m.text
-
-	if !regex.RightToLeft() {
-		prevat := 0
-		for m != nil {
-			if m.Index != prevat {
-				buf.WriteString(string(text[prevat:m.Index]))
-			}
-			prevat = m.Index + m.Length
-			if evaluator == nil {
-				replacementImpl(data, buf, m)
-			} else {
-				buf.WriteString(evaluator(*m))
-			}
-
-			count--
-			if count == 0 {
-				break
-			}
-			m, err = regex.FindNextMatch(m)
-			if err != nil {
-				return "", nil
-			}
-		}
-
-		if prevat < len(text) {
-			buf.WriteString(string(text[prevat:]))
-		}
-	} else {
-		prevat := len(text)
-		var al []string
-
-		for m != nil {
-			if m.Index+m.Length != prevat {
-				al = append(al, string(text[m.Index+m.Length:prevat]))
-			}
-			prevat = m.Index
-			if evaluator == nil {
-				replacementImplRTL(data, &al, m)
-			} else {
-				al = append(al, evaluator(*m))
-			}
-
-			count--
-			if count == 0 {
-				break
-			}
-			m, err = regex.FindNextMatch(m)
-			if err != nil {
-				return "", nil
-			}
-		}
-
-		if prevat > 0 {
-			buf.WriteString(string(text[:prevat]))
-		}
-
-		for i := len(al) - 1; i >= 0; i-- {
-			buf.WriteString(al[i])
-		}
-	}
-
-	return buf.String(), nil
-}
-
-// Given a Match, emits into the StringBuilder the evaluated
-// substitution pattern.
-func replacementImpl(data *syntax.ReplacerData, buf *bytes.Buffer, m *Match) {
-	for _, r := range data.Rules {
-
-		if r >= 0 { // string lookup
-			buf.WriteString(data.Strings[r])
-		} else if r < -replaceSpecials { // group lookup
-			m.groupValueAppendToBuf(-replaceSpecials-1-r, buf)
-		} else {
-			switch -replaceSpecials - 1 - r { // special insertion patterns
-			case replaceLeftPortion:
-				for i := 0; i < m.Index; i++ {
-					buf.WriteRune(m.text[i])
-				}
-			case replaceRightPortion:
-				for i := m.Index + m.Length; i < len(m.text); i++ {
-					buf.WriteRune(m.text[i])
-				}
-			case replaceLastGroup:
-				m.groupValueAppendToBuf(m.GroupCount()-1, buf)
-			case replaceWholeString:
-				for i := 0; i < len(m.text); i++ {
-					buf.WriteRune(m.text[i])
-				}
-			}
-		}
-	}
-}
-
-func replacementImplRTL(data *syntax.ReplacerData, al *[]string, m *Match) {
-	l := *al
-	buf := &bytes.Buffer{}
-
-	for _, r := range data.Rules {
-		buf.Reset()
-		if r >= 0 { // string lookup
-			l = append(l, data.Strings[r])
-		} else if r < -replaceSpecials { // group lookup
-			m.groupValueAppendToBuf(-replaceSpecials-1-r, buf)
-			l = append(l, buf.String())
-		} else {
-			switch -replaceSpecials - 1 - r { // special insertion patterns
-			case replaceLeftPortion:
-				for i := 0; i < m.Index; i++ {
-					buf.WriteRune(m.text[i])
-				}
-			case replaceRightPortion:
-				for i := m.Index + m.Length; i < len(m.text); i++ {
-					buf.WriteRune(m.text[i])
-				}
-			case replaceLastGroup:
-				m.groupValueAppendToBuf(m.GroupCount()-1, buf)
-			case replaceWholeString:
-				for i := 0; i < len(m.text); i++ {
-					buf.WriteRune(m.text[i])
-				}
-			}
-			l = append(l, buf.String())
-		}
-	}
-
-	*al = l
-}
@@ -1,865 +0,0 @@
-package syntax
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"sort"
-	"unicode"
-	"unicode/utf8"
-)
-
-// CharSet combines start-end rune ranges and unicode categories representing a set of characters
-type CharSet struct {
-	ranges     []singleRange
-	categories []category
-	sub        *CharSet //optional subtractor
-	negate     bool
-	anything   bool
-}
-
-type category struct {
-	negate bool
-	cat    string
-}
-
-type singleRange struct {
-	first rune
-	last  rune
-}
-
-const (
-	spaceCategoryText = " "
-	wordCategoryText  = "W"
-)
-
-var (
-	ecmaSpace = []rune{0x0009, 0x000e, 0x0020, 0x0021, 0x00a0, 0x00a1, 0x1680, 0x1681, 0x2000, 0x200b, 0x2028, 0x202a, 0x202f, 0x2030, 0x205f, 0x2060, 0x3000, 0x3001, 0xfeff, 0xff00}
-	ecmaWord  = []rune{0x0030, 0x003a, 0x0041, 0x005b, 0x005f, 0x0060, 0x0061, 0x007b}
-	ecmaDigit = []rune{0x0030, 0x003a}
-
-	re2Space = []rune{0x0009, 0x000b, 0x000c, 0x000e, 0x0020, 0x0021}
-)
-
-var (
-	AnyClass          = getCharSetFromOldString([]rune{0}, false)
-	ECMAAnyClass      = getCharSetFromOldString([]rune{0, 0x000a, 0x000b, 0x000d, 0x000e}, false)
-	NoneClass         = getCharSetFromOldString(nil, false)
-	ECMAWordClass     = getCharSetFromOldString(ecmaWord, false)
-	NotECMAWordClass  = getCharSetFromOldString(ecmaWord, true)
-	ECMASpaceClass    = getCharSetFromOldString(ecmaSpace, false)
-	NotECMASpaceClass = getCharSetFromOldString(ecmaSpace, true)
-	ECMADigitClass    = getCharSetFromOldString(ecmaDigit, false)
-	NotECMADigitClass = getCharSetFromOldString(ecmaDigit, true)
-
-	WordClass     = getCharSetFromCategoryString(false, false, wordCategoryText)
-	NotWordClass  = getCharSetFromCategoryString(true, false, wordCategoryText)
-	SpaceClass    = getCharSetFromCategoryString(false, false, spaceCategoryText)
-	NotSpaceClass = getCharSetFromCategoryString(true, false, spaceCategoryText)
-	DigitClass    = getCharSetFromCategoryString(false, false, "Nd")
-	NotDigitClass = getCharSetFromCategoryString(false, true, "Nd")
-
-	RE2SpaceClass    = getCharSetFromOldString(re2Space, false)
-	NotRE2SpaceClass = getCharSetFromOldString(re2Space, true)
-)
-
-var unicodeCategories = func() map[string]*unicode.RangeTable {
-	retVal := make(map[string]*unicode.RangeTable)
-	for k, v := range unicode.Scripts {
-		retVal[k] = v
-	}
-	for k, v := range unicode.Categories {
-		retVal[k] = v
-	}
-	for k, v := range unicode.Properties {
-		retVal[k] = v
-	}
-	return retVal
-}()
-
-func getCharSetFromCategoryString(negateSet bool, negateCat bool, cats ...string) func() *CharSet {
-	if negateCat && negateSet {
-		panic("BUG!  You should only negate the set OR the category in a constant setup, but not both")
-	}
-
-	c := CharSet{negate: negateSet}
-
-	c.categories = make([]category, len(cats))
-	for i, cat := range cats {
-		c.categories[i] = category{cat: cat, negate: negateCat}
-	}
-	return func() *CharSet {
-		//make a copy each time
-		local := c
-		//return that address
-		return &local
-	}
-}
-
-func getCharSetFromOldString(setText []rune, negate bool) func() *CharSet {
-	c := CharSet{}
-	if len(setText) > 0 {
-		fillFirst := false
-		l := len(setText)
-		if negate {
-			if setText[0] == 0 {
-				setText = setText[1:]
-			} else {
-				l++
-				fillFirst = true
-			}
-		}
-
-		if l%2 == 0 {
-			c.ranges = make([]singleRange, l/2)
-		} else {
-			c.ranges = make([]singleRange, l/2+1)
-		}
-
-		first := true
-		if fillFirst {
-			c.ranges[0] = singleRange{first: 0}
-			first = false
-		}
-
-		i := 0
-		for _, r := range setText {
-			if first {
-				// lower bound in a new range
-				c.ranges[i] = singleRange{first: r}
-				first = false
-			} else {
-				c.ranges[i].last = r - 1
-				i++
-				first = true
-			}
-		}
-		if !first {
-			c.ranges[i].last = utf8.MaxRune
-		}
-	}
-
-	return func() *CharSet {
-		local := c
-		return &local
-	}
-}
-
-// Copy makes a deep copy to prevent accidental mutation of a set
-func (c CharSet) Copy() CharSet {
-	ret := CharSet{
-		anything: c.anything,
-		negate:   c.negate,
-	}
-
-	ret.ranges = append(ret.ranges, c.ranges...)
-	ret.categories = append(ret.categories, c.categories...)
-
-	if c.sub != nil {
-		sub := c.sub.Copy()
-		ret.sub = &sub
-	}
-
-	return ret
-}
-
-// gets a human-readable description for a set string
-func (c CharSet) String() string {
-	buf := &bytes.Buffer{}
-	buf.WriteRune('[')
-
-	if c.IsNegated() {
-		buf.WriteRune('^')
-	}
-
-	for _, r := range c.ranges {
-
-		buf.WriteString(CharDescription(r.first))
-		if r.first != r.last {
-			if r.last-r.first != 1 {
-				//groups that are 1 char apart skip the dash
-				buf.WriteRune('-')
-			}
-			buf.WriteString(CharDescription(r.last))
-		}
-	}
-
-	for _, c := range c.categories {
-		buf.WriteString(c.String())
-	}
-
-	if c.sub != nil {
-		buf.WriteRune('-')
-		buf.WriteString(c.sub.String())
-	}
-
-	buf.WriteRune(']')
-
-	return buf.String()
-}
-
-// mapHashFill converts a charset into a buffer for use in maps
-func (c CharSet) mapHashFill(buf *bytes.Buffer) {
-	if c.negate {
-		buf.WriteByte(0)
-	} else {
-		buf.WriteByte(1)
-	}
-
-	binary.Write(buf, binary.LittleEndian, len(c.ranges))
-	binary.Write(buf, binary.LittleEndian, len(c.categories))
-	for _, r := range c.ranges {
-		buf.WriteRune(r.first)
-		buf.WriteRune(r.last)
-	}
-	for _, ct := range c.categories {
-		buf.WriteString(ct.cat)
-		if ct.negate {
-			buf.WriteByte(1)
-		} else {
-			buf.WriteByte(0)
-		}
-	}
-
-	if c.sub != nil {
-		c.sub.mapHashFill(buf)
-	}
-}
-
-// CharIn returns true if the rune is in our character set (either ranges or categories).
-// It handles negations and subtracted sub-charsets.
-func (c CharSet) CharIn(ch rune) bool {
-	val := false
-	// in s && !s.subtracted
-
-	//check ranges
-	for _, r := range c.ranges {
-		if ch < r.first {
-			continue
-		}
-		if ch <= r.last {
-			val = true
-			break
-		}
-	}
-
-	//check categories if we haven't already found a range
-	if !val && len(c.categories) > 0 {
-		for _, ct := range c.categories {
-			// special categories...then unicode
-			if ct.cat == spaceCategoryText {
-				if unicode.IsSpace(ch) {
-					// we found a space so we're done
-					// negate means this is a "bad" thing
-					val = !ct.negate
-					break
-				} else if ct.negate {
-					val = true
-					break
-				}
-			} else if ct.cat == wordCategoryText {
-				if IsWordChar(ch) {
-					val = !ct.negate
-					break
-				} else if ct.negate {
-					val = true
-					break
-				}
-			} else if unicode.Is(unicodeCategories[ct.cat], ch) {
-				// if we're in this unicode category then we're done
-				// if negate=true on this category then we "failed" our test
-				// otherwise we're good that we found it
-				val = !ct.negate
-				break
-			} else if ct.negate {
-				val = true
-				break
-			}
-		}
-	}
-
-	// negate the whole char set
-	if c.negate {
-		val = !val
-	}
-
-	// get subtracted recurse
-	if val && c.sub != nil {
-		val = !c.sub.CharIn(ch)
-	}
-
-	//log.Printf("Char '%v' in %v == %v", string(ch), c.String(), val)
-	return val
-}
-
-func (c category) String() string {
-	switch c.cat {
-	case spaceCategoryText:
-		if c.negate {
-			return "\\S"
-		}
-		return "\\s"
-	case wordCategoryText:
-		if c.negate {
-			return "\\W"
-		}
-		return "\\w"
-	}
-	if _, ok := unicodeCategories[c.cat]; ok {
-
-		if c.negate {
-			return "\\P{" + c.cat + "}"
-		}
-		return "\\p{" + c.cat + "}"
-	}
-	return "Unknown category: " + c.cat
-}
-
-// CharDescription Produces a human-readable description for a single character.
-func CharDescription(ch rune) string {
-	/*if ch == '\\' {
-		return "\\\\"
-	}
-
-	if ch > ' ' && ch <= '~' {
-		return string(ch)
-	} else if ch == '\n' {
-		return "\\n"
-	} else if ch == ' ' {
-		return "\\ "
-	}*/
-
-	b := &bytes.Buffer{}
-	escape(b, ch, false) //fmt.Sprintf("%U", ch)
-	return b.String()
-}
-
-// According to UTS#18 Unicode Regular Expressions (http://www.unicode.org/reports/tr18/)
-// RL 1.4 Simple Word Boundaries  The class of <word_character> includes all Alphabetic
-// values from the Unicode character database, from UnicodeData.txt [UData], plus the U+200C
-// ZERO WIDTH NON-JOINER and U+200D ZERO WIDTH JOINER.
-func IsWordChar(r rune) bool {
-	//"L", "Mn", "Nd", "Pc"
-	return unicode.In(r,
-		unicode.Categories["L"], unicode.Categories["Mn"],
-		unicode.Categories["Nd"], unicode.Categories["Pc"]) || r == '\u200D' || r == '\u200C'
-	//return 'A' <= r && r <= 'Z' || 'a' <= r && r <= 'z' || '0' <= r && r <= '9' || r == '_'
-}
-
-func IsECMAWordChar(r rune) bool {
-	return unicode.In(r,
-		unicode.Categories["L"], unicode.Categories["Mn"],
-		unicode.Categories["Nd"], unicode.Categories["Pc"])
-
-	//return 'A' <= r && r <= 'Z' || 'a' <= r && r <= 'z' || '0' <= r && r <= '9' || r == '_'
-}
-
-// SingletonChar will return the char from the first range without validation.
-// It assumes you have checked for IsSingleton or IsSingletonInverse and will panic given bad input
-func (c CharSet) SingletonChar() rune {
-	return c.ranges[0].first
-}
-
-func (c CharSet) IsSingleton() bool {
-	return !c.negate && //negated is multiple chars
-		len(c.categories) == 0 && len(c.ranges) == 1 && // multiple ranges and unicode classes represent multiple chars
-		c.sub == nil && // subtraction means we've got multiple chars
-		c.ranges[0].first == c.ranges[0].last // first and last equal means we're just 1 char
-}
-
-func (c CharSet) IsSingletonInverse() bool {
-	return c.negate && //same as above, but requires negated
-		len(c.categories) == 0 && len(c.ranges) == 1 && // multiple ranges and unicode classes represent multiple chars
-		c.sub == nil && // subtraction means we've got multiple chars
-		c.ranges[0].first == c.ranges[0].last // first and last equal means we're just 1 char
-}
-
-func (c CharSet) IsMergeable() bool {
-	return !c.IsNegated() && !c.HasSubtraction()
-}
-
-func (c CharSet) IsNegated() bool {
-	return c.negate
-}
-
-func (c CharSet) HasSubtraction() bool {
-	return c.sub != nil
-}
-
-func (c CharSet) IsEmpty() bool {
-	return len(c.ranges) == 0 && len(c.categories) == 0 && c.sub == nil
-}
-
-func (c *CharSet) addDigit(ecma, negate bool, pattern string) {
-	if ecma {
-		if negate {
-			c.addRanges(NotECMADigitClass().ranges)
-		} else {
-			c.addRanges(ECMADigitClass().ranges)
-		}
-	} else {
-		c.addCategories(category{cat: "Nd", negate: negate})
-	}
-}
-
-func (c *CharSet) addChar(ch rune) {
-	c.addRange(ch, ch)
-}
-
-func (c *CharSet) addSpace(ecma, re2, negate bool) {
-	if ecma {
-		if negate {
-			c.addRanges(NotECMASpaceClass().ranges)
-		} else {
-			c.addRanges(ECMASpaceClass().ranges)
-		}
-	} else if re2 {
-		if negate {
-			c.addRanges(NotRE2SpaceClass().ranges)
-		} else {
-			c.addRanges(RE2SpaceClass().ranges)
-		}
-	} else {
-		c.addCategories(category{cat: spaceCategoryText, negate: negate})
-	}
-}
-
-func (c *CharSet) addWord(ecma, negate bool) {
-	if ecma {
-		if negate {
-			c.addRanges(NotECMAWordClass().ranges)
-		} else {
-			c.addRanges(ECMAWordClass().ranges)
-		}
-	} else {
-		c.addCategories(category{cat: wordCategoryText, negate: negate})
-	}
-}
-
-// Add set ranges and categories into ours -- no deduping or anything
-func (c *CharSet) addSet(set CharSet) {
-	if c.anything {
-		return
-	}
-	if set.anything {
-		c.makeAnything()
-		return
-	}
-	// just append here to prevent double-canon
-	c.ranges = append(c.ranges, set.ranges...)
-	c.addCategories(set.categories...)
-	c.canonicalize()
-}
-
-func (c *CharSet) makeAnything() {
-	c.anything = true
-	c.categories = []category{}
-	c.ranges = AnyClass().ranges
-}
-
-func (c *CharSet) addCategories(cats ...category) {
-	// don't add dupes and remove positive+negative
-	if c.anything {
-		// if we've had a previous positive+negative group then
-		// just return, we're as broad as we can get
-		return
-	}
-
-	for _, ct := range cats {
-		found := false
-		for _, ct2 := range c.categories {
-			if ct.cat == ct2.cat {
-				if ct.negate != ct2.negate {
-					// oposite negations...this mean we just
-					// take us as anything and move on
-					c.makeAnything()
-					return
-				}
-				found = true
-				break
-			}
-		}
-
-		if !found {
-			c.categories = append(c.categories, ct)
-		}
-	}
-}
-
-// Merges new ranges to our own
-func (c *CharSet) addRanges(ranges []singleRange) {
-	if c.anything {
-		return
-	}
-	c.ranges = append(c.ranges, ranges...)
-	c.canonicalize()
-}
-
-// Merges everything but the new ranges into our own
-func (c *CharSet) addNegativeRanges(ranges []singleRange) {
-	if c.anything {
-		return
-	}
-
-	var hi rune
-
-	// convert incoming ranges into opposites, assume they are in order
-	for _, r := range ranges {
-		if hi < r.first {
-			c.ranges = append(c.ranges, singleRange{hi, r.first - 1})
-		}
-		hi = r.last + 1
-	}
-
-	if hi < utf8.MaxRune {
-		c.ranges = append(c.ranges, singleRange{hi, utf8.MaxRune})
-	}
-
-	c.canonicalize()
-}
-
-func isValidUnicodeCat(catName string) bool {
-	_, ok := unicodeCategories[catName]
-	return ok
-}
-
-func (c *CharSet) addCategory(categoryName string, negate, caseInsensitive bool, pattern string) {
-	if !isValidUnicodeCat(categoryName) {
-		// unknown unicode category, script, or property "blah"
-		panic(fmt.Errorf("Unknown unicode category, script, or property '%v'", categoryName))
-
-	}
-
-	if caseInsensitive && (categoryName == "Ll" || categoryName == "Lu" || categoryName == "Lt") {
-		// when RegexOptions.IgnoreCase is specified then {Ll} {Lu} and {Lt} cases should all match
-		c.addCategories(
-			category{cat: "Ll", negate: negate},
-			category{cat: "Lu", negate: negate},
-			category{cat: "Lt", negate: negate})
-	}
-	c.addCategories(category{cat: categoryName, negate: negate})
-}
-
-func (c *CharSet) addSubtraction(sub *CharSet) {
-	c.sub = sub
-}
-
-func (c *CharSet) addRange(chMin, chMax rune) {
-	c.ranges = append(c.ranges, singleRange{first: chMin, last: chMax})
-	c.canonicalize()
-}
-
-func (c *CharSet) addNamedASCII(name string, negate bool) bool {
-	var rs []singleRange
-
-	switch name {
-	case "alnum":
-		rs = []singleRange{singleRange{'0', '9'}, singleRange{'A', 'Z'}, singleRange{'a', 'z'}}
-	case "alpha":
-		rs = []singleRange{singleRange{'A', 'Z'}, singleRange{'a', 'z'}}
-	case "ascii":
-		rs = []singleRange{singleRange{0, 0x7f}}
-	case "blank":
-		rs = []singleRange{singleRange{'\t', '\t'}, singleRange{' ', ' '}}
-	case "cntrl":
-		rs = []singleRange{singleRange{0, 0x1f}, singleRange{0x7f, 0x7f}}
-	case "digit":
-		c.addDigit(false, negate, "")
-	case "graph":
-		rs = []singleRange{singleRange{'!', '~'}}
-	case "lower":
-		rs = []singleRange{singleRange{'a', 'z'}}
-	case "print":
-		rs = []singleRange{singleRange{' ', '~'}}
-	case "punct": //[!-/:-@[-`{-~]
-		rs = []singleRange{singleRange{'!', '/'}, singleRange{':', '@'}, singleRange{'[', '`'}, singleRange{'{', '~'}}
-	case "space":
-		c.addSpace(true, false, negate)
-	case "upper":
-		rs = []singleRange{singleRange{'A', 'Z'}}
-	case "word":
-		c.addWord(true, negate)
-	case "xdigit":
-		rs = []singleRange{singleRange{'0', '9'}, singleRange{'A', 'F'}, singleRange{'a', 'f'}}
-	default:
-		return false
-	}
-
-	if len(rs) > 0 {
-		if negate {
-			c.addNegativeRanges(rs)
-		} else {
-			c.addRanges(rs)
-		}
-	}
-
-	return true
-}
-
-type singleRangeSorter []singleRange
-
-func (p singleRangeSorter) Len() int           { return len(p) }
-func (p singleRangeSorter) Less(i, j int) bool { return p[i].first < p[j].first }
-func (p singleRangeSorter) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }
-
-// Logic to reduce a character class to a unique, sorted form.
-func (c *CharSet) canonicalize() {
-	var i, j int
-	var last rune
-
-	//
-	// Find and eliminate overlapping or abutting ranges
-	//
-
-	if len(c.ranges) > 1 {
-		sort.Sort(singleRangeSorter(c.ranges))
-
-		done := false
-
-		for i, j = 1, 0; ; i++ {
-			for last = c.ranges[j].last; ; i++ {
-				if i == len(c.ranges) || last == utf8.MaxRune {
-					done = true
-					break
-				}
-
-				CurrentRange := c.ranges[i]
-				if CurrentRange.first > last+1 {
-					break
-				}
-
-				if last < CurrentRange.last {
-					last = CurrentRange.last
-				}
-			}
-
-			c.ranges[j] = singleRange{first: c.ranges[j].first, last: last}
-
-			j++
-
-			if done {
-				break
-			}
-
-			if j < i {
-				c.ranges[j] = c.ranges[i]
-			}
-		}
-
-		c.ranges = append(c.ranges[:j], c.ranges[len(c.ranges):]...)
-	}
-}
-
-// Adds to the class any lowercase versions of characters already
-// in the class. Used for case-insensitivity.
-func (c *CharSet) addLowercase() {
-	if c.anything {
-		return
-	}
-	toAdd := []singleRange{}
-	for i := 0; i < len(c.ranges); i++ {
-		r := c.ranges[i]
-		if r.first == r.last {
-			lower := unicode.ToLower(r.first)
-			c.ranges[i] = singleRange{first: lower, last: lower}
-		} else {
-			toAdd = append(toAdd, r)
-		}
-	}
-
-	for _, r := range toAdd {
-		c.addLowercaseRange(r.first, r.last)
-	}
-	c.canonicalize()
-}
-
-/**************************************************************************
-    Let U be the set of Unicode character values and let L be the lowercase
-    function, mapping from U to U. To perform case insensitive matching of
-    character sets, we need to be able to map an interval I in U, say
-
-        I = [chMin, chMax] = { ch : chMin <= ch <= chMax }
-
-    to a set A such that A contains L(I) and A is contained in the union of
-    I and L(I).
-
-    The table below partitions U into intervals on which L is non-decreasing.
-    Thus, for any interval J = [a, b] contained in one of these intervals,
-    L(J) is contained in [L(a), L(b)].
-
-    It is also true that for any such J, [L(a), L(b)] is contained in the
-    union of J and L(J). This does not follow from L being non-decreasing on
-    these intervals. It follows from the nature of the L on each interval.
-    On each interval, L has one of the following forms:
-
-        (1) L(ch) = constant            (LowercaseSet)
-        (2) L(ch) = ch + offset         (LowercaseAdd)
-        (3) L(ch) = ch | 1              (LowercaseBor)
-        (4) L(ch) = ch + (ch & 1)       (LowercaseBad)
-
-    It is easy to verify that for any of these forms [L(a), L(b)] is
-    contained in the union of [a, b] and L([a, b]).
-***************************************************************************/
-
-const (
-	LowercaseSet = 0 // Set to arg.
-	LowercaseAdd = 1 // Add arg.
-	LowercaseBor = 2 // Bitwise or with 1.
-	LowercaseBad = 3 // Bitwise and with 1 and add original.
-)
-
-type lcMap struct {
-	chMin, chMax rune
-	op, data     int32
-}
-
-var lcTable = []lcMap{
-	lcMap{'\u0041', '\u005A', LowercaseAdd, 32},
-	lcMap{'\u00C0', '\u00DE', LowercaseAdd, 32},
-	lcMap{'\u0100', '\u012E', LowercaseBor, 0},
-	lcMap{'\u0130', '\u0130', LowercaseSet, 0x0069},
-	lcMap{'\u0132', '\u0136', LowercaseBor, 0},
-	lcMap{'\u0139', '\u0147', LowercaseBad, 0},
-	lcMap{'\u014A', '\u0176', LowercaseBor, 0},
-	lcMap{'\u0178', '\u0178', LowercaseSet, 0x00FF},
-	lcMap{'\u0179', '\u017D', LowercaseBad, 0},
-	lcMap{'\u0181', '\u0181', LowercaseSet, 0x0253},
-	lcMap{'\u0182', '\u0184', LowercaseBor, 0},
-	lcMap{'\u0186', '\u0186', LowercaseSet, 0x0254},
-	lcMap{'\u0187', '\u0187', LowercaseSet, 0x0188},
-	lcMap{'\u0189', '\u018A', LowercaseAdd, 205},
-	lcMap{'\u018B', '\u018B', LowercaseSet, 0x018C},
-	lcMap{'\u018E', '\u018E', LowercaseSet, 0x01DD},
-	lcMap{'\u018F', '\u018F', LowercaseSet, 0x0259},
-	lcMap{'\u0190', '\u0190', LowercaseSet, 0x025B},
-	lcMap{'\u0191', '\u0191', LowercaseSet, 0x0192},
-	lcMap{'\u0193', '\u0193', LowercaseSet, 0x0260},
-	lcMap{'\u0194', '\u0194', LowercaseSet, 0x0263},
-	lcMap{'\u0196', '\u0196', LowercaseSet, 0x0269},
-	lcMap{'\u0197', '\u0197', LowercaseSet, 0x0268},
-	lcMap{'\u0198', '\u0198', LowercaseSet, 0x0199},
-	lcMap{'\u019C', '\u019C', LowercaseSet, 0x026F},
-	lcMap{'\u019D', '\u019D', LowercaseSet, 0x0272},
-	lcMap{'\u019F', '\u019F', LowercaseSet, 0x0275},
-	lcMap{'\u01A0', '\u01A4', LowercaseBor, 0},
-	lcMap{'\u01A7', '\u01A7', LowercaseSet, 0x01A8},
-	lcMap{'\u01A9', '\u01A9', LowercaseSet, 0x0283},
-	lcMap{'\u01AC', '\u01AC', LowercaseSet, 0x01AD},
-	lcMap{'\u01AE', '\u01AE', LowercaseSet, 0x0288},
-	lcMap{'\u01AF', '\u01AF', LowercaseSet, 0x01B0},
-	lcMap{'\u01B1', '\u01B2', LowercaseAdd, 217},
-	lcMap{'\u01B3', '\u01B5', LowercaseBad, 0},
-	lcMap{'\u01B7', '\u01B7', LowercaseSet, 0x0292},
-	lcMap{'\u01B8', '\u01B8', LowercaseSet, 0x01B9},
-	lcMap{'\u01BC', '\u01BC', LowercaseSet, 0x01BD},
-	lcMap{'\u01C4', '\u01C5', LowercaseSet, 0x01C6},
-	lcMap{'\u01C7', '\u01C8', LowercaseSet, 0x01C9},
-	lcMap{'\u01CA', '\u01CB', LowercaseSet, 0x01CC},
-	lcMap{'\u01CD', '\u01DB', LowercaseBad, 0},
-	lcMap{'\u01DE', '\u01EE', LowercaseBor, 0},
-	lcMap{'\u01F1', '\u01F2', LowercaseSet, 0x01F3},
-	lcMap{'\u01F4', '\u01F4', LowercaseSet, 0x01F5},
-	lcMap{'\u01FA', '\u0216', LowercaseBor, 0},
-	lcMap{'\u0386', '\u0386', LowercaseSet, 0x03AC},
-	lcMap{'\u0388', '\u038A', LowercaseAdd, 37},
-	lcMap{'\u038C', '\u038C', LowercaseSet, 0x03CC},
-	lcMap{'\u038E', '\u038F', LowercaseAdd, 63},
-	lcMap{'\u0391', '\u03AB', LowercaseAdd, 32},
-	lcMap{'\u03E2', '\u03EE', LowercaseBor, 0},
-	lcMap{'\u0401', '\u040F', LowercaseAdd, 80},
-	lcMap{'\u0410', '\u042F', LowercaseAdd, 32},
-	lcMap{'\u0460', '\u0480', LowercaseBor, 0},
-	lcMap{'\u0490', '\u04BE', LowercaseBor, 0},
-	lcMap{'\u04C1', '\u04C3', LowercaseBad, 0},
-	lcMap{'\u04C7', '\u04C7', LowercaseSet, 0x04C8},
-	lcMap{'\u04CB', '\u04CB', LowercaseSet, 0x04CC},
-	lcMap{'\u04D0', '\u04EA', LowercaseBor, 0},
-	lcMap{'\u04EE', '\u04F4', LowercaseBor, 0},
-	lcMap{'\u04F8', '\u04F8', LowercaseSet, 0x04F9},
-	lcMap{'\u0531', '\u0556', LowercaseAdd, 48},
-	lcMap{'\u10A0', '\u10C5', LowercaseAdd, 48},
-	lcMap{'\u1E00', '\u1EF8', LowercaseBor, 0},
-	lcMap{'\u1F08', '\u1F0F', LowercaseAdd, -8},
-	lcMap{'\u1F18', '\u1F1F', LowercaseAdd, -8},
-	lcMap{'\u1F28', '\u1F2F', LowercaseAdd, -8},
-	lcMap{'\u1F38', '\u1F3F', LowercaseAdd, -8},
-	lcMap{'\u1F48', '\u1F4D', LowercaseAdd, -8},
-	lcMap{'\u1F59', '\u1F59', LowercaseSet, 0x1F51},
-	lcMap{'\u1F5B', '\u1F5B', LowercaseSet, 0x1F53},
-	lcMap{'\u1F5D', '\u1F5D', LowercaseSet, 0x1F55},
-	lcMap{'\u1F5F', '\u1F5F', LowercaseSet, 0x1F57},
-	lcMap{'\u1F68', '\u1F6F', LowercaseAdd, -8},
-	lcMap{'\u1F88', '\u1F8F', LowercaseAdd, -8},
-	lcMap{'\u1F98', '\u1F9F', LowercaseAdd, -8},
-	lcMap{'\u1FA8', '\u1FAF', LowercaseAdd, -8},
-	lcMap{'\u1FB8', '\u1FB9', LowercaseAdd, -8},
-	lcMap{'\u1FBA', '\u1FBB', LowercaseAdd, -74},
-	lcMap{'\u1FBC', '\u1FBC', LowercaseSet, 0x1FB3},
-	lcMap{'\u1FC8', '\u1FCB', LowercaseAdd, -86},
-	lcMap{'\u1FCC', '\u1FCC', LowercaseSet, 0x1FC3},
-	lcMap{'\u1FD8', '\u1FD9', LowercaseAdd, -8},
-	lcMap{'\u1FDA', '\u1FDB', LowercaseAdd, -100},
-	lcMap{'\u1FE8', '\u1FE9', LowercaseAdd, -8},
-	lcMap{'\u1FEA', '\u1FEB', LowercaseAdd, -112},
-	lcMap{'\u1FEC', '\u1FEC', LowercaseSet, 0x1FE5},
-	lcMap{'\u1FF8', '\u1FF9', LowercaseAdd, -128},
-	lcMap{'\u1FFA', '\u1FFB', LowercaseAdd, -126},
-	lcMap{'\u1FFC', '\u1FFC', LowercaseSet, 0x1FF3},
-	lcMap{'\u2160', '\u216F', LowercaseAdd, 16},
-	lcMap{'\u24B6', '\u24D0', LowercaseAdd, 26},
-	lcMap{'\uFF21', '\uFF3A', LowercaseAdd, 32},
-}
-
-func (c *CharSet) addLowercaseRange(chMin, chMax rune) {
-	var i, iMax, iMid int
-	var chMinT, chMaxT rune
-	var lc lcMap
-
-	for i, iMax = 0, len(lcTable); i < iMax; {
-		iMid = (i + iMax) / 2
-		if lcTable[iMid].chMax < chMin {
-			i = iMid + 1
-		} else {
-			iMax = iMid
-		}
-	}
-
-	for ; i < len(lcTable); i++ {
-		lc = lcTable[i]
-		if lc.chMin > chMax {
-			return
-		}
-		chMinT = lc.chMin
-		if chMinT < chMin {
-			chMinT = chMin
-		}
-
-		chMaxT = lc.chMax
-		if chMaxT > chMax {
-			chMaxT = chMax
-		}
-
-		switch lc.op {
-		case LowercaseSet:
-			chMinT = rune(lc.data)
-			chMaxT = rune(lc.data)
-			break
-		case LowercaseAdd:
-			chMinT += lc.data
-			chMaxT += lc.data
-			break
-		case LowercaseBor:
-			chMinT |= 1
-			chMaxT |= 1
-			break
-		case LowercaseBad:
-			chMinT += (chMinT & 1)
-			chMaxT += (chMaxT & 1)
-			break
-		}
-
-		if chMinT < chMin || chMaxT > chMax {
-			c.addRange(chMinT, chMaxT)
-		}
-	}
-}
@@ -1,274 +0,0 @@
-package syntax
-
-import (
-	"bytes"
-	"fmt"
-	"math"
-)
-
-// similar to prog.go in the go regex package...also with comment 'may not belong in this package'
-
-// File provides operator constants for use by the Builder and the Machine.
-
-// Implementation notes:
-//
-// Regexps are built into RegexCodes, which contain an operation array,
-// a string table, and some constants.
-//
-// Each operation is one of the codes below, followed by the integer
-// operands specified for each op.
-//
-// Strings and sets are indices into a string table.
-
-type InstOp int
-
-const (
-	// 					    lef/back operands        description
-
-	Onerep    InstOp = 0 // lef,back char,min,max    a {n}
-	Notonerep        = 1 // lef,back char,min,max    .{n}
-	Setrep           = 2 // lef,back set,min,max     [\d]{n}
-
-	Oneloop    = 3 // lef,back char,min,max    a {,n}
-	Notoneloop = 4 // lef,back char,min,max    .{,n}
-	Setloop    = 5 // lef,back set,min,max     [\d]{,n}
-
-	Onelazy    = 6 // lef,back char,min,max    a {,n}?
-	Notonelazy = 7 // lef,back char,min,max    .{,n}?
-	Setlazy    = 8 // lef,back set,min,max     [\d]{,n}?
-
-	One    = 9  // lef      char            a
-	Notone = 10 // lef      char            [^a]
-	Set    = 11 // lef      set             [a-z\s]  \w \s \d
-
-	Multi = 12 // lef      string          abcd
-	Ref   = 13 // lef      group           \#
-
-	Bol         = 14 //                          ^
-	Eol         = 15 //                          $
-	Boundary    = 16 //                          \b
-	Nonboundary = 17 //                          \B
-	Beginning   = 18 //                          \A
-	Start       = 19 //                          \G
-	EndZ        = 20 //                          \Z
-	End         = 21 //                          \Z
-
-	Nothing = 22 //                          Reject!
-
-	// Primitive control structures
-
-	Lazybranch      = 23 // back     jump            straight first
-	Branchmark      = 24 // back     jump            branch first for loop
-	Lazybranchmark  = 25 // back     jump            straight first for loop
-	Nullcount       = 26 // back     val             set counter, null mark
-	Setcount        = 27 // back     val             set counter, make mark
-	Branchcount     = 28 // back     jump,limit      branch++ if zero<=c<limit
-	Lazybranchcount = 29 // back     jump,limit      same, but straight first
-	Nullmark        = 30 // back                     save position
-	Setmark         = 31 // back                     save position
-	Capturemark     = 32 // back     group           define group
-	Getmark         = 33 // back                     recall position
-	Setjump         = 34 // back                     save backtrack state
-	Backjump        = 35 //                          zap back to saved state
-	Forejump        = 36 //                          zap backtracking state
-	Testref         = 37 //                          backtrack if ref undefined
-	Goto            = 38 //          jump            just go
-
-	Prune = 39 //                          prune it baby
-	Stop  = 40 //                          done!
-
-	ECMABoundary    = 41 //                          \b
-	NonECMABoundary = 42 //                          \B
-
-	// Modifiers for alternate modes
-
-	Mask  = 63  // Mask to get unmodified ordinary operator
-	Rtl   = 64  // bit to indicate that we're reverse scanning.
-	Back  = 128 // bit to indicate that we're backtracking.
-	Back2 = 256 // bit to indicate that we're backtracking on a second branch.
-	Ci    = 512 // bit to indicate that we're case-insensitive.
-)
-
-type Code struct {
-	Codes       []int       // the code
-	Strings     [][]rune    // string table
-	Sets        []*CharSet  //character set table
-	TrackCount  int         // how many instructions use backtracking
-	Caps        map[int]int // mapping of user group numbers -> impl group slots
-	Capsize     int         // number of impl group slots
-	FcPrefix    *Prefix     // the set of candidate first characters (may be null)
-	BmPrefix    *BmPrefix   // the fixed prefix string as a Boyer-Moore machine (may be null)
-	Anchors     AnchorLoc   // the set of zero-length start anchors (RegexFCD.Bol, etc)
-	RightToLeft bool        // true if right to left
-}
-
-func opcodeBacktracks(op InstOp) bool {
-	op &= Mask
-
-	switch op {
-	case Oneloop, Notoneloop, Setloop, Onelazy, Notonelazy, Setlazy, Lazybranch, Branchmark, Lazybranchmark,
-		Nullcount, Setcount, Branchcount, Lazybranchcount, Setmark, Capturemark, Getmark, Setjump, Backjump,
-		Forejump, Goto:
-		return true
-
-	default:
-		return false
-	}
-}
-
-func opcodeSize(op InstOp) int {
-	op &= Mask
-
-	switch op {
-	case Nothing, Bol, Eol, Boundary, Nonboundary, ECMABoundary, NonECMABoundary, Beginning, Start, EndZ,
-		End, Nullmark, Setmark, Getmark, Setjump, Backjump, Forejump, Stop:
-		return 1
-
-	case One, Notone, Multi, Ref, Testref, Goto, Nullcount, Setcount, Lazybranch, Branchmark, Lazybranchmark,
-		Prune, Set:
-		return 2
-
-	case Capturemark, Branchcount, Lazybranchcount, Onerep, Notonerep, Oneloop, Notoneloop, Onelazy, Notonelazy,
-		Setlazy, Setrep, Setloop:
-		return 3
-
-	default:
-		panic(fmt.Errorf("Unexpected op code: %v", op))
-	}
-}
-
-var codeStr = []string{
-	"Onerep", "Notonerep", "Setrep",
-	"Oneloop", "Notoneloop", "Setloop",
-	"Onelazy", "Notonelazy", "Setlazy",
-	"One", "Notone", "Set",
-	"Multi", "Ref",
-	"Bol", "Eol", "Boundary", "Nonboundary", "Beginning", "Start", "EndZ", "End",
-	"Nothing",
-	"Lazybranch", "Branchmark", "Lazybranchmark",
-	"Nullcount", "Setcount", "Branchcount", "Lazybranchcount",
-	"Nullmark", "Setmark", "Capturemark", "Getmark",
-	"Setjump", "Backjump", "Forejump", "Testref", "Goto",
-	"Prune", "Stop",
-	"ECMABoundary", "NonECMABoundary",
-}
-
-func operatorDescription(op InstOp) string {
-	desc := codeStr[op&Mask]
-	if (op & Ci) != 0 {
-		desc += "-Ci"
-	}
-	if (op & Rtl) != 0 {
-		desc += "-Rtl"
-	}
-	if (op & Back) != 0 {
-		desc += "-Back"
-	}
-	if (op & Back2) != 0 {
-		desc += "-Back2"
-	}
-
-	return desc
-}
-
-// OpcodeDescription is a humman readable string of the specific offset
-func (c *Code) OpcodeDescription(offset int) string {
-	buf := &bytes.Buffer{}
-
-	op := InstOp(c.Codes[offset])
-	fmt.Fprintf(buf, "%06d ", offset)
-
-	if opcodeBacktracks(op & Mask) {
-		buf.WriteString("*")
-	} else {
-		buf.WriteString(" ")
-	}
-	buf.WriteString(operatorDescription(op))
-	buf.WriteString("(")
-	op &= Mask
-
-	switch op {
-	case One, Notone, Onerep, Notonerep, Oneloop, Notoneloop, Onelazy, Notonelazy:
-		buf.WriteString("Ch = ")
-		buf.WriteString(CharDescription(rune(c.Codes[offset+1])))
-
-	case Set, Setrep, Setloop, Setlazy:
-		buf.WriteString("Set = ")
-		buf.WriteString(c.Sets[c.Codes[offset+1]].String())
-
-	case Multi:
-		fmt.Fprintf(buf, "String = %s", string(c.Strings[c.Codes[offset+1]]))
-
-	case Ref, Testref:
-		fmt.Fprintf(buf, "Index = %d", c.Codes[offset+1])
-
-	case Capturemark:
-		fmt.Fprintf(buf, "Index = %d", c.Codes[offset+1])
-		if c.Codes[offset+2] != -1 {
-			fmt.Fprintf(buf, ", Unindex = %d", c.Codes[offset+2])
-		}
-
-	case Nullcount, Setcount:
-		fmt.Fprintf(buf, "Value = %d", c.Codes[offset+1])
-
-	case Goto, Lazybranch, Branchmark, Lazybranchmark, Branchcount, Lazybranchcount:
-		fmt.Fprintf(buf, "Addr = %d", c.Codes[offset+1])
-	}
-
-	switch op {
-	case Onerep, Notonerep, Oneloop, Notoneloop, Onelazy, Notonelazy, Setrep, Setloop, Setlazy:
-		buf.WriteString(", Rep = ")
-		if c.Codes[offset+2] == math.MaxInt32 {
-			buf.WriteString("inf")
-		} else {
-			fmt.Fprintf(buf, "%d", c.Codes[offset+2])
-		}
-
-	case Branchcount, Lazybranchcount:
-		buf.WriteString(", Limit = ")
-		if c.Codes[offset+2] == math.MaxInt32 {
-			buf.WriteString("inf")
-		} else {
-			fmt.Fprintf(buf, "%d", c.Codes[offset+2])
-		}
-
-	}
-
-	buf.WriteString(")")
-
-	return buf.String()
-}
-
-func (c *Code) Dump() string {
-	buf := &bytes.Buffer{}
-
-	if c.RightToLeft {
-		fmt.Fprintln(buf, "Direction:  right-to-left")
-	} else {
-		fmt.Fprintln(buf, "Direction:  left-to-right")
-	}
-	if c.FcPrefix == nil {
-		fmt.Fprintln(buf, "Firstchars: n/a")
-	} else {
-		fmt.Fprintf(buf, "Firstchars: %v\n", c.FcPrefix.PrefixSet.String())
-	}
-
-	if c.BmPrefix == nil {
-		fmt.Fprintln(buf, "Prefix:     n/a")
-	} else {
-		fmt.Fprintf(buf, "Prefix:     %v\n", Escape(c.BmPrefix.String()))
-	}
-
-	fmt.Fprintf(buf, "Anchors:    %v\n", c.Anchors)
-	fmt.Fprintln(buf)
-
-	if c.BmPrefix != nil {
-		fmt.Fprintln(buf, "BoyerMoore:")
-		fmt.Fprintln(buf, c.BmPrefix.Dump("    "))
-	}
-	for i := 0; i < len(c.Codes); i += opcodeSize(InstOp(c.Codes[i])) {
-		fmt.Fprintln(buf, c.OpcodeDescription(i))
-	}
-
-	return buf.String()
-}
@@ -1,654 +0,0 @@
-package syntax
-
-import (
-	"bytes"
-	"fmt"
-	"math"
-	"strconv"
-)
-
-type RegexTree struct {
-	root       *regexNode
-	caps       map[int]int
-	capnumlist []int
-	captop     int
-	Capnames   map[string]int
-	Caplist    []string
-	options    RegexOptions
-}
-
-// It is built into a parsed tree for a regular expression.
-
-// Implementation notes:
-//
-// Since the node tree is a temporary data structure only used
-// during compilation of the regexp to integer codes, it's
-// designed for clarity and convenience rather than
-// space efficiency.
-//
-// RegexNodes are built into a tree, linked by the n.children list.
-// Each node also has a n.parent and n.ichild member indicating
-// its parent and which child # it is in its parent's list.
-//
-// RegexNodes come in as many types as there are constructs in
-// a regular expression, for example, "concatenate", "alternate",
-// "one", "rept", "group". There are also node types for basic
-// peephole optimizations, e.g., "onerep", "notsetrep", etc.
-//
-// Because perl 5 allows "lookback" groups that scan backwards,
-// each node also gets a "direction". Normally the value of
-// boolean n.backward = false.
-//
-// During parsing, top-level nodes are also stacked onto a parse
-// stack (a stack of trees). For this purpose we have a n.next
-// pointer. [Note that to save a few bytes, we could overload the
-// n.parent pointer instead.]
-//
-// On the parse stack, each tree has a "role" - basically, the
-// nonterminal in the grammar that the parser has currently
-// assigned to the tree. That code is stored in n.role.
-//
-// Finally, some of the different kinds of nodes have data.
-// Two integers (for the looping constructs) are stored in
-// n.operands, an an object (either a string or a set)
-// is stored in n.data
-type regexNode struct {
-	t        nodeType
-	children []*regexNode
-	str      []rune
-	set      *CharSet
-	ch       rune
-	m        int
-	n        int
-	options  RegexOptions
-	next     *regexNode
-}
-
-type nodeType int32
-
-const (
-	// The following are leaves, and correspond to primitive operations
-
-	ntOnerep      nodeType = 0  // lef,back char,min,max    a {n}
-	ntNotonerep            = 1  // lef,back char,min,max    .{n}
-	ntSetrep               = 2  // lef,back set,min,max     [\d]{n}
-	ntOneloop              = 3  // lef,back char,min,max    a {,n}
-	ntNotoneloop           = 4  // lef,back char,min,max    .{,n}
-	ntSetloop              = 5  // lef,back set,min,max     [\d]{,n}
-	ntOnelazy              = 6  // lef,back char,min,max    a {,n}?
-	ntNotonelazy           = 7  // lef,back char,min,max    .{,n}?
-	ntSetlazy              = 8  // lef,back set,min,max     [\d]{,n}?
-	ntOne                  = 9  // lef      char            a
-	ntNotone               = 10 // lef      char            [^a]
-	ntSet                  = 11 // lef      set             [a-z\s]  \w \s \d
-	ntMulti                = 12 // lef      string          abcd
-	ntRef                  = 13 // lef      group           \#
-	ntBol                  = 14 //                          ^
-	ntEol                  = 15 //                          $
-	ntBoundary             = 16 //                          \b
-	ntNonboundary          = 17 //                          \B
-	ntBeginning            = 18 //                          \A
-	ntStart                = 19 //                          \G
-	ntEndZ                 = 20 //                          \Z
-	ntEnd                  = 21 //                          \Z
-
-	// Interior nodes do not correspond to primitive operations, but
-	// control structures compositing other operations
-
-	// Concat and alternate take n children, and can run forward or backwards
-
-	ntNothing     = 22 //          []
-	ntEmpty       = 23 //          ()
-	ntAlternate   = 24 //          a|b
-	ntConcatenate = 25 //          ab
-	ntLoop        = 26 // m,x      * + ? {,}
-	ntLazyloop    = 27 // m,x      *? +? ?? {,}?
-	ntCapture     = 28 // n        ()
-	ntGroup       = 29 //          (?:)
-	ntRequire     = 30 //          (?=) (?<=)
-	ntPrevent     = 31 //          (?!) (?<!)
-	ntGreedy      = 32 //          (?>) (?<)
-	ntTestref     = 33 //          (?(n) | )
-	ntTestgroup   = 34 //          (?(...) | )
-
-	ntECMABoundary    = 41 //                          \b
-	ntNonECMABoundary = 42 //                          \B
-)
-
-func newRegexNode(t nodeType, opt RegexOptions) *regexNode {
-	return &regexNode{
-		t:       t,
-		options: opt,
-	}
-}
-
-func newRegexNodeCh(t nodeType, opt RegexOptions, ch rune) *regexNode {
-	return &regexNode{
-		t:       t,
-		options: opt,
-		ch:      ch,
-	}
-}
-
-func newRegexNodeStr(t nodeType, opt RegexOptions, str []rune) *regexNode {
-	return &regexNode{
-		t:       t,
-		options: opt,
-		str:     str,
-	}
-}
-
-func newRegexNodeSet(t nodeType, opt RegexOptions, set *CharSet) *regexNode {
-	return &regexNode{
-		t:       t,
-		options: opt,
-		set:     set,
-	}
-}
-
-func newRegexNodeM(t nodeType, opt RegexOptions, m int) *regexNode {
-	return &regexNode{
-		t:       t,
-		options: opt,
-		m:       m,
-	}
-}
-func newRegexNodeMN(t nodeType, opt RegexOptions, m, n int) *regexNode {
-	return &regexNode{
-		t:       t,
-		options: opt,
-		m:       m,
-		n:       n,
-	}
-}
-
-func (n *regexNode) writeStrToBuf(buf *bytes.Buffer) {
-	for i := 0; i < len(n.str); i++ {
-		buf.WriteRune(n.str[i])
-	}
-}
-
-func (n *regexNode) addChild(child *regexNode) {
-	reduced := child.reduce()
-	n.children = append(n.children, reduced)
-	reduced.next = n
-}
-
-func (n *regexNode) insertChildren(afterIndex int, nodes []*regexNode) {
-	newChildren := make([]*regexNode, 0, len(n.children)+len(nodes))
-	n.children = append(append(append(newChildren, n.children[:afterIndex]...), nodes...), n.children[afterIndex:]...)
-}
-
-// removes children including the start but not the end index
-func (n *regexNode) removeChildren(startIndex, endIndex int) {
-	n.children = append(n.children[:startIndex], n.children[endIndex:]...)
-}
-
-// Pass type as OneLazy or OneLoop
-func (n *regexNode) makeRep(t nodeType, min, max int) {
-	n.t += (t - ntOne)
-	n.m = min
-	n.n = max
-}
-
-func (n *regexNode) reduce() *regexNode {
-	switch n.t {
-	case ntAlternate:
-		return n.reduceAlternation()
-
-	case ntConcatenate:
-		return n.reduceConcatenation()
-
-	case ntLoop, ntLazyloop:
-		return n.reduceRep()
-
-	case ntGroup:
-		return n.reduceGroup()
-
-	case ntSet, ntSetloop:
-		return n.reduceSet()
-
-	default:
-		return n
-	}
-}
-
-// Basic optimization. Single-letter alternations can be replaced
-// by faster set specifications, and nested alternations with no
-// intervening operators can be flattened:
-//
-// a|b|c|def|g|h -> [a-c]|def|[gh]
-// apple|(?:orange|pear)|grape -> apple|orange|pear|grape
-func (n *regexNode) reduceAlternation() *regexNode {
-	if len(n.children) == 0 {
-		return newRegexNode(ntNothing, n.options)
-	}
-
-	wasLastSet := false
-	lastNodeCannotMerge := false
-	var optionsLast RegexOptions
-	var i, j int
-
-	for i, j = 0, 0; i < len(n.children); i, j = i+1, j+1 {
-		at := n.children[i]
-
-		if j < i {
-			n.children[j] = at
-		}
-
-		for {
-			if at.t == ntAlternate {
-				for k := 0; k < len(at.children); k++ {
-					at.children[k].next = n
-				}
-				n.insertChildren(i+1, at.children)
-
-				j--
-			} else if at.t == ntSet || at.t == ntOne {
-				// Cannot merge sets if L or I options differ, or if either are negated.
-				optionsAt := at.options & (RightToLeft | IgnoreCase)
-
-				if at.t == ntSet {
-					if !wasLastSet || optionsLast != optionsAt || lastNodeCannotMerge || !at.set.IsMergeable() {
-						wasLastSet = true
-						lastNodeCannotMerge = !at.set.IsMergeable()
-						optionsLast = optionsAt
-						break
-					}
-				} else if !wasLastSet || optionsLast != optionsAt || lastNodeCannotMerge {
-					wasLastSet = true
-					lastNodeCannotMerge = false
-					optionsLast = optionsAt
-					break
-				}
-
-				// The last node was a Set or a One, we're a Set or One and our options are the same.
-				// Merge the two nodes.
-				j--
-				prev := n.children[j]
-
-				var prevCharClass *CharSet
-				if prev.t == ntOne {
-					prevCharClass = &CharSet{}
-					prevCharClass.addChar(prev.ch)
-				} else {
-					prevCharClass = prev.set
-				}
-
-				if at.t == ntOne {
-					prevCharClass.addChar(at.ch)
-				} else {
-					prevCharClass.addSet(*at.set)
-				}
-
-				prev.t = ntSet
-				prev.set = prevCharClass
-			} else if at.t == ntNothing {
-				j--
-			} else {
-				wasLastSet = false
-				lastNodeCannotMerge = false
-			}
-			break
-		}
-	}
-
-	if j < i {
-		n.removeChildren(j, i)
-	}
-
-	return n.stripEnation(ntNothing)
-}
-
-// Basic optimization. Adjacent strings can be concatenated.
-//
-// (?:abc)(?:def) -> abcdef
-func (n *regexNode) reduceConcatenation() *regexNode {
-	// Eliminate empties and concat adjacent strings/chars
-
-	var optionsLast RegexOptions
-	var optionsAt RegexOptions
-	var i, j int
-
-	if len(n.children) == 0 {
-		return newRegexNode(ntEmpty, n.options)
-	}
-
-	wasLastString := false
-
-	for i, j = 0, 0; i < len(n.children); i, j = i+1, j+1 {
-		var at, prev *regexNode
-
-		at = n.children[i]
-
-		if j < i {
-			n.children[j] = at
-		}
-
-		if at.t == ntConcatenate &&
-			((at.options & RightToLeft) == (n.options & RightToLeft)) {
-			for k := 0; k < len(at.children); k++ {
-				at.children[k].next = n
-			}
-
-			//insert at.children at i+1 index in n.children
-			n.insertChildren(i+1, at.children)
-
-			j--
-		} else if at.t == ntMulti || at.t == ntOne {
-			// Cannot merge strings if L or I options differ
-			optionsAt = at.options & (RightToLeft | IgnoreCase)
-
-			if !wasLastString || optionsLast != optionsAt {
-				wasLastString = true
-				optionsLast = optionsAt
-				continue
-			}
-
-			j--
-			prev = n.children[j]
-
-			if prev.t == ntOne {
-				prev.t = ntMulti
-				prev.str = []rune{prev.ch}
-			}
-
-			if (optionsAt & RightToLeft) == 0 {
-				if at.t == ntOne {
-					prev.str = append(prev.str, at.ch)
-				} else {
-					prev.str = append(prev.str, at.str...)
-				}
-			} else {
-				if at.t == ntOne {
-					// insert at the front by expanding our slice, copying the data over, and then setting the value
-					prev.str = append(prev.str, 0)
-					copy(prev.str[1:], prev.str)
-					prev.str[0] = at.ch
-				} else {
-					//insert at the front...this one we'll make a new slice and copy both into it
-					merge := make([]rune, len(prev.str)+len(at.str))
-					copy(merge, at.str)
-					copy(merge[len(at.str):], prev.str)
-					prev.str = merge
-				}
-			}
-		} else if at.t == ntEmpty {
-			j--
-		} else {
-			wasLastString = false
-		}
-	}
-
-	if j < i {
-		// remove indices j through i from the children
-		n.removeChildren(j, i)
-	}
-
-	return n.stripEnation(ntEmpty)
-}
-
-// Nested repeaters just get multiplied with each other if they're not
-// too lumpy
-func (n *regexNode) reduceRep() *regexNode {
-
-	u := n
-	t := n.t
-	min := n.m
-	max := n.n
-
-	for {
-		if len(u.children) == 0 {
-			break
-		}
-
-		child := u.children[0]
-
-		// multiply reps of the same type only
-		if child.t != t {
-			childType := child.t
-
-			if !(childType >= ntOneloop && childType <= ntSetloop && t == ntLoop ||
-				childType >= ntOnelazy && childType <= ntSetlazy && t == ntLazyloop) {
-				break
-			}
-		}
-
-		// child can be too lumpy to blur, e.g., (a {100,105}) {3} or (a {2,})?
-		// [but things like (a {2,})+ are not too lumpy...]
-		if u.m == 0 && child.m > 1 || child.n < child.m*2 {
-			break
-		}
-
-		u = child
-		if u.m > 0 {
-			if (math.MaxInt32-1)/u.m < min {
-				u.m = math.MaxInt32
-			} else {
-				u.m = u.m * min
-			}
-		}
-		if u.n > 0 {
-			if (math.MaxInt32-1)/u.n < max {
-				u.n = math.MaxInt32
-			} else {
-				u.n = u.n * max
-			}
-		}
-	}
-
-	if math.MaxInt32 == min {
-		return newRegexNode(ntNothing, n.options)
-	}
-	return u
-
-}
-
-// Simple optimization. If a concatenation or alternation has only
-// one child strip out the intermediate node. If it has zero children,
-// turn it into an empty.
-func (n *regexNode) stripEnation(emptyType nodeType) *regexNode {
-	switch len(n.children) {
-	case 0:
-		return newRegexNode(emptyType, n.options)
-	case 1:
-		return n.children[0]
-	default:
-		return n
-	}
-}
-
-func (n *regexNode) reduceGroup() *regexNode {
-	u := n
-
-	for u.t == ntGroup {
-		u = u.children[0]
-	}
-
-	return u
-}
-
-// Simple optimization. If a set is a singleton, an inverse singleton,
-// or empty, it's transformed accordingly.
-func (n *regexNode) reduceSet() *regexNode {
-	// Extract empty-set, one and not-one case as special
-
-	if n.set == nil {
-		n.t = ntNothing
-	} else if n.set.IsSingleton() {
-		n.ch = n.set.SingletonChar()
-		n.set = nil
-		n.t += (ntOne - ntSet)
-	} else if n.set.IsSingletonInverse() {
-		n.ch = n.set.SingletonChar()
-		n.set = nil
-		n.t += (ntNotone - ntSet)
-	}
-
-	return n
-}
-
-func (n *regexNode) reverseLeft() *regexNode {
-	if n.options&RightToLeft != 0 && n.t == ntConcatenate && len(n.children) > 0 {
-		//reverse children order
-		for left, right := 0, len(n.children)-1; left < right; left, right = left+1, right-1 {
-			n.children[left], n.children[right] = n.children[right], n.children[left]
-		}
-	}
-
-	return n
-}
-
-func (n *regexNode) makeQuantifier(lazy bool, min, max int) *regexNode {
-	if min == 0 && max == 0 {
-		return newRegexNode(ntEmpty, n.options)
-	}
-
-	if min == 1 && max == 1 {
-		return n
-	}
-
-	switch n.t {
-	case ntOne, ntNotone, ntSet:
-		if lazy {
-			n.makeRep(Onelazy, min, max)
-		} else {
-			n.makeRep(Oneloop, min, max)
-		}
-		return n
-
-	default:
-		var t nodeType
-		if lazy {
-			t = ntLazyloop
-		} else {
-			t = ntLoop
-		}
-		result := newRegexNodeMN(t, n.options, min, max)
-		result.addChild(n)
-		return result
-	}
-}
-
-// debug functions
-
-var typeStr = []string{
-	"Onerep", "Notonerep", "Setrep",
-	"Oneloop", "Notoneloop", "Setloop",
-	"Onelazy", "Notonelazy", "Setlazy",
-	"One", "Notone", "Set",
-	"Multi", "Ref",
-	"Bol", "Eol", "Boundary", "Nonboundary",
-	"Beginning", "Start", "EndZ", "End",
-	"Nothing", "Empty",
-	"Alternate", "Concatenate",
-	"Loop", "Lazyloop",
-	"Capture", "Group", "Require", "Prevent", "Greedy",
-	"Testref", "Testgroup",
-	"Unknown", "Unknown", "Unknown",
-	"Unknown", "Unknown", "Unknown",
-	"ECMABoundary", "NonECMABoundary",
-}
-
-func (n *regexNode) description() string {
-	buf := &bytes.Buffer{}
-
-	buf.WriteString(typeStr[n.t])
-
-	if (n.options & ExplicitCapture) != 0 {
-		buf.WriteString("-C")
-	}
-	if (n.options & IgnoreCase) != 0 {
-		buf.WriteString("-I")
-	}
-	if (n.options & RightToLeft) != 0 {
-		buf.WriteString("-L")
-	}
-	if (n.options & Multiline) != 0 {
-		buf.WriteString("-M")
-	}
-	if (n.options & Singleline) != 0 {
-		buf.WriteString("-S")
-	}
-	if (n.options & IgnorePatternWhitespace) != 0 {
-		buf.WriteString("-X")
-	}
-	if (n.options & ECMAScript) != 0 {
-		buf.WriteString("-E")
-	}
-
-	switch n.t {
-	case ntOneloop, ntNotoneloop, ntOnelazy, ntNotonelazy, ntOne, ntNotone:
-		buf.WriteString("(Ch = " + CharDescription(n.ch) + ")")
-		break
-	case ntCapture:
-		buf.WriteString("(index = " + strconv.Itoa(n.m) + ", unindex = " + strconv.Itoa(n.n) + ")")
-		break
-	case ntRef, ntTestref:
-		buf.WriteString("(index = " + strconv.Itoa(n.m) + ")")
-		break
-	case ntMulti:
-		fmt.Fprintf(buf, "(String = %s)", string(n.str))
-		break
-	case ntSet, ntSetloop, ntSetlazy:
-		buf.WriteString("(Set = " + n.set.String() + ")")
-		break
-	}
-
-	switch n.t {
-	case ntOneloop, ntNotoneloop, ntOnelazy, ntNotonelazy, ntSetloop, ntSetlazy, ntLoop, ntLazyloop:
-		buf.WriteString("(Min = ")
-		buf.WriteString(strconv.Itoa(n.m))
-		buf.WriteString(", Max = ")
-		if n.n == math.MaxInt32 {
-			buf.WriteString("inf")
-		} else {
-			buf.WriteString(strconv.Itoa(n.n))
-		}
-		buf.WriteString(")")
-
-		break
-	}
-
-	return buf.String()
-}
-
-var padSpace = []byte("                                ")
-
-func (t *RegexTree) Dump() string {
-	return t.root.dump()
-}
-
-func (n *regexNode) dump() string {
-	var stack []int
-	CurNode := n
-	CurChild := 0
-
-	buf := bytes.NewBufferString(CurNode.description())
-	buf.WriteRune('\n')
-
-	for {
-		if CurNode.children != nil && CurChild < len(CurNode.children) {
-			stack = append(stack, CurChild+1)
-			CurNode = CurNode.children[CurChild]
-			CurChild = 0
-
-			Depth := len(stack)
-			if Depth > 32 {
-				Depth = 32
-			}
-			buf.Write(padSpace[:Depth])
-			buf.WriteString(CurNode.description())
-			buf.WriteRune('\n')
-		} else {
-			if len(stack) == 0 {
-				break
-			}
-
-			CurChild = stack[len(stack)-1]
-			stack = stack[:len(stack)-1]
-			CurNode = CurNode.next
-		}
-	}
-	return buf.String()
-}
@@ -25,3 +25,5 @@ _testmain.go
 *.out

 .DS_Store
+*.txt
+benchmarks/
--- a/Show More
+++ b/Show More