@agentcomms/resend 0.17.0 → 0.18.0

package/dist/{send-DEor7f1N.mjs → send-D-SXJezp.mjs}

@@ -12,7 +12,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.17.0";
+const VERSION$1 = "0.18.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +201,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-XMsGuXRl.mjs
+//#region ../core/dist/update-check-C_PW2LlM.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -1386,6 +1386,24 @@ const CHANNEL_SNAPSHOT = [
 		}
 	}
 ];
+/** Every declared service server: what core knows about it without installing it. */
+const SERVICE_SNAPSHOT = [{
+	packageName: "@agentcomms/events-daemon",
+	declaration: {
+		kind: "service",
+		binary: "agent-events",
+		server: {
+			defaultName: "events",
+			entry: "src/mcp/server.ts",
+			factory: "createEventsMcpServer"
+		},
+		operations: "src/operations",
+		skills: {
+			prefix: "agentcomms-",
+			contract: "skills/_shared/contract-events.md"
+		}
+	}
+}];
 const DISCLOSURE_VERSION_KINDS = [
 	"rule",
 	"target",
@@ -1575,8 +1593,8 @@ function bindingDigestOf(record) {
 * Everywhere but Windows that shell is a POSIX one, and a word goes in single quotes, inside which nothing is special
 * but the quote itself. Windows has two shells, and neither reads single quotes that way: cmd.exe does not take them
 * as quotes at all, so `'C:\Profiles\First Last\outgoing'` reached the command as two words, quote marks and all, and
-* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A command printed on Windows
-* has to be safe in both, because nothing says which one it will be pasted into (CUE-306) — and safe is not enough:
+* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A common line printed on
+* Windows has to be safe in both — and safe is not enough:
 * the program has to receive the same words from either. Three readers stand between the line and the program. cmd.exe
 * hands the program the line as it is, and the program's own parser (the C runtime's, Node's) splits it. PowerShell
 * reads the line itself, a double-quoted word with its backslashes as plain characters, and then writes a new command
@@ -1603,15 +1621,17 @@ function bindingDigestOf(record) {
 *   backslash, which the C runtime reads with the closing quote as `\"` — and doubled for it, PowerShell 7 passes both
 *   backslashes on where cmd.exe and Windows PowerShell pass one; and a word with `& | < > ^ ( )` but no whitespace,
 *   which PowerShell passes to a `.cmd` script unquoted, for cmd.exe to run `&whoami` from or to split at `|`.
-* - With any other word in it, no line is printed at all (`line` is null), and the printers show the command's words
+* - With any other word in it, the common renderer has no line, and the printers show the command's words
 *   as JSON instead, saying it has to be typed. Not a line with the word left out: a placeholder in its place was
 *   still a command that ran — `claude mcp remove NAME` removed whatever entry was called `NAME`, and an install
 *   hint's `--force` replaced it — and before that, a word quoted for PowerShell's single quotes, which cmd.exe reads
 *   as characters, ran `whoami` from a server named `$x&whoami&`. See `commandAsJson` for why the JSON runs nothing.
 *
-* - The program itself has to be left as it is. Quoted, it is a string to PowerShell rather than a command — PowerShell
-*   runs a quoted program only after `&`, which cmd.exe reads as the end of a command — so a program whose path needs
-*   quotes, as `C:\Program Files\nodejs\node.exe` does, leaves the command with no line either (CUE-403).
+* - The program itself has to be left as it is in the common form. Quoted, it is a string to PowerShell rather than a
+*   command. When its path needs quoting, CUE-410 may emit a labelled PowerShell line: `&`, then every word in single
+*   quotes, with an inner single quote doubled. Empty words, trailing backslashes, double quotes and control or
+*   formatting characters retain the inert-JSON fallback because their native-program boundary cannot be proved
+*   across the supported PowerShell versions.
 *
 * Everywhere else there is always a line: single quotes make any word safe.
 *
@@ -1627,9 +1647,23 @@ function quoteCommand(words, platform) {
 	};
 	const printed = words.map(windowsShellWord);
 	const programBare = words.length === 0 || printed[0] === words[0];
+	if (!printed.includes(null) && programBare) return {
+		words,
+		line: printed.join(" "),
+		platform
+	};
+	if (!programBare && printed.slice(1).every((word) => word !== null)) {
+		const powershell = words.map(powerShellWord);
+		if (!powershell.includes(null)) return {
+			words,
+			line: `& ${powershell.join(" ")}`,
+			platform,
+			shell: "powershell"
+		};
+	}
 	return {
 		words,
-		line: printed.includes(null) || !programBare ? null : printed.join(" "),
+		line: null,
 		platform
 	};
 }
@@ -1642,6 +1676,14 @@ function quotedLineWithWordsToFill(command, ...toFill) {
 	if (command.line === null) return null;
 	const sentinel = command.words.indexOf("--");
 	if (sentinel < 0) return [command.line, ...toFill].join(" ");
+	if (command.shell === "powershell") {
+		const printed = command.words.map((each) => powerShellWord(each));
+		return `& ${[
+			...printed.slice(0, sentinel),
+			...toFill,
+			...printed.slice(sentinel)
+		].join(" ")}`;
+	}
 	const word = command.platform === "win32" ? windowsShellWord : posixShellWord;
 	const printed = command.words.map((each) => word(each));
 	return [
@@ -1669,6 +1711,11 @@ function windowsShellWord(word) {
 	if (/[&|<>^()]/.test(word) && !/\s/.test(word)) return null;
 	return `"${word}"`;
 }
+/** One native-command word in a PowerShell single-quoted literal, or null when a one-line call is not provable. */
+function powerShellWord(word) {
+	if (word === "" || word.endsWith("\\") || /["\u201C-\u201E]|[\p{C}\p{Zl}\p{Zp}]/u.test(word)) return null;
+	return `'${word.replaceAll("'", "''")}'`;
+}
 /**
 * The words of a command as a JSON array, for a command that cannot be printed as a line: something to read, and to
 * parse, and nothing to run.
@@ -1699,17 +1746,19 @@ function commandAsJson(words) {
 /** What is said beside a command shown as JSON. */
 const TO_TYPE = "the command's words, written as JSON: one of them cannot be quoted the same way for cmd.exe and for PowerShell, so type the command yourself, with that word quoted for the shell you use";
 /** What is said beside a command shown as JSON because its program's path needs quotes. */
-const TO_TYPE_PROGRAM = "the command's words, written as JSON: the program's path needs quotes, and PowerShell runs a quoted program only after `&`, which cmd.exe does not accept, so type the command yourself, with each word quoted for the shell you use and, in PowerShell, `&` before the program";
+const TO_TYPE_PROGRAM = "the command's words, written as JSON: the program's path needs quoting and at least one word cannot be represented safely in a one-line PowerShell call, so type the command yourself, with each word quoted for the shell you use and, in PowerShell, `&` before the program";
 function toType(command) {
 	return programNeedsQuotes(command) ? TO_TYPE_PROGRAM : TO_TYPE;
 }
 /** Quoted words in backticks, for a sentence — as words in JSON, saying it has to be typed, when there is no line. */
 function inlineQuoted(command) {
-	return command.line === null ? `\`${commandAsJson(command.words)}\` (${toType(command)})` : `\`${command.line}\``;
+	if (command.line === null) return `\`${commandAsJson(command.words)}\` (${toType(command)})`;
+	return `\`${command.line}\`${command.shell === "powershell" ? " (PowerShell)" : ""}`;
 }
 /** Quoted words as text of their own — a list's line, a field's value — or as words in JSON, saying to type them. */
 function quotedText(command) {
-	return command.line === null ? `${commandAsJson(command.words)} (${toType(command)})` : command.line;
+	if (command.line === null) return `${commandAsJson(command.words)} (${toType(command)})`;
+	return command.shell === "powershell" ? `PowerShell:\n${command.line}` : command.line;
 }
 /**
 * The same command with words the agent is to fill in — a placeholder such as `<folder>` — before its first `--`: for
@@ -2173,7 +2222,7 @@ function handoffSentence(handoff, say, options = {}) {
 function handoffSentenceToFill(handoff, toFill, say, options = {}) {
 	if (!isCommand(handoff)) return noCommand(handoff, options);
 	const line = lineWithWordsToFill(handoff, ...toFill);
-	if (line !== null) return say(`\`${line}\``);
+	if (line !== null) return say(`\`${line}\`${handoff.shell === "powershell" ? " (PowerShell)" : ""}`);
 	return say(inlineQuoted(quotedWithWordsToFill(handoff, toFill)));
 }
 /**
@@ -2393,7 +2442,7 @@ function nearestPackage(start) {
 * Whether `path` is `root` or inside it, by whole path segments: `/x/core-evil` is not inside `/x/core`, which a
 * comparison of strings would say it was. Both are taken as given; a caller compares real paths with real paths.
 */
-function isWithin(root, path) {
+function isWithin$1(root, path) {
 	const between = relative(resolve(root), resolve(path));
 	return between === "" || !isAbsolute(between) && between !== ".." && !/^\.\.[\\/]/.test(between);
 }
@@ -2463,15 +2512,18 @@ var ExternalCommand = class {
 	#reason;
 	/** The words, as the program is to receive them. */
 	words;
-	/** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+	/** The line to paste; null when no supported common or labelled shell rendering is safe. */
 	line;
 	platform;
+	shell;
 	constructor(gate, words, platform, reason) {
 		if (gate !== GATE$1) throw new TypeError("an external command is made by externalCommand, and only there");
 		this.#reason = reason;
 		this.words = Object.freeze([...words]);
-		this.line = quoteCommand(this.words, platform).line;
+		const quoted = quoteCommand(this.words, platform);
+		this.line = quoted.line;
 		this.platform = platform;
+		if (quoted.shell !== void 0) this.shell = quoted.shell;
 		Object.freeze(this);
 	}
 	/** Why this program, which is not part of this suite, is one a person may be told to run. */
@@ -3185,6 +3237,343 @@ function commandLinePackage(command, args) {
 	const line = [command, ...withoutPathOptions(args).words].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
+const RECEIPT_VERSION = 1;
+const RECEIPT_FILE = "managed-shims.json";
+const MUTATION_LOCK_FILE = "managed-shims.lock";
+const POSIX_SHIM_MODE = 493;
+const WINDOWS_SHIM_NOTICE = "Managed CLI shims are not offered on Windows yet because cmd.exe re-parses arguments forwarded through .cmd files, including shell metacharacters. Use the full-path command or the labelled PowerShell & line the result provides.";
+function platformOf(context) {
+	return context.platform ?? process.platform;
+}
+/** Why the selected platform has no managed shim in this release. */
+function managedShimUnsupportedNotice(context = {}) {
+	return platformOf(context) === "win32" ? WINDOWS_SHIM_NOTICE : "Managed CLI shims are offered only on macOS and Linux in this release. Use the full-path command the result provides.";
+}
+/** The per-user directory managed installs put their command shims in. */
+function managedShimDirectory(context) {
+	if (!managedShimsSupported(context)) throw new CommsError("CONFIG", managedShimUnsupportedNotice(context));
+	return join(homeDirectory(context.env), ".local", "bin");
+}
+/** Managed CLI shims are POSIX-only until Windows has an argument-forwarding form that does not re-parse input. */
+function managedShimsSupported(context = {}) {
+	const platform = platformOf(context);
+	return platform === "darwin" || platform === "linux";
+}
+/** A managed shim's name: one plain command word, never a path, so joining it to the directory stays inside it. */
+function isSafeBinary(binary) {
+	return /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(binary);
+}
+function checkedBinary(binary) {
+	if (!isSafeBinary(binary)) throw new CommsError("CONFIG", `${JSON.stringify(binary)} is not a safe managed CLI binary name`);
+	return binary;
+}
+/** The exact path for one declared binary's managed shim. */
+function managedShimPath(context, binary) {
+	return join(managedShimDirectory(context), checkedBinary(binary));
+}
+function receiptPath(context) {
+	return join(context.dataDir, RECEIPT_FILE);
+}
+function emptyReceipt() {
+	return {
+		version: RECEIPT_VERSION,
+		shims: {}
+	};
+}
+async function readReceipt(context) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(receiptPath(context), "utf8"));
+	} catch (error) {
+		return error.code === "ENOENT" ? emptyReceipt() : null;
+	}
+	if (typeof parsed !== "object" || parsed === null || parsed.version !== RECEIPT_VERSION || typeof parsed.shims !== "object" || parsed.shims === null) return null;
+	const shims = {};
+	for (const [binary, value] of Object.entries(parsed.shims)) {
+		if (!isSafeBinary(binary) || typeof value !== "object" || value === null || ![
+			"path",
+			"digest",
+			"node",
+			"entry"
+		].every((key) => typeof value[key] === "string")) return null;
+		shims[binary] = value;
+	}
+	return {
+		version: RECEIPT_VERSION,
+		shims
+	};
+}
+async function writeReceipt(context, receipt) {
+	await writeFileAtomic(receiptPath(context), `${JSON.stringify(receipt, null, 2)}\n`);
+}
+function sha256(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function posixWord(word) {
+	return `'${word.replaceAll("'", `'"'"'`)}'`;
+}
+function shimSource(spec) {
+	return `#!/bin/sh\n# managed CLI shim v1\nexec ${spec.command.map(posixWord).join(" ")} "$@"\n`;
+}
+async function pinShimDirectory(context, create) {
+	const publicDirectory = managedShimDirectory(context);
+	if (create) await mkdir(publicDirectory, {
+		recursive: true,
+		mode: 493
+	});
+	let resolved;
+	try {
+		resolved = await realpath(publicDirectory);
+	} catch (error) {
+		if (!create && error.code === "ENOENT") return null;
+		throw error;
+	}
+	return {
+		public: publicDirectory,
+		resolved
+	};
+}
+async function assertPinnedDirectory(directory) {
+	let now;
+	try {
+		now = await realpath(directory.public);
+	} catch {
+		throw new CommsError("CONFIG", `the managed shim directory's resolved directory changed from ${directory.resolved} during the operation`, { hint: "Nothing was changed. Inspect the directory link, then run the install, update or prune again." });
+	}
+	if (now !== directory.resolved) throw new CommsError("CONFIG", `the managed shim directory's resolved directory changed from ${directory.resolved} to ${now} during the operation`, { hint: "Nothing was changed. Inspect the directory link, then run the install, update or prune again." });
+}
+async function regularFileBytes(path) {
+	try {
+		if (!(await lstat(path)).isFile()) return null;
+		return await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function pathExists(path) {
+	try {
+		await lstat(path);
+		return true;
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+/** Serialize this installation's receipt and shim mutations across its processes. */
+async function withMutationLock(context, change) {
+	await mkdir(context.dataDir, {
+		recursive: true,
+		mode: 448
+	});
+	return withFileLock(join(context.dataDir, MUTATION_LOCK_FILE), change, {
+		timeoutMs: 5e3,
+		staleMs: 3e4,
+		renewMs: 1e4,
+		...context.lockOptions
+	});
+}
+/** Publish complete shim bytes only if the target is still absent. */
+async function createShimExclusive(directory, path, source) {
+	const nonce = randomBytes(6).toString("hex");
+	const temp = join(directory.resolved, `.${basename(path)}.${nonce}.tmp`);
+	await assertPinnedDirectory(directory);
+	const handle = await open(temp, "wx", POSIX_SHIM_MODE);
+	try {
+		await handle.writeFile(source);
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+	await assertPinnedDirectory(directory);
+	await chmod(temp, POSIX_SHIM_MODE);
+	try {
+		await assertPinnedDirectory(directory);
+		await link(temp, path);
+	} finally {
+		await assertPinnedDirectory(directory);
+		await rm(temp, { force: true });
+	}
+}
+/** Restore an object moved aside without ever replacing a raced object at its public path. */
+async function restoreMoved(directory, path, moved) {
+	try {
+		await assertPinnedDirectory(directory);
+		await link(moved, path);
+	} catch (error) {
+		if (error.code === "EEXIST") return false;
+		throw error;
+	}
+	await assertPinnedDirectory(directory);
+	await rm(moved);
+	return true;
+}
+/**
+* Move the exact current object aside atomically, then prove that object still has the owned digest. A raced foreign
+* file is put back; if another object has already occupied its path, both are preserved and the change is refused.
+*/
+async function moveOwned(directory, path, digest, suffix, before) {
+	await before?.(path);
+	await assertPinnedDirectory(directory);
+	const moved = join(directory.resolved, `.${basename(path)}.${randomBytes(6).toString("hex")}.${suffix}`);
+	try {
+		await rename(path, moved);
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	const bytes = await regularFileBytes(moved);
+	if (bytes !== null && sha256(bytes) === digest) return moved;
+	if (!await restoreMoved(directory, path, moved)) throw new CommsError("CONFIG", `${path} changed during a managed shim operation; its bytes were preserved at ${moved}`, { hint: "Resolve the two files by hand, then run the install, update or prune again." });
+	return null;
+}
+/** Remove only the exact object whose bytes prove it is still owned. */
+async function removeOwned(directory, path, digest, before) {
+	const moved = await moveOwned(directory, path, digest, "remove", before);
+	if (moved === null) return false;
+	await assertPinnedDirectory(directory);
+	await rm(moved);
+	return true;
+}
+function normalPath(path, platform) {
+	const trimmed = path.replace(/[\\/]+$/, "");
+	return platform === "win32" ? trimmed.toLowerCase() : trimmed;
+}
+function directoryOnPath(context, directory) {
+	const platform = platformOf(context);
+	const value = context.env.PATH ?? context.env.Path ?? "";
+	const separator = platform === "win32" ? ";" : ":";
+	return value.split(separator).filter(Boolean).some((part) => normalPath(part, platform) === normalPath(directory, platform));
+}
+function pathNotice(directory) {
+	return `The shim directory ${directory} is not on PATH. For this shell, run: export PATH=${posixWord(directory)}:"$PATH". No shell profile was edited.`;
+}
+/** Create or repoint one shim, but only while its target is free or still matches this installation's receipt. */
+async function writeManagedShim(context, spec) {
+	checkedBinary(spec.binary);
+	const directory = await pinShimDirectory(context, true);
+	if (directory === null) throw new CommsError("UNEXPECTED", "the managed shim directory was not created");
+	const publicPath = join(directory.public, spec.binary);
+	const path = join(directory.resolved, spec.binary);
+	const result = (status) => {
+		const onPath = directoryOnPath(context, directory.public);
+		return {
+			path: publicPath,
+			directory: directory.public,
+			status,
+			onPath,
+			...onPath ? {} : { pathNotice: pathNotice(directory.public) }
+		};
+	};
+	return withMutationLock(context, async () => {
+		const receipt = await readReceipt(context);
+		const recorded = receipt?.shims[spec.binary];
+		const current = await regularFileBytes(path);
+		const owned = receipt !== null && recorded !== void 0 && recorded.path === path && current !== null && sha256(current) === recorded.digest;
+		if (await pathExists(path) && !owned) return result("foreign");
+		if (receipt === null || recorded !== void 0 && recorded.path !== path) return result("foreign");
+		const node = spec.command[0];
+		if (node === void 0) throw new CommsError("CONFIG", "the managed shim command has no program");
+		const source = shimSource(spec);
+		const digest = sha256(source);
+		let previous = null;
+		if (owned) {
+			previous = await moveOwned(directory, path, recorded.digest, "old", context.hooks?.beforeReplace);
+			if (previous === null) return result("foreign");
+		}
+		try {
+			await createShimExclusive(directory, path, source);
+		} catch (error) {
+			if (previous !== null) {
+				if (!await restoreMoved(directory, path, previous)) throw new CommsError("CONFIG", `${path} was occupied while its owned shim was being updated; the old shim remains at ${previous}`, {
+					hint: "Resolve the two files by hand, then run the managed install again.",
+					cause: error
+				});
+			}
+			if (error.code === "EEXIST") return result("foreign");
+			throw error;
+		}
+		receipt.shims[spec.binary] = {
+			path,
+			digest,
+			node,
+			entry: spec.entry
+		};
+		try {
+			await assertPinnedDirectory(directory);
+			await writeReceipt(context, receipt);
+		} catch (error) {
+			const removed = await removeOwned(directory, path, digest);
+			if (previous !== null && removed && !await restoreMoved(directory, path, previous)) throw new CommsError("CONFIG", `the shim receipt failed and the old shim could not be restored from ${previous}`, {
+				hint: "Restore that file to the reported shim path, then run the managed install again.",
+				cause: error
+			});
+			throw error;
+		}
+		if (previous !== null) {
+			await assertPinnedDirectory(directory);
+			await rm(previous);
+		}
+		return result(owned ? "updated" : "created");
+	});
+}
+function isWithin(root, path) {
+	const child = relative(root, path);
+	return child === "" || !child.startsWith("..") && !isAbsolute(child);
+}
+/** Remove unchanged owned shims whose recorded entry is inside one of the runtimes prune removed. */
+async function removeManagedShimsForRuntimes(context, runtimes, options = {}) {
+	if (!managedShimsSupported(context)) return {
+		removed: [],
+		kept: []
+	};
+	const directory = await pinShimDirectory(context, false);
+	if (directory === null) return {
+		removed: [],
+		kept: []
+	};
+	return withMutationLock(context, async () => {
+		const receipt = await readReceipt(context);
+		if (receipt === null) return {
+			removed: [],
+			kept: []
+		};
+		const removed = [];
+		const kept = [];
+		let changed = false;
+		for (const [binary, recorded] of Object.entries(receipt.shims)) {
+			if (!runtimes.some((runtime) => isWithin(runtime, recorded.entry))) continue;
+			const publicPath = join(directory.public, binary);
+			const path = join(directory.resolved, binary);
+			if (recorded.path !== path) {
+				kept.push(recorded.path);
+				continue;
+			}
+			if (options.dryRun) {
+				const bytes = await regularFileBytes(path);
+				if (bytes !== null && sha256(bytes) === recorded.digest) removed.push(publicPath);
+				else if (await pathExists(path)) kept.push(publicPath);
+				continue;
+			}
+			if (await removeOwned(directory, path, recorded.digest, context.hooks?.beforeRemove)) {
+				delete receipt.shims[binary];
+				changed = true;
+				removed.push(publicPath);
+			} else if (!await pathExists(path)) {
+				delete receipt.shims[binary];
+				changed = true;
+			} else kept.push(publicPath);
+		}
+		if (changed) {
+			await assertPinnedDirectory(directory);
+			await writeReceipt(context, receipt);
+		}
+		return {
+			removed,
+			kept
+		};
+	});
+}
 /**
 * The environment a child process is started with: `env` as it is, and on Windows also
 * `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
@@ -4269,8 +4658,8 @@ async function mergeIntoJsonConfig(path, client, name, entry) {
 }
 /** Starts the server exactly as a client would, and completes the handshake. */
 async function verifyEntry(entry, product) {
-	const { Client } = await import("./dist-COPefvtq-COGS2a-K.mjs");
-	const { StdioClientTransport } = await import("./stdio-CHZ2WRcx-B2_wGdA5.mjs");
+	const { Client } = await import("./dist-C7DG2LdL-l0mj9_dH.mjs");
+	const { StdioClientTransport } = await import("./stdio-CyjIgrch-59zcjSEt.mjs");
 	const client = new Client({
 		name: `${product.binary}-install-check`,
 		version: product.version
@@ -4395,7 +4784,11 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 		runtimeDir: join(context.core.paths.dataDir, "runtime"),
 		dryRun: options.dryRun === true,
 		removed: [],
-		kept: []
+		kept: [],
+		shims: {
+			removed: [],
+			kept: []
+		}
 	};
 	const candidates = [];
 	for (const { path, version } of await listManagedRuntimes(context.core.paths.dataDir, product.packageName)) {
@@ -4462,6 +4855,11 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 		const left = handedOut.filter((record) => !gone.some((path) => mentions([path], record.runtime)));
 		if (left.length !== handedOut.length) await writeFileAtomic(ledger, left.map((record) => `${JSON.stringify(record)}\n`).join(""));
 	}
+	if (result.removed.length > 0) result.shims = await removeManagedShimsForRuntimes({
+		env: context.env,
+		dataDir: context.core.paths.dataDir,
+		platform: context.platform
+	}, result.removed.map((item) => item.path), { dryRun: result.dryRun });
 	return result;
 }
 /** Every runtime the installer handed out, or null when the record is there and cannot be read. */
@@ -4594,6 +4992,8 @@ function rivalWordWarnings(servers, word, can, product) {
 }
 /** Every channel in core's snapshot, the core first. */
 const CHANNELS = Object.freeze(CHANNEL_SNAPSHOT.map((entry) => entry.manifest.channel));
+/** Every declared MCP server, channels first and then services, with no separate hand-kept list. */
+const SERVERS = Object.freeze([...CHANNELS, ...SERVICE_SNAPSHOT.map((entry) => entry.declaration.server.defaultName)]);
 /**
 * The value a pin's flag carries in an entry's arguments: `--account acme/resend`, or `--account=acme/resend` — the
 * first given, in either form.
@@ -4654,8 +5054,28 @@ function serverFactsOf({ packageName, manifest }) {
 	};
 }
 const CHANNEL_SERVERS = Object.freeze(Object.fromEntries(CHANNEL_SNAPSHOT.map((entry) => [entry.manifest.channel, serverFactsOf(entry)])));
+/** Service server facts, derived from each service package's declaration. */
+const SERVICE_SERVERS = Object.freeze(Object.fromEntries(SERVICE_SNAPSHOT.map(({ packageName, declaration }) => [declaration.server.defaultName, {
+	packageName,
+	binary: declaration.binary,
+	defaultServerName: declaration.server.defaultName,
+	npxPackage: packageName,
+	npxArgs: ["mcp"],
+	serverArgs: () => [],
+	narrowingOf: () => ({})
+}])));
+/** All managed servers, derived from channel manifests and service declarations. */
+const SERVERS_BY_ID = Object.freeze({
+	...CHANNEL_SERVERS,
+	...SERVICE_SERVERS
+});
 /** How each server is named to a person: in a preview, and in what a tool returns. */
 const CHANNEL_LABELS = Object.freeze(Object.fromEntries(CHANNEL_SNAPSHOT.map((entry) => [entry.manifest.channel, entry.manifest.label])));
+/** Labels for every managed server; a service declares its public server name. */
+const SERVER_LABELS = Object.freeze({
+	...CHANNEL_LABELS,
+	...Object.fromEntries(SERVICE_SNAPSHOT.map(({ declaration }) => [declaration.server.defaultName, declaration.server.defaultName]))
+});
 /** A channel's manifest, from core's snapshot. */
 function channelManifest(channel) {
 	return CHANNEL_SNAPSHOT.find((entry) => entry.manifest.channel === channel)?.manifest;
@@ -4663,10 +5083,18 @@ function channelManifest(channel) {
 function isChannel(value) {
 	return typeof value === "string" && CHANNELS.includes(value);
 }
+/** Whether a word identifies any channel or service server in this release. */
+function isServer(value) {
+	return typeof value === "string" && SERVERS.includes(value);
+}
 /** Refuses a word that is not a channel of this release, naming the ones that are. */
 function notAChannel(value) {
 	return new CommsError("USAGE", `"${String(value)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 }
+/** Refuses a word that is not a declared server of this release. */
+function notAServer(value) {
+	return new CommsError("USAGE", `"${String(value)}" is not a server`, { hint: `One of: ${SERVERS.join(", ")}.` });
+}
 /** A channel's server facts, by its word; refused for a word that is not a channel. */
 function channelServer(channel) {
 	if (!isChannel(channel)) throw notAChannel(channel);
@@ -4677,6 +5105,16 @@ function channelLabel(channel) {
 	if (!isChannel(channel)) throw notAChannel(channel);
 	return CHANNEL_LABELS[channel];
 }
+/** A channel or service's server facts, by its declared server name. */
+function serverFacts(server) {
+	if (!isServer(server)) throw notAServer(server);
+	return SERVERS_BY_ID[server];
+}
+/** How a channel or service server is named to a person. */
+function serverLabel(server) {
+	if (!isServer(server)) throw notAServer(server);
+	return SERVER_LABELS[server];
+}
 /** A channel's manifest, by its word; refused for a word that is not a channel. */
 function requireChannelManifest(channel) {
 	const manifest = channelManifest(channel);
@@ -9643,7 +10081,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.17.0";
+const VERSION = "0.18.0";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -9779,15 +10217,18 @@ var PrintedCommand = class {
 	#entry;
 	/** The words, as the program is to receive them: this Node, its flags, the entry, then the CLI's own words. */
 	words;
-	/** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+	/** The line to paste; null when no supported common or labelled shell rendering is safe. */
 	line;
 	platform;
+	shell;
 	constructor(gate, words, platform, entry) {
 		if (gate !== GATE) throw new TypeError("a printed command is made by locateCliCommand, and only there");
 		this.#entry = entry;
 		this.words = Object.freeze([...words]);
-		this.line = quoteCommand(this.words, platform).line;
+		const quoted = quoteCommand(this.words, platform);
+		this.line = quoted.line;
 		this.platform = platform;
+		if (quoted.shell !== void 0) this.shell = quoted.shell;
 		Object.freeze(this);
 	}
 	/**
@@ -9814,7 +10255,7 @@ const STRIP_TYPES = "--experimental-strip-types";
 const TRANSFORM_TYPES = "--experimental-transform-types";
 /** The suite's packages, by name, and its channel packages, which reach core through their own dependency on it. */
 const SUITE_PACKAGES = new Set(CHANNEL_SNAPSHOT.map(({ packageName }) => packageName));
-const CHANNEL_PACKAGES$1 = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manifest.channel !== "core").map(({ packageName }) => packageName));
+const CHANNEL_PACKAGES = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manifest.channel !== "core").map(({ packageName }) => packageName));
 /**
 * Locates the command that runs `request.target`'s CLI with `request.words`, or says why there is none.
 *
@@ -9897,7 +10338,7 @@ function locateCliCommand(request, runtime = {
 			sameCheckout: true
 		});
 	}
-	if (target.manifest.channel === "core" && CHANNEL_PACKAGES$1.has(caller.packageName)) {
+	if (target.manifest.channel === "core" && CHANNEL_PACKAGES.has(caller.packageName)) {
 		const installed = installedPackage(dirname(callerFile), target.packageName);
 		if (installed === null) return fail("core", `${caller.packageName} has no ${target.packageName} installed where it can find one`);
 		const manifest = readPackageManifest(installed);
@@ -9925,7 +10366,9 @@ function locateCliCommand(request, runtime = {
 	}
 	if (!SUITE_PACKAGES.has(caller.packageName)) return fail("direction", `${caller.packageName} is not a package of this suite`);
 	if (request.registrations === void 0) return fail("no-registrations", "nothing registered was given to look through for another product's command");
-	const facts = registrationFactsOf(target);
+	const channelTarget = CHANNEL_SNAPSHOT.find((entry) => entry.packageName === target.packageName);
+	if (channelTarget === void 0) return fail("direction", `${target.packageName} is not a channel package this locator can find through a registration`);
+	const facts = registrationFactsOf(channelTarget);
 	const notUsed = [];
 	const usable = [];
 	let engineRange;
@@ -10023,8 +10466,7 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	let entry;
 	if (found.source) entry = join(found.root, "src", "cli.ts");
 	else {
-		const declared = found.manifest.agentcomms;
-		const binary = typeof declared === "object" && declared !== null ? declared.binary : void 0;
+		const binary = declaredBinary(found.manifest);
 		const bin = found.manifest.bin;
 		const path = binary === target.manifest.binary && typeof bin === "object" && bin !== null && Object.hasOwn(bin, target.manifest.binary) ? bin[target.manifest.binary] : void 0;
 		if (typeof path !== "string" || path.length === 0) return {
@@ -10053,6 +10495,16 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	};
 }
 /**
+* The command a package declares for itself: a channel's in its `agentcomms` field, a service's in `agentcommsPackage`
+* (D14). A library declares none, and no package declares both: the registry refuses one that does.
+*/
+function declaredBinary(manifest) {
+	const channel = manifest.agentcomms;
+	if (typeof channel === "object" && channel !== null) return channel.binary;
+	const service = manifest.agentcommsPackage;
+	if (typeof service === "object" && service !== null && service.kind === "service") return service.binary;
+}
+/**
 * The target's package a registration's files lead to, or null: a script it starts, real or as written when it is
 * gone, inside the package (or inside the product's own server wrapper, which depends on it); or, for the product's
 * own command, the package that command links into or that npm installed beside it.
@@ -10184,7 +10636,7 @@ function notLocated(target, version, reason, detail, nodeVersion, extra) {
 * anywhere else for the product, PATH included, and a later locate checks the path again.
 */
 function checkedEntry(root, entry) {
-	if (!isWithin(root, entry)) return {
+	if (!isWithin$1(root, entry)) return {
 		ok: false,
 		why: `${entry} is outside its package, ${root}`
 	};
@@ -10197,7 +10649,7 @@ function checkedEntry(root, entry) {
 			why: `${entry} is not there`
 		};
 	}
-	if (!isWithin(root, real)) return {
+	if (!isWithin$1(root, real)) return {
 		ok: false,
 		why: `${entry} leads to ${real}, outside its package, ${root}`
 	};
@@ -10611,6 +11063,10 @@ function renderInstall(result, color) {
 		lines.push(paint(color, "bold", `Add this to ${result.configPath ?? `the MCP configuration of ${result.client}`}:`), result.snippet.trimEnd());
 	}
 	if (result.backupPath) lines.push(`The entry it replaced was saved to ${result.backupPath}.`);
+	if (result.shim && result.shim.status !== "foreign") lines.push(`CLI shim ${result.shim.status}: ${result.shim.path}.`);
+	if (result.shimFailure) lines.push(paint(color, "yellow", `CLI shim failed: ${result.shimFailure}.`));
+	if (result.shimNotice) lines.push(paint(color, "yellow", result.shimNotice));
+	if (result.shim?.pathNotice) lines.push(result.shim.pathNotice);
 	if (result.verification === "passed") lines.push(paint(color, "green", `Checked: ${result.verifyDetail}`));
 	else if (result.verification === "failed") {
 		lines.push(paint(color, "red", `Failed to start: ${result.verifyDetail ?? "no reason given"}`));
@@ -10625,6 +11081,8 @@ function renderPrune(result, color) {
 	if (result.refused) lines.push(paint(color, "yellow", `Nothing removed: ${result.refused}.`));
 	const verb = result.dryRun ? "Would remove" : "Removed";
 	for (const item of result.removed) lines.push(paint(color, "green", `${verb} ${item.version}: ${item.path}`));
+	for (const path of result.shims.removed) lines.push(paint(color, "green", `${verb} CLI shim: ${path}`));
+	for (const path of result.shims.kept) lines.push(`Kept foreign CLI shim: ${path}`);
 	for (const item of result.kept) lines.push(`Kept ${item.version} (${item.reason}): ${item.path}`);
 	if (lines.length === 0) lines.push(`No managed runtimes to remove in ${result.runtimeDir}.`);
 	return lines.join("\n");
@@ -10636,7 +11094,7 @@ function describeItem(item) {
 	const where = item.scope === "project" ? `for a project, in ${item.path}` : `in ${item.path}`;
 	const pins = item.narrowing.length > 0 ? `, ${item.narrowing.join(" ")}` : "";
 	const version = item.version === null ? "pins no release" : `${item.version}${item.version === item.latest ? "" : ` → ${item.latest}`}`;
-	return `${channelLabel(item.channel)} with ${item.client} as "${item.name}" ${where} (${item.launcher}, ${version}${pins})`;
+	return `${serverLabel(item.channel)} with ${item.client} as "${item.name}" ${where} (${item.launcher}, ${version}${pins})`;
 }
 function renderUpdate(result, color) {
 	const lines = [];
@@ -10648,6 +11106,8 @@ function renderUpdate(result, color) {
 			if (step.verification === "passed") lines.push(`  Checked: ${step.detail}`);
 			else if (step.verification === "failed") lines.push(paint(color, "red", `  Failed to start: ${step.detail}`));
 			else lines.push(paint(color, "yellow", `  Not checked: ${step.detail ?? "skipped"}`));
+			if (step.shim && step.shim.status !== "foreign") lines.push(`  CLI shim ${step.shim.status}: ${step.shim.path}.`);
+			if (step.shim?.pathNotice) lines.push(`  ${step.shim.pathNotice}`);
 			for (const warning of step.warnings ?? []) lines.push(`  ${warning}`);
 		} else lines.push(paint(color, "red", `${step.outcome === "skipped" ? "Skipped" : "Could not register"} ${what}: ${step.detail}`));
 	} else lines.push(step.outcome === "updated" ? paint(color, "green", `Updated the global ${step.package} from ${step.from} to ${step.to}.`) : paint(color, "red", `Could not update the global ${step.package}: ${step.detail ?? "no reason given"}`));
@@ -12052,10 +12512,10 @@ async function npmInstallGlobal(env, spec) {
 	}
 }
 /**
-* Registering, pruning and listing the MCP servers of every channel, from the core.
+* Registering, pruning and listing every declared channel or service MCP server, from the core.
 *
-* `agentcomms mcp install` registers the core server; `comms_server_install` registers any channel's; and
-* `agent-gmail mcp install` and `agent-slack mcp install` register their own. All four are the one change here, over
+* `agentcomms mcp install` registers core or a declared service; `comms_server_install` registers any declared
+* server; and channel CLIs register their own. They are the one change here, over
 * the shared installer (`mcp-install.ts`), and all go through the change flow: registering a server is a loosening in
 * the design's terms (§3.1) — it hands a client a new set of tools — and so is asked for once and applied on the
 * second call with the approval. Printing an entry registers nothing and asks nobody.
@@ -12066,7 +12526,7 @@ async function npmInstallGlobal(env, spec) {
 * the other — or worse, a channel's own command would register with no approval at all, which is what it did.
 *
 * The version installed is this core's own, or the calling channel's when it passes its product. The packages are
-* released together, at one version, so the core that is asked to install Gmail installs the Gmail of its own release.
+* released together, at one version, so the core asked to install Gmail or events installs its own release.
 */
 const CLIENTS = Object.freeze([
 	"claude-code",
@@ -12107,10 +12567,10 @@ const exists = (path) => access(path, constants.R_OK).then(() => true, () => fal
 * core depends on none of them. So the channel is looked for beside this core — `packages/gmail` next to
 * `packages/core` in a checkout — and from source when this core runs from source, as the channel CLIs do.
 */
-async function localModuleUrl(channel) {
+async function localModuleUrl(server) {
 	const coreRoot = await corePackageRoot();
-	const unscopedName = channelServer(channel).packageName.split("/").at(-1) ?? channel;
-	const root = channel === "core" ? coreRoot : join(dirname(coreRoot), unscopedName);
+	const unscopedName = serverFacts(server).packageName.split("/").at(-1) ?? server;
+	const root = server === "core" ? coreRoot : join(dirname(coreRoot), unscopedName);
 	const source = join(root, "src", "cli.ts");
 	const built = join(root, "dist", "cli.mjs");
 	const fromSource = fileURLToPath(import.meta.url).endsWith(".ts");
@@ -12118,7 +12578,7 @@ async function localModuleUrl(channel) {
 		if (!await exists(cli)) continue;
 		return pathToFileURL(cli === source ? join(root, "src", "mcp", "module.ts") : join(root, "dist", "module.mjs")).href;
 	}
-	throw new CommsError("USAGE", `\`--launcher local\` registers a checkout's own code, and there is no ${channelServer(channel).packageName} beside this one`, { hint: `Looked in ${root}. Use the managed launcher, or run the install from that checkout.` });
+	throw new CommsError("USAGE", `\`--launcher local\` registers a checkout's own code, and there is no ${serverFacts(server).packageName} beside this one`, { hint: `Looked in ${root}. Use the managed launcher, or run the install from that checkout.` });
 }
 /**
 * The product the shared installer registers, for one channel: at this core's version unless another is named.
@@ -12128,11 +12588,11 @@ async function localModuleUrl(channel) {
 * newer release here is all it takes to register one this core is older than — which is what `agentcomms update` does.
 * `comms_server_install` and every `mcp install` name none, and register their own release as they always have.
 */
-async function channelProduct(channel, launcher, version = VERSION) {
+async function serverProduct(server, launcher, version = VERSION) {
 	return {
-		...channelServer(channel),
+		...serverFacts(server),
 		version,
-		moduleUrl: launcher === "local" ? await localModuleUrl(channel) : ""
+		moduleUrl: launcher === "local" ? await localModuleUrl(server) : ""
 	};
 }
 /**
@@ -12145,8 +12605,8 @@ async function channelProduct(channel, launcher, version = VERSION) {
 * registered, from the channel; a product for another package would register something else under those words, and
 * the person would have approved a sentence that was not true.
 */
-function ownProduct(channel, own) {
-	if (own !== void 0 && own.packageName !== channelServer(channel).packageName) throw new CommsError("UNEXPECTED", `${own.packageName} is not the ${channelLabel(channel)} server's package, so it cannot register that server`);
+function ownProduct(server, own) {
+	if (own !== void 0 && own.packageName !== serverFacts(server).packageName) throw new CommsError("UNEXPECTED", `${own.packageName} is not the ${serverLabel(server)} server's package, so it cannot register that server`);
 	return own;
 }
 /**
@@ -12156,11 +12616,11 @@ function ownProduct(channel, own) {
 * register a server reaching every workspace for a caller who believed they had pinned it.
 */
 function checkRequest(request) {
-	if (!isChannel(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
+	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 	if (!CLIENTS.includes(request.client)) throw new CommsError("USAGE", `"${String(request.client)}" is not a client this can register with`, { hint: `One of: ${CLIENTS.join(", ")}.` });
 	if (request.launcher !== void 0 && !LAUNCHERS.includes(request.launcher)) throw new CommsError("USAGE", `"${String(request.launcher)}" is not a launcher`, { hint: `One of: ${LAUNCHERS.join(", ")}.` });
 	if (request.name !== void 0) checkServerName(request.name);
-	const label = channelLabel(request.channel);
+	const label = serverLabel(request.channel);
 	const refuse = (option) => {
 		const owner = narrowingOwner(option);
 		throw new CommsError("USAGE", owner === void 0 ? `\`${option}\` is not an option of the ${label} server` : `\`${option}\` is an option of the ${owner.label} server; the ${label} server has no such option`);
@@ -12196,7 +12656,7 @@ function checkPin(config, request) {
 		return;
 	}
 	const { account } = resolveName(config, "account", pin);
-	if (account.platform !== request.channel) throw new CommsError("USAGE", `"${pin}" is not a ${channelLabel(request.channel)} ${accountNoun(request.channel)}`);
+	if (account.platform !== request.channel) throw new CommsError("USAGE", `"${pin}" is not a ${serverLabel(request.channel)} ${accountNoun(request.channel)}`);
 }
 function installOptions(request) {
 	const own = pinOption(request.channel);
@@ -12215,7 +12675,7 @@ function installOptions(request) {
 	};
 }
 /**
-* Registering one channel's server with one client, as a change.
+* Registering one declared server with one client, as a change.
 *
 * The effects are what a person is agreeing to, one sentence each, and everything that decides what the server may
 * reach is in them — which server, which client, under which name, pinned to what, replacing what, started how. The
@@ -12230,21 +12690,22 @@ function installOptions(request) {
 * resolves another — `CLAUDE_CONFIG_DIR` set to another account's, a PATH that finds another node, a core running
 * from another build of the checkout — is another registration, refused as one.
 */
-function serverInstallChange(core, env, request, own) {
+function serverInstallChange(core, env, request, own, deps = {}) {
 	checkRequest(request);
 	ownProduct(request.channel, own);
 	const context = {
 		env,
-		core
+		core,
+		...deps.platform === void 0 ? {} : { platform: deps.platform }
 	};
-	const facts = channelServer(request.channel);
-	const label = channelLabel(request.channel);
+	const facts = serverFacts(request.channel);
+	const label = serverLabel(request.channel);
 	const noun = accountNoun(request.channel);
 	const pinName = pinOption(request.channel);
 	const switchable = hasNarrowing(request.channel, "readOnly");
 	const name = request.name ?? facts.defaultServerName;
 	const launcher = request.launcher ?? "managed";
-	const productNow = async () => own ?? await channelProduct(request.channel, request.launcher);
+	const productNow = async () => own ?? await serverProduct(request.channel, request.launcher);
 	let planned;
 	return {
 		plan: async (config) => {
@@ -12275,6 +12736,14 @@ function serverInstallChange(core, env, request, own) {
 				else if (launcher === "local") effects.push(`${request.client} will start it from ${await localCliEntry(product.moduleUrl)}`);
 			}
 			if (request.print !== true && launcher === "managed" && await reusableRuntime(core.paths.dataDir, facts.packageName, version) === null) effects.push(`installs ${facts.packageName}@${version} from npm into ${managedRuntimeDir(core.paths.dataDir, facts.packageName, version)}`);
+			if (request.print !== true && launcher === "managed" && managedShimsSupported(context)) {
+				const path = managedShimPath({
+					env,
+					dataDir: core.paths.dataDir,
+					platform: context.platform
+				}, facts.binary);
+				effects.push(`writes or repoints the owned CLI shim at ${path}; a foreign file there is left unchanged`);
+			}
 			return {
 				before: config,
 				after: config,
@@ -12284,9 +12753,10 @@ function serverInstallChange(core, env, request, own) {
 		},
 		apply: async () => {
 			if (planned === void 0) throw new CommsError("UNEXPECTED", "the registration was applied before it was planned");
-			const result = await mcpInstall(context, planned.product, installOptions(request), planned.install).catch(async (error) => {
+			const installed = await mcpInstall(context, planned.product, installOptions(request), planned.install).catch(async (error) => {
 				throw await remedyLocated(error, core);
 			});
+			const result = request.print === true ? installed : await withManagedShim(context, planned.product, installed);
 			return {
 				...result,
 				restart: result.applied ? `Restart ${request.client} to load "${result.name}": no MCP client loads a new server into a session that is already running.` : null
@@ -12295,6 +12765,68 @@ function serverInstallChange(core, env, request, own) {
 	};
 }
 /**
+* A managed install's CLI shim (CUE-406), once the registration's outcome is known: the command the locator finds in
+* the runtime the entry starts, written where nothing is or over this installation's own unchanged shim, and never
+* over anything else. A shim that cannot be written leaves the registration as it went, and says how to repair both.
+* The installer may not import the locator, so the operation writes it — for `mcp install` and `update` alike.
+*/
+async function withManagedShim(context, product, installed) {
+	if (installed.launcher !== "managed") return installed;
+	const cliEntry = installed.entry.args[0];
+	if (cliEntry === void 0) throw new CommsError("UNEXPECTED", "the managed entry has no CLI path");
+	const shimContext = {
+		env: context.env,
+		dataDir: context.core.paths.dataDir,
+		platform: context.platform
+	};
+	if (!managedShimsSupported(shimContext)) return {
+		...installed,
+		shimNotice: managedShimUnsupportedNotice(shimContext)
+	};
+	const warnings = [...installed.warnings];
+	let shim;
+	let shimFailure;
+	try {
+		const located = locateCliCommand({
+			caller: {
+				url: pathToFileURL(cliEntry).href,
+				packageName: product.packageName
+			},
+			target: {
+				packageName: product.packageName,
+				manifest: {
+					label: product.defaultServerName,
+					binary: product.binary
+				}
+			},
+			words: [],
+			uses: [],
+			paths: {
+				...context.core.paths,
+				downloadsDir: context.core.paths.dataDir
+			},
+			platform: context.platform
+		});
+		if (!located.ok) throw new CommsError("CONFIG", `the managed CLI command could not be located: ${located.message}`);
+		shim = await (context.writeShim ?? writeManagedShim)(shimContext, {
+			binary: product.binary,
+			command: located.command.words,
+			entry: located.command.entry
+		});
+	} catch (error) {
+		shimFailure = error instanceof Error ? error.message : String(error);
+		const path = join(homeDirectory(context.env), ".local", "bin", product.binary);
+		warnings.push(`The MCP registration ${installed.applied ? "succeeded" : "was not changed"}, but the CLI shim at ${path} could not be written (${shimFailure}). Fix that shim directory, then run this managed install again with \`--force\`; the owned registration is replaced without widening it and the shim is repaired.`);
+	}
+	if (shim?.status === "foreign") warnings.push(`${shim.path} already exists but was not written by this installation, so it was left unchanged; move it aside and run this managed install again with \`--force\` to create the CLI shim at that path.`);
+	return {
+		...installed,
+		warnings,
+		...shim === void 0 ? {} : { shim },
+		...shimFailure === void 0 ? {} : { shimFailure }
+	};
+}
+/**
 * A refusal of `mcp install` with its remedy — another install of the same product — said with the command located:
 * the printing package's own, core's, or another product's found among this machine's registrations (CUE-403). The
 * installer says only the words; it may not import the locator.
@@ -12302,17 +12834,24 @@ function serverInstallChange(core, env, request, own) {
 async function remedyLocated(error, core) {
 	const remedy = installRemedyOf(error);
 	if (remedy === void 0 || !(error instanceof CommsError)) return error;
-	const channel = CHANNELS.find((each) => channelServer(each).binary === remedy.binary);
-	if (channel === void 0) return error;
+	const server = SERVERS.find((each) => serverFacts(each).binary === remedy.binary);
+	if (server === void 0) return error;
 	const maker = await requireHandoffs(core).registered();
+	const handoff = isChannel(server) ? maker.of(server, remedy.words) : maker.core([
+		"mcp",
+		"install",
+		"--server",
+		server,
+		...remedy.words.slice(2)
+	]);
 	return new CommsError(error.code, error.message, {
-		hint: handoffSentence(maker.of(channel, remedy.words), remedy.say),
+		hint: handoffSentence(handoff, remedy.say),
 		...error.details === void 0 ? {} : { details: error.details },
 		...error.cause === void 0 ? {} : { cause: error.cause }
 	});
 }
 /**
-* Removing a channel's unused managed runtimes, as a change.
+* Removing a declared server's unused managed runtimes, as a change.
 *
 * A dry run is free: it removes nothing. Otherwise the plan is that same dry run, and each runtime it would remove is
 * one effect — the removal cannot be taken back — so the approval is bound to exactly that list; and the removal is
@@ -12322,20 +12861,20 @@ async function remedyLocated(error, core) {
 * release of the command that was run; checked to be that channel's, as for an install.
 */
 function serverPruneChange(core, env, request, own) {
-	if (!isChannel(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
+	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 	const context = {
 		env,
 		core
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
-		packageName: channelServer(request.channel).packageName,
-		version: "0.17.0"
+		packageName: serverFacts(request.channel).packageName,
+		version: "0.18.0"
 	};
 	const product = {
 		packageName,
 		version
 	};
-	const label = channelLabel(request.channel);
+	const label = serverLabel(request.channel);
 	const base = {
 		includePrinted: request.includePrinted === true,
 		...request.processes ? { processes: request.processes } : {}
@@ -12356,7 +12895,7 @@ function serverPruneChange(core, env, request, own) {
 			return {
 				before: config,
 				after: config,
-				effects: preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`),
+				effects: [...preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`), ...preview.shims.removed.map((path) => `deletes the owned ${label} CLI shim at ${path}`)],
 				summary: `Remove ${approved.length} unused ${label} runtime${approved.length === 1 ? "" : "s"}`
 			};
 		},
@@ -12635,21 +13174,22 @@ function updateStopMessage(pending, where, commands) {
 * the yes is a different change, and the claim is refused. Nothing behind, nothing is prepared.
 */
 /**
-* The packages this suite publishes, whose latest releases an update reads: every channel's, from the manifests, and
-* every package a channel's server is run through by `npx` when that is another one — Gmail's `gmail-mcp`.
+* The packages this suite publishes, whose latest releases an update reads: every declared server owner's, from the
+* channel and service declarations, and every package a server is run through by `npx` when that is another one —
+* Gmail's `gmail-mcp`.
 */
-const CHANNEL_PACKAGES = Object.freeze(CHANNELS.map((channel) => channelServer(channel).packageName));
-const SERVER_PACKAGES = Object.freeze(CHANNELS.map((channel) => channelServer(channel).npxPackage).filter((name) => !CHANNEL_PACKAGES.includes(name)));
-const PUBLISHED_NAMES = Object.freeze([.../* @__PURE__ */ new Set([...CHANNEL_PACKAGES, ...SERVER_PACKAGES])].sort());
-function narrowingArgs(channel, narrowing) {
-	return channelServer(channel).serverArgs({
+const OWNER_PACKAGES = Object.freeze(SERVERS.map((server) => serverFacts(server).packageName));
+const SERVER_PACKAGES = Object.freeze(SERVERS.map((server) => serverFacts(server).npxPackage).filter((name) => !OWNER_PACKAGES.includes(name)));
+const PUBLISHED_NAMES = Object.freeze([.../* @__PURE__ */ new Set([...OWNER_PACKAGES, ...SERVER_PACKAGES])].sort());
+function narrowingArgs(server, narrowing) {
+	return serverFacts(server).serverArgs({
 		client: "json",
 		...narrowing
 	});
 }
-/** Every registration of every channel's server, as the core's `channels` finds them — nothing an `env` holds. */
+/** Every registration of every declared server, as the core's `channels` finds them — nothing an `env` holds. */
 function registrations(servers) {
-	return CHANNELS.flatMap((channel) => servers.filter((server) => isProductServer(server, channelServer(channel))).map((server) => ({
+	return SERVERS.flatMap((channel) => servers.filter((server) => isProductServer(server, serverFacts(channel))).map((server) => ({
 		channel,
 		server
 	})));
@@ -12687,7 +13227,7 @@ async function latestReleases(names, latestVersion) {
 * have no line to paste: the reasons below give it with `handoffSentence`, which shows it as words then.
 */
 function installHandoff(item, handoffs) {
-	const facts = channelServer(item.channel);
+	const facts = serverFacts(item.channel);
 	const words = [
 		"mcp",
 		"install",
@@ -12696,7 +13236,13 @@ function installHandoff(item, handoffs) {
 	];
 	if (item.name !== facts.defaultServerName) words.push("--name", item.name);
 	words.push(...item.narrowing, "--force");
-	return handoffs.of(item.channel, words);
+	return isChannel(item.channel) ? handoffs.of(item.channel, words) : handoffs.core([
+		"mcp",
+		"install",
+		"--server",
+		item.channel,
+		...words.slice(2)
+	]);
 }
 /**
 * Why a registration that is behind cannot be registered again from here, or undefined when it can.
@@ -12736,8 +13282,8 @@ function newest(versions) {
 */
 async function runtimesNeeded(dataDir, latest, managed) {
 	const needed = [];
-	for (const channel of CHANNELS) {
-		const packageName = channelServer(channel).packageName;
+	for (const channel of SERVERS) {
+		const packageName = serverFacts(channel).packageName;
 		const version = latest[packageName];
 		if (version === void 0) continue;
 		if (!managed.some((item) => item.channel === channel && item.launcher === "managed")) continue;
@@ -12764,7 +13310,7 @@ async function inspect(core, env, deps) {
 	const handoffs = requireHandoffs(core, deps.platform).withRegistrations(scan.servers);
 	const unreadable = [...scan.unreadable];
 	const found = registrations(scan.servers).map(({ channel, server }) => {
-		const facts = channelServer(channel);
+		const facts = serverFacts(channel);
 		return {
 			channel,
 			server,
@@ -12784,9 +13330,9 @@ async function inspect(core, env, deps) {
 			reason: error instanceof Error ? error.message : String(error)
 		});
 	}
-	const wanted = /* @__PURE__ */ new Set([channelServer("core").packageName]);
+	const wanted = /* @__PURE__ */ new Set([serverFacts("core").packageName]);
 	for (const entry of found) {
-		wanted.add(channelServer(entry.channel).packageName);
+		wanted.add(serverFacts(entry.channel).packageName);
 		wanted.add(entry.package);
 	}
 	for (const name of Object.keys(installed)) wanted.add(name);
@@ -12809,7 +13355,7 @@ async function inspect(core, env, deps) {
 			name: entry.server.name,
 			scope: entry.server.scope ?? "user",
 			path: entry.server.path,
-			launcher: launcherOf(entry.server, channelServer(entry.channel)),
+			launcher: launcherOf(entry.server, serverFacts(entry.channel)),
 			version: entry.version,
 			latest: latest[entry.package] ?? "",
 			narrowing: narrowingArgs(entry.channel, entry.narrowing)
@@ -12840,8 +13386,8 @@ async function inspect(core, env, deps) {
 	}
 	const needed = await runtimesNeeded(core.paths.dataDir, latest, candidates.map((candidate) => candidate.item));
 	behind.push(...needed);
-	for (const channel of CHANNELS) {
-		const packageName = channelServer(channel).packageName;
+	for (const channel of SERVERS) {
+		const packageName = serverFacts(channel).packageName;
 		const version = latest[packageName];
 		if (version === void 0 || await reusableRuntime(core.paths.dataDir, packageName, version) === null) continue;
 		upToDate.push({
@@ -12899,7 +13445,7 @@ async function updateCheck(core, env, deps = {}, claim) {
 	await recordFound(core, env, report, deps, null, claim);
 	return report;
 }
-const CORE_PACKAGE$1 = channelServer("core").packageName;
+const CORE_PACKAGE$1 = serverFacts("core").packageName;
 /**
 * One registration: its channel, its client, its scope, the file it is in and its name. Two copies of it in one file —
 * `servers` and an old `mcpServers` — are one registration, and an update registers them again as one.
@@ -12978,7 +13524,7 @@ function updateCheckFindings(report, latest, after = null) {
 	});
 	const globals = items.filter((item) => item.kind === "global");
 	const global = CHANNELS.filter((channel) => {
-		const name = channelServer(channel).packageName;
+		const name = serverFacts(channel).packageName;
 		return globals.some((item) => item.package === name && atLatest(installed.has(name) ? item.latest : item.version));
 	});
 	const stillBehind = after === null ? report.behind.length > 0 : !(after.ok && after.manual.length === 0 && after.status !== "manual");
@@ -13009,13 +13555,11 @@ function reachOf(channel, narrowing) {
 */
 function registrationEffects(step) {
 	const { item } = step;
-	const reach = reachOf(item.channel, channelServer(item.channel).narrowingOf(item.narrowing));
-	const entry = `registers the ${channelLabel(item.channel)} MCP server with ${item.client} as "${item.name}" again (${item.scope} scope, ${item.launcher} launcher), at ${item.latest} in place of ${item.version}${reach ? ` — ${reach}, as now` : ""}`;
-	return item.launcher === "npx" ? [
-		entry,
-		step.destination,
-		`${item.client} will fetch ${item.package}@${item.latest} from npm each time it starts "${item.name}"`
-	] : [entry, step.destination];
+	const reach = reachOf(item.channel, serverFacts(item.channel).narrowingOf(item.narrowing));
+	const effects = [`registers the ${serverLabel(item.channel)} MCP server with ${item.client} as "${item.name}" again (${item.scope} scope, ${item.launcher} launcher), at ${item.latest} in place of ${item.version}${reach ? ` — ${reach}, as now` : ""}`, step.destination];
+	if (step.shim) effects.push(`writes or repoints the owned CLI shim at ${step.shim}; a foreign file there is left unchanged`);
+	if (item.launcher === "npx") effects.push(`${item.client} will fetch ${item.package}@${item.latest} from npm each time it starts "${item.name}"`);
+	return effects;
 }
 /** Every step as the sentences a person reads, in the order the steps are taken. */
 function effectsOf(planned) {
@@ -13051,7 +13595,7 @@ async function planRegistrations(context, candidates, request, handoffs) {
 		if (seen.has(key)) continue;
 		seen.add(key);
 		const launcher = item.launcher;
-		const product = await channelProduct(item.channel, launcher, item.latest);
+		const product = await serverProduct(item.channel, launcher, item.latest);
 		const options = {
 			client: item.client,
 			name: item.name,
@@ -13077,7 +13621,12 @@ async function planRegistrations(context, candidates, request, handoffs) {
 			product,
 			options,
 			install: plannedInstall(preflight),
-			destination: entryDestination(item.client, preflight.target, preflight.command, context.env)
+			destination: entryDestination(item.client, preflight.target, preflight.command, context.env),
+			...launcher === "managed" && managedShimsSupported(context) ? { shim: managedShimPath({
+				env: context.env,
+				dataDir: context.core.paths.dataDir,
+				platform: context.platform
+			}, product.binary) } : {}
 		});
 	}
 	return {
@@ -13199,18 +13748,23 @@ function whatBecameOf(stored) {
 		revoked: "it had been revoked"
 	}[record.state] ?? `it is ${JSON.stringify(record.state)}, a state this version does not know`;
 }
-/** The product a runtime of `packageName` is installed as: the channel whose package it is. */
+/** The product a runtime of `packageName` is installed as: the declared server whose package it is. */
 function runtimeProduct(packageName, version) {
-	const channel = CHANNELS.find((each) => channelServer(each).packageName === packageName);
-	if (channel === void 0) throw new CommsError("UNEXPECTED", `${packageName} is not a channel's package`);
-	return channelProduct(channel, "managed", version);
+	const channel = SERVERS.find((each) => serverFacts(each).packageName === packageName);
+	if (channel === void 0) throw new CommsError("UNEXPECTED", `${packageName} is not a declared server package`);
+	return serverProduct(channel, "managed", version);
 }
 /**
-* Every channel's `mcp prune`, as a person runs it at a terminal: each located among this machine's registrations, and
-* for one that is not, why — never a bare name (CUE-403).
+* Every declared server's `mcp prune`, as a person runs it at a terminal: each channel command is located among this
+* machine's registrations, and each service uses core — never a bare name (CUE-403).
 */
 function pruneCommands(handoffs) {
-	return handoffChoices(CHANNELS.map((channel) => handoffs.of(channel, ["mcp", "prune"])), "none of their commands is locatable here:", { conjunction: "and" });
+	return handoffChoices(SERVERS.map((channel) => isChannel(channel) ? handoffs.of(channel, ["mcp", "prune"]) : handoffs.core([
+		"mcp",
+		"prune",
+		"--server",
+		channel
+	])), "none of their commands is locatable here:", { conjunction: "and" });
 }
 function message(error) {
 	return error instanceof CommsError ? error.message : error instanceof Error ? error.message : String(error);
@@ -13267,26 +13821,28 @@ async function applyUpdate(context, planned, deps) {
 			continue;
 		}
 		try {
-			const pins = channelServer(item.channel).narrowingOf(item.narrowing);
-			const result = await mcpInstall(context, product, {
+			const pins = serverFacts(item.channel).narrowingOf(item.narrowing);
+			const installed = await mcpInstall(context, product, {
 				...options,
 				...pins
 			}, install);
-			if (!result.applied) {
+			if (!installed.applied) {
 				steps.push({
 					...base,
 					outcome: "failed",
-					detail: result.notApplied ?? "nothing was registered"
+					detail: installed.notApplied ?? "nothing was registered"
 				});
 				continue;
 			}
+			const result = await withManagedShim(context, product, installed);
 			steps.push({
 				...base,
 				outcome: "registered",
 				verification: result.verification,
 				...result.verifyDetail !== void 0 ? { detail: result.verifyDetail } : {},
 				...result.backupPath !== void 0 ? { backupPath: result.backupPath } : {},
-				...result.warnings.length > 0 ? { warnings: result.warnings } : {}
+				...result.warnings.length > 0 ? { warnings: result.warnings } : {},
+				...result.shim !== void 0 ? { shim: result.shim } : {}
 			});
 		} catch (error) {
 			steps.push({
@@ -14046,7 +14602,7 @@ function terminalUpdateHooks(core, env, options) {
 	};
 }
 //#endregion
-//#region ../core/dist/tool-arguments-rfCRYwaZ.mjs
+//#region ../core/dist/tool-arguments-C_RA7n3A.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -14351,7 +14907,7 @@ function spoken(words, joiner) {
 	return `${words.slice(0, -1).join(", ")} ${joiner} ${words.at(-1)}`;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/postal-mime@3.0.0/node_modules/postal-mime/src/decode-strings.js
+//#region ../../node_modules/.pnpm/postal-mime@4.0.5/node_modules/postal-mime/dist/esm/decode-strings.js
 const textEncoder = new TextEncoder();
 const base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 const base64Lookup = /* @__PURE__ */ new Uint8Array(256);
@@ -14406,26 +14962,143 @@ const codePagePattern = /^(?:cp|windows|ms|ibm)(\d+)$/;
 function normalizeCharset(charset) {
 	return charset.replace(/^(?:x-ms-|x-|cs)/, "").replace(/[\s._-]+/g, "");
 }
+const ENCODING_LABELS = new Set([
+	"unicode-1-1-utf-8 unicode11utf8 unicode20utf8 utf-8 utf8 x-unicode20utf8",
+	"866 cp866 csibm866 ibm866",
+	"csisolatin2 iso-8859-2 iso-ir-101 iso8859-2 iso88592 iso_8859-2 iso_8859-2:1987 l2 latin2",
+	"csisolatin3 iso-8859-3 iso-ir-109 iso8859-3 iso88593 iso_8859-3 iso_8859-3:1988 l3 latin3",
+	"csisolatin4 iso-8859-4 iso-ir-110 iso8859-4 iso88594 iso_8859-4 iso_8859-4:1988 l4 latin4",
+	"csisolatincyrillic cyrillic iso-8859-5 iso-ir-144 iso8859-5 iso88595 iso_8859-5 iso_8859-5:1988",
+	"arabic asmo-708 csiso88596e csiso88596i csisolatinarabic ecma-114 iso-8859-6 iso-8859-6-e",
+	"iso-8859-6-i iso-ir-127 iso8859-6 iso88596 iso_8859-6 iso_8859-6:1987",
+	"csisolatingreek ecma-118 elot_928 greek greek8 iso-8859-7 iso-ir-126 iso8859-7 iso88597 iso_8859-7",
+	"iso_8859-7:1987 sun_eu_greek",
+	"csiso88598e csisolatinhebrew hebrew iso-8859-8 iso-8859-8-e iso-ir-138 iso8859-8 iso88598 iso_8859-8",
+	"iso_8859-8:1988 visual",
+	"csiso88598i iso-8859-8-i logical",
+	"csisolatin6 iso-8859-10 iso-ir-157 iso8859-10 iso885910 l6 latin6",
+	"iso-8859-13 iso8859-13 iso885913",
+	"iso-8859-14 iso8859-14 iso885914",
+	"csisolatin9 iso-8859-15 iso8859-15 iso885915 iso_8859-15 l9",
+	"iso-8859-16",
+	"cskoi8r koi koi8 koi8-r koi8_r",
+	"koi8-ru koi8-u",
+	"csmacintosh mac macintosh x-mac-roman",
+	"dos-874 iso-8859-11 iso8859-11 iso885911 tis-620 windows-874",
+	"cp1250 windows-1250 x-cp1250",
+	"cp1251 windows-1251 x-cp1251",
+	"ansi_x3.4-1968 ascii cp1252 cp819 csisolatin1 ibm819 iso-8859-1 iso-ir-100 iso8859-1 iso88591",
+	"iso_8859-1 iso_8859-1:1987 l1 latin1 us-ascii windows-1252 x-cp1252",
+	"cp1253 windows-1253 x-cp1253",
+	"cp1254 csisolatin5 iso-8859-9 iso-ir-148 iso8859-9 iso88599 iso_8859-9 iso_8859-9:1989 l5 latin5",
+	"windows-1254 x-cp1254",
+	"cp1255 windows-1255 x-cp1255",
+	"cp1256 windows-1256 x-cp1256",
+	"cp1257 windows-1257 x-cp1257",
+	"cp1258 windows-1258 x-cp1258",
+	"x-mac-cyrillic x-mac-ukrainian",
+	"chinese csgb2312 csiso58gb231280 gb2312 gb_2312 gb_2312-80 gbk iso-ir-58 x-gbk",
+	"gb18030",
+	"big5 big5-hkscs cn-big5 csbig5 x-x-big5",
+	"cseucpkdfmtjapanese euc-jp x-euc-jp",
+	"csiso2022jp iso-2022-jp",
+	"csshiftjis ms932 ms_kanji shift-jis shift_jis sjis windows-31j x-sjis",
+	"cseuckr csksc56011987 euc-kr iso-ir-149 korean ks_c_5601-1987 ks_c_5601-1989 ksc5601 ksc_5601",
+	"windows-949",
+	"csiso2022kr hz-gb-2312 iso-2022-cn iso-2022-cn-ext iso-2022-kr replacement",
+	"unicodefffe utf-16be",
+	"csunicode iso-10646-ucs-2 ucs-2 unicode unicodefeff utf-16 utf-16le",
+	"x-user-defined"
+].join(" ").split(" "));
+const decoders = /* @__PURE__ */ new Map();
 function tryDecoder(charset) {
-	try {
-		return new TextDecoder(charset);
-	} catch (err) {
-		return null;
+	if (!ENCODING_LABELS.has(charset)) return null;
+	let decoder = decoders.get(charset);
+	if (decoder === void 0) {
+		decoder = null;
+		try {
+			decoder = new TextDecoder(charset);
+		} catch {}
+		decoders.set(charset, decoder);
 	}
+	return decoder;
 }
-function getDecoder(charset) {
+const utf8Decoder = new TextDecoder();
+/**
+* Finds the decoder for a charset label, or null when the runtime has no encoding for it
+*/
+function findDecoder(charset) {
 	charset = (charset || "utf8").trim().toLowerCase();
 	const decoder = tryDecoder(charset);
 	if (decoder) return decoder;
 	const normalized = normalizeCharset(charset);
 	const codePage = normalized.match(codePagePattern);
-	return tryDecoder(codePage && codePageAliases.get(codePage[1]) || charsetAliases.get(normalized) || normalized) || new TextDecoder("windows-1252");
+	return tryDecoder(codePage && codePageAliases.get(codePage[1]) || charsetAliases.get(normalized) || normalized);
+}
+function getDecoder(charset) {
+	return findDecoder(charset) || tryDecoder("windows-1252") || utf8Decoder;
+}
+/**
+* Whether the bytes are well formed UTF-8. A scan rather than a fatal TextDecoder, since
+* the exception one throws costs more than the decode itself and a message decides how
+* many lines throw it.
+*/
+function isUtf8(bytes) {
+	for (let i = 0; i < bytes.length;) {
+		const lead = bytes[i];
+		if (lead < 128) {
+			i++;
+			continue;
+		}
+		let count;
+		if (lead >= 194 && lead <= 223) count = 1;
+		else if (lead >= 224 && lead <= 239) count = 2;
+		else if (lead >= 240 && lead <= 244) count = 3;
+		else return false;
+		if (i + count >= bytes.length) return false;
+		const second = bytes[i + 1];
+		if (second < (lead === 224 ? 160 : lead === 240 ? 144 : 128) || second > (lead === 237 ? 159 : lead === 244 ? 143 : 191)) return false;
+		for (let k = 2; k <= count; k++) if ((bytes[i + k] & 192) !== 128) return false;
+		i += count + 1;
+	}
+	return true;
+}
+/**
+* Decodes bytes whose encoding is not known: as UTF-8 when they are well formed UTF-8, as
+* windows-1252 otherwise.
+*
+* A message that declares no charset, or one the runtime has never heard of, usually
+* predates RFC 6532 or comes from a generator that never heard of it either, and its 8-bit
+* bytes are a legacy single byte encoding far more often than broken UTF-8. windows-1252
+* is the fallback the WHATWG Encoding Standard prescribes and what a mail client's default
+* charset amounts to, and it reads such text rather than filling it with replacement
+* characters.
+*
+* @param bytes Bytes to decode
+* @param utf8 The UTF-8 decoder to use, header lines bring one that keeps a BOM
+* @return Decoded text
+*/
+function decodeUtf8OrWindows1252(bytes, utf8 = utf8Decoder) {
+	const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+	return isUtf8(view) ? utf8.decode(view) : getDecoder("windows-1252").decode(view);
+}
+/**
+* Decodes bytes in a named charset. A label the runtime does not know is no charset at
+* all, see decodeUtf8OrWindows1252.
+*
+* @param bytes Bytes to decode
+* @param charset Charset label
+* @return Decoded text
+*/
+function decodeCharset(bytes, charset) {
+	const decoder = findDecoder(charset);
+	return decoder ? decoder.decode(bytes) : decodeUtf8OrWindows1252(bytes);
 }
 /**
 * Numeric value of an ASCII hex digit
 *
-* @param {Number} c Byte to read
-* @return {Number} Value 0-15, or -1 if the byte is not a hex digit
+* @param c Byte to read
+* @return Value 0-15, or -1 if the byte is not a hex digit
 */
 function hexNibble(c) {
 	if (c >= 48 && c <= 57) return c - 48;
@@ -14434,14 +15107,35 @@ function hexNibble(c) {
 	return -1;
 }
 /**
+* Folds the line breaks of a header value into spaces.
+*
+* A header value holds no line breaks. The raw value is folded when the headers are
+* processed, see processHeaders in mime-node.ts, an RFC 2047 encoded word is folded as it
+* is decoded, and an RFC 2231 filename is folded where the attachment is built. Otherwise a
+* decoded name, subject or filename written into a header of an outgoing message by the
+* consumer ends the header early and starts another one with the rest of the value.
+*
+* The RFC 2231 percent decoder itself does not fold: it also produces the boundary, and a
+* boundary holding a line break can never match a line. That has to stay so, or a message
+* that has no parts for every other parser would have them here.
+*
+* @param str Header value
+* @return The value with every run of CR and LF replaced by a space
+*/
+function foldLineBreaks(str) {
+	return str.replace(/[\r\n]+/g, " ");
+}
+/**
 * Decode a complete mime word encoded string
 *
-* @param {String} str Mime word encoded string
-* @return {String} Decoded unicode string
+* @param charset Character set of the encoded word
+* @param encoding `Q` or `B`
+* @param str Mime word encoded string
+* @return Decoded unicode string
 */
 function decodeWord(charset, encoding, str) {
 	let splitPos = charset.indexOf("*");
-	if (splitPos >= 0) charset = charset.substr(0, splitPos);
+	if (splitPos >= 0) charset = charset.slice(0, splitPos);
 	encoding = encoding.toUpperCase();
 	let byteStr;
 	if (encoding === "Q") {
@@ -14466,7 +15160,7 @@ function decodeWord(charset, encoding, str) {
 		for (let i = 0, len = encodedBytes.length; i < len; i++) dataView.setUint8(i, encodedBytes[i]);
 	} else if (encoding === "B") byteStr = decodeBase64$1(str.replace(/[^a-zA-Z0-9\+\/=]+/g, ""));
 	else byteStr = textEncoder.encode(str);
-	return getDecoder(charset).decode(byteStr);
+	return foldLineBreaks(decodeCharset(byteStr, charset));
 }
 const ENCODED_WORD_PATTERN = "=\\?([^?\\s]+)\\?([QqBb])\\?([^?]*)\\?=";
 const ENCODED_WORD_REGEX = new RegExp(ENCODED_WORD_PATTERN, "g");
@@ -14476,8 +15170,8 @@ const ENCODED_WORDS_ONLY_REGEX = new RegExp(`^(?:${ENCODED_WORD_PATTERN}\\s*)+$`
 * Checks whether a string is nothing but RFC 2047 encoded words. Kept next to the grammar
 * it depends on, so the pattern has a single definition.
 *
-* @param {String} str String to check
-* @return {Boolean} true if the string holds encoded words and nothing else
+* @param str String to check
+* @return true if the string holds encoded words and nothing else
 */
 function isEncodedWordsOnly(str) {
 	return ENCODED_WORDS_ONLY_REGEX.test(str);
@@ -14489,8 +15183,8 @@ function isEncodedWordsOnly(str) {
 * means the input can not contain the marker, which previously let a sender delete text
 * from a subject or a display name by writing the marker into the header themselves.
 *
-* @param {String} str String to split
-* @return {Array} Array of `{text}` and `{charset, encoding, encodedText}` tokens
+* @param str String to split
+* @return Array of `{text}` and `{charset, encoding, encodedText}` tokens
 */
 function splitEncodedWords(str) {
 	const tokens = [];
@@ -14524,9 +15218,9 @@ function canJoinWords(left, right) {
 /**
 * Decodes a token list into a string, optionally merging adjacent encoded words.
 *
-* @param {Array} tokens Tokens from splitEncodedWords
-* @param {Boolean} joinWords Whether adjacent encoded words may be decoded as one unit
-* @return {String} Decoded string
+* @param tokens Tokens from splitEncodedWords
+* @param joinWords Whether adjacent encoded words may be decoded as one unit
+* @return Decoded string
 */
 function renderTokens(tokens, joinWords) {
 	let result = "";
@@ -14557,6 +15251,12 @@ function renderTokens(tokens, joinWords) {
 	if (pending) result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
 	return result;
 }
+/**
+* Decodes RFC 2047 encoded words in a string
+*
+* @param str String that may contain encoded words
+* @return Unicode string with every encoded word decoded
+*/
 function decodeWords(str) {
 	const tokens = splitEncodedWords((str || "").toString());
 	const result = renderTokens(tokens, true);
@@ -14564,55 +15264,279 @@ function decodeWords(str) {
 }
 new TextDecoder("utf-8", { ignoreBOM: true });
 //#endregion
-//#region ../../node_modules/.pnpm/postal-mime@3.0.0/node_modules/postal-mime/src/address-parser.js
-const WORD_CHAR_REGEX = /\w/;
-const NON_SPACE_TOKEN_REGEX = /[^\s]+/g;
+//#region ../../node_modules/.pnpm/postal-mime@4.0.5/node_modules/postal-mime/dist/esm/address-parser.js
+/**
+* Any whitespace, the test for an angle-addr that needs recovering
+*/
+const HAS_WHITESPACE = /\s/;
 /**
-* Finds the first address looking token in a run of text.
+* An addr-spec that carries its whitespace legally, inside a quoted local part. The
+* optional tail is the malformed shape: a real mailbox with wreckage trailing it.
+*/
+const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
+/**
+* One run holding a single '@' and no whitespace, the shape an addr-spec has to have
+*/
+const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+/**
+* The looser reading applied once the strict one finds nothing, which tolerates the
+* further '@' that a domain should not have but malformed headers carry anyway
+*/
+const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+* An addr-spec sitting inside free text, together with the whitespace around it. Sticky
+* on purpose: it is only run at the offset looseAddressStart picks, see there.
+*/
+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+* Restores the quoting of a local part that was read out of a quoted string.
 *
-* This replaces a `\s*\b[^@\s]+@[^\s]+\b\s*` scan over the whole string, which backtracks
-* quadratically: the leading `\s*` makes every position inside a whitespace run a viable
-* start, and `[^@\s]+` then gives back one character at a time looking for an '@'. A
-* single header well inside the default size limit could hold a core busy for minutes.
+* RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
+* on as the bare 'user@evil.com@good.com' leaves it to the consumer which '@' splits the
+* domain off. Getting that wrong is a misrouting vector, so the quotes go back on. The
+* same holds for the other specials: a ',' or a ';' that loses its quotes reads as a
+* recipient separator once the consumer puts the address back into a header.
+*
+* @param address Address with an unquoted local part
+* @return Address with the local part as a quoted-string
+*/
+function quoteLocalPart(address) {
+	const lastAt = address.lastIndexOf("@");
+	if (lastAt < 0) return address;
+	const user = address.substring(0, lastAt);
+	if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) return address;
+	return "\"" + user.replace(/["\\]/g, "\\$&") + "\"@" + address.substring(lastAt + 1);
+}
+/**
+* The characters JS `\s` matches, which the scan below has to agree with to land on the
+* same match LOOSE_TEXT_ADDR would.
+*/
+function isSpaceCode(code) {
+	return code === 32 || code >= 9 && code <= 13 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279;
+}
+/**
+* The characters JS `\w` matches without the unicode flag, the set the `\b` in
+* LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,
+* which compares false throughout, so out of range reads as a non-word character.
+*/
+function isWordCode(code) {
+	return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95;
+}
+/**
+* Whether `\b` holds at an offset
+*/
+function isBoundary(text, at) {
+	return isWordCode(text.charCodeAt(at - 1)) !== isWordCode(text.charCodeAt(at));
+}
+/**
+* Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.
+* Bounded rather than indexOf, which would scan on to the end of the header once for every
+* whitespace delimited run and make the walk below quadratic.
+*/
+function indexOfAt(text, from, to) {
+	for (let i = from; i < to; i++) if (text.charCodeAt(i) === 64) return i;
+	return -1;
+}
+/**
+* Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
 *
-* Scanning whitespace delimited tokens instead is linear and keeps the word boundary
-* semantics of the regex: the local part has to open on a word character and the domain
-* has to end on one.
+* Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
+* offset and rescans the run to the next '@' each time, so a single header well inside
+* the default size limit could hold a core busy for minutes. The search is also
+* unnecessary. '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin
+* at the head of a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b'
+* gives characters back until it lands on a boundary, so the only end it can take in that
+* run is the last boundary in it. Both are found in one pass, and the pattern is then run
+* at that single offset.
 *
-* @param {String} text Text to search
-* @return {Object|null} `{index, length, value}` of the address, or null if there is none
+* @param text Free text to look in
+* @return Offset to match at, or -1
 */
-function findAddressInText(text) {
-	NON_SPACE_TOKEN_REGEX.lastIndex = 0;
-	let match;
-	while (match = NON_SPACE_TOKEN_REGEX.exec(text)) {
-		const token = match[0];
-		const at = token.indexOf("@");
-		let start = 0;
-		while (start < at && !WORD_CHAR_REGEX.test(token.charAt(start))) start++;
-		if (start >= at) continue;
-		let end = token.length;
-		while (end > at + 1 && !WORD_CHAR_REGEX.test(token.charAt(end - 1))) end--;
-		if (end <= at + 1) continue;
-		return {
-			index: match.index + start,
-			length: end - start,
-			value: token.substring(start, end)
+function looseAddressStart(text) {
+	const len = text.length;
+	let pos = 0;
+	while (pos < len) {
+		while (pos < len && isSpaceCode(text.charCodeAt(pos))) pos++;
+		if (pos >= len) break;
+		const runStart = pos;
+		let runEnd = pos;
+		while (runEnd < len && !isSpaceCode(text.charCodeAt(runEnd))) runEnd++;
+		let at = indexOfAt(text, runStart, runEnd);
+		if (at >= 0) {
+			let lastBoundary = -1;
+			for (let k = runEnd; k > runStart; k--) if (isBoundary(text, k)) {
+				lastBoundary = k;
+				break;
+			}
+			let atomStart = runStart;
+			while (lastBoundary >= 0 && at >= 0) {
+				if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
+					for (let start = atomStart; start < at; start++) if (isBoundary(text, start)) {
+						if (start > runStart) return start;
+						let padded = runStart;
+						while (padded > 0 && isSpaceCode(text.charCodeAt(padded - 1))) padded--;
+						return padded;
+					}
+				}
+				atomStart = at + 1;
+				at = indexOfAt(text, atomStart, runEnd);
+			}
+		}
+		pos = runEnd;
+	}
+	return -1;
+}
+/**
+* Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
+*
+* A malformed header can put more than a mailbox between the angle brackets, most often
+* because the generator wrote the recipient twice: '<user@example.com user@example.com>'
+* or '<example.com user@example.com>'. Whitespace is not addr-spec, so the whole run can
+* never be a mailbox, and passing it on as the address loses the recipient that is
+* sitting right there in the header.
+*
+* The run that still reads as an addr-spec is kept and whatever is left over becomes
+* display text. Candidates are read strictly first and then under the looser grammar,
+* the same two tiers the unquoted text fallback applies, so that '<a@b@c.com junk>' and a
+* bare 'a@b@c.com junk' agree on the recipient.
+*
+* A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
+* '<"user name"@example.com>' is well formed and means exactly what it says.
+*
+* @param address Collected address
+* @param text Collected display text
+* @return The address and the display text, with any leftovers moved to the text
+*/
+function recoverAddrSpec(address, text) {
+	if (!HAS_WHITESPACE.test(address)) return {
+		address,
+		text
+	};
+	let rest;
+	const quoted = address.match(QUOTED_LOCAL_ADDR);
+	if (quoted) {
+		if (!quoted[2]) return {
+			address,
+			text
+		};
+		address = quoted[1];
+		rest = [quoted[2]];
+	} else {
+		if (address.indexOf("\"") >= 0) return {
+			address,
+			text
+		};
+		const parts = address.split(/\s+/);
+		let addrIndex = parts.findIndex((part) => ADDR_SPEC.test(part));
+		if (addrIndex < 0) addrIndex = parts.findIndex((part) => LOOSE_ADDR_SPEC.test(part));
+		if (addrIndex < 0) return {
+			address,
+			text
 		};
+		address = parts.splice(addrIndex, 1)[0];
+		rest = parts;
 	}
-	return null;
+	return {
+		address,
+		text: [text, ...rest].filter((part) => part).join(" ")
+	};
+}
+/**
+* Takes the RFC 5322 comments out of the contents of an angle-addr.
+*
+* The tokenizer tracks a single open operator, so once '<' is open a '(' is plain text and
+* a comment inside the brackets reached the address verbatim: 'Name <user@example.com(x)evil.com>'
+* put 'user@example.com(x)evil.com' into the address, a value that is no mailbox and that a
+* consumer stripping the comment reads as 'user@example.comevil.com'. A comment is folding
+* whitespace, so it is read as a space that splits two atoms and as nothing next to an '@',
+* the same rule the token walk applies outside the brackets. Quoted strings and domain
+* literals are copied through untouched, a '(' in there is not a comment.
+*
+* @param address Contents of the angle brackets
+* @return The address with the comments removed, and the text of the comments
+*/
+function stripAddressComments(address) {
+	const comments = [];
+	let result = "";
+	let comment = "";
+	let depth = 0;
+	let closer = "";
+	let lastChar = "";
+	for (let i = 0, len = address.length; i < len; i++) {
+		const chr = address.charAt(i);
+		if (depth) {
+			if (chr === "\\" && i < len - 1) comment += address.charAt(++i);
+			else if (chr === "(") {
+				depth++;
+				comment += chr;
+			} else if (chr === ")" && !--depth) {
+				comments.push(comment.trim());
+				comment = "";
+				if (lastChar !== "@" && address.charAt(i + 1) !== "@") {
+					result += " ";
+					lastChar = " ";
+				}
+			} else comment += chr;
+			continue;
+		}
+		if (closer) {
+			if (chr === "\\" && closer === "\"" && i < len - 1) {
+				result += chr + address.charAt(++i);
+				lastChar = address.charAt(i);
+				continue;
+			}
+			if (chr === closer) closer = "";
+		} else if (chr === "\"") closer = "\"";
+		else if (chr === "[") closer = "]";
+		else if (chr === "(") {
+			depth = 1;
+			continue;
+		}
+		result += chr;
+		lastChar = chr;
+	}
+	if (depth) comments.push(comment.trim());
+	return {
+		address: result.trim(),
+		comments: comments.filter((text) => text)
+	};
+}
+/**
+* Checks whether text holds an angle bracket address, ie. `<` and `>` around a run
+* without other angle brackets that has an '@' with at least one character on each side.
+*
+* Same answer as `/<[^<>]+@[^<>]+>/.test(text)`, which backtracks quadratically on a `<`
+* followed by a long run of '@' and no closing `>`.
+*
+* @param text Text to check
+* @return true if an angle bracket address is present
+*/
+function hasAngleAddress(text) {
+	let start = -1;
+	let at = -1;
+	for (let i = 0; i < text.length; i++) {
+		const chr = text.charAt(i);
+		if (chr === "<") {
+			start = i + 1;
+			at = -1;
+		} else if (chr === ">") {
+			if (at >= 0 && at < i - 1) return true;
+			start = -1;
+			at = -1;
+		} else if (chr === "@" && start >= 0 && at < 0 && i > start) at = i;
+	}
+	return false;
 }
 /**
 * Converts tokens for a single address into an address object
 *
-* @param {Array} tokens Tokens object
-* @param {Number} depth Current recursion depth for nested group protection
-* @return {Object} Address object
+* @param tokens Tokens object
+* @param depth Current recursion depth for nested group protection
+* @return Address objects
 */
 function _handleAddress(tokens, depth) {
 	let isGroup = false;
 	let state = "text";
-	let address;
 	let addresses = [];
 	let data = {
 		address: [],
@@ -14624,6 +15548,12 @@ function _handleAddress(tokens, depth) {
 	let i;
 	let len;
 	let insideQuotes = false;
+	const lastChars = {
+		address: "",
+		comment: "",
+		group: "",
+		text: ""
+	};
 	for (i = 0, len = tokens.length; i < len; i++) {
 		let token = tokens[i];
 		let prevToken = i ? tokens[i - 1] : null;
@@ -14650,14 +15580,17 @@ function _handleAddress(tokens, depth) {
 				insideQuotes = false;
 		}
 		else if (token.value) {
+			const prevPrevToken = i > 1 ? tokens[i - 2] : null;
+			const opensAfterEmptyQuotedString = prevToken?.type === "operator" && prevToken.value === "\"" && !!prevToken.noBreak && prevPrevToken?.type === "operator" && prevPrevToken.value === "\"";
 			if (state === "address") token.value = token.value.replace(/^[^<]*<\s*/, "");
-			if (prevToken && prevToken.noBreak && data[state].length) {
+			if (prevToken && prevToken.noBreak && data[state].length && (prevToken.value !== ")" || lastChars[state] === "@" || token.value.charAt(0) === "@")) {
 				data[state][data[state].length - 1] += token.value;
 				if (state === "text" && insideQuotes) data.textWasQuoted[data.textWasQuoted.length - 1] = true;
 			} else {
 				data[state].push(token.value);
-				if (state === "text") data.textWasQuoted.push(insideQuotes);
+				if (state === "text") data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
 			}
+			lastChars[state] = token.value.charAt(token.value.length - 1);
 		}
 	}
 	if (!data.text.length && data.comment.length) {
@@ -14665,32 +15598,49 @@ function _handleAddress(tokens, depth) {
 		data.comment = [];
 	}
 	if (isGroup) {
-		data.text = data.text.join(" ");
+		const text = data.text.join(" ");
 		let groupMembers = [];
-		if (data.group.length) addressParser(data.group.join(","), { _depth: depth + 1 }).forEach((member) => {
-			if (member.group) groupMembers = groupMembers.concat(member.group);
+		if (data.group.length) parseAddressList$1(data.group.join(","), depth + 1).forEach((member) => {
+			if (member.group) for (const nestedMember of member.group) groupMembers.push(nestedMember);
 			else groupMembers.push(member);
 		});
 		addresses.push({
-			name: decodeWords(data.text || address && address.name),
+			name: decodeWords(text),
 			group: groupMembers
 		});
 	} else {
+		const addressComments = [];
+		const addressParts = [];
+		for (const part of data.address) {
+			if (part.indexOf("(") < 0) {
+				addressParts.push(part);
+				continue;
+			}
+			const stripped = stripAddressComments(part);
+			for (const comment of stripped.comments) addressComments.push(comment);
+			if (stripped.address) addressParts.push(stripped.address);
+		}
+		data.address = addressParts;
 		if (!data.address.length && data.text.length) {
-			for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i] && data.text[i].match(/^[^@\s]+@[^@\s]+$/)) {
+			for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
 				data.address = data.text.splice(i, 1);
 				data.textWasQuoted.splice(i, 1);
 				break;
 			}
 			if (!data.address.length) {
 				for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i]) {
-					const found = findAddressInText(data.text[i]);
-					if (found) {
-						data.address = [found.value];
-						data.text[i] = (data.text[i].substring(0, found.index).replace(/\s+$/, "") + " " + data.text[i].substring(found.index + found.length).replace(/^\s+/, "")).trim();
-						break;
+					const part = data.text[i];
+					const start = looseAddressStart(part);
+					if (start >= 0) {
+						LOOSE_TEXT_ADDR.lastIndex = start;
+						const match = LOOSE_TEXT_ADDR.exec(part);
+						if (match) {
+							data.address = [match[0].trim()];
+							data.text[i] = (part.slice(0, start) + " " + part.slice(start + match[0].length)).trim();
+							break;
+						}
 					}
-					data.text[i] = data.text[i].trim();
+					data.text[i] = part.trim();
 				}
 			}
 		}
@@ -14699,25 +15649,33 @@ function _handleAddress(tokens, depth) {
 			data.comment = [];
 		}
 		if (data.address.length > 1) data.text = data.text.concat(data.address.splice(1));
-		data.text = data.text.join(" ");
-		data.address = data.address.join(" ");
-		if (!data.address && isEncodedWordsOnly(data.text.trim())) {
-			const decodedText = decodeWords(data.text);
-			if (/<[^<>]+@[^<>]+>/.test(decodedText)) {
-				const parsedSubAddresses = addressParser(decodedText);
-				if (parsedSubAddresses && parsedSubAddresses.length) return parsedSubAddresses;
+		const addressFromQuotedText = !data.address.length && data.textWasQuoted.some((wasQuoted) => wasQuoted);
+		let text = data.text.join(" ");
+		let addressValue = data.address.join(" ");
+		if (!addressValue && isEncodedWordsOnly(text.trim())) {
+			const decodedText = decodeWords(text);
+			if (!addressFromQuotedText && hasAngleAddress(decodedText)) {
+				const parsedSubAddresses = parseAddressList$1(decodedText, depth + 1);
+				if (parsedSubAddresses.length) return parsedSubAddresses;
 			}
 			return [{
 				address: "",
 				name: decodedText
 			}];
 		}
-		address = {
-			address: data.address || data.text || "",
-			name: decodeWords(data.text || data.address || "")
+		if (addressFromQuotedText && text.indexOf("@") >= 0) {
+			addressValue = quoteLocalPart(text);
+			text = "";
+		}
+		({address: addressValue, text} = recoverAddrSpec(addressValue, text));
+		if (!text && addressComments.length) text = addressComments.join(" ");
+		const rawName = text || addressValue || "";
+		const address = {
+			address: addressValue || text || "",
+			name: decodeWords(rawName)
 		};
-		if (address.address === address.name) {
-			if ((address.address || "").match(/@/)) address.name = "";
+		if (address.address === rawName || address.address === address.name) {
+			if (address.address.match(/@/)) address.name = "";
 			else address.address = "";
 		}
 		addresses.push(address);
@@ -14725,22 +15683,21 @@ function _handleAddress(tokens, depth) {
 	return addresses;
 }
 /**
-* Creates a Tokenizer object for tokenizing address field strings
-*
-* @constructor
-* @param {String} str Address field string
+* Tokenizer for address field strings
 */
 var Tokenizer$2 = class {
+	/**
+	* @param str Address field string
+	*/
 	constructor(str) {
 		this.str = (str || "").toString();
 		this.operatorCurrent = "";
 		this.operatorExpecting = "";
 		this.node = null;
 		this.escaped = false;
+		this.inDomainLiteral = false;
+		this.afterAt = false;
 		this.list = [];
-		/**
-		* Operator tokens and which tokens are expected to end the sequence
-		*/
 		this.operators = {
 			"\"": "\"",
 			"(": ")",
@@ -14753,7 +15710,7 @@ var Tokenizer$2 = class {
 	/**
 	* Tokenizes the original input string
 	*
-	* @return {Array} An array of operator|text tokens
+	* @return An array of operator|text tokens
 	*/
 	tokenize() {
 		let list = [];
@@ -14771,9 +15728,14 @@ var Tokenizer$2 = class {
 	/**
 	* Checks if a character is an operator or text and acts accordingly
 	*
-	* @param {String} chr Character from the address field
+	* @param chr Character from the address field
+	* @param nextChr The character that follows, or null at the end of the field
 	*/
 	checkChar(chr, nextChr) {
+		if (!this.escaped && !this.operatorExpecting) {
+			if (!this.inDomainLiteral && chr === "[" && this.afterAt) this.inDomainLiteral = true;
+			else if (this.inDomainLiteral && (chr === "]" || chr === "," || chr === ";")) this.inDomainLiteral = false;
+		}
 		if (this.escaped) {} else if (chr === this.operatorExpecting) {
 			this.node = {
 				type: "operator",
@@ -14789,20 +15751,22 @@ var Tokenizer$2 = class {
 			].includes(nextChr)) this.node.noBreak = true;
 			this.list.push(this.node);
 			this.node = null;
+			if (chr !== ")") this.afterAt = false;
 			this.operatorExpecting = "";
 			this.escaped = false;
 			return;
-		} else if (!this.operatorExpecting && chr in this.operators) {
+		} else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ":") && chr in this.operators) {
 			this.node = {
 				type: "operator",
 				value: chr
 			};
 			this.list.push(this.node);
 			this.node = null;
+			if (chr !== "(") this.afterAt = false;
 			this.operatorExpecting = this.operators[chr];
 			this.escaped = false;
 			return;
-		} else if (this.operatorExpecting === "\"" && chr === "\\") {
+		} else if ((this.operatorExpecting === "\"" || this.operatorExpecting === ")") && chr === "\\") {
 			this.escaped = true;
 			return;
 		}
@@ -14814,7 +15778,10 @@ var Tokenizer$2 = class {
 			this.list.push(this.node);
 		}
 		if (chr === "\n") chr = " ";
-		if (chr.charCodeAt(0) >= 33 || [" ", "	"].includes(chr)) this.node.value += chr;
+		if (chr.charCodeAt(0) >= 33 || [" ", "	"].includes(chr)) {
+			this.node.value += chr;
+			if (!this.operatorExpecting && chr !== " " && chr !== "	") this.afterAt = chr === "@";
+		}
 		this.escaped = false;
 	}
 };
@@ -14825,29 +15792,20 @@ var Tokenizer$2 = class {
 */
 const MAX_NESTED_GROUP_DEPTH = 50;
 /**
-* Parses structured e-mail addresses from an address field
-*
-* Example:
-*
-*    'Name <address@domain>'
+* Parses an address list, recursing into groups. The depth is threaded through the
+* calls rather than taken from an option, so a caller supplied options object can not
+* seed it and lift the recursion limit.
 *
-* will be converted to
-*
-*     [{name: 'Name', address: 'address@domain'}]
-*
-* @param {String} str Address field
-* @param {Object} options Optional options object
-* @param {Number} options._depth Internal recursion depth counter (do not set manually)
-* @return {Array} An array of address objects
+* @param str Address field
+* @param depth Current recursion depth for nested group protection
+* @return An array of address objects
 */
-function addressParser(str, options) {
-	options = options || {};
-	let depth = options._depth || 0;
+function parseAddressList$1(str, depth) {
 	if (depth > MAX_NESTED_GROUP_DEPTH) return [];
 	let tokens = new Tokenizer$2(str).tokenize();
 	let addresses = [];
 	let address = [];
-	let parsedAddresses = [];
+	const parsedAddresses = [];
 	tokens.forEach((token) => {
 		if (token.type === "operator" && (token.value === "," || token.value === ";")) {
 			if (address.length) addresses.push(address);
@@ -14855,11 +15813,34 @@ function addressParser(str, options) {
 		} else address.push(token);
 	});
 	if (address.length) addresses.push(address);
-	addresses.forEach((address) => {
-		address = _handleAddress(address, depth);
-		if (address.length) parsedAddresses = parsedAddresses.concat(address);
-	});
-	if (options.flatten) {
+	for (const tokens of addresses) for (const address of _handleAddress(tokens, depth)) parsedAddresses.push(address);
+	const mergedAddresses = [];
+	for (let i = parsedAddresses.length - 1; i >= 0; i--) {
+		const current = parsedAddresses[i];
+		const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
+		if (next && current.address === "" && current.name && !current.group && next.address && next.name) next.name = current.name + ", " + next.name;
+		else mergedAddresses.push(current);
+	}
+	return mergedAddresses.reverse();
+}
+/**
+* Parses structured e-mail addresses from an address field
+*
+* Example:
+*
+*    'Name <address@domain>'
+*
+* will be converted to
+*
+*     [{name: 'Name', address: 'address@domain'}]
+*
+* @param str Address field
+* @param options Optional options object
+* @return An array of address objects
+*/
+function addressParser(str, options) {
+	const parsedAddresses = parseAddressList$1(str, 0);
+	if (options && options.flatten) {
 		let addresses = [];
 		let walkAddressList = (list) => {
 			list.forEach((address) => {
@@ -14872,6 +15853,7 @@ function addressParser(str, options) {
 	}
 	return parsedAddresses;
 }
+new Uint8Array([10]);
 //#endregion
 //#region ../../node_modules/.pnpm/domelementtype@3.0.0/node_modules/domelementtype/dist/index.js
 /** Types of elements found in htmlparser2's DOM */
@@ -25992,7 +26974,7 @@ function bad(message, hint) {
 /** A bare address, checked and canonicalised. Display names are only accepted on From. */
 function address(value, field) {
 	const trimmed = value.trim();
-	if (!ADDRESS.test(trimmed)) throw bad(`${field}: "${[...trimmed].slice(0, 80).join("")}" is not an email address`, "Give bare addresses.");
+	if (!ADDRESS.test(trimmed)) throw bad(`${field} contains a value that is not a bare email address`, "Give bare addresses.");
 	return canonicalAddress(trimmed);
 }
 function list(values, field) {
@@ -27778,11 +28760,37 @@ function outcomeUnavailable(why) {
 //#endregion
 //#region src/operations/send.ts
 /**
+* A caller may hand back the canonical expectation it kept, or the display-safe `expect` that prepare returned. The
+* latter is accepted only when it is byte-for-byte this approval's field rendering under the boundary it carries, the
+* way Gmail accepts its own; then the claim compares the raw binding. Anything else is passed on as given, so an
+* invented or edited envelope still mismatches and the send is refused.
+*/
+function canonicalSuppliedExpectation(supplied, bound, account, id) {
+	const boundary = /^<untrusted-content boundary="([A-Za-z0-9_-]+)" field="subject"/.exec(supplied.subject)?.[1];
+	if (boundary === void 0) return supplied;
+	const displayed = expectationFields(bound, {
+		boundary,
+		account,
+		id
+	});
+	const same = (left, right) => left.length === right.length && left.every((value, index) => value === right[index]);
+	return displayed.subject === supplied.subject && same(displayed.to, supplied.to) && same(displayed.cc, supplied.cc) && same(displayed.bcc, supplied.bcc) ? bound : supplied;
+}
+/**
 * A used approval, as Resend's own surfaces refuse it (design 2026-10-05 §D2, the used-send row): Resend accepted the
 * email — which is not that it went, since one may be scheduled, bounce or be cancelled — and never "sent". The words
 * `resend_send_wait` shows for it too, core's for every provider.
 */
 const ACCEPTED_BY_RESEND = (usedAt) => `accepted by Resend at ${usedAt}`;
+/** A send's recipients and subject as Resend may return them: display-safe, never the raw approval binding. */
+function expectationFields(expect, envelope) {
+	return {
+		to: expect.to.map((address) => addressField(address, "to", envelope)),
+		cc: expect.cc.map((address) => addressField(address, "cc", envelope)),
+		bcc: expect.bcc.map((address) => addressField(address, "bcc", envelope)),
+		subject: wrapField(expect.subject, "subject", envelope)
+	};
+}
 /**
 * A send's approval as the one account that may use it, classified under its lock as the claim would classify it
 * (design 2026-10-05 §D2), or a refusal that does not touch it.
@@ -28043,9 +29051,13 @@ async function prepareSend(context, name, input) {
 		effectivePolicy: effective,
 		riskFlags: study.flags,
 		reach,
-		expect: record.expect,
+		expect: expectationFields(record.expect, {
+			boundary: newBoundary(),
+			account: name,
+			id: record.approvalId
+		}),
 		expiresAt: record.expiresAt,
-		nextStep: effective === "confirm" ? `${approveAndWaitSentence(context.handoffs, context.surface, record.approvalId, (command, wait) => `Show the preview to the user, then have them run ${command} in their own terminal${wait === void 0 ? "" : `; learn when they have with ${wait}`}.`, { instead: "Show the preview to the user; they approve it at their own terminal." })} You cannot approve this yourself. Then execute it with the same approval id and the recipients and subject shown.` : "Show the preview to the user verbatim and wait for an explicit yes. Then execute it with the same approval id and the recipients and subject shown above.",
+		nextStep: effective === "confirm" ? `${approveAndWaitSentence(context.handoffs, context.surface, record.approvalId, (command, wait) => `Show the preview to the user, then have them run ${command} in their own terminal${wait === void 0 ? "" : `; learn when they have with ${wait}`}.`, { instead: "Show the preview to the user; they approve it at their own terminal." })} You cannot approve this yourself. Then execute it with the same approval id.` : "Show the preview to the user verbatim and wait for an explicit yes. Then execute it with the same approval id.",
 		approval: await context.core.approvals.approvalOf(record),
 		...legacyDrain === void 0 ? {} : { legacyDrain }
 	};
@@ -28236,7 +29248,7 @@ async function claimAndSend(context, named, name, options, known, _seen, legacyD
 		contentDigest: digest,
 		inboxId: named.account.id,
 		inboxSub: named.account.userId,
-		expect: options.expect
+		expect: options.expect === void 0 ? known.expect : canonicalSuppliedExpectation(options.expect, known.expect, name, known.approvalId)
 	}, {
 		pendingHint: `${approveAndWaitSentence(context.handoffs, context.surface, options.approvalId, (command, wait) => `Ask the user to run ${command} in their own terminal${wait === void 0 ? "," : `; learn when they have with ${wait},`} then execute it again with the same approval.`, { instead: "Ask the user to approve it at their own terminal, then execute it again with the same approval." })} You cannot approve it yourself.`,
 		usedSaid: ACCEPTED_BY_RESEND,
@@ -28396,16 +29408,26 @@ async function claimAndSend(context, named, name, options, known, _seen, legacyD
 			state: message.scheduledAt ? "scheduled" : "sent",
 			scheduledAt: message.scheduledAt,
 			said: acceptedSaid(resendId !== void 0, message.scheduledAt),
-			to: claimed.expect.to,
-			cc: claimed.expect.cc,
-			bcc: claimed.expect.bcc,
-			subject: claimed.expect.subject,
+			...expectationFields(claimed.expect, {
+				boundary: newBoundary(),
+				account: name,
+				id: options.approvalId
+			}),
 			...unrecorded.length > 0 ? { note: unrecorded.join("; ") } : {},
 			approval: approval ?? await approvalNow(context, options.approvalId, named.account.id, claimedApproval),
 			...legacyDrain === void 0 ? {} : { legacyDrain }
 		};
 	});
 }
+/** A stored send as a result may show it: canonical recipients stay addresses; its subject is always prose. */
+function sendSummaryFields(summary, envelope) {
+	if (summary === null) return null;
+	return {
+		...summary,
+		recipients: summary.recipients.map((address) => addressField(address, "recipient", envelope)),
+		...summary.subject === void 0 ? {} : { subject: wrapField(summary.subject, "subject", envelope) }
+	};
+}
 const CANNOT_READ = "this key can only send, so it cannot read what Resend did with the email";
 /**
 * What this machine knows Resend accepted, from its own send record: a scheduled send is accepted for the time the
@@ -28439,11 +29461,16 @@ async function sendStatus(context, name, approvalId) {
 		throw error;
 	});
 	const stored = seen?.stored ?? null;
+	const envelope = {
+		boundary: newBoundary(),
+		account: name,
+		id: approvalId
+	};
 	const base = {
 		account: name,
 		approvalId,
-		approval: seen ? publicApproval(seen.stored, seen.outcome) : null,
-		local
+		approval: seen ? publicApproval(seen.stored, seen.outcome, { wrap: (text, field) => field === "subject" || field === "filename" ? wrapField(text, field, envelope) : addressField(text, field, envelope) }) : null,
+		local: sendSummaryFields(local, envelope)
 	};
 	if (!local) return {
 		...base,